fix(csv): recover refused rows instead of re-importing the file

[IBJunior]

What happened

Importing a real 451-row export, 9 rows were refused: the file mixed 06/09/2026 22:41:15 with a
bare 07/09/2026, and the declared dd/MM/yyyy HH:mm:ss matched only the first shape. The only
way to rescue them was to re-run the import with a different format — which refused the other 442
and imported a second copy of the 9. Three passes later the ledger held triplicates, and
skippedDuplicates: 0 said nothing was wrong: dedup keys on (source, external_id), and in
Postgres NULL never equals NULL, so for a file with no id column nothing is deduplicated at
all. The wrong totals fed several charts before anyone noticed.

Root cause is not the date parser. The importer gave the agent no way to recover a single row,
so its only recovery move was to re-run the whole file — and the system prompt explicitly told it
to.

Changes

• read_csv_rows — read refused rows by number, raw. Refused rows now carry a row number and a
  reason (badDateRows, unparsableRows) under one convention: 1-based over data rows. Recovery is
  per row via log_expense, never a re-import.
• validate_csv_import — parses the whole file, writes nothing. The import returns
  validation_required for a plan it has not seen, fingerprinted over every argument, so changing
  only dateFormat re-triggers it. A separate tool rather than a dryRun flag because approval is
  keyed by tool name — a flag would make auto-approval depend on a model-authored boolean.
• Optional time — a declared format carrying a time absorbs rows without one; those land at
  00:00:00 and are counted in datesWithoutTime.
• Honest duplicates — duplicateDetection: "active" | "unavailable" plus a warning, replacing
  skippedDuplicates: 0.

Prompt, capabilities page, tool renderers and eval cases follow the four-step flow. Docs in
docs/CSV_IMPORT_FLOW.md.

Verification

• 246 unit tests, root + eval typecheck, Prettier — all clean.
• Full eval suite: 20/20, 0 inconclusive, no regressions outside CSV.
• Both new cases at full policy: csv-import-handles-rows-without-a-time 3/3 (strict),
  csv-import-validates-before-writing 3/3 (majority). Across nine runs validation always
  preceded the write, always auto-approved, and the write always paused for approval.

Not included

• Content-hash dedup. The retry loop is closed, but a deliberate re-import (new month, corrected
  export) still duplicates.
• The 24 duplicate rows still in the production ledger — real financial data, needs a backup first.

🤖 Generated with Claude Code