diff --git a/db/task_assets.go b/db/task_assets.go
index db87fef..cd8823c 100644
--- a/db/task_assets.go
+++ b/db/task_assets.go
@@ -288,6 +288,10 @@ FROM assets WHERE id=ANY($2::bigint[])`, taskID, assetIDs).Scan(&found, &existin
 	if found != len(assetIDs) {
 		return mutation, ErrTaskAssetAssetNotFound
 	}
+	// Order matters: this UPDATE fires trg_assets_task_links, which creates the
+	// link rows with the generic source='system'. The INSERT below must stay
+	// after it so the operator-authored 'manual' provenance wins; swapping the
+	// two statements silently degrades every manual attach back to 'system'.
 	if _, err := tx.Exec(`
 UPDATE assets
 SET task_ids=CASE WHEN $1=ANY(task_ids) THEN task_ids ELSE array_append(task_ids,$1) END
diff --git a/db/task_assets_context.go b/db/task_assets_context.go
index b14c79a..7b08c0d 100644
--- a/db/task_assets_context.go
+++ b/db/task_assets_context.go
@@ -29,12 +29,12 @@ target AS (
   JOIN task_scope ts ON (
        (ts.kind='company'     AND a.company_id = ts.company_id)
     OR (ts.kind='root_domain' AND a.root_domain = ts.domain)
-	    OR (ts.kind='subdomain'   AND a.domain = ts.domain)
-	    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
-	    OR (ts.kind='icp' AND (
-	         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	       ))
+    OR (ts.kind='subdomain'   AND a.domain = ts.domain)
+    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
+    OR (ts.kind='icp' AND (
+         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
+         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
+       ))
   )
   JOIN context_tasks ctx ON ctx.task_id=ts.task_id
 	UNION
@@ -179,12 +179,12 @@ context_assets AS (
   JOIN task_scope ts ON (
        (ts.kind='company'     AND a.company_id=ts.company_id)
     OR (ts.kind='root_domain' AND a.root_domain=ts.domain)
-	    OR (ts.kind='subdomain'   AND a.domain=ts.domain)
-	    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
-	    OR (ts.kind='icp' AND (
-	         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	       ))
+    OR (ts.kind='subdomain'   AND a.domain=ts.domain)
+    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
+    OR (ts.kind='icp' AND (
+         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
+         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
+       ))
   )
   JOIN context_tasks ctx ON ctx.task_id=ts.task_id
 )
diff --git a/db/task_scope.go b/db/task_scope.go
index f584b5d..f3907f5 100644
--- a/db/task_scope.go
+++ b/db/task_scope.go
@@ -308,13 +308,13 @@ target AS (
   JOIN task_scope ts ON ts.task_id = $1 AND (
        (ts.kind='company'     AND a.company_id = ts.company_id)
     OR (ts.kind='root_domain' AND a.root_domain = ts.domain)
-	    OR (ts.kind='subdomain'   AND a.domain = ts.domain)
-	    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
-	    OR (ts.kind='icp' AND (
-	         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
-	       ))
-	  )
+    OR (ts.kind='subdomain'   AND a.domain = ts.domain)
+    OR (ts.kind IN ('ip','cidr') AND a.ip IS NOT NULL AND a.ip !~ '[^0-9a-fA-F:.]' AND ts.net >>= a.ip::inet)
+    OR (ts.kind='icp' AND (
+         lower(regexp_replace(COALESCE(a.icp,''), '[[:space:]]+', '', 'g')) = ts.value
+         OR lower(regexp_replace(COALESCE(a.app_icp,''), '[[:space:]]+', '', 'g')) = ts.value
+       ))
+  )
 ),
 tested AS (
   SELECT DISTINCT ea.asset_id