v1.6.0 — KDF floor hardening + encrypted-/boot research (gated)

Security fix — the fast profile was weaker than doing nothing

fast shipped 1 GiB × 4 through v1.5.0. cryptsetup's own default is argon2id at 1 GiB with iterations auto-tuned to --iter-time (2000 ms) — measured at t=8 on an M2 Max. So fast was exactly half the work of a plain luksFormat with no arguments, while the README claimed every profile beat stock.

• fast → 1 GiB × 9, and it is now a hard floor. LUKS_PBKDF_ACK_WEAK is removed — there is no override. The floor tests two conditions because they fail differently: memory below 1 GiB loses memory-hardness, and total work below fast is cheaper per guess however the factors are traded.
• moderate → 2 GiB × 8, restoring separation from fast.
• New runtime guard. Before formatting, the installer reads what cryptsetup would choose unaided on that machine and refuses to ship weaker: a named profile below the bar is raised to 25% past it; pinned LUKS_PBKDF_* below it is fatal. The benchmark is sampled and the lowest reading wins, because it is load-sensitive and the errors are asymmetric.
• The pre-flight summary now prints the measured multiple: = 2x the work of cryptsetup's own default here.

Profile	Memory	Iterations	Unlock, M2 Max	vs stock
aggressive	4 GiB	10	9.5 s (measured)	5x
moderate (default)	2 GiB	8	~3.8 s	2x
fast	1 GiB	9	~2.1 s	1.125x

Encrypted /boot — research published, still gated

Not shipped, not enabled, no flag. Every released version encrypts root only. Lifting the gate will be a major bump.

docs/BOOT-ENCRYPTION-STATUS.md is a laboratory notebook of what has been measured on real hardware, what broke, and what is still unknown. Highlights from an M2 Max running GRUB 2.14 under U-Boot:

• argon2id allocates and decrypts at 512 / 1024 / 2048 MiB. The familiar "GRUB caps at 1 GiB" is an artefact of x86 vendor UEFI leaving GRUB a constrained heap — not a GRUB limit. The only unconditional rule is the u32 overflow at exactly 4 GiB.
• GRUB's argon2 is 8.5× slower than the kernel's for identical work — 9.5 s in the initramfs versus ~80 s in GRUB — and linear at ~2.0 s per GiB-pass. Encrypted /boot would cost ~20 s at every boot, minimum.
• 2 GiB × 20 hard-resets the machine, reproducibly, with no output. It allocates exactly what 2 GiB × 10 allocates, so the cause is time, not size: a wall between 40 s and 80 s of uninterrupted computation.
• save_env to the FAT ESP returns success and writes nothing.

Contributions wanted — especially probe results from other Apple Silicon Macs, and a base M1 in particular. tools/boot-probe/ carries the harness; it builds throwaway LUKS containers holding nothing, chainloads a self-contained image, and leaves the installed bootloader alone. Open questions are listed at the end of the status doc.