@mean-weasel/lineage 0.1.6 → 0.1.8

package/dist/server.js

@@ -328,6 +328,10 @@ function lineageDb() {
     create index if not exists assets_project_source_seen on assets(project_id, source, last_seen_at);
     create index if not exists assets_project_checksum on assets(project_id, checksum_sha256);
     create index if not exists assets_project_channel_campaign on assets(project_id, channel, campaign);
+    create table if not exists lineage_schema_migrations (
+      key text primary key,
+      applied_at text not null
+    );
     create table if not exists asset_edges (
       id text primary key,
       project_id text not null references projects(id),
@@ -633,12 +637,49 @@ function lineageDb() {
     );
     create index if not exists generation_job_receipts_job on generation_job_receipts(job_id, created_at);
     create table if not exists adapter_settings (project_id text not null references projects(id), adapter_type text not null check (adapter_type in ('cloud', 'scheduler', 'image_generator')), provider text not null, enabled integer not null check (enabled in (0, 1)), secret_ref text, safe_config_json text not null, created_at text not null, updated_at text not null, primary key(project_id, adapter_type, provider)); create index if not exists adapter_settings_project_type on adapter_settings(project_id, adapter_type);
+    create table if not exists lineage_tasks (
+      id text primary key,
+      project_id text not null references projects(id),
+      root_asset_id text not null references assets(id),
+      target_asset_id text not null references assets(id),
+      task_type text not null check (task_type in ('iterate', 'reroll')),
+      status text not null check (status in ('pending', 'claimed', 'in_progress', 'resolved', 'cancelled')),
+      instructions text,
+      created_by text not null check (created_by in ('human', 'agent', 'system')),
+      created_at text not null,
+      updated_at text not null,
+      claimed_at text,
+      started_at text,
+      resolved_at text,
+      cancelled_at text,
+      resolved_generation_job_id text,
+      resolved_asset_id text references assets(id),
+      metadata_json text
+    );
+    create unique index if not exists lineage_tasks_one_open
+      on lineage_tasks(project_id, root_asset_id, target_asset_id, task_type)
+      where status in ('pending', 'claimed', 'in_progress');
+    create index if not exists lineage_tasks_root_status
+      on lineage_tasks(project_id, root_asset_id, status, updated_at);
+    create index if not exists lineage_tasks_target
+      on lineage_tasks(project_id, root_asset_id, target_asset_id, task_type, status);
+    create table if not exists lineage_task_events (
+      id text primary key,
+      task_id text not null references lineage_tasks(id) on delete cascade,
+      event_type text not null,
+      actor text,
+      message text,
+      created_at text not null,
+      metadata_json text
+    );
+    create index if not exists lineage_task_events_task_created
+      on lineage_task_events(task_id, created_at);
     create table if not exists agent_claims (
       id text primary key,
       token_hash text not null,
       project_id text not null references projects(id),
       channel text,
-      scope_type text not null check (scope_type in ('lineage_workspace', 'content_post', 'content_queue_lane', 'selection_set', 'project_channel')),
+      scope_type text not null check (scope_type in ('lineage_workspace', 'lineage_task', 'content_post', 'content_queue_lane', 'selection_set', 'project_channel')),
       target_id text not null,
       target_title text,
       agent_id text,
@@ -672,13 +713,76 @@ function lineageDb() {
   migrateAssetSelections(database);
   dropLegacyAssetSelectionRootUnique(database);
   ensureColumn(database, "asset_selections", "notes", "text");
+  backfillLineageTasks(database);
   ensureColumn(database, "asset_ledger_records", "first_seen_at", "text");
   ensureColumn(database, "asset_ledger_records", "indexed_by_run_id", "text");
   ensureColumn(database, "asset_ledger_sources", "first_seen_at", "text");
   ensureColumn(database, "asset_ledger_sources", "indexed_by_run_id", "text");
   ensureReviewStateValues(database);
+  ensureAgentClaimScopeValues(database);
+  ensureGenerationReceiptCheckValues(database);
   return database;
 }
+function backfillLineageTasks(database) {
+  database.exec(`
+    create table if not exists lineage_schema_migrations (
+      key text primary key,
+      applied_at text not null
+    )
+  `);
+  const marker = database.prepare("select key from lineage_schema_migrations where key = 'lineage_tasks_backfilled_v1'").get();
+  if (marker) return;
+  database.exec("BEGIN IMMEDIATE");
+  try {
+    database.exec(`
+      insert or ignore into lineage_tasks (
+        id, project_id, root_asset_id, target_asset_id, task_type, status, instructions,
+        created_by, created_at, updated_at, metadata_json
+      )
+      select
+        s.project_id || ':' || s.root_asset_id || ':lineage-task:iterate:' || s.asset_id,
+        s.project_id,
+        s.root_asset_id,
+        s.asset_id,
+        'iterate',
+        'pending',
+        s.notes,
+        'human',
+        s.selected_at,
+        s.selected_at,
+        null
+      from asset_selections s;
+
+      insert or ignore into lineage_tasks (
+        id, project_id, root_asset_id, target_asset_id, task_type, status, instructions,
+        created_by, created_at, updated_at, metadata_json
+      )
+      select
+        r.project_id || ':' || r.root_asset_id || ':lineage-task:reroll:' || r.node_asset_id,
+        r.project_id,
+        r.root_asset_id,
+        r.node_asset_id,
+        'reroll',
+        'pending',
+        r.notes,
+        r.requested_by,
+        r.created_at,
+        r.created_at,
+        null
+      from asset_reroll_requests r
+      where r.status = 'pending';
+    `);
+    database.prepare(`
+      insert into lineage_schema_migrations (key, applied_at)
+      values ('lineage_tasks_backfilled_v1', ?)
+      on conflict(key) do nothing
+    `).run(nowIso());
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
+}
 function ensureColumn(database, table, column, definition) {
   const rows = database.prepare(`pragma table_info(${table})`).all();
   if (!rows.some((row) => row.name === column)) database.exec(`alter table ${table} add column ${column} ${definition}`);
@@ -742,6 +846,132 @@ function ensureReviewStateValues(database) {
     drop table asset_reviews_old;
   `);
 }
+function ensureAgentClaimScopeValues(database) {
+  const createSql = database.prepare("select sql from sqlite_master where type = 'table' and name = 'agent_claims'").get();
+  if (createSql?.sql?.includes("'lineage_task'")) return;
+  database.exec("PRAGMA foreign_keys = OFF; PRAGMA legacy_alter_table = ON; BEGIN IMMEDIATE");
+  try {
+    database.exec(`
+      alter table agent_claims rename to agent_claims_old;
+      create table agent_claims (
+        id text primary key,
+        token_hash text not null,
+        project_id text not null references projects(id),
+        channel text,
+        scope_type text not null check (scope_type in ('lineage_workspace', 'lineage_task', 'content_post', 'content_queue_lane', 'selection_set', 'project_channel')),
+        target_id text not null,
+        target_title text,
+        agent_id text,
+        agent_name text not null,
+        agent_kind text not null,
+        thread_id text,
+        status text not null check (status in ('active', 'expired', 'released', 'revoked', 'transferred')),
+        created_at text not null,
+        heartbeat_at text not null,
+        expires_at text not null,
+        released_at text,
+        revoked_at text,
+        revoked_by text,
+        override_reason text,
+        metadata_json text
+      );
+      insert into agent_claims
+      select * from agent_claims_old;
+      drop table agent_claims_old;
+      create unique index if not exists agent_claims_token_hash on agent_claims(token_hash);
+      create index if not exists agent_claims_project_status on agent_claims(project_id, status, heartbeat_at);
+      create index if not exists agent_claims_target on agent_claims(project_id, channel, scope_type, target_id, status);
+    `);
+    const violations = database.prepare("pragma foreign_key_check").all();
+    if (violations.length > 0) throw new Error(`Agent claim scope migration failed foreign key check: ${JSON.stringify(violations)}`);
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  } finally {
+    database.exec("PRAGMA legacy_alter_table = OFF; PRAGMA foreign_keys = ON");
+  }
+}
+function tableCreateSql(database, table) {
+  const row = database.prepare("select sql from sqlite_master where type = 'table' and name = ?").get(table);
+  return row?.sql || "";
+}
+function ensureGenerationReceiptCheckValues(database) {
+  const jobsSql = tableCreateSql(database, "generation_jobs");
+  const inputsSql = tableCreateSql(database, "generation_job_inputs");
+  const needsJobsMigration = Boolean(jobsSql && !jobsSql.includes("'lineage_reroll'"));
+  const needsInputsMigration = Boolean(inputsSql && !inputsSql.includes("'reroll_target'"));
+  if (!needsJobsMigration && !needsInputsMigration) return;
+  database.exec("PRAGMA foreign_keys = OFF; PRAGMA legacy_alter_table = ON; BEGIN IMMEDIATE");
+  try {
+    if (needsJobsMigration) migrateGenerationJobsCheck(database);
+    if (needsInputsMigration) migrateGenerationJobInputsCheck(database);
+    const violations = database.prepare("pragma foreign_key_check").all();
+    if (violations.length > 0) throw new Error(`Generation receipt migration failed foreign key check: ${JSON.stringify(violations)}`);
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  } finally {
+    database.exec("PRAGMA legacy_alter_table = OFF; PRAGMA foreign_keys = ON");
+  }
+}
+function migrateGenerationJobsCheck(database) {
+  database.exec(`
+    alter table generation_jobs rename to generation_jobs_legacy_check;
+    create table generation_jobs (
+      id text primary key,
+      project_id text not null references projects(id),
+      provider text not null default 'codex-handoff',
+      adapter_version text not null,
+      source_mode text not null check (source_mode in ('lineage_selection', 'lineage_reroll')),
+      root_asset_id text not null references assets(id),
+      prompt text not null,
+      expected_output_count integer not null check (expected_output_count > 0),
+      status text not null check (status in ('planned', 'imported', 'failed', 'cancelled')),
+      output_dir text,
+      handoff_json text,
+      created_at text not null,
+      updated_at text not null,
+      imported_at text
+    );
+    insert into generation_jobs (
+      id, project_id, provider, adapter_version, source_mode, root_asset_id, prompt,
+      expected_output_count, status, output_dir, handoff_json, created_at, updated_at, imported_at
+    )
+    select
+      id, project_id, provider, adapter_version, source_mode, root_asset_id, prompt,
+      expected_output_count, status, output_dir, handoff_json, created_at, updated_at, imported_at
+    from generation_jobs_legacy_check;
+    drop table generation_jobs_legacy_check;
+    create index if not exists generation_jobs_project_created on generation_jobs(project_id, created_at);
+  `);
+}
+function migrateGenerationJobInputsCheck(database) {
+  database.exec(`
+    alter table generation_job_inputs rename to generation_job_inputs_legacy_check;
+    create table generation_job_inputs (
+      id text primary key,
+      job_id text not null references generation_jobs(id) on delete cascade,
+      project_id text not null references projects(id),
+      asset_id text not null references assets(id),
+      root_asset_id text not null references assets(id),
+      role text not null check (role in ('lineage_next_base', 'reference', 'reroll_target')),
+      position integer not null,
+      selection_strategy text not null,
+      selection_snapshot_json text not null,
+      unique(job_id, asset_id, role)
+    );
+    insert into generation_job_inputs (
+      id, job_id, project_id, asset_id, root_asset_id, role, position, selection_strategy, selection_snapshot_json
+    )
+    select
+      id, job_id, project_id, asset_id, root_asset_id, role, position, selection_strategy, selection_snapshot_json
+    from generation_job_inputs_legacy_check;
+    drop table generation_job_inputs_legacy_check;
+    create index if not exists generation_job_inputs_job on generation_job_inputs(job_id, position);
+  `);
+}
 
 // src/server/assetLedgerWorkflow.ts
 function ensureProject(database, project) {
@@ -1355,327 +1585,440 @@ function normalizeSelectionInput(fields) {
   return [...new Set([...fields.assetIds || [], fields.assetId || ""].map((assetId) => assetId.trim()).filter(Boolean))];
 }
 
-// src/server/assetLineageWorkspaces.ts
-var actors = /* @__PURE__ */ new Set(["human", "agent", "system"]);
-var statuses = /* @__PURE__ */ new Set(["active", "paused", "archived"]);
-var LineageWorkspaceError = class extends Error {
-  constructor(message, status = 400) {
+// src/server/assetLineageTasks.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+
+// src/server/agentClaims.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+var defaultTtlSeconds = 20 * 60;
+var idleAfterSeconds = 5 * 60;
+var staleAfterSeconds = 15 * 60;
+var scopes = /* @__PURE__ */ new Set(["lineage_workspace", "lineage_task", "content_post", "content_queue_lane", "selection_set", "project_channel"]);
+var AgentClaimError = class extends Error {
+  constructor(message, status = 400, code = "agent_claim_error", conflicts = []) {
     super(message);
     this.status = status;
+    this.code = code;
+    this.conflicts = conflicts;
   }
   status;
+  code;
+  conflicts;
 };
-function isLineageWorkspaceError(error) {
-  return error instanceof LineageWorkspaceError;
+function isAgentClaimError(error) {
+  return error instanceof AgentClaimError;
 }
-function lineageWorkspaceId(project, rootAssetId) {
-  return `${project}:lineage-workspace:${rootAssetId}`;
+function parseClaimTtl(value) {
+  if (!value) return defaultTtlSeconds;
+  const match = value.trim().match(/^(\d+)(s|m|h)?$/);
+  if (!match) throw new AgentClaimError(`Invalid claim ttl: ${value}`);
+  const amount = Number(match[1]);
+  const unit = match[2] || "s";
+  const multiplier = unit === "h" ? 3600 : unit === "m" ? 60 : 1;
+  const seconds = amount * multiplier;
+  if (!Number.isInteger(seconds) || seconds < 30 || seconds > 24 * 60 * 60) {
+    throw new AgentClaimError("Claim ttl must be between 30 seconds and 24 hours");
+  }
+  return seconds;
 }
-function ensureProject2(database, project) {
-  const timestamp = nowIso();
-  database.prepare(`
-    insert into projects (id, product, created_at, updated_at)
-    values (?, ?, ?, ?)
-    on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, timestamp, timestamp);
+function randomId(prefix) {
+  return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
-function normalizeStatus(value, fallback) {
-  const status = value || fallback;
-  if (!statuses.has(status)) throw new LineageWorkspaceError(`Unsupported lineage workspace status: ${status}`);
-  return status;
+function tokenHash(token) {
+  return createHash2("sha256").update(token).digest("hex");
 }
-function normalizeActor(value) {
-  const actor = value || "human";
-  if (!actors.has(actor)) throw new LineageWorkspaceError(`Unsupported lineage workspace actor: ${actor}`);
-  return actor;
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
 }
-function requireAsset(database, project, assetId) {
-  const row = database.prepare("select id, title from assets where project_id = ? and id = ?").get(project, assetId);
-  if (!row) throw new LineageWorkspaceError(`Unknown indexed asset: ${assetId}`, 404);
-  return row;
+function expiresAtFrom(timestamp, ttlSeconds) {
+  return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
 }
-function rowToWorkspace(row) {
+function metadataJson(metadata2) {
+  return metadata2 ? JSON.stringify(metadata2) : null;
+}
+function parseMetadata(value) {
+  if (typeof value !== "string" || !value) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function derivedState(row, now = /* @__PURE__ */ new Date()) {
+  if (row.status !== "active") return row.status === "expired" ? "expired" : "stale";
+  if (new Date(row.expires_at).getTime() <= now.getTime()) return "expired";
+  const ageSeconds = Math.max(0, Math.floor((now.getTime() - new Date(row.heartbeat_at).getTime()) / 1e3));
+  if (ageSeconds >= staleAfterSeconds) return "stale";
+  if (ageSeconds >= idleAfterSeconds) return "idle";
+  return "active";
+}
+function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
+  const heartbeatAt = String(row.heartbeat_at);
   return {
     id: String(row.id),
     project: String(row.project_id),
-    root_asset_id: String(row.root_asset_id),
-    title: String(row.title),
+    channel: typeof row.channel === "string" ? row.channel : void 0,
+    scope_type: String(row.scope_type),
+    target_id: String(row.target_id),
+    target_title: typeof row.target_title === "string" ? row.target_title : void 0,
+    agent_id: typeof row.agent_id === "string" ? row.agent_id : void 0,
+    agent_name: String(row.agent_name),
+    agent_kind: String(row.agent_kind),
+    thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
     status: String(row.status),
-    notes: typeof row.notes === "string" ? row.notes : void 0,
-    created_by: String(row.created_by),
-    active_at: typeof row.active_at === "string" ? row.active_at : void 0,
     created_at: String(row.created_at),
-    updated_at: String(row.updated_at)
+    heartbeat_at: heartbeatAt,
+    expires_at: String(row.expires_at),
+    released_at: typeof row.released_at === "string" ? row.released_at : void 0,
+    revoked_at: typeof row.revoked_at === "string" ? row.revoked_at : void 0,
+    revoked_by: typeof row.revoked_by === "string" ? row.revoked_by : void 0,
+    override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
+    metadata: parseMetadata(row.metadata_json),
+    heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
+    derived_state: derivedState({
+      expires_at: String(row.expires_at),
+      heartbeat_at: heartbeatAt,
+      status: String(row.status)
+    }, now)
   };
 }
-function workspaceById(database, project, id) {
-  const row = database.prepare("select * from lineage_workspaces where project_id = ? and id = ?").get(project, id);
-  return row ? rowToWorkspace(row) : null;
+function eventToRow(row) {
+  return {
+    claim_id: String(row.claim_id),
+    event_type: String(row.event_type),
+    actor: typeof row.actor === "string" ? row.actor : void 0,
+    message: typeof row.message === "string" ? row.message : void 0,
+    created_at: String(row.created_at),
+    metadata: parseMetadata(row.metadata_json)
+  };
 }
-function workspaceByRoot(database, project, rootAssetId) {
-  const row = database.prepare("select * from lineage_workspaces where project_id = ? and root_asset_id = ?").get(project, rootAssetId);
-  return row ? rowToWorkspace(row) : null;
+function ensureProject2(database, project) {
+  const timestamp = nowIso();
+  database.prepare(`
+    insert into projects (id, product, created_at, updated_at)
+    values (?, ?, ?, ?)
+    on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
+  `).run(project, project, timestamp, timestamp);
 }
-function knownRoots(database, project) {
-  const rows = database.prepare(`
-    select root_asset_id, max(selected_at) selected_at from asset_selections where project_id = ? group by root_asset_id
-    union
-    select root_asset_id, null selected_at from asset_layouts where project_id = ? group by root_asset_id
-    union
-    select parent_asset_id root_asset_id, null selected_at
-    from asset_edges
-    where project_id = ?
-      and parent_asset_id not in (select child_asset_id from asset_edges where project_id = ?)
-    group by parent_asset_id
-  `).all(project, project, project, project);
-  return rows.map((row) => ({ root_asset_id: row.root_asset_id, selected_at: row.selected_at || void 0 }));
+function recordEvent(database, claimId, eventType, actor, message, metadata2) {
+  database.prepare(`
+    insert into agent_claim_events (id, claim_id, event_type, actor, message, created_at, metadata_json)
+    values (?, ?, ?, ?, ?, ?, ?)
+  `).run(randomId("claim_event"), claimId, eventType, actor || null, message || null, nowIso(), metadataJson(metadata2));
 }
-function seedLegacyWorkspaces(database, project) {
-  ensureProject2(database, project);
+function expireActiveClaims(database) {
   const timestamp = nowIso();
-  const statement = database.prepare(`
-    insert into lineage_workspaces (
-      id, project_id, root_asset_id, title, status, notes, created_by, active_at, created_at, updated_at
-    )
-    select ?, ?, a.id, a.title || ' lineage', 'active', null, 'system', ?, ?, ?
-    from assets a
-    where a.project_id = ? and a.id = ?
-    on conflict(project_id, root_asset_id) do nothing
-  `);
-  for (const root of knownRoots(database, project)) {
-    statement.run(
-      lineageWorkspaceId(project, root.root_asset_id),
-      project,
-      root.selected_at || null,
-      timestamp,
-      timestamp,
-      project,
-      root.root_asset_id
-    );
-  }
-}
-function listRows(database, project) {
-  return database.prepare(`
-    select * from lineage_workspaces
-    where project_id = ?
-    order by
-      case status when 'active' then 0 when 'paused' then 1 else 2 end,
-      active_at desc nulls last,
-      updated_at desc,
-      title
-  `).all(project).map(rowToWorkspace);
+  const expired = database.prepare(`
+    select id from agent_claims where status = 'active' and expires_at <= ?
+  `).all(timestamp);
+  if (expired.length === 0) return;
+  database.prepare(`
+    update agent_claims set status = 'expired' where status = 'active' and expires_at <= ?
+  `).run(timestamp);
+  for (const claim of expired) recordEvent(database, claim.id, "expired", "system", "Claim expired after missed heartbeat.");
 }
-function activeWorkspace(database, project) {
-  const row = database.prepare(`
-    select * from lineage_workspaces
-    where project_id = ? and status != 'archived'
-    order by active_at desc nulls last, updated_at desc
-    limit 1
-  `).get(project);
-  return row ? rowToWorkspace(row) : null;
+function normalizeScope(scopeType) {
+  if (!scopes.has(scopeType)) throw new AgentClaimError(`Unsupported claim scope: ${scopeType}`);
+  return scopeType;
 }
-function listLineageWorkspaces(project) {
+function channelOverlaps(left, right) {
+  return !left || !right || left === right;
+}
+function claimOverlaps(candidate, existing) {
+  if (candidate.project !== existing.project) return false;
+  if (!channelOverlaps(candidate.channel, existing.channel)) return false;
+  if (candidate.scope_type === existing.scope_type && candidate.target_id === existing.target_id) return true;
+  return candidate.scope_type === "project_channel" || existing.scope_type === "project_channel";
+}
+function activeClaims(database, project) {
+  const rows = project ? database.prepare("select * from agent_claims where project_id = ? and status = 'active' order by heartbeat_at desc").all(project) : database.prepare("select * from agent_claims where status = 'active' order by project_id, heartbeat_at desc").all();
+  return rows.map((row) => rowToClaim(row));
+}
+function findClaimById(database, claimId, project) {
+  const row = project ? database.prepare("select * from agent_claims where project_id = ? and id = ?").get(project, claimId) : database.prepare("select * from agent_claims where id = ?").get(claimId);
+  return row ? rowToClaim(row) : null;
+}
+function findClaimRowByToken(database, claimToken) {
+  const claimId = claimToken.split(".")[0];
+  const row = database.prepare("select * from agent_claims where id = ?").get(claimId);
+  if (!row) return null;
+  return safeEqual(String(row.token_hash), tokenHash(claimToken)) ? row : null;
+}
+function denied(code, message, conflicts = []) {
+  return { ok: false, code, message, conflicts };
+}
+function scopeAllowsWrite(claim, scopeType, targetId, writeKind) {
+  if (claim.scope_type === scopeType && claim.target_id === targetId) return true;
+  if (claim.scope_type === "project_channel") return true;
+  if (claim.scope_type === "lineage_workspace" && scopeType === "lineage_workspace") return claim.target_id === targetId;
+  if (claim.scope_type === "content_queue_lane" && writeKind === "content_queue_next") return true;
+  return false;
+}
+function createAgentClaim(fields) {
+  const project = fields.project.trim();
+  const targetId = fields.targetId.trim();
+  const agentName = fields.agentName.trim();
+  if (!project) throw new AgentClaimError("Agent claim requires project");
+  if (!targetId) throw new AgentClaimError("Agent claim requires target");
+  if (!agentName) throw new AgentClaimError("Agent claim requires agent name");
+  const scopeType = normalizeScope(fields.scopeType);
+  const ttlSeconds = fields.ttlSeconds || defaultTtlSeconds;
   const database = lineageDb();
   try {
-    seedLegacyWorkspaces(database, project);
-    return {
+    ensureProject2(database, project);
+    expireActiveClaims(database);
+    const candidate = { project, channel: fields.channel?.trim() || void 0, scope_type: scopeType, target_id: targetId };
+    const conflicts = activeClaims(database, project).filter((claim2) => claimOverlaps(candidate, claim2));
+    if (conflicts.length > 0 && !fields.force) {
+      throw new AgentClaimError("Target already has an active overlapping agent claim.", 409, "target_already_claimed", conflicts);
+    }
+    if (conflicts.length > 0 && !fields.reason?.trim()) {
+      throw new AgentClaimError("Overriding an active claim requires --reason.", 400, "override_reason_required", conflicts);
+    }
+    const timestamp = nowIso();
+    for (const conflict of conflicts) {
+      database.prepare(`
+        update agent_claims
+        set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+        where id = ? and status = 'active'
+      `).run(timestamp, agentName, fields.reason || null, conflict.id);
+      recordEvent(database, conflict.id, "revoked", agentName, fields.reason || "Revoked by forced claim takeover.");
+      recordEvent(database, conflict.id, "conflict", agentName, `Overridden by ${agentName}.`, { new_claim_target: targetId });
+    }
+    const id = randomId("claim");
+    const secret = randomBytes(24).toString("base64url");
+    const claimToken = `${id}.${secret}`;
+    const expiresAt = expiresAtFrom(timestamp, ttlSeconds);
+    database.prepare(`
+      insert into agent_claims (
+        id, token_hash, project_id, channel, scope_type, target_id, target_title, agent_id, agent_name,
+        agent_kind, thread_id, status, created_at, heartbeat_at, expires_at, metadata_json
+      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)
+    `).run(
+      id,
+      tokenHash(claimToken),
       project,
-      active_workspace: activeWorkspace(database, project),
-      workspaces: listRows(database, project),
-      fetchedAt: nowIso()
-    };
+      candidate.channel || null,
+      scopeType,
+      targetId,
+      fields.targetTitle?.trim() || null,
+      fields.agentId?.trim() || null,
+      agentName,
+      fields.agentKind?.trim() || "codex",
+      fields.threadId?.trim() || null,
+      timestamp,
+      timestamp,
+      expiresAt,
+      metadataJson(fields.metadata)
+    );
+    recordEvent(database, id, "created", agentName, `Claimed ${scopeType} ${targetId}.`, { ttl_seconds: ttlSeconds });
+    const claim = findClaimById(database, id);
+    return { ok: true, claim, claim_token: claimToken, conflicts_revoked: conflicts.map((conflict) => conflict.id) };
   } finally {
     database.close();
   }
 }
-function inspectLineageWorkspace(project, workspaceId) {
+function listAgentClaims(project) {
   const database = lineageDb();
   try {
-    seedLegacyWorkspaces(database, project);
-    const workspace = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
-    if (!workspace) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
-    return workspace;
+    expireActiveClaims(database);
+    const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
+    return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
   } finally {
     database.close();
   }
 }
-function createLineageWorkspace(project, fields) {
-  const rootAssetId = fields.rootAssetId.trim();
-  if (!rootAssetId) throw new LineageWorkspaceError("Lineage workspace requires rootAssetId");
-  const status = normalizeStatus(fields.status, "active");
-  const actor = normalizeActor(fields.createdBy);
+function inspectAgentClaim(claimId, project) {
   const database = lineageDb();
   try {
-    const root = requireAsset(database, project, rootAssetId);
-    const timestamp = nowIso();
-    const workspace = {
-      id: lineageWorkspaceId(project, rootAssetId),
-      project,
-      root_asset_id: rootAssetId,
-      title: fields.title?.trim() || `${root.title} lineage`,
-      status,
-      notes: fields.notes?.trim() || void 0,
-      created_by: actor,
-      active_at: fields.activate !== false && status !== "archived" ? timestamp : void 0,
-      created_at: timestamp,
-      updated_at: timestamp
-    };
-    if (!fields.confirmWrite) return { ok: true, dryRun: true, workspace };
-    ensureProject2(database, project);
-    database.prepare(`
-      insert into lineage_workspaces (
-        id, project_id, root_asset_id, title, status, notes, created_by, active_at, created_at, updated_at
-      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      on conflict(project_id, root_asset_id) do update set
-        title = excluded.title,
-        status = excluded.status,
-        notes = excluded.notes,
-        active_at = coalesce(excluded.active_at, lineage_workspaces.active_at),
-        updated_at = excluded.updated_at
-    `).run(
-      workspace.id,
-      project,
-      workspace.root_asset_id,
-      workspace.title,
-      workspace.status,
-      workspace.notes || null,
-      workspace.created_by,
-      workspace.active_at || null,
-      workspace.created_at,
-      workspace.updated_at
-    );
-    return {
-      ok: true,
-      message: `Saved lineage workspace ${workspace.title}`,
-      workspace: workspaceById(database, project, workspace.id)
-    };
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
+    return { ok: true, claim, events: events.map(eventToRow) };
   } finally {
     database.close();
   }
 }
-function updateLineageWorkspace(project, workspaceId, fields) {
+function heartbeatAgentClaim(claimToken, ttlSeconds = defaultTtlSeconds) {
   const database = lineageDb();
   try {
-    seedLegacyWorkspaces(database, project);
-    const current = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
-    if (!current) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
     const timestamp = nowIso();
-    const next = {
-      ...current,
-      title: fields.title?.trim() || current.title,
-      status: normalizeStatus(fields.status, current.status),
-      notes: fields.notes === void 0 ? current.notes : fields.notes.trim() || void 0,
-      active_at: fields.activate ? timestamp : current.active_at,
-      updated_at: timestamp
-    };
-    if (!fields.confirmWrite) return { ok: true, dryRun: true, workspace: next };
-    database.prepare(`
-      update lineage_workspaces
-      set title = ?, status = ?, notes = ?, active_at = ?, updated_at = ?
-      where project_id = ? and id = ?
-    `).run(next.title, next.status, next.notes || null, next.active_at || null, timestamp, project, current.id);
-    return {
-      ok: true,
-      message: `Updated lineage workspace ${next.title}`,
-      workspace: workspaceById(database, project, current.id)
-    };
+    database.prepare("update agent_claims set heartbeat_at = ?, expires_at = ? where id = ?").run(timestamp, expiresAtFrom(timestamp, ttlSeconds), claim.id);
+    recordEvent(database, claim.id, "heartbeat", claim.agent_name, "Claim heartbeat received.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
   } finally {
     database.close();
   }
 }
-function activateLineageWorkspace(project, workspaceId, confirmWrite) {
-  return updateLineageWorkspace(project, workspaceId, { activate: true, status: "active", confirmWrite });
-}
-function archiveLineageWorkspace(project, workspaceId, confirmWrite) {
+function releaseAgentClaim(claimToken) {
   const database = lineageDb();
   try {
-    seedLegacyWorkspaces(database, project);
-    const current = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
-    if (!current) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
     const timestamp = nowIso();
-    const next = {
-      ...current,
-      status: "archived",
-      active_at: void 0,
-      updated_at: timestamp
-    };
-    if (!confirmWrite) return { ok: true, dryRun: true, workspace: next };
-    database.prepare(`
-      update lineage_workspaces
-      set status = 'archived', active_at = null, updated_at = ?
-      where project_id = ? and id = ?
-    `).run(timestamp, project, current.id);
-    database.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, current.root_asset_id);
-    return {
-      ok: true,
-      message: `Archived lineage workspace ${current.title}`,
-      workspace: workspaceById(database, project, current.id)
-    };
+    database.prepare("update agent_claims set status = 'released', released_at = ? where id = ?").run(timestamp, claim.id);
+    recordEvent(database, claim.id, "released", claim.agent_name, "Claim released by token holder.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
   } finally {
     database.close();
   }
 }
-function activeLineageWorkspaceRoot(project) {
+function releaseStaleAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Releasing a stale agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Releasing a stale agent claim requires a reason.", 400, "reason_required");
   const database = lineageDb();
   try {
-    seedLegacyWorkspaces(database, project);
-    return activeWorkspace(database, project)?.root_asset_id;
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active" || claim.derived_state !== "stale") {
+      throw new AgentClaimError("Only stale active claims can be released without the claim token.", 409, "claim_not_stale", [claim]);
+    }
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set status = 'released', released_at = ?, revoked_by = ?, override_reason = ? where id = ?").run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "released", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function revokeAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Revoking an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Revoking an agent claim requires a reason.", 400, "reason_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const timestamp = nowIso();
+    database.prepare(`
+      update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+      where id = ?
+    `).run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function revokeAgentClaimInDatabase(database, project, claimId, fields) {
+  expireActiveClaims(database);
+  const claim = findClaimById(database, claimId, project);
+  if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+  if (claim.status !== "active") return claim;
+  const timestamp = nowIso();
+  database.prepare(`
+    update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+    where id = ? and status = 'active'
+  `).run(timestamp, fields.actor || "human", fields.reason || null, claim.id);
+  recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
+  return findClaimById(database, claim.id, project);
+}
+function transferAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Transferring an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  const toAgentName = fields.toAgentName.trim();
+  if (!toAgentName) throw new AgentClaimError("Transfer requires toAgentName.", 400, "agent_name_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    database.prepare("update agent_claims set agent_name = ? where id = ?").run(toAgentName, claim.id);
+    recordEvent(database, claim.id, "transferred", fields.actor || "human", fields.reason || `Transferred claim to ${toAgentName}.`, { to_agent_name: toAgentName });
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function recordAgentClaimWriteAllowed(claim, fields) {
+  const database = lineageDb();
+  try {
+    recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
+      danger_level: fields.dangerLevel,
+      target_id: fields.targetId,
+      write_kind: fields.writeKind
+    });
+    return { ok: true };
+  } finally {
+    database.close();
+  }
+}
+function validateAgentClaimForWrite(fields) {
+  if (fields.dangerLevel === "danger" && !fields.confirmWrite) {
+    return denied("human_confirmation_required", "Dangerous write requires explicit human confirmation.");
+  }
+  if (!fields.claimToken) return denied("claim_required", "Mutating agent write requires a matching claim token.");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, fields.claimToken);
+    if (!row) return denied("claim_token_invalid", "Unknown or invalid claim token.");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") return denied("claim_not_active", `Agent claim is ${claim.status}.`);
+    if (new Date(claim.expires_at).getTime() <= Date.now()) return denied("claim_expired", "Agent claim has expired.");
+    if (claim.project !== fields.project) return denied("claim_project_mismatch", `Claim project ${claim.project} does not match ${fields.project}.`, [claim]);
+    if (fields.channel && claim.channel && claim.channel !== fields.channel) {
+      return denied("claim_channel_mismatch", `Claim channel ${claim.channel} does not match ${fields.channel}.`, [claim]);
+    }
+    if (!scopeAllowsWrite(claim, fields.scopeType, fields.targetId, fields.writeKind)) {
+      return denied("claim_scope_mismatch", `Claim does not cover ${fields.scopeType} ${fields.targetId}.`, [claim]);
+    }
+    if (fields.recordEvent !== false) {
+      recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
+        danger_level: fields.dangerLevel,
+        target_id: fields.targetId,
+        write_kind: fields.writeKind
+      });
+    }
+    return { ok: true, claim, warnings: [] };
   } finally {
     database.close();
   }
 }
 
-// src/server/agentClaims.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
-var defaultTtlSeconds = 20 * 60;
-var idleAfterSeconds = 5 * 60;
-var staleAfterSeconds = 15 * 60;
-var scopes = /* @__PURE__ */ new Set(["lineage_workspace", "content_post", "content_queue_lane", "selection_set", "project_channel"]);
-var AgentClaimError = class extends Error {
-  constructor(message, status = 400, code = "agent_claim_error", conflicts = []) {
+// src/server/assetLineageTasks.ts
+var LineageTaskError = class extends Error {
+  constructor(message, status = 400) {
     super(message);
     this.status = status;
-    this.code = code;
-    this.conflicts = conflicts;
   }
   status;
-  code;
-  conflicts;
 };
-function isAgentClaimError(error) {
-  return error instanceof AgentClaimError;
-}
-function parseClaimTtl(value) {
-  if (!value) return defaultTtlSeconds;
-  const match = value.trim().match(/^(\d+)(s|m|h)?$/);
-  if (!match) throw new AgentClaimError(`Invalid claim ttl: ${value}`);
-  const amount = Number(match[1]);
-  const unit = match[2] || "s";
-  const multiplier = unit === "h" ? 3600 : unit === "m" ? 60 : 1;
-  const seconds = amount * multiplier;
-  if (!Number.isInteger(seconds) || seconds < 30 || seconds > 24 * 60 * 60) {
-    throw new AgentClaimError("Claim ttl must be between 30 seconds and 24 hours");
-  }
-  return seconds;
-}
-function randomId(prefix) {
-  return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
-}
-function tokenHash(token) {
-  return createHash2("sha256").update(token).digest("hex");
+function isLineageTaskError(error) {
+  return error instanceof LineageTaskError;
 }
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
+var activeStatuses = ["pending", "claimed", "in_progress"];
+var taskTypes = /* @__PURE__ */ new Set(["iterate", "reroll"]);
+var taskStatuses = /* @__PURE__ */ new Set(["pending", "claimed", "in_progress", "resolved", "cancelled"]);
+function taskIdFor(project, rootAssetId, targetAssetId, taskType) {
+  return `${project}:${rootAssetId}:lineage-task:${taskType}:${targetAssetId}`;
 }
-function expiresAtFrom(timestamp, ttlSeconds) {
-  return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
+function randomId2(prefix) {
+  return `${prefix}_${Date.now().toString(36)}_${randomBytes2(6).toString("base64url").toLowerCase()}`;
 }
-function metadataJson(metadata2) {
+function metadataJson2(metadata2) {
   return metadata2 ? JSON.stringify(metadata2) : null;
 }
-function parseMetadata(value) {
+function metadataWithoutClaim(metadata2) {
+  if (!metadata2) return void 0;
+  const next = { ...metadata2 };
+  delete next.claim_id;
+  return Object.keys(next).length > 0 ? next : void 0;
+}
+function parseMetadata2(value) {
   if (typeof value !== "string" || !value) return void 0;
   try {
     const parsed = JSON.parse(value);
@@ -1684,315 +2027,711 @@ function parseMetadata(value) {
     return void 0;
   }
 }
-function derivedState(row, now = /* @__PURE__ */ new Date()) {
-  if (row.status !== "active") return row.status === "expired" ? "expired" : "stale";
-  if (new Date(row.expires_at).getTime() <= now.getTime()) return "expired";
-  const ageSeconds = Math.max(0, Math.floor((now.getTime() - new Date(row.heartbeat_at).getTime()) / 1e3));
-  if (ageSeconds >= staleAfterSeconds) return "stale";
-  if (ageSeconds >= idleAfterSeconds) return "idle";
-  return "active";
+function normalizeProject(project) {
+  const trimmed = project.trim();
+  if (!trimmed) throw new LineageTaskError("Lineage task requires project");
+  return trimmed;
 }
-function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
-  const heartbeatAt = String(row.heartbeat_at);
+function normalizeTaskType(taskType) {
+  if (!taskTypes.has(taskType)) throw new LineageTaskError(`Unsupported lineage task type: ${taskType}`);
+  return taskType;
+}
+function normalizeStatus(status) {
+  if (!taskStatuses.has(status)) throw new LineageTaskError(`Unsupported lineage task status: ${status}`);
+  return status;
+}
+function normalizeActor(actor, label) {
+  const trimmed = actor.trim();
+  if (!trimmed) throw new LineageTaskError(`${label} is required`);
+  return trimmed;
+}
+function requireAsset(database, project, assetId) {
+  const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
+  if (!row) throw new LineageTaskError(`Unknown indexed asset: ${assetId}`, 404);
+}
+function taskFromRow(row) {
+  const metadata2 = parseMetadata2(row.metadata_json);
+  const claimId = typeof metadata2?.claim_id === "string" ? metadata2.claim_id : void 0;
   return {
     id: String(row.id),
-    project: String(row.project_id),
-    channel: typeof row.channel === "string" ? row.channel : void 0,
-    scope_type: String(row.scope_type),
-    target_id: String(row.target_id),
-    target_title: typeof row.target_title === "string" ? row.target_title : void 0,
-    agent_id: typeof row.agent_id === "string" ? row.agent_id : void 0,
-    agent_name: String(row.agent_name),
-    agent_kind: String(row.agent_kind),
-    thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
+    project_id: String(row.project_id),
+    root_asset_id: String(row.root_asset_id),
+    target_asset_id: String(row.target_asset_id),
+    task_type: String(row.task_type),
     status: String(row.status),
+    instructions: typeof row.instructions === "string" ? row.instructions : void 0,
+    created_by: String(row.created_by),
     created_at: String(row.created_at),
-    heartbeat_at: heartbeatAt,
-    expires_at: String(row.expires_at),
-    released_at: typeof row.released_at === "string" ? row.released_at : void 0,
-    revoked_at: typeof row.revoked_at === "string" ? row.revoked_at : void 0,
-    revoked_by: typeof row.revoked_by === "string" ? row.revoked_by : void 0,
-    override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
-    metadata: parseMetadata(row.metadata_json),
-    heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
-    derived_state: derivedState({
-      expires_at: String(row.expires_at),
-      heartbeat_at: heartbeatAt,
-      status: String(row.status)
-    }, now)
+    updated_at: String(row.updated_at),
+    claimed_at: typeof row.claimed_at === "string" ? row.claimed_at : void 0,
+    started_at: typeof row.started_at === "string" ? row.started_at : void 0,
+    resolved_at: typeof row.resolved_at === "string" ? row.resolved_at : void 0,
+    cancelled_at: typeof row.cancelled_at === "string" ? row.cancelled_at : void 0,
+    resolved_generation_job_id: typeof row.resolved_generation_job_id === "string" ? row.resolved_generation_job_id : void 0,
+    resolved_asset_id: typeof row.resolved_asset_id === "string" ? row.resolved_asset_id : void 0,
+    claimed_by_claim_id: claimId,
+    metadata: metadata2
   };
 }
-function eventToRow(row) {
+function eventFromRow(row) {
   return {
-    claim_id: String(row.claim_id),
+    id: String(row.id),
+    task_id: String(row.task_id),
     event_type: String(row.event_type),
     actor: typeof row.actor === "string" ? row.actor : void 0,
     message: typeof row.message === "string" ? row.message : void 0,
     created_at: String(row.created_at),
-    metadata: parseMetadata(row.metadata_json)
+    metadata: parseMetadata2(row.metadata_json)
   };
 }
-function ensureProject3(database, project) {
-  const timestamp = nowIso();
-  database.prepare(`
-    insert into projects (id, product, created_at, updated_at)
-    values (?, ?, ?, ?)
-    on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, timestamp, timestamp);
+function findTask(database, project, taskId) {
+  const row = database.prepare("select * from lineage_tasks where project_id = ? and id = ?").get(project, taskId);
+  return row ? taskFromRow(row) : null;
 }
-function recordEvent(database, claimId, eventType, actor, message, metadata2) {
+function requireTask(database, project, taskId) {
+  const task = findTask(database, project, taskId);
+  if (!task) throw new LineageTaskError(`Unknown lineage task: ${taskId}`, 404);
+  return task;
+}
+function taskEvents(database, taskId) {
+  const rows = database.prepare("select * from lineage_task_events where task_id = ? order by created_at, rowid").all(taskId);
+  return rows.map(eventFromRow);
+}
+function recordEvent2(database, taskId, eventType, actor, message, metadata2) {
   database.prepare(`
-    insert into agent_claim_events (id, claim_id, event_type, actor, message, created_at, metadata_json)
+    insert into lineage_task_events (id, task_id, event_type, actor, message, created_at, metadata_json)
     values (?, ?, ?, ?, ?, ?, ?)
-  `).run(randomId("claim_event"), claimId, eventType, actor || null, message || null, nowIso(), metadataJson(metadata2));
+  `).run(randomId2("lineage_task_event"), taskId, eventType, actor || null, message || null, nowIso(), metadataJson2(metadata2));
 }
-function expireActiveClaims(database) {
-  const timestamp = nowIso();
-  const expired = database.prepare(`
-    select id from agent_claims where status = 'active' and expires_at <= ?
-  `).all(timestamp);
-  if (expired.length === 0) return;
-  database.prepare(`
-    update agent_claims set status = 'expired' where status = 'active' and expires_at <= ?
-  `).run(timestamp);
-  for (const claim of expired) recordEvent(database, claim.id, "expired", "system", "Claim expired after missed heartbeat.");
+function taskWithEvents(database, project, taskId) {
+  return { project, ok: true, task: requireTask(database, project, taskId), events: taskEvents(database, taskId) };
 }
-function normalizeScope(scopeType) {
-  if (!scopes.has(scopeType)) throw new AgentClaimError(`Unsupported claim scope: ${scopeType}`);
-  return scopeType;
+function assertChanged(result, message) {
+  if (Number(result.changes) !== 1) throw new LineageTaskError(message, 409);
 }
-function channelOverlaps(left, right) {
-  return !left || !right || left === right;
+function transaction(database, callback) {
+  database.exec("BEGIN IMMEDIATE");
+  try {
+    const value = callback();
+    database.exec("COMMIT");
+    return value;
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
 }
-function claimOverlaps(candidate, existing) {
-  if (candidate.project !== existing.project) return false;
-  if (!channelOverlaps(candidate.channel, existing.channel)) return false;
-  if (candidate.scope_type === existing.scope_type && candidate.target_id === existing.target_id) return true;
-  return candidate.scope_type === "project_channel" || existing.scope_type === "project_channel";
+function taskReadWithEvents(database, project, taskId) {
+  return { task: requireTask(database, project, taskId), events: taskEvents(database, taskId) };
 }
-function activeClaims(database, project) {
-  const rows = project ? database.prepare("select * from agent_claims where project_id = ? and status = 'active' order by heartbeat_at desc").all(project) : database.prepare("select * from agent_claims where status = 'active' order by project_id, heartbeat_at desc").all();
-  return rows.map((row) => rowToClaim(row));
+function listLineageTasks(project, rootAssetId, statuses2 = activeStatuses) {
+  const normalizedProject = normalizeProject(project);
+  const normalizedStatuses = statuses2.map(normalizeStatus);
+  const database = lineageDb();
+  try {
+    requireAsset(database, normalizedProject, rootAssetId);
+    if (normalizedStatuses.length === 0) {
+      return { project: normalizedProject, root_asset_id: rootAssetId, tasks: [], fetchedAt: nowIso() };
+    }
+    const placeholders2 = normalizedStatuses.map(() => "?").join(",");
+    const rows = database.prepare(`
+      select * from lineage_tasks
+      where project_id = ? and root_asset_id = ? and status in (${placeholders2})
+      order by updated_at desc, created_at desc, id
+    `).all(normalizedProject, rootAssetId, ...normalizedStatuses);
+    return { project: normalizedProject, root_asset_id: rootAssetId, tasks: rows.map(taskFromRow), fetchedAt: nowIso() };
+  } finally {
+    database.close();
+  }
 }
-function findClaimById(database, claimId, project) {
-  const row = project ? database.prepare("select * from agent_claims where project_id = ? and id = ?").get(project, claimId) : database.prepare("select * from agent_claims where id = ?").get(claimId);
-  return row ? rowToClaim(row) : null;
+function getLineageTask(project, taskId) {
+  const normalizedProject = normalizeProject(project);
+  const database = lineageDb();
+  try {
+    return { project: normalizedProject, ...taskReadWithEvents(database, normalizedProject, taskId) };
+  } finally {
+    database.close();
+  }
 }
-function findClaimRowByToken(database, claimToken) {
-  const claimId = claimToken.split(".")[0];
-  const row = database.prepare("select * from agent_claims where id = ?").get(claimId);
-  if (!row) return null;
-  return safeEqual(String(row.token_hash), tokenHash(claimToken)) ? row : null;
+function upsertLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const taskType = normalizeTaskType(fields.taskType);
+  const taskId = taskIdFor(normalizedProject, fields.rootAssetId, fields.targetAssetId, taskType);
+  const database = lineageDb();
+  try {
+    requireAsset(database, normalizedProject, fields.rootAssetId);
+    requireAsset(database, normalizedProject, fields.targetAssetId);
+    const existing = database.prepare(`
+      select * from lineage_tasks
+      where project_id = ? and root_asset_id = ? and target_asset_id = ? and task_type = ?
+        and status in ('pending', 'claimed', 'in_progress')
+      order by created_at desc limit 1
+    `).get(normalizedProject, fields.rootAssetId, fields.targetAssetId, taskType);
+    const instructions = fields.instructions?.trim() || void 0;
+    if (existing) {
+      const task = taskFromRow(existing);
+      if (task.status !== "pending" && instructions !== void 0 && instructions !== task.instructions) {
+        throw new LineageTaskError("Only pending lineage tasks can update instructions.", 409);
+      }
+      if (task.status === "pending" && instructions !== void 0 && instructions !== task.instructions) {
+        const timestamp2 = nowIso();
+        transaction(database, () => {
+          const result = database.prepare(`
+            update lineage_tasks
+            set instructions = ?, updated_at = ?
+            where id = ? and status = 'pending'
+          `).run(instructions, timestamp2, task.id);
+          assertChanged(result, "Only pending lineage tasks can update instructions.");
+          recordEvent2(database, task.id, "instructions_updated", fields.createdBy, "Instructions updated.");
+        });
+      }
+      return taskWithEvents(database, normalizedProject, task.id);
+    }
+    const closedTask = findTask(database, normalizedProject, taskId);
+    if (closedTask) {
+      const timestamp2 = nowIso();
+      transaction(database, () => {
+        const result = database.prepare(`
+          update lineage_tasks
+          set status = 'pending', instructions = ?, created_by = ?, updated_at = ?,
+            claimed_at = null, started_at = null, resolved_at = null, cancelled_at = null,
+            resolved_generation_job_id = null, resolved_asset_id = null, metadata_json = null
+          where id = ? and status not in ('pending', 'claimed', 'in_progress')
+        `).run(instructions || null, fields.createdBy, timestamp2, taskId);
+        assertChanged(result, "Lineage task changed while reopening.");
+        recordEvent2(database, taskId, "created", fields.createdBy, "Lineage task created.");
+      });
+      return taskWithEvents(database, normalizedProject, taskId);
+    }
+    const timestamp = nowIso();
+    transaction(database, () => {
+      database.prepare(`
+        insert into lineage_tasks (
+          id, project_id, root_asset_id, target_asset_id, task_type, status, instructions,
+          created_by, created_at, updated_at, metadata_json
+        ) values (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, null)
+      `).run(taskId, normalizedProject, fields.rootAssetId, fields.targetAssetId, taskType, instructions || null, fields.createdBy, timestamp, timestamp);
+      recordEvent2(database, taskId, "created", fields.createdBy, "Lineage task created.");
+    });
+    return taskWithEvents(database, normalizedProject, taskId);
+  } finally {
+    database.close();
+  }
 }
-function denied(code, message, conflicts = []) {
-  return { ok: false, code, message, conflicts };
+function updateLineageTaskInstructions(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const instructions = fields.instructions.trim();
+  const database = lineageDb();
+  try {
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (task.status !== "pending") throw new LineageTaskError("Only pending lineage tasks can update instructions.", 409);
+    const timestamp = nowIso();
+    transaction(database, () => {
+      const result = database.prepare(`
+        update lineage_tasks
+        set instructions = ?, updated_at = ?
+        where id = ? and status = 'pending'
+      `).run(instructions || null, timestamp, task.id);
+      assertChanged(result, "Only pending lineage tasks can update instructions.");
+      recordEvent2(database, task.id, "instructions_updated", "human", "Instructions updated.");
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
+  } finally {
+    database.close();
+  }
 }
-function scopeAllowsWrite(claim, scopeType, targetId, writeKind) {
-  if (claim.scope_type === scopeType && claim.target_id === targetId) return true;
-  if (claim.scope_type === "project_channel") return true;
-  if (claim.scope_type === "lineage_workspace" && scopeType === "lineage_workspace") return claim.target_id === targetId;
-  if (claim.scope_type === "content_queue_lane" && writeKind === "content_queue_next") return true;
-  return false;
+function addLineageTaskComment(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const actor = normalizeActor(fields.actor, "Comment actor");
+  const message = fields.message.trim();
+  if (!message) throw new LineageTaskError("Comment message is required");
+  const database = lineageDb();
+  try {
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    transaction(database, () => {
+      recordEvent2(database, task.id, "comment_added", actor, message);
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
+  } finally {
+    database.close();
+  }
 }
-function createAgentClaim(fields) {
-  const project = fields.project.trim();
-  const targetId = fields.targetId.trim();
-  const agentName = fields.agentName.trim();
-  if (!project) throw new AgentClaimError("Agent claim requires project");
-  if (!targetId) throw new AgentClaimError("Agent claim requires target");
-  if (!agentName) throw new AgentClaimError("Agent claim requires agent name");
-  const scopeType = normalizeScope(fields.scopeType);
-  const ttlSeconds = fields.ttlSeconds || defaultTtlSeconds;
+function claimLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const agentName = normalizeActor(fields.agentName, "Agent name");
+  const beforeClaimDb = lineageDb();
+  try {
+    const task = requireTask(beforeClaimDb, normalizedProject, fields.taskId);
+    if (task.status !== "pending") throw new LineageTaskError("Only pending lineage tasks can be claimed.", 409);
+  } finally {
+    beforeClaimDb.close();
+  }
+  const claimResult = createAgentClaim({
+    agentName,
+    project: normalizedProject,
+    scopeType: "lineage_task",
+    targetId: fields.taskId,
+    targetTitle: fields.taskId
+  });
+  if (!claimResult.claim) throw new LineageTaskError("Unable to create lineage task claim.", 500);
+  const claim = claimResult.claim;
   const database = lineageDb();
   try {
-    ensureProject3(database, project);
-    expireActiveClaims(database);
-    const candidate = { project, channel: fields.channel?.trim() || void 0, scope_type: scopeType, target_id: targetId };
-    const conflicts = activeClaims(database, project).filter((claim2) => claimOverlaps(candidate, claim2));
-    if (conflicts.length > 0 && !fields.force) {
-      throw new AgentClaimError("Target already has an active overlapping agent claim.", 409, "target_already_claimed", conflicts);
-    }
-    if (conflicts.length > 0 && !fields.reason?.trim()) {
-      throw new AgentClaimError("Overriding an active claim requires --reason.", 400, "override_reason_required", conflicts);
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (task.status !== "pending") {
+      releaseAgentClaim(claimResult.claim_token);
+      throw new LineageTaskError("Only pending lineage tasks can be claimed.", 409);
     }
     const timestamp = nowIso();
-    for (const conflict of conflicts) {
-      database.prepare(`
-        update agent_claims
-        set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
-        where id = ? and status = 'active'
-      `).run(timestamp, agentName, fields.reason || null, conflict.id);
-      recordEvent(database, conflict.id, "revoked", agentName, fields.reason || "Revoked by forced claim takeover.");
-      recordEvent(database, conflict.id, "conflict", agentName, `Overridden by ${agentName}.`, { new_claim_target: targetId });
+    const metadata2 = { ...task.metadata || {}, claim_id: claim.id };
+    try {
+      transaction(database, () => {
+        const result = database.prepare(`
+          update lineage_tasks
+          set status = 'claimed', claimed_at = ?, updated_at = ?, metadata_json = ?
+          where id = ? and status = 'pending'
+        `).run(timestamp, timestamp, metadataJson2(metadata2), task.id);
+        assertChanged(result, "Only pending lineage tasks can be claimed.");
+        recordEvent2(database, task.id, "claimed", agentName, "Lineage task claimed.", { claim_id: claim.id });
+      });
+    } catch (error) {
+      releaseAgentClaim(claimResult.claim_token);
+      throw error;
     }
-    const id = randomId("claim");
-    const secret = randomBytes(24).toString("base64url");
-    const claimToken = `${id}.${secret}`;
-    const expiresAt = expiresAtFrom(timestamp, ttlSeconds);
-    database.prepare(`
-      insert into agent_claims (
-        id, token_hash, project_id, channel, scope_type, target_id, target_title, agent_id, agent_name,
-        agent_kind, thread_id, status, created_at, heartbeat_at, expires_at, metadata_json
-      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)
-    `).run(
-      id,
-      tokenHash(claimToken),
-      project,
-      candidate.channel || null,
-      scopeType,
-      targetId,
-      fields.targetTitle?.trim() || null,
-      fields.agentId?.trim() || null,
-      agentName,
-      fields.agentKind?.trim() || "codex",
-      fields.threadId?.trim() || null,
-      timestamp,
-      timestamp,
-      expiresAt,
-      metadataJson(fields.metadata)
-    );
-    recordEvent(database, id, "created", agentName, `Claimed ${scopeType} ${targetId}.`, { ttl_seconds: ttlSeconds });
-    const claim = findClaimById(database, id);
-    return { ok: true, claim, claim_token: claimToken, conflicts_revoked: conflicts.map((conflict) => conflict.id) };
+    return {
+      ...taskWithEvents(database, normalizedProject, task.id),
+      claim,
+      claim_token: claimResult.claim_token
+    };
   } finally {
     database.close();
   }
 }
-function listAgentClaims(project) {
+function startLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const precheckDatabase = lineageDb();
+  try {
+    const task = requireTask(precheckDatabase, normalizedProject, fields.taskId);
+    if (task.status !== "claimed") throw new LineageTaskError("Only claimed lineage tasks can be started.", 409);
+  } finally {
+    precheckDatabase.close();
+  }
+  const validation = validateAgentClaimForWrite({
+    claimToken: fields.claimToken,
+    dangerLevel: "enforce",
+    project: normalizedProject,
+    recordEvent: false,
+    scopeType: "lineage_task",
+    targetId: fields.taskId,
+    writeKind: "lineage_task_start"
+  });
+  if (!validation.ok) throw new LineageTaskError(validation.message, 409);
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
-    return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (task.status !== "claimed") throw new LineageTaskError("Only claimed lineage tasks can be started.", 409);
+    if (task.claimed_by_claim_id && task.claimed_by_claim_id !== validation.claim.id) {
+      throw new LineageTaskError("Claim token does not match the task claim.", 409);
+    }
+    const timestamp = nowIso();
+    const metadata2 = { ...task.metadata || {}, claim_id: validation.claim.id };
+    transaction(database, () => {
+      const result = database.prepare(`
+        update lineage_tasks
+        set status = 'in_progress', started_at = ?, updated_at = ?, metadata_json = ?
+        where id = ? and status = 'claimed'
+      `).run(timestamp, timestamp, metadataJson2(metadata2), task.id);
+      assertChanged(result, "Only claimed lineage tasks can be started.");
+      recordEvent2(database, task.id, "started", validation.claim.agent_name, "Lineage task started.", { claim_id: validation.claim.id });
+    });
+    recordAgentClaimWriteAllowed(validation.claim, {
+      dangerLevel: "enforce",
+      targetId: fields.taskId,
+      writeKind: "lineage_task_start"
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
   } finally {
     database.close();
   }
 }
-function inspectAgentClaim(claimId, project) {
+function overrideLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const actor = normalizeActor(fields.actor, "Override actor");
+  const reason = fields.reason.trim();
+  if (!reason) throw new LineageTaskError("Override reason is required");
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
-    return { ok: true, claim, events: events.map(eventToRow) };
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (!["claimed", "in_progress"].includes(task.status)) {
+      throw new LineageTaskError(`Only claimed or in-progress lineage tasks can be overridden; task is ${task.status}.`, 409);
+    }
+    const timestamp = nowIso();
+    const instructions = fields.instructions === void 0 ? task.instructions : fields.instructions.trim() || void 0;
+    const metadata2 = metadataWithoutClaim(task.metadata);
+    transaction(database, () => {
+      const result = database.prepare(`
+        update lineage_tasks
+        set status = 'pending', instructions = ?, claimed_at = null, started_at = null,
+          updated_at = ?, metadata_json = ?
+        where project_id = ? and id = ? and status in ('claimed', 'in_progress')
+      `).run(instructions || null, timestamp, metadataJson2(metadata2), normalizedProject, task.id);
+      assertChanged(result, `Only active lineage task ${task.id} could be overridden.`);
+      if (task.claimed_by_claim_id) {
+        revokeAgentClaimInDatabase(database, normalizedProject, task.claimed_by_claim_id, {
+          actor,
+          reason
+        });
+      }
+      recordEvent2(database, task.id, "human_override", actor, reason, {
+        previous_claim_id: task.claimed_by_claim_id,
+        previous_status: task.status
+      });
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
   } finally {
     database.close();
   }
 }
-function heartbeatAgentClaim(claimToken, ttlSeconds = defaultTtlSeconds) {
+function cancelLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const actor = normalizeActor(fields.actor, "Cancel actor");
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, claimToken);
-    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (task.status === "cancelled") return { project: normalizedProject, ok: true, task, events: taskEvents(database, task.id) };
+    if (!["pending", "claimed", "in_progress"].includes(task.status)) {
+      throw new LineageTaskError(`Only open lineage tasks can be cancelled; task is ${task.status}.`, 409);
+    }
+    if (task.status !== "pending" && !fields.override) {
+      throw new LineageTaskError("Cancelling an active lineage task requires override=true.", 409);
+    }
+    const overridingActiveTask = fields.override === true && task.status !== "pending";
+    const metadata2 = overridingActiveTask ? metadataWithoutClaim(task.metadata) : task.metadata;
     const timestamp = nowIso();
-    database.prepare("update agent_claims set heartbeat_at = ?, expires_at = ? where id = ?").run(timestamp, expiresAtFrom(timestamp, ttlSeconds), claim.id);
-    recordEvent(database, claim.id, "heartbeat", claim.agent_name, "Claim heartbeat received.");
-    return { ok: true, claim: findClaimById(database, claim.id) };
+    const cancelledTask = {
+      ...task,
+      cancelled_at: timestamp,
+      claimed_at: overridingActiveTask ? void 0 : task.claimed_at,
+      claimed_by_claim_id: overridingActiveTask ? void 0 : task.claimed_by_claim_id,
+      started_at: overridingActiveTask ? void 0 : task.started_at,
+      status: "cancelled",
+      updated_at: timestamp,
+      metadata: metadata2
+    };
+    if (!fields.confirmWrite) return { project: normalizedProject, ok: true, dryRun: true, task: cancelledTask, events: taskEvents(database, task.id) };
+    transaction(database, () => {
+      const result = database.prepare(`
+        update lineage_tasks
+        set status = 'cancelled', cancelled_at = ?, claimed_at = ?, started_at = ?,
+          updated_at = ?, metadata_json = ?
+        where id = ? and status = ?
+      `).run(
+        timestamp,
+        overridingActiveTask ? null : task.claimed_at || null,
+        overridingActiveTask ? null : task.started_at || null,
+        timestamp,
+        metadataJson2(metadata2),
+        task.id,
+        task.status
+      );
+      assertChanged(result, `Only ${task.status} lineage task ${task.id} could be cancelled.`);
+      if (overridingActiveTask) {
+        if (task.claimed_by_claim_id) {
+          revokeAgentClaimInDatabase(database, normalizedProject, task.claimed_by_claim_id, {
+            actor,
+            reason: "Lineage task cancelled by human override."
+          });
+        }
+        recordEvent2(database, task.id, "human_override", actor, "Lineage task cancelled by human override.", {
+          previous_claim_id: task.claimed_by_claim_id,
+          previous_status: task.status
+        });
+      }
+      recordEvent2(database, task.id, "cancelled", actor, "Lineage task cancelled.");
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
+  } finally {
+    database.close();
+  }
+}
+function cancelLineageIterateTasksForAssets(project, fields) {
+  const targetIds = fields.assetIds ? new Set(fields.assetIds) : void 0;
+  return listLineageTasks(project, fields.rootAssetId, ["pending"]).tasks.filter((task) => task.task_type === "iterate").filter((task) => !targetIds || targetIds.has(task.target_asset_id)).map((task) => cancelLineageTask(project, {
+    actor: fields.actor,
+    confirmWrite: fields.confirmWrite,
+    taskId: task.id
+  }));
+}
+
+// src/server/assetLineageWorkspaces.ts
+var actors = /* @__PURE__ */ new Set(["human", "agent", "system"]);
+var statuses = /* @__PURE__ */ new Set(["active", "paused", "archived"]);
+var LineageWorkspaceError = class extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+function isLineageWorkspaceError(error) {
+  return error instanceof LineageWorkspaceError;
+}
+function lineageWorkspaceId(project, rootAssetId) {
+  return `${project}:lineage-workspace:${rootAssetId}`;
+}
+function ensureProject3(database, project) {
+  const timestamp = nowIso();
+  database.prepare(`
+    insert into projects (id, product, created_at, updated_at)
+    values (?, ?, ?, ?)
+    on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
+  `).run(project, project, timestamp, timestamp);
+}
+function normalizeStatus2(value, fallback) {
+  const status = value || fallback;
+  if (!statuses.has(status)) throw new LineageWorkspaceError(`Unsupported lineage workspace status: ${status}`);
+  return status;
+}
+function normalizeActor2(value) {
+  const actor = value || "human";
+  if (!actors.has(actor)) throw new LineageWorkspaceError(`Unsupported lineage workspace actor: ${actor}`);
+  return actor;
+}
+function requireAsset2(database, project, assetId) {
+  const row = database.prepare("select id, title from assets where project_id = ? and id = ?").get(project, assetId);
+  if (!row) throw new LineageWorkspaceError(`Unknown indexed asset: ${assetId}`, 404);
+  return row;
+}
+function rowToWorkspace(row) {
+  return {
+    id: String(row.id),
+    project: String(row.project_id),
+    root_asset_id: String(row.root_asset_id),
+    title: String(row.title),
+    status: String(row.status),
+    notes: typeof row.notes === "string" ? row.notes : void 0,
+    created_by: String(row.created_by),
+    active_at: typeof row.active_at === "string" ? row.active_at : void 0,
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at)
+  };
+}
+function workspaceById(database, project, id) {
+  const row = database.prepare("select * from lineage_workspaces where project_id = ? and id = ?").get(project, id);
+  return row ? rowToWorkspace(row) : null;
+}
+function workspaceByRoot(database, project, rootAssetId) {
+  const row = database.prepare("select * from lineage_workspaces where project_id = ? and root_asset_id = ?").get(project, rootAssetId);
+  return row ? rowToWorkspace(row) : null;
+}
+function knownRoots(database, project) {
+  const rows = database.prepare(`
+    select root_asset_id, max(selected_at) selected_at from asset_selections where project_id = ? group by root_asset_id
+    union
+    select root_asset_id, null selected_at from asset_layouts where project_id = ? group by root_asset_id
+    union
+    select parent_asset_id root_asset_id, null selected_at
+    from asset_edges
+    where project_id = ?
+      and parent_asset_id not in (select child_asset_id from asset_edges where project_id = ?)
+    group by parent_asset_id
+  `).all(project, project, project, project);
+  return rows.map((row) => ({ root_asset_id: row.root_asset_id, selected_at: row.selected_at || void 0 }));
+}
+function seedLegacyWorkspaces(database, project) {
+  ensureProject3(database, project);
+  const timestamp = nowIso();
+  const statement = database.prepare(`
+    insert into lineage_workspaces (
+      id, project_id, root_asset_id, title, status, notes, created_by, active_at, created_at, updated_at
+    )
+    select ?, ?, a.id, a.title || ' lineage', 'active', null, 'system', ?, ?, ?
+    from assets a
+    where a.project_id = ? and a.id = ?
+    on conflict(project_id, root_asset_id) do nothing
+  `);
+  for (const root of knownRoots(database, project)) {
+    statement.run(
+      lineageWorkspaceId(project, root.root_asset_id),
+      project,
+      root.selected_at || null,
+      timestamp,
+      timestamp,
+      project,
+      root.root_asset_id
+    );
+  }
+}
+function listRows(database, project) {
+  return database.prepare(`
+    select * from lineage_workspaces
+    where project_id = ?
+    order by
+      case status when 'active' then 0 when 'paused' then 1 else 2 end,
+      active_at desc nulls last,
+      updated_at desc,
+      title
+  `).all(project).map(rowToWorkspace);
+}
+function activeWorkspace(database, project) {
+  const row = database.prepare(`
+    select * from lineage_workspaces
+    where project_id = ? and status != 'archived'
+    order by active_at desc nulls last, updated_at desc
+    limit 1
+  `).get(project);
+  return row ? rowToWorkspace(row) : null;
+}
+function listLineageWorkspaces(project) {
+  const database = lineageDb();
+  try {
+    seedLegacyWorkspaces(database, project);
+    return {
+      project,
+      active_workspace: activeWorkspace(database, project),
+      workspaces: listRows(database, project),
+      fetchedAt: nowIso()
+    };
   } finally {
     database.close();
   }
 }
-function releaseAgentClaim(claimToken) {
+function inspectLineageWorkspace(project, workspaceId) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, claimToken);
-    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
-    const timestamp = nowIso();
-    database.prepare("update agent_claims set status = 'released', released_at = ? where id = ?").run(timestamp, claim.id);
-    recordEvent(database, claim.id, "released", claim.agent_name, "Claim released by token holder.");
-    return { ok: true, claim: findClaimById(database, claim.id) };
+    seedLegacyWorkspaces(database, project);
+    const workspace = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
+    if (!workspace) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
+    return workspace;
   } finally {
     database.close();
   }
 }
-function releaseStaleAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Releasing a stale agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  if (!fields.reason?.trim()) throw new AgentClaimError("Releasing a stale agent claim requires a reason.", 400, "reason_required");
+function createLineageWorkspace(project, fields) {
+  const rootAssetId = fields.rootAssetId.trim();
+  if (!rootAssetId) throw new LineageWorkspaceError("Lineage workspace requires rootAssetId");
+  const status = normalizeStatus2(fields.status, "active");
+  const actor = normalizeActor2(fields.createdBy);
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    if (claim.status !== "active" || claim.derived_state !== "stale") {
-      throw new AgentClaimError("Only stale active claims can be released without the claim token.", 409, "claim_not_stale", [claim]);
-    }
+    const root = requireAsset2(database, project, rootAssetId);
     const timestamp = nowIso();
-    database.prepare("update agent_claims set status = 'released', released_at = ?, revoked_by = ?, override_reason = ? where id = ?").run(timestamp, fields.actor || "human", fields.reason, claim.id);
-    recordEvent(database, claim.id, "released", fields.actor || "human", fields.reason);
-    return { ok: true, claim: findClaimById(database, claim.id) };
+    const workspace = {
+      id: lineageWorkspaceId(project, rootAssetId),
+      project,
+      root_asset_id: rootAssetId,
+      title: fields.title?.trim() || `${root.title} lineage`,
+      status,
+      notes: fields.notes?.trim() || void 0,
+      created_by: actor,
+      active_at: fields.activate !== false && status !== "archived" ? timestamp : void 0,
+      created_at: timestamp,
+      updated_at: timestamp
+    };
+    if (!fields.confirmWrite) return { ok: true, dryRun: true, workspace };
+    ensureProject3(database, project);
+    database.prepare(`
+      insert into lineage_workspaces (
+        id, project_id, root_asset_id, title, status, notes, created_by, active_at, created_at, updated_at
+      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      on conflict(project_id, root_asset_id) do update set
+        title = excluded.title,
+        status = excluded.status,
+        notes = excluded.notes,
+        active_at = coalesce(excluded.active_at, lineage_workspaces.active_at),
+        updated_at = excluded.updated_at
+    `).run(
+      workspace.id,
+      project,
+      workspace.root_asset_id,
+      workspace.title,
+      workspace.status,
+      workspace.notes || null,
+      workspace.created_by,
+      workspace.active_at || null,
+      workspace.created_at,
+      workspace.updated_at
+    );
+    return {
+      ok: true,
+      message: `Saved lineage workspace ${workspace.title}`,
+      workspace: workspaceById(database, project, workspace.id)
+    };
   } finally {
     database.close();
   }
 }
-function revokeAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Revoking an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  if (!fields.reason?.trim()) throw new AgentClaimError("Revoking an agent claim requires a reason.", 400, "reason_required");
+function updateLineageWorkspace(project, workspaceId, fields) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    seedLegacyWorkspaces(database, project);
+    const current = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
+    if (!current) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
     const timestamp = nowIso();
+    const next = {
+      ...current,
+      title: fields.title?.trim() || current.title,
+      status: normalizeStatus2(fields.status, current.status),
+      notes: fields.notes === void 0 ? current.notes : fields.notes.trim() || void 0,
+      active_at: fields.activate ? timestamp : current.active_at,
+      updated_at: timestamp
+    };
+    if (!fields.confirmWrite) return { ok: true, dryRun: true, workspace: next };
     database.prepare(`
-      update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
-      where id = ?
-    `).run(timestamp, fields.actor || "human", fields.reason, claim.id);
-    recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
-    return { ok: true, claim: findClaimById(database, claim.id) };
+      update lineage_workspaces
+      set title = ?, status = ?, notes = ?, active_at = ?, updated_at = ?
+      where project_id = ? and id = ?
+    `).run(next.title, next.status, next.notes || null, next.active_at || null, timestamp, project, current.id);
+    return {
+      ok: true,
+      message: `Updated lineage workspace ${next.title}`,
+      workspace: workspaceById(database, project, current.id)
+    };
   } finally {
     database.close();
   }
 }
-function transferAgentClaim(project, claimId, fields) {
-  if (!fields.confirmWrite) throw new AgentClaimError("Transferring an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
-  const toAgentName = fields.toAgentName.trim();
-  if (!toAgentName) throw new AgentClaimError("Transfer requires toAgentName.", 400, "agent_name_required");
+function activateLineageWorkspace(project, workspaceId, confirmWrite) {
+  return updateLineageWorkspace(project, workspaceId, { activate: true, status: "active", confirmWrite });
+}
+function archiveLineageWorkspace(project, workspaceId, confirmWrite) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const claim = findClaimById(database, claimId, project);
-    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
-    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
-    database.prepare("update agent_claims set agent_name = ? where id = ?").run(toAgentName, claim.id);
-    recordEvent(database, claim.id, "transferred", fields.actor || "human", fields.reason || `Transferred claim to ${toAgentName}.`, { to_agent_name: toAgentName });
-    return { ok: true, claim: findClaimById(database, claim.id) };
+    seedLegacyWorkspaces(database, project);
+    const current = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
+    if (!current) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
+    const timestamp = nowIso();
+    const next = {
+      ...current,
+      status: "archived",
+      active_at: void 0,
+      updated_at: timestamp
+    };
+    if (!confirmWrite) return { ok: true, dryRun: true, workspace: next };
+    cancelLineageIterateTasksForAssets(project, {
+      actor: "human",
+      confirmWrite: true,
+      rootAssetId: current.root_asset_id
+    });
+    database.prepare(`
+      update lineage_workspaces
+      set status = 'archived', active_at = null, updated_at = ?
+      where project_id = ? and id = ?
+    `).run(timestamp, project, current.id);
+    database.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, current.root_asset_id);
+    return {
+      ok: true,
+      message: `Archived lineage workspace ${current.title}`,
+      workspace: workspaceById(database, project, current.id)
+    };
   } finally {
     database.close();
   }
 }
-function validateAgentClaimForWrite(fields) {
-  if (fields.dangerLevel === "danger" && !fields.confirmWrite) {
-    return denied("human_confirmation_required", "Dangerous write requires explicit human confirmation.");
-  }
-  if (!fields.claimToken) return denied("claim_required", "Mutating agent write requires a matching claim token.");
+function activeLineageWorkspaceRoot(project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
-    const row = findClaimRowByToken(database, fields.claimToken);
-    if (!row) return denied("claim_token_invalid", "Unknown or invalid claim token.");
-    const claim = rowToClaim(row);
-    if (claim.status !== "active") return denied("claim_not_active", `Agent claim is ${claim.status}.`);
-    if (new Date(claim.expires_at).getTime() <= Date.now()) return denied("claim_expired", "Agent claim has expired.");
-    if (claim.project !== fields.project) return denied("claim_project_mismatch", `Claim project ${claim.project} does not match ${fields.project}.`, [claim]);
-    if (fields.channel && claim.channel && claim.channel !== fields.channel) {
-      return denied("claim_channel_mismatch", `Claim channel ${claim.channel} does not match ${fields.channel}.`, [claim]);
-    }
-    if (!scopeAllowsWrite(claim, fields.scopeType, fields.targetId, fields.writeKind)) {
-      return denied("claim_scope_mismatch", `Claim does not cover ${fields.scopeType} ${fields.targetId}.`, [claim]);
-    }
-    recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
-      danger_level: fields.dangerLevel,
-      target_id: fields.targetId,
-      write_kind: fields.writeKind
-    });
-    return { ok: true, claim, warnings: [] };
+    seedLegacyWorkspaces(database, project);
+    return activeWorkspace(database, project)?.root_asset_id;
   } finally {
     database.close();
   }
@@ -2104,7 +2843,7 @@ function indexLineageAssets(project = defaultProject) {
   database.close();
   return { catalog: catalog.length, local: local.length, total: catalog.length + local.length, database: lineageDbPath() };
 }
-function requireAsset2(database, project, assetId) {
+function requireAsset3(database, project, assetId) {
   const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
   if (!row) throw new LineageError(`Unknown indexed asset: ${assetId}`, 404);
 }
@@ -2124,7 +2863,7 @@ function rootFor(database, project, assetId) {
   return assetId;
 }
 function assertCanonicalRoot(database, project, root) {
-  requireAsset2(database, project, root);
+  requireAsset3(database, project, root);
   const canonicalRoot = rootFor(database, project, root);
   if (canonicalRoot !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
 }
@@ -2161,7 +2900,7 @@ function lineageWriteClaimContext(database, project, assetId) {
 function getLineageWriteClaimContext(project, assetId) {
   const database = lineageDb();
   try {
-    requireAsset2(database, project, assetId);
+    requireAsset3(database, project, assetId);
     return lineageWriteClaimContext(database, project, assetId);
   } finally {
     database.close();
@@ -2173,12 +2912,12 @@ function latestSelectedRoot(database, project) {
 }
 function resolveRoot(database, project, rootAssetId) {
   if (rootAssetId) {
-    requireAsset2(database, project, rootAssetId);
+    requireAsset3(database, project, rootAssetId);
     return rootAssetId;
   }
   const root = activeLineageWorkspaceRoot(project) || latestSelectedRoot(database, project);
   if (!root) throw new LineageError("Lineage command requires --root unless a project selection exists");
-  requireAsset2(database, project, root);
+  requireAsset3(database, project, root);
   return root;
 }
 function edgeId(project, parent, child) {
@@ -2203,6 +2942,33 @@ function rerollRequestFrom(row) {
     resolved_at: rowString(row.resolved_at)
   };
 }
+function tasksByTarget(tasks) {
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const task of tasks) {
+    if (task.task_type !== "iterate" && task.task_type !== "reroll") continue;
+    const existing = byTarget.get(task.target_asset_id) || {};
+    existing[task.task_type] = task;
+    byTarget.set(task.target_asset_id, existing);
+  }
+  return byTarget;
+}
+function withRerollTask(request, task) {
+  return task ? { ...request, task_id: task.id, task } : request;
+}
+function taskBackedRerollRequest(project, rootAssetId, task) {
+  return {
+    id: `${task.id}:request`,
+    project_id: project,
+    root_asset_id: rootAssetId,
+    node_asset_id: task.target_asset_id,
+    status: "pending",
+    requested_by: task.created_by,
+    notes: task.instructions,
+    created_at: task.created_at,
+    task_id: task.id,
+    task
+  };
+}
 function attemptFrom(row) {
   return {
     id: String(row.id),
@@ -2242,7 +3008,7 @@ function withImplicitAttempt(physicalAttempts, row) {
 }
 function assertNodeInRoot(database, project, root, node) {
   assertCanonicalRoot(database, project, root);
-  requireAsset2(database, project, node);
+  requireAsset3(database, project, node);
   const nodeRoot = rootFor(database, project, node);
   if (nodeRoot !== root) throw new LineageError(`Asset ${node} is not in lineage rooted at ${root}`);
 }
@@ -2256,8 +3022,8 @@ function localPreviewUrl(project, localPath) {
 }
 function linkLineageAssets(project, fields) {
   const database = lineageDb();
-  requireAsset2(database, project, fields.parentAssetId);
-  requireAsset2(database, project, fields.childAssetId);
+  requireAsset3(database, project, fields.parentAssetId);
+  requireAsset3(database, project, fields.childAssetId);
   if (fields.parentAssetId === fields.childAssetId) throw new LineageError("Lineage link cannot point to itself");
   const claimContext = lineageWriteClaimContext(database, project, fields.parentAssetId);
   try {
@@ -2308,10 +3074,17 @@ function descendants(database, project, root) {
 }
 function getLineageSnapshot(project, assetId) {
   const database = lineageDb();
-  requireAsset2(database, project, assetId);
+  requireAsset3(database, project, assetId);
   const root = explicitWorkspaceRoot(database, project, assetId) || rootFor(database, project, assetId);
   const edges = descendants(database, project, root);
-  const ids = [.../* @__PURE__ */ new Set([root, ...edges.flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id])])];
+  const selected = selectedRows(database, project, root);
+  const tasks = listLineageTasks(project, root).tasks;
+  const ids = [.../* @__PURE__ */ new Set([
+    root,
+    ...edges.flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id]),
+    ...selected.map((row) => row.asset_id),
+    ...tasks.map((task) => task.target_asset_id)
+  ])];
   const placeholders2 = ids.map(() => "?").join(",");
   const rows = database.prepare(`
     select a.id asset_id, a.project_id project, a.source, a.title, a.media_type, a.status, a.channel, a.campaign,
@@ -2326,12 +3099,12 @@ function getLineageSnapshot(project, assetId) {
   for (const attempt of attemptRows.map(attemptFrom)) {
     attemptsByNode.set(attempt.node_asset_id, [...attemptsByNode.get(attempt.node_asset_id) || [], attempt]);
   }
+  const lineageTasksByNode = tasksByTarget(tasks);
   const rerollRows = ids.length > 0 ? database.prepare(`select * from asset_reroll_requests where project_id = ? and root_asset_id = ? and status = 'pending' and node_asset_id in (${placeholders2}) order by created_at`).all(project, root, ...ids) : [];
   const rerollsByNode = new Map(rerollRows.map((row) => {
     const request = rerollRequestFrom(row);
-    return [request.node_asset_id, request];
+    return [request.node_asset_id, withRerollTask(request, lineageTasksByNode.get(request.node_asset_id)?.reroll)];
   }));
-  const selected = selectedRows(database, project, root);
   const childIds = new Set(edges.map((edge) => edge.parent_asset_id));
   const selectedIds = new Set(selected.map((row) => row.asset_id));
   const selections = selected.map((row) => ({
@@ -2348,11 +3121,13 @@ function getLineageSnapshot(project, assetId) {
     const attempts = withImplicitAttempt(attemptsByNode.get(row.asset_id) || [], row);
     const currentAttempt = attempts.find((attempt) => attempt.is_current) || attempts[0];
     const previewPath = currentAttempt?.file_path || row.local_path;
+    const lineageTasks = lineageTasksByNode.get(row.asset_id);
     return {
       ...node,
       attempt_count: attempts.length,
       current_attempt: currentAttempt,
       is_latest: !childIds.has(row.asset_id),
+      lineage_tasks: lineageTasks && Object.keys(lineageTasks).length > 0 ? lineageTasks : void 0,
       position,
       preview_url: canPreviewLocally(row.media_type, previewPath) ? localPreviewUrl(project, previewPath) : void 0,
       reroll_request: rerollsByNode.get(row.asset_id),
@@ -2368,6 +3143,7 @@ function getLineageSnapshot(project, assetId) {
     selected: selections.map((row) => row.asset_id),
     selection,
     selections,
+    tasks,
     latest: nodes.filter((node) => node.is_latest).map((node) => node.asset_id),
     nodes,
     edges,
@@ -2377,8 +3153,8 @@ function getLineageSnapshot(project, assetId) {
 function updateLineageLayout(project, fields) {
   if (fields.positions.length === 0) throw new LineageError("Lineage layout requires at least one position");
   const database = lineageDb();
-  requireAsset2(database, project, fields.rootAssetId);
-  for (const position of fields.positions) requireAsset2(database, project, position.assetId);
+  requireAsset3(database, project, fields.rootAssetId);
+  for (const position of fields.positions) requireAsset3(database, project, position.assetId);
   try {
     requireLineageWorkspaceClaimForWrite({
       channel: assetChannel(database, project, fields.rootAssetId),
@@ -2414,7 +3190,25 @@ function getLineageNextAsset(project, rootAssetId) {
   const root = resolveRoot(database, project, rootAssetId);
   database.close();
   const snapshot = getLineageSnapshot(project, root);
-  const selectedNodes = snapshot.selected.map((assetId) => snapshot.nodes.find((node) => node.asset_id === assetId)).filter((node) => Boolean(node));
+  const pendingIterateTasks = (snapshot.tasks || []).filter((task) => task.task_type === "iterate" && task.status === "pending");
+  const taskIdsInSelectionOrder = [
+    ...snapshot.selections.map((selection) => selection.asset_id).filter((assetId) => pendingIterateTasks.some((task) => task.target_asset_id === assetId)),
+    ...pendingIterateTasks.map((task) => task.target_asset_id).filter((assetId) => !snapshot.selections.some((selection) => selection.asset_id === assetId))
+  ];
+  const taskSelectedIds = [...new Set(taskIdsInSelectionOrder)];
+  const selectedIds = taskSelectedIds.length > 0 ? taskSelectedIds : snapshot.selected;
+  const selectedNodes = selectedIds.map((assetId) => snapshot.nodes.find((node) => node.asset_id === assetId)).filter((node) => Boolean(node));
+  const taskSelections = taskSelectedIds.map((assetId, position) => {
+    const task = pendingIterateTasks.find((item) => item.target_asset_id === assetId);
+    return {
+      asset_id: assetId,
+      notes: task?.instructions,
+      position,
+      selected_at: task?.created_at || nowIso()
+    };
+  });
+  const selectedSelection = taskSelections.length > 0 ? taskSelections[0] : snapshot.selection;
+  const selectedSelections = taskSelections.length > 0 ? taskSelections : snapshot.selections;
   const latestNodes = snapshot.nodes.filter((node) => snapshot.latest.includes(node.asset_id));
   const warnings = [];
   for (const selectedNode of selectedNodes) {
@@ -2432,9 +3226,9 @@ function getLineageNextAsset(project, rootAssetId) {
       next_asset: selectedNodes[0],
       next_assets: selectedNodes,
       latest: snapshot.latest,
-      selected: snapshot.selected,
-      selection: snapshot.selection,
-      selections: snapshot.selections,
+      selected: selectedIds,
+      selection: selectedSelection,
+      selections: selectedSelections,
       candidates: latestNodes,
       warnings,
       fetchedAt: nowIso()
@@ -2451,9 +3245,9 @@ function getLineageNextAsset(project, rootAssetId) {
       next_asset: latestNodes[0],
       next_assets: [latestNodes[0]],
       latest: snapshot.latest,
-      selected: snapshot.selected,
-      selection: snapshot.selection,
-      selections: snapshot.selections,
+      selected: selectedIds,
+      selection: selectedSelection,
+      selections: selectedSelections,
       candidates: latestNodes,
       warnings,
       fetchedAt: nowIso()
@@ -2469,9 +3263,9 @@ function getLineageNextAsset(project, rootAssetId) {
     next_asset: null,
     next_assets: [],
     latest: snapshot.latest,
-    selected: snapshot.selected,
-    selection: snapshot.selection,
-    selections: snapshot.selections,
+    selected: selectedIds,
+    selection: selectedSelection,
+    selections: selectedSelections,
     candidates: latestNodes,
     warnings,
     fetchedAt: nowIso()
@@ -2493,12 +3287,23 @@ function listLineageRerollRequests(project, rootAssetId) {
   const database = lineageDb();
   try {
     assertCanonicalRoot(database, project, rootAssetId);
+    const rerollTasks = listLineageTasks(project, rootAssetId).tasks.filter((task) => task.task_type === "reroll");
+    const pendingRerollTasks = listLineageTasks(project, rootAssetId, ["pending"]).tasks.filter((task) => task.task_type === "reroll");
+    const rerollTaskByTarget = new Map(rerollTasks.map((task) => [task.target_asset_id, task]));
     const rows = database.prepare(`
       select * from asset_reroll_requests
       where project_id = ? and root_asset_id = ? and status = 'pending'
       order by created_at, id
     `).all(project, rootAssetId);
-    return { project, root_asset_id: rootAssetId, requests: rows.map(rerollRequestFrom), fetchedAt: nowIso() };
+    const requests = rows.map((row) => {
+      const request = rerollRequestFrom(row);
+      return withRerollTask(request, rerollTaskByTarget.get(request.node_asset_id));
+    });
+    const legacyTargets = new Set(requests.map((request) => request.node_asset_id));
+    for (const task of pendingRerollTasks) {
+      if (!legacyTargets.has(task.target_asset_id)) requests.push(taskBackedRerollRequest(project, rootAssetId, task));
+    }
+    return { project, root_asset_id: rootAssetId, requests, fetchedAt: nowIso() };
   } finally {
     database.close();
   }
@@ -2606,6 +3411,13 @@ function markLineageRerollRequest(project, fields) {
       created_at: timestamp
     };
     if (!fields.confirmWrite) return { ok: true, dryRun: true, request };
+    const taskResult = upsertLineageTask(project, {
+      createdBy: request.requested_by,
+      instructions: request.notes,
+      rootAssetId: fields.rootAssetId,
+      targetAssetId: fields.nodeAssetId,
+      taskType: "reroll"
+    });
     if (existing) {
       database.prepare(`
         update asset_reroll_requests
@@ -2625,7 +3437,12 @@ function markLineageRerollRequest(project, fields) {
         review_state = excluded.review_state, reviewed_at = excluded.reviewed_at,
         ignored_at = excluded.ignored_at, notes = coalesce(excluded.notes, asset_reviews.notes), updated_at = excluded.updated_at
     `).run(fields.nodeAssetId, timestamp, request.notes || null, timestamp);
-    return { ok: true, request: rerollRequestFrom(database.prepare("select * from asset_reroll_requests where id = ?").get(request.id)) };
+    return {
+      ok: true,
+      request: withRerollTask(rerollRequestFrom(database.prepare("select * from asset_reroll_requests where id = ?").get(request.id)), taskResult.task),
+      task_id: taskResult.task.id,
+      task: taskResult.task
+    };
   } finally {
     database.close();
   }
@@ -2643,59 +3460,104 @@ function clearLineageRerollRequest(project, fields) {
     const timestamp = nowIso();
     const request = { ...rerollRequestFrom(existing), status: "cancelled", resolved_at: timestamp };
     if (!fields.confirmWrite) return { ok: true, dryRun: true, request };
+    const task = listLineageTasks(project, fields.rootAssetId, ["pending"]).tasks.find((item) => item.task_type === "reroll" && item.target_asset_id === fields.nodeAssetId);
+    const cancelledTask = task ? cancelLineageTask(project, {
+      actor: "human",
+      confirmWrite: true,
+      taskId: task.id
+    }).task : void 0;
     database.prepare(`
       update asset_reroll_requests
       set status = 'cancelled', resolved_at = ?
       where id = ?
     `).run(timestamp, request.id);
-    return { ok: true, request };
+    return {
+      ok: true,
+      request: withRerollTask(request, cancelledTask),
+      task_id: cancelledTask?.id,
+      task: cancelledTask
+    };
   } finally {
     database.close();
   }
 }
 function updateSelectedAsset(project, fields) {
   const database = lineageDb();
-  const inputAssetIds = normalizeSelectionInput(fields);
-  const root = fields.rootAssetId || (inputAssetIds[0] ? rootFor(database, project, inputAssetIds[0]) : "");
-  if (!root) throw new LineageError("Selection requires rootAssetId or assetId");
-  requireAsset2(database, project, root);
-  for (const assetId of inputAssetIds) requireAsset2(database, project, assetId);
-  const mode = fields.mode || "replace";
-  const limit = fields.maxSelections || LINEAGE_NEXT_VARIATION_LIMIT;
-  if (!fields.confirmWrite) {
+  let root;
+  let current;
+  let inputAssetIds;
+  let mode;
+  let limit;
+  let nextIds;
+  const notesByAsset = /* @__PURE__ */ new Map();
+  try {
+    inputAssetIds = normalizeSelectionInput(fields);
+    root = fields.rootAssetId || (inputAssetIds[0] ? rootFor(database, project, inputAssetIds[0]) : "");
+    if (!root) throw new LineageError("Selection requires rootAssetId or assetId");
+    requireAsset3(database, project, root);
+    for (const assetId of inputAssetIds) requireAsset3(database, project, assetId);
+    mode = fields.mode || "replace";
+    limit = fields.maxSelections || LINEAGE_NEXT_VARIATION_LIMIT;
+    if (!fields.confirmWrite) {
+      return { ok: true, dryRun: true, root_asset_id: root, asset_ids: inputAssetIds, mode, clear: Boolean(fields.clear), max_selections: limit };
+    }
+    current = selectedRows(database, project, root);
+    nextIds = current.map((row) => row.asset_id);
+    if (fields.clear) {
+      nextIds = [];
+    } else if (mode === "replace") {
+      nextIds = inputAssetIds;
+    } else if (mode === "add") {
+      nextIds = [...nextIds, ...inputAssetIds];
+    } else if (mode === "remove") {
+      nextIds = nextIds.filter((assetId) => !inputAssetIds.includes(assetId));
+    } else if (mode === "toggle") {
+      for (const assetId of inputAssetIds) {
+        nextIds = nextIds.includes(assetId) ? nextIds.filter((id) => id !== assetId) : [...nextIds, assetId];
+      }
+    }
+    nextIds = [...new Set(nextIds)];
+    if (!fields.clear && inputAssetIds.length === 0) throw new LineageError("Selection set requires assetId or assetIds");
+    if (nextIds.length > limit) throw new LineageError(`Select at most ${limit} assets for next variation`);
+    for (const assetId of nextIds) {
+      const existing = current.find((row) => row.asset_id === assetId);
+      notesByAsset.set(assetId, inputAssetIds.includes(assetId) ? fields.notes || existing?.notes : existing?.notes);
+    }
+  } finally {
     database.close();
-    return { ok: true, dryRun: true, root_asset_id: root, asset_ids: inputAssetIds, mode, clear: Boolean(fields.clear), max_selections: limit };
   }
-  const current = selectedRows(database, project, root);
-  let nextIds = current.map((row) => row.asset_id);
-  if (fields.clear) {
-    nextIds = [];
-  } else if (mode === "replace") {
-    nextIds = inputAssetIds;
-  } else if (mode === "add") {
-    nextIds = [...nextIds, ...inputAssetIds];
-  } else if (mode === "remove") {
-    nextIds = nextIds.filter((assetId) => !inputAssetIds.includes(assetId));
-  } else if (mode === "toggle") {
-    for (const assetId of inputAssetIds) {
-      nextIds = nextIds.includes(assetId) ? nextIds.filter((id) => id !== assetId) : [...nextIds, assetId];
+  const removedIds = current.map((row) => row.asset_id).filter((assetId) => !nextIds.includes(assetId));
+  const openIterateTasks = listLineageTasks(project, root, ["pending"]).tasks.filter((task) => task.task_type === "iterate");
+  for (const assetId of removedIds) {
+    const task = openIterateTasks.find((item) => item.target_asset_id === assetId);
+    if (task) {
+      cancelLineageTask(project, {
+        actor: "human",
+        confirmWrite: true,
+        taskId: task.id
+      });
     }
   }
-  nextIds = [...new Set(nextIds)];
-  if (!fields.clear && inputAssetIds.length === 0) throw new LineageError("Selection set requires assetId or assetIds");
-  if (nextIds.length > limit) throw new LineageError(`Select at most ${limit} assets for next variation`);
-  database.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, root);
+  for (const assetId of nextIds) {
+    upsertLineageTask(project, {
+      createdBy: "human",
+      instructions: notesByAsset.get(assetId),
+      rootAssetId: root,
+      targetAssetId: assetId,
+      taskType: "iterate"
+    });
+  }
+  const writeDatabase = lineageDb();
+  writeDatabase.prepare("delete from asset_selections where project_id = ? and root_asset_id = ?").run(project, root);
   const timestamp = nowIso();
-  const insert = database.prepare(`
+  const insert = writeDatabase.prepare(`
     insert into asset_selections (id, project_id, root_asset_id, asset_id, position, notes, selected_at)
     values (?, ?, ?, ?, ?, ?, ?)
   `);
   nextIds.forEach((assetId, position) => {
-    const existing = current.find((row) => row.asset_id === assetId);
-    const notes = inputAssetIds.includes(assetId) ? fields.notes || existing?.notes : existing?.notes;
-    insert.run(selectionId(project, root, assetId), project, root, assetId, position, notes || null, timestamp);
+    insert.run(selectionId(project, root, assetId), project, root, assetId, position, notesByAsset.get(assetId) || null, timestamp);
   });
-  database.close();
+  writeDatabase.close();
   const message = nextIds.length === 0 ? `Cleared selected assets for ${root}` : `Selected ${nextIds.length} asset${nextIds.length === 1 ? "" : "s"} for ${root}`;
   return { ok: true, message, root_asset_id: root, asset_id: nextIds[0] || null, asset_ids: nextIds, mode };
 }
@@ -2703,7 +3565,7 @@ function updateAssetReview(project, fields) {
   const allowed = /* @__PURE__ */ new Set(["unreviewed", "approved", "needs_revision", "rejected", "ignored"]);
   if (!allowed.has(fields.reviewState)) throw new LineageError(`Unsupported review state: ${fields.reviewState}`);
   const database = lineageDb();
-  requireAsset2(database, project, fields.assetId);
+  requireAsset3(database, project, fields.assetId);
   if (!fields.confirmWrite) {
     database.close();
     return { ok: true, dryRun: true, asset_id: fields.assetId, review_state: fields.reviewState, notes: fields.notes };
@@ -2731,6 +3593,9 @@ function lineageCommand(command, project, rootAssetId) {
 function linkChildCommand(project, rootAssetId) {
   return `${publicPackageCommand} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write --db ${shellQuote(lineageDbPath())} --json`;
 }
+function rerollImportGuidance(rootAssetId, targetAssetId) {
+  return `Use lineage reroll plan --root ${rootAssetId} --target ${targetAssetId} and lineage reroll import instead.`;
+}
 function getLineageBrief(project, rootAssetId) {
   const next = getLineageNextAsset(project, rootAssetId);
   const assets = next.next_assets;
@@ -2777,6 +3642,14 @@ function getLineageBrief(project, rootAssetId) {
 function linkSelectedLineageChild(project, fields) {
   const next = getLineageNextAsset(project, fields.rootAssetId);
   if (!next.next_asset) throw new LineageError("Cannot link child until a next base is selected or unambiguous");
+  const rerollRequests = listLineageRerollRequests(project, next.root_asset_id).requests;
+  const pendingRerollForParent = rerollRequests.find((request) => request.node_asset_id === next.next_asset?.asset_id);
+  if (pendingRerollForParent && fields.confirmWrite) {
+    throw new LineageError(
+      `Pending re-roll exists for ${pendingRerollForParent.node_asset_id}. lineage link-child creates a visible child variation edge; it does not re-roll the same node. ${rerollImportGuidance(next.root_asset_id, pendingRerollForParent.node_asset_id)} Cancel the re-roll first if you intentionally want a new child variation.`,
+      409
+    );
+  }
   if (fields.confirmWrite) {
     const claimContext = getLineageWriteClaimContext(project, next.next_asset.asset_id);
     const validation = validateAgentClaimForWrite({
@@ -2803,12 +3676,16 @@ function linkSelectedLineageChild(project, fields) {
     parent_asset_id: next.next_asset.asset_id,
     child_asset_id: fields.childAssetId,
     reference_asset_ids: next.next_assets.map((asset) => asset.asset_id),
-    warning: next.next_assets.length > 1 ? "Linked child to the primary selected base; add explicit edges to other selected references if the child derives from them too." : void 0
+    warning: [
+      pendingRerollForParent ? `Pending re-roll exists for ${pendingRerollForParent.node_asset_id}. link-child would create a visible child variation; use reroll plan/import to update the same node attempt.` : void 0,
+      rerollRequests.length > 0 && !pendingRerollForParent ? `This lineage has ${rerollRequests.length} pending re-roll target(s). link-child is only for new visible child variations, not re-roll attempts.` : void 0,
+      next.next_assets.length > 1 ? "Linked child to the primary selected base; add explicit edges to other selected references if the child derives from them too." : void 0
+    ].filter(Boolean).join(" ") || void 0
   };
 }
 
 // src/server/assetLineageRemove.ts
-function requireAsset3(database, project, assetId) {
+function requireAsset4(database, project, assetId) {
   const row = database.prepare("select id from assets where project_id = ? and id = ?").get(project, assetId);
   if (!row) throw new LineageError(`Unknown indexed asset: ${assetId}`, 404);
 }
@@ -2850,9 +3727,9 @@ function compactSelectionsAfterRemove(database, project, root, assetId, timestam
 }
 function removeLineageNode(project, fields) {
   const database = lineageDb();
-  requireAsset3(database, project, fields.assetId);
+  requireAsset4(database, project, fields.assetId);
   const root = fields.rootAssetId || rootFor2(database, project, fields.assetId);
-  requireAsset3(database, project, root);
+  requireAsset4(database, project, root);
   if (fields.assetId === root) {
     database.close();
     throw new LineageError("Cannot remove the root lineage node; archive the workspace or create a new root instead.");
@@ -2900,6 +3777,19 @@ function removeLineageNode(project, fields) {
       asset_preserved: true
     };
   }
+  if (selectionRemoved) {
+    try {
+      cancelLineageIterateTasksForAssets(project, {
+        actor: "human",
+        assetIds: [fields.assetId],
+        confirmWrite: true,
+        rootAssetId: root
+      });
+    } catch (error) {
+      database.close();
+      throw error;
+    }
+  }
   try {
     database.exec("begin immediate transaction");
     const deleteEdge = database.prepare("delete from asset_edges where id = ? and project_id = ?");
@@ -3702,7 +4592,7 @@ function requireText(value, label) {
   if (!text) throw new AssetSelectionError(`Selection ${label} is required`);
   return text;
 }
-function normalizeActor2(value, fallback) {
+function normalizeActor3(value, fallback) {
   const actor = value || fallback;
   if (!actors2.has(actor)) throw new AssetSelectionError(`Unsupported selection actor: ${actor}`);
   return actor;
@@ -3834,7 +4724,7 @@ function getAssetSelectionSnapshot(project) {
 }
 function selectCurrentAssets(project, fields) {
   const assetIds = [...new Set(fields.assetIds.map((assetId) => assetId.trim()).filter(Boolean))];
-  const actor = normalizeActor2(fields.selectedBy, "human");
+  const actor = normalizeActor3(fields.selectedBy, "human");
   const preview = { assetIds, notes: fields.notes, project, selectedBy: actor };
   if (!fields.confirmWrite) return { ok: true, dryRun: true, message: `Would select ${assetIds.length} assets`, preview };
   const database = lineageDb();
@@ -3871,7 +4761,7 @@ function createReviewSet(project, fields) {
   const label = requireText(fields.label, "review set label");
   const key = fields.key?.trim() || `${slug(label)}-${Date.now().toString(36)}`;
   const assetIds = [...new Set((fields.assetIds || []).map((assetId) => assetId.trim()).filter(Boolean))];
-  const actor = normalizeActor2(fields.createdBy, "agent");
+  const actor = normalizeActor3(fields.createdBy, "agent");
   const preview = { assetIds, createdBy: actor, key, label, notes: fields.notes, project };
   if (!fields.confirmWrite) return { ok: true, dryRun: true, message: `Would create review set ${label}`, preview };
   const database = lineageDb();
@@ -3908,7 +4798,7 @@ function activeReviewSet(database, project, setId2) {
 function chooseReviewSetLabels(project, fields) {
   const labels = [...new Set(fields.labels.map((label) => label.trim().toUpperCase()).filter(Boolean))];
   if (labels.length === 0) throw new AssetSelectionError("At least one variation label is required");
-  const actor = normalizeActor2(fields.selectedBy, "human");
+  const actor = normalizeActor3(fields.selectedBy, "human");
   const database = lineageDb();
   try {
     const reviewSet2 = activeReviewSet(database, project, fields.setId);
@@ -5467,6 +6357,64 @@ function listImageGenerationJobs(project = defaultProject, fields = {}) {
   }
 }
 
+// src/server/lineageTaskRoutes.ts
+function stringBody3(req, key) {
+  const value = req.body[key];
+  return typeof value === "string" ? value : void 0;
+}
+function boolBody3(req, key) {
+  return req.body[key] === true;
+}
+function registerLineageTaskRoutes(app2, projectFrom2, asyncRoute2) {
+  app2.get("/api/lineage/:rootAssetId/tasks", asyncRoute2((req, res) => {
+    res.json(listLineageTasks(projectFrom2(req), req.params.rootAssetId));
+  }));
+  app2.get("/api/lineage/tasks/:taskId", asyncRoute2((req, res) => {
+    res.json(getLineageTask(projectFrom2(req), req.params.taskId));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/instructions", asyncRoute2((req, res) => {
+    res.json(updateLineageTaskInstructions(projectFrom2(req), {
+      instructions: stringBody3(req, "instructions") || "",
+      taskId: req.params.taskId
+    }));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/comment", asyncRoute2((req, res) => {
+    res.json(addLineageTaskComment(projectFrom2(req), {
+      actor: stringBody3(req, "actor") || "",
+      message: stringBody3(req, "message") || stringBody3(req, "comment") || "",
+      taskId: req.params.taskId
+    }));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/claim", asyncRoute2((req, res) => {
+    res.json(claimLineageTask(projectFrom2(req), {
+      agentName: stringBody3(req, "agentName") || stringBody3(req, "agent_name") || "",
+      taskId: req.params.taskId
+    }));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/start", asyncRoute2((req, res) => {
+    res.json(startLineageTask(projectFrom2(req), {
+      claimToken: stringBody3(req, "claimToken") || stringBody3(req, "claim_token") || "",
+      taskId: req.params.taskId
+    }));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/cancel", asyncRoute2((req, res) => {
+    res.json(cancelLineageTask(projectFrom2(req), {
+      actor: stringBody3(req, "actor") || "",
+      confirmWrite: boolBody3(req, "confirmWrite") || boolBody3(req, "confirm_write"),
+      override: boolBody3(req, "override"),
+      taskId: req.params.taskId
+    }));
+  }));
+  app2.post("/api/lineage/tasks/:taskId/override", asyncRoute2((req, res) => {
+    res.json(overrideLineageTask(projectFrom2(req), {
+      actor: stringBody3(req, "actor") || "",
+      instructions: stringBody3(req, "instructions"),
+      reason: stringBody3(req, "reason") || "",
+      taskId: req.params.taskId
+    }));
+  }));
+}
+
 // src/server/assetLineageDemo.ts
 import { createHash as createHash3 } from "node:crypto";
 import { copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -6339,6 +7287,7 @@ app.get(
   })
 );
 registerLineageWorkspaceRoutes(app, projectFrom, asyncRoute);
+registerLineageTaskRoutes(app, projectFrom, asyncRoute);
 app.get("/api/lineage/:rootAssetId/rerolls", asyncRoute((req, res) => {
   res.json(listLineageRerollRequests(projectFrom(req), req.params.rootAssetId));
 }));
@@ -6646,6 +7595,10 @@ app.use((error, _req, res, _next) => {
     res.status(error.status).json({ error: error.message });
     return;
   }
+  if (isLineageTaskError(error)) {
+    res.status(error.status).json({ error: error.message });
+    return;
+  }
   if (isLineageError(error)) {
     res.status(error.status).json({ error: error.message });
     return;