Enable automatic browsing upvotes

docs/services.md

@@ -41,8 +41,8 @@ Comment-based growth exists so a new account accumulates the age/karma history R
 | `services/growth-comment-safety.ts` | Deterministic pre-publication gate on generated comment text | Rejects links, contact solicitation, user tags, filler, and any text revealing the generator. Independent of prompt wording. |
 | `reddit/comment-client.ts` | Comment submission and comment-state lookups for one account | Classifies Reddit's error codes into retry/abandon/disable/re-auth/stop; runs inside the account's own browser session and shares the request coordinator. |
 | `database/growth-repository.ts` | Growth settings, per-account community list, durable comment records | One comment per thread across every account; mutations require the expected worker lease; queue clearing deletes only unposted discovered/retryable rows. |
-| `services/account-browsing-simulation.ts` | Durable pacing, eligibility, post/comment weighting, and hypothetical selection | Runs below comment growth; its only terminal capability is a simulation decision sink, never a Reddit vote. |
-| `database/browsing-simulation-repository.ts` | Per-account browsing policy, cross-account selection checks, and minimal decision audit | Stores identity/permalink and reasons without copying Reddit content; simulation never feeds comment trust. |
+| `services/account-browsing-simulation.ts` | Durable pacing, eligibility, post/comment weighting, selection, and optional vote dispatch | Runs below comment growth; votes require the per-account opt-in plus running mode outside dry-run, and uncertain writes are never retried. |
+| `database/browsing-simulation-repository.ts` | Per-account browsing policy, cross-account selection checks, and minimal decision audit | Stores identity/permalink, reasons, and whether Reddit confirmed a vote without copying Reddit content; browsing never feeds comment trust. |
 
 Verification is the safety mechanism that matters most. Posted comments are swept at roughly 15 minutes, 2 hours, and 24 hours using one batched `info.json` request, and a single signed-out probe on the second sweep decides whether the comment is publicly visible at all. Two consecutive removals, or one invisible comment, hard-pauses the account until an operator clears it; a failed probe never pauses anything.