Fix the origin-changes review findings

Hold the 100,000-row cap after a failed write's rows are put back, dropping and counting the oldest rows past it. Stop counts the unwritten origin changes. The prefix handler's per-write origin change limit is a field, so a test checks that one write leaves the rest. The server and README now say where origin changes come from. README, TODO and schema say 72 hours or 500 rows, whichever keeps more. The prefix page and TODO list the origin change columns and say what the peer count counts. The page takes its 5,000-row note from the constant.

Model: deepseek-v4-pro

internal/routetable/originchanges.go

@@ -7,7 +7,8 @@ import (
 )
 
 // maxWaitingOriginChanges is the most origin changes the table keeps waiting
-// for the prefix handler to write. A change past it is dropped and counted.
+// for the prefix handler to write. The oldest change past it is dropped and
+// counted.
 const maxWaitingOriginChanges = 100000
 
 // OriginChange is one change of a prefix and origin AS pair: the origin AS
@@ -39,13 +40,8 @@ func (t *Table) recordOriginChange(
 		Time:      t.now(),
 	}
 
-	if len(t.originChanges) == maxWaitingOriginChanges {
-		// The oldest change is dropped to make room.
-		t.originChanges = t.originChanges[1:]
-		t.originChangesDropped++
-	}
-
 	t.originChanges = append(t.originChanges, change)
+	t.trimOriginChanges()
 }
 
 // TakeOriginChanges returns at most limit of the origin changes that wait to
@@ -67,12 +63,31 @@ func (t *Table) TakeOriginChanges(limit int) ([]OriginChange, int) {
 
 // PutBackOriginChanges records again what one TakeOriginChanges call returned,
 // for a caller that could not write it. The next TakeOriginChanges returns
-// those changes first, before the ones that arrived since.
+// those changes first, before the ones that arrived since. The oldest changes
+// past the cap are dropped and counted.
 func (t *Table) PutBackOriginChanges(changes []OriginChange) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
 	t.originChanges = append(changes, t.originChanges...)
+	t.trimOriginChanges()
+}
+
+// trimOriginChanges drops the oldest origin changes past the cap and counts
+// them. The caller holds the lock.
+func (t *Table) trimOriginChanges() {
+	if extra := len(t.originChanges) - maxWaitingOriginChanges; extra > 0 {
+		t.originChangesDropped += extra
+		t.originChanges = t.originChanges[extra:]
+	}
+}
+
+// OriginChangeCount returns how many origin changes wait for TakeOriginChanges.
+func (t *Table) OriginChangeCount() int {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+
+	return len(t.originChanges)
 }
 
 // prefixPeerCount returns how many peers carry prefix, counting every origin

internal/routetable/originchanges_test.go

@@ -206,6 +206,60 @@ func TestOriginChangesDropPastTheLimit(t *testing.T) {
 	}
 }
 
+// TestOriginChangesPutBackTrimsToTheLimit checks that putting back what a
+// failed write took, after new changes filled the table again, drops the
+// oldest changes past the cap and counts them, so the cap still holds. The
+// clock advances one second per change, so a change's time says its age.
+func TestOriginChangesPutBackTrimsToTheLimit(t *testing.T) {
+	t.Parallel()
+
+	const (
+		limit = 100000
+		taken = 20000
+		added = 20000
+	)
+
+	now := time.Unix(0, 0)
+	table := routetable.New(routetable.Params{
+		Now: func() time.Time {
+			now = now.Add(time.Second)
+
+			return now
+		},
+	})
+	addr := netip.MustParseAddr("10.0.0.0")
+
+	announce := func(n int) {
+		for range n {
+			table.Announce(netip.PrefixFrom(addr, 32), asA, routeOf(peerA, asA, 10))
+			addr = addr.Next()
+		}
+	}
+
+	announce(limit)
+
+	takenChanges, _ := table.TakeOriginChanges(taken)
+
+	announce(added)
+
+	table.PutBackOriginChanges(takenChanges)
+
+	changes, dropped := table.TakeOriginChanges(math.MaxInt)
+	if dropped != added {
+		t.Errorf("dropped = %d, want %d", dropped, added)
+	}
+
+	if len(changes) != limit {
+		t.Errorf("len(changes) = %d, want %d", len(changes), limit)
+	}
+
+	// The put-back rows are the oldest, so they are the ones dropped. The
+	// first remaining change is the one that followed them.
+	if want := time.Unix(int64(added+1), 0); !changes[0].Time.Equal(want) {
+		t.Errorf("first change's time = %v, want %v", changes[0].Time, want)
+	}
+}
+
 // checkOriginChanges checks that TakeOriginChanges, taking every change,
 // returns want.
 func checkOriginChanges(