# PCH-02 Fix Drafts

Drafts for all 10 findings of `peach-code-review.md` (Fable 5, 2026-06-12):
1 Low (PCH-02-001), 9 Informational. Drafted against v4.0.0, dev lane,
baseline 117 test files / 3474 tests green, `tsc --noEmit` clean.

**Nothing outside `src/drafts/PCH-02-FIXES/` was modified.** Both gates
exclude this folder (`tsconfig.json` excludes `src/drafts`; `vitest.config.ts`
excludes `src/drafts/**`), so the drafts are inert until integrated.

Every `*.patch.md` carries exact before/after code anchored to the cited
file:line, the rationale, compatibility verification, and its integration
save message. Every `*.test.ts` is written with destination-form imports and
a `DESTINATION:` header — copy to the stated path, no rewrite needed.

| Finding | Severity | Draft | Kind |
|---|---|---|---|
| PCH-02-001 update-entry sanitizers | Low | `PCH-02-001-vault-patch-sanitizers.patch.md` + `vault.update-entry-sanitize.test.ts` | code + 8 tests |
| PCH-02-002 Noise XX msg1 hash | Info | `PCH-02-002-noise-xx-msg1-hash.patch.md` | **deferred wire change** (doc part landable now) |
| PCH-02-003 SAS trust model | Info | `PCH-02-003-sas-trust-model-comment.patch.md` | doc only |
| PCH-02-004 exact-pin deps | Info | `PCH-02-004-exact-pin-deps.patch.md` + `WASM-PROVENANCE.md` | manifest of pins + new doc |
| PCH-02-005 legacy PBKDF2 | Info | `PCH-02-005-legacy-pbkdf2-doc.patch.md` | doc + small UI notice |
| PCH-02-006 vault_id privacy | Info | `PCH-02-006-vault-id-privacy-note.patch.md` | doc only |
| PCH-02-007 HIBP padding | Info | `PCH-02-007-hibp-add-padding.patch.md` + `vault.hibp-padding.test.ts` | code + 3 tests |
| PCH-02-008 BinaryReader bounds | Info | `PCH-02-008-binaryreader-bounds.patch.md` + `peachPayload.binaryreader-bounds.test.ts` | code + 8 tests |
| PCH-02-009 reject-zero DH | Info | `PCH-02-009-reject-zero-dh.patch.md` + `noise.reject-zero-dh.test.ts` | code + 5 tests |
| PCH-02-010 clipboard hash match | Info | `PCH-02-010-clipboard-hash-match.patch.md` + `clipboard.hash-match.test.ts` | **decision: Option A (doc) recommended / Option B (code + 4 tests + ⚠ permission)** |

Integration sequencing, decisions, and the full contract:
`INTEGRATION-CONTRACT.md`.