Validate analytics installation IDs before using them as PostHog identities

[Exohayvan]

Summary

LocalInstanceId accepts any nonblank existing file content and sends it as the persistent PostHog distinct_id without UUID-format or length validation.

Evidence

• common Minecraft LocalInstanceId.java returns arbitrary nonblank analytics-instance-id.txt content unchanged.
• Every loader forwards that value to PostHog as distinct_id.
• The telemetry notice describes the identifier as randomly generated, but edited/corrupted content can contain email addresses, personal text, control characters, or oversized values.

Impact

Accidental or user-supplied personal information can become a persistent analytics identity, weakening the documented pseudonymous-ID guarantee and potentially creating malformed telemetry.

Reproduction / verification

• Test blank, invalid UUID, email-like, whitespace-padded, control-character, and oversized existing files.
• Verify invalid values are replaced locally with a valid generated identifier before analytics initialization.

Proposed direction

Require a canonical bounded UUID (or explicitly documented identifier format), trim safely, regenerate invalid values atomically, and avoid logging the rejected raw value.

Acceptance criteria

• Only valid canonical installation IDs can reach PostHog.
• Invalid existing files are repaired without transmitting their content.
• The Stardew and Minecraft implementations follow the same policy.
• Tests cover malformed and privacy-sensitive values.

Audit provenance

Candidate #26 from the read-only repository audit performed on 2026-07-20. This is separate from existing issues #3, #4, #25, and #27 unless explicitly linked later.