[flaxvin]

Second top-down pass on current main

The layers below were checked in order, from build down to the money engine. Only the last one found anything.

Layer	Check	Result
Build	npm run typecheck, then the full suite	clean, 2073/2073
Runtime	production build started in demo mode; every reachable page crawled as each of the three members (15,000 fetches). Each response was checked for the names of another member's private accounts, envelopes and groups	no 5xx, no error logs, no leaks. The string hits were UI copy or a household envelope with a similar name
Write side	every POST handler that reads an id from the form body	all 48 pass through a visibility guard. The other 9 are guarded by other means or are the intended demo/dev sign-in
Money	the 36-month household simulation, run on 41 seeds (39 of them new). Checks: the identity closes in every month of every budget, the rollup cache matches a cold compute, transfers cancel, no bank account goes below zero	all 41 clean
Static SQL	raw queries in route handlers that read member-scoped tables without a visibility predicate	3 found, fixed here

What this fixes

Three places read the whole household to pick something for the reader. None of them showed another member's private data, because each result was filtered before display. But each one made its choice from that data, so the reader got a worse answer than their own history would have given.

• Review's "File as" suggestion counted every member's filings. Take a payee that Ravi files privately more often than Priya files it anywhere. The suggestion came out as Ravi's envelope, which the page correctly refuses to name, so Priya got no suggestion at all. It now uses the reader's own history, which is what payeeStats already does on /add.
• /add started on the household's last-used account. When that account was another member's private one, it was not in the reader's list, so nothing was preselected.
• /health showed the household's total transaction count, which changed whenever someone spent privately.

Each of these now filters with hiddenTransactionSql.

Tests

src/web/viewer-defaults.test.ts adds 3 tests, one per case. All three fail on main and pass with this change. Full suite is 2076/2076, and typecheck is clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_016zXWwzys3K4XksLh3rrcKu

---

Generated by Claude Code

[flaxvin]

The github-advanced-security check (run 36302374854) failed on GitHub's side. The cause is the same as on #1, and it has nothing to do with this PR.

GitHub's hosted AI scanner failed while opening its model session (CAPIError: 400 The requested model is not supported). That happened before it read any file, so no findings were produced. Nothing in this repository sets that model, so this PR can't fix it. On #1 the API refused to re-run a run of this kind (403 This workflow run cannot be retried). It will either run again on the next push or can be started from the repo's code-scanning settings.

CodeQL and local checks cover this head: npm run typecheck is clean and npm test passes 2076/2076.

---

Generated by Claude Code