arcodange-bank-reco V7: avoir netting + fk_account context + wire-ref matching

Three improvements that reduce the V6.1 exit-1 signal from 10 to 1 on
the current Arcodange baseline. Every bucket now has a single, clear
purpose; the only entry counted as a failure is a genuine action item.

A. fk_account context on dolibarr-only
   - Fetches /bankaccounts and tags each dolibarr-only with the account
     ref + label (e.g. "CCA1 (G.RADUREAU Compte Courant Asso)").
   - Splits dolibarr-only into "on API-tracked accounts" (QON*/WIS* — real
     gaps) vs "not in API scope" (CCA1 / personal — expected gaps).
   - Personal-account entries no longer count toward the failure verdict.

B. Avoir-cycle netting
   - Pairs AVC entries of -X on socid S with FAC entries of +X on the
     same socid within ±5d.
   - Both surface in a dedicated AVOIR-NETTED bucket and are excluded from
     dolibarr-only, since the bank only sees the net of the cycle.
   - Resolves the V6.1 noise where AVC001-CL0001001 + FAC001-CL00001
     appeared as fake gaps for a 510€ cancel-and-reissue dance.

C. Wire-reference strong matching (--enrich flag, opt-in)
   - When --enrich is passed, bank-match.sh fetches /v1/transfers/{id}
     per Wise TRANSFER and reads the wire `reference` field.
   - References containing a FAC\d+(CL\d+)? pattern strong-match against
     the corresponding Dolibarr customer invoice (annotated [wire-ref]
     vs the loose [amt+date] kind).
   - Verified on FAC002 5100€: KM's wire memo "FOR INVOICE FAC002CL0001002"
     gives an unambiguous match independent of date drift.

Baseline (Jan-May 2026, --enrich on):
  6 matched · 1 internal · 2 avoir-netted · 7 bank-known · 1 bank-UNKNOWN
  0 dol-only-API · 7 dol-only-personal
  → exit-1 count = 1 (just the +2147€ KM Wise 2026-05-29 to record).

The CLI (bin/arcodange) gains --enrich on the match subcommand. The
SKILL.md has a new "V7 bucket structure" section explaining the seven
buckets and a before/after table showing the signal/noise improvement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/arcodange-bank-reco/SKILL.md

@@ -169,6 +169,45 @@ Without a catalog, both look identical in the BANK-ONLY bucket — noise drowns
 
 After applying the catalog to the V6 baseline, the **only remaining BANK-UNKNOWN** is the **+2147 € KissMetrics payment on 2026-05-29** that hasn't been entered in Dolibarr — the actual signal.
 
+## V7 bucket structure
+
+V7 adds three improvements that reshape the output buckets:
+
+| Bucket | Meaning | Counts toward exit-1? |
+|---|---|---|
+| **MATCHED** | Bank ↔ Dolibarr paired. Annotated with match kind: `[wire-ref]` (strong, via `--enrich`) or `[amt+date]` (loose). | No |
+| **INTERNAL** | Wise↔Qonto consolidations (5000€ moved between Arcodange's own accounts). | No |
+| **AVOIR-NETTED** | Dolibarr AVC + FAC cancellation cycles paired and excluded (the bank only saw the net). | No |
+| **BANK-ONLY — known patterns** | Bank movement with a `known-patterns.json` annotation. Intentional gap. | No |
+| **BANK-ONLY — unknown** | Bank movement with no Dolibarr counterpart AND no catalog pattern. **Real action item**. | Yes |
+| **DOLIBARR-ONLY — on API-tracked accounts** (QON*/WIS*) | Dolibarr payment that the bank should have shown. **Real gap**. | Yes |
+| **DOLIBARR-ONLY — not in API scope** (CCA1 perso etc.) | Expected gap — we have no API on those accounts. | No |
+
+Exit code 0 iff the two "real gap" buckets are empty.
+
+### `--enrich` — wire-reference strong matching
+
+`bank-match.sh --enrich` fetches `/v1/transfers/{id}` for each Wise TRANSFER and reads the `reference` field (the wire memo from the sender, e.g. `FROM KISSMETRICS HOLDINGS INC FOR INVOICE FAC002CL0001002/ VENDOR:DEV`). When the reference contains a `FAC\d+(CL\d+)?` pattern matching a Dolibarr customer invoice, that pairing takes precedence over the loose date+amount match. Only the strong-matched ones get `[wire-ref]`; the rest fall through to `[amt+date]`. Cost: 1 extra HTTP call per Wise transfer.
+
+### Avoir cycle netting
+
+When Arcodange cancels and reissues an invoice (FAC001 → AVC001 + FAC001-NEW), the bank sees one net credit but Dolibarr stores 3 payment entries. V7 pairs AVC entries of -X with FAC entries of +X for the same socid within ±5d, surfaces them in **AVOIR-NETTED**, and excludes them from `dolibarr-only`. Removes the V6.1 noise where AVC001 + FAC001-CL00001 appeared as fake gaps.
+
+### fk_account context
+
+`bank-match.sh` now fetches `/bankaccounts` and tags `dolibarr-only` entries with their account ref + label. Splits into API-tracked (QON*/WIS* — real gaps) vs not-in-scope (everything else — expected). The 7 CCA1 personal-account entries that used to look like failures are now correctly classified as expected gaps.
+
+### Effect on the baseline
+
+| | V6 | V6.1 | V7 |
+|---|---|---|---|
+| MATCHED | 6 (all amt+date) | 6 | 6 (1 wire-ref strong + 5 amt+date when --enrich) |
+| BANK-ONLY total | 8 mixed | 7 known + 1 UNKNOWN | 7 known + 1 UNKNOWN |
+| AVOIR-NETTED | — | — | 2 (silently absorbed) |
+| DOL-only TRUE GAP | 9 (noisy) | 9 (noisy) | **0** |
+| DOL-only EXPECTED | — | — | 7 (CCA1 personal) |
+| Exit-1 signal count | 17 (noise) | 10 (less noise) | **1** (just the +2147€ KM) |
+
 ## Matching heuristic — what's in v1 and what's V7
 
 Today's match logic: