## Verdict: **FAIL / BLOCK**

Reviewed exact working tree at `852aac4a8060d2dfec716fc630560a11d297abde`, including all 12 modified and 5 untracked candidate files.

### P0 — Release blockers

- **Real financial details are versioned despite the repository’s private-data boundary.**
  - `docs/sprint16-smart-household-version-bound-inventory.md:114-127` contains source-specific balances, account suffixes, transaction counts, dates, mappings, and the CHF 2.60 interest transaction.
  - `scripts/sprint16_household_onboarding.py:123-127,160-163` hard-codes real provider balances and the interest amount.
  - This conflicts with `AGENTS.md` (“Produktive Finanzdaten … und Reports bleiben außerhalb Git”) and the document’s own claim that real evidence remains private. Keep only approved aggregate assertions such as **69 = 68+1** in Git; move record/account-specific values to an owner-only runtime authorization manifest or bind them cryptographically.

- **Onboarding is not copy-first and has no backup/restore path.**
  - `--confirm-onboarding` directly opens and modifies the supplied `--db` at lines 140-216.
  - The artifact neither creates/verifies a backup nor supplies a tested restore procedure. This is insufficient for authorized production data onboarding.

- **Integrity is checked only after commit and is not enforced.**
  - Commit occurs at line 216; `PRAGMA integrity_check` runs at line 220.
  - A result other than `ok` is merely returned as text, not rejected, and the committed changes can no longer be rolled back.

### P1

- **Rerun is not a no-op/idempotent.**
  - Every mapping is upserted and audited again through `configure_source_mapping`.
  - Disposable schema-47 probe: first run produced **12 audit rows / 5 mappings**; identical rerun produced **17 audit rows / 5 mappings**.
  - The result also always reports `status=confirmed`, with no `idempotent`/`unchanged` state.

- **Existing fixed VISA platform semantics are not validated.**
  - If `platform_s16_visa_liability` already exists, lines 177-189 accept it without checking type, currency, country, active state, or liability role.

### P2 / non-blocking

- Full npm audit retains **6 documented dev-only high findings** under `@vue/test-utils → js-beautify/editorconfig/glob/minimatch/brace-expansion`; production audit is clean.
- Production build emits the existing >500 kB chunk warning.

### Passing evidence

- Approved Raiffeisen contract: **127 physical lines → 69 logical bookings = 68+1** passed synthetic probing.
- Schema remained **47**; no migration/schema files changed and no Sprint 16 DDL was found.
- Account-role enforcement rejects bank/card mismatches.
- FK-delta probe returned zero; synthetic `integrity_check=ok`.
- Direct frontend dependencies are exactly pinned; Node engine matches tested Node `24.17.0`.
- No real import-confirm operation was executed; onboarding script does not call transaction confirm.
- Python focused suites: **55 passed**.
- Frontend focused suites: **12 passed**.
- `npm ci`, typecheck, production build, and `git diff --check`: passed.
- `npm audit --omit=dev`: **0 findings**.

### Files

- **Repository files modified:** none by this read-only review.
- Created only disposable `/tmp` review artifacts, including `/tmp/s16_onboarding_probe.py`; ignored frontend install/build outputs were regenerated.