[dormancygrace]

Browser-originated WebSocket frames use Gorilla's generic word-at-a-time masking loop. Add a C906 path that keeps 0–7 bytes in Go, handles 8–127 bytes with scalar assembly, and uses XTheadVector from 128 bytes while preserving phase and exact buffer bounds.

The server builder stages the pinned Gorilla v1.5.3 package under its output and uses a private modfile. The shared module cache stays intact; the build verifies the linked assembly and records its source hashes. Runtime checks require XTheadVector, enabled vector state and fast misaligned accesses, with an explicit generic control.

Validation on SG2002/C906, Ethernet and video enabled, three processes with three repetitions and medians:

• Actual package masking: 21.6–32.2% less CPU when streaming 1400 B–1 MiB buffers; larger gains for repeated cached buffers.
• In-memory ReadMessage, including allocations and GC: 1.96–9.37% less process CPU for 16 B–256 KiB payloads; every case improved in all three processes. This is not a network/USB throughput or FPS claim.
• Full Gorilla suite passed on the device in automatic and generic modes, including 104,184 comparison cases, 2,272 guard-page cases, thread stress and a rejected corruption control.
• Production server cross-build, linked vector-instruction check, host/default and purego Gorilla tests, storage/stream/ws tests, RISC-V vet and staging tests passed.

CI checks the generated instructions, module staging, fallback tests and target test compilation. The test-only CONNECT fixture uses a real tunnel for Go 1.27, and prepared-message tests retain their intended deterministic seeds; no assertions were removed.

Methodology, process medians and qualification hashes are in firmware/cpu/go-websocket-c906/. Memory clearing remains a separate investigation and is not changed by this PR.

[github-actions]

Build outputs

Compared with the build of main at c93fb1a.

1 changed, 0 added, 0 removed of 570 outputs.

	directory	files
changed	server	server/NanoKVM-Server
Hashes: outputs-sha256 artifact of this run.