diff --git a/veilid-core/src/dht/crypto.rs b/veilid-core/src/dht/crypto.rs
index 59840591..0ddb8ad5 100644
--- a/veilid-core/src/dht/crypto.rs
+++ b/veilid-core/src/dht/crypto.rs
@@ -283,9 +283,20 @@ impl Crypto {
         cipher.apply_keystream(body);
     }
 
+    pub fn crypt_b2b_no_auth(
+        in_buf: &[u8],
+        nonce: &Nonce,
+        shared_secret: &SharedSecret,
+    ) -> Vec<u8> {
+        let mut cipher = XChaCha20::new(shared_secret.into(), nonce.into());
+        // Allocate uninitialized memory, aligned to 8 byte boundary because capnp is faster this way
+        // and the Vec returned here will be used to hold decrypted rpc messages
+        let mut out_buf = unsafe { aligned_8_u8_vec_uninit(in_buf.len()) };
+        cipher.apply_keystream_b2b(in_buf, &mut out_buf).unwrap();
+        out_buf
+    }
+
     pub fn crypt_no_auth(body: &[u8], nonce: &Nonce, shared_secret: &SharedSecret) -> Vec<u8> {
-        let mut out = body.to_vec();
-        Self::crypt_in_place_no_auth(&mut out, nonce, shared_secret);
-        out
+        Self::crypt_b2b_no_auth(body, nonce, shared_secret)
     }
 }
diff --git a/veilid-core/src/network_manager/native/protocol/ws.rs b/veilid-core/src/network_manager/native/protocol/ws.rs
index 4f78fda0..753e716a 100644
--- a/veilid-core/src/network_manager/native/protocol/ws.rs
+++ b/veilid-core/src/network_manager/native/protocol/ws.rs
@@ -78,6 +78,9 @@ where
     pub async fn recv(&self) -> Result<Vec<u8>, String> {
         let out = match self.stream.clone().next().await {
             Some(Ok(Message::Binary(v))) => v,
+            Some(Ok(Message::Close(e))) => {
+                return Err(format!("WS connection closed: {:?}", e));
+            }
             Some(Ok(x)) => {
                 return Err(format!("Unexpected WS message type: {:?}", x));
             }
diff --git a/veilid-core/src/rpc_processor/debug.rs b/veilid-core/src/rpc_processor/debug.rs
index 29c4f637..5a294cab 100644
--- a/veilid-core/src/rpc_processor/debug.rs
+++ b/veilid-core/src/rpc_processor/debug.rs
@@ -24,6 +24,7 @@ pub fn rpc_error_protocol<T: AsRef<str>>(x: T) -> RPCError {
 }
 pub fn rpc_error_capnp_error(e: capnp::Error) -> RPCError {
     error!("RPCError Protocol: capnp error: {}", &e.description);
+    panic!("wtf");
     RPCError::Protocol(e.description)
 }
 pub fn rpc_error_capnp_notinschema(e: capnp::NotInSchema) -> RPCError {
diff --git a/veilid-core/src/rpc_processor/mod.rs b/veilid-core/src/rpc_processor/mod.rs
index d03b4cd4..8ac1af56 100644
--- a/veilid-core/src/rpc_processor/mod.rs
+++ b/veilid-core/src/rpc_processor/mod.rs
@@ -83,9 +83,9 @@ struct RPCMessageHeader {
     peer_noderef: NodeRef, // ensures node doesn't get evicted from routing table until we're done with it
 }
 
-#[derive(Debug, Clone)]
+#[derive(Debug)]
 struct RPCMessageData {
-    contents: Vec<u8>, // rpc messages must be a canonicalized single segment
+    contents: Vec<u8>,  // rpc messages must be a canonicalized single segment
 }
 
 impl ReaderSegments for RPCMessageData {
diff --git a/veilid-core/src/xx/tools.rs b/veilid-core/src/xx/tools.rs
index dbaca60e..05f17335 100644
--- a/veilid-core/src/xx/tools.rs
+++ b/veilid-core/src/xx/tools.rs
@@ -235,3 +235,20 @@ cfg_if::cfg_if! {
         }
     }
 }
+
+#[repr(C, align(8))]
+struct AlignToEight([u8; 8]);
+
+pub unsafe fn aligned_8_u8_vec_uninit(n_bytes: usize) -> Vec<u8> {
+    let n_units = (n_bytes + mem::size_of::<AlignToEight>() - 1) / mem::size_of::<AlignToEight>();
+    let mut aligned: Vec<AlignToEight> = Vec::with_capacity(n_units);
+    let ptr = aligned.as_mut_ptr();
+    let cap_units = aligned.capacity();
+    mem::forget(aligned);
+
+    Vec::from_raw_parts(
+        ptr as *mut u8,
+        n_bytes,
+        cap_units * mem::size_of::<AlignToEight>(),
+    )
+}
diff --git a/veilid-flutter/example/web/wasm b/veilid-flutter/example/web/wasm
index 75fb9e0b..7003bcf7 120000
--- a/veilid-flutter/example/web/wasm
+++ b/veilid-flutter/example/web/wasm
@@ -1 +1 @@
-../../../target/wasm32-unknown-unknown/release/pkg
\ No newline at end of file
+../../../target/wasm32-unknown-unknown/debug/pkg
\ No newline at end of file
diff --git a/veilid-wasm/wasm_build.sh b/veilid-wasm/wasm_build.sh
index 7d6b9978..9aa3cbf8 100755
--- a/veilid-wasm/wasm_build.sh
+++ b/veilid-wasm/wasm_build.sh
@@ -23,7 +23,7 @@ if [[ "$1" == "debug" ]]; then
     mkdir -p $OUTPUTDIR
     wasm-bindgen --out-dir $OUTPUTDIR --target web --no-typescript --keep-debug --debug $INPUTDIR/veilid_wasm.wasm
     ./wasm-sourcemap.py $OUTPUTDIR/veilid_wasm_bg.wasm -o $OUTPUTDIR/veilid_wasm_bg.wasm.map --dwarfdump $DWARFDUMP
-    wasm-strip $OUTPUTDIR/veilid_wasm_bg.wasm
+    # wasm-strip $OUTPUTDIR/veilid_wasm_bg.wasm
 else
     OUTPUTDIR=../target/wasm32-unknown-unknown/release/pkg
     INPUTDIR=../target/wasm32-unknown-unknown/release