Force poly1305's soft backend: 424 intrinsics were reaching the binary

.cargo/config.toml

@@ -48,5 +48,41 @@
 #
 # Read by curve25519-dalek's build.rs via CARGO_CFG_CURVE25519_DALEK_BACKEND.
 # Verify: cargo build -p encryption -v 2>&1 | grep curve25519_dalek_backend
+
+# poly1305 backend: SOFT, deliberately. Same reasoning as dalek above, but
+# unlike dalek this surface was actually REACHING THE BINARY.
+#
+# `crates/encryption` -> `chacha20poly1305` -> `poly1305`, and poly1305 0.8
+# auto-selects its AVX2 backend on any x86/x86_64 target unless told otherwise.
+# That backend is 424 `_mm*` intrinsic calls under 30 `unsafe` occurrences in a
+# single file (`src/backend/avx2/helpers.rs`) — over seven times dalek's 57, and
+# a second unaudited SIMD surface beside `ndarray::simd`, which is what the
+# matryoshka pattern exists to prevent.
+#
+# Reachability, not porting: the whole thing is gated behind one cfg —
+# `src/backend.rs`, `#[cfg(all(any(target_arch = "x86", target_arch = "x86_64"),
+# not(poly1305_force_soft)))] pub(crate) mod avx2;` — so the flag below compiles
+# it out without touching a line of crypto.
+#
+# What it costs: the soft backend (poly1305-donna, the same algorithm) instead
+# of the AVX2 one, on the AEAD's MAC. That is a real throughput cost on large
+# payloads and it has NOT been measured here. It is accepted because the
+# alternative is an unaudited intrinsic surface in the crypto path.
+#
+# What it does NOT mean: writing our own Poly1305. Per the operator-ratified
+# doctrine in `.claude/CHACHA20_MATRYOSHKA_PLAN.md` — "RustCrypto owns the
+# algorithm; ndarray owns the SIMD... Rolling your own AEAD (HChaCha20 +
+# Poly1305 + framing) is the footgun; it is forbidden." The sanctioned way to
+# accelerate this later is the chacha20 route: vendor the fork and give
+# RustCrypto's own backend an `ndarray::simd` lane, never a reimplementation.
+#
+# Read by poly1305's src/backend.rs as a plain cfg.
+# Verify: cargo build -p encryption -v 2>&1 | grep poly1305_force_soft
 [target.'cfg(target_arch = "x86_64")']
-rustflags = ["-Ctarget-cpu=x86-64-v3", "--cfg", "curve25519_dalek_backend=\"serial\""]
+rustflags = [
+    "-Ctarget-cpu=x86-64-v3",
+    "--cfg",
+    "curve25519_dalek_backend=\"serial\"",
+    "--cfg",
+    "poly1305_force_soft",
+]