feat(context): save execution plans and per-node outcomes
Context execution currently loses its plan and node outcomes when the process ends. Add immutable, owner-scoped execution records and independently saved node outcomes so future durable steps can resume and the inspector can explain what happened.
- Exact plan/outcome replay returns the original record; conflicting replay fails.
- Plans bind to completed/partial requests and their subjects. Reads and writes require the owning workspace; browser roles have no access.
- Saved/reused receipts must reference evidence belonging to the same workspace, subject and audited module. Cancelled runs remain inspectable.
Validation: local PostgreSQL 17 regression covers replay, conflicts, unknown/duplicate nodes, subject/owner isolation, invented success receipts, actual evidence claim/save receipts, cancellation and privileges. No live providers or production mutations. Minimal context fixture, not the entire historical migration chain.
These are storage primitives, not spending grants. API adapters, persisted policy authorization, durable workflow integration and inspector loading remain to be connected. Database #76 remains a prerequisite for safely enabling evidence dispatch. Tracks recoupable/app#2122 and supports recoupable/api#917.
Summary by cubic
Adds durable, owner-scoped execution plans, per-node outcomes, and one-time node claims so context runs survive restarts, can be resumed, and stay inspectable. Also adds scoped request entries for artists, releases, release tracks, songwriters, companies, campaign briefs, and supporting text.
- Exact replay returns the original record; conflicting replays fail. Nodes must be claimed before dispatch and require runnable state, the subject still in the request, and completed prerequisites; repeated claims return an unknown state. Cancelled runs stay readable but cannot be restarted or planned against.
- Success receipts must reference evidence owned by the same workspace, subject, and matched module, and reuse is bound to the fingerprint's original subject and topic. Recording ISRC resolution now requires the accepted request-track identity link.
- Resolves request subjects into planner targets and Songstats lookups from evidence-based identity confirmation, including confirmed Spotify track IDs and workspace catalog access.
- Persists expanded catalog member recordings durably outside the 100-subject cap, with idempotent, owner-scoped, cursor-paged expansion that rechecks current access per page.
- Persists observed Spotify release track slots scoped to owner and source result; only the current accepted result counts as current membership. Per-slot ISRC claims are one-time and never auto-retried, and observations are review candidates, never automatic recording or rights claims.
- Saves submitted songwriter, company, campaign brief, or supporting text as private, unconfirmed input that never asserts a person, organization, rights, or verified result. Artist and album entries stay unverified until real metadata confirms identity and rights.
These are storage primitives only: API adapters, persisted authorization, durable workflow integration, and inspector loading are not yet connected.