Sample the prefix-length pages with bounded lookups, each prefix once (closes #66)

/prefixlength/{length} and /prefixlength6/{length} grouped every live route
of that length by prefix, shuffled all the prefixes and joined the routes
back, so a request grew with the number of routes and listed a prefix once
for each peer that shared its newest time.

Now a length with at most 5000 prefixes has them all read and shuffled, and
the page lists 500 of them. A longer one is sampled with random row-id
lookups on the mask length index, at most four per prefix asked for, filled
up from the shuffled prefixes if the lookups keep repeating. Each prefix is
shown once, with its newest route.

Model: opus-5-5

.dockerignore

@@ -0,0 +1,32 @@
+# Docker does not read .gitignore, and a pattern here matches from the root of
+# the build context only: a pattern meant for every directory needs `**/`.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+.git/config
+
+# Local build and debug output: `make build`, `make run`, `make asupdate`, test
+# binaries, coverage profiles and source archives.
+/bin
+/log.txt
+/out
+/pkg/asinfo/asdata.json
+**/*.tar.zst
+**/*.test
+**/*.out
+**/*.tmp
+
+# Local databases and secrets. The image carries a source archive of the whole
+# build context, so these would otherwise ship inside it.
+**/*.db
+**/*.db-journal
+**/*.db-wal
+**/.env
+
+# A local Go workspace points at directories outside the build context.
+/go.work
+/go.work.sum
+
+**/.DS_Store

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab

.gitea/workflows/check.yml

@@ -0,0 +1,9 @@
+name: check
+on: [push]
+jobs:
+    check:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-28
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: script/cibuild

Dockerfile

@@ -1,5 +1,22 @@
+# Lint stage — fast feedback on formatting and lint issues.
+# The golangci-lint image bundles Go, gcc and make, so it can run go vet on
+# the CGO sqlite package and golangci-lint without extra installs.
+# golangci/golangci-lint:v2.7.2 (Go 1.25.5), 2026-09-21
+FROM golangci/golangci-lint@sha256:5d6d5c70a61f1356adfd9dd6316ce286799fefc9d743421356ff1b00842368ba AS lint
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN make fmt-check
+RUN make lint
+
 # Build stage
-FROM golang:1.24-bookworm AS builder
+# golang:1.24-bookworm, 2026-09-21
+FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
 
 # Install build dependencies (zstd for archive, gcc for CGO/sqlite3)
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -10,14 +27,36 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /src
 
+# Force BuildKit to run the lint stage before compiling or testing.
+COPY --from=lint /src/go.sum /dev/null
+
 # Copy everything
 COPY . .
 
 # Vendor dependencies (must be after copying source)
 RUN go mod download && go mod vendor
 
-# Build the binary with CGO enabled (required for sqlite3)
-RUN CGO_ENABLED=1 GOOS=linux go build -o /routewatch ./cmd/routewatch
+# Run the test suite in the build stage: -race needs cgo and the C compiler
+# installed above. The suite is offline (the live-feed test is opt-in).
+RUN make test
+
+# Build the binary with CGO enabled (required for sqlite3). The version the
+# page footer shows is the VERSION build argument when one is given, otherwise
+# `git describe --tags --always` of the .git in the build context (git comes
+# with this image): the tag on a tagged commit, tag-N-gHASH after one, the
+# short commit when no tag is reachable. A context that carries .git and still
+# yields no version fails the build. The footer links to the full commit.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always || echo unknown)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    CGO_ENABLED=1 GOOS=linux go build -o /routewatch -ldflags "\
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevision=$(git rev-parse --verify HEAD || echo unknown) \
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevisionShort=$version" \
+        ./cmd/routewatch
 
 # Create source archive with vendored dependencies
 RUN tar --zstd -cf /routewatch-source.tar.zst \
@@ -26,7 +65,8 @@ RUN tar --zstd -cf /routewatch-source.tar.zst \
     .
 
 # Runtime stage
-FROM debian:bookworm-slim
+# debian:bookworm-slim, 2026-09-21
+FROM debian@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
 
 # Install runtime dependencies
 # - ca-certificates: for HTTPS connections
@@ -39,9 +79,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Create non-root user
 RUN useradd -r -u 1000 -m routewatch
 
-# Create state directory
-RUN mkdir -p /var/lib/routewatch && chown routewatch:routewatch /var/lib/routewatch
+RUN mkdir -p /var/lib/berlin.sneak.app.routewatch && chown routewatch:routewatch /var/lib/berlin.sneak.app.routewatch
 
+RUN mkdir /app
 WORKDIR /app
 
 # Copy binary and source archive from builder
@@ -51,16 +91,28 @@ COPY --from=builder /routewatch-source.tar.zst /app/source/routewatch-source.tar
 # Set ownership
 RUN chown -R routewatch:routewatch /app
 
-USER routewatch
+ENV XDG_DATA_HOME=/var/lib
 
-# Default state directory
-ENV ROUTEWATCH_STATE_DIR=/var/lib/routewatch
+# Cap the Go heap at 1.5 GiB so the runtime collects harder before the
+# container's memory limit is reached. setpriv in the entrypoint preserves this
+# the way it does XDG_DATA_HOME above.
+ENV GOMEMLIMIT=1536MiB
+
+# Cap glibc's malloc arenas. The SQLite C library allocates and frees millions
+# of small page-cache chunks from many threads; glibc otherwise creates up to
+# eight arenas per core (hundreds on a large host) and keeps each arena's freed
+# chunks resident, so process RSS climbs far above SQLite's live heap and never
+# comes back down. Two arenas keep that retained memory bounded; database writes
+# are already serialized, so the lost allocator concurrency costs nothing here.
+ENV MALLOC_ARENA_MAX=2
 
 # Expose HTTP port
 EXPOSE 8080
 
-# Health check using the health endpoint
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD curl -sf http://localhost:8080/.well-known/healthcheck.json || exit 1
+COPY ./entrypoint.sh /entrypoint.sh
 
-ENTRYPOINT ["/app/routewatch"]
+# Health check using the health endpoint, on the port PORT names
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -sf "http://localhost:${PORT:-8080}/.well-known/healthcheck.json" || exit 1
+
+ENTRYPOINT ["/bin/bash", "/entrypoint.sh" ]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeffrey Paul <sneak@sneak.berlin>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -2,23 +2,46 @@ export DEBUG = routewatch
 
 # Git revision for version embedding
 GIT_REVISION := $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
-GIT_REVISION_SHORT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+GIT_REVISION_SHORT := $(shell git describe --tags --always 2>/dev/null || echo "unknown")
 VERSION_PKG := git.eeqj.de/sneak/routewatch/internal/version
 LDFLAGS := -X $(VERSION_PKG).GitRevision=$(GIT_REVISION) -X $(VERSION_PKG).GitRevisionShort=$(GIT_REVISION_SHORT)
 
-.PHONY: test fmt lint build clean run asupdate
+.PHONY: bootstrap setup check test lint fmt fmt-check docker hooks build clean run asupdate
 
 all: test
 
-test: lint
-	go test -v ./...
+# Install all development dependencies.
+bootstrap:
+	@script/bootstrap
+
+# Prepare a fresh clone: bootstrap plus pre-commit hook.
+setup:
+	@script/setup
+
+# Combined pre-commit/CI gate: tests, lint, format check.
+check:
+	@script/check
+
+test:
+	@script/test
 
 fmt:
-	go fmt ./...
+	@script/fmt
+
+# Check if code is formatted (read-only).
+fmt-check:
+	@script/fmt-check
 
 lint:
-	go vet ./...
-	golangci-lint run
+	@script/lint
+
+# Build Docker image.
+docker:
+	@script/docker
+
+# Install pre-commit hook.
+hooks:
+	@script/install-precommit
 
 build:
 	CGO_ENABLED=1 go build -ldflags "$(LDFLAGS)" -o bin/routewatch cmd/routewatch/main.go

README.md

@@ -1,6 +1,10 @@
 # RouteWatch
 
-RouteWatch is a real-time BGP routing table monitor that streams BGP UPDATE messages from the RIPE RIS Live service, maintains a live routing table in SQLite, and provides HTTP APIs for querying routing information.
+RouteWatch is an MIT-licensed Go daemon by @sneak that monitors the BGP routing
+table in real time: it streams BGP UPDATE messages from the RIPE RIS Live
+service, maintains a live routing table in SQLite, and provides HTTP APIs for
+querying routing information.
+
 
 ## Features
 
@@ -137,8 +141,15 @@ routewatch/
 - **Batched Writes**: All database operations are batched for performance
 - **Backpressure**: Probabilistic message dropping when queues exceed 50% capacity
 - **Graceful Shutdown**: 60-second timeout, flushes all pending batches
-- **Reconnection**: Exponential backoff (5s-320s) with reset after 30s of stable connection
-- **IPv4 Optimization**: IP ranges stored as uint32 for O(1) lookups
+- **Reconnection**: Any end of the stream other than shutdown, including RIS Live
+  ending the response normally, marks the feed disconnected and reconnects with
+  exponential backoff (5s-320s). The backoff resets after a stream that lasted
+  more than 30s. A stream with no line for 60s is dropped and reconnected.
+- **IP Lookup**: the most specific live route is found by looking up the
+  address's prefix at each mask length, longest first, in the prefix index
+  (at most 25 lookups for IPv4, 113 for IPv6); prefixes are stored in the
+  text form Go's `net/netip` prints. Routes shorter than /8 for IPv4 or /16
+  for IPv6, such as a default route, are not used.
 
 ### Database Schema
 
@@ -150,7 +161,7 @@ prefixes_v6(id, prefix, mask_length, first_seen, last_seen)
 
 -- Live routing tables (one per IP version)
 live_routes_v4(id, prefix, mask_length, origin_asn, peer_ip, as_path,
-               next_hop, last_updated, v4_ip_start, v4_ip_end)
+               next_hop, last_updated)
 live_routes_v6(id, prefix, mask_length, origin_asn, peer_ip, as_path,
                next_hop, last_updated)
 
@@ -164,13 +175,83 @@ bgp_peers(id, peer_ip, peer_asn, last_message_type, last_seen)
 Configuration is handled via environment variables and OS-specific paths:
 
 | Variable | Default | Description |
-|----------|---------|-------------|
-| `PORT` | `8080` | HTTP server port |
+|----------|----------|-------------|
+| `PORT` | `8080` | HTTP server port, a whole number from 1 to 65535 |
 | `DEBUG` | (empty) | Set to `routewatch` for debug logging |
+| `XDG_DATA_HOME` | `/var/lib` (in the Docker image) | Base of the state directory; must be an absolute path |
+| `GOMEMLIMIT` | `1536MiB` (in the Docker image) | Go soft memory limit; see Memory |
+| `MALLOC_ARENA_MAX` | `2` (in the Docker image) | glibc malloc arena cap, a positive whole number; see Memory |
+
+A variable that is set to an invalid value stops the start with an error and a
+non-zero exit. An empty variable counts as unset.
 
 State directory (database location):
 - macOS: `~/Library/Application Support/routewatch/`
-- Linux: `/var/lib/routewatch/` or `~/.local/share/routewatch/`
+- Linux: `/var/lib/berlin.sneak.app.routewatch/` when running as root,
+  otherwise `$XDG_DATA_HOME/berlin.sneak.app.routewatch/` (with `XDG_DATA_HOME`
+  unset, `~/.local/share/berlin.sneak.app.routewatch/`). In the Docker image
+  this is `/var/lib/berlin.sneak.app.routewatch/`.
+
+## Memory
+
+The daemon holds a live routing table, so its memory grows with the size of the
+data it tracks. The image sets ceilings that keep it inside a 5 GiB container.
+
+Budget:
+- Go heap: a 1.5 GiB soft limit (`GOMEMLIMIT=1536MiB`, set in the image).
+- SQLite: at most 640 MiB of page cache across the connection pool (64 MiB per
+  connection, 10 connections) and a 1.5 GiB hard heap limit for the C library.
+- glibc allocator: the SQLite C library runs on glibc `malloc`, which frees
+  page-cache chunks back to per-arena free lists rather than to the kernel, so
+  process RSS tracks the high-water mark of those arenas, not SQLite's live
+  heap. glibc creates up to eight arenas per core, so on a many-core host the
+  retained memory — and thus RSS — grows with the core count. The image sets
+  `MALLOC_ARENA_MAX=2` to bound it; the two-arena cap costs nothing here because
+  database writes are already serialized.
+- About 0.2 GiB for everything else in the runtime.
+
+Run the container with a memory limit of 5 GiB and swap disabled:
+
+```bash
+docker run --memory=5g --memory-swap=5g ...
+```
+
+or the equivalent in your deployment tool. This leaves headroom above the
+ceilings for spikes and the kernel page cache.
+
+Override the Go soft limit by setting `GOMEMLIMIT` in the environment (for
+example `-e GOMEMLIMIT=1GiB`); this replaces the image default. `MALLOC_ARENA_MAX`
+can be overridden the same way, but raising it lets RSS climb again on a
+many-core host.
+
+What happens at each limit:
+- Go soft limit: as the heap approaches `GOMEMLIMIT`, the runtime runs garbage
+  collection more aggressively rather than growing further.
+- SQLite: at a 1 GiB soft heap limit it recycles its page cache instead of
+  allocating more; at the 1.5 GiB hard heap limit a statement fails with an
+  out-of-memory error, and the handler logs it and drops that batch. The process
+  keeps running.
+- Handler queues: each of the four handler queues holds at most 20,000 messages.
+  When a queue fills, the streamer drops messages instead of blocking.
+
+With `DEBUG=routewatch` the daemon logs a `System stats` line every 60 seconds
+with the goroutine count and Go memory figures.
+
+## Running under upaas
+
+What the [upaas](https://git.eeqj.de/sneak/upaas) app needs:
+
+- Container port: `8080`.
+- Volume: one, at container path `/var/lib/berlin.sneak.app.routewatch`.
+- Environment: nothing is required. Leave `XDG_DATA_HOME`, `GOMEMLIMIT` and
+  `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch` is optional and
+  adds the `System stats` memory line to the log.
+- Memory Limit: `5g`, the 5 GiB limit from Memory above. upaas sets no swap
+  limit, so on a host with swap Docker allows the same amount of swap again.
+- Health check: the image's `HEALTHCHECK` requests
+  `/.well-known/healthcheck.json` on the container port. upaas reads the
+  container's health 60 seconds after a deploy and fails the deploy unless it
+  is `healthy`.
 
 ## Development
 
@@ -188,6 +269,46 @@ make lint
 make
 ```
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call
+them. We provide:
+
+- `script/bootstrap` — install all development dependencies (go,
+  golangci-lint, Go module download)
+- `script/setup` — make a fresh clone ready for development: runs
+  `script/bootstrap`, then `script/install-precommit`
+- `script/projectname` — print the project name (used for the Docker
+  image tag)
+- `script/test` — run the test suite
+  (`go test -short -timeout 30s -race -cover ./...`, verbose rerun on
+  failure). The `-short` flag skips the live-network integration test so the
+  default run is deterministic and offline.
+- `script/lint` — run `go vet ./...` and `golangci-lint run`
+- `script/fmt` — format all code (writes)
+- `script/fmt-check` — check formatting (read-only)
+- `script/check` — run `script/test`, `script/lint`, and
+  `script/fmt-check`
+- `script/docker` — build the Docker image tagged via
+  `script/projectname`
+- `script/cibuild` — CI entrypoint: `docker build .`
+- `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
+  not change files), then `script/check`
+- `script/install-precommit` — install the git pre-commit hook that
+  runs `script/precommit`
+
+The live-network integration test `TestRouteWatchLiveFeed` streams the RIPE
+RIS feed for a few seconds and is skipped in short mode. To run it on demand,
+invoke `go test` directly without `-short`:
+`go test -run TestRouteWatchLiveFeed ./internal/routewatch/`.
+
 ## License
 
-See LICENSE file.
+MIT. See [`LICENSE`](LICENSE).
+
+## Author
+
+[@sneak](https://sneak.berlin)

REPO_POLICIES.md

@@ -0,0 +1,408 @@
+---
+title: Repository Policies
+last_modified: 2026-07-06
+---
+
+This document covers repository structure, tooling, and workflow standards. Code
+style conventions are in separate documents:
+
+- [Code Styleguide](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE.md)
+  (general, bash, Docker)
+- [Go](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_GO.md)
+- [JavaScript](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_JS.md)
+- [Python](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_PYTHON.md)
+- [Go HTTP Server Conventions](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/GO_HTTP_SERVER_CONVENTIONS.md)
+
+---
+
+- Cross-project documentation (such as this file) must include
+  `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync
+  with the authoritative source as policies evolve.
+
+- **ALL external references must be pinned by cryptographic hash.** This
+  includes Docker base images, Go modules, npm packages, GitHub Actions, and
+  anything else fetched from a remote source. Version tags (`@v4`, `@latest`,
+  `:3.21`, etc.) are server-mutable and therefore remote code execution
+  vulnerabilities. The ONLY acceptable way to reference an external dependency
+  is by its content hash (Docker `@sha256:...`, Go module hash in `go.sum`, npm
+  integrity hash in lockfile, GitHub Actions `@<commit-sha>`). No exceptions.
+  This also means never `curl | bash` to install tools like pyenv, nvm, rustup,
+  etc. Instead, download a specific release archive from GitHub, verify its hash
+  (hardcoded in the Dockerfile or script), and only then install. Unverified
+  install scripts are arbitrary remote code execution. This is the single most
+  important rule in this document. Double-check every external reference in
+  every file before committing. There are zero exceptions to this rule.
+
+- Every repo with software must have a root `Makefile` with these targets:
+  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+
+- Repos follow the
+  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+  pattern: the implementation of each Makefile target lives in an executable
+  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
+  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
+  `script/docker`), and the Makefile targets are thin shims that call them. The
+  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
+  minimal containers (e.g. alpine images have no bash); locate the repo root
+  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
+  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
+  for development after a fresh clone: runs `bootstrap`, then
+  `install-precommit`, plus any repo-specific initialization), `test`, and
+  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
+  assumes nothing is present: base tools come from nix, apt, brew, or apk
+  (detected in that order; apt runs noninteractive). For node it uses the
+  installed node if present; otherwise it installs a PINNED node version via
+  nvm, first installing nvm itself if missing — from a hash-verified GitHub
+  release archive (never `curl | sh`), with bash installed as an explicit
+  prerequisite since nvm requires bash. yarn is then pinned via
+  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
+  always exact versions. `script/cibuild` runs the CI build: it changes to the
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
+  scripts are our own extensions to the standard: `script/check` runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
+  what the git pre-commit hook runs, and it calls `script/check`;
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
+  target shims to it); and `script/projectname` (literally that filename) simply
+  outputs the project's name. Scripts that need the name call
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
+  so those scripts stay byte-identical across all repos. Repo-type-specific
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/precommit`, not in the hook itself. Model scripts are at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
+  must document the provided scripts in an **Entrypoints** section (see the
+  README requirements below).
+
+- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
+  instead of invoking the underlying tools directly. The Makefile is the single
+  source of truth for how these operations are run.
+
+- The Makefile is authoritative documentation for how the repo is used. Beyond
+  the required targets above, it should have targets for every common operation:
+  running a local development server (`make run`, `make dev`), re-initializing
+  or migrating the database (`make db-reset`, `make migrate`), building
+  artifacts (`make build`), generating code, seeding data, or anything else a
+  developer would do regularly. If someone checks out the repo and types
+  `make<tab>`, they should see every meaningful operation available. A new
+  contributor should be able to understand the entire development workflow by
+  reading the Makefile.
+
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
+  as a build step so the build fails if the branch is not green. For non-server
+  repos, the Dockerfile should bring up a development environment and run
+  `make check`. For server repos, `make check` should run as an early build
+  stage before the final image is assembled. Dockerfiles install development
+  prerequisites by running `script/bootstrap` rather than duplicating installs
+  inline; COPY `script/` and the dependency manifests (`package.json` +
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
+  layer stays cached until dependencies change.
+
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
+  repos use a multistage build where linting runs in an independent stage based
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
+  `make fmt-check` and `make lint` before the full build begins. The build stage
+  then declares an explicit dependency on the lint stage via
+  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
+  linting before proceeding to compilation and tests. This ensures lint failures
+  surface in seconds rather than minutes, without blocking on dependency
+  download or compilation in the build stage.
+
+    The standard pattern for a Go repo Dockerfile is:
+
+    ```dockerfile
+    # Lint stage — fast feedback on formatting and lint issues
+    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
+    FROM golangci/golangci-lint@sha256:... AS lint
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make fmt-check
+    RUN make lint
+
+    # Build stage
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    WORKDIR /src
+
+    # Force BuildKit to run the lint stage before proceeding
+    COPY --from=lint /src/go.sum /dev/null
+
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make test
+
+    ARG VERSION=dev
+    RUN CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /app ./cmd/app/
+
+    # Runtime stage
+    FROM alpine@sha256:...
+    COPY --from=builder /app /usr/local/bin/app
+    ENTRYPOINT ["app"]
+    ```
+
+    Key points:
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
+      includes both Go and the linter), so there is no need to install the
+      linter separately.
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
+      a stage dependency. BuildKit runs stages in parallel by default; without
+      this line, the build stage would not wait for lint to finish and a lint
+      failure might not fail the overall build.
+    - If the project uses `//go:embed` directives that reference build artifacts
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      create placeholder files so the embed directives resolve. Example:
+      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
+      The lint stage should not depend on the actual build output — it exists to
+      fail fast.
+    - If the project requires CGO or system libraries for linting (e.g.
+      `vips-dev`), install them in the lint stage with `apk add`.
+    - The build stage runs `make test` after compilation setup. Tests run in the
+      build stage, not the lint stage, because they may require compiled
+      artifacts or heavier dependencies.
+
+- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  Dockerfile already runs `make check`, a successful build implies all checks
+  pass.
+
+- Use platform-standard formatters: `black` for Python, `prettier` for
+  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
+  two exceptions: four-space indents (except Go), and `proseWrap: always` for
+  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
+  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
+
+- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  `script/install-precommit`; the Makefile must provide a `make hooks` target
+  that shims to it.
+
+- All repos with software must have tests that run via the platform-standard
+  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
+  tests exist yet, add the most minimal test possible — e.g. importing the
+  module under test to verify it compiles/parses. There is no excuse for
+  `make test` to be a no-op.
+
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+  Makefile.
+
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
+  show full output. This keeps CI logs and `docker build` output clean on
+  success (just package/suite summaries) while providing full diagnostic detail
+  on failure (every test case, every assertion). The general shell pattern:
+
+    ```makefile
+    test:
+    	@<test-command> || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  <test-command-with-v>; exit 1; }
+    ```
+
+    Go example:
+
+    ```makefile
+    test:
+    	@go test -timeout 30s -race -cover ./... || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  go test -timeout 30s -race -v ./...; exit 1; }
+    ```
+
+    Python example:
+
+    ```makefile
+    test:
+    	@python -m pytest || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  python -m pytest -v; exit 1; }
+    ```
+
+    The `exit 1` ensures the target always fails after a rerun — the first run
+    already proved the tests are broken, so the build must not pass even if a
+    flaky test happens to succeed on the second attempt. The rerun exists solely
+    for diagnostic output.
+
+- Docker builds must complete in under 5 minutes.
+
+- `make check` must not modify any files in the repo. Tests may use temporary
+  directories.
+
+- `main` must always pass `make check`, no exceptions.
+
+- Never commit secrets. `.env` files, credentials, API keys, and private keys
+  must be in `.gitignore`. No exceptions.
+
+- `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
+  Fetch the standard `.gitignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
+  a new repo.
+
+- **No build artifacts in version control.** Code-derived data (compiled
+  bundles, minified output, generated assets) must never be committed to the
+  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
+  should generate these at build time. Notable exception: Go protobuf generated
+  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
+  downloads code but does not execute code generation.
+
+- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
+
+- Never force-push to `main`.
+
+- Make all changes on a feature branch. You can do whatever you want on a
+  feature branch.
+
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
+  manually by the user. Fetch from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+
+- When pinning images or packages by hash, add a comment above the reference
+  with the version and date (YYYY-MM-DD).
+
+- Use `yarn`, not `npm`.
+
+- Write all dates as YYYY-MM-DD (ISO 8601).
+
+- Simple projects should be configured with environment variables.
+
+- Dockerized web services listen on port 8080 by default, overridable with
+  `PORT`.
+
+- **HTTP/web services must be hardened for production internet exposure before
+  tagging 1.0.** This means full compliance with security best practices
+  including, without limitation, all of the following:
+    - **Security headers** on every response:
+        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
+          and `includeSubDomains`.
+        - `Content-Security-Policy` (CSP) with a restrictive default policy
+          (`default-src 'self'` as a baseline, tightened per-resource as
+          needed). Never use `unsafe-inline` or `unsafe-eval` unless
+          unavoidable, and document the reason.
+        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
+          Prefer the `frame-ancestors` CSP directive as the primary control.
+        - `X-Content-Type-Options: nosniff`.
+        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
+        - `Permissions-Policy` restricting access to browser features the
+          application does not use (camera, microphone, geolocation, etc.).
+    - **Request and response limits:**
+        - Maximum request body size enforced on all endpoints (e.g. Go
+          `http.MaxBytesReader`). Choose a sane default per-route; never accept
+          unbounded input.
+        - Maximum response body size where applicable (e.g. paginated APIs).
+        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
+          against slowloris attacks.
+        - `WriteTimeout` on the `http.Server`.
+        - `IdleTimeout` on the `http.Server`.
+        - Per-handler execution time limits via `context.WithTimeout` or
+          chi/stdlib `middleware.Timeout`.
+    - **Authentication and session security:**
+        - Rate limiting on password-based authentication endpoints. API keys are
+          high-entropy and not susceptible to brute force, so they are exempt.
+        - CSRF tokens on all state-mutating HTML forms. API endpoints
+          authenticated via `Authorization` header (Bearer token, API key) are
+          exempt because the browser does not attach these automatically.
+        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
+          MD5, or SHA.
+        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
+          `Strict`) attributes.
+    - **Reverse proxy awareness:**
+        - True client IP detection when behind a reverse proxy
+          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
+          forwarded headers only from a configured set of trusted proxy
+          addresses — never trust `X-Forwarded-For` unconditionally.
+    - **CORS:**
+        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
+          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
+          only for public, unauthenticated read-only APIs.
+    - **Error handling:**
+        - Internal errors must never leak stack traces, SQL queries, file paths,
+          or other implementation details to the client. Return generic error
+          messages in production; detailed errors only when `DEBUG` is enabled.
+    - **TLS:**
+        - Services never terminate TLS directly. They are always deployed behind
+          a TLS-terminating reverse proxy. The service itself listens on plain
+          HTTP. However, HSTS headers and `Secure` cookie flags must still be
+          set by the application so that the browser enforces HTTPS end-to-end.
+
+    This list is non-exhaustive. Apply defense-in-depth: if a standard security
+    hardening measure exists for HTTP services and is not listed here, it is
+    still expected. When in doubt, harden.
+
+- `README.md` is the primary documentation. Required sections:
+    - **Description**: First line must include the project name, purpose,
+      category (web server, SPA, CLI tool, etc.), license, and author. Example:
+      "µPaaS is an MIT-licensed Go web application by @sneak that receives
+      git-frontend webhooks and deploys applications via Docker in realtime."
+    - **Getting Started**: Copy-pasteable install/usage code block.
+    - **Entrypoints**: Opens by stating that the repo adheres to the
+      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+      standard (with that link), then documents each provided `script/`
+      entrypoint and its purpose.
+    - **Rationale**: Why does this exist?
+    - **Design**: How is the program structured?
+    - **TODO**: Update meticulously, even between commits. When planning, put
+      the todo list in the README so a new agent can pick up where the last one
+      left off.
+    - **License**: MIT, GPL, or WTFPL. Ask the user for new projects. Include a
+      `LICENSE` file in the repo root and a License section in the README.
+    - **Author**: [@sneak](https://sneak.berlin).
+
+- First commit of a new repo should contain only `README.md`.
+
+- Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy` before
+  committing.
+
+- Use SemVer.
+
+- Database migrations live in `internal/db/migrations/` and must be embedded in
+  the binary.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.
+
+- All repos should have an `.editorconfig` enforcing the project's indentation
+  settings.
+
+- Avoid putting files in the repo root unless necessary. Root should contain
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
+  language-specific config). Everything else goes in a subdirectory. Canonical
+  subdirectory names:
+    - `bin/` — executable scripts and tools
+    - `cmd/` — Go command entrypoints
+    - `configs/` — configuration templates and examples
+    - `deploy/` — deployment manifests (k8s, compose, terraform)
+    - `docs/` — documentation and markdown (README.md stays in root)
+    - `internal/` — Go internal packages
+    - `internal/db/migrations/` — database migrations
+    - `pkg/` — Go library packages
+    - `share/` — systemd units, data files
+    - `static/` — static assets (images, fonts, etc.)
+    - `web/` — web frontend source
+
+- When setting up a new repo, files from the `prompts` repo may be used as
+  templates. Fetch them from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/<path>`.
+
+- New repos must contain at minimum:
+    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
+    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
+    - `Makefile`
+    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
+      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
+      `install-precommit`)
+    - `Dockerfile`, `.dockerignore`
+    - `.gitea/workflows/check.yml`
+    - Go: `go.mod`, `go.sum`, `.golangci.yml`
+    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
+    - Python: `pyproject.toml`

TODO.md

@@ -0,0 +1,122 @@
+# Workflow
+
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
+
+# Status
+
+pre-1.0. No git tags. The Docker build runs the format check, the linter
+and the tests, and the Gitea workflow runs that build on every push. The
+image sets memory ceilings for a 5 GiB container (README "Memory") and the
+README says how to run it under upaas (README "Running under upaas"). A
+35-hour run of `3898daa` on the live feed peaked at about 1 GiB, without a
+container memory limit.
+
+# Next Step
+
+`next` waits for sneak to merge it to `main` through
+https://git.eeqj.de/sneak/routewatch/pulls/6. After that, setting
+routewatch up under upaas on fsn1app1 and deploying it are his
+(https://git.eeqj.de/sneak/routewatch/issues/31), and so is the run under a
+real 5 GiB limit (https://git.eeqj.de/sneak/routewatch/issues/3).
+
+# Completed Steps
+
+- 2026-10-03: `/api/v1/stats` serves the prefix distribution from memory,
+  seeded at startup and adjusted on every live-route write, so a request no
+  longer reads every live route (closes #30)
+- 2026-10-03: a new database is created with `auto_vacuum` set to
+  incremental, through the connection string so it is set before the file
+  is first written, and each periodic incremental vacuum now returns up to
+  1000 free pages; the late `PRAGMA auto_vacuum` in `Initialize`, which
+  SQLite ignored, is gone (closes #43)
+- 2026-10-03: looking up an IP address no longer reads every IPv6 route:
+  both families find the most specific live route with at most 33 or 129
+  lookups on the prefix index, and the IPv4 range columns are gone. Prefixes
+  from the feed are stored in one text form, so an IPv6 withdrawal, which the
+  feed sends uncompressed, now removes its route (closes #48)
+- 2026-10-02: a plain `docker build .` stamps the commit's tag or short
+  commit (`git describe --tags --always`) into the page footer instead of
+  `unknown`: `.dockerignore` sends `.git` without `.git/config`, a `VERSION`
+  build argument takes precedence, and `make build` stamps the same value
+  (closes #46)
+- 2026-09-29: the entrypoint creates the data directory if it is missing and
+  stops the start if a step fails; README "Running under upaas" no longer
+  asks for the host directory to be created first (closes #42)
+- 2026-09-29: `.dockerignore` keeps `.git`, local build output, local
+  databases and `.env` out of the Docker build context, and so out of the
+  source archive in the image (closes #39)
+- 2026-09-29: README first line names the MIT license and the author;
+  the License section now says MIT and links `LICENSE`, and an Author
+  section was added; this file brought up to date (closes #38)
+- 2026-09-29: MIT `LICENSE` (closes #1)
+- 2026-09-28: stopping the daemon while the feed is flowing no longer
+  panics with "send on closed channel": the read loop checks for a stop
+  just before handing a message to the handler queues, and a second
+  `Stop` no longer closes the queues again (closes #34)
+- 2026-09-28: `docker stop` no longer kills the daemon 2 seconds after the
+  stop signal: the entrypoint switches to the `routewatch` user with
+  `setpriv` instead of `runuser`, so the daemon receives the signal itself
+  and gets the whole wait `docker stop` allows, up to its own 60-second
+  limit (closes #33)
+- 2026-09-28: ready to run under upaas: a set but invalid `PORT`,
+  `XDG_DATA_HOME` or `MALLOC_ARENA_MAX` stops the start, the health
+  check follows `PORT`, README "Running under upaas" section (closes
+  #31)
+- 2026-09-22: realtime in-memory database statistics: counts seeded at
+  startup and adjusted on every write, oldest/newest route timestamps via
+  index-end lookups; `/api/v1/stats` no longer scans the tables (closes
+  #27)
+- 2026-09-21: batch writes take the write lock when their transaction
+  begins (`_txlock=immediate`), so they wait out a WAL checkpoint instead
+  of failing with "database is locked" (closes #25)
+- 2026-09-21: `MALLOC_ARENA_MAX=2` in the image caps glibc malloc arenas,
+  so memory outside the Go runtime no longer grows with the core count
+  (closes #23)
+- 2026-09-21: `GOMEMLIMIT=1536MiB` in the image; README Memory section
+  with the memory budget and the 5 GiB container limit (closes #13)
+- 2026-09-21: the four handler queues hold at most 20,000 messages each,
+  down from 100,000 (closes #11)
+- 2026-09-21: two goroutine leaks fixed: the stats handlers after a
+  timeout and the streamer's tickers on every reconnect (closes #12)
+- 2026-09-21: parsed RIS messages no longer keep the unused `Community`
+  and `Raw` fields (closes #9)
+- 2026-09-21: `.editorconfig`, and a Gitea workflow that runs
+  `script/cibuild` on every push (closes #14)
+- 2026-09-21: the peering handler's AS-path map holds at most 500,000
+  paths and is swapped for an empty one every 30 seconds instead of copied
+  (closes #10)
+- 2026-09-21: SQLite memory bounded across the whole connection pool: a
+  64 MiB page cache on each connection, 1 GiB soft and 1.5 GiB hard heap
+  limits (closes #8)
+- 2026-09-21: the Docker build runs the format check, the linter and the
+  tests, linting in a separate stage on a golangci-lint image pinned by
+  digest (closes #5)
+- 2026-09-21: `make test` skips the live-network feed test (`-short`), so
+  `make check` no longer depends on the network (closes #2)
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  Makefile shims, README Entrypoints section
+- 2026-02-22: repo policy compliance: required policy files, .gitignore
+  update, Makefile fmt-check/check/docker/hooks targets, gofmt pass
+  (repo-policies-compliance, unmerged)
+- 2026-01-01: WAL checkpointing: periodic (5s), on startup with logging,
+  TRUNCATE mode; fixed slow queries
+- 2025-12-31: status page: navbar, home page with search, oldest/newest
+  route timestamps, NULL handling in WHOIS stats; container runs as
+  routewatch user with proper state dir
+- 2025-12-30: structured HTTP request logging, increased timeouts,
+  CIDR prefix URL routing fixes, status page metrics and footer
+- 2025-12-29: Dockerfile multi-stage build with source archive; SQLite
+  incremental vacuum for non-blocking space reclamation
+- 2025-07-27: initial RouteWatch BGP stream monitor
+
+# Future Steps
+
+- Production memory under 5 GiB: whether to test under a real 5 GiB
+  container limit on fsn1app1 is open for sneak
+  (https://git.eeqj.de/sneak/routewatch/issues/3)

entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+
+# glibc silently ignores a malformed MALLOC_ARENA_MAX, so refuse it here.
+if [[ -n "${MALLOC_ARENA_MAX:-}" && ! "$MALLOC_ARENA_MAX" =~ ^[1-9][0-9]*$ ]]; then
+    echo "MALLOC_ARENA_MAX must be a positive whole number, got '$MALLOC_ARENA_MAX'" >&2
+    exit 1
+fi
+
+# Give the data directory to the routewatch user before the daemon starts,
+# whether it is missing, an empty root-owned mount, or holds another uid's files.
+mkdir -p /var/lib/berlin.sneak.app.routewatch
+cd /var/lib/berlin.sneak.app.routewatch
+chown -R routewatch:routewatch .
+chmod 700 .
+
+# setpriv replaces itself with the daemon, so the daemon receives the stop
+# signal directly. runuser would stay in between and kill the daemon 2 seconds
+# after passing the signal on.
+exec setpriv --reuid=routewatch --regid=routewatch --init-groups -- /app/routewatch

internal/config/config.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"time"
 )
 
@@ -18,6 +19,12 @@ const (
 
 	// defaultRouteExpirationMinutes is the default route expiration timeout in minutes
 	defaultRouteExpirationMinutes = 5
+
+	// defaultPort is the HTTP port used when PORT is not set
+	defaultPort = 8080
+
+	// maxPort is the highest TCP port number
+	maxPort = 65535
 )
 
 // Config holds configuration for the entire application
@@ -25,6 +32,9 @@ type Config struct {
 	// StateDir is the directory for all application state (database, snapshots)
 	StateDir string
 
+	// Port is the TCP port the HTTP server listens on
+	Port int
+
 	// MaxRuntime is the maximum runtime (0 = run forever)
 	MaxRuntime time.Duration
 
@@ -43,8 +53,14 @@ func New() (*Config, error) {
 		return nil, fmt.Errorf("failed to determine state directory: %w", err)
 	}
 
+	port, err := getPort()
+	if err != nil {
+		return nil, err
+	}
+
 	return &Config{
 		StateDir:                    stateDir,
+		Port:                        port,
 		MaxRuntime:                  0,                                           // Run forever by default
 		EnableBatchedDatabaseWrites: true,                                        // Enable batching by default
 		RouteExpirationTimeout:      defaultRouteExpirationMinutes * time.Minute, // For active route monitoring
@@ -69,13 +85,20 @@ func getStateDirectory() (string, error) {
 		return filepath.Join(home, "Library", "Application Support", AppIdentifier), nil
 
 	case "linux", "freebsd", "openbsd", "netbsd":
+		// The XDG spec requires an absolute path; a relative one would put
+		// the database somewhere unexpected.
+		xdgData := os.Getenv("XDG_DATA_HOME")
+		if xdgData != "" && !filepath.IsAbs(xdgData) {
+			return "", fmt.Errorf("XDG_DATA_HOME must be an absolute path, got %q", xdgData)
+		}
+
 		// Unix-like: /var/lib/berlin.sneak.app.routewatch if root, else XDG_DATA_HOME
 		if os.Geteuid() == 0 {
 			return filepath.Join("/var/lib", AppIdentifier), nil
 		}
 
 		// Check XDG_DATA_HOME first
-		if xdgData := os.Getenv("XDG_DATA_HOME"); xdgData != "" {
+		if xdgData != "" {
 			return filepath.Join(xdgData, AppIdentifier), nil
 		}
 
@@ -92,6 +115,22 @@ func getStateDirectory() (string, error) {
 	}
 }
 
+// getPort returns the HTTP port from PORT, or defaultPort when PORT is not set
+func getPort() (int, error) {
+	value := os.Getenv("PORT")
+	if value == "" {
+		return defaultPort, nil
+	}
+
+	// ParseUint, unlike Atoi, refuses a sign: the health check URL cannot use "+9090"
+	port, err := strconv.ParseUint(value, 10, 0)
+	if err != nil || port < 1 || port > maxPort {
+		return 0, fmt.Errorf("PORT must be a whole number from 1 to %d, got %q", maxPort, value)
+	}
+
+	return int(port), nil
+}
+
 // EnsureDirectories creates all necessary directories if they don't exist
 func (c *Config) EnsureDirectories() error {
 	// Ensure state directory exists

internal/config/config_test.go

@@ -0,0 +1,62 @@
+package config
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestNewReadsPort(t *testing.T) {
+	tests := map[string]int{
+		"":      defaultPort,
+		"1":     1,
+		"9090":  9090,
+		"65535": 65535,
+	}
+
+	for value, want := range tests {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PORT", value)
+			t.Setenv("XDG_DATA_HOME", "")
+
+			cfg, err := New()
+			if err != nil {
+				t.Fatalf("New() with PORT=%q: %v", value, err)
+			}
+
+			if cfg.Port != want {
+				t.Errorf("New() with PORT=%q: Port = %d, want %d", value, cfg.Port, want)
+			}
+		})
+	}
+}
+
+func TestNewRefusesInvalidPort(t *testing.T) {
+	for _, value := range []string{"0", "65536", "-1", "+9090", "http", "80.5"} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PORT", value)
+			t.Setenv("XDG_DATA_HOME", "")
+
+			if _, err := New(); err == nil {
+				t.Errorf("New() with PORT=%q returned no error", value)
+			}
+		})
+	}
+}
+
+func TestNewRefusesRelativeXDGDataHome(t *testing.T) {
+	if runtime.GOOS == "darwin" {
+		t.Skip("macOS does not read XDG_DATA_HOME")
+	}
+
+	t.Setenv("PORT", "")
+
+	t.Setenv("XDG_DATA_HOME", "relative/path")
+	if _, err := New(); err == nil {
+		t.Error("New() with a relative XDG_DATA_HOME returned no error")
+	}
+
+	t.Setenv("XDG_DATA_HOME", "/var/lib")
+	if _, err := New(); err != nil {
+		t.Errorf("New() with XDG_DATA_HOME=/var/lib: %v", err)
+	}
+}

internal/database/counts.go

@@ -0,0 +1,203 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// liveCounts holds the running row counts and the prefix distribution that the
+// stats endpoints report. They are seeded once at startup from the tables and
+// then adjusted on every write, so a stats read serves them from memory instead
+// of running a query over the tables. The COUNT(*) scans (issue 27) and then
+// the prefix distribution query (issue 30) each grew with the database until
+// they took the whole request timeout and made /api/v1/stats return 500.
+//
+// A single mutex guards all fields so the stats reader takes a consistent
+// snapshot at one instant and writers, which already run under the database
+// write lock, adjust the counts after their transaction commits.
+type liveCounts struct {
+	mu         sync.RWMutex
+	asns       int
+	prefixesV4 int
+	prefixesV6 int
+	peerings   int
+	peers      int
+	routesV4   int
+	routesV6   int
+	// The prefix distribution: for each mask length, the number of distinct
+	// prefixes that have at least one live route.
+	distributionV4 [ipv4Bits + 1]int
+	distributionV6 [ipv6Bits + 1]int
+}
+
+// seed sets every count to the value read from the tables at startup. It runs
+// before any writer, so it needs no coordination with the adjust methods.
+func (c *liveCounts) seed(asns, prefixesV4, prefixesV6, peerings, peers, routesV4, routesV6 int,
+	distributionV4, distributionV6 []PrefixDistribution) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.asns = asns
+	c.prefixesV4 = prefixesV4
+	c.prefixesV6 = prefixesV6
+	c.peerings = peerings
+	c.peers = peers
+	c.routesV4 = routesV4
+	c.routesV6 = routesV6
+	for _, entry := range distributionV4 {
+		addAtMaskLength(c.distributionV4[:], entry.MaskLength, entry.Count)
+	}
+	for _, entry := range distributionV6 {
+		addAtMaskLength(c.distributionV6[:], entry.MaskLength, entry.Count)
+	}
+}
+
+// addASNs adds n to the ASN count.
+func (c *liveCounts) addASNs(n int) {
+	c.mu.Lock()
+	c.asns += n
+	c.mu.Unlock()
+}
+
+// addPrefixes adds to the IPv4 and IPv6 prefix counts.
+func (c *liveCounts) addPrefixes(v4, v6 int) {
+	c.mu.Lock()
+	c.prefixesV4 += v4
+	c.prefixesV6 += v6
+	c.mu.Unlock()
+}
+
+// addPeerings adds n to the peering count.
+func (c *liveCounts) addPeerings(n int) {
+	c.mu.Lock()
+	c.peerings += n
+	c.mu.Unlock()
+}
+
+// addPeers adds n to the BGP peer count.
+func (c *liveCounts) addPeers(n int) {
+	c.mu.Lock()
+	c.peers += n
+	c.mu.Unlock()
+}
+
+// addRoutes adds to the IPv4 and IPv6 live-route counts. Deletions pass
+// negative values.
+func (c *liveCounts) addRoutes(v4, v6 int) {
+	c.mu.Lock()
+	c.routesV4 += v4
+	c.routesV6 += v6
+	c.mu.Unlock()
+}
+
+// addToDistribution adds n to the IPv4 and IPv6 prefix distributions once for
+// each listed mask length. A write lists the mask lengths of the prefixes it
+// gave their first live route with n = 1, and of the prefixes it left with no
+// live route with n = -1.
+func (c *liveCounts) addToDistribution(maskLengthsV4, maskLengthsV6 []int, n int) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for _, maskLength := range maskLengthsV4 {
+		addAtMaskLength(c.distributionV4[:], maskLength, n)
+	}
+	for _, maskLength := range maskLengthsV6 {
+		addAtMaskLength(c.distributionV6[:], maskLength, n)
+	}
+}
+
+// addAtMaskLength adds n to counts[maskLength]. A mask length the array has no
+// entry for is ignored, so a malformed route cannot crash the daemon.
+func addAtMaskLength(counts []int, maskLength, n int) {
+	if maskLength >= 0 && maskLength < len(counts) {
+		counts[maskLength] += n
+	}
+}
+
+// fill copies the counts into a Stats, including the derived totals, under a
+// single read lock so the reader sees one consistent snapshot.
+func (c *liveCounts) fill(s *Stats) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	s.ASNs = c.asns
+	s.IPv4Prefixes = c.prefixesV4
+	s.IPv6Prefixes = c.prefixesV6
+	s.Prefixes = c.prefixesV4 + c.prefixesV6
+	s.Peerings = c.peerings
+	s.Peers = c.peers
+	s.IPv4Routes = c.routesV4
+	s.IPv6Routes = c.routesV6
+	s.LiveRoutes = c.routesV4 + c.routesV6
+	s.IPv4PrefixDistribution = distributionList(c.distributionV4[:])
+	s.IPv6PrefixDistribution = distributionList(c.distributionV6[:])
+}
+
+// distributionList lists the mask lengths that have at least one prefix, in
+// ascending order, the way the distribution query returns them.
+func distributionList(counts []int) []PrefixDistribution {
+	var list []PrefixDistribution
+	for maskLength, count := range counts {
+		if count > 0 {
+			list = append(list, PrefixDistribution{MaskLength: maskLength, Count: count})
+		}
+	}
+
+	return list
+}
+
+// countRows returns the number of rows in the named table. It is used only at
+// startup to seed the in-memory counters, so a full COUNT(*) is acceptable.
+func (d *Database) countRows(ctx context.Context, table string) (int, error) {
+	var n int
+	// table is one of a fixed set of literals below, never external input.
+	if err := d.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM "+table).Scan(&n); err != nil {
+		return 0, fmt.Errorf("failed to count %s: %w", table, err)
+	}
+
+	return n, nil
+}
+
+// seedCounts reads the current row counts and prefix distribution from the
+// tables into the in-memory counters. It runs once at startup, before the
+// streamer begins writing.
+func (d *Database) seedCounts(ctx context.Context) error {
+	asns, err := d.countRows(ctx, "asns")
+	if err != nil {
+		return err
+	}
+	prefixesV4, err := d.countRows(ctx, "prefixes_v4")
+	if err != nil {
+		return err
+	}
+	prefixesV6, err := d.countRows(ctx, "prefixes_v6")
+	if err != nil {
+		return err
+	}
+	peerings, err := d.countRows(ctx, "peerings")
+	if err != nil {
+		return err
+	}
+	peers, err := d.countRows(ctx, "bgp_peers")
+	if err != nil {
+		return err
+	}
+	routesV4, err := d.countRows(ctx, "live_routes_v4")
+	if err != nil {
+		return err
+	}
+	routesV6, err := d.countRows(ctx, "live_routes_v6")
+	if err != nil {
+		return err
+	}
+	distributionV4, distributionV6, err := d.GetPrefixDistributionContext(ctx)
+	if err != nil {
+		return err
+	}
+
+	d.counts.seed(asns, prefixesV4, prefixesV6, peerings, peers, routesV4, routesV6,
+		distributionV4, distributionV6)
+
+	return nil
+}

internal/database/counts_test.go

@@ -0,0 +1,511 @@
+package database
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"github.com/google/uuid"
+)
+
+// mkV4Route builds an IPv4 live route with its mask length taken from the
+// prefix.
+func mkV4Route(t *testing.T, prefix string, asn int, ts time.Time) *LiveRoute {
+	t.Helper()
+
+	maskLength, err := prefixMaskLength(prefix)
+	if err != nil {
+		t.Fatalf("prefixMaskLength(%s): %v", prefix, err)
+	}
+
+	return &LiveRoute{
+		ID:          uuid.New(),
+		Prefix:      prefix,
+		MaskLength:  maskLength,
+		IPVersion:   ipVersionV4,
+		OriginASN:   asn,
+		PeerIP:      "192.0.2.1",
+		ASPath:      []int{asn},
+		NextHop:     "192.0.2.254",
+		LastUpdated: ts,
+	}
+}
+
+// mkV6Route builds an IPv6 live route.
+func mkV6Route(prefix string, asn int, ts time.Time) *LiveRoute {
+	return &LiveRoute{
+		ID:          uuid.New(),
+		Prefix:      prefix,
+		MaskLength:  32,
+		IPVersion:   ipVersionV6,
+		OriginASN:   asn,
+		PeerIP:      "2001:db8::1",
+		ASPath:      []int{asn},
+		NextHop:     "2001:db8::ffff",
+		LastUpdated: ts,
+	}
+}
+
+// TestLiveCountsTrackWritesInRealtime checks that the stats counts start at
+// zero, reflect each write the moment it commits (no recompute, no timer), do
+// not move when a route is merely re-announced, and drop when a route is
+// deleted. These counts are what /api/v1/stats reports; before this change the
+// endpoint recomputed them with a COUNT(*) over each table on every request.
+func TestLiveCountsTrackWritesInRealtime(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	empty, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext on empty database: %v", err)
+	}
+	if empty.ASNs != 0 || empty.Prefixes != 0 || empty.Peerings != 0 ||
+		empty.Peers != 0 || empty.LiveRoutes != 0 {
+		t.Fatalf("empty database counts nonzero: %+v", empty)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	if err := db.GetOrCreateASNBatch(map[int]time.Time{64500: ts, 64501: ts}); err != nil {
+		t.Fatalf("GetOrCreateASNBatch: %v", err)
+	}
+	if err := db.UpdatePrefixesBatch(map[string]time.Time{
+		"198.51.100.0/24": ts,
+		"2001:db8::/32":   ts,
+	}); err != nil {
+		t.Fatalf("UpdatePrefixesBatch: %v", err)
+	}
+	if err := db.UpdatePeerBatch(map[string]PeerUpdate{
+		"192.0.2.1": {PeerIP: "192.0.2.1", PeerASN: 64500, MessageType: "UPDATE", Timestamp: ts},
+	}); err != nil {
+		t.Fatalf("UpdatePeerBatch: %v", err)
+	}
+	if err := db.RecordPeering(64500, 64501, ts); err != nil {
+		t.Fatalf("RecordPeering: %v", err)
+	}
+
+	routes := []*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, ts),
+		mkV4Route(t, "203.0.113.0/24", 64501, ts.Add(time.Minute)),
+		mkV6Route("2001:db8::/32", 64502, ts.Add(2*time.Minute)),
+	}
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	assertCounts(t, "after inserts", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 2, ipv6Routes: 1, liveRoutes: 3,
+	})
+
+	// Re-announcing the same routes is an update, not an insert: counts hold.
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch (re-announce): %v", err)
+	}
+	stats, err = db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	assertCounts(t, "after re-announce", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 2, ipv6Routes: 1, liveRoutes: 3,
+	})
+
+	// A withdrawal removes one route.
+	if err := db.DeleteLiveRouteBatch([]LiveRouteDeletion{
+		{Prefix: "203.0.113.0/24", OriginASN: 64501, PeerIP: "192.0.2.1", IPVersion: ipVersionV4},
+	}); err != nil {
+		t.Fatalf("DeleteLiveRouteBatch: %v", err)
+	}
+	stats, err = db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	assertCounts(t, "after delete", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 1, ipv6Routes: 1, liveRoutes: 2,
+	})
+}
+
+// TestLiveCountsSeededFromDatabaseAtStartup writes rows, reopens the same
+// database file, and checks the counts and the prefix distribution come back
+// from the seed scan rather than starting at zero.
+func TestLiveCountsSeededFromDatabaseAtStartup(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	if err := db.GetOrCreateASNBatch(map[int]time.Time{64500: ts, 64501: ts, 64502: ts}); err != nil {
+		t.Fatalf("GetOrCreateASNBatch: %v", err)
+	}
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, ts),
+		mkV6Route("2001:db8::/32", 64502, ts),
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	reopened, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to reopen database: %v", err)
+	}
+	defer func() { _ = reopened.Close() }()
+
+	stats, err := reopened.GetStatsContext(context.Background())
+	if err != nil {
+		t.Fatalf("GetStatsContext after reopen: %v", err)
+	}
+	if stats.ASNs != 3 {
+		t.Errorf("seeded ASNs = %d, want 3", stats.ASNs)
+	}
+	if stats.IPv4Routes != 1 || stats.IPv6Routes != 1 || stats.LiveRoutes != 2 {
+		t.Errorf("seeded routes = (v4 %d, v6 %d, total %d), want (1, 1, 2)",
+			stats.IPv4Routes, stats.IPv6Routes, stats.LiveRoutes)
+	}
+	assertDistribution(t, "seeded IPv4 distribution", stats.IPv4PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 24, Count: 1}})
+	assertDistribution(t, "seeded IPv6 distribution", stats.IPv6PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 32, Count: 1}})
+}
+
+// TestPrefixDistributionTracksWrites checks that the prefix distribution the
+// stats read reports stays exact across each kind of live-route write, and that
+// after every step it equals what the distribution query reads from the route
+// tables. The steps run once through the batch methods the prefix handler uses
+// and once through the single-route methods.
+func TestPrefixDistributionTracksWrites(t *testing.T) {
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	shared := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	sharedSecondPeer := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	sharedSecondPeer.PeerIP = "192.0.2.2"
+	other := mkV4Route(t, "203.0.113.0/24", 64501, ts)
+	wide := mkV4Route(t, "172.16.0.0/16", 64502, ts)
+	v6 := mkV6Route("2001:db8::/32", 64503, ts)
+	v6SecondPeer := mkV6Route("2001:db8::/32", 64503, ts)
+	v6SecondPeer.PeerIP = "2001:db8::2"
+
+	all := []PrefixDistribution{{MaskLength: 16, Count: 1}, {MaskLength: 24, Count: 2}}
+	v6Only := []PrefixDistribution{{MaskLength: 32, Count: 1}}
+
+	steps := []struct {
+		name     string
+		announce []*LiveRoute
+		withdraw []*LiveRoute
+		wantV4   []PrefixDistribution
+		wantV6   []PrefixDistribution
+	}{
+		{
+			name:     "new routes",
+			announce: []*LiveRoute{shared, other, wide, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "re-announcement",
+			announce: []*LiveRoute{shared, other, wide, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "second peer announces a prefix that has a live route",
+			announce: []*LiveRoute{sharedSecondPeer, v6SecondPeer},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "withdrawal of a route that is not the last for its prefix",
+			withdraw: []*LiveRoute{shared, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "withdrawal of the last route for a prefix",
+			withdraw: []*LiveRoute{sharedSecondPeer, v6SecondPeer},
+			wantV4:   []PrefixDistribution{{MaskLength: 16, Count: 1}, {MaskLength: 24, Count: 1}},
+		},
+		{
+			name:     "withdrawal of every remaining route",
+			withdraw: []*LiveRoute{other, wide},
+		},
+		{
+			name:     "two peers announce a new prefix together",
+			announce: []*LiveRoute{shared, sharedSecondPeer, v6, v6SecondPeer},
+			wantV4:   []PrefixDistribution{{MaskLength: 24, Count: 1}},
+			wantV6:   v6Only,
+		},
+		{
+			name:     "both routes for a prefix withdrawn together",
+			withdraw: []*LiveRoute{shared, sharedSecondPeer, v6, v6SecondPeer},
+		},
+		// The feed often withdraws a route that is not live. That must not take
+		// the prefix out of the distribution. A count wrongly taken below zero is
+		// left out of the answer, so the next step shows it: its announcement
+		// at the same mask length would then not be counted.
+		{
+			name:     "withdrawal of routes that are not live",
+			withdraw: []*LiveRoute{other, v6},
+		},
+		{
+			name:     "announcement after a withdrawal of routes that are not live",
+			announce: []*LiveRoute{other, v6},
+			wantV4:   []PrefixDistribution{{MaskLength: 24, Count: 1}},
+			wantV6:   v6Only,
+		},
+	}
+
+	for _, batch := range []bool{true, false} {
+		name := "single-route writes"
+		if batch {
+			name = "batch writes"
+		}
+
+		t.Run(name, func(t *testing.T) {
+			db, err := New(&config.Config{StateDir: t.TempDir()}, logger.New())
+			if err != nil {
+				t.Fatalf("failed to create database: %v", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			ctx := context.Background()
+			for _, step := range steps {
+				if err := announceRoutes(db, batch, step.announce); err != nil {
+					t.Fatalf("%s: announce: %v", step.name, err)
+				}
+				if err := withdrawRoutes(db, batch, step.withdraw); err != nil {
+					t.Fatalf("%s: withdraw: %v", step.name, err)
+				}
+
+				stats, err := db.GetStatsContext(ctx)
+				if err != nil {
+					t.Fatalf("%s: GetStatsContext: %v", step.name, err)
+				}
+				queryV4, queryV6, err := db.GetPrefixDistributionContext(ctx)
+				if err != nil {
+					t.Fatalf("%s: GetPrefixDistributionContext: %v", step.name, err)
+				}
+
+				assertDistribution(t, step.name+": IPv4 distribution", stats.IPv4PrefixDistribution, step.wantV4)
+				assertDistribution(t, step.name+": IPv6 distribution", stats.IPv6PrefixDistribution, step.wantV6)
+				assertDistribution(t, step.name+": IPv4 distribution query", queryV4, step.wantV4)
+				assertDistribution(t, step.name+": IPv6 distribution query", queryV6, step.wantV6)
+			}
+		})
+	}
+}
+
+// announceRoutes writes routes in one UpsertLiveRouteBatch, or with one
+// UpsertLiveRoute each.
+func announceRoutes(db *Database, batch bool, routes []*LiveRoute) error {
+	if batch {
+		return db.UpsertLiveRouteBatch(routes)
+	}
+	for _, route := range routes {
+		if err := db.UpsertLiveRoute(route); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// withdrawRoutes removes routes in one DeleteLiveRouteBatch, or with one
+// DeleteLiveRoute each. It names each route by prefix and peer only, with no
+// origin ASN, as a withdrawal from the feed does when its message carries no AS
+// path.
+func withdrawRoutes(db *Database, batch bool, routes []*LiveRoute) error {
+	if !batch {
+		for _, route := range routes {
+			if err := db.DeleteLiveRoute(route.Prefix, 0, route.PeerIP); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+
+	deletions := make([]LiveRouteDeletion, 0, len(routes))
+	for _, route := range routes {
+		deletions = append(deletions, LiveRouteDeletion{
+			Prefix: route.Prefix, PeerIP: route.PeerIP, IPVersion: route.IPVersion,
+		})
+	}
+
+	return db.DeleteLiveRouteBatch(deletions)
+}
+
+// TestStatsRouteTimestamps checks the oldest/newest route timestamps are read
+// from the right rows across both tables and parse into time.Time. The old
+// MIN/MAX union query read its result into *time.Time, which the driver could
+// not parse, so it logged a warning every call and left both timestamps nil.
+func TestStatsRouteTimestamps(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	empty, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext on empty database: %v", err)
+	}
+	if empty.OldestRoute != nil || empty.NewestRoute != nil {
+		t.Fatalf("empty database timestamps = (%v, %v), want (nil, nil)",
+			empty.OldestRoute, empty.NewestRoute)
+	}
+
+	base := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	oldest := base
+	newest := base.Add(2 * time.Minute)
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, base.Add(time.Minute)),
+		mkV4Route(t, "203.0.113.0/24", 64501, oldest),
+		mkV6Route("2001:db8::/32", 64502, newest),
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	if stats.OldestRoute == nil || !stats.OldestRoute.Equal(oldest) {
+		t.Errorf("OldestRoute = %v, want %v", stats.OldestRoute, oldest)
+	}
+	if stats.NewestRoute == nil || !stats.NewestRoute.Equal(newest) {
+		t.Errorf("NewestRoute = %v, want %v", stats.NewestRoute, newest)
+	}
+}
+
+// TestLiveCountsConcurrentReadWrite runs writers and stats readers at once so
+// the race detector proves the counters are safe under concurrent use.
+func TestLiveCountsConcurrentReadWrite(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	const writers = 4
+	var wg sync.WaitGroup
+
+	wg.Add(writers)
+	for w := range writers {
+		go func(base int) {
+			defer wg.Done()
+			for i := range 25 {
+				asn := 65000 + base*100 + i
+				route := mkV6Route("2001:db8::/32", asn, ts)
+				route.PeerIP = "2001:db8::" + uuid.NewString()
+				if err := db.UpsertLiveRoute(route); err != nil {
+					t.Errorf("UpsertLiveRoute: %v", err)
+
+					return
+				}
+			}
+		}(w)
+	}
+
+	var readerWG sync.WaitGroup
+	readerWG.Add(1)
+	stop := make(chan struct{})
+	go func() {
+		defer readerWG.Done()
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+				if _, err := db.GetStatsContext(context.Background()); err != nil {
+					t.Errorf("GetStatsContext: %v", err)
+
+					return
+				}
+			}
+		}
+	}()
+
+	wg.Wait()
+	close(stop)
+	readerWG.Wait()
+
+	stats, err := db.GetStatsContext(context.Background())
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	if want := writers * 25; stats.IPv6Routes != want {
+		t.Errorf("IPv6Routes = %d, want %d", stats.IPv6Routes, want)
+	}
+	// Every writer announced the same prefix, so it counts once.
+	assertDistribution(t, "IPv6 distribution", stats.IPv6PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 32, Count: 1}})
+}
+
+type wantCounts struct {
+	asns       int
+	prefixes   int
+	peerings   int
+	peers      int
+	ipv4Routes int
+	ipv6Routes int
+	liveRoutes int
+}
+
+func assertCounts(t *testing.T, when string, got Stats, want wantCounts) {
+	t.Helper()
+
+	if got.ASNs != want.asns {
+		t.Errorf("%s: ASNs = %d, want %d", when, got.ASNs, want.asns)
+	}
+	if got.Prefixes != want.prefixes {
+		t.Errorf("%s: Prefixes = %d, want %d", when, got.Prefixes, want.prefixes)
+	}
+	if got.Peerings != want.peerings {
+		t.Errorf("%s: Peerings = %d, want %d", when, got.Peerings, want.peerings)
+	}
+	if got.Peers != want.peers {
+		t.Errorf("%s: Peers = %d, want %d", when, got.Peers, want.peers)
+	}
+	if got.IPv4Routes != want.ipv4Routes {
+		t.Errorf("%s: IPv4Routes = %d, want %d", when, got.IPv4Routes, want.ipv4Routes)
+	}
+	if got.IPv6Routes != want.ipv6Routes {
+		t.Errorf("%s: IPv6Routes = %d, want %d", when, got.IPv6Routes, want.ipv6Routes)
+	}
+	if got.LiveRoutes != want.liveRoutes {
+		t.Errorf("%s: LiveRoutes = %d, want %d", when, got.LiveRoutes, want.liveRoutes)
+	}
+}
+
+func assertDistribution(t *testing.T, what string, got, want []PrefixDistribution) {
+	t.Helper()
+
+	if !slices.Equal(got, want) {
+		t.Errorf("%s = %v, want %v", what, got, want)
+	}
+}

internal/database/database_test.go

@@ -1,301 +1,696 @@
 package database
 
 import (
-	"net"
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/netip"
+	"slices"
+	"sync"
 	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"github.com/google/uuid"
 )
 
-func TestIPToUint32(t *testing.T) {
-	tests := []struct {
-		name     string
-		ip       string
-		expected uint32
-	}{
-		{
-			name:     "Simple IP",
-			ip:       "192.168.1.1",
-			expected: 3232235777, // 192<<24 + 168<<16 + 1<<8 + 1
-		},
-		{
-			name:     "Minimum IP",
-			ip:       "0.0.0.0",
-			expected: 0,
-		},
-		{
-			name:     "Maximum IP",
-			ip:       "255.255.255.255",
-			expected: 4294967295,
-		},
-		{
-			name:     "10.0.0.0",
-			ip:       "10.0.0.0",
-			expected: 167772160,
-		},
-		{
-			name:     "172.16.0.0",
-			ip:       "172.16.0.0",
-			expected: 2886729728,
-		},
-		{
-			name:     "8.8.8.8",
-			ip:       "8.8.8.8",
-			expected: 134744072,
-		},
-		{
-			name:     "1.2.3.4",
-			ip:       "1.2.3.4",
-			expected: 16909060,
-		},
+// tempStoreMemory is the PRAGMA temp_store value meaning "hold temp B-trees in
+// memory"; the DSN change must leave temp_store below this so they spill to disk.
+const tempStoreMemory = 2
+
+// autoVacuumIncremental is the PRAGMA auto_vacuum value meaning "incremental".
+const autoVacuumIncremental = 2
+
+// vacuumTestRoutes is how many routes the vacuum test writes and then deletes,
+// enough to leave many free pages in the file.
+const vacuumTestRoutes = 2000
+
+// heldConnections is how many pooled connections the pragma test holds open at
+// once so each is a distinct SQLite connection that parsed the DSN.
+const heldConnections = 5
+
+// testPeerIP is the peer every route in the IP lookup test is learned from.
+const testPeerIP = "192.0.2.254"
+
+// Parameters for the checkpoint-contention regression test.
+const (
+	// contentionIterations is how many batch writes race the checkpoint loop.
+	contentionIterations = 400
+	// contendedASNCount is the small set of ASNs the batches reuse, so most
+	// batches update existing rows and exercise the read-before-write path.
+	contendedASNCount = 16
+	// asnSecondBand offsets a second ASN per batch so each batch writes more
+	// than one row.
+	asnSecondBand = 100
+)
+
+// Parameters for the prefix-length sample tests.
+const (
+	// sampleLimit is how many prefixes the tests ask the sample for.
+	sampleLimit = 10
+	// sampledPrefixCount is how many prefixes the sampling test stores, more
+	// than sampleLimit so the sample has to choose among them.
+	sampledPrefixCount = 30
+	// secondV4PeerIP and secondV6PeerIP are the second peer each prefix is
+	// learned from, besides the one mkV4Route and mkV6Route set.
+	secondV4PeerIP = "192.0.2.2"
+	secondV6PeerIP = "2001:db8::2"
+	// largeSamplePrefixCount is how many prefixes the test of a mask length
+	// with more than maxPrefixesToShuffle prefixes stores: twice that, so about
+	// half of them come after the first maxPrefixesToShuffle+1 in text order.
+	largeSamplePrefixCount = 2 * maxPrefixesToShuffle
+	// largeSampleLimit is how many prefixes that test asks for. Each random
+	// lookup lands after the first maxPrefixesToShuffle+1 in text order about
+	// half the time, so none of them doing so is about as likely as
+	// largeSampleLimit coin tosses all coming up heads.
+	largeSampleLimit = 30
+	// liveRoutesV4Table and liveRoutesV6Table are the live route tables the
+	// tests pass to the sampling steps.
+	liveRoutesV4Table = "live_routes_v4"
+	liveRoutesV6Table = "live_routes_v6"
+)
+
+// TestGetIPInfoFindsMostSpecificLiveRoute stores nested live prefixes for both
+// families and checks that a lookup returns the most specific one covering the
+// address, ErrNoRoute when none covers it, and the next less specific prefix
+// once the only route of the most specific one is withdrawn.
+func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	// Nested live prefixes, each originated by its own AS.
+	origins := map[string]int{
+		"10.0.0.0/8":        64500,
+		"10.1.0.0/16":       64501,
+		"10.1.2.0/24":       64502,
+		"2001:db8::/32":     64500,
+		"2001:db8:1::/48":   64501,
+		"2001:db8:1:2::/64": 64502,
+	}
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	routes := make([]*LiveRoute, 0, len(origins))
+	for prefix, asn := range origins {
+		routes = append(routes, &LiveRoute{
+			ID:          uuid.New(),
+			Prefix:      prefix,
+			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
+			IPVersion:   detectIPVersion(prefix),
+			OriginASN:   asn,
+			PeerIP:      testPeerIP,
+			ASPath:      []int{asn},
+			NextHop:     testPeerIP,
+			LastUpdated: ts,
+		})
+	}
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ip := net.ParseIP(tt.ip)
-			if ip == nil {
-				t.Fatalf("Failed to parse IP: %s", tt.ip)
+	// lookup checks that ip resolves to the live prefix want, or to ErrNoRoute
+	// when want is empty.
+	lookup := func(ip, want string) {
+		t.Helper()
+
+		info, err := db.GetIPInfo(ip)
+		if want == "" {
+			if !errors.Is(err, ErrNoRoute) {
+				t.Errorf("GetIPInfo(%s) = %+v, %v; want ErrNoRoute", ip, info, err)
 			}
 
-			result := ipToUint32(ip)
-			if result != tt.expected {
-				t.Errorf("ipToUint32(%s) = %d, want %d", tt.ip, result, tt.expected)
-			}
+			return
+		}
+		if err != nil {
+			t.Errorf("GetIPInfo(%s): %v", ip, err)
 
-			// Test with IPv4-mapped IPv6 address
-			ip6 := net.ParseIP(tt.ip).To16()
-			if ip6 != nil {
-				result6 := ipToUint32(ip6)
-				if result6 != tt.expected {
-					t.Errorf("ipToUint32(%s as IPv6) = %d, want %d", tt.ip, result6, tt.expected)
-				}
-			}
-		})
+			return
+		}
+		if info.Netblock != want || info.MaskLength != netip.MustParsePrefix(want).Bits() ||
+			info.ASN != origins[want] {
+			t.Errorf("GetIPInfo(%s) = %s (mask %d) AS%d, want %s AS%d",
+				ip, info.Netblock, info.MaskLength, info.ASN, want, origins[want])
+		}
+	}
+
+	lookup("10.1.2.3", "10.1.2.0/24")
+	lookup("::ffff:10.1.2.3", "10.1.2.0/24")
+	lookup("10.1.3.4", "10.1.0.0/16")
+	lookup("10.2.0.1", "10.0.0.0/8")
+	lookup("192.0.2.1", "")
+	lookup("2001:db8:1:2::3", "2001:db8:1:2::/64")
+	lookup("2001:db8:1:3::4", "2001:db8:1::/48")
+	lookup("2001:db8:2::1", "2001:db8::/32")
+	lookup("2001:db9::1", "")
+
+	err = db.DeleteLiveRouteBatch([]LiveRouteDeletion{
+		{Prefix: "10.1.2.0/24", OriginASN: 64502, PeerIP: testPeerIP, IPVersion: ipVersionV4},
+		{Prefix: "2001:db8:1:2::/64", OriginASN: 64502, PeerIP: testPeerIP, IPVersion: ipVersionV6},
+	})
+	if err != nil {
+		t.Fatalf("DeleteLiveRouteBatch: %v", err)
+	}
+
+	lookup("10.1.2.3", "10.1.0.0/16")
+	lookup("2001:db8:1:2::3", "2001:db8:1::/48")
+}
+
+// TestGetIPInfoIgnoresShortRoutes checks that the IP lookup does not report a
+// default route, or a route shorter than /8 for IPv4 or /16 for IPv6, as the
+// route for an address, and that a route of exactly /8 or /16, or longer, still
+// is. The prefixes are written out so that a wrong limit fails the test.
+func TestGetIPInfoIgnoresShortRoutes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(prefix string, asn int) {
+		t.Helper()
+
+		err := db.UpsertLiveRouteBatch([]*LiveRoute{{
+			ID:          uuid.New(),
+			Prefix:      prefix,
+			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
+			IPVersion:   detectIPVersion(prefix),
+			OriginASN:   asn,
+			PeerIP:      testPeerIP,
+			ASPath:      []int{asn},
+			NextHop:     testPeerIP,
+			LastUpdated: ts,
+		}})
+		if err != nil {
+			t.Fatalf("UpsertLiveRouteBatch(%s): %v", prefix, err)
+		}
+	}
+
+	// lookup checks that ip resolves to the live prefix netblock from asn.
+	lookup := func(ip, netblock string, asn int) {
+		t.Helper()
+
+		info, err := db.GetIPInfo(ip)
+		if err != nil {
+			t.Errorf("GetIPInfo(%s): %v", ip, err)
+
+			return
+		}
+		if info.Netblock != netblock || info.ASN != asn {
+			t.Errorf("GetIPInfo(%s) = %s AS%d, want %s AS%d", ip, info.Netblock, info.ASN, netblock, asn)
+		}
+	}
+
+	// Default and very short routes, and routes one bit shorter than each limit.
+	announce("2000::/3", 64500)
+	announce("0.0.0.0/0", 64500)
+	announce("2000::/15", 64500)
+	announce("192.0.0.0/7", 64500)
+
+	for _, ip := range []string{"2001:db8::1", "192.0.2.1"} {
+		if info, err := db.GetIPInfo(ip); !errors.Is(err, ErrNoRoute) {
+			t.Errorf("GetIPInfo(%s) with only short routes = %+v, %v; want ErrNoRoute", ip, info, err)
+		}
+	}
+
+	// Routes of exactly the minimum length are used.
+	announce("2001::/16", 64501)
+	announce("192.0.0.0/8", 64501)
+
+	lookup("2001:db8::1", "2001::/16", 64501)
+	lookup("192.0.2.1", "192.0.0.0/8", 64501)
+
+	announce("2001:db8::/32", 64502)
+
+	lookup("2001:db8::1", "2001:db8::/32", 64502)
+}
+
+// TestConnectionPoolPragmas holds several pooled connections open at once and
+// checks each one carries the per-connection settings from the DSN, plus the
+// process-wide hard heap limit, and sees the new file with auto_vacuum
+// incremental.
+func TestConnectionPoolPragmas(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	// Hold distinct connections open simultaneously so the pool must open a new
+	// one (each parsing the DSN) rather than hand back the same connection.
+	conns := make([]*sql.Conn, 0, heldConnections)
+	defer func() {
+		for _, c := range conns {
+			_ = c.Close()
+		}
+	}()
+
+	for i := 0; i < heldConnections; i++ {
+		c, err := db.db.Conn(ctx)
+		if err != nil {
+			t.Fatalf("failed to open connection %d: %v", i, err)
+		}
+		conns = append(conns, c)
+	}
+
+	for i, c := range conns {
+		var cacheSize int
+		if err := c.QueryRowContext(ctx, "PRAGMA cache_size").Scan(&cacheSize); err != nil {
+			t.Fatalf("conn %d: failed to read cache_size: %v", i, err)
+		}
+		if cacheSize != sqliteCacheSizeKiB {
+			t.Errorf("conn %d: cache_size = %d, want %d", i, cacheSize, sqliteCacheSizeKiB)
+		}
+
+		var busyTimeout int
+		if err := c.QueryRowContext(ctx, "PRAGMA busy_timeout").Scan(&busyTimeout); err != nil {
+			t.Fatalf("conn %d: failed to read busy_timeout: %v", i, err)
+		}
+		if busyTimeout != sqliteBusyTimeoutMs {
+			t.Errorf("conn %d: busy_timeout = %d, want %d", i, busyTimeout, sqliteBusyTimeoutMs)
+		}
+
+		var tempStore int
+		if err := c.QueryRowContext(ctx, "PRAGMA temp_store").Scan(&tempStore); err != nil {
+			t.Fatalf("conn %d: failed to read temp_store: %v", i, err)
+		}
+		if tempStore == tempStoreMemory {
+			t.Errorf("conn %d: temp_store = %d, want anything but %d (MEMORY)", i, tempStore, tempStoreMemory)
+		}
+
+		var hardHeapLimit int64
+		if err := c.QueryRowContext(ctx, "PRAGMA hard_heap_limit").Scan(&hardHeapLimit); err != nil {
+			t.Fatalf("conn %d: failed to read hard_heap_limit: %v", i, err)
+		}
+		if hardHeapLimit != sqliteHardHeapLimitBytes {
+			t.Errorf("conn %d: hard_heap_limit = %d, want %d", i, hardHeapLimit, sqliteHardHeapLimitBytes)
+		}
+
+		var autoVacuum int
+		if err := c.QueryRowContext(ctx, "PRAGMA auto_vacuum").Scan(&autoVacuum); err != nil {
+			t.Fatalf("conn %d: failed to read auto_vacuum: %v", i, err)
+		}
+		if autoVacuum != autoVacuumIncremental {
+			t.Errorf("conn %d: auto_vacuum = %d, want %d (incremental)", i, autoVacuum, autoVacuumIncremental)
+		}
 	}
 }
 
-func TestCalculateIPv4Range(t *testing.T) {
-	tests := []struct {
-		name      string
-		cidr      string
-		wantStart uint32
-		wantEnd   uint32
-		wantErr   bool
-	}{
-		{
-			name:      "Single IP /32",
-			cidr:      "192.168.1.1/32",
-			wantStart: 3232235777,
-			wantEnd:   3232235777,
-		},
-		{
-			name:      "Class C /24",
-			cidr:      "192.168.1.0/24",
-			wantStart: 3232235776, // 192.168.1.0
-			wantEnd:   3232236031, // 192.168.1.255
-		},
-		{
-			name:      "Class B /16",
-			cidr:      "192.168.0.0/16",
-			wantStart: 3232235520, // 192.168.0.0
-			wantEnd:   3232301055, // 192.168.255.255
-		},
-		{
-			name:      "Class A /8",
-			cidr:      "10.0.0.0/8",
-			wantStart: 167772160, // 10.0.0.0
-			wantEnd:   184549375, // 10.255.255.255
-		},
-		{
-			name:      "Entire IPv4 space /0",
-			cidr:      "0.0.0.0/0",
-			wantStart: 0,
-			wantEnd:   4294967295,
-		},
-		{
-			name:      "Small subnet /30",
-			cidr:      "192.168.1.0/30",
-			wantStart: 3232235776, // 192.168.1.0
-			wantEnd:   3232235779, // 192.168.1.3
-		},
-		{
-			name:      "Medium subnet /20",
-			cidr:      "172.16.0.0/20",
-			wantStart: 2886729728, // 172.16.0.0
-			wantEnd:   2886733823, // 172.16.15.255
-		},
-		{
-			name:      "Private range 172.16/12",
-			cidr:      "172.16.0.0/12",
-			wantStart: 2886729728, // 172.16.0.0
-			wantEnd:   2887778303, // 172.31.255.255
-		},
-		{
-			name:      "Google DNS /29",
-			cidr:      "8.8.8.8/29",
-			wantStart: 134744072, // 8.8.8.8 (network is actually 8.8.8.8 with /29)
-			wantEnd:   134744079, // 8.8.8.15
-		},
-		{
-			name:      "Non-zero host bits",
-			cidr:      "192.168.1.5/24",
-			wantStart: 3232235776, // 192.168.1.0 (network address)
-			wantEnd:   3232236031, // 192.168.1.255
-		},
-		{
-			name:    "Invalid CIDR",
-			cidr:    "192.168.1.1/33",
-			wantErr: true,
-		},
-		{
-			name:    "Invalid IP",
-			cidr:    "256.256.256.256/24",
-			wantErr: true,
-		},
-		{
-			name:    "IPv6 CIDR",
-			cidr:    "2001:db8::/32",
-			wantErr: true,
-		},
-		{
-			name:    "Empty CIDR",
-			cidr:    "",
-			wantErr: true,
-		},
-		{
-			name:    "Missing mask",
-			cidr:    "192.168.1.1",
-			wantErr: true,
-		},
+// TestVacuumReturnsFreePages checks that after routes are deleted from a new
+// database, one Vacuum call returns every page they used. The deletes leave
+// fewer free pages than the 1000 Vacuum frees per call, so none may remain.
+// With auto_vacuum off (issue https://git.eeqj.de/sneak/routewatch/issues/43)
+// the free pages stayed in the file, and with the PRAGMA run by ExecContext
+// Vacuum freed only one page per call.
+func TestVacuumReturnsFreePages(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+	ts := time.Now().UTC()
+	const asn = 64500
+
+	routes := make([]*LiveRoute, 0, vacuumTestRoutes)
+	deletions := make([]LiveRouteDeletion, 0, vacuumTestRoutes)
+	for i := range vacuumTestRoutes {
+		route := mkV4Route(t, fmt.Sprintf("10.%d.%d.0/24", i/256, i%256), asn, ts)
+		routes = append(routes, route)
+		deletions = append(deletions, LiveRouteDeletion{
+			Prefix:    route.Prefix,
+			OriginASN: asn,
+			PeerIP:    route.PeerIP,
+			IPVersion: ipVersionV4,
+		})
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			start, end, err := CalculateIPv4Range(tt.cidr)
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("failed to write routes: %v", err)
+	}
+	if err := db.DeleteLiveRouteBatch(deletions); err != nil {
+		t.Fatalf("failed to delete routes: %v", err)
+	}
 
-			if tt.wantErr {
-				if err == nil {
-					t.Errorf("CalculateIPv4Range(%s) expected error, got nil", tt.cidr)
-				}
+	var before int
+	if err := db.db.QueryRowContext(ctx, "PRAGMA freelist_count").Scan(&before); err != nil {
+		t.Fatalf("failed to read freelist_count: %v", err)
+	}
+	if before == 0 {
+		t.Fatalf("no free pages after deleting %d routes", vacuumTestRoutes)
+	}
+
+	if err := db.Vacuum(ctx); err != nil {
+		t.Fatalf("Vacuum failed: %v", err)
+	}
+
+	var after int
+	if err := db.db.QueryRowContext(ctx, "PRAGMA freelist_count").Scan(&after); err != nil {
+		t.Fatalf("failed to read freelist_count: %v", err)
+	}
+	if after != 0 {
+		t.Errorf("free pages after Vacuum = %d of %d, want 0", after, before)
+	}
+}
+
+// TestBatchWriteDuringCheckpoint reproduces issue #25. A batch write reads
+// (SELECT) before it writes (INSERT/UPDATE). Under the default deferred locking
+// the transaction begins as a reader and, when the maintainer's WAL checkpoint
+// holds the write lock, its upgrade to writer fails immediately with "database
+// is locked" without honouring busy_timeout, dropping the batch. With
+// _txlock=immediate the transaction takes the write lock at BEGIN and waits, so
+// no batch is dropped. The checkpoint runs without the Database mutex, exactly
+// as the background maintainer does in production.
+func TestBatchWriteDuringCheckpoint(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for {
+			select {
+			case <-ctx.Done():
 				return
+			default:
+				_ = db.Checkpoint(ctx) // errors are the checkpoint's own to absorb
 			}
+		}
+	}()
 
-			if err != nil {
-				t.Errorf("CalculateIPv4Range(%s) unexpected error: %v", tt.cidr, err)
-				return
-			}
+	ts := time.Now().UTC()
+	for i := 0; i < contentionIterations; i++ {
+		asns := map[int]time.Time{
+			i % contendedASNCount:                   ts,
+			(i % contendedASNCount) + asnSecondBand: ts,
+		}
+		if err := db.GetOrCreateASNBatch(asns); err != nil {
+			cancel()
+			wg.Wait()
+			t.Fatalf("batch write failed under checkpoint contention: %v", err)
+		}
+	}
 
-			if start != tt.wantStart {
-				t.Errorf("CalculateIPv4Range(%s) start = %d, want %d", tt.cidr, start, tt.wantStart)
-			}
+	cancel()
+	wg.Wait()
+}
 
-			if end != tt.wantEnd {
-				t.Errorf("CalculateIPv4Range(%s) end = %d, want %d", tt.cidr, end, tt.wantEnd)
-			}
+// TestGetRandomPrefixesByLengthListsPrefixOnce stores one prefix of each
+// family learned from two peers in the same second and checks that the
+// prefix-length sample lists each of them once.
+func TestGetRandomPrefixesByLengthListsPrefixOnce(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
 
-			// Verify that start <= end
-			if start > end {
-				t.Errorf("CalculateIPv4Range(%s) start (%d) > end (%d)", tt.cidr, start, end)
-			}
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
 
-			// Verify the range size matches the CIDR mask
-			if !tt.wantErr && tt.cidr != "" {
-				_, ipNet, _ := net.ParseCIDR(tt.cidr)
-				if ipNet != nil {
-					ones, bits := ipNet.Mask.Size()
-					expectedSize := uint32(1) << uint(bits-ones)
-					actualSize := end - start + 1
-					if actualSize != expectedSize {
-						t.Errorf("CalculateIPv4Range(%s) range size = %d, want %d", tt.cidr, actualSize, expectedSize)
-					}
-				}
-			}
-		})
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	v4First := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	v4Second := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	v4Second.PeerIP = secondV4PeerIP
+	v6First := mkV6Route("2001:db8::/32", 64500, ts)
+	v6Second := mkV6Route("2001:db8::/32", 64500, ts)
+	v6Second.PeerIP = secondV6PeerIP
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{v4First, v4Second, v6First, v6Second}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	for _, want := range []*LiveRoute{v4First, v6First} {
+		routes, err := db.GetRandomPrefixesByLength(want.MaskLength, want.IPVersion, sampleLimit)
+		if err != nil {
+			t.Fatalf("GetRandomPrefixesByLength(%d, %d): %v", want.MaskLength, want.IPVersion, err)
+		}
+		if len(routes) != 1 || routes[0].Prefix != want.Prefix {
+			t.Errorf("GetRandomPrefixesByLength(%d, %d) = %+v, want %s listed once",
+				want.MaskLength, want.IPVersion, routes, want.Prefix)
+		}
 	}
 }
 
-func TestIPv4RangeIntegration(t *testing.T) {
-	// Test that our functions work correctly together
-	tests := []struct {
-		name          string
-		cidr          string
-		testIPs       []string
-		shouldContain []bool
-	}{
-		{
-			name: "192.168.1.0/24",
-			cidr: "192.168.1.0/24",
-			testIPs: []string{
-				"192.168.1.0",
-				"192.168.1.1",
-				"192.168.1.255",
-				"192.168.0.255",
-				"192.168.2.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
-		{
-			name: "10.0.0.0/8",
-			cidr: "10.0.0.0/8",
-			testIPs: []string{
-				"10.0.0.0",
-				"10.255.255.255",
-				"10.1.2.3",
-				"9.255.255.255",
-				"11.0.0.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
-		{
-			name: "172.16.0.0/12",
-			cidr: "172.16.0.0/12",
-			testIPs: []string{
-				"172.16.0.0",
-				"172.31.255.255",
-				"172.20.1.1",
-				"172.15.255.255",
-				"172.32.0.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
+// TestGetRandomPrefixesByLengthListsNewestRoute stores a prefix learned from
+// two peers at different times, the older route first, and checks that the
+// prefix-length sample lists the newer route.
+func TestGetRandomPrefixesByLengthListsNewestRoute(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	older := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	olderRoute := mkV4Route(t, "198.51.100.0/24", 64500, older)
+	newerRoute := mkV4Route(t, "198.51.100.0/24", 64500, older.Add(time.Minute))
+	newerRoute.PeerIP = secondV4PeerIP
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{olderRoute, newerRoute}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
 	}
 
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			start, end, err := CalculateIPv4Range(tt.cidr)
-			if err != nil {
-				t.Fatalf("Failed to calculate range for %s: %v", tt.cidr, err)
-			}
-
-			for i, testIP := range tt.testIPs {
-				ip := net.ParseIP(testIP)
-				if ip == nil {
-					t.Fatalf("Failed to parse test IP: %s", testIP)
-				}
-
-				ipUint := ipToUint32(ip)
-				contained := ipUint >= start && ipUint <= end
-
-				if contained != tt.shouldContain[i] {
-					t.Errorf("IP %s in range %s: got %v, want %v", testIP, tt.cidr, contained, tt.shouldContain[i])
-				}
-			}
-		})
+	routes, err := db.GetRandomPrefixesByLength(newerRoute.MaskLength, ipVersionV4, sampleLimit)
+	if err != nil {
+		t.Fatalf("GetRandomPrefixesByLength: %v", err)
+	}
+	if len(routes) != 1 || routes[0].PeerIP != newerRoute.PeerIP {
+		t.Errorf("GetRandomPrefixesByLength = %+v, want only the newer route, from %s",
+			routes, newerRoute.PeerIP)
 	}
 }
 
-func BenchmarkIPToUint32(b *testing.B) {
-	ip := net.ParseIP("192.168.1.1")
-	b.ResetTimer()
+// TestGetRandomPrefixesByLengthSamplesManyPrefixes stores more /24 prefixes
+// than the sample asks for, each followed by a /16 so that routes of another
+// mask length sit between the /24 rows, and each prefix learned from two peers
+// in the same second. It checks both the sample the pages get, picked from the
+// shuffled prefixes, and the random lookups used for a mask length with more
+// than maxPrefixesToShuffle prefixes.
+func TestGetRandomPrefixesByLengthSamplesManyPrefixes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
 
-	for i := 0; i < b.N; i++ {
-		_ = ipToUint32(ip)
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	var routes []*LiveRoute
+	var stored []string
+	for i := range sampledPrefixCount {
+		prefix := fmt.Sprintf("10.0.%d.0/24", i)
+		for _, p := range []string{prefix, fmt.Sprintf("172.%d.0.0/16", i)} {
+			first := mkV4Route(t, p, 64500, ts)
+			second := mkV4Route(t, p, 64500, ts)
+			second.PeerIP = secondV4PeerIP
+			routes = append(routes, first, second)
+		}
+		stored = append(stored, prefix)
+	}
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	slices.Sort(stored)
+
+	maskLength := routes[0].MaskLength
+	sample, err := db.GetRandomPrefixesByLength(maskLength, ipVersionV4, sampleLimit)
+	if err != nil {
+		t.Fatalf("GetRandomPrefixesByLength: %v", err)
+	}
+	var listed []string
+	for _, route := range sample {
+		listed = append(listed, route.Prefix)
+	}
+	checkPrefixSample(t, "GetRandomPrefixesByLength", listed, stored)
+
+	looked, err := db.samplePrefixesByLength(
+		context.Background(), liveRoutesV4Table, maskLength, sampleLimit, nil)
+	if err != nil {
+		t.Fatalf("samplePrefixesByLength: %v", err)
+	}
+	checkPrefixSample(t, "samplePrefixesByLength", looked, stored)
+}
+
+// checkPrefixSample checks that sample lists sampleLimit prefixes, each once
+// and each one of stored, and that it is not just the first sampleLimit of
+// stored, which is in text order.
+func checkPrefixSample(t *testing.T, name string, sample, stored []string) {
+	t.Helper()
+
+	if len(sample) != sampleLimit {
+		t.Errorf("%s listed %d prefixes, want %d", name, len(sample), sampleLimit)
+	}
+	listed := make(map[string]bool)
+	for _, prefix := range sample {
+		if listed[prefix] || !slices.Contains(stored, prefix) {
+			t.Errorf("%s lists %s twice or it is not one of the /24s", name, prefix)
+		}
+		listed[prefix] = true
+	}
+	if slices.Equal(slices.Sorted(slices.Values(sample)), stored[:sampleLimit]) {
+		t.Errorf("%s lists just the first %d prefixes in text order", name, sampleLimit)
 	}
 }
 
-func BenchmarkCalculateIPv4Range(b *testing.B) {
-	cidr := "192.168.0.0/16"
-	b.ResetTimer()
+// TestGetRandomPrefixesByLengthSamplesPastFirstPrefixes stores more prefixes
+// of one mask length than maxPrefixesToShuffle. It checks that
+// firstPrefixesByLength reads just the first maxPrefixesToShuffle+1 in text
+// order, and that the sample lists the prefixes asked for, each once, some of
+// them after those first ones, which only the random lookups reach.
+func TestGetRandomPrefixesByLengthSamplesPastFirstPrefixes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
 
-	for i := 0; i < b.N; i++ {
-		_, _, _ = CalculateIPv4Range(cidr)
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	var routes []*LiveRoute
+	var stored []string
+	for i := range largeSamplePrefixCount {
+		route := mkV6Route(fmt.Sprintf("2001:%x::/32", i), 64500, ts)
+		routes = append(routes, route)
+		stored = append(stored, route.Prefix)
+	}
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	slices.Sort(stored)
+	firstPrefixes := stored[:maxPrefixesToShuffle+1]
+
+	maskLength := routes[0].MaskLength
+	read, err := db.firstPrefixesByLength(
+		context.Background(), liveRoutesV6Table, maskLength, maxPrefixesToShuffle+1)
+	if err != nil {
+		t.Fatalf("firstPrefixesByLength: %v", err)
+	}
+	if !slices.Equal(read, firstPrefixes) {
+		t.Errorf("firstPrefixesByLength read %d prefixes, want the first %d in text order",
+			len(read), len(firstPrefixes))
+	}
+
+	sample, err := db.GetRandomPrefixesByLength(maskLength, ipVersionV6, largeSampleLimit)
+	if err != nil {
+		t.Fatalf("GetRandomPrefixesByLength: %v", err)
+	}
+	if len(sample) != largeSampleLimit {
+		t.Errorf("GetRandomPrefixesByLength listed %d prefixes, want %d", len(sample), largeSampleLimit)
+	}
+	listed := make(map[string]bool)
+	pastFirstPrefixes := 0
+	for _, route := range sample {
+		if listed[route.Prefix] {
+			t.Errorf("GetRandomPrefixesByLength lists %s twice", route.Prefix)
+		}
+		listed[route.Prefix] = true
+		if !slices.Contains(firstPrefixes, route.Prefix) {
+			pastFirstPrefixes++
+		}
+	}
+	if pastFirstPrefixes == 0 {
+		t.Errorf("GetRandomPrefixesByLength lists only prefixes among the first %d in text order",
+			len(firstPrefixes))
+	}
+}
+
+// TestSamplePrefixesByLengthFillsUpFromShuffled stores a single prefix, so
+// every random lookup lands on it, and checks that the sample still lists
+// sampleLimit prefixes: the stored one, then the shuffled ones in order. The
+// stored prefix is the second shuffled one, so the fill-up must skip it.
+func TestSamplePrefixesByLengthFillsUpFromShuffled(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	var shuffled []string
+	for i := range sampledPrefixCount {
+		shuffled = append(shuffled, fmt.Sprintf("10.0.%d.0/24", i))
+	}
+	route := mkV4Route(t, shuffled[1], 64500, time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC))
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{route}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	sample, err := db.samplePrefixesByLength(
+		context.Background(), liveRoutesV4Table, route.MaskLength, sampleLimit, shuffled)
+	if err != nil {
+		t.Fatalf("samplePrefixesByLength: %v", err)
+	}
+	want := append([]string{shuffled[1], shuffled[0]}, shuffled[2:sampleLimit]...)
+	if !slices.Equal(sample, want) {
+		t.Errorf("samplePrefixesByLength = %v, want %v", sample, want)
+	}
+}
+
+// TestGetRandomPrefixesByLengthSkipsWithdrawnRoutes withdraws a route after
+// storing it, as can happen between the steps of GetRandomPrefixesByLength. It
+// checks that the random lookups pick nothing for a mask length with no route
+// left, and that only the prefixes that still have a route get their newest
+// route listed.
+func TestGetRandomPrefixesByLengthSkipsWithdrawnRoutes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	kept := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	withdrawn := mkV4Route(t, "172.16.0.0/16", 64500, ts)
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{kept, withdrawn}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	if err := db.DeleteLiveRoute(withdrawn.Prefix, withdrawn.OriginASN, withdrawn.PeerIP); err != nil {
+		t.Fatalf("DeleteLiveRoute: %v", err)
+	}
+
+	ctx := context.Background()
+	sample, err := db.samplePrefixesByLength(
+		ctx, liveRoutesV4Table, withdrawn.MaskLength, sampleLimit, []string{withdrawn.Prefix})
+	if err != nil {
+		t.Fatalf("samplePrefixesByLength: %v", err)
+	}
+	if len(sample) != 0 {
+		t.Errorf("samplePrefixesByLength = %v, want none for a mask length with no route left", sample)
+	}
+
+	routes, err := db.newestRouteOfEachPrefix(
+		ctx, liveRoutesV4Table, ipVersionV4, []string{withdrawn.Prefix, kept.Prefix})
+	if err != nil {
+		t.Fatalf("newestRouteOfEachPrefix: %v", err)
+	}
+	if len(routes) != 1 || routes[0].Prefix != kept.Prefix {
+		t.Errorf("newestRouteOfEachPrefix = %+v, want only the route of %s", routes, kept.Prefix)
 	}
 }

internal/database/interface.go

@@ -18,6 +18,10 @@ type Stats struct {
 	Peers                  int
 	FileSizeBytes          int64
 	LiveRoutes             int
+	IPv4Routes             int
+	IPv6Routes             int
+	OldestRoute            *time.Time
+	NewestRoute            *time.Time
 	IPv4PrefixDistribution []PrefixDistribution
 	IPv6PrefixDistribution []PrefixDistribution
 }
@@ -59,8 +63,6 @@ type Store interface {
 	GetLiveRouteCountsContext(ctx context.Context) (ipv4Count, ipv6Count int, err error)
 
 	// IP lookup operations
-	GetASInfoForIP(ip string) (*ASInfo, error)
-	GetASInfoForIPContext(ctx context.Context, ip string) (*ASInfo, error)
 	GetIPInfo(ip string) (*IPInfo, error)
 	GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, error)
 
@@ -74,8 +76,8 @@ type Store interface {
 	GetASDetailsContext(ctx context.Context, asn int) (*ASN, []LiveRoute, error)
 	GetASPeers(asn int) ([]ASPeer, error)
 	GetASPeersContext(ctx context.Context, asn int) ([]ASPeer, error)
-	GetPrefixDetails(prefix string) ([]LiveRoute, error)
-	GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, error)
+	GetPrefixDetails(prefix string) ([]LiveRoute, map[int]ASN, error)
+	GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, map[int]ASN, error)
 	GetRandomPrefixesByLength(maskLength, ipVersion, limit int) ([]LiveRoute, error)
 	GetRandomPrefixesByLengthContext(ctx context.Context, maskLength, ipVersion, limit int) ([]LiveRoute, error)
 
@@ -85,6 +87,8 @@ type Store interface {
 	// Maintenance operations
 	Vacuum(ctx context.Context) error
 	Analyze(ctx context.Context) error
+	Checkpoint(ctx context.Context) error
+	Ping(ctx context.Context) error
 }
 
 // Ensure Database implements Store

internal/database/models.go

@@ -77,9 +77,6 @@ type LiveRoute struct {
 	ASPath      []int     `json:"as_path"`
 	NextHop     string    `json:"next_hop"`
 	LastUpdated time.Time `json:"last_updated"`
-	// IPv4 range fields for fast lookups (nil for IPv6)
-	V4IPStart *uint32 `json:"v4_ip_start,omitempty"`
-	V4IPEnd   *uint32 `json:"v4_ip_end,omitempty"`
 }
 
 // PrefixDistribution represents the distribution of prefixes by mask length
@@ -88,16 +85,6 @@ type PrefixDistribution struct {
 	Count      int `json:"count"`
 }
 
-// ASInfo represents AS information for an IP lookup (legacy format)
-type ASInfo struct {
-	ASN         int       `json:"asn"`
-	Handle      string    `json:"handle"`
-	Description string    `json:"description"`
-	Prefix      string    `json:"prefix"`
-	LastUpdated time.Time `json:"last_updated"`
-	Age         string    `json:"age"`
-}
-
 // IPInfo represents comprehensive IP information for the /ip endpoint
 type IPInfo struct {
 	IP         string   `json:"ip"`

internal/database/schema.sql

@@ -107,9 +107,6 @@ CREATE TABLE IF NOT EXISTS live_routes_v4 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	-- IPv4 range columns for fast lookups
-	ip_start INTEGER NOT NULL, -- Start of IPv4 range as 32-bit unsigned int
-	ip_end INTEGER NOT NULL,    -- End of IPv4 range as 32-bit unsigned int
 	UNIQUE(prefix, origin_asn, peer_ip)
 );
 
@@ -123,7 +120,6 @@ CREATE TABLE IF NOT EXISTS live_routes_v6 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	-- Note: IPv6 doesn't use integer range columns
 	UNIQUE(prefix, origin_asn, peer_ip)
 );
 
@@ -132,8 +128,6 @@ CREATE INDEX IF NOT EXISTS idx_live_routes_v4_prefix ON live_routes_v4(prefix);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_mask_length ON live_routes_v4(mask_length);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_origin_asn ON live_routes_v4(origin_asn);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_last_updated ON live_routes_v4(last_updated);
--- Indexes for IPv4 range queries
-CREATE INDEX IF NOT EXISTS idx_live_routes_v4_ip_range ON live_routes_v4(ip_start, ip_end);
 -- Index to optimize prefix distribution queries
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_mask_prefix ON live_routes_v4(mask_length, prefix);
 

internal/database/utils.go

@@ -1,6 +1,8 @@
 package database
 
 import (
+	"fmt"
+	"net"
 	"strings"
 
 	"github.com/google/uuid"
@@ -18,3 +20,14 @@ func detectIPVersion(prefix string) int {
 
 	return ipVersionV4
 }
+
+// prefixMaskLength returns the mask length of a prefix such as 192.0.2.0/24.
+func prefixMaskLength(prefix string) (int, error) {
+	_, network, err := net.ParseCIDR(prefix)
+	if err != nil {
+		return 0, fmt.Errorf("invalid prefix %s: %w", prefix, err)
+	}
+	maskLength, _ := network.Mask.Size()
+
+	return maskLength, nil
+}

internal/metrics/metrics.go

@@ -60,17 +60,22 @@ func New() *Tracker {
 	}
 }
 
-// SetConnected updates the connection status
+// SetConnected updates the connection status. Every connection after the
+// first counts one reconnect.
 func (t *Tracker) SetConnected(connected bool) {
-	wasConnected := t.isConnected.Swap(connected)
-	if connected {
-		t.mu.Lock()
-		t.connectedSince = time.Now()
-		t.mu.Unlock()
-		// Increment reconnect count (but not for the initial connection)
-		if wasConnected || t.reconnectCount.Load() > 0 {
-			t.reconnectCount.Add(1)
-		}
+	t.isConnected.Store(connected)
+	if !connected {
+		return
+	}
+
+	t.mu.Lock()
+	// connectedSince is zero until the first connection.
+	connectedBefore := !t.connectedSince.IsZero()
+	t.connectedSince = time.Now()
+	t.mu.Unlock()
+
+	if connectedBefore {
+		t.reconnectCount.Add(1)
 	}
 }
 

internal/metrics/metrics_test.go

@@ -0,0 +1,21 @@
+package metrics
+
+import "testing"
+
+// TestReconnectCount connects three times with a disconnect between each, the
+// way the streamer does, and expects every connection after the first to count
+// one reconnect.
+func TestReconnectCount(t *testing.T) {
+	tracker := New()
+
+	tracker.SetConnected(true)
+	tracker.SetConnected(false)
+	tracker.SetConnected(true)
+	tracker.SetConnected(false)
+	tracker.SetConnected(true)
+
+	const wantReconnects = 2
+	if got := tracker.GetReconnectCount(); got != wantReconnects {
+		t.Fatalf("reconnect count = %d, want %d", got, wantReconnects)
+	}
+}

internal/ristypes/ris.go

@@ -63,24 +63,28 @@ type RISLiveMessage struct {
 // the actual BGP update data including AS path, communities, announcements,
 // and withdrawals.
 type RISMessage struct {
-	Type            string            `json:"type"`
-	Timestamp       float64           `json:"timestamp"`
-	ParsedTimestamp time.Time         `json:"-"` // Parsed from Timestamp field
-	Peer            string            `json:"peer"`
-	PeerASN         string            `json:"peer_asn"`
-	ID              string            `json:"id"`
-	Host            string            `json:"host"`
-	RRC             string            `json:"rrc,omitempty"`
-	MrtTime         float64           `json:"mrt_time,omitempty"`
-	SocketTime      float64           `json:"socket_time,omitempty"`
-	Path            ASPath            `json:"path,omitempty"`
-	Community       [][]int           `json:"community,omitempty"`
-	Origin          string            `json:"origin,omitempty"`
-	MED             *int              `json:"med,omitempty"`
-	LocalPref       *int              `json:"local_pref,omitempty"`
-	Announcements   []RISAnnouncement `json:"announcements,omitempty"`
-	Withdrawals     []string          `json:"withdrawals,omitempty"`
-	Raw             string            `json:"raw,omitempty"`
+	Type            string    `json:"type"`
+	Timestamp       float64   `json:"timestamp"`
+	ParsedTimestamp time.Time `json:"-"` // Parsed from Timestamp field
+	Peer            string    `json:"peer"`
+	PeerASN         string    `json:"peer_asn"`
+	ID              string    `json:"id"`
+	Host            string    `json:"host"`
+	RRC             string    `json:"rrc,omitempty"`
+	MrtTime         float64   `json:"mrt_time,omitempty"`
+	SocketTime      float64   `json:"socket_time,omitempty"`
+	Path            ASPath    `json:"path,omitempty"`
+	// Community and Raw are present in the feed but read by no handler.
+	// They are the largest fields on a message that lives in up to four
+	// handler queues, so json:"-" keeps them out of the decoded message
+	// to save queue memory. Do not decode them without a consumer.
+	Community     [][]int           `json:"-"`
+	Origin        string            `json:"origin,omitempty"`
+	MED           *int              `json:"med,omitempty"`
+	LocalPref     *int              `json:"local_pref,omitempty"`
+	Announcements []RISAnnouncement `json:"announcements,omitempty"`
+	Withdrawals   []string          `json:"withdrawals,omitempty"`
+	Raw           string            `json:"-"`
 }
 
 // RISAnnouncement represents a BGP route announcement within a RIS message.

internal/ristypes/ris_test.go

@@ -0,0 +1,67 @@
+package ristypes
+
+import (
+	"bufio"
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+// messageExamplesPath is the captured RIS Live feed used as decode fixtures,
+// one JSON message per line.
+const messageExamplesPath = "../../docs/message-examples.json"
+
+// TestDecodeDropsCommunityAndRaw decodes every captured message the way the
+// streamer does and checks that the fields no handler reads (Community, Raw)
+// stay empty while the fields handlers use (Path, Announcements) still decode.
+func TestDecodeDropsCommunityAndRaw(t *testing.T) {
+	f, err := os.Open(messageExamplesPath)
+	if err != nil {
+		t.Fatalf("open fixtures: %v", err)
+	}
+	defer f.Close()
+
+	var messages, withPath, withAnnouncements int
+
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+
+		var wrapper RISLiveMessage
+		if err := json.Unmarshal(line, &wrapper); err != nil {
+			t.Fatalf("unmarshal message %d: %v", messages+1, err)
+		}
+		messages++
+
+		msg := wrapper.Data
+		if msg.Community != nil {
+			t.Errorf("message %d: Community decoded, want empty: %v", messages, msg.Community)
+		}
+		if msg.Raw != "" {
+			t.Errorf("message %d: Raw decoded, want empty", messages)
+		}
+
+		if len(msg.Path) > 0 {
+			withPath++
+		}
+		if len(msg.Announcements) > 0 {
+			withAnnouncements++
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatalf("scan fixtures: %v", err)
+	}
+
+	if messages == 0 {
+		t.Fatal("no messages decoded from fixtures")
+	}
+	// The fixtures include announcement messages; a used field must still decode,
+	// otherwise an empty Community/Raw would prove nothing.
+	if withPath == 0 || withAnnouncements == 0 {
+		t.Fatalf("used fields did not decode: withPath=%d withAnnouncements=%d", withPath, withAnnouncements)
+	}
+}

internal/routewatch/app_integration_test.go

@@ -232,25 +232,6 @@ func (m *mockStore) GetLiveRouteCountsContext(ctx context.Context) (ipv4Count, i
 	return m.GetLiveRouteCounts()
 }
 
-// GetASInfoForIP mock implementation
-func (m *mockStore) GetASInfoForIP(ip string) (*database.ASInfo, error) {
-	// Simple mock - return a test AS
-	now := time.Now()
-	return &database.ASInfo{
-		ASN:         15169,
-		Handle:      "GOOGLE",
-		Description: "Google LLC",
-		Prefix:      "8.8.8.0/24",
-		LastUpdated: now.Add(-5 * time.Minute),
-		Age:         "5m0s",
-	}, nil
-}
-
-// GetASInfoForIPContext mock implementation with context support
-func (m *mockStore) GetASInfoForIPContext(ctx context.Context, ip string) (*database.ASInfo, error) {
-	return m.GetASInfoForIP(ip)
-}
-
 // GetASDetails mock implementation
 func (m *mockStore) GetASDetails(asn int) (*database.ASN, []database.LiveRoute, error) {
 	m.mu.Lock()
@@ -271,13 +252,15 @@ func (m *mockStore) GetASDetailsContext(ctx context.Context, asn int) (*database
 }
 
 // GetPrefixDetails mock implementation
-func (m *mockStore) GetPrefixDetails(prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetails(prefix string) ([]database.LiveRoute, map[int]database.ASN, error) {
 	// Return empty routes for now
-	return []database.LiveRoute{}, nil
+	return []database.LiveRoute{}, map[int]database.ASN{}, nil
 }
 
 // GetPrefixDetailsContext mock implementation with context support
-func (m *mockStore) GetPrefixDetailsContext(ctx context.Context, prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetailsContext(
+	ctx context.Context, prefix string,
+) ([]database.LiveRoute, map[int]database.ASN, error) {
 	return m.GetPrefixDetails(prefix)
 }
 
@@ -415,7 +398,20 @@ func (m *mockStore) Analyze(ctx context.Context) error {
 	return nil
 }
 
+// Checkpoint mock implementation
+func (m *mockStore) Checkpoint(ctx context.Context) error {
+	return nil
+}
+
+// Ping mock implementation
+func (m *mockStore) Ping(ctx context.Context) error {
+	return nil
+}
+
 func TestRouteWatchLiveFeed(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping live RIPE RIS network feed test in short mode; run without -short to include it")
+	}
 
 	// Create mock database
 	mockDB := newMockStore()
@@ -437,7 +433,7 @@ func TestRouteWatchLiveFeed(t *testing.T) {
 	}
 
 	// Create server
-	srv := server.New(mockDB, s, logger)
+	srv := server.New(mockDB, s, logger, cfg)
 
 	// Create RouteWatch with 5 second limit
 	deps := Dependencies{

internal/routewatch/ashandler.go

@@ -10,9 +10,11 @@ import (
 )
 
 const (
-	// asHandlerQueueSize is the queue capacity for ASN operations
-	// DO NOT set this higher than 100000 without explicit instructions
-	asHandlerQueueSize = 100000
+	// asHandlerQueueSize is the queue capacity for ASN operations, about 4
+	// seconds of feed at peak. The streamer drops rather than blocks when a
+	// queue is full, so this bounds memory. Batches still flush on a timer
+	// (asnBatchTimeout), so a queue smaller than asnBatchSize is fine.
+	asHandlerQueueSize = 20000
 
 	// asnBatchSize is the number of ASN operations to batch together
 	asnBatchSize = 30000

internal/routewatch/asnfetcher.go

@@ -36,7 +36,6 @@ const (
 	statsWindow = time.Hour
 )
 
-
 // ASNFetcher handles background WHOIS lookups for ASNs.
 type ASNFetcher struct {
 	db             database.Store
@@ -55,9 +54,9 @@ type ASNFetcher struct {
 	consecutiveFails int
 
 	// hourly stats tracking
-	statsMu        sync.Mutex
-	successTimes   []time.Time
-	errorTimes     []time.Time
+	statsMu      sync.Mutex
+	successTimes []time.Time
+	errorTimes   []time.Time
 }
 
 // NewASNFetcher creates a new ASN fetcher.

internal/routewatch/cli.go

@@ -20,6 +20,8 @@ const (
 	debugInterval = 60 * time.Second
 	// bytesPerMB is bytes per megabyte
 	bytesPerMB = 1024 * 1024
+	// failureExitCode is the exit status when RouteWatch stops on an error
+	failureExitCode = 1
 )
 
 // logDebugStats logs goroutine count and memory usage
@@ -83,6 +85,9 @@ func CLIEntry() {
 					go func() {
 						if err := rw.Run(ctx); err != nil {
 							logger.Error("RouteWatch error", "error", err)
+							if err := shutdowner.Shutdown(fx.ExitCode(failureExitCode)); err != nil {
+								logger.Error("Failed to shutdown gracefully", "error", err)
+							}
 						}
 					}()
 

internal/routewatch/dbmaintainer.go

@@ -12,6 +12,11 @@ import (
 
 // Database maintenance configuration constants.
 const (
+	// checkpointInterval is how often to run WAL checkpoint.
+	// Frequent checkpoints keep the WAL small, improving read performance.
+	// Under heavy write load, we need aggressive checkpointing.
+	checkpointInterval = 5 * time.Second
+
 	// vacuumInterval is how often to run incremental vacuum.
 	// Since incremental vacuum only frees ~1000 pages (~4MB) per run,
 	// we run it frequently to keep up with deletions.
@@ -20,6 +25,9 @@ const (
 	// analyzeInterval is how often to run ANALYZE.
 	analyzeInterval = 1 * time.Hour
 
+	// checkpointTimeout is the max time for WAL checkpoint.
+	checkpointTimeout = 10 * time.Second
+
 	// vacuumTimeout is the max time for incremental vacuum (should be quick).
 	vacuumTimeout = 30 * time.Second
 
@@ -35,13 +43,16 @@ type DBMaintainer struct {
 	wg     sync.WaitGroup
 
 	// Stats tracking
-	statsMu          sync.Mutex
-	lastVacuum       time.Time
-	lastAnalyze      time.Time
-	vacuumCount      int
-	analyzeCount     int
-	lastVacuumError  error
-	lastAnalyzeError error
+	statsMu             sync.Mutex
+	lastCheckpoint      time.Time
+	lastVacuum          time.Time
+	lastAnalyze         time.Time
+	checkpointCount     int
+	vacuumCount         int
+	analyzeCount        int
+	lastCheckpointError error
+	lastVacuumError     error
+	lastAnalyzeError    error
 }
 
 // NewDBMaintainer creates a new database maintainer.
@@ -58,6 +69,7 @@ func (m *DBMaintainer) Start() {
 	m.wg.Add(1)
 	go m.run()
 	m.logger.Info("Database maintainer started",
+		"checkpoint_interval", checkpointInterval,
 		"vacuum_interval", vacuumInterval,
 		"analyze_interval", analyzeInterval,
 	)
@@ -75,8 +87,10 @@ func (m *DBMaintainer) run() {
 	defer m.wg.Done()
 
 	// Use different timers for each task
+	checkpointTimer := time.NewTimer(checkpointInterval)
 	vacuumTimer := time.NewTimer(vacuumInterval)
 	analyzeTimer := time.NewTimer(analyzeInterval)
+	defer checkpointTimer.Stop()
 	defer vacuumTimer.Stop()
 	defer analyzeTimer.Stop()
 
@@ -85,6 +99,10 @@ func (m *DBMaintainer) run() {
 		case <-m.stopCh:
 			return
 
+		case <-checkpointTimer.C:
+			m.runCheckpoint()
+			checkpointTimer.Reset(checkpointInterval)
+
 		case <-vacuumTimer.C:
 			m.runVacuum()
 			vacuumTimer.Reset(vacuumInterval)
@@ -96,6 +114,30 @@ func (m *DBMaintainer) run() {
 	}
 }
 
+// runCheckpoint performs a WAL checkpoint to keep the WAL file small.
+func (m *DBMaintainer) runCheckpoint() {
+	ctx, cancel := context.WithTimeout(context.Background(), checkpointTimeout)
+	defer cancel()
+
+	startTime := time.Now()
+
+	err := m.db.Checkpoint(ctx)
+
+	m.statsMu.Lock()
+	m.lastCheckpoint = time.Now()
+	m.lastCheckpointError = err
+	if err == nil {
+		m.checkpointCount++
+	}
+	m.statsMu.Unlock()
+
+	if err != nil {
+		m.logger.Error("WAL checkpoint failed", "error", err, "duration", time.Since(startTime))
+	} else {
+		m.logger.Debug("WAL checkpoint completed", "duration", time.Since(startTime))
+	}
+}
+
 // runVacuum performs an incremental vacuum operation on the database.
 func (m *DBMaintainer) runVacuum() {
 	ctx, cancel := context.WithTimeout(context.Background(), vacuumTimeout)

internal/routewatch/peerhandler.go

@@ -14,8 +14,11 @@ import (
 )
 
 const (
-	// peerHandlerQueueSize is the queue capacity for peer tracking operations
-	peerHandlerQueueSize = 100000
+	// peerHandlerQueueSize is the queue capacity for peer tracking operations,
+	// about 4 seconds of feed at peak. The streamer drops rather than blocks
+	// when a queue is full, so this bounds memory. Batches still flush on a
+	// timer (peerBatchTimeout).
+	peerHandlerQueueSize = 20000
 
 	// peerBatchSize is the number of peer updates to batch together
 	peerBatchSize = 10000

internal/routewatch/peeringhandler.go

@@ -11,29 +11,25 @@ import (
 )
 
 const (
-	// peeringHandlerQueueSize defines the buffer capacity for the peering
-	// handler's message queue. This should be large enough to handle bursts
-	// of BGP UPDATE messages without blocking.
-	peeringHandlerQueueSize = 100000
+	// peeringHandlerQueueSize is the buffer capacity for the peering handler's
+	// message queue, about 4 seconds of feed at peak. The streamer drops
+	// rather than blocks when a queue is full, so this bounds memory.
+	peeringHandlerQueueSize = 20000
 
 	// minPathLengthForPeering specifies the minimum number of ASNs required
 	// in a BGP AS path to extract peering relationships. A path with fewer
 	// than 2 ASNs cannot contain any peering information.
 	minPathLengthForPeering = 2
 
-	// pathExpirationTime determines how long AS paths are kept in memory
-	// before being eligible for pruning. Paths older than this are removed
-	// to prevent unbounded memory growth.
-	pathExpirationTime = 30 * time.Minute
-
 	// peeringProcessInterval controls how frequently the handler processes
 	// accumulated AS paths and extracts peering relationships to store
 	// in the database.
 	peeringProcessInterval = 30 * time.Second
 
-	// pathPruneInterval determines how often the handler checks for and
-	// removes expired AS paths from memory.
-	pathPruneInterval = 5 * time.Minute
+	// maxTrackedPaths bounds how many distinct AS paths are held in memory
+	// between processing runs. Once the map is full, further new paths are
+	// dropped and counted until the next run empties it.
+	maxTrackedPaths = 500000
 )
 
 // PeeringHandler processes BGP UPDATE messages to extract and track
@@ -46,17 +42,17 @@ type PeeringHandler struct {
 	logger *logger.Logger
 
 	// In-memory AS path tracking
-	mu      sync.RWMutex
-	asPaths map[string]time.Time // key is JSON-encoded AS path
+	mu           sync.Mutex
+	asPaths      map[string]time.Time // key is JSON-encoded AS path
+	droppedPaths int                  // paths dropped because the map was full
 
 	stopCh chan struct{}
 }
 
 // NewPeeringHandler creates and initializes a new PeeringHandler with the
-// provided database store and logger. It starts two background goroutines:
-// one for periodic processing of accumulated AS paths into peering records,
-// and one for pruning expired paths from memory. The handler begins
-// processing immediately upon creation.
+// provided database store and logger. It starts one background goroutine that
+// periodically processes accumulated AS paths into peering records. The
+// handler begins processing immediately upon creation.
 func NewPeeringHandler(db database.Store, logger *logger.Logger) *PeeringHandler {
 	h := &PeeringHandler{
 		db:      db,
@@ -65,9 +61,8 @@ func NewPeeringHandler(db database.Store, logger *logger.Logger) *PeeringHandler
 		stopCh:  make(chan struct{}),
 	}
 
-	// Start the periodic processing goroutines
+	// Start the periodic processing goroutine
 	go h.processLoop()
-	go h.pruneLoop()
 
 	return h
 }
@@ -106,9 +101,18 @@ func (h *PeeringHandler) HandleMessage(msg *ristypes.RISMessage) {
 
 		return
 	}
+	key := string(pathJSON)
 
 	h.mu.Lock()
-	h.asPaths[string(pathJSON)] = timestamp
+	if _, exists := h.asPaths[key]; exists {
+		// Already tracked: refresh its timestamp.
+		h.asPaths[key] = timestamp
+	} else if len(h.asPaths) >= maxTrackedPaths {
+		// Map is full; drop this new path and count it.
+		h.droppedPaths++
+	} else {
+		h.asPaths[key] = timestamp
+	}
 	h.mu.Unlock()
 }
 
@@ -130,41 +134,6 @@ func (h *PeeringHandler) processLoop() {
 	}
 }
 
-// pruneLoop runs periodically to remove old AS paths
-func (h *PeeringHandler) pruneLoop() {
-	ticker := time.NewTicker(pathPruneInterval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ticker.C:
-			h.prunePaths()
-		case <-h.stopCh:
-			return
-		}
-	}
-}
-
-// prunePaths removes AS paths older than pathExpirationTime
-func (h *PeeringHandler) prunePaths() {
-	cutoff := time.Now().Add(-pathExpirationTime)
-	var removed int
-
-	h.mu.Lock()
-	for pathKey, timestamp := range h.asPaths {
-		if timestamp.Before(cutoff) {
-			delete(h.asPaths, pathKey)
-			removed++
-		}
-	}
-	pathCount := len(h.asPaths)
-	h.mu.Unlock()
-
-	if removed > 0 {
-		h.logger.Debug("Pruned old AS paths", "removed", removed, "remaining", pathCount)
-	}
-}
-
 // ProcessPeeringsNow triggers immediate processing of all accumulated AS
 // paths into peering records. This bypasses the normal periodic processing
 // schedule and is primarily intended for testing purposes.
@@ -174,15 +143,16 @@ func (h *PeeringHandler) ProcessPeeringsNow() {
 
 // processPeerings extracts peerings from AS paths and writes to database
 func (h *PeeringHandler) processPeerings() {
-	// Take a snapshot of current AS paths
-	h.mu.RLock()
-	pathsCopy := make(map[string]time.Time, len(h.asPaths))
-	for k, v := range h.asPaths {
-		pathsCopy[k] = v
-	}
-	h.mu.RUnlock()
+	// Take the accumulated paths and replace the map with a fresh empty one
+	// under the lock. Each path is processed exactly once and the memory is
+	// released, so the map never grows past a single interval's traffic.
+	h.mu.Lock()
+	paths := h.asPaths
+	h.asPaths = make(map[string]time.Time)
+	dropped := h.droppedPaths
+	h.mu.Unlock()
 
-	if len(pathsCopy) == 0 {
+	if len(paths) == 0 {
 		return
 	}
 
@@ -192,7 +162,7 @@ func (h *PeeringHandler) processPeerings() {
 	}
 	peerings := make(map[peeringKey]time.Time)
 
-	for pathJSON, timestamp := range pathsCopy {
+	for pathJSON, timestamp := range paths {
 		var path []int
 		if err := json.Unmarshal([]byte(pathJSON), &path); err != nil {
 			h.logger.Error("Failed to decode AS path", "error", err)
@@ -241,15 +211,16 @@ func (h *PeeringHandler) processPeerings() {
 	}
 
 	h.logger.Info("Processed AS peerings",
-		"paths", len(pathsCopy),
+		"paths", len(paths),
 		"unique_peerings", len(peerings),
 		"success", successCount,
+		"dropped_paths", dropped,
 		"duration", time.Since(start),
 	)
 }
 
 // Stop gracefully shuts down the handler by signaling the background
-// goroutines to stop and performing a final synchronous processing of
+// goroutine to stop and performing a final synchronous processing of
 // any remaining AS paths. This ensures no peering data is lost during
 // shutdown.
 func (h *PeeringHandler) Stop() {

internal/routewatch/peeringhandler_test.go

@@ -0,0 +1,163 @@
+package routewatch
+
+import (
+	"encoding/json"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
+)
+
+const (
+	testASNA = 64500
+	testASNB = 64501
+	testASNC = 64502
+)
+
+// recordingStore wraps mockStore to count every RecordPeering call, so a
+// test can tell how many times a peering was written across separate runs.
+type recordingStore struct {
+	*mockStore
+
+	mu    sync.Mutex
+	calls int
+}
+
+func (r *recordingStore) RecordPeering(asA, asB int, ts time.Time) error {
+	r.mu.Lock()
+	r.calls++
+	r.mu.Unlock()
+
+	return r.mockStore.RecordPeering(asA, asB, ts)
+}
+
+func (r *recordingStore) callCount() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	return r.calls
+}
+
+// newTestHandler builds a PeeringHandler without starting the periodic
+// processing goroutine, so tests drive processing explicitly.
+func newTestHandler(db database.Store) *PeeringHandler {
+	return &PeeringHandler{
+		db:      db,
+		logger:  logger.New(),
+		asPaths: make(map[string]time.Time),
+		stopCh:  make(chan struct{}),
+	}
+}
+
+func snapshot(h *PeeringHandler) (tracked, dropped int) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	return len(h.asPaths), h.droppedPaths
+}
+
+func pathKey(t *testing.T, asns ...int) string {
+	t.Helper()
+
+	b, err := json.Marshal(ristypes.ASPath(asns))
+	if err != nil {
+		t.Fatalf("failed to marshal path: %v", err)
+	}
+
+	return string(b)
+}
+
+func handle(h *PeeringHandler, ts time.Time, asns ...int) {
+	h.HandleMessage(&ristypes.RISMessage{
+		Path:            ristypes.ASPath(asns),
+		ParsedTimestamp: ts,
+	})
+}
+
+// TestPeeringHandlerProcessesEachRunAndEmpties verifies that a processing run
+// empties the path map (the swap) and that a path seen again after a run is
+// recorded in the next run too.
+func TestPeeringHandlerProcessesEachRunAndEmpties(t *testing.T) {
+	store := &recordingStore{mockStore: newMockStore()}
+	h := newTestHandler(store)
+
+	now := time.Now().UTC()
+
+	// Run 1: one path, one peering recorded, map emptied afterwards.
+	handle(h, now, testASNA, testASNB)
+	h.ProcessPeeringsNow()
+
+	if tracked, _ := snapshot(h); tracked != 0 {
+		t.Fatalf("map not empty after first run: %d paths remain", tracked)
+	}
+	if got := store.callCount(); got != 1 {
+		t.Fatalf("want 1 RecordPeering call after first run, got %d", got)
+	}
+
+	// Run 2: the same path again is recorded again (RecordPeering upserts).
+	handle(h, now.Add(time.Second), testASNA, testASNB)
+	h.ProcessPeeringsNow()
+
+	if tracked, _ := snapshot(h); tracked != 0 {
+		t.Fatalf("map not empty after second run: %d paths remain", tracked)
+	}
+	if got := store.callCount(); got != 2 {
+		t.Fatalf("want 2 RecordPeering calls after second run, got %d", got)
+	}
+}
+
+// TestPeeringHandlerCapDropsAndCounts verifies that a full map drops new paths
+// and counts them, while a path already tracked is refreshed rather than
+// dropped.
+func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
+	store := &recordingStore{mockStore: newMockStore()}
+	h := newTestHandler(store)
+
+	now := time.Now().UTC()
+
+	// Fill the map to exactly maxTrackedPaths, including one real path key so
+	// the "already tracked" branch can be exercised. The filler keys are never
+	// processed in this test, so their contents do not matter.
+	existing := pathKey(t, testASNA, testASNB)
+
+	h.mu.Lock()
+	h.asPaths[existing] = now
+	for i := 0; len(h.asPaths) < maxTrackedPaths; i++ {
+		h.asPaths[strconv.Itoa(i)] = now
+	}
+	h.mu.Unlock()
+
+	// A new path is dropped and counted because the map is full.
+	handle(h, now.Add(time.Second), testASNA, testASNC)
+
+	tracked, dropped := snapshot(h)
+	if tracked != maxTrackedPaths {
+		t.Fatalf("want map size %d after drop, got %d", maxTrackedPaths, tracked)
+	}
+	if dropped != 1 {
+		t.Fatalf("want dropped count 1, got %d", dropped)
+	}
+
+	// A path already tracked is refreshed, not dropped.
+	refreshed := now.Add(2 * time.Second)
+	handle(h, refreshed, testASNA, testASNB)
+
+	tracked, dropped = snapshot(h)
+	if tracked != maxTrackedPaths {
+		t.Fatalf("want map size %d after refresh, got %d", maxTrackedPaths, tracked)
+	}
+	if dropped != 1 {
+		t.Fatalf("want dropped count still 1 after refresh, got %d", dropped)
+	}
+
+	h.mu.Lock()
+	gotTS := h.asPaths[existing]
+	h.mu.Unlock()
+	if !gotTS.Equal(refreshed) {
+		t.Fatalf("existing path timestamp not refreshed: want %v, got %v", refreshed, gotTS)
+	}
+}

internal/routewatch/prefixhandler.go

@@ -2,6 +2,7 @@ package routewatch
 
 import (
 	"net"
+	"net/netip"
 	"strings"
 	"sync"
 	"time"
@@ -14,9 +15,11 @@ import (
 )
 
 const (
-	// prefixHandlerQueueSize is the queue capacity for prefix tracking operations
-	// DO NOT set this higher than 100000 without explicit instructions
-	prefixHandlerQueueSize = 100000
+	// prefixHandlerQueueSize is the queue capacity for prefix tracking
+	// operations, about 4 seconds of feed at peak. The streamer drops rather
+	// than blocks when a queue is full, so this bounds memory. Batches still
+	// flush on a timer (prefixBatchTimeout).
+	prefixHandlerQueueSize = 20000
 
 	// prefixBatchSize is the number of prefix updates to batch together
 	prefixBatchSize = 25000
@@ -102,11 +105,28 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
-	// Process announcements
+	// Withdrawals are queued before announcements, because the batch keeps
+	// each peer's last update for a prefix: a message that lists a prefix as
+	// both withdrawn and announced keeps the route (RFC 4271 section 4.3).
+	for _, prefix := range msg.Withdrawals {
+		h.batch = append(h.batch, prefixUpdate{
+			prefix:      canonicalPrefix(prefix),
+			originASN:   originASN, // Use the originASN from path if available
+			peer:        msg.Peer,
+			messageType: "withdrawal",
+			timestamp:   timestamp,
+			path:        msg.Path,
+		})
+		// Record withdrawal in metrics
+		if h.metrics != nil {
+			h.metrics.RecordWithdrawal()
+		}
+	}
+
 	for _, announcement := range msg.Announcements {
 		for _, prefix := range announcement.Prefixes {
 			h.batch = append(h.batch, prefixUpdate{
-				prefix:      prefix,
+				prefix:      canonicalPrefix(prefix),
 				originASN:   originASN,
 				peer:        msg.Peer,
 				messageType: "announcement",
@@ -120,22 +140,6 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 		}
 	}
 
-	// Process withdrawals
-	for _, prefix := range msg.Withdrawals {
-		h.batch = append(h.batch, prefixUpdate{
-			prefix:      prefix,
-			originASN:   originASN, // Use the originASN from path if available
-			peer:        msg.Peer,
-			messageType: "withdrawal",
-			timestamp:   timestamp,
-			path:        msg.Path,
-		})
-		// Record withdrawal in metrics
-		if h.metrics != nil {
-			h.metrics.RecordWithdrawal()
-		}
-	}
-
 	// Check if we need to flush
 	if len(h.batch) >= prefixBatchSize {
 		h.flushBatchLocked()
@@ -176,14 +180,14 @@ func (h *PrefixHandler) flushBatchLocked() {
 	startTime := time.Now()
 	batchSize := len(h.batch)
 
-	// Group updates by prefix to deduplicate
-	// For each prefix, keep the latest update
-	prefixMap := make(map[string]prefixUpdate)
+	// For each prefix and peer, keep only the last update the feed delivered.
+	// Updates from different peers for the same prefix are all kept. Arrival
+	// order decides, not the timestamp: timestamps are whole seconds, so
+	// updates within one second carry the same one.
+	type prefixAndPeer struct{ prefix, peer string }
+	lastUpdates := make(map[prefixAndPeer]prefixUpdate)
 	for _, update := range h.batch {
-		key := update.prefix
-		if existing, ok := prefixMap[key]; !ok || update.timestamp.After(existing.timestamp) {
-			prefixMap[key] = update
-		}
+		lastUpdates[prefixAndPeer{update.prefix, update.peer}] = update
 	}
 
 	// Collect routes to upsert and delete
@@ -193,7 +197,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 	// Collect unique prefixes to update
 	prefixesToUpdate := make(map[string]time.Time)
 
-	for _, update := range prefixMap {
+	for _, update := range lastUpdates {
 		// Track prefix for both announcements and withdrawals
 		if _, exists := prefixesToUpdate[update.prefix]; !exists || update.timestamp.After(prefixesToUpdate[update.prefix]) {
 			prefixesToUpdate[update.prefix] = update.timestamp
@@ -252,7 +256,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 	elapsed := time.Since(startTime)
 	h.logger.Debug("Flushed prefix batch",
 		"batch_size", batchSize,
-		"unique_prefixes", len(prefixMap),
+		"unique_prefixes", len(prefixesToUpdate),
 		"success", successCount,
 		"duration_ms", elapsed.Milliseconds(),
 	)
@@ -262,6 +266,21 @@ func (h *PrefixHandler) flushBatchLocked() {
 	h.lastFlush = time.Now()
 }
 
+// canonicalPrefix returns prefix in the text form net/netip prints, the form
+// the IP lookup builds when it looks a prefix up. The feed sends IPv6
+// announcements compressed ("2001:db8::/32") but IPv6 withdrawals uncompressed
+// ("2001:db8:0:0:0:0:0:0/32"); stored as received, a withdrawal would not match
+// the route its announcement stored. A prefix that does not parse is returned
+// unchanged, and the batch flush reports it.
+func canonicalPrefix(prefix string) string {
+	p, err := netip.ParsePrefix(prefix)
+	if err != nil {
+		return prefix
+	}
+
+	return p.Masked().String()
+}
+
 // parseCIDR extracts the mask length and IP version from a prefix string
 func parseCIDR(prefix string) (maskLength int, ipVersion int, err error) {
 	_, ipNet, err := net.ParseCIDR(prefix)
@@ -313,20 +332,6 @@ func (h *PrefixHandler) processAnnouncement(_ *database.Prefix, update prefixUpd
 		LastUpdated: update.timestamp,
 	}
 
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
 	if err := h.db.UpsertLiveRoute(liveRoute); err != nil {
 		h.logger.Error("Failed to upsert live route",
 			"prefix", update.prefix,
@@ -370,20 +375,6 @@ func (h *PrefixHandler) createLiveRoute(update prefixUpdate) *database.LiveRoute
 		LastUpdated: update.timestamp,
 	}
 
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
 	return liveRoute
 }
 
@@ -423,20 +414,6 @@ func (h *PrefixHandler) processAnnouncementDirect(update prefixUpdate) {
 		LastUpdated: update.timestamp,
 	}
 
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
 	if err := h.db.UpsertLiveRoute(liveRoute); err != nil {
 		h.logger.Error("Failed to upsert live route",
 			"prefix", update.prefix,

internal/routewatch/prefixhandler_test.go

@@ -0,0 +1,213 @@
+package routewatch
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
+)
+
+const testPeerIP = "2001:db8:ffff::1"
+
+// TestPrefixHandlerStoresPrefixesTheIPLookupFinds runs announcements and
+// withdrawals through the prefix handler into a real database and looks the
+// addresses up. The prefixes are written the way the feed sends them: IPv6
+// announcements compressed, IPv6 withdrawals uncompressed. The withdrawal must
+// remove the route the announcement stored, and the IP lookup must find the
+// stored prefix.
+func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+	h := &PrefixHandler{db: db, logger: logger.New()}
+	flush := func() {
+		h.mu.Lock()
+		defer h.mu.Unlock()
+		h.flushBatchLocked()
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	h.HandleMessage(&ristypes.RISMessage{
+		Peer:            testPeerIP,
+		Path:            ristypes.ASPath{testASNA, testASNB},
+		ParsedTimestamp: ts,
+		Announcements: []ristypes.RISAnnouncement{{
+			NextHop:  testPeerIP,
+			Prefixes: []string{"2001:db8:1::/48", "192.0.2.0/24"},
+		}},
+	})
+	flush()
+
+	for ip, want := range map[string]string{
+		"2001:db8:1::1": "2001:db8:1::/48",
+		"192.0.2.1":     "192.0.2.0/24",
+	} {
+		info, err := db.GetIPInfo(ip)
+		if err != nil {
+			t.Fatalf("GetIPInfo(%s) after announcement: %v", ip, err)
+		}
+		if info.Netblock != want || info.ASN != testASNB {
+			t.Errorf("GetIPInfo(%s) = %s AS%d, want %s AS%d", ip, info.Netblock, info.ASN, want, testASNB)
+		}
+	}
+
+	h.HandleMessage(&ristypes.RISMessage{
+		Peer:            testPeerIP,
+		ParsedTimestamp: ts.Add(time.Minute),
+		Withdrawals:     []string{"2001:db8:1:0:0:0:0:0/48", "192.0.2.0/24"},
+	})
+	flush()
+
+	for _, ip := range []string{"2001:db8:1::1", "192.0.2.1"} {
+		if info, err := db.GetIPInfo(ip); !errors.Is(err, database.ErrNoRoute) {
+			t.Errorf("GetIPInfo(%s) after withdrawal = %+v, %v; want ErrNoRoute", ip, info, err)
+		}
+	}
+}
+
+// TestPrefixHandlerAppliesEachPeersLastUpdateInABatch runs updates for one
+// prefix through the prefix handler into a real database. All updates carry the
+// same timestamp, as updates within one second of the feed do. Within a batch,
+// the last update each peer sent for the prefix decides whether that peer has a
+// live route for it, and updates from different peers are all applied. The
+// in-memory route count and prefix distribution must match the route table.
+func TestPrefixHandlerAppliesEachPeersLastUpdateInABatch(t *testing.T) {
+	const (
+		prefix           = "198.51.100.0/24"
+		prefixMaskLength = 24
+		otherPeerIP      = "2001:db8:ffff::2"
+	)
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(peer string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{
+			Peer:            peer,
+			Path:            ristypes.ASPath{testASNA, testASNB},
+			ParsedTimestamp: ts,
+			Announcements:   []ristypes.RISAnnouncement{{NextHop: peer, Prefixes: []string{prefix}}},
+		}
+	}
+	withdraw := func(peer string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{Peer: peer, ParsedTimestamp: ts, Withdrawals: []string{prefix}}
+	}
+	announceAndWithdraw := func(peer string) *ristypes.RISMessage {
+		msg := announce(peer)
+		msg.Withdrawals = []string{prefix}
+
+		return msg
+	}
+
+	tests := []struct {
+		name string
+		// Each inner list is handled and then flushed as one batch.
+		batches [][]*ristypes.RISMessage
+		// The peers left with a live route for the prefix, by peer IP.
+		wantPeers []string
+	}{
+		{
+			name:      "two peers announce the prefix",
+			batches:   [][]*ristypes.RISMessage{{announce(testPeerIP), announce(otherPeerIP)}},
+			wantPeers: []string{testPeerIP, otherPeerIP},
+		},
+		{
+			name: "two peers withdraw the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{announce(otherPeerIP)},
+				{withdraw(testPeerIP), withdraw(otherPeerIP)},
+			},
+		},
+		{
+			name:    "a peer announces and then withdraws the prefix",
+			batches: [][]*ristypes.RISMessage{{announce(testPeerIP), withdraw(testPeerIP)}},
+		},
+		{
+			name: "a peer withdraws and then re-announces the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{withdraw(testPeerIP), announce(testPeerIP)},
+			},
+			wantPeers: []string{testPeerIP},
+		},
+		{
+			// RFC 4271 section 4.3: the announcement counts, not the withdrawal.
+			name: "one message announces and withdraws the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{announceAndWithdraw(testPeerIP)},
+			},
+			wantPeers: []string{testPeerIP},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+			if err != nil {
+				t.Fatalf("failed to create database: %v", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+			h := &PrefixHandler{db: db, logger: logger.New()}
+			for _, batch := range tt.batches {
+				for _, msg := range batch {
+					h.HandleMessage(msg)
+				}
+				h.mu.Lock()
+				h.flushBatchLocked()
+				h.mu.Unlock()
+			}
+
+			ctx := context.Background()
+			routes, _, err := db.GetPrefixDetailsContext(ctx, prefix)
+			if err != nil && !errors.Is(err, database.ErrNoRoute) {
+				t.Fatalf("GetPrefixDetailsContext: %v", err)
+			}
+			var gotPeers []string
+			for _, route := range routes {
+				gotPeers = append(gotPeers, route.PeerIP)
+			}
+			if !slices.Equal(gotPeers, tt.wantPeers) {
+				t.Errorf("peers with a live route for %s = %v, want %v", prefix, gotPeers, tt.wantPeers)
+			}
+
+			stats, err := db.GetStatsContext(ctx)
+			if err != nil {
+				t.Fatalf("GetStatsContext: %v", err)
+			}
+			tableRoutesV4, _, err := db.GetLiveRouteCountsContext(ctx)
+			if err != nil {
+				t.Fatalf("GetLiveRouteCountsContext: %v", err)
+			}
+			if stats.IPv4Routes != len(tt.wantPeers) || tableRoutesV4 != len(tt.wantPeers) {
+				t.Errorf("IPv4 live routes: %d in memory, %d in the table, want %d",
+					stats.IPv4Routes, tableRoutesV4, len(tt.wantPeers))
+			}
+
+			var wantDistribution []database.PrefixDistribution
+			if len(tt.wantPeers) > 0 {
+				wantDistribution = []database.PrefixDistribution{{MaskLength: prefixMaskLength, Count: 1}}
+			}
+			queryDistributionV4, _, err := db.GetPrefixDistributionContext(ctx)
+			if err != nil {
+				t.Fatalf("GetPrefixDistributionContext: %v", err)
+			}
+			if !slices.Equal(stats.IPv4PrefixDistribution, wantDistribution) ||
+				!slices.Equal(queryDistributionV4, wantDistribution) {
+				t.Errorf("IPv4 prefix distribution: %v in memory, %v from the table, want %v",
+					stats.IPv4PrefixDistribution, queryDistributionV4, wantDistribution)
+			}
+		})
+	}
+}

internal/server/handlers.go

@@ -7,7 +7,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"net/url"
+	"net/netip"
 	"runtime"
 	"sort"
 	"strconv"
@@ -38,6 +38,7 @@ type HealthCheckResponse struct {
 
 // handleHealthCheck returns a handler that performs health checks.
 // Returns 200 if healthy, 503 if any check fails.
+// Uses lightweight checks to avoid timeout issues under load.
 func (s *Server) handleHealthCheck() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), healthCheckTimeout)
@@ -46,13 +47,11 @@ func (s *Server) handleHealthCheck() http.HandlerFunc {
 		checks := make(map[string]string)
 		healthy := true
 
-		// Check database connectivity
-		dbStats, err := s.db.GetStatsContext(ctx)
+		// Check database connectivity with lightweight ping
+		err := s.db.Ping(ctx)
 		if err != nil {
 			checks["database"] = "error: " + err.Error()
 			healthy = false
-		} else if dbStats.ASNs == 0 && dbStats.Prefixes == 0 {
-			checks["database"] = "warning: empty database"
 		} else {
 			checks["database"] = "ok"
 		}
@@ -88,10 +87,16 @@ func (s *Server) handleHealthCheck() http.HandlerFunc {
 	}
 }
 
-// handleRoot returns a handler that redirects to /status.
-func (s *Server) handleRoot() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, "/status", http.StatusSeeOther)
+// handleIndex returns a handler that serves the home page.
+func (s *Server) handleIndex() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+
+		tmpl := templates.IndexTemplate()
+		if err := tmpl.Execute(w, nil); err != nil {
+			s.logger.Error("Failed to render index template", "error", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }
 
@@ -159,6 +164,8 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 		LiveRoutes             int                           `json:"live_routes"`
 		IPv4Routes             int                           `json:"ipv4_routes"`
 		IPv6Routes             int                           `json:"ipv6_routes"`
+		OldestRoute            *time.Time                    `json:"oldest_route,omitempty"`
+		NewestRoute            *time.Time                    `json:"newest_route,omitempty"`
 		IPv4UpdatesPerSec      float64                       `json:"ipv4_updates_per_sec"`
 		IPv6UpdatesPerSec      float64                       `json:"ipv6_updates_per_sec"`
 		IPv4PrefixDistribution []database.PrefixDistribution `json:"ipv4_prefix_distribution"`
@@ -173,9 +180,11 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 
 		metrics := s.streamer.GetMetrics()
 
-		// Get database stats with timeout
-		statsChan := make(chan database.Stats)
-		errChan := make(chan error)
+		// Get database stats with timeout. The channels are buffered so the
+		// goroutine's send never blocks if the timeout wins and nothing here
+		// receives; otherwise it would block forever and leak.
+		statsChan := make(chan database.Stats, 1)
+		errChan := make(chan error, 1)
 
 		go func() {
 			dbStats, err := s.db.GetStatsContext(ctx)
@@ -211,13 +220,6 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 
 		const bitsPerMegabit = 1000000.0
 
-		// Get route counts from database
-		ipv4Routes, ipv6Routes, err := s.db.GetLiveRouteCountsContext(ctx)
-		if err != nil {
-			s.logger.Warn("Failed to get live route counts", "error", err)
-			// Continue with zero counts
-		}
-
 		// Get route update metrics
 		routeMetrics := s.streamer.GetMetricsTracker().GetRouteMetrics()
 
@@ -251,8 +253,10 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 			Peers:                  dbStats.Peers,
 			DatabaseSizeBytes:      dbStats.FileSizeBytes,
 			LiveRoutes:             dbStats.LiveRoutes,
-			IPv4Routes:             ipv4Routes,
-			IPv6Routes:             ipv6Routes,
+			IPv4Routes:             dbStats.IPv4Routes,
+			IPv6Routes:             dbStats.IPv6Routes,
+			OldestRoute:            dbStats.OldestRoute,
+			NewestRoute:            dbStats.NewestRoute,
 			IPv4UpdatesPerSec:      routeMetrics.IPv4UpdatesPerSec,
 			IPv6UpdatesPerSec:      routeMetrics.IPv6UpdatesPerSec,
 			IPv4PrefixDistribution: dbStats.IPv4PrefixDistribution,
@@ -322,19 +326,19 @@ func (s *Server) handleStats() http.HandlerFunc {
 
 	// GCStats represents garbage collection statistics
 	type GCStats struct {
-		NumGC           uint32 `json:"num_gc"`
-		TotalPauseMs    uint64 `json:"total_pause_ms"`
-		LastPauseMs     float64 `json:"last_pause_ms"`
-		HeapAllocBytes  uint64 `json:"heap_alloc_bytes"`
-		HeapSysBytes    uint64 `json:"heap_sys_bytes"`
+		NumGC          uint32  `json:"num_gc"`
+		TotalPauseMs   uint64  `json:"total_pause_ms"`
+		LastPauseMs    float64 `json:"last_pause_ms"`
+		HeapAllocBytes uint64  `json:"heap_alloc_bytes"`
+		HeapSysBytes   uint64  `json:"heap_sys_bytes"`
 	}
 
 	// StreamStats represents stream statistics including announcements/withdrawals
 	type StreamStats struct {
-		Announcements     uint64  `json:"announcements"`
-		Withdrawals       uint64  `json:"withdrawals"`
-		RouteChurnPerSec  float64 `json:"route_churn_per_sec"`
-		BGPPeerCount      int     `json:"bgp_peer_count"`
+		Announcements    uint64  `json:"announcements"`
+		Withdrawals      uint64  `json:"withdrawals"`
+		RouteChurnPerSec float64 `json:"route_churn_per_sec"`
+		BGPPeerCount     int     `json:"bgp_peer_count"`
 	}
 
 	// StatsResponse represents the API statistics response
@@ -364,6 +368,8 @@ func (s *Server) handleStats() http.HandlerFunc {
 		LiveRoutes             int                           `json:"live_routes"`
 		IPv4Routes             int                           `json:"ipv4_routes"`
 		IPv6Routes             int                           `json:"ipv6_routes"`
+		OldestRoute            *time.Time                    `json:"oldest_route,omitempty"`
+		NewestRoute            *time.Time                    `json:"newest_route,omitempty"`
 		IPv4UpdatesPerSec      float64                       `json:"ipv4_updates_per_sec"`
 		IPv6UpdatesPerSec      float64                       `json:"ipv6_updates_per_sec"`
 		HandlerStats           []HandlerStatsInfo            `json:"handler_stats"`
@@ -388,9 +394,11 @@ func (s *Server) handleStats() http.HandlerFunc {
 
 		metrics := s.streamer.GetMetrics()
 
-		// Get database stats with timeout
-		statsChan := make(chan database.Stats)
-		errChan := make(chan error)
+		// Get database stats with timeout. The channels are buffered so the
+		// goroutine's send never blocks if the timeout wins and nothing here
+		// receives; otherwise it would block forever and leak.
+		statsChan := make(chan database.Stats, 1)
+		errChan := make(chan error, 1)
 
 		go func() {
 			dbStats, err := s.db.GetStatsContext(ctx)
@@ -425,13 +433,6 @@ func (s *Server) handleStats() http.HandlerFunc {
 
 		const bitsPerMegabit = 1000000.0
 
-		// Get route counts from database
-		ipv4Routes, ipv6Routes, err := s.db.GetLiveRouteCountsContext(ctx)
-		if err != nil {
-			s.logger.Warn("Failed to get live route counts", "error", err)
-			// Continue with zero counts
-		}
-
 		// Get route update metrics
 		routeMetrics := s.streamer.GetMetricsTracker().GetRouteMetrics()
 
@@ -489,19 +490,19 @@ func (s *Server) handleStats() http.HandlerFunc {
 		}
 
 		stats := StatsResponse{
-			Uptime:                 uptime,
-			TotalMessages:          metrics.TotalMessages,
-			TotalBytes:             metrics.TotalBytes,
-			TotalWireBytes:         metrics.TotalWireBytes,
-			MessagesPerSec:         metrics.MessagesPerSec,
-			MbitsPerSec:            metrics.BitsPerSec / bitsPerMegabit,
-			WireMbitsPerSec:        metrics.WireBitsPerSec / bitsPerMegabit,
-			Connected:              metrics.Connected,
-			ConnectionDuration:     connectionDuration,
-			ReconnectCount:         metrics.ReconnectCount,
-			GoVersion:              runtime.Version(),
-			Goroutines:             runtime.NumGoroutine(),
-			MemoryUsage:            humanize.Bytes(memStats.Alloc),
+			Uptime:             uptime,
+			TotalMessages:      metrics.TotalMessages,
+			TotalBytes:         metrics.TotalBytes,
+			TotalWireBytes:     metrics.TotalWireBytes,
+			MessagesPerSec:     metrics.MessagesPerSec,
+			MbitsPerSec:        metrics.BitsPerSec / bitsPerMegabit,
+			WireMbitsPerSec:    metrics.WireBitsPerSec / bitsPerMegabit,
+			Connected:          metrics.Connected,
+			ConnectionDuration: connectionDuration,
+			ReconnectCount:     metrics.ReconnectCount,
+			GoVersion:          runtime.Version(),
+			Goroutines:         runtime.NumGoroutine(),
+			MemoryUsage:        humanize.Bytes(memStats.Alloc),
 			GC: GCStats{
 				NumGC:          memStats.NumGC,
 				TotalPauseMs:   memStats.PauseTotalNs / uint64(nanosecondsPerMillisecond),
@@ -523,8 +524,10 @@ func (s *Server) handleStats() http.HandlerFunc {
 			Peers:                  dbStats.Peers,
 			DatabaseSizeBytes:      dbStats.FileSizeBytes,
 			LiveRoutes:             dbStats.LiveRoutes,
-			IPv4Routes:             ipv4Routes,
-			IPv6Routes:             ipv6Routes,
+			IPv4Routes:             dbStats.IPv4Routes,
+			IPv6Routes:             dbStats.IPv6Routes,
+			OldestRoute:            dbStats.OldestRoute,
+			NewestRoute:            dbStats.NewestRoute,
 			IPv4UpdatesPerSec:      routeMetrics.IPv4UpdatesPerSec,
 			IPv6UpdatesPerSec:      routeMetrics.IPv6UpdatesPerSec,
 			HandlerStats:           handlerStatsInfo,
@@ -736,23 +739,27 @@ func (s *Server) handleASDetailJSON() http.HandlerFunc {
 // handlePrefixDetailJSON returns prefix details as JSON
 func (s *Server) handlePrefixDetailJSON() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Get wildcard parameter (everything after /prefix/)
-		prefixParam := chi.URLParam(r, "*")
-		if prefixParam == "" {
-			writeJSONError(w, http.StatusBadRequest, "Prefix parameter is required")
+		// Get prefix and length from URL params
+		prefixParam := chi.URLParam(r, "prefix")
+		lenParam := chi.URLParam(r, "len")
+
+		if prefixParam == "" || lenParam == "" {
+			writeJSONError(w, http.StatusBadRequest, "Prefix and length parameters are required")
 
 			return
 		}
 
-		// URL decode the prefix parameter
-		prefix, err := url.QueryUnescape(prefixParam)
+		// Look the prefix up in the text form net/netip prints, the form the
+		// tables store, so that any valid way of writing it finds the route.
+		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
 		if err != nil {
-			writeJSONError(w, http.StatusBadRequest, "Invalid prefix parameter")
+			writeJSONError(w, http.StatusBadRequest, err.Error())
 
 			return
 		}
+		prefix := parsed.Masked().String()
 
-		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+		routes, _, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				writeJSONError(w, http.StatusNotFound, err.Error())
@@ -903,23 +910,27 @@ func (s *Server) handleASDetail() http.HandlerFunc {
 // handlePrefixDetail returns a handler that serves the prefix detail HTML page
 func (s *Server) handlePrefixDetail() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Get wildcard parameter (everything after /prefix/)
-		prefixParam := chi.URLParam(r, "*")
-		if prefixParam == "" {
-			http.Error(w, "Prefix parameter is required", http.StatusBadRequest)
+		// Get prefix and length from URL params
+		prefixParam := chi.URLParam(r, "prefix")
+		lenParam := chi.URLParam(r, "len")
+
+		if prefixParam == "" || lenParam == "" {
+			http.Error(w, "Prefix and length parameters are required", http.StatusBadRequest)
 
 			return
 		}
 
-		// URL decode the prefix parameter
-		prefix, err := url.QueryUnescape(prefixParam)
+		// Look the prefix up in the text form net/netip prints, the form the
+		// tables store, so that any valid way of writing it finds the route.
+		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
 		if err != nil {
-			http.Error(w, "Invalid prefix parameter", http.StatusBadRequest)
+			http.Error(w, "Invalid prefix", http.StatusBadRequest)
 
 			return
 		}
+		prefix := parsed.Masked().String()
 
-		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+		routes, originASNs, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				http.Error(w, "Prefix not found", http.StatusNotFound)
@@ -941,18 +952,10 @@ func (s *Server) handlePrefixDetail() http.HandlerFunc {
 		originMap := make(map[int]*ASNInfo)
 		for _, route := range routes {
 			if _, exists := originMap[route.OriginASN]; !exists {
-				// Get AS info from database
-				asInfo, _, _ := s.db.GetASDetailsContext(r.Context(), route.OriginASN)
-				handle := ""
-				description := ""
-				if asInfo != nil {
-					handle = asInfo.Handle
-					description = asInfo.Description
-				}
 				originMap[route.OriginASN] = &ASNInfo{
 					ASN:         route.OriginASN,
-					Handle:      handle,
-					Description: description,
+					Handle:      originASNs[route.OriginASN].Handle,
+					Description: originASNs[route.OriginASN].Description,
 					PeerCount:   0,
 				}
 			}

internal/server/handlers_test.go

@@ -0,0 +1,299 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"html"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/streamer"
+	"git.eeqj.de/sneak/routewatch/pkg/asinfo"
+	"github.com/google/uuid"
+)
+
+// blockingStatsDB embeds database.Store (left nil) and overrides only
+// GetStatsContext, which blocks until release is closed. The stats handlers
+// call it in a goroutine; every other Store method is unused on the timeout
+// path and would panic if called.
+type blockingStatsDB struct {
+	database.Store
+	release chan struct{}
+}
+
+func (d blockingStatsDB) GetStatsContext(_ context.Context) (database.Stats, error) {
+	<-d.release
+
+	return database.Stats{}, nil
+}
+
+// TestStatsHandlersDoNotLeakOnTimeout drives each stats handler repeatedly with
+// a request whose context times out before the database responds, then releases
+// the blocked queries and asserts the goroutine count returns to its starting
+// value. Before the fix the per-request goroutine sent on an unbuffered channel
+// that nothing received once the timeout won, so it blocked forever and every
+// poll leaked one goroutine.
+func TestStatsHandlersDoNotLeakOnTimeout(t *testing.T) {
+	release := make(chan struct{})
+	db := blockingStatsDB{release: release}
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	handlers := map[string]http.HandlerFunc{
+		"status.json": s.handleStatusJSON(),
+		"stats":       s.handleStats(),
+	}
+
+	baseline := settledGoroutineCount()
+
+	const (
+		iterations     = 20
+		requestTimeout = 50 * time.Millisecond
+	)
+	for _, handler := range handlers {
+		for range iterations {
+			ctx, cancel := context.WithTimeout(context.Background(), requestTimeout)
+			req := httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx)
+			handler(httptest.NewRecorder(), req)
+			cancel()
+		}
+	}
+
+	// Let the blocked queries finish; with buffered channels each goroutine's
+	// send now succeeds and the goroutine exits.
+	close(release)
+
+	if !waitForGoroutines(baseline) {
+		t.Fatalf("goroutines did not return to baseline %d, got %d",
+			baseline, runtime.NumGoroutine())
+	}
+}
+
+// TestStatsHandlersAnswerFromMemory checks that both stats handlers answer 200
+// with the live route counts and the prefix distribution while the database is
+// closed, so that any query would fail: the request path reads them from
+// memory. The prefix distribution query it used to run read every live route
+// and, on a large database, took the whole 4-second deadline, so
+// /api/v1/stats answered 500 (https://git.eeqj.de/sneak/routewatch/issues/30).
+// The oldest and newest route times still come from one-row lookups at the ends
+// of an index; with the database closed they are left out of the answer.
+func TestStatsHandlersAnswerFromMemory(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "198.51.100.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: 64500, PeerIP: "192.0.2.1", ASPath: []int{64500}, NextHop: "192.0.2.1",
+			LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "2001:db8::/32", MaskLength: 32, IPVersion: 6,
+			OriginASN: 64501, PeerIP: "2001:db8::1", ASPath: []int{64501}, NextHop: "2001:db8::1",
+			LastUpdated: ts,
+		},
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	if err := db.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	handlers := map[string]http.HandlerFunc{
+		"status.json": s.handleStatusJSON(),
+		"stats":       s.handleStats(),
+	}
+
+	for name, handler := range handlers {
+		rec := httptest.NewRecorder()
+		handler(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+		if rec.Code != http.StatusOK {
+			t.Errorf("%s: status %d, want %d; body %s", name, rec.Code, http.StatusOK, rec.Body)
+
+			continue
+		}
+
+		var body struct {
+			Data struct {
+				IPv4Routes             int                           `json:"ipv4_routes"`
+				IPv6Routes             int                           `json:"ipv6_routes"`
+				IPv4PrefixDistribution []database.PrefixDistribution `json:"ipv4_prefix_distribution"`
+				IPv6PrefixDistribution []database.PrefixDistribution `json:"ipv6_prefix_distribution"`
+			} `json:"data"`
+		}
+		if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+			t.Fatalf("%s: decoding the answer: %v", name, err)
+		}
+
+		if body.Data.IPv4Routes != 1 || body.Data.IPv6Routes != 1 {
+			t.Errorf("%s: routes = (v4 %d, v6 %d), want (1, 1)", name, body.Data.IPv4Routes, body.Data.IPv6Routes)
+		}
+		wantV4 := []database.PrefixDistribution{{MaskLength: 24, Count: 1}}
+		if !slices.Equal(body.Data.IPv4PrefixDistribution, wantV4) {
+			t.Errorf("%s: IPv4 distribution = %v, want %v", name, body.Data.IPv4PrefixDistribution, wantV4)
+		}
+		wantV6 := []database.PrefixDistribution{{MaskLength: 32, Count: 1}}
+		if !slices.Equal(body.Data.IPv6PrefixDistribution, wantV6) {
+			t.Errorf("%s: IPv6 distribution = %v, want %v", name, body.Data.IPv6PrefixDistribution, wantV6)
+		}
+	}
+}
+
+// TestPrefixDetailHandlersParsePrefix checks that both prefix pages find a
+// stored route whatever valid text form the URL writes its prefix in, and
+// answer 400 for a prefix that does not parse. The tables store the form
+// net/netip prints. Before the fix the URL text was looked up as typed, so
+// "2001:DB8:0:0::/32" was not found although "2001:db8::/32" was stored, and
+// "foo/24" answered 500 (https://git.eeqj.de/sneak/routewatch/issues/71).
+func TestPrefixDetailHandlersParsePrefix(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: 64500, PeerIP: "198.51.100.1", ASPath: []int{64500}, NextHop: "198.51.100.1",
+			LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "2001:db8::/32", MaskLength: 32, IPVersion: 6,
+			OriginASN: 64501, PeerIP: "2001:db8::1", ASPath: []int{64501}, NextHop: "2001:db8::1",
+			LastUpdated: ts,
+		},
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	tests := []struct {
+		path string
+		want int
+	}{
+		{"/api/v1/prefix/foo/24", http.StatusBadRequest},
+		{"/prefix/foo/24", http.StatusBadRequest},
+		{"/api/v1/prefix/2001:DB8:0:0::/32", http.StatusOK},
+		{"/prefix/2001:DB8:0:0::/32", http.StatusOK},
+		{"/api/v1/prefix/192.0.2.1/24", http.StatusOK},
+		{"/prefix/192.0.2.1/24", http.StatusOK},
+	}
+
+	for _, tt := range tests {
+		rec := httptest.NewRecorder()
+		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil))
+		if rec.Code != tt.want {
+			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, tt.want, rec.Body)
+		}
+	}
+}
+
+// failingASDetailsDB wraps a real store and fails every AS details lookup.
+type failingASDetailsDB struct {
+	database.Store
+}
+
+func (failingASDetailsDB) GetASDetailsContext(_ context.Context, _ int) (*database.ASN, []database.LiveRoute, error) {
+	return nil, nil, errors.New("AS details lookup failed")
+}
+
+// TestPrefixDetailShowsOriginNames checks that the prefix page shows each
+// origin AS's handle and description without looking up the AS's details,
+// which also read every route the AS originates. Before the fix the page did
+// that lookup once per origin, so with it failing the names were missing
+// (https://git.eeqj.de/sneak/routewatch/issues/67). The AS path column shows
+// handles too, so the test looks for the origin list's "(handle)" form.
+func TestPrefixDetailShowsOriginNames(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	origins := []int{15169, 13335}
+	for _, asn := range origins {
+		if _, err := db.GetOrCreateASN(asn, ts); err != nil {
+			t.Fatalf("GetOrCreateASN(%d): %v", asn, err)
+		}
+	}
+	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: origins[0], PeerIP: "198.51.100.1", ASPath: []int{origins[0]}, NextHop: "198.51.100.1",
+			LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: origins[1], PeerIP: "198.51.100.2", ASPath: []int{origins[1]}, NextHop: "198.51.100.2",
+			LastUpdated: ts,
+		},
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	s := New(failingASDetailsDB{db}, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	rec := httptest.NewRecorder()
+	s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/prefix/192.0.2.0/24", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d, want %d; body %s", rec.Code, http.StatusOK, rec.Body)
+	}
+
+	page := rec.Body.String()
+	for _, asn := range origins {
+		info, ok := asinfo.Get(asn)
+		if !ok {
+			t.Fatalf("AS%d is not in the AS info data", asn)
+		}
+		if want := "(" + html.EscapeString(info.Handle) + ")"; !strings.Contains(page, want) {
+			t.Errorf("page does not show AS%d's handle %q", asn, want)
+		}
+		if want := html.EscapeString(info.Description); !strings.Contains(page, want) {
+			t.Errorf("page does not show AS%d's description %q", asn, want)
+		}
+	}
+}
+
+// settledGoroutineCount lets transient goroutines finish, then reports the
+// current count.
+func settledGoroutineCount() int {
+	prev := runtime.NumGoroutine()
+	for range 20 {
+		time.Sleep(10 * time.Millisecond)
+		cur := runtime.NumGoroutine()
+		if cur == prev {
+			return cur
+		}
+		prev = cur
+	}
+
+	return prev
+}
+
+// waitForGoroutines waits until the goroutine count drops to target or below.
+func waitForGoroutines(target int) bool {
+	for range 100 {
+		if runtime.NumGoroutine() <= target {
+			return true
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	return false
+}

internal/server/middleware.go

@@ -168,7 +168,7 @@ func (tw *timeoutWriter) markWritten() {
 // The timeout parameter specifies the maximum duration allowed for request processing.
 // The returned middleware handles panics from the wrapped handler by re-panicking
 // after cleanup, and prevents concurrent writes to the response after timeout occurs.
-func TimeoutMiddleware(timeout time.Duration) func(http.Handler) http.Handler {
+func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			startTime := time.Now()
@@ -204,6 +204,14 @@ func TimeoutMiddleware(timeout time.Duration) func(http.Handler) http.Handler {
 				tw.markWritten() // Prevent the handler from writing after timeout
 				execTime := time.Since(startTime)
 
+				// Log the timeout as a warning
+				logger.Warn("Request timeout",
+					"method", r.Method,
+					"path", r.URL.Path,
+					"duration_ms", execTime.Milliseconds(),
+					"remote_addr", r.RemoteAddr,
+				)
+
 				// Write directly to the underlying writer since we've marked tw as written
 				// This is safe because markWritten() prevents the handler from writing
 				tw.mu.Lock()
@@ -350,10 +358,16 @@ func RequestLoggerMiddleware(logger *slog.Logger) func(http.Handler) http.Handle
 			// Log request completion
 			duration := time.Since(start)
 			logLevel := slog.LevelInfo
+
+			// Slow query threshold (1 second)
+			const slowQueryThreshold = 1 * time.Second
+
 			if sw.statusCode >= http.StatusInternalServerError {
 				logLevel = slog.LevelError
 			} else if sw.statusCode >= http.StatusBadRequest {
 				logLevel = slog.LevelWarn
+			} else if duration >= slowQueryThreshold {
+				logLevel = slog.LevelWarn
 			}
 
 			logger.Log(r.Context(), logLevel, "HTTP request completed",
@@ -362,6 +376,7 @@ func RequestLoggerMiddleware(logger *slog.Logger) func(http.Handler) http.Handle
 				"status", sw.statusCode,
 				"duration_ms", duration.Milliseconds(),
 				"remote_addr", r.RemoteAddr,
+				"slow", duration >= slowQueryThreshold,
 			)
 		})
 	}

internal/server/routes.go

@@ -17,18 +17,18 @@ func (s *Server) setupRoutes() {
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
 	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
-	r.Use(TimeoutMiddleware(requestTimeout))
+	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
 	r.Use(JSONResponseMiddleware)
 
 	// Routes
-	r.Get("/", s.handleRoot())
+	r.Get("/", s.handleIndex())
 	r.Get("/status", s.handleStatusHTML())
 	r.Get("/status.json", JSONValidationMiddleware(s.handleStatusJSON()).ServeHTTP)
 	r.Get("/.well-known/healthcheck.json", JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP)
 
 	// AS and prefix detail pages
 	r.Get("/as/{asn}", s.handleASDetail())
-	r.Get("/prefix/*", s.handlePrefixDetail())
+	r.Get("/prefix/{prefix}/{len}", s.handlePrefixDetail())
 	r.Get("/prefixlength/{length}", s.handlePrefixLength())
 	r.Get("/prefixlength6/{length}", s.handlePrefixLength6())
 
@@ -45,7 +45,7 @@ func (s *Server) setupRoutes() {
 		r.Get("/stats", s.handleStats())
 		r.Get("/ip/{ip}", s.handleIPLookup())
 		r.Get("/as/{asn}", s.handleASDetailJSON())
-		r.Get("/prefix/*", s.handlePrefixDetailJSON())
+		r.Get("/prefix/{prefix}/{len}", s.handlePrefixDetailJSON())
 	})
 
 	s.router = r

internal/server/server.go

@@ -3,10 +3,13 @@ package server
 
 import (
 	"context"
+	"fmt"
+	"net"
 	"net/http"
-	"os"
+	"strconv"
 	"time"
 
+	"git.eeqj.de/sneak/routewatch/internal/config"
 	"git.eeqj.de/sneak/routewatch/internal/database"
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/streamer"
@@ -33,16 +36,18 @@ type Server struct {
 	db         database.Store
 	streamer   *streamer.Streamer
 	logger     *logger.Logger
+	port       int
 	srv        *http.Server
 	asnFetcher ASNFetcher
 }
 
 // New creates a new HTTP server
-func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger) *Server {
+func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger, cfg *config.Config) *Server {
 	s := &Server{
 		db:       db,
 		streamer: streamer,
 		logger:   logger,
+		port:     cfg.Port,
 	}
 
 	s.setupRoutes()
@@ -50,14 +55,12 @@ func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger)
 	return s
 }
 
-// Start starts the HTTP server
+// Start listens on the configured port and serves HTTP in the background.
+// It returns an error if it cannot listen, for example because the port is
+// already in use.
 func (s *Server) Start() error {
-	port := os.Getenv("PORT")
-	if port == "" {
-		port = "8080"
-	}
-
 	const (
+		network           = "tcp"
 		readHeaderTimeout = 40 * time.Second
 		readTimeout       = 60 * time.Second
 		writeTimeout      = 60 * time.Second
@@ -65,7 +68,7 @@ func (s *Server) Start() error {
 	)
 
 	s.srv = &http.Server{
-		Addr:              ":" + port,
+		Addr:              ":" + strconv.Itoa(s.port),
 		Handler:           s.router,
 		ReadHeaderTimeout: readHeaderTimeout,
 		ReadTimeout:       readTimeout,
@@ -73,12 +76,17 @@ func (s *Server) Start() error {
 		IdleTimeout:       idleTimeout,
 	}
 
-	s.logger.Info("Starting HTTP server", "port", port, "addr", s.srv.Addr)
+	s.logger.Info("Starting HTTP server", "port", s.port, "addr", s.srv.Addr)
+
+	listener, err := net.Listen(network, s.srv.Addr)
+	if err != nil {
+		return fmt.Errorf("starting HTTP server: %w", err)
+	}
+
+	s.logger.Info("HTTP server listening", "addr", listener.Addr().String())
 
-	// Start in goroutine but log when actually listening
 	go func() {
-		s.logger.Info("HTTP server listening", "addr", s.srv.Addr)
-		if err := s.srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		if err := s.srv.Serve(listener); err != nil && err != http.ErrServerClosed {
 			s.logger.Error("HTTP server error", "error", err)
 		}
 	}()

internal/server/server_test.go

@@ -0,0 +1,33 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/streamer"
+)
+
+// TestStartFailsWhenPortIsHeld holds a port with a listener of its own and
+// checks that Start on that port returns an error. Before the fix Start
+// listened in a goroutine, only logged the failure and returned nil, so the
+// daemon kept running without its web server.
+func TestStartFailsWhenPortIsHeld(t *testing.T) {
+	held, err := net.Listen("tcp", ":0")
+	if err != nil {
+		t.Fatalf("failed to open the test listener: %v", err)
+	}
+	defer func() { _ = held.Close() }()
+
+	port := held.Addr().(*net.TCPAddr).Port
+	log := logger.New()
+	s := New(nil, streamer.New(log, metrics.New()), log, &config.Config{Port: port})
+	defer func() { _ = s.Stop(context.Background()) }()
+
+	if err := s.Start(); err == nil {
+		t.Fatalf("Start returned nil while port %d was held by another listener", port)
+	}
+}

internal/streamer/streamer.go

@@ -7,6 +7,7 @@ import (
 	"compress/gzip"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -48,6 +49,7 @@ const (
 	metricsUpdateRate     = time.Second
 	minBackoffDelay       = 5 * time.Second
 	maxBackoffDelay       = 320 * time.Second
+	streamIdleTimeout     = 60 * time.Second // Reconnect when no line arrives for this long
 	metricsLogInterval    = 10 * time.Second
 	bytesPerKB            = 1024
 	bytesPerMB            = 1024 * 1024
@@ -58,6 +60,9 @@ const (
 	backpressureSlope     = 2.0 // Slope for linear drop probability increase
 )
 
+// errStreamEnded is returned by stream when RIS Live ends the response.
+var errStreamEnded = errors.New("RIS Live ended the stream")
+
 // MessageHandler defines the interface for processing RIS messages.
 // Implementations must specify which message types they want to receive,
 // how to process messages, and their desired queue capacity.
@@ -106,14 +111,17 @@ type handlerInfo struct {
 type Streamer struct {
 	logger       *logger.Logger
 	client       *http.Client
+	url          string
+	idleTimeout  time.Duration // Drop the connection when no line arrives for this long
+	minBackoff   time.Duration // First wait before reconnecting; doubles up to maxBackoffDelay
 	handlers     []*handlerInfo
 	rawHandler   RawMessageHandler
 	mu           sync.RWMutex
 	cancel       context.CancelFunc
 	running      bool
 	metrics      *metrics.Tracker
-	totalDropped uint64     // Total dropped messages across all handlers
-	random       *rand.Rand // Random number generator for backpressure drops
+	totalDropped uint64          // Total dropped messages across all handlers
+	random       *rand.Rand      // Random number generator for backpressure drops
 	bgpPeers     map[string]bool // Track active BGP peers by peer IP
 	bgpPeersMu   sync.RWMutex    // Protects bgpPeers map
 }
@@ -123,7 +131,10 @@ type Streamer struct {
 // The metrics tracker is used to record message counts, bytes received, and connection status.
 func New(logger *logger.Logger, metrics *metrics.Tracker) *Streamer {
 	return &Streamer{
-		logger: logger,
+		logger:      logger,
+		url:         risLiveURL,
+		idleTimeout: streamIdleTimeout,
+		minBackoff:  minBackoffDelay,
 		client: &http.Client{
 			Timeout: 0, // No timeout for streaming
 			Transport: &http.Transport{
@@ -208,9 +219,14 @@ func (s *Streamer) Start() error {
 // the connection status in metrics. This method is safe to call multiple times.
 func (s *Streamer) Stop() {
 	s.mu.Lock()
-	if s.cancel != nil {
-		s.cancel()
+	if s.cancel == nil {
+		// Not started, or already stopped: closing the queues again would panic.
+		s.mu.Unlock()
+
+		return
 	}
+	s.cancel()
+	s.cancel = nil
 	// Close all handler queues to signal workers to stop
 	for _, info := range s.handlers {
 		close(info.queue)
@@ -398,7 +414,7 @@ func (s *Streamer) updateMetrics(messageBytes int) {
 
 // streamWithReconnect handles streaming with automatic reconnection and exponential backoff
 func (s *Streamer) streamWithReconnect(ctx context.Context) {
-	backoffDelay := minBackoffDelay
+	backoffDelay := s.minBackoff
 	consecutiveFailures := 0
 
 	for {
@@ -415,8 +431,9 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 		err := s.stream(ctx)
 		streamDuration := time.Since(startTime)
 
-		if err == nil {
-			// Clean exit (context cancelled)
+		// Only Stop ends the streamer. A stream that ends any other way,
+		// with or without an error, is a disconnect and is reconnected.
+		if ctx.Err() != nil {
 			return
 		}
 
@@ -427,17 +444,13 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 			"stream_duration", streamDuration)
 		s.metrics.SetConnected(false)
 
-		// Check if context is cancelled
-		if ctx.Err() != nil {
-			return
-		}
-
-		// If we streamed for more than 30 seconds, reset the backoff
-		// This indicates we had a successful connection that received data
+		// A stream that lasted more than 30 seconds resets the backoff. That
+		// includes a stream dropped after streamIdleTimeout with no line, so
+		// a silent feed is retried after the first backoff delay every time.
 		if streamDuration > 30*time.Second {
 			s.logger.Info("Resetting backoff delay due to successful connection",
 				"stream_duration", streamDuration)
-			backoffDelay = minBackoffDelay
+			backoffDelay = s.minBackoff
 			consecutiveFailures = 0
 		} else {
 			// Increment consecutive failures
@@ -463,7 +476,20 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 }
 
 func (s *Streamer) stream(ctx context.Context) error {
-	req, err := http.NewRequestWithContext(ctx, "GET", risLiveURL, nil)
+	// connCtx is scoped to this single connection: cancelling it when stream
+	// returns stops the ticker goroutines below, so a reconnect does not leak
+	// them. Without this they would live until the streamer's lifetime context
+	// is cancelled, leaking two per reconnect.
+	connCtx, connCancel := context.WithCancel(ctx)
+	defer connCancel()
+
+	// The idle timer drops the connection, by cancelling connCtx, when no
+	// line arrives for s.idleTimeout. Each line read starts it over. It
+	// also covers the wait for the server to answer.
+	idleTimer := time.AfterFunc(s.idleTimeout, connCancel)
+	defer idleTimer.Stop()
+
+	req, err := http.NewRequestWithContext(connCtx, "GET", s.url, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -516,7 +542,7 @@ func (s *Streamer) stream(ctx context.Context) error {
 			select {
 			case <-metricsTicker.C:
 				s.logMetrics()
-			case <-ctx.Done():
+			case <-connCtx.Done():
 				return
 			}
 		}
@@ -536,7 +562,7 @@ func (s *Streamer) stream(ctx context.Context) error {
 					s.metrics.RecordWireBytes(delta)
 					lastWireBytes = currentBytes
 				}
-			case <-ctx.Done():
+			case <-connCtx.Done():
 				return
 			}
 		}
@@ -545,6 +571,8 @@ func (s *Streamer) stream(ctx context.Context) error {
 	scanner := bufio.NewScanner(reader)
 
 	for scanner.Scan() {
+		idleTimer.Reset(s.idleTimeout)
+
 		select {
 		case <-ctx.Done():
 			s.logger.Info("Stream stopped by context")
@@ -651,8 +679,15 @@ func (s *Streamer) stream(ctx context.Context) error {
 			continue
 		}
 
-		// Dispatch to interested handlers
+		// Dispatch to interested handlers. Stop cancels ctx and closes the
+		// queues under the write lock, so if ctx is cancelled here, under the
+		// read lock, the queues are closed and must not be sent to.
 		s.mu.RLock()
+		if ctx.Err() != nil {
+			s.mu.RUnlock()
+
+			return ctx.Err()
+		}
 		for _, info := range s.handlers {
 			if !info.handler.WantsMessage(msg.Type) {
 				continue
@@ -686,11 +721,19 @@ func (s *Streamer) stream(ctx context.Context) error {
 		s.mu.RUnlock()
 	}
 
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+
+	if connCtx.Err() != nil {
+		return fmt.Errorf("no line received for %s", s.idleTimeout)
+	}
+
 	if err := scanner.Err(); err != nil {
 		return fmt.Errorf("scanner error: %w", err)
 	}
 
-	return nil
+	return errStreamEnded
 }
 
 // shouldDropForBackpressure determines if a message should be dropped based on queue utilization

internal/streamer/streamer_test.go

@@ -1,10 +1,19 @@
 package streamer
 
 import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
 )
 
 func TestNewStreamer(t *testing.T) {
@@ -31,4 +40,239 @@ func TestNewStreamer(t *testing.T) {
 	if s.metrics != metricsTracker {
 		t.Error("metrics tracker not set correctly")
 	}
+
+	if s.idleTimeout != streamIdleTimeout {
+		t.Errorf("idleTimeout = %s, want %s", s.idleTimeout, streamIdleTimeout)
+	}
+
+	if s.minBackoff != minBackoffDelay {
+		t.Errorf("minBackoff = %s, want %s", s.minBackoff, minBackoffDelay)
+	}
+}
+
+// TestStreamDoesNotLeakTickersAcrossReconnects drives many short-lived
+// connections (each stream call is one reconnect cycle) and asserts the
+// goroutine count returns to its starting value. Each connection starts two
+// ticker goroutines; before the fix they lived until the streamer's lifetime
+// context was cancelled, so every reconnect leaked two.
+func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
+	// The handler returns immediately, so the response body is empty and each
+	// stream call ends at once, standing in for a dropped connection.
+	srv := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+
+	// One warm-up connection so any persistent HTTP transport goroutine exists
+	// before we take the baseline.
+	if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+		t.Fatalf("warm-up stream returned %v, want %v", err, errStreamEnded)
+	}
+	s.client.CloseIdleConnections()
+
+	baseline := settledGoroutineCount()
+
+	const reconnects = 20
+	for range reconnects {
+		if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+			t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
+		}
+	}
+	s.client.CloseIdleConnections()
+
+	if !waitForGoroutines(baseline) {
+		t.Fatalf("goroutines did not return to baseline %d after %d reconnects, got %d",
+			baseline, reconnects, runtime.NumGoroutine())
+	}
+}
+
+// updateLine is one UPDATE message as RIS Live sends it.
+const updateLine = `{"type":"ris_message","data":{"type":"UPDATE","peer":"192.0.2.1",` +
+	`"peer_asn":"64496","timestamp":1700000000}}` + "\n"
+
+// updateHandler wants UPDATE messages. For each one it handles it sends on
+// handled if there is room, and otherwise does nothing; a nil handled is
+// never sent on.
+type updateHandler struct {
+	handled chan struct{}
+}
+
+func (updateHandler) WantsMessage(messageType string) bool { return messageType == "UPDATE" }
+func (updateHandler) QueueCapacity() int                   { return 10 }
+
+func (h updateHandler) HandleMessage(*ristypes.RISMessage) {
+	select {
+	case h.handled <- struct{}{}:
+	default:
+	}
+}
+
+// TestStopBeforeMessageReachesQueues stops the streamer after the read loop
+// has checked for cancellation but before it hands the message to the handler
+// queues. That is the gap a stop from another goroutine can land in, and it
+// used to end in "send on closed channel". The raw handler runs in that gap on
+// the read loop itself, so calling Stop from it hits the gap every time.
+func TestStopBeforeMessageReachesQueues(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, updateLine)
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+	s.RegisterHandler(updateHandler{})
+	s.RegisterRawHandler(func(string) { s.Stop() })
+
+	// Start would run the stream in the background, where the test cannot
+	// wait for it. Setting cancel as Start does lets Stop cancel the stream
+	// run here instead.
+	ctx, cancel := context.WithCancel(context.Background())
+	s.cancel = cancel
+
+	if err := s.stream(ctx); !errors.Is(err, context.Canceled) {
+		t.Fatalf("stream returned %v, want %v", err, context.Canceled)
+	}
+
+	// A second Stop must not close the queues again.
+	s.Stop()
+}
+
+// TestReconnectWhenStreamEnds has the server end the first response
+// normally, as when RIS Live restarts. The streamer must treat that as a
+// disconnect and connect again.
+func TestReconnectWhenStreamEnds(t *testing.T) {
+	endResponse := func(http.ResponseWriter, *http.Request) {}
+	checkReconnect(t, endResponse, streamIdleTimeout)
+}
+
+// TestReconnectWhenStreamGoesIdle has the server hold the first response
+// open without sending anything. The streamer must drop it once the idle
+// timeout passes and connect again.
+func TestReconnectWhenStreamGoesIdle(t *testing.T) {
+	const idleTimeout = 50 * time.Millisecond
+	holdResponse := func(w http.ResponseWriter, r *http.Request) {
+		w.(http.Flusher).Flush()
+		<-r.Context().Done()
+	}
+	checkReconnect(t, holdResponse, idleTimeout)
+}
+
+// TestReconnectWhenServerNeverAnswers has the server accept the first
+// request and never answer it, not even with headers. The streamer must give
+// up on it once the idle timeout passes and connect again.
+func TestReconnectWhenServerNeverAnswers(t *testing.T) {
+	const idleTimeout = 50 * time.Millisecond
+	neverAnswer := func(_ http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	}
+	checkReconnect(t, neverAnswer, idleTimeout)
+}
+
+// TestStreamNotDroppedWhileLinesArrive has the server send lines well within
+// the idle timeout for several times the timeout, then end the response. Each
+// line must start the idle timeout over, so the stream lasts until the server
+// ends it instead of being dropped as idle.
+func TestStreamNotDroppedWhileLinesArrive(t *testing.T) {
+	const (
+		idleTimeout  = 100 * time.Millisecond
+		lineInterval = idleTimeout / 10
+		sendFor      = 5 * idleTimeout
+	)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		deadline := time.Now().Add(sendFor)
+		for time.Now().Before(deadline) {
+			_, _ = io.WriteString(w, updateLine)
+			w.(http.Flusher).Flush()
+			time.Sleep(lineInterval)
+		}
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+	s.idleTimeout = idleTimeout
+
+	if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+		t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
+	}
+}
+
+// checkReconnect runs a streamer against a fake RIS Live server. The first
+// response is served by firstResponse; every later one carries one UPDATE
+// line and then stays open. The streamer must come back for a second
+// response, must not be marked connected when it does, and must handle the
+// UPDATE in it.
+func checkReconnect(t *testing.T, firstResponse http.HandlerFunc, idleTimeout time.Duration) {
+	t.Helper()
+
+	const maxWait = 5 * time.Second
+
+	tracker := metrics.New()
+	connectedAtReconnect := make(chan bool, 1)
+	var requests atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if requests.Add(1) == 1 {
+			firstResponse(w, r)
+
+			return
+		}
+		select {
+		case connectedAtReconnect <- tracker.IsConnected():
+		default:
+		}
+		_, _ = io.WriteString(w, updateLine)
+		w.(http.Flusher).Flush()
+		<-r.Context().Done()
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), tracker)
+	s.url = srv.URL
+	s.idleTimeout = idleTimeout
+	s.minBackoff = time.Millisecond
+	handler := updateHandler{handled: make(chan struct{}, 1)}
+	s.RegisterHandler(handler)
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start returned error: %v", err)
+	}
+	defer s.Stop()
+
+	select {
+	case <-handler.handled:
+	case <-time.After(maxWait):
+		t.Fatalf("no message from a second response handled within %s", maxWait)
+	}
+
+	if <-connectedAtReconnect {
+		t.Error("streamer was still marked connected when it came back for a second response")
+	}
+}
+
+// settledGoroutineCount lets transient goroutines finish, then reports the
+// current count.
+func settledGoroutineCount() int {
+	prev := runtime.NumGoroutine()
+	for range 20 {
+		time.Sleep(10 * time.Millisecond)
+		cur := runtime.NumGoroutine()
+		if cur == prev {
+			return cur
+		}
+		prev = cur
+	}
+
+	return prev
+}
+
+// waitForGoroutines waits until the goroutine count drops to target or below.
+func waitForGoroutines(target int) bool {
+	for range 100 {
+		if runtime.NumGoroutine() <= target {
+			return true
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	return false
 }

internal/templates/as_detail.html

@@ -5,13 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>AS{{.ASN.ASN}} - {{.ASN.Handle}} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
             margin: 0;
-            padding: 20px;
+            padding: 0;
             background: #f5f5f5;
             color: #333;
         }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            padding: 20px;
+        }
         .container {
             max-width: 1200px;
             margin: 0 auto;
@@ -133,8 +196,20 @@
     </style>
 </head>
 <body>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <div class="container">
-        <a href="/status" class="nav-link">← Back to Status</a>
         
         <h1>AS{{.ASN.ASN}}{{if .ASN.Handle}} - {{.ASN.Handle}}{{end}}</h1>
         {{if .ASN.Description}}
@@ -182,7 +257,7 @@
                 <tbody>
                     {{range .IPv4Prefixes}}
                     <tr>
-                        <td><a href="/prefix/{{.Prefix | urlEncode}}" class="prefix-link">{{.Prefix}}</a></td>
+                        <td><a href="{{.Prefix | prefixURL}}" class="prefix-link">{{.Prefix}}</a></td>
                         <td>/{{.MaskLength}}</td>
                         <td>{{.LastUpdated.Format "2006-01-02 15:04:05"}}</td>
                         <td class="age">{{.LastUpdated | timeSince}}</td>
@@ -211,7 +286,7 @@
                 <tbody>
                     {{range .IPv6Prefixes}}
                     <tr>
-                        <td><a href="/prefix/{{.Prefix | urlEncode}}" class="prefix-link">{{.Prefix}}</a></td>
+                        <td><a href="{{.Prefix | prefixURL}}" class="prefix-link">{{.Prefix}}</a></td>
                         <td>/{{.MaskLength}}</td>
                         <td>{{.LastUpdated.Format "2006-01-02 15:04:05"}}</td>
                         <td class="age">{{.LastUpdated | timeSince}}</td>
@@ -266,5 +341,6 @@
         </div>
         {{end}}
     </div>
+    </main>
 </body>
 </html>

internal/templates/index.html

@@ -0,0 +1,447 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>RouteWatch - BGP Route Monitor</title>
+    <style>
+        * {
+            box-sizing: border-box;
+        }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+            color: #333;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 30px 20px;
+        }
+
+        /* Stats overview */
+        .stats-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+            gap: 20px;
+            margin-bottom: 40px;
+        }
+        .stat-card {
+            background: white;
+            padding: 24px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            text-align: center;
+        }
+        .stat-value {
+            font-size: 32px;
+            font-weight: bold;
+            color: #2c3e50;
+            margin-bottom: 8px;
+        }
+        .stat-label {
+            font-size: 14px;
+            color: #7f8c8d;
+            text-transform: uppercase;
+            letter-spacing: 0.5px;
+        }
+        .stat-card.connected .stat-value {
+            color: #27ae60;
+        }
+        .stat-card.disconnected .stat-value {
+            color: #e74c3c;
+        }
+
+        /* Search section */
+        .search-section {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(350px, 1fr));
+            gap: 24px;
+            margin-bottom: 40px;
+        }
+        .search-card {
+            background: white;
+            padding: 24px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .search-card h2 {
+            margin: 0 0 16px 0;
+            font-size: 18px;
+            color: #2c3e50;
+        }
+        .search-input-group {
+            display: flex;
+            gap: 10px;
+        }
+        .search-input-group input {
+            flex: 1;
+            padding: 12px 16px;
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            font-size: 14px;
+            outline: none;
+            transition: border-color 0.2s;
+        }
+        .search-input-group input:focus {
+            border-color: #3498db;
+        }
+        .search-input-group button {
+            padding: 12px 24px;
+            background: #3498db;
+            color: white;
+            border: none;
+            border-radius: 6px;
+            font-size: 14px;
+            cursor: pointer;
+            transition: background-color 0.2s;
+        }
+        .search-input-group button:hover {
+            background: #2980b9;
+        }
+        .search-input-group button:disabled {
+            background: #bdc3c7;
+            cursor: not-allowed;
+        }
+        .search-hint {
+            font-size: 12px;
+            color: #95a5a6;
+            margin-top: 8px;
+        }
+
+        /* IP Lookup result */
+        .ip-result {
+            margin-top: 16px;
+            display: none;
+        }
+        .ip-result.visible {
+            display: block;
+        }
+        .ip-result-header {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 8px;
+        }
+        .ip-result-header h3 {
+            margin: 0;
+            font-size: 14px;
+            color: #2c3e50;
+        }
+        .ip-result-header button {
+            background: none;
+            border: none;
+            color: #e74c3c;
+            cursor: pointer;
+            font-size: 12px;
+        }
+        .ip-result pre {
+            background: #2c3e50;
+            color: #ecf0f1;
+            padding: 16px;
+            border-radius: 6px;
+            overflow-x: auto;
+            font-size: 12px;
+            line-height: 1.5;
+            margin: 0;
+            max-height: 400px;
+            overflow-y: auto;
+        }
+        .ip-result .error {
+            background: #fee;
+            color: #c00;
+            padding: 12px;
+            border-radius: 6px;
+            font-size: 14px;
+        }
+        .ip-result .loading {
+            color: #7f8c8d;
+            font-style: italic;
+        }
+
+        /* Footer */
+        .footer {
+            margin-top: 40px;
+            padding: 20px;
+            background: white;
+            border-radius: 8px;
+            box-shadow: 0 -2px 10px rgba(0,0,0,0.05);
+            text-align: center;
+            color: #7f8c8d;
+            font-size: 14px;
+        }
+        .footer a {
+            color: #3498db;
+            text-decoration: none;
+        }
+        .footer a:hover {
+            text-decoration: underline;
+        }
+        .footer .separator {
+            margin: 0 10px;
+            color: #ddd;
+        }
+    </style>
+</head>
+<body>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/" class="active">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
+        <div class="stats-grid">
+            <div class="stat-card" id="status-card">
+                <div class="stat-value" id="stat-status">-</div>
+                <div class="stat-label">Status</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-routes">-</div>
+                <div class="stat-label">Live Routes</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-asns">-</div>
+                <div class="stat-label">Autonomous Systems</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-prefixes">-</div>
+                <div class="stat-label">Prefixes</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-peers">-</div>
+                <div class="stat-label">BGP Peers</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-updates">-</div>
+                <div class="stat-label">Updates/sec</div>
+            </div>
+        </div>
+
+        <div class="search-section">
+            <div class="search-card">
+                <h2>AS Number Lookup</h2>
+                <form id="asn-form" class="search-input-group">
+                    <input type="text" id="asn-input" placeholder="e.g., 15169 or AS15169" autocomplete="off">
+                    <button type="submit">Lookup</button>
+                </form>
+                <p class="search-hint">Enter an AS number to view its announced prefixes and peers</p>
+            </div>
+
+            <div class="search-card">
+                <h2>AS Name Search</h2>
+                <form id="asname-form" class="search-input-group">
+                    <input type="text" id="asname-input" placeholder="e.g., Google, Cloudflare" autocomplete="off">
+                    <button type="submit">Search</button>
+                </form>
+                <p class="search-hint">Search for autonomous systems by organization name</p>
+                <div id="asname-results"></div>
+            </div>
+
+            <div class="search-card">
+                <h2>IP Address Lookup</h2>
+                <form id="ip-form" class="search-input-group">
+                    <input type="text" id="ip-input" placeholder="e.g., 8.8.8.8 or 2001:4860:4860::8888" autocomplete="off">
+                    <button type="submit">Lookup</button>
+                </form>
+                <p class="search-hint">Get routing information for any IP address</p>
+                <div id="ip-result" class="ip-result">
+                    <div class="ip-result-header">
+                        <h3>Result</h3>
+                        <button type="button" id="ip-result-close">Clear</button>
+                    </div>
+                    <pre id="ip-result-content"></pre>
+                </div>
+            </div>
+        </div>
+    </main>
+
+    <footer class="footer">
+        <span><a href="{{appRepoURL}}">{{appName}}</a> by <a href="{{appAuthorURL}}">{{appAuthor}}</a></span>
+        <span class="separator">|</span>
+        <span>{{appLicense}}</span>
+        <span class="separator">|</span>
+        <span><a href="{{appGitCommitURL}}">{{appGitRevision}}</a></span>
+    </footer>
+
+    <script>
+        function formatNumber(num) {
+            if (num >= 1000000) {
+                return (num / 1000000).toFixed(1) + 'M';
+            } else if (num >= 1000) {
+                return (num / 1000).toFixed(1) + 'K';
+            }
+            return num.toLocaleString();
+        }
+
+        // Fetch and display stats
+        function updateStats() {
+            fetch('/api/v1/stats')
+                .then(response => response.json())
+                .then(response => {
+                    if (response.status !== 'ok') return;
+                    const data = response.data;
+
+                    const statusCard = document.getElementById('status-card');
+                    const statusEl = document.getElementById('stat-status');
+                    statusEl.textContent = data.connected ? 'Connected' : 'Disconnected';
+                    statusCard.className = 'stat-card ' + (data.connected ? 'connected' : 'disconnected');
+
+                    document.getElementById('stat-routes').textContent = formatNumber(data.live_routes);
+                    document.getElementById('stat-asns').textContent = formatNumber(data.asns);
+                    document.getElementById('stat-prefixes').textContent = formatNumber(data.prefixes);
+
+                    if (data.stream) {
+                        document.getElementById('stat-peers').textContent = formatNumber(data.stream.bgp_peer_count);
+                    }
+
+                    const totalUpdates = data.ipv4_updates_per_sec + data.ipv6_updates_per_sec;
+                    document.getElementById('stat-updates').textContent = totalUpdates.toFixed(1);
+                })
+                .catch(() => {
+                    document.getElementById('stat-status').textContent = 'Error';
+                    document.getElementById('status-card').className = 'stat-card disconnected';
+                });
+        }
+
+        // ASN lookup
+        document.getElementById('asn-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            let asn = document.getElementById('asn-input').value.trim();
+            // Remove 'AS' prefix if present
+            asn = asn.replace(/^AS/i, '');
+            if (asn && /^\d+$/.test(asn)) {
+                window.location.href = '/as/' + asn;
+            }
+        });
+
+        // AS name search
+        document.getElementById('asname-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            const query = document.getElementById('asname-input').value.trim();
+            if (!query) return;
+
+            const resultsDiv = document.getElementById('asname-results');
+            resultsDiv.innerHTML = '<p class="loading" style="color: #7f8c8d; margin-top: 12px;">Searching...</p>';
+
+            // Use a simple client-side search against the asinfo data
+            // For now, redirect to AS page if it looks like an ASN
+            if (/^\d+$/.test(query)) {
+                window.location.href = '/as/' + query;
+                return;
+            }
+
+            // Show a message that server-side search is coming
+            resultsDiv.innerHTML = '<p style="color: #7f8c8d; margin-top: 12px; font-size: 13px;">AS name search coming soon. For now, try an AS number.</p>';
+        });
+
+        // IP lookup
+        document.getElementById('ip-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            const ip = document.getElementById('ip-input').value.trim();
+            if (!ip) return;
+
+            const resultDiv = document.getElementById('ip-result');
+            const contentEl = document.getElementById('ip-result-content');
+
+            resultDiv.classList.add('visible');
+            contentEl.className = '';
+            contentEl.textContent = 'Loading...';
+            contentEl.classList.add('loading');
+
+            fetch('/ip/' + encodeURIComponent(ip))
+                .then(response => response.json())
+                .then(response => {
+                    contentEl.classList.remove('loading');
+                    if (response.status === 'error') {
+                        contentEl.className = 'error';
+                        contentEl.textContent = 'Error: ' + response.error.msg;
+                    } else {
+                        contentEl.className = '';
+                        contentEl.textContent = JSON.stringify(response.data, null, 2);
+                    }
+                })
+                .catch(error => {
+                    contentEl.classList.remove('loading');
+                    contentEl.className = 'error';
+                    contentEl.textContent = 'Error: ' + error.message;
+                });
+        });
+
+        // Close IP result
+        document.getElementById('ip-result-close').addEventListener('click', function() {
+            document.getElementById('ip-result').classList.remove('visible');
+            document.getElementById('ip-input').value = '';
+        });
+
+        // Initial load and refresh stats every 5 seconds
+        updateStats();
+        setInterval(updateStats, 5000);
+    </script>
+</body>
+</html>

internal/templates/prefix_detail.html

@@ -5,13 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{.Prefix}} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
             margin: 0;
-            padding: 20px;
+            padding: 0;
             background: #f5f5f5;
             color: #333;
         }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            padding: 20px;
+        }
         .container {
             width: 90%;
             max-width: 1600px;
@@ -180,9 +243,20 @@
     </style>
 </head>
 <body>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <div class="container">
-        <a href="/status" class="nav-link">← Back to Status</a>
-        
         <h1>{{.Prefix}}</h1>
         <p class="subtitle">IPv{{.IPVersion}} Prefix{{if .MaskLength}} • /{{.MaskLength}}{{end}}</p>
         
@@ -209,6 +283,7 @@
                 <div class="origin-item">
                     <a href="/as/{{.ASN}}" class="as-link">AS{{.ASN}}</a>
                     {{if .Handle}} ({{.Handle}}){{end}}
+                    {{if .Description}} {{.Description}}{{end}}
                     <span style="color: #7f8c8d; margin-left: 10px;">{{.PeerCount}} peer{{if ne .PeerCount 1}}s{{end}}</span>
                 </div>
                 {{end}}
@@ -255,5 +330,6 @@
         </div>
         {{end}}
     </div>
+    </main>
 </body>
 </html>

internal/templates/prefix_length.html

@@ -5,12 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Prefixes with /{{ .MaskLength }} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
             max-width: 1200px;
             margin: 0 auto;
             padding: 20px;
-            background: #f5f5f5;
         }
         h1 {
             color: #333;
@@ -78,7 +142,19 @@
     </style>
 </head>
 <body>
-    <a href="/status" class="back-link">← Back to Status</a>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <h1>IPv{{ .IPVersion }} Prefixes with /{{ .MaskLength }}</h1>
     <p class="subtitle">Showing {{ .Count }} randomly selected prefixes</p>
     
@@ -93,7 +169,7 @@
         <tbody>
             {{ range .Prefixes }}
             <tr>
-                <td><a href="/prefix/{{ .Prefix | urlEncode }}" class="prefix-link">{{ .Prefix }}</a></td>
+                <td><a href="{{ .Prefix | prefixURL }}" class="prefix-link">{{ .Prefix }}</a></td>
                 <td class="age">{{ .Age }}</td>
                 <td>
                     <a href="/as/{{ .OriginASN }}" class="as-link">
@@ -104,5 +180,6 @@
             {{ end }}
         </tbody>
     </table>
+    </main>
 </body>
 </html>

internal/templates/status.html

@@ -5,12 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>RouteWatch Status</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
             max-width: 1200px;
             margin: 0 auto;
             padding: 20px;
-            background: #f5f5f5;
         }
         h1 {
             color: #333;
@@ -96,7 +160,19 @@
     </style>
 </head>
 <body>
-    <h1>RouteWatch Status</h1>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status" class="active">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <div id="error" class="error" style="display: none;"></div>
     <div class="status-grid">
         <div class="status-card">
@@ -245,6 +321,14 @@
                 <span class="metric-label">IPv6 Updates/sec</span>
                 <span class="metric-value" id="ipv6_updates_per_sec">-</span>
             </div>
+            <div class="metric">
+                <span class="metric-label">Oldest Route</span>
+                <span class="metric-value" id="oldest_route">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Newest Route</span>
+                <span class="metric-value" id="newest_route">-</span>
+            </div>
         </div>
 
         <div class="status-card">
@@ -324,7 +408,23 @@
                 return ms.toFixed(2) + ' ms';
             }
         }
-        
+
+        function formatRelativeTime(isoString) {
+            if (!isoString) return '-';
+            const date = new Date(isoString);
+            const now = new Date();
+            const diffMs = now - date;
+            const diffSec = Math.floor(diffMs / 1000);
+            const diffMin = Math.floor(diffSec / 60);
+            const diffHour = Math.floor(diffMin / 60);
+            const diffDay = Math.floor(diffHour / 24);
+
+            if (diffSec < 60) return diffSec + 's ago';
+            if (diffMin < 60) return diffMin + 'm ago';
+            if (diffHour < 24) return diffHour + 'h ' + (diffMin % 60) + 'm ago';
+            return diffDay + 'd ' + (diffHour % 24) + 'h ago';
+        }
+
         function updatePrefixDistribution(elementId, distribution) {
             const container = document.getElementById(elementId);
             container.innerHTML = '';
@@ -430,6 +530,8 @@
             document.getElementById('ipv6_routes').textContent = '-';
             document.getElementById('ipv4_updates_per_sec').textContent = '-';
             document.getElementById('ipv6_updates_per_sec').textContent = '-';
+            document.getElementById('oldest_route').textContent = '-';
+            document.getElementById('newest_route').textContent = '-';
             document.getElementById('whois_fresh').textContent = '-';
             document.getElementById('whois_stale').textContent = '-';
             document.getElementById('whois_never').textContent = '-';
@@ -490,6 +592,8 @@
                     document.getElementById('ipv6_routes').textContent = formatNumber(data.ipv6_routes);
                     document.getElementById('ipv4_updates_per_sec').textContent = data.ipv4_updates_per_sec.toFixed(1);
                     document.getElementById('ipv6_updates_per_sec').textContent = data.ipv6_updates_per_sec.toFixed(1);
+                    document.getElementById('oldest_route').textContent = formatRelativeTime(data.oldest_route);
+                    document.getElementById('newest_route').textContent = formatRelativeTime(data.newest_route);
 
                     // Update stream stats
                     if (data.stream) {
@@ -542,6 +646,7 @@
         updateStatus();
         setInterval(updateStatus, 2000);
     </script>
+    </main>
 
     <footer class="footer">
         <span><a href="{{appRepoURL}}">{{appName}}</a> by <a href="{{appAuthorURL}}">{{appAuthor}}</a></span>

internal/templates/templates.go

@@ -5,12 +5,16 @@ import (
 	_ "embed"
 	"html/template"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
 
 	"git.eeqj.de/sneak/routewatch/internal/version"
 )
 
+//go:embed index.html
+var indexHTML string
+
 //go:embed status.html
 var statusHTML string
 
@@ -25,6 +29,8 @@ var prefixLengthHTML string
 
 // Templates contains all parsed templates
 type Templates struct {
+	// Index is the template for the home page
+	Index *template.Template
 	// Status is the template for the main status page
 	Status *template.Template
 	// ASDetail is the template for displaying AS (Autonomous System) details
@@ -43,8 +49,9 @@ var (
 )
 
 const (
-	hoursPerDay  = 24
-	daysPerMonth = 30
+	hoursPerDay   = 24
+	daysPerMonth  = 30
+	cidrPartCount = 2 // A CIDR has two parts: prefix and length
 )
 
 // timeSince returns a human-readable duration since the given time
@@ -80,6 +87,20 @@ func timeSince(t time.Time) string {
 	return t.Format("2006-01-02")
 }
 
+// prefixURL generates a URL path for a prefix in CIDR notation.
+// Takes a prefix like "192.168.1.0/24" and returns "/prefix/192.168.1.0/24"
+// with the prefix part URL-encoded to handle IPv6 colons.
+func prefixURL(cidr string) string {
+	// Split CIDR into prefix and length
+	parts := strings.SplitN(cidr, "/", cidrPartCount)
+	if len(parts) != cidrPartCount {
+		// Fallback if no slash found
+		return "/prefix/" + url.PathEscape(cidr) + "/0"
+	}
+
+	return "/prefix/" + url.PathEscape(parts[0]) + "/" + parts[1]
+}
+
 // initTemplates parses all embedded templates
 func initTemplates() {
 	var err error
@@ -88,15 +109,22 @@ func initTemplates() {
 
 	// Create common template functions
 	funcs := template.FuncMap{
-		"timeSince":        timeSince,
-		"urlEncode":        url.QueryEscape,
-		"appName":          func() string { return version.Name },
-		"appAuthor":        func() string { return version.Author },
-		"appAuthorURL":     func() string { return version.AuthorURL },
-		"appLicense":       func() string { return version.License },
-		"appRepoURL":       func() string { return version.RepoURL },
-		"appGitRevision":   func() string { return version.GitRevisionShort },
-		"appGitCommitURL":  func() string { return version.CommitURL() },
+		"timeSince":       timeSince,
+		"urlEncode":       url.QueryEscape,
+		"prefixURL":       prefixURL,
+		"appName":         func() string { return version.Name },
+		"appAuthor":       func() string { return version.Author },
+		"appAuthorURL":    func() string { return version.AuthorURL },
+		"appLicense":      func() string { return version.License },
+		"appRepoURL":      func() string { return version.RepoURL },
+		"appGitRevision":  func() string { return version.GitRevisionShort },
+		"appGitCommitURL": func() string { return version.CommitURL() },
+	}
+
+	// Parse index template
+	defaultTemplates.Index, err = template.New("index").Funcs(funcs).Parse(indexHTML)
+	if err != nil {
+		panic("failed to parse index template: " + err.Error())
 	}
 
 	// Parse status template
@@ -131,6 +159,11 @@ func Get() *Templates {
 	return defaultTemplates
 }
 
+// IndexTemplate returns the parsed index template
+func IndexTemplate() *template.Template {
+	return Get().Index
+}
+
 // StatusTemplate returns the parsed status template
 func StatusTemplate() *template.Template {
 	return Get().Status

internal/version/version.go

@@ -7,7 +7,8 @@ package version
 var (
 	// GitRevision is the git commit hash
 	GitRevision = "unknown"
-	// GitRevisionShort is the short git commit hash (7 chars)
+	// GitRevisionShort is the version the page footer shows: the tag or
+	// short commit hash from `git describe --tags --always`
 	GitRevisionShort = "unknown"
 )
 

script/bootstrap

@@ -0,0 +1,73 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes NOTHING is present (not git,
+# make, or go).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+    [ -n "$PKGMGR" ] && return 0
+    if command -v nix-env >/dev/null 2>&1; then
+        PKGMGR="nix"
+    elif command -v apt-get >/dev/null 2>&1; then
+        PKGMGR="apt"
+    elif command -v brew >/dev/null 2>&1; then
+        PKGMGR="brew"
+    elif command -v apk >/dev/null 2>&1; then
+        PKGMGR="apk"
+    else
+        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+        exit 1
+    fi
+    if [ "$PKGMGR" = "apt" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        if [ "$(id -u)" != "0" ]; then
+            SUDO="sudo"
+        fi
+    fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+    detect_pkgmgr
+    case "$PKGMGR" in
+        nix) nix-env -iA "nixpkgs.$1" ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        brew) brew install "$3" ;;
+        apk) apk add --no-cache "$4" ;;
+    esac
+}
+
+missing() {
+    ! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+    cd "$ROOT"
+
+    # Base tooling (every repo)
+    if missing git; then pkg_install git git git git; fi
+    if missing make; then pkg_install gnumake make make make; fi
+
+    # Go toolchain
+    if missing go; then pkg_install go golang go go; fi
+
+    # golangci-lint: packaged in nix, brew, and apk. There is no apt
+    # package; on apt systems install it manually from a hash-verified
+    # GitHub release archive (never curl | sh).
+    if missing golangci-lint; then
+        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    fi
+
+    go mod download
+
+    echo "bootstrap complete"
+}
+
+main "$@"

script/check

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. Must not modify any files.
+# Generic: usually needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
+}
+
+main "$@"

script/cibuild

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs script/check
+# (via make check), so a successful build implies all checks pass.
+# Generic: needs no adaptation. The Gitea workflow runs this on push.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"

script/docker

@@ -0,0 +1,24 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/fmt

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/fmt: format all files (writes).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go fmt ./...
+}
+
+main "$@"

script/fmt-check

@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/fmt-check: check formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    unformatted="$(gofmt -l .)"
+    if [ -n "$unformatted" ]; then
+        echo "Files not formatted:" >&2
+        echo "$unformatted" >&2
+        exit 1
+    fi
+}
+
+main "$@"

script/install-precommit

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+# Generic: needs no adaptation.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    hook=".git/hooks/pre-commit"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"

script/lint

@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/lint: run the linters.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go vet ./...
+    golangci-lint run
+}
+
+main "$@"

script/precommit

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
+# extras: go mod tidy and go fmt must leave the tree unchanged.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go mod tidy
+    go fmt ./...
+    git diff --exit-code -- go.mod go.sum || {
+        echo "go mod tidy changed files; please stage and retry"
+        exit 1
+    }
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"

script/projectname

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our own
+# extension to scripts-to-rule-them-all. Other scripts that need the
+# name (e.g. script/docker) call this, so they can stay identical
+# across all repos.
+set -eu
+
+main() {
+    echo "routewatch"
+}
+
+main "$@"

script/setup

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/setup: set up the repo for development after a fresh clone:
+# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# Add any repo-specific initialization (db init, .env template) here.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"

script/test

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/test: run the test suite. On failure, rerun verbosely so the
+# failing tests are visible in the output.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go test -short -timeout 30s -race -cover ./... || {
+        echo "--- Rerunning with -v for details ---"
+        go test -short -timeout 30s -race -v ./...
+        exit 1
+    }
+}
+
+main "$@"