# Review Backlog Cleanup & Source Triage Pattern

Use this when FinanceManager has many already-imported budget candidates and the user wants productive review, not new imports.

## Scope

- No new import sources, parsers, OCR, provider calls, or import engines.
- Runtime DB/CSV/XLS/XLSX/credentials never go to Git.
- Header dashboards expose counts only; no real amounts in chat.
- Candidate edits may be productive runtime mutations: create a SQLite backup first and write audit events.
- No productively confirmed budget transaction without explicit user click/confirm.

## Implementation pattern

1. Reuse `/api/budget/import-status-audit` for header counts.
2. Build `/api/budget/review-backlog` as a read-only triage DTO:
   - header counts: total, open, without category, low confidence, duplicates, covered-by-Migros, 2025 reference, Galaxus/Digitec, Migros review, AKB, Raiffeisen, fixed-cost candidates.
   - groups: without category, safe subscriptions, Migros Bons, Galaxus/Digitec, AKB/Raiffeisen, duplicates, reference_2025, fixkosten.
   - confirm groups are previews only: candidate IDs/count/category distribution/warnings; no booking.
3. Group uncategorized candidates by merchant/source. Sort by count first and amount magnitude internally, but don't expose amounts in chat.
4. Bulk category assignment updates candidates only; candidates remain candidates until explicit confirm. It must call existing audited batch/category paths where possible.
5. Add a `reference_2025`/`archived_reference` tab and keep normal 2026 review excluding those statuses.
6. For runtime 2025 cleanup:
   - backup DB first under runtime backups.
   - update only non-final 2025 candidates to `reference_2025`.
   - write an audit event with counts and candidate IDs in runtime audit, not chat.
7. AKB/Raiffeisen triage uses existing candidates only; never import Drive/runtime files in this sprint.
8. Fixkosten page remains no-booking: detect/activate recurring metadata only.

## Verification

- RED tests for 2025 reference marking, normal review exclusion, group DTOs, safe confirm exclusion, and read-only/no-new-import behavior.
- Frontend tests for Review Backlog page, nav route, workgroup cards, confirm previews, and bulk category call.
- Full Python compile/pytest, full npm test/build, source/build secret scans, git diff check, git safety.
- Browser sanity for Review Backlog, Buchungen prüfen, reference_2025 tab, Galaxus/Digitec, AKB, Raiffeisen, Migros, duplicates, Fixkosten.