cursedbelt-server 4.22.0 → 4.24.0

package/dist/server/worker-argon2/argon2.js

@@ -0,0 +1,71 @@
+/**
+ * argon2id as WebAssembly the Worker was HANDED, never WebAssembly it compiles.
+ *
+ * ## 🔴 Why this file exists: one unlock was 8.5–15 seconds of billed CPU
+ *
+ * `collections` averaged **489 CPU-ms per request on 2026-09-22 with a 15.2 s p99** (Cloudflare
+ * GraphQL, `workersInvocationsAdaptive`). Every second of it was `POST /__lock/unlock`: a real
+ * `wrangler tail` of the stage walk on 2026-09-23 read **8,519 CPU-ms and 10.4 s wall** for that
+ * one request and 10–38 ms for each of the other eleven. The lock verifies every account's
+ * argon2id hash (no early exit — `cursedbelt-server/master-lock` explains the timing oracle) plus
+ * a timing equalizer, so production's two accounts are three to four derivations per unlock, and
+ * `@noble/hashes`' pure-JS argon2id costs ~2.8 s each on workerd — five times the 562 ms it
+ * costs on this Mac. The owner waited ten seconds at the lock page, and a third account would
+ * have put the unlock within reach of the Worker's 30 s CPU ceiling, where it is killed and
+ * reads as a wrong password.
+ *
+ * ## 🔴 Why this shape: workerd refuses to COMPILE WebAssembly, not to RUN it
+ *
+ * `hash-wasm` failed here on 2026-09-18 with `Wasm code generation disallowed by embedder`
+ * because it compiles bytes it carries inline (`./password.ts` has the whole story). A
+ * `.wasm` file that is a STATIC import is different: wrangler bundles it as a
+ * `CompiledWasm` module and the runtime hands this code a ready `WebAssembly.Module`, which
+ * `WebAssembly.instantiate(module, imports)` may instantiate. `argon2id` (openpgpjs, MIT) ships
+ * its two binaries as plain files and lets the caller do the instantiating, which is exactly the
+ * seam a Worker needs. Its default entry inlines base64 and compiles it — so it is never imported.
+ *
+ * Under Bun (every test, and the Mac) the same import is a PATH STRING, so the bytes are read
+ * and compiled here — which Bun allows. `index.spec.ts` drives the Worker's branch too, with
+ * `WebAssembly.compile` made to throw exactly as workerd throws.
+ *
+ * ## Why it lives in `cursedbelt-server` (4.24.0)
+ *
+ * It was born in `apps/collections/worker/argon2.ts` (commit 7996ded) while `apps/vault` and
+ * `apps/patterns` still carried the pure-JS copy, so every sign-in there billed seconds. One copy
+ * here, `argon2id` a pinned dependency of this package: its two `.wasm` files ship in its own
+ * `files`, and wrangler — which resolves this subpath's `import` condition, `dist/…/argon2.js`,
+ * where tsc leaves the bare `argon2id/dist/*.wasm` specifiers untouched — bundles them from
+ * `node_modules` as `CompiledWasm`. `index.spec.ts` asserts `dist` still carries them that way.
+ */
+import noSimdWasm from "argon2id/dist/no-simd.wasm";
+import simdWasm from "argon2id/dist/simd.wasm";
+import setupWasm, {} from "argon2id/lib/setup.js";
+/**
+ * Turn one `.wasm` import into an instance. 🔴 A `Module` is instantiated and NEVER compiled —
+ * that is the whole workerd rule — and only a path (Bun) is read and compiled.
+ */
+export async function instantiateWasm(source, imports) {
+    const module = typeof source === "string" ? await WebAssembly.compile(await Bun.file(source).arrayBuffer()) : source;
+    const instance = await WebAssembly.instantiate(module, imports);
+    return { module, instance };
+}
+/** Build a hasher from the two binaries — SIMD first, the plain one if SIMD will not load. */
+export function loadArgon2(simd = simdWasm, noSimd = noSimdWasm) {
+    return setupWasm((imports) => instantiateWasm(simd, imports), (imports) => instantiateWasm(noSimd, imports));
+}
+/*
+ * 🔴 ONE hasher per isolate, built on first use. Not request state — it holds no password and no
+ * result between calls (the library clears its memory after each) — so this is the one kind of
+ * module-scope value a Worker may keep. The reason to keep it is MEMORY: each
+ * instance owns a 65 MB `WebAssembly.Memory` that can never shrink, and an unlock runs three or
+ * four derivations back to back; one per call would stack up to four of them against a 128 MB
+ * isolate before a collector ran. A load that FAILS is not cached, so the next unlock retries.
+ */
+let shared = null;
+export function argon2() {
+    shared ??= loadArgon2().catch((error) => {
+        shared = null;
+        throw error;
+    });
+    return shared;
+}

package/dist/server/worker-argon2/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2, type WasmImport } from "./argon2.js";
+export { type BunPasswordShim, installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/dist/server/worker-argon2/index.js

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2 } from "./argon2.js";
+export { installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/dist/server/worker-argon2/password.d.ts

@@ -0,0 +1,26 @@
+interface Phc {
+    m: number;
+    t: number;
+    p: number;
+    salt: Uint8Array;
+    hash: Uint8Array;
+}
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export declare function parsePhc(encoded: string): Phc | null;
+export interface BunPasswordShim {
+    verify(password: string, hash: string): Promise<boolean>;
+    hash(password: string, options?: {
+        algorithm?: string;
+        memoryCost?: number;
+        timeCost?: number;
+    }): Promise<string>;
+}
+export declare const workerPassword: BunPasswordShim;
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export declare function installBunPasswordShim(): void;
+export {};

package/dist/server/worker-argon2/password.js

@@ -0,0 +1,164 @@
+/**
+ * argon2id on `workerd`, where the obvious answer does not work.
+ *
+ * ## 🔴 The finding, and it applies to every app in this fleet
+ *
+ * **A Worker may not compile WebAssembly at runtime.** `hash-wasm` — the first and
+ * most natural choice, and the one every search result recommends — inlines its
+ * argon2 module as base64 and calls `WebAssembly.compile(bytes)` on first use.
+ * Deployed here on 2026-09-18, that produced:
+ *
+ * ```
+ * [patterns] argon2 verification threw:   ← the pilot's log line, quoted verbatim
+ *   WebAssembly.compile(): Wasm code generation disallowed by embedder
+ * ```
+ *
+ * It **builds, deploys and starts perfectly**, and fails only when somebody tries
+ * to sign in — where it is indistinguishable from a wrong password, because a KDF
+ * that throws must fail closed. That combination is the worst shape a defect can
+ * have, and it is why `verify` below logs the error: a silent `false` cost a
+ * diagnosis on the day this was written. On Workers, WASM must be a *static
+ * import* of a `.wasm` file that wrangler bundles as a module; a library that
+ * carries its bytes inline can never satisfy that.
+ *
+ * So this runs **argon2id as WebAssembly that wrangler bundles as a static module** —
+ * `./argon2.ts`, which instantiates a `WebAssembly.Module` it was handed and never compiles
+ * one. Until 2026-09-23 it was `@noble/hashes/argon2`, pure JavaScript: byte-identical output
+ * and 562 ms per verification on this Mac, which read as acceptable — and on workerd it was
+ * **~2.8 s per derivation**, so one unlock (every account's hash plus the timing equalizer)
+ * billed 8.5 s on the stage and 15 s in production, and was 489 CPU-ms averaged over every
+ * request the app served on 2026-09-22. `./argon2.ts` carries the measurement.
+ * `cursedbelt-server/login-throttle` is what holds the line against a flood, not the KDF's cost.
+ *
+ * ## What this buys, and it is the reason to pay for argon2id at all
+ *
+ * **The owner's existing password hash works on a Worker unchanged.** No re-hash,
+ * no "sign in again on the new host", and above all no downgrade to PBKDF2 to fit
+ * the runtime — `ownerAuth.ts` argues at length for argon2id over a fast KDF, and
+ * a port that quietly swapped it would have thrown that argument away for a
+ * platform detail. Same PHC string, same parameters, same answer.
+ *
+ * ## Why a GLOBAL shim rather than an injected verifier
+ *
+ * `Bun.password` is reached from three files (`auth.ts`, `ownerAuth.ts`,
+ * `cursedbelt-server/password`), and `Bun.` is a *global property access*, not an import — so
+ * a Worker bundle containing it builds fine and throws `Bun is not defined` only
+ * when a login happens. Threading a verifier through three signatures would be
+ * three more places for the Mac and the edge to disagree. Installing the global
+ * instead keeps the auth tier byte-identical on both runtimes, which is the same
+ * argument the apps' `store.ts` make for the async database seam.
+ *
+ * Used by `collections`, `vault` and `patterns` (each app's `worker/index.ts` calls
+ * {@link installBunPasswordShim} first thing). In `vault` this is ONLY the sign-in / lock
+ * verifier: the vault's ciphertext is derived and opened in the browser and never comes near it.
+ */
+import { constantTimeEqualBytes } from "cwip/constant-time";
+import { argon2 } from "./argon2.js";
+/** What Bun's `argon2id` default writes, so a hash minted here matches one minted there. */
+const DEFAULT_MEMORY_KIB = 65_536;
+const DEFAULT_ITERATIONS = 2;
+const DEFAULT_PARALLELISM = 1;
+const HASH_BYTES = 32;
+// 32, matching what `Bun.password.hash` actually writes — measured 2026-09-18.
+const SALT_BYTES = 32;
+/**
+ * argon2's PHC encoding is base64 **without padding**, and with the standard
+ * alphabet rather than base64url. Getting either wrong yields a salt that decodes
+ * to the wrong bytes and a verification that fails for a correct password.
+ */
+const b64decode = (value) => {
+    const padded = value + "===".slice((value.length + 3) % 4);
+    return Uint8Array.from(atob(padded), (ch) => ch.charCodeAt(0));
+};
+const b64encode = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/=+$/, "");
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export function parsePhc(encoded) {
+    const parts = encoded.split("$");
+    // ["", "argon2id", "v=19", "m=...,t=...,p=...", salt, hash]
+    if (parts.length !== 6 || parts[1] !== "argon2id")
+        return null;
+    const params = new Map(parts[3].split(",").map((pair) => {
+        const [key, value] = pair.split("=");
+        return [key, Number(value)];
+    }));
+    const m = params.get("m");
+    const t = params.get("t");
+    const p = params.get("p");
+    if (!m || !t || !p)
+        return null;
+    try {
+        return { m, t, p, salt: b64decode(parts[4]), hash: b64decode(parts[5]) };
+    }
+    catch {
+        return null;
+    }
+}
+export const workerPassword = {
+    async verify(password, encoded) {
+        if (!password || !encoded)
+            return false;
+        try {
+            const phc = parsePhc(encoded);
+            if (!phc)
+                return false;
+            const derive = await argon2();
+            const derived = derive({
+                password: new TextEncoder().encode(password),
+                salt: phc.salt,
+                // 🔴 The STORED parameters, never this file's defaults. A hash written
+                // under a different cost must still verify, or rotating the cost locks
+                // the owner out of their own app.
+                passes: phc.t,
+                memorySize: phc.m,
+                parallelism: phc.p,
+                tagLength: phc.hash.length,
+            });
+            // Through the fleet's one constant-time primitive, exactly as
+            // `sync/tokens.ts` compares digests. A `===` here is a timing oracle on the
+            // one comparison in the app where it would matter.
+            return constantTimeEqualBytes(derived, phc.hash);
+        }
+        catch (error) {
+            // A malformed stored hash must fail CLOSED, exactly as `auth.ts` does on
+            // Bun. Returning `false` rather than throwing keeps the refusal a phrase
+            // instead of a 500 that tells a caller the hash is broken.
+            //
+            // 🔴 But it is LOGGED, because a silent `false` here is indistinguishable
+            // from a wrong password — and on 2026-09-18 that cost a diagnosis: a
+            // working credential was refused and the only line anywhere said "invalid
+            // email or password". Never the password, never the hash; the error only.
+            console.error(`[cursedbelt-server/worker-argon2] argon2 verification threw: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    },
+    async hash(password, options = {}) {
+        const salt = new Uint8Array(SALT_BYTES);
+        crypto.getRandomValues(salt);
+        // `memoryCost`/`timeCost` are Bun's names; `cursedbelt-server/password` passes exactly
+        // those two, and its test profile passes much smaller ones.
+        const m = options.memoryCost ?? DEFAULT_MEMORY_KIB;
+        const t = options.timeCost ?? DEFAULT_ITERATIONS;
+        const derive = await argon2();
+        const derived = derive({
+            password: new TextEncoder().encode(password),
+            salt,
+            passes: t,
+            memorySize: m,
+            parallelism: DEFAULT_PARALLELISM,
+            tagLength: HASH_BYTES,
+        });
+        return `$argon2id$v=19$m=${m},t=${t},p=${DEFAULT_PARALLELISM}$${b64encode(salt)}$${b64encode(derived)}`;
+    },
+};
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export function installBunPasswordShim() {
+    const existing = globalThis.Bun;
+    if (existing)
+        return;
+    globalThis.Bun = { password: workerPassword };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.22.0",
+	"version": "4.24.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -215,6 +215,12 @@
 			"source": "./src/server/auth/passwordCost.ts",
 			"import": "./dist/server/auth/passwordCost.js"
 		},
+		"./worker-argon2": {
+			"types": "./dist/server/worker-argon2/index.d.ts",
+			"bun": "./src/server/worker-argon2/index.ts",
+			"source": "./src/server/worker-argon2/index.ts",
+			"import": "./dist/server/worker-argon2/index.js"
+		},
 		"./request-log": {
 			"types": "./dist/server/requestLog/requestMetrics.d.ts",
 			"bun": "./src/server/requestLog/requestMetrics.ts",
@@ -301,6 +307,7 @@
 		}
 	},
 	"dependencies": {
+		"argon2id": "1.0.1",
 		"cursedbelt-core": "^2.1.1",
 		"cursedops": "^0.6.0",
 		"cwip": "^4.6.0",

package/src/server/bench/budget.spec.ts

@@ -4,6 +4,7 @@ import {
   DEFAULT_ROUTE_CPU_BUDGET_MS,
   deriveCpuBudgetMs,
   MEASURED_FLEET_REQUESTS_PER_DAY,
+  MEASURED_WORKER_TRAFFIC,
   monthlyOverageUsd,
   OWNER_PROJECTED_REQUESTS_PER_DAY,
   resolveBudget,
@@ -64,6 +65,43 @@ describe('the derivation', () => {
   });
 });
 
+describe('the WORKER re-derivation (2026-09-23, task 083)', () => {
+  const W = MEASURED_WORKER_TRAFFIC;
+  const perDay = W.requests / W.days;
+  const edgeGatePerMonth = (W.edgeGateCpuMs / W.days) * DAYS_PER_MONTH;
+
+  it('the naive call over the whole account says 9.1 — below the default — and that is recorded, not hidden', () => {
+    expect(perDay).toBeCloseTo(108_001, 0);
+    const naive = deriveCpuBudgetMs({ requestsPerDay: perDay });
+    expect(naive).toBeCloseTo(9.13, 2);
+    expect(naive).toBeLessThan(DEFAULT_ROUTE_CPU_BUDGET_MS);
+    // …because 99.9 % of it is the edge gate, whose mean sits far under any route budget.
+    expect(W.edgeGateRequests / W.requests).toBeGreaterThan(0.998);
+    expect(W.edgeGateCpuMs / W.edgeGateRequests).toBeLessThan(DEFAULT_ROUTE_CPU_BUDGET_MS / 4);
+  });
+
+  it('🔴 the default stays under what an APP request may spend once the edge gate is set aside', () => {
+    const appAllowance = deriveCpuBudgetMs({
+      requestsPerDay: MEASURED_FLEET_REQUESTS_PER_DAY,
+      reservedCpuMsPerMonth: edgeGatePerMonth,
+    });
+    expect(appAllowance).toBeCloseTo(16.9, 1);
+    expect(DEFAULT_ROUTE_CPU_BUDGET_MS).toBeLessThanOrEqual(appAllowance);
+  });
+
+  it('and there is no evidence for tightening it: the account spends 30 % of its CPU allowance', () => {
+    const monthly = (W.cpuMs / W.days) * DAYS_PER_MONTH;
+    expect(monthly / WORKERS_PAID_INCLUDED_CPU_MS).toBeCloseTo(0.3, 2);
+  });
+
+  it('FAILURE PATH: a reservation that eats the allowance is refused, not turned into a negative budget', () => {
+    expect(() => deriveCpuBudgetMs({ reservedCpuMsPerMonth: WORKERS_PAID_INCLUDED_CPU_MS })).toThrow(
+      /reservedCpuMsPerMonth/,
+    );
+    expect(() => deriveCpuBudgetMs({ reservedCpuMsPerMonth: -1 })).toThrow(/reservedCpuMsPerMonth/);
+  });
+});
+
 describe('what going over actually costs', () => {
   it('prices the overage — 3× the CPU budget at this traffic is about $1.20/month', () => {
     const requestsPerMonth = OWNER_PROJECTED_REQUESTS_PER_DAY * DAYS_PER_MONTH;

package/src/server/bench/budget.ts

@@ -82,6 +82,48 @@ export const DAYS_PER_MONTH = 30.4375;
  */
 export const MEASURED_FLEET_REQUESTS_PER_DAY = 42_971;
 
+/**
+ * 🔴 The WORKER re-derivation — 2026-09-23 (task 083, bullet 3). Cloudflare's own numbers,
+ * not a proxy: the account's `workersInvocationsAdaptive` dataset (GraphQL Analytics API,
+ * `sum { requests cpuTimeUs }` by `scriptName`) over the seven whole days
+ * 2026-09-16T00:00Z → 2026-09-23T00:00Z, while `patterns` (since 09-18) and `collections`
+ * (since 09-22) served from Workers:
+ *
+ * ```
+ * script                    requests    billed CPU-ms   mean
+ * binary-server-edge-gate    754,974       1,805,750    2.39
+ * collections                    350         171,228  489.2   (09-22: p99 15.2 s — one-off imports)
+ * collections-stage               61          96,081   1575    (stage: seeding and gate runs)
+ * patterns                       424          12,718   30.0    (09-18: p99 2.9 s, first boot)
+ * 3 others                       196             126
+ * ACCOUNT                    756,005       2,085,903    2.76  →  108,001 req/day, 9.07 M CPU-ms/month (30 %)
+ * ```
+ *
+ * **What the call says.** `deriveCpuBudgetMs({ requestsPerDay: 108_001 })` = **9.1**, i.e.
+ * BELOW the shipped 9.9 — the account already carries more requests than the owner's
+ * 100,000/day projection. **The default did not move, and this is why:** 99.9 % of those
+ * requests are the binary server's edge gate, a fixed-cost auth check at 2.39 CPU-ms mean
+ * that no app route budget governs. Averaging them in hands the app routes an allowance
+ * those requests never use. The question the default answers is what an APP request may
+ * spend once the measured non-app spend is set aside:
+ * `deriveCpuBudgetMs({ requestsPerDay: MEASURED_FLEET_REQUESTS_PER_DAY, reservedCpuMsPerMonth: edge gate })`
+ * = **16.9** CPU-ms — the fleet's whole app traffic (42,971/day, above) on Workers, with the
+ * edge gate still running beside it. 9.9 stays under that with 1.7× headroom, and the
+ * account is at 30 % of its CPU allowance, so there is no evidence for tightening it either.
+ * App-Worker traffic itself (~111/day, mostly agent deploy checks) is too small to derive
+ * anything from yet. `budget.spec.ts` holds both orderings as assertions.
+ */
+export const MEASURED_WORKER_TRAFFIC = {
+  from: '2026-09-16T00:00:00Z',
+  until: '2026-09-23T00:00:00Z',
+  days: 7,
+  requests: 756_005,
+  cpuMs: 2_085_903,
+  /** The binary server's edge gate — fixed-cost traffic no app route budget governs. */
+  edgeGateRequests: 754_974,
+  edgeGateCpuMs: 1_805_750,
+} as const;
+
 /**
  * Derive the average CPU-ms a single request may spend before the fleet exceeds its
  * included CPU allowance.
@@ -99,9 +141,21 @@ export function deriveCpuBudgetMs(
     requestsPerMonth?: number;
     /** Measured (or projected) requests per day — converted with {@link DAYS_PER_MONTH}. */
     requestsPerDay?: number;
+    /**
+     * CPU-ms per month already spent by traffic OUTSIDE the budgeted routes (measured —
+     * the edge gate in {@link MEASURED_WORKER_TRAFFIC}), taken off the allowance first.
+     * Default: 0.
+     */
+    reservedCpuMsPerMonth?: number;
   } = {},
 ): number {
-  const includedCpuMs = opts.includedCpuMs ?? WORKERS_PAID_INCLUDED_CPU_MS;
+  const reserved = opts.reservedCpuMsPerMonth ?? 0;
+  const includedCpuMs = (opts.includedCpuMs ?? WORKERS_PAID_INCLUDED_CPU_MS) - reserved;
+  if (!(reserved >= 0) || !(includedCpuMs > 0)) {
+    throw new Error(
+      `deriveCpuBudgetMs: reservedCpuMsPerMonth (${reserved}) must be ≥ 0 and leave some allowance`,
+    );
+  }
   const requestsPerMonth =
     opts.requestsPerMonth ??
     (opts.requestsPerDay ?? OWNER_PROJECTED_REQUESTS_PER_DAY) * DAYS_PER_MONTH;
@@ -136,6 +190,9 @@ export function monthlyOverageUsd(opts: {
  *
  * 🔴 Deliberately kept BELOW the ~22.9 ms that {@link MEASURED_FLEET_REQUESTS_PER_DAY}
  * derives; that constant says why, and `budget.spec.ts` reddens if the two ever swap.
+ *
+ * Re-derived from WORKER traffic on 2026-09-23 and kept: {@link MEASURED_WORKER_TRAFFIC}
+ * has the numbers (16.9 ms per app request after the edge gate's measured spend).
  */
 export const DEFAULT_ROUTE_CPU_BUDGET_MS = Math.round(deriveCpuBudgetMs() * 10) / 10;
 

package/src/server/bench/cpuBudget.spec.ts

@@ -23,11 +23,23 @@ import { BENCH_ORIGIN, runCpuBench } from './runBench.js';
  * timing would make the suite flaky for no extra truth.
  */
 
-/** Burn approximately `ms` of CPU. Deliberately un-optimizable: the result escapes. */
+/**
+ * Burn at least `ms` of CPU. Deliberately un-optimizable: the result escapes.
+ *
+ * 🔴 The deadline is on the CPU clock, not the wall clock. The recorder measures
+ * `process.cpuUsage`; a burner that stops at a WALL deadline hands it only the share of
+ * those milliseconds the scheduler granted, so under load (measured 2026-09-23, load 17 on
+ * 14 cores) a 12 ms burn read 5.5 CPU-ms and reddened `row.max > 6`. Spinning until the
+ * process has actually been charged `ms` makes every lower bound here hold at any load.
+ */
 function burnCpu(ms: number): number {
-  const deadline = performance.now() + ms;
+  const start = process.cpuUsage();
+  const spent = () => {
+    const d = process.cpuUsage(start);
+    return (d.user + d.system) / 1000;
+  };
   let acc = 0;
-  while (performance.now() < deadline) {
+  while (spent() < ms) {
     for (let i = 0; i < 2_000; i += 1) acc += Math.sqrt(i + acc % 7);
   }
   return acc;

package/src/server/bench/index.ts

@@ -50,6 +50,7 @@ export {
   deriveCpuBudgetMs,
   isExemption,
   MEASURED_FLEET_REQUESTS_PER_DAY,
+  MEASURED_WORKER_TRAFFIC,
   monthlyOverageUsd,
   OWNER_PROJECTED_REQUESTS_PER_DAY,
   type ResolvedBudget,

package/src/server/metrics/metricsBuffer.ts

@@ -20,8 +20,19 @@ export interface MetricRow {
   durationMs: number | null;
   bytesOut: number | null;
   userId: string | null;
+  /**
+   * Where the request came from — a PLACE, never an address (4.23.0). Filled by
+   * `requestLogger`'s `locate` hook; absent/null when nothing could place it. There is
+   * deliberately no `ip` field: the raw address is never stored, anywhere.
+   */
+  country?: string | null;
+  region?: string | null;
+  city?: string | null;
 }
 
+/** The optional place columns, in insert order. Each is written only when the table HAS it. */
+export const PLACE_COLUMNS = ['country', 'region', 'city'] as const;
+
 export interface MetricsBufferOptions {
   db: Database;
   /** Flush cadence in ms. Default: 1500. */
@@ -45,9 +56,17 @@ export function createMetricsBuffer(opts: MetricsBufferOptions): MetricsBuffer {
   const { db, flushIntervalMs = 1500, maxSize = 5000 } = opts;
   let buffer: MetricRow[] = [];
 
+  // 🔴 The place columns are written only where the table has them (4.23.0). An app that
+  // created `request_metrics` with its own DDL before they existed keeps working unchanged —
+  // a fixed column list would make `prepare` throw on its first boot after the bump.
+  const present = new Set(
+    (db.query('PRAGMA table_info(request_metrics)').all() as Array<{ name: string }>).map((c) => c.name),
+  );
+  const place = PLACE_COLUMNS.filter((c) => present.has(c));
+  const columns = ['id', 'ts', 'method', 'route', 'status', 'duration_ms', 'bytes_out', 'user_id', ...place];
   const insert = db.prepare(
-    `INSERT INTO request_metrics (id, ts, method, route, status, duration_ms, bytes_out, user_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    `INSERT INTO request_metrics (${columns.join(', ')})
+     VALUES (${columns.map(() => '?').join(', ')})`,
   );
   const insertMany = db.transaction((rows: MetricRow[]) => {
     for (const r of rows) {
@@ -60,6 +79,7 @@ export function createMetricsBuffer(opts: MetricsBufferOptions): MetricsBuffer {
         r.durationMs,
         r.bytesOut,
         r.userId,
+        ...place.map((c) => r[c] ?? null),
       );
     }
   });