PCH-02-006 — vault_id LAN-linkability privacy note (doc-only)

Severity: Informational Target file: src/shared/sync-identity.ts:62-67 (computeVaultId docblock) Report: peach-code-review.md, Finding PCH-02-006

Decision

Documentation only. The property is inherent to peer discovery (peers must recognise "same vault" before exchanging entries); the fix is to state the privacy consequence where the identifier is minted, with the existing mitigation pointers.

Exact edit — extend the computeVaultId docblock

// BEFORE (sync-identity.ts:62-67)
/**
 * Stable per-vault identifier carried in the mDNS TXT record and the
 * first WebSocket handshake. Receiver rejects the connection if its
 * own vault_id differs — prevents a paired-but-different-vault peer
 * from corrupting the registry.
 */

// AFTER
/**
 * Stable per-vault identifier carried in the mDNS TXT record and the
 * first WebSocket handshake. Receiver rejects the connection if its
 * own vault_id differs — prevents a paired-but-different-vault peer
 * from corrupting the registry.
 *
 * PRIVACY NOTE (PCH-02-006): vault_id is stable across sessions and is
 * broadcast over mDNS during LAN sync discovery. A passive observer on the
 * same network can therefore (a) link every device sharing this vault as
 * belonging to one user, and (b) observe when sync activity occurs. This is
 * inherent to the discovery design and is one-way — the master key is not
 * recoverable from the BLAKE3 output. It never leaves the local network.
 * Users who need LAN unlinkability should leave sync disabled; "rotate sync
 * identity" (vault.ts rotateSyncIdentity) re-keys the root key and with it
 * this identifier.
 */

No tests — comment-only change.

Save message (integration)

docs: PCH-02-006 document vault_id LAN-linkability privacy note at computeVaultId