Register private original versions with scoped receipts
Private original intake needs a durable receipt that identifies exactly which customer-source byte version was retained. This adds service-only owner-authorized register/read functions using existing Context sources and versions, with stable retry receipts, changed-payload conflicts and retained history. No accepted analysis, observed identity, rights decision or artist provisioning is created.
Registration validates trusted server byte metadata and owner-scoped storage keys, serializes owner imports, rejects rebinding a retained object path to changed bytes, and rechecks access/withdrawal on receipt reads and retries. Receipt rows have SELECT/INSERT only for service_role; browser roles cannot execute. Responses omit paths and contents. SQL metadata binding does not prove immutable storage or actually verify bytes; future callers must use the server verifier and immutable upload/staging/retrieval controls before customer intake.
Validation:eleven new transaction cases plus one inherited release case pass on disposable PostgreSQL15/17, including concurrent retries, history, revoked/foreign/withdrawn access, mutation denial and rollback. Six initial regressions failed before implementation. Python compilation/diff pass. CI15/16 added. No production migration, customer file access, registration or provider call. Part of app#2116/#2140; each release requires its own approval.
Review corrections: four explicit empty-input regressions failed before fixture defaults were narrowed to None. Browser roles now exercise both RPCs; CI bootstrap pins the matrix version. Fresh33ec49b head checks/review pending; the preview-applied migration remains unchanged.