PCH-02-006-vault-id-privacy-note.patch.md

1# PCH-02-006 — vault_id LAN-linkability privacy note (doc-only)23**Severity:** Informational4**Target file:** `src/shared/sync-identity.ts:62-67` (`computeVaultId` docblock)5**Report:** peach-code-review.md, Finding PCH-02-00667## Decision89Documentation only. The property is inherent to peer discovery (peers must10recognise "same vault" before exchanging entries); the fix is to state the11privacy consequence where the identifier is minted, with the existing12mitigation pointers.1314## Exact edit — extend the computeVaultId docblock1516```typescript17// BEFORE (sync-identity.ts:62-67)18/**19 * Stable per-vault identifier carried in the mDNS TXT record and the20 * first WebSocket handshake. Receiver rejects the connection if its21 * own vault_id differs — prevents a paired-but-different-vault peer22 * from corrupting the registry.23 */2425// AFTER26/**27 * Stable per-vault identifier carried in the mDNS TXT record and the28 * first WebSocket handshake. Receiver rejects the connection if its29 * own vault_id differs — prevents a paired-but-different-vault peer30 * from corrupting the registry.31 *32 * PRIVACY NOTE (PCH-02-006): vault_id is stable across sessions and is33 * broadcast over mDNS during LAN sync discovery. A passive observer on the34 * same network can therefore (a) link every device sharing this vault as35 * belonging to one user, and (b) observe when sync activity occurs. This is36 * inherent to the discovery design and is one-way — the master key is not37 * recoverable from the BLAKE3 output. It never leaves the local network.38 * Users who need LAN unlinkability should leave sync disabled; "rotate sync39 * identity" (vault.ts rotateSyncIdentity) re-keys the root key and with it40 * this identifier.41 */42```4344No tests — comment-only change.4546## Save message (integration)4748`docs: PCH-02-006 document vault_id LAN-linkability privacy note at computeVaultId`