fix(pending-ops): record posted ids and land failed_partial instead of clean rejected after partial commits (#842) (#1110)

Multi-step executors (match_transaction_invoice, credit_invoice) post an
irreversible voucher or persist a credit note and then run later fallible
steps. A failure there previously marked the whole op status=rejected,
hiding the posted entity and its id from operators.

- new migration 20260722134114: add failed_partial to the
  pending_operations status CHECK and treat it as terminal in both
  immutability triggers (immutable, undeletable, never re-claimable)
- PartialCommitError + ExecutorResult.partialPostedIds carry the posted
  ids; the dispatcher writes status=failed_partial with
  result_data.posted_ids and returns code=partial_commit
- instrument only the two named executors; hoist the read-only
  settlement-account resolution above the storno in the match executor
- consumer sweep: status union + query schema widened, failed_partial
  folds into the Avvisade tab with a badge and posted-ids detail line,
  bulk/reject routes and MCP tools message it explicitly, worklist and
  expiry sweep intentionally untouched (not pending work)
- tests: pg-real coverage for the new terminal semantics, dispatcher unit
  tests for both partial paths plus byte-for-byte regression guards

Fixes #842

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/pending-operations/errors.ts

@@ -0,0 +1,35 @@
+/**
+ * Typed errors for the pending-operations commit path.
+ *
+ * PartialCommitError is thrown by multi-step executors when an irreversible
+ * side-effect (posted voucher, persisted credit note) already exists and a
+ * LATER step fails. The dispatcher (commitPendingOperationInner) detects it
+ * and lands the op in the terminal status 'failed_partial' instead of
+ * 'rejected', persisting the posted ids in result_data.posted_ids so an
+ * operator can locate the orphaned voucher/entity (issue #842).
+ *
+ * Do NOT throw this before the first irreversible step: a clean failure with
+ * nothing posted must keep today's 'rejected' semantics.
+ */
+export class PartialCommitError extends Error {
+  readonly name = 'PartialCommitError'
+  /**
+   * Ids of the entities that were irreversibly created before the failure,
+   * keyed by a stable snake_case label (e.g. reversal_journal_entry_id,
+   * payment_journal_entry_id, credit_note_id). Persisted verbatim into
+   * pending_operations.result_data.posted_ids.
+   */
+  readonly postedIds: Record<string, string>
+  /** The underlying failure that interrupted the executor. */
+  readonly cause: unknown
+
+  constructor(message: string, postedIds: Record<string, string>, cause?: unknown) {
+    super(message)
+    this.postedIds = postedIds
+    this.cause = cause
+  }
+}
+
+export function isPartialCommitError(err: unknown): err is PartialCommitError {
+  return err instanceof PartialCommitError
+}