Enable automatic browsing upvotes

docs/database.md

@@ -20,8 +20,8 @@ The application uses one `better-sqlite3` database, normally `data/reddit-bot.db
 - `account_growth_settings`: per-account commenting switch, adaptive trust level, optional operator daily-limit override (`daily_limit`, null means adaptive), spacing/jitter, quiet hours, NSFW opt-in, and the operator-clearable pause reason.
 - `account_growth_subreddits`: per-account community list with weight, daily cap, and any Reddit-imposed disable reason or cooldown.
 - `account_growth_comments`: durable growth comment records from discovery through posting and verification, including the exact text posted, score history, removal and public-visibility verdicts.
-- `account_browsing_settings`: disabled-by-default per-account simulation policy, conservative daily range, post/comment weights, quiet hours, spacing, NSFW policy, and durable next due time.
-- `account_browsing_decisions`: minimal post/comment identity, permalink, decision/reason, and scheduled-session audit. Reddit text is deliberately not retained.
+- `account_browsing_settings`: disabled-by-default per-account browsing policy, conservative daily range, post/comment weights, quiet hours, spacing, NSFW policy, default-off automatic-upvote setting, and durable next due time.
+- `account_browsing_decisions`: minimal post/comment identity, permalink, decision/reason, submitted-vote flag, and scheduled-session audit. Reddit text is deliberately not retained.
 
 The special legacy-unassigned account exists only to preserve rows created before account ownership was introduced. New runtime data must use a verified account ID.
 
@@ -63,7 +63,7 @@ The special legacy-unassigned account exists only to preserve rows created befor
 11. Exactly one account may comment on a given thread. `account_growth_comments` enforces this with a unique index on `post_id` across all accounts, because two owned accounts commenting on the same post is the easiest pattern for Reddit to correlate.
 12. A growth comment interrupted while posting is rejected, never retried. The process cannot know whether the write reached Reddit, and a duplicate comment cannot be withdrawn.
 13. Browsing decisions are unique per account and thing. Before selecting, the service also checks for a `simulated-upvote` by any other owned account, but account-specific rejections do not unnecessarily reserve an item globally.
-14. Browsing simulation rows never contribute to adaptive comment-growth promotion, and no schema or repository operation represents a submitted Reddit vote.
+14. A browsing selection is persisted before any vote request. `vote_submitted` becomes true only after Reddit confirms the authenticated upvote; unconfirmed selections are never retried. Browsing rows never contribute to adaptive comment-growth promotion.
 
 10. Recipient account status changes only after a definitive Reddit profile response. Transient lookup failures retain the previous value, and the shared check timestamp prevents duplicate lookups across account runtimes during the four-hour interval.