Project creatortrack finance single store bug

RESOLVED, LIVE 2026-07-08 (merged 9b25975). Per-workspace scoping shipped via the app.finance_ws Postgres GUC; see reference_creatortrack_finance_module.md for the current canonical state. This file is kept as the bug/root-cause record; the plan-in-flight language below is historical, not current status.

CreatorTrack's Finances module is architecturally a single store per user, not per-active-workspace, despite fin-connect work making it per-workspace accessible. All of Justin's 345 merchant logos (and all other finance rows: accounts, transactions, budgets, balances) live in one workspace (his lowest-membership id, ws67 Personal), because resolveFinanceWorkspace always resolves there and every read in lib/finance.ts is pure-RLS with no workspace_id filter (asUser in lib/rls.ts only stamps app.user_id, never a current-workspace). RLS admits rows from any workspace the user is a member of, so ws67 data bleeds into every workspace Justin belongs to (Gus Outdoor, Gus The Bass, etc). This surfaced as a merchant-icon bleed bug but is systemic across the whole finance read layer.

Justin chose (2026-07-08) to fix this by making Finances genuinely per-workspace: thread the active-workspace cookie (lib/active-workspace.ts) into every finance read and write (accounts, transactions, budgets, balances, categories, recurring, cashflow, merchant icons), keep RLS as the cross-tenant backstop, and fall back to resolveFinanceWorkspace (home workspace) if no active-workspace cookie is set. No data migration: ws67 keeps existing data as Personal, other workspaces start empty. Plan going through /feature-plan hard-gate before implementation, built in a CT dev-slot worktree, merged once via integrator per standard CT workflow.

Why: existing memory only documents the finance module as "canonical, finance.* PG=truth" and fin-connect as done; it does not capture that reads are unscoped or that this redesign is in flight. How to apply: before touching lib/finance.ts or any finance read/write path, check the plan file at memory/plans/ for this dated 2026-07-08 for current implementation status; do not assume icon-only or single-file fix is sufficient.

[auto-memory session a605ae94-0b86-4450-a7bf-e492e7f1041e, confidence 0.85, mode direct]