Specter v3.5.1 — pooled randomness, deadline hygiene

Wire unchanged: mixes freely with v3.2–v3.5. No deploy strictly needed over v3.5.0 (same wire, same behavior on the fast path).

• Pooled CSPRNG: one 64KB kernel read sliced per record instead of 1–2 getrandom syscalls each — bulk throughput up ~10–20%
• Deadline discipline: writers are write-only (SetWriteDeadline), so a future short read deadline can never hang a sibling pump; documented in code
• Debug record counters (recs/payload per session/trunk) for performance work
• Reverted an experimental 2ms send-batcher: measured zero bulk gain (reads arrive full) against a proven +4ms trickle tax

Specter v3.5.0 — trunk health + flow control

Wire still 0x03/0x04, fully interoperable with v3.4 (and v3.2/v3.3 for legacy paths).

Trunk health: idle trunks PING every 25s (NAT survival); client tracks RTT (EMA/min/last, per-minute info summary, last-RTT attached to trunk-death warns). Permanent built-in answer to proxy-vs-path questions.

Flow control: per-stream 1MB start, 64KB grants as receivers consume. Bulk no longer starves sibling streams. Gated on first WINDOW_UPDATE: old peers never send one, so mixed versions behave exactly as before — verified bulk + interactive-share tests green.

Specter v3.4.0 — mux, dial racing, UDP ACKs

Wire: 0x03 legacy + 0x04 mux (same crypto). Old clients, mux=off, and Python legacy all interoperate.

Mux (TCP legs): one trunk carries all streams; handshake once per trunk. Client mux on|off|auto (config.json + SPECTER_MUX, default auto); server SPECTER_MUX on|off (default on, off enforces legacy). Auto negotiates via version byte with transparent fallback + negative caching. UDP stays single-stream (mux=on + udp refuses loudly).

Reliability: target dials race all resolved IPs (250ms stagger, IPv4-first); UDP first flight selectively acked (cumul+SACK, delayed+gap-triggered) with client resend up to ~3s.

E2E: 20 parallel + 15x6.5MB on one trunk, legacy/fallback/UDP/Python matrix green, loopback UDP p50 ~1.5ms.

Specter v3.3.1 — access log + hygiene

Wire unchanged (0x03): mixes freely with v3.2/v3.3. No deploy needed over v3.3 server.

• Client access log, always on: from accepted //host:port [socks -> proxy], microsecond timestamps
• appVersion const: version bump is one line per binary now (wire version separate, changes only on protocol breaks)
• raceLegs drain goroutines touch no shared state (was a -race violation; verified clean)
• Dropped the relayTCPNoReply wrapper lie; documented optimistic SOCKS reply semantics

Specter v3.3.0 — observability

Wire unchanged (0x03): v3.3 servers work with v3.2 clients, and vice versa.

Logging (SPECTER_LOG=error|warn|info|debug, default warn; no keys ever logged):

• warn: target dial failures + slow dials (>2s) with target host (where user -1s/spikes come from), client handshake failures with hints (wrong PSK? UDP blocked?), maxConns drops
• info: 5-min counters (tcp accept/drop/hs/dial, udp hello/dial/done, orphan drained/expired); SPECTER_STATS_SEC overrides interval
• debug: handshake rejects, hello retries/dups, relay ends, orphan drains; scanner noise rate-limited (1/5s + suppressed count) so the port still looks dead
• server startup line now logs version/listen/mode; UDP-only mode starts sweepers correctly

Specter v3.2.0 — browsing latency

Browsing-TTFB release, wire 0x03 unchanged (compatible with v3.1.x).

• Early SOCKS reply overlaps browser TLS with Specter handshake (~1 RTT saved per connection)
• Small-first size classes for first 4KB (320B TCP / 576B UDP), random after
• UDP hello retry 1s to 150ms, gap-skip 300-500ms to 100ms
• Per-connection AEAD reuse, single rand.Read for nonce+pad, TCP_NODELAY+keepalive
• Server O(1) UDP session lookup, DNS cache (60s, timeout ctx), UDP pacing default 40 to 100 Mbps + 64KB interactive bypass
• Client transport pinning: race once, reuse winner 5min (auto no longer races every connection)
• Fix: server DNS crash on domain requests (nil context)
• Fix: UDP 0-RTT early-data orphan queue replaces grace sleep (removes +20ms floor/jitter per fresh connection, no drop on slow dials)

E2E localhost: TCP p50 1.7ms max 3.7ms; UDP p50 1.6ms max 4.4ms (was 21.9ms floor); 20x parallel clean.

Specter v3.1.0 — auto transport race

Transport auto mode (TCP+UDP Happy-Eyeballs race per connection), variable record size classes, TCP 0-RTT combine, UDP sk0 early-data, pinned tcp/udp/both server gate. Backward-incompatible with v3.0.0 (wire 0x03).

Specter v3.0.0 — forward secrecy

X25519 ephemeral key exchange both sides + HKDF-SHA256 session keys. PSK is salt/auth only. AEAD cells, dynamic magic, replay cache, UDP sessions. Backward-incompatible with v2 (wire 0x02).

Specter v2.0.0

Hardened v2 wire (AEAD cells, dynamic magic, replay cache) + Go client (tcp/udp) for all platforms. First run writes a dummy config.json — fill in server details.