1# PCH-02-FIXES — Integration Contract23Source of truth for integrating these drafts. Where a patch file and this4contract disagree, this contract wins.56## Integration Contract78### Files in `src/drafts/PCH-02-FIXES/`910| Draft file | Destination / role |11|---|---|12| `README.md` | index — stays in drafts (or trash after integration) |13| `INTEGRATION-CONTRACT.md` | this file — keep as reference (cited by tests) |14| `PCH-02-001-vault-patch-sanitizers.patch.md` | edits → `src/background/vault.ts:2375-2388` |15| `vault.update-entry-sanitize.test.ts` | → `src/background/vault.update-entry-sanitize.test.ts` |16| `PCH-02-003-sas-trust-model-comment.patch.md` | edits → `src/shared/chirp-handshake.ts:125-154` |17| `PCH-02-004-exact-pin-deps.patch.md` | edits → `package.json:40-46`; then `bun install` |18| `WASM-PROVENANCE.md` | → repo root `WASM-PROVENANCE.md` (new file) |19| `PCH-02-005-legacy-pbkdf2-doc.patch.md` | edits → `src/shared/backup.ts:146` + `src/popup/views/Import.tsx` (3 hunks) |20| `PCH-02-007-hibp-add-padding.patch.md` | edits → `src/background/vault.ts:230` |21| `vault.hibp-padding.test.ts` | → `src/background/vault.hibp-padding.test.ts` |22| `PCH-02-008-binaryreader-bounds.patch.md` | edits → `src/crypto/peachPayload.ts:940-969` (+ `export` seam) |23| `peachPayload.binaryreader-bounds.test.ts` | → `src/crypto/peachPayload.binaryreader-bounds.test.ts` |24| `PCH-02-010-clipboard-hash-match.patch.md` | **Option A (recommended):** comment → `src/background/clipboard.ts:18-19`. **Option B:** `clipboard.ts` + `offscreen.ts` + `manifest.json` |25| `clipboard.hash-match.test.ts` | → `src/background/clipboard.hash-match.test.ts` — **Option B ONLY; do not integrate under Option A** |2627### Decisions required from the integrator (2)28291. **PCH-02-010 Option A vs B.** Option B requires adding `clipboardRead` to30 `manifest.json` — a store-visible permission expansion ("Read data you31 copy and paste"). Recommendation: Option A now, Option B parked.322. **PCH-02-004 papaparse hunk.** The brief pins 5 packages; the report also33 cites `papaparse`. The patch includes it as an optional sixth line.3435### PCH-02-004 exact versions (read from bun.lock 2026-06-12 — pin, don't upgrade)3637| Package | Pin |38|---|---|39| otpauth | 9.5.0 |40| pako | 2.1.0 |41| @zxing/library | 0.23.0 |42| bwip-js | 4.11.1 *(lockfile had drifted above the declared ^4.10.1)* |43| pdf-lib | 1.17.1 |44| papaparse | 5.5.3 *(optional hunk)* |4546After the edit run `bun install` (regenerates `bun.lock`; resolved tree is47unchanged because every pin equals the installed version).4849### Estimated test count per finding5051| Finding | New tests |52|---|---|53| PCH-02-001 | 8 |54| PCH-02-003 | 0 — doc only (gateOnSAS already pinned by PCH-01-024 test) |55| PCH-02-004 | 0 — dependency metadata only |56| PCH-02-005 | 0 required (1 optional UI contract case sketched in the patch) |57| PCH-02-007 | 3 |58| PCH-02-008 | 8 |59| PCH-02-009 | 5 |60| PCH-02-010 | Option A: 0 — doc only / Option B: 4 |61| **Total** | **24 (Option A) / 28 (Option B)** |6263### Documentation-only findings (no tests needed)6465PCH-02-003, PCH-02-005 (comment + notice), and PCH-02-010 under66Option A.6768### Suggested integration order (one koh save each, tests green at every step)69701. PCH-02-001 (the Low) + its tests712. PCH-02-007 and PCH-02-008 + tests (independent hardening)723. PCH-02-003 and PCH-02-005 (comments/UI)734. PCH-02-004 (package.json + `bun install` + WASM-PROVENANCE.md)745. PCH-02-010 (whichever option is chosen)756. Version bump + build all three targets (`npm run build`)7677### Gates after every save7879- `npx tsc --noEmit` clean (baseline: clean)80- `npx vitest run` — baseline 117 files / 3474 passed; after full81 integration expect **+4 test files / +24 tests** (Option A) or **+5 / +28**82 (Option B)83- No `@ts-ignore` / type suppressions introduced (none in any draft)8485### Version bump recommendation8687v4.0.0 → **v4.0.1** (patch: hardening + docs, no feature surface) across88`package.json`, `manifest.json`, `manifest.firefox.json`, then89`npm run build` (all three targets, per project rule). If PCH-02-01090Option B is chosen, bump v4.0.0 → **v4.1.0** instead — a new permission is91not a patch-level change.9293### Out-of-scope observations recorded during drafting9495- `vault.updateEntryDirect` (vault.ts:1978) spreads patches verbatim but has96 zero production callers — dead-code candidate, noted in the 001 patch.97- The fix brief's PCH-02-005 text says "100,000 iterations"; the code and98 report say 250,000 — drafts use 250,000.99- The brief's PCH-02-004 step references an existing `WASM-PROVENANCE.md`;100 no such file exists in the repo, so the draft ships one.