CHANGES_REQUIRED

All three findings from the `1984433` review are closed:

- **PASS — transaction cursor versioning:** focused synthetic probe mutated a non-max confirmed transaction’s `amount_chf` without changing `updated_at`, while another row owned the maximum timestamp. The old cursor was rejected with HTTP 409.
- **PASS — unlinked-refund overview contract:** synthetic public API probe returned `data_status.status="partial"`, `unlinked_refund_count=1`, and an explicit exclusion message.
- **PASS — missing-FX monthly-summary contract:** synthetic public API probe returned `unavailable_chf_count=1` and `data_status="partial"`.
- The two focused regression tests passed: `2 passed`.

Remaining release blockers:

1. **P1 — Arbitrary or excessive refund links can manufacture negative expenses and false net income.**  
   `household_financials.py:74-89` treats a refund as linked whenever the referenced transaction merely exists and is confirmed. It does not require the origin to be an eligible `expense`/`fee` or constrain cumulative refunds to the original expense. The public writer also accepts unrestricted `reversal_of_transaction_id` values (`budget_transactions.py:64,85-100`).  
   Synthetic writer→reader probe linked a CHF 20 refund to a CHF 100 income; the accepted result was reported as `income=100.00`, `expense=-20.00`, `net=120.00`, `data_status=current`. Validate linkage eligibility and refund bounds in both writer and canonical reader; invalid links must remain unlinked/partial.

2. **P1 — `/charts` falsely reports unlinked-refund months as current.**  
   `budget_overview.py:414-440` tracks only `unavailable_chf` when deriving chart `data_status`; it ignores `unlinked_refund`. A month containing only an unlinked refund returned zero financial effects with `data_status="current"`. Aggregate and expose both partiality dimensions consistently.

3. **P1 — Missing-FX transfers are reported as a current CHF 0.00 transfer volume.**  
   `household_financials.py:87,97-100,133-137` excludes transfers from `unavailable_chf` and coerces their missing CHF amount to zero. Synthetic EUR-transfer probe returned `neutral_transfer_count=1`, `neutral_transfer_volume_chf="0.00"`, `unavailable_chf_count=0`, and `data_status="current"`. Missing conversion must make the CHF transfer-volume contract partial/unavailable rather than inventing zero.

4. **P1 — Review pagination retains the same weak COUNT/MAX dataset token fixed for transaction pagination.**  
   `household_import.py:2536-2549` versions review pages using only open-row count and maximum candidate `updated_at`, although ordering and rendered/state fields depend on all candidate values and active category rows (`2524-2530`, `2593-2605`). A non-max candidate mutation without timestamp change—or archiving/retyping a proposed category—leaves the cursor valid while page membership, proposal counts, and rendered decisions change. Use a digest/version covering all open candidate and category values affecting pagination and rendering, with a post-query consistency check.

- Exact HEAD reverified: `033e1b74795877d757a00c733b8f4638c24f18c4`
- Worktree remained clean; no files were created or modified.