fix(bookkeeping): send each missing-underlag lookup chunk once per URL (#2430)

* fix(bookkeeping): send each missing-underlag lookup chunk once per URL

The "verifikat utan underlag" filter (/bookkeeping?missingUnderlag=true)
failed with "Verifikaten kunde inte hamtas" on a self-hosted instance as
soon as the candidate set passed one chunk of 150 ids.

Why it occurred: resolveMissingUnderlagEntries issues four lookups per
chunk. Three carry the id list once; the supplier_invoices lookup
interpolated the same chunk twice into a single .or() over
registration_journal_entry_id and payment_journal_entry_id. That URL
alone crossed the 8 KB header buffer nginx/Kong ship with, so the
gateway answered 414 before PostgREST saw the request. Hosted sits at
roughly half of Cloudflare's 16 KB ceiling on the same query. The
LOOKUP_CHUNK docblock acknowledged the doubling without sizing for it.

What was removed: the runtime-built .or() string, the chunkInList
helper and its uuid guard (the .in() array filter is injection-safe on
its own). The supplier-invoice lookup is now two .in() queries, one per
FK column, merged into the same set, so every request carries the chunk
exactly once and the proxy limit stops being a dependency rather than
moving. LOOKUP_CHUNK stays 150 and its comment is now true. The
literal filter also leaves the phantom-column scanner's unresolvable
budget.

Two secondary defects from the same report: MissingUnderlagQueryError
now carries the raw driver error as `cause` and the journal-entries
route logs it, while the response keeps the Swedish text (the log used
to say only "Nagot gick fel", hiding the 414). The "Visa saknade
underlag" badge renders the total of the last successful filtered fetch
and hides on failure, instead of borrowing the list count (0 on a
failed first load, the whole ledger after a toggle).

Alternatives: halving LOOKUP_CHUNK moves the wall instead of removing
it. Pushing the list filters into the verifikat_without_documents RPC
and deleting the TS mirror leaves one predicate instead of two, but
moves search, series, date and sort into SQL; recorded in DECISIONS.md
as the intended next step for the surface owner.

Fixes #2395

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q4kpVfYooLp8CWeUguRVpQ

* fix(bookkeeping): hide the underlag badge on network failure, log the bulk route's cause

Skeptic findings on aacb17634. The badge contract is "no honest source,
no badge": the non-OK branch cleared missingCount but the network-level
catch (offline, aborted body, JSON parse rejection) did not, so a period
or series change that failed at that level kept the previous filtered
total next to the toggle. The bulk "Inget underlag kravs" route had the
same log gap as the list route: it returned the mapped text without
logging the driver error, so a gateway 414 on that path stayed
invisible.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q4kpVfYooLp8CWeUguRVpQ

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

DECISIONS.md

@@ -1665,6 +1665,7 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-09-08] #2391 skeptic pass: orgNumberKey only strips hyphens and spaces and only unprefixes 12-digit values behind 16/18/19/20. Reason: 26 prod supplier rows hold a VAT number (orgnr + 01, prefixes 55/52/87) in org_number, and 'last 10 of any 12 digits' would have rewritten them to another company's identity; letters stay because BE0123456789 is not the Swedish 0123456789. The matcher scans live suppliers only (archived_at IS NULL), the list and v1 search compare without separators, the CSV import and the provider migration orchestrator key and write through the same rule.
 [2026-09-08] correctEntry re-points the original entry's transaction_voucher_links rows to the corrected entry (lib/core/bookkeeping/storno-service.ts relinkTransactionsToEntry) instead of deleting them as issue #2364 proposed. Why: for a samlingsverifikat (bulk-book N>1) the junction is the row's only anchor, so deleting it would push rows the corrected verifikat still explains back into Att bokföra; the pointer column already follows the correction and the junction now follows it the same way, so every reader (is_transaction_booked, fetchJunctionLinkedTxIds, the bulk_book RPC) sees one live anchor. Rejected: a relink_entry_anchors RPC moving pointer and junction atomically (a migration plus pg test for a path that is already best-effort across five other statements; revisit if a partial failure ever shows up in the surfaced transactionRelinkError). Prod repair (planned, runs after merge on the founder's go; completion gets its own dated entry): the 7 stale links (3 companies) all sit on rows whose pointer names a posted entry (4 on a correction chain, 3 from a June 2026 samlingsverifikat storno that predates the junction cleanup and were re-booked 1:1); they will be re-pointed to the pointer's entry, the same rule the fix applies, rather than deleted.
 [2026-09-08] delete_last_voucher returns a correction's bank anchors (transactions.journal_entry_id and transaction_voucher_links rows) to correction_of_id before the row is deleted (migration 20260908095907). Why: the #2364 skeptic showed that once the junction follows the correction, the two-step undo (delete the correction, then the storno) cascaded the links away and restored an original that explains bank rows nobody points at, so the rows surfaced as bookable again; before, the links had stayed on the original by accident. Chosen over releasing the rows (the restored original would still explain them, same trap) and over a TS pre-step in the DELETE route (not atomic with the RPC's own guards: a refused delete would leave anchors on a reversed entry). A duplicate of a link the original already holds is dropped, not re-pointed (UNIQUE (transaction_id, journal_entry_id)).
+[2026-09-08] #2395 missing-underlag: split the supplier-invoice .or() into two .in() lookups instead of halving LOOKUP_CHUNK or moving the list filters into the verifikat_without_documents RPC: halving only moves the proxy-limit wall; the RPC move deletes the TS mirror (one predicate instead of two) but pulls search, series, date and sort into SQL and is the surface owner's design call. Intended next step, not taken here.
 [2026-09-08] Onboarding name search picks via chip row, never the top hit blind: Typesense name ranking is fuzzy and common names ("Bygg AB", sole-trader surnames) make a blind pick a wrong company; five hits, active first, fired on Enter only to protect the 3000/mo TIC budget (issue #2418).
 [2026-09-08] #2418 skeptic pass: a name-search hit's org number is derived from the Lens registrationNumber via lensRegistrationToOrgNumber (16-prefixed 12 digits and the 16-digit enskild-firma form, century plus 4-digit serial, reduce to the 10-digit key; hits that do not normalize are dropped) instead of being stored as returned. Why: the typed-orgnr path never stores Lens's number, so this was the first place a 16-digit value reached settings.org_number and createCompany refused it at the last step. Sole-trader chips name the form ("Enskild firma") instead of the number, because that number is the owner's personnummer and the repo masks those everywhere else; the number still travels in the search payload since a pick has to store it.
 [2026-09-08] Medelantal anställda (Not 2, ÅRL 5:20 §) gets a whole-number override on arsredovisning_narratives (migration 20260908130127) instead of the free-text note override the support request asked for. Why: the number keeps the statutory sentence and the iXBRL MedelantaletAnstallda fact correct; free text would let a non-compliant note through and could not be tagged. One resolver (lib/salary/medelantal.ts resolveMedelantalAnstallda: override, else FTE average over employees) feeds the K2 and K3 note builders and the iXBRL input, which also reads the previous period's override so the jämförelseår column shows the same figure the previous year's document did. Rejected: rounding 0.5 up globally (silently changes every company's note and does nothing for the 148 of 195 aktiebolag with salary but no employees rows); asking the user to backdate employment_start (fixes one company, misstates the hire date).