Bring README and TODO.md up to date with the code (closes #72)

README "HTTP Endpoints" now lists every route the server registers with
what it answers, errors included: / is a home page and /ip/{addr} answers
JSON, neither redirects; /ip/ looks up the caller; the IP endpoints take
host names and comma-separated lists; 400, 404 and 504 are described, and
the health check's envelope. "Database Schema" matches schema.sql, and
other sentences the code contradicted are corrected. TODO.md gets a dated
line for each issue landed since 2026-10-03, with Status and Next Step
current.

Model: opus-5-5

TODO.md

@@ -10,28 +10,91 @@
 
 # Status
 
-pre-1.0. No git tags. The linter and the tests are phases of the Docker build,
-and the Gitea workflow runs `script/cibuild` (the format check of the Go code
-and the markdown, both phases, then the image) on every push. The image sets
-memory ceilings for a 5 GiB container (README "Memory") and the README says how
-to run it under upaas (README "Running under upaas"). A 35-hour run of `3898daa`
-on the live feed peaked at about 1 GiB, without a container memory limit.
+pre-1.0. No git tags. `main` last took `next` on 2026-10-06, through
+https://git.eeqj.de/sneak/routewatch/pulls/6. The linter and the tests are
+phases of the Docker build, and the Gitea workflow runs `script/cibuild` (the
+format check of the Go code and the markdown, both phases, then the image) on
+every push. The image sets memory ceilings for a 5 GiB container (README
+"Memory") and the README says how to run it under upaas (README "Running under
+upaas"). A 25-hour run of `a9b6860` on the live feed peaked at about 0.6 GiB
+(https://git.eeqj.de/sneak/routewatch/issues/3). A run of `825afa2` on the live
+feed found the prefix handler dropping about a quarter of its updates because
+its route writes were slower than the feed
+(https://git.eeqj.de/sneak/routewatch/issues/96); the cheaper writes since then
+are measured by a benchmark, not yet on the live feed.
 
 # Next Step
 
-`next` waits for sneak to merge it to `main` through
-https://git.eeqj.de/sneak/routewatch/pulls/6. After that, setting routewatch up
-under upaas on fsn1app1 and deploying it are his
-(https://git.eeqj.de/sneak/routewatch/issues/31), and so is the run under a real
-5 GiB limit (https://git.eeqj.de/sneak/routewatch/issues/3).
+Run `next` on the live feed, as README "Running under upaas" describes, for the
+final check https://git.eeqj.de/sneak/routewatch/issues/96 names: whether the
+prefix handler still drops updates after the first hour. If it does, a new issue
+follows with the numbers. Then an audit of the code at the commit that run
+tested.
 
 # Completed Steps
 
+- 2026-10-19: README "HTTP Endpoints" lists every route with what it answers,
+  "Database Schema" matches `schema.sql`, and the rest of the README matches the
+  code; this file brought up to date (closes #72)
+- 2026-10-19: route writes are cheaper: the live route and prefix tables lose
+  their random UUID keys and the prefix tables their duplicate index, a route
+  update sets only the columns that change, and every write goes through one
+  connection with a page cache of 1 GiB (README "Memory"). A benchmark writes
+  the prefix handler's largest batch faster than the feed sends it (closes #96)
+- 2026-10-19: the WAL checkpoint, the incremental vacuum and ANALYZE take the
+  database lock every batch write holds, so a vacuum no longer fails with
+  "database is locked" and an ANALYZE no longer makes a batch write lose its
+  updates; ANALYZE runs as `PRAGMA optimize` with an analysis limit (closes #94)
+- 2026-10-19: shutdown stops the streamer first, and each handler writes
+  everything left on its queue before it stops, so the updates waiting there are
+  no longer lost (closes #69)
+- 2026-10-19: a path that ends in an AS set of several members has origin AS 0,
+  no known origin, instead of the set's last member, and the set adds no
+  peerings; the pages show such a route as having no known origin (closes #75)
+- 2026-10-19: `bgp_peer_count` drops to 0 when the last peer goes down (closes
+  #92)
+- 2026-10-19: `bgp_peer_count` counts every peer the feed has heard from, not
+  only those whose session opened since startup, and drops a peer whose session
+  goes down (closes #74)
 - 2026-10-19: the shared files are re-vendored from `sneak/prompts` at
   `0653579`: golangci-lint v2.14.0 and its configuration, lint and test as
   `Dockerfile` phases that keep Go's and golangci-lint's caches, markdown
   formatted with prettier, agent guidance in `AGENTS.md`; the code is fixed for
   what the new linter configuration finds (closes #52)
+- 2026-10-19: the streamer reads feed lines up to 1 MiB, so a line over 64 KiB
+  no longer ends the connection (closes #76)
+- 2026-10-19: a peer's live routes are removed when its BGP session goes down;
+  `STATE` messages are never dropped for backpressure, and one that finds its
+  queue full waits for room ahead of the handler's other messages (closes #56)
+- 2026-10-19: the prefix-length pages pick their sample with a bounded number of
+  index lookups instead of reading every route of that length, and list each
+  prefix once (closes #66)
+- 2026-10-19: a request past its time limit answers 504 instead of 408, and
+  `/api/v1/stats` answers 504 instead of 500 when its read runs out of time
+  (closes #70)
+- 2026-10-19: the AS, peer and prefix handlers write each batch outside the lock
+  their message handling needs, so messages keep coming off their queues during
+  a write; meanwhile the next batch grows to at most ten batch sizes (closes
+  #65)
+- 2026-10-19: a live route is identified by prefix and peer, so an announcement
+  with a new origin AS replaces the peer's route and a withdrawal removes it
+  whatever its origin AS (closes #55)
+- 2026-10-14: the streamer reconnects when RIS Live ends the stream or sends
+  nothing for 60 seconds, and the health check reports the feed disconnected
+  meanwhile (closes #53)
+- 2026-10-14: the prefix page takes the names of the origin ASes from the prefix
+  query instead of reading every route of each origin AS (closes #67)
+- 2026-10-14: the daemon exits with status 1 when its web server cannot listen
+  on its port, instead of running on without it (closes #73)
+- 2026-10-14: the prefix pages parse the prefix before looking it up: one that
+  does not parse answers 400, and any valid way of writing a prefix finds its
+  routes (closes #71)
+- 2026-10-14: the IP lookup ignores routes shorter than /8 for IPv4 and /16 for
+  IPv6, so a default route is no longer named as an address's owner (closes #57)
+- 2026-10-14: a prefix batch keeps each peer's last update for a prefix, instead
+  of one update per prefix across all peers (closes #54)
+- 2026-10-14: `reconnect_count` in `/api/v1/stats` counts every reconnect
+  (closes #68)
 - 2026-10-03: `/api/v1/stats` serves the prefix distribution from memory, seeded
   at startup and adjusted on every live-route write, so a request no longer
   reads every live route (closes #30)
@@ -116,6 +179,4 @@ under upaas on fsn1app1 and deploying it are his
 
 # Future Steps
 
-- Production memory under 5 GiB: whether to test under a real 5 GiB container
-  limit on fsn1app1 is open for sneak
-  (https://git.eeqj.de/sneak/routewatch/issues/3)
+None open.