@mean-weasel/lineage 0.1.22 → 0.1.24

package/dist/cli/lineage-preview.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/lineageCli.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { homedir as homedir2, platform as platform2 } from "node:os";
-import { dirname as dirname6, join as join10, resolve as resolve8 } from "node:path";
+import { dirname as dirname6, join as join10, resolve as resolve10 } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
@@ -648,6 +648,7 @@ var lineageProfileDoctorSchemaVersion = "lineage.profile_doctor.v1";
 var lineageProfileCloneReceiptSchemaVersion = "lineage.profile_clone_receipt.v1";
 var lineageProfileAssetsCloneReceiptSchemaVersion = "lineage.profile_assets_clone_receipt.v1";
 var lineageProfileRuntimeRepinReceiptSchemaVersion = "lineage.profile_runtime_repin_receipt.v1";
+var lineageProfileRuntimeUpgradeReceiptSchemaVersion = "lineage.profile_runtime_upgrade_receipt.v1";
 
 // src/server/nodeSqlite.ts
 import { createRequire } from "node:module";
@@ -848,7 +849,9 @@ function initializeLineageProfile(profileId, serviceOrigin, runtime, confirmWrit
     expected_runtime: {
       channel: runtime.channel,
       code_fingerprint: runtime.code.fingerprint.toLowerCase(),
-      code_origin: runtime.code.origin
+      code_origin: runtime.code.origin,
+      ...runtime.gitSha ? { git_sha: runtime.gitSha } : {},
+      version: runtime.version
     },
     profile_id: profileId,
     schema_version: lineageProfileSchemaVersion,
@@ -914,7 +917,9 @@ function initializeLineageProfile(profileId, serviceOrigin, runtime, confirmWrit
       runtime: {
         channel: runtime.channel,
         code_fingerprint: runtime.code.fingerprint,
-        code_origin: runtime.code.origin
+        code_origin: runtime.code.origin,
+        ...runtime.gitSha ? { git_sha: runtime.gitSha } : {},
+        version: runtime.version
       },
       schema_version: lineageProfileInitSchemaVersion,
       service_origin: profile.service_origin
@@ -950,6 +955,229 @@ function runtimeRepinInvariant(profile) {
 function sameFileIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
 }
+function fsyncDirectory(path) {
+  const directoryFd = openSync(path, "r");
+  try {
+    fsyncSync(directoryFd);
+  } finally {
+    closeSync(directoryFd);
+  }
+}
+function parseStableVersion(value, label) {
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value);
+  if (!match) throw new Error(`${label} must be a valid stable SemVer without a prerelease, found ${value}`);
+  return match.slice(1).map(BigInt);
+}
+function compareStableVersions(left, right) {
+  for (let index = 0; index < left.length; index += 1) {
+    if (left[index] !== right[index]) return left[index] < right[index] ? -1 : 1;
+  }
+  return 0;
+}
+function profileUpgradePreflight(profile, runtime) {
+  const doctor = doctorLineageProfile(profile.manifest_path, runtime);
+  const allowedRuntimeMismatches = /* @__PURE__ */ new Set(["runtime_code", "runtime_version", "runtime_git_sha"]);
+  const failures = doctor.checks.filter((check) => check.status === "fail" && !allowedRuntimeMismatches.has(check.id));
+  if (failures.length > 0) {
+    throw new Error(`Stable profile runtime upgrade requires a healthy production profile before changing its pin: ${failures.map((check) => `${check.id}: ${check.message}`).join("; ")}`);
+  }
+}
+function upgradeRuntimeIdentity(fingerprint, options = {}) {
+  return {
+    channel: "stable",
+    code_fingerprint: fingerprint,
+    code_origin: "package",
+    ...options.codeRoot ? { code_root: options.codeRoot } : {},
+    ...options.gitSha ? { git_sha: options.gitSha } : {},
+    ...options.version ? { version: options.version } : {}
+  };
+}
+function upgradeLineageStableProfileRuntime(selector, runtime, confirmWrite, testHooks = {}) {
+  if (!confirmWrite) throw new Error("Stable profile runtime upgrade requires --confirm-write");
+  if (runtime.channel !== "stable") throw new Error(`Stable profile runtime upgrade requires stable code, not ${runtime.channel}`);
+  if (!runtime.code?.verified) throw new Error("Stable profile runtime upgrade requires a verified package runtime");
+  if (runtime.code.channel !== "stable") throw new Error(`Stable profile runtime upgrade requires stable code identity, not ${runtime.code.channel}`);
+  if (runtime.code.origin !== "package") throw new Error(`Stable profile runtime upgrade requires package code, not ${runtime.code.origin}`);
+  if (!runtime.code.fingerprint || !/^[a-f0-9]{64}$/i.test(runtime.code.fingerprint)) {
+    throw new Error("Stable profile runtime upgrade requires a valid executing code fingerprint");
+  }
+  if (runtime.code.package_version !== runtime.version) {
+    throw new Error(`Stable profile runtime upgrade version ${runtime.version} does not match package version ${runtime.code.package_version || "missing"}`);
+  }
+  const targetVersion = parseStableVersion(runtime.version, "Stable profile runtime upgrade target version");
+  const executingRoot = realpathSync(runtime.code.root);
+  if (!statSync3(executingRoot).isDirectory()) {
+    throw new Error(`Stable profile runtime upgrade code root is not a directory: ${executingRoot}`);
+  }
+  const profile = resolveLineageProfile(selector);
+  if (profile.environment !== "production") {
+    throw new Error(`Stable profile runtime upgrade requires a production profile, not ${profile.environment}`);
+  }
+  if (profile.expected_runtime?.channel !== "stable") {
+    throw new Error("Stable profile runtime upgrade requires an existing stable channel pin");
+  }
+  if (profile.expected_runtime.code_origin !== "package") {
+    throw new Error("Stable profile runtime upgrade requires an existing package origin pin");
+  }
+  const previousFingerprint = profile.expected_runtime.code_fingerprint;
+  if (!previousFingerprint) throw new Error("Stable profile runtime upgrade requires an existing code fingerprint pin");
+  const previousVersion = profile.expected_runtime.version;
+  if (previousVersion) {
+    const comparison = compareStableVersions(targetVersion, parseStableVersion(previousVersion, "Stable profile runtime upgrade source version"));
+    if (previousFingerprint === runtime.code.fingerprint && previousVersion !== runtime.version) {
+      throw new Error(`Stable profile runtime upgrade found one code fingerprint claiming conflicting versions ${previousVersion} and ${runtime.version}`);
+    }
+    if (comparison === 0 && previousFingerprint !== runtime.code.fingerprint) {
+      throw new Error(`Stable profile runtime upgrade refuses same-version fingerprint change for ${runtime.version}`);
+    }
+    if (comparison < 0) {
+      throw new Error(`Stable profile runtime upgrade refuses downgrade from ${previousVersion} to ${runtime.version}`);
+    }
+    if (comparison > 0 && previousFingerprint === runtime.code.fingerprint) {
+      throw new Error(`Stable profile runtime upgrade requires a new code fingerprint for version ${runtime.version}`);
+    }
+  }
+  if (previousFingerprint === runtime.code.fingerprint && profile.expected_runtime.git_sha && runtime.gitSha && profile.expected_runtime.git_sha !== runtime.gitSha) {
+    throw new Error("Stable profile runtime upgrade found one code fingerprint claiming conflicting Git revisions");
+  }
+  profileUpgradePreflight(profile, runtime);
+  const manifestPath = profile.manifest_path;
+  const profileDirectory = dirname3(manifestPath);
+  assertOwnerOnlyPath(profileDirectory, "profile directory");
+  const beforeStats = assertOwnerOnlyPath(manifestPath, "manifest");
+  const beforeText = readFileSync3(manifestPath, "utf8");
+  const beforeHash = sha256(beforeText);
+  let raw;
+  try {
+    raw = JSON.parse(beforeText);
+  } catch (error) {
+    throw new Error(`Could not parse profile manifest ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Profile manifest must be a JSON object");
+  const nextExpectedRuntime = {
+    channel: "stable",
+    code_fingerprint: runtime.code.fingerprint.toLowerCase(),
+    code_origin: "package",
+    ...runtime.gitSha ? { git_sha: runtime.gitSha } : {},
+    version: runtime.version
+  };
+  const afterText = `${JSON.stringify({ ...raw, expected_runtime: nextExpectedRuntime }, null, 2)}
+`;
+  const afterHash = sha256(afterText);
+  const normalizedTargetMatches = previousFingerprint === nextExpectedRuntime.code_fingerprint && previousVersion === nextExpectedRuntime.version && profile.expected_runtime.git_sha === nextExpectedRuntime.git_sha;
+  const newRuntime = upgradeRuntimeIdentity(runtime.code.fingerprint, {
+    codeRoot: executingRoot,
+    gitSha: runtime.gitSha,
+    version: runtime.version
+  });
+  const result = {
+    asset_root: profile.asset_root,
+    changed: !normalizedTargetMatches,
+    database_path: profile.database_path,
+    manifest_after_sha256: normalizedTargetMatches ? beforeHash : afterHash,
+    manifest_before_sha256: beforeHash,
+    manifest_path: manifestPath,
+    new_runtime: newRuntime,
+    post_upgrade_doctor_ok: true,
+    previous_runtime: upgradeRuntimeIdentity(previousFingerprint, {
+      gitSha: profile.expected_runtime.git_sha,
+      version: previousVersion
+    }),
+    profile_fingerprint: profile.profile_fingerprint,
+    profile_id: profile.profile_id,
+    schema_version: lineageProfileRuntimeUpgradeReceiptSchemaVersion,
+    service_origin: profile.service_origin,
+    upgrade_kind: normalizedTargetMatches ? "idempotent" : previousVersion ? "versioned" : "legacy_unversioned"
+  };
+  if (!result.changed) {
+    const doctor = doctorLineageProfile(manifestPath, runtime);
+    if (!doctor.ok) throw new Error("Stable profile runtime upgrade idempotency check did not pass profile doctor");
+    return result;
+  }
+  const operationId = randomUUID();
+  const temporaryPath = join4(profileDirectory, `.profile.runtime-upgrade-${operationId}.tmp`);
+  const rollbackPath = join4(profileDirectory, `.profile.runtime-upgrade-${operationId}.rollback`);
+  let temporaryExists = false;
+  let rollbackExists = false;
+  let published = false;
+  let preserveRollback = false;
+  try {
+    writeFileSync2(temporaryPath, afterText, { encoding: "utf8", flag: "wx", mode: 384 });
+    temporaryExists = true;
+    chmodSync2(temporaryPath, 384);
+    const temporaryFd = openSync(temporaryPath, "r");
+    try {
+      fsyncSync(temporaryFd);
+    } finally {
+      closeSync(temporaryFd);
+    }
+    const preparedReplacement = resolveLineageProfile(temporaryPath);
+    if (runtimeRepinInvariant(preparedReplacement) !== runtimeRepinInvariant(profile)) {
+      throw new Error("Stable profile runtime upgrade would change immutable profile routing identity");
+    }
+    testHooks.beforePublish?.();
+    const currentStats = assertOwnerOnlyPath(manifestPath, "manifest");
+    const currentText = readFileSync3(manifestPath, "utf8");
+    if (!sameFileIdentity(beforeStats, currentStats) || sha256(currentText) !== beforeHash) {
+      throw new Error("Profile manifest changed while stable runtime upgrade was being prepared; refusing replacement");
+    }
+    linkSync(manifestPath, rollbackPath);
+    rollbackExists = true;
+    chmodSync2(rollbackPath, 384);
+    const rollbackStats = assertOwnerOnlyPath(rollbackPath, "manifest");
+    const linkedCurrentStats = assertOwnerOnlyPath(manifestPath, "manifest");
+    if (!sameFileIdentity(rollbackStats, linkedCurrentStats) || readFileSync3(rollbackPath, "utf8") !== beforeText) {
+      throw new Error("Stable profile runtime upgrade could not preserve an exact rollback preimage");
+    }
+    fsyncDirectory(profileDirectory);
+    renameSync(temporaryPath, manifestPath);
+    temporaryExists = false;
+    published = true;
+    fsyncDirectory(profileDirectory);
+    testHooks.afterPublish?.();
+    const replacement = resolveLineageProfile(manifestPath);
+    if (runtimeRepinInvariant(replacement) !== runtimeRepinInvariant(profile)) {
+      throw new Error("Stable profile runtime upgrade changed immutable profile routing identity");
+    }
+    if (readFileSync3(manifestPath, "utf8") !== afterText) {
+      throw new Error("Stable profile runtime upgrade replacement bytes do not match the prepared manifest");
+    }
+    const doctor = doctorLineageProfile(manifestPath, runtime);
+    if (!doctor.ok) {
+      const failures = doctor.checks.filter((check) => check.status === "fail").map((check) => `${check.id}: ${check.message}`).join("; ");
+      throw new Error(`Stable profile runtime upgrade failed post-upgrade profile doctor: ${failures}`);
+    }
+    rmSync(rollbackPath);
+    rollbackExists = false;
+    fsyncDirectory(profileDirectory);
+    return result;
+  } catch (error) {
+    if (published && rollbackExists) {
+      try {
+        if (readFileSync3(manifestPath, "utf8") !== afterText) {
+          throw new Error("published manifest no longer matches the prepared replacement", { cause: error });
+        }
+        renameSync(rollbackPath, manifestPath);
+        rollbackExists = false;
+        fsyncDirectory(profileDirectory);
+        const restoredText = readFileSync3(manifestPath, "utf8");
+        if (restoredText !== beforeText || sha256(restoredText) !== beforeHash) {
+          throw new Error("restored manifest does not match the exact preimage", { cause: error });
+        }
+      } catch (rollbackError) {
+        preserveRollback = true;
+        throw new Error(
+          `Stable profile runtime upgrade failed and automatic rollback could not be proven: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`,
+          { cause: rollbackError }
+        );
+      }
+    }
+    throw error;
+  } finally {
+    if (temporaryExists) rmSync(temporaryPath, { force: true });
+    if (rollbackExists && !preserveRollback) rmSync(rollbackPath, { force: true });
+  }
+}
 function repinLineageDevelopmentProfileRuntime(selector, checkoutRoot, runtime, confirmWrite) {
   if (!confirmWrite) throw new Error("Profile runtime repin requires --confirm-write");
   if (runtime.channel !== "dev") throw new Error(`Profile runtime repin requires dev code, not ${runtime.channel}`);
@@ -1824,6 +2052,21 @@ function lineageDb() {
       where status = 'pending';
     create index if not exists asset_reroll_requests_root_status
       on asset_reroll_requests(project_id, root_asset_id, status, created_at);
+    create table if not exists asset_social_marks (
+      id text primary key,
+      project_id text not null references projects(id),
+      root_asset_id text not null references assets(id),
+      asset_id text not null references assets(id),
+      notes text,
+      marked_by text not null,
+      marked_at text not null,
+      unmarked_by text,
+      unmarked_at text,
+      updated_at text not null,
+      unique(project_id, root_asset_id, asset_id)
+    );
+    create index if not exists asset_social_marks_root_active
+      on asset_social_marks(project_id, root_asset_id, unmarked_at, marked_at);
     create table if not exists asset_reviews (
       asset_id text primary key references assets(id),
       review_state text not null check (review_state in ('unreviewed', 'approved', 'needs_revision', 'rejected', 'ignored')),
@@ -2810,7 +3053,7 @@ function validateAgentClaimForWrite(fields) {
 }
 
 // src/server/assetLineage.ts
-import { join as join7 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join7, resolve as resolve5 } from "node:path";
 
 // src/server/assetLineageSelection.ts
 function selectedRows(database, project, root) {
@@ -3515,6 +3758,11 @@ function collectAssets(project, source) {
   }
   return assets;
 }
+function absoluteLocalPath(localPath) {
+  if (!localPath) return void 0;
+  if (isAbsolute2(localPath)) return localPath;
+  return resolve5(repoRoot, ".asset-scratch", localPath);
+}
 function upsertProject(database, project) {
   const timestamp = nowIso();
   database.prepare(`
@@ -3910,6 +4158,19 @@ function getLineageSnapshot(project, assetId) {
     const request = rerollRequestFrom(row);
     return [request.node_asset_id, withRerollTask(request, lineageTasksByNode.get(request.node_asset_id)?.reroll)];
   }));
+  const hasSocialMarks = database.prepare("select 1 from sqlite_master where type = 'table' and name = 'asset_social_marks'").get() !== void 0;
+  const socialMarkRows = ids.length > 0 && hasSocialMarks ? database.prepare(`select * from asset_social_marks where project_id = ? and root_asset_id = ? and unmarked_at is null and asset_id in (${placeholders})`).all(project, root, ...ids) : [];
+  const socialMarksByNode = new Map(socialMarkRows.map((row) => [String(row.asset_id), {
+    active: true,
+    asset_id: String(row.asset_id),
+    id: String(row.id),
+    marked_at: String(row.marked_at),
+    marked_by: String(row.marked_by),
+    notes: rowString(row.notes),
+    project_id: String(row.project_id),
+    root_asset_id: String(row.root_asset_id),
+    updated_at: String(row.updated_at)
+  }]));
   const childIds = new Set(edges.map((edge) => edge.parent_asset_id));
   const selectedIds = new Set(selected.map((row) => row.asset_id));
   const selections = selected.map((row) => ({
@@ -3929,6 +4190,7 @@ function getLineageSnapshot(project, assetId) {
     const lineageTasks = lineageTasksByNode.get(row.asset_id);
     return {
       ...node,
+      absolute_path: absoluteLocalPath(row.local_path),
       attempt_count: attempts.length,
       current_attempt: currentAttempt,
       is_latest: !childIds.has(row.asset_id),
@@ -3937,6 +4199,7 @@ function getLineageSnapshot(project, assetId) {
       preview_url: canPreviewLocally(row.media_type, previewPath) ? localPreviewUrl(project, previewPath) : void 0,
       reroll_request: rerollsByNode.get(row.asset_id),
       selection_note: nodeSelection?.notes,
+      social_mark: socialMarksByNode.get(row.asset_id),
       user_selected: selectedIds.has(row.asset_id)
     };
   });
@@ -4359,9 +4622,246 @@ function linkSelectedLineageChild(project, fields) {
   };
 }
 
+// src/server/assetSocialMarks.ts
+import { accessSync, constants, existsSync as existsSync8 } from "node:fs";
+import { isAbsolute as isAbsolute3, resolve as resolve6 } from "node:path";
+function markFromRow(row) {
+  return {
+    active: row.unmarked_at === null,
+    asset_id: row.asset_id,
+    id: row.id,
+    marked_at: row.marked_at,
+    marked_by: row.marked_by,
+    notes: row.notes || void 0,
+    project_id: row.project_id,
+    root_asset_id: row.root_asset_id,
+    unmarked_at: row.unmarked_at || void 0,
+    unmarked_by: row.unmarked_by || void 0,
+    updated_at: row.updated_at
+  };
+}
+function requireCanonicalSnapshot(project, rootAssetId) {
+  const snapshot = getLineageSnapshot(project, rootAssetId);
+  if (snapshot.root_asset_id !== rootAssetId) {
+    throw new LineageError(`Asset ${rootAssetId} is not a canonical lineage canvas root`, 400);
+  }
+  return snapshot;
+}
+function resolveVisibleNode(snapshot, asset) {
+  const exactId = snapshot.nodes.find((node) => node.asset_id === asset);
+  if (exactId) return exactId;
+  const title = asset.trim().toLocaleLowerCase();
+  const matches = snapshot.nodes.filter((node) => node.title.trim().toLocaleLowerCase() === title);
+  if (matches.length > 1) throw new LineageError(`Asset title "${asset}" matches multiple visible nodes; use an exact asset ID.`, 409);
+  if (matches.length === 1) return matches[0];
+  throw new LineageError(`Asset ${asset} is not visible in lineage canvas ${snapshot.root_asset_id}`, 404);
+}
+function rootChannel(snapshot) {
+  return snapshot.nodes.find((node) => node.asset_id === snapshot.root_asset_id)?.channel;
+}
+function requireActor(actor, field) {
+  const normalized = actor.trim();
+  if (!normalized) throw new LineageError(`Social mark ${field} is required`);
+  return normalized;
+}
+function socialMarkId(project, rootAssetId, assetId) {
+  return `${project}:${rootAssetId}:social:${assetId}`;
+}
+function activeRow(project, rootAssetId, assetId) {
+  const database = lineageDb();
+  try {
+    return database.prepare(`
+      select * from asset_social_marks
+      where project_id = ? and root_asset_id = ? and asset_id = ? and unmarked_at is null
+    `).get(project, rootAssetId, assetId);
+  } finally {
+    database.close();
+  }
+}
+function mutationResponse(project, rootAssetId, active, mark, dryRun) {
+  return {
+    active,
+    ...dryRun ? { dryRun } : {},
+    ...mark ? { mark } : {},
+    ok: true,
+    snapshot: getLineageSnapshot(project, rootAssetId)
+  };
+}
+function markAssetSocial(project, fields) {
+  const snapshot = requireCanonicalSnapshot(project, fields.rootAssetId);
+  const node = resolveVisibleNode(snapshot, fields.asset);
+  const markedBy = requireActor(fields.markedBy, "markedBy");
+  requireLineageWorkspaceClaimForWrite({
+    channel: rootChannel(snapshot),
+    claimToken: fields.claimToken,
+    confirmWrite: fields.confirmWrite,
+    project,
+    rootAssetId: fields.rootAssetId,
+    writeKind: "social_mark"
+  });
+  const existing = activeRow(project, fields.rootAssetId, node.asset_id);
+  if (existing) return mutationResponse(project, fields.rootAssetId, true, markFromRow(existing), fields.confirmWrite ? void 0 : true);
+  const timestamp = nowIso();
+  const preview = {
+    active: true,
+    asset_id: node.asset_id,
+    id: socialMarkId(project, fields.rootAssetId, node.asset_id),
+    marked_at: timestamp,
+    marked_by: markedBy,
+    notes: fields.notes?.trim() || void 0,
+    project_id: project,
+    root_asset_id: fields.rootAssetId,
+    updated_at: timestamp
+  };
+  if (!fields.confirmWrite) return mutationResponse(project, fields.rootAssetId, true, preview, true);
+  const database = lineageDb();
+  try {
+    database.prepare(`
+      insert into asset_social_marks (
+        id, project_id, root_asset_id, asset_id, notes, marked_by, marked_at,
+        unmarked_by, unmarked_at, updated_at
+      ) values (?, ?, ?, ?, ?, ?, ?, null, null, ?)
+      on conflict(project_id, root_asset_id, asset_id) do update set
+        notes = excluded.notes,
+        marked_by = excluded.marked_by,
+        marked_at = excluded.marked_at,
+        unmarked_by = null,
+        unmarked_at = null,
+        updated_at = excluded.updated_at
+    `).run(
+      preview.id,
+      project,
+      fields.rootAssetId,
+      node.asset_id,
+      preview.notes || null,
+      markedBy,
+      timestamp,
+      timestamp
+    );
+  } finally {
+    database.close();
+  }
+  return mutationResponse(project, fields.rootAssetId, true, markFromRow(activeRow(project, fields.rootAssetId, node.asset_id)));
+}
+function unmarkAssetSocial(project, fields) {
+  const snapshot = requireCanonicalSnapshot(project, fields.rootAssetId);
+  const node = resolveVisibleNode(snapshot, fields.asset);
+  const unmarkedBy = requireActor(fields.unmarkedBy, "unmarkedBy");
+  requireLineageWorkspaceClaimForWrite({
+    channel: rootChannel(snapshot),
+    claimToken: fields.claimToken,
+    confirmWrite: fields.confirmWrite,
+    project,
+    rootAssetId: fields.rootAssetId,
+    writeKind: "social_unmark"
+  });
+  const existing = activeRow(project, fields.rootAssetId, node.asset_id);
+  if (!existing) return mutationResponse(project, fields.rootAssetId, false, void 0, fields.confirmWrite ? void 0 : true);
+  const timestamp = nowIso();
+  const preview = markFromRow({
+    ...existing,
+    unmarked_at: timestamp,
+    unmarked_by: unmarkedBy,
+    updated_at: timestamp
+  });
+  if (!fields.confirmWrite) return mutationResponse(project, fields.rootAssetId, false, preview, true);
+  const database = lineageDb();
+  try {
+    database.prepare(`
+      update asset_social_marks
+      set unmarked_by = ?, unmarked_at = ?, updated_at = ?
+      where project_id = ? and root_asset_id = ? and asset_id = ? and unmarked_at is null
+    `).run(unmarkedBy, timestamp, timestamp, project, fields.rootAssetId, node.asset_id);
+  } finally {
+    database.close();
+  }
+  return mutationResponse(project, fields.rootAssetId, false, preview);
+}
+function absoluteLocalPath2(reference) {
+  if (!reference) return void 0;
+  if (isAbsolute3(reference)) return reference;
+  const repoRelative = resolve6(repoRoot, reference);
+  return existsSync8(repoRelative) || reference === ".asset-scratch" || reference.startsWith(".asset-scratch/") ? repoRelative : resolve6(repoRoot, ".asset-scratch", reference);
+}
+function isReadable(path) {
+  try {
+    accessSync(path, constants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listItem(project, rootAssetId, node, row) {
+  const relativePath = node.current_attempt?.file_path || node.local_path;
+  const absolutePath = absoluteLocalPath2(relativePath);
+  const exists = absolutePath ? existsSync8(absolutePath) : false;
+  const warnings = [];
+  if (absolutePath && !exists) warnings.push(`Asset ${node.asset_id} local file is missing: ${absolutePath}`);
+  if (absolutePath && exists && !isReadable(absolutePath)) {
+    warnings.push(`Asset ${node.asset_id} local file is unreadable: ${absolutePath}. Check file permissions before handoff.`);
+  }
+  if (!absolutePath && node.s3_key) {
+    warnings.push(`Asset ${node.asset_id} is only available in non-local storage; create a readable local copy before handoff.`);
+  }
+  if (!absolutePath && !node.s3_key) warnings.push(`Asset ${node.asset_id} has no local file or storage key.`);
+  const base = `--project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --asset ${shellQuote(node.asset_id)}`;
+  return {
+    ...markFromRow(row),
+    checksum_sha256: node.current_attempt?.checksum_sha256 || node.checksum_sha256,
+    commands: {
+      mark: lineageCliCommand(`social mark ${base} --confirm-write`),
+      unmark: lineageCliCommand(`social unmark ${base} --confirm-write`)
+    },
+    current_attempt: node.current_attempt,
+    local: {
+      absolute_path: absolutePath,
+      exists,
+      relative_path: relativePath
+    },
+    media_type: node.media_type,
+    s3: node.s3_key ? { key: node.s3_key } : void 0,
+    source: node.source,
+    title: node.title,
+    warnings
+  };
+}
+function listAssetSocialMarks(project, rootAssetId) {
+  const snapshot = requireCanonicalSnapshot(project, rootAssetId);
+  const database = lineageDb();
+  let rows;
+  try {
+    const hasSocialMarks = database.prepare("select 1 from sqlite_master where type = 'table' and name = 'asset_social_marks'").get() !== void 0;
+    rows = hasSocialMarks ? database.prepare(`
+        select * from asset_social_marks
+        where project_id = ? and root_asset_id = ? and unmarked_at is null
+        order by marked_at, asset_id
+      `).all(project, rootAssetId) : [];
+  } finally {
+    database.close();
+  }
+  const nodesById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  return {
+    commands: {
+      mark: lineageCliCommand(`social mark --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --asset <asset-id> --confirm-write`)
+    },
+    fetchedAt: nowIso(),
+    marks: rows.flatMap((row) => {
+      const node = nodesById.get(row.asset_id);
+      return node ? [listItem(project, rootAssetId, node, row)] : [];
+    }),
+    project,
+    root_asset_id: rootAssetId,
+    schema_version: "lineage.social_marks.v1",
+    workspace: {
+      id: lineageWorkspaceId(project, rootAssetId),
+      root_asset_id: rootAssetId
+    }
+  };
+}
+
 // src/server/generationReceipts.ts
-import { existsSync as existsSync8, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
-import { relative as relative3, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync9, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { relative as relative3, resolve as resolve7 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/shared/generationOutputManifest.ts
@@ -4896,8 +5396,8 @@ function isPathInside(child, parent) {
   return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
 }
 function scratchCandidate(file) {
-  const scratchRoot = resolve5(repoRoot, ".asset-scratch");
-  const candidate = file.startsWith(".asset-scratch/") || resolve5(file).startsWith(scratchRoot) ? resolve5(repoRoot, file) : resolve5(scratchRoot, file);
+  const scratchRoot = resolve7(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve7(file).startsWith(scratchRoot) ? resolve7(repoRoot, file) : resolve7(scratchRoot, file);
   if (!isPathInside(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
   return { candidate, scratchRoot };
 }
@@ -4907,7 +5407,7 @@ function resolveScratchManifestPath(file) {
 }
 function resolveScratchFile(file) {
   const { candidate, scratchRoot } = scratchCandidate(file);
-  if (!existsSync8(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
+  if (!existsSync9(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
   const realScratchRoot = realpathSync2(scratchRoot);
   const realCandidate = realpathSync2(candidate);
   if (!isPathInside(realCandidate, realScratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
@@ -5151,8 +5651,8 @@ function importImageRerollOutput(project = defaultProject, fields) {
 
 // src/server/lineageSelectionPacket.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync9, statSync as statSync5 } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync10, statSync as statSync5 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve8 } from "node:path";
 var LineageSelectionPacketError = class extends Error {
   constructor(message, warnings = [], errors = [], diagnostics = []) {
     super(message);
@@ -5198,13 +5698,13 @@ function resolveWorkspace(project, options) {
 }
 function resolveLocalReference(reference) {
   if (!reference) return void 0;
-  if (isAbsolute2(reference)) return reference;
-  const repoRelative = resolve6(repoRoot, reference);
-  if (existsSync9(repoRelative)) return repoRelative;
-  return resolve6(repoRoot, ".asset-scratch", reference);
+  if (isAbsolute4(reference)) return reference;
+  const repoRelative = resolve8(repoRoot, reference);
+  if (existsSync10(repoRelative)) return repoRelative;
+  return resolve8(repoRoot, ".asset-scratch", reference);
 }
 function fileSize(path) {
-  if (!path || !existsSync9(path)) return void 0;
+  if (!path || !existsSync10(path)) return void 0;
   try {
     return statSync5(path).size;
   } catch {
@@ -5232,7 +5732,7 @@ function currentAttemptFor(node) {
 function assetForNode(node, catalogAsset, warnings) {
   const localReference = catalogAsset?.local?.absolute_path || node.current_attempt?.file_path || node.local_path || catalogAsset?.local?.relative_path;
   const absolutePath = catalogAsset?.local?.absolute_path || resolveLocalReference(localReference);
-  const localExists = absolutePath ? existsSync9(absolutePath) : false;
+  const localExists = absolutePath ? existsSync10(absolutePath) : false;
   const hasLocalClaim = Boolean(absolutePath || node.local_path || catalogAsset?.local?.relative_path);
   const s3Key = catalogAsset?.s3?.key || node.s3_key;
   const hasS3 = Boolean(s3Key);
@@ -5389,7 +5889,7 @@ function assetForNodeV2(node, visibleCatalogAsset, catalogById, warnings, errors
   const mediaCatalogAsset = currentAttemptCatalogAsset || (isVisibleNodeAttempt ? visibleCatalogAsset : void 0);
   const localReference = currentAttempt.file_path || mediaCatalogAsset?.local?.absolute_path || mediaCatalogAsset?.local?.relative_path || (isVisibleNodeAttempt ? node.local_path : void 0);
   const absolutePath = resolveLocalReference(localReference);
-  const localExists = absolutePath ? existsSync9(absolutePath) : false;
+  const localExists = absolutePath ? existsSync10(absolutePath) : false;
   const hasLocalClaim = Boolean(localReference);
   const s3Key = mediaCatalogAsset?.s3?.key || (isVisibleNodeAttempt ? node.s3_key : void 0);
   const hasS3 = Boolean(s3Key);
@@ -5655,8 +6155,8 @@ function getLineageSelectionPacket(project, options = {}) {
 // src/server/runtimeInfo.ts
 import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync10, lstatSync as lstatSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, readlinkSync, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join9, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync11, lstatSync as lstatSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, readlinkSync, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute5, join as join9, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/shared/runtimeInfoTypes.ts
@@ -5675,7 +6175,7 @@ function isLineagePackageRoot(root) {
 }
 function executingCodeRoot() {
   const moduleDirectory = dirname5(fileURLToPath2(import.meta.url));
-  const candidates = [resolve7(moduleDirectory, "../.."), resolve7(moduleDirectory, "..")];
+  const candidates = [resolve9(moduleDirectory, "../.."), resolve9(moduleDirectory, "..")];
   const root = candidates.find(isLineagePackageRoot);
   if (!root) throw new Error(`Unable to derive Lineage code root from executing module ${fileURLToPath2(import.meta.url)}`);
   return canonicalRoot(root);
@@ -5688,7 +6188,7 @@ function canonicalRoot(root) {
   try {
     return realpathSync3(root);
   } catch {
-    return resolve7(root);
+    return resolve9(root);
   }
 }
 function packageInfo(root = codeRoot) {
@@ -5788,7 +6288,7 @@ function readInstallReceipt(path, errors) {
     return void 0;
   }
   let receipt;
-  const receiptPath = resolve7(path);
+  const receiptPath = resolve9(path);
   try {
     receipt = JSON.parse(readFileSync5(receiptPath, "utf8"));
   } catch (error) {
@@ -5796,7 +6296,7 @@ function readInstallReceipt(path, errors) {
     return void 0;
   }
   if (receipt.schema_version !== lineageRuntimeInstallSchemaVersion) errors.push(`Unsupported runtime install receipt schema: ${String(receipt.schema_version)}`);
-  if (!isAbsolute3(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
+  if (!isAbsolute5(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
   if (!receipt.package_integrity?.startsWith("sha512-")) errors.push("Runtime install receipt package integrity is invalid");
   if (receipt.package_source !== "registry" && receipt.package_source !== "local") errors.push("Runtime install receipt package source is invalid");
   if (typeof receipt.package_spec !== "string" || !receipt.package_spec) errors.push("Runtime install receipt package spec is invalid");
@@ -5877,8 +6377,8 @@ function packageCodeIdentity(root, channel, info, receiptPath) {
 function getLineageCodeIdentity(channel, options = {}) {
   const root = canonicalRoot(options.root || codeRoot);
   const info = packageInfo(root);
-  if (existsSync10(join9(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
-  if (existsSync10(join9(root, "package.json"))) {
+  if (existsSync11(join9(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
+  if (existsSync11(join9(root, "package.json"))) {
     return packageCodeIdentity(root, channel, info, options.receiptPath ?? process.env.LINEAGE_RUNTIME_RECEIPT);
   }
   const errors = [`Code root has neither checkout metadata nor package.json: ${root}`];
@@ -5917,7 +6417,7 @@ function getLineageRuntimeInfo(options = {}) {
   const dbPath = options.dbPath || lineageDbPath();
   const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
   const code = options.code || getLineageCodeIdentity(channel);
-  const databaseInfo = { exists: existsSync10(dbPath), path: dbPath };
+  const databaseInfo = { exists: existsSync11(dbPath), path: dbPath };
   const schema = { migration_keys: [] };
   const serviceInstanceId = process.env.LINEAGE_SERVICE_INSTANCE_ID;
   const launcherPid = process.env.LINEAGE_LAUNCHER_PID ? Number(process.env.LINEAGE_LAUNCHER_PID) : void 0;
@@ -6074,7 +6574,7 @@ var signalExitCodes = {
   SIGTERM: 143
 };
 function packageRoot2() {
-  return resolve8(dirname6(fileURLToPath3(import.meta.url)), "..", "..");
+  return resolve10(dirname6(fileURLToPath3(import.meta.url)), "..", "..");
 }
 function packageVersion() {
   try {
@@ -6113,7 +6613,7 @@ function readOptions(args, name) {
 }
 function readJsonFile(path, label) {
   try {
-    return JSON.parse(readFileSync6(resolve8(path), "utf8"));
+    return JSON.parse(readFileSync6(resolve10(path), "utf8"));
   } catch (error) {
     throw new Error(`${label} must be a readable JSON file: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
@@ -6157,7 +6657,7 @@ function resolveStartOptions(config, args) {
   };
 }
 function resolveCliAssetRoot(args) {
-  return resolve8(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
+  return resolve10(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
 }
 function configureCliAssetRoot(args) {
   const assetRoot = resolveCliAssetRoot(args);
@@ -6189,10 +6689,10 @@ function prepareCliProfile(config, args) {
   if (hasOption(args, "--db")) throw new Error("A named profile cannot be combined with --db");
   if (hasOption(args, "--asset-root")) throw new Error("A named profile cannot be combined with --asset-root");
   const profile = resolveLineageProfile(selector);
-  if (process.env.LINEAGE_DB && resolve8(process.env.LINEAGE_DB) !== profile.database_path) {
+  if (process.env.LINEAGE_DB && resolve10(process.env.LINEAGE_DB) !== profile.database_path) {
     throw new Error(`Profile ${profile.profile_id} database_path conflicts with LINEAGE_DB`);
   }
-  if (process.env.LINEAGE_ASSET_ROOT && resolve8(process.env.LINEAGE_ASSET_ROOT) !== profile.asset_root) {
+  if (process.env.LINEAGE_ASSET_ROOT && resolve10(process.env.LINEAGE_ASSET_ROOT) !== profile.asset_root) {
     throw new Error(`Profile ${profile.profile_id} asset_root conflicts with LINEAGE_ASSET_ROOT`);
   }
   assertProfileChannel(profile, config.channel);
@@ -6221,6 +6721,7 @@ Usage:
   ${config.binName} profile clone --source-db <snapshot-source> --target-profile <id-or-manifest> --confirm-write [--json]
   ${config.binName} profile clone-assets --source-asset-root <path> --target-profile <id-or-manifest> --confirm-write [--json]
   ${config.binName} profile repin-runtime --profile <development-profile> --checkout-root <path> --confirm-write [--json]
+  ${config.binName} profile upgrade-runtime --profile <production-profile> --confirm-write [--json]
   ${config.binName} runtime info [--json]
   ${config.binName} runtime doctor [--json]
   ${config.binName} next [--project <project>] [--root <asset-id>] [--db <path>] [--json]
@@ -6237,6 +6738,9 @@ Usage:
   ${config.binName} reroll cancel --root <asset-id> --target <asset-id> [--project <project>] [--confirm-write] [--db <path>] [--json]
   ${config.binName} reroll plan --root <asset-id> --target <asset-id> --prompt <text> [--project <project>] [--db <path>] [--json]
   ${config.binName} reroll import --job-id <job-id> --file <scratch-file> --confirm-write [--project <project>] [--db <path>] [--json]
+  ${config.binName} social list --project <project> --root <asset-id> [--db <path>] [--json]
+  ${config.binName} social mark --project <project> --root <asset-id> --asset <asset-id-or-exact-title> --confirm-write [--actor <actor>] [--notes <text>] [--claim-token <claim-id.secret>] [--db <path>] [--json]
+  ${config.binName} social unmark --project <project> --root <asset-id> --asset <asset-id-or-exact-title> --confirm-write [--actor <actor>] [--claim-token <claim-id.secret>] [--db <path>] [--json]
   ${config.binName} tasks list --root <asset-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} tasks inspect --task <task-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} tasks claim --task <task-id> --agent-name <name> [--project <project>] [--db <path>] [--json]
@@ -6293,7 +6797,7 @@ function lineageServiceIdentityErrors(runtime, expected) {
   if (runtime.channel !== expected.channel) errors.push(`channel ${runtime.channel} != ${expected.channel}`);
   if (!runtime.code?.verified) errors.push("service code identity is not verified");
   if (runtime.code?.fingerprint !== expected.code_fingerprint) errors.push(`code fingerprint ${runtime.code?.fingerprint || "missing"} != ${expected.code_fingerprint}`);
-  if (resolve8(runtime.database.path) !== resolve8(expected.database_path)) errors.push(`database ${runtime.database.path} != ${expected.database_path}`);
+  if (resolve10(runtime.database.path) !== resolve10(expected.database_path)) errors.push(`database ${runtime.database.path} != ${expected.database_path}`);
   if (runtime.service?.instance_id !== expected.instance_id) errors.push(`service instance ${runtime.service?.instance_id || "missing"} != ${expected.instance_id}`);
   if (runtime.service?.launcher_pid !== expected.launcher_pid) errors.push(`launcher pid ${runtime.service?.launcher_pid || "missing"} != ${expected.launcher_pid}`);
   if (expected.profile) {
@@ -6388,7 +6892,7 @@ function runLineageDataCommand(command, args) {
     });
     const out = readOption(args, "--out");
     if (out) {
-      const outPath = resolve8(out);
+      const outPath = resolve10(out);
       mkdirSync6(dirname6(outPath), { recursive: true });
       writeFileSync4(outPath, `${JSON.stringify(packet, null, 2)}
 `);
@@ -6499,6 +7003,35 @@ function runLineageDataCommand(command, args) {
     }
     throw new Error(`Unknown reroll command: ${subcommand}`);
   }
+  if (command === "social") {
+    const subcommand = positionalArgs(args)[0] || "";
+    const explicitProject = readOption(args, "--project");
+    const asset = readOption(args, "--asset");
+    if (!explicitProject) throw new Error(`lineage social ${subcommand || "command"} requires --project`);
+    if (!options.rootAssetId) throw new Error(`lineage social ${subcommand || "command"} requires --root`);
+    if (subcommand === "list") return listAssetSocialMarks(explicitProject, options.rootAssetId);
+    if (!asset) throw new Error(`lineage social ${subcommand || "command"} requires --asset`);
+    if (subcommand === "mark") {
+      return markAssetSocial(explicitProject, {
+        asset,
+        claimToken: options.claimToken,
+        confirmWrite: options.confirmWrite,
+        markedBy: readOption(args, "--actor") || "agent",
+        notes: readOption(args, "--notes"),
+        rootAssetId: options.rootAssetId
+      });
+    }
+    if (subcommand === "unmark") {
+      return unmarkAssetSocial(explicitProject, {
+        asset,
+        claimToken: options.claimToken,
+        confirmWrite: options.confirmWrite,
+        rootAssetId: options.rootAssetId,
+        unmarkedBy: readOption(args, "--actor") || "agent"
+      });
+    }
+    throw new Error(`Unknown social command: ${subcommand}`);
+  }
   if (command === "tasks") {
     const subcommand = positionalArgs(args)[0] || "";
     const taskId = readOption(args, "--task");
@@ -6628,6 +7161,20 @@ function printDataResult(command, result, json) {
       return;
     }
   }
+  if (command === "social" && result && typeof result === "object") {
+    if ("marks" in result) {
+      const listed = result;
+      console.log(`${listed.marks.length} social-marked asset(s)`);
+      for (const mark of listed.marks) {
+        console.log(`${mark.asset_id}: ${mark.title}`);
+        for (const warning of mark.warnings || []) console.log(`Warning: ${warning}`);
+      }
+      return;
+    }
+    const mutation = result;
+    console.log(`${mutation.dryRun ? "Dry run: " : ""}${mutation.active ? "Marked" : "Unmarked"} ${mutation.mark?.asset_id || "asset"} for social`);
+    return;
+  }
   if (command === "tasks" && result && typeof result === "object") {
     if ("tasks" in result) {
       const listed = result;
@@ -6716,6 +7263,30 @@ function runLineageProfileCommand(config, command, args) {
       writerLease.release();
     }
   }
+  if (command === "upgrade-runtime") {
+    if (!args.includes("--confirm-write")) throw new Error("Profile runtime upgrade requires --confirm-write");
+    for (const option of [
+      "--checkout-root",
+      "--code-fingerprint",
+      "--code-root",
+      "--from-code-fingerprint",
+      "--git-sha",
+      "--runtime-receipt",
+      "--runtime-root",
+      "--to-code-fingerprint",
+      "--to-version",
+      "--version"
+    ]) {
+      if (hasOption(args, option)) throw new Error(`Profile runtime upgrade derives its target from the executing stable package and does not accept ${option}`);
+    }
+    const profile = resolveLineageProfile(selector);
+    const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
+    try {
+      return upgradeLineageStableProfileRuntime(selector, runtimeIdentity, true);
+    } finally {
+      writerLease.release();
+    }
+  }
   if (command === "bind") {
     if (!args.includes("--confirm-write")) throw new Error("Profile bind requires --confirm-write");
     const profile = resolveLineageProfile(selector);
@@ -6747,6 +7318,9 @@ function printProfileResult(result, json) {
   } else if (result.schema_version === "lineage.profile_runtime_repin_receipt.v1") {
     console.log(`${result.changed ? "Repinned" : "Already pinned"} ${result.profile_id} to checkout ${result.checkout_root}`);
     console.log(`Code fingerprint: ${result.new_code_fingerprint}`);
+  } else if (result.schema_version === "lineage.profile_runtime_upgrade_receipt.v1") {
+    console.log(`${result.changed ? "Upgraded" : "Already pinned"} ${result.profile_id} to stable ${result.new_runtime.version}`);
+    console.log(`Code fingerprint: ${result.new_runtime.code_fingerprint}`);
   } else {
     console.log(`Cloned ${result.files_copied} referenced asset file(s) into ${result.asset_root}`);
     console.log(`Receipt: ${result.receipt_path}`);
@@ -6781,6 +7355,7 @@ function lineageCliRequiresWriterLease(command, args) {
   const subcommand = positions[0] || "";
   if (command === "generate") return positions[0] !== "image" || positions[1] !== "inspect";
   if (command === "reroll") return subcommand !== "list";
+  if (command === "social") return subcommand !== "list";
   if (command === "tasks") return subcommand !== "list" && subcommand !== "inspect";
   if (command === "db") return subcommand !== "info";
   if (command === "agent") return subcommand !== "status" && subcommand !== "graph" && subcommand !== "inspect";
@@ -6954,7 +7529,7 @@ function start(config, args) {
     process.exit(1);
   }
   const serverPath = join10(packageRoot2(), "dist", "server.js");
-  if (!existsSync11(serverPath)) {
+  if (!existsSync12(serverPath)) {
     const message = `Missing bundled server at ${serverPath}. Run npm run build before using ${config.binName} start from a source checkout.`;
     if (options.json) console.error(JSON.stringify({ ok: false, error: message }, null, 2));
     else console.error(`${config.binName}: ${message}`);
@@ -7118,7 +7693,7 @@ async function runLineageCli(config, args = process.argv.slice(2)) {
     else console.error(`${config.binName}: ${message2}`);
     process.exit(1);
   }
-  if (command === "next" || command === "brief" || command === "inspect" || command === "selection" || command === "link-child" || command === "generate" || command === "reroll" || command === "tasks") {
+  if (command === "next" || command === "brief" || command === "inspect" || command === "selection" || command === "link-child" || command === "generate" || command === "reroll" || command === "social" || command === "tasks") {
     const commandArgs = normalizedArgs.slice(1);
     const json2 = commandArgs.includes("--json");
     try {