Sample the prefix-length pages with bounded lookups, each prefix once (closes #66)

/prefixlength/{length} and /prefixlength6/{length} grouped every live route
of that length by prefix, shuffled all the prefixes and joined the routes
back, so a request grew with the number of routes and listed a prefix once
for each peer that shared its newest time.

Now a length with at most 5000 prefixes has them all read and shuffled, and
the page lists 500 of them. A longer one is sampled with random row-id
lookups on the mask length index, at most four per prefix asked for, filled
up from the shuffled prefixes if the lookups keep repeating. Each prefix is
shown once, with its newest route.

Model: opus-5-5

README.md

@@ -144,9 +144,8 @@ routewatch/
 - **Reconnection**: Exponential backoff (5s-320s) with reset after 30s of stable connection
 - **IP Lookup**: the most specific live route is found by looking up the
   address's prefix at each mask length, longest first, in the prefix index
-  (at most 25 lookups for IPv4, 113 for IPv6); prefixes are stored in the
-  text form Go's `net/netip` prints. Routes shorter than /8 for IPv4 or /16
-  for IPv6, such as a default route, are not used.
+  (at most 33 lookups for IPv4, 129 for IPv6); prefixes are stored in the
+  text form Go's `net/netip` prints
 
 ### Database Schema
 

internal/database/database.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math/rand/v2"
 	"net"
 	"net/netip"
 	"os"
@@ -37,14 +38,6 @@ const (
 	ipv6Bits       = 128
 )
 
-// The IP lookup does not use routes shorter than these mask lengths. A default
-// route or a route this short only says where a peer sends traffic it has no
-// better route for; it does not say who holds the address.
-const (
-	minLookupMaskLengthV4 = 8
-	minLookupMaskLengthV6 = 16
-)
-
 // SQLite memory tuning. cache_size and busy_timeout go in the DSN so every
 // pooled connection gets them; the heap limits are process-wide and set once.
 const (
@@ -61,6 +54,17 @@ const (
 	sqliteHardHeapLimitBytes = 1610612736
 )
 
+// Bounds on the work GetRandomPrefixesByLength does to pick its sample.
+const (
+	// maxPrefixesToShuffle is the most prefixes of one mask length that are
+	// read in full and shuffled to pick the sample. A mask length with more is
+	// sampled with random lookups, which then seldom land on a prefix twice.
+	maxPrefixesToShuffle = 5000
+	// sampleLookupsPerPrefix is the most random lookups made for each prefix
+	// asked for.
+	sampleLookupsPerPrefix = 4
+)
+
 // Common errors
 var (
 	// ErrInvalidIP is returned when an IP address is malformed
@@ -1704,45 +1708,176 @@ func (d *Database) GetRandomPrefixesByLength(maskLength, ipVersion, limit int) (
 	return d.GetRandomPrefixesByLengthContext(context.Background(), maskLength, ipVersion, limit)
 }
 
-// GetRandomPrefixesByLengthContext returns a random sample of prefixes with context support
+// GetRandomPrefixesByLengthContext returns limit prefixes with the given mask
+// length picked at random, or all of them when there are fewer, each once with
+// its most recently updated live route. However many routes there are, it
+// reads at most maxPrefixesToShuffle+1 prefixes and makes at most
+// sampleLookupsPerPrefix lookups for each prefix asked for.
 func (d *Database) GetRandomPrefixesByLengthContext(
 	ctx context.Context, maskLength, ipVersion, limit int) ([]LiveRoute, error) {
-	// Select unique prefixes with their most recent route information
 	tableName := "live_routes_v4"
 	if ipVersion == ipVersionV6 {
 		tableName = "live_routes_v6"
 	}
 
+	// Reading one prefix more than maxPrefixesToShuffle tells whether these
+	// are all the prefixes with this mask length.
+	prefixes, err := d.firstPrefixesByLength(ctx, tableName, maskLength, maxPrefixesToShuffle+1)
+	if err != nil {
+		return nil, err
+	}
+	rand.Shuffle(len(prefixes), func(i, j int) {
+		prefixes[i], prefixes[j] = prefixes[j], prefixes[i]
+	})
+	if len(prefixes) > maxPrefixesToShuffle {
+		prefixes, err = d.samplePrefixesByLength(ctx, tableName, maskLength, limit, prefixes)
+		if err != nil {
+			return nil, err
+		}
+	}
+	prefixes = prefixes[:min(limit, len(prefixes))]
+
+	return d.newestRouteOfEachPrefix(ctx, tableName, ipVersion, prefixes)
+}
+
+// firstPrefixesByLength returns the first n distinct prefixes, in text order,
+// with the given mask length. It reads only their entries in the mask length
+// and prefix index.
+func (d *Database) firstPrefixesByLength(
+	ctx context.Context, tableName string, maskLength, n int) ([]string, error) {
 	//nolint:gosec // Table name is hardcoded based on IP version
 	query := fmt.Sprintf(`
-		WITH unique_prefixes AS (
-			SELECT prefix, MAX(last_updated) as max_updated
-			FROM %s
-			WHERE mask_length = ?
-			GROUP BY prefix
-			ORDER BY RANDOM()
-			LIMIT ?
-		)
-		SELECT lr.prefix, lr.mask_length, lr.origin_asn, lr.as_path, 
-			lr.peer_ip, lr.last_updated
-		FROM %s lr
-		INNER JOIN unique_prefixes up ON lr.prefix = up.prefix AND lr.last_updated = up.max_updated
-		WHERE lr.mask_length = ?
-	`, tableName, tableName)
+		SELECT DISTINCT prefix FROM %s
+		WHERE mask_length = ?
+		ORDER BY prefix
+		LIMIT ?
+	`, tableName)
 
-	rows, err := d.db.QueryContext(ctx, query, maskLength, limit, maskLength)
+	rows, err := d.db.QueryContext(ctx, query, maskLength, n)
 	if err != nil {
-		return nil, fmt.Errorf("failed to query random prefixes: %w", err)
+		return nil, fmt.Errorf("failed to list prefixes: %w", err)
 	}
-	defer func() {
-		_ = rows.Close()
-	}()
+	defer func() { _ = rows.Close() }()
 
-	var routes []LiveRoute
+	var prefixes []string
 	for rows.Next() {
-		var route LiveRoute
+		var prefix string
+		if err := rows.Scan(&prefix); err != nil {
+			return nil, fmt.Errorf("failed to scan prefix: %w", err)
+		}
+		prefixes = append(prefixes, prefix)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed to list prefixes: %w", err)
+	}
+
+	return prefixes, nil
+}
+
+// samplePrefixesByLength picks limit distinct prefixes with the given mask
+// length at random, in at most sampleLookupsPerPrefix lookups for each prefix
+// asked for. ORDER BY RANDOM() would read every route with that mask length.
+// Instead each lookup draws a row id between those of the first and last route
+// with that mask length and takes the prefix of the first such route at or
+// after it. SQLite keeps the row id at the end of every index entry, so the
+// mask length index is ordered by mask length, then row id, and the lookup is
+// one search of it. A prefix with more routes, or with more rows of other mask
+// lengths just before its own, comes up more often: the page needs a varied
+// sample, not an even one. Should the lookups keep landing on prefixes already
+// picked, the rest are taken from shuffled, prefixes of that length in random
+// order.
+func (d *Database) samplePrefixesByLength(
+	ctx context.Context, tableName string, maskLength, limit int, shuffled []string) ([]string, error) {
+	//nolint:gosec // Table name is hardcoded based on IP version
+	rangeQuery := fmt.Sprintf(`
+		SELECT
+			(SELECT MIN(rowid) FROM %[1]s WHERE mask_length = ?),
+			(SELECT MAX(rowid) FROM %[1]s WHERE mask_length = ?)
+	`, tableName)
+
+	var first, last sql.NullInt64
+	if err := d.db.QueryRowContext(ctx, rangeQuery, maskLength, maskLength).Scan(&first, &last); err != nil {
+		return nil, fmt.Errorf("failed to read row id range: %w", err)
+	}
+	if !first.Valid {
+		// Every route with this mask length was withdrawn since they were listed.
+		return nil, nil
+	}
+
+	//nolint:gosec // Table name is hardcoded based on IP version
+	lookupQuery := fmt.Sprintf(`
+		SELECT prefix FROM %s
+		WHERE mask_length = ? AND rowid >= ?
+		ORDER BY rowid
+		LIMIT 1
+	`, tableName)
+
+	stmt, err := d.db.PrepareContext(ctx, lookupQuery)
+	if err != nil {
+		return nil, fmt.Errorf("failed to prepare prefix lookup: %w", err)
+	}
+	defer func() { _ = stmt.Close() }()
+
+	picked := make(map[string]bool, limit)
+	prefixes := make([]string, 0, limit)
+	pick := func(prefix string) {
+		if !picked[prefix] {
+			picked[prefix] = true
+			prefixes = append(prefixes, prefix)
+		}
+	}
+
+	for lookups := 0; lookups < limit*sampleLookupsPerPrefix && len(prefixes) < limit; lookups++ {
+		//nolint:gosec // The sample needs variety, not unpredictability.
+		rowID := first.Int64 + rand.Int64N(last.Int64-first.Int64+1)
+
+		var prefix string
+		err := stmt.QueryRowContext(ctx, maskLength, rowID).Scan(&prefix)
+		if errors.Is(err, sql.ErrNoRows) {
+			// The routes from rowID on were withdrawn since the range was read.
+			continue
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to look up prefix: %w", err)
+		}
+		pick(prefix)
+	}
+
+	for _, prefix := range shuffled {
+		if len(prefixes) == limit {
+			break
+		}
+		pick(prefix)
+	}
+
+	return prefixes, nil
+}
+
+// newestRouteOfEachPrefix returns the most recently updated live route of each
+// prefix, one lookup on the prefix index per prefix. A prefix whose routes were
+// all withdrawn since it was picked is left out.
+func (d *Database) newestRouteOfEachPrefix(
+	ctx context.Context, tableName string, ipVersion int, prefixes []string) ([]LiveRoute, error) {
+	//nolint:gosec // Table name is hardcoded based on IP version
+	query := fmt.Sprintf(`
+		SELECT prefix, mask_length, origin_asn, as_path, peer_ip, last_updated
+		FROM %s
+		WHERE prefix = ?
+		ORDER BY last_updated DESC
+		LIMIT 1
+	`, tableName)
+
+	stmt, err := d.db.PrepareContext(ctx, query)
+	if err != nil {
+		return nil, fmt.Errorf("failed to prepare route query: %w", err)
+	}
+	defer func() { _ = stmt.Close() }()
+
+	routes := make([]LiveRoute, 0, len(prefixes))
+	for _, prefix := range prefixes {
+		route := LiveRoute{IPVersion: ipVersion}
 		var pathJSON string
-		err := rows.Scan(
+		err := stmt.QueryRowContext(ctx, prefix).Scan(
 			&route.Prefix,
 			&route.MaskLength,
 			&route.OriginASN,
@@ -1750,17 +1885,16 @@ func (d *Database) GetRandomPrefixesByLengthContext(
 			&route.PeerIP,
 			&route.LastUpdated,
 		)
-		// Set IP version based on which table we queried
-		route.IPVersion = ipVersion
-		if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
 			continue
 		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to query route of %s: %w", prefix, err)
+		}
 
-		// Decode AS path
 		if err := json.Unmarshal([]byte(pathJSON), &route.ASPath); err != nil {
 			route.ASPath = []int{}
 		}
-
 		routes = append(routes, route)
 	}
 
@@ -1884,12 +2018,11 @@ func (d *Database) GetIPInfo(ip string) (*IPInfo, error) {
 // GetIPInfoContext returns comprehensive IP information with context support.
 //
 // It finds the most specific live route for the address with point lookups on
-// the prefix index: for each mask length from the longest (32 or 128) down to
-// minLookupMaskLengthV4 or minLookupMaskLengthV6 it looks up the address's
-// network prefix at that length, and the first length with a live route wins.
-// That is at most 25 or 113 indexed lookups, however many routes are live. The
-// prefix is looked up in the text form net/netip prints, which is the form the
-// prefix handler stores.
+// the prefix index: for each mask length from the longest (32 or 128) down to 0
+// it looks up the address's network prefix at that length, and the first length
+// with a live route wins. That is at most 33 or 129 indexed lookups, however
+// many routes are live. The prefix is looked up in the text form net/netip
+// prints, which is the form the prefix handler stores.
 func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, error) {
 	addr, err := netip.ParseAddr(ip)
 	if err != nil {
@@ -1900,11 +2033,9 @@ func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, er
 
 	info := &IPInfo{IP: ip, IPVersion: ipVersionV6}
 	routesTable, prefixesTable := "live_routes_v6", "prefixes_v6"
-	minMaskLength := minLookupMaskLengthV6
 	if addr.Is4() {
 		info.IPVersion = ipVersionV4
 		routesTable, prefixesTable = "live_routes_v4", "prefixes_v4"
-		minMaskLength = minLookupMaskLengthV4
 	}
 
 	// Route info with peer count and prefix first_seen
@@ -1945,7 +2076,7 @@ func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, er
 	var whoisUpdatedAt sql.NullTime
 
 	found := false
-	for bits := addr.BitLen(); bits >= minMaskLength; bits-- {
+	for bits := addr.BitLen(); bits >= 0; bits-- {
 		prefix := netip.PrefixFrom(addr, bits).Masked().String()
 		err := stmt.QueryRowContext(ctx, prefix).Scan(
 			&info.Netblock,

internal/database/database_test.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
+	"slices"
 	"sync"
 	"testing"
 	"time"
@@ -45,6 +46,19 @@ const (
 	asnSecondBand = 100
 )
 
+// Parameters for the prefix-length sample tests.
+const (
+	// sampleLimit is how many prefixes the tests ask the sample for.
+	sampleLimit = 10
+	// sampledPrefixCount is how many prefixes the sampling test stores, more
+	// than sampleLimit so the sample has to choose among them.
+	sampledPrefixCount = 30
+	// secondV4PeerIP and secondV6PeerIP are the second peer each prefix is
+	// learned from, besides the one mkV4Route and mkV6Route set.
+	secondV4PeerIP = "192.0.2.2"
+	secondV6PeerIP = "2001:db8::2"
+)
+
 // TestGetIPInfoFindsMostSpecificLiveRoute stores nested live prefixes for both
 // families and checks that a lookup returns the most specific one covering the
 // address, ErrNoRoute when none covers it, and the next less specific prefix
@@ -133,78 +147,6 @@ func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
 	lookup("2001:db8:1:2::3", "2001:db8:1::/48")
 }
 
-// TestGetIPInfoIgnoresShortRoutes checks that the IP lookup does not report a
-// default route, or a route shorter than /8 for IPv4 or /16 for IPv6, as the
-// route for an address, and that a route of exactly /8 or /16, or longer, still
-// is. The prefixes are written out so that a wrong limit fails the test.
-func TestGetIPInfoIgnoresShortRoutes(t *testing.T) {
-	cfg := &config.Config{StateDir: t.TempDir()}
-
-	db, err := New(cfg, logger.New())
-	if err != nil {
-		t.Fatalf("failed to create database: %v", err)
-	}
-	defer func() { _ = db.Close() }()
-
-	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-	announce := func(prefix string, asn int) {
-		t.Helper()
-
-		err := db.UpsertLiveRouteBatch([]*LiveRoute{{
-			ID:          uuid.New(),
-			Prefix:      prefix,
-			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
-			IPVersion:   detectIPVersion(prefix),
-			OriginASN:   asn,
-			PeerIP:      testPeerIP,
-			ASPath:      []int{asn},
-			NextHop:     testPeerIP,
-			LastUpdated: ts,
-		}})
-		if err != nil {
-			t.Fatalf("UpsertLiveRouteBatch(%s): %v", prefix, err)
-		}
-	}
-
-	// lookup checks that ip resolves to the live prefix netblock from asn.
-	lookup := func(ip, netblock string, asn int) {
-		t.Helper()
-
-		info, err := db.GetIPInfo(ip)
-		if err != nil {
-			t.Errorf("GetIPInfo(%s): %v", ip, err)
-
-			return
-		}
-		if info.Netblock != netblock || info.ASN != asn {
-			t.Errorf("GetIPInfo(%s) = %s AS%d, want %s AS%d", ip, info.Netblock, info.ASN, netblock, asn)
-		}
-	}
-
-	// Default and very short routes, and routes one bit shorter than each limit.
-	announce("2000::/3", 64500)
-	announce("0.0.0.0/0", 64500)
-	announce("2000::/15", 64500)
-	announce("192.0.0.0/7", 64500)
-
-	for _, ip := range []string{"2001:db8::1", "192.0.2.1"} {
-		if info, err := db.GetIPInfo(ip); !errors.Is(err, ErrNoRoute) {
-			t.Errorf("GetIPInfo(%s) with only short routes = %+v, %v; want ErrNoRoute", ip, info, err)
-		}
-	}
-
-	// Routes of exactly the minimum length are used.
-	announce("2001::/16", 64501)
-	announce("192.0.0.0/8", 64501)
-
-	lookup("2001:db8::1", "2001::/16", 64501)
-	lookup("192.0.2.1", "192.0.0.0/8", 64501)
-
-	announce("2001:db8::/32", 64502)
-
-	lookup("2001:db8::1", "2001:db8::/32", 64502)
-}
-
 // TestConnectionPoolPragmas holds several pooled connections open at once and
 // checks each one carries the per-connection settings from the DSN, plus the
 // process-wide hard heap limit, and sees the new file with auto_vacuum
@@ -389,3 +331,141 @@ func TestBatchWriteDuringCheckpoint(t *testing.T) {
 	cancel()
 	wg.Wait()
 }
+
+// TestGetRandomPrefixesByLengthListsPrefixOnce stores one prefix of each
+// family learned from two peers in the same second and checks that the
+// prefix-length sample lists each of them once.
+func TestGetRandomPrefixesByLengthListsPrefixOnce(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	v4First := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	v4Second := mkV4Route(t, "198.51.100.0/24", 64500, ts)
+	v4Second.PeerIP = secondV4PeerIP
+	v6First := mkV6Route("2001:db8::/32", 64500, ts)
+	v6Second := mkV6Route("2001:db8::/32", 64500, ts)
+	v6Second.PeerIP = secondV6PeerIP
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{v4First, v4Second, v6First, v6Second}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	for _, want := range []*LiveRoute{v4First, v6First} {
+		routes, err := db.GetRandomPrefixesByLength(want.MaskLength, want.IPVersion, sampleLimit)
+		if err != nil {
+			t.Fatalf("GetRandomPrefixesByLength(%d, %d): %v", want.MaskLength, want.IPVersion, err)
+		}
+		if len(routes) != 1 || routes[0].Prefix != want.Prefix {
+			t.Errorf("GetRandomPrefixesByLength(%d, %d) = %+v, want %s listed once",
+				want.MaskLength, want.IPVersion, routes, want.Prefix)
+		}
+	}
+}
+
+// TestGetRandomPrefixesByLengthListsNewestRoute stores a prefix learned from
+// two peers at different times, the older route first, and checks that the
+// prefix-length sample lists the newer route.
+func TestGetRandomPrefixesByLengthListsNewestRoute(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	older := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	olderRoute := mkV4Route(t, "198.51.100.0/24", 64500, older)
+	newerRoute := mkV4Route(t, "198.51.100.0/24", 64500, older.Add(time.Minute))
+	newerRoute.PeerIP = secondV4PeerIP
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{olderRoute, newerRoute}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	routes, err := db.GetRandomPrefixesByLength(newerRoute.MaskLength, ipVersionV4, sampleLimit)
+	if err != nil {
+		t.Fatalf("GetRandomPrefixesByLength: %v", err)
+	}
+	if len(routes) != 1 || routes[0].PeerIP != newerRoute.PeerIP {
+		t.Errorf("GetRandomPrefixesByLength = %+v, want only the newer route, from %s",
+			routes, newerRoute.PeerIP)
+	}
+}
+
+// TestGetRandomPrefixesByLengthSamplesManyPrefixes stores more /24 prefixes
+// than the sample asks for, each followed by a /16 so that routes of another
+// mask length sit between the /24 rows, and each prefix learned from two peers
+// in the same second. It checks both the sample the pages get, picked from the
+// shuffled prefixes, and the random lookups used for a mask length with more
+// than maxPrefixesToShuffle prefixes.
+func TestGetRandomPrefixesByLengthSamplesManyPrefixes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	var routes []*LiveRoute
+	var stored []string
+	for i := range sampledPrefixCount {
+		prefix := fmt.Sprintf("10.0.%d.0/24", i)
+		for _, p := range []string{prefix, fmt.Sprintf("172.%d.0.0/16", i)} {
+			first := mkV4Route(t, p, 64500, ts)
+			second := mkV4Route(t, p, 64500, ts)
+			second.PeerIP = secondV4PeerIP
+			routes = append(routes, first, second)
+		}
+		stored = append(stored, prefix)
+	}
+	if err := db.UpsertLiveRouteBatch(routes); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+	slices.Sort(stored)
+
+	maskLength := routes[0].MaskLength
+	sample, err := db.GetRandomPrefixesByLength(maskLength, ipVersionV4, sampleLimit)
+	if err != nil {
+		t.Fatalf("GetRandomPrefixesByLength: %v", err)
+	}
+	var listed []string
+	for _, route := range sample {
+		listed = append(listed, route.Prefix)
+	}
+	checkPrefixSample(t, "GetRandomPrefixesByLength", listed, stored)
+
+	looked, err := db.samplePrefixesByLength(
+		context.Background(), "live_routes_v4", maskLength, sampleLimit, nil)
+	if err != nil {
+		t.Fatalf("samplePrefixesByLength: %v", err)
+	}
+	checkPrefixSample(t, "samplePrefixesByLength", looked, stored)
+}
+
+// checkPrefixSample checks that sample lists sampleLimit prefixes, each once
+// and each one of stored, and that it is not just the first sampleLimit of
+// stored, which is in text order.
+func checkPrefixSample(t *testing.T, name string, sample, stored []string) {
+	t.Helper()
+
+	if len(sample) != sampleLimit {
+		t.Errorf("%s listed %d prefixes, want %d", name, len(sample), sampleLimit)
+	}
+	listed := make(map[string]bool)
+	for _, prefix := range sample {
+		if listed[prefix] || !slices.Contains(stored, prefix) {
+			t.Errorf("%s lists %s twice or it is not one of the /24s", name, prefix)
+		}
+		listed[prefix] = true
+	}
+	if slices.Equal(slices.Sorted(slices.Values(sample)), stored[:sampleLimit]) {
+		t.Errorf("%s lists just the first %d prefixes in text order", name, sampleLimit)
+	}
+}

internal/routewatch/prefixhandler.go

@@ -105,24 +105,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
-	// Withdrawals are queued before announcements, because the batch keeps
-	// each peer's last update for a prefix: a message that lists a prefix as
-	// both withdrawn and announced keeps the route (RFC 4271 section 4.3).
-	for _, prefix := range msg.Withdrawals {
-		h.batch = append(h.batch, prefixUpdate{
-			prefix:      canonicalPrefix(prefix),
-			originASN:   originASN, // Use the originASN from path if available
-			peer:        msg.Peer,
-			messageType: "withdrawal",
-			timestamp:   timestamp,
-			path:        msg.Path,
-		})
-		// Record withdrawal in metrics
-		if h.metrics != nil {
-			h.metrics.RecordWithdrawal()
-		}
-	}
-
+	// Process announcements
 	for _, announcement := range msg.Announcements {
 		for _, prefix := range announcement.Prefixes {
 			h.batch = append(h.batch, prefixUpdate{
@@ -140,6 +123,22 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 		}
 	}
 
+	// Process withdrawals
+	for _, prefix := range msg.Withdrawals {
+		h.batch = append(h.batch, prefixUpdate{
+			prefix:      canonicalPrefix(prefix),
+			originASN:   originASN, // Use the originASN from path if available
+			peer:        msg.Peer,
+			messageType: "withdrawal",
+			timestamp:   timestamp,
+			path:        msg.Path,
+		})
+		// Record withdrawal in metrics
+		if h.metrics != nil {
+			h.metrics.RecordWithdrawal()
+		}
+	}
+
 	// Check if we need to flush
 	if len(h.batch) >= prefixBatchSize {
 		h.flushBatchLocked()
@@ -180,14 +179,14 @@ func (h *PrefixHandler) flushBatchLocked() {
 	startTime := time.Now()
 	batchSize := len(h.batch)
 
-	// For each prefix and peer, keep only the last update the feed delivered.
-	// Updates from different peers for the same prefix are all kept. Arrival
-	// order decides, not the timestamp: timestamps are whole seconds, so
-	// updates within one second carry the same one.
-	type prefixAndPeer struct{ prefix, peer string }
-	lastUpdates := make(map[prefixAndPeer]prefixUpdate)
+	// Group updates by prefix to deduplicate
+	// For each prefix, keep the latest update
+	prefixMap := make(map[string]prefixUpdate)
 	for _, update := range h.batch {
-		lastUpdates[prefixAndPeer{update.prefix, update.peer}] = update
+		key := update.prefix
+		if existing, ok := prefixMap[key]; !ok || update.timestamp.After(existing.timestamp) {
+			prefixMap[key] = update
+		}
 	}
 
 	// Collect routes to upsert and delete
@@ -197,7 +196,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 	// Collect unique prefixes to update
 	prefixesToUpdate := make(map[string]time.Time)
 
-	for _, update := range lastUpdates {
+	for _, update := range prefixMap {
 		// Track prefix for both announcements and withdrawals
 		if _, exists := prefixesToUpdate[update.prefix]; !exists || update.timestamp.After(prefixesToUpdate[update.prefix]) {
 			prefixesToUpdate[update.prefix] = update.timestamp
@@ -256,7 +255,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 	elapsed := time.Since(startTime)
 	h.logger.Debug("Flushed prefix batch",
 		"batch_size", batchSize,
-		"unique_prefixes", len(prefixesToUpdate),
+		"unique_prefixes", len(prefixMap),
 		"success", successCount,
 		"duration_ms", elapsed.Milliseconds(),
 	)

internal/routewatch/prefixhandler_test.go

@@ -1,9 +1,7 @@
 package routewatch
 
 import (
-	"context"
 	"errors"
-	"slices"
 	"testing"
 	"time"
 
@@ -74,140 +72,3 @@ func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
 		}
 	}
 }
-
-// TestPrefixHandlerAppliesEachPeersLastUpdateInABatch runs updates for one
-// prefix through the prefix handler into a real database. All updates carry the
-// same timestamp, as updates within one second of the feed do. Within a batch,
-// the last update each peer sent for the prefix decides whether that peer has a
-// live route for it, and updates from different peers are all applied. The
-// in-memory route count and prefix distribution must match the route table.
-func TestPrefixHandlerAppliesEachPeersLastUpdateInABatch(t *testing.T) {
-	const (
-		prefix           = "198.51.100.0/24"
-		prefixMaskLength = 24
-		otherPeerIP      = "2001:db8:ffff::2"
-	)
-
-	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-	announce := func(peer string) *ristypes.RISMessage {
-		return &ristypes.RISMessage{
-			Peer:            peer,
-			Path:            ristypes.ASPath{testASNA, testASNB},
-			ParsedTimestamp: ts,
-			Announcements:   []ristypes.RISAnnouncement{{NextHop: peer, Prefixes: []string{prefix}}},
-		}
-	}
-	withdraw := func(peer string) *ristypes.RISMessage {
-		return &ristypes.RISMessage{Peer: peer, ParsedTimestamp: ts, Withdrawals: []string{prefix}}
-	}
-	announceAndWithdraw := func(peer string) *ristypes.RISMessage {
-		msg := announce(peer)
-		msg.Withdrawals = []string{prefix}
-
-		return msg
-	}
-
-	tests := []struct {
-		name string
-		// Each inner list is handled and then flushed as one batch.
-		batches [][]*ristypes.RISMessage
-		// The peers left with a live route for the prefix, by peer IP.
-		wantPeers []string
-	}{
-		{
-			name:      "two peers announce the prefix",
-			batches:   [][]*ristypes.RISMessage{{announce(testPeerIP), announce(otherPeerIP)}},
-			wantPeers: []string{testPeerIP, otherPeerIP},
-		},
-		{
-			name: "two peers withdraw the prefix",
-			batches: [][]*ristypes.RISMessage{
-				{announce(testPeerIP)},
-				{announce(otherPeerIP)},
-				{withdraw(testPeerIP), withdraw(otherPeerIP)},
-			},
-		},
-		{
-			name:    "a peer announces and then withdraws the prefix",
-			batches: [][]*ristypes.RISMessage{{announce(testPeerIP), withdraw(testPeerIP)}},
-		},
-		{
-			name: "a peer withdraws and then re-announces the prefix",
-			batches: [][]*ristypes.RISMessage{
-				{announce(testPeerIP)},
-				{withdraw(testPeerIP), announce(testPeerIP)},
-			},
-			wantPeers: []string{testPeerIP},
-		},
-		{
-			// RFC 4271 section 4.3: the announcement counts, not the withdrawal.
-			name: "one message announces and withdraws the prefix",
-			batches: [][]*ristypes.RISMessage{
-				{announce(testPeerIP)},
-				{announceAndWithdraw(testPeerIP)},
-			},
-			wantPeers: []string{testPeerIP},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
-			if err != nil {
-				t.Fatalf("failed to create database: %v", err)
-			}
-			defer func() { _ = db.Close() }()
-
-			// Built without NewPrefixHandler's flush timer, so the test flushes itself.
-			h := &PrefixHandler{db: db, logger: logger.New()}
-			for _, batch := range tt.batches {
-				for _, msg := range batch {
-					h.HandleMessage(msg)
-				}
-				h.mu.Lock()
-				h.flushBatchLocked()
-				h.mu.Unlock()
-			}
-
-			ctx := context.Background()
-			routes, err := db.GetPrefixDetailsContext(ctx, prefix)
-			if err != nil && !errors.Is(err, database.ErrNoRoute) {
-				t.Fatalf("GetPrefixDetailsContext: %v", err)
-			}
-			var gotPeers []string
-			for _, route := range routes {
-				gotPeers = append(gotPeers, route.PeerIP)
-			}
-			if !slices.Equal(gotPeers, tt.wantPeers) {
-				t.Errorf("peers with a live route for %s = %v, want %v", prefix, gotPeers, tt.wantPeers)
-			}
-
-			stats, err := db.GetStatsContext(ctx)
-			if err != nil {
-				t.Fatalf("GetStatsContext: %v", err)
-			}
-			tableRoutesV4, _, err := db.GetLiveRouteCountsContext(ctx)
-			if err != nil {
-				t.Fatalf("GetLiveRouteCountsContext: %v", err)
-			}
-			if stats.IPv4Routes != len(tt.wantPeers) || tableRoutesV4 != len(tt.wantPeers) {
-				t.Errorf("IPv4 live routes: %d in memory, %d in the table, want %d",
-					stats.IPv4Routes, tableRoutesV4, len(tt.wantPeers))
-			}
-
-			var wantDistribution []database.PrefixDistribution
-			if len(tt.wantPeers) > 0 {
-				wantDistribution = []database.PrefixDistribution{{MaskLength: prefixMaskLength, Count: 1}}
-			}
-			queryDistributionV4, _, err := db.GetPrefixDistributionContext(ctx)
-			if err != nil {
-				t.Fatalf("GetPrefixDistributionContext: %v", err)
-			}
-			if !slices.Equal(stats.IPv4PrefixDistribution, wantDistribution) ||
-				!slices.Equal(queryDistributionV4, wantDistribution) {
-				t.Errorf("IPv4 prefix distribution: %v in memory, %v from the table, want %v",
-					stats.IPv4PrefixDistribution, queryDistributionV4, wantDistribution)
-			}
-		})
-	}
-}

internal/server/handlers.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"net/netip"
 	"runtime"
 	"sort"
 	"strconv"
@@ -201,16 +200,12 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 		select {
 		case <-ctx.Done():
 			s.logger.Error("Database stats timeout in status.json")
-			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+			writeJSONError(w, http.StatusRequestTimeout, "Database timeout")
 
 			return
 		case err := <-errChan:
 			s.logger.Error("Failed to get database stats", "error", err)
-			if deadlinePassed(ctx) {
-				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-			} else {
-				writeJSONError(w, http.StatusInternalServerError, err.Error())
-			}
+			writeJSONError(w, http.StatusInternalServerError, err.Error())
 
 			return
 		case dbStats = <-statsChan:
@@ -390,7 +385,7 @@ func (s *Server) handleStats() http.HandlerFunc {
 		// Check if context is already cancelled
 		select {
 		case <-ctx.Done():
-			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+			http.Error(w, "Request timeout", http.StatusRequestTimeout)
 
 			return
 		default:
@@ -419,16 +414,11 @@ func (s *Server) handleStats() http.HandlerFunc {
 		select {
 		case <-ctx.Done():
 			s.logger.Error("Database stats timeout")
-			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-
+			// Don't write response here - timeout middleware already handles it
 			return
 		case err := <-errChan:
 			s.logger.Error("Failed to get database stats", "error", err)
-			if deadlinePassed(ctx) {
-				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-			} else {
-				writeJSONError(w, http.StatusInternalServerError, err.Error())
-			}
+			writeJSONError(w, http.StatusInternalServerError, err.Error())
 
 			return
 		case dbStats = <-statsChan:
@@ -631,13 +621,6 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 			}
 		}
 
-		// The time limit passed while resolving host names.
-		if deadlinePassed(ctx) {
-			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-
-			return
-		}
-
 		if len(ipsToLookup) == 0 {
 			writeJSONError(w, http.StatusBadRequest, "No valid IPs or hostnames provided")
 
@@ -680,13 +663,6 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 			}
 		}
 
-		// The time limit passed while looking up the IPs.
-		if deadlinePassed(ctx) {
-			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-
-			return
-		}
-
 		// Return response (even if no results, include errors)
 		if len(response.Results) == 0 && len(response.Errors) > 0 {
 			writeJSONError(w, http.StatusNotFound, "No routes found: "+response.Errors[0])
@@ -726,12 +702,9 @@ func (s *Server) handleASDetailJSON() http.HandlerFunc {
 
 		asInfo, prefixes, err := s.db.GetASDetailsContext(r.Context(), asn)
 		if err != nil {
-			switch {
-			case errors.Is(err, database.ErrNoRoute):
+			if errors.Is(err, database.ErrNoRoute) {
 				writeJSONError(w, http.StatusNotFound, err.Error())
-			case deadlinePassed(r.Context()):
-				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-			default:
+			} else {
 				writeJSONError(w, http.StatusInternalServerError, err.Error())
 			}
 
@@ -775,24 +748,14 @@ func (s *Server) handlePrefixDetailJSON() http.HandlerFunc {
 			return
 		}
 
-		// Look the prefix up in the text form net/netip prints, the form the
-		// tables store, so that any valid way of writing it finds the route.
-		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
-		if err != nil {
-			writeJSONError(w, http.StatusBadRequest, err.Error())
-
-			return
-		}
-		prefix := parsed.Masked().String()
+		// Combine prefix and length into CIDR notation
+		prefix := prefixParam + "/" + lenParam
 
 		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {
-			switch {
-			case errors.Is(err, database.ErrNoRoute):
+			if errors.Is(err, database.ErrNoRoute) {
 				writeJSONError(w, http.StatusNotFound, err.Error())
-			case deadlinePassed(r.Context()):
-				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
-			default:
+			} else {
 				writeJSONError(w, http.StatusInternalServerError, err.Error())
 			}
 
@@ -832,12 +795,9 @@ func (s *Server) handleASDetail() http.HandlerFunc {
 
 		asInfo, prefixes, err := s.db.GetASDetailsContext(r.Context(), asn)
 		if err != nil {
-			switch {
-			case errors.Is(err, database.ErrNoRoute):
+			if errors.Is(err, database.ErrNoRoute) {
 				http.Error(w, "AS not found", http.StatusNotFound)
-			case deadlinePassed(r.Context()):
-				http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
-			default:
+			} else {
 				s.logger.Error("Failed to get AS details", "error", err)
 				http.Error(w, "Internal server error", http.StatusInternalServerError)
 			}
@@ -952,24 +912,14 @@ func (s *Server) handlePrefixDetail() http.HandlerFunc {
 			return
 		}
 
-		// Look the prefix up in the text form net/netip prints, the form the
-		// tables store, so that any valid way of writing it finds the route.
-		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
-		if err != nil {
-			http.Error(w, "Invalid prefix", http.StatusBadRequest)
-
-			return
-		}
-		prefix := parsed.Masked().String()
+		// Combine prefix and length into CIDR notation
+		prefix := prefixParam + "/" + lenParam
 
 		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {
-			switch {
-			case errors.Is(err, database.ErrNoRoute):
+			if errors.Is(err, database.ErrNoRoute) {
 				http.Error(w, "Prefix not found", http.StatusNotFound)
-			case deadlinePassed(r.Context()):
-				http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
-			default:
+			} else {
 				s.logger.Error("Failed to get prefix details", "error", err)
 				http.Error(w, "Internal server error", http.StatusInternalServerError)
 			}
@@ -1123,12 +1073,8 @@ func (s *Server) handlePrefixLength() http.HandlerFunc {
 		const maxPrefixes = 500
 		prefixes, err := s.db.GetRandomPrefixesByLengthContext(r.Context(), maskLength, ipVersion, maxPrefixes)
 		if err != nil {
-			if deadlinePassed(r.Context()) {
-				http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
-			} else {
-				s.logger.Error("Failed to get prefixes by length", "error", err)
-				http.Error(w, "Internal server error", http.StatusInternalServerError)
-			}
+			s.logger.Error("Failed to get prefixes by length", "error", err)
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
 
 			return
 		}
@@ -1218,12 +1164,8 @@ func (s *Server) handlePrefixLength6() http.HandlerFunc {
 		const maxPrefixes = 500
 		prefixes, err := s.db.GetRandomPrefixesByLengthContext(r.Context(), maskLength, ipVersion, maxPrefixes)
 		if err != nil {
-			if deadlinePassed(r.Context()) {
-				http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
-			} else {
-				s.logger.Error("Failed to get prefixes by length", "error", err)
-				http.Error(w, "Internal server error", http.StatusInternalServerError)
-			}
+			s.logger.Error("Failed to get prefixes by length", "error", err)
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
 
 			return
 		}

internal/server/handlers_test.go

@@ -148,231 +148,6 @@ func TestStatsHandlersAnswerFromMemory(t *testing.T) {
 	}
 }
 
-// TestPrefixDetailHandlersParsePrefix checks that both prefix pages find a
-// stored route whatever valid text form the URL writes its prefix in, and
-// answer 400 for a prefix that does not parse. The tables store the form
-// net/netip prints. Before the fix the URL text was looked up as typed, so
-// "2001:DB8:0:0::/32" was not found although "2001:db8::/32" was stored, and
-// "foo/24" answered 500 (https://git.eeqj.de/sneak/routewatch/issues/71).
-func TestPrefixDetailHandlersParsePrefix(t *testing.T) {
-	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
-	if err != nil {
-		t.Fatalf("database.New: %v", err)
-	}
-	t.Cleanup(func() { _ = db.Close() })
-
-	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
-		{
-			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
-			OriginASN: 64500, PeerIP: "198.51.100.1", ASPath: []int{64500}, NextHop: "198.51.100.1",
-			LastUpdated: ts,
-		},
-		{
-			ID: uuid.New(), Prefix: "2001:db8::/32", MaskLength: 32, IPVersion: 6,
-			OriginASN: 64501, PeerIP: "2001:db8::1", ASPath: []int{64501}, NextHop: "2001:db8::1",
-			LastUpdated: ts,
-		},
-	}); err != nil {
-		t.Fatalf("UpsertLiveRouteBatch: %v", err)
-	}
-
-	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-
-	tests := []struct {
-		path string
-		want int
-	}{
-		{"/api/v1/prefix/foo/24", http.StatusBadRequest},
-		{"/prefix/foo/24", http.StatusBadRequest},
-		{"/api/v1/prefix/2001:DB8:0:0::/32", http.StatusOK},
-		{"/prefix/2001:DB8:0:0::/32", http.StatusOK},
-		{"/api/v1/prefix/192.0.2.1/24", http.StatusOK},
-		{"/prefix/192.0.2.1/24", http.StatusOK},
-	}
-
-	for _, tt := range tests {
-		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil))
-		if rec.Code != tt.want {
-			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, tt.want, rec.Body)
-		}
-	}
-}
-
-// shortRequestDeadline is the deadline the tests below give a request. The
-// server's 30-second limit and the stats handlers' 4-second limit inherit it,
-// so the tests do not wait for either.
-const shortRequestDeadline = 50 * time.Millisecond
-
-// TestRequestPastTimeLimitAnswers504 sends a request through the server's
-// router to a page and to a JSON route whose handlers wait for the time limit
-// to pass and return without answering. The page answers 504; the JSON route
-// answers 504 with the JSON error body. Before the fix both answered 408,
-// written by the time limit middleware from its own goroutine while the
-// handler could still be writing.
-func TestRequestPastTimeLimitAnswers504(t *testing.T) {
-	s := New(nil, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-
-	waitForTimeLimit := func(_ http.ResponseWriter, r *http.Request) {
-		<-r.Context().Done()
-	}
-	// Registered the way setupRoutes registers pages and JSON routes.
-	s.router.Get("/slow-page", waitForTimeLimit)
-	s.router.Get("/slow.json", JSONValidationMiddleware(http.HandlerFunc(waitForTimeLimit)).ServeHTTP)
-
-	tests := []struct {
-		path         string
-		wantJSONBody bool
-	}{
-		{path: "/slow-page"},
-		{path: "/slow.json", wantJSONBody: true},
-	}
-
-	for _, tt := range tests {
-		ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
-		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil).WithContext(ctx))
-		cancel()
-
-		if rec.Code != http.StatusGatewayTimeout {
-			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, http.StatusGatewayTimeout, rec.Body)
-		}
-		if tt.wantJSONBody {
-			checkJSONErrorCode(t, tt.path, rec, http.StatusGatewayTimeout)
-		}
-	}
-}
-
-// TestStatsHandlersAnswer504WhenDatabaseReadRunsOut calls each stats handler
-// with a store that does not answer before the handler's 4-second limit runs
-// out, and checks that the handler itself answers 504 with the JSON error
-// body. Before the fix status.json answered 408, and /api/v1/stats wrote
-// nothing, which the JSON check on its route turned into 500.
-func TestStatsHandlersAnswer504WhenDatabaseReadRunsOut(t *testing.T) {
-	release := make(chan struct{})
-	defer close(release)
-	db := blockingStatsDB{release: release}
-	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-
-	handlers := map[string]http.HandlerFunc{
-		"status.json": s.handleStatusJSON(),
-		"stats":       s.handleStats(),
-	}
-
-	for name, handler := range handlers {
-		ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
-		rec := httptest.NewRecorder()
-		handler(rec, httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx))
-		cancel()
-
-		if rec.Code != http.StatusGatewayTimeout {
-			t.Errorf("%s: status %d, want %d; body %s", name, rec.Code, http.StatusGatewayTimeout, rec.Body)
-		}
-		checkJSONErrorCode(t, name, rec, http.StatusGatewayTimeout)
-	}
-}
-
-// slowDB embeds database.Store (left nil) and overrides the reads the routes
-// in TestRoutesAnswer504WhenDatabaseReadIsCutOff make. Each read waits until
-// its context ends and returns the context's error, as a slow database read
-// cut off by a time limit does.
-type slowDB struct {
-	database.Store
-}
-
-func (slowDB) GetStatsContext(ctx context.Context) (database.Stats, error) {
-	<-ctx.Done()
-
-	return database.Stats{}, ctx.Err()
-}
-
-func (slowDB) GetIPInfoContext(ctx context.Context, _ string) (*database.IPInfo, error) {
-	<-ctx.Done()
-
-	return nil, ctx.Err()
-}
-
-func (slowDB) GetASDetailsContext(ctx context.Context, _ int) (*database.ASN, []database.LiveRoute, error) {
-	<-ctx.Done()
-
-	return nil, nil, ctx.Err()
-}
-
-func (slowDB) GetPrefixDetailsContext(ctx context.Context, _ string) ([]database.LiveRoute, error) {
-	<-ctx.Done()
-
-	return nil, ctx.Err()
-}
-
-func (slowDB) GetRandomPrefixesByLengthContext(ctx context.Context, _, _, _ int) ([]database.LiveRoute, error) {
-	<-ctx.Done()
-
-	return nil, ctx.Err()
-}
-
-// TestRoutesAnswer504WhenDatabaseReadIsCutOff sends a request through the
-// server's router for each route that reads the database, with a store whose
-// reads fail when the request's time limit passes. Each route answers 504, the
-// JSON routes with the JSON error body. Before the fix they answered 408 or,
-// when the handler wrote first, its own error: 500, or 404 on the IP lookups.
-// The health check is left out: it answers 503 when its own 2-second ping runs
-// out.
-func TestRoutesAnswer504WhenDatabaseReadIsCutOff(t *testing.T) {
-	s := New(slowDB{}, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-
-	tests := []struct {
-		path         string
-		wantJSONBody bool
-	}{
-		{path: "/as/64500"},
-		{path: "/prefix/192.0.2.0/24"},
-		{path: "/prefixlength/24"},
-		{path: "/prefixlength6/48"},
-		{path: "/status.json", wantJSONBody: true},
-		{path: "/ip/192.0.2.1", wantJSONBody: true},
-		{path: "/api/v1/stats", wantJSONBody: true},
-		{path: "/api/v1/ip/192.0.2.1", wantJSONBody: true},
-		{path: "/api/v1/as/64500", wantJSONBody: true},
-		{path: "/api/v1/prefix/192.0.2.0/24", wantJSONBody: true},
-	}
-
-	for _, tt := range tests {
-		ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
-		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil).WithContext(ctx))
-		cancel()
-
-		if rec.Code != http.StatusGatewayTimeout {
-			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, http.StatusGatewayTimeout, rec.Body)
-		}
-		if tt.wantJSONBody {
-			checkJSONErrorCode(t, tt.path, rec, http.StatusGatewayTimeout)
-		}
-	}
-}
-
-// checkJSONErrorCode checks that rec holds the JSON error body with the given
-// code.
-func checkJSONErrorCode(t *testing.T, name string, rec *httptest.ResponseRecorder, want int) {
-	t.Helper()
-
-	var body struct {
-		Status string `json:"status"`
-		Error  struct {
-			Code int `json:"code"`
-		} `json:"error"`
-	}
-	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
-		t.Errorf("%s: decoding the answer %q: %v", name, rec.Body, err)
-
-		return
-	}
-	if body.Status != "error" || body.Error.Code != want {
-		t.Errorf("%s: answer %s, want status \"error\" and error code %d", name, rec.Body, want)
-	}
-}
-
 // settledGoroutineCount lets transient goroutines finish, then reports the
 // current count.
 func settledGoroutineCount() int {

internal/server/middleware.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -110,24 +109,142 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 	})
 }
 
-// requestTimeoutMessage is the error message sent with 504 Gateway Timeout.
-const requestTimeoutMessage = "Request timeout"
+// timeoutWriter wraps ResponseWriter to prevent concurrent writes after timeout
+type timeoutWriter struct {
+	http.ResponseWriter
+	mu      sync.Mutex
+	written bool
+	header  http.Header // cached header to prevent concurrent access
+}
 
-// deadlinePassed reports whether ctx ended because its deadline passed. When
-// a handler's database read or other lookup fails, it uses this to tell a
-// request cut off by its time limit, which answers 504, from other failures.
-func deadlinePassed(ctx context.Context) bool {
-	return errors.Is(ctx.Err(), context.DeadlineExceeded)
+func (tw *timeoutWriter) Write(b []byte) (int, error) {
+	tw.mu.Lock()
+	defer tw.mu.Unlock()
+
+	if tw.written {
+		return 0, nil // Discard writes after timeout
+	}
+
+	return tw.ResponseWriter.Write(b)
+}
+
+func (tw *timeoutWriter) WriteHeader(statusCode int) {
+	tw.mu.Lock()
+	defer tw.mu.Unlock()
+
+	if tw.written {
+		return // Discard writes after timeout
+	}
+
+	tw.ResponseWriter.WriteHeader(statusCode)
+}
+
+func (tw *timeoutWriter) Header() http.Header {
+	tw.mu.Lock()
+	defer tw.mu.Unlock()
+
+	if tw.written {
+		// Return a copy to prevent modifications after timeout
+		if tw.header == nil {
+			tw.header = make(http.Header)
+		}
+
+		return tw.header
+	}
+
+	return tw.ResponseWriter.Header()
+}
+
+func (tw *timeoutWriter) markWritten() {
+	tw.mu.Lock()
+	defer tw.mu.Unlock()
+	tw.written = true
+}
+
+// TimeoutMiddleware creates an HTTP middleware that enforces a request timeout.
+// If the handler does not complete within the specified duration, the middleware
+// returns a JSON error response with HTTP status 408 (Request Timeout).
+//
+// The timeout parameter specifies the maximum duration allowed for request processing.
+// The returned middleware handles panics from the wrapped handler by re-panicking
+// after cleanup, and prevents concurrent writes to the response after timeout occurs.
+func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			startTime := time.Now()
+
+			ctx, cancel := context.WithTimeout(r.Context(), timeout)
+			defer cancel()
+
+			tw := &timeoutWriter{
+				ResponseWriter: w,
+				header:         make(http.Header),
+			}
+
+			done := make(chan struct{})
+			panicChan := make(chan interface{}, 1)
+
+			go func() {
+				defer func() {
+					if p := recover(); p != nil {
+						panicChan <- p
+					}
+				}()
+
+				next.ServeHTTP(tw, r.WithContext(ctx))
+				close(done)
+			}()
+
+			select {
+			case p := <-panicChan:
+				panic(p)
+			case <-done:
+				return
+			case <-ctx.Done():
+				tw.markWritten() // Prevent the handler from writing after timeout
+				execTime := time.Since(startTime)
+
+				// Log the timeout as a warning
+				logger.Warn("Request timeout",
+					"method", r.Method,
+					"path", r.URL.Path,
+					"duration_ms", execTime.Milliseconds(),
+					"remote_addr", r.RemoteAddr,
+				)
+
+				// Write directly to the underlying writer since we've marked tw as written
+				// This is safe because markWritten() prevents the handler from writing
+				tw.mu.Lock()
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusRequestTimeout)
+				tw.mu.Unlock()
+
+				response := map[string]interface{}{
+					"status": "error",
+					"error": map[string]interface{}{
+						"msg":  "Request timeout",
+						"code": http.StatusRequestTimeout,
+					},
+					"@meta": map[string]interface{}{
+						"time_zone":      "UTC",
+						"api_version":    1,
+						"execution_time": fmt.Sprintf("%d ms", execTime.Milliseconds()),
+					},
+				}
+
+				_ = json.NewEncoder(w).Encode(response)
+			}
+		})
+	}
 }
 
 // JSONValidationMiddleware is an HTTP middleware that validates JSON API responses.
 // It ensures that responses with Content-Type "application/json" contain valid JSON.
 //
 // If a response is not valid JSON or is empty when JSON is expected, the middleware
-// returns a properly formatted JSON error response. If the request's time limit
-// has passed, it answers 504 with the error message "Request timeout". For other
-// errors, it returns "Internal server error" with status 500 if the original
-// status was 200.
+// returns a properly formatted JSON error response. For timeout errors (status 408),
+// the error message will be "Request timeout". For other errors, it returns
+// "Internal server error" with status 500 if the original status was 200.
 //
 // Non-JSON responses are passed through unchanged.
 func JSONValidationMiddleware(next http.Handler) http.Handler {
@@ -176,14 +293,11 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 		if statusCode == http.StatusOK {
 			statusCode = http.StatusInternalServerError
 		}
-		if deadlinePassed(r.Context()) {
-			statusCode = http.StatusGatewayTimeout
-		}
 		w.WriteHeader(statusCode)
 
 		errorMsg := "Internal server error"
-		if statusCode == http.StatusGatewayTimeout {
-			errorMsg = requestTimeoutMessage
+		if statusCode == http.StatusRequestTimeout {
+			errorMsg = "Request timeout"
 		}
 
 		response := map[string]interface{}{

internal/server/routes.go

@@ -16,12 +16,9 @@ func (s *Server) setupRoutes() {
 	r.Use(middleware.RealIP)
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
-	r.Use(JSONResponseMiddleware)
-	// Timeout must come after JSONResponseMiddleware, which sends its answer
-	// when the handler returns and would send a 200 ahead of Timeout's 504 for
-	// a handler that wrote nothing.
 	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
-	r.Use(middleware.Timeout(requestTimeout))
+	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
+	r.Use(JSONResponseMiddleware)
 
 	// Routes
 	r.Get("/", s.handleIndex())