Fix the second review of the origin changes

Stop now counts the origin changes inside a running write, in a new
writingOriginChanges field, and adds them to the count it logs. The prune test
checks which rows survive, including a prefix with rows on both sides of 72
hours. The prefix page tests cover 5,000 and 5,001 rows and a row's time and
peer count. New tests cover the dropped-rows warning and the dropped count's
reset. The prune floor is named minOriginChangesPerPrefix. The README, TODO,
package doc and doc comments are corrected to match.

Model: deepseek-v4-pro

internal/routetable/originchanges_test.go

@@ -206,6 +206,33 @@ func TestOriginChangesDropPastTheLimit(t *testing.T) {
 	}
 }
 
+// TestOriginChangesTakeResetsTheDroppedCount checks that a TakeOriginChanges
+// that reports dropped rows leaves the next one reporting none, so each drop
+// is logged once, not on every later write.
+func TestOriginChangesTakeResetsTheDroppedCount(t *testing.T) {
+	t.Parallel()
+
+	const limit = 100000
+
+	table := routetable.New(routetable.Params{})
+	addr := netip.MustParseAddr("10.0.0.0")
+
+	for range limit + 1 {
+		table.Announce(netip.PrefixFrom(addr, 32), asA, routeOf(peerA, asA, 10))
+		addr = addr.Next()
+	}
+
+	_, dropped := table.TakeOriginChanges(limit)
+	if dropped != 1 {
+		t.Fatalf("dropped = %d, want 1", dropped)
+	}
+
+	_, dropped = table.TakeOriginChanges(0)
+	if dropped != 0 {
+		t.Errorf("the next take's dropped = %d, want 0", dropped)
+	}
+}
+
 // TestOriginChangesPutBackTrimsToTheLimit checks that putting back what a
 // failed write took, after new changes filled the table again, drops the
 // oldest changes past the cap and counts them, so the cap still holds. The

internal/routetable/routetable.go

@@ -287,8 +287,9 @@ func (t *Table) PeersDown(peers []string) {
 // Load puts one prefix and origin AS pair that the database holds into the
 // table, as startup does with each row it reads. The change's peers join the
 // pair's peer set, and its routes are kept as an announcement's would be.
-// Unlike an update, Load records no change, so TakeChanges does not hand the
-// pair back to be written again. Loading a pair twice changes nothing.
+// Unlike an update, Load records no change and no origin change, so
+// TakeChanges does not hand the pair back to be written again. Loading a pair
+// twice changes nothing.
 //
 // The caller makes sure that every peer change names, in its peer set or in
 // its routes, has a number in Params.PeerNumbers.
@@ -479,6 +480,7 @@ func (t *Table) removeOrigin(prefix netip.Prefix, o *origin) {
 // r in full when it is one of the two newest routes of o. The peer's earlier
 // route, if o keeps one, is replaced: it is no longer the peer's current route.
 // The pair is recorded as changed only when its peer set or kept routes change.
+// When r is the origin's first peer, an announced origin change is recorded.
 func (t *Table) join(prefix netip.Prefix, o *origin, r route) {
 	if slices.ContainsFunc(o.routes, r.equal) {
 		// The peer announced its kept route again.
@@ -565,7 +567,8 @@ func (t *Table) dropKeptRoute(o *origin, peer uint) bool {
 // recordChange records that the pair of prefix and the AS of o changed, and
 // brings the count of origins without a kept route up to date.
 // wasWithoutKeptRoute says whether o was such an origin before the change. An
-// origin that no peer carries any more is removed.
+// origin that no peer carries any more is removed, and a withdrawn origin
+// change is recorded.
 func (t *Table) recordChange(
 	prefix netip.Prefix, o *origin, wasWithoutKeptRoute bool,
 ) {