Remove a peer's live routes when its session goes down (closes #56)

RIS sends no withdrawals for the routes of a peer whose BGP session goes
down, so those routes stayed in the live tables for good.

The streamer now hands STATE messages to the handlers that want them. When
the prefix handler gets one whose state is down, it drops the peer's
updates still in its batch and notes the peer; the next flush deletes all
of the peer's live routes, IPv4 and IPv6, before writing the batch, so
updates the peer sends after the down are kept. The new store method keeps
the in-memory route counts and prefix distribution exact, and an index on
peer_ip lets it find the peer's routes without reading the whole table.

Model: opus-5-5

README.md

@@ -128,7 +128,10 @@ routewatch/
 4. **Handler Details**
    - **ASHandler**: Tracks all ASNs seen in AS paths
    - **PeerHandler**: Records BGP peer information
-   - **PrefixHandler**: Maintains live routing table (upserts on announcement, deletes on withdrawal)
+   - **PrefixHandler**: Maintains live routing table (upserts on announcement, deletes on withdrawal,
+     deletes all of a peer's routes when its BGP session goes down). Routes are kept per peer IP, so
+     when one peer IP has sessions on two collectors, a session going down on one also removes the
+     routes the other still carries, until they are announced again.
    - **PeeringHandler**: Extracts AS peering relationships from AS paths
 
 5. **HTTP Request Flow**
@@ -141,11 +144,15 @@ routewatch/
 - **Batched Writes**: All database operations are batched for performance
 - **Backpressure**: Probabilistic message dropping when queues exceed 50% capacity
 - **Graceful Shutdown**: 60-second timeout, flushes all pending batches
-- **Reconnection**: Exponential backoff (5s-320s) with reset after 30s of stable connection
+- **Reconnection**: Any end of the stream other than shutdown, including RIS Live
+  ending the response normally, marks the feed disconnected and reconnects with
+  exponential backoff (5s-320s). The backoff resets after a stream that lasted
+  more than 30s. A stream with no line for 60s is dropped and reconnected.
 - **IP Lookup**: the most specific live route is found by looking up the
   address's prefix at each mask length, longest first, in the prefix index
-  (at most 33 lookups for IPv4, 129 for IPv6); prefixes are stored in the
-  text form Go's `net/netip` prints
+  (at most 25 lookups for IPv4, 113 for IPv6); prefixes are stored in the
+  text form Go's `net/netip` prints. Routes shorter than /8 for IPv4 or /16
+  for IPv6, such as a default route, are not used.
 
 ### Database Schema
 
@@ -229,6 +236,15 @@ What happens at each limit:
   keeps running.
 - Handler queues: each of the four handler queues holds at most 20,000 messages.
   When a queue fills, the streamer drops messages instead of blocking.
+- Handler batches: while the AS, peer or prefix handler writes a batch to the
+  database, the updates that arrive collect in its next batch, which stops at
+  ten times the batch size: 300,000 updates for the AS handler
+  (`asnBatchMaxSize`, about 10 MiB), 100,000 for the peer handler
+  (`peerBatchMaxSize`, about 10 MiB) and 250,000 for the prefix handler
+  (`prefixBatchMaxSize`, about 60 MiB). At that size the handler takes nothing
+  more off its queue until the write ends, so the queue fills and the streamer
+  drops messages as above. With the batches being written, the three handlers'
+  batches take at most about 0.25 GiB of the Go heap's 1.5 GiB.
 
 With `DEBUG=routewatch` the daemon logs a `System stats` line every 60 seconds
 with the goroutine count and Go memory figures.

internal/database/counts_test.go

@@ -128,7 +128,7 @@ func TestLiveCountsTrackWritesInRealtime(t *testing.T) {
 
 	// A withdrawal removes one route.
 	if err := db.DeleteLiveRouteBatch([]LiveRouteDeletion{
-		{Prefix: "203.0.113.0/24", OriginASN: 64501, PeerIP: "192.0.2.1", IPVersion: ipVersionV4},
+		{Prefix: "203.0.113.0/24", PeerIP: "192.0.2.1", IPVersion: ipVersionV4},
 	}); err != nil {
 		t.Fatalf("DeleteLiveRouteBatch: %v", err)
 	}
@@ -327,13 +327,11 @@ func announceRoutes(db *Database, batch bool, routes []*LiveRoute) error {
 }
 
 // withdrawRoutes removes routes in one DeleteLiveRouteBatch, or with one
-// DeleteLiveRoute each. It names each route by prefix and peer only, with no
-// origin ASN, as a withdrawal from the feed does when its message carries no AS
-// path.
+// DeleteLiveRoute each.
 func withdrawRoutes(db *Database, batch bool, routes []*LiveRoute) error {
 	if !batch {
 		for _, route := range routes {
-			if err := db.DeleteLiveRoute(route.Prefix, 0, route.PeerIP); err != nil {
+			if err := db.DeleteLiveRoute(route.Prefix, route.PeerIP); err != nil {
 				return err
 			}
 		}
@@ -351,6 +349,82 @@ func withdrawRoutes(db *Database, batch bool, routes []*LiveRoute) error {
 	return db.DeleteLiveRouteBatch(deletions)
 }
 
+// TestDeleteLiveRoutesOfPeer gives two peers IPv4 and IPv6 live routes, some
+// for the same prefixes, and deletes all of one peer's routes. The other peer's
+// routes stay, and the route counts and prefix distribution held in memory
+// equal what is read from the route tables.
+func TestDeleteLiveRoutesOfPeer(t *testing.T) {
+	const (
+		peerIP      = "192.0.2.1"
+		otherPeerIP = "192.0.2.2"
+		sharedV4    = "198.51.100.0/24"
+		sharedV6    = "2001:db8::/32"
+	)
+
+	db, err := New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	ofPeer := func(peer string, route *LiveRoute) *LiveRoute {
+		route.PeerIP = peer
+
+		return route
+	}
+	onlyV6 := mkV6Route("2001:db8:1::/48", 64503, ts)
+	onlyV6.MaskLength = 48
+	if err := db.UpsertLiveRouteBatch([]*LiveRoute{
+		ofPeer(peerIP, mkV4Route(t, sharedV4, 64500, ts)),
+		ofPeer(otherPeerIP, mkV4Route(t, sharedV4, 64500, ts)),
+		ofPeer(peerIP, mkV4Route(t, "203.0.113.0/24", 64501, ts)),
+		ofPeer(peerIP, mkV6Route(sharedV6, 64502, ts)),
+		ofPeer(otherPeerIP, mkV6Route(sharedV6, 64502, ts)),
+		ofPeer(peerIP, onlyV6),
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	if err := db.DeleteLiveRoutesOfPeer(peerIP); err != nil {
+		t.Fatalf("DeleteLiveRoutesOfPeer: %v", err)
+	}
+
+	ctx := context.Background()
+	for _, prefix := range []string{sharedV4, sharedV6} {
+		routes, _, err := db.GetPrefixDetailsContext(ctx, prefix)
+		if err != nil {
+			t.Fatalf("GetPrefixDetailsContext(%s): %v", prefix, err)
+		}
+		if len(routes) != 1 || routes[0].PeerIP != otherPeerIP {
+			t.Errorf("live routes for %s = %+v, want only the one from %s", prefix, routes, otherPeerIP)
+		}
+	}
+
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	tableV4, tableV6, err := db.GetLiveRouteCountsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetLiveRouteCountsContext: %v", err)
+	}
+	if stats.IPv4Routes != 1 || tableV4 != 1 || stats.IPv6Routes != 1 || tableV6 != 1 {
+		t.Errorf("live routes (IPv4, IPv6): (%d, %d) in memory, (%d, %d) in the tables, want (1, 1)",
+			stats.IPv4Routes, stats.IPv6Routes, tableV4, tableV6)
+	}
+	queryV4, queryV6, err := db.GetPrefixDistributionContext(ctx)
+	if err != nil {
+		t.Fatalf("GetPrefixDistributionContext: %v", err)
+	}
+	wantV4 := []PrefixDistribution{{MaskLength: 24, Count: 1}}
+	wantV6 := []PrefixDistribution{{MaskLength: 32, Count: 1}}
+	assertDistribution(t, "IPv4 distribution", stats.IPv4PrefixDistribution, wantV4)
+	assertDistribution(t, "IPv6 distribution", stats.IPv6PrefixDistribution, wantV6)
+	assertDistribution(t, "IPv4 distribution query", queryV4, wantV4)
+	assertDistribution(t, "IPv6 distribution query", queryV6, wantV6)
+}
+
 // TestStatsRouteTimestamps checks the oldest/newest route timestamps are read
 // from the right rows across both tables and parse into time.Time. The old
 // MIN/MAX union query read its result into *time.Time, which the driver could

internal/database/database.go

@@ -37,6 +37,14 @@ const (
 	ipv6Bits       = 128
 )
 
+// The IP lookup does not use routes shorter than these mask lengths. A default
+// route or a route this short only says where a peer sends traffic it has no
+// better route for; it does not say who holds the address.
+const (
+	minLookupMaskLengthV4 = 8
+	minLookupMaskLengthV6 = 16
+)
+
 // SQLite memory tuning. cache_size and busy_timeout go in the DSN so every
 // pooled connection gets them; the heap limits are process-wide and set once.
 const (
@@ -220,21 +228,22 @@ func (d *Database) beginTx() (*loggingTx, error) {
 }
 
 // A live-route upsert is an UPDATE followed, only when no row matched, by an
-// INSERT. The UPDATE's rows-affected count (1 for an existing key, 0 for a new
-// one) is what lets the in-memory route counters stay exact without a COUNT(*).
-// Callers hold the database write lock, so no other writer can insert the same
-// key between the two statements. The id column is set only on INSERT, so an
-// updated route keeps its original id, exactly as the previous ON CONFLICT
-// upsert did.
+// INSERT. A live route is keyed by prefix and peer, so an announcement replaces
+// the peer's route for the prefix whatever its origin AS. The UPDATE's
+// rows-affected count (1 for an existing key, 0 for a new one) is what lets the
+// in-memory route counters stay exact without a COUNT(*). Callers hold the
+// database write lock, so no other writer can insert the same key between the
+// two statements. The id column is set only on INSERT, so an updated route
+// keeps its original id, exactly as the previous ON CONFLICT upsert did.
 const (
-	updateLiveRouteV4SQL = `UPDATE live_routes_v4 SET mask_length = ?, as_path = ?, next_hop = ?,
-		last_updated = ? WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`
+	updateLiveRouteV4SQL = `UPDATE live_routes_v4 SET mask_length = ?, origin_asn = ?, as_path = ?,
+		next_hop = ?, last_updated = ? WHERE prefix = ? AND peer_ip = ?`
 
 	insertLiveRouteV4SQL = `INSERT INTO live_routes_v4 (id, prefix, mask_length, origin_asn, peer_ip,
 		as_path, next_hop, last_updated) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
 
-	updateLiveRouteV6SQL = `UPDATE live_routes_v6 SET mask_length = ?, as_path = ?, next_hop = ?,
-		last_updated = ? WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`
+	updateLiveRouteV6SQL = `UPDATE live_routes_v6 SET mask_length = ?, origin_asn = ?, as_path = ?,
+		next_hop = ?, last_updated = ? WHERE prefix = ? AND peer_ip = ?`
 
 	insertLiveRouteV6SQL = `INSERT INTO live_routes_v6 (id, prefix, mask_length, origin_asn, peer_ip,
 		as_path, next_hop, last_updated) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
@@ -253,8 +262,8 @@ const (
 // live route for its prefix.
 func upsertRouteRowV4(upd, ins, has *sql.Stmt, route *LiveRoute, pathJSON string) (
 	inserted, newPrefix bool, err error) {
-	res, err := upd.Exec(route.MaskLength, pathJSON, route.NextHop, route.LastUpdated,
-		route.Prefix, route.OriginASN, route.PeerIP)
+	res, err := upd.Exec(route.MaskLength, route.OriginASN, pathJSON, route.NextHop, route.LastUpdated,
+		route.Prefix, route.PeerIP)
 	if err != nil {
 		return false, false, err
 	}
@@ -285,8 +294,8 @@ func upsertRouteRowV4(upd, ins, has *sql.Stmt, route *LiveRoute, pathJSON string
 // live route for its prefix.
 func upsertRouteRowV6(upd, ins, has *sql.Stmt, route *LiveRoute, pathJSON string) (
 	inserted, newPrefix bool, err error) {
-	res, err := upd.Exec(route.MaskLength, pathJSON, route.NextHop, route.LastUpdated,
-		route.Prefix, route.OriginASN, route.PeerIP)
+	res, err := upd.Exec(route.MaskLength, route.OriginASN, pathJSON, route.NextHop, route.LastUpdated,
+		route.Prefix, route.PeerIP)
 	if err != nil {
 		return false, false, err
 	}
@@ -433,32 +442,18 @@ func (d *Database) DeleteLiveRouteBatch(deletions []LiveRouteDeletion) error {
 		}
 	}()
 
-	// No longer need to separate deletions since we handle them in the loop below
-
 	// Prepare statements for both IPv4 and IPv6 tables
-	stmtV4WithOrigin, err := tx.Prepare(`DELETE FROM live_routes_v4 WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`)
+	deleteV4, err := tx.Prepare(`DELETE FROM live_routes_v4 WHERE prefix = ? AND peer_ip = ?`)
 	if err != nil {
-		return fmt.Errorf("failed to prepare IPv4 delete with origin statement: %w", err)
+		return fmt.Errorf("failed to prepare IPv4 delete statement: %w", err)
 	}
-	defer func() { _ = stmtV4WithOrigin.Close() }()
+	defer func() { _ = deleteV4.Close() }()
 
-	stmtV4WithoutOrigin, err := tx.Prepare(`DELETE FROM live_routes_v4 WHERE prefix = ? AND peer_ip = ?`)
+	deleteV6, err := tx.Prepare(`DELETE FROM live_routes_v6 WHERE prefix = ? AND peer_ip = ?`)
 	if err != nil {
-		return fmt.Errorf("failed to prepare IPv4 delete without origin statement: %w", err)
+		return fmt.Errorf("failed to prepare IPv6 delete statement: %w", err)
 	}
-	defer func() { _ = stmtV4WithoutOrigin.Close() }()
-
-	stmtV6WithOrigin, err := tx.Prepare(`DELETE FROM live_routes_v6 WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`)
-	if err != nil {
-		return fmt.Errorf("failed to prepare IPv6 delete with origin statement: %w", err)
-	}
-	defer func() { _ = stmtV6WithOrigin.Close() }()
-
-	stmtV6WithoutOrigin, err := tx.Prepare(`DELETE FROM live_routes_v6 WHERE prefix = ? AND peer_ip = ?`)
-	if err != nil {
-		return fmt.Errorf("failed to prepare IPv6 delete without origin statement: %w", err)
-	}
-	defer func() { _ = stmtV6WithoutOrigin.Close() }()
+	defer func() { _ = deleteV6.Close() }()
 
 	hasV4, err := tx.Prepare(prefixHasLiveRouteV4SQL)
 	if err != nil {
@@ -477,38 +472,18 @@ func (d *Database) DeleteLiveRouteBatch(deletions []LiveRouteDeletion) error {
 	// Mask lengths of the prefixes this batch leaves with no live route.
 	var gonePrefixMaskLengthsV4, gonePrefixMaskLengthsV6 []int
 	for _, del := range deletions {
-		var stmt *sql.Stmt
-
-		// Select appropriate statement based on IP version and whether we have origin ASN
-		//nolint:nestif // Clear logic for selecting the right statement
-		if del.IPVersion == ipVersionV4 {
-			if del.OriginASN == 0 {
-				stmt = stmtV4WithoutOrigin
-			} else {
-				stmt = stmtV4WithOrigin
-			}
-		} else {
-			if del.OriginASN == 0 {
-				stmt = stmtV6WithoutOrigin
-			} else {
-				stmt = stmtV6WithOrigin
-			}
-		}
-
-		// Execute deletion
-		var res sql.Result
-		if del.OriginASN == 0 {
-			res, err = stmt.Exec(del.Prefix, del.PeerIP)
-		} else {
-			res, err = stmt.Exec(del.Prefix, del.OriginASN, del.PeerIP)
+		stmt := deleteV4
+		if del.IPVersion != ipVersionV4 {
+			stmt = deleteV6
 		}
 
+		res, err := stmt.Exec(del.Prefix, del.PeerIP)
 		if err != nil {
 			return fmt.Errorf("failed to delete route %s: %w", del.Prefix, err)
 		}
 
-		// A deletion with no origin ASN can remove several rows, so use the
-		// exact rows-affected count to keep the in-memory route counters right.
+		// The feed often withdraws a route that is not live, which deletes
+		// nothing, so the in-memory route counters use the rows-affected count.
 		affected, err := res.RowsAffected()
 		if err != nil {
 			return fmt.Errorf("failed to count deleted route %s: %w", del.Prefix, err)
@@ -555,6 +530,90 @@ func (d *Database) DeleteLiveRouteBatch(deletions []LiveRouteDeletion) error {
 	return nil
 }
 
+// Deleting all live routes of a peer. The first query of each table selects the
+// mask length of each of the peer's routes whose prefix no other peer has a
+// live route for: the delete takes those prefixes out of the prefix
+// distribution.
+const (
+	peerOnlyRouteMaskLengthsV4SQL = `SELECT r.mask_length FROM live_routes_v4 AS r WHERE r.peer_ip = ?
+		AND NOT EXISTS (SELECT 1 FROM live_routes_v4 AS o WHERE o.prefix = r.prefix AND o.peer_ip != r.peer_ip)`
+	deletePeerLiveRoutesV4SQL = `DELETE FROM live_routes_v4 WHERE peer_ip = ?`
+
+	peerOnlyRouteMaskLengthsV6SQL = `SELECT r.mask_length FROM live_routes_v6 AS r WHERE r.peer_ip = ?
+		AND NOT EXISTS (SELECT 1 FROM live_routes_v6 AS o WHERE o.prefix = r.prefix AND o.peer_ip != r.peer_ip)`
+	deletePeerLiveRoutesV6SQL = `DELETE FROM live_routes_v6 WHERE peer_ip = ?`
+)
+
+// deletePeerRoutes deletes all live routes of peerIP from one table, given that
+// table's two statements above. It returns how many routes it deleted and the
+// mask length of each prefix it left with no live route.
+func deletePeerRoutes(tx *loggingTx, onlyRouteMaskLengthsSQL, deleteSQL, peerIP string) (
+	deleted int64, goneMaskLengths []int, err error) {
+	rows, err := tx.Query(onlyRouteMaskLengthsSQL, peerIP)
+	if err != nil {
+		return 0, nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	for rows.Next() {
+		var maskLength int
+		if err := rows.Scan(&maskLength); err != nil {
+			return 0, nil, err
+		}
+		goneMaskLengths = append(goneMaskLengths, maskLength)
+	}
+	if err := rows.Err(); err != nil {
+		return 0, nil, err
+	}
+
+	res, err := tx.Exec(deleteSQL, peerIP)
+	if err != nil {
+		return 0, nil, err
+	}
+	deleted, err = res.RowsAffected()
+	if err != nil {
+		return 0, nil, err
+	}
+
+	return deleted, goneMaskLengths, nil
+}
+
+// DeleteLiveRoutesOfPeer deletes every live route of the peer, IPv4 and IPv6,
+// in one transaction, as when the peer's BGP session goes down.
+func (d *Database) DeleteLiveRoutesOfPeer(peerIP string) error {
+	d.lock("DeleteLiveRoutesOfPeer")
+	defer d.unlock()
+
+	tx, err := d.beginTx()
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
+	}
+	defer func() {
+		if err := tx.Rollback(); err != nil && err != sql.ErrTxDone {
+			d.logger.Error("Failed to rollback transaction", "error", err)
+		}
+	}()
+
+	deletedV4, goneMaskLengthsV4, err := deletePeerRoutes(tx,
+		peerOnlyRouteMaskLengthsV4SQL, deletePeerLiveRoutesV4SQL, peerIP)
+	if err != nil {
+		return fmt.Errorf("failed to delete the IPv4 routes of peer %s: %w", peerIP, err)
+	}
+	deletedV6, goneMaskLengthsV6, err := deletePeerRoutes(tx,
+		peerOnlyRouteMaskLengthsV6SQL, deletePeerLiveRoutesV6SQL, peerIP)
+	if err != nil {
+		return fmt.Errorf("failed to delete the IPv6 routes of peer %s: %w", peerIP, err)
+	}
+
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("failed to commit transaction: %w", err)
+	}
+
+	d.counts.addRoutes(-int(deletedV4), -int(deletedV6))
+	d.counts.addToDistribution(goneMaskLengthsV4, goneMaskLengthsV6, -1)
+
+	return nil
+}
+
 // UpdatePrefixesBatch updates the last_seen time for multiple prefixes in a single transaction
 func (d *Database) UpdatePrefixesBatch(prefixes map[string]time.Time) error {
 	if len(prefixes) == 0 {
@@ -1274,9 +1333,8 @@ func (d *Database) UpsertLiveRoute(route *LiveRoute) error {
 	return nil
 }
 
-// DeleteLiveRoute deletes a live route
-// If originASN is 0, deletes all routes for the prefix/peer combination
-func (d *Database) DeleteLiveRoute(prefix string, originASN int, peerIP string) error {
+// DeleteLiveRoute deletes the live route the peer has for the prefix
+func (d *Database) DeleteLiveRoute(prefix, peerIP string) error {
 	d.lock("DeleteLiveRoute")
 	defer d.unlock()
 
@@ -1301,22 +1359,12 @@ func (d *Database) DeleteLiveRoute(prefix string, originASN int, peerIP string)
 	}()
 
 	// Literal per-table queries (rather than one formatted with the table name)
-	// so the delete carries no dynamically built SQL. A delete with no origin
-	// ASN can remove several rows.
+	// so the delete carries no dynamically built SQL.
 	var res sql.Result
-	switch {
-	case isV4 && originASN == 0:
+	if isV4 {
 		res, err = tx.Exec(`DELETE FROM live_routes_v4 WHERE prefix = ? AND peer_ip = ?`, prefix, peerIP)
-	case isV4:
-		res, err = tx.Exec(
-			`DELETE FROM live_routes_v4 WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`,
-			prefix, originASN, peerIP)
-	case originASN == 0:
+	} else {
 		res, err = tx.Exec(`DELETE FROM live_routes_v6 WHERE prefix = ? AND peer_ip = ?`, prefix, peerIP)
-	default:
-		res, err = tx.Exec(
-			`DELETE FROM live_routes_v6 WHERE prefix = ? AND origin_asn = ? AND peer_ip = ?`,
-			prefix, originASN, peerIP)
 	}
 	if err != nil {
 		return err
@@ -1624,16 +1672,17 @@ func (d *Database) GetASPeersContext(ctx context.Context, asn int) ([]ASPeer, er
 }
 
 // GetPrefixDetails returns detailed information about a prefix
-func (d *Database) GetPrefixDetails(prefix string) ([]LiveRoute, error) {
+func (d *Database) GetPrefixDetails(prefix string) ([]LiveRoute, map[int]ASN, error) {
 	return d.GetPrefixDetailsContext(context.Background(), prefix)
 }
 
-// GetPrefixDetailsContext returns detailed information about a prefix with context support
-func (d *Database) GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, error) {
+// GetPrefixDetailsContext returns the live routes for a prefix and, keyed by
+// AS number, the handle and description of each AS that originates it.
+func (d *Database) GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, map[int]ASN, error) {
 	// Determine if it's IPv4 or IPv6 by parsing the prefix
 	_, ipnet, err := net.ParseCIDR(prefix)
 	if err != nil {
-		return nil, fmt.Errorf("invalid prefix format: %w", err)
+		return nil, nil, fmt.Errorf("invalid prefix format: %w", err)
 	}
 
 	tableName := "live_routes_v4"
@@ -1655,11 +1704,12 @@ func (d *Database) GetPrefixDetailsContext(ctx context.Context, prefix string) (
 
 	rows, err := d.db.QueryContext(ctx, query, prefix)
 	if err != nil {
-		return nil, fmt.Errorf("failed to query prefix details: %w", err)
+		return nil, nil, fmt.Errorf("failed to query prefix details: %w", err)
 	}
 	defer func() { _ = rows.Close() }()
 
 	var routes []LiveRoute
+	origins := make(map[int]ASN)
 	for rows.Next() {
 		var route LiveRoute
 		var pathJSON string
@@ -1682,13 +1732,18 @@ func (d *Database) GetPrefixDetailsContext(ctx context.Context, prefix string) (
 		route.IPVersion = ipVersion
 		route.MaskLength, _ = ipnet.Mask.Size()
 		routes = append(routes, route)
+		origins[route.OriginASN] = ASN{
+			ASN:         route.OriginASN,
+			Handle:      handle.String,
+			Description: description.String,
+		}
 	}
 
 	if len(routes) == 0 {
-		return nil, fmt.Errorf("%w: %s", ErrNoRoute, prefix)
+		return nil, nil, fmt.Errorf("%w: %s", ErrNoRoute, prefix)
 	}
 
-	return routes, nil
+	return routes, origins, nil
 }
 
 // GetRandomPrefixesByLength returns a random sample of prefixes with the specified mask length
@@ -1876,11 +1931,12 @@ func (d *Database) GetIPInfo(ip string) (*IPInfo, error) {
 // GetIPInfoContext returns comprehensive IP information with context support.
 //
 // It finds the most specific live route for the address with point lookups on
-// the prefix index: for each mask length from the longest (32 or 128) down to 0
-// it looks up the address's network prefix at that length, and the first length
-// with a live route wins. That is at most 33 or 129 indexed lookups, however
-// many routes are live. The prefix is looked up in the text form net/netip
-// prints, which is the form the prefix handler stores.
+// the prefix index: for each mask length from the longest (32 or 128) down to
+// minLookupMaskLengthV4 or minLookupMaskLengthV6 it looks up the address's
+// network prefix at that length, and the first length with a live route wins.
+// That is at most 25 or 113 indexed lookups, however many routes are live. The
+// prefix is looked up in the text form net/netip prints, which is the form the
+// prefix handler stores.
 func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, error) {
 	addr, err := netip.ParseAddr(ip)
 	if err != nil {
@@ -1891,9 +1947,11 @@ func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, er
 
 	info := &IPInfo{IP: ip, IPVersion: ipVersionV6}
 	routesTable, prefixesTable := "live_routes_v6", "prefixes_v6"
+	minMaskLength := minLookupMaskLengthV6
 	if addr.Is4() {
 		info.IPVersion = ipVersionV4
 		routesTable, prefixesTable = "live_routes_v4", "prefixes_v4"
+		minMaskLength = minLookupMaskLengthV4
 	}
 
 	// Route info with peer count and prefix first_seen
@@ -1934,7 +1992,7 @@ func (d *Database) GetIPInfoContext(ctx context.Context, ip string) (*IPInfo, er
 	var whoisUpdatedAt sql.NullTime
 
 	found := false
-	for bits := addr.BitLen(); bits >= 0; bits-- {
+	for bits := addr.BitLen(); bits >= minMaskLength; bits-- {
 		prefix := netip.PrefixFrom(addr, bits).Masked().String()
 		err := stmt.QueryRowContext(ctx, prefix).Scan(
 			&info.Netblock,

internal/database/database_test.go

@@ -13,6 +13,7 @@ import (
 	"git.eeqj.de/sneak/routewatch/internal/config"
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"github.com/google/uuid"
+	"github.com/mattn/go-sqlite3"
 )
 
 // tempStoreMemory is the PRAGMA temp_store value meaning "hold temp B-trees in
@@ -122,8 +123,8 @@ func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
 	lookup("2001:db9::1", "")
 
 	err = db.DeleteLiveRouteBatch([]LiveRouteDeletion{
-		{Prefix: "10.1.2.0/24", OriginASN: 64502, PeerIP: testPeerIP, IPVersion: ipVersionV4},
-		{Prefix: "2001:db8:1:2::/64", OriginASN: 64502, PeerIP: testPeerIP, IPVersion: ipVersionV6},
+		{Prefix: "10.1.2.0/24", PeerIP: testPeerIP, IPVersion: ipVersionV4},
+		{Prefix: "2001:db8:1:2::/64", PeerIP: testPeerIP, IPVersion: ipVersionV6},
 	})
 	if err != nil {
 		t.Fatalf("DeleteLiveRouteBatch: %v", err)
@@ -133,6 +134,112 @@ func TestGetIPInfoFindsMostSpecificLiveRoute(t *testing.T) {
 	lookup("2001:db8:1:2::3", "2001:db8:1::/48")
 }
 
+// TestGetIPInfoIgnoresShortRoutes checks that the IP lookup does not report a
+// default route, or a route shorter than /8 for IPv4 or /16 for IPv6, as the
+// route for an address, and that a route of exactly /8 or /16, or longer, still
+// is. The prefixes are written out so that a wrong limit fails the test.
+func TestGetIPInfoIgnoresShortRoutes(t *testing.T) {
+	cfg := &config.Config{StateDir: t.TempDir()}
+
+	db, err := New(cfg, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(prefix string, asn int) {
+		t.Helper()
+
+		err := db.UpsertLiveRouteBatch([]*LiveRoute{{
+			ID:          uuid.New(),
+			Prefix:      prefix,
+			MaskLength:  netip.MustParsePrefix(prefix).Bits(),
+			IPVersion:   detectIPVersion(prefix),
+			OriginASN:   asn,
+			PeerIP:      testPeerIP,
+			ASPath:      []int{asn},
+			NextHop:     testPeerIP,
+			LastUpdated: ts,
+		}})
+		if err != nil {
+			t.Fatalf("UpsertLiveRouteBatch(%s): %v", prefix, err)
+		}
+	}
+
+	// lookup checks that ip resolves to the live prefix netblock from asn.
+	lookup := func(ip, netblock string, asn int) {
+		t.Helper()
+
+		info, err := db.GetIPInfo(ip)
+		if err != nil {
+			t.Errorf("GetIPInfo(%s): %v", ip, err)
+
+			return
+		}
+		if info.Netblock != netblock || info.ASN != asn {
+			t.Errorf("GetIPInfo(%s) = %s AS%d, want %s AS%d", ip, info.Netblock, info.ASN, netblock, asn)
+		}
+	}
+
+	// Default and very short routes, and routes one bit shorter than each limit.
+	announce("2000::/3", 64500)
+	announce("0.0.0.0/0", 64500)
+	announce("2000::/15", 64500)
+	announce("192.0.0.0/7", 64500)
+
+	for _, ip := range []string{"2001:db8::1", "192.0.2.1"} {
+		if info, err := db.GetIPInfo(ip); !errors.Is(err, ErrNoRoute) {
+			t.Errorf("GetIPInfo(%s) with only short routes = %+v, %v; want ErrNoRoute", ip, info, err)
+		}
+	}
+
+	// Routes of exactly the minimum length are used.
+	announce("2001::/16", 64501)
+	announce("192.0.0.0/8", 64501)
+
+	lookup("2001:db8::1", "2001::/16", 64501)
+	lookup("192.0.2.1", "192.0.0.0/8", 64501)
+
+	announce("2001:db8::/32", 64502)
+
+	lookup("2001:db8::1", "2001:db8::/32", 64502)
+}
+
+// TestLiveRouteTablesHoldOneRoutePerPrefixAndPeer checks that each live route
+// table refuses a second route from a peer for a prefix, even with another
+// origin AS. An upsert updates the peer's route before it would insert one, so
+// only an insert straight into the table shows what the table allows.
+func TestLiveRouteTablesHoldOneRoutePerPrefixAndPeer(t *testing.T) {
+	db, err := New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("failed to create database: %v", err)
+	}
+	defer func() { _ = db.Close() }()
+
+	const otherOriginASN = 64501
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	for _, tt := range []struct {
+		route     *LiveRoute
+		insertSQL string
+	}{
+		{route: mkV4Route(t, "198.51.100.0/24", 64500, ts), insertSQL: insertLiveRouteV4SQL},
+		{route: mkV6Route("2001:db8::/32", 64500, ts), insertSQL: insertLiveRouteV6SQL},
+	} {
+		if err := db.UpsertLiveRoute(tt.route); err != nil {
+			t.Fatalf("UpsertLiveRoute(%s): %v", tt.route.Prefix, err)
+		}
+
+		_, err := db.db.Exec(tt.insertSQL, uuid.NewString(), tt.route.Prefix, tt.route.MaskLength,
+			otherOriginASN, tt.route.PeerIP, "[]", tt.route.NextHop, ts)
+		var sqliteErr sqlite3.Error
+		if !errors.As(err, &sqliteErr) || sqliteErr.ExtendedCode != sqlite3.ErrConstraintUnique {
+			t.Errorf("second route from peer %s for %s: error %v, want a UNIQUE constraint error",
+				tt.route.PeerIP, tt.route.Prefix, err)
+		}
+	}
+}
+
 // TestConnectionPoolPragmas holds several pooled connections open at once and
 // checks each one carries the per-connection settings from the DSN, plus the
 // process-wide hard heap limit, and sees the new file with auto_vacuum
@@ -234,7 +341,6 @@ func TestVacuumReturnsFreePages(t *testing.T) {
 		routes = append(routes, route)
 		deletions = append(deletions, LiveRouteDeletion{
 			Prefix:    route.Prefix,
-			OriginASN: asn,
 			PeerIP:    route.PeerIP,
 			IPVersion: ipVersionV4,
 		})

internal/database/interface.go

@@ -55,8 +55,9 @@ type Store interface {
 	// Live route operations
 	UpsertLiveRoute(route *LiveRoute) error
 	UpsertLiveRouteBatch(routes []*LiveRoute) error
-	DeleteLiveRoute(prefix string, originASN int, peerIP string) error
+	DeleteLiveRoute(prefix, peerIP string) error
 	DeleteLiveRouteBatch(deletions []LiveRouteDeletion) error
+	DeleteLiveRoutesOfPeer(peerIP string) error
 	GetPrefixDistribution() (ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
 	GetPrefixDistributionContext(ctx context.Context) (ipv4 []PrefixDistribution, ipv6 []PrefixDistribution, err error)
 	GetLiveRouteCounts() (ipv4Count, ipv6Count int, err error)
@@ -76,8 +77,8 @@ type Store interface {
 	GetASDetailsContext(ctx context.Context, asn int) (*ASN, []LiveRoute, error)
 	GetASPeers(asn int) ([]ASPeer, error)
 	GetASPeersContext(ctx context.Context, asn int) ([]ASPeer, error)
-	GetPrefixDetails(prefix string) ([]LiveRoute, error)
-	GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, error)
+	GetPrefixDetails(prefix string) ([]LiveRoute, map[int]ASN, error)
+	GetPrefixDetailsContext(ctx context.Context, prefix string) ([]LiveRoute, map[int]ASN, error)
 	GetRandomPrefixesByLength(maskLength, ipVersion, limit int) ([]LiveRoute, error)
 	GetRandomPrefixesByLengthContext(ctx context.Context, maskLength, ipVersion, limit int) ([]LiveRoute, error)
 

internal/database/models.go

@@ -114,7 +114,6 @@ type IPInfo struct {
 // LiveRouteDeletion represents parameters for deleting a live route
 type LiveRouteDeletion struct {
 	Prefix    string
-	OriginASN int
 	PeerIP    string
 	IPVersion int
 }

internal/database/schema.sql

@@ -107,7 +107,7 @@ CREATE TABLE IF NOT EXISTS live_routes_v4 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	UNIQUE(prefix, origin_asn, peer_ip)
+	UNIQUE(prefix, peer_ip) -- a peer has at most one route for a prefix
 );
 
 -- IPv6 routing table maintained by PrefixHandler
@@ -120,7 +120,7 @@ CREATE TABLE IF NOT EXISTS live_routes_v6 (
 	as_path TEXT NOT NULL, -- JSON array
 	next_hop TEXT NOT NULL,
 	last_updated DATETIME NOT NULL,
-	UNIQUE(prefix, origin_asn, peer_ip)
+	UNIQUE(prefix, peer_ip) -- a peer has at most one route for a prefix
 );
 
 -- Indexes for live_routes_v4 table
@@ -130,6 +130,8 @@ CREATE INDEX IF NOT EXISTS idx_live_routes_v4_origin_asn ON live_routes_v4(origi
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_last_updated ON live_routes_v4(last_updated);
 -- Index to optimize prefix distribution queries
 CREATE INDEX IF NOT EXISTS idx_live_routes_v4_mask_prefix ON live_routes_v4(mask_length, prefix);
+-- Index to find a peer's routes when its BGP session goes down
+CREATE INDEX IF NOT EXISTS idx_live_routes_v4_peer_ip ON live_routes_v4(peer_ip);
 
 -- Indexes for live_routes_v6 table
 CREATE INDEX IF NOT EXISTS idx_live_routes_v6_prefix ON live_routes_v6(prefix);
@@ -137,4 +139,6 @@ CREATE INDEX IF NOT EXISTS idx_live_routes_v6_mask_length ON live_routes_v6(mask
 CREATE INDEX IF NOT EXISTS idx_live_routes_v6_origin_asn ON live_routes_v6(origin_asn);
 CREATE INDEX IF NOT EXISTS idx_live_routes_v6_last_updated ON live_routes_v6(last_updated);
 -- Index to optimize prefix distribution queries
-CREATE INDEX IF NOT EXISTS idx_live_routes_v6_mask_prefix ON live_routes_v6(mask_length, prefix);
+CREATE INDEX IF NOT EXISTS idx_live_routes_v6_mask_prefix ON live_routes_v6(mask_length, prefix);
+-- Index to find a peer's routes when its BGP session goes down
+CREATE INDEX IF NOT EXISTS idx_live_routes_v6_peer_ip ON live_routes_v6(peer_ip);

internal/metrics/metrics.go

@@ -60,17 +60,22 @@ func New() *Tracker {
 	}
 }
 
-// SetConnected updates the connection status
+// SetConnected updates the connection status. Every connection after the
+// first counts one reconnect.
 func (t *Tracker) SetConnected(connected bool) {
-	wasConnected := t.isConnected.Swap(connected)
-	if connected {
-		t.mu.Lock()
-		t.connectedSince = time.Now()
-		t.mu.Unlock()
-		// Increment reconnect count (but not for the initial connection)
-		if wasConnected || t.reconnectCount.Load() > 0 {
-			t.reconnectCount.Add(1)
-		}
+	t.isConnected.Store(connected)
+	if !connected {
+		return
+	}
+
+	t.mu.Lock()
+	// connectedSince is zero until the first connection.
+	connectedBefore := !t.connectedSince.IsZero()
+	t.connectedSince = time.Now()
+	t.mu.Unlock()
+
+	if connectedBefore {
+		t.reconnectCount.Add(1)
 	}
 }
 

internal/metrics/metrics_test.go

@@ -0,0 +1,21 @@
+package metrics
+
+import "testing"
+
+// TestReconnectCount connects three times with a disconnect between each, the
+// way the streamer does, and expects every connection after the first to count
+// one reconnect.
+func TestReconnectCount(t *testing.T) {
+	tracker := New()
+
+	tracker.SetConnected(true)
+	tracker.SetConnected(false)
+	tracker.SetConnected(true)
+	tracker.SetConnected(false)
+	tracker.SetConnected(true)
+
+	const wantReconnects = 2
+	if got := tracker.GetReconnectCount(); got != wantReconnects {
+		t.Fatalf("reconnect count = %d, want %d", got, wantReconnects)
+	}
+}

internal/ristypes/ris.go

@@ -6,6 +6,22 @@ import (
 	"time"
 )
 
+// Message types and the session state the handlers act on, as the feed writes
+// them in a message's type and state fields.
+const (
+	// MessageTypeUpdate is a BGP UPDATE: announcements and withdrawals.
+	MessageTypeUpdate = "UPDATE"
+
+	// MessageTypeState is a change in the state of the BGP session between
+	// the collector and the peer.
+	MessageTypeState = "STATE"
+
+	// StateDown is the state of a STATE message whose session has ended: the
+	// collector no longer has any of the peer's routes, and sends no
+	// withdrawals for them.
+	StateDown = "down"
+)
+
 // ASPath represents a BGP AS path as a slice of AS numbers.
 // It handles JSON unmarshaling of both simple arrays and nested AS sets,
 // flattening any nested structures into a single sequence of AS numbers.
@@ -85,6 +101,8 @@ type RISMessage struct {
 	Announcements []RISAnnouncement `json:"announcements,omitempty"`
 	Withdrawals   []string          `json:"withdrawals,omitempty"`
 	Raw           string            `json:"-"`
+	// State is set on STATE messages: the session's new state, such as StateDown.
+	State string `json:"state,omitempty"`
 }
 
 // RISAnnouncement represents a BGP route announcement within a RIS message.

internal/routewatch/app_integration_test.go

@@ -205,7 +205,7 @@ func (m *mockStore) UpsertLiveRoute(route *database.LiveRoute) error {
 }
 
 // DeleteLiveRoute mock implementation
-func (m *mockStore) DeleteLiveRoute(prefix string, originASN int, peerIP string) error {
+func (m *mockStore) DeleteLiveRoute(prefix, peerIP string) error {
 	// Simple mock - just return nil
 	return nil
 }
@@ -252,13 +252,15 @@ func (m *mockStore) GetASDetailsContext(ctx context.Context, asn int) (*database
 }
 
 // GetPrefixDetails mock implementation
-func (m *mockStore) GetPrefixDetails(prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetails(prefix string) ([]database.LiveRoute, map[int]database.ASN, error) {
 	// Return empty routes for now
-	return []database.LiveRoute{}, nil
+	return []database.LiveRoute{}, map[int]database.ASN{}, nil
 }
 
 // GetPrefixDetailsContext mock implementation with context support
-func (m *mockStore) GetPrefixDetailsContext(ctx context.Context, prefix string) ([]database.LiveRoute, error) {
+func (m *mockStore) GetPrefixDetailsContext(
+	ctx context.Context, prefix string,
+) ([]database.LiveRoute, map[int]database.ASN, error) {
 	return m.GetPrefixDetails(prefix)
 }
 
@@ -362,6 +364,12 @@ func (m *mockStore) DeleteLiveRouteBatch(deletions []database.LiveRouteDeletion)
 	return nil
 }
 
+// DeleteLiveRoutesOfPeer mock implementation
+func (m *mockStore) DeleteLiveRoutesOfPeer(peerIP string) error {
+	// Simple mock - just return nil
+	return nil
+}
+
 // GetOrCreateASNBatch mock implementation
 func (m *mockStore) GetOrCreateASNBatch(asns map[int]time.Time) error {
 	m.mu.Lock()

internal/routewatch/ashandler.go

@@ -19,6 +19,12 @@ const (
 	// asnBatchSize is the number of ASN operations to batch together
 	asnBatchSize = 30000
 
+	// asnBatchMaxSize is the most ASN operations the batch holds while the
+	// flush goroutine writes the previous one: ten batches, about 10 MiB
+	// (README "Memory"). At this size HandleMessage waits until the flush
+	// goroutine takes the batch.
+	asnBatchMaxSize = 300000
+
 	// asnBatchTimeout is the maximum time to wait before flushing a batch
 	// DO NOT reduce this timeout - larger batches are more efficient
 	asnBatchTimeout = 2 * time.Second
@@ -32,12 +38,16 @@ type ASHandler struct {
 	db     database.Store
 	logger *logger.Logger
 
-	// Batching
-	mu        sync.Mutex
-	batch     []asnOp
-	lastFlush time.Time
-	stopCh    chan struct{}
-	wg        sync.WaitGroup
+	// Batching. mu guards batch only: the flush goroutine takes the batch
+	// under mu and writes it after releasing mu, so HandleMessage waits for
+	// a database write only while batch is at asnBatchMaxSize.
+	mu          sync.Mutex
+	batch       []asnOp
+	batchTaken  sync.Cond     // signalled when the flush goroutine takes batch; its L is &mu
+	batchFullCh chan struct{} // wakes the flush goroutine when batch is full
+	lastFlush   time.Time     // used only by the flush goroutine
+	stopCh      chan struct{}
+	wg          sync.WaitGroup
 }
 
 type asnOp struct {
@@ -52,12 +62,14 @@ type asnOp struct {
 // background goroutine is terminated.
 func NewASHandler(db database.Store, logger *logger.Logger) *ASHandler {
 	h := &ASHandler{
-		db:        db,
-		logger:    logger,
-		batch:     make([]asnOp, 0, asnBatchSize),
-		lastFlush: time.Now(),
-		stopCh:    make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		batch:       make([]asnOp, 0, asnBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		lastFlush:   time.Now(),
+		stopCh:      make(chan struct{}),
 	}
+	h.batchTaken.L = &h.mu
 
 	// Start the flush timer goroutine
 	h.wg.Add(1)
@@ -85,8 +97,8 @@ func (h *ASHandler) QueueCapacity() int {
 // HandleMessage processes a RIS Live BGP message by extracting all ASNs from
 // the AS path and queuing them for batch insertion into the database. The
 // origin ASN (last element in the path) and all transit ASNs are recorded
-// with their associated timestamps. The batch is automatically flushed when
-// it reaches the configured size threshold.
+// with their associated timestamps. When the batch reaches the configured size
+// threshold, the flush goroutine is woken to write it.
 func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// Use the pre-parsed timestamp
 	timestamp := msg.ParsedTimestamp
@@ -100,6 +112,13 @@ func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
+	// While the batch is at its maximum size, wait until the flush goroutine
+	// takes it. Meanwhile the handler takes nothing off its queue, which
+	// fills, and the streamer drops messages for it.
+	for len(h.batch) >= asnBatchMaxSize {
+		h.batchTaken.Wait()
+	}
+
 	// Queue origin ASN operation
 	if originASN > 0 {
 		h.batch = append(h.batch, asnOp{
@@ -118,13 +137,19 @@ func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {
 		}
 	}
 
-	// Check if we need to flush
+	// A full batch wakes the flush goroutine. If it is writing, the wake-up
+	// waits in batchFullCh and the batch keeps growing until the write ends
+	// or the batch reaches asnBatchMaxSize.
 	if len(h.batch) >= asnBatchSize {
-		h.flushBatchLocked()
+		select {
+		case h.batchFullCh <- struct{}{}:
+		default: // already woken
+		}
 	}
 }
 
-// flushLoop runs in a goroutine and periodically flushes batches
+// flushLoop runs in a goroutine, the only one that writes the batch: it
+// flushes when the batch is full, periodically, and once more on Stop.
 func (h *ASHandler) flushLoop() {
 	defer h.wg.Done()
 	ticker := time.NewTicker(asnBatchTimeout)
@@ -133,31 +158,47 @@ func (h *ASHandler) flushLoop() {
 	for {
 		select {
 		case <-ticker.C:
-			h.mu.Lock()
 			if time.Since(h.lastFlush) >= asnBatchTimeout {
-				h.flushBatchLocked()
+				h.flushBatch()
 			}
-			h.mu.Unlock()
+		case <-h.batchFullCh:
+			h.flushBatch()
 		case <-h.stopCh:
 			// Final flush
-			h.mu.Lock()
-			h.flushBatchLocked()
-			h.mu.Unlock()
+			h.flushBatch()
 
 			return
 		}
 	}
 }
 
-// flushBatchLocked flushes the ASN batch to the database (must be called with mutex held)
-func (h *ASHandler) flushBatchLocked() {
+// takeBatch returns the pending operations and leaves an empty batch in their
+// place for HandleMessage to fill.
+func (h *ASHandler) takeBatch() []asnOp {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
 	if len(h.batch) == 0 {
+		return nil
+	}
+	batch := h.batch
+	h.batch = make([]asnOp, 0, asnBatchSize)
+	h.batchTaken.Broadcast()
+
+	return batch
+}
+
+// flushBatch takes the pending batch and writes it to the database, without
+// holding the mutex during the write.
+func (h *ASHandler) flushBatch() {
+	batch := h.takeBatch()
+	if len(batch) == 0 {
 		return
 	}
 
 	// Process ASNs first (deduped)
 	asnMap := make(map[int]time.Time)
-	for _, op := range h.batch {
+	for _, op := range batch {
 		if existing, ok := asnMap[op.number]; !ok || op.timestamp.After(existing) {
 			asnMap[op.number] = op.timestamp
 		}
@@ -168,8 +209,6 @@ func (h *ASHandler) flushBatchLocked() {
 		h.logger.Error("Failed to process ASN batch", "error", err, "count", len(asnMap))
 	}
 
-	// Clear batch
-	h.batch = h.batch[:0]
 	h.lastFlush = time.Now()
 }
 

internal/routewatch/batchwrite_test.go

@@ -0,0 +1,374 @@
+package routewatch
+
+import (
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/database"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/ristypes"
+)
+
+const (
+	// handleMessageTimeout is how long a test waits for HandleMessage to
+	// return, or for a write to start, before it fails.
+	handleMessageTimeout = 2 * time.Second
+
+	// stillWaitingAfter is how long a test watches a HandleMessage that must
+	// wait. One that does not wait returns well within it.
+	stillWaitingAfter = 100 * time.Millisecond
+)
+
+// blockingStore is a mockStore whose batch writes for the AS, peer and prefix
+// handlers wait until the test calls releaseWrites. writeStarted is closed when
+// the first of them starts. It records what each write was given.
+type blockingStore struct {
+	*mockStore
+
+	release      chan struct{}
+	releaseOnce  sync.Once
+	writeStarted chan struct{}
+	startOnce    sync.Once
+
+	mu       sync.Mutex
+	prefixes map[string]bool
+	asns     map[int]bool
+	peers    map[string]bool
+}
+
+func newBlockingStore() *blockingStore {
+	return &blockingStore{
+		mockStore:    newMockStore(),
+		release:      make(chan struct{}),
+		writeStarted: make(chan struct{}),
+		prefixes:     make(map[string]bool),
+		asns:         make(map[int]bool),
+		peers:        make(map[string]bool),
+	}
+}
+
+func (s *blockingStore) waitForRelease() {
+	s.startOnce.Do(func() { close(s.writeStarted) })
+	<-s.release
+}
+
+// releaseWrites lets the held writes, and all later ones, finish. A second call
+// does nothing.
+func (s *blockingStore) releaseWrites() {
+	s.releaseOnce.Do(func() { close(s.release) })
+}
+
+func (s *blockingStore) UpsertLiveRouteBatch(routes []*database.LiveRoute) error {
+	s.waitForRelease()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, route := range routes {
+		s.prefixes[route.Prefix] = true
+	}
+
+	return nil
+}
+
+func (s *blockingStore) GetOrCreateASNBatch(asns map[int]time.Time) error {
+	s.waitForRelease()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for asn := range asns {
+		s.asns[asn] = true
+	}
+
+	return nil
+}
+
+func (s *blockingStore) UpdatePeerBatch(peers map[string]database.PeerUpdate) error {
+	s.waitForRelease()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for peerIP := range peers {
+		s.peers[peerIP] = true
+	}
+
+	return nil
+}
+
+// returnsInTime reports whether f returns within handleMessageTimeout.
+func returnsInTime(f func()) bool {
+	done := make(chan struct{})
+	go func() {
+		f()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		return true
+	case <-time.After(handleMessageTimeout):
+		return false
+	}
+}
+
+// startBlockedWrite hands h the messages in fill, which fill its batch so that
+// the handler writes it to store, and waits until that write starts. store
+// holds it until the test calls releaseWrites.
+func startBlockedWrite(
+	t *testing.T,
+	store *blockingStore,
+	h interface{ HandleMessage(*ristypes.RISMessage) },
+	fill []*ristypes.RISMessage,
+) {
+	t.Helper()
+
+	if !returnsInTime(func() {
+		for _, msg := range fill {
+			h.HandleMessage(msg)
+		}
+	}) {
+		t.Fatal("HandleMessage did not return after filling the batch: it waits for the database write")
+	}
+
+	select {
+	case <-store.writeStarted:
+	case <-time.After(handleMessageTimeout):
+		t.Fatal("the handler did not write its full batch")
+	}
+}
+
+// handleWhileAWriteIsBlocked starts a blocked write with the messages in fill
+// and hands h the message extra while store holds the write. HandleMessage must
+// return each time. Then it lets the writes finish and stops h, which writes
+// what it holds.
+func handleWhileAWriteIsBlocked(
+	t *testing.T,
+	store *blockingStore,
+	h interface {
+		HandleMessage(*ristypes.RISMessage)
+		Stop()
+	},
+	fill []*ristypes.RISMessage,
+	extra *ristypes.RISMessage,
+) {
+	t.Helper()
+	defer h.Stop()
+	defer store.releaseWrites()
+
+	startBlockedWrite(t, store, h, fill)
+
+	if !returnsInTime(func() { h.HandleMessage(extra) }) {
+		t.Fatal("HandleMessage did not return while a database write was blocked")
+	}
+}
+
+// handleAtMaxBatchSize starts a blocked write with the messages in fill, then,
+// while store holds the write, hands h the messages in toMax, which bring its
+// next batch to its maximum size, and the message extra. HandleMessage for
+// extra must wait until the test lets the write finish, and return after. Then
+// it stops h, which writes what it holds.
+func handleAtMaxBatchSize(
+	t *testing.T,
+	store *blockingStore,
+	h interface {
+		HandleMessage(*ristypes.RISMessage)
+		Stop()
+	},
+	fill, toMax []*ristypes.RISMessage,
+	extra *ristypes.RISMessage,
+) {
+	t.Helper()
+	defer h.Stop()
+	defer store.releaseWrites()
+
+	startBlockedWrite(t, store, h, fill)
+	for _, msg := range toMax {
+		h.HandleMessage(msg)
+	}
+
+	returned := make(chan struct{})
+	go func() {
+		h.HandleMessage(extra)
+		close(returned)
+	}()
+
+	select {
+	case <-returned:
+		t.Fatal("HandleMessage returned while the batch was at its maximum size and a write was blocked")
+	case <-time.After(stillWaitingAfter):
+	}
+
+	store.releaseWrites()
+	select {
+	case <-returned:
+	case <-time.After(handleMessageTimeout):
+		t.Fatal("HandleMessage did not return after the database write finished")
+	}
+}
+
+// prefixAnnouncement returns a message in which testPeerIP announces prefixes
+// with origin AS testASNA.
+func prefixAnnouncement(prefixes []string) *ristypes.RISMessage {
+	return &ristypes.RISMessage{
+		Peer:          testPeerIP,
+		Path:          ristypes.ASPath{testASNA},
+		Announcements: []ristypes.RISAnnouncement{{NextHop: testPeerIP, Prefixes: prefixes}},
+	}
+}
+
+func TestPrefixHandlerHandlesMessagesWhileAWriteIsBlocked(t *testing.T) {
+	const (
+		fillPrefix  = "192.0.2.0/24"
+		extraPrefix = "198.51.100.0/24"
+	)
+
+	store := newBlockingStore()
+	h := NewPrefixHandler(store, logger.New())
+	handleWhileAWriteIsBlocked(t, store, h,
+		[]*ristypes.RISMessage{prefixAnnouncement(slices.Repeat([]string{fillPrefix}, prefixBatchSize))},
+		prefixAnnouncement([]string{extraPrefix}))
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.prefixes[extraPrefix] {
+		t.Errorf("Stop did not write %s, handled while a write was blocked", extraPrefix)
+	}
+}
+
+func TestASHandlerHandlesMessagesWhileAWriteIsBlocked(t *testing.T) {
+	store := newBlockingStore()
+	h := NewASHandler(store, logger.New())
+	handleWhileAWriteIsBlocked(t, store, h,
+		[]*ristypes.RISMessage{{Path: slices.Repeat(ristypes.ASPath{testASNA}, asnBatchSize)}},
+		&ristypes.RISMessage{Path: ristypes.ASPath{testASNB}})
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.asns[testASNB] {
+		t.Errorf("Stop did not write AS%d, handled while a write was blocked", testASNB)
+	}
+}
+
+func TestPeerHandlerHandlesMessagesWhileAWriteIsBlocked(t *testing.T) {
+	const otherPeerIP = "2001:db8:ffff::2"
+
+	store := newBlockingStore()
+	h := NewPeerHandler(store, logger.New())
+	handleWhileAWriteIsBlocked(t, store, h,
+		slices.Repeat([]*ristypes.RISMessage{{Peer: testPeerIP}}, peerBatchSize),
+		&ristypes.RISMessage{Peer: otherPeerIP})
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.peers[otherPeerIP] {
+		t.Errorf("Stop did not write peer %s, handled while a write was blocked", otherPeerIP)
+	}
+}
+
+func TestPrefixHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
+	const (
+		fillPrefix  = "192.0.2.0/24"
+		extraPrefix = "198.51.100.0/24"
+	)
+
+	store := newBlockingStore()
+	h := NewPrefixHandler(store, logger.New())
+	handleAtMaxBatchSize(t, store, h,
+		[]*ristypes.RISMessage{prefixAnnouncement(slices.Repeat([]string{fillPrefix}, prefixBatchSize))},
+		[]*ristypes.RISMessage{prefixAnnouncement(slices.Repeat([]string{fillPrefix}, prefixBatchMaxSize))},
+		prefixAnnouncement([]string{extraPrefix}))
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.prefixes[extraPrefix] {
+		t.Errorf("Stop did not write %s, handled after the batch reached its maximum size", extraPrefix)
+	}
+}
+
+func TestASHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
+	store := newBlockingStore()
+	h := NewASHandler(store, logger.New())
+	handleAtMaxBatchSize(t, store, h,
+		[]*ristypes.RISMessage{{Path: slices.Repeat(ristypes.ASPath{testASNA}, asnBatchSize)}},
+		[]*ristypes.RISMessage{{Path: slices.Repeat(ristypes.ASPath{testASNA}, asnBatchMaxSize)}},
+		&ristypes.RISMessage{Path: ristypes.ASPath{testASNB}})
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.asns[testASNB] {
+		t.Errorf("Stop did not write AS%d, handled after the batch reached its maximum size", testASNB)
+	}
+}
+
+func TestPeerHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
+	const otherPeerIP = "2001:db8:ffff::2"
+
+	store := newBlockingStore()
+	h := NewPeerHandler(store, logger.New())
+	handleAtMaxBatchSize(t, store, h,
+		slices.Repeat([]*ristypes.RISMessage{{Peer: testPeerIP}}, peerBatchSize),
+		slices.Repeat([]*ristypes.RISMessage{{Peer: testPeerIP}}, peerBatchMaxSize),
+		&ristypes.RISMessage{Peer: otherPeerIP})
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if !store.peers[otherPeerIP] {
+		t.Errorf("Stop did not write peer %s, handled after the batch reached its maximum size", otherPeerIP)
+	}
+}
+
+// TestHandlersWakeTheFlushGoroutineWhenTheBatchIsFull hands each handler, built
+// without its flush goroutine so that nothing takes a wake-up, one update short
+// of a full batch, and a second one exactly a full batch. Only the full batch
+// leaves a wake-up in batchFullCh.
+func TestHandlersWakeTheFlushGoroutineWhenTheBatchIsFull(t *testing.T) {
+	tests := []struct {
+		name      string
+		batchSize int
+		// handle hands a new handler n updates and returns its batchFullCh.
+		handle func(n int) chan struct{}
+	}{
+		{
+			name:      "prefix",
+			batchSize: prefixBatchSize,
+			handle: func(n int) chan struct{} {
+				h := &PrefixHandler{batchFullCh: make(chan struct{}, 1)}
+				h.HandleMessage(prefixAnnouncement(slices.Repeat([]string{"192.0.2.0/24"}, n)))
+
+				return h.batchFullCh
+			},
+		},
+		{
+			name:      "AS",
+			batchSize: asnBatchSize,
+			handle: func(n int) chan struct{} {
+				h := &ASHandler{batchFullCh: make(chan struct{}, 1)}
+				// The origin AS and each AS in the path are one update each.
+				h.HandleMessage(&ristypes.RISMessage{Path: slices.Repeat(ristypes.ASPath{testASNA}, n-1)})
+
+				return h.batchFullCh
+			},
+		},
+		{
+			name:      "peer",
+			batchSize: peerBatchSize,
+			handle: func(n int) chan struct{} {
+				h := &PeerHandler{batchFullCh: make(chan struct{}, 1)}
+				for range n {
+					h.HandleMessage(&ristypes.RISMessage{Peer: testPeerIP})
+				}
+
+				return h.batchFullCh
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := len(tt.handle(tt.batchSize - 1)); got != 0 {
+				t.Errorf("one update short of a full batch left %d wake-ups, want none", got)
+			}
+			if got := len(tt.handle(tt.batchSize)); got != 1 {
+				t.Errorf("a full batch left %d wake-ups, want 1", got)
+			}
+		})
+	}
+}

internal/routewatch/cli.go

@@ -20,6 +20,8 @@ const (
 	debugInterval = 60 * time.Second
 	// bytesPerMB is bytes per megabyte
 	bytesPerMB = 1024 * 1024
+	// failureExitCode is the exit status when RouteWatch stops on an error
+	failureExitCode = 1
 )
 
 // logDebugStats logs goroutine count and memory usage
@@ -83,6 +85,9 @@ func CLIEntry() {
 					go func() {
 						if err := rw.Run(ctx); err != nil {
 							logger.Error("RouteWatch error", "error", err)
+							if err := shutdowner.Shutdown(fx.ExitCode(failureExitCode)); err != nil {
+								logger.Error("Failed to shutdown gracefully", "error", err)
+							}
 						}
 					}()
 

internal/routewatch/peerhandler.go

@@ -23,6 +23,12 @@ const (
 	// peerBatchSize is the number of peer updates to batch together
 	peerBatchSize = 10000
 
+	// peerBatchMaxSize is the most peer updates the batch holds while the
+	// flush goroutine writes the previous one: ten batches, about 10 MiB
+	// (README "Memory"). At this size HandleMessage waits until the flush
+	// goroutine takes the batch.
+	peerBatchMaxSize = 100000
+
 	// peerBatchTimeout is the maximum time to wait before flushing a batch
 	peerBatchTimeout = 2 * time.Second
 )
@@ -35,12 +41,16 @@ type PeerHandler struct {
 	db     database.Store
 	logger *logger.Logger
 
-	// Batching
-	mu        sync.Mutex
-	peerBatch []peerUpdate
-	lastFlush time.Time
-	stopCh    chan struct{}
-	wg        sync.WaitGroup
+	// Batching. mu guards peerBatch only: the flush goroutine takes the batch
+	// under mu and writes it after releasing mu, so HandleMessage waits for
+	// a database write only while peerBatch is at peerBatchMaxSize.
+	mu          sync.Mutex
+	peerBatch   []peerUpdate
+	batchTaken  sync.Cond     // signalled when the flush goroutine takes peerBatch; its L is &mu
+	batchFullCh chan struct{} // wakes the flush goroutine when peerBatch is full
+	lastFlush   time.Time     // used only by the flush goroutine
+	stopCh      chan struct{}
+	wg          sync.WaitGroup
 }
 
 type peerUpdate struct {
@@ -56,12 +66,14 @@ type peerUpdate struct {
 // should be stopped by calling Stop when it is no longer needed.
 func NewPeerHandler(db database.Store, logger *logger.Logger) *PeerHandler {
 	h := &PeerHandler{
-		db:        db,
-		logger:    logger,
-		peerBatch: make([]peerUpdate, 0, peerBatchSize),
-		lastFlush: time.Now(),
-		stopCh:    make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		peerBatch:   make([]peerUpdate, 0, peerBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		lastFlush:   time.Now(),
+		stopCh:      make(chan struct{}),
 	}
+	h.batchTaken.L = &h.mu
 
 	// Start the flush timer goroutine
 	h.wg.Add(1)
@@ -87,8 +99,8 @@ func (h *PeerHandler) QueueCapacity() int {
 
 // HandleMessage processes a RIS message to track peer information.
 // It extracts the peer IP address and ASN from the message and adds
-// the update to an internal batch. When the batch reaches peerBatchSize
-// or the batch timeout expires, the batch is flushed to the database.
+// the update to an internal batch. The flush goroutine writes the batch to the
+// database when it reaches peerBatchSize or the batch timeout expires.
 func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// Parse peer ASN from string
 	peerASN := 0
@@ -101,6 +113,13 @@ func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
+	// While the batch is at its maximum size, wait until the flush goroutine
+	// takes it. Meanwhile the handler takes nothing off its queue, which
+	// fills, and the streamer drops messages for it.
+	for len(h.peerBatch) >= peerBatchMaxSize {
+		h.batchTaken.Wait()
+	}
+
 	// Add to batch
 	h.peerBatch = append(h.peerBatch, peerUpdate{
 		peerIP:      msg.Peer,
@@ -109,13 +128,19 @@ func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 		timestamp:   msg.ParsedTimestamp,
 	})
 
-	// Check if we need to flush
+	// A full batch wakes the flush goroutine. If it is writing, the wake-up
+	// waits in batchFullCh and the batch keeps growing until the write ends
+	// or the batch reaches peerBatchMaxSize.
 	if len(h.peerBatch) >= peerBatchSize {
-		h.flushBatchLocked()
+		select {
+		case h.batchFullCh <- struct{}{}:
+		default: // already woken
+		}
 	}
 }
 
-// flushLoop runs in a goroutine and periodically flushes batches
+// flushLoop runs in a goroutine, the only one that writes the batch: it
+// flushes when the batch is full, periodically, and once more on Stop.
 func (h *PeerHandler) flushLoop() {
 	defer h.wg.Done()
 	ticker := time.NewTicker(peerBatchTimeout)
@@ -124,31 +149,47 @@ func (h *PeerHandler) flushLoop() {
 	for {
 		select {
 		case <-ticker.C:
-			h.mu.Lock()
 			if time.Since(h.lastFlush) >= peerBatchTimeout {
-				h.flushBatchLocked()
+				h.flushBatch()
 			}
-			h.mu.Unlock()
+		case <-h.batchFullCh:
+			h.flushBatch()
 		case <-h.stopCh:
 			// Final flush
-			h.mu.Lock()
-			h.flushBatchLocked()
-			h.mu.Unlock()
+			h.flushBatch()
 
 			return
 		}
 	}
 }
 
-// flushBatchLocked flushes the peer batch to the database (must be called with mutex held)
-func (h *PeerHandler) flushBatchLocked() {
+// takeBatch returns the pending updates and leaves an empty batch in their
+// place for HandleMessage to fill.
+func (h *PeerHandler) takeBatch() []peerUpdate {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
 	if len(h.peerBatch) == 0 {
+		return nil
+	}
+	batch := h.peerBatch
+	h.peerBatch = make([]peerUpdate, 0, peerBatchSize)
+	h.batchTaken.Broadcast()
+
+	return batch
+}
+
+// flushBatch takes the pending batch and writes it to the database, without
+// holding the mutex during the write.
+func (h *PeerHandler) flushBatch() {
+	batch := h.takeBatch()
+	if len(batch) == 0 {
 		return
 	}
 
 	// Deduplicate by peer IP, keeping the latest update for each peer
 	peerMap := make(map[string]peerUpdate)
-	for _, update := range h.peerBatch {
+	for _, update := range batch {
 		if existing, ok := peerMap[update.peerIP]; !ok || update.timestamp.After(existing.timestamp) {
 			peerMap[update.peerIP] = update
 		}
@@ -170,8 +211,6 @@ func (h *PeerHandler) flushBatchLocked() {
 		h.logger.Error("Failed to process peer batch", "error", err, "count", len(dbPeerMap))
 	}
 
-	// Clear batch
-	h.peerBatch = h.peerBatch[:0]
 	h.lastFlush = time.Now()
 }
 

internal/routewatch/prefixhandler.go

@@ -3,6 +3,7 @@ package routewatch
 import (
 	"net"
 	"net/netip"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -24,6 +25,12 @@ const (
 	// prefixBatchSize is the number of prefix updates to batch together
 	prefixBatchSize = 25000
 
+	// prefixBatchMaxSize is the most prefix updates the batch holds while the
+	// flush goroutine writes the previous one: ten batches, about 60 MiB
+	// (README "Memory"). At this size HandleMessage waits until the flush
+	// goroutine takes the batch.
+	prefixBatchMaxSize = 250000
+
 	// prefixBatchTimeout is the maximum time to wait before flushing a batch
 	// DO NOT reduce this timeout - larger batches are more efficient
 	prefixBatchTimeout = 1 * time.Second
@@ -34,18 +41,24 @@ const (
 )
 
 // PrefixHandler tracks BGP prefixes and maintains a live routing table in the database.
-// Routes are added on announcement and deleted on withdrawal.
+// Routes are added on announcement and deleted on withdrawal, and all routes of
+// a peer are deleted when its BGP session goes down.
 type PrefixHandler struct {
 	db      database.Store
 	logger  *logger.Logger
 	metrics *metrics.Tracker
 
-	// Batching
-	mu        sync.Mutex
-	batch     []prefixUpdate
-	lastFlush time.Time
-	stopCh    chan struct{}
-	wg        sync.WaitGroup
+	// Batching. mu guards batch and peersDown only: the flush goroutine takes
+	// both under mu and writes them after releasing mu, so HandleMessage
+	// waits for a database write only while batch is at prefixBatchMaxSize.
+	mu          sync.Mutex
+	batch       []prefixUpdate
+	peersDown   []string      // peers whose BGP session went down since the batch was taken
+	batchTaken  sync.Cond     // signalled when the flush goroutine takes batch; its L is &mu
+	batchFullCh chan struct{} // wakes the flush goroutine when batch is full
+	lastFlush   time.Time     // used only by the flush goroutine
+	stopCh      chan struct{}
+	wg          sync.WaitGroup
 }
 
 type prefixUpdate struct {
@@ -60,12 +73,14 @@ type prefixUpdate struct {
 // NewPrefixHandler creates a new batched prefix tracking handler
 func NewPrefixHandler(db database.Store, logger *logger.Logger) *PrefixHandler {
 	h := &PrefixHandler{
-		db:        db,
-		logger:    logger,
-		batch:     make([]prefixUpdate, 0, prefixBatchSize),
-		lastFlush: time.Now(),
-		stopCh:    make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		batch:       make([]prefixUpdate, 0, prefixBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		lastFlush:   time.Now(),
+		stopCh:      make(chan struct{}),
 	}
+	h.batchTaken.L = &h.mu
 
 	// Start the flush timer goroutine
 	h.wg.Add(1)
@@ -81,8 +96,9 @@ func (h *PrefixHandler) SetMetricsTracker(metrics *metrics.Tracker) {
 
 // WantsMessage returns true if this handler wants to process messages of the given type
 func (h *PrefixHandler) WantsMessage(messageType string) bool {
-	// We only care about UPDATE messages for the routing table
-	return messageType == "UPDATE"
+	// UPDATE messages change routes; a STATE message can say a peer's
+	// session went down, which removes all of its routes.
+	return messageType == ristypes.MessageTypeUpdate || messageType == ristypes.MessageTypeState
 }
 
 // QueueCapacity returns the desired queue capacity for this handler
@@ -93,6 +109,14 @@ func (h *PrefixHandler) QueueCapacity() int {
 
 // HandleMessage processes a message to track prefix information
 func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
+	if msg.Type == ristypes.MessageTypeState {
+		if msg.State == ristypes.StateDown {
+			h.peerSessionDown(msg.Peer)
+		}
+
+		return
+	}
+
 	// Use the pre-parsed timestamp
 	timestamp := msg.ParsedTimestamp
 
@@ -105,7 +129,31 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
-	// Process announcements
+	// While the batch is at its maximum size, wait until the flush goroutine
+	// takes it. Meanwhile the handler takes nothing off its queue, which
+	// fills, and the streamer drops messages for it.
+	for len(h.batch) >= prefixBatchMaxSize {
+		h.batchTaken.Wait()
+	}
+
+	// Withdrawals are queued before announcements, because the batch keeps
+	// each peer's last update for a prefix: a message that lists a prefix as
+	// both withdrawn and announced keeps the route (RFC 4271 section 4.3).
+	// A withdrawal names only the prefix and peer: the message's AS path, and
+	// so its origin AS, belongs to the announced prefixes.
+	for _, prefix := range msg.Withdrawals {
+		h.batch = append(h.batch, prefixUpdate{
+			prefix:      canonicalPrefix(prefix),
+			peer:        msg.Peer,
+			messageType: "withdrawal",
+			timestamp:   timestamp,
+		})
+		// Record withdrawal in metrics
+		if h.metrics != nil {
+			h.metrics.RecordWithdrawal()
+		}
+	}
+
 	for _, announcement := range msg.Announcements {
 		for _, prefix := range announcement.Prefixes {
 			h.batch = append(h.batch, prefixUpdate{
@@ -123,29 +171,32 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 		}
 	}
 
-	// Process withdrawals
-	for _, prefix := range msg.Withdrawals {
-		h.batch = append(h.batch, prefixUpdate{
-			prefix:      canonicalPrefix(prefix),
-			originASN:   originASN, // Use the originASN from path if available
-			peer:        msg.Peer,
-			messageType: "withdrawal",
-			timestamp:   timestamp,
-			path:        msg.Path,
-		})
-		// Record withdrawal in metrics
-		if h.metrics != nil {
-			h.metrics.RecordWithdrawal()
-		}
-	}
-
-	// Check if we need to flush
+	// A full batch wakes the flush goroutine. If it is writing, the wake-up
+	// waits in batchFullCh and the batch keeps growing until the write ends
+	// or the batch reaches prefixBatchMaxSize.
 	if len(h.batch) >= prefixBatchSize {
-		h.flushBatchLocked()
+		select {
+		case h.batchFullCh <- struct{}{}:
+		default: // already woken
+		}
 	}
 }
 
-// flushLoop runs in a goroutine and periodically flushes batches
+// peerSessionDown notes that the peer's BGP session went down, so that the next
+// flush deletes all of the peer's live routes before it writes the batch. The
+// peer's updates still in the batch came before the down, which replaces them,
+// so they are dropped; updates the peer sends later stay in the batch and are
+// written after the delete.
+func (h *PrefixHandler) peerSessionDown(peer string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	h.batch = slices.DeleteFunc(h.batch, func(update prefixUpdate) bool { return update.peer == peer })
+	h.peersDown = append(h.peersDown, peer)
+}
+
+// flushLoop runs in a goroutine, the only one that writes the batch: it
+// flushes when the batch is full, periodically, and once more on Stop.
 func (h *PrefixHandler) flushLoop() {
 	defer h.wg.Done()
 	ticker := time.NewTicker(prefixBatchTimeout)
@@ -154,39 +205,69 @@ func (h *PrefixHandler) flushLoop() {
 	for {
 		select {
 		case <-ticker.C:
-			h.mu.Lock()
 			if time.Since(h.lastFlush) >= prefixBatchTimeout {
-				h.flushBatchLocked()
+				h.flushBatch()
 			}
-			h.mu.Unlock()
+		case <-h.batchFullCh:
+			h.flushBatch()
 		case <-h.stopCh:
 			// Final flush
-			h.mu.Lock()
-			h.flushBatchLocked()
-			h.mu.Unlock()
+			h.flushBatch()
 
 			return
 		}
 	}
 }
 
-// flushBatchLocked flushes the prefix batch to the database (must be called with mutex held)
-func (h *PrefixHandler) flushBatchLocked() {
-	if len(h.batch) == 0 {
+// takeBatch returns the pending updates and the peers whose session went down
+// since the last flush, and leaves an empty batch and no peers in their place
+// for HandleMessage to fill.
+func (h *PrefixHandler) takeBatch() ([]prefixUpdate, []string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	if len(h.batch) == 0 && len(h.peersDown) == 0 {
+		return nil, nil
+	}
+	batch, peersDown := h.batch, h.peersDown
+	h.batch = make([]prefixUpdate, 0, prefixBatchSize)
+	h.peersDown = nil
+	h.batchTaken.Broadcast()
+
+	return batch, peersDown
+}
+
+// flushBatch takes the pending batch and writes it to the database, without
+// holding the mutex during the write.
+func (h *PrefixHandler) flushBatch() {
+	batch, peersDown := h.takeBatch()
+	if len(batch) == 0 && len(peersDown) == 0 {
 		return
 	}
 
 	startTime := time.Now()
-	batchSize := len(h.batch)
+	batchSize := len(batch)
 
-	// Group updates by prefix to deduplicate
-	// For each prefix, keep the latest update
-	prefixMap := make(map[string]prefixUpdate)
-	for _, update := range h.batch {
-		key := update.prefix
-		if existing, ok := prefixMap[key]; !ok || update.timestamp.After(existing.timestamp) {
-			prefixMap[key] = update
+	// The routes of a peer whose session went down are deleted first: the
+	// batch holds only the updates the peer sent after the down.
+	for _, peer := range peersDown {
+		if err := h.db.DeleteLiveRoutesOfPeer(peer); err != nil {
+			h.logger.Error("Failed to delete the live routes of a peer whose session went down",
+				"peer", peer, "error", err)
+
+			continue
 		}
+		h.logger.Info("Deleted the live routes of a peer whose session went down", "peer", peer)
+	}
+
+	// For each prefix and peer, keep only the last update the feed delivered.
+	// Updates from different peers for the same prefix are all kept. Arrival
+	// order decides, not the timestamp: timestamps are whole seconds, so
+	// updates within one second carry the same one.
+	type prefixAndPeer struct{ prefix, peer string }
+	lastUpdates := make(map[prefixAndPeer]prefixUpdate)
+	for _, update := range batch {
+		lastUpdates[prefixAndPeer{update.prefix, update.peer}] = update
 	}
 
 	// Collect routes to upsert and delete
@@ -196,7 +277,7 @@ func (h *PrefixHandler) flushBatchLocked() {
 	// Collect unique prefixes to update
 	prefixesToUpdate := make(map[string]time.Time)
 
-	for _, update := range prefixMap {
+	for _, update := range lastUpdates {
 		// Track prefix for both announcements and withdrawals
 		if _, exists := prefixesToUpdate[update.prefix]; !exists || update.timestamp.After(prefixesToUpdate[update.prefix]) {
 			prefixesToUpdate[update.prefix] = update.timestamp
@@ -220,7 +301,6 @@ func (h *PrefixHandler) flushBatchLocked() {
 			// Create deletion record for batch delete
 			routesToDelete = append(routesToDelete, database.LiveRouteDeletion{
 				Prefix:    update.prefix,
-				OriginASN: update.originASN,
 				PeerIP:    update.peer,
 				IPVersion: ipVersion,
 			})
@@ -255,13 +335,12 @@ func (h *PrefixHandler) flushBatchLocked() {
 	elapsed := time.Since(startTime)
 	h.logger.Debug("Flushed prefix batch",
 		"batch_size", batchSize,
-		"unique_prefixes", len(prefixMap),
+		"peers_down", len(peersDown),
+		"unique_prefixes", len(prefixesToUpdate),
 		"success", successCount,
 		"duration_ms", elapsed.Milliseconds(),
 	)
 
-	// Clear batch
-	h.batch = h.batch[:0]
 	h.lastFlush = time.Now()
 }
 
@@ -424,51 +503,24 @@ func (h *PrefixHandler) processAnnouncementDirect(update prefixUpdate) {
 // processWithdrawalDirect handles removing a route directly without prefix table
 // nolint:unused // kept for potential future use
 func (h *PrefixHandler) processWithdrawalDirect(update prefixUpdate) {
-	// For withdrawals, we need to delete the route from live_routes
-	if update.originASN > 0 {
-		if err := h.db.DeleteLiveRoute(update.prefix, update.originASN, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route",
-				"prefix", update.prefix,
-				"origin_asn", update.originASN,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	} else {
-		// If no origin ASN, just delete all routes for this prefix from this peer
-		if err := h.db.DeleteLiveRoute(update.prefix, 0, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route (no origin ASN)",
-				"prefix", update.prefix,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
+	if err := h.db.DeleteLiveRoute(update.prefix, update.peer); err != nil {
+		h.logger.Error("Failed to delete live route",
+			"prefix", update.prefix,
+			"peer", update.peer,
+			"error", err,
+		)
 	}
 }
 
 // processWithdrawal handles removing a route from the live routing table
 // nolint:unused // kept for potential future use
 func (h *PrefixHandler) processWithdrawal(_ *database.Prefix, update prefixUpdate) {
-	// For withdrawals, we need to delete the route from live_routes
-	// Since we have the origin ASN from the update, we can delete the specific route
-	if update.originASN > 0 {
-		if err := h.db.DeleteLiveRoute(update.prefix, update.originASN, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route",
-				"prefix", update.prefix,
-				"origin_asn", update.originASN,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
-	} else {
-		// If no origin ASN, just delete all routes for this prefix from this peer
-		if err := h.db.DeleteLiveRoute(update.prefix, 0, update.peer); err != nil {
-			h.logger.Error("Failed to delete live route (no origin ASN)",
-				"prefix", update.prefix,
-				"peer", update.peer,
-				"error", err,
-			)
-		}
+	if err := h.db.DeleteLiveRoute(update.prefix, update.peer); err != nil {
+		h.logger.Error("Failed to delete live route",
+			"prefix", update.prefix,
+			"peer", update.peer,
+			"error", err,
+		)
 	}
 }
 

internal/routewatch/prefixhandler_test.go

@@ -1,7 +1,10 @@
 package routewatch
 
 import (
+	"context"
 	"errors"
+	"fmt"
+	"slices"
 	"testing"
 	"time"
 
@@ -28,11 +31,6 @@ func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
 
 	// Built without NewPrefixHandler's flush timer, so the test flushes itself.
 	h := &PrefixHandler{db: db, logger: logger.New()}
-	flush := func() {
-		h.mu.Lock()
-		defer h.mu.Unlock()
-		h.flushBatchLocked()
-	}
 
 	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
 	h.HandleMessage(&ristypes.RISMessage{
@@ -44,7 +42,7 @@ func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
 			Prefixes: []string{"2001:db8:1::/48", "192.0.2.0/24"},
 		}},
 	})
-	flush()
+	h.flushBatch()
 
 	for ip, want := range map[string]string{
 		"2001:db8:1::1": "2001:db8:1::/48",
@@ -64,7 +62,7 @@ func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
 		ParsedTimestamp: ts.Add(time.Minute),
 		Withdrawals:     []string{"2001:db8:1:0:0:0:0:0/48", "192.0.2.0/24"},
 	})
-	flush()
+	h.flushBatch()
 
 	for _, ip := range []string{"2001:db8:1::1", "192.0.2.1"} {
 		if info, err := db.GetIPInfo(ip); !errors.Is(err, database.ErrNoRoute) {
@@ -72,3 +70,374 @@ func TestPrefixHandlerStoresPrefixesTheIPLookupFinds(t *testing.T) {
 		}
 	}
 }
+
+// TestPrefixHandlerAppliesEachPeersLastUpdateInABatch runs updates for one
+// prefix through the prefix handler into a real database. All updates carry the
+// same timestamp, as updates within one second of the feed do. Within a batch,
+// the last update each peer sent for the prefix decides whether that peer has a
+// live route for it, and updates from different peers are all applied. The
+// in-memory route count and prefix distribution must match the route table.
+func TestPrefixHandlerAppliesEachPeersLastUpdateInABatch(t *testing.T) {
+	const (
+		prefix           = "198.51.100.0/24"
+		prefixMaskLength = 24
+		otherPeerIP      = "2001:db8:ffff::2"
+	)
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(peer string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{
+			Peer:            peer,
+			Path:            ristypes.ASPath{testASNA, testASNB},
+			ParsedTimestamp: ts,
+			Announcements:   []ristypes.RISAnnouncement{{NextHop: peer, Prefixes: []string{prefix}}},
+		}
+	}
+	withdraw := func(peer string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{Peer: peer, ParsedTimestamp: ts, Withdrawals: []string{prefix}}
+	}
+	announceAndWithdraw := func(peer string) *ristypes.RISMessage {
+		msg := announce(peer)
+		msg.Withdrawals = []string{prefix}
+
+		return msg
+	}
+
+	tests := []struct {
+		name string
+		// Each inner list is handled and then flushed as one batch.
+		batches [][]*ristypes.RISMessage
+		// The peers left with a live route for the prefix, by peer IP.
+		wantPeers []string
+	}{
+		{
+			name:      "two peers announce the prefix",
+			batches:   [][]*ristypes.RISMessage{{announce(testPeerIP), announce(otherPeerIP)}},
+			wantPeers: []string{testPeerIP, otherPeerIP},
+		},
+		{
+			name: "two peers withdraw the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{announce(otherPeerIP)},
+				{withdraw(testPeerIP), withdraw(otherPeerIP)},
+			},
+		},
+		{
+			name:    "a peer announces and then withdraws the prefix",
+			batches: [][]*ristypes.RISMessage{{announce(testPeerIP), withdraw(testPeerIP)}},
+		},
+		{
+			name: "a peer withdraws and then re-announces the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{withdraw(testPeerIP), announce(testPeerIP)},
+			},
+			wantPeers: []string{testPeerIP},
+		},
+		{
+			// RFC 4271 section 4.3: the announcement counts, not the withdrawal.
+			name: "one message announces and withdraws the prefix",
+			batches: [][]*ristypes.RISMessage{
+				{announce(testPeerIP)},
+				{announceAndWithdraw(testPeerIP)},
+			},
+			wantPeers: []string{testPeerIP},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+			if err != nil {
+				t.Fatalf("failed to create database: %v", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+			h := &PrefixHandler{db: db, logger: logger.New()}
+			for _, batch := range tt.batches {
+				for _, msg := range batch {
+					h.HandleMessage(msg)
+				}
+				h.flushBatch()
+			}
+
+			ctx := context.Background()
+			routes, _, err := db.GetPrefixDetailsContext(ctx, prefix)
+			if err != nil && !errors.Is(err, database.ErrNoRoute) {
+				t.Fatalf("GetPrefixDetailsContext: %v", err)
+			}
+			var gotPeers []string
+			for _, route := range routes {
+				gotPeers = append(gotPeers, route.PeerIP)
+			}
+			if !slices.Equal(gotPeers, tt.wantPeers) {
+				t.Errorf("peers with a live route for %s = %v, want %v", prefix, gotPeers, tt.wantPeers)
+			}
+
+			var wantDistribution []database.PrefixDistribution
+			if len(tt.wantPeers) > 0 {
+				wantDistribution = []database.PrefixDistribution{{MaskLength: prefixMaskLength, Count: 1}}
+			}
+			assertCounts(t, db, ipv4Version, len(tt.wantPeers), wantDistribution)
+		})
+	}
+}
+
+// TestPrefixHandlerKeepsOneRoutePerPrefixAndPeer runs updates from one peer
+// through the prefix handler into a real database, flushing each message as its
+// own batch, once with IPv4 prefixes and once with IPv6 prefixes. A peer has at
+// most one route for a prefix: a later announcement replaces it whatever its
+// origin AS, and a withdrawal removes it whatever AS the message's AS path ends
+// in. The in-memory route count and prefix distribution must match the route
+// table.
+func TestPrefixHandlerKeepsOneRoutePerPrefixAndPeer(t *testing.T) {
+	families := []struct {
+		ipVersion           int
+		prefix, otherPrefix string
+		// The mask length of both prefixes.
+		maskLength int
+	}{
+		{ipVersion: ipv4Version, prefix: "198.51.100.0/24", otherPrefix: "203.0.113.0/24", maskLength: 24},
+		{ipVersion: ipv6Version, prefix: "2001:db8:1::/48", otherPrefix: "2001:db8:2::/48", maskLength: 48},
+	}
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(path ristypes.ASPath, announced string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{
+			Peer:            testPeerIP,
+			Path:            path,
+			ParsedTimestamp: ts,
+			Announcements:   []ristypes.RISAnnouncement{{NextHop: testPeerIP, Prefixes: []string{announced}}},
+		}
+	}
+
+	for _, family := range families {
+		prefix, otherPrefix := family.prefix, family.otherPrefix
+
+		// One message that announces otherPrefix with origin AS testASNB and
+		// withdraws prefix.
+		announceOtherAndWithdraw := announce(ristypes.ASPath{testASNA, testASNB}, otherPrefix)
+		announceOtherAndWithdraw.Withdrawals = []string{prefix}
+
+		tests := []struct {
+			name     string
+			messages []*ristypes.RISMessage
+			// The origin AS of the peer's live route for each prefix. A prefix
+			// left out must have no live route.
+			wantOrigins map[string]int
+		}{
+			{
+				name: "the peer announces the prefix with a new origin AS",
+				messages: []*ristypes.RISMessage{
+					announce(ristypes.ASPath{testASNA}, prefix),
+					announce(ristypes.ASPath{testASNA, testASNB}, prefix),
+				},
+				wantOrigins: map[string]int{prefix: testASNB},
+			},
+			{
+				name: "one message announces a prefix with another origin AS and withdraws the prefix",
+				messages: []*ristypes.RISMessage{
+					announce(ristypes.ASPath{testASNA}, prefix),
+					announceOtherAndWithdraw,
+				},
+				wantOrigins: map[string]int{otherPrefix: testASNB},
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(fmt.Sprintf("IPv%d %s", family.ipVersion, tt.name), func(t *testing.T) {
+				db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+				if err != nil {
+					t.Fatalf("failed to create database: %v", err)
+				}
+				defer func() { _ = db.Close() }()
+
+				// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+				h := &PrefixHandler{db: db, logger: logger.New()}
+				for _, msg := range tt.messages {
+					h.HandleMessage(msg)
+					h.flushBatch()
+				}
+
+				for _, p := range []string{prefix, otherPrefix} {
+					routes, _, err := db.GetPrefixDetailsContext(context.Background(), p)
+					if err != nil && !errors.Is(err, database.ErrNoRoute) {
+						t.Fatalf("GetPrefixDetailsContext(%s): %v", p, err)
+					}
+					var gotOrigins []int
+					for _, route := range routes {
+						gotOrigins = append(gotOrigins, route.OriginASN)
+					}
+					var wantOrigins []int
+					if origin, ok := tt.wantOrigins[p]; ok {
+						wantOrigins = []int{origin}
+					}
+					if !slices.Equal(gotOrigins, wantOrigins) {
+						t.Errorf("origin ASes of the live routes for %s = %v, want %v", p, gotOrigins, wantOrigins)
+					}
+				}
+
+				wantDistribution := []database.PrefixDistribution{
+					{MaskLength: family.maskLength, Count: len(tt.wantOrigins)},
+				}
+				assertCounts(t, db, family.ipVersion, len(tt.wantOrigins), wantDistribution)
+			})
+		}
+	}
+}
+
+// TestPrefixHandlerDeletesAPeersRoutesWhenItsSessionGoesDown runs
+// announcements from two peers through the prefix handler into a real
+// database, then a batch in which one of the peers announces a prefix and its
+// session goes down. The down deletes every live route of that peer, IPv4 and
+// IPv6, the one announced just before it included, and keeps the other peer's
+// routes for the same prefixes. An announcement the peer sends after the down,
+// in the same batch, is kept. The in-memory route counts and prefix
+// distribution must match the route tables.
+func TestPrefixHandlerDeletesAPeersRoutesWhenItsSessionGoesDown(t *testing.T) {
+	const (
+		otherPeerIP = "2001:db8:ffff::2"
+		// Both peers announce the shared prefixes, only testPeerIP the others.
+		sharedV4   = "198.51.100.0/24"
+		sharedV6   = "2001:db8:1::/48"
+		onlyV4     = "203.0.113.0/24"
+		onlyV6     = "2001:db8:2::/48"
+		beforeDown = "192.0.2.0/24"
+		afterDown  = "2001:db8:3::/48"
+		// The mask lengths of the IPv4 and of the IPv6 prefixes.
+		maskLengthV4 = 24
+		maskLengthV6 = 48
+	)
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	announce := func(peer string, prefixes ...string) *ristypes.RISMessage {
+		return &ristypes.RISMessage{
+			Type:            ristypes.MessageTypeUpdate,
+			Peer:            peer,
+			Path:            ristypes.ASPath{testASNA, testASNB},
+			ParsedTimestamp: ts,
+			Announcements:   []ristypes.RISAnnouncement{{NextHop: peer, Prefixes: prefixes}},
+		}
+	}
+	down := &ristypes.RISMessage{
+		Type:            ristypes.MessageTypeState,
+		Peer:            testPeerIP,
+		ParsedTimestamp: ts,
+		State:           ristypes.StateDown,
+	}
+
+	tests := []struct {
+		name string
+		// Handled and flushed as one batch after both peers' announcements.
+		batch []*ristypes.RISMessage
+		// Whether testPeerIP is left with a live route for afterDown.
+		wantAfterDown bool
+	}{
+		{
+			name:  "the down ends the batch",
+			batch: []*ristypes.RISMessage{announce(testPeerIP, beforeDown), down},
+		},
+		{
+			name: "the peer announces a prefix after the down",
+			batch: []*ristypes.RISMessage{
+				announce(testPeerIP, beforeDown), down, announce(testPeerIP, afterDown),
+			},
+			wantAfterDown: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+			if err != nil {
+				t.Fatalf("failed to create database: %v", err)
+			}
+			defer func() { _ = db.Close() }()
+
+			// Built without NewPrefixHandler's flush timer, so the test flushes itself.
+			h := &PrefixHandler{db: db, logger: logger.New()}
+			h.HandleMessage(announce(testPeerIP, sharedV4, sharedV6, onlyV4, onlyV6))
+			h.HandleMessage(announce(otherPeerIP, sharedV4, sharedV6))
+			h.flushBatch()
+			for _, msg := range tt.batch {
+				h.HandleMessage(msg)
+			}
+			h.flushBatch()
+
+			// The peers left with a live route for each prefix.
+			wantPeers := map[string][]string{
+				sharedV4:   {otherPeerIP},
+				sharedV6:   {otherPeerIP},
+				onlyV4:     nil,
+				onlyV6:     nil,
+				beforeDown: nil,
+				afterDown:  nil,
+			}
+			wantRoutesV6 := 1
+			if tt.wantAfterDown {
+				wantPeers[afterDown] = []string{testPeerIP}
+				wantRoutesV6++
+			}
+
+			for prefix, want := range wantPeers {
+				routes, _, err := db.GetPrefixDetailsContext(context.Background(), prefix)
+				if err != nil && !errors.Is(err, database.ErrNoRoute) {
+					t.Fatalf("GetPrefixDetailsContext(%s): %v", prefix, err)
+				}
+				var got []string
+				for _, route := range routes {
+					got = append(got, route.PeerIP)
+				}
+				if !slices.Equal(got, want) {
+					t.Errorf("peers with a live route for %s = %v, want %v", prefix, got, want)
+				}
+			}
+
+			assertCounts(t, db, ipv4Version, 1,
+				[]database.PrefixDistribution{{MaskLength: maskLengthV4, Count: 1}})
+			assertCounts(t, db, ipv6Version, wantRoutesV6,
+				[]database.PrefixDistribution{{MaskLength: maskLengthV6, Count: wantRoutesV6}})
+		})
+	}
+}
+
+// assertCounts checks that the live route count and prefix distribution of one
+// IP version are wantRoutes and wantDistribution, both as held in memory and as
+// read from the route table.
+func assertCounts(t *testing.T, db *database.Database, ipVersion, wantRoutes int,
+	wantDistribution []database.PrefixDistribution) {
+	t.Helper()
+
+	ctx := context.Background()
+	stats, err := db.GetStatsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetStatsContext: %v", err)
+	}
+	tableRoutesV4, tableRoutesV6, err := db.GetLiveRouteCountsContext(ctx)
+	if err != nil {
+		t.Fatalf("GetLiveRouteCountsContext: %v", err)
+	}
+	queryDistributionV4, queryDistributionV6, err := db.GetPrefixDistributionContext(ctx)
+	if err != nil {
+		t.Fatalf("GetPrefixDistributionContext: %v", err)
+	}
+
+	memoryRoutes, tableRoutes := stats.IPv4Routes, tableRoutesV4
+	memoryDistribution, queryDistribution := stats.IPv4PrefixDistribution, queryDistributionV4
+	if ipVersion == ipv6Version {
+		memoryRoutes, tableRoutes = stats.IPv6Routes, tableRoutesV6
+		memoryDistribution, queryDistribution = stats.IPv6PrefixDistribution, queryDistributionV6
+	}
+
+	if memoryRoutes != wantRoutes || tableRoutes != wantRoutes {
+		t.Errorf("IPv%d live routes: %d in memory, %d in the table, want %d",
+			ipVersion, memoryRoutes, tableRoutes, wantRoutes)
+	}
+	if !slices.Equal(memoryDistribution, wantDistribution) ||
+		!slices.Equal(queryDistribution, wantDistribution) {
+		t.Errorf("IPv%d prefix distribution: %v in memory, %v from the table, want %v",
+			ipVersion, memoryDistribution, queryDistribution, wantDistribution)
+	}
+}

internal/server/handlers.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"net/netip"
 	"runtime"
 	"sort"
 	"strconv"
@@ -197,19 +198,24 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 		}()
 
 		var dbStats database.Stats
+		var err error
 		select {
 		case <-ctx.Done():
+			err = ctx.Err()
+		case err = <-errChan:
+		case dbStats = <-statsChan:
+		}
+		if deadlinePassed(ctx) {
 			s.logger.Error("Database stats timeout in status.json")
-			writeJSONError(w, http.StatusRequestTimeout, "Database timeout")
+			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
 
 			return
-		case err := <-errChan:
+		}
+		if err != nil {
 			s.logger.Error("Failed to get database stats", "error", err)
 			writeJSONError(w, http.StatusInternalServerError, err.Error())
 
 			return
-		case dbStats = <-statsChan:
-			// Success
 		}
 
 		uptime := time.Since(metrics.ConnectedSince).Truncate(time.Second).String()
@@ -230,6 +236,11 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 		var whoisStats *WHOISStatsInfo
 		if s.asnFetcher != nil {
 			whoisStats = s.getWHOISStats(ctx)
+			if deadlinePassed(ctx) {
+				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+				return
+			}
 		}
 
 		stats := Stats{
@@ -385,7 +396,7 @@ func (s *Server) handleStats() http.HandlerFunc {
 		// Check if context is already cancelled
 		select {
 		case <-ctx.Done():
-			http.Error(w, "Request timeout", http.StatusRequestTimeout)
+			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
 
 			return
 		default:
@@ -411,18 +422,24 @@ func (s *Server) handleStats() http.HandlerFunc {
 		}()
 
 		var dbStats database.Stats
+		var err error
 		select {
 		case <-ctx.Done():
+			err = ctx.Err()
+		case err = <-errChan:
+		case dbStats = <-statsChan:
+		}
+		if deadlinePassed(ctx) {
 			s.logger.Error("Database stats timeout")
-			// Don't write response here - timeout middleware already handles it
+			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
 			return
-		case err := <-errChan:
+		}
+		if err != nil {
 			s.logger.Error("Failed to get database stats", "error", err)
 			writeJSONError(w, http.StatusInternalServerError, err.Error())
 
 			return
-		case dbStats = <-statsChan:
-			// Success
 		}
 
 		uptime := time.Since(metrics.ConnectedSince).Truncate(time.Second).String()
@@ -461,6 +478,11 @@ func (s *Server) handleStats() http.HandlerFunc {
 		var whoisStats *WHOISStatsInfo
 		if s.asnFetcher != nil {
 			whoisStats = s.getWHOISStats(ctx)
+			if deadlinePassed(ctx) {
+				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+				return
+			}
 		}
 
 		// Calculate connection duration
@@ -612,6 +634,11 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 			} else {
 				// It's a hostname - resolve it
 				resolved, err := net.DefaultResolver.LookupHost(ctx, t)
+				if deadlinePassed(ctx) {
+					writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+					return
+				}
 				if err != nil {
 					response.Errors = append(response.Errors, t+": "+err.Error())
 
@@ -633,6 +660,11 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 		// Look up each IP
 		for _, ip := range ipsToLookup {
 			ipInfo, err := s.db.GetIPInfoContext(ctx, ip)
+			if deadlinePassed(ctx) {
+				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+				return
+			}
 			if err != nil {
 				response.Errors = append(response.Errors, ip+": "+err.Error())
 
@@ -641,6 +673,11 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 
 			// Do PTR lookup for this IP
 			ptrs, err := net.DefaultResolver.LookupAddr(ctx, ip)
+			if deadlinePassed(ctx) {
+				writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+				return
+			}
 			if err == nil && len(ptrs) > 0 {
 				// Remove trailing dots from PTR records
 				for i, ptr := range ptrs {
@@ -701,6 +738,11 @@ func (s *Server) handleASDetailJSON() http.HandlerFunc {
 		}
 
 		asInfo, prefixes, err := s.db.GetASDetailsContext(r.Context(), asn)
+		if deadlinePassed(r.Context()) {
+			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+			return
+		}
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				writeJSONError(w, http.StatusNotFound, err.Error())
@@ -748,10 +790,22 @@ func (s *Server) handlePrefixDetailJSON() http.HandlerFunc {
 			return
 		}
 
-		// Combine prefix and length into CIDR notation
-		prefix := prefixParam + "/" + lenParam
+		// Look the prefix up in the text form net/netip prints, the form the
+		// tables store, so that any valid way of writing it finds the route.
+		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
+		if err != nil {
+			writeJSONError(w, http.StatusBadRequest, err.Error())
 
-		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+			return
+		}
+		prefix := parsed.Masked().String()
+
+		routes, _, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+		if deadlinePassed(r.Context()) {
+			writeJSONError(w, http.StatusGatewayTimeout, requestTimeoutMessage)
+
+			return
+		}
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				writeJSONError(w, http.StatusNotFound, err.Error())
@@ -794,6 +848,11 @@ func (s *Server) handleASDetail() http.HandlerFunc {
 		}
 
 		asInfo, prefixes, err := s.db.GetASDetailsContext(r.Context(), asn)
+		if deadlinePassed(r.Context()) {
+			http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
+
+			return
+		}
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				http.Error(w, "AS not found", http.StatusNotFound)
@@ -807,6 +866,11 @@ func (s *Server) handleASDetail() http.HandlerFunc {
 
 		// Get peers
 		peers, err := s.db.GetASPeersContext(r.Context(), asn)
+		if deadlinePassed(r.Context()) {
+			http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
+
+			return
+		}
 		if err != nil {
 			s.logger.Error("Failed to get AS peers", "error", err)
 			// Continue without peers rather than failing the whole request
@@ -912,10 +976,22 @@ func (s *Server) handlePrefixDetail() http.HandlerFunc {
 			return
 		}
 
-		// Combine prefix and length into CIDR notation
-		prefix := prefixParam + "/" + lenParam
+		// Look the prefix up in the text form net/netip prints, the form the
+		// tables store, so that any valid way of writing it finds the route.
+		parsed, err := netip.ParsePrefix(prefixParam + "/" + lenParam)
+		if err != nil {
+			http.Error(w, "Invalid prefix", http.StatusBadRequest)
 
-		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+			return
+		}
+		prefix := parsed.Masked().String()
+
+		routes, originASNs, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
+		if deadlinePassed(r.Context()) {
+			http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
+
+			return
+		}
 		if err != nil {
 			if errors.Is(err, database.ErrNoRoute) {
 				http.Error(w, "Prefix not found", http.StatusNotFound)
@@ -937,18 +1013,10 @@ func (s *Server) handlePrefixDetail() http.HandlerFunc {
 		originMap := make(map[int]*ASNInfo)
 		for _, route := range routes {
 			if _, exists := originMap[route.OriginASN]; !exists {
-				// Get AS info from database
-				asInfo, _, _ := s.db.GetASDetailsContext(r.Context(), route.OriginASN)
-				handle := ""
-				description := ""
-				if asInfo != nil {
-					handle = asInfo.Handle
-					description = asInfo.Description
-				}
 				originMap[route.OriginASN] = &ASNInfo{
 					ASN:         route.OriginASN,
-					Handle:      handle,
-					Description: description,
+					Handle:      originASNs[route.OriginASN].Handle,
+					Description: originASNs[route.OriginASN].Description,
 					PeerCount:   0,
 				}
 			}
@@ -1072,6 +1140,11 @@ func (s *Server) handlePrefixLength() http.HandlerFunc {
 		// Get random sample of prefixes
 		const maxPrefixes = 500
 		prefixes, err := s.db.GetRandomPrefixesByLengthContext(r.Context(), maskLength, ipVersion, maxPrefixes)
+		if deadlinePassed(r.Context()) {
+			http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
+
+			return
+		}
 		if err != nil {
 			s.logger.Error("Failed to get prefixes by length", "error", err)
 			http.Error(w, "Internal server error", http.StatusInternalServerError)
@@ -1163,6 +1236,11 @@ func (s *Server) handlePrefixLength6() http.HandlerFunc {
 		// Get random sample of prefixes
 		const maxPrefixes = 500
 		prefixes, err := s.db.GetRandomPrefixesByLengthContext(r.Context(), maskLength, ipVersion, maxPrefixes)
+		if deadlinePassed(r.Context()) {
+			http.Error(w, requestTimeoutMessage, http.StatusGatewayTimeout)
+
+			return
+		}
 		if err != nil {
 			s.logger.Error("Failed to get prefixes by length", "error", err)
 			http.Error(w, "Internal server error", http.StatusInternalServerError)

internal/server/handlers_test.go

@@ -3,10 +3,13 @@ package server
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"html"
 	"net/http"
 	"net/http/httptest"
 	"runtime"
 	"slices"
+	"strings"
 	"testing"
 	"time"
 
@@ -15,6 +18,7 @@ import (
 	"git.eeqj.de/sneak/routewatch/internal/logger"
 	"git.eeqj.de/sneak/routewatch/internal/metrics"
 	"git.eeqj.de/sneak/routewatch/internal/streamer"
+	"git.eeqj.de/sneak/routewatch/pkg/asinfo"
 	"github.com/google/uuid"
 )
 
@@ -148,6 +152,375 @@ func TestStatsHandlersAnswerFromMemory(t *testing.T) {
 	}
 }
 
+// TestPrefixDetailHandlersParsePrefix checks that both prefix pages find a
+// stored route whatever valid text form the URL writes its prefix in, and
+// answer 400 for a prefix that does not parse. The tables store the form
+// net/netip prints. Before the fix the URL text was looked up as typed, so
+// "2001:DB8:0:0::/32" was not found although "2001:db8::/32" was stored, and
+// "foo/24" answered 500 (https://git.eeqj.de/sneak/routewatch/issues/71).
+func TestPrefixDetailHandlersParsePrefix(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: 64500, PeerIP: "198.51.100.1", ASPath: []int{64500}, NextHop: "198.51.100.1",
+			LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "2001:db8::/32", MaskLength: 32, IPVersion: 6,
+			OriginASN: 64501, PeerIP: "2001:db8::1", ASPath: []int{64501}, NextHop: "2001:db8::1",
+			LastUpdated: ts,
+		},
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	tests := []struct {
+		path string
+		want int
+	}{
+		{"/api/v1/prefix/foo/24", http.StatusBadRequest},
+		{"/prefix/foo/24", http.StatusBadRequest},
+		{"/api/v1/prefix/2001:DB8:0:0::/32", http.StatusOK},
+		{"/prefix/2001:DB8:0:0::/32", http.StatusOK},
+		{"/api/v1/prefix/192.0.2.1/24", http.StatusOK},
+		{"/prefix/192.0.2.1/24", http.StatusOK},
+	}
+
+	for _, tt := range tests {
+		rec := httptest.NewRecorder()
+		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil))
+		if rec.Code != tt.want {
+			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, tt.want, rec.Body)
+		}
+	}
+}
+
+// failingASDetailsDB wraps a real store and fails every AS details lookup.
+type failingASDetailsDB struct {
+	database.Store
+}
+
+func (failingASDetailsDB) GetASDetailsContext(_ context.Context, _ int) (*database.ASN, []database.LiveRoute, error) {
+	return nil, nil, errors.New("AS details lookup failed")
+}
+
+// TestPrefixDetailShowsOriginNames checks that the prefix page shows each
+// origin AS's handle and description without looking up the AS's details,
+// which also read every route the AS originates. Before the fix the page did
+// that lookup once per origin, so with it failing the names were missing
+// (https://git.eeqj.de/sneak/routewatch/issues/67). The AS path column shows
+// handles too, so the test looks for the origin list's "(handle)" form.
+func TestPrefixDetailShowsOriginNames(t *testing.T) {
+	db, err := database.New(&config.Config{StateDir: t.TempDir()}, logger.New())
+	if err != nil {
+		t.Fatalf("database.New: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	ts := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	origins := []int{15169, 13335}
+	for _, asn := range origins {
+		if _, err := db.GetOrCreateASN(asn, ts); err != nil {
+			t.Fatalf("GetOrCreateASN(%d): %v", asn, err)
+		}
+	}
+	if err := db.UpsertLiveRouteBatch([]*database.LiveRoute{
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: origins[0], PeerIP: "198.51.100.1", ASPath: []int{origins[0]}, NextHop: "198.51.100.1",
+			LastUpdated: ts,
+		},
+		{
+			ID: uuid.New(), Prefix: "192.0.2.0/24", MaskLength: 24, IPVersion: 4,
+			OriginASN: origins[1], PeerIP: "198.51.100.2", ASPath: []int{origins[1]}, NextHop: "198.51.100.2",
+			LastUpdated: ts,
+		},
+	}); err != nil {
+		t.Fatalf("UpsertLiveRouteBatch: %v", err)
+	}
+
+	s := New(failingASDetailsDB{db}, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	rec := httptest.NewRecorder()
+	s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/prefix/192.0.2.0/24", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d, want %d; body %s", rec.Code, http.StatusOK, rec.Body)
+	}
+
+	page := rec.Body.String()
+	for _, asn := range origins {
+		info, ok := asinfo.Get(asn)
+		if !ok {
+			t.Fatalf("AS%d is not in the AS info data", asn)
+		}
+		if want := "(" + html.EscapeString(info.Handle) + ")"; !strings.Contains(page, want) {
+			t.Errorf("page does not show AS%d's handle %q", asn, want)
+		}
+		if want := html.EscapeString(info.Description); !strings.Contains(page, want) {
+			t.Errorf("page does not show AS%d's description %q", asn, want)
+		}
+	}
+}
+
+// shortRequestDeadline is the deadline the tests below give a request. The
+// server's 30-second limit and the stats handlers' 4-second limit inherit it,
+// so the tests do not wait for either.
+const shortRequestDeadline = 50 * time.Millisecond
+
+// TestRequestPastTimeLimitAnswers504 sends a request through the server's
+// router to a page and to a JSON route whose handlers wait for the time limit
+// to pass and return without answering. The page answers 504; the JSON route
+// answers 504 with the JSON error body. Before the fix both answered 408,
+// written by the time limit middleware from its own goroutine while the
+// handler could still be writing.
+func TestRequestPastTimeLimitAnswers504(t *testing.T) {
+	s := New(nil, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	waitForTimeLimit := func(_ http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	}
+	// Registered the way setupRoutes registers pages and JSON routes.
+	s.router.Get("/slow-page", waitForTimeLimit)
+	s.router.Get("/slow.json", JSONValidationMiddleware(http.HandlerFunc(waitForTimeLimit)).ServeHTTP)
+
+	tests := []struct {
+		path         string
+		wantJSONBody bool
+	}{
+		{path: "/slow-page"},
+		{path: "/slow.json", wantJSONBody: true},
+	}
+
+	for _, tt := range tests {
+		ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
+		rec := httptest.NewRecorder()
+		s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, tt.path, nil).WithContext(ctx))
+		cancel()
+
+		if rec.Code != http.StatusGatewayTimeout {
+			t.Errorf("%s: status %d, want %d; body %s", tt.path, rec.Code, http.StatusGatewayTimeout, rec.Body)
+		}
+		if tt.wantJSONBody {
+			checkJSONErrorCode(t, tt.path, rec, http.StatusGatewayTimeout)
+		}
+	}
+}
+
+// TestStatsHandlersAnswer504WhenDatabaseReadRunsOut calls each stats handler
+// with a store that does not answer before the handler's 4-second limit runs
+// out, and checks that the handler itself answers 504 with the JSON error
+// body. Before the fix status.json answered 408, and /api/v1/stats wrote
+// nothing, which the JSON check on its route turned into 500.
+func TestStatsHandlersAnswer504WhenDatabaseReadRunsOut(t *testing.T) {
+	release := make(chan struct{})
+	defer close(release)
+	db := blockingStatsDB{release: release}
+	s := New(db, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	handlers := map[string]http.HandlerFunc{
+		"status.json": s.handleStatusJSON(),
+		"stats":       s.handleStats(),
+	}
+
+	for name, handler := range handlers {
+		ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
+		rec := httptest.NewRecorder()
+		handler(rec, httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx))
+		cancel()
+
+		if rec.Code != http.StatusGatewayTimeout {
+			t.Errorf("%s: status %d, want %d; body %s", name, rec.Code, http.StatusGatewayTimeout, rec.Body)
+		}
+		checkJSONErrorCode(t, name, rec, http.StatusGatewayTimeout)
+	}
+}
+
+// slowDB embeds database.Store (left nil) and overrides the reads the routes
+// in TestRoutesAnswer504WhenDatabaseReadIsCutOff make. Each read waits until
+// its context ends and then answers as the real store does when the time
+// limit cuts it off: the IP read with the context's error, the prefix read
+// that there is no route, and the others with what they had read, here
+// nothing, and no error. Every other Store method is unused and would panic
+// if called.
+type slowDB struct {
+	database.Store
+}
+
+func (slowDB) GetStatsContext(ctx context.Context) (database.Stats, error) {
+	<-ctx.Done()
+
+	return database.Stats{}, nil
+}
+
+func (slowDB) GetIPInfoContext(ctx context.Context, _ string) (*database.IPInfo, error) {
+	<-ctx.Done()
+
+	return nil, ctx.Err()
+}
+
+func (slowDB) GetASDetailsContext(ctx context.Context, asn int) (*database.ASN, []database.LiveRoute, error) {
+	<-ctx.Done()
+
+	return &database.ASN{ASN: asn}, nil, nil
+}
+
+func (slowDB) GetPrefixDetailsContext(ctx context.Context, _ string) ([]database.LiveRoute, map[int]database.ASN, error) {
+	<-ctx.Done()
+
+	return nil, nil, database.ErrNoRoute
+}
+
+func (slowDB) GetRandomPrefixesByLengthContext(ctx context.Context, _, _, _ int) ([]database.LiveRoute, error) {
+	<-ctx.Done()
+
+	return nil, nil
+}
+
+// TestRoutesAnswer504WhenDatabaseReadIsCutOff sends a request through the
+// server's router for each route that reads the database, with a store whose
+// reads are cut off when the request's time limit passes. Each route answers
+// 504 with the time limit message. Without its check after the read, a route
+// answers with what the cut-off read returned: 500, 404, 200, or, on a page
+// that stops before rendering once the request has ended, 504 with an empty
+// body. The health check is left out: it answers 503 when its own 2-second
+// ping runs out.
+func TestRoutesAnswer504WhenDatabaseReadIsCutOff(t *testing.T) {
+	s := New(slowDB{}, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+
+	tests := []struct {
+		path         string
+		wantJSONBody bool
+	}{
+		{path: "/as/64500"},
+		{path: "/prefix/192.0.2.0/24"},
+		{path: "/prefixlength/24"},
+		{path: "/prefixlength6/48"},
+		{path: "/status.json", wantJSONBody: true},
+		{path: "/ip/192.0.2.1", wantJSONBody: true},
+		{path: "/api/v1/stats", wantJSONBody: true},
+		{path: "/api/v1/ip/192.0.2.1", wantJSONBody: true},
+		{path: "/api/v1/as/64500", wantJSONBody: true},
+		{path: "/api/v1/prefix/192.0.2.0/24", wantJSONBody: true},
+	}
+
+	for _, tt := range tests {
+		checkRouteAnswers504(t, s, tt.path, tt.wantJSONBody)
+	}
+}
+
+// slowSecondReadDB embeds database.Store (left nil) and overrides the reads
+// of the routes that read the database twice. The first read answers at once;
+// the second, the AS page's peers read or the stats routes' WHOIS read, waits
+// until its context ends and then answers with the context's error, as the
+// real store does.
+type slowSecondReadDB struct {
+	database.Store
+}
+
+func (slowSecondReadDB) GetASDetailsContext(_ context.Context, asn int) (*database.ASN, []database.LiveRoute, error) {
+	return &database.ASN{ASN: asn}, nil, nil
+}
+
+func (slowSecondReadDB) GetASPeersContext(ctx context.Context, _ int) ([]database.ASPeer, error) {
+	<-ctx.Done()
+
+	return nil, ctx.Err()
+}
+
+func (slowSecondReadDB) GetStatsContext(_ context.Context) (database.Stats, error) {
+	return database.Stats{}, nil
+}
+
+func (slowSecondReadDB) GetWHOISStats(ctx context.Context, _ time.Duration) (*database.WHOISStats, error) {
+	<-ctx.Done()
+
+	return nil, ctx.Err()
+}
+
+// idleASNFetcher is a WHOIS fetcher that does nothing. The stats handlers
+// read the WHOIS stats only when the server has a fetcher.
+type idleASNFetcher struct{}
+
+func (idleASNFetcher) QueueImmediate(int) {}
+
+func (idleASNFetcher) GetStats() ASNFetcherStats {
+	return ASNFetcherStats{}
+}
+
+// TestRoutesAnswer504WhenSecondDatabaseReadIsCutOff sends a request through
+// the server's router for each route that reads the database twice, with a
+// store that answers the first read and cuts off the second when the
+// request's time limit passes. Each route answers 504 with the time limit
+// message. Without the check after the second read, the AS page answers 504
+// with an empty body and the stats routes answer 200 without the WHOIS stats.
+func TestRoutesAnswer504WhenSecondDatabaseReadIsCutOff(t *testing.T) {
+	s := New(slowSecondReadDB{}, streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	s.SetASNFetcher(idleASNFetcher{})
+
+	tests := []struct {
+		path         string
+		wantJSONBody bool
+	}{
+		{path: "/as/64500"},
+		{path: "/status.json", wantJSONBody: true},
+		{path: "/api/v1/stats", wantJSONBody: true},
+	}
+
+	for _, tt := range tests {
+		checkRouteAnswers504(t, s, tt.path, tt.wantJSONBody)
+	}
+}
+
+// checkRouteAnswers504 sends a request for path through the server's router
+// with a short deadline and checks that it answers 504 with the time limit
+// message: the JSON error body on JSON routes, the plain message on pages.
+func checkRouteAnswers504(t *testing.T, s *Server, path string, wantJSONBody bool) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), shortRequestDeadline)
+	defer cancel()
+	rec := httptest.NewRecorder()
+	s.router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil).WithContext(ctx))
+
+	if rec.Code != http.StatusGatewayTimeout {
+		t.Errorf("%s: status %d, want %d; body %s", path, rec.Code, http.StatusGatewayTimeout, rec.Body)
+	}
+	if wantJSONBody {
+		checkJSONErrorCode(t, path, rec, http.StatusGatewayTimeout)
+	} else if body := strings.TrimSpace(rec.Body.String()); body != requestTimeoutMessage {
+		t.Errorf("%s: body %q, want %q", path, body, requestTimeoutMessage)
+	}
+}
+
+// checkJSONErrorCode checks that rec holds the JSON error body with the given
+// code.
+func checkJSONErrorCode(t *testing.T, name string, rec *httptest.ResponseRecorder, want int) {
+	t.Helper()
+
+	var body struct {
+		Status string `json:"status"`
+		Error  struct {
+			Code int `json:"code"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Errorf("%s: decoding the answer %q: %v", name, rec.Body, err)
+
+		return
+	}
+	if body.Status != "error" || body.Error.Code != want {
+		t.Errorf("%s: answer %s, want status \"error\" and error code %d", name, rec.Body, want)
+	}
+}
+
 // settledGoroutineCount lets transient goroutines finish, then reports the
 // current count.
 func settledGoroutineCount() int {

internal/server/middleware.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -109,142 +110,28 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 	})
 }
 
-// timeoutWriter wraps ResponseWriter to prevent concurrent writes after timeout
-type timeoutWriter struct {
-	http.ResponseWriter
-	mu      sync.Mutex
-	written bool
-	header  http.Header // cached header to prevent concurrent access
-}
+// requestTimeoutMessage is the error message sent with 504 Gateway Timeout.
+const requestTimeoutMessage = "Request timeout"
 
-func (tw *timeoutWriter) Write(b []byte) (int, error) {
-	tw.mu.Lock()
-	defer tw.mu.Unlock()
-
-	if tw.written {
-		return 0, nil // Discard writes after timeout
-	}
-
-	return tw.ResponseWriter.Write(b)
-}
-
-func (tw *timeoutWriter) WriteHeader(statusCode int) {
-	tw.mu.Lock()
-	defer tw.mu.Unlock()
-
-	if tw.written {
-		return // Discard writes after timeout
-	}
-
-	tw.ResponseWriter.WriteHeader(statusCode)
-}
-
-func (tw *timeoutWriter) Header() http.Header {
-	tw.mu.Lock()
-	defer tw.mu.Unlock()
-
-	if tw.written {
-		// Return a copy to prevent modifications after timeout
-		if tw.header == nil {
-			tw.header = make(http.Header)
-		}
-
-		return tw.header
-	}
-
-	return tw.ResponseWriter.Header()
-}
-
-func (tw *timeoutWriter) markWritten() {
-	tw.mu.Lock()
-	defer tw.mu.Unlock()
-	tw.written = true
-}
-
-// TimeoutMiddleware creates an HTTP middleware that enforces a request timeout.
-// If the handler does not complete within the specified duration, the middleware
-// returns a JSON error response with HTTP status 408 (Request Timeout).
+// deadlinePassed reports whether ctx ended because its deadline passed.
 //
-// The timeout parameter specifies the maximum duration allowed for request processing.
-// The returned middleware handles panics from the wrapped handler by re-panicking
-// after cleanup, and prevents concurrent writes to the response after timeout occurs.
-func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			startTime := time.Now()
-
-			ctx, cancel := context.WithTimeout(r.Context(), timeout)
-			defer cancel()
-
-			tw := &timeoutWriter{
-				ResponseWriter: w,
-				header:         make(http.Header),
-			}
-
-			done := make(chan struct{})
-			panicChan := make(chan interface{}, 1)
-
-			go func() {
-				defer func() {
-					if p := recover(); p != nil {
-						panicChan <- p
-					}
-				}()
-
-				next.ServeHTTP(tw, r.WithContext(ctx))
-				close(done)
-			}()
-
-			select {
-			case p := <-panicChan:
-				panic(p)
-			case <-done:
-				return
-			case <-ctx.Done():
-				tw.markWritten() // Prevent the handler from writing after timeout
-				execTime := time.Since(startTime)
-
-				// Log the timeout as a warning
-				logger.Warn("Request timeout",
-					"method", r.Method,
-					"path", r.URL.Path,
-					"duration_ms", execTime.Milliseconds(),
-					"remote_addr", r.RemoteAddr,
-				)
-
-				// Write directly to the underlying writer since we've marked tw as written
-				// This is safe because markWritten() prevents the handler from writing
-				tw.mu.Lock()
-				w.Header().Set("Content-Type", "application/json")
-				w.WriteHeader(http.StatusRequestTimeout)
-				tw.mu.Unlock()
-
-				response := map[string]interface{}{
-					"status": "error",
-					"error": map[string]interface{}{
-						"msg":  "Request timeout",
-						"code": http.StatusRequestTimeout,
-					},
-					"@meta": map[string]interface{}{
-						"time_zone":      "UTC",
-						"api_version":    1,
-						"execution_time": fmt.Sprintf("%d ms", execTime.Milliseconds()),
-					},
-				}
-
-				_ = json.NewEncoder(w).Encode(response)
-			}
-		})
-	}
+// A handler calls it right after each database read or host name lookup,
+// before it looks at what came back, error or not, and answers 504 if it
+// reports true. A read cut off by the time limit can return an error, or part
+// of its rows or none of them without one, so only this check tells a cut-off
+// read from a complete one.
+func deadlinePassed(ctx context.Context) bool {
+	return errors.Is(ctx.Err(), context.DeadlineExceeded)
 }
 
 // JSONValidationMiddleware is an HTTP middleware that validates JSON API responses.
 // It ensures that responses with Content-Type "application/json" contain valid JSON.
 //
 // If a response is not valid JSON or is empty when JSON is expected, the middleware
-// returns a properly formatted JSON error response. For timeout errors (status 408),
-// the error message will be "Request timeout". For other errors, it returns
-// "Internal server error" with status 500 if the original status was 200.
+// returns a properly formatted JSON error response. If the request's time limit
+// has passed, it answers 504 with the error message "Request timeout". For other
+// errors, it returns "Internal server error" with status 500 if the original
+// status was 200.
 //
 // Non-JSON responses are passed through unchanged.
 func JSONValidationMiddleware(next http.Handler) http.Handler {
@@ -293,11 +180,14 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 		if statusCode == http.StatusOK {
 			statusCode = http.StatusInternalServerError
 		}
+		if deadlinePassed(r.Context()) {
+			statusCode = http.StatusGatewayTimeout
+		}
 		w.WriteHeader(statusCode)
 
 		errorMsg := "Internal server error"
-		if statusCode == http.StatusRequestTimeout {
-			errorMsg = "Request timeout"
+		if statusCode == http.StatusGatewayTimeout {
+			errorMsg = requestTimeoutMessage
 		}
 
 		response := map[string]interface{}{

internal/server/routes.go

@@ -16,9 +16,12 @@ func (s *Server) setupRoutes() {
 	r.Use(middleware.RealIP)
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
-	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
-	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
 	r.Use(JSONResponseMiddleware)
+	// Timeout must come after JSONResponseMiddleware, which sends its answer
+	// when the handler returns and would send a 200 ahead of Timeout's 504 for
+	// a handler that wrote nothing.
+	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
+	r.Use(middleware.Timeout(requestTimeout))
 
 	// Routes
 	r.Get("/", s.handleIndex())

internal/server/server.go

@@ -3,6 +3,8 @@ package server
 
 import (
 	"context"
+	"fmt"
+	"net"
 	"net/http"
 	"strconv"
 	"time"
@@ -53,9 +55,12 @@ func New(db database.Store, streamer *streamer.Streamer, logger *logger.Logger,
 	return s
 }
 
-// Start starts the HTTP server
+// Start listens on the configured port and serves HTTP in the background.
+// It returns an error if it cannot listen, for example because the port is
+// already in use.
 func (s *Server) Start() error {
 	const (
+		network           = "tcp"
 		readHeaderTimeout = 40 * time.Second
 		readTimeout       = 60 * time.Second
 		writeTimeout      = 60 * time.Second
@@ -73,10 +78,15 @@ func (s *Server) Start() error {
 
 	s.logger.Info("Starting HTTP server", "port", s.port, "addr", s.srv.Addr)
 
-	// Start in goroutine but log when actually listening
+	listener, err := net.Listen(network, s.srv.Addr)
+	if err != nil {
+		return fmt.Errorf("starting HTTP server: %w", err)
+	}
+
+	s.logger.Info("HTTP server listening", "addr", listener.Addr().String())
+
 	go func() {
-		s.logger.Info("HTTP server listening", "addr", s.srv.Addr)
-		if err := s.srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		if err := s.srv.Serve(listener); err != nil && err != http.ErrServerClosed {
 			s.logger.Error("HTTP server error", "error", err)
 		}
 	}()

internal/server/server_test.go

@@ -0,0 +1,33 @@
+package server
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"git.eeqj.de/sneak/routewatch/internal/config"
+	"git.eeqj.de/sneak/routewatch/internal/logger"
+	"git.eeqj.de/sneak/routewatch/internal/metrics"
+	"git.eeqj.de/sneak/routewatch/internal/streamer"
+)
+
+// TestStartFailsWhenPortIsHeld holds a port with a listener of its own and
+// checks that Start on that port returns an error. Before the fix Start
+// listened in a goroutine, only logged the failure and returned nil, so the
+// daemon kept running without its web server.
+func TestStartFailsWhenPortIsHeld(t *testing.T) {
+	held, err := net.Listen("tcp", ":0")
+	if err != nil {
+		t.Fatalf("failed to open the test listener: %v", err)
+	}
+	defer func() { _ = held.Close() }()
+
+	port := held.Addr().(*net.TCPAddr).Port
+	log := logger.New()
+	s := New(nil, streamer.New(log, metrics.New()), log, &config.Config{Port: port})
+	defer func() { _ = s.Stop(context.Background()) }()
+
+	if err := s.Start(); err == nil {
+		t.Fatalf("Start returned nil while port %d was held by another listener", port)
+	}
+}

internal/streamer/streamer.go

@@ -7,6 +7,7 @@ import (
 	"compress/gzip"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -48,6 +49,7 @@ const (
 	metricsUpdateRate     = time.Second
 	minBackoffDelay       = 5 * time.Second
 	maxBackoffDelay       = 320 * time.Second
+	streamIdleTimeout     = 60 * time.Second // Reconnect when no line arrives for this long
 	metricsLogInterval    = 10 * time.Second
 	bytesPerKB            = 1024
 	bytesPerMB            = 1024 * 1024
@@ -58,6 +60,9 @@ const (
 	backpressureSlope     = 2.0 // Slope for linear drop probability increase
 )
 
+// errStreamEnded is returned by stream when RIS Live ends the response.
+var errStreamEnded = errors.New("RIS Live ended the stream")
+
 // MessageHandler defines the interface for processing RIS messages.
 // Implementations must specify which message types they want to receive,
 // how to process messages, and their desired queue capacity.
@@ -107,6 +112,8 @@ type Streamer struct {
 	logger       *logger.Logger
 	client       *http.Client
 	url          string
+	idleTimeout  time.Duration // Drop the connection when no line arrives for this long
+	minBackoff   time.Duration // First wait before reconnecting; doubles up to maxBackoffDelay
 	handlers     []*handlerInfo
 	rawHandler   RawMessageHandler
 	mu           sync.RWMutex
@@ -124,8 +131,10 @@ type Streamer struct {
 // The metrics tracker is used to record message counts, bytes received, and connection status.
 func New(logger *logger.Logger, metrics *metrics.Tracker) *Streamer {
 	return &Streamer{
-		logger: logger,
-		url:    risLiveURL,
+		logger:      logger,
+		url:         risLiveURL,
+		idleTimeout: streamIdleTimeout,
+		minBackoff:  minBackoffDelay,
 		client: &http.Client{
 			Timeout: 0, // No timeout for streaming
 			Transport: &http.Transport{
@@ -405,7 +414,7 @@ func (s *Streamer) updateMetrics(messageBytes int) {
 
 // streamWithReconnect handles streaming with automatic reconnection and exponential backoff
 func (s *Streamer) streamWithReconnect(ctx context.Context) {
-	backoffDelay := minBackoffDelay
+	backoffDelay := s.minBackoff
 	consecutiveFailures := 0
 
 	for {
@@ -422,8 +431,9 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 		err := s.stream(ctx)
 		streamDuration := time.Since(startTime)
 
-		if err == nil {
-			// Clean exit (context cancelled)
+		// Only Stop ends the streamer. A stream that ends any other way,
+		// with or without an error, is a disconnect and is reconnected.
+		if ctx.Err() != nil {
 			return
 		}
 
@@ -434,17 +444,13 @@ func (s *Streamer) streamWithReconnect(ctx context.Context) {
 			"stream_duration", streamDuration)
 		s.metrics.SetConnected(false)
 
-		// Check if context is cancelled
-		if ctx.Err() != nil {
-			return
-		}
-
-		// If we streamed for more than 30 seconds, reset the backoff
-		// This indicates we had a successful connection that received data
+		// A stream that lasted more than 30 seconds resets the backoff. That
+		// includes a stream dropped after streamIdleTimeout with no line, so
+		// a silent feed is retried after the first backoff delay every time.
 		if streamDuration > 30*time.Second {
 			s.logger.Info("Resetting backoff delay due to successful connection",
 				"stream_duration", streamDuration)
-			backoffDelay = minBackoffDelay
+			backoffDelay = s.minBackoff
 			consecutiveFailures = 0
 		} else {
 			// Increment consecutive failures
@@ -477,7 +483,13 @@ func (s *Streamer) stream(ctx context.Context) error {
 	connCtx, connCancel := context.WithCancel(ctx)
 	defer connCancel()
 
-	req, err := http.NewRequestWithContext(ctx, "GET", s.url, nil)
+	// The idle timer drops the connection, by cancelling connCtx, when no
+	// line arrives for s.idleTimeout. Each line read starts it over. It
+	// also covers the wait for the server to answer.
+	idleTimer := time.AfterFunc(s.idleTimeout, connCancel)
+	defer idleTimer.Stop()
+
+	req, err := http.NewRequestWithContext(connCtx, "GET", s.url, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -559,6 +571,8 @@ func (s *Streamer) stream(ctx context.Context) error {
 	scanner := bufio.NewScanner(reader)
 
 	for scanner.Scan() {
+		idleTimer.Reset(s.idleTimeout)
+
 		select {
 		case <-ctx.Done():
 			s.logger.Info("Stream stopped by context")
@@ -615,7 +629,7 @@ func (s *Streamer) stream(ctx context.Context) error {
 
 		// Process based on message type
 		switch msg.Type {
-		case "UPDATE":
+		case ristypes.MessageTypeUpdate:
 			// Process BGP UPDATE messages
 			// Will be dispatched to handlers
 		case "RIS_PEER_STATE":
@@ -654,9 +668,9 @@ func (s *Streamer) stream(ctx context.Context) error {
 			)
 
 			continue
-		case "STATE":
-			// Peer state changes - silently ignore
-			continue
+		case ristypes.MessageTypeState:
+			// The BGP session with the peer changed state, for example went
+			// down. Dispatched to the handlers that want it.
 		default:
 			s.logger.Warn("Unknown message type, skipping",
 				"type", msg.Type,
@@ -707,11 +721,19 @@ func (s *Streamer) stream(ctx context.Context) error {
 		s.mu.RUnlock()
 	}
 
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+
+	if connCtx.Err() != nil {
+		return fmt.Errorf("no line received for %s", s.idleTimeout)
+	}
+
 	if err := scanner.Err(); err != nil {
 		return fmt.Errorf("scanner error: %w", err)
 	}
 
-	return nil
+	return errStreamEnded
 }
 
 // shouldDropForBackpressure determines if a message should be dropped based on queue utilization

internal/streamer/streamer_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"runtime"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -39,6 +40,14 @@ func TestNewStreamer(t *testing.T) {
 	if s.metrics != metricsTracker {
 		t.Error("metrics tracker not set correctly")
 	}
+
+	if s.idleTimeout != streamIdleTimeout {
+		t.Errorf("idleTimeout = %s, want %s", s.idleTimeout, streamIdleTimeout)
+	}
+
+	if s.minBackoff != minBackoffDelay {
+		t.Errorf("minBackoff = %s, want %s", s.minBackoff, minBackoffDelay)
+	}
 }
 
 // TestStreamDoesNotLeakTickersAcrossReconnects drives many short-lived
@@ -57,8 +66,8 @@ func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 
 	// One warm-up connection so any persistent HTTP transport goroutine exists
 	// before we take the baseline.
-	if err := s.stream(context.Background()); err != nil {
-		t.Fatalf("warm-up stream returned error: %v", err)
+	if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+		t.Fatalf("warm-up stream returned %v, want %v", err, errStreamEnded)
 	}
 	s.client.CloseIdleConnections()
 
@@ -66,8 +75,8 @@ func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 
 	const reconnects = 20
 	for range reconnects {
-		if err := s.stream(context.Background()); err != nil {
-			t.Fatalf("stream returned error: %v", err)
+		if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+			t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
 		}
 	}
 	s.client.CloseIdleConnections()
@@ -78,23 +87,81 @@ func TestStreamDoesNotLeakTickersAcrossReconnects(t *testing.T) {
 	}
 }
 
-// updateHandler wants UPDATE messages and does nothing with them.
-type updateHandler struct{}
+// updateLine is one UPDATE message as RIS Live sends it.
+const updateLine = `{"type":"ris_message","data":{"type":"UPDATE","peer":"192.0.2.1",` +
+	`"peer_asn":"64496","timestamp":1700000000}}` + "\n"
+
+// updateHandler wants UPDATE messages. For each one it handles it sends on
+// handled if there is room, and otherwise does nothing; a nil handled is
+// never sent on.
+type updateHandler struct {
+	handled chan struct{}
+}
 
 func (updateHandler) WantsMessage(messageType string) bool { return messageType == "UPDATE" }
-func (updateHandler) HandleMessage(*ristypes.RISMessage)   {}
 func (updateHandler) QueueCapacity() int                   { return 10 }
 
+func (h updateHandler) HandleMessage(*ristypes.RISMessage) {
+	select {
+	case h.handled <- struct{}{}:
+	default:
+	}
+}
+
+// stateDownLine is the STATE message RIS Live sends when the collector's BGP
+// session with the peer stateDownPeer goes down.
+const (
+	stateDownPeer = "192.0.2.1"
+	stateDownLine = `{"type":"ris_message","data":{"type":"STATE","peer":"` + stateDownPeer + `",` +
+		`"peer_asn":"64496","timestamp":1700000000,"state":"down"}}` + "\n"
+)
+
+// stateHandler wants STATE messages only. Tests read what it is handed from
+// its queue, so HandleMessage does nothing.
+type stateHandler struct{}
+
+func (stateHandler) WantsMessage(messageType string) bool {
+	return messageType == ristypes.MessageTypeState
+}
+func (stateHandler) QueueCapacity() int                 { return 10 }
+func (stateHandler) HandleMessage(*ristypes.RISMessage) {}
+
+// TestStreamHandsStateMessagesToHandlersThatWantThem has the server send one
+// STATE message whose state is down. The streamer must queue it, with its
+// peer and state, for a handler that wants STATE messages.
+func TestStreamHandsStateMessagesToHandlersThatWantThem(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, stateDownLine)
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+	s.RegisterHandler(stateHandler{})
+
+	if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+		t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
+	}
+
+	select {
+	case msg := <-s.handlers[0].queue:
+		if msg.Type != ristypes.MessageTypeState || msg.Peer != stateDownPeer || msg.State != ristypes.StateDown {
+			t.Errorf("queued message has type %q, peer %q, state %q; want %q, %q, %q",
+				msg.Type, msg.Peer, msg.State, ristypes.MessageTypeState, stateDownPeer, ristypes.StateDown)
+		}
+	default:
+		t.Fatal("the STATE message was not queued for the handler that wants it")
+	}
+}
+
 // TestStopBeforeMessageReachesQueues stops the streamer after the read loop
 // has checked for cancellation but before it hands the message to the handler
 // queues. That is the gap a stop from another goroutine can land in, and it
 // used to end in "send on closed channel". The raw handler runs in that gap on
 // the read loop itself, so calling Stop from it hits the gap every time.
 func TestStopBeforeMessageReachesQueues(t *testing.T) {
-	const line = `{"type":"ris_message","data":{"type":"UPDATE","peer":"192.0.2.1",` +
-		`"peer_asn":"64496","timestamp":1700000000}}` + "\n"
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		_, _ = io.WriteString(w, line)
+		_, _ = io.WriteString(w, updateLine)
 	}))
 	defer srv.Close()
 
@@ -117,6 +184,117 @@ func TestStopBeforeMessageReachesQueues(t *testing.T) {
 	s.Stop()
 }
 
+// TestReconnectWhenStreamEnds has the server end the first response
+// normally, as when RIS Live restarts. The streamer must treat that as a
+// disconnect and connect again.
+func TestReconnectWhenStreamEnds(t *testing.T) {
+	endResponse := func(http.ResponseWriter, *http.Request) {}
+	checkReconnect(t, endResponse, streamIdleTimeout)
+}
+
+// TestReconnectWhenStreamGoesIdle has the server hold the first response
+// open without sending anything. The streamer must drop it once the idle
+// timeout passes and connect again.
+func TestReconnectWhenStreamGoesIdle(t *testing.T) {
+	const idleTimeout = 50 * time.Millisecond
+	holdResponse := func(w http.ResponseWriter, r *http.Request) {
+		w.(http.Flusher).Flush()
+		<-r.Context().Done()
+	}
+	checkReconnect(t, holdResponse, idleTimeout)
+}
+
+// TestReconnectWhenServerNeverAnswers has the server accept the first
+// request and never answer it, not even with headers. The streamer must give
+// up on it once the idle timeout passes and connect again.
+func TestReconnectWhenServerNeverAnswers(t *testing.T) {
+	const idleTimeout = 50 * time.Millisecond
+	neverAnswer := func(_ http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	}
+	checkReconnect(t, neverAnswer, idleTimeout)
+}
+
+// TestStreamNotDroppedWhileLinesArrive has the server send lines well within
+// the idle timeout for several times the timeout, then end the response. Each
+// line must start the idle timeout over, so the stream lasts until the server
+// ends it instead of being dropped as idle.
+func TestStreamNotDroppedWhileLinesArrive(t *testing.T) {
+	const (
+		idleTimeout  = 100 * time.Millisecond
+		lineInterval = idleTimeout / 10
+		sendFor      = 5 * idleTimeout
+	)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		deadline := time.Now().Add(sendFor)
+		for time.Now().Before(deadline) {
+			_, _ = io.WriteString(w, updateLine)
+			w.(http.Flusher).Flush()
+			time.Sleep(lineInterval)
+		}
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), metrics.New())
+	s.url = srv.URL
+	s.idleTimeout = idleTimeout
+
+	if err := s.stream(context.Background()); !errors.Is(err, errStreamEnded) {
+		t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
+	}
+}
+
+// checkReconnect runs a streamer against a fake RIS Live server. The first
+// response is served by firstResponse; every later one carries one UPDATE
+// line and then stays open. The streamer must come back for a second
+// response, must not be marked connected when it does, and must handle the
+// UPDATE in it.
+func checkReconnect(t *testing.T, firstResponse http.HandlerFunc, idleTimeout time.Duration) {
+	t.Helper()
+
+	const maxWait = 5 * time.Second
+
+	tracker := metrics.New()
+	connectedAtReconnect := make(chan bool, 1)
+	var requests atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if requests.Add(1) == 1 {
+			firstResponse(w, r)
+
+			return
+		}
+		select {
+		case connectedAtReconnect <- tracker.IsConnected():
+		default:
+		}
+		_, _ = io.WriteString(w, updateLine)
+		w.(http.Flusher).Flush()
+		<-r.Context().Done()
+	}))
+	defer srv.Close()
+
+	s := New(logger.New(), tracker)
+	s.url = srv.URL
+	s.idleTimeout = idleTimeout
+	s.minBackoff = time.Millisecond
+	handler := updateHandler{handled: make(chan struct{}, 1)}
+	s.RegisterHandler(handler)
+	if err := s.Start(); err != nil {
+		t.Fatalf("Start returned error: %v", err)
+	}
+	defer s.Stop()
+
+	select {
+	case <-handler.handled:
+	case <-time.After(maxWait):
+		t.Fatalf("no message from a second response handled within %s", maxWait)
+	}
+
+	if <-connectedAtReconnect {
+		t.Error("streamer was still marked connected when it came back for a second response")
+	}
+}
+
 // settledGoroutineCount lets transient goroutines finish, then reports the
 // current count.
 func settledGoroutineCount() int {

internal/templates/prefix_detail.html

@@ -283,6 +283,7 @@
                 <div class="origin-item">
                     <a href="/as/{{.ASN}}" class="as-link">AS{{.ASN}}</a>
                     {{if .Handle}} ({{.Handle}}){{end}}
+                    {{if .Description}} {{.Description}}{{end}}
                     <span style="color: #7f8c8d; margin-left: 10px;">{{.PeerCount}} peer{{if ne .PeerCount 1}}s{{end}}</span>
                 </div>
                 {{end}}