Leakage profile

Observer	Per transaction
Public / pool	`N`, a fixed-shape statement per fragment, the listed FI indices, the actors' party ids (needed for revocation), time bucket, fee, envelope sizes, the public effect if any, salted state roots. Not: program, method, template, instance, amounts, assets, which slots are dummies, or how fragments' flows pair.
Coordinator	The statements and proofs before submission. Nothing more than the pool.
Counterparty in another fragment	Its own view plus the agreed flow preimages. Nothing about the other fragment's records.
Stakeholder of a record	The record's opening; the fact of its consumption, when it happens.
FI of an actor	The customer's whole fragment plaintext, including both assets of a swap the customer is party to. Not the counterparty's fragment.

Listing actor party ids publicly is a divergence from full anonymity, taken so revocation is immediate. §12 asks whether to move it into K under a party-root window.