docs: Argon2id, the multi-browser property, and what a browser found

draft-v5 §7 rewritten around the keypair bundle, because that is where the last
open finding actually lives. New §7.1 states the adversary (an operator holding
their own node's disk), what cracking a bundle yields (identity keys, hence
content on *other* nodes and the ability to sign as that user — not the content
they host in the clear by design), and the measured numbers rather than
adjectives: PBKDF2 241 ms vs Argon2id 88 ms natively, a GPU ceiling moving from
~8k to ~2k guesses/s, six days for a 10⁹ dictionary run, four random words
outlasting the sun. The honest summary is in there too — a factor of four on one
card, not a thousand; what it buys is the cost of scale.

§2 gains the row the table never had: **your identity keys stay yours**, ⚠️
against a malicious node operator. An operator hosts your content by design, and
that was documented; that they can also try to become *you* was not. That is the
difference between reading what they host and reading what other operators host.

§4 records that the challenge now carries `node_pk`, why (a first-time member
signs a transcript naming the node and has no GEK to complete a handshake with),
and that it is checked against the ack rather than trusted. Also that refusals
carry a code, and what `not_a_member` usually means.

§8.1 states the multi-browser property plainly — one identity across browsers,
recovered with the passphrase, no second code — together with its cost, since it
is the same mechanism as C4.

invite-pairing-v1 is no longer "a proposal": it shipped. §9bis gains the four
browser-found failures and their common thread — e2e.py is a second
implementation of the client, written in the right order by construction, so it
proves the protocol and nothing about app.js.

CLAUDE.md gets the two things a future session must not rediscover the hard way:
the KDF parameters live in three places held identical by a parity test, and an
unbounded await on the hub socket makes a node silently unreachable (three found).

second-review: C4 marked reduced, not closed. devel-phases-next: 12.2's CSP must
keep `wasm-unsafe-eval`, or the strict policy locks every user out of their keys.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/second-review.md b/second-review.md
index 071e6ef..01ee2af 100644
--- a/second-review.md
+++ b/second-review.md
@@ -557,6 +557,13 @@ their browser key. Fails closed, so it is a correctness problem rather than a ho
 sovereignty feature is effectively inert as shipped, and the mismatch will invite the wrong
 fix (relaxing the check) unless it is documented.
 
+> **C4 — REDUCED 2026-08-14, not closed.** The bundle's KDF moved from PBKDF2-SHA512
+> 600k to Argon2id 128 MB/t=3 in the browser (vendored WebAssembly), so an operator
+> attacking one offline no longer enjoys the GPU economics of a compute-only KDF. The
+> pre-proof window is unchanged and still bounded. What remains: bundles are still stored
+> on every node their owner joins, and a weak passphrase still loses — draft-v5 §7.1 gives
+> the measured numbers. It closes at 13.3.
+
 **M4 — Response-to-request matching by arrival order.** `transport.js:390-422` resolves the
 **oldest** pending promise with whatever message arrives, ignoring type. With the 8-deep
 pipelined download window, a node that reorders responses (or an `error` message arriving