Add private evidence version associations and receipts
Retained Context source versions cannot yet be associated with multiple existing roster and business records. This adds service-only attach/read/list operations with persisted version-specific relevance receipts for existing artist accounts, scoped organization professionals, and owned Context request/subject pairs. Concrete foreign keys preserve owner/identity boundaries. It creates no identities, roster entries, accepted results, rights, mandates, provider calls or charges.
Writes/read/list/replay check current membership, source retention and independent target access. Canonical exact-key replay returns the original receipt; changed inputs conflict. Fixed target slots and deferred completeness prevent later appends; reads verify the stored fingerprint. Withdrawn or inaccessible evidence/targets are withheld without deleting history. Retained accepted owned-request lineage supplies a separate historical path after roster termination. Candidate identities remain unresolved. Bounded paging advances across withheld receipts.
The first migration is byte-for-byte preserved after hosted preview application. Four forward corrections seal original receipt targets, add the minimal service-role UPDATE(updated_at) lock permission, and replace authorization/read/write/list functions. Inconsistent existing receipt fingerprints abort for review. The initial migration's length and bounded composite-uniqueness scan remain historical; future fixes are split by responsibility. The failed split's duplicate-function collision was reproduced locally; hosted failure logs were unavailable. No preview reset or hosted mutation was performed.
Validation: 15 behavior tests on clean installation plus the same behaviors and an existing-receipt upgrade/replay test produce 31 passing transaction executions on disposable PostgreSQL15/17. The append, lock-privilege and already-applied migration regressions failed before correction. CI15/16 and hosted preview must be checked for the latest head, not an earlier green preview. No merge, production migration or customer association occurred.
Companion API https://github.com/recoupable/api/pull/983 supplies strict shared authenticated HTTP and individually discoverable standard MCP operations, with delegated OAuth exclusion pending the organization-grant audit. Release this database change and verify migration bodies/permissions before the API. The pair does not complete file registration, source-version discovery, locators, parsing or saved assessments. Broad import still requires fixing research-to-roster enrollment side effects. Part of recoupable/app#2116, #2147 and #2140; independent of the unmerged company-baseline migration.