@mean-weasel/lineage 0.1.12 → 0.1.14

package/dist/cli/lineage.js

@@ -1,19 +1,20 @@
 #!/usr/bin/env node
 
 // src/cli/lineageCli.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { homedir as homedir2, platform as platform2 } from "node:os";
-import { dirname as dirname5, join as join10, resolve as resolve8 } from "node:path";
+import { dirname as dirname6, join as join10, resolve as resolve8 } from "node:path";
 import { spawn } from "node:child_process";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/server/agentClaims.ts
-import { createHash as createHash3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash4, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
 // src/server/assetLineageDb.ts
 import { createRequire as createRequire2 } from "node:module";
 import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join6, resolve as resolve5 } from "node:path";
+import { join as join6 } from "node:path";
 
 // src/server/assetCore.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "node:fs";
@@ -587,15 +588,35 @@ function validateProject(project = defaultProject) {
   return { project: catalog.project, product: catalog.product, catalogPath: resolvedCatalogPath(project), default_bucket: catalog.default_bucket, default_region: catalog.default_region, asset_count: catalog.assets.length };
 }
 
+// src/server/profileWriterLease.ts
+import { createHash as createHash3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+
 // src/server/lineageProfiles.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync as statSync3 } from "node:fs";
+import {
+  chmodSync,
+  constants as fsConstants,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync4,
+  linkSync,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync,
+  rmSync,
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
+} from "node:fs";
 import { homedir, platform } from "node:os";
-import { dirname as dirname3, isAbsolute, join as join4, resolve as resolve3 } from "node:path";
+import { dirname as dirname3, isAbsolute, join as join4, relative as relative2, resolve as resolve3 } from "node:path";
 
 // src/shared/lineageProfileTypes.ts
 var lineageProfileSchemaVersion = "lineage.profile.v1";
 var lineageProfileDoctorSchemaVersion = "lineage.profile_doctor.v1";
+var lineageProfileCloneReceiptSchemaVersion = "lineage.profile_clone_receipt.v1";
+var lineageProfileAssetsCloneReceiptSchemaVersion = "lineage.profile_assets_clone_receipt.v1";
 
 // src/server/lineageProfiles.ts
 var require2 = createRequire(import.meta.url);
@@ -647,6 +668,16 @@ function validateChannel(value) {
   if (value === "stable" || value === "preview" || value === "dev") return value;
   throw new Error(`Invalid expected runtime channel: ${String(value)}`);
 }
+function validateCodeOrigin(value) {
+  if (value === void 0) return void 0;
+  if (value === "checkout" || value === "package") return value;
+  throw new Error(`Invalid expected runtime code_origin: ${String(value)}`);
+}
+function validateFingerprint(value, field) {
+  if (value === void 0) return void 0;
+  if (!/^[a-f0-9]{64}$/i.test(value)) throw new Error(`Profile ${field} must be a 64-character SHA-256 fingerprint`);
+  return value.toLowerCase();
+}
 function resolveManifestPath(manifestPath, value) {
   return resolve3(dirname3(manifestPath), value);
 }
@@ -662,9 +693,6 @@ function validateServiceOrigin(value) {
   if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
     throw new Error("Profile service_origin must contain only scheme, host, and port");
   }
-  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  const isLocal = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
-  if (!isLocal) throw new Error("Profile service_origin must use a loopback or localhost host");
   return parsed.origin;
 }
 function resolveLineageProfile(selector) {
@@ -692,6 +720,8 @@ function resolveLineageProfile(selector) {
   const expected = expectedRaw;
   const expectedGitSha = expected ? optionalString(expected, "git_sha") : void 0;
   const expectedVersion = expected ? optionalString(expected, "version") : void 0;
+  const expectedCodeFingerprint = validateFingerprint(expected ? optionalString(expected, "code_fingerprint") : void 0, "expected_runtime.code_fingerprint");
+  const expectedCodeOrigin = validateCodeOrigin(expected?.code_origin);
   const migrationsRaw = record.required_schema_migrations;
   if (migrationsRaw !== void 0 && (!Array.isArray(migrationsRaw) || migrationsRaw.some((value) => typeof value !== "string" || !value.trim()))) {
     throw new Error("Profile required_schema_migrations must be an array of non-empty strings");
@@ -708,6 +738,8 @@ function resolveLineageProfile(selector) {
     ...expected ? {
       expected_runtime: {
         ...expectedChannel ? { channel: expectedChannel } : {},
+        ...expectedCodeFingerprint ? { code_fingerprint: expectedCodeFingerprint } : {},
+        ...expectedCodeOrigin ? { code_origin: expectedCodeOrigin } : {},
         ...expectedGitSha ? { git_sha: expectedGitSha } : {},
         ...expectedVersion ? { version: expectedVersion } : {}
       }
@@ -717,48 +749,30 @@ function resolveLineageProfile(selector) {
     schema_version: lineageProfileSchemaVersion,
     service_origin: validateServiceOrigin(requiredString(record, "service_origin"))
   };
-  return { ...manifest, manifest_path: manifestPath };
+  return { ...manifest, manifest_path: manifestPath, profile_fingerprint: lineageProfileFingerprint(manifest) };
 }
-function bindLineageProfileDatabase(profile, confirmWrite) {
-  const result = {
-    database_path: profile.database_path,
+function lineageProfileFingerprint(profile) {
+  return createHash2("sha256").update(JSON.stringify({
+    asset_root: resolve3(profile.asset_root),
+    database_path: resolve3(profile.database_path),
     environment: profile.environment,
-    ok: true,
     profile_id: profile.profile_id,
-    schema_version: "lineage.profile_bind.v1"
-  };
-  if (!confirmWrite) return { ...result, dryRun: true };
-  mkdirSync3(dirname3(profile.database_path), { recursive: true });
-  const { DatabaseSync } = require2("node:sqlite");
-  const database = new DatabaseSync(profile.database_path);
-  try {
-    database.exec("BEGIN IMMEDIATE");
-    try {
-      database.exec(`
-        create table if not exists lineage_profile_identity (
-          profile_id text primary key,
-          environment text not null,
-          bound_at text not null
-        )
-      `);
-      const rows = database.prepare("select profile_id, environment, bound_at from lineage_profile_identity").all();
-      if (rows.length > 0) {
-        if (rows.length !== 1 || rows[0].profile_id !== profile.profile_id || rows[0].environment !== profile.environment) {
-          throw new Error(`Database ${profile.database_path} is already bound to a different Lineage profile identity`);
-        }
-        database.exec("COMMIT");
-        return { ...result, already_bound: true, bound_at: rows[0].bound_at };
-      }
-      const boundAt = (/* @__PURE__ */ new Date()).toISOString();
-      database.prepare("insert into lineage_profile_identity (profile_id, environment, bound_at) values (?, ?, ?)").run(profile.profile_id, profile.environment, boundAt);
-      database.exec("COMMIT");
-      return { ...result, bound_at: boundAt };
-    } catch (error) {
-      database.exec("ROLLBACK");
-      throw error;
-    }
-  } finally {
-    database.close();
+    schema_version: profile.schema_version,
+    service_origin: profile.service_origin
+  })).digest("hex");
+}
+function assertProfileRuntimePin(profile, runtime) {
+  if (!profile.expected_runtime?.code_fingerprint || !profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} must pin expected_runtime.code_fingerprint and expected_runtime.code_origin before binding or writing`);
+  }
+  if (!runtime?.code?.verified) {
+    throw new Error(`Profile ${profile.profile_id} requires a verified runtime code identity before binding or writing`);
+  }
+  if (runtime.code.fingerprint !== profile.expected_runtime.code_fingerprint) {
+    throw new Error(`Profile ${profile.profile_id} expects code fingerprint ${profile.expected_runtime.code_fingerprint}, found ${runtime.code.fingerprint}`);
+  }
+  if (runtime.code.origin !== profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} expects code origin ${profile.expected_runtime.code_origin}, found ${runtime.code.origin}`);
   }
 }
 function assertProfileChannel(profile, channel) {
@@ -772,12 +786,9 @@ function assertProfileChannel(profile, channel) {
 function tableExists(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
 }
-function gitShasMatch(expected, actual) {
-  if (!actual) return false;
-  const normalizedExpected = expected.toLowerCase();
-  const normalizedActual = actual.toLowerCase();
-  const shorterLength = Math.min(normalizedExpected.length, normalizedActual.length);
-  return shorterLength >= 12 && normalizedExpected.slice(0, shorterLength) === normalizedActual.slice(0, shorterLength);
+function tableColumns(database, table) {
+  if (!tableExists(database, table)) return /* @__PURE__ */ new Set();
+  return new Set(database.prepare(`pragma table_info(${table})`).all().map((row) => row.name));
 }
 function inspectDatabase(profile) {
   const result = {
@@ -791,11 +802,14 @@ function inspectDatabase(profile) {
     const database = new DatabaseSync(profile.database_path, { readOnly: true });
     try {
       if (tableExists(database, "lineage_profile_identity")) {
-        const rows = database.prepare("select profile_id, environment, bound_at from lineage_profile_identity").all();
+        const columns = tableColumns(database, "lineage_profile_identity");
+        const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "'' as profile_fingerprint";
+        const rows = database.prepare(`select profile_id, environment, bound_at, ${fingerprintExpression} from lineage_profile_identity`).all();
         if (rows.length === 1) {
           const identity = {
             bound_at: typeof rows[0].bound_at === "string" ? rows[0].bound_at : void 0,
             environment: String(rows[0].environment),
+            profile_fingerprint: typeof rows[0].profile_fingerprint === "string" ? rows[0].profile_fingerprint : "",
             profile_id: String(rows[0].profile_id)
           };
           result.identity = identity;
@@ -819,7 +833,14 @@ function doctorLineageProfile(selector, runtime) {
   const result = {
     checks,
     ok: false,
-    runtime: { channel: runtime.channel, git_sha: runtime.gitSha, version: runtime.version },
+    runtime: {
+      channel: runtime.channel,
+      code_fingerprint: runtime.code?.fingerprint,
+      code_origin: runtime.code?.origin,
+      code_verified: runtime.code?.verified,
+      git_sha: runtime.gitSha,
+      version: runtime.version
+    },
     schema_version: lineageProfileDoctorSchemaVersion
   };
   let profile;
@@ -838,12 +859,18 @@ function doctorLineageProfile(selector, runtime) {
   } catch (error) {
     checks.push({ id: "runtime_channel", message: error instanceof Error ? error.message : String(error), status: "fail" });
   }
+  try {
+    assertProfileRuntimePin(profile, runtime);
+    checks.push({ id: "runtime_code", message: `Verified ${runtime.code.origin} code ${runtime.code.fingerprint}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_code", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
   if (profile.expected_runtime?.version && profile.expected_runtime.version !== runtime.version) {
     checks.push({ id: "runtime_version", message: `Expected version ${profile.expected_runtime.version}, found ${runtime.version}`, status: "fail" });
   } else {
     checks.push({ id: "runtime_version", message: `Runtime version ${runtime.version}`, status: "pass" });
   }
-  if (profile.expected_runtime?.git_sha && !gitShasMatch(profile.expected_runtime.git_sha, runtime.gitSha)) {
+  if (profile.expected_runtime?.git_sha && profile.expected_runtime.git_sha !== runtime.gitSha) {
     checks.push({ id: "runtime_git_sha", message: `Expected Git SHA ${profile.expected_runtime.git_sha}, found ${runtime.gitSha || "unavailable"}`, status: "fail" });
   } else if (profile.expected_runtime?.git_sha) {
     checks.push({ id: "runtime_git_sha", message: `Git SHA ${runtime.gitSha}`, status: "pass" });
@@ -866,10 +893,10 @@ function doctorLineageProfile(selector, runtime) {
   if (database.error) checks.push({ id: "database_read", message: database.error, status: "fail" });
   if (!database.identity) {
     checks.push({ id: "database_identity", message: "Database is not bound to a Lineage profile", status: "fail" });
-  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment) {
+  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment || database.identity.profile_fingerprint !== profile.profile_fingerprint) {
     checks.push({
       id: "database_identity",
-      message: `Database identity ${database.identity.profile_id}/${database.identity.environment} does not match ${profile.profile_id}/${profile.environment}`,
+      message: `Database identity ${database.identity.profile_id}/${database.identity.environment}/${database.identity.profile_fingerprint || "no-fingerprint"} does not match ${profile.profile_id}/${profile.environment}/${profile.profile_fingerprint}`,
       status: "fail"
     });
   } else {
@@ -892,6 +919,7 @@ function runtimeProfileIdentity(channel) {
     return {
       bound: true,
       environment,
+      fingerprint: process.env.LINEAGE_PROFILE_FINGERPRINT,
       id,
       manifest_path: process.env.LINEAGE_PROFILE_MANIFEST,
       service_origin: process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
@@ -901,31 +929,308 @@ function runtimeProfileIdentity(channel) {
     bound: false,
     environment: channelEnvironment(channel),
     id: "legacy-unbound",
-    warning: id || environment || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
+    warning: id || environment || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
   };
 }
 function assertUnselectedDatabaseIsUnbound(runtime) {
-  if (runtime.database.exists && runtime.database.error) {
-    throw new Error(
-      `Database ${runtime.database.path} identity could not be verified: ${runtime.database.error}; refusing unselected access`
-    );
-  }
-  if (runtime.schema.profile_identity_rows !== void 0 && runtime.schema.profile_identity_rows !== 1) {
-    throw new Error(
-      `Database ${runtime.database.path} has invalid Lineage profile identity row count ${runtime.schema.profile_identity_rows}; refusing unselected access`
-    );
-  }
   if (!runtime.schema.profile_id) return;
   const environment = runtime.schema.profile_environment || "unknown";
   throw new Error(
     `Database ${runtime.database.path} is bound to Lineage profile ${runtime.schema.profile_id}/${environment}; select that profile with --profile`
   );
 }
+function ensureProfileIdentityTable(database) {
+  if (!tableExists(database, "lineage_profile_identity")) {
+    database.exec(`
+      create table lineage_profile_identity (
+        profile_id text primary key,
+        environment text not null,
+        profile_fingerprint text not null,
+        bound_at text not null
+      )
+    `);
+    return;
+  }
+  const columns = tableColumns(database, "lineage_profile_identity");
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("bound_at")) {
+    throw new Error("Existing lineage_profile_identity table has an unsupported shape");
+  }
+  if (!columns.has("profile_fingerprint")) {
+    database.exec("alter table lineage_profile_identity add column profile_fingerprint text not null default ''");
+  }
+}
+function assertRequiredMigrations(database, profile) {
+  const required = profile.required_schema_migrations || [];
+  if (required.length === 0) return;
+  if (!tableExists(database, "lineage_schema_migrations")) {
+    throw new Error(`Database is missing required schema migrations: ${required.join(", ")}`);
+  }
+  const available = new Set(database.prepare("select key from lineage_schema_migrations").all().map((row) => row.key));
+  const missing = required.filter((key) => !available.has(key));
+  if (missing.length > 0) throw new Error(`Database is missing required schema migrations: ${missing.join(", ")}`);
+}
+function profileIdentity(profile) {
+  return {
+    bound_at: (/* @__PURE__ */ new Date()).toISOString(),
+    environment: profile.environment,
+    profile_fingerprint: profile.profile_fingerprint,
+    profile_id: profile.profile_id
+  };
+}
+function bindOpenDatabase(database, profile, replace) {
+  database.exec("begin immediate");
+  try {
+    ensureProfileIdentityTable(database);
+    assertRequiredMigrations(database, profile);
+    const rows = database.prepare("select profile_id, environment, profile_fingerprint, bound_at from lineage_profile_identity").all();
+    if (!replace && rows.length > 0) {
+      if (rows.length !== 1) throw new Error(`Expected at most one lineage_profile_identity row, found ${rows.length}`);
+      const existing = rows[0];
+      const sameBaseIdentity = existing.profile_id === profile.profile_id && existing.environment === profile.environment;
+      const migratableLegacyIdentity = sameBaseIdentity && !existing.profile_fingerprint;
+      if (!migratableLegacyIdentity && existing.profile_fingerprint !== profile.profile_fingerprint) {
+        throw new Error(`Database is already bound to ${existing.profile_id}/${existing.environment}/${existing.profile_fingerprint || "no-fingerprint"}`);
+      }
+      if (!migratableLegacyIdentity) {
+        database.exec("commit");
+        return existing;
+      }
+    }
+    const identity = profileIdentity(profile);
+    database.exec("delete from lineage_profile_identity");
+    database.prepare("insert into lineage_profile_identity (profile_id, environment, profile_fingerprint, bound_at) values (?, ?, ?, ?)").run(identity.profile_id, identity.environment, identity.profile_fingerprint, identity.bound_at);
+    const integrity = database.prepare("pragma integrity_check").get();
+    if (integrity?.integrity_check !== "ok") throw new Error(`SQLite integrity check failed: ${integrity?.integrity_check || "unknown result"}`);
+    database.exec("commit");
+    return identity;
+  } catch (error) {
+    try {
+      database.exec("rollback");
+    } catch {
+    }
+    throw error;
+  }
+}
+function bindLineageProfileDatabase(selector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile bind requires --confirm-write");
+  const profile = resolveLineageProfile(selector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (!existsSync4(profile.database_path)) throw new Error(`Profile database does not exist: ${profile.database_path}`);
+  const { DatabaseSync } = require2("node:sqlite");
+  const database = new DatabaseSync(profile.database_path);
+  try {
+    const before = inspectDatabase(profile).identity;
+    const identity = bindOpenDatabase(database, profile, false);
+    return {
+      already_bound: Boolean(before?.profile_fingerprint === profile.profile_fingerprint),
+      database_path: profile.database_path,
+      identity,
+      schema_version: "lineage.profile_bind.v1"
+    };
+  } finally {
+    database.close();
+  }
+}
+async function cloneLineageProfileDatabase(sourceDatabasePath, targetSelector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile clone requires --confirm-write");
+  const profile = resolveLineageProfile(targetSelector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (profile.environment === "production") throw new Error("Profile clone target must be preview or development, never production");
+  const sourcePath = resolve3(sourceDatabasePath);
+  const targetPath = resolve3(profile.database_path);
+  if (sourcePath === targetPath) throw new Error("Profile clone source and target database paths must be different");
+  if (!existsSync4(sourcePath)) throw new Error(`Profile clone source database does not exist: ${sourcePath}`);
+  if (existsSync4(targetPath)) throw new Error(`Profile clone target database already exists: ${targetPath}`);
+  mkdirSync3(dirname3(targetPath), { recursive: true });
+  const temporaryPath = `${targetPath}.clone-${randomUUID()}.tmp`;
+  const receiptDirectory = join4(dirname3(profile.manifest_path), "clone-receipts");
+  let targetCreated = false;
+  const { DatabaseSync, backup } = require2("node:sqlite");
+  const source = new DatabaseSync(sourcePath, { readOnly: true });
+  try {
+    const pagesCopied = await backup(source, temporaryPath);
+    const cloned = new DatabaseSync(temporaryPath);
+    let identity;
+    try {
+      identity = bindOpenDatabase(cloned, profile, true);
+    } finally {
+      cloned.close();
+    }
+    linkSync(temporaryPath, targetPath);
+    targetCreated = true;
+    rmSync(temporaryPath, { force: true });
+    mkdirSync3(receiptDirectory, { recursive: true, mode: 448 });
+    const receiptPath = join4(receiptDirectory, `${Date.now()}-${randomUUID()}.json`);
+    const result = {
+      database_path: targetPath,
+      pages_copied: pagesCopied,
+      receipt_path: receiptPath,
+      schema_version: lineageProfileCloneReceiptSchemaVersion,
+      source_database_path: sourcePath,
+      target_identity: identity
+    };
+    writeFileSync2(receiptPath, `${JSON.stringify({ ...result, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+    return result;
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    if (targetCreated) rmSync(targetPath, { force: true });
+    throw error;
+  } finally {
+    source.close();
+  }
+}
+function pathIsInside(path, parent) {
+  const child = relative2(parent, path);
+  return child !== "" && !child.startsWith("..") && !isAbsolute(child);
+}
+function fileSha2562(path) {
+  return createHash2("sha256").update(readFileSync3(path)).digest("hex");
+}
+function profileAssetReferences(database) {
+  const references = [];
+  const addColumn = (table, column, kind) => {
+    if (!tableColumns(database, table).has(column)) return;
+    const rows = database.prepare(`select ${column} value from ${table} where ${column} is not null and ${column} <> ''`).all();
+    for (const row of rows) references.push({ kind, value: row.value });
+  };
+  addColumn("assets", "local_path", "scratch");
+  addColumn("asset_attempts", "file_path", "scratch");
+  addColumn("generation_job_outputs", "file_path", "scratch");
+  addColumn("asset_ledger_sources", "local_path", "scratch");
+  addColumn("content_posts", "source_path", "root");
+  if (tableColumns(database, "projects").has("id")) {
+    const projects = database.prepare("select id from projects where id is not null and id <> ''").all();
+    for (const project of projects) {
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(project.id)) throw new Error("A project ID cannot be mapped safely into the source asset root");
+      references.push({ kind: "root", value: join4(project.id, "assets", "catalog.json") });
+    }
+  }
+  return references;
+}
+function resolveProfileAssetReference(sourceRoot, reference) {
+  if (reference.value.includes("\0")) throw new Error("A referenced asset path contains a null byte");
+  const sourceScratch = join4(sourceRoot, ".asset-scratch");
+  const base = reference.kind === "scratch" ? sourceScratch : sourceRoot;
+  const value = reference.kind === "scratch" && reference.value.startsWith(".asset-scratch/") ? reference.value.slice(".asset-scratch/".length) : reference.value;
+  const candidate = isAbsolute(value) ? resolve3(value) : resolve3(base, value);
+  if (!pathIsInside(candidate, base)) throw new Error("A referenced asset path escapes the declared source asset root");
+  return { path: candidate, relative_path: relative2(sourceRoot, candidate) };
+}
+function cloneLineageProfileAssets(sourceAssetRoot, targetSelector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile asset clone requires --confirm-write");
+  const profile = resolveLineageProfile(targetSelector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (!existsSync4(profile.database_path)) throw new Error(`Profile database does not exist: ${profile.database_path}`);
+  const sourceRoot = resolve3(sourceAssetRoot);
+  const targetRoot = resolve3(profile.asset_root);
+  if (!existsSync4(sourceRoot) || !statSync3(sourceRoot).isDirectory()) throw new Error(`Source asset root does not exist: ${sourceRoot}`);
+  if (sourceRoot === targetRoot || pathIsInside(targetRoot, sourceRoot) || pathIsInside(sourceRoot, targetRoot)) {
+    throw new Error("Source and target asset roots must be disjoint");
+  }
+  if (pathIsInside(profile.database_path, targetRoot)) throw new Error("Profile database must not be stored inside its asset root");
+  if (existsSync4(targetRoot)) throw new Error(`Profile asset clone target already exists: ${targetRoot}`);
+  const databaseIdentity = inspectDatabase(profile).identity;
+  if (databaseIdentity && (databaseIdentity.profile_id !== profile.profile_id || databaseIdentity.environment !== profile.environment || databaseIdentity.profile_fingerprint && databaseIdentity.profile_fingerprint !== profile.profile_fingerprint)) {
+    throw new Error(`Profile database is already bound to ${databaseIdentity.profile_id}/${databaseIdentity.environment}`);
+  }
+  const { DatabaseSync } = require2("node:sqlite");
+  const database = new DatabaseSync(profile.database_path, { readOnly: true });
+  let references;
+  try {
+    database.exec("begin");
+    references = profileAssetReferences(database);
+    database.exec("commit");
+  } catch (error) {
+    try {
+      database.exec("rollback");
+    } catch {
+    }
+    throw error;
+  } finally {
+    database.close();
+  }
+  const sourceRealRoot = realpathSync(sourceRoot);
+  const files = /* @__PURE__ */ new Map();
+  let missingReferences = 0;
+  let duplicateReferences = 0;
+  for (const reference of references) {
+    const resolved = resolveProfileAssetReference(sourceRoot, reference);
+    if (!existsSync4(resolved.path)) {
+      missingReferences += 1;
+      continue;
+    }
+    const stats = statSync3(resolved.path);
+    if (!stats.isFile()) {
+      missingReferences += 1;
+      continue;
+    }
+    const realSource = realpathSync(resolved.path);
+    if (!pathIsInside(realSource, sourceRealRoot)) throw new Error("A referenced asset symlink escapes the declared source asset root");
+    const existing = files.get(resolved.relative_path);
+    if (existing) {
+      if (realpathSync(existing) !== realSource) throw new Error("Two source assets map to the same target path");
+      duplicateReferences += 1;
+      continue;
+    }
+    files.set(resolved.relative_path, resolved.path);
+  }
+  mkdirSync3(dirname3(targetRoot), { recursive: true, mode: 448 });
+  mkdirSync3(targetRoot, { mode: 448 });
+  try {
+    let bytesCopied = 0;
+    const treeHash = createHash2("sha256");
+    for (const relativePath of [...files.keys()].sort()) {
+      const sourcePath = files.get(relativePath);
+      const destinationPath = join4(targetRoot, relativePath);
+      mkdirSync3(dirname3(destinationPath), { recursive: true, mode: 448 });
+      copyFileSync2(sourcePath, destinationPath, fsConstants.COPYFILE_EXCL);
+      chmodSync(destinationPath, 384);
+      const sourceHash = fileSha2562(sourcePath);
+      const destinationHash = fileSha2562(destinationPath);
+      if (sourceHash !== destinationHash) throw new Error("A source asset changed or failed checksum verification during clone");
+      bytesCopied += statSync3(destinationPath).size;
+      treeHash.update(relativePath.replaceAll("\\", "/"));
+      treeHash.update("\0");
+      treeHash.update(destinationHash);
+      treeHash.update("\0");
+    }
+    chmodSync(targetRoot, 448);
+    const receiptPath = join4(targetRoot, ".lineage-profile-assets.json");
+    const result = {
+      asset_root: targetRoot,
+      bytes_copied: bytesCopied,
+      code_fingerprint: runtime.code.fingerprint,
+      database_path: profile.database_path,
+      duplicate_references: duplicateReferences,
+      files_copied: files.size,
+      missing_references: missingReferences,
+      profile_fingerprint: profile.profile_fingerprint,
+      profile_id: profile.profile_id,
+      receipt_path: receiptPath,
+      references_discovered: references.length,
+      runtime_channel: runtime.channel,
+      schema_version: lineageProfileAssetsCloneReceiptSchemaVersion,
+      source_asset_root: sourceRoot,
+      tree_sha256: treeHash.digest("hex")
+    };
+    writeFileSync2(receiptPath, `${JSON.stringify({ ...result, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    return result;
+  } catch (error) {
+    rmSync(targetRoot, { force: true, recursive: true });
+    throw error;
+  }
+}
 
 // src/server/profileWriterLease.ts
-import { createHash as createHash2, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, realpathSync, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename as basename3, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
 var writerLeaseSchemaVersion = "lineage.profile_writer_lease.v1";
 var ownerFileName = "owner.json";
 var ProfileWriterLeaseConflictError = class extends Error {
@@ -936,24 +1241,8 @@ var ProfileWriterLeaseConflictError = class extends Error {
   }
   owner;
 };
-function canonicalDatabasePath(databasePath) {
-  const resolved = resolve4(databasePath);
-  const missingSegments = [];
-  let candidate = resolved;
-  while (!existsSync5(candidate)) {
-    const parent = dirname4(candidate);
-    if (parent === candidate) return resolved;
-    missingSegments.unshift(basename3(candidate));
-    candidate = parent;
-  }
-  try {
-    return join5(realpathSync(candidate), ...missingSegments);
-  } catch {
-    return resolved;
-  }
-}
 function profileWriterLockPath(profile) {
-  return `${canonicalDatabasePath(profile.database_path)}.writer.lock`;
+  return join5(dirname4(profile.manifest_path), "writer.lock");
 }
 function ownerPath(lockPath) {
   return join5(lockPath, ownerFileName);
@@ -976,7 +1265,7 @@ function readOwner(lockPath) {
     throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
   }
   const owner = raw;
-  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
+  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || typeof owner.profile_fingerprint !== "string" || !/^[a-f0-9]{64}$/i.test(owner.profile_fingerprint) || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
     throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
   }
   return owner;
@@ -993,10 +1282,10 @@ function processIsAlive(pid) {
 function createLeaseDirectory(lockPath, owner) {
   mkdirSync4(lockPath, { mode: 448 });
   try {
-    writeFileSync2(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
+    writeFileSync3(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
 `, { encoding: "utf8", flag: "wx", mode: 384 });
   } catch (error) {
-    rmSync(lockPath, { force: true, recursive: true });
+    rmSync2(lockPath, { force: true, recursive: true });
     throw error;
   }
 }
@@ -1008,14 +1297,15 @@ function reclaimDeadOwner(lockPath, owner) {
       publicOwner
     );
   }
-  const tokenFence = createHash2("sha256").update(owner.token).digest("hex").slice(0, 24);
+  const tokenFence = createHash3("sha256").update(owner.token).digest("hex").slice(0, 24);
   const tombstone = `${lockPath}.stale-${owner.pid}-${tokenFence}`;
   try {
     renameSync(lockPath, tombstone);
   } catch (error) {
-    if (errorCode(error) === "ENOENT" || errorCode(error) === "EEXIST" || errorCode(error) === "ENOTEMPTY") return;
+    if (errorCode(error) === "ENOENT") return;
     throw error;
   }
+  rmSync2(tombstone, { force: true, recursive: true });
 }
 function acquireProfileWriterLease(profile, channel, role = "service") {
   assertProfileChannel(profile, channel);
@@ -1024,11 +1314,12 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
     acquired_at: (/* @__PURE__ */ new Date()).toISOString(),
     environment: profile.environment,
     pid: process.pid,
+    profile_fingerprint: profile.profile_fingerprint,
     profile_id: profile.profile_id,
     role,
     schema_version: writerLeaseSchemaVersion,
     ...role === "service" ? { service_origin: profile.service_origin } : {},
-    token: randomUUID()
+    token: randomUUID2()
   };
   for (let attempt = 0; attempt < 4; attempt += 1) {
     try {
@@ -1051,7 +1342,7 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
           released = true;
           try {
             const current = readOwner(lockPath);
-            if (current.token === owner.token && current.pid === owner.pid) rmSync(lockPath, { force: true, recursive: true });
+            if (current.token === owner.token && current.pid === owner.pid) rmSync2(lockPath, { force: true, recursive: true });
           } catch {
           }
           if (process.env.LINEAGE_WRITER_LEASE_TOKEN === owner.token) delete process.env.LINEAGE_WRITER_LEASE_TOKEN;
@@ -1067,7 +1358,7 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
         if (errorCode(readError) === "ENOENT") continue;
         throw readError;
       }
-      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment) {
+      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment || existing.profile_fingerprint !== profile.profile_fingerprint) {
         throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; manual inspection is required`, { cause: error });
       }
       reclaimDeadOwner(lockPath, existing);
@@ -1076,23 +1367,47 @@ function acquireProfileWriterLease(profile, channel, role = "service") {
   throw new Error(`Could not acquire writer lease for Lineage profile ${profile.profile_id}; another writer is racing for ownership`);
 }
 function assertProfileWriterLeaseHeld() {
-  if (!process.env.LINEAGE_PROFILE) return;
+  if (!process.env.LINEAGE_PROFILE) {
+    throw new Error("Persistent writes require a selected named Lineage profile and its writer lease; legacy-unbound access is read-only");
+  }
   const profileId = process.env.LINEAGE_PROFILE_ID;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
   const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
   const manifestPath = process.env.LINEAGE_PROFILE_MANIFEST;
-  const databasePath = process.env.LINEAGE_DB;
   const lockPath = process.env.LINEAGE_WRITER_LOCK_PATH;
   const token = process.env.LINEAGE_WRITER_LEASE_TOKEN;
-  if (!profileId || !environment || !manifestPath || !databasePath || !lockPath || !token) {
+  if (!profileId || !profileFingerprint || !environment || !manifestPath || !lockPath || !token) {
     throw new Error("Named Lineage profiles may write only through a process holding the profile writer lease");
   }
-  const expectedLockPath = `${canonicalDatabasePath(databasePath)}.writer.lock`;
-  if (resolve4(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile database");
+  const expectedLockPath = join5(dirname4(resolve4(manifestPath)), "writer.lock");
+  if (resolve4(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile manifest");
   const owner = readOwner(lockPath);
-  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.environment !== environment) {
+  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.profile_fingerprint !== profileFingerprint || owner.environment !== environment) {
     throw new Error("Current process does not own the selected Lineage profile writer lease");
   }
 }
+function assertSelectedProfileDatabaseIdentity(database) {
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  if (!process.env.LINEAGE_PROFILE || !profileId || !environment || !profileFingerprint) {
+    throw new Error("Writable SQLite identity validation requires a fully resolved named Lineage profile");
+  }
+  const table = database.prepare("select name from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
+  if (!table) throw new Error(`Refusing writable open: database is not bound to Lineage profile ${profileId}`);
+  const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("profile_fingerprint")) {
+    throw new Error(`Refusing writable open: database identity for ${profileId} is missing required fingerprint fields`);
+  }
+  const rows = database.prepare("select profile_id, environment, profile_fingerprint from lineage_profile_identity").all();
+  if (rows.length !== 1) throw new Error(`Refusing writable open: expected exactly one database profile identity, found ${rows.length}`);
+  const identity = rows[0];
+  if (identity.profile_id !== profileId || identity.environment !== environment || identity.profile_fingerprint !== profileFingerprint) {
+    throw new Error(
+      `Refusing writable open: database identity ${String(identity.profile_id)}/${String(identity.environment)}/${String(identity.profile_fingerprint)} does not match selected profile ${profileId}/${environment}/${profileFingerprint}`
+    );
+  }
+}
 function getProfileWriterDelegation(profile) {
   const lockPath = profileWriterLockPath(profile);
   if (!existsSync5(lockPath)) {
@@ -1101,7 +1416,7 @@ function getProfileWriterDelegation(profile) {
     );
   }
   const owner = readOwner(lockPath);
-  if (owner.profile_id !== profile.profile_id || owner.environment !== profile.environment) {
+  if (owner.profile_id !== profile.profile_id || owner.environment !== profile.environment || owner.profile_fingerprint !== profile.profile_fingerprint) {
     throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; refusing delegation`);
   }
   if (owner.role !== "service" || owner.service_origin !== profile.service_origin) {
@@ -1122,44 +1437,19 @@ function nowIso() {
 function lineageDbPath() {
   return process.env.LINEAGE_DB || join6(packageRoot, ".lineage", "asset-lineage.sqlite");
 }
-function assertOpenedProfileIdentity(database, databasePath) {
-  const selector = process.env.LINEAGE_PROFILE;
-  if (!selector) return;
-  const profile = resolveLineageProfile(selector);
-  if (resolve5(databasePath) !== profile.database_path) {
-    throw new Error(`Profile ${profile.profile_id} requires database ${profile.database_path}, not ${databasePath}`);
-  }
-  const table = database.prepare("select 1 from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
-  if (!table) throw new Error(`Profile database ${databasePath} is not bound to a Lineage profile identity`);
-  const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
-  if (rows.length !== 1) {
-    throw new Error(`Profile database ${databasePath} has invalid Lineage profile identity row count ${rows.length}`);
-  }
-  if (rows[0].profile_id !== profile.profile_id || rows[0].environment !== profile.environment) {
-    throw new Error(
-      `Profile database ${databasePath} is bound to ${rows[0].profile_id}/${rows[0].environment}, not ${profile.profile_id}/${profile.environment}`
-    );
-  }
-}
 function lineageDb() {
   const readOnly = process.env.LINEAGE_DB_ACCESS === "read-only";
-  const databasePath = lineageDbPath();
   if (!readOnly) assertProfileWriterLeaseHeld();
-  if (process.env.LINEAGE_PROFILE && !existsSync6(databasePath)) {
-    throw new Error(`Profile database does not exist: ${databasePath}; bind the profile before opening it`);
+  if (!readOnly && !existsSync6(lineageDbPath())) {
+    throw new Error(`Refusing writable open of missing profile database ${lineageDbPath()}; bind an existing database or create a non-production clone first`);
   }
-  if (!readOnly) mkdirSync5(join6(databasePath, ".."), { recursive: true });
+  if (!readOnly) mkdirSync5(join6(lineageDbPath(), ".."), { recursive: true });
   const { DatabaseSync } = require3("node:sqlite");
-  const database = readOnly ? new DatabaseSync(databasePath, { readOnly: true }) : new DatabaseSync(databasePath);
-  try {
-    assertOpenedProfileIdentity(database, databasePath);
-    database.exec("PRAGMA foreign_keys = ON");
-    database.exec("PRAGMA busy_timeout = 5000");
-    if (readOnly) return database;
-  } catch (error) {
-    database.close();
-    throw error;
-  }
+  const database = readOnly ? new DatabaseSync(lineageDbPath(), { readOnly: true }) : new DatabaseSync(lineageDbPath());
+  if (process.env.LINEAGE_PROFILE) assertSelectedProfileDatabaseIdentity(database);
+  database.exec("PRAGMA foreign_keys = ON");
+  database.exec("PRAGMA busy_timeout = 5000");
+  if (readOnly) return database;
   database.exec("PRAGMA journal_mode = WAL");
   database.exec(`
     create table if not exists projects (
@@ -1876,7 +2166,7 @@ function randomId(prefix) {
   return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
 function tokenHash(token) {
-  return createHash3("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function safeEqual(a, b) {
   const left = Buffer.from(a);
@@ -2998,8 +3288,8 @@ function rootFor(database, project, assetId) {
 }
 function assertCanonicalRoot(database, project, root) {
   requireAsset2(database, project, root);
-  const canonicalRoot = rootFor(database, project, root);
-  if (canonicalRoot !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
+  const canonicalRoot2 = rootFor(database, project, root);
+  if (canonicalRoot2 !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
 }
 function explicitWorkspaceRoot(database, project, assetId) {
   const row = database.prepare(`
@@ -3688,8 +3978,8 @@ function linkSelectedLineageChild(project, fields) {
 
 // src/server/generationReceipts.ts
 import { existsSync as existsSync8, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
-import { relative as relative2, resolve as resolve6 } from "node:path";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { relative as relative3, resolve as resolve5 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var adapterVersion = "generation-receipts-v1";
 var provider = "codex-handoff";
 var GenerationReceiptError = class extends Error {
@@ -3700,7 +3990,7 @@ var GenerationReceiptError = class extends Error {
   status;
 };
 function jobId() {
-  return `gen-${Date.now().toString(36)}-${randomUUID2().slice(0, 8)}`;
+  return `gen-${Date.now().toString(36)}-${randomUUID3().slice(0, 8)}`;
 }
 function quote(value) {
   return JSON.stringify(value);
@@ -3896,12 +4186,12 @@ function planImageReroll(project = defaultProject, fields) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = relative2(parent, child);
+  const rel = relative3(parent, child);
   return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
 }
 function resolveScratchFile(file) {
-  const scratchRoot = resolve6(repoRoot, ".asset-scratch");
-  const candidate = file.startsWith(".asset-scratch/") || resolve6(file).startsWith(scratchRoot) ? resolve6(repoRoot, file) : resolve6(scratchRoot, file);
+  const scratchRoot = resolve5(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve5(file).startsWith(scratchRoot) ? resolve5(repoRoot, file) : resolve5(scratchRoot, file);
   if (!isPathInside(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
   if (!existsSync8(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
   const realScratchRoot = realpathSync2(scratchRoot);
@@ -3911,7 +4201,7 @@ function resolveScratchFile(file) {
   if (!stats.isFile()) throw new GenerationReceiptError(`Import path is not a file: ${file}`);
   const checksum = fileSha256(candidate);
   return {
-    relativePath: relative2(scratchRoot, candidate),
+    relativePath: relative3(scratchRoot, candidate),
     checksum,
     size: stats.size,
     contentType: contentTypeFor(candidate),
@@ -3987,9 +4277,9 @@ function importImageRerollOutput(project = defaultProject, fields) {
 }
 
 // src/server/lineageSelectionPacket.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync9, statSync as statSync5 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve6 } from "node:path";
 var LineageSelectionPacketError = class extends Error {
   constructor(message, warnings = [], errors = [], diagnostics = []) {
     super(message);
@@ -4036,9 +4326,9 @@ function resolveWorkspace(project, options) {
 function resolveLocalReference(reference) {
   if (!reference) return void 0;
   if (isAbsolute2(reference)) return reference;
-  const repoRelative = resolve7(repoRoot, reference);
+  const repoRelative = resolve6(repoRoot, reference);
   if (existsSync9(repoRelative)) return repoRelative;
-  return resolve7(repoRoot, ".asset-scratch", reference);
+  return resolve6(repoRoot, ".asset-scratch", reference);
 }
 function fileSize(path) {
   if (!path || !existsSync9(path)) return void 0;
@@ -4114,7 +4404,7 @@ function assetForNode(node, catalogAsset, warnings) {
   };
 }
 function packetId(packetIdentity) {
-  const digest = createHash4("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
+  const digest = createHash5("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
   return `lineage_packet_${digest}`;
 }
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -4185,7 +4475,7 @@ function lineageSelectionPacketV2IdentityProjection(packet) {
 }
 function lineageSelectionPacketV2IdentitySha256(packet) {
   const projection = lineageSelectionPacketV2IdentityProjection(packet);
-  return createHash4("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
+  return createHash5("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
 }
 function addDiagnostic(diagnostics, diagnostic) {
   if (diagnostics.some((item) => item.code === diagnostic.code && item.severity === diagnostic.severity && item.asset_id === diagnostic.asset_id)) return;
@@ -4490,14 +4780,49 @@ function getLineageSelectionPacket(project, options = {}) {
 }
 
 // src/server/runtimeInfo.ts
+import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire as createRequire4 } from "node:module";
-import { existsSync as existsSync10, readFileSync as readFileSync5, statSync as statSync6 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, lstatSync as lstatSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, readlinkSync, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join9, resolve as resolve7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/shared/runtimeInfoTypes.ts
+var lineageRuntimeBuildSchemaVersion = "lineage.runtime_build.v1";
+var lineageRuntimeInstallSchemaVersion = "lineage.runtime_install.v1";
+
+// src/server/runtimeInfo.ts
 var require5 = createRequire4(import.meta.url);
-function packageInfo() {
+var processStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+function isLineagePackageRoot(root) {
   try {
-    const info = JSON.parse(readFileSync5(join9(packageRoot, "package.json"), "utf8"));
+    const info = JSON.parse(readFileSync5(join9(root, "package.json"), "utf8"));
+    return info.name === "@mean-weasel/lineage";
+  } catch {
+    return false;
+  }
+}
+function executingCodeRoot() {
+  const moduleDirectory = dirname5(fileURLToPath2(import.meta.url));
+  const candidates = [resolve7(moduleDirectory, "../.."), resolve7(moduleDirectory, "..")];
+  const root = candidates.find(isLineagePackageRoot);
+  if (!root) throw new Error(`Unable to derive Lineage code root from executing module ${fileURLToPath2(import.meta.url)}`);
+  return canonicalRoot(root);
+}
+var codeRoot = executingCodeRoot();
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function canonicalRoot(root) {
+  try {
+    return realpathSync3(root);
+  } catch {
+    return resolve7(root);
+  }
+}
+function packageInfo(root = codeRoot) {
+  try {
+    const info = JSON.parse(readFileSync5(join9(root, "package.json"), "utf8"));
     return { name: info.name || "@mean-weasel/lineage", version: info.version || "0.0.0" };
   } catch {
     return { name: "@mean-weasel/lineage", version: "0.0.0" };
@@ -4510,12 +4835,199 @@ function normalizeRuntimeChannel(value) {
   if (value === "development") return "dev";
   return process.env.NODE_ENV === "production" ? "stable" : "dev";
 }
-function gitSha() {
-  const envSha = process.env.LINEAGE_GIT_SHA || process.env.GITHUB_SHA;
-  if (envSha) return envSha.slice(0, 40);
-  if (!existsSync10(join9(packageRoot, ".git"))) return void 0;
-  const result = spawnSync2("git", ["rev-parse", "--short=12", "HEAD"], { cwd: packageRoot, encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim() || void 0 : void 0;
+function git(root, args) {
+  const result = spawnSync2("git", args, { cwd: root, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function untrackedFingerprint(root, status) {
+  const hash = createHash6("sha256");
+  hash.update(status);
+  const listed = git(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (listed === void 0) return hash.digest("hex");
+  for (const relativePath of listed.split("\0").filter(Boolean).sort()) {
+    hash.update("\0");
+    hash.update(relativePath);
+    const path = join9(root, relativePath);
+    try {
+      const stat = lstatSync2(path);
+      if (stat.isSymbolicLink()) hash.update(readlinkSync(path));
+      else if (stat.isFile()) hash.update(readFileSync5(path));
+      else hash.update(`[${stat.mode}:${stat.size}]`);
+    } catch (error) {
+      hash.update(`[unreadable:${error instanceof Error ? error.message : String(error)}]`);
+    }
+  }
+  return hash.digest("hex");
+}
+function checkoutCodeIdentity(root, channel, version) {
+  const errors = [];
+  const gitRootRaw = git(root, ["rev-parse", "--show-toplevel"])?.trim();
+  const gitSha = git(root, ["rev-parse", "HEAD"])?.trim();
+  const status = git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  const diff = git(root, ["diff", "--binary", "HEAD", "--"]);
+  const canonicalGitRoot = gitRootRaw ? canonicalRoot(gitRootRaw) : void 0;
+  if (!canonicalGitRoot || canonicalGitRoot !== root) errors.push("Code root is not the canonical root of a Git checkout/worktree");
+  if (!gitSha || !/^[a-f0-9]{40}$/i.test(gitSha)) errors.push("Checkout Git revision is unavailable");
+  if (status === void 0 || diff === void 0) errors.push("Checkout dirty state could not be inspected");
+  if (channel !== "dev") errors.push(`Checkout code may run only as dev, not ${channel}`);
+  const dirty = Boolean(status);
+  const sourceFingerprint = sha256(`${gitSha || "unknown"}\0${sha256(diff || "")}\0${untrackedFingerprint(root, status || "")}`);
+  return {
+    channel,
+    dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, dirty, git_sha: gitSha, origin: "checkout", root, source_fingerprint: sourceFingerprint, version })),
+    git_sha: gitSha,
+    origin: "checkout",
+    package_version: version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function buildFingerprint(build) {
+  return sha256(JSON.stringify({
+    package_name: build.package_name,
+    package_version: build.package_version,
+    schema_version: build.schema_version,
+    source_dirty: build.source_dirty,
+    source_fingerprint: build.source_fingerprint,
+    source_git_sha: build.source_git_sha
+  }));
+}
+function readBuildIdentity(root, errors) {
+  const path = join9(root, "dist", "runtime-build.json");
+  let build;
+  try {
+    build = JSON.parse(readFileSync5(path, "utf8"));
+  } catch (error) {
+    errors.push(`Embedded build identity is missing or unreadable at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (build.schema_version !== lineageRuntimeBuildSchemaVersion) errors.push(`Unsupported build identity schema: ${String(build.schema_version)}`);
+  if (!/^[a-f0-9]{40}$/i.test(build.source_git_sha || "")) errors.push("Embedded build Git revision is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(build.source_fingerprint || "")) errors.push("Embedded source fingerprint is invalid");
+  const expected = buildFingerprint(build);
+  if (build.build_fingerprint !== expected) errors.push("Embedded build fingerprint does not match its contents");
+  return build;
+}
+function readInstallReceipt(path, errors) {
+  if (!path) {
+    errors.push("Packaged runtime was not launched through a channel install receipt");
+    return void 0;
+  }
+  let receipt;
+  const receiptPath = resolve7(path);
+  try {
+    receipt = JSON.parse(readFileSync5(receiptPath, "utf8"));
+  } catch (error) {
+    errors.push(`Runtime install receipt is missing or unreadable at ${receiptPath}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (receipt.schema_version !== lineageRuntimeInstallSchemaVersion) errors.push(`Unsupported runtime install receipt schema: ${String(receipt.schema_version)}`);
+  if (!isAbsolute3(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
+  if (!receipt.package_integrity?.startsWith("sha512-")) errors.push("Runtime install receipt package integrity is invalid");
+  if (receipt.package_source !== "registry" && receipt.package_source !== "local") errors.push("Runtime install receipt package source is invalid");
+  if (typeof receipt.package_spec !== "string" || !receipt.package_spec) errors.push("Runtime install receipt package spec is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(receipt.package_tree_sha256 || "")) errors.push("Runtime install receipt package tree hash is invalid");
+  if (Number.isNaN(Date.parse(receipt.installed_at))) errors.push("Runtime install receipt timestamp is invalid");
+  return { ...receipt, receipt_path: receiptPath };
+}
+function lineagePackageTreeSha256(root) {
+  const hash = createHash6("sha256");
+  const visit = (directory, relativeDirectory = "") => {
+    for (const entry of readdirSync3(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      const relativePath = relativeDirectory ? join9(relativeDirectory, entry.name) : entry.name;
+      const path = join9(directory, entry.name);
+      hash.update(relativePath.replaceAll("\\", "/"));
+      hash.update("\0");
+      if (entry.isDirectory()) {
+        hash.update("directory\0");
+        visit(path, relativePath);
+      } else if (entry.isSymbolicLink()) {
+        hash.update("symlink\0");
+        hash.update(readlinkSync(path));
+      } else if (entry.isFile()) {
+        hash.update("file\0");
+        hash.update(readFileSync5(path));
+      } else {
+        hash.update("other\0");
+      }
+      hash.update("\0");
+    }
+  };
+  visit(root);
+  return hash.digest("hex");
+}
+function packageCodeIdentity(root, channel, info, receiptPath) {
+  const errors = [];
+  const build = readBuildIdentity(root, errors);
+  const install = readInstallReceipt(receiptPath, errors);
+  if (channel === "dev") errors.push("Published package code cannot run as dev; use a Git checkout/worktree");
+  if (build?.package_name !== info.name || build?.package_version !== info.version) {
+    errors.push("Embedded build package identity does not match package.json");
+  }
+  if (build?.source_dirty) errors.push("Stable and preview package installs require a clean-source build");
+  if (install) {
+    if (install.channel !== channel) errors.push(`Install receipt channel ${install.channel} does not match requested ${channel}`);
+    if (canonicalRoot(install.package_root) !== root) errors.push("Install receipt package root does not match the executing package root");
+    if (install.package_name !== info.name || install.package_version !== info.version) errors.push("Install receipt package identity does not match package.json");
+    if (build && install.build_fingerprint !== build.build_fingerprint) errors.push("Install receipt build fingerprint does not match the embedded build");
+    try {
+      if (lineagePackageTreeSha256(root) !== install.package_tree_sha256) errors.push("Installed package tree does not match the channel install receipt");
+    } catch (error) {
+      errors.push(`Installed package tree could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  const gitSha = build?.source_git_sha;
+  const sourceFingerprint = build?.source_fingerprint;
+  return {
+    build,
+    channel,
+    dirty: build?.source_dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({
+      build_fingerprint: build?.build_fingerprint,
+      channel,
+      install_integrity: install?.package_integrity,
+      origin: "package",
+      root,
+      version: info.version
+    })),
+    git_sha: gitSha,
+    install,
+    origin: "package",
+    package_version: info.version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function getLineageCodeIdentity(channel, options = {}) {
+  const root = canonicalRoot(options.root || codeRoot);
+  const info = packageInfo(root);
+  if (existsSync10(join9(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
+  if (existsSync10(join9(root, "package.json"))) {
+    return packageCodeIdentity(root, channel, info, options.receiptPath ?? process.env.LINEAGE_RUNTIME_RECEIPT);
+  }
+  const errors = [`Code root has neither checkout metadata nor package.json: ${root}`];
+  return {
+    channel,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, origin: "unknown", root, version: info.version })),
+    origin: "unknown",
+    package_version: info.version,
+    root,
+    verified: false
+  };
+}
+function assertLineageCodeOrigin(channel) {
+  const identity = getLineageCodeIdentity(channel);
+  if (!identity.verified) {
+    const migration = channel === "dev" ? "Run dev from a Git checkout with npm run lineage:dev -- <command>." : `Install and launch an isolated ${channel} runtime with lineage-channel install ${channel}.`;
+    throw new Error(`Unverified ${channel} code origin: ${identity.errors.join("; ")}. ${migration}`);
+  }
+  return identity;
 }
 function tableExists2(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
@@ -4533,6 +5045,7 @@ function getLineageRuntimeInfo(options = {}) {
   const info = packageInfo();
   const dbPath = options.dbPath || lineageDbPath();
   const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+  const code = options.code || getLineageCodeIdentity(channel);
   const databaseInfo = { exists: existsSync10(dbPath), path: dbPath };
   const schema = { migration_keys: [] };
   if (databaseInfo.exists) {
@@ -4547,11 +5060,13 @@ function getLineageRuntimeInfo(options = {}) {
         databaseInfo.workspaces = tableCount(database, "lineage_workspaces");
         schema.migration_keys = migrationKeys(database);
         if (tableExists2(database, "lineage_profile_identity")) {
-          const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
-          schema.profile_identity_rows = rows.length;
+          const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+          const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "null as profile_fingerprint";
+          const rows = database.prepare(`select profile_id, environment, ${fingerprintExpression} from lineage_profile_identity`).all();
           if (rows.length === 1) {
             schema.profile_id = rows[0].profile_id;
             schema.profile_environment = rows[0].environment;
+            if (rows[0].profile_fingerprint) schema.profile_fingerprint = rows[0].profile_fingerprint;
           }
         }
       } finally {
@@ -4564,13 +5079,20 @@ function getLineageRuntimeInfo(options = {}) {
   return {
     asset_root: repoRoot,
     channel,
+    code,
     database: databaseInfo,
     fetchedAt: nowIso(),
-    git_sha: gitSha(),
+    git_sha: code.git_sha,
     node_env: process.env.NODE_ENV,
     package_name: info.name,
     profile: runtimeProfileIdentity(channel),
     schema,
+    service: {
+      instance_id: process.env.LINEAGE_SERVICE_INSTANCE_ID,
+      launcher_pid: process.env.LINEAGE_LAUNCHER_PID ? Number(process.env.LINEAGE_LAUNCHER_PID) : void 0,
+      pid: process.pid,
+      started_at: processStartedAt
+    },
     version: info.version
   };
 }
@@ -4665,7 +5187,7 @@ var signalExitCodes = {
   SIGTERM: 143
 };
 function packageRoot2() {
-  return resolve8(dirname5(fileURLToPath2(import.meta.url)), "..", "..");
+  return resolve8(dirname6(fileURLToPath3(import.meta.url)), "..", "..");
 }
 function packageVersion() {
   try {
@@ -4710,9 +5232,8 @@ function resolveStartOptions(config, args) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error(`Invalid port: ${rawPort}`);
   }
-  const profileHost = serviceUrl ? normalizeListenHost(serviceUrl.hostname) : void 0;
-  const host = normalizeListenHost(readOption(args, "--host") || process.env.HOST || profileHost || config.defaultHost);
-  if (profile && serviceUrl && (host !== profileHost || port !== Number(serviceUrl.port || 80))) {
+  const host = readOption(args, "--host") || process.env.HOST || serviceUrl?.hostname || config.defaultHost;
+  if (profile && serviceUrl && (host !== serviceUrl.hostname || port !== Number(serviceUrl.port || 80))) {
     throw new Error(`Profile ${profile.profile_id} service_origin ${profile.service_origin} conflicts with requested host/port ${host}:${port}`);
   }
   return {
@@ -4725,13 +5246,6 @@ function resolveStartOptions(config, args) {
     profile
   };
 }
-function normalizeListenHost(host) {
-  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}
-function lineageServiceUrl(host, port) {
-  const urlHost = host.includes(":") ? `[${normalizeListenHost(host)}]` : host;
-  return `http://${urlHost}:${port}`;
-}
 function resolveCliAssetRoot(args) {
   return resolve8(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
 }
@@ -4748,15 +5262,8 @@ function hasOption(args, name) {
 }
 function profileSelector(args) {
   const option = readOption(args, "--profile");
-  if (hasOption(args, "--profile") && !option?.trim()) {
-    throw new Error("--profile requires a non-empty profile ID or manifest path");
-  }
-  if (option && process.env.LINEAGE_PROFILE) {
-    const optionProfile = resolveLineageProfile(option);
-    const environmentProfile = resolveLineageProfile(process.env.LINEAGE_PROFILE);
-    if (optionProfile.manifest_path !== environmentProfile.manifest_path) {
-      throw new Error(`--profile ${option} conflicts with LINEAGE_PROFILE ${process.env.LINEAGE_PROFILE}`);
-    }
+  if (option && process.env.LINEAGE_PROFILE && option !== process.env.LINEAGE_PROFILE) {
+    throw new Error(`--profile ${option} conflicts with LINEAGE_PROFILE ${process.env.LINEAGE_PROFILE}`);
   }
   return option || process.env.LINEAGE_PROFILE;
 }
@@ -4780,12 +5287,13 @@ function prepareCliProfile(config, args) {
   }
   assertProfileChannel(profile, config.channel);
   const runtime = getLineageRuntimeInfo({ channel: config.channel, dbPath: profile.database_path });
-  const doctor = doctorLineageProfile(selector, { channel: config.channel, gitSha: runtime.git_sha, version: runtime.version });
+  const doctor = doctorLineageProfile(selector, { channel: config.channel, code: runtime.code, gitSha: runtime.git_sha, version: runtime.version });
   if (!doctor.ok) throw new Error(`Profile ${profile.profile_id} failed doctor: ${doctorFailures(doctor)}`);
   process.env.LINEAGE_ASSET_ROOT = profile.asset_root;
   process.env.LINEAGE_DB = profile.database_path;
   process.env.LINEAGE_PROFILE = selector;
   process.env.LINEAGE_PROFILE_ENVIRONMENT = profile.environment;
+  process.env.LINEAGE_PROFILE_FINGERPRINT = profile.profile_fingerprint;
   process.env.LINEAGE_PROFILE_ID = profile.profile_id;
   process.env.LINEAGE_PROFILE_MANIFEST = profile.manifest_path;
   process.env.LINEAGE_PROFILE_SERVICE_ORIGIN = profile.service_origin;
@@ -4798,7 +5306,11 @@ function formatLineageHelp(config) {
 Usage:
   ${config.binName} start [--profile <id-or-manifest>] [--port <port>] [--host <host>] [--db <path>] [--asset-root <path>] [--open] [--json]
   ${config.binName} profile doctor --profile <id-or-manifest> [--json]
-  ${config.binName} profile bind --profile <id-or-manifest> [--confirm-write] [--json]
+  ${config.binName} profile bind --profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} profile clone --source-db <snapshot-source> --target-profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} profile clone-assets --source-asset-root <path> --target-profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} runtime info [--json]
+  ${config.binName} runtime doctor [--json]
   ${config.binName} next [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} brief [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} inspect --asset-id <asset-id> [--project <project>] [--db <path>] [--json]
@@ -4837,7 +5349,15 @@ Asset catalogs and local media default to the installed package root. Pass
 All commands accept --profile <id-or-manifest> or LINEAGE_PROFILE. Named
 profiles are authoritative for database, asset root, environment, and origin;
 they cannot be combined with direct --db or --asset-root overrides. Commands
-without a profile run in legacy-unbound compatibility mode.
+without a profile run in legacy-unbound diagnostic/read-only mode.
+
+Operational commands also require an attested code origin. Stable and preview
+run from separate lineage-channel install receipts. Dev runs only from a Git
+checkout/worktree through npm run lineage:dev.
+
+Server startup independently verifies code origin. When --open is requested,
+the browser opens only after /api/runtime matches the expected code, profile,
+database, and unique service instance.
 
 Variation vs re-roll:
   link-child creates a new visible child variation edge.
@@ -4852,6 +5372,48 @@ function openBrowser(url) {
   const opener = spawn(command, args, { detached: true, stdio: "ignore" });
   opener.unref();
 }
+function lineageServiceIdentityErrors(runtime, expected) {
+  const errors = [];
+  if (runtime.channel !== expected.channel) errors.push(`channel ${runtime.channel} != ${expected.channel}`);
+  if (!runtime.code?.verified) errors.push("service code identity is not verified");
+  if (runtime.code?.fingerprint !== expected.code_fingerprint) errors.push(`code fingerprint ${runtime.code?.fingerprint || "missing"} != ${expected.code_fingerprint}`);
+  if (resolve8(runtime.database.path) !== resolve8(expected.database_path)) errors.push(`database ${runtime.database.path} != ${expected.database_path}`);
+  if (runtime.service?.instance_id !== expected.instance_id) errors.push(`service instance ${runtime.service?.instance_id || "missing"} != ${expected.instance_id}`);
+  if (runtime.service?.launcher_pid !== expected.launcher_pid) errors.push(`launcher pid ${runtime.service?.launcher_pid || "missing"} != ${expected.launcher_pid}`);
+  if (expected.profile) {
+    if (!runtime.profile.bound) errors.push("service profile is unbound");
+    if (runtime.profile.id !== expected.profile.profile_id) errors.push(`profile ${runtime.profile.id} != ${expected.profile.profile_id}`);
+    if (runtime.profile.environment !== expected.profile.environment) errors.push(`environment ${runtime.profile.environment} != ${expected.profile.environment}`);
+    if (runtime.profile.fingerprint !== expected.profile.profile_fingerprint) errors.push(`profile fingerprint ${runtime.profile.fingerprint || "missing"} != ${expected.profile.profile_fingerprint}`);
+    if (runtime.schema.profile_id !== expected.profile.profile_id) errors.push(`database profile ${runtime.schema.profile_id || "missing"} != ${expected.profile.profile_id}`);
+    if (runtime.schema.profile_fingerprint !== expected.profile.profile_fingerprint) errors.push(`database fingerprint ${runtime.schema.profile_fingerprint || "missing"} != ${expected.profile.profile_fingerprint}`);
+  }
+  return errors;
+}
+async function openBrowserAfterReadiness(url, expected, child) {
+  const deadline = Date.now() + 15e3;
+  let lastError = "service did not respond";
+  while (Date.now() < deadline && child.exitCode === null) {
+    try {
+      const response = await fetch(`${url}/api/runtime`, { signal: AbortSignal.timeout(1e3) });
+      if (response.ok) {
+        const body = await response.json();
+        if (body.runtime) {
+          const errors = lineageServiceIdentityErrors(body.runtime, expected);
+          if (errors.length === 0) {
+            openBrowser(url);
+            return;
+          }
+          lastError = errors.join("; ");
+        }
+      } else lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 200));
+  }
+  throw new Error(`Service readiness failed; browser was not opened: ${lastError}`);
+}
 function positionalArgs(args) {
   const values = [];
   for (let index = 0; index < args.length; index += 1) {
@@ -4910,8 +5472,8 @@ function runLineageDataCommand(command, args) {
     const out = readOption(args, "--out");
     if (out) {
       const outPath = resolve8(out);
-      mkdirSync6(dirname5(outPath), { recursive: true });
-      writeFileSync3(outPath, `${JSON.stringify(packet, null, 2)}
+      mkdirSync6(dirname6(outPath), { recursive: true });
+      writeFileSync4(outPath, `${JSON.stringify(packet, null, 2)}
 `);
     }
     return packet;
@@ -5122,41 +5684,90 @@ function runLineageDbCommand(config, command, args) {
   throw new Error(`Unknown db command: ${command}`);
 }
 function runLineageProfileCommand(config, command, args) {
-  if (command !== "doctor" && command !== "bind") throw new Error(`Unknown profile command: ${command}`);
+  const runtime = getLineageRuntimeInfo({ channel: config.channel });
+  const runtimeIdentity = { channel: config.channel, code: runtime.code, gitSha: runtime.git_sha, version: runtime.version };
+  if (command === "clone") {
+    const source = readOption(args, "--source-db");
+    const target = readOption(args, "--target-profile");
+    if (!source || !target) throw new Error("lineage profile clone requires --source-db and --target-profile");
+    if (hasOption(args, "--profile")) throw new Error("Profile clone uses --target-profile, not --profile");
+    if (!args.includes("--confirm-write")) throw new Error("Profile clone requires --confirm-write");
+    const targetProfile = resolveLineageProfile(target);
+    const writerLease = acquireProfileWriterLease(targetProfile, config.channel, "cli");
+    return cloneLineageProfileDatabase(source, target, runtimeIdentity, true).finally(writerLease.release);
+  }
+  if (command === "clone-assets") {
+    const source = readOption(args, "--source-asset-root");
+    const target = readOption(args, "--target-profile");
+    if (!source || !target) throw new Error("lineage profile clone-assets requires --source-asset-root and --target-profile");
+    if (hasOption(args, "--profile")) throw new Error("Profile asset clone uses --target-profile, not --profile");
+    if (!args.includes("--confirm-write")) throw new Error("Profile asset clone requires --confirm-write");
+    const targetProfile = resolveLineageProfile(target);
+    const writerLease = acquireProfileWriterLease(targetProfile, config.channel, "cli");
+    try {
+      return cloneLineageProfileAssets(source, target, runtimeIdentity, true);
+    } finally {
+      writerLease.release();
+    }
+  }
   if (hasOption(args, "--db")) throw new Error(`Profile ${command} cannot be combined with --db`);
   if (hasOption(args, "--asset-root")) throw new Error(`Profile ${command} cannot be combined with --asset-root`);
   const selector = profileSelector(args);
   if (!selector) throw new Error(`lineage profile ${command} requires --profile or LINEAGE_PROFILE`);
+  if (command === "doctor") return doctorLineageProfile(selector, runtimeIdentity);
   if (command === "bind") {
+    if (!args.includes("--confirm-write")) throw new Error("Profile bind requires --confirm-write");
     const profile = resolveLineageProfile(selector);
-    assertProfileChannel(profile, config.channel);
-    if (!args.includes("--confirm-write")) return bindLineageProfileDatabase(profile, false);
-    mkdirSync6(dirname5(profile.database_path), { recursive: true });
     const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
     try {
-      return bindLineageProfileDatabase(profile, true);
+      return bindLineageProfileDatabase(selector, runtimeIdentity, true);
     } finally {
       writerLease.release();
     }
   }
-  const runtime = getLineageRuntimeInfo({ channel: config.channel });
-  return doctorLineageProfile(selector, { channel: config.channel, gitSha: runtime.git_sha, version: runtime.version });
+  throw new Error(`Unknown profile command: ${command}`);
 }
 function printProfileResult(result, json) {
   if (json) {
     console.log(JSON.stringify(result, null, 2));
     return;
   }
-  if (result.schema_version === "lineage.profile_bind.v1") {
-    console.log(`${result.dryRun ? "Would bind" : result.already_bound ? "Already bound" : "Bound"} ${result.profile_id} to ${result.database_path}`);
-    return;
+  if (result.schema_version === "lineage.profile_doctor.v1") {
+    console.log(`Profile doctor: ${result.ok ? "ok" : "failed"}`);
+    for (const check of result.checks) console.log(`${check.status.toUpperCase()} ${check.id}: ${check.message}`);
+  } else if (result.schema_version === "lineage.profile_bind.v1") {
+    console.log(`${result.already_bound ? "Already bound" : "Bound"} ${result.database_path} to ${result.identity.profile_id}`);
+  } else if (result.schema_version === "lineage.profile_clone_receipt.v1") {
+    console.log(`Cloned ${result.source_database_path} to ${result.database_path} for ${result.target_identity.profile_id}`);
+    console.log(`Receipt: ${result.receipt_path}`);
+  } else {
+    console.log(`Cloned ${result.files_copied} referenced asset file(s) into ${result.asset_root}`);
+    console.log(`Receipt: ${result.receipt_path}`);
   }
-  console.log(`Profile doctor: ${result.ok ? "ok" : "failed"}`);
-  for (const check of result.checks) console.log(`${check.status.toUpperCase()} ${check.id}: ${check.message}`);
 }
 function lineageProfileDoctorExitCode(result) {
   return result.ok ? 0 : 1;
 }
+function runLineageRuntimeCommand(config, command) {
+  if (command === "info") return getLineageCodeIdentity(config.channel);
+  if (command === "doctor") return assertLineageCodeOrigin(config.channel);
+  throw new Error(`Unknown runtime command: ${command}`);
+}
+function printRuntimeResult(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(`Code origin: ${result.origin}`);
+  console.log(`Code root: ${result.root}`);
+  console.log(`Channel: ${result.channel}`);
+  console.log(`Version: ${result.package_version}`);
+  if (result.git_sha) console.log(`Git: ${result.git_sha}`);
+  if (result.dirty !== void 0) console.log(`Dirty: ${result.dirty ? "yes" : "no"}`);
+  console.log(`Fingerprint: ${result.fingerprint}`);
+  console.log(`Verified: ${result.verified ? "yes" : "no"}`);
+  for (const error of result.errors) console.log(`FAIL: ${error}`);
+}
 function lineageCliRequiresWriterLease(command, args) {
   if (command === "next" || command === "brief" || command === "inspect" || command === "selection") return false;
   const subcommand = positionalArgs(args)[0] || "";
@@ -5188,6 +5799,10 @@ function printDbResult(command, result, json) {
     const runtime = result;
     console.log(`Channel: ${runtime.channel}`);
     console.log(`Version: ${runtime.version}`);
+    if (runtime.code) {
+      console.log(`Code: ${runtime.code.origin} ${runtime.code.verified ? "verified" : "unverified"} ${runtime.code.fingerprint}`);
+      console.log(`Code root: ${runtime.code.root}`);
+    }
     if (runtime.git_sha) console.log(`Git: ${runtime.git_sha}`);
     if (runtime.node_env) console.log(`Node env: ${runtime.node_env}`);
     console.log(`Assets: ${runtime.asset_root}`);
@@ -5336,8 +5951,8 @@ function start(config, args) {
     else console.error(`${config.binName}: ${message}`);
     process.exit(1);
   }
-  mkdirSync6(dirname5(options.dbPath), { recursive: true });
-  const url = lineageServiceUrl(options.host, options.port);
+  mkdirSync6(dirname6(options.dbPath), { recursive: true });
+  const url = `http://${options.host}:${options.port}`;
   if (options.json) {
     console.log(JSON.stringify({ assetRoot: options.assetRoot, channel: config.channel, dbPath: options.dbPath, host: options.host, port: options.port, profile: options.profile ? { environment: options.profile.environment, id: options.profile.profile_id } : { bound: false, id: "legacy-unbound" }, status: "starting", url }, null, 2));
   } else {
@@ -5347,7 +5962,8 @@ function start(config, args) {
     console.log(`SQLite: ${options.dbPath}`);
     console.log(`Assets: ${options.assetRoot}`);
   }
-  if (options.open) openBrowser(url);
+  const code = getLineageCodeIdentity(config.channel);
+  const serviceInstanceId = process.env.LINEAGE_SERVICE_INSTANCE_ID || randomUUID4();
   const child = spawn(process.execPath, [serverPath], {
     env: {
       ...process.env,
@@ -5357,15 +5973,31 @@ function start(config, args) {
       LINEAGE_DB: options.dbPath,
       LINEAGE_PROFILE: options.profile ? process.env.LINEAGE_PROFILE : void 0,
       LINEAGE_PROFILE_ENVIRONMENT: options.profile?.environment,
+      LINEAGE_PROFILE_FINGERPRINT: options.profile?.profile_fingerprint,
       LINEAGE_PROFILE_ID: options.profile?.profile_id,
       LINEAGE_PROFILE_MANIFEST: options.profile?.manifest_path,
       LINEAGE_PROFILE_SERVICE_ORIGIN: options.profile?.service_origin,
-      LINEAGE_DB_ACCESS: void 0,
+      LINEAGE_LAUNCHER_PID: String(process.pid),
+      LINEAGE_SERVICE_INSTANCE_ID: serviceInstanceId,
+      LINEAGE_DB_ACCESS: options.profile ? void 0 : "read-only",
       NODE_ENV: "production",
       PORT: String(options.port)
     },
     stdio: "inherit"
   });
+  if (options.open) {
+    void openBrowserAfterReadiness(url, {
+      channel: config.channel,
+      code_fingerprint: code.fingerprint,
+      database_path: options.dbPath,
+      instance_id: serviceInstanceId,
+      launcher_pid: process.pid,
+      profile: options.profile
+    }, child).catch((error) => {
+      console.error(`${config.binName}: ${error instanceof Error ? error.message : String(error)}`);
+      child.kill("SIGTERM");
+    });
+  }
   let forwardedSignal;
   const stop = (signal) => {
     forwardedSignal = signal;
@@ -5373,7 +6005,7 @@ function start(config, args) {
   };
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  child.on("exit", (code) => process.exit(code ?? (forwardedSignal ? signalExitCodes[forwardedSignal] || 1 : 0)));
+  child.on("exit", (code2) => process.exit(code2 ?? (forwardedSignal ? signalExitCodes[forwardedSignal] || 1 : 0)));
   child.on("error", (error) => {
     console.error(`${config.binName}: failed to start server: ${error.message}`);
     process.exit(1);
@@ -5391,18 +6023,26 @@ async function runLineageCli(config, args = process.argv.slice(2)) {
   }
   const normalizedArgs = args[0] === "lineage" ? args.slice(1) : args;
   const [command] = normalizedArgs;
-  if (command === "start") {
-    start(config, normalizedArgs.slice(1));
-    return;
-  }
   if (command === "profile") {
     const commandArgs = normalizedArgs.slice(2);
     const profileCommand = normalizedArgs[1] || "";
     const json2 = commandArgs.includes("--json");
     try {
       const result = runLineageProfileCommand(config, profileCommand, commandArgs);
+      if (result instanceof Promise) {
+        result.then((value) => {
+          printProfileResult(value, json2);
+          process.exit(0);
+        }).catch((error) => {
+          const message2 = error instanceof Error ? error.message : String(error);
+          if (json2) console.error(JSON.stringify({ ok: false, command: `profile ${profileCommand}`, error: message2 }, null, 2));
+          else console.error(`${config.binName}: ${message2}`);
+          process.exit(1);
+        });
+        return;
+      }
       printProfileResult(result, json2);
-      process.exit(lineageProfileDoctorExitCode(result));
+      process.exit(result.schema_version === "lineage.profile_doctor.v1" ? lineageProfileDoctorExitCode(result) : 0);
     } catch (error) {
       const message2 = error instanceof Error ? error.message : String(error);
       if (json2) console.error(JSON.stringify({ ok: false, command: `profile ${profileCommand}`, error: message2 }, null, 2));
@@ -5410,11 +6050,42 @@ async function runLineageCli(config, args = process.argv.slice(2)) {
       process.exit(1);
     }
   }
+  if (command === "runtime") {
+    const runtimeCommand = normalizedArgs[1] || "";
+    const commandArgs = normalizedArgs.slice(2);
+    const json2 = commandArgs.includes("--json");
+    try {
+      printRuntimeResult(runLineageRuntimeCommand(config, runtimeCommand), json2);
+      process.exit(0);
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      if (json2) console.error(JSON.stringify({ ok: false, command: `runtime ${runtimeCommand}`, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
+  const originDiagnosticOnly = command === "db" && normalizedArgs[1] === "info";
+  if (!originDiagnosticOnly) {
+    try {
+      assertLineageCodeOrigin(config.channel);
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      const json2 = normalizedArgs.includes("--json");
+      if (json2) console.error(JSON.stringify({ ok: false, command, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
+  if (command === "start") {
+    start(config, normalizedArgs.slice(1));
+    return;
+  }
   let managedWriterProfile;
   try {
     const profile = prepareCliProfile(config, normalizedArgs.slice(1));
+    const requiresWriter = lineageCliRequiresWriterLease(command, normalizedArgs.slice(1));
     if (profile) {
-      if (lineageCliRequiresWriterLease(command, normalizedArgs.slice(1))) {
+      if (requiresWriter) {
         delete process.env.LINEAGE_DB_ACCESS;
         try {
           const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
@@ -5427,6 +6098,10 @@ async function runLineageCli(config, args = process.argv.slice(2)) {
       } else {
         process.env.LINEAGE_DB_ACCESS = "read-only";
       }
+    } else if (requiresWriter) {
+      throw new Error("Persistent writes require --profile; legacy-unbound access is read-only");
+    } else {
+      process.env.LINEAGE_DB_ACCESS = "read-only";
     }
   } catch (error) {
     const message2 = error instanceof Error ? error.message : String(error);