Track investments as broker facts with a position leg

An account now has a kind, and an investment account holds positions as well as
cash. A broker row is not a new entity: it is a bank fact with an optional
position leg, so deduplication, the journal, fact immutability, the DuckDB
projection and the transactions view carry it unchanged. Facts.Amount stays the
cash leg and is zero on the rows that move only a position.

Scalable Capital exports are recognized locally as a fourth format, read by
their own parser because a column mapping cannot describe them: the amount
column is settled cash on a cash row, a gross to be netted on a trade, and a
position valuation that must never touch cash on a corporate action or a depot
transfer. A cash amount is already net of the tax the broker withheld or
refunded, so that tax is recorded on the fact and never subtracted a second
time; treating a corporate action's valuation as money conjures cash, and a
depot switch would do it once per instrument. The share column is signed only
for those two types, so buys and sells take their direction from the type. Every
security row is checked against shares times price at 128-bit width, because a
lost decimal separator survives every other check. An unknown status, type or
assetType, a foreign currency, a missing ISIN, or one failed check rejects the
whole file with the record number.

Instruments live in instruments.finance, keyed by ISIN with an ID derived from
it, so re-importing never registers a security twice. One ISIN appears under
several broker descriptions over the years and sometimes under the ISIN itself:
the most recent real description names it, and an import never renames one that
already exists. A broker also reuses a single reference across every leg of one
event, so transaction identity includes the event and its instrument.

domain.Fallback returns kind "investment" for any fact carrying a position leg,
so no broker row reaches the sign-based branch. That single rule is what stops
an unmatched deposit from counting as income and a broker fee from counting as
household spending; the monthly PRIME fee and its matching credit now cancel in
clearing:investments with no configuration at all. Investment rows are excluded
from spending analytics, from bulk reclassification and from the model, exactly
as transfers are.

Equal competing transfers are paired instead of skipped. Every connected
component of the candidate graph is a complete bipartite graph between two fixed
accounts at one amount and currency, so every pairing produces the same
accounts, kinds and postings and only the displayed counterpart differs.
Refusing to choose was the expensive option: both legs fell through to the
sign-based fallback and appeared as spending and income that never happened.
Pairing follows the nearest booking date, then the transaction ID, so iteration
order decides nothing. POST /api/transactions/{id}/transfer rewrites the old and
the new pair in one commit, because reciprocity is validated and a half-applied
link is an invalid dataset, and the matcher now skips any record classified
manually so a hand-made link or unlink outlives the next import.

Wealth reports each account's cash and positions from the journal rather than
the index, with named checks - row arithmetic, cash never negative, holdings
never negative - because it exists to be compared against the figures a broker
shows on its own screen. A negative holding means the imported history is
partial. Share counts are exact to eight places; a reinvested distribution
quoted to six is rounded to money's four and the residue is reported rather than
hidden. Market prices, market value, net worth over time, FIFO lot accounting,
realised gains and currency conversion are deliberately absent.

internal/app/app_test.go

@@ -50,7 +50,7 @@ func sampleFacts(description, date string, amount domain.Money) domain.Facts {
 func seed(t *testing.T, a *App, s State) State {
 	t.Helper()
 	a.mu.Lock()
-	result, err := a.importFacts(context.Background(), s, []domain.Facts{sampleFacts("REWE", "2026-09-08", "-42.80"), sampleFacts("EDEKA", "2026-09-09", "-19.30")})
+	result, err := a.importFacts(context.Background(), s, []domain.Facts{sampleFacts("REWE", "2026-09-08", "-42.80"), sampleFacts("EDEKA", "2026-09-09", "-19.30")}, nil)
 	a.mu.Unlock()
 	if err != nil {
 		t.Fatal(err)
@@ -73,7 +73,7 @@ func TestFailedClassificationStillImportsAndRetryIsIdempotent(t *testing.T) {
 	}
 	before := domain.Clone(s.Data)
 	a.mu.Lock()
-	again, err := a.importFacts(context.Background(), s, []domain.Facts{sampleFacts("REWE", "2026-09-08", "-42.80"), sampleFacts("EDEKA", "2026-09-09", "-19.30")})
+	again, err := a.importFacts(context.Background(), s, []domain.Facts{sampleFacts("REWE", "2026-09-08", "-42.80"), sampleFacts("EDEKA", "2026-09-09", "-19.30")}, nil)
 	a.mu.Unlock()
 	if err != nil {
 		t.Fatal(err)
@@ -126,7 +126,7 @@ func TestPreviewCooldownProtectsLaterPreviewsAndImports(t *testing.T) {
 	}
 
 	a.mu.Lock()
-	result, err := a.importFacts(ctx, unchanged, []domain.Facts{sampleFacts("ALDI", "2026-09-10", "-12.34")})
+	result, err := a.importFacts(ctx, unchanged, []domain.Facts{sampleFacts("ALDI", "2026-09-10", "-12.34")}, nil)
 	a.mu.Unlock()
 	if err != nil {
 		t.Fatal(err)

internal/app/import.go

@@ -35,12 +35,26 @@ func addProposal(d *domain.Dataset, p classification.Proposal) error {
 	}
 	return nil
 }
-func (a *App) importFacts(ctx context.Context, s State, facts []domain.Facts) (ImportResult, error) {
+func (a *App) importFacts(ctx context.Context, s State, facts []domain.Facts, instruments []domain.Instrument) (ImportResult, error) {
+	// Instruments first: a broker fact references one, and the canonical
+	// dataset is validated as a whole, so a trade cannot be committed before
+	// the security it trades exists.
+	known := make(map[string]bool, len(s.Data.Instruments))
+	for _, v := range s.Data.Instruments {
+		known[v.ID] = true
+	}
+	registered := false
+	for _, v := range instruments {
+		if !known[v.ID] {
+			known[v.ID], registered = true, true
+			s.Data.Instruments = append(s.Data.Instruments, v)
+		}
+	}
 	added, err := banking.NormalizeAndDedupe(s.Data, facts)
 	if err != nil {
 		return ImportResult{}, err
 	}
-	if len(added) == 0 {
+	if len(added) == 0 && !registered {
 		return ImportResult{State: s}, nil
 	}
 	s.Data.Transactions = append(s.Data.Transactions, added...)
@@ -55,7 +69,7 @@ func (a *App) importFacts(ctx context.Context, s State, facts []domain.Facts) (I
 		ids[t.Facts.ID] = true
 	}
 	for i, t := range s.Data.Transactions {
-		if !ids[t.Facts.ID] || t.Enrichment.Kind == "transfer" {
+		if !ids[t.Facts.ID] || t.Enrichment.Kind == "transfer" || t.Enrichment.Kind == domain.KindInvestment {
 			continue
 		}
 		// With AI classification off for imports, no provider is contacted at
@@ -105,9 +119,16 @@ type CSVImport struct {
 	New         int                `json:"new"`
 	Duplicates  int                `json:"duplicates"`
 	Samples     []domain.Facts     `json:"samples"`
+	// Broker is present when the statement is a broker export. Its rows carry
+	// positions as well as cash, so they are read by a dedicated parser rather
+	// than by a column mapping, and the review needs to show what that parser
+	// decided: which securities it would register, which rows it skipped, and
+	// which figures it deliberately did not apply.
+	Broker *banking.ScalableImport `json:"broker,omitempty"`
 
-	facts   []domain.Facts
-	created time.Time
+	facts       []domain.Facts
+	instruments []domain.Instrument
+	created     time.Time
 }
 
 const csvImportLifetime = time.Hour
@@ -141,6 +162,28 @@ func (a *App) PrepareCSVImport(ctx context.Context, rev, accountID string, r io.
 		return CSVImport{}, err
 	}
 	prepared := CSVImport{ID: domain.NewID("csvimport"), Revision: s.Revision, AccountID: account.ID, MappedBy: "preset", created: time.Now()}
+	// A broker export is recognized before any column mapping is attempted. Its
+	// rows are not interchangeable statement lines: the same amount column is
+	// cash on one row, a gross to be netted on another, and a position
+	// valuation that must not touch cash on a third, so a column mapping cannot
+	// describe it.
+	if header, broker := banking.DetectScalableCSV(file); broker {
+		read, e := banking.ParseScalableCSV(file, account, s.Data.Instruments)
+		if e != nil {
+			return CSVImport{}, e
+		}
+		added, e := banking.NormalizeAndDedupe(s.Data, read.Facts)
+		if e != nil {
+			return CSVImport{}, e
+		}
+		prepared.Source, prepared.SourceLabel = banking.SourceScalable, "Scalable Capital"
+		prepared.Mapping = banking.CSVMapping{HeaderRow: header, DateFormat: "yyyy-mm-dd", DecimalFormat: "comma"}
+		prepared.Columns = brokerColumns()
+		prepared.Records, prepared.New, prepared.Duplicates = len(read.Facts), len(added), len(read.Facts)-len(added)
+		prepared.Samples, prepared.facts, prepared.instruments = csvSamples(read.Facts), read.Facts, read.Instruments
+		prepared.Broker = &read
+		return a.retain(prepared)
+	}
 	mapping, source, label, recognized := banking.DetectCSVMapping(file)
 	if !recognized {
 		sample, e := file.Sample()
@@ -188,6 +231,12 @@ func (a *App) PrepareCSVImport(ctx context.Context, rev, accountID string, r io.
 	prepared.Columns = csvColumns(mapping, account)
 	prepared.Records, prepared.New, prepared.Duplicates = len(facts), len(added), len(facts)-len(added)
 	prepared.Samples, prepared.facts = csvSamples(facts), facts
+	return a.retain(prepared)
+}
+
+// retain holds a reviewed statement until it is confirmed or expires. Nothing
+// is written to the journal here.
+func (a *App) retain(prepared CSVImport) (CSVImport, error) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 	for id, old := range a.csvImports {
@@ -202,6 +251,21 @@ func (a *App) PrepareCSVImport(ctx context.Context, rev, accountID string, r io.
 	return prepared, nil
 }
 
+// brokerColumns describes what the broker parser decided, in the same
+// reviewable shape as a column mapping. The dispatch is the part that can be
+// wrong in a way that moves money, so it is the part shown.
+func brokerColumns() []CSVColumn {
+	return []CSVColumn{
+		{Field: "Booking date", Column: "date, exactly as printed; the time column is local and crosses midnight, so it is ignored"},
+		{Field: "Imported rows", Column: `status "Executed" only; cancelled retries are all zeros and would import as phantom trades`},
+		{Field: "Cash movement", Column: "cash rows: amount, already net of tax; trades: amount − fee − tax; corporate actions and depot transfers: none"},
+		{Field: "Position change", Column: "shares, signed by type for buys and sells and exactly as printed for corporate actions and depot transfers"},
+		{Field: "Instrument", Column: "isin; the description only names it"},
+		{Field: "Reference", Column: "reference, which the broker reuses across every leg of one event"},
+		{Field: "Decimals", Column: "German: comma decimal, and a dot only groups thousands in exact three-digit runs"},
+	}
+}
+
 // ConfirmCSVImport imports exactly the facts that were previewed, provided the
 // journal has not changed since.
 func (a *App) ConfirmCSVImport(ctx context.Context, id, rev string) (ImportResult, error) {
@@ -221,7 +285,7 @@ func (a *App) ConfirmCSVImport(ctx context.Context, id, rev string) (ImportResul
 	if s.Revision != prepared.Revision {
 		return ImportResult{}, errors.New("revision conflict: data changed after the preview; upload the statement again")
 	}
-	result, err := a.importFacts(ctx, s, prepared.facts)
+	result, err := a.importFacts(ctx, s, prepared.facts, prepared.instruments)
 	if err != nil {
 		return ImportResult{}, err
 	}
@@ -414,7 +478,7 @@ func (a *App) Backfill(ctx context.Context, rev, accountID string, historyMonths
 	}
 	// Use normal import processing without changing sync cursors or saved consent
 	// settings, including when the requested range adds no transactions.
-	result, err := a.importFacts(ctx, s, facts)
+	result, err := a.importFacts(ctx, s, facts, nil)
 	if err != nil {
 		return ImportResult{}, err
 	}
@@ -779,7 +843,7 @@ func (a *App) Sync(ctx context.Context) (State, error) {
 			failures = append(failures, account.DisplayName+": "+meta.Error)
 			continue
 		}
-		result, e := a.importFacts(ctx, s, facts)
+		result, e := a.importFacts(ctx, s, facts, nil)
 		if e != nil {
 			failures = append(failures, account.DisplayName+": "+e.Error())
 			waiting = false

internal/app/manage.go

@@ -67,6 +67,33 @@ func SaveAccount(d *domain.Dataset, v domain.Account) error {
 	d.Accounts = append(d.Accounts, v)
 	return nil
 }
+
+// SaveInstrument registers or renames a security. The ISIN is the identity the
+// facts were imported under, so it cannot be changed: pointing an existing
+// instrument at a different security would silently relabel every trade that
+// references it.
+func SaveInstrument(d *domain.Dataset, v domain.Instrument) error {
+	v.Name = strings.TrimSpace(v.Name)
+	v.ISIN = strings.ToUpper(strings.Join(strings.Fields(v.ISIN), ""))
+	v.Currency = strings.ToUpper(strings.TrimSpace(v.Currency))
+	if v.ID == "" {
+		if !domain.ValidISIN(v.ISIN) {
+			return errors.New("an instrument needs a valid ISIN")
+		}
+		v.ID = domain.InstrumentID(v.ISIN)
+	}
+	for i, x := range d.Instruments {
+		if x.ID == v.ID {
+			if x.ISIN != v.ISIN {
+				return errors.New("an instrument's ISIN is its identity; register the other security separately")
+			}
+			d.Instruments[i] = v
+			return nil
+		}
+	}
+	d.Instruments = append(d.Instruments, v)
+	return nil
+}
 func SaveCategory(d *domain.Dataset, v domain.Category) error {
 	v.Name = strings.TrimSpace(v.Name)
 	if v.ID == "" {
@@ -146,6 +173,20 @@ func Manage(d *domain.Dataset, entity, action, id, target string) error {
 		if n == len(d.Accounts) {
 			return errors.New("unknown account")
 		}
+	case "instrument":
+		if action != "delete" {
+			return errors.New("instrument merging is not supported; an ISIN identifies exactly one security")
+		}
+		for _, t := range d.Transactions {
+			if t.Facts.Investment != nil && t.Facts.Investment.InstrumentID == id {
+				return errors.New("instrument is referenced by immutable financial records")
+			}
+		}
+		n := len(d.Instruments)
+		d.Instruments = slices.DeleteFunc(d.Instruments, func(v domain.Instrument) bool { return v.ID == id })
+		if n == len(d.Instruments) {
+			return errors.New("unknown instrument")
+		}
 	case "tag":
 		if !slices.ContainsFunc(d.Tags, func(v domain.Tag) bool { return v.ID == id }) {
 			return errors.New("unknown tag")

internal/app/reclassify.go

@@ -81,7 +81,7 @@ func (a *App) Preview(ctx context.Context, r PreviewRequest) (Preview, error) {
 	p := Preview{ID: domain.NewID("preview"), Revision: s.Revision, Changes: []Change{}, Errors: []ClassificationError{}, created: time.Now()}
 	baseMerchants := len(s.Data.Merchants)
 	for _, t := range s.Data.Transactions {
-		if t.Facts.BookingDate < r.From || t.Facts.BookingDate > r.To || t.Enrichment.Kind == "transfer" {
+		if t.Facts.BookingDate < r.From || t.Facts.BookingDate > r.To || t.Enrichment.Kind == "transfer" || t.Enrichment.Kind == domain.KindInvestment {
 			continue
 		}
 		if err = ctx.Err(); err != nil {

internal/app/transfer.go

@@ -0,0 +1,77 @@
+package app
+
+import (
+	"context"
+	"errors"
+
+	"finance-duck/internal/domain"
+)
+
+// LinkTransfer links a transaction to its own-account counterpart, or unlinks it
+// when peerID is empty.
+//
+// Reciprocity is a validated invariant: each side must name the other, with
+// opposite money, one currency and different accounts. So relinking has to
+// rewrite the old pair and the new pair in a single commit — applied one side
+// at a time, the dataset is invalid halfway through and the commit is refused.
+func (a *App) LinkTransfer(ctx context.Context, rev, id, peerID string) (State, error) {
+	return a.Mutate(ctx, rev, func(d *domain.Dataset) error { return Link(d, id, peerID) })
+}
+
+// Link rewrites both sides of a transfer decision at once.
+func Link(d *domain.Dataset, id, peerID string) error {
+	if id == "" {
+		return errors.New("select a transaction to link")
+	}
+	if id == peerID {
+		return errors.New("a transaction cannot be its own counterpart")
+	}
+	index := make(map[string]int, len(d.Transactions))
+	for i, t := range d.Transactions {
+		index[t.Facts.ID] = i
+	}
+	self, ok := index[id]
+	if !ok {
+		return errors.New("unknown transaction")
+	}
+	// Releasing a side also releases whatever it currently names, or the old
+	// counterpart is left pointing at a transaction that no longer points back.
+	release := func(i int) {
+		peer := d.Transactions[i].Enrichment.TransferPeerID
+		d.Transactions[i].Enrichment = unlinked(d.Transactions[i])
+		if j, found := index[peer]; found && j != i {
+			d.Transactions[j].Enrichment = unlinked(d.Transactions[j])
+		}
+	}
+	release(self)
+	if peerID == "" {
+		return nil
+	}
+	other, ok := index[peerID]
+	if !ok {
+		return errors.New("unknown counterpart transaction")
+	}
+	release(other)
+	for _, ends := range [][2]int{{self, other}, {other, self}} {
+		t := &d.Transactions[ends[0]]
+		t.Enrichment = domain.Enrichment{
+			Kind:           "transfer",
+			TagIDs:         t.Enrichment.TagIDs,
+			TransferPeerID: d.Transactions[ends[1]].Facts.ID,
+			Classification: domain.Provenance{Source: "manual"},
+		}
+	}
+	return nil
+}
+
+// unlinked is what a transaction becomes when it stops being a transfer: a
+// broker fact returns to the investment ledger, anything else to the sign-based
+// fallback. Either way the decision is recorded as manual, because the import
+// matcher skips manual rows — otherwise unlinking a pair that is not really a
+// transfer would be undone by the next import, every time.
+func unlinked(t domain.Transaction) domain.Enrichment {
+	e := domain.Fallback(t.Facts)
+	e.TagIDs = append([]string{}, t.Enrichment.TagIDs...)
+	e.Classification = domain.Provenance{Source: "manual"}
+	return e
+}

internal/app/wealth.go

@@ -0,0 +1,259 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"finance-duck/internal/domain"
+)
+
+// Wealth is a reconciliation report, computed from the journal rather than from
+// the DuckDB index: it exists to be checked against the figures a bank or
+// broker shows on its own screen, so it must not depend on the cache that the
+// same journal derives.
+type Wealth struct {
+	Accounts []WealthAccount `json:"accounts"`
+	// Totals is cash summed per currency across every account.
+	Totals []WealthTotal `json:"totals"`
+}
+
+type WealthTotal struct {
+	Currency string       `json:"currency"`
+	Cash     domain.Money `json:"cash"`
+}
+
+// WealthAccount is one account's position as the journal records it.
+type WealthAccount struct {
+	AccountID    string `json:"account_id"`
+	DisplayName  string `json:"display_name"`
+	Institution  string `json:"institution"`
+	Currency     string `json:"currency"`
+	Kind         string `json:"kind"`
+	Active       bool   `json:"active"`
+	Records      int    `json:"records"`
+	FirstBooking string `json:"first_booking,omitempty"`
+	LastBooking  string `json:"last_booking,omitempty"`
+	// Cash is every recorded movement summed. It equals the account's real
+	// balance only when the journal holds that account's complete history,
+	// which a broker export does and a date-windowed bank statement does not.
+	Cash     domain.Money    `json:"cash"`
+	Holdings []WealthHolding `json:"holdings"`
+	Checks   []WealthCheck   `json:"checks"`
+}
+
+// WealthHolding is one instrument's position in one account.
+type WealthHolding struct {
+	InstrumentID string          `json:"instrument_id"`
+	ISIN         string          `json:"isin"`
+	Name         string          `json:"name"`
+	Quantity     domain.Quantity `json:"quantity"`
+	// Invested is cash paid in less cash taken out through trades. It is not a
+	// cost basis: a depot transfer moves a position with no cash at all, and a
+	// sale returns cash without identifying which lot it closed.
+	Invested domain.Money `json:"invested"`
+	// Received is cash this instrument paid out without moving the position:
+	// distributions, and the cash side of a corporate action.
+	Received domain.Money `json:"received"`
+	Records  int          `json:"records"`
+}
+
+// WealthCheck is one named verification with its evidence. Failed marks a
+// disagreement inside the journal; the rest are notes that explain a figure
+// before it is compared with a broker's screen.
+type WealthCheck struct {
+	Name   string `json:"name"`
+	Detail string `json:"detail"`
+	Failed bool   `json:"failed"`
+}
+
+// Wealth reports every account's cash and positions with the checks that decide
+// whether those figures can be trusted.
+func (a *App) Wealth(ctx context.Context) (Wealth, error) {
+	s, err := a.Snapshot(ctx)
+	if err != nil {
+		return Wealth{}, err
+	}
+	return WealthOf(s.Data), nil
+}
+
+// WealthOf derives the report from a dataset. Money is summed in exact
+// ten-thousandths; 64 bits hold hundreds of trillions, far beyond any number a
+// journal of personal accounts can reach.
+func WealthOf(data domain.Dataset) Wealth {
+	instruments := map[string]domain.Instrument{}
+	for _, v := range data.Instruments {
+		instruments[v.ID] = v
+	}
+	accounts := map[string]domain.Account{}
+	for _, v := range data.Accounts {
+		accounts[v.ID] = v
+	}
+	ordered := slices.Clone(data.Transactions)
+	slices.SortStableFunc(ordered, func(x, y domain.Transaction) int {
+		if c := strings.Compare(x.Facts.BookingDate, y.Facts.BookingDate); c != 0 {
+			return c
+		}
+		return strings.Compare(x.Facts.ID, y.Facts.ID)
+	})
+
+	type holdingState struct {
+		units, invested, received int64
+		records                   int
+		lowest                    int64
+		lowestDate                string
+	}
+	type accountState struct {
+		cash, lowestCash             int64
+		lowestCashDate               string
+		records                      int
+		first, last                  string
+		holdings                     map[string]*holdingState
+		order                        []string
+		broken                       []string
+		unappliedFee, unappliedTax   int64
+		unappliedRows                int
+		unmatchedCash, unmatchedRows int64
+	}
+	states := map[string]*accountState{}
+	state := func(id string) *accountState {
+		if states[id] == nil {
+			states[id] = &accountState{holdings: map[string]*holdingState{}}
+		}
+		return states[id]
+	}
+	for _, t := range ordered {
+		f := t.Facts
+		account := accounts[f.AccountID]
+		st := state(f.AccountID)
+		st.records++
+		if st.first == "" {
+			st.first = f.BookingDate
+		}
+		st.last = f.BookingDate
+		minor, err := f.Amount.Minor()
+		if err != nil {
+			st.broken = append(st.broken, fmt.Sprintf("%s: unreadable amount %q", f.BookingDate, f.Amount))
+			continue
+		}
+		st.cash += minor
+		if st.cash < st.lowestCash {
+			st.lowestCash, st.lowestCashDate = st.cash, f.BookingDate
+		}
+		inv := f.Investment
+		if inv == nil {
+			continue
+		}
+		if err := domain.ValidateInvestment(f, account, instruments); err != nil {
+			st.broken = append(st.broken, fmt.Sprintf("%s %s: %v", f.BookingDate, f.ID, err))
+		}
+		if inv.CashOnly() {
+			fee, _ := inv.Fee.Minor()
+			tax, _ := inv.Tax.Minor()
+			if fee != 0 || tax != 0 {
+				st.unappliedRows++
+				st.unappliedFee += fee
+				st.unappliedTax += tax
+			}
+			if (inv.Event == domain.EventDeposit || inv.Event == domain.EventWithdrawal) && t.Enrichment.Kind != "transfer" {
+				st.unmatchedRows++
+				st.unmatchedCash += minor
+			}
+		}
+		if inv.InstrumentID == "" {
+			continue
+		}
+		held := st.holdings[inv.InstrumentID]
+		if held == nil {
+			held = &holdingState{}
+			st.holdings[inv.InstrumentID] = held
+			st.order = append(st.order, inv.InstrumentID)
+		}
+		held.records++
+		if inv.Settling() {
+			held.invested -= minor
+		} else {
+			held.received += minor
+		}
+		units, err := inv.Quantity.Units()
+		if inv.Quantity == "" {
+			units, err = 0, nil
+		}
+		if err != nil {
+			st.broken = append(st.broken, fmt.Sprintf("%s %s: unreadable quantity %q", f.BookingDate, f.ID, inv.Quantity))
+			continue
+		}
+		held.units += units
+		if held.units < held.lowest {
+			held.lowest, held.lowestDate = held.units, f.BookingDate
+		}
+	}
+
+	report := Wealth{Accounts: []WealthAccount{}, Totals: []WealthTotal{}}
+	totals := map[string]int64{}
+	currencies := []string{}
+	for _, account := range data.Accounts {
+		st := state(account.ID)
+		kind := account.Kind
+		if kind == "" {
+			kind = domain.AccountCash
+		}
+		entry := WealthAccount{
+			AccountID: account.ID, DisplayName: account.DisplayName, Institution: account.Institution,
+			Currency: account.Currency, Kind: kind, Active: account.Active,
+			Records: st.records, FirstBooking: st.first, LastBooking: st.last,
+			Cash: domain.FormatMoney(st.cash), Holdings: []WealthHolding{}, Checks: []WealthCheck{},
+		}
+		if _, seen := totals[account.Currency]; !seen {
+			currencies = append(currencies, account.Currency)
+		}
+		totals[account.Currency] += st.cash
+		for _, id := range st.order {
+			held := st.holdings[id]
+			instrument := instruments[id]
+			entry.Holdings = append(entry.Holdings, WealthHolding{
+				InstrumentID: id, ISIN: instrument.ISIN, Name: instrument.Name,
+				Quantity: domain.FormatQuantity(held.units), Invested: domain.FormatMoney(held.invested),
+				Received: domain.FormatMoney(held.received), Records: held.records,
+			})
+		}
+		slices.SortFunc(entry.Holdings, func(x, y WealthHolding) int { return strings.Compare(x.Name, y.Name) })
+
+		check := func(name, detail string, failed bool) {
+			entry.Checks = append(entry.Checks, WealthCheck{Name: name, Detail: detail, Failed: failed})
+		}
+		if len(st.broken) > 0 {
+			check("Row arithmetic", fmt.Sprintf("%d record(s) disagree with their own figures: %s", len(st.broken), strings.Join(st.broken, "; ")), true)
+		} else {
+			check("Row arithmetic", "every record agrees with its own gross, fee, tax, quantity and price", false)
+		}
+		if st.lowestCash < 0 {
+			check("Cash never negative", fmt.Sprintf("balance reached %s on %s, so the history is incomplete or a movement is misread", domain.FormatMoney(st.lowestCash), st.lowestCashDate), true)
+		} else {
+			check("Cash never negative", "the running balance stays at or above zero throughout", false)
+		}
+		negative := []string{}
+		for _, id := range st.order {
+			if held := st.holdings[id]; held.lowest < 0 {
+				negative = append(negative, fmt.Sprintf("%s reached %s on %s", instruments[id].ISIN, domain.FormatQuantity(held.lowest), held.lowestDate))
+			}
+		}
+		if len(negative) > 0 {
+			check("Holdings never negative", fmt.Sprintf("%s — a sale before its purchase means the export is partial or a sign is wrong", strings.Join(negative, "; ")), true)
+		} else if len(st.order) > 0 {
+			check("Holdings never negative", "every position stays at or above zero throughout", false)
+		}
+		if st.unappliedRows > 0 {
+			check("Fee and tax recorded, not applied", fmt.Sprintf("%d cash record(s) carry fee %s and tax %s. A broker cash amount is already net of them, so they are recorded and not subtracted again. If the balance above is wrong by one of these figures, this is why", st.unappliedRows, domain.FormatMoney(st.unappliedFee), domain.FormatMoney(st.unappliedTax)), false)
+		}
+		if st.unmatchedRows > 0 {
+			check("Deposits and withdrawals unmatched", fmt.Sprintf("%d transfer(s) totalling %s have no counterpart in another account. They stay out of spending either way; set this account's IBAN and settlement IBAN to pair them", st.unmatchedRows, domain.FormatMoney(st.unmatchedCash)), false)
+		}
+		report.Accounts = append(report.Accounts, entry)
+	}
+	for _, currency := range currencies {
+		report.Totals = append(report.Totals, WealthTotal{Currency: currency, Cash: domain.FormatMoney(totals[currency])})
+	}
+	return report
+}

internal/app/wealth_test.go

@@ -0,0 +1,233 @@
+package app
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"finance-duck/internal/analytics"
+	"finance-duck/internal/domain"
+)
+
+const brokerHeader = "date;time;status;reference;description;assetType;type;isin;shares;price;amount;fee;tax;currency\n"
+
+// A broker history end to end: money in, three purchases averaging down, the
+// distribution that came with a knock-out, the position row that closed it, and
+// a reinvested fraction of a share. Cash and holdings are what the user
+// compares against the broker's own screen, so they are asserted exactly.
+var brokerRows = []string{
+	`2025-05-06;02:00:00;Executed;DEP1;Scalable Capital Broker Einzahlung;Cash;Deposit;;;;800,00;;;EUR`,
+	`2025-05-07;09:02:13;Cancelled;SCAL9RdFWnYpi5T;Rheinmetall Long 10x Faktor-Zertifikat HVB;Security;Buy;DE000UG4V0Z7;0;0,00;0,00;0,00;0,00;EUR`,
+	`2025-05-07;09:02:29;Executed;SCALTThBbxx6z5Z;Rheinmetall Long 10x Faktor-Zertifikat HVB;Security;Buy;DE000UG4V0Z7;14;26,45;-370,30;0,00;0,00;EUR`,
+	`2025-09-17;15:14:49;Executed;SCALwBaNVPpjf8p;Rheinmetall Long 10x Factor HVB;Security;Buy;DE000UG4V0Z7;203;1,23;-249,69;0,99;0,00;EUR`,
+	`2025-09-18;13:38:08;Executed;SCALSVuyHibZT4w;Rheinmetall Long 10x Factor HVB;Security;Buy;DE000UG4V0Z7;6;1,10;-6,60;0,99;0,00;EUR`,
+	`2025-10-28;01:00:00;Executed;48231_rrCjP4EcbpefpNiVQeD495;Rheinmetall Long 10x Factor HVB;Cash;Distribution;DE000UG4V0Z7;;;32,64;;-1,42;EUR`,
+	`2025-10-28;01:00:00;Executed;48231_rrCjP4EcbpefpNiVQeD495;Rheinmetall Long 10x Factor HVB;Security;Corporate action;DE000UG4V0Z7;-223;0,14;-31,22;;;EUR`,
+	`2026-01-20;01:00:00;Executed;429776_rrCjP4EcbpefpNiVQeD495;Taiwan Semiconductor Manufact. ADR;Security;Reinvestment_Distribution;US8740391003;0,076494;388,00;-29,679672;0,00;0,00;EUR`,
+}
+
+func brokerApp(t *testing.T, rows []string) (*App, State, string) {
+	t.Helper()
+	a, s := testApp(t)
+	s, err := a.Mutate(context.Background(), s.Revision, func(d *domain.Dataset) error {
+		return SaveAccount(d, domain.Account{
+			ID: "broker", DisplayName: "Scalable", Institution: "Scalable Capital",
+			Currency: "EUR", Kind: domain.AccountInvestment, Active: true,
+		})
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	statement := brokerHeader + strings.Join(rows, "\n") + "\n"
+	prepared, err := a.PrepareCSVImport(context.Background(), s.Revision, "broker", strings.NewReader(statement))
+	if err != nil {
+		t.Fatal(err)
+	}
+	result, err := a.ConfirmCSVImport(context.Background(), prepared.ID, prepared.Revision)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return a, result.State, prepared.ID
+}
+
+func TestBrokerImportReconcilesCashAndHoldings(t *testing.T) {
+	a, s, _ := brokerApp(t, brokerRows)
+
+	// Seven executed rows; the cancelled retry is all zeros and must not
+	// import as a phantom trade.
+	broker := WealthOf(s.Data).Accounts[1]
+	if broker.Records != 7 {
+		t.Fatalf("imported %d records, want 7", broker.Records)
+	}
+	// 800.00 − 370.30 − 250.68 − 7.59 + 32.64 − 29.6797
+	if broker.Cash != "174.3903" {
+		t.Errorf("cash %s, want 174.3903", broker.Cash)
+	}
+	if broker.FirstBooking != "2025-05-06" || broker.LastBooking != "2026-01-20" {
+		t.Errorf("history spans %s..%s", broker.FirstBooking, broker.LastBooking)
+	}
+	holdings := map[string]domain.Quantity{}
+	for _, h := range broker.Holdings {
+		holdings[h.ISIN] = h.Quantity
+	}
+	// 14 + 203 + 6 − 223, the knock-out closing the position exactly.
+	if holdings["DE000UG4V0Z7"] != "0" {
+		t.Errorf("certificate holds %s, want 0", holdings["DE000UG4V0Z7"])
+	}
+	if holdings["US8740391003"] != "0.076494" {
+		t.Errorf("reinvested fraction holds %s, want 0.076494", holdings["US8740391003"])
+	}
+	for _, check := range broker.Checks {
+		if check.Failed {
+			t.Errorf("check %q failed: %s", check.Name, check.Detail)
+		}
+	}
+	// The distribution's refunded tax is recorded and not applied, because the
+	// broker's cash amount already includes it.
+	note := false
+	for _, check := range broker.Checks {
+		if strings.HasPrefix(check.Name, "Fee and tax") {
+			note = true
+			if !strings.Contains(check.Detail, "-1.42") {
+				t.Errorf("unapplied tax not reported: %s", check.Detail)
+			}
+		}
+	}
+	if !note {
+		t.Error("no note about the tax that was recorded but not applied")
+	}
+
+	// Instruments are registered from the export, and the latest description
+	// names one whose text changed between May and October.
+	names := map[string]string{}
+	for _, v := range s.Data.Instruments {
+		names[v.ISIN] = v.Name
+	}
+	if names["DE000UG4V0Z7"] != "Rheinmetall Long 10x Factor HVB" {
+		t.Errorf("certificate named %q", names["DE000UG4V0Z7"])
+	}
+
+	// The broker history must not reach spending analytics: a closed position
+	// and a reinvested dividend are neither income nor expenditure.
+	dashboard, err := a.Dashboard(context.Background(), analytics.Filter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, total := range dashboard.Totals {
+		if total.Expenses != "0.0000" || total.Income != "0.0000" {
+			t.Errorf("broker rows leaked into spending: %+v", total)
+		}
+	}
+
+	// Re-importing the same export changes nothing, including the two legs
+	// that share one reference.
+	again, err := a.PrepareCSVImport(context.Background(), s.Revision, "broker", strings.NewReader(brokerHeader+strings.Join(brokerRows, "\n")+"\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.New != 0 || again.Duplicates != 7 {
+		t.Fatalf("re-import proposed %d new and %d duplicate records", again.New, again.Duplicates)
+	}
+}
+
+// A partial export sells or closes a position that was never opened in it. The
+// journal accepts the facts, because they are facts, and the report says so.
+func TestPartialBrokerExportReportsNegativeHolding(t *testing.T) {
+	partial := []string{brokerRows[0], brokerRows[5], brokerRows[6]}
+	_, s, _ := brokerApp(t, partial)
+	broker := WealthOf(s.Data).Accounts[1]
+	failed := map[string]string{}
+	for _, check := range broker.Checks {
+		if check.Failed {
+			failed[check.Name] = check.Detail
+		}
+	}
+	detail, found := failed["Holdings never negative"]
+	if !found {
+		t.Fatalf("a position closed without ever being opened passed every check: %+v", broker.Checks)
+	}
+	if !strings.Contains(detail, "DE000UG4V0Z7") || !strings.Contains(detail, "2025-10-28") {
+		t.Errorf("negative holding not located: %s", detail)
+	}
+	if len(failed) != 1 {
+		t.Errorf("unexpected additional failures: %+v", failed)
+	}
+}
+
+// A broker fact never reaches the sign-based fallback. This is the single rule
+// that stops an unmatched deposit from being counted as income and a broker fee
+// from being counted as household spending.
+func TestBrokerFactsNeverClassifyBySign(t *testing.T) {
+	_, s, _ := brokerApp(t, brokerRows)
+	for _, tx := range s.Data.Transactions {
+		if tx.Facts.Investment == nil {
+			continue
+		}
+		if tx.Enrichment.Kind != domain.KindInvestment {
+			t.Fatalf("%s classified as %q", tx.Facts.ID, tx.Enrichment.Kind)
+		}
+		if tx.Enrichment.CategoryID != "" || tx.Enrichment.MerchantID != "" {
+			t.Fatalf("%s acquired a category or merchant: %+v", tx.Facts.ID, tx.Enrichment)
+		}
+	}
+}
+
+// Linking is one commit over both pairs, because reciprocity is validated: a
+// half-applied relink is an invalid dataset.
+func TestManualTransferLinkRewritesBothPairsAtOnce(t *testing.T) {
+	a, s, _ := brokerApp(t, brokerRows)
+	s, err := a.Mutate(context.Background(), s.Revision, func(d *domain.Dataset) error {
+		facts := domain.Facts{
+			Source: "test", AccountID: "n26", BookingDate: "2025-05-06", Amount: "-800.00",
+			Currency: "EUR", RawDescription: "Uberweisung Scalable", Fingerprint: "manual_fixture", ID: "tx_bank_out",
+		}
+		d.Transactions = append(d.Transactions, domain.Transaction{Facts: facts, Enrichment: domain.Fallback(facts)})
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	deposit := ""
+	for _, tx := range s.Data.Transactions {
+		if tx.Facts.Investment != nil && tx.Facts.Investment.Event == domain.EventDeposit {
+			deposit = tx.Facts.ID
+		}
+	}
+	if deposit == "" {
+		t.Fatal("no broker deposit to link")
+	}
+	s, err = a.LinkTransfer(context.Background(), s.Revision, "tx_bank_out", deposit)
+	if err != nil {
+		t.Fatal(err)
+	}
+	linked := map[string]domain.Enrichment{}
+	for _, tx := range s.Data.Transactions {
+		linked[tx.Facts.ID] = tx.Enrichment
+	}
+	if linked["tx_bank_out"].TransferPeerID != deposit || linked[deposit].TransferPeerID != "tx_bank_out" {
+		t.Fatalf("link is not reciprocal: %+v", linked)
+	}
+	if linked["tx_bank_out"].Kind != "transfer" || linked[deposit].Kind != "transfer" {
+		t.Fatalf("linked pair is not a transfer: %+v", linked)
+	}
+
+	// Unlinking returns the broker leg to the investment ledger and the bank
+	// leg to the fallback, both stamped manual so the next import's matcher
+	// leaves the decision alone.
+	s, err = a.LinkTransfer(context.Background(), s.Revision, "tx_bank_out", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tx := range s.Data.Transactions {
+		switch tx.Facts.ID {
+		case "tx_bank_out":
+			if tx.Enrichment.Kind != "expense" || tx.Enrichment.Classification.Source != "manual" {
+				t.Errorf("bank leg after unlink: %+v", tx.Enrichment)
+			}
+		case deposit:
+			if tx.Enrichment.Kind != domain.KindInvestment || tx.Enrichment.Classification.Source != "manual" {
+				t.Errorf("broker leg after unlink: %+v", tx.Enrichment)
+			}
+		}
+	}
+}