perf(client): bundle KDF to 128 MB, and derive it once per sign-in

Argon2id memory 64 → 128 MB. Memory is the lever, not time: it caps how many
guesses a card can hold at once, so the ceiling on one high-end GPU moves from
roughly 4k to roughly 2k guesses/s and its 24 GB fits ~187 lanes instead of ~375.
Measured through the vendored build: 640 ms, against 322 ms at 64 MB.

While measuring the real cost of a sign-in, found the SPA deriving the bundle key
twice — once for the key pair kept for the session, then again inside
decryptBundle() for the local bundle. At these parameters that is 0.6 s of pure
waste. Measured now, end to end:

    auth_key   (PBKDF2 600k)     239 ms
    bundle v1  (PBKDF2 600k)     240 ms   legacy, until every bundle is upgraded
    bundle v2  (Argon2id 128MB)  650 ms
    -----------------------------------
    sign-in                    1 129 ms   (889 ms once no v1 bundles remain)

Once per sign-in, and only then: reopening a group, downloading, streaming and
reloading the page all reuse the key, which lives in IndexedDB from login.

Also bounds two waits in the node's hub WebSocket, found because the node went
silent again mid-deploy. It had reconnected after the hub restart, sent its auth
frame, and waited for a reply that never came — `ws.recv()` had no timeout, so a
hub that accepts a socket and then says nothing for a few seconds while starting
up parks the task forever: node running, logging nothing, invisible to everyone.
The auth exchange now times out at 15 s, connect at 15 s, and a refused auth
retries with a fresh token instead of ending the task for good.

QE harness signs in once per account and reuses the token — several clients there
stand for several browsers of one person, and what tells them apart is which keys
they hold, not which token, while the hub quite rightly rate-limits repeated
logins from one address.

Tests: 341, plus the live workflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 12 insertions, 3 deletions

diff --git a/docs/meshbay-draft-v5.md b/docs/meshbay-draft-v5.md
index 6fdbbc6..e8cc3a4 100644
--- a/docs/meshbay-draft-v5.md
+++ b/docs/meshbay-draft-v5.md
@@ -353,11 +353,20 @@ whose group the user joins, and GEK and keypair bundle fetches are served in the
 window because the client needs its bundle to compute the proof. The window is bounded
 (4 fetches) and audited.
 
-The bundle's own protection moved from PBKDF2-SHA512 to **Argon2id, 64 MB, t=3, p=1**
+The bundle's own protection moved from PBKDF2-SHA512 to **Argon2id, 128 MB, t=3, p=1**
 (`static/vendor/argon2.min.js`, WebAssembly, no external host). PBKDF2 is compute-only,
 so 600k iterations cost an attacker with a GPU far less than the wall clock suggested:
-measured on the dev machine, both take ~0.3 s honestly, but only one of them makes a
-graphics card allocate 64 MB per guess. The two implementations — the browser's WASM and
+measured on the dev machine, PBKDF2 costs 241 ms and Argon2id 88 ms natively, but only
+one of them makes a graphics card find 128 MB per guess. The honest size of that gain:
+on a single card the ceiling moves from roughly 8k guesses/s to roughly 2k — a factor of
+four, not a thousand. What it really buys is the cost of scale, since 128 MB per lane caps
+a 24 GB card at about 187 concurrent guesses and makes custom hardware unattractive.
+
+**The passphrase, not the KDF, is what decides this.** At ~2k guesses/s a dictionary-plus-
+rules run of 10⁹ candidates — which covers a large share of human-chosen passwords —
+takes about six days on one card. Four random words (~52 bits) takes longer than the age
+of the universe. No parameter choice saves a weak passphrase; it only moves it from hours
+to days. The two implementations — the browser's WASM and
 `argon2-cffi` in QE — are held byte-identical by a parity test, because a disagreement
 would present as an account nobody can open.