Track investments as broker facts with a position leg

An account now has a kind, and an investment account holds positions as well as
cash. A broker row is not a new entity: it is a bank fact with an optional
position leg, so deduplication, the journal, fact immutability, the DuckDB
projection and the transactions view carry it unchanged. Facts.Amount stays the
cash leg and is zero on the rows that move only a position.

Scalable Capital exports are recognized locally as a fourth format, read by
their own parser because a column mapping cannot describe them: the amount
column is settled cash on a cash row, a gross to be netted on a trade, and a
position valuation that must never touch cash on a corporate action or a depot
transfer. A cash amount is already net of the tax the broker withheld or
refunded, so that tax is recorded on the fact and never subtracted a second
time; treating a corporate action's valuation as money conjures cash, and a
depot switch would do it once per instrument. The share column is signed only
for those two types, so buys and sells take their direction from the type. Every
security row is checked against shares times price at 128-bit width, because a
lost decimal separator survives every other check. An unknown status, type or
assetType, a foreign currency, a missing ISIN, or one failed check rejects the
whole file with the record number.

Instruments live in instruments.finance, keyed by ISIN with an ID derived from
it, so re-importing never registers a security twice. One ISIN appears under
several broker descriptions over the years and sometimes under the ISIN itself:
the most recent real description names it, and an import never renames one that
already exists. A broker also reuses a single reference across every leg of one
event, so transaction identity includes the event and its instrument.

domain.Fallback returns kind "investment" for any fact carrying a position leg,
so no broker row reaches the sign-based branch. That single rule is what stops
an unmatched deposit from counting as income and a broker fee from counting as
household spending; the monthly PRIME fee and its matching credit now cancel in
clearing:investments with no configuration at all. Investment rows are excluded
from spending analytics, from bulk reclassification and from the model, exactly
as transfers are.

Equal competing transfers are paired instead of skipped. Every connected
component of the candidate graph is a complete bipartite graph between two fixed
accounts at one amount and currency, so every pairing produces the same
accounts, kinds and postings and only the displayed counterpart differs.
Refusing to choose was the expensive option: both legs fell through to the
sign-based fallback and appeared as spending and income that never happened.
Pairing follows the nearest booking date, then the transaction ID, so iteration
order decides nothing. POST /api/transactions/{id}/transfer rewrites the old and
the new pair in one commit, because reciprocity is validated and a half-applied
link is an invalid dataset, and the matcher now skips any record classified
manually so a hand-made link or unlink outlives the next import.

Wealth reports each account's cash and positions from the journal rather than
the index, with named checks - row arithmetic, cash never negative, holdings
never negative - because it exists to be compared against the figures a broker
shows on its own screen. A negative holding means the imported history is
partial. Share counts are exact to eight places; a reinvested distribution
quoted to six is rounded to money's four and the residue is reported rather than
hidden. Market prices, market value, net worth over time, FIFO lot accounting,
realised gains and currency conversion are deliberately absent.

internal/banking/import.go

@@ -25,13 +25,31 @@ func identity(f domain.Facts) string {
 	if strings.HasPrefix(string(f.Amount), "-") {
 		direction = "debit"
 	}
-	return digest(f.AccountID, f.Source, f.ExternalID, direction)
+	return digest(f.AccountID, f.Source, f.ExternalID, direction, leg(f))
+}
+
+// leg distinguishes the records of one broker event. A broker reuses a single
+// reference across every leg: the cash side of a corporate action and its
+// position side arrive with the same reference byte for byte, and a position
+// leg's zero amount does not even differ in direction. The event and its
+// instrument separate them without making money part of an identity, so a
+// corrected upstream figure is still reported rather than imported twice.
+func leg(f domain.Facts) string {
+	if f.Investment == nil {
+		return ""
+	}
+	return f.Investment.Event + "\x00" + f.Investment.InstrumentID
 }
 func fingerprint(f domain.Facts) string {
-	return digest(f.AccountID, f.BookingDate, f.ValueDate, f.Amount.String(), f.Currency, strings.Join(strings.Fields(f.RawDescription), " "), strings.ToLower(strings.Join(strings.Fields(f.Counterparty), " ")), f.CounterpartyIBAN)
+	inv := domain.Investment{}
+	if f.Investment != nil {
+		inv = *f.Investment
+	}
+	return digest(f.AccountID, f.BookingDate, f.ValueDate, f.Amount.String(), f.Currency, strings.Join(strings.Fields(f.RawDescription), " "), strings.ToLower(strings.Join(strings.Fields(f.Counterparty), " ")), f.CounterpartyIBAN,
+		inv.Event, inv.InstrumentID, string(inv.Quantity), string(inv.Price), string(inv.Gross), string(inv.Fee), string(inv.Tax))
 }
 func looseFingerprint(f domain.Facts) string {
-	return digest(f.AccountID, f.BookingDate, f.Amount.String(), f.Currency)
+	return digest(f.AccountID, f.BookingDate, f.Amount.String(), f.Currency, leg(f))
 }
 func sameBookedMoney(a, b domain.Facts) bool {
 	return a.AccountID == b.AccountID && a.BookingDate == b.BookingDate && a.Amount == b.Amount && a.Currency == b.Currency
@@ -46,6 +64,8 @@ func sourceLabel(source string) string {
 		return "ING CSV"
 	case "kontist_csv":
 		return "Kontist CSV"
+	case SourceScalable:
+		return "Scalable CSV"
 	case "csv":
 		return "mapped CSV"
 	default:
@@ -310,10 +330,21 @@ func normalizeFacts(f domain.Facts, accounts map[string]bool) (domain.Facts, err
 	return f, nil
 }
 
-// MatchTransfers links only mutually unique candidates, with reciprocal own
-// IBANs, inverse exact money in one currency, and booking dates within 3 calendar
-// days. Existing manual links are retained. Ambiguous equal payments stay ordinary
-// transactions: iteration order must never decide which transfer gets linked.
+// MatchTransfers links own-account pairs with reciprocal own IBANs, inverse
+// exact money in one currency, and booking dates within 3 calendar days.
+//
+// Equal competing payments are paired by nearest booking date rather than left
+// alone. Every connected component of the candidate graph is a complete
+// bipartite graph between two fixed accounts at one amount and one currency:
+// an edge needs exactly inverse money, and a record's own counterparty IBAN
+// names exactly one other account. So every perfect matching produces the same
+// accounts, amounts, kinds and postings, and the only thing a choice decides is
+// which row displays as which one's counterpart. Refusing to choose is the
+// expensive option: both legs then fall through to the sign-based fallback and
+// show up as spending and income that never happened.
+//
+// Ordering is by date gap, then by transaction ID, so iteration order cannot
+// decide anything. Existing links and hand-made decisions are never revisited.
 func MatchTransfers(data *domain.Dataset) {
 	if data == nil {
 		return
@@ -336,10 +367,28 @@ func MatchTransfers(data *domain.Dataset) {
 			byAccount[id] = iban
 		}
 	}
-	candidates := make([][]int, len(data.Transactions))
+	matchable := func(t domain.Transaction) bool {
+		if t.Enrichment.Kind == "transfer" || t.Enrichment.TransferPeerID != "" {
+			return false
+		}
+		// A hand-made decision outlives the next import. Without this, an
+		// operator who unlinks a pair that is not really a transfer watches the
+		// matcher relink it on the following import, forever.
+		if t.Enrichment.Classification.Source == "manual" {
+			return false
+		}
+		// Only a broker cash movement can be a transfer leg; a trade's cash
+		// side settles against a position, not against another account.
+		return t.Facts.Investment == nil || t.Facts.Investment.CashOnly()
+	}
+	type candidate struct {
+		i, j int
+		gap  time.Duration
+	}
+	candidates := []candidate{}
 	for i := range data.Transactions {
 		a := data.Transactions[i]
-		if a.Enrichment.Kind == "transfer" || a.Enrichment.TransferPeerID != "" {
+		if !matchable(a) {
 			continue
 		}
 		ai := byAccount[a.Facts.AccountID]
@@ -357,7 +406,7 @@ func MatchTransfers(data *domain.Dataset) {
 		}
 		for j := i + 1; j < len(data.Transactions); j++ {
 			b := data.Transactions[j]
-			if b.Enrichment.Kind == "transfer" || b.Enrichment.TransferPeerID != "" || b.Facts.AccountID != own[target] || normalizeIBAN(b.Facts.CounterpartyIBAN) != ai || a.Facts.Currency != b.Facts.Currency {
+			if !matchable(b) || b.Facts.AccountID != own[target] || normalizeIBAN(b.Facts.CounterpartyIBAN) != ai || a.Facts.Currency != b.Facts.Currency {
 				continue
 			}
 			bm, err := b.Facts.Amount.Minor()
@@ -368,29 +417,39 @@ func MatchTransfers(data *domain.Dataset) {
 			if err != nil {
 				continue
 			}
-			delta := ad.Sub(bd)
-			if delta < -72*time.Hour || delta > 72*time.Hour {
+			gap := ad.Sub(bd)
+			if gap < 0 {
+				gap = -gap
+			}
+			if gap > 72*time.Hour {
 				continue
 			}
-			candidates[i] = append(candidates[i], j)
-			candidates[j] = append(candidates[j], i)
+			candidates = append(candidates, candidate{i: i, j: j, gap: gap})
 		}
 	}
-	for i, matches := range candidates {
-		if len(matches) != 1 {
+	sort.Slice(candidates, func(x, y int) bool {
+		if candidates[x].gap != candidates[y].gap {
+			return candidates[x].gap < candidates[y].gap
+		}
+		left, right := data.Transactions[candidates[x].i].Facts.ID, data.Transactions[candidates[y].i].Facts.ID
+		if left != right {
+			return left < right
+		}
+		return data.Transactions[candidates[x].j].Facts.ID < data.Transactions[candidates[y].j].Facts.ID
+	})
+	linked := make([]bool, len(data.Transactions))
+	for _, c := range candidates {
+		if linked[c.i] || linked[c.j] {
 			continue
 		}
-		j := matches[0]
-		if j <= i || len(candidates[j]) != 1 {
-			continue
-		}
-		for _, pair := range [][2]int{{i, j}, {j, i}} {
-			t := &data.Transactions[pair[0]]
+		linked[c.i], linked[c.j] = true, true
+		for _, ends := range [][2]int{{c.i, c.j}, {c.j, c.i}} {
+			t := &data.Transactions[ends[0]]
 			tags := t.Enrichment.TagIDs
 			if tags == nil {
 				tags = []string{}
 			}
-			t.Enrichment = domain.Enrichment{Kind: "transfer", TagIDs: tags, TransferPeerID: data.Transactions[pair[1]].Facts.ID, Classification: domain.Provenance{Source: "transfer_match"}}
+			t.Enrichment = domain.Enrichment{Kind: "transfer", TagIDs: tags, TransferPeerID: data.Transactions[ends[1]].Facts.ID, Classification: domain.Provenance{Source: "transfer_match"}}
 		}
 	}
 }