privacy: Altimate Base consent dialog no longer discloses persistent per-installation identifier

Read packages/core/src/altimate-base-disclosure.ts and the consuming consent flow in packages/tui/src/component/altimate-onboarding.tsx, then review the #1268 change that removed the identifier wording. Done means the consent dialog again makes the persistent per-installation identifier fact visible, either directly or through a pointer to the relevant documentation.

Summary

#1268 removed the sentence "Logs are linked to a persistent per-installation identifier" from ALTIMATE_BASE_DISCLOSURE (packages/core/src/altimate-base-disclosure.ts) — the literal text a user reads before accepting Altimate Base in the TUI onboarding dialog (packages/tui/src/component/altimate-onboarding.tsx). The fact itself was moved to a docs page (docs/docs/configure/providers.md, security-faq.md) that the consent dialog never surfaces or links to.

The persistent-identifier fact is exactly the kind of thing informed-consent expectations (e.g. GDPR Art. 4(11), CCPA notice-at-collection) expect to be disclosed at the point of collection — not reachable only via documentation the user has no reason to open before clicking "Yes".

The removed code comment (visible in the #1268 diff) originally argued the opposite: that this text "must disclose that requests are linkable across launches — not defer that to docs... which a user never sees before accepting." #1268 reversed that call for brevity/softer tone with no new counter-argument.

Where this was flagged

Independently raised by 3 of 5 personas in the v0.11.0 stable release review, from different angles:

• Product Manager: flagged as a real informed-consent regression, proposed restoring the sentence.
• End User: same finding, P2 — notes the docs still fully disclose it, only the live dialog doesn't.
• Chaos Gremlin (privacy/compliance): same finding, P1 — ties it to the broader consent-bypass gap in #1266 (see linked issue).

Proposed fix

Restore a short pointer/clause to packages/core/src/altimate-base-disclosure.ts — e.g. append "Logs are linked to a persistent per-installation identifier." back onto the existing disclosure text, or at minimum add "See for details on data retention and identifiers." so the fact is reachable from the consent screen itself.

Provenance

Found during the v0.11.0 stable release's multi-persona review. Deliberately shipped as-is in v0.11.0 (explicit, user-reviewed risk acceptance, not an oversight) — recorded here so the fix isn't lost.