1 files changed, 12 insertions, 8 deletions
diff --git a/packages/meshbay-hub/tests/test_argon2_off_loop.py b/packages/meshbay-hub/tests/test_argon2_off_loop.py
index b156ebc..5c25a8e 100644
--- a/packages/meshbay-hub/tests/test_argon2_off_loop.py
+++ b/packages/meshbay-hub/tests/test_argon2_off_loop.py
@@ -1,10 +1,11 @@
 """
 Argon2 runs off the event loop, and never two at a time.
 
-One derivation is 256 MB and a quarter to half a second of CPU. On the loop it
-stopped the whole hub for that long at every sign-in. In a thread pool it would
-have been worse: two concurrent `lanes=4` derivations deadlock inside OpenSSL
-and never return (`auth._argon2_executor`). These pin both halves.
+A derivation is 64 MiB and ~0.1 s at the current version, 256 MB and ~0.45 s
+for a v3 hash not yet rewritten. On the loop it stopped the whole hub for that
+long at every sign-in. In a thread pool it would have been worse: two concurrent
+`lanes=4` derivations deadlock inside OpenSSL and never return, at 64 MiB as at
+256 MB (`auth._argon2_executor`). These pin both halves.
 """
 
 import asyncio
@@ -51,9 +52,13 @@ async def test_concurrent_derivations_all_return():
 
 @pytest.mark.asyncio
 async def test_the_loop_keeps_turning_while_argon2_runs():
-    pw_hash, salt = auth.hash_password("k" * 44)
+    # A v3 (256 MB) hash, the heaviest the hub still verifies: at 64 MiB an
+    # inline derivation is ~45 ms and half of it is too close to scheduling
+    # noise to tell a stalled loop from a busy machine.
+    version = 3
+    pw_hash, salt = auth.hash_password("k" * 44, version)
     started = time.perf_counter()
-    auth.verify_password("k" * 44, pw_hash, salt, auth.current_pw_version())
+    auth.verify_password("k" * 44, pw_hash, salt, version)
     inline = time.perf_counter() - started
 
     gaps, done = [], asyncio.Event()
@@ -68,8 +73,7 @@ async def test_the_loop_keeps_turning_while_argon2_runs():
 
     task = asyncio.create_task(ticker())
     await asyncio.sleep(0.02)
-    assert await auth.verify_password_off_loop(
-        "k" * 44, pw_hash, salt, auth.current_pw_version())
+    assert await auth.verify_password_off_loop("k" * 44, pw_hash, salt, version)
     done.set()
     await task
     # Inline, the loop stalls for the whole derivation; off it, for scheduling noise.