# PCH-02-006 — vault_id LAN-linkability privacy note (doc-only)

**Severity:** Informational
**Target file:** `src/shared/sync-identity.ts:62-67` (`computeVaultId` docblock)
**Report:** peach-code-review.md, Finding PCH-02-006

## Decision

Documentation only. The property is inherent to peer discovery (peers must
recognise "same vault" before exchanging entries); the fix is to state the
privacy consequence where the identifier is minted, with the existing
mitigation pointers.

## Exact edit — extend the computeVaultId docblock

```typescript
// BEFORE (sync-identity.ts:62-67)
/**
 * Stable per-vault identifier carried in the mDNS TXT record and the
 * first WebSocket handshake. Receiver rejects the connection if its
 * own vault_id differs — prevents a paired-but-different-vault peer
 * from corrupting the registry.
 */

// AFTER
/**
 * Stable per-vault identifier carried in the mDNS TXT record and the
 * first WebSocket handshake. Receiver rejects the connection if its
 * own vault_id differs — prevents a paired-but-different-vault peer
 * from corrupting the registry.
 *
 * PRIVACY NOTE (PCH-02-006): vault_id is stable across sessions and is
 * broadcast over mDNS during LAN sync discovery. A passive observer on the
 * same network can therefore (a) link every device sharing this vault as
 * belonging to one user, and (b) observe when sync activity occurs. This is
 * inherent to the discovery design and is one-way — the master key is not
 * recoverable from the BLAKE3 output. It never leaves the local network.
 * Users who need LAN unlinkability should leave sync disabled; "rotate sync
 * identity" (vault.ts rotateSyncIdentity) re-keys the root key and with it
 * this identifier.
 */
```

No tests — comment-only change.

## Save message (integration)

`docs: PCH-02-006 document vault_id LAN-linkability privacy note at computeVaultId`