toiljs 0.0.85 → 0.0.87

package/src/devserver/analytics/index.ts

@@ -16,8 +16,9 @@ import type { MemoryRef } from '../runtime/host.js';
 
 /** Frame version + counter count, kept in lockstep with the edge (`analytics.rs` / `metric_id.rs`). */
 const FRAME_VERSION = 2;
-const METRIC_COUNTERS = 41;
-/** MetricId indices we seed with sample data (others default 0). Mirrors the wire contract. */
+const METRIC_COUNTERS = 43;
+/** MetricId indices we seed with sample data (others default 0). Mirrors the wire contract
+ *  (counter ids 0..=42; gauge ids ConnectedStreamsAvg=43, CommittedMemoryAvg=45). */
 const MID = {
     Requests: 0,
     BytesOutL1: 1,
@@ -33,6 +34,8 @@ const MID = {
     StreamBytesIn: 25,
     StreamBytesOut: 26,
     MemGrownBytes: 39,
+    CacheHits: 41,
+    CacheMisses: 42,
 } as const;
 
 interface DevTenantStats {
@@ -63,6 +66,8 @@ function devStats(): DevTenantStats {
     life[MID.StreamBytesIn] = 2048n;
     life[MID.StreamBytesOut] = 8192n;
     life[MID.MemGrownBytes] = 262144n;
+    life[MID.CacheHits] = 900n;
+    life[MID.CacheMisses] = 100n;
     return {
         life,
         connectedStreams: 3,
@@ -103,7 +108,7 @@ function encodeStats(s: DevTenantStats): Buffer {
 
 /** The metric ids carried in the per-minute ring (mirrors the edge `MINUTE_RING_METRICS`). Only these get
  *  minute resolution on the 1h/6h ranges; every other metric falls back to the hour ring there. */
-const MINUTE_RING_METRICS = new Set<number>([0, 2, 1, 25, 26, 12, 13, 39, 41, 43]);
+const MINUTE_RING_METRICS = new Set<number>([0, 2, 1, 25, 26, 12, 13, 39, 43, 45]);
 
 /**
  * Range id -> (bucketCount, bucketSecs), matching the edge `Range` + minute-ring fallback: 1h/6h are
@@ -206,7 +211,8 @@ export function buildAnalyticsImports(
             range: number,
         ): number => {
             if (domainLen > MAX_DOMAIN_LEN) return ABSENT;
-            if (metricId < 0 || metricId > 44 || range < 0 || range > 7) return ABSENT;
+            // Valid metric ids are 0..=46 (counters 0..=42 + the 4 gauge avg/peak series), ranges 0..=7.
+            if (metricId < 0 || metricId > 46 || range < 0 || range > 7) return ABSENT;
             if (domainLen > 0) {
                 if (!ref.memory) throw new Error('analytics_series called before memory was bound');
                 const m = Buffer.from(ref.memory.buffer);

package/src/devserver/db/database.ts

@@ -208,6 +208,7 @@ enum DbOp {
     ViewGet,
     ViewPublish,
     CapacitySetTotal,
+    EventsSince,
 }
 
 function isReadOp(op: DbOp): boolean {
@@ -221,12 +222,13 @@ function isReadOp(op: DbOp): boolean {
         op === DbOp.MembershipList ||
         op === DbOp.UniqueLookup ||
         op === DbOp.Latest ||
+        op === DbOp.EventsSince ||
         op === DbOp.CapacityAvailable
     );
 }
 
 function isScanOp(op: DbOp): boolean {
-    return op === DbOp.Latest || op === DbOp.MembershipList;
+    return op === DbOp.Latest || op === DbOp.MembershipList || op === DbOp.EventsSince;
 }
 
 function kindAllows(kind: DbFunctionKind, op: DbOp): boolean {
@@ -303,6 +305,11 @@ export class DevDatabase {
     private readonly counterIdem = new Map<string, bigint>();
     /** Events family: `"collection\0key"` -> append-ordered event blobs (oldest first). */
     private readonly events = new Map<string, Buffer[]>();
+    /** Durable resumable `events.since` cursors, keyed `"<deriveId>\0<storeKey>"` -> count of events folded.
+     *  A derive run stages its advances in `db.pendingCheckpoints` and only commits them here after its
+     *  `derive_run` returns (publish-then-persist, mirroring the edge), so a trapped fold never advances the
+     *  cursor past unpublished events. Persisted in the snapshot so a restart resumes the fold. */
+    private readonly deriveCheckpoints = new Map<string, number>();
     /** append_once dedup: `"collection\0key"` -> set of eventIds already appended. */
     private readonly eventDedup = new Map<string, Set<string>>();
     /** Capacity family: `"collection\0key"` -> an escrow ledger (ceiling + reservations). */
@@ -410,6 +417,7 @@ export class DevDatabase {
             counterIdem: {},
             events: {},
             eventDedup: {},
+            deriveCheckpoints: {},
             capacity: {},
         };
         for (const [k, v] of this.store)
@@ -436,6 +444,7 @@ export class DevDatabase {
             snap.events[k] = log.map((b, i) => ({ v: b.toString('base64'), sv: ver[i] ?? 0 }));
         }
         for (const [k, s] of this.eventDedup) snap.eventDedup[k] = [...s];
+        for (const [k, v] of this.deriveCheckpoints) snap.deriveCheckpoints![k] = v;
         for (const [k, l] of this.capacity)
             snap.capacity[k] = {
                 total: l.total.toString(),
@@ -510,6 +519,8 @@ export class DevDatabase {
         }
         for (const [k, ids] of Object.entries(snap.eventDedup ?? {}))
             this.eventDedup.set(k, new Set(ids));
+        for (const [k, v] of Object.entries(snap.deriveCheckpoints ?? {}))
+            this.deriveCheckpoints.set(k, v);
         for (const [k, l] of Object.entries(snap.capacity ?? {})) {
             const res = new Map<bigint, Reservation>();
             for (const [id, r] of l.reservations)
@@ -539,6 +550,7 @@ export class DevDatabase {
         this.eventVersions.clear();
         this.events.clear();
         this.eventDedup.clear();
+        this.deriveCheckpoints.clear();
         this.capacity.clear();
     }
 
@@ -1207,6 +1219,52 @@ export class DevDatabase {
         return db.lastResult.length;
     }
 
+    // `events.since(handle, keyPtr, keyLen, limit)`: the DERIVE-path incremental read. Returns the next
+    // batch of events for the key PAST this derive's checkpoint, OLDEST first, and advances the cursor. The
+    // advance is STAGED in `db.pendingCheckpoints` (this run only) and committed to the durable
+    // `deriveCheckpoints` after `derive_run` returns (see `commitDeriveCheckpoints`), so a trapped fold
+    // re-reads the batch next run instead of skipping it. Same wire frame as `latest`; empty once caught up.
+    since(
+        ref: MemoryRef,
+        db: DbDevState,
+        handle: number,
+        keyPtr: number,
+        keyLen: number,
+        limit: number,
+    ): number {
+        const coll = collForOp(db, handle, DbOp.EventsSince, CollectionFamily.Events);
+        if (typeof coll === 'number') return coll;
+        const sk = storeKey(coll.name, readKey(ref, keyPtr, keyLen));
+        const ckKey = `${db.deriveId}${sk}`;
+        const log = this.events.get(sk) ?? [];
+        const vers = this.eventVersions.get(sk) ?? [];
+        // Resume from this run's staged cursor if `since` was already called for this key, else the durable
+        // checkpoint, else the start.
+        const cursor = db.pendingCheckpoints.get(ckKey) ?? this.deriveCheckpoints.get(ckKey) ?? 0;
+        const n = Math.max(0, Math.min(limit, 0xffff));
+        const end = Math.min(log.length, cursor + n);
+        const batch = log.slice(cursor, end); // oldest-first
+        const batchVers = vers.slice(cursor, end);
+        db.pendingCheckpoints.set(ckKey, end); // staged; committed only on derive success
+        const w = new DataWriter();
+        w.writeU32(batch.length);
+        for (let i = 0; i < batch.length; i++) {
+            w.writeU32(batchVers[i] ?? 0).writeBytes(batch[i]);
+        }
+        db.lastResult = Buffer.from(w.toBytes());
+        return db.lastResult.length;
+    }
+
+    /** Commit the `events.since` cursor advances a derive run staged in `db.pendingCheckpoints` into the
+     *  durable map. Call ONLY after the fold's `derive_run` returned (its `view.publish`es have landed in
+     *  this.views), so a trapped fold leaves the durable cursor untouched and the next run re-reads the
+     *  batch (publish-then-persist, mirroring the edge `commit_derive_checkpoints`). No-op if none staged. */
+    commitDeriveCheckpoints(db: DbDevState): void {
+        if (db.pendingCheckpoints.size === 0) return;
+        for (const [k, v] of db.pendingCheckpoints) this.deriveCheckpoints.set(k, v);
+        db.pendingCheckpoints.clear();
+    }
+
     // --- capacity family (escrow: set_total / available / reserve / confirm / cancel) ---
 
     // Set the ceiling (restock / reduce). Job/derive only (kind-gated upstream).
@@ -1426,6 +1484,12 @@ export function persistDb(): void {
     devDb.persist();
 }
 
+/** Commit the `events.since` checkpoints a derive run staged in `db.pendingCheckpoints` (call after a
+ *  successful `derive_run`; a trapped fold must NOT reach this). No-op if the run staged none. */
+export function commitDeriveCheckpoints(db: DbDevState): void {
+    devDb.commitDeriveCheckpoints(db);
+}
+
 /**
  * Build the `data.*` host imports for one instance, delegating to the shared
  * {@link devDb}. `db` is the per-request state (handles + result stash); bind a
@@ -1588,6 +1652,8 @@ export function buildDatabaseImports(
 
         'data.latest': (handle: number, keyPtr: number, keyLen: number, limit: number): number =>
             devDb.latest(ref, db, handle, keyPtr, keyLen, limit),
+        'data.events_since': (handle: number, keyPtr: number, keyLen: number, limit: number): number =>
+            devDb.since(ref, db, handle, keyPtr, keyLen, limit),
 
         'data.capacity_set_total': (
             handle: number,

package/src/devserver/db/index.ts

@@ -8,6 +8,7 @@ export {
     __resetDbForTests,
     __setDbCatalogForTests,
     buildDatabaseImports,
+    commitDeriveCheckpoints,
     configureDbPersistence,
     DevDatabase,
     devDb,

package/src/devserver/db/types.ts

@@ -55,6 +55,14 @@ export interface DbDevState {
      *  Only populated for non-Derive dispatches (a derive's own writes must not
      *  re-trigger it - see `database.ts` `recordWrite`). */
     writtenCollections: Set<string>;
+    /** The derive index currently running (set by `runDerive`), so `events.since` keys its resumable
+     *  checkpoint per (derive, source key). 0 outside a derive. */
+    deriveId: number;
+    /** Checkpoint advances `events.since` staged during THIS derive run, keyed `"<deriveId>\0<storeKey>"` ->
+     *  events-folded count. Committed to the durable `deriveCheckpoints` only after the fold's `derive_run`
+     *  returns (its `view.publish`es have landed): a trapped fold discards this overlay, so the next run
+     *  re-reads the batch rather than skipping it (publish-then-persist, mirroring the edge). */
+    pendingCheckpoints: Map<string, number>;
 }
 
 export function freshDbState(): DbDevState {
@@ -64,6 +72,8 @@ export function freshDbState(): DbDevState {
         lastResultVersion: -1,
         functionKind: DbFunctionKind.Job,
         writtenCollections: new Set<string>(),
+        deriveId: 0,
+        pendingCheckpoints: new Map<string, number>(),
     };
 }
 
@@ -95,6 +105,9 @@ export interface DbSnapshot {
     counterIdem?: Record<string, string>;
     events: Record<string, { v: string; sv: number }[]>;
     eventDedup: Record<string, string[]>;
+    /** Durable `events.since` cursors, `"<deriveId>\0<storeKey>"` -> events-folded count, so a restart
+     *  resumes an incremental `@derive` instead of re-folding the whole log onto the persisted view. */
+    deriveCheckpoints?: Record<string, number>;
     capacity: Record<
         string,
         {

package/src/devserver/runtime/module.ts

@@ -14,6 +14,7 @@
 import fs from 'node:fs';
 
 import {
+    commitDeriveCheckpoints,
     DbFunctionKind,
     type DeriveEntry,
     derivesForWrites,
@@ -154,6 +155,7 @@ const PROVIDED_IMPORTS = new Set([
     'data.append_once',
     'data.enqueue',
     'data.latest',
+    'data.events_since',
     'data.capacity_set_total',
     'data.capacity_available',
     'data.capacity_reserve',
@@ -401,11 +403,16 @@ export class WasmServerModule {
         const ref: MemoryRef = { memory: null };
         const state = freshDispatchState();
         state.db.functionKind = DbFunctionKind.Derive;
+        state.db.deriveId = deriveId;
         const instance = new WebAssembly.Instance(this.module, buildHostImports(ref, state));
         const exports = instance.exports as unknown as DeriveExports;
         ref.memory = exports.memory;
         if (typeof exports.derive_run !== 'function') return;
         exports.derive_run(deriveId);
+        // Publish-then-persist: derive_run returned (its `view.publish`es landed synchronously in the dev
+        // store), so commit the `events.since` cursor advances staged this run. A trapped fold throws above
+        // and never reaches here, leaving the durable cursor for a re-read on the next trigger.
+        commitDeriveCheckpoints(state.db);
     }
 
     /** Fail instantiation up front, with names, when the guest needs imports we do not provide. */

package/test/analytics-dev.test.ts

@@ -32,12 +32,13 @@ describe('dev analytics stub v2 frame parity', () => {
         expect(u16()).toBe(2); // FRAME_VERSION
         u64(); // now_ms
         const count = u32();
-        expect(count).toBe(41); // METRIC_COUNTERS
+        expect(count).toBe(43); // METRIC_COUNTERS
         const life: bigint[] = [];
         for (let i = 0; i < count; i++) life.push(i64());
         expect(life[0]).toBe(42n); // Requests
         expect(life[1]).toBe(12345n); // BytesOutL1
         expect(life[12]).toBe(1_000_000n); // GasUsed
+        expect(life[41]).toBe(900n); // CacheHits
         expect(i64()).toBe(3n); // connectedStreams
         expect(i64()).toBe(65536n); // committedMemory
         expect(i64()).toBe(5n); // reqMinuteUsed

package/test/devserver-database.test.ts

@@ -10,6 +10,7 @@ import {
     __resetDbForTests,
     __setDbCatalogForTests,
     buildDatabaseImports,
+    commitDeriveCheckpoints,
     configureDbPersistence,
     derivesForWrites,
     freshDbState,
@@ -637,6 +638,118 @@ describe('toildb dev emulator (record family)', () => {
         expect(buf.readUInt32LE(300)).toBe(0);
     });
 
+    it('events.since: drains oldest-first, stages within a run, commits on success, resumes across runs', () => {
+        const { ref, imports, buf, db } = setup();
+        const h = resolve(imports, buf, 'App/feed');
+        const [kPtr, kLen] = put(buf, 32, 'room1');
+        for (let i = 0; i < 3; i++) {
+            const [eP, eL] = put(buf, 48, `e${String(i)}`);
+            expect(imports['data.append'](h, kPtr, kLen, eP, eL, 0)).toBe(0);
+        }
+
+        // Decode a framed since batch (u32 count, then per-event u32 ver + u32 len + bytes), oldest-first.
+        const drain = (
+            imps: Record<string, (...a: number[]) => number>,
+            total: number,
+            at: number,
+        ): string[] => {
+            expect(imps['data.take_result'](at, 256)).toBe(total);
+            let off = at;
+            const count = buf.readUInt32LE(off);
+            off += 4;
+            const out: string[] = [];
+            for (let i = 0; i < count; i++) {
+                off += 4; // schema_version (0 in dev)
+                const len = buf.readUInt32LE(off);
+                off += 4;
+                out.push(buf.toString('utf8', off, off + len));
+                off += len;
+            }
+            return out;
+        };
+
+        // A derive run drains the log in bounded batches, resuming from the STAGED cursor within the run.
+        db.functionKind = DbFunctionKind.Derive;
+        db.deriveId = 0;
+        expect(drain(imports, imports['data.events_since'](h, kPtr, kLen, 2), 512)).toEqual(['e0', 'e1']);
+        expect(drain(imports, imports['data.events_since'](h, kPtr, kLen, 2), 768)).toEqual(['e2']);
+        expect(drain(imports, imports['data.events_since'](h, kPtr, kLen, 2), 1024)).toEqual([]); // caught up
+
+        // The advance is only STAGED until the fold's derive_run returns; commit persists it.
+        expect(db.pendingCheckpoints.size).toBeGreaterThan(0);
+        commitDeriveCheckpoints(db);
+        expect(db.pendingCheckpoints.size).toBe(0);
+
+        // A fresh derive run (new per-request state, same shared store) resumes PAST the committed cursor:
+        // it re-reads nothing, then folds only a newly appended event.
+        const db2 = freshDbState();
+        db2.functionKind = DbFunctionKind.Derive;
+        db2.deriveId = 0;
+        const imports2 = buildDatabaseImports(ref, db2) as Record<string, (...a: number[]) => number>;
+        const h2 = resolve(imports2, buf, 'App/feed');
+        expect(drain(imports2, imports2['data.events_since'](h2, kPtr, kLen, 10), 512)).toEqual([]);
+        const [e3P, e3L] = put(buf, 48, 'e3');
+        expect(imports2['data.append'](h2, kPtr, kLen, e3P, e3L, 0)).toBe(0);
+        expect(drain(imports2, imports2['data.events_since'](h2, kPtr, kLen, 10), 512)).toEqual(['e3']);
+    });
+
+    it('events.since: a derive run that does not commit leaves the durable cursor unmoved (trap-safety)', () => {
+        const { ref, imports, buf, db } = setup();
+        const h = resolve(imports, buf, 'App/feed');
+        const [kPtr, kLen] = put(buf, 32, 'room1');
+        for (let i = 0; i < 2; i++) {
+            const [eP, eL] = put(buf, 48, `e${String(i)}`);
+            expect(imports['data.append'](h, kPtr, kLen, eP, eL, 0)).toBe(0);
+        }
+        const count = (imps: Record<string, (...a: number[]) => number>, total: number, at: number): number => {
+            expect(imps['data.take_result'](at, 256)).toBe(total);
+            return buf.readUInt32LE(at);
+        };
+
+        // Run 1 drains both events but NEVER commits (simulating a fold that trapped before returning): the
+        // staged advance lives only on this discarded per-request state.
+        db.functionKind = DbFunctionKind.Derive;
+        db.deriveId = 0;
+        expect(count(imports, imports['data.events_since'](h, kPtr, kLen, 10), 512)).toBe(2);
+
+        // Run 2 (fresh per-request state) still sees BOTH events: the durable cursor never moved.
+        const db2 = freshDbState();
+        db2.functionKind = DbFunctionKind.Derive;
+        db2.deriveId = 0;
+        const imports2 = buildDatabaseImports(ref, db2) as Record<string, (...a: number[]) => number>;
+        const h2 = resolve(imports2, buf, 'App/feed');
+        expect(count(imports2, imports2['data.events_since'](h2, kPtr, kLen, 10), 512)).toBe(2);
+    });
+
+    it('__resetDbForTests clears events.since checkpoints (no cross-test cursor leak)', () => {
+        {
+            const { imports, buf, db } = setup();
+            const h = resolve(imports, buf, 'App/feed');
+            const [kPtr, kLen] = put(buf, 32, 'room1');
+            const [eP, eL] = put(buf, 48, 'e0');
+            expect(imports['data.append'](h, kPtr, kLen, eP, eL, 0)).toBe(0);
+            db.functionKind = DbFunctionKind.Derive;
+            db.deriveId = 0;
+            imports['data.events_since'](h, kPtr, kLen, 10);
+            commitDeriveCheckpoints(db); // durable cursor now at 1
+        }
+        __resetDbForTests();
+        {
+            // A brand-new store reusing the same (deriveId, key): the cursor must be back at 0, so a fresh
+            // append is read, not skipped by a stale checkpoint.
+            const { imports, buf, db } = setup();
+            const h = resolve(imports, buf, 'App/feed');
+            const [kPtr, kLen] = put(buf, 32, 'room1');
+            const [eP, eL] = put(buf, 48, 'fresh0');
+            expect(imports['data.append'](h, kPtr, kLen, eP, eL, 0)).toBe(0);
+            db.functionKind = DbFunctionKind.Derive;
+            db.deriveId = 0;
+            const total = imports['data.events_since'](h, kPtr, kLen, 10);
+            expect(imports['data.take_result'](512, 256)).toBe(total);
+            expect(buf.readUInt32LE(512)).toBe(1); // the fresh event, not skipped
+        }
+    });
+
     it('collections are isolated (no key aliasing)', () => {
         const { imports, buf } = setup();
         const users = resolve(imports, buf, 'App/users');

package/docs/auth-todo.md

@@ -1,149 +0,0 @@
-# Auth: production TODO and toildb migration
-
-Tracking doc for finishing the Toil PQ-Auth system (shipped experimental in
-**v0.0.52**). The cryptographic core is in place; what is left is the deployment
-substrate, protocol hardening, and account lifecycle.
-
-> This system is a **hybrid, experimental** password-authenticated login and is **NOT a framework
-> default until externally reviewed** (see Tier 2.8). It is opt-in: a tenant must wire
-> it. The OPRF layer is classical ristretto255 (the one non-PQ piece); auth (ML-DSA-44)
-> and key agreement (ML-KEM-768) are post-quantum.
-
-## What ships today (v0.0.52)
-
-- OPRF keyed salt (RFC 9497 ristretto255-SHA512, mode 0x00, per-user key) -> precomputation resistance.
-- ML-DSA-44 client auth + registration proof-of-possession.
-- ML-KEM-768 mutual auth: client encapsulates to a pinned server key, server returns a confirmation tag.
-- Login enumeration fixed (deterministic per-user salt).
-- Atomic single-use challenge consume (shape is correct; storage is the dev KV, see below).
-
-Key files: `server/globals/auth.ts` (the `AuthService` global), `src/client/auth.ts`
-(browser), `src/devserver/{crypto,kv}.ts` (dev host mocks + dev KV), the Rust edge host
-imports in `toil-backend` (`crypto.mlkem_decapsulate`, `crypto.voprf_evaluate`),
-`examples/basic/server/routes/Auth.ts` (the flow).
-
----
-
-## Tier 1, blocks production (cannot run on the edge yet)
-
-### 1.1 Storage on toildb (THE blocker) -- "when building toildb, consider this"
-The accounts + login challenges live in the **DEV-ONLY** `kv.*` Map
-(`src/devserver/kv.ts`), which is intentionally **not** on the production edge
-(`toil-backend` `HOST_IMPORTS`), so a module importing `kv.*` will not instantiate in
-prod. When toildb lands:
-- **toildb MUST provide an atomic fetch-and-delete** (single-call read+remove). The
-  login challenge consume relies on it; a read-then-delete race makes a login replayable.
-  It also needs `get` and `put`.
-- Migrate **two stores**: `Accounts` (username -> {salt, params, publicKey}) and
-  `Challenges` (cid -> {username, nonce, iat, exp}) in `examples/basic/server/routes/Auth.ts`.
-- Add the toildb host imports to `toil-backend` `HOST_IMPORTS` + `define_*_imports`.
-- Then **delete `src/devserver/kv.ts`**, the `kv.*` entries in `module.ts`
-  `PROVIDED_IMPORTS`, and the `buildKvImports` wiring in `host.ts`. Grep `REMOVE KV LATER`.
-
-### 1.2 Real secrets (not dev placeholders)
-All three must come from the managed env / `getSecure` store, per-deployment, identical
-across edge instances, and rotatable:
-- session HMAC secret (still the `...CHANGE-ME` default in `auth.ts`),
-- OPRF master seed (currently `sha256Text('toil-demo-oprf-seed-v1')`),
-- **server ML-KEM keypair** -- generate a real one per deployment and pin **its** public
-  key in the client (today a fixed demo key is pinned in `src/client/auth.ts`, secret in
-  the example `Auth.ts`).
-
-### 1.3 Rate limiting on the auth routes
-`@ratelimit` exists (`docs/ratelimit.md`) but is not wired onto register/login. Add
-per-username + per-IP throttling with backoff/lockout. Offline resistance is good; online
-guessing + registration spam are currently open.
-
-### 1.4 Production Argon2id params
-Demo uses 32 MiB / 2 iters for tab responsiveness. Raise to >= 256 MiB / >= 3 iters and
-enforce a server-side floor.
-
-### 1.5 Gas calibration (edge metering)
-`MLKEM768_DECAPSULATE` and `VOPRF_EVALUATE` (`toil-backend src/config.rs`) are
-**conservative 12,000,000 placeholders copied from `MLDSA44_VERIFY`, not benchmarked**.
-They are charged correctly (before reads) and DoS-bounded by a test, and over-charge
-(fail-closed safe), but should be calibrated: measure cyc/op via `crypto::bench`,
-multiply by `GAS_PER_CYCLE`, round up ~30%, replace. Same TODO as `MLDSA44_VERIFY` itself.
-
-### 1.6 Real-edge end-to-end
-Never run: a full guest-dispatch through the **running** Rust edge exercising the two new
-imports (only proven at unit + interop-vector level + structurally identical to the
-in-prod `mldsa_verify` import). Do before trusting in prod.
-
----
-
-## Tier 2, protocol hardening
-
-### 2.6 A properly bound session key, DONE (on main, unreleased)
-The session key is now `K = HMAC-SHA256(sharedSecret, SESSION_KEY_LABEL || H(M))` and the
-mutual-auth tag is `HMAC-SHA256(K, SERVER_CONFIRM_LABEL || H(M))` (`AuthService.deriveSessionKey`
-+ `serverConfirmTag`; client mirrors it with hash-wasm `createHMAC`). REMAINING: binding the
-*session cookie* to the transport (so a stolen cookie is useless on another channel) needs
-the TLS exporter, which the wasm guest cannot see, an edge/transport follow-up, not doable
-purely in the guest.
-
-### 2.7 Bind the KDF params + server key into the transcript, DONE (on main, unreleased)
-The single `buildLoginMessage` now binds the ML-KEM ciphertext, the Argon2id params
-(mem/iters/par), and `serverKemKeyId = SHA-256(serverKemPublicKey)`. Closes
-key-substitution and param-downgrade confusion. (There is ONE login message format, no
-versioned variants.)
-
-### 2.8 External cryptographic review (the gate)
-Hand-rolled KEM + signature + OPRF composition with no security proof. Transcript binding
-especially needs a cryptographer. This is a human task; it cannot be self-served. Make it
-tractable: write the wire spec (messages, what each signature/MAC covers, the KDF tree) as
-a reviewable artifact.
-
----
-
-## Tier 3, account lifecycle (missing today)
-
-### 3.1 Password change / key rotation
-Re-derive under a fresh salt while authenticated, re-register the new public key. None
-exists today.
-
-### 3.2 Recovery
-"The password IS the key, no recovery" -> a forgotten password is a permanently dead
-account. Needs recovery codes or a second factor (ties to the 2FA crate already on the
-backend "left to do" list + the existing email support).
-
-### 3.3 Revocation
-No way to kill a compromised credential except deleting the account.
-
-### 3.4 Tighten registration enumeration
-`register/finish` still leaks "taken" via the generic fail after the PoP round.
-
----
-
-## Design decisions (open)
-
-### D1. User id = sha256(public key)? -- CAUTION: breaks under key rotation
-Yes, the public key is still the verifier (`AuthService.verifyLogin` checks the ML-DSA
-signature against the stored public key). `sha256(publicKey)` is a fine **content-addressed
-credential fingerprint** (collision-resistant, re-derivable, good for dedup). BUT:
-- It **cannot be the login lookup key**: at `login/start` the client presents an identifier
-  to fetch the salt + OPRF evaluation *before* it has derived its keypair (it needs the
-  OPRF response to derive the key -> to get the pubkey). So a human-meaningful **handle**
-  (username/email) is still required as the OPRF `info` + the `login/start` lookup key.
-- It is **not stable across password change**: rotating the password changes the pubkey,
-  hence `sha256(pubkey)`. If the user id must survive a password change, it must be a
-  separate stable id (random UUID assigned at registration), with `sha256(pubkey)` treated
-  as the *current credential* fingerprint, not the permanent identity.
-- **Recommendation:** handle (username/email) = login + OPRF info; permanent userId =
-  random id at registration; `sha256(pubkey)` = credential fingerprint (verifiable, for
-  dedup / "is this the same key"). Revisit only if password rotation is ruled out.
-
-### D2. OPRF mode vs VOPRF/DLEQ
-Plain OPRF mode by design (server auth comes from the ML-KEM layer). Add
-DLEQ only if the client must verify OPRF-key consistency. Likely unnecessary.
-
-### D3. Multi-device / WebAuthn-style per-device keys
-One-key-per-user (deterministic from password) is fine unless hardware-backed or per-device
-keys are wanted later; that needs a credential-set model.
-
----
-
-## Suggested sequence
-toildb storage (1.1) -> real secrets + real pinned KEM key (1.2) -> rate limiting (1.3) ->
-HKDF session key (2.6) + transcript binding (2.7) -> external review (2.8) -> lifecycle
-(3.1-3.3). 1.1-1.3 turn the demo into something deployable; 2.8 makes it trustworthy.