Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i
server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma
strängvärde byggs med konkatenering i stället för att matcha mönstret.
Lägger docs/production-readiness.md och siax/production-gaps.json enligt SIAX Master Definition of Done. Underlag: git-, kod- och live-evidens 2026-11-11. Nivån är evidensbaserad, inte ett leveransgodkännande.
* fix(invoices): stop popup blockers from silently eating the PDF preview tab
A window.open() after an await runs outside the click's transient user
activation (~5s, less in Safari), so the preview tab was popup-blocked
exactly when generation was slow (cold start + logo re-encode). The
request succeeded, nothing opened, no error: the button looked locked
(support: carina@cbysea.se).
- lib/browser/deferred-tab.ts: open the tab synchronously in the click,
navigate it when the result arrives, close it on failure (the pattern
AGIPanel already used for its signing tab), with unit tests.
- InvoiceEditor: preview uses the deferred tab + popup-blocked toast;
revoke the blob URL instead of leaking it; guard the review dialog
against an unresolved customer (silent no-op click); 5s timeout on the
pre-review next-number fetch; spinner + disable while the submit
handler is in flight in create mode.
- Same pre-open fix in TransactionAttachmentIndicator,
JournalEntryAttachments (failures now toast instead of vanishing),
DocumentViewButton, and the Arcim reconnect OAuth popup (its 'trusted
gesture' comment was wrong after the await).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(invoices): review triage: close blocked preview tab, precise popup hint, test convention
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>