Re-vendor the shared files from sneak/prompts at dd4027b (closes #52)

Takes .golangci.yml, .dockerignore, .gitignore, .editorconfig, the
workflow and REPO_POLICIES.md from sneak/prompts dd4027b, keeping this
repository's own entries after the shared content. Lint (golangci-lint
v2.14.0) and test become Dockerfile phases that script/lint and
script/test build alone and uncached; the image build depends on both,
and script/cibuild bootstraps, runs script/check, then builds the image.
The agent guidance file moves to AGENTS.md. The Go code is fixed for
what the new configuration finds; reads that iterate rows now also
report an iteration error.

Model: opus-5-5

.dockerignore

@@ -0,0 +1,97 @@
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
+.claude
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+**/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repository's host-built artifacts: `make build` writes bin/, `go
+# build` in the root the binaries, `make run` log.txt, `make asupdate` its
+# .tmp file; test binaries, coverage profiles and source archives.
+/bin
+/routewatch
+/asinfo-gen
+/streamdumper
+/log.txt
+/out
+/pkg/asinfo/asdata.json
+**/*.tar.zst
+**/*.test
+**/*.out
+**/*.tmp
+
+# Local databases. The image carries a source archive of the whole build
+# context, so these would otherwise ship inside it.
+**/*.db
+**/*.db-journal
+**/*.db-wal
+
+# A local Go workspace points at directories outside the build context.
+/go.work
+/go.work.sum

.editorconfig

@@ -10,3 +10,6 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
+
+[*.go]
+indent_style = tab

.gitea/workflows/check.yml

@@ -4,6 +4,6 @@ jobs:
     check:
         runs-on: ubuntu-latest
         steps:
-            # actions/checkout v4.2.2, 2026-02-28
+            # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
             - run: script/cibuild

.gitignore

@@ -1,41 +1,77 @@
-# Binaries for programs and plugins
+# OS
+.DS_Store
+Thumbs.db
+
+# Editors
+*.swp
+*.swo
+*~
+*.bak
+.idea/
+.vscode/
+*.sublime-*
+
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
+# Node
+node_modules/
+
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# This repository's own entries, kept after the canonical content above.
+
+# Go: logs, test binaries, coverage profiles, and the binaries `make build`
+# and `go build` in the repository root write.
+*.log
+*.out
+*.test
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
 /bin/
-
-.DS_Store
-log.txt
-
-# Test binary, built with `go test -c`
-*.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
-
-# Go workspace file
+/routewatch
+/asinfo-gen
+/streamdumper
 go.work
 go.work.sum
 
-# env file
-.env
-
-# Database files
+# Local databases, temporary files and debug output.
 *.db
 *.db-journal
 *.db-wal
-
-# Temporary files
 *.tmp
-
-# Raw AS data (we only commit the gzipped version)
-pkg/asinfo/asdata.json
-
-# Debug output files
-out
 log.txt
+out
+
+# Raw AS data (only the gzipped version is committed).
+pkg/asinfo/asdata.json

.golangci.yml

@@ -1,92 +1,99 @@
 version: "2"
 
+# Config schema uses the golangci-lint v2 layout (settings live under
+# linters.settings, not top-level linters-settings) so that the
+# thresholds below are actually applied by golangci-lint >= v2.
+
 run:
-  go: "1.24"
-  tests: false
+  timeout: 5m
+  modules-download-mode: readonly
 
 linters:
+  default: all
   enable:
-    # Additional linters requested
-    - testifylint      # Checks usage of github.com/stretchr/testify
-    - usetesting       # usetesting is an analyzer that detects using os.Setenv instead of t.Setenv since Go 1.17
-    # - tagliatelle      # Disabled: we need snake_case for external API compatibility
-    - nlreturn         # nlreturn checks for a new line before return and branch statements
-    - nilnil           # Checks that there is no simultaneous return of nil error and an invalid value
-    - nestif           # Reports deeply nested if statements
-    - mnd              # An analyzer to detect magic numbers
-    - lll              # Reports long lines
-    - intrange         # intrange is a linter to find places where for loops could make use of an integer range
-    - gochecknoglobals # Check that no global variables exist
-
-    # Default/existing linters that are commonly useful
-    - govet
-    - errcheck
-    - staticcheck
-    - unused
-    - ineffassign
-    - misspell
-    - revive
-    - gosec
-    - unconvert
-    - unparam
-
-linters-settings:
-  lll:
-    line-length: 120
-
-  nestif:
-    min-complexity: 4
-
-  nlreturn:
-    block-size: 2
-
-  revive:
-    rules:
-      - name: var-naming
-        arguments:
-          - []
-          - []
-          - "upperCaseConst=true"
-
-  tagliatelle:
-    case:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
+  disable:
+    # Genuinely incompatible with project patterns
+    - exhaustruct      # Requires all struct fields
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
+    - godot            # Requires comments to end with periods
+    - wrapcheck        # Too verbose for internal packages
+    - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
+  settings:
+    lll:
+      line-length: 88
+    funlen:
+      lines: 80
+      statements: 50
+    cyclop:
+      max-complexity: 15
+    dupl:
+      threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
       rules:
-        json: snake
-        yaml: snake
-        xml: snake
-        bson: snake
-
-  testifylint:
-    enable-all: true
-
-  usetesting: {}
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-  exclude-rules:
-    # Exclude unused parameter warnings for cobra command signatures
-    - text: "parameter '(args|cmd)' seems to be unused"
-      linters:
-        - revive
-
-    # Allow ALL_CAPS constant names
-    - text: "don't use ALL_CAPS in Go names"
-      linters:
-        - revive
-    
-    # Allow snake_case JSON tags for external API compatibility
-    - path: "internal/types/ris.go"
-      linters:
-        - tagliatelle
-    
-    # Allow snake_case JSON tags for database models
-    - path: "internal/database/models.go"
-      linters:
-        - tagliatelle
-    
-    # Allow generic package name for types that define data structures
-    - path: "internal/types/"
-      text: "avoid meaningless package names"
-      linters:
-        - revive

Dockerfile

@@ -1,22 +1,37 @@
-# Lint stage — fast feedback on formatting and lint issues.
-# The golangci-lint image bundles Go, gcc and make, so it can run go vet on
-# the CGO sqlite package and golangci-lint without extra installs.
-# golangci/golangci-lint:v2.7.2 (Go 1.25.5), 2026-09-21
-FROM golangci/golangci-lint@sha256:5d6d5c70a61f1356adfd9dd6316ce286799fefc9d743421356ff1b00842368ba AS lint
-
+# Lint phase, built alone by script/lint. The linter is invoked directly
+# rather than through `make lint`, which is itself a docker build and
+# would recurse into a daemon that does not exist in a build step. The
+# image is Debian-based and has Go and gcc, so it can check the cgo
+# SQLite package without extra installs.
+# golangci/golangci-lint:v2.14.0 (Go 1.27.0), 2026-10-14
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
-
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
+RUN golangci-lint run --config .golangci.yml ./...
 
-RUN make fmt-check
-RUN make lint
+# Test phase, built alone by script/test. -race needs cgo and so a C
+# compiler, which the Debian Go image ships. -short skips the live RIPE RIS
+# feed test, so the suite needs no network. The rerun with -v only shows
+# details: the build fails however it ends, because the first run failed.
+# golang:1.24-bookworm, 2026-09-21
+FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS test
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go test -short -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -short -timeout 90s -race -v ./...; exit 1; }
 
-# Build stage
+# Build stage. Nothing is wanted from the lint and test phases; the copies
+# are what make BuildKit build them first, so this stage cannot run unless
+# lint and test passed.
 # golang:1.24-bookworm, 2026-09-21
 FROM golang@sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
 
 # Install build dependencies (zstd for archive, gcc for CGO/sqlite3)
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -25,10 +40,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libc6-dev \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /src
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
 
-# Force BuildKit to run the lint stage before compiling or testing.
-COPY --from=lint /src/go.sum /dev/null
+WORKDIR /src
 
 # Copy everything
 COPY . .
@@ -36,12 +51,23 @@ COPY . .
 # Vendor dependencies (must be after copying source)
 RUN go mod download && go mod vendor
 
-# Run the test suite in the build stage: -race needs cgo and the C compiler
-# installed above. The suite is offline (the live-feed test is opt-in).
-RUN make test
-
-# Build the binary with CGO enabled (required for sqlite3)
-RUN CGO_ENABLED=1 GOOS=linux go build -o /routewatch ./cmd/routewatch
+# Build the binary with CGO enabled (required for sqlite3). The version the
+# page footer shows is the VERSION build argument when one is given, otherwise
+# `git describe --tags --always` of the .git in the build context (git comes
+# with this image): the tag on a tagged commit, tag-N-gHASH after one, the
+# short commit when no tag is reachable. A context that carries .git and still
+# yields no version fails the build. The footer links to the full commit.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always || echo unknown)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    CGO_ENABLED=1 GOOS=linux go build -o /routewatch -ldflags "\
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevision=$(git rev-parse --verify HEAD || echo unknown) \
+        -X git.eeqj.de/sneak/routewatch/internal/version.GitRevisionShort=$version" \
+        ./cmd/routewatch
 
 # Create source archive with vendored dependencies
 RUN tar --zstd -cf /routewatch-source.tar.zst \
@@ -79,8 +105,8 @@ RUN chown -R routewatch:routewatch /app
 ENV XDG_DATA_HOME=/var/lib
 
 # Cap the Go heap at 1.5 GiB so the runtime collects harder before the
-# container's memory limit is reached. runuser preserves this the way it does
-# XDG_DATA_HOME above.
+# container's memory limit is reached. setpriv in the entrypoint preserves this
+# the way it does XDG_DATA_HOME above.
 ENV GOMEMLIMIT=1536MiB
 
 # Cap glibc's malloc arenas. The SQLite C library allocates and frees millions
@@ -96,8 +122,8 @@ EXPOSE 8080
 
 COPY ./entrypoint.sh /entrypoint.sh
 
-# Health check using the health endpoint
+# Health check using the health endpoint, on the port PORT names
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD curl -sf http://localhost:8080/.well-known/healthcheck.json || exit 1
+    CMD curl -sf "http://localhost:${PORT:-8080}/.well-known/healthcheck.json" || exit 1
 
 ENTRYPOINT ["/bin/bash", "/entrypoint.sh" ]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeffrey Paul <sneak@sneak.berlin>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -2,7 +2,7 @@ export DEBUG = routewatch
 
 # Git revision for version embedding
 GIT_REVISION := $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
-GIT_REVISION_SHORT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+GIT_REVISION_SHORT := $(shell git describe --tags --always 2>/dev/null || echo "unknown")
 VERSION_PKG := git.eeqj.de/sneak/routewatch/internal/version
 LDFLAGS := -X $(VERSION_PKG).GitRevision=$(GIT_REVISION) -X $(VERSION_PKG).GitRevisionShort=$(GIT_REVISION_SHORT)
 

README.md

@@ -1,6 +1,9 @@
 # RouteWatch
 
-RouteWatch is a real-time BGP routing table monitor that streams BGP UPDATE messages from the RIPE RIS Live service, maintains a live routing table in SQLite, and provides HTTP APIs for querying routing information.
+RouteWatch is an MIT-licensed Go daemon by @sneak that monitors the BGP routing
+table in real time: it streams BGP UPDATE messages from the RIPE RIS Live
+service, maintains a live routing table in SQLite, and provides HTTP APIs for
+querying routing information.
 
 
 ## Features
@@ -139,7 +142,10 @@ routewatch/
 - **Backpressure**: Probabilistic message dropping when queues exceed 50% capacity
 - **Graceful Shutdown**: 60-second timeout, flushes all pending batches
 - **Reconnection**: Exponential backoff (5s-320s) with reset after 30s of stable connection
-- **IPv4 Optimization**: IP ranges stored as uint32 for O(1) lookups
+- **IP Lookup**: the most specific live route is found by looking up the
+  address's prefix at each mask length, longest first, in the prefix index
+  (at most 33 lookups for IPv4, 129 for IPv6); prefixes are stored in the
+  text form Go's `net/netip` prints
 
 ### Database Schema
 
@@ -151,7 +157,7 @@ prefixes_v6(id, prefix, mask_length, first_seen, last_seen)
 
 -- Live routing tables (one per IP version)
 live_routes_v4(id, prefix, mask_length, origin_asn, peer_ip, as_path,
-               next_hop, last_updated, v4_ip_start, v4_ip_end)
+               next_hop, last_updated)
 live_routes_v6(id, prefix, mask_length, origin_asn, peer_ip, as_path,
                next_hop, last_updated)
 
@@ -166,14 +172,21 @@ Configuration is handled via environment variables and OS-specific paths:
 
 | Variable | Default | Description |
 |----------|----------|-------------|
-| `PORT` | `8080` | HTTP server port |
+| `PORT` | `8080` | HTTP server port, a whole number from 1 to 65535 |
 | `DEBUG` | (empty) | Set to `routewatch` for debug logging |
+| `XDG_DATA_HOME` | `/var/lib` (in the Docker image) | Base of the state directory; must be an absolute path |
 | `GOMEMLIMIT` | `1536MiB` (in the Docker image) | Go soft memory limit; see Memory |
-| `MALLOC_ARENA_MAX` | `2` (in the Docker image) | glibc malloc arena cap; see Memory |
+| `MALLOC_ARENA_MAX` | `2` (in the Docker image) | glibc malloc arena cap, a positive whole number; see Memory |
+
+A variable that is set to an invalid value stops the start with an error and a
+non-zero exit. An empty variable counts as unset.
 
 State directory (database location):
 - macOS: `~/Library/Application Support/routewatch/`
-- Linux: `/var/lib/routewatch/` or `~/.local/share/routewatch/`
+- Linux: `/var/lib/berlin.sneak.app.routewatch/` when running as root,
+  otherwise `$XDG_DATA_HOME/berlin.sneak.app.routewatch/` (with `XDG_DATA_HOME`
+  unset, `~/.local/share/berlin.sneak.app.routewatch/`). In the Docker image
+  this is `/var/lib/berlin.sneak.app.routewatch/`.
 
 ## Memory
 
@@ -220,6 +233,22 @@ What happens at each limit:
 With `DEBUG=routewatch` the daemon logs a `System stats` line every 60 seconds
 with the goroutine count and Go memory figures.
 
+## Running under upaas
+
+What the [upaas](https://git.eeqj.de/sneak/upaas) app needs:
+
+- Container port: `8080`.
+- Volume: one, at container path `/var/lib/berlin.sneak.app.routewatch`.
+- Environment: nothing is required. Leave `XDG_DATA_HOME`, `GOMEMLIMIT` and
+  `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch` is optional and
+  adds the `System stats` memory line to the log.
+- Memory Limit: `5g`, the 5 GiB limit from Memory above. upaas sets no swap
+  limit, so on a host with swap Docker allows the same amount of swap again.
+- Health check: the image's `HEALTHCHECK` requests
+  `/.well-known/healthcheck.json` on the container port. upaas reads the
+  container's health 60 seconds after a deploy and fails the deploy unless it
+  is `healthy`.
+
 ## Development
 
 ```bash
@@ -244,24 +273,30 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call
 them. We provide:
 
-- `script/bootstrap` — install all development dependencies (go,
-  golangci-lint, Go module download)
+Tests and the linter run only in Docker, as the `test` and `lint` phases of the
+`Dockerfile`; the image cannot be built unless both pass. Every `docker build`
+in `script/` passes `--no-cache`, so each run executes every check.
+
+- `script/bootstrap` — install all development dependencies (git, make, go, Go
+  module download); warns when docker is missing
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — print the project name (used for the Docker
   image tag)
-- `script/test` — run the test suite
-  (`go test -short -timeout 30s -race -cover ./...`, verbose rerun on
-  failure). The `-short` flag skips the live-network integration test so the
-  default run is deterministic and offline.
-- `script/lint` — run `go vet ./...` and `golangci-lint run`
+- `script/test` — build the `test` phase alone, which runs
+  `go test -short -timeout 90s -race -cover ./...` (verbose rerun on failure).
+  The `-short` flag skips the live-network integration test so the run is
+  deterministic and offline.
+- `script/lint` — build the `lint` phase alone, which runs golangci-lint
+  v2.14.0 with `.golangci.yml`
 - `script/fmt` — format all code (writes)
 - `script/fmt-check` — check formatting (read-only)
 - `script/check` — run `script/test`, `script/lint`, and
   `script/fmt-check`
 - `script/docker` — build the Docker image tagged via
   `script/projectname`
-- `script/cibuild` — CI entrypoint: `docker build .`
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and
+  `script/check`, then builds the image
 - `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
   not change files), then `script/check`
 - `script/install-precommit` — install the git pre-commit hook that
@@ -274,4 +309,8 @@ invoke `go test` directly without `-short`:
 
 ## License
 
-See LICENSE file.
+MIT. See [`LICENSE`](LICENSE).
+
+## Author
+
+[@sneak](https://sneak.berlin)

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-10-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,17 +60,28 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
+  pristine checkout with nothing installed the run dies there, after the
+  containerised gates have passed. **The bootstrap alone is not enough**:
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
+  source nvm for the pinned node version before invoking it, exactly as
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  docker and git then gets through `script/check`. Four further scripts are our
+  own extensions to the standard: `script/check` runs `script/test`,
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/projectname` (literally that filename) simply outputs the project's
+  name. Scripts that need the name call `script/projectname` — e.g.
+  `script/docker` assembles its image tag from it — so those scripts stay
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -89,87 +100,198 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
+  `lint` phase and a `test` phase, with the final stage depending on both so the
+  image cannot be built unless they pass. For non-server repos the final stage
+  brings up a development environment; for server repos it is the runtime image.
+  The gate phases and the build stage start from their pinned base images and
+  install what those images lack either inline, as the canonical Go `Dockerfile`
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
+  repo's own `Dockerfile` does for its yarn packages. The development
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
+  no separate lint file. `script/lint` and `script/test` each build one phase
+  and nothing else:
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **Every `docker build` in `script/` is tagged**, here and in
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    image behind on every invocation, on every developer host and every CI
+    runner; a tagged one replaces the previous image.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own cache, its own `TMPDIR` and
+    a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
+  a `COPY` layer only when the copied content changes, so on an unchanged tree
+  the check `RUN` is served from cache, nothing executes, and the build still
+  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
+  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
+  four, and there is no fifth — `script/check` runs the two gate phases and
+  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
+  not evidence that anything ran: a sub-second build reporting success is a
+  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
+  and friends destroy a build cache shared with every other build on the host.
+  When a check is added or changed, prove it works by planting a defect it must
+  catch and watching the run fail on it, then revert the defect. A green run
+  alone shows neither that the check ran nor that it covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
-    RUN make lint
+    RUN golangci-lint run --config .golangci.yml ./...
 
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
+    # image ships and the alpine one does not.
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
     WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
+    RUN go test -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 90s -race -v ./...; exit 1; }
 
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
+    # Build stage. Nothing is wanted from either phase above; the copies
+    # are what make BuildKit build them first, so this stage cannot run
+    # unless lint and test passed.
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    COPY --from=lint /src/go.sum /dev/null
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
 
-    # Runtime stage
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
+
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
+      both Go and the linter), so nothing needs installing.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
+      and a stage nothing depends on is not built at all, so without these two
+      lines a red gate would not fail the build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+    - If the project requires CGO or system libraries for linting, install them
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
+      has no `apk`, so install with `apt-get` under the Debian package name
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
+      lists in the same `RUN`, so the layer does not keep them:
+
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
+  That script bootstraps, runs the gate phases, and then builds the image, so a
+  successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build is uncached and so runs the gate phases a second time. That is the
+  price of the rule above, and it is worth paying: the image that ships is built
+  from a run of its own gates rather than from a cache entry. A separate
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  checked by review: to try a change to it, add the feature branch to that list
+  and push, then remove the branch from the list again before merging. Keep any
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -189,14 +311,21 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
+- **The test command should use the conditional verbose rerun pattern.** Run
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
+  on success (just package/suite summaries) while providing full diagnostic
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -209,11 +338,26 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. That matters on a developer's machine, where this
+    target runs and the directory lasts from one run to the next. The `test`
+    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
+    result for this repo's tests and nothing before its `go test` step runs a
+    test, so there is nothing to replay. `--no-cache` (above) is what makes that
+    step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -239,10 +383,84 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
+  setting up a new repo. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$(script/projectname)" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -258,9 +476,56 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
+  _NEVER_ be modified by an agent: fetch it from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -374,12 +639,14 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
+  and language-specific config). Everything else goes in a subdirectory.
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -406,3 +673,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

TODO.md

@@ -10,19 +10,100 @@
 
 # Status
 
-pre-1.0. No git tags. Runs in production-style Docker deployment, but
-the policy compliance branch (repo-policies-compliance, make check
-passing, clean tree) is unmerged to main and the CI workflow is missing.
+pre-1.0. No git tags. The linter and the tests are phases of the Docker
+build, and the Gitea workflow runs `script/cibuild` (the format check, both
+phases, then the image) on every push. The
+image sets memory ceilings for a 5 GiB container (README "Memory") and the
+README says how to run it under upaas (README "Running under upaas"). A
+35-hour run of `3898daa` on the live feed peaked at about 1 GiB, without a
+container memory limit.
 
 # Next Step
 
-Merge repo-policies-compliance into main (3 commits: policy files and
-.gitignore, Makefile targets fmt-check/check/docker/hooks, gofmt pass),
-then add .gitea/workflows/check.yml as a small follow-up commit so CI
-runs make check on main.
+`next` waits for sneak to merge it to `main` through
+https://git.eeqj.de/sneak/routewatch/pulls/6. After that, setting
+routewatch up under upaas on fsn1app1 and deploying it are his
+(https://git.eeqj.de/sneak/routewatch/issues/31), and so is the run under a
+real 5 GiB limit (https://git.eeqj.de/sneak/routewatch/issues/3).
 
 # Completed Steps
 
+- 2026-10-14: the shared files are re-vendored from `sneak/prompts` at
+  `dd4027b`: golangci-lint v2.14.0 and its configuration, lint and test as
+  separate uncached Dockerfile phases, agent guidance in `AGENTS.md`; the code
+  is fixed for what the new linter configuration finds (closes #52)
+- 2026-10-03: `/api/v1/stats` serves the prefix distribution from memory,
+  seeded at startup and adjusted on every live-route write, so a request no
+  longer reads every live route (closes #30)
+- 2026-10-03: a new database is created with `auto_vacuum` set to
+  incremental, through the connection string so it is set before the file
+  is first written, and each periodic incremental vacuum now returns up to
+  1000 free pages; the late `PRAGMA auto_vacuum` in `Initialize`, which
+  SQLite ignored, is gone (closes #43)
+- 2026-10-03: looking up an IP address no longer reads every IPv6 route:
+  both families find the most specific live route with at most 33 or 129
+  lookups on the prefix index, and the IPv4 range columns are gone. Prefixes
+  from the feed are stored in one text form, so an IPv6 withdrawal, which the
+  feed sends uncompressed, now removes its route (closes #48)
+- 2026-10-02: a plain `docker build .` stamps the commit's tag or short
+  commit (`git describe --tags --always`) into the page footer instead of
+  `unknown`: `.dockerignore` sends `.git` without `.git/config`, a `VERSION`
+  build argument takes precedence, and `make build` stamps the same value
+  (closes #46)
+- 2026-09-29: the entrypoint creates the data directory if it is missing and
+  stops the start if a step fails; README "Running under upaas" no longer
+  asks for the host directory to be created first (closes #42)
+- 2026-09-29: `.dockerignore` keeps `.git`, local build output, local
+  databases and `.env` out of the Docker build context, and so out of the
+  source archive in the image (closes #39)
+- 2026-09-29: README first line names the MIT license and the author;
+  the License section now says MIT and links `LICENSE`, and an Author
+  section was added; this file brought up to date (closes #38)
+- 2026-09-29: MIT `LICENSE` (closes #1)
+- 2026-09-28: stopping the daemon while the feed is flowing no longer
+  panics with "send on closed channel": the read loop checks for a stop
+  just before handing a message to the handler queues, and a second
+  `Stop` no longer closes the queues again (closes #34)
+- 2026-09-28: `docker stop` no longer kills the daemon 2 seconds after the
+  stop signal: the entrypoint switches to the `routewatch` user with
+  `setpriv` instead of `runuser`, so the daemon receives the signal itself
+  and gets the whole wait `docker stop` allows, up to its own 60-second
+  limit (closes #33)
+- 2026-09-28: ready to run under upaas: a set but invalid `PORT`,
+  `XDG_DATA_HOME` or `MALLOC_ARENA_MAX` stops the start, the health
+  check follows `PORT`, README "Running under upaas" section (closes
+  #31)
+- 2026-09-22: realtime in-memory database statistics: counts seeded at
+  startup and adjusted on every write, oldest/newest route timestamps via
+  index-end lookups; `/api/v1/stats` no longer scans the tables (closes
+  #27)
+- 2026-09-21: batch writes take the write lock when their transaction
+  begins (`_txlock=immediate`), so they wait out a WAL checkpoint instead
+  of failing with "database is locked" (closes #25)
+- 2026-09-21: `MALLOC_ARENA_MAX=2` in the image caps glibc malloc arenas,
+  so memory outside the Go runtime no longer grows with the core count
+  (closes #23)
+- 2026-09-21: `GOMEMLIMIT=1536MiB` in the image; README Memory section
+  with the memory budget and the 5 GiB container limit (closes #13)
+- 2026-09-21: the four handler queues hold at most 20,000 messages each,
+  down from 100,000 (closes #11)
+- 2026-09-21: two goroutine leaks fixed: the stats handlers after a
+  timeout and the streamer's tickers on every reconnect (closes #12)
+- 2026-09-21: parsed RIS messages no longer keep the unused `Community`
+  and `Raw` fields (closes #9)
+- 2026-09-21: `.editorconfig`, and a Gitea workflow that runs
+  `script/cibuild` on every push (closes #14)
+- 2026-09-21: the peering handler's AS-path map holds at most 500,000
+  paths and is swapped for an empty one every 30 seconds instead of copied
+  (closes #10)
+- 2026-09-21: SQLite memory bounded across the whole connection pool: a
+  64 MiB page cache on each connection, 1 GiB soft and 1.5 GiB hard heap
+  limits (closes #8)
+- 2026-09-21: the Docker build runs the format check, the linter and the
+  tests, linting in a separate stage on a golangci-lint image pinned by
+  digest (closes #5)
+- 2026-09-21: `make test` skips the live-network feed test (`-short`), so
+  `make check` no longer depends on the network (closes #2)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-22: repo policy compliance: required policy files, .gitignore
@@ -41,8 +122,6 @@ runs make check on main.
 
 # Future Steps
 
-- Verify main is green after the merge: make check locally and the new
-  CI workflow passing
-- Review stale remote branches fix-min-time-calculation and
-  optimize-sqlite-settings: land or delete
-- Clean up the tmp/ directory at the repo root: gitignore or remove
+- Production memory under 5 GiB: whether to test under a real 5 GiB
+  container limit on fsn1app1 is open for sneak
+  (https://git.eeqj.de/sneak/routewatch/issues/3)

cmd/asinfo-gen/main.go

@@ -2,8 +2,10 @@
 package main
 
 import (
+	"context"
 	"encoding/csv"
 	"encoding/json"
+	"errors"
 	"io"
 	"log"
 	"net/http"
@@ -27,13 +29,17 @@ func main() {
 
 	// Fetch the CSV data
 	log.Println("Fetching AS CSV data...")
-	resp, err := http.Get(asCsvURL)
+
+	req, err := http.NewRequestWithContext(
+		context.Background(), http.MethodGet, asCsvURL, nil)
+	if err != nil {
+		log.Fatalf("Failed to fetch CSV: %v", err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		log.Fatalf("Failed to fetch CSV: %v", err)
 	}
-	defer func() {
-		_ = resp.Body.Close()
-	}()
 
 	if resp.StatusCode != http.StatusOK {
 		log.Fatalf("Failed to fetch CSV: HTTP %d", resp.StatusCode)
@@ -48,17 +54,20 @@ func main() {
 		log.Fatalf("Failed to read CSV header: %v", err)
 	}
 
-	if len(header) != 3 || header[0] != "asn" || header[1] != "handle" || header[2] != "description" {
+	if len(header) != 3 || header[0] != "asn" || header[1] != "handle" ||
+		header[2] != "description" {
 		log.Fatalf("Unexpected CSV header: %v", header)
 	}
 
 	// Read all records
 	var asInfos []ASInfo
+
 	for {
 		record, err := reader.Read()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
+
 		if err != nil {
 			log.Printf("Error reading CSV record: %v", err)
 
@@ -86,12 +95,18 @@ func main() {
 		})
 	}
 
+	// Closed here rather than deferred: log.Fatalf exits without running
+	// deferred calls.
+	_ = resp.Body.Close()
+
 	log.Printf("Parsed %d AS records", len(asInfos))
 
 	// Convert to JSON and output to stdout
 	encoder := json.NewEncoder(os.Stdout)
 	encoder.SetIndent("", "\t")
-	if err := encoder.Encode(asInfos); err != nil {
+
+	err = encoder.Encode(asInfos)
+	if err != nil {
 		log.Fatalf("Failed to encode JSON: %v", err)
 	}
 }

cmd/streamdumper/main.go

@@ -26,9 +26,17 @@ func main() {
 
 	// Register raw message handler that prints to stdout
 	s.RegisterRawHandler(func(line string) {
-		fmt.Println(line)
+		_, _ = fmt.Fprintln(os.Stdout, line)
 	})
 
+	// Start streaming before any defer: log.Fatal exits without running
+	// deferred calls.
+	err := s.Start(context.Background())
+	if err != nil {
+		log.Fatal("Failed to start streamer:", err)
+	}
+	defer s.Stop()
+
 	// Set up context with cancellation
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -36,18 +44,13 @@ func main() {
 	// Handle signals
 	sigChan := make(chan os.Signal, 1)
 	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
+
 	go func() {
 		<-sigChan
 		log.Println("Received shutdown signal")
 		cancel()
 	}()
 
-	// Start streaming
-	if err := s.Start(); err != nil {
-		log.Fatal("Failed to start streamer:", err)
-	}
-	defer s.Stop()
-
 	// Wait for context cancellation
 	<-ctx.Done()
 }

entrypoint.sh

@@ -1,7 +1,20 @@
 #!/bin/bash
+set -euo pipefail
 
+# glibc silently ignores a malformed MALLOC_ARENA_MAX, so refuse it here.
+if [[ -n "${MALLOC_ARENA_MAX:-}" && ! "$MALLOC_ARENA_MAX" =~ ^[1-9][0-9]*$ ]]; then
+    echo "MALLOC_ARENA_MAX must be a positive whole number, got '$MALLOC_ARENA_MAX'" >&2
+    exit 1
+fi
+
+# Give the data directory to the routewatch user before the daemon starts,
+# whether it is missing, an empty root-owned mount, or holds another uid's files.
+mkdir -p /var/lib/berlin.sneak.app.routewatch
 cd /var/lib/berlin.sneak.app.routewatch
 chown -R routewatch:routewatch .
 chmod 700 .
 
-exec runuser -u routewatch -- /app/routewatch
+# setpriv replaces itself with the daemon, so the daemon receives the stop
+# signal directly. runuser would stay in between and kill the daemon 2 seconds
+# after passing the signal on.
+exec setpriv --reuid=routewatch --regid=routewatch --init-groups -- /app/routewatch

internal/config/config.go

@@ -2,10 +2,12 @@
 package config
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"time"
 )
 
@@ -18,6 +20,18 @@ const (
 
 	// defaultRouteExpirationMinutes is the default route expiration timeout in minutes
 	defaultRouteExpirationMinutes = 5
+
+	// defaultPort is the HTTP port used when PORT is not set
+	defaultPort = 8080
+
+	// maxPort is the highest TCP port number
+	maxPort = 65535
+)
+
+var (
+	errRelativeXDGDataHome = errors.New("XDG_DATA_HOME must be an absolute path")
+	errUnsupportedOS       = errors.New("unsupported operating system")
+	errInvalidPort         = errors.New("PORT must be a whole number")
 )
 
 // Config holds configuration for the entire application
@@ -25,14 +39,20 @@ type Config struct {
 	// StateDir is the directory for all application state (database, snapshots)
 	StateDir string
 
+	// Port is the TCP port the HTTP server listens on
+	Port int
+
 	// MaxRuntime is the maximum runtime (0 = run forever)
 	MaxRuntime time.Duration
 
-	// EnableBatchedDatabaseWrites enables batched database operations for better performance
+	// EnableBatchedDatabaseWrites enables batched database operations for
+	// better performance
 	EnableBatchedDatabaseWrites bool
 
-	// RouteExpirationTimeout is how long a route can go without being refreshed before expiring
-	// Default is 2 hours which is conservative for BGP (typical BGP hold time is 90-180 seconds)
+	// RouteExpirationTimeout is how long a route can go without being
+	// refreshed before expiring
+	// Default is 2 hours which is conservative for BGP (typical BGP hold
+	// time is 90-180 seconds)
 	RouteExpirationTimeout time.Duration
 }
 
@@ -43,11 +63,20 @@ func New() (*Config, error) {
 		return nil, fmt.Errorf("failed to determine state directory: %w", err)
 	}
 
+	port, err := getPort()
+	if err != nil {
+		return nil, err
+	}
+
 	return &Config{
-		StateDir:                    stateDir,
-		MaxRuntime:                  0,                                           // Run forever by default
-		EnableBatchedDatabaseWrites: true,                                        // Enable batching by default
-		RouteExpirationTimeout:      defaultRouteExpirationMinutes * time.Minute, // For active route monitoring
+		StateDir: stateDir,
+		Port:     port,
+		// Run forever by default
+		MaxRuntime: 0,
+		// Enable batching by default
+		EnableBatchedDatabaseWrites: true,
+		// For active route monitoring
+		RouteExpirationTimeout: defaultRouteExpirationMinutes * time.Minute,
 	}, nil
 }
 
@@ -69,13 +98,20 @@ func getStateDirectory() (string, error) {
 		return filepath.Join(home, "Library", "Application Support", AppIdentifier), nil
 
 	case "linux", "freebsd", "openbsd", "netbsd":
+		// The XDG spec requires an absolute path; a relative one would put
+		// the database somewhere unexpected.
+		xdgData := os.Getenv("XDG_DATA_HOME")
+		if xdgData != "" && !filepath.IsAbs(xdgData) {
+			return "", fmt.Errorf("%w, got %q", errRelativeXDGDataHome, xdgData)
+		}
+
 		// Unix-like: /var/lib/berlin.sneak.app.routewatch if root, else XDG_DATA_HOME
 		if os.Geteuid() == 0 {
 			return filepath.Join("/var/lib", AppIdentifier), nil
 		}
 
 		// Check XDG_DATA_HOME first
-		if xdgData := os.Getenv("XDG_DATA_HOME"); xdgData != "" {
+		if xdgData != "" {
 			return filepath.Join(xdgData, AppIdentifier), nil
 		}
 
@@ -88,14 +124,32 @@ func getStateDirectory() (string, error) {
 		return filepath.Join(home, ".local", "share", AppIdentifier), nil
 
 	default:
-		return "", fmt.Errorf("unsupported operating system: %s", runtime.GOOS)
+		return "", fmt.Errorf("%w: %s", errUnsupportedOS, runtime.GOOS)
 	}
 }
 
+// getPort returns the HTTP port from PORT, or defaultPort when PORT is not set
+func getPort() (int, error) {
+	value := os.Getenv("PORT")
+	if value == "" {
+		return defaultPort, nil
+	}
+
+	// ParseUint, unlike Atoi, refuses a sign: the health check URL cannot use "+9090"
+	port, err := strconv.ParseUint(value, 10, 0)
+	if err != nil || port < 1 || port > maxPort {
+		return 0, fmt.Errorf("%w from 1 to %d, got %q",
+			errInvalidPort, maxPort, value)
+	}
+
+	return int(port), nil
+}
+
 // EnsureDirectories creates all necessary directories if they don't exist
 func (c *Config) EnsureDirectories() error {
 	// Ensure state directory exists
-	if err := os.MkdirAll(c.StateDir, dirPermissions); err != nil {
+	err := os.MkdirAll(c.StateDir, dirPermissions)
+	if err != nil {
 		return fmt.Errorf("failed to create state directory: %w", err)
 	}
 

internal/config/config_internal_test.go

@@ -0,0 +1,67 @@
+package config
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestNewReadsPort(t *testing.T) {
+	tests := map[string]int{
+		"":      defaultPort,
+		"1":     1,
+		"9090":  9090,
+		"65535": 65535,
+	}
+
+	for value, want := range tests {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PORT", value)
+			t.Setenv("XDG_DATA_HOME", "")
+
+			cfg, err := New()
+			if err != nil {
+				t.Fatalf("New() with PORT=%q: %v", value, err)
+			}
+
+			if cfg.Port != want {
+				t.Errorf("New() with PORT=%q: Port = %d, want %d", value, cfg.Port, want)
+			}
+		})
+	}
+}
+
+func TestNewRefusesInvalidPort(t *testing.T) {
+	for _, value := range []string{"0", "65536", "-1", "+9090", "http", "80.5"} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PORT", value)
+			t.Setenv("XDG_DATA_HOME", "")
+
+			_, err := New()
+			if err == nil {
+				t.Errorf("New() with PORT=%q returned no error", value)
+			}
+		})
+	}
+}
+
+func TestNewRefusesRelativeXDGDataHome(t *testing.T) {
+	if runtime.GOOS == "darwin" {
+		t.Skip("macOS does not read XDG_DATA_HOME")
+	}
+
+	t.Setenv("PORT", "")
+
+	t.Setenv("XDG_DATA_HOME", "relative/path")
+
+	_, err := New()
+	if err == nil {
+		t.Error("New() with a relative XDG_DATA_HOME returned no error")
+	}
+
+	t.Setenv("XDG_DATA_HOME", "/var/lib")
+
+	_, err = New()
+	if err != nil {
+		t.Errorf("New() with XDG_DATA_HOME=/var/lib: %v", err)
+	}
+}

internal/database/counts.go

@@ -0,0 +1,218 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// liveCounts holds the running row counts and the prefix distribution that the
+// stats endpoints report. They are seeded once at startup from the tables and
+// then adjusted on every write, so a stats read serves them from memory instead
+// of running a query over the tables. The COUNT(*) scans (issue 27) and then
+// the prefix distribution query (issue 30) each grew with the database until
+// they took the whole request timeout and made /api/v1/stats return 500.
+//
+// A single mutex guards all fields so the stats reader takes a consistent
+// snapshot at one instant and writers, which already run under the database
+// write lock, adjust the counts after their transaction commits.
+type liveCounts struct {
+	mu         sync.RWMutex
+	asns       int
+	prefixesV4 int
+	prefixesV6 int
+	peerings   int
+	peers      int
+	routesV4   int
+	routesV6   int
+	// The prefix distribution: for each mask length, the number of distinct
+	// prefixes that have at least one live route.
+	distributionV4 [ipv4Bits + 1]int
+	distributionV6 [ipv6Bits + 1]int
+}
+
+// seed sets every count to the value read from the tables at startup. It runs
+// before any writer, so it needs no coordination with the adjust methods.
+func (c *liveCounts) seed(
+	asns, prefixesV4, prefixesV6, peerings, peers, routesV4, routesV6 int,
+	distributionV4, distributionV6 []PrefixDistribution,
+) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.asns = asns
+	c.prefixesV4 = prefixesV4
+	c.prefixesV6 = prefixesV6
+	c.peerings = peerings
+	c.peers = peers
+	c.routesV4 = routesV4
+	c.routesV6 = routesV6
+
+	for _, entry := range distributionV4 {
+		addAtMaskLength(c.distributionV4[:], entry.MaskLength, entry.Count)
+	}
+
+	for _, entry := range distributionV6 {
+		addAtMaskLength(c.distributionV6[:], entry.MaskLength, entry.Count)
+	}
+}
+
+// addASNs adds n to the ASN count.
+func (c *liveCounts) addASNs(n int) {
+	c.mu.Lock()
+	c.asns += n
+	c.mu.Unlock()
+}
+
+// addPrefixes adds to the IPv4 and IPv6 prefix counts.
+func (c *liveCounts) addPrefixes(v4, v6 int) {
+	c.mu.Lock()
+	c.prefixesV4 += v4
+	c.prefixesV6 += v6
+	c.mu.Unlock()
+}
+
+// addPeerings adds n to the peering count.
+func (c *liveCounts) addPeerings(n int) {
+	c.mu.Lock()
+	c.peerings += n
+	c.mu.Unlock()
+}
+
+// addPeers adds n to the BGP peer count.
+func (c *liveCounts) addPeers(n int) {
+	c.mu.Lock()
+	c.peers += n
+	c.mu.Unlock()
+}
+
+// addRoutes adds to the IPv4 and IPv6 live-route counts. Deletions pass
+// negative values.
+func (c *liveCounts) addRoutes(v4, v6 int) {
+	c.mu.Lock()
+	c.routesV4 += v4
+	c.routesV6 += v6
+	c.mu.Unlock()
+}
+
+// addToDistribution adds n to the IPv4 and IPv6 prefix distributions once for
+// each listed mask length. A write lists the mask lengths of the prefixes it
+// gave their first live route with n = 1, and of the prefixes it left with no
+// live route with n = -1.
+func (c *liveCounts) addToDistribution(maskLengthsV4, maskLengthsV6 []int, n int) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for _, maskLength := range maskLengthsV4 {
+		addAtMaskLength(c.distributionV4[:], maskLength, n)
+	}
+
+	for _, maskLength := range maskLengthsV6 {
+		addAtMaskLength(c.distributionV6[:], maskLength, n)
+	}
+}
+
+// addAtMaskLength adds n to counts[maskLength]. A mask length the array has no
+// entry for is ignored, so a malformed route cannot crash the daemon.
+func addAtMaskLength(counts []int, maskLength, n int) {
+	if maskLength >= 0 && maskLength < len(counts) {
+		counts[maskLength] += n
+	}
+}
+
+// fill copies the counts into a Stats, including the derived totals, under a
+// single read lock so the reader sees one consistent snapshot.
+func (c *liveCounts) fill(s *Stats) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	s.ASNs = c.asns
+	s.IPv4Prefixes = c.prefixesV4
+	s.IPv6Prefixes = c.prefixesV6
+	s.Prefixes = c.prefixesV4 + c.prefixesV6
+	s.Peerings = c.peerings
+	s.Peers = c.peers
+	s.IPv4Routes = c.routesV4
+	s.IPv6Routes = c.routesV6
+	s.LiveRoutes = c.routesV4 + c.routesV6
+	s.IPv4PrefixDistribution = distributionList(c.distributionV4[:])
+	s.IPv6PrefixDistribution = distributionList(c.distributionV6[:])
+}
+
+// distributionList lists the mask lengths that have at least one prefix, in
+// ascending order, the way the distribution query returns them.
+func distributionList(counts []int) []PrefixDistribution {
+	var list []PrefixDistribution
+
+	for maskLength, count := range counts {
+		if count > 0 {
+			list = append(list,
+				PrefixDistribution{MaskLength: maskLength, Count: count})
+		}
+	}
+
+	return list
+}
+
+// countRows returns the number of rows in the named table. It is used only at
+// startup to seed the in-memory counters, so a full COUNT(*) is acceptable.
+func (d *Database) countRows(ctx context.Context, table string) (int, error) {
+	var n int
+	// table is one of a fixed set of literals below, never external input.
+	err := d.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM "+table).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("failed to count %s: %w", table, err)
+	}
+
+	return n, nil
+}
+
+// seedCounts reads the current row counts and prefix distribution from the
+// tables into the in-memory counters. It runs once at startup, before the
+// streamer begins writing.
+func (d *Database) seedCounts(ctx context.Context) error {
+	asns, err := d.countRows(ctx, "asns")
+	if err != nil {
+		return err
+	}
+
+	prefixesV4, err := d.countRows(ctx, "prefixes_v4")
+	if err != nil {
+		return err
+	}
+
+	prefixesV6, err := d.countRows(ctx, "prefixes_v6")
+	if err != nil {
+		return err
+	}
+
+	peerings, err := d.countRows(ctx, "peerings")
+	if err != nil {
+		return err
+	}
+
+	peers, err := d.countRows(ctx, "bgp_peers")
+	if err != nil {
+		return err
+	}
+
+	routesV4, err := d.countRows(ctx, tableLiveRoutesV4)
+	if err != nil {
+		return err
+	}
+
+	routesV6, err := d.countRows(ctx, tableLiveRoutesV6)
+	if err != nil {
+		return err
+	}
+
+	distributionV4, distributionV6, err := d.GetPrefixDistributionContext(ctx)
+	if err != nil {
+		return err
+	}
+
+	d.counts.seed(asns, prefixesV4, prefixesV6, peerings, peers, routesV4, routesV6,
+		distributionV4, distributionV6)
+
+	return nil
+}

internal/database/counts_internal_test.go

@@ -0,0 +1,614 @@
+package database
+
+import (
+	"context"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"github.com/google/uuid"
+)
+
+// testV4PeerIP is the peer the IPv4 routes in these tests are learned from.
+const testV4PeerIP = "192.0.2.1"
+
+// testV6Prefix is the prefix of every IPv6 route in these tests.
+const testV6Prefix = "2001:db8::/32"
+
+// mkV4Route builds an IPv4 live route with its mask length taken from the
+// prefix.
+func mkV4Route(t *testing.T, prefix string, asn int, ts time.Time) *LiveRoute {
+	t.Helper()
+
+	maskLength, err := prefixMaskLength(prefix)
+	if err != nil {
+		t.Fatalf("prefixMaskLength(%s): %v", prefix, err)
+	}
+
+	return &LiveRoute{
+		ID:          uuid.New(),
+		Prefix:      prefix,
+		MaskLength:  maskLength,
+		IPVersion:   ipVersionV4,
+		OriginASN:   asn,
+		PeerIP:      testV4PeerIP,
+		ASPath:      []int{asn},
+		NextHop:     "192.0.2.254",
+		LastUpdated: ts,
+	}
+}
+
+// mkV6Route builds an IPv6 live route for testV6Prefix.
+func mkV6Route(asn int, ts time.Time) *LiveRoute {
+	return &LiveRoute{
+		ID:          uuid.New(),
+		Prefix:      testV6Prefix,
+		MaskLength:  32,
+		IPVersion:   ipVersionV6,
+		OriginASN:   asn,
+		PeerIP:      "2001:db8::1",
+		ASPath:      []int{asn},
+		NextHop:     "2001:db8::ffff",
+		LastUpdated: ts,
+	}
+}
+
+// TestLiveCountsTrackWritesInRealtime checks that the stats counts start at
+// zero, reflect each write the moment it commits (no recompute, no timer), do
+// not move when a route is merely re-announced, and drop when a route is
+// deleted. These counts are what /api/v1/stats reports; before this change the
+// endpoint recomputed them with a COUNT(*) over each table on every request.
+func TestLiveCountsTrackWritesInRealtime(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	empty, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext on empty database: %v", err)
+	}
+
+	if empty.ASNs != 0 || empty.Prefixes != 0 || empty.Peerings != 0 ||
+		empty.Peers != 0 || empty.LiveRoutes != 0 {
+		t.Fatalf("empty database counts nonzero: %+v", empty)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	writeASNsPrefixesAndPeers(t, db, ts)
+
+	routes := []*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, ts),
+		mkV4Route(t, "203.0.113.0/24", 64501, ts.Add(time.Minute)),
+		mkV6Route(64502, ts.Add(2*time.Minute)),
+	}
+
+	err = db.UpsertLiveRouteBatch(routes)
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+
+	assertCounts(t, "after inserts", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 2, ipv6Routes: 1, liveRoutes: 3,
+	})
+
+	// Re-announcing the same routes is an update, not an insert: counts hold.
+	err = db.UpsertLiveRouteBatch(routes)
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch (re-announce): %v", err)
+	}
+
+	stats, err = db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+
+	assertCounts(t, "after re-announce", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 2, ipv6Routes: 1, liveRoutes: 3,
+	})
+
+	// A withdrawal removes one route.
+	err = db.DeleteLiveRouteBatch([]LiveRouteDeletion{{
+		Prefix: "203.0.113.0/24", OriginASN: 64501,
+		PeerIP: testV4PeerIP, IPVersion: ipVersionV4,
+	}})
+	if err != nil {
+		t.Fatalf("DeleteLiveRouteBatch: %v", err)
+	}
+
+	stats, err = db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+
+	assertCounts(t, "after delete", stats, wantCounts{
+		asns: 2, prefixes: 2, peerings: 1, peers: 1,
+		ipv4Routes: 1, ipv6Routes: 1, liveRoutes: 2,
+	})
+}
+
+// writeASNsPrefixesAndPeers writes two ASNs, two prefixes, one peer and one
+// peering: the rows besides live routes that the stats count.
+func writeASNsPrefixesAndPeers(t *testing.T, db *Database, ts time.Time) {
+	t.Helper()
+
+	err := db.GetOrCreateASNBatch(map[int]time.Time{64500: ts, 64501: ts})
+	if err != nil {
+		t.Fatalf("GetOrCreateASNBatch: %v", err)
+	}
+
+	err = db.UpdatePrefixesBatch(map[string]time.Time{
+		"198.51.100.0/24": ts,
+		testV6Prefix:      ts,
+	})
+	if err != nil {
+		t.Fatalf("UpdatePrefixesBatch: %v", err)
+	}
+
+	err = db.UpdatePeerBatch(map[string]PeerUpdate{
+		testV4PeerIP: {
+			PeerIP: testV4PeerIP, PeerASN: 64500,
+			MessageType: "UPDATE", Timestamp: ts,
+		},
+	})
+	if err != nil {
+		t.Fatalf("UpdatePeerBatch: %v", err)
+	}
+
+	err = db.RecordPeering(64500, 64501, ts)
+	if err != nil {
+		t.Fatalf("RecordPeering: %v", err)
+	}
+}
+
+// TestLiveCountsSeededFromDatabaseAtStartup writes rows, reopens the same
+// database file, and checks the counts and the prefix distribution come back
+// from the seed scan rather than starting at zero.
+func TestLiveCountsSeededFromDatabaseAtStartup(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	err = db.GetOrCreateASNBatch(map[int]time.Time{64500: ts, 64501: ts, 64502: ts})
+	if err != nil {
+		t.Fatalf("GetOrCreateASNBatch: %v", err)
+	}
+
+	err = db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, ts),
+		mkV6Route(64502, ts),
+	})
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	err = db.Close()
+	if err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	reopened, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to reopen database: %v", err)
+	}
+	defer func() { _ = reopened.Close() }()
+
+	stats, err := reopened.GetStatsContext(context.Background())
+	if err != nil {
+		t.Fatalf("GetStatsContext after reopen: %v", err)
+	}
+
+	if stats.ASNs != 3 {
+		t.Errorf("seeded ASNs = %d, want 3", stats.ASNs)
+	}
+
+	if stats.IPv4Routes != 1 || stats.IPv6Routes != 1 || stats.LiveRoutes != 2 {
+		t.Errorf("seeded routes = (v4 %d, v6 %d, total %d), want (1, 1, 2)",
+			stats.IPv4Routes, stats.IPv6Routes, stats.LiveRoutes)
+	}
+
+	assertDistribution(t, "seeded IPv4 distribution", stats.IPv4PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 24, Count: 1}})
+	assertDistribution(t, "seeded IPv6 distribution", stats.IPv6PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 32, Count: 1}})
+}
+
+// TestPrefixDistributionTracksWrites checks that the prefix distribution the
+// stats read reports stays exact across each kind of live-route write, and that
+// after every step it equals what the distribution query reads from the route
+// tables. The steps run once through the batch methods the prefix handler uses
+// and once through the single-route methods.
+func TestPrefixDistributionTracksWrites(t *testing.T) {
+	t.Parallel()
+
+	steps := prefixDistributionSteps(t)
+
+	for _, batch := range []bool{true, false} {
+		name := "single-route writes"
+		if batch {
+			name = "batch writes"
+		}
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			db, err := New(&config.Config{StateDir: t.TempDir()}, logger.New())
+			if err != nil {
+				t.Fatalf("failed to create database: %v", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			ctx := context.Background()
+
+			for _, step := range steps {
+				err := announceRoutes(db, batch, step.announce)
+				if err != nil {
+					t.Fatalf("%s: announce: %v", step.name, err)
+				}
+
+				err = withdrawRoutes(db, batch, step.withdraw)
+				if err != nil {
+					t.Fatalf("%s: withdraw: %v", step.name, err)
+				}
+
+				stats, err := db.GetStatsContext(ctx)
+				if err != nil {
+					t.Fatalf("%s: GetStatsContext: %v", step.name, err)
+				}
+
+				queryV4, queryV6, err := db.GetPrefixDistributionContext(ctx)
+				if err != nil {
+					t.Fatalf("%s: GetPrefixDistributionContext: %v", step.name, err)
+				}
+
+				assertDistribution(t, step.name+": IPv4 distribution",
+					stats.IPv4PrefixDistribution, step.wantV4)
+				assertDistribution(t, step.name+": IPv6 distribution",
+					stats.IPv6PrefixDistribution, step.wantV6)
+				assertDistribution(t, step.name+": IPv4 distribution query",
+					queryV4, step.wantV4)
+				assertDistribution(t, step.name+": IPv6 distribution query",
+					queryV6, step.wantV6)
+			}
+		})
+	}
+}
+
+// prefixDistributionStep is one step of TestPrefixDistributionTracksWrites:
+// the routes it announces, then the routes it withdraws, then the
+// distributions both the stats and the distribution query must report.
+type prefixDistributionStep struct {
+	name     string
+	announce []*LiveRoute
+	withdraw []*LiveRoute
+	wantV4   []PrefixDistribution
+	wantV6   []PrefixDistribution
+}
+
+// prefixDistributionSteps returns the steps of
+// TestPrefixDistributionTracksWrites, in the order they run.
+func prefixDistributionSteps(t *testing.T) []prefixDistributionStep {
+	t.Helper()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	shared := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	sharedSecondPeer := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	sharedSecondPeer.PeerIP = "192.0.2.2"
+	other := mkV4Route(t, "203.0.113.0/24", 64501, ts)
+	wide := mkV4Route(t, "172.16.0.0/16", 64502, ts)
+	v6 := mkV6Route(64503, ts)
+	v6SecondPeer := mkV6Route(64503, ts)
+	v6SecondPeer.PeerIP = "2001:db8::2"
+
+	all := []PrefixDistribution{{MaskLength: 16, Count: 1}, {MaskLength: 24, Count: 2}}
+	v6Only := []PrefixDistribution{{MaskLength: 32, Count: 1}}
+
+	return []prefixDistributionStep{
+		{
+			name:     "new routes",
+			announce: []*LiveRoute{shared, other, wide, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "re-announcement",
+			announce: []*LiveRoute{shared, other, wide, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "second peer announces a prefix that has a live route",
+			announce: []*LiveRoute{sharedSecondPeer, v6SecondPeer},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "withdrawal of a route that is not the last for its prefix",
+			withdraw: []*LiveRoute{shared, v6},
+			wantV4:   all, wantV6: v6Only,
+		},
+		{
+			name:     "withdrawal of the last route for a prefix",
+			withdraw: []*LiveRoute{sharedSecondPeer, v6SecondPeer},
+			wantV4: []PrefixDistribution{
+				{MaskLength: 16, Count: 1}, {MaskLength: 24, Count: 1},
+			},
+		},
+		{
+			name:     "withdrawal of every remaining route",
+			withdraw: []*LiveRoute{other, wide},
+		},
+		{
+			name:     "two peers announce a new prefix together",
+			announce: []*LiveRoute{shared, sharedSecondPeer, v6, v6SecondPeer},
+			wantV4:   []PrefixDistribution{{MaskLength: 24, Count: 1}},
+			wantV6:   v6Only,
+		},
+		{
+			name:     "both routes for a prefix withdrawn together",
+			withdraw: []*LiveRoute{shared, sharedSecondPeer, v6, v6SecondPeer},
+		},
+		// The feed often withdraws a route that is not live. That must not take
+		// the prefix out of the distribution. A count wrongly taken below zero is
+		// left out of the answer, so the next step shows it: its announcement
+		// at the same mask length would then not be counted.
+		{
+			name:     "withdrawal of routes that are not live",
+			withdraw: []*LiveRoute{other, v6},
+		},
+		{
+			name:     "announcement after a withdrawal of routes that are not live",
+			announce: []*LiveRoute{other, v6},
+			wantV4:   []PrefixDistribution{{MaskLength: 24, Count: 1}},
+			wantV6:   v6Only,
+		},
+	}
+}
+
+// announceRoutes writes routes in one UpsertLiveRouteBatch, or with one
+// UpsertLiveRoute each.
+func announceRoutes(db *Database, batch bool, routes []*LiveRoute) error {
+	if batch {
+		return db.UpsertLiveRouteBatch(routes)
+	}
+
+	for _, route := range routes {
+		err := db.UpsertLiveRoute(route)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// withdrawRoutes removes routes in one DeleteLiveRouteBatch, or with one
+// DeleteLiveRoute each. It names each route by prefix and peer only, with no
+// origin ASN, as a withdrawal from the feed does when its message carries no AS
+// path.
+func withdrawRoutes(db *Database, batch bool, routes []*LiveRoute) error {
+	if !batch {
+		for _, route := range routes {
+			err := db.DeleteLiveRoute(route.Prefix, 0, route.PeerIP)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+
+	deletions := make([]LiveRouteDeletion, 0, len(routes))
+	for _, route := range routes {
+		deletions = append(deletions, LiveRouteDeletion{
+			Prefix: route.Prefix, PeerIP: route.PeerIP, IPVersion: route.IPVersion,
+		})
+	}
+
+	return db.DeleteLiveRouteBatch(deletions)
+}
+
+// TestStatsRouteTimestamps checks the oldest/newest route timestamps are read
+// from the right rows across both tables and parse into time.Time. The old
+// MIN/MAX union query read its result into *time.Time, which the driver could
+// not parse, so it logged a warning every call and left both timestamps nil.
+func TestStatsRouteTimestamps(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	empty, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext on empty database: %v", err)
+	}
+
+	if empty.OldestRoute != nil || empty.NewestRoute != nil {
+		t.Fatalf("empty database timestamps = (%v, %v), want (nil, nil)",
+			empty.OldestRoute, empty.NewestRoute)
+	}
+
+	base := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	oldest := base
+	newest := base.Add(2 * time.Minute)
+
+	err = db.UpsertLiveRouteBatch([]*LiveRoute{
+		mkV4Route(t, "198.51.100.0/24", 64500, base.Add(time.Minute)),
+		mkV4Route(t, "203.0.113.0/24", 64501, oldest),
+		mkV6Route(64502, newest),
+	})
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+
+	if stats.OldestRoute == nil || !stats.OldestRoute.Equal(oldest) {
+		t.Errorf("OldestRoute = %v, want %v", stats.OldestRoute, oldest)
+	}
+
+	if stats.NewestRoute == nil || !stats.NewestRoute.Equal(newest) {
+		t.Errorf("NewestRoute = %v, want %v", stats.NewestRoute, newest)
+	}
+}
+
+// TestLiveCountsConcurrentReadWrite runs writers and stats readers at once so
+// the race detector proves the counters are safe under concurrent use.
+func TestLiveCountsConcurrentReadWrite(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	const writers = 4
+
+	var wg sync.WaitGroup
+	wg.Add(writers)
+
+	for w := range writers {
+		go func(base int) {
+			defer wg.Done()
+
+			for i := range 25 {
+				asn := 65000 + base*100 + i
+				route := mkV6Route(asn, ts)
+				route.PeerIP = "2001:db8::" + uuid.NewString()
+
+				err := db.UpsertLiveRoute(route)
+				if err != nil {
+					t.Errorf("UpsertLiveRoute: %v", err)
+
+					return
+				}
+			}
+		}(w)
+	}
+
+	var readerWG sync.WaitGroup
+	readerWG.Add(1)
+
+	stop := make(chan struct{})
+
+	go func() {
+		defer readerWG.Done()
+
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+				_, err := db.GetStatsContext(context.Background())
+				if err != nil {
+					t.Errorf("GetStatsContext: %v", err)
+
+					return
+				}
+			}
+		}
+	}()
+
+	wg.Wait()
+	close(stop)
+	readerWG.Wait()
+
+	stats, err := db.GetStatsContext(context.Background())
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+
+	if want := writers * 25; stats.IPv6Routes != want {
+		t.Errorf("IPv6Routes = %d, want %d", stats.IPv6Routes, want)
+	}
+	// Every writer announced the same prefix, so it counts once.
+	assertDistribution(t, "IPv6 distribution", stats.IPv6PrefixDistribution,
+		[]PrefixDistribution{{MaskLength: 32, Count: 1}})
+}
+
+type wantCounts struct {
+	asns       int
+	prefixes   int
+	peerings   int
+	peers      int
+	ipv4Routes int
+	ipv6Routes int
+	liveRoutes int
+}
+
+func assertCounts(t *testing.T, when string, got Stats, want wantCounts) {
+	t.Helper()
+
+	if got.ASNs != want.asns {
+		t.Errorf("%s: ASNs = %d, want %d", when, got.ASNs, want.asns)
+	}
+
+	if got.Prefixes != want.prefixes {
+		t.Errorf("%s: Prefixes = %d, want %d", when, got.Prefixes, want.prefixes)
+	}
+
+	if got.Peerings != want.peerings {
+		t.Errorf("%s: Peerings = %d, want %d", when, got.Peerings, want.peerings)
+	}
+
+	if got.Peers != want.peers {
+		t.Errorf("%s: Peers = %d, want %d", when, got.Peers, want.peers)
+	}
+
+	if got.IPv4Routes != want.ipv4Routes {
+		t.Errorf("%s: IPv4Routes = %d, want %d", when, got.IPv4Routes, want.ipv4Routes)
+	}
+
+	if got.IPv6Routes != want.ipv6Routes {
+		t.Errorf("%s: IPv6Routes = %d, want %d", when, got.IPv6Routes, want.ipv6Routes)
+	}
+
+	if got.LiveRoutes != want.liveRoutes {
+		t.Errorf("%s: LiveRoutes = %d, want %d", when, got.LiveRoutes, want.liveRoutes)
+	}
+}
+
+func assertDistribution(t *testing.T, what string, got, want []PrefixDistribution) {
+	t.Helper()
+
+	if !slices.Equal(got, want) {
+		t.Errorf("%s = %v, want %v", what, got, want)
+	}
+}

internal/database/database_internal_test.go

@@ -0,0 +1,369 @@
+package database
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"github.com/google/uuid"
+)
+
+// tempStoreMemory is the PRAGMA temp_store value meaning "hold temp B-trees in
+// memory"; the DSN change must leave temp_store below this so they spill to disk.
+const tempStoreMemory = 2
+
+// autoVacuumIncremental is the PRAGMA auto_vacuum value meaning "incremental".
+const autoVacuumIncremental = 2
+
+// vacuumTestRoutes is how many routes the vacuum test writes and then deletes,
+// enough to leave many free pages in the file.
+const vacuumTestRoutes = 2000
+
+// heldConnections is how many pooled connections the pragma test holds open at
+// once so each is a distinct SQLite connection that parsed the DSN.
+const heldConnections = 5
+
+// testPeerIP is the peer every route in the IP lookup test is learned from.
+const testPeerIP = "192.0.2.254"
+
+// Parameters for the checkpoint-contention regression test.
+const (
+	// contentionIterations is how many batch writes race the checkpoint loop.
+	contentionIterations = 400
+	// contendedASNCount is the small set of ASNs the batches reuse, so most
+	// batches update existing rows and exercise the read-before-write path.
+	contendedASNCount = 16
+	// asnSecondBand offsets a second ASN per batch so each batch writes more
+	// than one row.
+	asnSecondBand = 100
+)
+
+// TestGetIPInfoFindsMostSpecificLiveRoute stores nested live prefixes for both
+// families and checks that a lookup returns the most specific one covering the
+// address, ErrNoRoute when none covers it, and the next less specific prefix
+// once the only route of the most specific one is withdrawn.
+func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	// Nested live prefixes, each originated by its own AS.
+	origins := map[string]int{
+		"10.0.0.0/8":        64500,
+		"10.1.0.0/16":       64501,
+		"10.1.2.0/24":       64502,
+		"2001:db8::/32":     64500,
+		"2001:db8:1::/48":   64501,
+		"2001:db8:1:2::/64": 64502,
+	}
+	writeOriginRoutes(t, db, origins)
+
+	// lookup checks that ip resolves to the live prefix want, or to ErrNoRoute
+	// when want is empty.
+	lookup := func(ip, want string) {
+		t.Helper()
+
+		info, err := db.GetIPInfo(ip)
+		if want == "" {
+			if !errors.Is(err, ErrNoRoute) {
+				t.Errorf("GetIPInfo(%s) = %+v, %v; want ErrNoRoute", ip, info, err)
+			}
+
+			return
+		}
+
+		if err != nil {
+			t.Errorf("GetIPInfo(%s): %v", ip, err)
+
+			return
+		}
+
+		if info.Netblock != want || info.MaskLength != netip.MustParsePrefix(want).Bits() ||
+			info.ASN != origins[want] {
+			t.Errorf("GetIPInfo(%s) = %s (mask %d) AS%d, want %s AS%d",
+				ip, info.Netblock, info.MaskLength, info.ASN, want, origins[want])
+		}
+	}
+
+	lookup("10.1.2.3", "10.1.2.0/24")
+	lookup("::ffff:10.1.2.3", "10.1.2.0/24")
+	lookup("10.1.3.4", "10.1.0.0/16")
+	lookup("10.2.0.1", "10.0.0.0/8")
+	lookup("192.0.2.1", "")
+	lookup("2001:db8:1:2::3", "2001:db8:1:2::/64")
+	lookup("2001:db8:1:3::4", "2001:db8:1::/48")
+	lookup("2001:db8:2::1", "2001:db8::/32")
+	lookup("2001:db9::1", "")
+
+	err = db.DeleteLiveRouteBatch([]LiveRouteDeletion{
+		{
+			Prefix: "10.1.2.0/24", OriginASN: 64502,
+			PeerIP: testPeerIP, IPVersion: ipVersionV4,
+		},
+		{
+			Prefix: "2001:db8:1:2::/64", OriginASN: 64502,
+			PeerIP: testPeerIP, IPVersion: ipVersionV6,
+		},
+	})
+	if err != nil {
+		t.Fatalf("DeleteLiveRouteBatch: %v", err)
+	}
+
+	lookup("10.1.2.3", "10.1.0.0/16")
+	lookup("2001:db8:1:2::3", "2001:db8:1::/48")
+}
+
+// writeOriginRoutes writes one live route from testPeerIP for each prefix in
+// origins, originated by the AS it maps to.
+func writeOriginRoutes(t *testing.T, db *Database, origins map[string]int) {
+	t.Helper()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	routes := make([]*LiveRoute, 0, len(origins))
+
+	for prefix, asn := range origins {
+		routes = append(routes, &LiveRoute{
+			ID:          uuid.New(),
+			Prefix:      prefix,
+			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
+			IPVersion:   detectIPVersion(prefix),
+			OriginASN:   asn,
+			PeerIP:      testPeerIP,
+			ASPath:      []int{asn},
+			NextHop:     testPeerIP,
+			LastUpdated: ts,
+		})
+	}
+
+	err := db.UpsertLiveRouteBatch(routes)
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+}
+
+// TestConnectionPoolPragmas holds several pooled connections open at once and
+// checks each one carries the per-connection settings from the DSN, plus the
+// process-wide hard heap limit, and sees the new file with auto_vacuum
+// incremental.
+func TestConnectionPoolPragmas(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+
+	// Hold distinct connections open simultaneously so the pool must open a new
+	// one (each parsing the DSN) rather than hand back the same connection.
+	conns := make([]*sql.Conn, 0, heldConnections)
+	defer func() {
+		for _, c := range conns {
+			_ = c.Close()
+		}
+	}()
+
+	for i := range heldConnections {
+		c, err := db.db.Conn(ctx)
+		if err != nil {
+			t.Fatalf("failed to open connection %d: %v", i, err)
+		}
+
+		conns = append(conns, c)
+	}
+
+	for i, c := range conns {
+		cacheSize := readPragma(ctx, t, c, i, "cache_size")
+		if cacheSize != sqliteCacheSizeKiB {
+			t.Errorf("conn %d: cache_size = %d, want %d",
+				i, cacheSize, sqliteCacheSizeKiB)
+		}
+
+		busyTimeout := readPragma(ctx, t, c, i, "busy_timeout")
+		if busyTimeout != sqliteBusyTimeoutMs {
+			t.Errorf("conn %d: busy_timeout = %d, want %d",
+				i, busyTimeout, sqliteBusyTimeoutMs)
+		}
+
+		tempStore := readPragma(ctx, t, c, i, "temp_store")
+		if tempStore == tempStoreMemory {
+			t.Errorf("conn %d: temp_store = %d, want anything but %d (MEMORY)",
+				i, tempStore, tempStoreMemory)
+		}
+
+		hardHeapLimit := readPragma(ctx, t, c, i, "hard_heap_limit")
+		if hardHeapLimit != sqliteHardHeapLimitBytes {
+			t.Errorf("conn %d: hard_heap_limit = %d, want %d",
+				i, hardHeapLimit, sqliteHardHeapLimitBytes)
+		}
+
+		autoVacuum := readPragma(ctx, t, c, i, "auto_vacuum")
+		if autoVacuum != autoVacuumIncremental {
+			t.Errorf("conn %d: auto_vacuum = %d, want %d (incremental)",
+				i, autoVacuum, autoVacuumIncremental)
+		}
+	}
+}
+
+// readPragma reads the integer value of PRAGMA name on connection i, c.
+func readPragma(
+	ctx context.Context, t *testing.T, c *sql.Conn, i int, name string,
+) int64 {
+	t.Helper()
+
+	var value int64
+
+	err := c.QueryRowContext(ctx, "PRAGMA "+name).Scan(&value)
+	if err != nil {
+		t.Fatalf("conn %d: failed to read %s: %v", i, name, err)
+	}
+
+	return value
+}
+
+// TestVacuumReturnsFreePages checks that after routes are deleted from a new
+// database, one Vacuum call returns every page they used. The deletes leave
+// fewer free pages than the 1000 Vacuum frees per call, so none may remain.
+// With auto_vacuum off (issue https://git.eeqj.de/sneak/routewatch/issues/43)
+// the free pages stayed in the file, and with the PRAGMA run by ExecContext
+// Vacuum freed only one page per call.
+func TestVacuumReturnsFreePages(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx := context.Background()
+	ts := time.Now().UTC()
+
+	const asn = 64500
+
+	routes := make([]*LiveRoute, 0, vacuumTestRoutes)
+	deletions := make([]LiveRouteDeletion, 0, vacuumTestRoutes)
+
+	for i := range vacuumTestRoutes {
+		route := mkV4Route(t, fmt.Sprintf("10.%d.%d.0/24", i/256, i%256), asn, ts)
+		routes = append(routes, route)
+		deletions = append(deletions, LiveRouteDeletion{
+			Prefix:    route.Prefix,
+			OriginASN: asn,
+			PeerIP:    route.PeerIP,
+			IPVersion: ipVersionV4,
+		})
+	}
+
+	err = db.UpsertLiveRouteBatch(routes)
+	if err != nil {
+		t.Fatalf("failed to write routes: %v", err)
+	}
+
+	err = db.DeleteLiveRouteBatch(deletions)
+	if err != nil {
+		t.Fatalf("failed to delete routes: %v", err)
+	}
+
+	var before int
+
+	err = db.db.QueryRowContext(ctx, "PRAGMA freelist_count").Scan(&before)
+	if err != nil {
+		t.Fatalf("failed to read freelist_count: %v", err)
+	}
+
+	if before == 0 {
+		t.Fatalf("no free pages after deleting %d routes", vacuumTestRoutes)
+	}
+
+	err = db.Vacuum(ctx)
+	if err != nil {
+		t.Fatalf("Vacuum failed: %v", err)
+	}
+
+	var after int
+
+	err = db.db.QueryRowContext(ctx, "PRAGMA freelist_count").Scan(&after)
+	if err != nil {
+		t.Fatalf("failed to read freelist_count: %v", err)
+	}
+
+	if after != 0 {
+		t.Errorf("free pages after Vacuum = %d of %d, want 0", after, before)
+	}
+}
+
+// TestBatchWriteDuringCheckpoint reproduces issue #25. A batch write reads
+// (SELECT) before it writes (INSERT/UPDATE). Under the default deferred locking
+// the transaction begins as a reader and, when the maintainer's WAL checkpoint
+// holds the write lock, its upgrade to writer fails immediately with "database
+// is locked" without honouring busy_timeout, dropping the batch. With
+// _txlock=immediate the transaction takes the write lock at BEGIN and waits, so
+// no batch is dropped. The checkpoint runs without the Database mutex, exactly
+// as the background maintainer does in production.
+func TestBatchWriteDuringCheckpoint(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	go func() {
+		defer wg.Done()
+
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			default:
+				_ = db.Checkpoint(ctx) // errors are the checkpoint's own to absorb
+			}
+		}
+	}()
+
+	ts := time.Now().UTC()
+	for i := range contentionIterations {
+		asns := map[int]time.Time{
+			i % contendedASNCount:                   ts,
+			(i % contendedASNCount) + asnSecondBand: ts,
+		}
+
+		err := db.GetOrCreateASNBatch(asns)
+		if err != nil {
+			cancel()
+			wg.Wait()
+			t.Fatalf("batch write failed under checkpoint contention: %v", err)
+		}
+	}
+
+	cancel()
+	wg.Wait()
+}

internal/database/database_test.go

@@ -1,444 +0,0 @@
-package database
-
-import (
-	"context"
-	"database/sql"
-	"net"
-	"sync"
-	"testing"
-	"time"
-
-	"git.eeqj.de/sneak/routewatch/internal/config"
-	"git.eeqj.de/sneak/routewatch/internal/logger"
-)
-
-// tempStoreMemory is the PRAGMA temp_store value meaning "hold temp B-trees in
-// memory"; the DSN change must leave temp_store below this so they spill to disk.
-const tempStoreMemory = 2
-
-// heldConnections is how many pooled connections the pragma test holds open at
-// once so each is a distinct SQLite connection that parsed the DSN.
-const heldConnections = 5
-
-// Parameters for the checkpoint-contention regression test.
-const (
-	// contentionIterations is how many batch writes race the checkpoint loop.
-	contentionIterations = 400
-	// contendedASNCount is the small set of ASNs the batches reuse, so most
-	// batches update existing rows and exercise the read-before-write path.
-	contendedASNCount = 16
-	// asnSecondBand offsets a second ASN per batch so each batch writes more
-	// than one row.
-	asnSecondBand = 100
-)
-
-func TestIPToUint32(t *testing.T) {
-	tests := []struct {
-		name     string
-		ip       string
-		expected uint32
-	}{
-		{
-			name:     "Simple IP",
-			ip:       "192.168.1.1",
-			expected: 3232235777, // 192<<24 + 168<<16 + 1<<8 + 1
-		},
-		{
-			name:     "Minimum IP",
-			ip:       "0.0.0.0",
-			expected: 0,
-		},
-		{
-			name:     "Maximum IP",
-			ip:       "255.255.255.255",
-			expected: 4294967295,
-		},
-		{
-			name:     "10.0.0.0",
-			ip:       "10.0.0.0",
-			expected: 167772160,
-		},
-		{
-			name:     "172.16.0.0",
-			ip:       "172.16.0.0",
-			expected: 2886729728,
-		},
-		{
-			name:     "8.8.8.8",
-			ip:       "8.8.8.8",
-			expected: 134744072,
-		},
-		{
-			name:     "1.2.3.4",
-			ip:       "1.2.3.4",
-			expected: 16909060,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ip := net.ParseIP(tt.ip)
-			if ip == nil {
-				t.Fatalf("Failed to parse IP: %s", tt.ip)
-			}
-
-			result := ipToUint32(ip)
-			if result != tt.expected {
-				t.Errorf("ipToUint32(%s) = %d, want %d", tt.ip, result, tt.expected)
-			}
-
-			// Test with IPv4-mapped IPv6 address
-			ip6 := net.ParseIP(tt.ip).To16()
-			if ip6 != nil {
-				result6 := ipToUint32(ip6)
-				if result6 != tt.expected {
-					t.Errorf("ipToUint32(%s as IPv6) = %d, want %d", tt.ip, result6, tt.expected)
-				}
-			}
-		})
-	}
-}
-
-func TestCalculateIPv4Range(t *testing.T) {
-	tests := []struct {
-		name      string
-		cidr      string
-		wantStart uint32
-		wantEnd   uint32
-		wantErr   bool
-	}{
-		{
-			name:      "Single IP /32",
-			cidr:      "192.168.1.1/32",
-			wantStart: 3232235777,
-			wantEnd:   3232235777,
-		},
-		{
-			name:      "Class C /24",
-			cidr:      "192.168.1.0/24",
-			wantStart: 3232235776, // 192.168.1.0
-			wantEnd:   3232236031, // 192.168.1.255
-		},
-		{
-			name:      "Class B /16",
-			cidr:      "192.168.0.0/16",
-			wantStart: 3232235520, // 192.168.0.0
-			wantEnd:   3232301055, // 192.168.255.255
-		},
-		{
-			name:      "Class A /8",
-			cidr:      "10.0.0.0/8",
-			wantStart: 167772160, // 10.0.0.0
-			wantEnd:   184549375, // 10.255.255.255
-		},
-		{
-			name:      "Entire IPv4 space /0",
-			cidr:      "0.0.0.0/0",
-			wantStart: 0,
-			wantEnd:   4294967295,
-		},
-		{
-			name:      "Small subnet /30",
-			cidr:      "192.168.1.0/30",
-			wantStart: 3232235776, // 192.168.1.0
-			wantEnd:   3232235779, // 192.168.1.3
-		},
-		{
-			name:      "Medium subnet /20",
-			cidr:      "172.16.0.0/20",
-			wantStart: 2886729728, // 172.16.0.0
-			wantEnd:   2886733823, // 172.16.15.255
-		},
-		{
-			name:      "Private range 172.16/12",
-			cidr:      "172.16.0.0/12",
-			wantStart: 2886729728, // 172.16.0.0
-			wantEnd:   2887778303, // 172.31.255.255
-		},
-		{
-			name:      "Google DNS /29",
-			cidr:      "8.8.8.8/29",
-			wantStart: 134744072, // 8.8.8.8 (network is actually 8.8.8.8 with /29)
-			wantEnd:   134744079, // 8.8.8.15
-		},
-		{
-			name:      "Non-zero host bits",
-			cidr:      "192.168.1.5/24",
-			wantStart: 3232235776, // 192.168.1.0 (network address)
-			wantEnd:   3232236031, // 192.168.1.255
-		},
-		{
-			name:    "Invalid CIDR",
-			cidr:    "192.168.1.1/33",
-			wantErr: true,
-		},
-		{
-			name:    "Invalid IP",
-			cidr:    "256.256.256.256/24",
-			wantErr: true,
-		},
-		{
-			name:    "IPv6 CIDR",
-			cidr:    "2001:db8::/32",
-			wantErr: true,
-		},
-		{
-			name:    "Empty CIDR",
-			cidr:    "",
-			wantErr: true,
-		},
-		{
-			name:    "Missing mask",
-			cidr:    "192.168.1.1",
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			start, end, err := CalculateIPv4Range(tt.cidr)
-
-			if tt.wantErr {
-				if err == nil {
-					t.Errorf("CalculateIPv4Range(%s) expected error, got nil", tt.cidr)
-				}
-				return
-			}
-
-			if err != nil {
-				t.Errorf("CalculateIPv4Range(%s) unexpected error: %v", tt.cidr, err)
-				return
-			}
-
-			if start != tt.wantStart {
-				t.Errorf("CalculateIPv4Range(%s) start = %d, want %d", tt.cidr, start, tt.wantStart)
-			}
-
-			if end != tt.wantEnd {
-				t.Errorf("CalculateIPv4Range(%s) end = %d, want %d", tt.cidr, end, tt.wantEnd)
-			}
-
-			// Verify that start <= end
-			if start > end {
-				t.Errorf("CalculateIPv4Range(%s) start (%d) > end (%d)", tt.cidr, start, end)
-			}
-
-			// Verify the range size matches the CIDR mask
-			if !tt.wantErr && tt.cidr != "" {
-				_, ipNet, _ := net.ParseCIDR(tt.cidr)
-				if ipNet != nil {
-					ones, bits := ipNet.Mask.Size()
-					expectedSize := uint32(1) << uint(bits-ones)
-					actualSize := end - start + 1
-					if actualSize != expectedSize {
-						t.Errorf("CalculateIPv4Range(%s) range size = %d, want %d", tt.cidr, actualSize, expectedSize)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestIPv4RangeIntegration(t *testing.T) {
-	// Test that our functions work correctly together
-	tests := []struct {
-		name          string
-		cidr          string
-		testIPs       []string
-		shouldContain []bool
-	}{
-		{
-			name: "192.168.1.0/24",
-			cidr: "192.168.1.0/24",
-			testIPs: []string{
-				"192.168.1.0",
-				"192.168.1.1",
-				"192.168.1.255",
-				"192.168.0.255",
-				"192.168.2.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
-		{
-			name: "10.0.0.0/8",
-			cidr: "10.0.0.0/8",
-			testIPs: []string{
-				"10.0.0.0",
-				"10.255.255.255",
-				"10.1.2.3",
-				"9.255.255.255",
-				"11.0.0.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
-		{
-			name: "172.16.0.0/12",
-			cidr: "172.16.0.0/12",
-			testIPs: []string{
-				"172.16.0.0",
-				"172.31.255.255",
-				"172.20.1.1",
-				"172.15.255.255",
-				"172.32.0.0",
-			},
-			shouldContain: []bool{true, true, true, false, false},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			start, end, err := CalculateIPv4Range(tt.cidr)
-			if err != nil {
-				t.Fatalf("Failed to calculate range for %s: %v", tt.cidr, err)
-			}
-
-			for i, testIP := range tt.testIPs {
-				ip := net.ParseIP(testIP)
-				if ip == nil {
-					t.Fatalf("Failed to parse test IP: %s", testIP)
-				}
-
-				ipUint := ipToUint32(ip)
-				contained := ipUint >= start && ipUint <= end
-
-				if contained != tt.shouldContain[i] {
-					t.Errorf("IP %s in range %s: got %v, want %v", testIP, tt.cidr, contained, tt.shouldContain[i])
-				}
-			}
-		})
-	}
-}
-
-// TestConnectionPoolPragmas holds several pooled connections open at once and
-// checks each one carries the per-connection settings from the DSN, plus the
-// process-wide hard heap limit.
-func TestConnectionPoolPragmas(t *testing.T) {
-	cfg := &config.Config{StateDir: t.TempDir()}
-
-	db, err := New(cfg, logger.New())
-	if err != nil {
-		t.Fatalf("failed to create database: %v", err)
-	}
-	defer func() { _ = db.Close() }()
-
-	ctx := context.Background()
-
-	// Hold distinct connections open simultaneously so the pool must open a new
-	// one (each parsing the DSN) rather than hand back the same connection.
-	conns := make([]*sql.Conn, 0, heldConnections)
-	defer func() {
-		for _, c := range conns {
-			_ = c.Close()
-		}
-	}()
-
-	for i := 0; i < heldConnections; i++ {
-		c, err := db.db.Conn(ctx)
-		if err != nil {
-			t.Fatalf("failed to open connection %d: %v", i, err)
-		}
-		conns = append(conns, c)
-	}
-
-	for i, c := range conns {
-		var cacheSize int
-		if err := c.QueryRowContext(ctx, "PRAGMA cache_size").Scan(&cacheSize); err != nil {
-			t.Fatalf("conn %d: failed to read cache_size: %v", i, err)
-		}
-		if cacheSize != sqliteCacheSizeKiB {
-			t.Errorf("conn %d: cache_size = %d, want %d", i, cacheSize, sqliteCacheSizeKiB)
-		}
-
-		var busyTimeout int
-		if err := c.QueryRowContext(ctx, "PRAGMA busy_timeout").Scan(&busyTimeout); err != nil {
-			t.Fatalf("conn %d: failed to read busy_timeout: %v", i, err)
-		}
-		if busyTimeout != sqliteBusyTimeoutMs {
-			t.Errorf("conn %d: busy_timeout = %d, want %d", i, busyTimeout, sqliteBusyTimeoutMs)
-		}
-
-		var tempStore int
-		if err := c.QueryRowContext(ctx, "PRAGMA temp_store").Scan(&tempStore); err != nil {
-			t.Fatalf("conn %d: failed to read temp_store: %v", i, err)
-		}
-		if tempStore == tempStoreMemory {
-			t.Errorf("conn %d: temp_store = %d, want anything but %d (MEMORY)", i, tempStore, tempStoreMemory)
-		}
-
-		var hardHeapLimit int64
-		if err := c.QueryRowContext(ctx, "PRAGMA hard_heap_limit").Scan(&hardHeapLimit); err != nil {
-			t.Fatalf("conn %d: failed to read hard_heap_limit: %v", i, err)
-		}
-		if hardHeapLimit != sqliteHardHeapLimitBytes {
-			t.Errorf("conn %d: hard_heap_limit = %d, want %d", i, hardHeapLimit, sqliteHardHeapLimitBytes)
-		}
-	}
-}
-
-// TestBatchWriteDuringCheckpoint reproduces issue #25. A batch write reads
-// (SELECT) before it writes (INSERT/UPDATE). Under the default deferred locking
-// the transaction begins as a reader and, when the maintainer's WAL checkpoint
-// holds the write lock, its upgrade to writer fails immediately with "database
-// is locked" without honouring busy_timeout, dropping the batch. With
-// _txlock=immediate the transaction takes the write lock at BEGIN and waits, so
-// no batch is dropped. The checkpoint runs without the Database mutex, exactly
-// as the background maintainer does in production.
-func TestBatchWriteDuringCheckpoint(t *testing.T) {
-	cfg := &config.Config{StateDir: t.TempDir()}
-
-	db, err := New(cfg, logger.New())
-	if err != nil {
-		t.Fatalf("failed to create database: %v", err)
-	}
-	defer func() { _ = db.Close() }()
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			default:
-				_ = db.Checkpoint(ctx) // errors are the checkpoint's own to absorb
-			}
-		}
-	}()
-
-	ts := time.Now().UTC()
-	for i := 0; i < contentionIterations; i++ {
-		asns := map[int]time.Time{
-			i % contendedASNCount:                   ts,
-			(i % contendedASNCount) + asnSecondBand: ts,
-		}
-		if err := db.GetOrCreateASNBatch(asns); err != nil {
-			cancel()
-			wg.Wait()
-			t.Fatalf("batch write failed under checkpoint contention: %v", err)
-		}
-	}
-
-	cancel()
-	wg.Wait()
-}
-
-func BenchmarkIPToUint32(b *testing.B) {
-	ip := net.ParseIP("192.168.1.1")
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		_ = ipToUint32(ip)
-	}
-}
-
-func BenchmarkCalculateIPv4Range(b *testing.B) {
-	cidr := "192.168.0.0/16"
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		_, _, _ = CalculateIPv4Range(cidr)
-	}
-}

internal/database/interface.go

@@ -18,6 +18,8 @@ type Stats struct {
 	Peers                  int
 	FileSizeBytes          int64
 	LiveRoutes             int
+	IPv4Routes             int
+	IPv6Routes             int
 	OldestRoute            *time.Time
 	NewestRoute            *time.Time
 	IPv4PrefixDistribution []PrefixDistribution
@@ -27,6 +29,8 @@ type Stats struct {
 // Store defines the interface for database operations. It provides methods for
 // managing ASNs, prefixes, announcements, peerings, BGP peers, and live routes.
 // Implementations must be safe for concurrent use.
+//
+//nolint:interfacebloat // the one seam handlers and tests depend on
 type Store interface {
 	// ASN operations
 	GetOrCreateASN(number int, timestamp time.Time) (*ASN, error)
@@ -55,14 +59,14 @@ type Store interface {
 	UpsertLiveRouteBatch(routes []*LiveRoute) error
 	DeleteLiveRoute(prefix string, originASN int, peerIP string) error
 	DeleteLiveRouteBatch(deletions []LiveRouteDeletion) error
-	GetPrefixDistribution() (ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
-	GetPrefixDistributionContext(ctx context.Context) (ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
+	GetPrefixDistribution() (
+		ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
+	GetPrefixDistributionContext(ctx context.Context) (
+		ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
 	GetLiveRouteCounts() (ipv4Count, ipv6Count int, err error)
 	GetLiveRouteCountsContext(ctx context.Context) (ipv4Count, ipv6Count int, err error)
 
 	// IP lookup operations
-	GetASInfoForIP(ip string) (*ASInfo, error)
-	GetASInfoForIPContext(ctx context.Context, ip string) (*ASInfo, error)
 	GetIPInfo(ip string) (*IPInfo, error)
 	GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, error)
 
@@ -79,7 +83,9 @@ type Store interface {
 	GetPrefixDetails(prefix string) ([]LiveRoute, error)
 	GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, error)
 	GetRandomPrefixesByLength(maskLength, ipVersion, limit int) ([]LiveRoute, error)
-	GetRandomPrefixesByLengthContext(ctx context.Context, maskLength, ipVersion, limit int) ([]LiveRoute, error)
+	GetRandomPrefixesByLengthContext(
+		ctx context.Context, maskLength, ipVersion, limit int,
+	) ([]LiveRoute, error)
 
 	// Lifecycle
 	Close() error

internal/database/models.go

@@ -1,4 +1,3 @@
-// Package database provides SQLite storage for BGP routing data.
 package database
 
 import (
@@ -9,6 +8,8 @@ import (
 
 // ASN represents an Autonomous System Number with its metadata including
 // handle, description, WHOIS data, and first/last seen timestamps.
+//
+//nolint:tagliatelle // field names are the existing JSON API
 type ASN struct {
 	ASN         int    `json:"asn"`
 	Handle      string `json:"handle"`
@@ -36,37 +37,39 @@ type ASN struct {
 // Prefix represents an IP prefix (CIDR block) with its IP version (4 or 6)
 // and first/last seen timestamps.
 type Prefix struct {
-	ID        uuid.UUID `json:"id"`
-	Prefix    string    `json:"prefix"`
-	IPVersion int       `json:"ip_version"` // 4 or 6
-	FirstSeen time.Time `json:"first_seen"`
-	LastSeen  time.Time `json:"last_seen"`
+	ID        uuid.UUID
+	Prefix    string
+	IPVersion int // 4 or 6
+	FirstSeen time.Time
+	LastSeen  time.Time
 }
 
 // Announcement represents a BGP announcement or withdrawal event,
 // containing the prefix, AS path, origin ASN, peer ASN, next hop, and timestamp.
 type Announcement struct {
-	ID           uuid.UUID `json:"id"`
-	PrefixID     uuid.UUID `json:"prefix_id"`
-	PeerASN      int       `json:"peer_asn"`
-	OriginASN    int       `json:"origin_asn"`
-	Path         string    `json:"path"` // JSON-encoded AS path
-	NextHop      string    `json:"next_hop"`
-	Timestamp    time.Time `json:"timestamp"`
-	IsWithdrawal bool      `json:"is_withdrawal"`
+	ID           uuid.UUID
+	PrefixID     uuid.UUID
+	PeerASN      int
+	OriginASN    int
+	Path         string // JSON-encoded AS path
+	NextHop      string
+	Timestamp    time.Time
+	IsWithdrawal bool
 }
 
 // ASNPeering represents a peering relationship between two ASNs,
 // stored with the lower ASN as ASA and the higher as ASB.
 type ASNPeering struct {
-	ID        uuid.UUID `json:"id"`
-	ASA       int       `json:"as_a"`
-	ASB       int       `json:"as_b"`
-	FirstSeen time.Time `json:"first_seen"`
-	LastSeen  time.Time `json:"last_seen"`
+	ID        uuid.UUID
+	ASA       int
+	ASB       int
+	FirstSeen time.Time
+	LastSeen  time.Time
 }
 
 // LiveRoute represents a route in the live routing table
+//
+//nolint:tagliatelle // field names are the existing JSON API
 type LiveRoute struct {
 	ID          uuid.UUID `json:"id"`
 	Prefix      string    `json:"prefix"`
@@ -77,28 +80,19 @@ type LiveRoute struct {
 	ASPath      []int     `json:"as_path"`
 	NextHop     string    `json:"next_hop"`
 	LastUpdated time.Time `json:"last_updated"`
-	// IPv4 range fields for fast lookups (nil for IPv6)
-	V4IPStart *uint32 `json:"v4_ip_start,omitempty"`
-	V4IPEnd   *uint32 `json:"v4_ip_end,omitempty"`
 }
 
 // PrefixDistribution represents the distribution of prefixes by mask length
+//
+//nolint:tagliatelle // field names are the existing JSON API
 type PrefixDistribution struct {
 	MaskLength int `json:"mask_length"`
 	Count      int `json:"count"`
 }
 
-// ASInfo represents AS information for an IP lookup (legacy format)
-type ASInfo struct {
-	ASN         int       `json:"asn"`
-	Handle      string    `json:"handle"`
-	Description string    `json:"description"`
-	Prefix      string    `json:"prefix"`
-	LastUpdated time.Time `json:"last_updated"`
-	Age         string    `json:"age"`
-}
-
 // IPInfo represents comprehensive IP information for the /ip endpoint
+//
+//nolint:tagliatelle // field names are the existing JSON API
 type IPInfo struct {
 	IP         string   `json:"ip"`
 	PTR        []string `json:"ptr,omitempty"`

internal/database/schema.sql

@@ -107,9 +107,6 @@ CREATE TABLE IF NOT EXISTS live_routes_v4 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	-- IPv4 range columns for fast lookups
-	ip_start INTEGER NOT NULL, -- Start of IPv4 range as 32-bit unsigned int
-	ip_end INTEGER NOT NULL,    -- End of IPv4 range as 32-bit unsigned int
 	UNIQUE(prefix, origin_asn, peer_ip)
 );
 
@@ -123,7 +120,6 @@ CREATE TABLE IF NOT EXISTS live_routes_v6 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	-- Note: IPv6 doesn't use integer range columns
 	UNIQUE(prefix, origin_asn, peer_ip)
 );
 
@@ -132,8 +128,6 @@ CREATE INDEX IF NOT EXISTS idx_live_routes_v4_prefix ON live_routes_v4(prefix);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_mask_length ON live_routes_v4(mask_length);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_origin_asn ON live_routes_v4(origin_asn);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_last_updated ON live_routes_v4(last_updated);
--- Indexes for IPv4 range queries
-CREATE INDEX IF NOT EXISTS idx_live_routes_v4_ip_range ON live_routes_v4(ip_start, ip_end);
 -- Index to optimize prefix distribution queries
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_mask_prefix ON live_routes_v4(mask_length, prefix);
 

internal/database/slowquery.go

@@ -19,29 +19,21 @@ func logSlowQuery(logger *logger.Logger, query string, start time.Time) {
 }
 
 // queryRow wraps QueryRow with slow query logging
-// nolint:unused // kept for consistency with other query wrappers
-func (d *Database) queryRow(query string, args ...interface{}) *sql.Row {
+//
+//nolint:unused // kept for consistency with other query wrappers
+func (d *Database) queryRow(query string, args ...any) *sql.Row {
 	start := time.Now()
 	defer logSlowQuery(d.logger, query, start)
 
-	return d.db.QueryRow(query, args...)
-}
-
-// query wraps Query with slow query logging
-// nolint:unused // kept for future use to ensure all queries go through slow query logging
-func (d *Database) query(query string, args ...interface{}) (*sql.Rows, error) {
-	start := time.Now()
-	defer logSlowQuery(d.logger, query, start)
-
-	return d.db.Query(query, args...)
+	return d.db.QueryRowContext(context.Background(), query, args...)
 }
 
 // exec wraps Exec with slow query logging
-func (d *Database) exec(query string, args ...interface{}) error {
+func (d *Database) exec(query string, args ...any) error {
 	start := time.Now()
 	defer logSlowQuery(d.logger, query, start)
 
-	_, err := d.db.Exec(query, args...)
+	_, err := d.db.ExecContext(context.Background(), query, args...)
 
 	return err
 }
@@ -49,35 +41,22 @@ func (d *Database) exec(query string, args ...interface{}) error {
 // loggingTx wraps sql.Tx to log slow queries
 type loggingTx struct {
 	*sql.Tx
+
 	logger *logger.Logger
 }
 
 // QueryRow wraps sql.Tx.QueryRow to log slow queries
-func (tx *loggingTx) QueryRow(query string, args ...interface{}) *sql.Row {
+func (tx *loggingTx) QueryRow(query string, args ...any) *sql.Row {
 	start := time.Now()
 	defer logSlowQuery(tx.logger, query, start)
 
-	return tx.Tx.QueryRow(query, args...)
-}
-
-// Query wraps sql.Tx.Query to log slow queries
-func (tx *loggingTx) Query(query string, args ...interface{}) (*sql.Rows, error) {
-	start := time.Now()
-	defer logSlowQuery(tx.logger, query, start)
-
-	return tx.Tx.Query(query, args...)
-}
-
-// QueryContext wraps sql.Tx.QueryContext to log slow queries
-func (tx *loggingTx) QueryContext(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
-	start := time.Now()
-	defer logSlowQuery(tx.logger, query, start)
-
-	return tx.Tx.QueryContext(ctx, query, args...)
+	return tx.Tx.QueryRowContext(context.Background(), query, args...)
 }
 
 // QueryRowContext wraps sql.Tx.QueryRowContext to log slow queries
-func (tx *loggingTx) QueryRowContext(ctx context.Context, query string, args ...interface{}) *sql.Row {
+func (tx *loggingTx) QueryRowContext(
+	ctx context.Context, query string, args ...any,
+) *sql.Row {
 	start := time.Now()
 	defer logSlowQuery(tx.logger, query, start)
 
@@ -85,15 +64,17 @@ func (tx *loggingTx) QueryRowContext(ctx context.Context, query string, args ...
 }
 
 // Exec wraps sql.Tx.Exec to log slow queries
-func (tx *loggingTx) Exec(query string, args ...interface{}) (sql.Result, error) {
+func (tx *loggingTx) Exec(query string, args ...any) (sql.Result, error) {
 	start := time.Now()
 	defer logSlowQuery(tx.logger, query, start)
 
-	return tx.Tx.Exec(query, args...)
+	return tx.Tx.ExecContext(context.Background(), query, args...)
 }
 
 // ExecContext wraps sql.Tx.ExecContext to log slow queries
-func (tx *loggingTx) ExecContext(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+func (tx *loggingTx) ExecContext(
+	ctx context.Context, query string, args ...any,
+) (sql.Result, error) {
 	start := time.Now()
 	defer logSlowQuery(tx.logger, query, start)
 

internal/database/utils.go

@@ -1,6 +1,8 @@
 package database
 
 import (
+	"fmt"
+	"net"
 	"strings"
 
 	"github.com/google/uuid"
@@ -18,3 +20,15 @@ func detectIPVersion(prefix string) int {
 
 	return ipVersionV4
 }
+
+// prefixMaskLength returns the mask length of a prefix such as 192.0.2.0/24.
+func prefixMaskLength(prefix string) (int, error) {
+	_, network, err := net.ParseCIDR(prefix)
+	if err != nil {
+		return 0, fmt.Errorf("invalid prefix %s: %w", prefix, err)
+	}
+
+	maskLength, _ := network.Mask.Size()
+
+	return maskLength, nil
+}

internal/logger/logger.go

@@ -74,6 +74,7 @@ func getSourceAttrs() []slog.Attr {
 
 	// Get the function name
 	fn := runtime.FuncForPC(pc)
+
 	var funcName string
 	if fn != nil {
 		funcName = filepath.Base(fn.Name())

internal/metrics/metrics.go

@@ -115,9 +115,11 @@ func (t *Tracker) GetStreamMetrics() StreamMetrics {
 	if msgCount >= 0 {
 		totalMessages = uint64(msgCount)
 	}
+
 	if byteCount >= 0 {
 		totalBytes = uint64(byteCount)
 	}
+
 	if wireByteCount >= 0 {
 		totalWireBytes = uint64(wireByteCount)
 	}
@@ -161,7 +163,7 @@ func (t *Tracker) RecordWithdrawal() {
 func (t *Tracker) SetBGPPeerCount(count int) {
 	// BGP peer count is always small (< 1000), so int32 is safe
 	if count > 0 && count < 1<<31 {
-		t.bgpPeerCount.Store(int32(count)) //nolint:gosec // count is validated
+		t.bgpPeerCount.Store(int32(count))
 	}
 }
 
@@ -209,7 +211,8 @@ type StreamMetrics struct {
 	TotalMessages uint64
 	// TotalBytes is the total number of decompressed bytes received since startup
 	TotalBytes uint64
-	// TotalWireBytes is the total number of bytes received on the wire (before decompression)
+	// TotalWireBytes is the total number of bytes received on the wire (before
+	// decompression)
 	TotalWireBytes uint64
 	// ConnectedSince is the time when the current connection was established
 	ConnectedSince time.Time
@@ -217,9 +220,11 @@ type StreamMetrics struct {
 	Connected bool
 	// MessagesPerSec is the rate of messages received per second (1-minute average)
 	MessagesPerSec float64
-	// BitsPerSec is the rate of decompressed bits received per second (1-minute average)
+	// BitsPerSec is the rate of decompressed bits received per second (1-minute
+	// average)
 	BitsPerSec float64
-	// WireBitsPerSec is the rate of bits received on the wire per second (1-minute average)
+	// WireBitsPerSec is the rate of bits received on the wire per second
+	// (1-minute average)
 	WireBitsPerSec float64
 	// ReconnectCount is the number of reconnections since startup
 	ReconnectCount uint64

internal/ristypes/ris.go

@@ -1,4 +1,5 @@
-// Package ristypes defines the data structures for RIS Live BGP messages and announcements.
+// Package ristypes defines the data structures for RIS Live BGP messages and
+// announcements.
 package ristypes
 
 import (
@@ -17,25 +18,30 @@ type ASPath []int
 func (p *ASPath) UnmarshalJSON(data []byte) error {
 	// First try to unmarshal as a simple array of integers
 	var simple []int
-	if err := json.Unmarshal(data, &simple); err == nil {
+
+	err := json.Unmarshal(data, &simple)
+	if err == nil {
 		*p = ASPath(simple)
 
 		return nil
 	}
 
 	// If that fails, unmarshal as array of interfaces and flatten
-	var raw []interface{}
-	if err := json.Unmarshal(data, &raw); err != nil {
+	var raw []any
+
+	err = json.Unmarshal(data, &raw)
+	if err != nil {
 		return err
 	}
 
 	// Flatten the array
 	result := make([]int, 0)
+
 	for _, item := range raw {
 		switch v := item.(type) {
 		case float64:
 			result = append(result, int(v))
-		case []interface{}:
+		case []any:
 			// Nested array - flatten it
 			for _, nested := range v {
 				if num, ok := nested.(float64); ok {
@@ -62,6 +68,8 @@ type RISLiveMessage struct {
 // It contains metadata about the BGP session (peer, ASN, host) along with
 // the actual BGP update data including AS path, communities, announcements,
 // and withdrawals.
+//
+//nolint:tagliatelle // field names are the RIS Live feed's
 type RISMessage struct {
 	Type            string    `json:"type"`
 	Timestamp       float64   `json:"timestamp"`
@@ -90,6 +98,8 @@ type RISMessage struct {
 // RISAnnouncement represents a BGP route announcement within a RIS message.
 // It contains the next hop IP address and the list of prefixes being announced
 // via that next hop.
+//
+//nolint:tagliatelle // field names are the RIS Live feed's
 type RISAnnouncement struct {
 	NextHop  string   `json:"next_hop"`
 	Prefixes []string `json:"prefixes"`

internal/ristypes/ris_test.go

@@ -1,10 +1,12 @@
-package ristypes
+package ristypes_test
 
 import (
 	"bufio"
 	"encoding/json"
 	"os"
 	"testing"
+
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
 )
 
 // messageExamplesPath is the captured RIS Live feed used as decode fixtures,
@@ -15,32 +17,43 @@ const messageExamplesPath = "../../docs/message-examples.json"
 // streamer does and checks that the fields no handler reads (Community, Raw)
 // stay empty while the fields handlers use (Path, Announcements) still decode.
 func TestDecodeDropsCommunityAndRaw(t *testing.T) {
+	t.Parallel()
+
 	f, err := os.Open(messageExamplesPath)
 	if err != nil {
 		t.Fatalf("open fixtures: %v", err)
 	}
-	defer f.Close()
+
+	defer func() {
+		_ = f.Close()
+	}()
 
 	var messages, withPath, withAnnouncements int
 
 	scanner := bufio.NewScanner(f)
 	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+
 	for scanner.Scan() {
 		line := scanner.Bytes()
 		if len(line) == 0 {
 			continue
 		}
 
-		var wrapper RISLiveMessage
-		if err := json.Unmarshal(line, &wrapper); err != nil {
+		var wrapper ristypes.RISLiveMessage
+
+		err := json.Unmarshal(line, &wrapper)
+		if err != nil {
 			t.Fatalf("unmarshal message %d: %v", messages+1, err)
 		}
+
 		messages++
 
 		msg := wrapper.Data
 		if msg.Community != nil {
-			t.Errorf("message %d: Community decoded, want empty: %v", messages, msg.Community)
+			t.Errorf("message %d: Community decoded, want empty: %v",
+				messages, msg.Community)
 		}
+
 		if msg.Raw != "" {
 			t.Errorf("message %d: Raw decoded, want empty", messages)
 		}
@@ -48,11 +61,14 @@ func TestDecodeDropsCommunityAndRaw(t *testing.T) {
 		if len(msg.Path) > 0 {
 			withPath++
 		}
+
 		if len(msg.Announcements) > 0 {
 			withAnnouncements++
 		}
 	}
-	if err := scanner.Err(); err != nil {
+
+	err = scanner.Err()
+	if err != nil {
 		t.Fatalf("scan fixtures: %v", err)
 	}
 
@@ -62,6 +78,7 @@ func TestDecodeDropsCommunityAndRaw(t *testing.T) {
 	// The fixtures include announcement messages; a used field must still decode,
 	// otherwise an empty Community/Raw would prove nothing.
 	if withPath == 0 || withAnnouncements == 0 {
-		t.Fatalf("used fields did not decode: withPath=%d withAnnouncements=%d", withPath, withAnnouncements)
+		t.Fatalf("used fields did not decode: withPath=%d withAnnouncements=%d",
+			withPath, withAnnouncements)
 	}
 }

internal/routewatch/app.go

@@ -1,10 +1,11 @@
-// Package routewatch contains the primary RouteWatch type that represents a running instance
-// of the application and contains pointers to its core dependencies, and is responsible for initialization.
+// Package routewatch contains the primary RouteWatch type that represents a
+// running instance of the application and contains pointers to its core
+// dependencies, and is responsible for initialization.
 package routewatch
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"sync"
 	"time"
 
@@ -18,6 +19,10 @@ import (
 	"go.uber.org/fx"
 )
 
+// errNonBatchedNotImplemented is returned by Run when batched database writes
+// are disabled, since only the batched handlers exist.
+var errNonBatchedNotImplemented = errors.New("non-batched handlers not implemented")
+
 // Dependencies contains all dependencies for RouteWatch
 type Dependencies struct {
 	fx.In
@@ -68,8 +73,10 @@ func (rw *RouteWatch) Run(ctx context.Context) error {
 	// Apply runtime limit if specified
 	if rw.maxRuntime > 0 {
 		var cancel context.CancelFunc
+
 		ctx, cancel = context.WithTimeout(ctx, rw.maxRuntime)
 		defer cancel()
+
 		rw.logger.Info("Running with time limit", "max_runtime", rw.maxRuntime)
 	}
 
@@ -96,29 +103,31 @@ func (rw *RouteWatch) Run(ctx context.Context) error {
 		// Non-batched handlers not implemented yet
 		rw.logger.Error("Non-batched handlers not implemented")
 
-		return fmt.Errorf("non-batched handlers not implemented")
+		return errNonBatchedNotImplemented
 	}
 
 	// No longer need routing table handler - PrefixHandler maintains live_routes table
 
 	// Start streaming
-	if err := rw.streamer.Start(); err != nil {
+	err := rw.streamer.Start(ctx)
+	if err != nil {
 		return err
 	}
 
 	// Start HTTP server
-	if err := rw.server.Start(); err != nil {
+	err = rw.server.Start()
+	if err != nil {
 		return err
 	}
 
 	// Start ASN WHOIS fetcher for background updates
 	rw.asnFetcher = NewASNFetcher(rw.db, rw.logger.Logger)
-	rw.asnFetcher.Start()
+	rw.asnFetcher.Start(ctx)
 	rw.server.SetASNFetcher(rw.asnFetcher)
 
 	// Start database maintenance goroutine
 	rw.dbMaintainer = NewDBMaintainer(rw.db, rw.logger.Logger)
-	rw.dbMaintainer.Start()
+	rw.dbMaintainer.Start(ctx)
 
 	// Wait for context cancellation
 	<-ctx.Done()
@@ -127,13 +136,14 @@ func (rw *RouteWatch) Run(ctx context.Context) error {
 }
 
 // Shutdown performs graceful shutdown of all services
-func (rw *RouteWatch) Shutdown() {
+func (rw *RouteWatch) Shutdown(ctx context.Context) {
 	rw.mu.Lock()
 	if rw.shutdown {
 		rw.mu.Unlock()
 
 		return
 	}
+
 	rw.shutdown = true
 	rw.mu.Unlock()
 
@@ -142,14 +152,17 @@ func (rw *RouteWatch) Shutdown() {
 		rw.logger.Info("Flushing database handler")
 		rw.dbHandler.Stop()
 	}
+
 	if rw.peerHandler != nil {
 		rw.logger.Info("Flushing peer handler")
 		rw.peerHandler.Stop()
 	}
+
 	if rw.prefixHandler != nil {
 		rw.logger.Info("Flushing prefix handler")
 		rw.prefixHandler.Stop()
 	}
+
 	if rw.peeringHandler != nil {
 		rw.logger.Info("Flushing peering handler")
 		rw.peeringHandler.Stop()
@@ -168,11 +181,15 @@ func (rw *RouteWatch) Shutdown() {
 	// Stop services
 	rw.streamer.Stop()
 
-	// Stop HTTP server with a timeout
+	// Stop HTTP server with a timeout of its own, however much of ctx is left
 	const serverStopTimeout = 5 * time.Second
-	stopCtx, cancel := context.WithTimeout(context.Background(), serverStopTimeout)
+
+	stopCtx, cancel := context.WithTimeout(
+		context.WithoutCancel(ctx), serverStopTimeout)
 	defer cancel()
-	if err := rw.server.Stop(stopCtx); err != nil {
+
+	err := rw.server.Stop(stopCtx)
+	if err != nil {
 		rw.logger.Error("Failed to stop HTTP server gracefully", "error", err)
 	}
 
@@ -185,12 +202,11 @@ func (rw *RouteWatch) Shutdown() {
 		"bits_per_sec", metrics.BitsPerSec,
 		"duration", time.Since(metrics.ConnectedSince),
 	)
-
 }
 
 // getModule provides all fx dependencies
-func getModule() fx.Option {
-	return fx.Options(
+func getModule() []fx.Option {
+	return []fx.Option{
 		fx.Provide(
 			logger.New,
 			config.New,
@@ -203,5 +219,5 @@ func getModule() fx.Option {
 			server.New,
 			New,
 		),
-	)
+	}
 }

internal/routewatch/app_integration_internal_test.go

@@ -50,7 +50,9 @@ func newMockStore() *mockStore {
 }
 
 // GetOrCreateASN mock implementation
-func (m *mockStore) GetOrCreateASN(number int, timestamp time.Time) (*database.ASN, error) {
+func (m *mockStore) GetOrCreateASN(
+	number int, timestamp time.Time,
+) (*database.ASN, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -99,11 +101,14 @@ func (m *mockStore) UpdatePrefixesBatch(prefixes map[string]time.Time) error {
 			}
 		}
 	}
+
 	return nil
 }
 
 // GetOrCreatePrefix mock implementation
-func (m *mockStore) GetOrCreatePrefix(prefix string, timestamp time.Time) (*database.Prefix, error) {
+func (m *mockStore) GetOrCreatePrefix(
+	prefix string, timestamp time.Time,
+) (*database.Prefix, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -168,7 +173,7 @@ func (m *mockStore) RecordPeering(asA, asB int, _ time.Time) error {
 }
 
 // UpdatePeer mock implementation
-func (m *mockStore) UpdatePeer(peerIP string, peerASN int, messageType string, timestamp time.Time) error {
+func (m *mockStore) UpdatePeer(_ string, _ int, _ string, _ time.Time) error {
 	// Simple mock - just return nil
 	return nil
 }
@@ -194,63 +199,48 @@ func (m *mockStore) GetStats() (database.Stats, error) {
 }
 
 // GetStatsContext returns statistics about the mock store with context support
-func (m *mockStore) GetStatsContext(ctx context.Context) (database.Stats, error) {
+func (m *mockStore) GetStatsContext(_ context.Context) (database.Stats, error) {
 	return m.GetStats()
 }
 
 // UpsertLiveRoute mock implementation
-func (m *mockStore) UpsertLiveRoute(route *database.LiveRoute) error {
+func (m *mockStore) UpsertLiveRoute(_ *database.LiveRoute) error {
 	// Simple mock - just return nil
 	return nil
 }
 
 // DeleteLiveRoute mock implementation
-func (m *mockStore) DeleteLiveRoute(prefix string, originASN int, peerIP string) error {
+func (m *mockStore) DeleteLiveRoute(_ string, _ int, _ string) error {
 	// Simple mock - just return nil
 	return nil
 }
 
 // GetPrefixDistribution mock implementation
-func (m *mockStore) GetPrefixDistribution() (ipv4 []database.PrefixDistribution, ipv6 []database.PrefixDistribution, err error) {
+func (m *mockStore) GetPrefixDistribution() (
+	[]database.PrefixDistribution, []database.PrefixDistribution, error,
+) {
 	// Return empty distributions for now
 	return nil, nil, nil
 }
 
 // GetPrefixDistributionContext mock implementation with context support
-func (m *mockStore) GetPrefixDistributionContext(ctx context.Context) (ipv4 []database.PrefixDistribution, ipv6 []database.PrefixDistribution, err error) {
+func (m *mockStore) GetPrefixDistributionContext(_ context.Context) (
+	[]database.PrefixDistribution, []database.PrefixDistribution, error,
+) {
 	return m.GetPrefixDistribution()
 }
 
 // GetLiveRouteCounts mock implementation
-func (m *mockStore) GetLiveRouteCounts() (ipv4Count, ipv6Count int, err error) {
+func (m *mockStore) GetLiveRouteCounts() (int, int, error) {
 	// Return mock counts
 	return m.RouteCount / 2, m.RouteCount / 2, nil
 }
 
 // GetLiveRouteCountsContext mock implementation with context support
-func (m *mockStore) GetLiveRouteCountsContext(ctx context.Context) (ipv4Count, ipv6Count int, err error) {
+func (m *mockStore) GetLiveRouteCountsContext(_ context.Context) (int, int, error) {
 	return m.GetLiveRouteCounts()
 }
 
-// GetASInfoForIP mock implementation
-func (m *mockStore) GetASInfoForIP(ip string) (*database.ASInfo, error) {
-	// Simple mock - return a test AS
-	now := time.Now()
-	return &database.ASInfo{
-		ASN:         15169,
-		Handle:      "GOOGLE",
-		Description: "Google LLC",
-		Prefix:      "8.8.8.0/24",
-		LastUpdated: now.Add(-5 * time.Minute),
-		Age:         "5m0s",
-	}, nil
-}
-
-// GetASInfoForIPContext mock implementation with context support
-func (m *mockStore) GetASInfoForIPContext(ctx context.Context, ip string) (*database.ASInfo, error) {
-	return m.GetASInfoForIP(ip)
-}
-
 // GetASDetails mock implementation
 func (m *mockStore) GetASDetails(asn int) (*database.ASN, []database.LiveRoute, error) {
 	m.mu.Lock()
@@ -266,39 +256,49 @@ func (m *mockStore) GetASDetails(asn int) (*database.ASN, []database.LiveRoute,
 }
 
 // GetASDetailsContext mock implementation with context support
-func (m *mockStore) GetASDetailsContext(ctx context.Context, asn int) (*database.ASN, []database.LiveRoute, error) {
+func (m *mockStore) GetASDetailsContext(
+	_ context.Context, asn int,
+) (*database.ASN, []database.LiveRoute, error) {
 	return m.GetASDetails(asn)
 }
 
 // GetPrefixDetails mock implementation
-func (m *mockStore) GetPrefixDetails(prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetails(_ string) ([]database.LiveRoute, error) {
 	// Return empty routes for now
 	return []database.LiveRoute{}, nil
 }
 
 // GetPrefixDetailsContext mock implementation with context support
-func (m *mockStore) GetPrefixDetailsContext(ctx context.Context, prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetailsContext(
+	_ context.Context, prefix string,
+) ([]database.LiveRoute, error) {
 	return m.GetPrefixDetails(prefix)
 }
 
-func (m *mockStore) GetRandomPrefixesByLength(maskLength, ipVersion, limit int) ([]database.LiveRoute, error) {
+func (m *mockStore) GetRandomPrefixesByLength(
+	_, _, _ int,
+) ([]database.LiveRoute, error) {
 	// Return empty routes for now
 	return []database.LiveRoute{}, nil
 }
 
 // GetRandomPrefixesByLengthContext mock implementation with context support
-func (m *mockStore) GetRandomPrefixesByLengthContext(ctx context.Context, maskLength, ipVersion, limit int) ([]database.LiveRoute, error) {
+func (m *mockStore) GetRandomPrefixesByLengthContext(
+	_ context.Context, maskLength, ipVersion, limit int,
+) ([]database.LiveRoute, error) {
 	return m.GetRandomPrefixesByLength(maskLength, ipVersion, limit)
 }
 
 // GetASPeers mock implementation
-func (m *mockStore) GetASPeers(asn int) ([]database.ASPeer, error) {
+func (m *mockStore) GetASPeers(_ int) ([]database.ASPeer, error) {
 	// Return empty peers for now
 	return []database.ASPeer{}, nil
 }
 
 // GetASPeersContext mock implementation with context support
-func (m *mockStore) GetASPeersContext(ctx context.Context, asn int) ([]database.ASPeer, error) {
+func (m *mockStore) GetASPeersContext(
+	_ context.Context, asn int,
+) ([]database.ASPeer, error) {
 	return m.GetASPeers(asn)
 }
 
@@ -308,8 +308,11 @@ func (m *mockStore) GetIPInfo(ip string) (*database.IPInfo, error) {
 }
 
 // GetIPInfoContext mock implementation with context support
-func (m *mockStore) GetIPInfoContext(ctx context.Context, ip string) (*database.IPInfo, error) {
+func (m *mockStore) GetIPInfoContext(
+	_ context.Context, ip string,
+) (*database.IPInfo, error) {
 	now := time.Now()
+
 	return &database.IPInfo{
 		IP:          ip,
 		Netblock:    "8.8.8.0/24",
@@ -326,17 +329,21 @@ func (m *mockStore) GetIPInfoContext(ctx context.Context, ip string) (*database.
 }
 
 // GetNextStaleASN mock implementation
-func (m *mockStore) GetNextStaleASN(ctx context.Context, staleThreshold time.Duration) (int, error) {
+func (m *mockStore) GetNextStaleASN(_ context.Context, _ time.Duration) (int, error) {
 	return 0, database.ErrNoStaleASN
 }
 
 // UpdateASNWHOIS mock implementation
-func (m *mockStore) UpdateASNWHOIS(ctx context.Context, update *database.ASNWHOISUpdate) error {
+func (m *mockStore) UpdateASNWHOIS(
+	_ context.Context, _ *database.ASNWHOISUpdate,
+) error {
 	return nil
 }
 
 // GetWHOISStats mock implementation
-func (m *mockStore) GetWHOISStats(ctx context.Context, staleThreshold time.Duration) (*database.WHOISStats, error) {
+func (m *mockStore) GetWHOISStats(
+	_ context.Context, _ time.Duration,
+) (*database.WHOISStats, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -364,19 +371,22 @@ func (m *mockStore) UpsertLiveRouteBatch(routes []*database.LiveRoute) error {
 				LastSeen:  route.LastUpdated,
 			}
 			m.PrefixCount++
+
 			if route.IPVersion == 4 {
 				m.IPv4Prefixes++
 			} else {
 				m.IPv6Prefixes++
 			}
 		}
+
 		m.RouteCount++
 	}
+
 	return nil
 }
 
 // DeleteLiveRouteBatch mock implementation
-func (m *mockStore) DeleteLiveRouteBatch(deletions []database.LiveRouteDeletion) error {
+func (m *mockStore) DeleteLiveRouteBatch(_ []database.LiveRouteDeletion) error {
 	// Simple mock - just return nil
 	return nil
 }
@@ -396,43 +406,53 @@ func (m *mockStore) GetOrCreateASNBatch(asns map[int]time.Time) error {
 			m.ASNCount++
 		}
 	}
+
 	return nil
 }
 
 // UpdatePeerBatch mock implementation
-func (m *mockStore) UpdatePeerBatch(peers map[string]database.PeerUpdate) error {
+func (m *mockStore) UpdatePeerBatch(_ map[string]database.PeerUpdate) error {
 	// Simple mock - just return nil
 	return nil
 }
 
 // Vacuum mock implementation
-func (m *mockStore) Vacuum(ctx context.Context) error {
+func (m *mockStore) Vacuum(_ context.Context) error {
 	return nil
 }
 
 // Analyze mock implementation
-func (m *mockStore) Analyze(ctx context.Context) error {
+func (m *mockStore) Analyze(_ context.Context) error {
 	return nil
 }
 
 // Checkpoint mock implementation
-func (m *mockStore) Checkpoint(ctx context.Context) error {
+func (m *mockStore) Checkpoint(_ context.Context) error {
 	return nil
 }
 
 // Ping mock implementation
-func (m *mockStore) Ping(ctx context.Context) error {
+func (m *mockStore) Ping(_ context.Context) error {
 	return nil
 }
 
 func TestRouteWatchLiveFeed(t *testing.T) {
+	t.Parallel()
+
 	if testing.Short() {
-		t.Skip("skipping live RIPE RIS network feed test in short mode; run without -short to include it")
+		t.Skip("skipping live RIPE RIS network feed test in short mode; " +
+			"run without -short to include it")
 	}
 
 	// Create mock database
 	mockDB := newMockStore()
-	defer mockDB.Close()
+
+	defer func() {
+		err := mockDB.Close()
+		if err != nil {
+			t.Errorf("failed to close mock database: %v", err)
+		}
+	}()
 
 	logger := logger.New()
 
@@ -450,7 +470,7 @@ func TestRouteWatchLiveFeed(t *testing.T) {
 	}
 
 	// Create server
-	srv := server.New(mockDB, s, logger)
+	srv := server.New(mockDB, s, logger, cfg)
 
 	// Create RouteWatch with 5 second limit
 	deps := Dependencies{
@@ -485,16 +505,19 @@ func TestRouteWatchLiveFeed(t *testing.T) {
 	if stats.ASNs == 0 {
 		t.Error("Expected to receive some ASNs from live feed")
 	}
+
 	t.Logf("Received %d unique ASNs in 5 seconds", stats.ASNs)
 
 	if stats.Prefixes == 0 {
 		t.Error("Expected to receive some prefixes from live feed")
 	}
-	t.Logf("Received %d unique prefixes (%d IPv4, %d IPv6) in 5 seconds", stats.Prefixes, stats.IPv4Prefixes, stats.IPv6Prefixes)
+
+	t.Logf("Received %d unique prefixes (%d IPv4, %d IPv6) in 5 seconds",
+		stats.Prefixes, stats.IPv4Prefixes, stats.IPv6Prefixes)
 
 	if stats.Peerings == 0 {
 		t.Error("Expected to receive some peerings from live feed")
 	}
-	t.Logf("Recorded %d AS peering relationships in 5 seconds", stats.Peerings)
 
+	t.Logf("Recorded %d AS peering relationships in 5 seconds", stats.Peerings)
 }

internal/routewatch/app_test.go

@@ -1,3 +1,3 @@
-package routewatch
+package routewatch_test
 
 // Tests for routewatch package are in app_integration_test.go

internal/routewatch/ashandler.go

@@ -71,7 +71,7 @@ func NewASHandler(db database.Store, logger *logger.Logger) *ASHandler {
 // the AS path information needed to track autonomous systems.
 func (h *ASHandler) WantsMessage(messageType string) bool {
 	// We only care about UPDATE messages for the database
-	return messageType == "UPDATE"
+	return messageType == updateMessageType
 }
 
 // QueueCapacity returns the recommended message queue size for this handler.
@@ -124,9 +124,20 @@ func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {
 	}
 }
 
+// Stop gracefully shuts down the ASHandler by signaling the background flush
+// goroutine to terminate and waiting for it to complete. Any pending ASN
+// operations in the current batch are flushed to the database before Stop
+// returns. This method should be called during application shutdown to ensure
+// no data is lost.
+func (h *ASHandler) Stop() {
+	close(h.stopCh)
+	h.wg.Wait()
+}
+
 // flushLoop runs in a goroutine and periodically flushes batches
 func (h *ASHandler) flushLoop() {
 	defer h.wg.Done()
+
 	ticker := time.NewTicker(asnBatchTimeout)
 	defer ticker.Stop()
 
@@ -149,7 +160,8 @@ func (h *ASHandler) flushLoop() {
 	}
 }
 
-// flushBatchLocked flushes the ASN batch to the database (must be called with mutex held)
+// flushBatchLocked flushes the ASN batch to the database (must be called with
+// mutex held)
 func (h *ASHandler) flushBatchLocked() {
 	if len(h.batch) == 0 {
 		return
@@ -164,21 +176,13 @@ func (h *ASHandler) flushBatchLocked() {
 	}
 
 	// Process all ASNs in a single batch transaction
-	if err := h.db.GetOrCreateASNBatch(asnMap); err != nil {
-		h.logger.Error("Failed to process ASN batch", "error", err, "count", len(asnMap))
+	err := h.db.GetOrCreateASNBatch(asnMap)
+	if err != nil {
+		h.logger.Error("Failed to process ASN batch",
+			"error", err, "count", len(asnMap))
 	}
 
 	// Clear batch
 	h.batch = h.batch[:0]
 	h.lastFlush = time.Now()
 }
-
-// Stop gracefully shuts down the ASHandler by signaling the background flush
-// goroutine to terminate and waiting for it to complete. Any pending ASN
-// operations in the current batch are flushed to the database before Stop
-// returns. This method should be called during application shutdown to ensure
-// no data is lost.
-func (h *ASHandler) Stop() {
-	close(h.stopCh)
-	h.wg.Wait()
-}

internal/routewatch/asnfetcher.go

@@ -1,8 +1,8 @@
-// Package routewatch contains the ASN WHOIS fetcher for background updates.
 package routewatch
 
 import (
 	"context"
+	"errors"
 	"log/slog"
 	"sync"
 	"time"
@@ -73,10 +73,13 @@ func NewASNFetcher(db database.Store, logger *slog.Logger) *ASNFetcher {
 	}
 }
 
-// Start begins the background ASN fetcher goroutine.
-func (f *ASNFetcher) Start() {
+// Start begins the background ASN fetcher goroutine. It runs until Stop:
+// the end of ctx does not stop it.
+func (f *ASNFetcher) Start(ctx context.Context) {
 	f.wg.Add(1)
-	go f.run()
+
+	go f.run(context.WithoutCancel(ctx))
+
 	f.logger.Info("ASN fetcher started",
 		"base_interval", baseInterval,
 		"min_interval", minInterval,
@@ -151,10 +154,7 @@ func (f *ASNFetcher) recordSuccess() {
 	f.consecutiveFails = 0
 
 	// Decrease interval by half, but not below minimum
-	newInterval := f.currentInterval / backoffMultiplier
-	if newInterval < minInterval {
-		newInterval = minInterval
-	}
+	newInterval := max(f.currentInterval/backoffMultiplier, minInterval)
 
 	if newInterval != f.currentInterval {
 		f.logger.Debug("Decreased fetch interval",
@@ -177,10 +177,7 @@ func (f *ASNFetcher) recordFailure() {
 	f.consecutiveFails++
 
 	// Exponential backoff: multiply by 2, capped at max
-	newInterval := f.currentInterval * backoffMultiplier
-	if newInterval > maxInterval {
-		newInterval = maxInterval
-	}
+	newInterval := min(f.currentInterval*backoffMultiplier, maxInterval)
 
 	if newInterval != f.currentInterval {
 		f.logger.Debug("Increased fetch interval due to failure",
@@ -199,7 +196,7 @@ func (f *ASNFetcher) recordFailure() {
 }
 
 // run is the main background loop.
-func (f *ASNFetcher) run() {
+func (f *ASNFetcher) run(ctx context.Context) {
 	defer f.wg.Done()
 
 	timer := time.NewTimer(f.getInterval())
@@ -212,13 +209,13 @@ func (f *ASNFetcher) run() {
 
 		case asn := <-f.immediateQueue:
 			// Process immediate request (respects lock)
-			f.tryFetch(asn)
+			f.tryFetch(ctx, asn)
 			// Reset timer after immediate fetch
 			timer.Reset(f.getInterval())
 
 		case <-timer.C:
 			// Background fetch of stale/missing ASN
-			f.fetchNextStale()
+			f.fetchNextStale(ctx)
 			// Reset timer with potentially updated interval
 			timer.Reset(f.getInterval())
 		}
@@ -227,7 +224,7 @@ func (f *ASNFetcher) run() {
 
 // tryFetch attempts to fetch and update an ASN, respecting the fetch lock.
 // Returns true if fetch was successful.
-func (f *ASNFetcher) tryFetch(asn int) bool {
+func (f *ASNFetcher) tryFetch(ctx context.Context, asn int) bool {
 	// Try to acquire lock, skip if another fetch is running
 	if !f.fetchMu.TryLock() {
 		f.logger.Debug("Skipping fetch, another fetch in progress", "asn", asn)
@@ -236,11 +233,11 @@ func (f *ASNFetcher) tryFetch(asn int) bool {
 	}
 	defer f.fetchMu.Unlock()
 
-	return f.fetchAndUpdate(asn)
+	return f.fetchAndUpdate(ctx, asn)
 }
 
 // fetchNextStale finds and fetches the next ASN needing WHOIS data.
-func (f *ASNFetcher) fetchNextStale() {
+func (f *ASNFetcher) fetchNextStale(ctx context.Context) {
 	// Try to acquire lock, skip if another fetch is running
 	if !f.fetchMu.TryLock() {
 		f.logger.Debug("Skipping stale fetch, another fetch in progress")
@@ -249,12 +246,12 @@ func (f *ASNFetcher) fetchNextStale() {
 	}
 	defer f.fetchMu.Unlock()
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+	lookupCtx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
-	asn, err := f.db.GetNextStaleASN(ctx, whoisStaleThreshold)
+	asn, err := f.db.GetNextStaleASN(lookupCtx, whoisStaleThreshold)
 	if err != nil {
-		if err != database.ErrNoStaleASN {
+		if !errors.Is(err, database.ErrNoStaleASN) {
 			f.logger.Error("Failed to get stale ASN", "error", err)
 			f.recordFailure()
 		}
@@ -263,13 +260,13 @@ func (f *ASNFetcher) fetchNextStale() {
 		return
 	}
 
-	f.fetchAndUpdate(asn)
+	f.fetchAndUpdate(ctx, asn)
 }
 
 // fetchAndUpdate performs a WHOIS lookup and updates the database.
 // Returns true if successful.
-func (f *ASNFetcher) fetchAndUpdate(asn int) bool {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+func (f *ASNFetcher) fetchAndUpdate(ctx context.Context, asn int) bool {
+	ctx, cancel := context.WithTimeout(ctx, time.Minute)
 	defer cancel()
 
 	f.logger.Info("Fetching WHOIS data", "asn", asn)

internal/routewatch/cli.go

@@ -55,14 +55,19 @@ func logDebugStats(logger *logger.Logger) {
 
 // CLIEntry is the main entry point for the routewatch command-line interface.
 // It initializes the application using the fx dependency injection framework,
-// sets up signal handling for graceful shutdown, and starts the RouteWatch service.
-// This function blocks until the application receives a shutdown signal or encounters
-// a fatal error.
+// sets up signal handling for graceful shutdown, and starts the RouteWatch
+// service. This function blocks until the application receives a shutdown
+// signal or encounters a fatal error.
 func CLIEntry() {
 	app := fx.New(
-		getModule(),
+		fx.Options(getModule()...),
 		fx.StopTimeout(shutdownTimeout), // Allow 60 seconds for graceful shutdown
-		fx.Invoke(func(lc fx.Lifecycle, rw *RouteWatch, logger *logger.Logger, shutdowner fx.Shutdowner) {
+		fx.Invoke(func(
+			lc fx.Lifecycle,
+			rw *RouteWatch,
+			logger *logger.Logger,
+			shutdowner fx.Shutdowner,
+		) {
 			lc.Append(fx.Hook{
 				OnStart: func(ctx context.Context) error {
 					// Start debug stats logging
@@ -75,22 +80,25 @@ func CLIEntry() {
 					go func() {
 						<-sigCh
 						logger.Info("Received shutdown signal")
-						if err := shutdowner.Shutdown(); err != nil {
+
+						err := shutdowner.Shutdown()
+						if err != nil {
 							logger.Error("Failed to shutdown gracefully", "error", err)
 						}
 					}()
 
 					go func() {
-						if err := rw.Run(ctx); err != nil {
+						err := rw.Run(ctx)
+						if err != nil {
 							logger.Error("RouteWatch error", "error", err)
 						}
 					}()
 
 					return nil
 				},
-				OnStop: func(_ context.Context) error {
+				OnStop: func(ctx context.Context) error {
 					logger.Info("Shutting down RouteWatch")
-					rw.Shutdown()
+					rw.Shutdown(ctx)
 
 					return nil
 				},

internal/routewatch/dbmaintainer.go

@@ -1,4 +1,3 @@
-// Package routewatch contains the database maintainer for background maintenance tasks.
 package routewatch
 
 import (
@@ -64,10 +63,13 @@ func NewDBMaintainer(db database.Store, logger *slog.Logger) *DBMaintainer {
 	}
 }
 
-// Start begins the background maintenance goroutine.
-func (m *DBMaintainer) Start() {
+// Start begins the background maintenance goroutine. It runs until Stop:
+// the end of ctx does not stop it.
+func (m *DBMaintainer) Start(ctx context.Context) {
 	m.wg.Add(1)
-	go m.run()
+
+	go m.run(context.WithoutCancel(ctx))
+
 	m.logger.Info("Database maintainer started",
 		"checkpoint_interval", checkpointInterval,
 		"vacuum_interval", vacuumInterval,
@@ -83,15 +85,17 @@ func (m *DBMaintainer) Stop() {
 }
 
 // run is the main background loop.
-func (m *DBMaintainer) run() {
+func (m *DBMaintainer) run(ctx context.Context) {
 	defer m.wg.Done()
 
 	// Use different timers for each task
 	checkpointTimer := time.NewTimer(checkpointInterval)
-	vacuumTimer := time.NewTimer(vacuumInterval)
-	analyzeTimer := time.NewTimer(analyzeInterval)
 	defer checkpointTimer.Stop()
+
+	vacuumTimer := time.NewTimer(vacuumInterval)
 	defer vacuumTimer.Stop()
+
+	analyzeTimer := time.NewTimer(analyzeInterval)
 	defer analyzeTimer.Stop()
 
 	for {
@@ -100,90 +104,88 @@ func (m *DBMaintainer) run() {
 			return
 
 		case <-checkpointTimer.C:
-			m.runCheckpoint()
+			m.runCheckpoint(ctx)
 			checkpointTimer.Reset(checkpointInterval)
 
 		case <-vacuumTimer.C:
-			m.runVacuum()
+			m.runVacuum(ctx)
 			vacuumTimer.Reset(vacuumInterval)
 
 		case <-analyzeTimer.C:
-			m.runAnalyze()
+			m.runAnalyze(ctx)
 			analyzeTimer.Reset(analyzeInterval)
 		}
 	}
 }
 
 // runCheckpoint performs a WAL checkpoint to keep the WAL file small.
-func (m *DBMaintainer) runCheckpoint() {
-	ctx, cancel := context.WithTimeout(context.Background(), checkpointTimeout)
-	defer cancel()
-
-	startTime := time.Now()
-
-	err := m.db.Checkpoint(ctx)
-
-	m.statsMu.Lock()
-	m.lastCheckpoint = time.Now()
-	m.lastCheckpointError = err
-	if err == nil {
-		m.checkpointCount++
-	}
-	m.statsMu.Unlock()
+func (m *DBMaintainer) runCheckpoint(ctx context.Context) {
+	duration, err := runWithTimeout(ctx, checkpointTimeout, m.db.Checkpoint)
+	m.recordResult(&m.lastCheckpoint, &m.lastCheckpointError, &m.checkpointCount, err)
 
 	if err != nil {
-		m.logger.Error("WAL checkpoint failed", "error", err, "duration", time.Since(startTime))
+		m.logger.Error("WAL checkpoint failed", "error", err, "duration", duration)
 	} else {
-		m.logger.Debug("WAL checkpoint completed", "duration", time.Since(startTime))
+		m.logger.Debug("WAL checkpoint completed", "duration", duration)
 	}
 }
 
 // runVacuum performs an incremental vacuum operation on the database.
-func (m *DBMaintainer) runVacuum() {
-	ctx, cancel := context.WithTimeout(context.Background(), vacuumTimeout)
-	defer cancel()
-
+func (m *DBMaintainer) runVacuum(ctx context.Context) {
 	m.logger.Debug("Running incremental vacuum")
-	startTime := time.Now()
 
-	err := m.db.Vacuum(ctx)
-
-	m.statsMu.Lock()
-	m.lastVacuum = time.Now()
-	m.lastVacuumError = err
-	if err == nil {
-		m.vacuumCount++
-	}
-	m.statsMu.Unlock()
+	duration, err := runWithTimeout(ctx, vacuumTimeout, m.db.Vacuum)
+	m.recordResult(&m.lastVacuum, &m.lastVacuumError, &m.vacuumCount, err)
 
 	if err != nil {
-		m.logger.Error("Incremental vacuum failed", "error", err, "duration", time.Since(startTime))
+		m.logger.Error("Incremental vacuum failed", "error", err, "duration", duration)
 	} else {
-		m.logger.Debug("Incremental vacuum completed", "duration", time.Since(startTime))
+		m.logger.Debug("Incremental vacuum completed", "duration", duration)
 	}
 }
 
 // runAnalyze performs an ANALYZE operation on the database.
-func (m *DBMaintainer) runAnalyze() {
-	ctx, cancel := context.WithTimeout(context.Background(), analyzeTimeout)
-	defer cancel()
-
+func (m *DBMaintainer) runAnalyze(ctx context.Context) {
 	m.logger.Info("Starting database ANALYZE")
-	startTime := time.Now()
 
-	err := m.db.Analyze(ctx)
-
-	m.statsMu.Lock()
-	m.lastAnalyze = time.Now()
-	m.lastAnalyzeError = err
-	if err == nil {
-		m.analyzeCount++
-	}
-	m.statsMu.Unlock()
+	duration, err := runWithTimeout(ctx, analyzeTimeout, m.db.Analyze)
+	m.recordResult(&m.lastAnalyze, &m.lastAnalyzeError, &m.analyzeCount, err)
 
 	if err != nil {
-		m.logger.Error("ANALYZE failed", "error", err, "duration", time.Since(startTime))
+		m.logger.Error("ANALYZE failed", "error", err, "duration", duration)
 	} else {
-		m.logger.Info("ANALYZE completed", "duration", time.Since(startTime))
+		m.logger.Info("ANALYZE completed", "duration", duration)
+	}
+}
+
+// runWithTimeout runs operation with a context that ends after timeout and
+// returns how long it took and its error.
+func runWithTimeout(
+	ctx context.Context,
+	timeout time.Duration,
+	operation func(context.Context) error,
+) (time.Duration, error) {
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	startTime := time.Now()
+	err := operation(ctx)
+
+	return time.Since(startTime), err
+}
+
+// recordResult stores when a maintenance task last ran and its error, and
+// counts it when it succeeded.
+func (m *DBMaintainer) recordResult(
+	lastRun *time.Time, lastErr *error, successCount *int, err error,
+) {
+	m.statsMu.Lock()
+	defer m.statsMu.Unlock()
+
+	*lastRun = time.Now()
+	*lastErr = err
+
+	if err == nil {
+		*successCount++
 	}
 }

internal/routewatch/handler.go

@@ -1,10 +1,16 @@
 package routewatch
 
 import (
+	"slices"
+
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/ristypes"
 )
 
+// updateMessageType is the RIS message type of BGP UPDATE messages, the only
+// type the database handlers process.
+const updateMessageType = "UPDATE"
+
 // SimpleHandler is a basic implementation of streamer.MessageHandler that
 // filters messages by type and delegates processing to a callback function.
 // It provides a simple way to handle specific RIS message types without
@@ -15,10 +21,11 @@ type SimpleHandler struct {
 	callback     func(*ristypes.RISMessage)
 }
 
-// NewSimpleHandler creates a new SimpleHandler that accepts specific message types.
-// The messageTypes parameter specifies which RIS message types this handler will process.
-// If messageTypes is empty, the handler will accept all message types.
-// The callback function is invoked for each message that passes the type filter.
+// NewSimpleHandler creates a new SimpleHandler that accepts specific message
+// types. The messageTypes parameter specifies which RIS message types this
+// handler will process. If messageTypes is empty, the handler will accept all
+// message types. The callback function is invoked for each message that
+// passes the type filter.
 func NewSimpleHandler(
 	logger *logger.Logger,
 	messageTypes []string,
@@ -31,22 +38,17 @@ func NewSimpleHandler(
 	}
 }
 
-// WantsMessage returns true if this handler wants to process messages of the given type.
-// It checks whether messageType is in the handler's configured list of accepted types.
-// If no specific types were configured (empty messageTypes slice), it returns true for all types.
+// WantsMessage returns true if this handler wants to process messages of the
+// given type. It checks whether messageType is in the handler's configured
+// list of accepted types. If no specific types were configured (empty
+// messageTypes slice), it returns true for all types.
 func (h *SimpleHandler) WantsMessage(messageType string) bool {
 	// If no specific types are set, accept all messages
 	if len(h.messageTypes) == 0 {
 		return true
 	}
 
-	for _, t := range h.messageTypes {
-		if t == messageType {
-			return true
-		}
-	}
-
-	return false
+	return slices.Contains(h.messageTypes, messageType)
 }
 
 // HandleMessage processes a RIS message by invoking the configured callback function.

internal/routewatch/peerhandler.go

@@ -1,7 +1,8 @@
 package routewatch
 
-// peerhandler.go provides batched peer tracking functionality for BGP route monitoring.
-// It tracks BGP peers from all incoming RIS messages and maintains peer state in the database.
+// peerhandler.go provides batched peer tracking functionality for BGP route
+// monitoring. It tracks BGP peers from all incoming RIS messages and
+// maintains peer state in the database.
 
 import (
 	"strconv"
@@ -92,8 +93,10 @@ func (h *PeerHandler) QueueCapacity() int {
 func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// Parse peer ASN from string
 	peerASN := 0
+
 	if msg.PeerASN != "" {
-		if asn, err := strconv.Atoi(msg.PeerASN); err == nil {
+		asn, err := strconv.Atoi(msg.PeerASN)
+		if err == nil {
 			peerASN = asn
 		}
 	}
@@ -115,9 +118,16 @@ func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 	}
 }
 
+// Stop gracefully stops the handler and flushes remaining batches
+func (h *PeerHandler) Stop() {
+	close(h.stopCh)
+	h.wg.Wait()
+}
+
 // flushLoop runs in a goroutine and periodically flushes batches
 func (h *PeerHandler) flushLoop() {
 	defer h.wg.Done()
+
 	ticker := time.NewTicker(peerBatchTimeout)
 	defer ticker.Stop()
 
@@ -140,7 +150,8 @@ func (h *PeerHandler) flushLoop() {
 	}
 }
 
-// flushBatchLocked flushes the peer batch to the database (must be called with mutex held)
+// flushBatchLocked flushes the peer batch to the database (must be called
+// with mutex held)
 func (h *PeerHandler) flushBatchLocked() {
 	if len(h.peerBatch) == 0 {
 		return
@@ -149,7 +160,8 @@ func (h *PeerHandler) flushBatchLocked() {
 	// Deduplicate by peer IP, keeping the latest update for each peer
 	peerMap := make(map[string]peerUpdate)
 	for _, update := range h.peerBatch {
-		if existing, ok := peerMap[update.peerIP]; !ok || update.timestamp.After(existing.timestamp) {
+		existing, ok := peerMap[update.peerIP]
+		if !ok || update.timestamp.After(existing.timestamp) {
 			peerMap[update.peerIP] = update
 		}
 	}
@@ -166,17 +178,13 @@ func (h *PeerHandler) flushBatchLocked() {
 	}
 
 	// Process all peers in a single batch transaction
-	if err := h.db.UpdatePeerBatch(dbPeerMap); err != nil {
-		h.logger.Error("Failed to process peer batch", "error", err, "count", len(dbPeerMap))
+	err := h.db.UpdatePeerBatch(dbPeerMap)
+	if err != nil {
+		h.logger.Error("Failed to process peer batch",
+			"error", err, "count", len(dbPeerMap))
 	}
 
 	// Clear batch
 	h.peerBatch = h.peerBatch[:0]
 	h.lastFlush = time.Now()
 }
-
-// Stop gracefully stops the handler and flushes remaining batches
-func (h *PeerHandler) Stop() {
-	close(h.stopCh)
-	h.wg.Wait()
-}

internal/routewatch/peeringhandler.go

@@ -72,7 +72,7 @@ func NewPeeringHandler(db database.Store, logger *logger.Logger) *PeeringHandler
 // the AS path information needed to extract peering relationships.
 func (h *PeeringHandler) WantsMessage(messageType string) bool {
 	// We only care about UPDATE messages that have AS paths
-	return messageType == "UPDATE"
+	return messageType == updateMessageType
 }
 
 // QueueCapacity returns the buffer size for the handler's message queue.
@@ -101,6 +101,7 @@ func (h *PeeringHandler) HandleMessage(msg *ristypes.RISMessage) {
 
 		return
 	}
+
 	key := string(pathJSON)
 
 	h.mu.Lock()
@@ -116,6 +117,23 @@ func (h *PeeringHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Unlock()
 }
 
+// ProcessPeeringsNow triggers immediate processing of all accumulated AS
+// paths into peering records. This bypasses the normal periodic processing
+// schedule and is primarily intended for testing purposes.
+func (h *PeeringHandler) ProcessPeeringsNow() {
+	h.processPeerings()
+}
+
+// Stop gracefully shuts down the handler by signaling the background
+// goroutine to stop and performing a final synchronous processing of
+// any remaining AS paths. This ensures no peering data is lost during
+// shutdown.
+func (h *PeeringHandler) Stop() {
+	close(h.stopCh)
+	// Process any remaining peerings synchronously
+	h.processPeerings()
+}
+
 // processLoop runs periodically to process AS paths into peerings
 func (h *PeeringHandler) processLoop() {
 	ticker := time.NewTicker(peeringProcessInterval)
@@ -134,13 +152,6 @@ func (h *PeeringHandler) processLoop() {
 	}
 }
 
-// ProcessPeeringsNow triggers immediate processing of all accumulated AS
-// paths into peering records. This bypasses the normal periodic processing
-// schedule and is primarily intended for testing purposes.
-func (h *PeeringHandler) ProcessPeeringsNow() {
-	h.processPeerings()
-}
-
 // processPeerings extracts peerings from AS paths and writes to database
 func (h *PeeringHandler) processPeerings() {
 	// Take the accumulated paths and replace the map with a fresh empty one
@@ -160,11 +171,14 @@ func (h *PeeringHandler) processPeerings() {
 	type peeringKey struct {
 		low, high int
 	}
+
 	peerings := make(map[peeringKey]time.Time)
 
 	for pathJSON, timestamp := range paths {
 		var path []int
-		if err := json.Unmarshal([]byte(pathJSON), &path); err != nil {
+
+		err := json.Unmarshal([]byte(pathJSON), &path)
+		if err != nil {
 			h.logger.Error("Failed to decode AS path", "error", err)
 
 			continue
@@ -197,6 +211,7 @@ func (h *PeeringHandler) processPeerings() {
 	// Record peerings in database
 	start := time.Now()
 	successCount := 0
+
 	for key, ts := range peerings {
 		err := h.db.RecordPeering(key.low, key.high, ts)
 		if err != nil {
@@ -218,13 +233,3 @@ func (h *PeeringHandler) processPeerings() {
 		"duration", time.Since(start),
 	)
 }
-
-// Stop gracefully shuts down the handler by signaling the background
-// goroutine to stop and performing a final synchronous processing of
-// any remaining AS paths. This ensures no peering data is lost during
-// shutdown.
-func (h *PeeringHandler) Stop() {
-	close(h.stopCh)
-	// Process any remaining peerings synchronously
-	h.processPeerings()
-}

internal/routewatch/peeringhandler_internal_test.go

@@ -53,7 +53,8 @@ func newTestHandler(db database.Store) *PeeringHandler {
 	}
 }
 
-func snapshot(h *PeeringHandler) (tracked, dropped int) {
+// snapshot returns how many paths the handler tracks and how many it dropped.
+func snapshot(h *PeeringHandler) (int, int) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
@@ -82,6 +83,8 @@ func handle(h *PeeringHandler, ts time.Time, asns ...int) {
 // empties the path map (the swap) and that a path seen again after a run is
 // recorded in the next run too.
 func TestPeeringHandlerProcessesEachRunAndEmpties(t *testing.T) {
+	t.Parallel()
+
 	store := &recordingStore{mockStore: newMockStore()}
 	h := newTestHandler(store)
 
@@ -94,6 +97,7 @@ func TestPeeringHandlerProcessesEachRunAndEmpties(t *testing.T) {
 	if tracked, _ := snapshot(h); tracked != 0 {
 		t.Fatalf("map not empty after first run: %d paths remain", tracked)
 	}
+
 	if got := store.callCount(); got != 1 {
 		t.Fatalf("want 1 RecordPeering call after first run, got %d", got)
 	}
@@ -105,6 +109,7 @@ func TestPeeringHandlerProcessesEachRunAndEmpties(t *testing.T) {
 	if tracked, _ := snapshot(h); tracked != 0 {
 		t.Fatalf("map not empty after second run: %d paths remain", tracked)
 	}
+
 	if got := store.callCount(); got != 2 {
 		t.Fatalf("want 2 RecordPeering calls after second run, got %d", got)
 	}
@@ -114,6 +119,8 @@ func TestPeeringHandlerProcessesEachRunAndEmpties(t *testing.T) {
 // and counts them, while a path already tracked is refreshed rather than
 // dropped.
 func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
+	t.Parallel()
+
 	store := &recordingStore{mockStore: newMockStore()}
 	h := newTestHandler(store)
 
@@ -126,6 +133,7 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 
 	h.mu.Lock()
 	h.asPaths[existing] = now
+
 	for i := 0; len(h.asPaths) < maxTrackedPaths; i++ {
 		h.asPaths[strconv.Itoa(i)] = now
 	}
@@ -138,6 +146,7 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	if tracked != maxTrackedPaths {
 		t.Fatalf("want map size %d after drop, got %d", maxTrackedPaths, tracked)
 	}
+
 	if dropped != 1 {
 		t.Fatalf("want dropped count 1, got %d", dropped)
 	}
@@ -150,6 +159,7 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	if tracked != maxTrackedPaths {
 		t.Fatalf("want map size %d after refresh, got %d", maxTrackedPaths, tracked)
 	}
+
 	if dropped != 1 {
 		t.Fatalf("want dropped count still 1 after refresh, got %d", dropped)
 	}
@@ -157,7 +167,9 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	h.mu.Lock()
 	gotTS := h.asPaths[existing]
 	h.mu.Unlock()
+
 	if !gotTS.Equal(refreshed) {
-		t.Fatalf("existing path timestamp not refreshed: want %v, got %v", refreshed, gotTS)
+		t.Fatalf("existing path timestamp not refreshed: want %v, got %v",
+			refreshed, gotTS)
 	}
 }

internal/routewatch/prefixhandler.go

@@ -2,6 +2,7 @@ package routewatch
 
 import (
 	"net"
+	"net/netip"
 	"strings"
 	"sync"
 	"time"
@@ -32,8 +33,8 @@ const (
 	ipv6Version = 6
 )
 
-// PrefixHandler tracks BGP prefixes and maintains a live routing table in the database.
-// Routes are added on announcement and deleted on withdrawal.
+// PrefixHandler tracks BGP prefixes and maintains a live routing table in the
+// database. Routes are added on announcement and deleted on withdrawal.
 type PrefixHandler struct {
 	db      database.Store
 	logger  *logger.Logger
@@ -78,10 +79,11 @@ func (h *PrefixHandler) SetMetricsTracker(metrics *metrics.Tracker) {
 	h.metrics = metrics
 }
 
-// WantsMessage returns true if this handler wants to process messages of the given type
+// WantsMessage returns true if this handler wants to process messages of the
+// given type
 func (h *PrefixHandler) WantsMessage(messageType string) bool {
 	// We only care about UPDATE messages for the routing table
-	return messageType == "UPDATE"
+	return messageType == updateMessageType
 }
 
 // QueueCapacity returns the desired queue capacity for this handler
@@ -108,7 +110,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	for _, announcement := range msg.Announcements {
 		for _, prefix := range announcement.Prefixes {
 			h.batch = append(h.batch, prefixUpdate{
-				prefix:      prefix,
+				prefix:      canonicalPrefix(prefix),
 				originASN:   originASN,
 				peer:        msg.Peer,
 				messageType: "announcement",
@@ -125,7 +127,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// Process withdrawals
 	for _, prefix := range msg.Withdrawals {
 		h.batch = append(h.batch, prefixUpdate{
-			prefix:      prefix,
+			prefix:      canonicalPrefix(prefix),
 			originASN:   originASN, // Use the originASN from path if available
 			peer:        msg.Peer,
 			messageType: "withdrawal",
@@ -144,9 +146,16 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	}
 }
 
+// Stop gracefully stops the handler and flushes remaining batches
+func (h *PrefixHandler) Stop() {
+	close(h.stopCh)
+	h.wg.Wait()
+}
+
 // flushLoop runs in a goroutine and periodically flushes batches
 func (h *PrefixHandler) flushLoop() {
 	defer h.wg.Done()
+
 	ticker := time.NewTicker(prefixBatchTimeout)
 	defer ticker.Stop()
 
@@ -169,7 +178,8 @@ func (h *PrefixHandler) flushLoop() {
 	}
 }
 
-// flushBatchLocked flushes the prefix batch to the database (must be called with mutex held)
+// flushBatchLocked flushes the prefix batch to the database (must be called
+// with mutex held)
 func (h *PrefixHandler) flushBatchLocked() {
 	if len(h.batch) == 0 {
 		return
@@ -181,23 +191,29 @@ func (h *PrefixHandler) flushBatchLocked() {
 	// Group updates by prefix to deduplicate
 	// For each prefix, keep the latest update
 	prefixMap := make(map[string]prefixUpdate)
+
 	for _, update := range h.batch {
 		key := update.prefix
-		if existing, ok := prefixMap[key]; !ok || update.timestamp.After(existing.timestamp) {
+
+		existing, ok := prefixMap[key]
+		if !ok || update.timestamp.After(existing.timestamp) {
 			prefixMap[key] = update
 		}
 	}
 
 	// Collect routes to upsert and delete
-	var routesToUpsert []*database.LiveRoute
-	var routesToDelete []database.LiveRouteDeletion
+	var (
+		routesToUpsert []*database.LiveRoute
+		routesToDelete []database.LiveRouteDeletion
+	)
 
 	// Collect unique prefixes to update
 	prefixesToUpdate := make(map[string]time.Time)
 
 	for _, update := range prefixMap {
 		// Track prefix for both announcements and withdrawals
-		if _, exists := prefixesToUpdate[update.prefix]; !exists || update.timestamp.After(prefixesToUpdate[update.prefix]) {
+		seen, exists := prefixesToUpdate[update.prefix]
+		if !exists || update.timestamp.After(seen) {
 			prefixesToUpdate[update.prefix] = update.timestamp
 		}
 
@@ -211,7 +227,8 @@ func (h *PrefixHandler) flushBatchLocked() {
 			// Parse CIDR to get IP version
 			_, ipVersion, err := parseCIDR(update.prefix)
 			if err != nil {
-				h.logger.Error("Failed to parse CIDR for withdrawal", "prefix", update.prefix, "error", err)
+				h.logger.Error("Failed to parse CIDR for withdrawal",
+					"prefix", update.prefix, "error", err)
 
 				continue
 			}
@@ -226,30 +243,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 		}
 	}
 
-	// Process batch operations
-	successCount := 0
-	if len(routesToUpsert) > 0 {
-		if err := h.db.UpsertLiveRouteBatch(routesToUpsert); err != nil {
-			h.logger.Error("Failed to upsert route batch", "error", err, "count", len(routesToUpsert))
-		} else {
-			successCount += len(routesToUpsert)
-		}
-	}
-
-	if len(routesToDelete) > 0 {
-		if err := h.db.DeleteLiveRouteBatch(routesToDelete); err != nil {
-			h.logger.Error("Failed to delete route batch", "error", err, "count", len(routesToDelete))
-		} else {
-			successCount += len(routesToDelete)
-		}
-	}
-
-	// Update prefix tables
-	if len(prefixesToUpdate) > 0 {
-		if err := h.db.UpdatePrefixesBatch(prefixesToUpdate); err != nil {
-			h.logger.Error("Failed to update prefix batch", "error", err, "count", len(prefixesToUpdate))
-		}
-	}
+	successCount := h.writeBatch(routesToUpsert, routesToDelete, prefixesToUpdate)
 
 	elapsed := time.Since(startTime)
 	h.logger.Debug("Flushed prefix batch",
@@ -264,8 +258,64 @@ func (h *PrefixHandler) flushBatchLocked() {
 	h.lastFlush = time.Now()
 }
 
-// parseCIDR extracts the mask length and IP version from a prefix string
-func parseCIDR(prefix string) (maskLength int, ipVersion int, err error) {
+// writeBatch writes the collected route upserts, route deletions and prefix
+// updates to the database and returns how many routes it wrote.
+func (h *PrefixHandler) writeBatch(
+	routesToUpsert []*database.LiveRoute,
+	routesToDelete []database.LiveRouteDeletion,
+	prefixesToUpdate map[string]time.Time,
+) int {
+	successCount := 0
+
+	if len(routesToUpsert) > 0 {
+		err := h.db.UpsertLiveRouteBatch(routesToUpsert)
+		if err != nil {
+			h.logger.Error("Failed to upsert route batch",
+				"error", err, "count", len(routesToUpsert))
+		} else {
+			successCount += len(routesToUpsert)
+		}
+	}
+
+	if len(routesToDelete) > 0 {
+		err := h.db.DeleteLiveRouteBatch(routesToDelete)
+		if err != nil {
+			h.logger.Error("Failed to delete route batch",
+				"error", err, "count", len(routesToDelete))
+		} else {
+			successCount += len(routesToDelete)
+		}
+	}
+
+	// Update prefix tables
+	if len(prefixesToUpdate) > 0 {
+		err := h.db.UpdatePrefixesBatch(prefixesToUpdate)
+		if err != nil {
+			h.logger.Error("Failed to update prefix batch",
+				"error", err, "count", len(prefixesToUpdate))
+		}
+	}
+
+	return successCount
+}
+
+// canonicalPrefix returns prefix in the text form net/netip prints, the form
+// the IP lookup builds when it looks a prefix up. The feed sends IPv6
+// announcements compressed ("2001:db8::/32") but IPv6 withdrawals uncompressed
+// ("2001:db8:0:0:0:0:0:0/32"); stored as received, a withdrawal would not match
+// the route its announcement stored. A prefix that does not parse is returned
+// unchanged, and the batch flush reports it.
+func canonicalPrefix(prefix string) string {
+	p, err := netip.ParsePrefix(prefix)
+	if err != nil {
+		return prefix
+	}
+
+	return p.Masked().String()
+}
+
+// parseCIDR returns the mask length and the IP version of a prefix string
+func parseCIDR(prefix string) (int, int, error) {
 	_, ipNet, err := net.ParseCIDR(prefix)
 	if err != nil {
 		return 0, 0, err
@@ -279,64 +329,6 @@ func parseCIDR(prefix string) (maskLength int, ipVersion int, err error) {
 	return ones, ipv4Version, nil
 }
 
-// processAnnouncement handles storing an announcement in the database
-// nolint:unused // kept for potential future use
-func (h *PrefixHandler) processAnnouncement(_ *database.Prefix, update prefixUpdate) {
-	// Parse CIDR to get mask length
-	maskLength, ipVersion, err := parseCIDR(update.prefix)
-	if err != nil {
-		h.logger.Error("Failed to parse CIDR",
-			"prefix", update.prefix,
-			"error", err,
-		)
-
-		return
-	}
-
-	// Track route update metrics
-	if h.metrics != nil {
-		if ipVersion == ipv4Version {
-			h.metrics.RecordIPv4Update()
-		} else {
-			h.metrics.RecordIPv6Update()
-		}
-	}
-
-	// Create live route record
-	liveRoute := &database.LiveRoute{
-		ID:          uuid.New(),
-		Prefix:      update.prefix,
-		MaskLength:  maskLength,
-		IPVersion:   ipVersion,
-		OriginASN:   update.originASN,
-		PeerIP:      update.peer,
-		ASPath:      update.path,
-		NextHop:     update.peer, // Using peer as next hop
-		LastUpdated: update.timestamp,
-	}
-
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
-	if err := h.db.UpsertLiveRoute(liveRoute); err != nil {
-		h.logger.Error("Failed to upsert live route",
-			"prefix", update.prefix,
-			"error", err,
-		)
-	}
-}
-
 // createLiveRoute creates a LiveRoute from a prefix update
 func (h *PrefixHandler) createLiveRoute(update prefixUpdate) *database.LiveRoute {
 	// Parse CIDR to get mask length
@@ -372,134 +364,5 @@ func (h *PrefixHandler) createLiveRoute(update prefixUpdate) *database.LiveRoute
 		LastUpdated: update.timestamp,
 	}
 
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
 	return liveRoute
 }
-
-// processAnnouncementDirect handles storing an announcement directly without prefix table
-// nolint:unused // kept for potential future use
-func (h *PrefixHandler) processAnnouncementDirect(update prefixUpdate) {
-	// Parse CIDR to get mask length
-	maskLength, ipVersion, err := parseCIDR(update.prefix)
-	if err != nil {
-		h.logger.Error("Failed to parse CIDR",
-			"prefix", update.prefix,
-			"error", err,
-		)
-
-		return
-	}
-
-	// Track route update metrics
-	if h.metrics != nil {
-		if ipVersion == ipv4Version {
-			h.metrics.RecordIPv4Update()
-		} else {
-			h.metrics.RecordIPv6Update()
-		}
-	}
-
-	// Create live route record
-	liveRoute := &database.LiveRoute{
-		ID:          uuid.New(),
-		Prefix:      update.prefix,
-		MaskLength:  maskLength,
-		IPVersion:   ipVersion,
-		OriginASN:   update.originASN,
-		PeerIP:      update.peer,
-		ASPath:      update.path,
-		NextHop:     update.peer, // Using peer as next hop
-		LastUpdated: update.timestamp,
-	}
-
-	// For IPv4, calculate the IP range
-	if ipVersion == ipv4Version {
-		start, end, err := database.CalculateIPv4Range(update.prefix)
-		if err == nil {
-			liveRoute.V4IPStart = &start
-			liveRoute.V4IPEnd = &end
-		} else {
-			h.logger.Error("Failed to calculate IPv4 range",
-				"prefix", update.prefix,
-				"error", err,
-			)
-		}
-	}
-
-	if err := h.db.UpsertLiveRoute(liveRoute); err != nil {
-		h.logger.Error("Failed to upsert live route",
-			"prefix", update.prefix,
-			"error", err,
-		)
-	}
-}
-
-// processWithdrawalDirect handles removing a route directly without prefix table
-// nolint:unused // kept for potential future use
-func (h *PrefixHandler) processWithdrawalDirect(update prefixUpdate) {
-	// For withdrawals, we need to delete the route from live_routes
-	if update.originASN > 0 {
-		if err := h.db.DeleteLiveRoute(update.prefix, update.originASN, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route",
-				"prefix", update.prefix,
-				"origin_asn", update.originASN,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	} else {
-		// If no origin ASN, just delete all routes for this prefix from this peer
-		if err := h.db.DeleteLiveRoute(update.prefix, 0, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route (no origin ASN)",
-				"prefix", update.prefix,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	}
-}
-
-// processWithdrawal handles removing a route from the live routing table
-// nolint:unused // kept for potential future use
-func (h *PrefixHandler) processWithdrawal(_ *database.Prefix, update prefixUpdate) {
-	// For withdrawals, we need to delete the route from live_routes
-	// Since we have the origin ASN from the update, we can delete the specific route
-	if update.originASN > 0 {
-		if err := h.db.DeleteLiveRoute(update.prefix, update.originASN, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route",
-				"prefix", update.prefix,
-				"origin_asn", update.originASN,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	} else {
-		// If no origin ASN, just delete all routes for this prefix from this peer
-		if err := h.db.DeleteLiveRoute(update.prefix, 0, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route (no origin ASN)",
-				"prefix", update.prefix,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	}
-}
-
-// Stop gracefully stops the handler and flushes remaining batches
-func (h *PrefixHandler) Stop() {
-	close(h.stopCh)
-	h.wg.Wait()
-}

internal/routewatch/prefixhandler_internal_test.go

@@ -0,0 +1,84 @@
+package routewatch
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
+)
+
+const (
+	testPeerIP   = "2001:db8:ffff::1"
+	testV4Prefix = "192.0.2.0/24"
+)
+
+// TestPrefixHandlerStoresPrefixesTheIPLookupFinds runs announcements and
+// withdrawals through the prefix handler into a real database and looks the
+// addresses up. The prefixes are written the way the feed sends them: IPv6
+// announcements compressed, IPv6 withdrawals uncompressed. The withdrawal must
+// remove the route the announcement stored, and the IP lookup must find the
+// stored prefix.
+func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
+	t.Parallel()
+
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+	h := &PrefixHandler{db: db, logger: logger.New()}
+	flush := func() {
+		h.mu.Lock()
+		defer h.mu.Unlock()
+
+		h.flushBatchLocked()
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	h.HandleMessage(&ristypes.RISMessage{
+		Peer:            testPeerIP,
+		Path:            ristypes.ASPath{testASNA, testASNB},
+		ParsedTimestamp: ts,
+		Announcements: []ristypes.RISAnnouncement{{
+			NextHop:  testPeerIP,
+			Prefixes: []string{"2001:db8:1::/48", testV4Prefix},
+		}},
+	})
+	flush()
+
+	for ip, want := range map[string]string{
+		"2001:db8:1::1": "2001:db8:1::/48",
+		"192.0.2.1":     testV4Prefix,
+	} {
+		info, err := db.GetIPInfo(ip)
+		if err != nil {
+			t.Fatalf("GetIPInfo(%s) after announcement: %v", ip, err)
+		}
+
+		if info.Netblock != want || info.ASN != testASNB {
+			t.Errorf("GetIPInfo(%s) = %s AS%d, want %s AS%d",
+				ip, info.Netblock, info.ASN, want, testASNB)
+		}
+	}
+
+	h.HandleMessage(&ristypes.RISMessage{
+		Peer:            testPeerIP,
+		ParsedTimestamp: ts.Add(time.Minute),
+		Withdrawals:     []string{"2001:db8:1:0:0:0:0:0/48", testV4Prefix},
+	})
+	flush()
+
+	for _, ip := range []string{"2001:db8:1::1", "192.0.2.1"} {
+		info, err := db.GetIPInfo(ip)
+		if !errors.Is(err, database.ErrNoRoute) {
+			t.Errorf("GetIPInfo(%s) after withdrawal = %+v, %v; want ErrNoRoute",
+				ip, info, err)
+		}
+	}
+}

internal/server/handlers_internal_test.go

@@ -0,0 +1,200 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"slices"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/streamer"
+	"github.com/google/uuid"
+)
+
+// blockingStatsDB embeds database.Store (left nil) and overrides only
+// GetStatsContext, which blocks until release is closed. The stats handlers
+// call it in a goroutine; every other Store method is unused on the timeout
+// path and would panic if called.
+type blockingStatsDB struct {
+	database.Store
+
+	release chan struct{}
+}
+
+func (d blockingStatsDB) GetStatsContext(_ context.Context) (database.Stats, error) {
+	<-d.release
+
+	return database.Stats{}, nil
+}
+
+// TestStatsHandlersDoNotLeakOnTimeout drives each stats handler repeatedly with
+// a request whose context times out before the database responds, then releases
+// the blocked queries and asserts the goroutine count returns to its starting
+// value. Before the fix the per-request goroutine sent on an unbuffered channel
+// that nothing received once the timeout won, so it blocked forever and every
+// poll leaked one goroutine.
+//
+//nolint:paralleltest // counts goroutines, so no other test may run alongside
+func TestStatsHandlersDoNotLeakOnTimeout(t *testing.T) {
+	release := make(chan struct{})
+	db := blockingStatsDB{release: release}
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	handlers := map[string]http.HandlerFunc{
+		"status.json": s.handleStatusJSON(),
+		"stats":       s.handleStats(),
+	}
+
+	baseline := settledGoroutineCount()
+
+	const (
+		iterations     = 20
+		requestTimeout = 50 * time.Millisecond
+	)
+	for _, handler := range handlers {
+		for range iterations {
+			ctx, cancel := context.WithTimeout(context.Background(), requestTimeout)
+			req := httptest.NewRequestWithContext(ctx, http.MethodGet, "/", nil)
+			handler(httptest.NewRecorder(), req)
+			cancel()
+		}
+	}
+
+	// Let the blocked queries finish; with buffered channels each goroutine's
+	// send now succeeds and the goroutine exits.
+	close(release)
+
+	if !waitForGoroutines(baseline) {
+		t.Fatalf("goroutines did not return to baseline %d, got %d",
+			baseline, runtime.NumGoroutine())
+	}
+}
+
+// TestStatsHandlersAnswerFromMemory checks that both stats handlers answer 200
+// with the live route counts and the prefix distribution while the database is
+// closed, so that any query would fail: the request path reads them from
+// memory. The prefix distribution query it used to run read every live route
+// and, on a large database, took the whole 4-second deadline, so
+// /api/v1/stats answered 500 (https://git.eeqj.de/sneak/routewatch/issues/30).
+// The oldest and newest route times still come from one-row lookups at the ends
+// of an index; with the database closed they are left out of the answer.
+func TestStatsHandlersAnswerFromMemory(t *testing.T) {
+	t.Parallel()
+
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	err = db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "198.51.100.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: 64500, PeerIP: "192.0.2.1", ASPath: []int{64500},
+			NextHop: "192.0.2.1", LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "2001:db8::/32", MaskLength: 32, IPVersion: 6,
+			OriginASN: 64501, PeerIP: "2001:db8::1", ASPath: []int{64501},
+			NextHop: "2001:db8::1", LastUpdated: ts,
+		},
+	})
+	if err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	err = db.Close()
+	if err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	handlers := map[string]http.HandlerFunc{
+		"status.json": s.handleStatusJSON(),
+		"stats":       s.handleStats(),
+	}
+
+	for name, handler := range handlers {
+		rec := httptest.NewRecorder()
+		handler(rec, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil))
+
+		if rec.Code != http.StatusOK {
+			t.Errorf("%s: status %d, want %d; body %s",
+				name, rec.Code, http.StatusOK, rec.Body)
+
+			continue
+		}
+
+		//nolint:tagliatelle // field names are the existing JSON API
+		var body struct {
+			Data struct {
+				IPv4Routes       int                           `json:"ipv4_routes"`
+				IPv6Routes       int                           `json:"ipv6_routes"`
+				IPv4Distribution []database.PrefixDistribution `json:"ipv4_prefix_distribution"`
+				IPv6Distribution []database.PrefixDistribution `json:"ipv6_prefix_distribution"`
+			} `json:"data"`
+		}
+
+		err := json.Unmarshal(rec.Body.Bytes(), &body)
+		if err != nil {
+			t.Fatalf("%s: decoding the answer: %v", name, err)
+		}
+
+		if body.Data.IPv4Routes != 1 || body.Data.IPv6Routes != 1 {
+			t.Errorf("%s: routes = (v4 %d, v6 %d), want (1, 1)",
+				name, body.Data.IPv4Routes, body.Data.IPv6Routes)
+		}
+
+		wantV4 := []database.PrefixDistribution{{MaskLength: 24, Count: 1}}
+		if !slices.Equal(body.Data.IPv4Distribution, wantV4) {
+			t.Errorf("%s: IPv4 distribution = %v, want %v",
+				name, body.Data.IPv4Distribution, wantV4)
+		}
+
+		wantV6 := []database.PrefixDistribution{{MaskLength: 32, Count: 1}}
+		if !slices.Equal(body.Data.IPv6Distribution, wantV6) {
+			t.Errorf("%s: IPv6 distribution = %v, want %v",
+				name, body.Data.IPv6Distribution, wantV6)
+		}
+	}
+}
+
+// settledGoroutineCount lets transient goroutines finish, then reports the
+// current count.
+func settledGoroutineCount() int {
+	prev := runtime.NumGoroutine()
+
+	for range 20 {
+		time.Sleep(10 * time.Millisecond)
+
+		cur := runtime.NumGoroutine()
+		if cur == prev {
+			return cur
+		}
+
+		prev = cur
+	}
+
+	return prev
+}
+
+// waitForGoroutines waits until the goroutine count drops to target or below.
+func waitForGoroutines(target int) bool {
+	for range 100 {
+		if runtime.NumGoroutine() <= target {
+			return true
+		}
+
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	return false
+}

internal/server/handlers_test.go

@@ -1,99 +0,0 @@
-package server
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"runtime"
-	"testing"
-	"time"
-
-	"git.eeqj.de/sneak/routewatch/internal/database"
-	"git.eeqj.de/sneak/routewatch/internal/logger"
-	"git.eeqj.de/sneak/routewatch/internal/metrics"
-	"git.eeqj.de/sneak/routewatch/internal/streamer"
-)
-
-// blockingStatsDB embeds database.Store (left nil) and overrides only
-// GetStatsContext, which blocks until release is closed. The stats handlers
-// call it in a goroutine; every other Store method is unused on the timeout
-// path and would panic if called.
-type blockingStatsDB struct {
-	database.Store
-	release chan struct{}
-}
-
-func (d blockingStatsDB) GetStatsContext(_ context.Context) (database.Stats, error) {
-	<-d.release
-
-	return database.Stats{}, nil
-}
-
-// TestStatsHandlersDoNotLeakOnTimeout drives each stats handler repeatedly with
-// a request whose context times out before the database responds, then releases
-// the blocked queries and asserts the goroutine count returns to its starting
-// value. Before the fix the per-request goroutine sent on an unbuffered channel
-// that nothing received once the timeout won, so it blocked forever and every
-// poll leaked one goroutine.
-func TestStatsHandlersDoNotLeakOnTimeout(t *testing.T) {
-	release := make(chan struct{})
-	db := blockingStatsDB{release: release}
-	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New())
-
-	handlers := map[string]http.HandlerFunc{
-		"status.json": s.handleStatusJSON(),
-		"stats":       s.handleStats(),
-	}
-
-	baseline := settledGoroutineCount()
-
-	const (
-		iterations     = 20
-		requestTimeout = 50 * time.Millisecond
-	)
-	for _, handler := range handlers {
-		for range iterations {
-			ctx, cancel := context.WithTimeout(context.Background(), requestTimeout)
-			req := httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx)
-			handler(httptest.NewRecorder(), req)
-			cancel()
-		}
-	}
-
-	// Let the blocked queries finish; with buffered channels each goroutine's
-	// send now succeeds and the goroutine exits.
-	close(release)
-
-	if !waitForGoroutines(baseline) {
-		t.Fatalf("goroutines did not return to baseline %d, got %d",
-			baseline, runtime.NumGoroutine())
-	}
-}
-
-// settledGoroutineCount lets transient goroutines finish, then reports the
-// current count.
-func settledGoroutineCount() int {
-	prev := runtime.NumGoroutine()
-	for range 20 {
-		time.Sleep(10 * time.Millisecond)
-		cur := runtime.NumGoroutine()
-		if cur == prev {
-			return cur
-		}
-		prev = cur
-	}
-
-	return prev
-}
-
-// waitForGoroutines waits until the goroutine count drops to target or below.
-func waitForGoroutines(target int) bool {
-	for range 100 {
-		if runtime.NumGoroutine() <= target {
-			return true
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	return false
-}

internal/server/middleware.go

@@ -14,6 +14,7 @@ import (
 // responseWriter wraps http.ResponseWriter to capture the response
 type responseWriter struct {
 	http.ResponseWriter
+
 	body       *bytes.Buffer
 	statusCode int
 	written    bool
@@ -86,8 +87,10 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 		}
 
 		// Parse the original response
-		var originalResponse map[string]interface{}
-		if err := json.Unmarshal(rw.body.Bytes(), &originalResponse); err != nil {
+		var originalResponse map[string]any
+
+		err := json.Unmarshal(rw.body.Bytes(), &originalResponse)
+		if err != nil {
 			// If we can't parse it, just write original
 			w.WriteHeader(rw.statusCode)
 			_, _ = w.Write(rw.body.Bytes())
@@ -96,7 +99,7 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 		}
 
 		// Add @meta field
-		originalResponse["@meta"] = map[string]interface{}{
+		originalResponse["@meta"] = map[string]any{
 			"time_zone":      "UTC",
 			"api_version":    1,
 			"execution_time": fmt.Sprintf("%d ms", execTime.Milliseconds()),
@@ -112,6 +115,7 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 // timeoutWriter wraps ResponseWriter to prevent concurrent writes after timeout
 type timeoutWriter struct {
 	http.ResponseWriter
+
 	mu      sync.Mutex
 	written bool
 	header  http.Header // cached header to prevent concurrent access
@@ -158,6 +162,7 @@ func (tw *timeoutWriter) Header() http.Header {
 func (tw *timeoutWriter) markWritten() {
 	tw.mu.Lock()
 	defer tw.mu.Unlock()
+
 	tw.written = true
 }
 
@@ -168,7 +173,10 @@ func (tw *timeoutWriter) markWritten() {
 // The timeout parameter specifies the maximum duration allowed for request processing.
 // The returned middleware handles panics from the wrapped handler by re-panicking
 // after cleanup, and prevents concurrent writes to the response after timeout occurs.
-func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Handler) http.Handler {
+func TimeoutMiddleware(
+	timeout time.Duration,
+	logger *slog.Logger,
+) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			startTime := time.Now()
@@ -182,7 +190,7 @@ func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Han
 			}
 
 			done := make(chan struct{})
-			panicChan := make(chan interface{}, 1)
+			panicChan := make(chan any, 1)
 
 			go func() {
 				defer func() {
@@ -202,6 +210,7 @@ func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Han
 				return
 			case <-ctx.Done():
 				tw.markWritten() // Prevent the handler from writing after timeout
+
 				execTime := time.Since(startTime)
 
 				// Log the timeout as a warning
@@ -219,13 +228,13 @@ func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Han
 				w.WriteHeader(http.StatusRequestTimeout)
 				tw.mu.Unlock()
 
-				response := map[string]interface{}{
-					"status": "error",
-					"error": map[string]interface{}{
-						"msg":  "Request timeout",
-						"code": http.StatusRequestTimeout,
+				response := map[string]any{
+					jsonKeyStatus: jsonStatusError,
+					jsonKeyError: map[string]any{
+						jsonKeyMsg:  "Request timeout",
+						jsonKeyCode: http.StatusRequestTimeout,
 					},
-					"@meta": map[string]interface{}{
+					"@meta": map[string]any{
 						"time_zone":      "UTC",
 						"api_version":    1,
 						"execution_time": fmt.Sprintf("%d ms", execTime.Milliseconds()),
@@ -273,8 +282,10 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 
 		// For JSON responses, validate the JSON
 		if rw.body.Len() > 0 {
-			var testParse interface{}
-			if err := json.Unmarshal(rw.body.Bytes(), &testParse); err == nil {
+			var testParse any
+
+			err := json.Unmarshal(rw.body.Bytes(), &testParse)
+			if err == nil {
 				// Valid JSON, write it out
 				w.Header().Set("Content-Type", "application/json")
 				w.WriteHeader(rw.statusCode)
@@ -293,6 +304,7 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 		if statusCode == http.StatusOK {
 			statusCode = http.StatusInternalServerError
 		}
+
 		w.WriteHeader(statusCode)
 
 		errorMsg := "Internal server error"
@@ -300,11 +312,11 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 			errorMsg = "Request timeout"
 		}
 
-		response := map[string]interface{}{
-			"status": "error",
-			"error": map[string]interface{}{
-				"msg":  errorMsg,
-				"code": statusCode,
+		response := map[string]any{
+			jsonKeyStatus: jsonStatusError,
+			jsonKeyError: map[string]any{
+				jsonKeyMsg:  errorMsg,
+				jsonKeyCode: statusCode,
 			},
 		}
 		_ = json.NewEncoder(w).Encode(response)
@@ -314,6 +326,7 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 // statusWriter wraps http.ResponseWriter to capture the status code
 type statusWriter struct {
 	http.ResponseWriter
+
 	statusCode int
 	written    bool
 }
@@ -323,6 +336,7 @@ func (sw *statusWriter) WriteHeader(statusCode int) {
 		sw.statusCode = statusCode
 		sw.written = true
 	}
+
 	sw.ResponseWriter.WriteHeader(statusCode)
 }
 
@@ -362,11 +376,12 @@ func RequestLoggerMiddleware(logger *slog.Logger) func(http.Handler) http.Handle
 			// Slow query threshold (1 second)
 			const slowQueryThreshold = 1 * time.Second
 
-			if sw.statusCode >= http.StatusInternalServerError {
+			switch {
+			case sw.statusCode >= http.StatusInternalServerError:
 				logLevel = slog.LevelError
-			} else if sw.statusCode >= http.StatusBadRequest {
+			case sw.statusCode >= http.StatusBadRequest:
 				logLevel = slog.LevelWarn
-			} else if duration >= slowQueryThreshold {
+			case duration >= slowQueryThreshold:
 				logLevel = slog.LevelWarn
 			}
 

internal/server/routes.go

@@ -16,7 +16,9 @@ func (s *Server) setupRoutes() {
 	r.Use(middleware.RealIP)
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
+
 	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
+
 	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
 	r.Use(JSONResponseMiddleware)
 
@@ -24,7 +26,10 @@ func (s *Server) setupRoutes() {
 	r.Get("/", s.handleIndex())
 	r.Get("/status", s.handleStatusHTML())
 	r.Get("/status.json", JSONValidationMiddleware(s.handleStatusJSON()).ServeHTTP)
-	r.Get("/.well-known/healthcheck.json", JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP)
+	r.Get(
+		"/.well-known/healthcheck.json",
+		JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP,
+	)
 
 	// AS and prefix detail pages
 	r.Get("/as/{asn}", s.handleASDetail())

internal/server/server.go

@@ -3,10 +3,12 @@ package server
 
 import (
 	"context"
+	"errors"
 	"net/http"
-	"os"
+	"strconv"
 	"time"
 
+	"git.eeqj.de/sneak/routewatch/internal/config"
 	"git.eeqj.de/sneak/routewatch/internal/database"
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/streamer"
@@ -33,16 +35,23 @@ type Server struct {
 	db         database.Store
 	streamer   *streamer.Streamer
 	logger     *logger.Logger
+	port       int
 	srv        *http.Server
 	asnFetcher ASNFetcher
 }
 
 // New creates a new HTTP server
-func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger) *Server {
+func New(
+	db database.Store,
+	streamer *streamer.Streamer,
+	logger *logger.Logger,
+	cfg *config.Config,
+) *Server {
 	s := &Server{
 		db:       db,
 		streamer: streamer,
 		logger:   logger,
+		port:     cfg.Port,
 	}
 
 	s.setupRoutes()
@@ -52,11 +61,6 @@ func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger)
 
 // Start starts the HTTP server
 func (s *Server) Start() error {
-	port := os.Getenv("PORT")
-	if port == "" {
-		port = "8080"
-	}
-
 	const (
 		readHeaderTimeout = 40 * time.Second
 		readTimeout       = 60 * time.Second
@@ -65,7 +69,7 @@ func (s *Server) Start() error {
 	)
 
 	s.srv = &http.Server{
-		Addr:              ":" + port,
+		Addr:              ":" + strconv.Itoa(s.port),
 		Handler:           s.router,
 		ReadHeaderTimeout: readHeaderTimeout,
 		ReadTimeout:       readTimeout,
@@ -73,12 +77,14 @@ func (s *Server) Start() error {
 		IdleTimeout:       idleTimeout,
 	}
 
-	s.logger.Info("Starting HTTP server", "port", port, "addr", s.srv.Addr)
+	s.logger.Info("Starting HTTP server", "port", s.port, "addr", s.srv.Addr)
 
 	// Start in goroutine but log when actually listening
 	go func() {
 		s.logger.Info("HTTP server listening", "addr", s.srv.Addr)
-		if err := s.srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+
+		err := s.srv.ListenAndServe()
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
 			s.logger.Error("HTTP server error", "error", err)
 		}
 	}()

internal/streamer/streamer.go

@@ -1,5 +1,6 @@
-// Package streamer implements an HTTP client that connects to the RIPE RIS Live streaming API,
-// parses BGP UPDATE messages from the JSON stream, and dispatches them to registered handlers.
+// Package streamer implements an HTTP client that connects to the RIPE RIS Live
+// streaming API, parses BGP UPDATE messages from the JSON stream, and
+// dispatches them to registered handlers.
 package streamer
 
 import (
@@ -7,6 +8,7 @@ import (
 	"compress/gzip"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -24,20 +26,20 @@ import (
 // countingReader wraps an io.Reader and counts bytes read
 type countingReader struct {
 	reader io.Reader
-	count  int64
+	count  atomic.Int64
 }
 
 // Read implements io.Reader and counts bytes
 func (c *countingReader) Read(p []byte) (int, error) {
 	n, err := c.reader.Read(p)
-	atomic.AddInt64(&c.count, int64(n))
+	c.count.Add(int64(n))
 
 	return n, err
 }
 
 // Count returns the total bytes read
 func (c *countingReader) Count() int64 {
-	return atomic.LoadInt64(&c.count)
+	return c.count.Load()
 }
 
 // Configuration constants for the RIS Live streamer.
@@ -58,11 +60,17 @@ const (
 	backpressureSlope     = 2.0 // Slope for linear drop probability increase
 )
 
+var (
+	errAlreadyRunning   = errors.New("streamer already running")
+	errUnexpectedStatus = errors.New("unexpected status code")
+)
+
 // MessageHandler defines the interface for processing RIS messages.
 // Implementations must specify which message types they want to receive,
 // how to process messages, and their desired queue capacity.
 type MessageHandler interface {
-	// WantsMessage returns true if this handler wants to process messages of the given type.
+	// WantsMessage returns true if this handler wants to process messages of
+	// the given type.
 	WantsMessage(messageType string) bool
 
 	// HandleMessage processes a RIS message. This method is called from a dedicated
@@ -113,7 +121,7 @@ type Streamer struct {
 	cancel       context.CancelFunc
 	running      bool
 	metrics      *metrics.Tracker
-	totalDropped uint64          // Total dropped messages across all handlers
+	totalDropped atomic.Uint64   // Total dropped messages across all handlers
 	random       *rand.Rand      // Random number generator for backpressure drops
 	bgpPeers     map[string]bool // Track active BGP peers by peer IP
 	bgpPeersMu   sync.RWMutex    // Protects bgpPeers map
@@ -121,7 +129,8 @@ type Streamer struct {
 
 // New creates a new Streamer instance configured to connect to the RIS Live API.
 // The logger is used for structured logging of connection events and errors.
-// The metrics tracker is used to record message counts, bytes received, and connection status.
+// The metrics tracker is used to record message counts, bytes received, and
+// connection status.
 func New(logger *logger.Logger, metrics *metrics.Tracker) *Streamer {
 	return &Streamer{
 		logger: logger,
@@ -153,7 +162,8 @@ func (s *Streamer) RegisterHandler(handler MessageHandler) {
 		handler: handler,
 		queue:   make(chan *ristypes.RISMessage, handler.QueueCapacity()),
 		metrics: handlerMetrics{
-			minTime: time.Duration(math.MaxInt64), // Initialize to max so first value sets the floor
+			// Initialize to max so first value sets the floor
+			minTime: time.Duration(math.MaxInt64),
 		},
 	}
 
@@ -171,22 +181,24 @@ func (s *Streamer) RegisterHandler(handler MessageHandler) {
 func (s *Streamer) RegisterRawHandler(handler RawMessageHandler) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+
 	s.rawHandler = handler
 }
 
 // Start begins streaming BGP updates from the RIS Live API in a background goroutine.
 // It starts worker goroutines for each registered handler and manages automatic
 // reconnection with exponential backoff on connection failures.
-// Returns an error if the streamer is already running.
-func (s *Streamer) Start() error {
+// Returns an error if the streamer is already running. It streams until Stop:
+// the end of ctx does not stop it.
+func (s *Streamer) Start(ctx context.Context) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	if s.running {
-		return fmt.Errorf("streamer already running")
+		return errAlreadyRunning
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(context.WithoutCancel(ctx))
 	s.cancel = cancel
 	s.running = true
 
@@ -210,45 +222,27 @@ func (s *Streamer) Start() error {
 // the connection status in metrics. This method is safe to call multiple times.
 func (s *Streamer) Stop() {
 	s.mu.Lock()
-	if s.cancel != nil {
-		s.cancel()
+	if s.cancel == nil {
+		// Not started, or already stopped: closing the queues again would panic.
+		s.mu.Unlock()
+
+		return
 	}
+
+	s.cancel()
+	s.cancel = nil
 	// Close all handler queues to signal workers to stop
 	for _, info := range s.handlers {
 		close(info.queue)
 	}
+
 	s.running = false
 	s.mu.Unlock()
 	s.metrics.SetConnected(false)
 }
 
-// runHandlerWorker processes messages for a specific handler
-func (s *Streamer) runHandlerWorker(info *handlerInfo) {
-	for msg := range info.queue {
-		start := time.Now()
-		info.handler.HandleMessage(msg)
-		elapsed := time.Since(start)
-
-		// Update metrics
-		info.metrics.mu.Lock()
-		info.metrics.processedCount++
-		info.metrics.totalTime += elapsed
-
-		// Update min time
-		if elapsed < info.metrics.minTime {
-			info.metrics.minTime = elapsed
-		}
-
-		// Update max time
-		if elapsed > info.metrics.maxTime {
-			info.metrics.maxTime = elapsed
-		}
-		info.metrics.mu.Unlock()
-	}
-}
-
-// IsRunning reports whether the streamer is currently connected and processing messages.
-// This is safe to call concurrently from multiple goroutines.
+// IsRunning reports whether the streamer is currently connected and processing
+// messages. This is safe to call concurrently from multiple goroutines.
 func (s *Streamer) IsRunning() bool {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
@@ -309,12 +303,15 @@ func (s *Streamer) GetHandlerStats() []HandlerStats {
 		// Calculate average time
 		if info.metrics.processedCount > 0 {
 			processedCount := info.metrics.processedCount
+
 			const maxInt64 = 1<<63 - 1
+
 			if processedCount > maxInt64 {
 				processedCount = maxInt64
 			}
-			//nolint:gosec // processedCount is explicitly bounded above
-			hs.AvgProcessTime = info.metrics.totalTime / time.Duration(processedCount)
+
+			hs.AvgProcessTime = info.metrics.totalTime /
+				time.Duration(processedCount)
 		}
 
 		info.metrics.mu.Unlock()
@@ -325,11 +322,38 @@ func (s *Streamer) GetHandlerStats() []HandlerStats {
 	return stats
 }
 
-// GetDroppedMessages returns the total number of messages dropped across all handlers
-// due to queue overflow or backpressure. This counter is monotonically increasing
-// and is safe to call concurrently.
+// GetDroppedMessages returns the total number of messages dropped across all
+// handlers due to queue overflow or backpressure. This counter is monotonically
+// increasing and is safe to call concurrently.
 func (s *Streamer) GetDroppedMessages() uint64 {
-	return atomic.LoadUint64(&s.totalDropped)
+	return s.totalDropped.Load()
+}
+
+// runHandlerWorker processes messages for a specific handler
+func (s *Streamer) runHandlerWorker(info *handlerInfo) {
+	for msg := range info.queue {
+		start := time.Now()
+
+		info.handler.HandleMessage(msg)
+
+		elapsed := time.Since(start)
+
+		// Update metrics
+		info.metrics.mu.Lock()
+		info.metrics.processedCount++
+		info.metrics.totalTime += elapsed
+
+		// Update min time
+		if elapsed < info.metrics.minTime {
+			info.metrics.minTime = elapsed
+		}
+
+		// Update max time
+		if elapsed > info.metrics.maxTime {
+			info.metrics.maxTime = elapsed
+		}
+		info.metrics.mu.Unlock()
+	}
 }
 
 // logMetrics logs the current streaming statistics
@@ -338,7 +362,8 @@ func (s *Streamer) logMetrics() {
 	uptime := time.Since(metrics.ConnectedSince)
 
 	const bitsPerMegabit = 1000000
-	totalDropped := atomic.LoadUint64(&s.totalDropped)
+
+	totalDropped := s.totalDropped.Load()
 
 	s.logger.Info(
 		"Stream statistics",
@@ -364,16 +389,19 @@ func (s *Streamer) logMetrics() {
 
 	// Log per-handler statistics
 	s.mu.RLock()
+
 	for i, info := range s.handlers {
 		info.metrics.mu.Lock()
 		if info.metrics.processedCount > 0 {
 			// Safe conversion: processedCount is bounded by maxInt64
 			processedCount := info.metrics.processedCount
+
 			const maxInt64 = 1<<63 - 1
+
 			if processedCount > maxInt64 {
 				processedCount = maxInt64
 			}
-			//nolint:gosec // processedCount is explicitly bounded above
+
 			avgTime := info.metrics.totalTime / time.Duration(processedCount)
 			s.logger.Info(
 				"Handler statistics",
@@ -390,6 +418,7 @@ func (s *Streamer) logMetrics() {
 		}
 		info.metrics.mu.Unlock()
 	}
+
 	s.mu.RUnlock()
 }
 
@@ -398,7 +427,8 @@ func (s *Streamer) updateMetrics(messageBytes int) {
 	s.metrics.RecordMessage(int64(messageBytes))
 }
 
-// streamWithReconnect handles streaming with automatic reconnection and exponential backoff
+// streamWithReconnect handles streaming with automatic reconnection and
+// exponential backoff
 func (s *Streamer) streamWithReconnect(ctx context.Context) {
 	backoffDelay := minBackoffDelay
 	consecutiveFailures := 0
@@ -439,6 +469,7 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 		if streamDuration > 30*time.Second {
 			s.logger.Info("Resetting backoff delay due to successful connection",
 				"stream_duration", streamDuration)
+
 			backoffDelay = minBackoffDelay
 			consecutiveFailures = 0
 		} else {
@@ -472,7 +503,7 @@ func (s *Streamer) stream(ctx context.Context) error {
 	connCtx, connCancel := context.WithCancel(ctx)
 	defer connCancel()
 
-	req, err := http.NewRequestWithContext(ctx, "GET", s.url, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, s.url, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -485,13 +516,14 @@ func (s *Streamer) stream(ctx context.Context) error {
 		return fmt.Errorf("failed to connect to RIS Live: %w", err)
 	}
 	defer func() {
-		if err := resp.Body.Close(); err != nil {
+		err := resp.Body.Close()
+		if err != nil {
 			s.logger.Error("Failed to close response body", "error", err)
 		}
 	}()
 
 	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("unexpected status code: %d", resp.StatusCode)
+		return fmt.Errorf("%w: %d", errUnexpectedStatus, resp.StatusCode)
 	}
 
 	// Wrap body with counting reader to track actual wire bytes
@@ -505,7 +537,9 @@ func (s *Streamer) stream(ctx context.Context) error {
 			return fmt.Errorf("failed to create gzip reader: %w", err)
 		}
 		defer func() { _ = gzReader.Close() }()
+
 		reader = gzReader
+
 		s.logger.Info("Connected to RIS Live stream", "compression", "gzip")
 	} else {
 		s.logger.Info("Connected to RIS Live stream", "compression", "none")
@@ -513,9 +547,6 @@ func (s *Streamer) stream(ctx context.Context) error {
 
 	s.metrics.SetConnected(true)
 
-	// Track wire bytes for metrics updates
-	var lastWireBytes int64
-
 	// Start metrics logging goroutine
 	metricsTicker := time.NewTicker(metricsLogInterval)
 	defer metricsTicker.Stop()
@@ -532,25 +563,41 @@ func (s *Streamer) stream(ctx context.Context) error {
 	}()
 
 	// Wire byte update ticker - update metrics with actual wire bytes periodically
+	go s.recordWireBytes(connCtx, wireCounter)
+
+	return s.readStream(ctx, reader)
+}
+
+// recordWireBytes adds the bytes wireCounter has counted to the metrics once a
+// second until ctx is cancelled.
+func (s *Streamer) recordWireBytes(
+	ctx context.Context, wireCounter *countingReader,
+) {
 	wireUpdateTicker := time.NewTicker(time.Second)
 	defer wireUpdateTicker.Stop()
 
-	go func() {
-		for {
-			select {
-			case <-wireUpdateTicker.C:
-				currentBytes := wireCounter.Count()
-				delta := currentBytes - lastWireBytes
-				if delta > 0 {
-					s.metrics.RecordWireBytes(delta)
-					lastWireBytes = currentBytes
-				}
-			case <-connCtx.Done():
-				return
-			}
-		}
-	}()
+	var lastWireBytes int64
 
+	for {
+		select {
+		case <-wireUpdateTicker.C:
+			currentBytes := wireCounter.Count()
+
+			delta := currentBytes - lastWireBytes
+			if delta > 0 {
+				s.metrics.RecordWireBytes(delta)
+
+				lastWireBytes = currentBytes
+			}
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+// readStream hands each line of the stream to processLine until the stream
+// ends, a line fails, or ctx is cancelled.
+func (s *Streamer) readStream(ctx context.Context, reader io.Reader) error {
 	scanner := bufio.NewScanner(reader)
 
 	for scanner.Scan() {
@@ -567,142 +614,176 @@ func (s *Streamer) stream(ctx context.Context) error {
 			continue
 		}
 
-		// Update metrics with decompressed message size
-		s.updateMetrics(len(line))
-
-		// Call raw handler if registered
-		s.mu.RLock()
-		rawHandler := s.rawHandler
-		s.mu.RUnlock()
-
-		if rawHandler != nil {
-			// Call raw handler synchronously to preserve order
-			rawHandler(string(line))
+		err := s.processLine(ctx, line)
+		if err != nil {
+			return err
 		}
-
-		// Parse the message first
-		var wrapper ristypes.RISLiveMessage
-		if err := json.Unmarshal(line, &wrapper); err != nil {
-			// Log the error and return to trigger reconnection
-			s.logger.Error("Failed to parse JSON",
-				"error", err,
-				"line", string(line),
-				"line_length", len(line))
-
-			return fmt.Errorf("JSON parse error: %w", err)
-		}
-
-		// Check if it's a ris_message wrapper
-		if wrapper.Type != "ris_message" {
-			s.logger.Error("Unexpected wrapper type",
-				"type", wrapper.Type,
-				"line", string(line),
-			)
-
-			continue
-		}
-
-		// Get the actual message
-		msg := wrapper.Data
-
-		// Parse the timestamp
-		msg.ParsedTimestamp = time.Unix(int64(msg.Timestamp), 0).UTC()
-
-		// Process based on message type
-		switch msg.Type {
-		case "UPDATE":
-			// Process BGP UPDATE messages
-			// Will be dispatched to handlers
-		case "RIS_PEER_STATE":
-			// RIS peer state messages - silently ignore
-			continue
-		case "KEEPALIVE":
-			// BGP keepalive messages - silently process
-			continue
-		case "OPEN":
-			// BGP open messages - track peer as active
-			s.bgpPeersMu.Lock()
-			s.bgpPeers[msg.Peer] = true
-			peerCount := len(s.bgpPeers)
-			s.bgpPeersMu.Unlock()
-			s.metrics.SetBGPPeerCount(peerCount)
-
-			s.logger.Info("BGP session opened",
-				"peer", msg.Peer,
-				"peer_asn", msg.PeerASN,
-				"total_peers", peerCount,
-			)
-
-			continue
-		case "NOTIFICATION":
-			// BGP notification messages (session closed)
-			s.bgpPeersMu.Lock()
-			delete(s.bgpPeers, msg.Peer)
-			peerCount := len(s.bgpPeers)
-			s.bgpPeersMu.Unlock()
-			s.metrics.SetBGPPeerCount(peerCount)
-
-			s.logger.Warn("BGP notification",
-				"peer", msg.Peer,
-				"peer_asn", msg.PeerASN,
-				"total_peers", peerCount,
-			)
-
-			continue
-		case "STATE":
-			// Peer state changes - silently ignore
-			continue
-		default:
-			s.logger.Warn("Unknown message type, skipping",
-				"type", msg.Type,
-			)
-
-			continue
-		}
-
-		// Dispatch to interested handlers
-		s.mu.RLock()
-		for _, info := range s.handlers {
-			if !info.handler.WantsMessage(msg.Type) {
-				continue
-			}
-
-			// Check if we should drop due to backpressure
-			if s.shouldDropForBackpressure(info) {
-				atomic.AddUint64(&info.metrics.droppedCount, 1)
-				atomic.AddUint64(&s.totalDropped, 1)
-
-				continue
-			}
-
-			// Try to queue the message
-			select {
-			case info.queue <- &msg:
-				// Message queued successfully
-				// Update high water mark if needed
-				queueLen := len(info.queue)
-				info.metrics.mu.Lock()
-				if queueLen > info.metrics.queueHighWaterMark {
-					info.metrics.queueHighWaterMark = queueLen
-				}
-				info.metrics.mu.Unlock()
-			default:
-				// Queue is full, drop the message
-				atomic.AddUint64(&info.metrics.droppedCount, 1)
-				atomic.AddUint64(&s.totalDropped, 1)
-			}
-		}
-		s.mu.RUnlock()
 	}
 
-	if err := scanner.Err(); err != nil {
+	err := scanner.Err()
+	if err != nil {
 		return fmt.Errorf("scanner error: %w", err)
 	}
 
 	return nil
 }
 
-// shouldDropForBackpressure determines if a message should be dropped based on queue utilization
+// processLine passes one line of the stream to the raw handler, parses it,
+// and dispatches an UPDATE message to the handlers. An error ends the
+// connection.
+func (s *Streamer) processLine(ctx context.Context, line []byte) error {
+	// Update metrics with decompressed message size
+	s.updateMetrics(len(line))
+
+	// Call raw handler if registered
+	s.mu.RLock()
+	rawHandler := s.rawHandler
+	s.mu.RUnlock()
+
+	if rawHandler != nil {
+		// Call raw handler synchronously to preserve order
+		rawHandler(string(line))
+	}
+
+	// Parse the message first
+	var wrapper ristypes.RISLiveMessage
+
+	err := json.Unmarshal(line, &wrapper)
+	if err != nil {
+		// Log the error and return to trigger reconnection
+		s.logger.Error("Failed to parse JSON",
+			"error", err,
+			"line", string(line),
+			"line_length", len(line))
+
+		return fmt.Errorf("JSON parse error: %w", err)
+	}
+
+	// Check if it's a ris_message wrapper
+	if wrapper.Type != "ris_message" {
+		s.logger.Error("Unexpected wrapper type",
+			"type", wrapper.Type,
+			"line", string(line),
+		)
+
+		return nil
+	}
+
+	// Get the actual message
+	msg := wrapper.Data
+
+	// Parse the timestamp
+	msg.ParsedTimestamp = time.Unix(int64(msg.Timestamp), 0).UTC()
+
+	// Process based on message type
+	switch msg.Type {
+	case "UPDATE":
+		// Process BGP UPDATE messages
+		// Will be dispatched to handlers
+	case "RIS_PEER_STATE":
+		// RIS peer state messages - silently ignore
+		return nil
+	case "KEEPALIVE":
+		// BGP keepalive messages - silently process
+		return nil
+	case "OPEN":
+		// BGP open messages - track peer as active
+		s.bgpPeersMu.Lock()
+		s.bgpPeers[msg.Peer] = true
+		peerCount := len(s.bgpPeers)
+		s.bgpPeersMu.Unlock()
+		s.metrics.SetBGPPeerCount(peerCount)
+
+		s.logger.Info("BGP session opened",
+			"peer", msg.Peer,
+			"peer_asn", msg.PeerASN,
+			"total_peers", peerCount,
+		)
+
+		return nil
+	case "NOTIFICATION":
+		// BGP notification messages (session closed)
+		s.bgpPeersMu.Lock()
+		delete(s.bgpPeers, msg.Peer)
+		peerCount := len(s.bgpPeers)
+		s.bgpPeersMu.Unlock()
+		s.metrics.SetBGPPeerCount(peerCount)
+
+		s.logger.Warn("BGP notification",
+			"peer", msg.Peer,
+			"peer_asn", msg.PeerASN,
+			"total_peers", peerCount,
+		)
+
+		return nil
+	case "STATE":
+		// Peer state changes - silently ignore
+		return nil
+	default:
+		s.logger.Warn("Unknown message type, skipping",
+			"type", msg.Type,
+		)
+
+		return nil
+	}
+
+	return s.dispatchMessage(ctx, &msg)
+}
+
+// dispatchMessage queues msg for each handler that wants it, dropping it for
+// a handler whose queue is full or under backpressure.
+func (s *Streamer) dispatchMessage(
+	ctx context.Context, msg *ristypes.RISMessage,
+) error {
+	// Stop cancels ctx and closes the queues under the write lock, so if ctx
+	// is cancelled here, under the read lock, the queues are closed and must
+	// not be sent to.
+	s.mu.RLock()
+
+	if ctx.Err() != nil {
+		s.mu.RUnlock()
+
+		return ctx.Err()
+	}
+
+	for _, info := range s.handlers {
+		if !info.handler.WantsMessage(msg.Type) {
+			continue
+		}
+
+		// Check if we should drop due to backpressure
+		if s.shouldDropForBackpressure(info) {
+			atomic.AddUint64(&info.metrics.droppedCount, 1)
+			s.totalDropped.Add(1)
+
+			continue
+		}
+
+		// Try to queue the message
+		select {
+		case info.queue <- msg:
+			// Message queued successfully
+			// Update high water mark if needed
+			queueLen := len(info.queue)
+			info.metrics.mu.Lock()
+			if queueLen > info.metrics.queueHighWaterMark {
+				info.metrics.queueHighWaterMark = queueLen
+			}
+			info.metrics.mu.Unlock()
+		default:
+			// Queue is full, drop the message
+			atomic.AddUint64(&info.metrics.droppedCount, 1)
+			s.totalDropped.Add(1)
+		}
+	}
+
+	s.mu.RUnlock()
+
+	return nil
+}
+
+// shouldDropForBackpressure determines if a message should be dropped based on
+// queue utilization
 func (s *Streamer) shouldDropForBackpressure(info *handlerInfo) bool {
 	// Calculate queue utilization
 	queueLen := len(info.queue)

internal/streamer/streamer_internal_test.go

@@ -2,6 +2,8 @@ package streamer
 
 import (
 	"context"
+	"errors"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"runtime"
@@ -10,9 +12,12 @@ import (
 
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
 )
 
 func TestNewStreamer(t *testing.T) {
+	t.Parallel()
+
 	logger := logger.New()
 	metricsTracker := metrics.New()
 	s := New(logger, metricsTracker)
@@ -43,10 +48,13 @@ func TestNewStreamer(t *testing.T) {
 // goroutine count returns to its starting value. Each connection starts two
 // ticker goroutines; before the fix they lived until the streamer's lifetime
 // context was cancelled, so every reconnect leaked two.
+//
+//nolint:paralleltest // counts goroutines, so no other test may run alongside
 func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 	// The handler returns immediately, so the response body is empty and each
 	// stream call ends at once, standing in for a dropped connection.
-	srv := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {}))
+	srv := httptest.NewServer(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {}))
 	defer srv.Close()
 
 	s := New(logger.New(), metrics.New())
@@ -54,19 +62,23 @@ func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 
 	// One warm-up connection so any persistent HTTP transport goroutine exists
 	// before we take the baseline.
-	if err := s.stream(context.Background()); err != nil {
+	err := s.stream(context.Background())
+	if err != nil {
 		t.Fatalf("warm-up stream returned error: %v", err)
 	}
+
 	s.client.CloseIdleConnections()
 
 	baseline := settledGoroutineCount()
 
 	const reconnects = 20
 	for range reconnects {
-		if err := s.stream(context.Background()); err != nil {
+		err := s.stream(context.Background())
+		if err != nil {
 			t.Fatalf("stream returned error: %v", err)
 		}
 	}
+
 	s.client.CloseIdleConnections()
 
 	if !waitForGoroutines(baseline) {
@@ -75,16 +87,67 @@ func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 	}
 }
 
+// updateHandler wants UPDATE messages and does nothing with them.
+type updateHandler struct{}
+
+func (updateHandler) WantsMessage(messageType string) bool {
+	return messageType == "UPDATE"
+}
+
+func (updateHandler) HandleMessage(*ristypes.RISMessage) {}
+
+func (updateHandler) QueueCapacity() int { return 10 }
+
+// TestStopBeforeMessageReachesQueues stops the streamer after the read loop
+// has checked for cancellation but before it hands the message to the handler
+// queues. That is the gap a stop from another goroutine can land in, and it
+// used to end in "send on closed channel". The raw handler runs in that gap on
+// the read loop itself, so calling Stop from it hits the gap every time.
+func TestStopBeforeMessageReachesQueues(t *testing.T) {
+	t.Parallel()
+
+	const line = `{"type":"ris_message","data":{"type":"UPDATE",` +
+		`"peer":"192.0.2.1","peer_asn":"64496","timestamp":1700000000}}` + "\n"
+
+	srv := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = io.WriteString(w, line)
+		}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+	s.RegisterHandler(updateHandler{})
+	s.RegisterRawHandler(func(string) { s.Stop() })
+
+	// Start would run the stream in the background, where the test cannot
+	// wait for it. Setting cancel as Start does lets Stop cancel the stream
+	// run here instead.
+	ctx, cancel := context.WithCancel(context.Background())
+	s.cancel = cancel
+
+	err := s.stream(ctx)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("stream returned %v, want %v", err, context.Canceled)
+	}
+
+	// A second Stop must not close the queues again.
+	s.Stop()
+}
+
 // settledGoroutineCount lets transient goroutines finish, then reports the
 // current count.
 func settledGoroutineCount() int {
 	prev := runtime.NumGoroutine()
+
 	for range 20 {
 		time.Sleep(10 * time.Millisecond)
+
 		cur := runtime.NumGoroutine()
 		if cur == prev {
 			return cur
 		}
+
 		prev = cur
 	}
 
@@ -97,6 +160,7 @@ func waitForGoroutines(target int) bool {
 		if runtime.NumGoroutine() <= target {
 			return true
 		}
+
 		time.Sleep(10 * time.Millisecond)
 	}
 

internal/templates/templates.go

@@ -60,6 +60,7 @@ func timeSince(t time.Time) string {
 	if duration < time.Minute {
 		return "just now"
 	}
+
 	if duration < time.Hour {
 		minutes := int(duration.Minutes())
 		if minutes == 1 {
@@ -68,6 +69,7 @@ func timeSince(t time.Time) string {
 
 		return duration.Truncate(time.Minute).String() + " ago"
 	}
+
 	if duration < hoursPerDay*time.Hour {
 		hours := int(duration.Hours())
 		if hours == 1 {
@@ -76,10 +78,12 @@ func timeSince(t time.Time) string {
 
 		return duration.Truncate(time.Hour).String() + " ago"
 	}
+
 	days := int(duration.Hours() / hoursPerDay)
 	if days == 1 {
 		return "1 day ago"
 	}
+
 	if days < daysPerMonth {
 		return duration.Truncate(hoursPerDay*time.Hour).String() + " ago"
 	}
@@ -118,7 +122,7 @@ func initTemplates() {
 		"appLicense":      func() string { return version.License },
 		"appRepoURL":      func() string { return version.RepoURL },
 		"appGitRevision":  func() string { return version.GitRevisionShort },
-		"appGitCommitURL": func() string { return version.CommitURL() },
+		"appGitCommitURL": version.CommitURL,
 	}
 
 	// Parse index template
@@ -134,19 +138,22 @@ func initTemplates() {
 	}
 
 	// Parse AS detail template
-	defaultTemplates.ASDetail, err = template.New("asDetail").Funcs(funcs).Parse(asDetailHTML)
+	defaultTemplates.ASDetail, err = template.New("asDetail").
+		Funcs(funcs).Parse(asDetailHTML)
 	if err != nil {
 		panic("failed to parse AS detail template: " + err.Error())
 	}
 
 	// Parse prefix detail template
-	defaultTemplates.PrefixDetail, err = template.New("prefixDetail").Funcs(funcs).Parse(prefixDetailHTML)
+	defaultTemplates.PrefixDetail, err = template.New("prefixDetail").
+		Funcs(funcs).Parse(prefixDetailHTML)
 	if err != nil {
 		panic("failed to parse prefix detail template: " + err.Error())
 	}
 
 	// Parse prefix length template
-	defaultTemplates.PrefixLength, err = template.New("prefixLength").Funcs(funcs).Parse(prefixLengthHTML)
+	defaultTemplates.PrefixLength, err = template.New("prefixLength").
+		Funcs(funcs).Parse(prefixLengthHTML)
 	if err != nil {
 		panic("failed to parse prefix length template: " + err.Error())
 	}

internal/version/version.go

@@ -3,11 +3,12 @@ package version
 
 // Build-time variables set via ldflags
 //
-//nolint:gochecknoglobals // These must be variables to allow ldflags injection at build time
+//nolint:gochecknoglobals // variables so that ldflags can set them at build time
 var (
 	// GitRevision is the git commit hash
 	GitRevision = "unknown"
-	// GitRevisionShort is the short git commit hash (7 chars)
+	// GitRevisionShort is the version the page footer shows: the tag or
+	// short commit hash from `git describe --tags --always`
 	GitRevisionShort = "unknown"
 )
 

internal/whois/whois.go

@@ -98,7 +98,8 @@ func (c *Client) LookupASN(ctx context.Context, asn int) (*ASNInfo, error) {
 	if err != nil {
 		// Return partial data from IANA if RIR query fails
 		info := c.parseResponse(asn, rir, ianaResp)
-		info.RawResponse = ianaResp + "\n--- RIR query failed: " + err.Error() + " ---\n"
+		info.RawResponse = fmt.Sprintf("%s\n--- RIR query failed: %v ---\n",
+			ianaResp, err)
 
 		return info, nil
 	}
@@ -120,28 +121,33 @@ func (c *Client) query(ctx context.Context, server, query string) (string, error
 	defer func() { _ = conn.Close() }()
 
 	// Set deadlines
-	if err := conn.SetWriteDeadline(time.Now().Add(writeTimeout)); err != nil {
+	err = conn.SetWriteDeadline(time.Now().Add(writeTimeout))
+	if err != nil {
 		return "", fmt.Errorf("set write deadline: %w", err)
 	}
 
 	// Send query
-	if _, err := fmt.Fprintf(conn, "%s\r\n", query); err != nil {
+	_, err = fmt.Fprintf(conn, "%s\r\n", query)
+	if err != nil {
 		return "", fmt.Errorf("write query: %w", err)
 	}
 
 	// Read response
-	if err := conn.SetReadDeadline(time.Now().Add(readTimeout)); err != nil {
+	err = conn.SetReadDeadline(time.Now().Add(readTimeout))
+	if err != nil {
 		return "", fmt.Errorf("set read deadline: %w", err)
 	}
 
 	var sb strings.Builder
+
 	scanner := bufio.NewScanner(conn)
 	for scanner.Scan() {
 		sb.WriteString(scanner.Text())
 		sb.WriteString("\n")
 	}
 
-	if err := scanner.Err(); err != nil {
+	err = scanner.Err()
+	if err != nil {
 		return sb.String(), fmt.Errorf("read response: %w", err)
 	}
 
@@ -149,10 +155,10 @@ func (c *Client) query(ctx context.Context, server, query string) (string, error
 }
 
 // parseIANAReferral extracts the RIR and WHOIS server from an IANA response.
-func (c *Client) parseIANAReferral(response string) (rir, whoisServer string) {
-	lines := strings.Split(response, "\n")
+func (c *Client) parseIANAReferral(response string) (string, string) {
+	var rir string
 
-	for _, line := range lines {
+	for line := range strings.SplitSeq(response, "\n") {
 		line = strings.TrimSpace(line)
 
 		// Look for "refer:" line
@@ -183,18 +189,9 @@ func (c *Client) parseIANAReferral(response string) (rir, whoisServer string) {
 
 		// Also check organisation line for RIR hints
 		if strings.HasPrefix(strings.ToLower(line), "organisation:") {
-			org := strings.ToLower(line)
-			switch {
-			case strings.Contains(org, "arin"):
-				rir = RIRARIN
-			case strings.Contains(org, "ripe"):
-				rir = RIRRIPE
-			case strings.Contains(org, "apnic"):
-				rir = RIRAPNIC
-			case strings.Contains(org, "lacnic"):
-				rir = RIRLACNIC
-			case strings.Contains(org, "afrinic"):
-				rir = RIRAFRNIC
+			orgRIR := rirInOrganisationLine(strings.ToLower(line))
+			if orgRIR != "" {
+				rir = orgRIR
 			}
 		}
 	}
@@ -202,6 +199,25 @@ func (c *Client) parseIANAReferral(response string) (rir, whoisServer string) {
 	return rir, ""
 }
 
+// rirInOrganisationLine returns the RIR a lowercased IANA "organisation:"
+// line names, or "" when it names none.
+func rirInOrganisationLine(org string) string {
+	switch {
+	case strings.Contains(org, "arin"):
+		return RIRARIN
+	case strings.Contains(org, "ripe"):
+		return RIRRIPE
+	case strings.Contains(org, "apnic"):
+		return RIRAPNIC
+	case strings.Contains(org, "lacnic"):
+		return RIRLACNIC
+	case strings.Contains(org, "afrinic"):
+		return RIRAFRNIC
+	default:
+		return ""
+	}
+}
+
 // parseResponse extracts ASN information from a WHOIS response.
 func (c *Client) parseResponse(asn int, rir, response string) *ASNInfo {
 	info := &ASNInfo{
@@ -211,11 +227,13 @@ func (c *Client) parseResponse(asn int, rir, response string) *ASNInfo {
 	}
 
 	lines := strings.Split(response, "\n")
+
 	var addressLines []string
 
 	for _, line := range lines {
 		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "%") || strings.HasPrefix(line, "#") {
+		if line == "" || strings.HasPrefix(line, "%") ||
+			strings.HasPrefix(line, "#") {
 			continue
 		}
 
@@ -232,63 +250,14 @@ func (c *Client) parseResponse(asn int, rir, response string) *ASNInfo {
 			continue
 		}
 
-		switch key {
-		// AS Name (varies by RIR)
-		case "asname", "as-name":
-			if info.ASName == "" {
-				info.ASName = value
-			}
-
-		// Organization
-		case "orgname", "org-name", "owner":
-			if info.OrgName == "" {
-				info.OrgName = value
-			}
-		case "orgid", "org-id", "org":
-			if info.OrgID == "" {
-				info.OrgID = value
-			}
-
 		// Address (collect multiple lines)
-		case "address":
+		if key == "address" {
 			addressLines = append(addressLines, value)
 
-		// Country
-		case "country":
-			if info.CountryCode == "" && len(value) == 2 {
-				info.CountryCode = strings.ToUpper(value)
-			}
-
-		// Abuse contact
-		case "orgabuseemail", "abuse-mailbox":
-			if info.AbuseEmail == "" {
-				info.AbuseEmail = value
-			}
-		case "orgabusephone":
-			if info.AbusePhone == "" {
-				info.AbusePhone = value
-			}
-
-		// Tech contact
-		case "orgtechemail":
-			if info.TechEmail == "" {
-				info.TechEmail = value
-			}
-		case "orgtechphone":
-			if info.TechPhone == "" {
-				info.TechPhone = value
-			}
-
-		// Registration dates
-		case "regdate", "created":
-			if info.RegDate == nil {
-				info.RegDate = c.parseDate(value)
-			}
-		case "updated", "last-modified", "changed":
-			if info.LastMod == nil {
-				info.LastMod = c.parseDate(value)
-			}
+			continue
 		}
+
+		c.setResponseField(info, key, value)
 	}
 
 	// Combine address lines
@@ -304,6 +273,65 @@ func (c *Client) parseResponse(asn int, rir, response string) *ASNInfo {
 	return info
 }
 
+// setResponseField stores the value of one "key: value" line of a WHOIS
+// response in info, keeping the first value seen for each field.
+func (c *Client) setResponseField(info *ASNInfo, key, value string) {
+	switch key {
+	// Country
+	case "country":
+		if info.CountryCode == "" && len(value) == 2 {
+			info.CountryCode = strings.ToUpper(value)
+		}
+
+	// Registration dates
+	case "regdate", "created":
+		if info.RegDate == nil {
+			info.RegDate = c.parseDate(value)
+		}
+	case "updated", "last-modified", "changed":
+		if info.LastMod == nil {
+			info.LastMod = c.parseDate(value)
+		}
+
+	default:
+		field := textFieldForKey(info, key)
+		if field != nil && *field == "" {
+			*field = value
+		}
+	}
+}
+
+// textFieldForKey returns the text field of info that a WHOIS response key
+// fills, or nil when the key fills none.
+func textFieldForKey(info *ASNInfo, key string) *string {
+	switch key {
+	// AS Name (varies by RIR)
+	case "asname", "as-name":
+		return &info.ASName
+
+	// Organization
+	case "orgname", "org-name", "owner":
+		return &info.OrgName
+	case "orgid", "org-id", "org":
+		return &info.OrgID
+
+	// Abuse contact
+	case "orgabuseemail", "abuse-mailbox":
+		return &info.AbuseEmail
+	case "orgabusephone":
+		return &info.AbusePhone
+
+	// Tech contact
+	case "orgtechemail":
+		return &info.TechEmail
+	case "orgtechphone":
+		return &info.TechPhone
+
+	default:
+		return nil
+	}
+}
+
 // parseDate attempts to parse various date formats used in WHOIS responses.
 func (c *Client) parseDate(value string) *time.Time {
 	// Common formats
@@ -319,15 +347,15 @@ func (c *Client) parseDate(value string) *time.Time {
 	value = strings.TrimSpace(value)
 	// Handle "YYYYMMDD" format from LACNIC
 	if len(value) == lacnicDateFormatLen {
-		if _, err := time.Parse("20060102", value); err == nil {
-			t, _ := time.Parse("20060102", value)
-
+		t, err := time.Parse("20060102", value)
+		if err == nil {
 			return &t
 		}
 	}
 
 	for _, format := range formats {
-		if t, err := time.Parse(format, value); err == nil {
+		t, err := time.Parse(format, value)
+		if err == nil {
 			return &t
 		}
 	}

pkg/asinfo/asinfo.go

@@ -1,4 +1,3 @@
-// Package asinfo provides information about Autonomous Systems (AS)
 package asinfo
 
 import (
@@ -54,7 +53,9 @@ func initRegistry() {
 	}
 
 	var asInfos []Info
-	if err := json.Unmarshal(jsonData, &asInfos); err != nil {
+
+	err = json.Unmarshal(jsonData, &asInfos)
+	if err != nil {
 		panic("failed to unmarshal embedded AS data: " + err.Error())
 	}
 
@@ -137,6 +138,7 @@ func Search(query string) []Info {
 	defer defaultRegistry.mu.RUnlock()
 
 	var results []Info
+
 	for _, info := range defaultRegistry.byASN {
 		if contains(info.Handle, query) || contains(info.Description, query) {
 			results = append(results, *info)

pkg/asinfo/asinfo_test.go

@@ -1,10 +1,15 @@
-package asinfo
+package asinfo_test
 
 import (
+	"strings"
 	"testing"
+
+	"git.eeqj.de/sneak/routewatch/pkg/asinfo"
 )
 
 func TestGet(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name     string
 		asn      int
@@ -38,20 +43,26 @@ func TestGet(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			info, ok := Get(tt.asn)
+			t.Parallel()
+
+			info, ok := asinfo.Get(tt.asn)
 			if ok != tt.wantOK {
 				t.Errorf("Get(%d) ok = %v, want %v", tt.asn, ok, tt.wantOK)
+
 				return
 			}
 
 			if ok && info.Description != tt.wantDesc {
-				t.Errorf("Get(%d) description = %q, want %q", tt.asn, info.Description, tt.wantDesc)
+				t.Errorf("Get(%d) description = %q, want %q",
+					tt.asn, info.Description, tt.wantDesc)
 			}
 		})
 	}
 }
 
 func TestGetDescription(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		asn  int
 		want string
@@ -62,7 +73,10 @@ func TestGetDescription(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run("", func(t *testing.T) {
-			if got := GetDescription(tt.asn); got != tt.want {
+			t.Parallel()
+
+			got := asinfo.GetDescription(tt.asn)
+			if got != tt.want {
 				t.Errorf("GetDescription(%d) = %q, want %q", tt.asn, got, tt.want)
 			}
 		})
@@ -70,6 +84,8 @@ func TestGetDescription(t *testing.T) {
 }
 
 func TestGetHandle(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		asn  int
 		want string
@@ -81,7 +97,10 @@ func TestGetHandle(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run("", func(t *testing.T) {
-			if got := GetHandle(tt.asn); got != tt.want {
+			t.Parallel()
+
+			got := asinfo.GetHandle(tt.asn)
+			if got != tt.want {
 				t.Errorf("GetHandle(%d) = %q, want %q", tt.asn, got, tt.want)
 			}
 		})
@@ -89,18 +108,23 @@ func TestGetHandle(t *testing.T) {
 }
 
 func TestTotal(t *testing.T) {
-	total := Total()
+	t.Parallel()
+
+	total := asinfo.Total()
 	if total < 100000 {
 		t.Errorf("Total() = %d, expected > 100000", total)
 	}
 
 	// Verify it's consistent
-	if total2 := Total(); total2 != total {
+	total2 := asinfo.Total()
+	if total2 != total {
 		t.Errorf("Total() returned different values: %d vs %d", total, total2)
 	}
 }
 
 func TestSearch(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		name    string
 		query   string
@@ -130,16 +154,21 @@ func TestSearch(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			results := Search(tt.query)
+			t.Parallel()
+
+			results := asinfo.Search(tt.query)
 			if len(results) < tt.wantMin {
-				t.Errorf("Search(%q) returned %d results, want at least %d", tt.query, len(results), tt.wantMin)
+				t.Errorf("Search(%q) returned %d results, want at least %d",
+					tt.query, len(results), tt.wantMin)
 			}
 
 			// Verify all results contain the query
 			if tt.query != "" {
 				for _, r := range results {
-					if !contains(r.Handle, tt.query) && !contains(r.Description, tt.query) {
-						t.Errorf("Search result ASN %d doesn't contain query %q", r.ASN, tt.query)
+					if !strings.Contains(r.Handle, tt.query) &&
+						!strings.Contains(r.Description, tt.query) {
+						t.Errorf("Search result ASN %d doesn't contain query %q",
+							r.ASN, tt.query)
 					}
 				}
 			}
@@ -148,13 +177,17 @@ func TestSearch(t *testing.T) {
 }
 
 func TestDataIntegrity(t *testing.T) {
+	t.Parallel()
+
 	// Verify no duplicate ASNs
-	all := All()
+	all := asinfo.All()
 	seen := make(map[int]bool)
+
 	for _, info := range all {
 		if seen[info.ASN] {
 			t.Errorf("Duplicate ASN found: %d", info.ASN)
 		}
+
 		seen[info.ASN] = true
 	}
 
@@ -163,6 +196,7 @@ func TestDataIntegrity(t *testing.T) {
 		if info.Handle == "" && info.ASN != 0 {
 			t.Errorf("ASN %d has empty handle", info.ASN)
 		}
+
 		if info.Description == "" {
 			t.Errorf("ASN %d has empty description", info.ASN)
 		}
@@ -174,8 +208,9 @@ func BenchmarkGet(b *testing.B) {
 	asns := []int{1, 15169, 13335, 32934, 8075, 16509}
 
 	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		Get(asns[i%len(asns)])
+
+	for i := range b.N {
+		asinfo.Get(asns[i%len(asns)])
 	}
 }
 
@@ -183,7 +218,8 @@ func BenchmarkSearch(b *testing.B) {
 	queries := []string{"Google", "Amazon", "Microsoft", "University"}
 
 	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		Search(queries[i%len(queries)])
+
+	for i := range b.N {
+		asinfo.Search(queries[i%len(queries)])
 	}
 }

script/bootstrap

@@ -3,7 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go).
+# make, or go). The linter and the tests run only in Docker, as phases of
+# the Dockerfile, so nothing installs golangci-lint here.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -58,11 +59,10 @@ main() {
     # Go toolchain
     if missing go; then pkg_install go golang go go; fi
 
-    # golangci-lint: packaged in nix, brew, and apk. There is no apt
-    # package; on apt systems install it manually from a hash-verified
-    # GitHub release archive (never curl | sh).
-    if missing golangci-lint; then
-        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    # Warn, don't fail: make build works without it.
+    if missing docker; then
+        echo "bootstrap: WARNING: docker not found; install it to run" \
+            "make test, make lint, make check and make docker." >&2
     fi
 
     go mod download

script/check

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
+# extension to scripts-to-rule-them-all. test and lint are Docker
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/cibuild

@@ -1,14 +1,28 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs script/check
-# (via make check), so a successful build implies all checks pass.
-# Generic: needs no adaptation. The Gitea workflow runs this on push.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
+# checks out and runs this and nothing else, and script/fmt-check runs
+# the formatter on the host, which a pristine checkout cannot do.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build .
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/docker

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -9,7 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/lint

@@ -1,13 +1,23 @@
 #!/bin/sh
-# script/lint: run the linters.
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
+# this builds that phase alone; the linter is never installed or run on
+# a developer host, where a shared result cache and a host-global lock
+# make its answer untrustworthy.
+#
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go vet ./...
-    golangci-lint run
+    docker build --no-cache \
+        --target lint \
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
 }
 
 main "$@"

script/test

@@ -1,17 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite. On failure, rerun verbosely so the
-# failing tests are visible in the output.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -short -timeout 30s -race -cover ./... || {
-        echo "--- Rerunning with -v for details ---"
-        go test -short -timeout 30s -race -v ./...
-        exit 1
-    }
+    docker build --no-cache \
+        --target test \
+        -t "$("$SCRIPT_DIR/projectname")-test" .
 }
 
 main "$@"