From 2aecddbce9f4a43694889602331e5fa4ab0cdc96 Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Mon, 24 Aug 2026 20:58:54 +0800
Subject: [PATCH 1/6] Allow CSV backfill into already-linked accounts

PSD2/Enable Banking only exposes ~90 days of history. Mapping and
upload previously hid linked accounts, so there was no way to import
older CSV rows once a connection existed. Target writable accounts
(including linked ones) and skip CSV rows that already arrived via
provider sync instead of creating duplicates.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 app/controllers/import/mappings_controller.rb |  6 ++-
 app/controllers/import/uploads_controller.rb  |  4 +-
 app/controllers/imports_controller.rb         |  4 +-
 app/models/import/account_mapping.rb          | 14 +++++-
 app/models/transaction_import.rb              | 16 +++++--
 app/views/import/uploads/show.html.erb        |  6 +--
 .../import/mappings_controller_test.rb        | 43 +++++++++++++++++
 test/controllers/imports_controller_test.rb   |  4 +-
 test/models/transaction_import_test.rb        | 46 +++++++++++++++++++
 9 files changed, 128 insertions(+), 15 deletions(-)

diff --git a/app/controllers/import/mappings_controller.rb b/app/controllers/import/mappings_controller.rb
index 098c401010..06de2b218a 100644
--- a/app/controllers/import/mappings_controller.rb
+++ b/app/controllers/import/mappings_controller.rb
@@ -24,7 +24,11 @@ def set_import
     def mappable
       return nil unless mappable_class.present?
 
-      @mappable ||= mappable_class.find_by(id: mapping_params[:mappable_id], family: Current.family)
+      if mappable_class == Account
+        Current.family.accounts.writable_by(Current.user).find_by(id: mapping_params[:mappable_id])
+      else
+        mappable_class.find_by(id: mapping_params[:mappable_id], family: Current.family)
+      end
     end
 
     def create_when_empty
diff --git a/app/controllers/import/uploads_controller.rb b/app/controllers/import/uploads_controller.rb
index 076452a88a..4176b2ea9a 100644
--- a/app/controllers/import/uploads_controller.rb
+++ b/app/controllers/import/uploads_controller.rb
@@ -19,7 +19,7 @@ def update
     elsif @import.is_a?(SureImport)
       update_sure_import_upload
     elsif csv_valid?(csv_str)
-      @import.account = import_account_id.present? ? accessible_accounts.find(import_account_id) : nil
+      @import.account = import_account_id.present? ? Current.family.accounts.writable_by(Current.user).find(import_account_id) : nil
       @import.assign_attributes(raw_file_str: csv_str, col_sep: upload_params[:col_sep])
       @import.save!(validate: false)
 
@@ -78,7 +78,7 @@ def handle_qif_upload
       end
 
       ActiveRecord::Base.transaction do
-        @import.account = accessible_accounts.find(import_account_id)
+        @import.account = Current.family.accounts.writable_by(Current.user).find(import_account_id)
         @import.raw_file_str = QifParser.normalize_encoding(csv_str)
         @import.save!(validate: false)
         @import.generate_rows_from_csv
diff --git a/app/controllers/imports_controller.rb b/app/controllers/imports_controller.rb
index 3569561682..f802c6c581 100644
--- a/app/controllers/imports_controller.rb
+++ b/app/controllers/imports_controller.rb
@@ -9,7 +9,7 @@ def update
     account_id = params.dig(:pdf_import, :account_id) || params.dig(:import, :account_id)
 
     if account_id.present?
-      account = accessible_accounts.find_by(id: account_id)
+      account = Current.family.accounts.writable_by(Current.user).find_by(id: account_id)
       unless account
         redirect_back_or_to import_path(@import), alert: t("imports.update.invalid_account", default: "Account not found.")
         return
@@ -98,7 +98,7 @@ def create
     type = params.dig(:import, :type).to_s
     type = "TransactionImport" unless Import::TYPES.include?(type)
 
-    account = accessible_accounts.find_by(id: params.dig(:import, :account_id))
+    account = Current.family.accounts.writable_by(Current.user).find_by(id: params.dig(:import, :account_id))
     import = Current.family.imports.create!(
       type: type,
       account: account,
diff --git a/app/models/import/account_mapping.rb b/app/models/import/account_mapping.rb
index 67280da41a..0c42bfb093 100644
--- a/app/models/import/account_mapping.rb
+++ b/app/models/import/account_mapping.rb
@@ -4,14 +4,24 @@ class Import::AccountMapping < Import::Mapping
   class << self
     def mappables_by_key(import)
       unique_values = import.rows.map(&:account).uniq
-      accounts = import.family.accounts.where(name: unique_values).index_by(&:name)
+      accounts = importable_accounts(import).where(name: unique_values).index_by(&:name)
 
       unique_values.index_with { |value| accounts[value] }
     end
+
+    # Linked (provider-managed) accounts are valid CSV targets so users can
+    # backfill history after connecting. When Current.user is set, restrict to
+    # accounts they can write; otherwise fall back to the family (e.g. jobs).
+    def importable_accounts(import)
+      scope = import.family.accounts
+      return scope unless Current.user
+
+      scope.writable_by(Current.user)
+    end
   end
 
   def selectable_values
-    family_accounts = import.family.accounts.manual.alphabetically.map { |account| [ account.name, account.id ] }
+    family_accounts = self.class.importable_accounts(import).visible.alphabetically.map { |account| [ account.name, account.id ] }
 
     unless key.blank?
       family_accounts.unshift [ "Add as new account", CREATE_NEW_KEY ]
diff --git a/app/models/transaction_import.rb b/app/models/transaction_import.rb
index 8b93431e68..c5d88073ee 100644
--- a/app/models/transaction_import.rb
+++ b/app/models/transaction_import.rb
@@ -33,24 +33,34 @@ def import!
         # Check for duplicate transactions using the adapter's deduplication logic
         # Pass claimed_entry_ids to exclude entries we've already matched in this import
         # This ensures identical rows within the CSV are all imported as separate transactions
+        #
+        # include_provider_entries: true so CSV backfills into already-linked
+        # accounts (e.g. Enable Banking's ~90-day window) do not recreate rows
+        # that already arrived via sync. Mirror PDF statement reconciliation.
         adapter = Account::ProviderImportAdapter.new(mapped_account)
         duplicate_entry = adapter.find_duplicate_transaction(
           date: row.date_iso,
           amount: row.signed_amount,
           currency: effective_currency,
           name: row.name,
-          exclude_entry_ids: claimed_entry_ids
+          exclude_entry_ids: claimed_entry_ids,
+          include_provider_entries: true
         )
 
         if duplicate_entry
-          # Update existing transaction instead of creating a new one
+          claimed_entry_ids.add(duplicate_entry.id)
+
+          # Already synced from a provider — skip creating a CSV duplicate and
+          # do not mark the provider-owned row import_locked.
+          next if duplicate_entry.external_id.present?
+
+          # Update existing manual/CSV transaction instead of creating a new one
           duplicate_entry.transaction.category = category if category.present?
           duplicate_entry.transaction.tags = tags if tags.any?
           duplicate_entry.notes = row.notes if row.notes.present?
           duplicate_entry.import = self
           duplicate_entry.import_locked = true  # Protect from provider sync overwrites
           updated_entries << duplicate_entry
-          claimed_entry_ids.add(duplicate_entry.id)
         else
           # Create new transaction (no duplicate found)
           # Mark as import_locked to protect from provider sync overwrites
diff --git a/app/views/import/uploads/show.html.erb b/app/views/import/uploads/show.html.erb
index 7d19818c68..eaa54301a6 100644
--- a/app/views/import/uploads/show.html.erb
+++ b/app/views/import/uploads/show.html.erb
@@ -56,7 +56,7 @@
 
     <%= styled_form_with model: @import, scope: :import, url: import_upload_path(@import), multipart: true, class: "space-y-4" do |form| %>
       <%= form.select :account_id,
-            Current.user.accessible_accounts.visible.alphabetically.pluck(:name, :id),
+            Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id),
             { label: t(".qif_account_label"), include_blank: t(".qif_account_placeholder"), selected: @import.account_id },
             required: true %>
 
@@ -112,7 +112,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Current.user.accessible_accounts.visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <label for="import_import_file_csv" class="flex flex-col items-center justify-center w-full h-64 border border-secondary border-dashed rounded-xl cursor-pointer" data-controller="file-upload" data-file-upload-target="uploadArea">
@@ -144,7 +144,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Current.user.accessible_accounts.visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <%= form.text_area :raw_file_str,
diff --git a/test/controllers/import/mappings_controller_test.rb b/test/controllers/import/mappings_controller_test.rb
index 91b335dfe0..7064f33ff9 100644
--- a/test/controllers/import/mappings_controller_test.rb
+++ b/test/controllers/import/mappings_controller_test.rb
@@ -26,4 +26,47 @@ class Import::MappingsControllerTest < ActionDispatch::IntegrationTest
 
     assert_redirected_to import_confirm_path(@import)
   end
+
+  test "account mapping lists connected accounts as targets" do
+    @import.update!(
+      raw_file_str: <<~CSV,
+        date,amount,account
+        #{Date.current.iso8601},25,Imported Checking
+      CSV
+      date_col_label: "date",
+      amount_col_label: "amount",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d"
+    )
+    @import.generate_rows_from_csv
+    @import.sync_mappings
+
+    get import_confirm_path(@import, step: 3)
+
+    assert_response :success
+    assert_select "select option[value='#{accounts(:connected).id}']", text: "Plaid Depository Account"
+  end
+
+  test "account mapping excludes accounts the user cannot write" do
+    sign_in users(:family_member)
+
+    @import.update!(
+      raw_file_str: <<~CSV,
+        date,amount,account
+        #{Date.current.iso8601},25,Credit Card
+      CSV
+      date_col_label: "date",
+      amount_col_label: "amount",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d"
+    )
+    @import.generate_rows_from_csv
+    @import.sync_mappings
+
+    get import_confirm_path(@import, step: 3)
+
+    assert_response :success
+    assert_select "select option", text: "Add as new account"
+    assert_select "select option", text: "Credit Card", count: 0
+  end
 end
diff --git a/test/controllers/imports_controller_test.rb b/test/controllers/imports_controller_test.rb
index 10d34ae0b9..85fc0af5bc 100644
--- a/test/controllers/imports_controller_test.rb
+++ b/test/controllers/imports_controller_test.rb
@@ -327,8 +327,8 @@ class ImportsControllerTest < ActionDispatch::IntegrationTest
     sign_in users(:family_member)
     patch import_url(pdf_import), params: { import: { account_id: account.id } }
 
-    assert_redirected_to account_url(account)
-    assert_equal I18n.t("accounts.not_authorized"), flash[:alert]
+    assert_redirected_to import_url(pdf_import)
+    assert_equal I18n.t("imports.update.invalid_account", default: "Account not found."), flash[:alert]
     assert_nil pdf_import.reload.account
     assert_nil statement.reload.account
   end
diff --git a/test/models/transaction_import_test.rb b/test/models/transaction_import_test.rb
index 13d638dbdb..ed6b836d1d 100644
--- a/test/models/transaction_import_test.rb
+++ b/test/models/transaction_import_test.rb
@@ -272,6 +272,52 @@ class TransactionImportTest < ActiveSupport::TestCase
     assert_equal 2, account.entries.where(date: Date.new(2024, 1, 1), amount: 100).count
   end
 
+  test "skips CSV rows that already exist as provider-synced transactions" do
+    account = accounts(:connected)
+    assert account.linked?
+
+    existing_entry = account.entries.create!(
+      date: Date.new(2024, 1, 1),
+      amount: 100,
+      currency: "USD",
+      name: "Coffee Shop",
+      external_id: "enablebanking_txn_1",
+      source: "enable_banking",
+      entryable: Transaction.new
+    )
+
+    import_csv = <<~CSV
+      date,name,amount
+      01/01/2024,Coffee Shop,100
+      01/02/2024,Older History,50
+    CSV
+
+    @import.update!(
+      account: account,
+      raw_file_str: import_csv,
+      date_col_label: "date",
+      amount_col_label: "amount",
+      name_col_label: "name",
+      date_format: "%m/%d/%Y",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    @import.generate_rows_from_csv
+    @import.reload
+
+    assert_difference -> { Entry.count } => 1,
+                      -> { Transaction.count } => 1 do
+      @import.publish
+    end
+
+    existing_entry.reload
+    assert_equal "enablebanking_txn_1", existing_entry.external_id
+    assert_nil existing_entry.import_id
+    assert_not existing_entry.import_locked?
+    assert account.entries.exists?(date: Date.new(2024, 1, 2), name: "Older History", import_locked: true)
+  end
+
   test "imports all identical transactions from CSV even when one exists in database" do
     account = accounts(:depository)
 

From 713d48ffdf501ce664fa20775c694b3f943af022 Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:49:49 +0800
Subject: [PATCH 2/6] Gate provider CSV dedupe on present transaction name

Blank-name CSV rows must not match unrelated provider entries on
date+amount alone; only named rows reconcile against synced history.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 app/models/transaction_import.rb       |  8 ++---
 test/models/transaction_import_test.rb | 45 ++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/app/models/transaction_import.rb b/app/models/transaction_import.rb
index c5d88073ee..f5e823fa1a 100644
--- a/app/models/transaction_import.rb
+++ b/app/models/transaction_import.rb
@@ -34,9 +34,9 @@ def import!
         # Pass claimed_entry_ids to exclude entries we've already matched in this import
         # This ensures identical rows within the CSV are all imported as separate transactions
         #
-        # include_provider_entries: true so CSV backfills into already-linked
-        # accounts (e.g. Enable Banking's ~90-day window) do not recreate rows
-        # that already arrived via sync. Mirror PDF statement reconciliation.
+        # include_provider_entries only when the CSV row has a name: without it,
+        # date+amount would match unrelated provider rows. Named rows still skip
+        # already-synced overlap (e.g. Enable Banking's ~90-day window).
         adapter = Account::ProviderImportAdapter.new(mapped_account)
         duplicate_entry = adapter.find_duplicate_transaction(
           date: row.date_iso,
@@ -44,7 +44,7 @@ def import!
           currency: effective_currency,
           name: row.name,
           exclude_entry_ids: claimed_entry_ids,
-          include_provider_entries: true
+          include_provider_entries: row.name.present?
         )
 
         if duplicate_entry
diff --git a/test/models/transaction_import_test.rb b/test/models/transaction_import_test.rb
index ed6b836d1d..90d9c7fc13 100644
--- a/test/models/transaction_import_test.rb
+++ b/test/models/transaction_import_test.rb
@@ -318,6 +318,51 @@ class TransactionImportTest < ActiveSupport::TestCase
     assert account.entries.exists?(date: Date.new(2024, 1, 2), name: "Older History", import_locked: true)
   end
 
+  test "blank-name CSV rows do not skip unrelated provider-synced transactions" do
+    account = accounts(:connected)
+    assert account.linked?
+
+    existing_entry = account.entries.create!(
+      date: Date.new(2024, 1, 1),
+      amount: 100,
+      currency: "USD",
+      name: "Coffee Shop",
+      external_id: "enablebanking_txn_blank_name",
+      source: "enable_banking",
+      entryable: Transaction.new
+    )
+
+    import_csv = <<~CSV
+      date,name,amount
+      01/01/2024,,100
+    CSV
+
+    @import.update!(
+      account: account,
+      raw_file_str: import_csv,
+      date_col_label: "date",
+      amount_col_label: "amount",
+      name_col_label: "name",
+      date_format: "%m/%d/%Y",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    @import.generate_rows_from_csv
+    @import.reload
+
+    assert_difference -> { Entry.count } => 1,
+                      -> { Transaction.count } => 1 do
+      @import.publish
+    end
+
+    existing_entry.reload
+    assert_equal "enablebanking_txn_blank_name", existing_entry.external_id
+    assert_nil existing_entry.import_id
+    assert_not existing_entry.import_locked?
+    assert account.entries.exists?(date: Date.new(2024, 1, 1), amount: 100, import_locked: true, external_id: nil)
+  end
+
   test "imports all identical transactions from CSV even when one exists in database" do
     account = accounts(:depository)
 

From 0f5607e14b9e940aea0050e837d2dbbe79b9227c Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Mon, 24 Aug 2026 21:49:50 +0800
Subject: [PATCH 3/6] Keep linked accounts out of TradeImport mappings

TradeImport inserts every row without provider reconciliation, so
exposing linked investment accounts would duplicate synced trades.
Only TransactionImport may target linked accounts.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 app/controllers/import/mappings_controller.rb |  2 +-
 app/controllers/import/uploads_controller.rb  |  2 +-
 app/controllers/imports_controller.rb         |  6 +++-
 app/models/import/account_mapping.rb          | 26 +++++++++++++----
 app/views/import/uploads/show.html.erb        |  4 +--
 .../import/mappings_controller_test.rb        | 28 +++++++++++++++++++
 .../import/uploads_controller_test.rb         | 11 ++++++++
 7 files changed, 68 insertions(+), 11 deletions(-)

diff --git a/app/controllers/import/mappings_controller.rb b/app/controllers/import/mappings_controller.rb
index 06de2b218a..667671861d 100644
--- a/app/controllers/import/mappings_controller.rb
+++ b/app/controllers/import/mappings_controller.rb
@@ -25,7 +25,7 @@ def mappable
       return nil unless mappable_class.present?
 
       if mappable_class == Account
-        Current.family.accounts.writable_by(Current.user).find_by(id: mapping_params[:mappable_id])
+        Import::AccountMapping.importable_accounts(@import).find_by(id: mapping_params[:mappable_id])
       else
         mappable_class.find_by(id: mapping_params[:mappable_id], family: Current.family)
       end
diff --git a/app/controllers/import/uploads_controller.rb b/app/controllers/import/uploads_controller.rb
index 4176b2ea9a..72959fa118 100644
--- a/app/controllers/import/uploads_controller.rb
+++ b/app/controllers/import/uploads_controller.rb
@@ -19,7 +19,7 @@ def update
     elsif @import.is_a?(SureImport)
       update_sure_import_upload
     elsif csv_valid?(csv_str)
-      @import.account = import_account_id.present? ? Current.family.accounts.writable_by(Current.user).find(import_account_id) : nil
+      @import.account = import_account_id.present? ? Import::AccountMapping.importable_accounts(@import).find(import_account_id) : nil
       @import.assign_attributes(raw_file_str: csv_str, col_sep: upload_params[:col_sep])
       @import.save!(validate: false)
 
diff --git a/app/controllers/imports_controller.rb b/app/controllers/imports_controller.rb
index f802c6c581..5844c72d3c 100644
--- a/app/controllers/imports_controller.rb
+++ b/app/controllers/imports_controller.rb
@@ -98,7 +98,11 @@ def create
     type = params.dig(:import, :type).to_s
     type = "TransactionImport" unless Import::TYPES.include?(type)
 
-    account = Current.family.accounts.writable_by(Current.user).find_by(id: params.dig(:import, :account_id))
+    account = Import::AccountMapping.account_scope(
+      family: Current.family,
+      user: Current.user,
+      allow_linked: type == "TransactionImport"
+    ).find_by(id: params.dig(:import, :account_id))
     import = Current.family.imports.create!(
       type: type,
       account: account,
diff --git a/app/models/import/account_mapping.rb b/app/models/import/account_mapping.rb
index 0c42bfb093..d106443dc1 100644
--- a/app/models/import/account_mapping.rb
+++ b/app/models/import/account_mapping.rb
@@ -9,14 +9,28 @@ def mappables_by_key(import)
       unique_values.index_with { |value| accounts[value] }
     end
 
-    # Linked (provider-managed) accounts are valid CSV targets so users can
-    # backfill history after connecting. When Current.user is set, restrict to
-    # accounts they can write; otherwise fall back to the family (e.g. jobs).
+    # Writable accounts the current user may target for this import.
+    # Linked (provider-managed) accounts are only offered for import types that
+    # reconcile against provider-synced rows (TransactionImport). TradeImport
+    # inserts unconditionally and would duplicate Plaid/Questrade trades.
     def importable_accounts(import)
-      scope = import.family.accounts
-      return scope unless Current.user
+      account_scope(
+        family: import.family,
+        user: Current.user,
+        allow_linked: allows_linked_account_targets?(import)
+      )
+    end
+
+    def account_scope(family:, user: nil, allow_linked: false)
+      scope = family.accounts
+      scope = scope.writable_by(user) if user
+      return scope if allow_linked
+
+      scope.where(id: family.accounts.manual.select(:id))
+    end
 
-      scope.writable_by(Current.user)
+    def allows_linked_account_targets?(import)
+      import.is_a?(TransactionImport)
     end
   end
 
diff --git a/app/views/import/uploads/show.html.erb b/app/views/import/uploads/show.html.erb
index eaa54301a6..9c1370a26f 100644
--- a/app/views/import/uploads/show.html.erb
+++ b/app/views/import/uploads/show.html.erb
@@ -112,7 +112,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, Import::AccountMapping.importable_accounts(@import).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <label for="import_import_file_csv" class="flex flex-col items-center justify-center w-full h-64 border border-secondary border-dashed rounded-xl cursor-pointer" data-controller="file-upload" data-file-upload-target="uploadArea">
@@ -144,7 +144,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, Import::AccountMapping.importable_accounts(@import).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <%= form.text_area :raw_file_str,
diff --git a/test/controllers/import/mappings_controller_test.rb b/test/controllers/import/mappings_controller_test.rb
index 7064f33ff9..5daf8656f9 100644
--- a/test/controllers/import/mappings_controller_test.rb
+++ b/test/controllers/import/mappings_controller_test.rb
@@ -69,4 +69,32 @@ class Import::MappingsControllerTest < ActionDispatch::IntegrationTest
     assert_select "select option", text: "Add as new account"
     assert_select "select option", text: "Credit Card", count: 0
   end
+
+  test "trade import account mapping excludes linked accounts without reconciliation" do
+    linked = accounts(:connected)
+    assert linked.linked?
+
+    trade_import = imports(:trade)
+    trade_import.update!(
+      raw_file_str: <<~CSV,
+        date,ticker,qty,price,account
+        #{Date.current.iso8601},AAPL,1,100,#{linked.name}
+      CSV
+      date_col_label: "date",
+      ticker_col_label: "ticker",
+      qty_col_label: "qty",
+      price_col_label: "price",
+      account_col_label: "account",
+      date_format: "%Y-%m-%d"
+    )
+    trade_import.generate_rows_from_csv
+    trade_import.sync_mappings
+
+    get import_confirm_path(trade_import, step: 1)
+
+    assert_response :success
+    assert_select "select option", text: "Add as new account"
+    assert_select "select option[value='#{linked.id}']", count: 0
+    assert_nil trade_import.mappings.accounts.find_by(key: linked.name)&.mappable
+  end
 end
diff --git a/test/controllers/import/uploads_controller_test.rb b/test/controllers/import/uploads_controller_test.rb
index fd203a23e0..615c91e35b 100644
--- a/test/controllers/import/uploads_controller_test.rb
+++ b/test/controllers/import/uploads_controller_test.rb
@@ -47,6 +47,17 @@ class Import::UploadsControllerTest < ActionDispatch::IntegrationTest
     assert_select 'select[name="import[account_id]"] option', text: "Plaid Depository Account", count: 0
   end
 
+  test "trade import account select excludes linked accounts without reconciliation" do
+    linked = accounts(:connected)
+    trade_import = imports(:trade)
+
+    get import_upload_url(trade_import)
+
+    assert_response :success
+    assert_select 'select[name="import[account_id]"] option[value=?]', linked.id, count: 0
+    assert_select 'select[name="import[account_id]"] option', text: accounts(:investment).name
+  end
+
   test "respects SURE_IMPORT_MAX_NDJSON_SIZE_MB when uploading Sure import file (#3010)" do
     configured_limit = 2.megabytes
     SureImport.stubs(:max_ndjson_size).returns(configured_limit)

From 35ffa5629c5fbb733cee13ef71f5e9bfaa046765 Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Mon, 24 Aug 2026 22:08:09 +0800
Subject: [PATCH 4/6] Move import upload account options out of the template

QIF and CSV selectors now reuse controller-built option lists so the
view does not query account scopes.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 app/controllers/import/uploads_controller.rb | 7 +++++++
 app/views/import/uploads/show.html.erb       | 6 +++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/app/controllers/import/uploads_controller.rb b/app/controllers/import/uploads_controller.rb
index 72959fa118..6da0d6e3ff 100644
--- a/app/controllers/import/uploads_controller.rb
+++ b/app/controllers/import/uploads_controller.rb
@@ -2,6 +2,7 @@ class Import::UploadsController < ApplicationController
   layout "imports"
 
   before_action :set_import
+  before_action :set_account_options, only: %i[show update]
 
   def show
   end
@@ -66,6 +67,12 @@ def set_import
       @import = Current.family.imports.find(params[:import_id])
     end
 
+    def set_account_options
+      writable_accounts = Current.family.accounts.writable_by(Current.user).visible.alphabetically
+      @qif_account_options = writable_accounts.pluck(:name, :id)
+      @csv_account_options = Import::AccountMapping.importable_accounts(@import).visible.alphabetically.pluck(:name, :id)
+    end
+
     def handle_qif_upload
       unless QifParser.valid?(csv_str)
         flash.now[:alert] = "Must be a valid QIF file"
diff --git a/app/views/import/uploads/show.html.erb b/app/views/import/uploads/show.html.erb
index 9c1370a26f..130d69466d 100644
--- a/app/views/import/uploads/show.html.erb
+++ b/app/views/import/uploads/show.html.erb
@@ -56,7 +56,7 @@
 
     <%= styled_form_with model: @import, scope: :import, url: import_upload_path(@import), multipart: true, class: "space-y-4" do |form| %>
       <%= form.select :account_id,
-            Current.family.accounts.writable_by(Current.user).visible.alphabetically.pluck(:name, :id),
+            @qif_account_options,
             { label: t(".qif_account_label"), include_blank: t(".qif_account_placeholder"), selected: @import.account_id },
             required: true %>
 
@@ -112,7 +112,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Import::AccountMapping.importable_accounts(@import).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, @csv_account_options, { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <label for="import_import_file_csv" class="flex flex-col items-center justify-center w-full h-64 border border-secondary border-dashed rounded-xl cursor-pointer" data-controller="file-upload" data-file-upload-target="uploadArea">
@@ -144,7 +144,7 @@
             <%= form.select :col_sep, Import.separator_options, label: true %>
 
             <% if @import.type == "TransactionImport" || @import.type == "TradeImport" %>
-              <%= form.select :account_id, Import::AccountMapping.importable_accounts(@import).visible.alphabetically.pluck(:name, :id), { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
+              <%= form.select :account_id, @csv_account_options, { label: t(".account_optional_label"), include_blank: t(".multi_account_import"), selected: @import.account_id } %>
             <% end %>
 
             <%= form.text_area :raw_file_str,

From fb9b9515606cd33422e05cca9b2ba29e1f26cf0a Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:24:57 +0800
Subject: [PATCH 5/6] Make the provider dedupe name gate actually gate

`row.name` is never blank: Import#generate_rows_from_csv substitutes
default_row_name ("Imported item") whenever the name cell is empty, so
`include_provider_entries: row.name.present?` was always true and the
previous commit was a no-op. The test added alongside it passed with the
gate reverted, so it was not covering the risk either.

Gate on csv_provided_name? instead, which distinguishes a real CSV name
from the substituted placeholder, and rewrite the test around a provider
entry carrying that placeholder -- the only way date+amount+name can
actually collide. That test now fails without the gate, dropping the CSV
row entirely, which is the data loss the gate is meant to prevent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/models/transaction_import.rb       | 18 ++++++++++++++----
 test/models/transaction_import_test.rb |  8 ++++++--
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/app/models/transaction_import.rb b/app/models/transaction_import.rb
index f5e823fa1a..5c4748c96b 100644
--- a/app/models/transaction_import.rb
+++ b/app/models/transaction_import.rb
@@ -34,9 +34,12 @@ def import!
         # Pass claimed_entry_ids to exclude entries we've already matched in this import
         # This ensures identical rows within the CSV are all imported as separate transactions
         #
-        # include_provider_entries only when the CSV row has a name: without it,
-        # date+amount would match unrelated provider rows. Named rows still skip
-        # already-synced overlap (e.g. Enable Banking's ~90-day window).
+        # Only rows carrying a real CSV name may claim a provider-synced entry.
+        # A blank name cell falls back to default_row_name, so row.name is never
+        # actually blank -- gating on presence alone would always be true and let
+        # a placeholder row match a provider entry on date+amount+placeholder.
+        # Named rows still skip already-synced overlap (Enable Banking's ~90-day
+        # window); placeholder rows only reconcile against manual/CSV entries.
         adapter = Account::ProviderImportAdapter.new(mapped_account)
         duplicate_entry = adapter.find_duplicate_transaction(
           date: row.date_iso,
@@ -44,7 +47,7 @@ def import!
           currency: effective_currency,
           name: row.name,
           exclude_entry_ids: claimed_entry_ids,
-          include_provider_entries: row.name.present?
+          include_provider_entries: csv_provided_name?(row)
         )
 
         if duplicate_entry
@@ -126,4 +129,11 @@ def csv_template
     csv.delete("account") if account.present?
     csv
   end
+
+  private
+    # True only when the row's name came from the CSV rather than the
+    # default_row_name placeholder substituted for a blank cell.
+    def csv_provided_name?(row)
+      row.name.present? && row.name != default_row_name
+    end
 end
diff --git a/test/models/transaction_import_test.rb b/test/models/transaction_import_test.rb
index 90d9c7fc13..a28c60efd5 100644
--- a/test/models/transaction_import_test.rb
+++ b/test/models/transaction_import_test.rb
@@ -318,7 +318,11 @@ class TransactionImportTest < ActiveSupport::TestCase
     assert account.entries.exists?(date: Date.new(2024, 1, 2), name: "Older History", import_locked: true)
   end
 
-  test "blank-name CSV rows do not skip unrelated provider-synced transactions" do
+  # A blank name cell is replaced by Import#default_row_name ("Imported item"),
+  # so the placeholder is what reaches dedupe. Naming the provider entry with the
+  # same placeholder is the only way date+amount+name can collide, and it is the
+  # case the csv_provided_name? gate exists to stop.
+  test "placeholder-name CSV rows do not claim provider-synced transactions" do
     account = accounts(:connected)
     assert account.linked?
 
@@ -326,7 +330,7 @@ class TransactionImportTest < ActiveSupport::TestCase
       date: Date.new(2024, 1, 1),
       amount: 100,
       currency: "USD",
-      name: "Coffee Shop",
+      name: @import.send(:default_row_name),
       external_id: "enablebanking_txn_blank_name",
       source: "enable_banking",
       entryable: Transaction.new

From 6b24d2cb22457c99ae3cc4526c8c6b5111a67f02 Mon Sep 17 00:00:00 2001
From: bittensorrider <280573057+bittensorrider@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:38:44 +0800
Subject: [PATCH 6/6] Treat a literal "Imported item" CSV name as provided

csv_provided_name? compared row.name against default_row_name, so a CSV
that literally supplies "Imported item" was misread as a blank cell. That
row was then barred from reconciling against provider-synced history and
imported as a duplicate.

Resolve the ambiguity against the source CSV instead: source_row_number is
1-based and assigned in Import#generate_rows_from_csv, so it maps back to
the original name cell. A supplied placeholder now counts as provided; a
blank cell still does not. Without a CSV behind the import the map is
empty, keeping the conservative answer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/models/transaction_import.rb       | 25 ++++++++++--
 test/models/transaction_import_test.rb | 53 ++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 3 deletions(-)

diff --git a/app/models/transaction_import.rb b/app/models/transaction_import.rb
index 5c4748c96b..b956976da9 100644
--- a/app/models/transaction_import.rb
+++ b/app/models/transaction_import.rb
@@ -131,9 +131,28 @@ def csv_template
   end
 
   private
-    # True only when the row's name came from the CSV rather than the
-    # default_row_name placeholder substituted for a blank cell.
+    # True when the row's name came from the CSV rather than the
+    # default_row_name placeholder substituted for a blank cell. A row whose
+    # name cell literally holds the placeholder text still counts as provided,
+    # so it reconciles against provider-synced history like any other named row.
     def csv_provided_name?(row)
-      row.name.present? && row.name != default_row_name
+      return false if row.name.blank?
+      return true unless row.name == default_row_name
+
+      csv_name_cells[row.source_row_number].present?
+    end
+
+    # Maps source_row_number (1-based, assigned in Import#generate_rows_from_csv)
+    # to the raw name cell, so a supplied placeholder is distinguishable from a
+    # blank one. Empty without a CSV behind the import, which keeps the
+    # conservative "not provided" answer.
+    def csv_name_cells
+      @csv_name_cells ||= if raw_file_str.blank?
+        {}
+      else
+        csv_rows.each_with_index.to_h do |csv_row, index|
+          [ index + 1, csv_value(csv_row, name_col_label, "name") ]
+        end
+      end
     end
 end
diff --git a/test/models/transaction_import_test.rb b/test/models/transaction_import_test.rb
index a28c60efd5..930f9f54be 100644
--- a/test/models/transaction_import_test.rb
+++ b/test/models/transaction_import_test.rb
@@ -367,6 +367,59 @@ class TransactionImportTest < ActiveSupport::TestCase
     assert account.entries.exists?(date: Date.new(2024, 1, 1), amount: 100, import_locked: true, external_id: nil)
   end
 
+  # The inverse of the placeholder case: a CSV that literally supplies the
+  # default_row_name text is a real name, so it must still reconcile against
+  # provider-synced history instead of creating a duplicate.
+  test "CSV rows naming the placeholder literally still claim provider-synced transactions" do
+    account = accounts(:connected)
+    assert account.linked?
+
+    literal_name = @import.send(:default_row_name)
+
+    existing_entry = account.entries.create!(
+      date: Date.new(2024, 1, 1),
+      amount: 100,
+      currency: "USD",
+      name: literal_name,
+      external_id: "enablebanking_txn_literal_name",
+      source: "enable_banking",
+      entryable: Transaction.new
+    )
+
+    import_csv = <<~CSV
+      date,name,amount
+      01/01/2024,#{literal_name},100
+      01/02/2024,Older History,50
+    CSV
+
+    @import.update!(
+      account: account,
+      raw_file_str: import_csv,
+      date_col_label: "date",
+      amount_col_label: "amount",
+      name_col_label: "name",
+      date_format: "%m/%d/%Y",
+      amount_type_strategy: "signed_amount",
+      signage_convention: "inflows_negative"
+    )
+
+    @import.generate_rows_from_csv
+    @import.reload
+
+    # Only the older row is new; the placeholder-named row matches the synced entry.
+    assert_difference -> { Entry.count } => 1,
+                      -> { Transaction.count } => 1 do
+      @import.publish
+    end
+
+    existing_entry.reload
+    assert_equal "enablebanking_txn_literal_name", existing_entry.external_id
+    assert_nil existing_entry.import_id
+    assert_not existing_entry.import_locked?
+    assert_equal 1, account.entries.where(date: Date.new(2024, 1, 1), amount: 100, name: literal_name).count
+    assert account.entries.exists?(date: Date.new(2024, 1, 2), name: "Older History", import_locked: true)
+  end
+
   test "imports all identical transactions from CSV even when one exists in database" do
     account = accounts(:depository)