[verified] Fix backtest accounting identity + honest UI disclosure

Correct the multi-rebalance backtest accounting so ending wealth is
capital + price_pnl + dividend_income with no double counting:
- price_pnl now measures equity change excluding dividends (was reusing
  ending holdings value as 'price profit')
- dividend proxy is included in final_value and net_return, exposed as
  dividend_method=final_holdings_yield_proxy
- regression tests: flat price => zero price_pnl; flat + dividend =>
  dividend-only return; rising no-dividend => correct bucket P&L;
  multi-rebalance accounting identity
- UI (result card + saved-run history) labels dividends as ประมาณการปันผล
  (Proxy) and shows descriptive non-PIT badge when leakage_guard=false

Backend 239 tests passed; targeted backtest 11 passed; frontend build,
npm audit (0), static scan and diff check passed; fresh independent
review deleg_10918fed passed with empty blocker arrays.
Backtest remains descriptive non-PIT (leakage_guard=false) with the
default current-score scorer.

docs/HANDOFF.md

@@ -157,6 +157,42 @@ NEVER include API keys, tokens, passwords, secrets, credentials, or connection s
 
 ---
 
+## Session 2026-08-27 — Backtest Accounting Remediation
+
+**Branch:** `main` · **Base HEAD:** `b362cc3` · **Commit/push:** not performed
+
+### Completed
+
+- Added RED/GREEN flat-price accounting invariants in `backend/tests/test_backtest.py`.
+- Corrected general backtest price P&L to compare ending pre-dividend equity with initial capital.
+- Included the final-holdings dividend-yield proxy in `final_value` and `net_return`.
+- Added machine-readable `dividend_method=final_holdings_yield_proxy`.
+- Updated the Vue backtest panel to label estimated dividends and warn when `leakage_guard=false`.
+
+### Verified
+
+- RED: flat-price regressions failed with incorrect `price_pnl=20,000` and `49,000`.
+- GREEN: flat/no-dividend, flat/proxy-dividend, rising/no-dividend, and multi-rebalance accounting checks passed; targeted suite **11 passed**.
+- Full backend suite: **239 passed**.
+- Python compileall passed.
+- Vite production build passed.
+- npm audit reported 0 high-severity vulnerabilities.
+- Added-line security/dangerous-pattern scan and `git diff --check` passed.
+- Independent review cycle 1 failed closed on missing proxy/non-PIT disclosure in saved-run history. A fresh fix agent added `ประมาณการปันผล (Proxy)` and per-row `descriptive non-PIT` badges. Fresh final review `deleg_10918fed` inspected the current post-hardening diff and returned `passed=true` with empty security, logic, and suggestion arrays.
+
+### Known limitations
+
+- `dividend_income` is still estimated from final holdings and final dividend yield; it is not a dated cash-flow ledger.
+- The default public backtest still applies current scores historically, so `leakage_guard=false` and the result remains descriptive non-PIT.
+- A supplied scorer toggles `leakage_guard=true`, but provenance and release-time semantics are not independently certified.
+- Backtest run history remains in process memory.
+
+### Exact next action
+
+Implement dated dividend events and a provenance-validated PIT score provider before using results as strategy-performance evidence. Do not reset or stage unrelated pre-existing working-tree changes.
+
+---
+
 ## Session 2026-08-25 — Multi-theme + Simulation (appended)
 
 **Branch:** main · **HEAD:** aae1d13 (pushed `8a6991b..aae1d13`)