- Added alternate Let’s Encrypt ISRG Root X1 for TLS fallback and noted the requirement to run as root
- Fixed tstun packet looping and ensured state directory permissions are set to 0700
- Enabled SOCKS5 proxy for userspace tun networking and ignored iOS IPsec link monitor events to prevent wake‑ups