docs: decision log for the 2026-08-13 feedback batch (#1576)

Ten entries for the Johan Lind feedback fixes (PRs #1565-#1575): the
non-obvious calls live here in one commit instead of ten conflicting
appends, per the standing concurrent-PR DECISIONS.md conflict gotcha.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

DECISIONS.md

@@ -898,3 +898,13 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-08-13] Oversized phone photos are re-encoded in the browser (2400px long edge, JPEG q0.85 stepping down) rather than raising a platform limit or streaming straight to storage: hosted rejects any request body over 4.5 MB itself (measured against prod: 4.4 MB reaches the route, 4.6 MB returns a plain-text FUNCTION_PAYLOAD_TOO_LARGE), before the route runs and therefore invisibly in the function logs, while the route advertises 10 MB it can never receive. A downscaled photo is still a faithful, durably readable reproduction (BFL 7 kap), which a refusal is not. What cannot be shrunk (PDF, or HEIC where the browser will not decode it) is refused client-side with its actual size named, and 413 was added to the HTTP status map so a rejection in transit still says what happened. Direct-to-storage upload, which would remove the ceiling for PDFs too, is the follow-up, not this fix: it moves sha256/WORM integrity off the server.
 [2026-08-13] The book-route underlag fix landed as a pinned-document leg inside propagateUnderlagForBookedTransaction rather than the planned "extract categorize-core's propagation block into a shared helper": PR #1547 had already done that extraction overnight and wired /book and bulk-book to the shared helper, but the helper only walked matched inbox items, so a document pinned via transactions.document_id with no unconsumed inbox item (direct upload, or item consumed elsewhere) still booked to "Underlag saknas". Anchoring the pin inside the helper fixes /book, categorize, bulk-book and attach-after-book in one place; the pin is read fresh (not from the caller's pre-booking snapshot) so a concurrent attach still anchors, and the bulk-book RPC's own atomic doc-linking makes the leg a no-op there.
 [2026-08-13] v1 categorize/batch-categorize wire the shared underlag propagation after the CAS write rather than inlining anchoring logic, and the route tests mock the helper to assert wiring only (called once per booking the request owns; skipped on partial success and lost CAS races): the helper's own semantics (pin anchoring, never-steal, failure isolation) are unit-tested where they live, and duplicating them at route level is what let the v1 surface drift out of the #1560 fix in the first place. Salvaged from the closed duplicate PR #1559: the attach-after-bulk-book samlingsverifikat test.
+[2026-08-13] Bank import: an explicit format choice that parses 0 rows falls back to auto-detect (info issue names both formats) instead of failing: an explicit bank pick must never underperform Automatisk identifiering, and the fallback result carries the detected format so external_ids equal the auto path. generic_csv is exempt: it is the manual column-mapping escape hatch whose default mapping legitimately parses 0 rows.
+[2026-08-13] BOM'd bank files decode with utf-8-sig semantics (BOM stripped at byte level, never re-included in the windows-1252 fallback), plus UTF-16 BOM support: kills the mojibake-prefix class that broke exact-match header detectors.
+[2026-08-13] franvaro audit trigger functions made SECURITY DEFINER (search_path pinned) instead of adding RLS policies on salary_absence_franvaro_audit: the audit table must stay client-unwritable, and an INSERT policy for authenticated would let clients forge audit rows. New DB_PERMISSION_DENIED (500) instead of reusing FORBIDDEN for 42501 in the absence path: an RLS denial of a trigger write is a server misconfig, not a user-permission failure.
+[2026-08-13] Bank import duplicate warning is advisory only: execute still sends all rows and ingest skips server-side; the preview deliberately runs without settlement account and mirrors, so copy never promises an exact number.
+[2026-08-13] Transaction cash-account move shipped as a dedicated PATCH endpoint plus UI action; manualLink's cross-account guards stay intact (users move the row rather than cross-linking a verifikat).
+[2026-08-13] Recon bulk matching = promotion of the existing preview/apply flow (attn line, autorun=1 deep link, strong-relabel, confidence_threshold on the app route) rather than a new engine; the review step is never bypassed and autorun fires only via the query param.
+[2026-08-13] MCP list tools fetch everything via fetchAllRows (bounded registries) instead of limit/offset pagination: no outputSchema growth against the 59K tools/list ceiling, which now has roughly 1 token of headroom after the audit_package egress note.
+[2026-08-13] Booking duplicate guard widened (sibling window +-3 days with exact-date-first total order, is_transaction_booked semantics, ledger twin de-exclusion) and the dialog offers Matcha/Ignorera for sibling candidates; renaming the "Att bokfora" tab is deferred to a founder call.
+[2026-08-13] SIE mojibake: prevention only in code (dead gateway SIE path deleted, CP1252-artifact tripwire that warns and never blocks); repairing affected companies' posted entries is a founder decision (rattelse RPC vs re-import with replace), not automated.
+[2026-08-13] Agent float panel: contain-on-open/resize via containFloatRect; clampFloatRect and the mid-session hang-off-the-edge allowance deliberately untouched.