Rollup release covering builds 130 → 134 since v1.0-build129. Headline
is elimination of the SRTP-path silent extension restart pattern that
was killing 5+ extensions over ~5 days on builds 124-129. Confirmed
2026-05-24 via AssistiveTouch sysdiagnose + PowerLog SQL query on
PLProcessMonitorAgent_EventPoint_ProcessExit as JETSAM_REASON_MEMORY_
PERPROCESSLIMIT (RC=7 NS=1) — per-process-limit jetsam doesn't generate
.ips files, which is why earlier debugging mis-attributed them to
"RunningBoard reclaim". Validated 2026-05-25: 0 jetsam events in 13h50m
post-build-133 window vs 4 in the 39h pre-deploy window.
Build 130 — GOMEMLIMIT 35MB + reusable timer in probe polling.
Lowered debug.SetMemoryLimit from 40 → 35 MB in bridge.go to give Go
GC a tighter budget under sustained load. Also replaced
time.After(100ms) per-iteration timer creation in both DTLS+WG and
SRTP active-probe-on-wake polling loops with a single reusable
time.NewTimer + Reset pattern — reduces transient goroutine bursts
during wake events (open_improvement_wake_goroutine_burst.md fix B).
Build 131 — periodic debug.FreeOSMemory every 60s. bridge.go
goroutine wakes once a minute and calls FreeOSMemory to mark idle heap
pages as MADV_FREE'able faster than Go's default lazy scavenger. Helps
keep heap-released growing as headroom for spike absorption.
Build 132 — startLogWriter race fix. Previous startLogWriter silently
dropped log messages when logFilePath was empty (race between writer
goroutine scheduling and wgSetLogFilePath call from Swift). Build 132
buffers init()-time logs locally until path set, then flushes. GOMEMLIMIT
- FreeOSMemory log lines now reliably appear in vpn.log. (Also tried
GODEBUG=madvdontneed=1 but reverted same day — confirmed Linux-only
knob, no-op on Darwin.)
Build 133 — sync.Pool for per-packet byte slices. THIS IS THE FIX
that closes the jetsam regression. Added pktPool + pktPoolGet +
pktPoolPut helpers in pkg/proxy/srtpwrap/srtp.go and wired them into
both demux paths (Server.demux + runDemuxFromPacketConn) plus
wrappedConn.Read after decrypt. Mirror change in proxy.go for the 3
runSRTPSession recv goroutine sites (DTLS, Direct, SRTP) + ReceivePacket
consumer-side Put. ~2400 packets/sec under speedtest load × ~5 MB/sec
garbage per hand-off path eliminated. heap-objects spike under load now
absorbed by pool buffer reuse → sys stays flat instead of forcing new
mmap.
Empirical 13.5h+ soak after deploy (vpn.wifi-lte-wifi.2.log):
- Sys: progressive plateau 17 → 41.8 MB through 6 step-ups under load
(last at 20:51 under heaviest speedtest), then dead-flat 41.8 MB for
the remaining 11+ hours. - Margin to jetsam ceiling: ~8 MB stable.
- 0 silent restarts, 0 panics, 0 ForceReconnect.
- 5 speedtests, 244 wake/sleep cycles, 2 WiFi↔LTE transitions handled.
Build 134 — presharedKey Optional in ConnectionSettings. WireGuard
PSK is itself optional in the protocol — deployments without one
shouldn't be forced to provide a value in Connection Link payloads.
ConnectionSettings.presharedKey: String → String?. Nil-preserves-default
semantics in BackupManager.applyConnectionLink mirrors the build 129
pattern for useDTLS/useWrap/wrapKeyHex. AppSettings.presharedKey
(full-backup path) stays required — currentConfig() always populates it.
quick_link.py at the repo root: presharedKey moved out of REQUIRED tuple
into the optional section. New validate() check rejects literal
"REPLACE_ME" in any optional field — prevents accidentally embedding
the placeholder when admin forgot to either set a real value or delete
the key line. Compat: links generated by build 134's quick_link.py
omitting presharedKey require build 134+ on the importing device (older
Swift Codable rejects missing field). Links carrying presharedKey work
on both eras.
Server side: vk-turn-proxy anton48/add-server-srtp-layer branch has
matching sync.Pool in server/srtpwrap/srtp.go for defensive GC efficiency
(no jetsam pressure server-side).