v1.8.0 — audit release

v1.8.0 — audit release

Full-repo audit: eight code defects fixed, stale and contradictory documentation corrected, README deduplicated. No change to encryption parameters, the KDF floor, or the verification gate. All scripts pass bash -n + shellcheck -S warning; the sed and awk fixes were verified against real LUKS2 headers.

Fixed

• luks-deploy.sh: the splash strip missed rhgb/quiet at the start of a line or just inside the opening quote of GRUB_CMDLINE_LINUX; "GRUB config rebuilt" was printed even when grub2-mkconfig failed; an initramfs whose name yields no parseable kernel version could pass the cryptsetup gate silently (now an error); a typo at the KDF profile menu aborted the whole run — it re-prompts.
• luks-tune.sh: pbkdf2 keyslots were invisible to the menu — the exact slots the README tells you to convert. They are now listed (- for memory/threads) and convertible to argon2id like any other slot.
• post-encryption-setup.sh: the splash marker is kept when the grubby restore fails, so a re-run can retry; the "is root encrypted" check now inspects root's own mapper (the btrfs [/subvol] suffix silently broke cryptsetup status before); the initramfs check matches cryptsetup/dm-crypt instead of any string containing "crypt"; unknown arguments are refused instead of ignored.
• save-luks-recovery-bundle.sh: the backing-device parse truncated device names containing -; it now takes cryptsetup status's device: line verbatim.

Changed

• ESP stub guard caps drifted-copy forensics at the 5 newest .broken.* files; the stale-EFI cleaner also removes inactive (un-starred) entries; luks-fetch-cache.service dropped its unused [Install] section (could double-run the sweep at boot); the deploy prints LUKS2-format header fields and logs the KDF parameters the recovery keyslot is enrolled with.

Documentation

• INSTALL: removed the false "there is no recovery key" claim — the deploy offers one, default yes; unlock-time figures now match the README (2.1 / 3.8 / 9.5 s); the prompt table is in true runtime order and gains the missing unmount prompt.
• The last two retracted "1 GiB hard GRUB ceiling" claims (extras) now carry the measured position: the ceiling is the firmware's — 2 GiB works under U-Boot on an M2 Max, 4 GiB never, 1 GiB stays the portable default.
• BOOT-ENCRYPTION-DESIGN reconciled with its own probe results (stale "open questions" resolved or reframed; keyfile size settled at 4096 bytes); the 2026-08-23 probe postmortem is marked superseded.
• CONTRIBUTING: GRUB 2.14 build path now matches the probes' GRUB_PREFIX default; loopback pass counts explained for stage-5b SKIPs. LIVE-USB: caveat that Fedora's GRUB_DISABLE_OS_PROBER=true can hide Method A's USB entry.
• README: the two duplicate "change your KDF" sections merged into one canonical section with all four tiers and the strength graph (the FAQ entry is now a pointer); the stranded fleet-pinning paragraphs moved next to the KDF pinning they refer to; strength figures made self-consistent (28 years / ten days at 40 bits); broken fragments and grammar fixed; BOOT-ENCRYPTION-DESIGN added to the docs table.