* fix(xhttp): suppress inherited SNI inside the carrier
Retain the hop identity for certificate verification while restoring the absent default wire SNI for inner protocols. Extend the TLS identity matrix through the XHTTP builder to cover omitted, null, and explicit SNI.
* fix(vision): keep the initial prefix in one TLS record
Floor configured Vision client TLS buffers at 21 bytes so peers receive the UUID and first frame header together. Preserve ordinary TLS limits and cover tiny buffers with record-level assertions, UDP exchanges, and sing-box/Xray peer tests.
* fix(tls): drain deferred KeyUpdate replies before Vision writes
Materialize pending KeyUpdate replies before draining TLS output so they cannot fragment the initial Vision prefix. Preserve queued application data and fatal alerts after session failure, with framing and backpressure regressions.
* refactor(tls): clarify identity and Vision regression tests
Replace positional identity-path flags with a test-local enum, use the existing message shutdown helper, and document the XHTTP inner SNI boundary. Preserve test coverage and production behavior.
* ci: pin Xray test peers to 26.10.31
Replace the unavailable release download with the latest release and its verified checksum. Align source-built peers and fixture version checks with the same release.
Adds an outermost sudoku_mask wrapper so TCP clients and servers can interoperate with Xray FinalMask, including configurable layouts and padding, stacked masks, and XHTTP carriers. Preserves explicit flush ownership and prevents Vision or raw TCP splice from bypassing the mask, with configuration validation and documentation for supported placements and limits. Native UDP/QUIC masking is not included.
XHTTP required-header support still carried leftovers from its earlier connection-closing design. This removes `close_on_http1_error` entirely (configs that set it now fail to load), so header and path mismatches return the same plain 404 on every HTTP version, and makes every XHTTP error response a bare status with an empty body. `matching_headers` values can now be lists so secrets can rotate without downtime, and client `headers` now reject names that differ only in case and values with leading or trailing whitespace, neither of which could ever match. Redundant H2/H3 reset handling is removed while the ordering and H3 upload-reset handling that prevent session closures and held request slots are kept, documented and covered by a regression test; new interop tests cover Xray and Mihomo clients sending required headers, and the README explains that Xray clients using `extra` must put `headers` inside it.
Prevent TUN startup resets and orphaned connections by deferring inbound TCP publication until handshakes complete, bounding half-open admission, and propagating worker failures while preserving Linux link-down and Apple queue-backpressure recovery. Fix Naive HTTP/2 writes that stall despite available credit and improve transfer diagnostics. Preserve full-payload and clean-EOF Mihomo REALITY coverage with reply-first sequencing, retaining early half-close as an opt-in peer regression. Upgrade Xray test peers to the 26.10.21 security release after upstream withdrew the previous releases.
Expand legacy and encrypted VLESS coverage across peer transports, Vision transitions, session lifecycle, replay isolation, and chained connections, with Xray updated to 26.10.17. Preserve complete XHTTP HTTP/2 responses when peers gracefully stop an unfinished upload while continuing to reject truncated responses and incomplete packet uploads. Isolate the pinned sing-box server TLS 1.2 shutdown limitation in a test-only workaround, retaining an ignored reproducer and a reference to SagerNet/sing-vmess#16 for removal when the peer pin includes the fix.
Improve XHTTP transfer reliability under slow destinations and resource pressure with bounded packet pipelining, admission before body reads, queue-acceptance acknowledgements, and cancellation-safe session handling. Preserve reusable H1 uploads, correct H2/H3 finalization, add configurable receive windows and download-tail timeouts, validate effective request capacity, and expand Xray/Mihomo interoperability coverage with pinned peers in CI.
cfal