Enable automatic browsing upvotes

docs/api.md

@@ -108,7 +108,8 @@ an administrator credential.
 | `GET` | `/api/growth` | Get per-account comment growth state | read | no |
 | `GET` | `/api/growth/{accountId}` | Get one account's growth settings, communities and comment history | read | no |
 | `PATCH` | `/api/growth/{accountId}` | Enable, disable or re-pace comment growth for an account | admin | yes |
-| `PATCH` | `/api/growth/{accountId}/browsing` | Configure simulation-only browsing selections for an account | admin | yes |
+| `PATCH` | `/api/growth/{accountId}/browsing` | Configure per-account browsing selection and automatic upvotes | admin | yes |
+| `POST` | `/api/growth/{accountId}/browsing/run` | Run one simulation-only browsing session immediately | admin | yes |
 | `POST` | `/api/growth/{accountId}/pause` | Stop an account from posting further comments | control | yes |
 | `POST` | `/api/growth/{accountId}/resume` | Clear a growth pause after reviewing the cause | admin | yes |
 | `DELETE` | `/api/growth/{accountId}/queue` | Clear queued and retryable growth threads that have not been posted | admin | yes |

docs/architecture.md

@@ -66,7 +66,7 @@ SIGINT/SIGTERM abort shared loops, stop account runtimes, stop the web server, c
 - verified Reddit and Matrix identity;
 - persistent Playwright browser profile;
 - posts, messages, outcomes, activity, outbox, and conversation state repositories;
-- growth settings, community list, comment history, adaptive comment allowance, and isolated browsing-simulation policy/audit;
+- growth settings, community list, comment history, adaptive comment allowance, and isolated browsing policy/audit with optional submitted-vote state;
 - Matrix chat cache and sync cursor;
 - media index and files;
 - rate limiter and invitation cooldown;
@@ -137,7 +137,7 @@ docs/                          Maintainer and agent documentation
 - Shared operator media: keep it under `MediaLibraryService`/`MediaLibraryRepository`; never merge it with account-owned received media.
 - New account behavior: place it in the account runtime or a service injected into it; do not add mutable cross-account identity to a singleton.
 - New account-growth behavior: keep it account-scoped and lowest-priority, fail closed before anything is published, and make every outcome visible in the growth audit trail.
-- Simulation-only account behavior: keep the decision sink separate from Reddit transports so future remote-write authority cannot appear as a hidden setting.
+- Browsing actions: keep selection and durable audit separate from the browser-session vote transport; remote writes require an explicit per-account setting and are unavailable in scan/dry-run modes.
 - New candidate stage: make transitions durable and idempotent, expose counts/reasons, and define lease/retry behavior.
 - New dashboard feature: add a feature slice and route, use shared schemas and query keys, and treat HTTP as authoritative.
 

docs/configuration.md

@@ -105,7 +105,7 @@ A per-community `dailyCap` only distributes the account allowance; caps are not
 
 Community weights feed a new weighted-random pick for each discovered growth thread. The grower queues only one new thread at a time, drains due retries and existing queue work before polling another community, and exposes an account-scoped queue clear that removes only unposted discovered/retryable rows.
 
-Browsing simulation is configured separately per account through `/api/growth/{accountId}/browsing` and reuses the enabled growth-community list and weights. It defaults off, targets 3–6 hypothetical selections per local day with a 60/40 post/comment split, enforces at least 45 minutes between sessions, respects quiet hours, excludes NSFW unless enabled, and has a non-overridable 12/day ceiling. `nextDueAt` is service-owned durable state and cannot be set through the API. Browser dry-run does not change the behavior because simulation never performs a remote write.
+Browsing sessions are configured separately per account through `/api/growth/{accountId}/browsing` and reuse the enabled growth-community list and weights. Sessions default off and target 3–6 selections per local day with a 60/40 post/comment split, enforce at least 45 minutes between sessions, respect quiet hours, exclude NSFW unless enabled, and have a non-overridable 12/day ceiling. `autoVoteEnabled` is a separate, default-off operator setting; it can submit the selected upvote only in running mode when browser dry-run is off. `nextDueAt` is service-owned durable state and cannot be set through the API.
 
 ## Runtime-editable subset
 

docs/data-flow.md

@@ -60,11 +60,11 @@ Every runtime shares one `RedditRequestCoordinator`, because Reddit can enforce
 
 Do not add local retries around this layer without preserving the shared schedule. Per-account bursts defeat the coordinator.
 
-## Browsing simulation flow
+## Browsing session flow
 
-After reply handling, response checks, and comment-growth work, an enabled account may run one due browsing simulation session. The durable `next_due_at` gate survives restarts; a deterministic per-account daily target and randomized waking-hours spacing avoid recalculating a flapping schedule on each minute tick. The session picks one configured growth community by weight, reads its hot listing through the shared Reddit request coordinator, optionally reads typed top-level comments, applies deterministic exclusions, and only then selects randomly.
+After reply handling, response checks, and comment-growth work, an enabled account may run one due browsing session. The durable `next_due_at` gate survives restarts; a deterministic per-account daily target and randomized waking-hours spacing avoid recalculating a flapping schedule on each minute tick. The session picks one configured growth community by weight, reads its hot listing through the shared Reddit request coordinator, optionally reads typed top-level comments, applies deterministic exclusions, and only then selects randomly.
 
-The terminal operation records `simulated-upvote` in SQLite and operator activity. There is no vote endpoint or Reddit write dependency. Scan, running, and browser dry-run all perform the same simulation; stopped mode performs no discovery or decision work. Reddit 429 responses extend the shared cooldown, while ordinary read failures remain isolated from replies and comment growth.
+The terminal operation records the selection in SQLite before any remote write, so an interrupted or uncertain vote is never retried. With the separate automatic-upvote setting enabled, running mode sends one authenticated Reddit `api/vote` request through the same browser transport and shared coordinator as growth comments, then marks the audit record submitted only after Reddit confirms it. Scan mode and browser dry-run always record simulation-only selections; stopped mode performs no discovery or decision work. Reddit 429 responses extend the shared cooldown, while ordinary read failures remain isolated from replies and comment growth. An operator can also run one immediate session for an enabled, running account: it bypasses the due, quiet-hours, and daily-target gates but preserves content exclusions and always disables vote submission.
 
 ## Reply-first conversation automation
 

docs/database.md

@@ -20,8 +20,8 @@ The application uses one `better-sqlite3` database, normally `data/reddit-bot.db
 - `account_growth_settings`: per-account commenting switch, adaptive trust level, optional operator daily-limit override (`daily_limit`, null means adaptive), spacing/jitter, quiet hours, NSFW opt-in, and the operator-clearable pause reason.
 - `account_growth_subreddits`: per-account community list with weight, daily cap, and any Reddit-imposed disable reason or cooldown.
 - `account_growth_comments`: durable growth comment records from discovery through posting and verification, including the exact text posted, score history, removal and public-visibility verdicts.
-- `account_browsing_settings`: disabled-by-default per-account simulation policy, conservative daily range, post/comment weights, quiet hours, spacing, NSFW policy, and durable next due time.
-- `account_browsing_decisions`: minimal post/comment identity, permalink, decision/reason, and scheduled-session audit. Reddit text is deliberately not retained.
+- `account_browsing_settings`: disabled-by-default per-account browsing policy, conservative daily range, post/comment weights, quiet hours, spacing, NSFW policy, default-off automatic-upvote setting, and durable next due time.
+- `account_browsing_decisions`: minimal post/comment identity, permalink, decision/reason, submitted-vote flag, and scheduled-session audit. Reddit text is deliberately not retained.
 
 The special legacy-unassigned account exists only to preserve rows created before account ownership was introduced. New runtime data must use a verified account ID.
 
@@ -63,7 +63,7 @@ The special legacy-unassigned account exists only to preserve rows created befor
 11. Exactly one account may comment on a given thread. `account_growth_comments` enforces this with a unique index on `post_id` across all accounts, because two owned accounts commenting on the same post is the easiest pattern for Reddit to correlate.
 12. A growth comment interrupted while posting is rejected, never retried. The process cannot know whether the write reached Reddit, and a duplicate comment cannot be withdrawn.
 13. Browsing decisions are unique per account and thing. Before selecting, the service also checks for a `simulated-upvote` by any other owned account, but account-specific rejections do not unnecessarily reserve an item globally.
-14. Browsing simulation rows never contribute to adaptive comment-growth promotion, and no schema or repository operation represents a submitted Reddit vote.
+14. A browsing selection is persisted before any vote request. `vote_submitted` becomes true only after Reddit confirms the authenticated upvote; unconfirmed selections are never retried. Browsing rows never contribute to adaptive comment-growth promotion.
 
 10. Recipient account status changes only after a definitive Reddit profile response. Transient lookup failures retain the previous value, and the shared check timestamp prevents duplicate lookups across account runtimes during the four-hour interval.
 

docs/frontend.md

@@ -19,14 +19,14 @@ Shared HTTP/SSE schemas live in `packages/api-contracts`. The server and client
 | `/media-library` | Upload, classify, correct, enable, preview, and delete shared exchange images. |
 | `/performance` | Mature outcome trends, strategy/subreddit results, and model usage. |
 | `/operations` | Background jobs, sync state, events, rate limits, and technical logs. |
-| `/growth` | Per-account comment growth plus simulation-only browsing: switches, communities, pacing/allowance, next browsing session, and both audit trails. |
+| `/growth` | Per-account comment growth plus browsing sessions: switches, communities, pacing/allowance, next session, optional automatic-upvote control, and both audit trails. |
 | `/settings` | Validated runtime configuration and account/session management. |
 
 Navigation is declared in `app/navigation.ts`; route elements are composed in `app/router.tsx`.
 
 The account-growth page states plainly that comments are AI-written and posted without review, shows the adaptive allowance and trust level rather than a settable rate, and surfaces every posted comment's exact text alongside its score and removal state. A paused account replaces the pause control with a resume control and explains why it stopped, because resuming is the one action that can compound the damage.
 
-Its browsing section separately states that no Reddit votes were submitted, shows today's deterministic target, post/comment split, exclusion counts, durable next session, and recent simulated selections with Reddit permalinks. Enabling browsing changes only the simulation policy; it does not enable comment growth or bot processing.
+Its browsing section separates session scheduling from the default-off automatic-upvote switch, shows whether each selection was submitted or simulated, today's deterministic target, post/comment split, exclusion counts, durable next session, and recent selections with Reddit permalinks. Scan mode and browser dry-run remain simulation-only. An enabled, running account can also run one immediate simulation-only selection; it bypasses the schedule but never submits a vote. Enabling browsing does not enable comment growth or bot processing.
 
 The Monitoring settings section owns the optional physique-targeting toggle and inclusive 1–10 range. It explains that the signal is subjective, applies only to image posts, and screens out unscorable images while enabled.
 

docs/product-and-safety.md

@@ -70,7 +70,7 @@ This is inauthentic account activity under Reddit's content policy, and many sub
 - Growth deliberately continues while an account is held out of outbound messaging, because building the history is what lifts that hold. It is always the lowest-priority work an account performs, after inbound replies.
 - Dry run prepares and records a comment but never posts it. Every posted comment, and every comment refused by either gate, is kept with its reason in the growth audit trail.
 
-Browsing simulation is a separate, disabled-by-default account-growth experiment. It selects a conservative number of eligible posts or comments from the same configured communities and records a hypothetical upvote, but it cannot submit a vote: the service has no Reddit vote method or write transport. Owned-account content, outreach recipients, cross-account duplicates, growth-comment threads, promotion experiments, moderator content, closed or removed threads, old or low-context items, and NSFW content unless explicitly allowed are excluded before randomness is applied. Simulation records never affect the adaptive comment-growth trust level.
+Browsing sessions are a separate, disabled-by-default account-growth experiment. They select a conservative number of eligible posts or comments from the same configured communities. The per-account automatic-upvote switch is separately disabled by default; when enabled, a selected item is upvoted through the account's authenticated browser session only in running mode and outside browser dry-run. Owned-account content, outreach recipients, cross-account duplicates, growth-comment threads, promotion experiments, moderator content, closed or removed threads, old or low-context items, and NSFW content unless explicitly allowed are excluded before randomness is applied. Every selection records whether Reddit confirmed the vote, and browsing never affects the adaptive comment-growth trust level.
 
 ## Operator exchange media
 

docs/services.md

@@ -41,8 +41,8 @@ Comment-based growth exists so a new account accumulates the age/karma history R
 | `services/growth-comment-safety.ts` | Deterministic pre-publication gate on generated comment text | Rejects links, contact solicitation, user tags, filler, and any text revealing the generator. Independent of prompt wording. |
 | `reddit/comment-client.ts` | Comment submission and comment-state lookups for one account | Classifies Reddit's error codes into retry/abandon/disable/re-auth/stop; runs inside the account's own browser session and shares the request coordinator. |
 | `database/growth-repository.ts` | Growth settings, per-account community list, durable comment records | One comment per thread across every account; mutations require the expected worker lease; queue clearing deletes only unposted discovered/retryable rows. |
-| `services/account-browsing-simulation.ts` | Durable pacing, eligibility, post/comment weighting, and hypothetical selection | Runs below comment growth; its only terminal capability is a simulation decision sink, never a Reddit vote. |
-| `database/browsing-simulation-repository.ts` | Per-account browsing policy, cross-account selection checks, and minimal decision audit | Stores identity/permalink and reasons without copying Reddit content; simulation never feeds comment trust. |
+| `services/account-browsing-simulation.ts` | Durable pacing, eligibility, post/comment weighting, selection, and optional vote dispatch | Runs below comment growth; votes require the per-account opt-in plus running mode outside dry-run, and uncertain writes are never retried. |
+| `database/browsing-simulation-repository.ts` | Per-account browsing policy, cross-account selection checks, and minimal decision audit | Stores identity/permalink, reasons, and whether Reddit confirmed a vote without copying Reddit content; browsing never feeds comment trust. |
 
 Verification is the safety mechanism that matters most. Posted comments are swept at roughly 15 minutes, 2 hours, and 24 hours using one batched `info.json` request, and a single signed-out probe on the second sweep decides whether the comment is publicly visible at all. Two consecutive removals, or one invisible comment, hard-pauses the account until an operator clears it; a failed probe never pauses anything.