Show figures of the routing table on the home page (closes #154 )

The home page gets cards for the newest and oldest kept route, the newest and oldest updated AS, the AS with the most prefixes, the ASes with a single prefix and fifteen well-known networks. Two more cards count the bogon announcements and the prefixes with several origin ASes. They link to the new pages /bogons and /multiple-origins, which list up to 1,000 entries each. The new package internal/bogon tells reserved prefixes and AS numbers, from the IANA special-purpose registries. Table.Overview walks the table and lets the read lock go every 10,000 prefixes. The server works the cards out once a minute and serves that copy. A new index on asns(last_seen) finds the newest and oldest updated AS. Model: opus-5-5
2026-10-27 16:48:32 +00:00
37 changed files with 431 additions and 1707 deletions
@@ -1,20 +0,0 @@
---
-title: API Policies
-last_modified: 2026-10-27
---
-
-A value in an API response is never a string with a label or unit in it. A value
-of a native type is sent as that type, and its unit goes in the field name, for
-example `_ms`.
-
-Wrong:
-
-```json
-{ "execution_time": "0 ms" }
-```
-
-Right:
-
-```json
-{ "execution_time_ms": 0 }
-```
@@ -9,38 +9,19 @@ table in real time. It works like this:

 ## Rationale

-RouteWatch exists to serve our other services as an internal API for information
-about IP addresses.
+RIPE RIS Live streams the BGP updates that RIPE's route collectors receive, as
+they happen, from the moment a client connects. It reports changes, not the
+routing table they add up to, so it cannot say which AS an IP address is routed
+to now or which routes a prefix has. RouteWatch applies the feed's updates to a
+routing table that it keeps in memory, with a copy in its own SQLite database.
+It answers IP-to-AS lookups and prefix pages from that table.

-RouteWatch follows BGP routing table updates from RIPE RIS Live. RIS Live
-streams the updates that RIPE's route collectors receive, as they happen, from
-the moment a client connects. It reports changes, not the routing table they add
-up to. RouteWatch applies those changes to a routing table that it keeps in
-memory, with a copy in its own SQLite database. From that table, RouteWatch sees
-directly:
-
- which AS each IP address is routed to
- which announced prefix holds each IP address, and how big that prefix is
-
-RouteWatch adds details of each AS from WHOIS, the public directory of the
-internet registries. The details include the organisation that holds the AS.
-RouteWatch keeps them in its database and looks them up again once they are 30
-days old. An IP lookup answers from those stored details and never waits for
-WHOIS.
-
-So our own services can ask RouteWatch about an IP address, instead of each
-working it out for itself.
-
-RIS Live sends no routing table when a client connects. So the routing table
-holds only the routes announced since RouteWatch first started. An IP lookup
-finds no route for an address until a prefix that holds it is announced. The
-routing table also misses these updates:
-
- those sent while RouteWatch is stopped
- those that RouteWatch drops when it falls behind
-
-A lookup or a prefix page can therefore show a route that has since been
-withdrawn.
+The feed sends no table when a client connects. So the routing table holds only
+the routes announced since RouteWatch first started. An IP-to-AS lookup finds
+nothing for an address whose routes have not been announced since then. The
+routing table also misses updates RouteWatch drops when it falls behind, and
+updates sent while it is stopped. So a lookup or a prefix page can show a route
+the feed has withdrawn.

 ## Features

@@ -107,13 +88,9 @@ one of its peers sends an update.
    old.

 - `GET /bogons` - The bogon announcements (HTML): the routes whose prefix or
-  origin AS is reserved. A prefix is reserved when it lies inside one of these:
-    - a block that the IANA special-purpose address registries mark as not
-      globally reachable
-    - the multicast space, `224.0.0.0/4` and `ff00::/8`, which the IANA IPv4 and
-      IPv6 address space registries list as Multicast
-
-    A reserved AS number is one of these:
+  origin AS is reserved. A prefix is reserved when it lies inside a block that
+  the IANA special-purpose address registries mark as not globally reachable. A
+  reserved AS number is one of these:
    - an AS number for private use or for documentation
    - `AS23456`
    - the last AS number of the 16-bit or the 32-bit range
@@ -132,13 +109,7 @@ one of its peers sends an update.
  figures. The route figures come from the routing table. `oldest_route` and
  `newest_route` are the times of the oldest and the newest kept routes.
  `origins_without_kept_route` counts, across all prefixes, the origin ASes that
-  have no kept route. Other figures include these:
-    - `uptime_seconds`: the number of seconds since the RIS Live feed last
-      connected, or 0 when it has never connected
-    - `memory_usage_bytes`: the size of the Go heap in use, in bytes
-    - `whois_stats.current_interval_seconds`: the WHOIS fetcher's wait between
-      two fetches, in seconds, which can include a fraction of a second
-
+  have no kept route.
 - `GET /.well-known/healthcheck.json` - Health check (JSON): 200 when the
  database answers and the RIS Live feed is connected, otherwise 503;
  `data.status` is `ok` or `error` and `data.checks` says which check failed
@@ -161,45 +132,20 @@ one of its peers sends an update.
 ### API v1

 - `GET /api/v1/stats` - The `/status.json` figures plus connection, garbage
-  collector, stream and handler queue statistics. `connection_duration_seconds`
-  is the number of seconds the RIS Live feed has been connected, or null while
-  it is not connected. `stream.route_churn_per_min` is the number of prefix
-  announcements and withdrawals, from all peers, in the last full clock minute.
+  collector, stream and handler queue statistics. `stream.route_churn_per_min`
+  is the number of prefix announcements and withdrawals, from all peers, in the
+  last full clock minute.
 - `GET /api/v1/ip/{ip}` - Looks up each address. `{ip}` is an IP address, a host
  name, or a comma-separated list of at most 10 of these. `results` has one
-  entry for each address. Every entry has the same fields:
-    - `ip`: the address
-    - `ptr`: the address's PTR names, or an empty list when it has none
-    - `blocklists`: the public blocklists the address is on (see Blocklists), or
-      an empty list when it is on none
-
-    Every other field is about the address's live route. Each is null when the
-    address has no live route. The fields about the route:
-    - `netblock`: the most specific prefix that holds the address
-    - `mask_length`: the netblock's mask length
-    - `ip_version`: the netblock's IP version, 4 or 6
-    - `num_peers`: the number of peers that carry the netblock
-    - `asn`: the origin AS that the most peers carry the netblock with
-    - `num_origins`: the number of origin ASes that peers carry the netblock
-      with
-    - `origin_asns`: those origin ASes, in AS number order
-    - `first_seen`: when RouteWatch first saw the netblock, or null when the
-      database has not stored the netblock yet
-    - `last_seen`: the time of the netblock's newest kept route, or null when
-      the netblock keeps no route
-
-    The fields about the AS in `asn` come from the database. Each is also null
-    when the database does not have it:
-    - `handle`: the AS's handle
-    - `description`: the AS's description
-    - `as_name`: the AS's name in its WHOIS details
-    - `org_name`: the name of the organisation that holds the AS
-    - `org_id`: the organisation's ID at its registry
-    - `address`: the organisation's postal address
-    - `country_code`: the organisation's country code
-    - `abuse_email`: the address that takes abuse reports for the AS
-    - `rir`: the regional internet registry of the AS
+  entry for each address, with:
+    - `ip` and `ptr`: the address and its PTR names
+    - `netblock` and the fields beside it: the most specific prefix that holds
+      the address, and its origin AS with that AS's WHOIS details. For a prefix
+      with several origin ASes, `asn` is the one that most peers carry.
+      `last_seen` is the time of the prefix's newest kept route.
+    - `blocklists`: the public blocklists the address is on (see Blocklists)

+    An address with no live route has a result without the route and AS fields.
    Of the addresses a host name resolves to, only public ones are looked up. A
    name with none, such as one that resolves to a private address, is reported
    as `host name has no public address`, without its addresses. `errors` has
@@ -233,16 +179,10 @@ one of its peers sends an update.
    missing, empty or only spaces answers 400.

 A JSON answer is `{"status": "ok", "data": ...}`, or for an error
-`{"status": "error", "error": {"msg": ..., "code": ...}}`. The health check is
-the exception: its 503 answer is also `{"status": "ok", "data": ...}`, with
-`error` in `data.status`. Every JSON answer also carries an `@meta` object:
-
- `time_zone`: always `UTC`
- `api_version`: `1`
- `execution_time_ms`: the number of milliseconds the request took
-
-Every value with a unit is a number whose field name ends in the unit, such as
-`_ms`, `_seconds` or `_bytes`.
+`{"status": "error", "error": {"msg": ..., "code": ...}}`, and carries an
+`@meta` object with the time zone, the API version and the time the request
+took. The health check is the exception: its 503 answer is also
+`{"status": "ok", "data": ...}`, with `error` in `data.status`.

 A request that runs past its time limit answers 504: the limit is 30 seconds,
 and 4 seconds for the database reads behind `/status.json` and `/api/v1/stats`.
@@ -252,17 +192,11 @@ originates no prefix and has no record in the database or in the AS list built
 into RouteWatch. AS 0 always answers 404, because it means no known origin. The
 AS name search never lists it. A prefix with no live route answers 404 too. The
 HTML pages give these errors as plain text. Under `/api/v1` and `/ip/`, a path
-that matches no route answers 404 with the message `Not found`. A request with
-`POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` or `CONNECT` answers 405
-with `Method not allowed` on these routes:
-
- the routes under `/api/v1` and `/ip/`
- `/status.json`
- `/.well-known/healthcheck.json`
-
-A 500 answer says only `Internal server error`. The error for a host name that
-does not resolve says only `could not resolve host name`. The detail goes to the
-log.
+no route matches answers 404 with the message `Not found`, and `POST`, `PUT`,
+`PATCH`, `DELETE`, `OPTIONS`, `TRACE` or `CONNECT` answers 405 with
+`Method not allowed`. A 500 answer says only `Internal server error`, and a host
+name that does not resolve only `could not resolve host name`; the detail goes
+to the log.

 Every answer carries `Strict-Transport-Security`, `Content-Security-Policy`,
 `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy` and
@@ -273,15 +207,10 @@ so each answer's policy names a random nonce made for that answer, and the
 browser applies or runs only the blocks that carry it. The pages therefore use
 no `style` attributes, which a nonce cannot cover.

-An origin AS of 0 means the route has no known origin. Its AS path ends in an AS
-set of several members, any of which may have originated it. The 0 appears in
-these fields:
-
- `origin_asn` in a route
- `asn` and `origin_asns` in an IP lookup
- the key `0` in a prefix's `origins`
-
-The pages show such a route as having no known origin.
+An origin AS of 0 (`origin_asn` in a route, `asn` in an IP lookup, the key `0`
+in a prefix's `origins`) means the route has no known origin: its AS path ends
+in an AS set of several members, any of which may have originated it. The pages
+show such a route as having no known origin.

 ## Blocklists

@@ -536,29 +465,19 @@ Configuration is handled via environment variables and OS-specific paths:
 | `XDG_DATA_HOME`    | `/var/lib` (in the Docker image) | Base of the state directory; must be an absolute path       |
 | `GOMEMLIMIT`       | `2560MiB` (in the Docker image)  | Go soft memory limit; see Memory                            |
 | `MALLOC_ARENA_MAX` | `2` (in the Docker image)        | glibc malloc arena cap, a positive whole number; see Memory |
-| `TRUSTED_PROXIES`  | the RFC 1918 ranges              | Addresses and CIDR ranges of trusted proxies; see below     |
+| `TRUSTED_PROXIES`  | (empty)                          | Addresses and CIDR ranges of trusted proxies; see below     |

 A variable that is set to an invalid value stops the start with an error and a
-non-zero exit. An empty variable counts as unset. `TRUSTED_PROXIES` is the one
-exception: set but empty, it makes the server trust no proxy.
+non-zero exit. An empty variable counts as unset.

-`TRUSTED_PROXIES` names the reverse proxies whose `X-Forwarded-For` the server
-believes:
-
- When it is not set, the server trusts the private ranges of RFC 1918:
-    - `10.0.0.0/8`
-    - `172.16.0.0/12`
-    - `192.168.0.0/16`
- When it lists addresses and CIDR ranges, comma-separated, such as
-  `10.0.0.0/8,192.0.2.1`, the server trusts those instead.
- When it is set but empty (`TRUSTED_PROXIES=`), the server trusts no proxy.
-
-For a request from a trusted proxy, the request log and `/ip/` use the last
-address in `X-Forwarded-For` that is not a trusted proxy. Each proxy adds the
-address it received the request from to the end, so the entries before it are
-whatever the client sent. For a request from any other address they use the
-address the request came from, whatever forwarding headers it carries.
-`X-Real-IP` and `True-Client-IP` are not read.
+`TRUSTED_PROXIES` lists the reverse proxies whose `X-Forwarded-For` the server
+believes, comma-separated, such as `10.0.0.0/8,192.0.2.1`. For a request from
+one of them, the request log and `/ip/` use the last address in
+`X-Forwarded-For` that is not a trusted proxy: each proxy adds the address it
+received the request from to the end, so the entries before it are whatever the
+client sent. For a request from any other address they use the address the
+request came from, whatever forwarding headers it carries. `X-Real-IP` and
+`True-Client-IP` are not read.

 State directory (the database and the blocklist copies):

@@ -652,11 +571,12 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app needs:

 - Container port: `8080`.
 - Volume: one, at container path `/var/lib/berlin.sneak.app.routewatch`.
- Environment: nothing. The server trusts a reverse proxy at an RFC 1918 address
-  without `TRUSTED_PROXIES` (see Configuration). Set it only when the proxy
-  connects from any other address. Leave `XDG_DATA_HOME`, `GOMEMLIMIT` and
-  `MALLOC_ARENA_MAX` at the image's values. `DEBUG=routewatch` is optional and
-  adds the `System stats` memory line to the log.
+- Environment: `TRUSTED_PROXIES`, set to the address the reverse proxy in front
+  of the app connects from, as the container sees it; without it the request log
+  and `/ip/` give the proxy's address for every request. Nothing else is needed:
+  leave `XDG_DATA_HOME`, `GOMEMLIMIT` and `MALLOC_ARENA_MAX` at the image's
+  values. `DEBUG=routewatch` is optional and adds the `System stats` memory line
+  to the log.
 - Memory Limit: `5g`, the 5 GiB limit from Memory above. upaas sets no swap
  limit, so on a host with swap Docker allows the same amount of swap again.
 - Health check: the image's `HEALTHCHECK` requests
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-27
+last_modified: 2026-10-18
 ---

 This document covers repository structure, tooling, and workflow standards. Code
@@ -12,7 +12,6 @@ style conventions are in separate documents:
 - [JavaScript](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_JS.md)
 - [Python](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_PYTHON.md)
 - [Go HTTP Server Conventions](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/GO_HTTP_SERVER_CONVENTIONS.md)
- [API Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/API_POLICIES.md)

 ---

@@ -175,32 +174,27 @@ style conventions are in separate documents:
  `script/cibuild`. `script/lint`, `script/test`, `script/cibuild` and
  `script/docker` are the four, and there is no fifth — `script/check` runs the
  two gate phases and `script/fmt-check`, and builds no image of its own. In
-  every stage of the `Dockerfile`, every step that lints, tests or compiles
-  comes after `ARG CACHEBUST`. `ARG CACHEBUST` comes right after these steps:
-    - the steps that install system packages
-    - the steps that download Go's modules
-    - the step that runs `script/bootstrap` to install a Python `test` phase's
-      packages from `Pipfile.lock`
-
-    A stage with none of these steps declares `ARG CACHEBUST` right after
-    `FROM`. A step that installs anything else as well, such as a
-    `script/bootstrap` that also installs node packages, comes after it too. A
-    new value reruns every `RUN` step after that line; `COPY` steps are compared
-    by content and need nothing. Docker keeps the layers above the line until
-    the base image, their own lines or the files they copy change. A stage
-    without the `ARG` line is served from cache on an unchanged tree, so a
-    repository re-vendors the scripts and adds the `ARG` lines in one commit.
-    The scripts do not pass `--no-cache`: it reruns every step too, but it also
-    builds the layers above the line again and empties every cache mount, so
-    Go's build cache and golangci-lint's, which the canonical Go `Dockerfile`
-    below mounts so that they survive between check builds, would start empty
-    every time. A bare `docker build .` is not evidence that anything ran: a
-    sub-second build reporting success is a cache hit, not a result. Never
-    invalidate by pruning — `docker builder prune` and friends destroy a build
-    cache shared with every other build on the host. When a check is added or
-    changed, prove it works by planting a defect it must catch and watching the
-    run fail on it, then revert the defect. A green run alone shows neither that
-    the check ran nor that it covers what it should.
+  every stage of the `Dockerfile`, `ARG CACHEBUST` comes right after the steps
+  that install system packages and download Go's modules, or right after `FROM`
+  in a stage with neither, and every step that lints, tests or compiles comes
+  after it. A step that installs anything else as well, such as a
+  `script/bootstrap` that also installs node packages, comes after it too. A new
+  value reruns every `RUN` step after that line; `COPY` steps are compared by
+  content and need nothing. Docker keeps the layers above the line until the
+  base image, their own lines or the files they copy change. A stage without the
+  `ARG` line is served from cache on an unchanged tree, so a repository
+  re-vendors the scripts and adds the `ARG` lines in one commit. The scripts do
+  not pass `--no-cache`: it reruns every step too, but it also builds the layers
+  above the line again and empties every cache mount, so Go's build cache and
+  golangci-lint's, which the canonical Go `Dockerfile` below mounts so that they
+  survive between check builds, would start empty every time. A bare
+  `docker build .` is not evidence that anything ran: a sub-second build
+  reporting success is a cache hit, not a result. Never invalidate by pruning —
+  `docker builder prune` and friends destroy a build cache shared with every
+  other build on the host. When a check is added or changed, prove it works by
+  planting a defect it must catch and watching the run fail on it, then revert
+  the defect. A green run alone shows neither that the check ran nor that it
+  covers what it should.

 - **The gate phases are separate stages, and the build stage depends on both.**
  The lint phase is based on the `golangci/golangci-lint` image (pinned by
@@ -315,9 +309,6 @@ style conventions are in separate documents:
          a package's findings only when the package's files and those of every
          package it imports, `go.mod`, the linters and their settings in
          `.golangci.yml`, and the golangci-lint version are all unchanged.
-        - In a Python `test` phase, the layer of the step that runs
-          `script/bootstrap` to install the packages from `Pipfile.lock`, as
-          described for that phase below.
    - If the project uses `//go:embed` directives that reference build artifacts
      (e.g. a web frontend compiled in a separate stage), the lint phase must
      create placeholder files so the embed directives resolve. Example:
@@ -372,67 +363,6 @@ style conventions are in separate documents:
      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
      do.

- **A Python `test` phase that installs its packages from `Pipfile.lock` does it
-  above `ARG CACHEBUST`, so check builds keep them.** The steps are
-  `COPY script/ script/`, `COPY Pipfile Pipfile.lock ./` and
-  `RUN script/bootstrap`, with `ARG CACHEBUST` right after them. Docker keeps
-  what that `RUN` installed until the base image, `script/`, `Pipfile`,
-  `Pipfile.lock` or a line up to and including the `RUN` changes. The tests run
-  after `ARG CACHEBUST`, on every check build. In every other stage, a step that
-  installs Python packages comes after `ARG CACHEBUST`.
-    - When `script/bootstrap` runs in that step, it installs nothing beyond
-      system packages, pipenv and its dependencies, and the packages from
-      `Pipfile.lock`. It installs no Python there: the tests use the base
-      image's Python, which the image's hash pins. If it installs anything else
-      there, the step goes after `ARG CACHEBUST`.
-    - Every external reference must be pinned by hash, so `script/bootstrap`
-      installs pipenv and its dependencies by hash. It does so with
-      `pip install --require-hashes -r` and a requirements file in `script/`
-      that lists each of them with `==` and its `--hash`. pip refuses to install
-      a dependency the file does not list.
-    - It then runs `pipenv install --deploy`, with `--dev` when the tests need
-      the development packages. `--deploy` installs only what `Pipfile.lock`
-      names, checks every package against the lockfile's hashes, and fails when
-      the lockfile is out of date with `Pipfile`.
-    - A kept layer holds nothing a new install would refuse: pip checked pipenv
-      and its dependencies, and pipenv checked the lockfile's packages, against
-      their hashes. pipenv creates its virtual environment with the `virtualenv`
-      package. The packages that `virtualenv` adds come from wheels inside that
-      package, so the hash pip checked for it covers them. Two things in the
-      layer are not fixed by a hash. A package with no ready-built wheel for the
-      image is built from source. pip downloads the build tools without a hash
-      check, so a kept layer's build of such a package may differ from a new
-      one. And system packages keep the versions the package manager gave when
-      the layer was built; a new install may get newer ones.
-    - As with Go's modules, the packages are kept in a layer, not a cache mount.
-      A cache mount is shared by every build on the host, and nothing checks its
-      files again.
-
-    In this example, `script/bootstrap` finds `make` and `git` already
-    installed, installs pipenv and its dependencies by hash, and runs
-    `pipenv install --dev --deploy`:
-
-    ```dockerfile
-    # Test phase. The 90-second timeout covers both pytest runs.
-    # python:3.x-slim, YYYY-MM-DD
-    FROM python@sha256:... AS test
-    # make and git are base tools that script/bootstrap installs when they
-    # are missing. Installed here, they stay in their own layer when
-    # script/ changes.
-    RUN apt-get update \
-        && apt-get install -y --no-install-recommends make git \
-        && rm -rf /var/lib/apt/lists/*
-    WORKDIR /app
-    COPY script/ script/
-    COPY Pipfile Pipfile.lock ./
-    RUN script/bootstrap
-    ARG CACHEBUST
-    COPY . .
-    RUN timeout 90 sh -c 'pipenv run pytest || { \
-            echo "--- Rerunning with -v for details ---"; \
-            pipenv run pytest -v; exit 1; }'
-    ```
-
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
  runs `script/cibuild` on push, and checks out the repo as its only other step,
  with `persist-credentials: false`: `script/cibuild` needs no token, and
@@ -35,45 +35,6 @@ tested.

 # Completed Steps

- 2026-10-27: the tests of `internal/routewatch` no longer fail on a loaded
-  host. Five of them gave `HandleMessage` two seconds to apply a full prefix
-  batch, which under the race detector can take longer. A test now waits up to
-  15 seconds for each step it expects. The tests of the handlers' limits give
-  the handlers small ones, so the package no longer runs past its 90-second
-  limit (closes #213, #215)
- 2026-10-27: the server works out the home page's cards every minute until it
-  stops. It used to work them out only once, at startup: the end of the context
-  that `Start` is given stopped the refreshes (closes #211)
- 2026-10-27: README "Rationale" says why RouteWatch exists: to answer our other
-  services' questions about IP addresses, from its own routing table and the
-  WHOIS details it keeps. It still says what RIS Live does not give (closes
-  #204)
- 2026-10-27: every JSON answer carries `@meta`. A panic on a JSON route answers
-  500 with the JSON error body. `/status.json` and the health check answer 405
-  with the JSON error body to any method they do not take. The 500 and the 405
-  used to have an empty body. The home page's IP lookup shows the whole JSON
-  answer, `@meta` included. It used to show only the answer's `data`, or only
-  the message of an error answer. A test checks `@meta` on every JSON route, in
-  its successes and its errors (closes #201)
- 2026-10-27: every value in a JSON answer that has a unit is a number, with the
-  unit at the end of its field name. `@meta.execution_time` is now
-  `execution_time_ms`. The stats' `uptime`, `connection_duration` and
-  `memory_usage` are now `uptime_seconds`, `connection_duration_seconds` and
-  `memory_usage_bytes`. `whois_stats.current_interval` is now
-  `current_interval_seconds`. They used to be strings such as "12 ms",
-  "1h18m34s" or "1.1 GB". `connection_duration_seconds` is null while the feed
-  is not connected. `API_POLICIES.md` is vendored from `sneak/prompts`, and
-  `REPO_POLICIES.md` re-vendored (closes #199)
- 2026-10-27: every result of the IP lookup has the same fields. A field without
-  a value is null. It used to be left out. An address with no live route has
-  every route and AS field set to null, and `ptr` is an empty list when there
-  are no PTR names. New fields give the number of origin ASes of the netblock,
-  in `num_origins`, and which they are, in `origin_asns` (closes #200)
- 2026-10-27: with `TRUSTED_PROXIES` unset, the server trusts reverse proxies at
-  the private addresses of RFC 1918. `/ip/`, the home page's `curl` card and the
-  request log then give the client's address from `X-Forwarded-For`. They used
-  to give the proxy's address. A list in `TRUSTED_PROXIES` replaces the default,
-  and `TRUSTED_PROXIES` set but empty trusts no proxy (closes #198)
 - 2026-10-27: the home page has cards with figures of the routing table: the
  newest and oldest kept route, the newest and oldest updated AS, the AS with
  the most prefixes, the ASes with a single prefix, and fifteen well-known
@@ -3,10 +3,9 @@
 // internet. A route is a bogon announcement when its prefix is reserved or its
 // origin AS is.
 //
-// Most reserved prefixes come from the IANA special-purpose address registries
-// for IPv4 and IPv6. The two multicast blocks, 224.0.0.0/4 and ff00::/8, come
-// from the IANA IPv4 and IPv6 address space registries. The reserved AS
-// numbers come from the IANA special-purpose AS numbers registry:
+// The reserved prefixes come from the IANA special-purpose address registries
+// for IPv4 and IPv6. The reserved AS numbers come from the IANA special-purpose
+// AS numbers registry:
 //   - the AS numbers for private use
 //   - the AS numbers for documentation
 //   - AS 23456, which stands in for a 32-bit AS number
@@ -28,10 +27,10 @@ import (
 func Prefix(prefix netip.Prefix) (string, bool) {
 	var holder *block

-	for i, b := range registryBlocks {
+	for i, b := range specialPurposeBlocks {
 		inside := b.prefix.Bits() <= prefix.Bits() && b.prefix.Contains(prefix.Addr())
 		if inside && (holder == nil || b.prefix.Bits() > holder.prefix.Bits()) {
-			holder = &registryBlocks[i]
+			holder = &specialPurposeBlocks[i]
 		}
 	}

@@ -73,43 +72,35 @@ const (
 	amt                     = "AMT"
 	as112DirectDelegation   = "Direct Delegation AS112 Service"
 	ipv4IPv6Translation     = "IPv4-IPv6 Translat."
-	multicast               = "Multicast"
 )

-// block is one row of an IANA address registry.
+// block is one row of an IANA special-purpose address registry.
 type block struct {
 	prefix netip.Prefix
 	name   string
-	// reserved says that no network should announce the row's addresses on
-	// the internet.
+	// reserved says that the row's Globally Reachable column is False.
 	reserved bool
 }

-// reservedBlock returns a reserved row: a multicast block, or a special-purpose
-// row whose Globally Reachable column is False.
+// reservedBlock returns a row whose Globally Reachable column is False.
 func reservedBlock(prefix, name string) block {
 	return block{prefix: netip.MustParsePrefix(prefix), name: name, reserved: true}
 }

-// reachableBlock returns a special-purpose row whose Globally Reachable column
-// is True or N/A. Such a row matters only inside a reserved block, whose
-// addresses it lets be announced.
+// reachableBlock returns a row whose Globally Reachable column is True or N/A.
+// Such a row matters only inside a reserved block, whose addresses it lets be
+// announced.
 func reachableBlock(prefix, name string) block {
 	return block{prefix: netip.MustParsePrefix(prefix), name: name}
 }

-// registryBlocks are the rows of the IANA special-purpose address registries,
-// without the deprecated ones:
+// specialPurposeBlocks are the rows of the IANA special-purpose address
+// registries, without the deprecated ones:
 //   - https://www.iana.org/assignments/iana-ipv4-special-registry/
 //   - https://www.iana.org/assignments/iana-ipv6-special-registry/
 //
-// They also hold the multicast blocks, which the IANA address space registries
-// list as Multicast:
-//   - https://www.iana.org/assignments/ipv4-address-space/
-//   - https://www.iana.org/assignments/ipv6-address-space/
-//
 //nolint:gochecknoglobals // a fixed list, parsed once
-var registryBlocks = []block{
+var specialPurposeBlocks = []block{
 	reservedBlock("0.0.0.0/8", "This network"),
 	reservedBlock("0.0.0.0/32", "This host on this network"),
 	reservedBlock("10.0.0.0/8", privateUse),
@@ -133,7 +124,6 @@ var registryBlocks = []block{
 	reservedBlock("198.18.0.0/15", benchmarking),
 	reservedBlock("198.51.100.0/24", "Documentation (TEST-NET-2)"),
 	reservedBlock("203.0.113.0/24", "Documentation (TEST-NET-3)"),
-	reservedBlock("224.0.0.0/4", multicast),
 	reservedBlock("240.0.0.0/4", "Reserved"),
 	reservedBlock("255.255.255.255/32", "Limited Broadcast"),

@@ -161,7 +151,6 @@ var registryBlocks = []block{
 	reservedBlock("5f00::/16", "Segment Routing (SRv6) SIDs"),
 	reservedBlock("fc00::/7", "Unique-Local"),
 	reservedBlock("fe80::/10", "Link-Local Unicast"),
-	reservedBlock("ff00::/8", multicast),
 }

 // asRange is a range of reserved AS numbers, first to last.
@@ -21,11 +21,6 @@ func TestPrefix(t *testing.T) {
 		{"192.0.2.0/24", "Documentation (TEST-NET-1) (192.0.2.0/24)"},
 		{"2001:db8:1::/48", "Documentation (2001:db8::/32)"},
 		{"fd00::/8", "Unique-Local (fc00::/7)"},
-		// Multicast space, from the IANA address space registries.
-		{"224.0.0.0/4", "Multicast (224.0.0.0/4)"},
-		{"239.255.0.0/16", "Multicast (224.0.0.0/4)"},
-		{"ff00::/8", "Multicast (ff00::/8)"},
-		{"ff02::/16", "Multicast (ff00::/8)"},
 		// The most specific block names the reason.
 		{"0.0.0.0/32", "This host on this network (0.0.0.0/32)"},
 		{"2001:2::/48", "Benchmarking (2001:2::/48)"},
@@ -30,14 +30,6 @@ const (
 	maxPort = 65535
 )

-// The private address ranges of RFC 1918. The HTTP server trusts a reverse
-// proxy in any of them when TRUSTED_PROXIES is not set.
-const (
-	privateRange10  = "10.0.0.0/8"
-	privateRange172 = "172.16.0.0/12"
-	privateRange192 = "192.168.0.0/16"
-)
-
 var (
 	errRelativeXDGDataHome = errors.New("XDG_DATA_HOME must be an absolute path")
 	errUnsupportedOS       = errors.New("unsupported operating system")
@@ -167,21 +159,11 @@ func getPort() (int, error) {
 	return int(port), nil
 }

-// getTrustedProxies returns the reverse proxies the HTTP server trusts. When
-// TRUSTED_PROXIES is not set, they are the private ranges of RFC 1918. When it
-// is set, they are the addresses and CIDR ranges it lists, such as
-// "10.0.0.0/8,192.0.2.1", and none when it is empty. An address is returned as
-// a range holding only that address.
+// getTrustedProxies returns the addresses and CIDR ranges listed in
+// TRUSTED_PROXIES, such as "10.0.0.0/8,192.0.2.1", or none when it is not set.
+// An address is returned as a range holding only that address.
 func getTrustedProxies() ([]netip.Prefix, error) {
-	value, set := os.LookupEnv("TRUSTED_PROXIES")
-	if !set {
-		return []netip.Prefix{
-			netip.MustParsePrefix(privateRange10),
-			netip.MustParsePrefix(privateRange172),
-			netip.MustParsePrefix(privateRange192),
-		}, nil
-	}
-
+	value := os.Getenv("TRUSTED_PROXIES")
 	if value == "" {
 		return nil, nil
 	}
@@ -2,7 +2,6 @@ package config

 import (
 	"net/netip"
-	"os"
 	"runtime"
 	"slices"
 	"testing"
@@ -47,47 +46,25 @@ func TestNewRefusesInvalidPort(t *testing.T) {
 	}
 }

-// TestNewTrustsPrivateRangesByDefault checks that with TRUSTED_PROXIES unset
-// the trusted proxies are the private ranges of RFC 1918. Before the fix no
-// proxy was trusted, so a reverse proxy at a private address was taken for the
-// client (https://git.eeqj.de/sneak/routewatch/issues/198).
-func TestNewTrustsPrivateRangesByDefault(t *testing.T) {
+func TestNewReadsTrustedProxies(t *testing.T) {
 	t.Setenv("PORT", "")
 	t.Setenv("XDG_DATA_HOME", "")

-	// t.Setenv puts the variable back when the test ends.
 	t.Setenv("TRUSTED_PROXIES", "")

-	err := os.Unsetenv("TRUSTED_PROXIES")
-	if err != nil {
-		t.Fatal(err)
-	}
-
 	cfg, err := New()
 	if err != nil {
 		t.Fatalf("New() without TRUSTED_PROXIES: %v", err)
 	}

-	want := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("172.16.0.0/12"),
-		netip.MustParsePrefix("192.168.0.0/16"),
+	if len(cfg.TrustedProxies) != 0 {
+		t.Errorf("New() without TRUSTED_PROXIES: TrustedProxies = %v, want none",
+			cfg.TrustedProxies)
 	}
-	if !slices.Equal(cfg.TrustedProxies, want) {
-		t.Errorf("New() without TRUSTED_PROXIES: TrustedProxies = %v, want %v",
-			cfg.TrustedProxies, want)
-	}
-}
-
-// TestNewReadsTrustedProxies checks that a list in TRUSTED_PROXIES replaces
-// the default, and that TRUSTED_PROXIES set but empty trusts no proxy.
-func TestNewReadsTrustedProxies(t *testing.T) {
-	t.Setenv("PORT", "")
-	t.Setenv("XDG_DATA_HOME", "")

 	t.Setenv("TRUSTED_PROXIES", "10.0.0.0/8, 192.0.2.1,2001:db8::/32")

-	cfg, err := New()
+	cfg, err = New()
 	if err != nil {
 		t.Fatalf("New() with TRUSTED_PROXIES: %v", err)
 	}
@@ -100,18 +77,6 @@ func TestNewReadsTrustedProxies(t *testing.T) {
 	if !slices.Equal(cfg.TrustedProxies, want) {
 		t.Errorf("TrustedProxies = %v, want %v", cfg.TrustedProxies, want)
 	}
-
-	t.Setenv("TRUSTED_PROXIES", "")
-
-	cfg, err = New()
-	if err != nil {
-		t.Fatalf("New() with TRUSTED_PROXIES set but empty: %v", err)
-	}
-
-	if len(cfg.TrustedProxies) != 0 {
-		t.Errorf("New() with TRUSTED_PROXIES set but empty: TrustedProxies = %v, "+
-			"want none", cfg.TrustedProxies)
-	}
 }

 func TestNewRefusesInvalidTrustedProxies(t *testing.T) {
@@ -2,7 +2,6 @@ package routetable

 import (
 	"net/netip"
-	"runtime"
 	"testing"
 	"time"
 )
@@ -73,61 +72,3 @@ func TestWalkPrefixesVisitsEveryPrefix(t *testing.T) {
 		}
 	}
 }
-
-// TestWalkPrefixesLetsUpdatesIn starts an update during the walk's first
-// batch. The update must have been made by the time the walk visits the first
-// prefix of its second batch, because the walk lets the lock go in between.
-func TestWalkPrefixesLetsUpdatesIn(t *testing.T) {
-	t.Parallel()
-
-	const (
-		asn  = 1000
-		peer = "192.0.2.1"
-	)
-
-	routeTime := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-	table := New(Params{})
-	addr := netip.MustParseAddr("1.0.0.0")
-
-	for range walkBatch + 1 {
-		prefix := netip.PrefixFrom(addr, addr.BitLen())
-		table.Announce(prefix, asn, Route{Peer: peer, Time: routeTime})
-
-		addr = addr.Next()
-	}
-
-	updatePrefix := netip.MustParsePrefix("2.0.0.0/8")
-	updateDone := make(chan struct{})
-	visited := 0
-	madeBeforeSecondBatch := false
-
-	table.walkPrefixes(func(netip.Prefix, []*origin) {
-		visited++
-
-		switch visited {
-		case 1:
-			go func() {
-				defer close(updateDone)
-
-				table.Announce(updatePrefix, asn, Route{Peer: peer, Time: routeTime})
-			}()
-
-			// Wait until the update waits for the lock. TryRLock fails
-			// once a writer waits.
-			for table.mu.TryRLock() {
-				table.mu.RUnlock()
-				runtime.Gosched()
-			}
-		case walkBatch + 1:
-			// The walk holds the read lock, so the table can be read.
-			madeBeforeSecondBatch = table.origins(updatePrefix) != nil
-		}
-	})
-
-	<-updateDone
-
-	if !madeBeforeSecondBatch {
-		t.Fatal("an update started during the walk's first batch was not made " +
-			"before its second batch")
-	}
-}
@@ -14,9 +14,6 @@ type PrefixSummary struct {
 	// OriginASN is the origin AS that the most peers carry the prefix with.
 	// When several have as many peers, it is the lowest AS number.
 	OriginASN int
-	// OriginASNs are all the origin ASes that peers carry the prefix with, in
-	// AS number order.
-	OriginASNs []int
 	// Peers is how many peers carry the prefix.
 	Peers int
 	// Newest is the time of the newest kept route of the prefix, or nil when
@@ -214,12 +211,10 @@ func (t *Table) addresses(peers *bitset.BitSet) []string {
 // summarize returns the summary of prefix, whose origins are in AS number
 // order.
 func summarize(prefix netip.Prefix, origins []*origin) PrefixSummary {
-	summary := PrefixSummary{Prefix: prefix, OriginASNs: make([]int, 0, len(origins))}
+	summary := PrefixSummary{Prefix: prefix}
 	mostPeers := 0

 	for _, o := range origins {
-		summary.OriginASNs = append(summary.OriginASNs, o.asn)
-
 		peers := int(o.peers.Count())
 		summary.Peers += peers

@@ -46,22 +46,21 @@ func TestLookup(t *testing.T) {
 	tests := []struct {
 		addr string
 		// want is the summary's prefix, or empty when none is found.
-		want       string
-		originASN  int
-		originASNs []int
-		peers      int
-		newest     int // in seconds after the start; 0 for none
+		want      string
+		originASN int
+		peers     int
+		newest    int // in seconds after the start; 0 for none
 	}{
-		{"10.1.2.3", prefixV4, asA, []int{asA, asB}, 2, 20},
-		{"::ffff:10.1.2.3", prefixV4, asA, []int{asA, asB}, 2, 20},
-		{"10.1.3.4", "10.1.0.0/16", asB, []int{asA, asB}, 3, 30},
-		{"10.2.0.1", "10.0.0.0/8", asA, []int{asA}, 1, 10},
-		{"10.9.0.1", "10.9.0.0/16", asA, []int{asA}, 1, 0},
-		{"192.0.2.1", "", 0, nil, 0, 0},
-		{"2001:db8:1::5", prefixV6, asB, []int{asB}, 1, 20},
-		{"2001:db8:2::1", "2001:db8::/32", asA, []int{asA}, 1, 10},
-		{"3000::1", "3000::/16", asA, []int{asA}, 1, 10},
-		{"2001:db9::1", "", 0, nil, 0, 0},
+		{"10.1.2.3", prefixV4, asA, 2, 20},
+		{"::ffff:10.1.2.3", prefixV4, asA, 2, 20},
+		{"10.1.3.4", "10.1.0.0/16", asB, 3, 30},
+		{"10.2.0.1", "10.0.0.0/8", asA, 1, 10},
+		{"10.9.0.1", "10.9.0.0/16", asA, 1, 0},
+		{"192.0.2.1", "", 0, 0, 0},
+		{"2001:db8:1::5", prefixV6, asB, 1, 20},
+		{"2001:db8:2::1", "2001:db8::/32", asA, 1, 10},
+		{"3000::1", "3000::/16", asA, 1, 10},
+		{"2001:db9::1", "", 0, 0, 0},
 	}

 	for _, tc := range tests {
@@ -78,10 +77,9 @@ func TestLookup(t *testing.T) {
 			}

 			want := routetable.PrefixSummary{
-				Prefix:     netip.MustParsePrefix(tc.want),
-				OriginASN:  tc.originASN,
-				OriginASNs: tc.originASNs,
-				Peers:      tc.peers,
+				Prefix:    netip.MustParsePrefix(tc.want),
+				OriginASN: tc.originASN,
+				Peers:     tc.peers,
 			}
 			if tc.newest != 0 {
 				want.Newest = timeAt(tc.newest)
@@ -168,8 +166,7 @@ func TestSamplePrefixes(t *testing.T) {

 			for _, got := range sample {
 				want := routetable.PrefixSummary{
-					Prefix: got.Prefix, OriginASN: asA, OriginASNs: []int{asA},
-					Peers: 1, Newest: timeAt(10),
+					Prefix: got.Prefix, OriginASN: asA, Peers: 1, Newest: timeAt(10),
 				}
 				if seen[got.Prefix] || got.Prefix.Bits() != tc.maskLength ||
 					!reflect.DeepEqual(got, want) {
@@ -509,6 +509,8 @@ func announcementFeed(prefixes []string) string {
 func TestShutdownWritesTheUpdatesQueuedInTheStreamer(t *testing.T) {
 	t.Parallel()

+	const maxWait = 10 * time.Second
+
 	prefixes := []string{"192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24"}
 	feed := announcementFeed(prefixes)

@@ -554,9 +556,9 @@ func TestShutdownWritesTheUpdatesQueuedInTheStreamer(t *testing.T) {
 	for range cap(linesSeen) {
 		select {
 		case <-linesSeen:
-		case <-time.After(stepTimeout):
+		case <-time.After(maxWait):
 			t.Fatalf("the streamer did not read %d lines within %s",
-				cap(linesSeen), stepTimeout)
+				cap(linesSeen), maxWait)
 		}
 	}

@@ -569,8 +571,8 @@ func TestShutdownWritesTheUpdatesQueuedInTheStreamer(t *testing.T) {

 	select {
 	case <-shutDown:
-	case <-time.After(stepTimeout):
-		t.Fatalf("Shutdown did not return within %s", stepTimeout)
+	case <-time.After(maxWait):
+		t.Fatalf("Shutdown did not return within %s", maxWait)
 	}

 	store.mu.Lock()
@@ -607,16 +609,21 @@ func freePort(t *testing.T) int {
 	return addr.Port
 }

-// TestShutdownDoesNotWaitForABlockedWrite starts the HTTP server and has the
-// AS handler start a write that the store holds until the test ends, past
-// Shutdown's deadline. Shutdown must return without waiting for the write, with
-// the HTTP server stopped, and must neither checkpoint nor close the database:
-// the real one would wait for the write.
+// TestShutdownReturnsByItsDeadlineWhileAWriteIsBlocked starts the HTTP server
+// and has the AS handler start a write that the store holds until the test
+// ends, past Shutdown's deadline. Shutdown must return within its deadline
+// plus a small margin, with the HTTP server stopped, and must neither
+// checkpoint nor close the database: the real one would wait for the write.
 // Before the fix Shutdown waited for the write.
-func TestShutdownDoesNotWaitForABlockedWrite(t *testing.T) {
+func TestShutdownReturnsByItsDeadlineWhileAWriteIsBlocked(t *testing.T) {
 	t.Parallel()

-	const deadline = 100 * time.Millisecond
+	const (
+		deadline = 100 * time.Millisecond
+		// margin is how long Shutdown may take after its deadline, to stop
+		// the HTTP server.
+		margin = 2 * time.Second
+	)

 	blocking := newBlockingStore()
 	defer blocking.releaseWrites()
@@ -660,9 +667,9 @@ func TestShutdownDoesNotWaitForABlockedWrite(t *testing.T) {

 	select {
 	case <-shutDown:
-	case <-time.After(deadline + stepTimeout):
+	case <-time.After(deadline + margin):
 		t.Fatalf("Shutdown did not return within %s of its deadline while "+
-			"a write was blocked", stepTimeout)
+			"a write was blocked", margin)
 	}

 	var dialer net.Dialer
@@ -737,6 +744,8 @@ func (s *closeOrderStore) record(call string) {
 func TestShutdownCheckpointsAndClosesTheDatabaseLast(t *testing.T) {
 	t.Parallel()

+	const deadline = 10 * time.Second
+
 	store := &closeOrderStore{Store: newMockStore()}
 	log := logger.New()
 	cfg := &config.Config{}
@@ -754,7 +763,7 @@ func TestShutdownCheckpointsAndClosesTheDatabaseLast(t *testing.T) {
 		Path: ristypes.ASPath{Sequence: []int{testASNA}},
 	})

-	ctx, cancel := context.WithTimeout(t.Context(), stepTimeout)
+	ctx, cancel := context.WithTimeout(t.Context(), deadline)
 	defer cancel()

 	rw.Shutdown(ctx)
@@ -40,13 +40,9 @@ type ASHandler struct {
 	db     database.Store
 	logger *logger.Logger

-	// batchMaxSize is asnBatchMaxSize. Only HandleMessage reads it, so a test
-	// may lower it before it hands the handler a message.
-	batchMaxSize int
-
 	// Batching. mu guards batch and writing only: the flush goroutine takes
 	// the batch under mu and writes it after releasing mu, so HandleMessage
-	// waits for a database write only while batch is at batchMaxSize.
+	// waits for a database write only while batch is at asnBatchMaxSize.
 	mu    sync.Mutex
 	batch []asnOp
 	// writing is how many operations the flush goroutine took from batch
@@ -83,13 +79,12 @@ func newASHandler(
 	db database.Store, logger *logger.Logger, batchTimeout time.Duration,
 ) *ASHandler {
 	h := &ASHandler{
-		db:           db,
-		logger:       logger,
-		batchMaxSize: asnBatchMaxSize,
-		batch:        make([]asnOp, 0, asnBatchSize),
-		batchFullCh:  make(chan struct{}, 1),
-		stopCh:       make(chan context.Context, 1),
-		done:         make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		batch:       make([]asnOp, 0, asnBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		stopCh:      make(chan context.Context, 1),
+		done:        make(chan struct{}),
 	}
 	h.batchTaken.L = &h.mu

@@ -132,7 +127,7 @@ func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// While the batch is at its maximum size, wait until the flush goroutine
 	// takes it. Meanwhile the handler takes nothing off its queue, which
 	// fills, and the streamer drops messages for it.
-	for len(h.batch) >= h.batchMaxSize {
+	for len(h.batch) >= asnBatchMaxSize {
 		h.batchTaken.Wait()
 	}

@@ -156,7 +151,7 @@ func (h *ASHandler) HandleMessage(msg *ristypes.RISMessage) {

 	// A full batch wakes the flush goroutine. If it is writing, the wake-up
 	// waits in batchFullCh and the batch keeps growing until the write ends
-	// or the batch reaches batchMaxSize.
+	// or the batch reaches asnBatchMaxSize.
 	if len(h.batch) >= asnBatchSize {
 		select {
 		case h.batchFullCh <- struct{}{}:
@@ -19,7 +19,7 @@ func TestASHandlerStoresTheEarliestAndLatestTimesOfANewAS(t *testing.T) {
 	db := newTestDatabase(t)

 	// Built without NewASHandler's flush goroutine, so the test flushes itself.
-	h := &ASHandler{db: db, logger: logger.New(), batchMaxSize: asnBatchMaxSize}
+	h := &ASHandler{db: db, logger: logger.New()}

 	first := peerAnnouncement(testPeerIP, testV4Prefix)
 	second := peerAnnouncement(testPeerIP, testV4Prefix)
@@ -54,7 +54,7 @@ func TestASHandlerRecordsNothingFromAPathWithASZero(t *testing.T) {
 	store := newMockStore()

 	// Built without NewASHandler's flush goroutine, so the test flushes itself.
-	h := &ASHandler{db: store, logger: logger.New(), batchMaxSize: asnBatchMaxSize}
+	h := &ASHandler{db: store, logger: logger.New()}

 	msg := peerAnnouncement(testPeerIP, testV4Prefix)
 	msg.Path = decodePath(t, testASNA, 0, testASNB)
@@ -224,7 +224,7 @@ func TestASNFetcherStopReturnsByItsDeadline(t *testing.T) {

 	select {
 	case <-lookupStarted:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the fetcher did not start the lookup")
 	}

@@ -240,22 +240,22 @@ func TestASNFetcherStopReturnsByItsDeadline(t *testing.T) {

 	select {
 	case <-f.done:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the fetcher goroutine did not return after the lookup ended")
 	}
 }

 // TestRecordKeepsOnlyTheStatsWindow records a success and a failure every
-// second, by a clock the test sets, for three times statsWindow, and never
+// second, by a clock the test sets, far longer than statsWindow, and never
 // asks for the stats. The fetcher must keep only the times within the last
 // statsWindow.
 func TestRecordKeepsOnlyTheStatsWindow(t *testing.T) {
 	t.Parallel()

 	const (
+		records = 100_000
 		step    = time.Second
 		want    = int(statsWindow / step)
-		records = 3 * want
 	)

 	clock := time.Now()
@@ -19,15 +19,9 @@ import (
 )

 const (
-	// stepTimeout is how long a test waits for a step it expects, such as
-	// HandleMessage returning, a write starting or Shutdown returning, before
-	// it fails. Only a step that never comes should reach it. On a loaded
-	// host, under the race detector, HandleMessage takes seconds to apply a
-	// full prefix batch. The helpers below bound every wait with it, Stop
-	// included. A test that hangs in one of them waits out at most two of
-	// these bounds, its step's and Stop's, and then fails with its own
-	// message. That leaves time before go test's 90-second timeout.
-	stepTimeout = 15 * time.Second
+	// handleMessageTimeout is how long a test waits for HandleMessage to
+	// return, or for a write to start, before it fails.
+	handleMessageTimeout = 2 * time.Second

 	// stillWaitingAfter is how long a test watches a HandleMessage that must
 	// wait. One that does not wait returns well within it.
@@ -204,7 +198,7 @@ func lastLogged(t *testing.T, logs *bytes.Buffer) stopLog {
 	return logged
 }

-// returnsInTime reports whether f returns within stepTimeout.
+// returnsInTime reports whether f returns within handleMessageTimeout.
 func returnsInTime(f func()) bool {
 	done := make(chan struct{})

@@ -216,22 +210,11 @@ func returnsInTime(f func()) bool {
 	select {
 	case <-done:
 		return true
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		return false
 	}
 }

-// stopInTime stops h, with no deadline, and fails the test if Stop does not
-// return within stepTimeout. It only marks the test failed, so it can be
-// deferred.
-func stopInTime(t *testing.T, h interface{ Stop(ctx context.Context) }) {
-	t.Helper()
-
-	if !returnsInTime(func() { h.Stop(t.Context()) }) {
-		t.Errorf("Stop did not return within %s", stepTimeout)
-	}
-}
-
 // startBlockedWrite hands h the messages in fill and waits until h starts to
 // write them to store. The prefix, AS and peer handlers start when fill fills
 // their batch, and the peering handler on its timer. store holds the write
@@ -257,7 +240,7 @@ func startBlockedWrite(

 	select {
 	case <-store.writeStarted:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the handler did not start to write the messages")
 	}
 }
@@ -278,7 +261,7 @@ func handleWhileAWriteIsBlocked(
 ) {
 	t.Helper()

-	defer stopInTime(t, h)
+	defer h.Stop(t.Context())
 	defer store.releaseWrites()

 	startBlockedWrite(t, store, h, fill)
@@ -292,9 +275,7 @@ func handleWhileAWriteIsBlocked(
 // while store holds the write, hands h the messages in toMax, which bring its
 // next batch to its maximum size, and the message extra. HandleMessage for
 // extra must wait until the test lets the write finish, and return after. Then
-// it stops h, which writes what it holds. The tests lower h's maximum batch
-// size to one batch, so toMax is one batch: the real maximum of ten batches is
-// slow to reach under the race detector.
+// it stops h, which writes what it holds.
 func handleAtMaxBatchSize(
 	t *testing.T,
 	store *blockingStore,
@@ -307,18 +288,13 @@ func handleAtMaxBatchSize(
 ) {
 	t.Helper()

-	defer stopInTime(t, h)
+	defer h.Stop(t.Context())
 	defer store.releaseWrites()

 	startBlockedWrite(t, store, h, fill)

-	if !returnsInTime(func() {
-		for _, msg := range toMax {
-			h.HandleMessage(msg)
-		}
-	}) {
-		t.Fatal("HandleMessage did not return while the batch grew to its " +
-			"maximum size")
+	for _, msg := range toMax {
+		h.HandleMessage(msg)
 	}

 	returned := make(chan struct{})
@@ -339,7 +315,7 @@ func handleAtMaxBatchSize(

 	select {
 	case <-returned:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("HandleMessage did not return after the database write finished")
 	}
 }
@@ -369,12 +345,8 @@ func stopWhileAWriteIsBlocked(

 	startBlockedWrite(t, store, h, fill)

-	if !returnsInTime(func() {
-		for _, msg := range extra {
-			h.HandleMessage(msg)
-		}
-	}) {
-		t.Fatal("HandleMessage did not return while a database write was blocked")
+	for _, msg := range extra {
+		h.HandleMessage(msg)
 	}

 	ctx, cancel := context.WithTimeout(t.Context(), stopDeadline)
@@ -389,7 +361,7 @@ func stopWhileAWriteIsBlocked(

 	select {
 	case <-done:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the flush goroutine did not return after the write finished")
 	}
 }
@@ -408,8 +380,7 @@ func TestPrefixHandlerSkipsItsLastWriteAfterTheStopDeadline(t *testing.T) {

 	store := newBlockingStore()
 	h := newPrefixHandler(store, newErrorLogger(&logs),
-		routetable.New(routetable.Params{}), longerThanAnyTest,
-		maxTableChangesPerWrite)
+		routetable.New(routetable.Params{}), longerThanAnyTest)
 	fill := slices.Repeat([]string{testV4Prefix}, prefixBatchSize)
 	stopWhileAWriteIsBlocked(t, store, h, h.done,
 		[]*ristypes.RISMessage{prefixAnnouncement(fill)},
@@ -626,7 +597,7 @@ func TestPeeringHandlerStopCountsTheWriteInProgress(t *testing.T) {

 	select {
 	case <-h.done:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the processing goroutine did not return after the write " +
 			"finished")
 	}
@@ -647,7 +618,7 @@ func TestPeeringHandlerStartsNoWriteAfterTheStopDeadline(t *testing.T) {
 	const processInterval = 10 * time.Millisecond

 	store := newBlockingStore()
-	h := newPeeringHandler(store, logger.New(), processInterval, maxTrackedPaths)
+	h := newPeeringHandler(store, logger.New(), processInterval)
 	stopWhileAWriteIsBlocked(t, store, h, h.done,
 		[]*ristypes.RISMessage{
 			{Path: ristypes.ASPath{Sequence: []int{testASNA, testASNB}}},
@@ -743,11 +714,9 @@ func TestPrefixHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
 	const extraPrefix = "198.51.100.0/24"

 	store := newBlockingStore()
-	h := newPrefixHandler(store, logger.New(), routetable.New(routetable.Params{}),
-		longerThanAnyTest, maxTableChangesPerWrite)
-	h.batchMaxSize = prefixBatchSize
+	h := NewPrefixHandler(store, logger.New(), routetable.New(routetable.Params{}))
 	fill := slices.Repeat([]string{testV4Prefix}, prefixBatchSize)
-	toMax := slices.Repeat([]string{testV4Prefix}, prefixBatchSize)
+	toMax := slices.Repeat([]string{testV4Prefix}, prefixBatchMaxSize)
 	handleAtMaxBatchSize(t, store, h,
 		[]*ristypes.RISMessage{prefixAnnouncement(fill)},
 		[]*ristypes.RISMessage{prefixAnnouncement(toMax)},
@@ -767,9 +736,8 @@ func TestASHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {

 	store := newBlockingStore()
 	h := newASHandler(store, logger.New(), longerThanAnyTest)
-	h.batchMaxSize = asnBatchSize
 	fill := ristypes.ASPath{Sequence: slices.Repeat([]int{testASNA}, asnBatchSize)}
-	toMax := ristypes.ASPath{Sequence: slices.Repeat([]int{testASNA}, asnBatchSize)}
+	toMax := ristypes.ASPath{Sequence: slices.Repeat([]int{testASNA}, asnBatchMaxSize)}
 	handleAtMaxBatchSize(t, store, h,
 		[]*ristypes.RISMessage{{Path: fill}},
 		[]*ristypes.RISMessage{{Path: toMax}},
@@ -787,7 +755,7 @@ func TestASHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
 // TestPeerHandlerWaitsAtTheMaximumBatchSize must not have its flush timer fire.
 // A timer flush during the fill would take only part of it. The batch would
 // then reach its maximum size before the test's last message, and the test
-// would fail.
+// would hang.
 func TestPeerHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {
 	t.Parallel()

@@ -795,11 +763,10 @@ func TestPeerHandlerWaitsAtTheMaximumBatchSize(t *testing.T) {

 	store := newBlockingStore()
 	h := newPeerHandler(store, logger.New(), longerThanAnyTest)
-	h.batchMaxSize = peerBatchSize
 	message := []*ristypes.RISMessage{{Peer: testPeerIP}}
 	handleAtMaxBatchSize(t, store, h,
 		slices.Repeat(message, peerBatchSize),
-		slices.Repeat(message, peerBatchSize),
+		slices.Repeat(message, peerBatchMaxSize),
 		&ristypes.RISMessage{Peer: otherPeerIP})

 	store.mu.Lock()
@@ -829,9 +796,8 @@ func TestHandlersWakeTheFlushGoroutineWhenTheBatchIsFull(t *testing.T) {
 			batchSize: prefixBatchSize,
 			handle: func(n int) chan struct{} {
 				h := &PrefixHandler{
-					batchMaxSize: prefixBatchMaxSize,
-					batchFullCh:  make(chan struct{}, 1),
-					table:        routetable.New(routetable.Params{}),
+					batchFullCh: make(chan struct{}, 1),
+					table:       routetable.New(routetable.Params{}),
 				}
 				h.HandleMessage(prefixAnnouncement(
 					slices.Repeat([]string{testV4Prefix}, n)))
@@ -843,10 +809,7 @@ func TestHandlersWakeTheFlushGoroutineWhenTheBatchIsFull(t *testing.T) {
 			name:      "AS",
 			batchSize: asnBatchSize,
 			handle: func(n int) chan struct{} {
-				h := &ASHandler{
-					batchMaxSize: asnBatchMaxSize,
-					batchFullCh:  make(chan struct{}, 1),
-				}
+				h := &ASHandler{batchFullCh: make(chan struct{}, 1)}
 				// The origin AS and each AS in the path are one update each.
 				h.HandleMessage(&ristypes.RISMessage{
 					Path: ristypes.ASPath{Sequence: slices.Repeat([]int{testASNA}, n-1)},
@@ -859,10 +822,7 @@ func TestHandlersWakeTheFlushGoroutineWhenTheBatchIsFull(t *testing.T) {
 			name:      "peer",
 			batchSize: peerBatchSize,
 			handle: func(n int) chan struct{} {
-				h := &PeerHandler{
-					batchMaxSize: peerBatchMaxSize,
-					batchFullCh:  make(chan struct{}, 1),
-				}
+				h := &PeerHandler{batchFullCh: make(chan struct{}, 1)}
 				for range n {
 					h.HandleMessage(&ristypes.RISMessage{Peer: testPeerIP})
 				}
@@ -97,7 +97,7 @@ func TestDBMaintainerStopReturnsByItsDeadline(t *testing.T) {

 	select {
 	case <-store.started:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the maintainer did not start the checkpoint")
 	}

@@ -113,7 +113,7 @@ func TestDBMaintainerStopReturnsByItsDeadline(t *testing.T) {

 	select {
 	case <-m.done:
-	case <-time.After(stepTimeout):
+	case <-time.After(handleMessageTimeout):
 		t.Fatal("the maintenance goroutine did not return after the " +
 			"checkpoint ended")
 	}
@@ -43,14 +43,10 @@ type PeerHandler struct {
 	db     database.Store
 	logger *logger.Logger

-	// batchMaxSize is peerBatchMaxSize. Only HandleMessage reads it, so a test
-	// may lower it before it hands the handler a message.
-	batchMaxSize int
-
 	// Batching. mu guards peerBatch and writing only: the flush goroutine
 	// takes the batch under mu and writes it after releasing mu, so
 	// HandleMessage waits for a database write only while peerBatch is at
-	// batchMaxSize.
+	// peerBatchMaxSize.
 	mu        sync.Mutex
 	peerBatch []peerUpdate
 	// writing is how many updates the flush goroutine took from peerBatch
@@ -88,13 +84,12 @@ func newPeerHandler(
 	db database.Store, logger *logger.Logger, batchTimeout time.Duration,
 ) *PeerHandler {
 	h := &PeerHandler{
-		db:           db,
-		logger:       logger,
-		batchMaxSize: peerBatchMaxSize,
-		peerBatch:    make([]peerUpdate, 0, peerBatchSize),
-		batchFullCh:  make(chan struct{}, 1),
-		stopCh:       make(chan context.Context, 1),
-		done:         make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		peerBatch:   make([]peerUpdate, 0, peerBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		stopCh:      make(chan context.Context, 1),
+		done:        make(chan struct{}),
 	}
 	h.batchTaken.L = &h.mu

@@ -140,7 +135,7 @@ func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// While the batch is at its maximum size, wait until the flush goroutine
 	// takes it. Meanwhile the handler takes nothing off its queue, which
 	// fills, and the streamer drops messages for it.
-	for len(h.peerBatch) >= h.batchMaxSize {
+	for len(h.peerBatch) >= peerBatchMaxSize {
 		h.batchTaken.Wait()
 	}

@@ -154,7 +149,7 @@ func (h *PeerHandler) HandleMessage(msg *ristypes.RISMessage) {

 	// A full batch wakes the flush goroutine. If it is writing, the wake-up
 	// waits in batchFullCh and the batch keeps growing until the write ends
-	// or the batch reaches batchMaxSize.
+	// or the batch reaches peerBatchMaxSize.
 	if len(h.peerBatch) >= peerBatchSize {
 		select {
 		case h.batchFullCh <- struct{}{}:
@@ -35,7 +35,7 @@ func TestPeerHandlerWritesTheEarliestAndLatestTimesOfANewPeer(t *testing.T) {

 	// Built without NewPeerHandler's flush goroutine, so the test flushes
 	// itself.
-	h := &PeerHandler{db: store, logger: logger.New(), batchMaxSize: peerBatchMaxSize}
+	h := &PeerHandler{db: store, logger: logger.New()}

 	first := peerAnnouncement(testPeerIP, testV4Prefix)
 	second := peerAnnouncement(testPeerIP, testV4Prefix)
@@ -42,10 +42,6 @@ type PeeringHandler struct {
 	db     database.Store
 	logger *logger.Logger

-	// maxPaths is the most paths asPaths holds: maxTrackedPaths, except in
-	// tests that give a smaller one.
-	maxPaths int
-
 	// In-memory AS path tracking: each path, JSON-encoded, with the earliest
 	// and the latest time an update carried it.
 	mu           sync.Mutex
@@ -66,24 +62,21 @@ type PeeringHandler struct {
 // periodically processes accumulated AS paths into peering records. The
 // handler begins processing immediately upon creation.
 func NewPeeringHandler(db database.Store, logger *logger.Logger) *PeeringHandler {
-	return newPeeringHandler(db, logger, peeringProcessInterval, maxTrackedPaths)
+	return newPeeringHandler(db, logger, peeringProcessInterval)
 }

 // newPeeringHandler is NewPeeringHandler with the processing timer's interval,
-// processInterval, in place of peeringProcessInterval, and the most paths it
-// holds, maxPaths, in place of maxTrackedPaths. A test gives a short interval to
-// have the timer start a write, and a small maxPaths to fill the map quickly.
+// processInterval, in place of peeringProcessInterval. A test gives a short
+// one to have the timer start a write.
 func newPeeringHandler(
 	db database.Store, logger *logger.Logger, processInterval time.Duration,
-	maxPaths int,
 ) *PeeringHandler {
 	h := &PeeringHandler{
-		db:       db,
-		logger:   logger,
-		asPaths:  make(map[string]database.SeenTimes),
-		maxPaths: maxPaths,
-		stopCh:   make(chan context.Context, 1),
-		done:     make(chan struct{}),
+		db:      db,
+		logger:  logger,
+		asPaths: make(map[string]database.SeenTimes),
+		stopCh:  make(chan context.Context, 1),
+		done:    make(chan struct{}),
 	}

 	// Start the periodic processing goroutine
@@ -138,7 +131,7 @@ func (h *PeeringHandler) HandleMessage(msg *ristypes.RISMessage) {
 	defer h.mu.Unlock()

 	seen, exists := h.asPaths[key]
-	if !exists && len(h.asPaths) >= h.maxPaths {
+	if !exists && len(h.asPaths) >= maxTrackedPaths {
 		// Map is full; drop this new path and count it.
 		h.droppedPaths++

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"maps"
 	"slices"
+	"strconv"
 	"sync"
 	"testing"
 	"time"
@@ -19,10 +20,6 @@ const (
 	testASNB = 64501
 	testASNC = 64502
 	testASND = 64503
-
-	// testMaxTrackedPaths is a limit of the path map that a test fills
-	// quickly, in place of maxTrackedPaths.
-	testMaxTrackedPaths = 10
 )

 // recordingStore wraps mockStore to count every RecordPeering call, so a
@@ -55,10 +52,9 @@ func (r *recordingStore) callCount() int {
 // processing goroutine, so tests drive processing explicitly.
 func newTestHandler(db database.Store) *PeeringHandler {
 	return &PeeringHandler{
-		db:       db,
-		logger:   logger.New(),
-		asPaths:  make(map[string]database.SeenTimes),
-		maxPaths: maxTrackedPaths,
+		db:      db,
+		logger:  logger.New(),
+		asPaths: make(map[string]database.SeenTimes),
 	}
 }

@@ -248,28 +244,25 @@ func TestPeeringHandlerStopWritesTheRemainingPaths(t *testing.T) {

 // TestPeeringHandlerCapDropsAndCounts verifies that a full map drops new paths
 // and counts them, while a path already tracked is refreshed rather than
-// dropped. The handler's limit is small, and its timer does not fire.
+// dropped.
 func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	t.Parallel()

 	store := &recordingStore{mockStore: newMockStore()}
-	h := newPeeringHandler(store, logger.New(), longerThanAnyTest,
-		testMaxTrackedPaths)
-
-	defer stopInTime(t, h)
+	h := newTestHandler(store)

 	now := time.Now().UTC()

-	// Fill the map to exactly its limit, including one real path key so the
-	// "already tracked" branch can be exercised. The other paths are of one
-	// AS, so they carry no peering.
+	// Fill the map to exactly maxTrackedPaths, including one real path key so
+	// the "already tracked" branch can be exercised. The filler keys are never
+	// processed in this test, so their contents do not matter.
 	existing := pathKey(t, testASNA, testASNB)

 	h.mu.Lock()
 	h.asPaths[existing] = database.SeenTimes{First: now, Last: now}

-	for asn := 1; len(h.asPaths) < testMaxTrackedPaths; asn++ {
-		h.asPaths[pathKey(t, asn)] = database.SeenTimes{First: now, Last: now}
+	for i := 0; len(h.asPaths) < maxTrackedPaths; i++ {
+		h.asPaths[strconv.Itoa(i)] = database.SeenTimes{First: now, Last: now}
 	}
 	h.mu.Unlock()

@@ -277,9 +270,8 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	handle(h, now.Add(time.Second), testASNA, testASNC)

 	tracked, dropped := snapshot(h)
-	if tracked != testMaxTrackedPaths {
-		t.Fatalf("want map size %d after drop, got %d", testMaxTrackedPaths,
-			tracked)
+	if tracked != maxTrackedPaths {
+		t.Fatalf("want map size %d after drop, got %d", maxTrackedPaths, tracked)
 	}

 	if dropped != 1 {
@@ -291,9 +283,8 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {
 	handle(h, refreshed, testASNA, testASNB)

 	tracked, dropped = snapshot(h)
-	if tracked != testMaxTrackedPaths {
-		t.Fatalf("want map size %d after refresh, got %d", testMaxTrackedPaths,
-			tracked)
+	if tracked != maxTrackedPaths {
+		t.Fatalf("want map size %d after refresh, got %d", maxTrackedPaths, tracked)
 	}

 	if dropped != 1 {
@@ -312,21 +303,17 @@ func TestPeeringHandlerCapDropsAndCounts(t *testing.T) {

 // TestPeeringHandlerRunResetsTheDroppedCount fills the map, has the handler
 // drop one path, and runs the processing. The count of dropped paths is the
-// run's own, so it is 0 again after the run. The handler's limit is small, and
-// its timer does not fire.
+// run's own, so it is 0 again after the run.
 func TestPeeringHandlerRunResetsTheDroppedCount(t *testing.T) {
 	t.Parallel()

-	h := newPeeringHandler(newMockStore(), logger.New(), longerThanAnyTest,
-		testMaxTrackedPaths)
-
-	defer stopInTime(t, h)
+	h := newTestHandler(newMockStore())

 	now := time.Now().UTC()

 	// Paths of one AS carry no peering, so the run records nothing.
 	h.mu.Lock()
-	for asn := 1; len(h.asPaths) < testMaxTrackedPaths; asn++ {
+	for asn := 1; len(h.asPaths) < maxTrackedPaths; asn++ {
 		h.asPaths[pathKey(t, asn)] = database.SeenTimes{First: now, Last: now}
 	}
 	h.mu.Unlock()
@@ -60,17 +60,10 @@ type PrefixHandler struct {
 	metrics *metrics.Tracker
 	table   *routetable.Table

-	// batchMaxSize is prefixBatchMaxSize. Only HandleMessage reads it, so a
-	// test may lower it before it hands the handler a message.
-	batchMaxSize int
-	// tableChangesPerWrite is maxTableChangesPerWrite, except in tests that
-	// give a smaller one.
-	tableChangesPerWrite int
-
 	// Batching. mu guards batch, writing and writingTableChanges only: the
 	// flush goroutine takes them under mu and writes them after releasing
 	// mu, so HandleMessage waits for a database write only while batch is at
-	// batchMaxSize.
+	// prefixBatchMaxSize.
 	mu    sync.Mutex
 	batch []seenPrefix
 	// writing is how many updates the flush goroutine took and has not
@@ -126,30 +119,24 @@ func (u prefixUpdate) announcesRoute() bool {
 func NewPrefixHandler(
 	db database.Store, logger *logger.Logger, table *routetable.Table,
 ) *PrefixHandler {
-	return newPrefixHandler(db, logger, table, prefixBatchTimeout,
-		maxTableChangesPerWrite)
+	return newPrefixHandler(db, logger, table, prefixBatchTimeout)
 }

 // newPrefixHandler is NewPrefixHandler with the flush timer's interval,
-// batchTimeout, in place of prefixBatchTimeout, and tableChangesPerWrite in
-// place of maxTableChangesPerWrite. A test that the timer must not disturb
-// gives an interval longer than the test runs. A test of writes split over
-// several flushes gives a small tableChangesPerWrite, so that it exceeds it
-// with few changes.
+// batchTimeout, in place of prefixBatchTimeout. A test that the timer must not
+// disturb gives an interval longer than the test runs.
 func newPrefixHandler(
 	db database.Store, logger *logger.Logger, table *routetable.Table,
-	batchTimeout time.Duration, tableChangesPerWrite int,
+	batchTimeout time.Duration,
 ) *PrefixHandler {
 	h := &PrefixHandler{
-		db:                   db,
-		logger:               logger,
-		table:                table,
-		batch:                make([]seenPrefix, 0, prefixBatchSize),
-		batchMaxSize:         prefixBatchMaxSize,
-		tableChangesPerWrite: tableChangesPerWrite,
-		batchFullCh:          make(chan struct{}, 1),
-		stopCh:               make(chan context.Context, 1),
-		done:                 make(chan struct{}),
+		db:          db,
+		logger:      logger,
+		table:       table,
+		batch:       make([]seenPrefix, 0, prefixBatchSize),
+		batchFullCh: make(chan struct{}, 1),
+		stopCh:      make(chan context.Context, 1),
+		done:        make(chan struct{}),
 	}
 	h.batchTaken.L = &h.mu

@@ -204,7 +191,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 	// While the batch is at its maximum size, wait until the flush goroutine
 	// takes it. Meanwhile the handler takes nothing off its queue, which
 	// fills, and the streamer drops messages for it.
-	for len(h.batch) >= h.batchMaxSize {
+	for len(h.batch) >= prefixBatchMaxSize {
 		h.batchTaken.Wait()
 	}

@@ -252,7 +239,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {

 	// A full batch wakes the flush goroutine. If it is writing, the wake-up
 	// waits in batchFullCh and the batch keeps growing until the write ends
-	// or the batch reaches batchMaxSize.
+	// or the batch reaches prefixBatchMaxSize.
 	if len(h.batch) >= prefixBatchSize {
 		select {
 		case h.batchFullCh <- struct{}{}:
@@ -263,7 +250,7 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {

 // Stop stops the flush goroutine, which makes one last flush before it returns,
 // and waits for it until ctx ends. That flush writes at most
-// tableChangesPerWrite of the routing table's changes, and the prefixes of
+// maxTableChangesPerWrite of the routing table's changes, and the prefixes of
 // the updates the handler holds. Once ctx has ended the flush goroutine skips
 // that last flush, and a write still running is lost when the process exits. A
 // failed write of the table's changes is not retried either. Stop logs how many
@@ -391,13 +378,14 @@ func (h *PrefixHandler) applyToTable(update prefixUpdate) {
 	})
 }

-// writeTableChanges writes at most tableChangesPerWrite changes of the routing
-// table in memory, and every peer the table numbered since the last write.
+// writeTableChanges writes at most maxTableChangesPerWrite changes of the
+// routing table in memory, and every peer the table numbered since the last
+// write.
 // When the write fails, they go back to the table, so that a later write writes
 // them again, each pair with its content then.
 func (h *PrefixHandler) writeTableChanges() {
 	h.mu.Lock()
-	changes, newPeers := h.table.TakeChanges(h.tableChangesPerWrite)
+	changes, newPeers := h.table.TakeChanges(maxTableChangesPerWrite)
 	h.writingTableChanges = len(changes)
 	h.mu.Unlock()

@@ -237,10 +237,9 @@ func TestPrefixHandlerStopLogsNothingWhenItWroteEverything(t *testing.T) {
 	}
 }

-// longerThanAnyTest is a timer interval that no test lasts. A test gives it to
-// newPrefixHandler, newASHandler, newPeerHandler or newPeeringHandler when the
-// handler must write only when its batch is full, when the test says, or on
-// Stop.
+// longerThanAnyTest is a flush timer interval that no test lasts. A test whose
+// prefix, AS or peer handler must flush only when its batch is full and on Stop
+// gives it to newPrefixHandler, newASHandler or newPeerHandler.
 const longerThanAnyTest = time.Hour

 // prefixHandlerWithoutTimer returns a prefix handler that writes to store and
@@ -248,11 +247,9 @@ const longerThanAnyTest = time.Hour
 // NewPrefixHandler's flush goroutine, so the test flushes itself.
 func prefixHandlerWithoutTimer(store database.Store) *PrefixHandler {
 	return &PrefixHandler{
-		db:                   store,
-		logger:               logger.New(),
-		table:                routetable.New(routetable.Params{}),
-		batchMaxSize:         prefixBatchMaxSize,
-		tableChangesPerWrite: maxTableChangesPerWrite,
+		db:     store,
+		logger: logger.New(),
+		table:  routetable.New(routetable.Params{}),
 	}
 }

@@ -30,13 +30,12 @@ const (

 	// firstManyPrefix is the first prefix announceManyPrefixes announces.
 	firstManyPrefix = "10.0.0.0/32"
-
-	// testMaxTableChangesPerWrite is a limit of one write of the routing
-	// table's changes that a test exceeds quickly, in place of
-	// maxTableChangesPerWrite.
-	testMaxTableChangesPerWrite = 10
 )

+// tableWriteTimeout is how long a test waits for the flush timer to write the
+// routing table's changes: a few ticks of it.
+const tableWriteTimeout = 5 * prefixBatchTimeout
+
 // tableCase is one test of the routing table in memory: the messages handed to
 // the prefix handler, and for each prefix the peers that carry it with each
 // origin AS after them.
@@ -277,9 +276,9 @@ func TestPrefixHandlerWritesTheTableChangesEachSecond(t *testing.T) {
 				t.Fatalf("wrote %+v, want the pair of %s and AS%d with "+
 					"removed %t", changes, prefix, testASNB, step.wantRemoved)
 			}
-		case <-time.After(stepTimeout):
+		case <-time.After(tableWriteTimeout):
 			t.Fatalf("the routing table's change was not written within %s",
-				stepTimeout)
+				tableWriteTimeout)
 		}
 	}
 }
@@ -376,32 +375,25 @@ func (s *tableWriteSizesStore) WriteRouteChanges(
 // takes, then flushes three times. The first write must hold as many pairs as
 // one write takes, and the peer. The second must hold the other pairs, and the
 // third flush must write nothing. The database must then hold the table in
-// memory. The handler's limit is small, and its timer does not fire.
+// memory.
 func TestPrefixHandlerWritesManyTableChangesOverSeveralFlushes(t *testing.T) {
 	t.Parallel()

 	const (
-		pairs   = testMaxTableChangesPerWrite * 3 / 2
+		pairs   = maxTableChangesPerWrite * 3 / 2
 		flushes = 3
 	)

 	db := newTestDatabase(t)
 	store := &tableWriteSizesStore{Database: db}
-	table := routetable.New(routetable.Params{})
-	announceManyPrefixes(table, pairs)
-
-	h := newPrefixHandler(store, logger.New(), table, longerThanAnyTest,
-		testMaxTableChangesPerWrite)
-
-	defer stopInTime(t, h)
+	h := prefixHandlerWithoutTimer(store)
+	announceManyPrefixes(h.table, pairs)

 	for range flushes {
 		h.flushBatch()
 	}

-	wantChanges := []int{
-		testMaxTableChangesPerWrite, pairs - testMaxTableChangesPerWrite,
-	}
+	wantChanges := []int{maxTableChangesPerWrite, pairs - maxTableChangesPerWrite}
 	wantNewPeers := []int{1, 0}

 	if !slices.Equal(store.changes, wantChanges) ||
@@ -423,11 +415,11 @@ func TestPrefixHandlerWritesManyTableChangesOverSeveralFlushes(t *testing.T) {
 // takes. Its last flush writes one write's worth, so Stop must log the pairs
 // that no write took, and must not say that the stop deadline passed. The
 // flush timer must not fire, or its writes could leave no pairs for Stop to
-// log. The handler's limit of one write is small.
+// log.
 func TestPrefixHandlerStopLogsTheTableChangesLeftUnwritten(t *testing.T) {
 	t.Parallel()

-	const pairs = testMaxTableChangesPerWrite + 1
+	const pairs = maxTableChangesPerWrite + 1

 	var logs bytes.Buffer

@@ -435,8 +427,7 @@ func TestPrefixHandlerStopLogsTheTableChangesLeftUnwritten(t *testing.T) {
 	table := routetable.New(routetable.Params{})
 	announceManyPrefixes(table, pairs)

-	h := newPrefixHandler(store, newErrorLogger(&logs), table, longerThanAnyTest,
-		testMaxTableChangesPerWrite)
+	h := newPrefixHandler(store, newErrorLogger(&logs), table, longerThanAnyTest)
 	h.Stop(t.Context())

 	written := 0
@@ -23,6 +23,7 @@ import (
 	"git.eeqj.de/sneak/routewatch/internal/streamer"
 	"git.eeqj.de/sneak/routewatch/internal/templates"
 	asinfo "git.eeqj.de/sneak/routewatch/pkg/asinfo"
+	"github.com/dustin/go-humanize"
 	"github.com/go-chi/chi/v5"
 )

@@ -225,23 +226,18 @@ type WHOISStatsInfo struct {
 	NeverFetched      int     `json:"never_fetched"`
 	SuccessesLastHour int     `json:"successes_last_hour"`
 	ErrorsLastHour    int     `json:"errors_last_hour"`
+	CurrentInterval   string  `json:"current_interval"`
 	ConsecutiveFails  int     `json:"consecutive_fails"`
 	FreshPercent      float64 `json:"fresh_percent"`
-
-	// CurrentIntervalSeconds is the wait between two fetches. It can have a
-	// fractional part, such as 22.5.
-	CurrentIntervalSeconds float64 `json:"current_interval_seconds"`
 }

 // Stats is the /status.json answer: uptime, message counts, database stats,
-// and the routing table's figures. UptimeSeconds is the time since the stream
-// last connected, or 0 if it has never connected. MemoryUsageBytes is the Go
-// heap in use. OldestRoute and NewestRoute are the times of the oldest and the
-// newest kept routes.
+// and the routing table's figures. OldestRoute and NewestRoute are the times
+// of the oldest and the newest kept routes.
 //
 //nolint:tagliatelle // field names are the existing JSON API
 type Stats struct {
-	UptimeSeconds          int64                `json:"uptime_seconds"`
+	Uptime                 string               `json:"uptime"`
 	TotalMessages          uint64               `json:"total_messages"`
 	TotalBytes             uint64               `json:"total_bytes"`
 	TotalWireBytes         uint64               `json:"total_wire_bytes"`
@@ -251,7 +247,7 @@ type Stats struct {
 	Connected              bool                 `json:"connected"`
 	GoVersion              string               `json:"go_version"`
 	Goroutines             int                  `json:"goroutines"`
-	MemoryUsageBytes       uint64               `json:"memory_usage_bytes"`
+	MemoryUsage            string               `json:"memory_usage"`
 	ASNs                   int                  `json:"asns"`
 	Prefixes               int                  `json:"prefixes"`
 	IPv4Prefixes           int                  `json:"ipv4_prefixes"`
@@ -366,7 +362,7 @@ func (s *Server) statusStats(
 	runtime.ReadMemStats(&memStats)

 	return Stats{
-		UptimeSeconds:          uptimeSeconds(streamMetrics.ConnectedSince),
+		Uptime:                 streamUptime(streamMetrics.ConnectedSince),
 		TotalMessages:          streamMetrics.TotalMessages,
 		TotalBytes:             streamMetrics.TotalBytes,
 		TotalWireBytes:         streamMetrics.TotalWireBytes,
@@ -376,7 +372,7 @@ func (s *Server) statusStats(
 		Connected:              streamMetrics.Connected,
 		GoVersion:              runtime.Version(),
 		Goroutines:             runtime.NumGoroutine(),
-		MemoryUsageBytes:       memStats.Alloc,
+		MemoryUsage:            humanize.Bytes(memStats.Alloc),
 		ASNs:                   dbStats.ASNs,
 		Prefixes:               counts.IPv4Prefixes + counts.IPv6Prefixes,
 		IPv4Prefixes:           counts.IPv4Prefixes,
@@ -443,31 +439,30 @@ func (s *Server) getWHOISStats(ctx context.Context) *WHOISStatsInfo {
 		NeverFetched:      dbStats.NeverFetched,
 		SuccessesLastHour: fetcherStats.SuccessesLastHour,
 		ErrorsLastHour:    fetcherStats.ErrorsLastHour,
+		CurrentInterval:   fetcherStats.CurrentInterval.String(),
 		ConsecutiveFails:  fetcherStats.ConsecutiveFails,
 		FreshPercent:      freshPercent,
-
-		CurrentIntervalSeconds: fetcherStats.CurrentInterval.Seconds(),
 	}
 }

-// uptimeSeconds is the number of whole seconds since the stream last
-// connected, or 0 if it has never connected.
-func uptimeSeconds(connectedSince time.Time) int64 {
+// streamUptime is how long the stream has been connected, to the second, or
+// "0s" if it has never connected.
+func streamUptime(connectedSince time.Time) string {
 	if connectedSince.IsZero() {
-		return 0
+		return "0s"
 	}

-	return int64(time.Since(connectedSince) / time.Second)
+	return time.Since(connectedSince).Truncate(time.Second).String()
 }

-// connectionDurationSeconds is the number of whole seconds the stream has
-// been connected, or nil while it is not connected.
-func connectionDurationSeconds(connected bool, connectedSince time.Time) *int64 {
+// connectionDuration is how long the stream has been connected, to the
+// second, or "disconnected".
+func connectionDuration(connected bool, connectedSince time.Time) string {
 	if !connected || connectedSince.IsZero() {
-		return nil
+		return "disconnected"
 	}

-	return new(uptimeSeconds(connectedSince))
+	return time.Since(connectedSince).Truncate(time.Second).String()
 }

 // whoisStaleThreshold matches the fetcher's threshold for consistency.
@@ -517,7 +512,7 @@ type StreamStats struct {
 //
 //nolint:tagliatelle // field names are the existing JSON API
 type StatsResponse struct {
-	UptimeSeconds          int64                `json:"uptime_seconds"`
+	Uptime                 string               `json:"uptime"`
 	TotalMessages          uint64               `json:"total_messages"`
 	TotalBytes             uint64               `json:"total_bytes"`
 	TotalWireBytes         uint64               `json:"total_wire_bytes"`
@@ -525,10 +520,11 @@ type StatsResponse struct {
 	MbitsPerSec            float64              `json:"mbits_per_sec"`
 	WireMbitsPerSec        float64              `json:"wire_mbits_per_sec"`
 	Connected              bool                 `json:"connected"`
+	ConnectionDuration     string               `json:"connection_duration"`
 	ReconnectCount         uint64               `json:"reconnect_count"`
 	GoVersion              string               `json:"go_version"`
 	Goroutines             int                  `json:"goroutines"`
-	MemoryUsageBytes       uint64               `json:"memory_usage_bytes"`
+	MemoryUsage            string               `json:"memory_usage"`
 	GC                     GCStats              `json:"gc"`
 	Stream                 StreamStats          `json:"stream"`
 	ASNs                   int                  `json:"asns"`
@@ -550,9 +546,6 @@ type StatsResponse struct {
 	IPv6PrefixDistribution []PrefixDistribution `json:"ipv6_prefix_distribution"`
 	WHOISStats             *WHOISStatsInfo      `json:"whois_stats,omitempty"`

-	// ConnectionDurationSeconds is null while the stream is not connected.
-	ConnectionDurationSeconds *int64 `json:"connection_duration_seconds"`
-
 	OriginsWithoutKeptRoute int `json:"origins_without_kept_route"`
 }

@@ -691,18 +684,20 @@ func (s *Server) statsResponse(
 	runtime.ReadMemStats(&memStats)

 	return StatsResponse{
-		UptimeSeconds:          uptimeSeconds(streamMetrics.ConnectedSince),
-		TotalMessages:          streamMetrics.TotalMessages,
-		TotalBytes:             streamMetrics.TotalBytes,
-		TotalWireBytes:         streamMetrics.TotalWireBytes,
-		MessagesPerSec:         streamMetrics.MessagesPerSec,
-		MbitsPerSec:            streamMetrics.BitsPerSec / bitsPerMegabit,
-		WireMbitsPerSec:        streamMetrics.WireBitsPerSec / bitsPerMegabit,
-		Connected:              streamMetrics.Connected,
+		Uptime:          streamUptime(streamMetrics.ConnectedSince),
+		TotalMessages:   streamMetrics.TotalMessages,
+		TotalBytes:      streamMetrics.TotalBytes,
+		TotalWireBytes:  streamMetrics.TotalWireBytes,
+		MessagesPerSec:  streamMetrics.MessagesPerSec,
+		MbitsPerSec:     streamMetrics.BitsPerSec / bitsPerMegabit,
+		WireMbitsPerSec: streamMetrics.WireBitsPerSec / bitsPerMegabit,
+		Connected:       streamMetrics.Connected,
+		ConnectionDuration: connectionDuration(
+			streamMetrics.Connected, streamMetrics.ConnectedSince),
 		ReconnectCount:         streamMetrics.ReconnectCount,
 		GoVersion:              runtime.Version(),
 		Goroutines:             runtime.NumGoroutine(),
-		MemoryUsageBytes:       memStats.Alloc,
+		MemoryUsage:            humanize.Bytes(memStats.Alloc),
 		GC:                     gcStats(&memStats),
 		Stream:                 s.streamStats(),
 		ASNs:                   dbStats.ASNs,
@@ -724,9 +719,6 @@ func (s *Server) statsResponse(
 		IPv6PrefixDistribution: prefixDistribution(counts.IPv6PrefixesByLength),
 		WHOISStats:             whoisStats,

-		ConnectionDurationSeconds: connectionDurationSeconds(
-			streamMetrics.Connected, streamMetrics.ConnectedSince),
-
 		OriginsWithoutKeptRoute: counts.OriginsWithoutKeptRoute,
 	}
 }
@@ -760,14 +752,15 @@ type IPLookupResponse struct {
 }

 // IPLookupResult is the answer for one address: its PTR names, its live route
-// and that route's AS, and the blocklists that list it. Every result has every
-// field. The fields of IPInfo are null when the address has no live route.
+// and that route's AS, and the blocklists that list it. IPInfo is nil when
+// the address has no live route, and the answer then has no route or AS
+// fields. IP hides the IPInfo field of the same name, so that an address with
+// no route has it too.
 type IPLookupResult struct {
-	IPInfo
+	*IPInfo

-	IP string `json:"ip"`
-	// PTR is empty, never nil, when the address has no PTR names.
-	PTR []string `json:"ptr"`
+	IP  string   `json:"ip"`
+	PTR []string `json:"ptr,omitempty"`

 	// Blocklists has one entry for each blocklist the address is on.
 	Blocklists []blocklist.Listing `json:"blocklists"`
@@ -825,8 +818,8 @@ func (s *Server) handleIPInfo() http.HandlerFunc {

 			switch {
 			case errors.Is(err, ErrNoRoute):
-				// The address still gets a result, with every field of
-				// ipInfo null.
+				// The address still gets a result, without route fields.
+				ipInfo = nil
 			case errors.Is(err, ErrInvalidIP):
 				response.Errors = append(response.Errors, ip+": "+err.Error())

@@ -853,8 +846,8 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 				Blocklists: s.blocklistListings(ip),
 			})

-			if ipInfo.NeedsWHOISRefresh {
-				refreshASNs[*ipInfo.ASN] = true
+			if ipInfo != nil && ipInfo.NeedsWHOISRefresh {
+				refreshASNs[ipInfo.ASN] = true
 			}
 		}

@@ -865,72 +858,60 @@ func (s *Server) handleIPInfo() http.HandlerFunc {
 	}
 }

-// ipInfo returns what the IP lookup knows about the route of ip. The routing
-// table gives the most specific prefix that holds the address, the number of
-// peers that carry it, its origin ASes and the one that most peers carry, and
-// the time of its newest kept route. The database gives the prefix's
-// first-seen time and the AS's WHOIS details. It returns ErrNoRoute when no
-// prefix holds the address, and ErrInvalidIP when ip does not parse. With an
-// error, every field of the IPInfo it returns is nil.
-func (s *Server) ipInfo(ctx context.Context, ip string) (IPInfo, error) {
+// ipInfo returns the IP lookup's answer for ip. The routing table gives the
+// most specific prefix that holds the address, the number of peers that carry
+// it, the origin AS that most of them carry, and the time of its newest kept
+// route. The database gives the prefix's first-seen time and the AS's WHOIS
+// details. It returns ErrNoRoute when no prefix holds the address, and
+// ErrInvalidIP when ip does not parse.
+func (s *Server) ipInfo(ctx context.Context, ip string) (*IPInfo, error) {
 	addr, err := netip.ParseAddr(ip)
 	if err != nil {
-		return IPInfo{}, fmt.Errorf("%w: %s", ErrInvalidIP, ip)
+		return nil, fmt.Errorf("%w: %s", ErrInvalidIP, ip)
 	}

 	summary, found := s.table.Lookup(addr)
 	if !found {
-		return IPInfo{}, fmt.Errorf("%w for IP %s", ErrNoRoute, ip)
+		return nil, fmt.Errorf("%w for IP %s", ErrNoRoute, ip)
 	}

 	firstSeen, err := s.db.GetPrefixFirstSeen(ctx, summary.Prefix)
 	if err != nil {
-		return IPInfo{}, err
+		return nil, err
 	}

 	asInfo, err := s.db.GetASWHOIS(ctx, summary.OriginASN)
 	if err != nil {
-		return IPInfo{}, err
+		return nil, err
 	}

-	info := IPInfo{
-		Netblock:          new(summary.Prefix.String()),
-		MaskLength:        new(summary.Prefix.Bits()),
-		IPVersion:         new(ipVersionOf(summary.Prefix)),
-		NumPeers:          new(summary.Peers),
-		ASN:               new(summary.OriginASN),
-		NumOrigins:        new(len(summary.OriginASNs)),
-		OriginASNs:        summary.OriginASNs,
-		ASName:            nilIfEmpty(asInfo.ASName),
-		Handle:            nilIfEmpty(asInfo.Handle),
-		Description:       nilIfEmpty(asInfo.Description),
-		OrgName:           nilIfEmpty(asInfo.OrgName),
-		OrgID:             nilIfEmpty(asInfo.OrgID),
-		Address:           nilIfEmpty(asInfo.Address),
-		CountryCode:       nilIfEmpty(asInfo.CountryCode),
-		AbuseEmail:        nilIfEmpty(asInfo.AbuseEmail),
-		RIR:               nilIfEmpty(asInfo.RIR),
-		LastSeen:          summary.Newest,
+	info := &IPInfo{
+		IP:                ip,
+		Netblock:          summary.Prefix.String(),
+		MaskLength:        summary.Prefix.Bits(),
+		IPVersion:         ipVersionOf(summary.Prefix),
+		NumPeers:          summary.Peers,
+		ASN:               summary.OriginASN,
+		ASName:            asInfo.ASName,
+		Handle:            asInfo.Handle,
+		Description:       asInfo.Description,
+		OrgName:           asInfo.OrgName,
+		OrgID:             asInfo.OrgID,
+		Address:           asInfo.Address,
+		CountryCode:       asInfo.CountryCode,
+		AbuseEmail:        asInfo.AbuseEmail,
+		RIR:               asInfo.RIR,
+		FirstSeen:         firstSeen,
 		NeedsWHOISRefresh: needsWHOISRefresh(asInfo),
 	}

-	if !firstSeen.IsZero() {
-		info.FirstSeen = &firstSeen
+	if summary.Newest != nil {
+		info.LastSeen = *summary.Newest
 	}

 	return info, nil
 }

-// nilIfEmpty returns a pointer to s, or nil when s is empty, so that JSON
-// gives a detail the database does not hold as null.
-func nilIfEmpty(s string) *string {
-	if s == "" {
-		return nil
-	}
-
-	return &s
-}
-
 // needsWHOISRefresh says whether the WHOIS details of asInfo were never
 // fetched or are older than whoisStaleThreshold. AS 0, no known origin, has
 // none to fetch.
@@ -1136,17 +1117,15 @@ func publicAddresses(addrs []string) []string {
 	return public
 }

-// lookupPTRNames returns the PTR records of ip without their trailing dots. It
-// returns an empty list, never nil, when there are none, when the lookup fails
-// and when it runs past ptrLookupTimeout, so that an answer's ptr is [] rather
-// than null.
+// lookupPTRNames returns the PTR records of ip without their trailing dots, or
+// nil when the lookup fails or runs past ptrLookupTimeout.
 func (s *Server) lookupPTRNames(ctx context.Context, ip string) []string {
 	ctx, cancel := context.WithTimeout(ctx, ptrLookupTimeout)
 	defer cancel()

 	ptrs, err := s.resolver.LookupAddr(ctx, ip)
-	if err != nil || ptrs == nil {
-		return []string{}
+	if err != nil {
+		return nil
 	}

 	// Remove trailing dots from PTR records
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"html"
-	"maps"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -73,8 +72,8 @@ func emptyTable() *routetable.Table {
 // Paths several tests request.
 const (
 	asPagePath           = "/as/64500"
-	asJSONPath           = "/api/v1/as/64500"
 	prefixLengthPagePath = "/prefixlength/24"
+	statusJSONPath       = "/status.json"
 	statsPath            = "/api/v1/stats"
 )

@@ -295,167 +294,6 @@ func TestStatsAnswerCarriesChurnPerMinute(t *testing.T) {
 	}
 }

-// fixedIntervalASNFetcher is a WHOIS fetcher that does nothing and reports
-// interval as its wait between fetches.
-type fixedIntervalASNFetcher struct {
-	idleASNFetcher
-
-	interval time.Duration
-}
-
-func (f fixedIntervalASNFetcher) GetStats() ASNFetcherStats {
-	return ASNFetcherStats{CurrentInterval: f.interval}
-}
-
-// unitStats holds the figures of a stats answer that carry a unit. Each is a
-// pointer, so that a figure missing from the answer is nil.
-//
-//nolint:tagliatelle // field names are the existing JSON API
-type unitStats struct {
-	UptimeSeconds    *int64  `json:"uptime_seconds"`
-	MemoryUsageBytes *uint64 `json:"memory_usage_bytes"`
-	WHOISStats       struct {
-		CurrentIntervalSeconds *float64 `json:"current_interval_seconds"`
-	} `json:"whois_stats"`
-	GC struct {
-		HeapAllocBytes uint64 `json:"heap_alloc_bytes"`
-	} `json:"gc"`
-}
-
-// TestStatsAnswersGiveUnitsInFieldNames checks that the figures of both stats
-// answers that carry a unit are numbers, with the unit at the end of their
-// names. They used to be strings with the unit in them, such as "1h18m34s" or
-// "1.1 GB" (https://git.eeqj.de/sneak/routewatch/issues/199). The stream has
-// never connected, so the uptime is 0. The memory use in /api/v1/stats is the
-// same number of bytes as its gc.heap_alloc_bytes.
-func TestStatsAnswersGiveUnitsInFieldNames(t *testing.T) {
-	t.Parallel()
-
-	const fetchInterval = 18200 * time.Millisecond
-
-	s := newServerWithTestRoutes(t)
-	s.SetASNFetcher(fixedIntervalASNFetcher{interval: fetchInterval})
-
-	for _, path := range []string{statusJSONPath, statsPath} {
-		answer := get(t, s, path).Body.Bytes()
-
-		var body struct {
-			Data unitStats `json:"data"`
-		}
-
-		err := json.Unmarshal(answer, &body)
-		if err != nil {
-			t.Errorf("%s: figures are not numbers: %v; answer %s", path, err, answer)
-
-			continue
-		}
-
-		got := body.Data
-		if got.UptimeSeconds == nil || *got.UptimeSeconds != 0 {
-			t.Errorf("%s: uptime_seconds is not 0: %s", path, answer)
-		}
-
-		if got.MemoryUsageBytes == nil || *got.MemoryUsageBytes == 0 {
-			t.Errorf("%s: memory_usage_bytes is not a number of bytes: %s",
-				path, answer)
-		}
-
-		interval := got.WHOISStats.CurrentIntervalSeconds
-		if interval == nil || *interval != fetchInterval.Seconds() {
-			t.Errorf("%s: whois_stats.current_interval_seconds is not %v: %s",
-				path, fetchInterval.Seconds(), answer)
-		}
-
-		if path == statsPath && got.MemoryUsageBytes != nil &&
-			*got.MemoryUsageBytes != got.GC.HeapAllocBytes {
-			t.Errorf("%s: memory_usage_bytes %d, want gc.heap_alloc_bytes %d",
-				path, *got.MemoryUsageBytes, got.GC.HeapAllocBytes)
-		}
-	}
-}
-
-// TestStatsAnswerGivesConnectionDurationInSeconds checks that the
-// connection_duration_seconds of /api/v1/stats is null while the stream is not
-// connected, and a whole number of seconds once it is. It used to be the
-// string "disconnected", or a Go duration such as "1h18m34s"
-// (https://git.eeqj.de/sneak/routewatch/issues/199).
-func TestStatsAnswerGivesConnectionDurationInSeconds(t *testing.T) {
-	t.Parallel()
-
-	s := newServerWithTestRoutes(t)
-
-	connectionDuration := func() json.RawMessage {
-		answer := get(t, s, statsPath).Body.Bytes()
-
-		var body struct {
-			Data map[string]json.RawMessage `json:"data"`
-		}
-
-		err := json.Unmarshal(answer, &body)
-		if err != nil {
-			t.Fatalf("decoding the answer: %v; answer %s", err, answer)
-		}
-
-		duration, ok := body.Data["connection_duration_seconds"]
-		if !ok {
-			t.Fatalf("no connection_duration_seconds: %s", answer)
-		}
-
-		return duration
-	}
-
-	disconnected := connectionDuration()
-	if string(disconnected) != "null" {
-		t.Errorf("disconnected: connection_duration_seconds = %s, want null",
-			disconnected)
-	}
-
-	s.streamer.GetMetricsTracker().SetConnected(true)
-
-	var seconds int64
-
-	connected := connectionDuration()
-
-	err := json.Unmarshal(connected, &seconds)
-	if err != nil || seconds != 0 {
-		t.Errorf("just connected: connection_duration_seconds = %s, want 0",
-			connected)
-	}
-}
-
-// TestStreamDurationsCountSeconds checks that the uptime and the connection
-// duration of a stream that connected 90 seconds ago are both 90. A stream
-// that has never connected has an uptime of 0, and one that is not connected
-// has no connection duration.
-func TestStreamDurationsCountSeconds(t *testing.T) {
-	t.Parallel()
-
-	const connectedFor = 90 * time.Second
-
-	connectedSince := time.Now().Add(-connectedFor)
-	want := int64(connectedFor / time.Second)
-
-	if got := uptimeSeconds(connectedSince); got != want {
-		t.Errorf("uptimeSeconds = %d, want %d", got, want)
-	}
-
-	if got := uptimeSeconds(time.Time{}); got != 0 {
-		t.Errorf("uptimeSeconds before any connection = %d, want 0", got)
-	}
-
-	switch got := connectionDurationSeconds(true, connectedSince); {
-	case got == nil:
-		t.Errorf("connectionDurationSeconds = nil, want %d", want)
-	case *got != want:
-		t.Errorf("connectionDurationSeconds = %d, want %d", *got, want)
-	}
-
-	if got := connectionDurationSeconds(false, connectedSince); got != nil {
-		t.Errorf("connectionDurationSeconds while not connected = %d, want nil",
-			*got)
-	}
-}
-
 // newTestTable returns a routing table that holds a route for testPrefixV4,
 // with origin AS 64500, and one for testPrefixV6, with origin AS 64501.
 func newTestTable() *routetable.Table {
@@ -927,7 +765,7 @@ func TestRoutesAnswer504WhenDatabaseReadIsCutOff(t *testing.T) {
 		{path: "/ip/" + addrInTestPrefixV4, wantJSONBody: true},
 		{path: statsPath, wantJSONBody: true},
 		{path: "/api/v1/ip/" + addrInTestPrefixV4, wantJSONBody: true},
-		{path: asJSONPath, wantJSONBody: true},
+		{path: "/api/v1/as/64500", wantJSONBody: true},
 	}

 	for _, tt := range tests {
@@ -1108,10 +946,10 @@ func TestJSONRoutesDoNotSendErrorDetails(t *testing.T) {
 		path     string
 		wantCode int
 	}{
-		{healthCheckPath, http.StatusServiceUnavailable},
+		{"/.well-known/healthcheck.json", http.StatusServiceUnavailable},
 		{statusJSONPath, http.StatusInternalServerError},
 		{statsPath, http.StatusInternalServerError},
-		{asJSONPath, http.StatusInternalServerError},
+		{"/api/v1/as/64500", http.StatusInternalServerError},
 		{"/api/v1/ip/" + addrInTestPrefixV4, http.StatusInternalServerError},
 		{"/api/v1/prefix/foo/24", http.StatusBadRequest},
 	}
@@ -1381,8 +1219,7 @@ func TestIPLookupKeepsRouteWhenPTRLookupDoesNotAnswer(t *testing.T) {
 		t.Fatalf("decoding the answer %q: %v", rec.Body, err)
 	}

-	if len(body.Data.Results) != 1 || body.Data.Results[0].Netblock == nil ||
-		*body.Data.Results[0].Netblock != testPrefixV4 {
+	if len(body.Data.Results) != 1 || body.Data.Results[0].Netblock != testPrefixV4 {
 		t.Errorf("answer %s, want one result in %s", rec.Body, testPrefixV4)
 	}
 }
@@ -1474,39 +1311,12 @@ func TestIPLookupReportsBlocklists(t *testing.T) {
 	}
 }

-// jsonNull is how JSON writes a field without a value.
-const jsonNull = "null"
-
-// jsonEmptyList is how JSON writes an empty list.
-const jsonEmptyList = "[]"
-
-// resultFields decodes an IP lookup answer and returns each of its results as
-// its JSON fields.
-func resultFields(t *testing.T, answer []byte) []map[string]json.RawMessage {
-	t.Helper()
-
-	var body struct {
-		Data struct {
-			Results []map[string]json.RawMessage `json:"results"`
-		} `json:"data"`
-	}
-
-	err := json.Unmarshal(answer, &body)
-	if err != nil {
-		t.Fatalf("decoding the answer %s: %v", answer, err)
-	}
-
-	return body.Data.Results
-}
-
 // TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute looks up a listed
 // address that has no live route, alone and beside a routed address. Each
-// answer is 200 and has a result for the address, with its blocklists and
-// every route field set to null. Before the fix the lookup of that address
-// alone answered 404, and beside a routed address it was only named in
-// errors, so its blocklists were never reported. After that fix the result
-// still left out the route fields
-// (https://git.eeqj.de/sneak/routewatch/issues/200).
+// answer is 200 and has a result for the address, with its blocklists and no
+// route fields. Before the fix the lookup of that address alone answered
+// 404, and beside a routed address it was only named in errors, so its
+// blocklists were never reported.
 func TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute(t *testing.T) {
 	t.Parallel()

@@ -1514,15 +1324,6 @@ func TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute(t *testing.T) {
 	s.resolver = &fakeResolver{}
 	s.SetBlocklists(fakeBlocklists{})

-	// routeFields are the fields of a result that come from the address's
-	// route and that route's origin AS.
-	routeFields := []string{
-		"netblock", "mask_length", "ip_version", "num_peers", "asn",
-		"num_origins", "origin_asns", "as_name", "handle", "description",
-		"org_name", "org_id", "address", "country_code", "abuse_email", "rir",
-		"first_seen", "last_seen",
-	}
-
 	for _, target := range []string{
 		listedUnroutedAddr,
 		addrInTestPrefixV4 + "," + listedUnroutedAddr,
@@ -1553,21 +1354,12 @@ func TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute(t *testing.T) {
 			continue
 		}

-		fields := resultFields(t, rec.Body.Bytes())[i]
-		for _, name := range routeFields {
-			value, present := fields[name]
-
-			switch {
-			case !present:
-				t.Errorf("%s: the result for %s has no %s",
-					target, listedUnroutedAddr, name)
-			case string(value) != jsonNull:
-				t.Errorf("%s: %s of %s is %s, want %s",
-					target, name, listedUnroutedAddr, value, jsonNull)
-			}
+		result := body.Data.Results[i]
+		if result.IPInfo != nil {
+			t.Errorf("%s: result for %s has route fields %+v",
+				target, listedUnroutedAddr, result.IPInfo)
 		}

-		result := body.Data.Results[i]
 		if len(result.Blocklists) != 1 ||
 			result.Blocklists[0].Name != testListing().Name {
 			t.Errorf("%s: blocklists %+v, want [%+v]",
@@ -1576,76 +1368,6 @@ func TestIPLookupReportsBlocklistsOfAnAddressWithNoRoute(t *testing.T) {
 	}
 }

-// twoAddressHostName is a host name that resolves to addrInTestPrefixV4 and
-// listedUnroutedAddr.
-const twoAddressHostName = "two-addresses.test"
-
-// TestIPLookupResultsHaveTheSameFields looks up a host name, addresses and
-// the caller's own address, through each IP lookup route. Some of the
-// addresses have a route and some do not, and none has PTR names. Every
-// result has the same fields. Before the fix a result left out every field
-// without a value (https://git.eeqj.de/sneak/routewatch/issues/200).
-func TestIPLookupResultsHaveTheSameFields(t *testing.T) {
-	t.Parallel()
-
-	s := newServerWithTestRoutes(t)
-	s.resolver = &fakeResolver{hosts: map[string][]string{
-		twoAddressHostName: {addrInTestPrefixV4, listedUnroutedAddr},
-	}}
-	s.SetBlocklists(fakeBlocklists{})
-
-	// want is the fields of the first result.
-	var want []string
-
-	for _, path := range []string{
-		"/api/v1/ip/" + twoAddressHostName,
-		"/ip/" + addrInTestPrefixV6 + "," + listedUnroutedAddr,
-		ownAddressPath,
-	} {
-		for _, result := range resultFields(t, get(t, s, path).Body.Bytes()) {
-			got := slices.Sorted(maps.Keys(result))
-			if want == nil {
-				want = got
-			}
-
-			if !slices.Equal(got, want) {
-				t.Errorf("%s: a result has the fields %v, want %v", path, got, want)
-			}
-		}
-	}
-}
-
-// TestIPLookupOfAnAddressWithoutPTRNamesOrStoredNetblock looks up a routed
-// address that has no PTR names, and whose netblock the database has not
-// stored. Its ptr is an empty list and its first_seen is null. Before the fix
-// ptr was left out, and first_seen was 0001-01-01T00:00:00Z
-// (https://git.eeqj.de/sneak/routewatch/issues/200).
-func TestIPLookupOfAnAddressWithoutPTRNamesOrStoredNetblock(t *testing.T) {
-	t.Parallel()
-
-	s := newServerWithTestRoutes(t)
-	s.resolver = &fakeResolver{}
-
-	path := "/api/v1/ip/" + addrInTestPrefixV4
-
-	results := resultFields(t, get(t, s, path).Body.Bytes())
-	if len(results) != 1 {
-		t.Fatalf("%s: %d results, want 1", path, len(results))
-	}
-
-	want := map[string]string{
-		"ptr":        jsonEmptyList,
-		"first_seen": jsonNull,
-	}
-
-	for name, value := range want {
-		got := string(results[0][name])
-		if got != value {
-			t.Errorf("%s: %s is %s, want %s", path, name, got, value)
-		}
-	}
-}
-
 // TestIPLookupAnswersMayBeCached checks the Cache-Control header of the IP
 // lookup answers. Caches may keep them for the blocklists' shortest interval,
 // and only the caller's own browser may keep the answer about the caller's
@@ -4,8 +4,6 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"net/netip"
-	"reflect"
 	"slices"
 	"strconv"
 	"strings"
@@ -77,10 +75,9 @@ func get(t *testing.T, s *Server, path string) *httptest.ResponseRecorder {

 // TestIPLookupGivesTheOriginMostPeersCarry looks up an address in a prefix
 // with two origin ASes, through each IP lookup route. The answer names the
-// origin AS that more peers carry, counts every peer, lists both origin ASes,
-// and gives the time of the prefix's newest kept route. The prefix's
-// first-seen time and the AS's WHOIS details come from the database. A WHOIS
-// detail the database does not hold is null.
+// origin AS that more peers carry, counts every peer, and gives the time of
+// the prefix's newest kept route. The prefix's first-seen time and the AS's
+// WHOIS details come from the database.
 func TestIPLookupGivesTheOriginMostPeersCarry(t *testing.T) {
 	t.Parallel()

@@ -108,26 +105,6 @@ func TestIPLookupGivesTheOriginMostPeersCarry(t *testing.T) {
 		t.Fatalf("UpdateASNWHOIS: %v", err)
 	}

-	// The details the database does not hold, such as org_name, are null.
-	want := IPInfo{
-		Netblock:    new(testPrefixV4),
-		MaskLength:  new(netip.MustParsePrefix(testPrefixV4).Bits()),
-		IPVersion:   new(ipVersionV4),
-		NumPeers:    new(4),
-		ASN:         new(mostPeersASN),
-		NumOrigins:  new(2),
-		OriginASNs:  []int{mostPeersASN, fewerPeersASN},
-		ASName:      &whois.ASName,
-		CountryCode: &whois.CountryCode,
-		FirstSeen:   &firstSeen,
-		LastSeen:    new(testRouteTime(5)),
-	}
-
-	wantJSON, err := json.Marshal(want)
-	if err != nil {
-		t.Fatalf("encoding %+v: %v", want, err)
-	}
-
 	// ownAddressPath looks up the request's own address, which httptest
 	// gives as addrInTestPrefixV4.
 	for _, path := range []string{
@@ -138,15 +115,22 @@ func TestIPLookupGivesTheOriginMostPeersCarry(t *testing.T) {
 			Data IPLookupResponse `json:"data"`
 		}

-		answer := get(t, s, path).Body.Bytes()
-
-		err := json.Unmarshal(answer, &body)
-		if err != nil || len(body.Data.Results) != 1 {
-			t.Fatalf("%s: answer %s (%v), want one result", path, answer, err)
+		err := json.Unmarshal(get(t, s, path).Body.Bytes(), &body)
+		if err != nil || len(body.Data.Results) != 1 ||
+			body.Data.Results[0].IPInfo == nil {
+			t.Fatalf("%s: answer %+v (%v), want one result with a route",
+				path, body.Data, err)
 		}

-		if !reflect.DeepEqual(body.Data.Results[0].IPInfo, want) {
-			t.Errorf("%s: answer %s, want the fields %s", path, answer, wantJSON)
+		got := body.Data.Results[0].IPInfo
+		if got.Netblock != testPrefixV4 || got.ASN != mostPeersASN ||
+			got.NumPeers != 4 || !got.LastSeen.Equal(testRouteTime(5)) ||
+			!got.FirstSeen.Equal(firstSeen) || got.ASName != whois.ASName ||
+			got.CountryCode != whois.CountryCode {
+			t.Errorf("%s: route %+v, want %s from AS%d, 4 peers, last seen %v, "+
+				"first seen %v, %s in %s", path, *got, testPrefixV4,
+				mostPeersASN, testRouteTime(5), firstSeen, whois.ASName,
+				whois.CountryCode)
 		}
 	}
 }
@@ -6,7 +6,6 @@ import (
 	"strconv"
 	"strings"
 	"testing"
-	"testing/synctest"
 	"time"

 	"git.eeqj.de/sneak/routewatch/internal/database"
@@ -174,7 +173,7 @@ func TestListPagesListTheirEntries(t *testing.T) {
 		},
 		multipleOriginsPath: {
 			"Prefixes announced by more than one origin AS: 1.", "1.0.0.0/24",
-			asLink(twoPrefixASN), asLink(secondOrigin), ">1 peer<",
+			asLink(twoPrefixASN), asLink(secondOrigin),
 		},
 	}

@@ -316,92 +315,6 @@ func TestKeepHomeCardsFreshWorksThemOutEveryInterval(t *testing.T) {
 	}
 }

-// TestStartedServerWorksOutTheCards starts a server and waits until its home
-// page shows the cards.
-func TestStartedServerWorksOutTheCards(t *testing.T) {
-	t.Parallel()
-
-	const maxWait = 5 * time.Second
-
-	s := newServerWithTable(t, newCardsTable())
-
-	err := s.Start(t.Context())
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-
-	defer func() { _ = s.Stop(context.Background()) }()
-
-	waitUntil(t, maxWait, func() bool {
-		return !strings.Contains(get(t, s, "/").Body.String(), cardsNotReadyText)
-	})
-
-	card := homeCard(t, get(t, s, "/").Body.String(), "Newest Updated Route")
-	if !strings.Contains(card, "8.8.8.0/24") {
-		t.Errorf("the newest route is not the table's: %s", card)
-	}
-}
-
-// TestStartedServerWorksOutTheCardsUntilStop starts a server with a context
-// that ends as soon as Start returns. It runs in a synctest bubble, whose clock
-// is fake: time.Sleep there moves the clock on and returns at once. The server
-// must work the cards out again a minute later, and no more after Stop. Each
-// time it works them out, it keeps a new copy. Before the fix the end of
-// Start's context stopped the goroutine that works them out.
-func TestStartedServerWorksOutTheCardsUntilStop(t *testing.T) {
-	t.Parallel()
-
-	// The server is made outside the bubble. The streamer's metrics start a
-	// goroutine that never returns, and a bubble waits for each of its
-	// goroutines to return.
-	s := newServerWithTable(t, newCardsTable())
-
-	synctest.Test(t, func(t *testing.T) {
-		ctx, cancel := context.WithCancel(t.Context())
-
-		err := s.Start(ctx)
-		if err != nil {
-			t.Fatalf("Start: %v", err)
-		}
-
-		cancel()
-
-		// The bubble's clock moves only while each of its goroutines waits
-		// on the bubble, and the goroutine that serves HTTP waits on the
-		// network. The test sends no request, so it closes the HTTP server.
-		_ = s.srv.Close()
-
-		synctest.Wait()
-
-		started := s.cards.Load()
-		if started == nil {
-			t.Fatal("the server did not work out the cards when it started")
-		}
-
-		time.Sleep(homeCardsRefreshInterval)
-		synctest.Wait()
-
-		if s.cards.Load() == started {
-			t.Error("the server did not work out the cards again a minute " +
-				"after its start context ended")
-		}
-
-		err = s.Stop(t.Context())
-		if err != nil {
-			t.Fatalf("Stop: %v", err)
-		}
-
-		stopped := s.cards.Load()
-
-		time.Sleep(homeCardsRefreshInterval)
-		synctest.Wait()
-
-		if s.cards.Load() != stopped {
-			t.Error("the server worked out the cards again after Stop")
-		}
-	})
-}
-
 // waitUntil fails the test unless done reports true within maxWait.
 func waitUntil(t *testing.T, maxWait time.Duration, done func() bool) {
 	t.Helper()
@@ -16,7 +16,6 @@ import (
 	"time"

 	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 )

 // responseWriter wraps http.ResponseWriter to capture the response
@@ -54,15 +53,6 @@ func (rw *responseWriter) Header() http.Header {
 	return rw.ResponseWriter.Header()
 }

-// The @meta object JSONResponseMiddleware adds to a JSON answer: its key, and
-// the keys of its fields.
-const (
-	jsonKeyMeta            = "@meta"
-	metaKeyTimeZone        = "time_zone"
-	metaKeyAPIVersion      = "api_version"
-	metaKeyExecutionTimeMs = "execution_time_ms"
-)
-
 // JSONResponseMiddleware is an HTTP middleware that wraps all JSON responses
 // with a @meta field containing execution metadata. The metadata includes the
 // time zone (always UTC), API version, and request execution time in milliseconds.
@@ -116,10 +106,10 @@ func JSONResponseMiddleware(next http.Handler) http.Handler {
 		}

 		// Add @meta field
-		originalResponse[jsonKeyMeta] = map[string]any{
-			metaKeyTimeZone:        "UTC",
-			metaKeyAPIVersion:      1,
-			metaKeyExecutionTimeMs: execTime.Milliseconds(),
+		originalResponse["@meta"] = map[string]any{
+			"time_zone":      "UTC",
+			"api_version":    1,
+			"execution_time": fmt.Sprintf("%d ms", execTime.Milliseconds()),
 		}

 		// Write the enhanced response
@@ -155,8 +145,7 @@ func deadlinePassed(ctx context.Context) bool {
 // has passed, it answers 504 with the error message "Request timeout". A 4xx
 // keeps its status, with the status's standard text as the message. For other
 // errors, it returns "Internal server error", with status 500 if the original
-// status was 200. A panic in the handler answers 500 with "Internal server
-// error" too.
+// status was 200.
 //
 // Non-JSON responses are passed through unchanged.
 func JSONValidationMiddleware(next http.Handler) http.Handler {
@@ -168,9 +157,8 @@ func JSONValidationMiddleware(next http.Handler) http.Handler {
 			statusCode:     http.StatusOK,
 		}

-		// Serve the request. Recoverer logs a panic in the handler and turns it
-		// into a 500 without a body, which gets the JSON error body below.
-		middleware.Recoverer(next).ServeHTTP(rw, r)
+		// Serve the request
+		next.ServeHTTP(rw, r)

 		// Check if it's meant to be a JSON response
 		contentType := rw.Header().Get("Content-Type")
@@ -1,40 +1,25 @@
 package server

 import (
-	"bytes"
-	"context"
 	"encoding/json"
-	"io"
-	"log/slog"
-	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
-	"os"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
-
-	"git.eeqj.de/sneak/routewatch/internal/config"
-	"git.eeqj.de/sneak/routewatch/internal/database"
-	"git.eeqj.de/sneak/routewatch/internal/logger"
-	"git.eeqj.de/sneak/routewatch/internal/metrics"
-	"git.eeqj.de/sneak/routewatch/internal/streamer"
 )

 // The addresses the forwarding tests use: the client a proxy names in
 // X-Forwarded-For, the range of trusted proxies, a peer inside it, and a peer
 // outside it, which lies in testPrefixV4 so that an IP lookup of it finds a
-// route. reverseProxyPeer is a reverse proxy at a private address, as Docker
-// gives one.
+// route.
 const (
 	forwardedClient   = "203.0.113.9"
 	trustedProxyRange = "10.0.0.0/8"
 	trustedPeer       = "10.0.0.2:1234"
 	untrustedPeerAddr = "192.0.2.1"
 	untrustedPeer     = untrustedPeerAddr + ":1234"
-	reverseProxyPeer  = "172.19.0.14:1234"
 )

 // TestResponsesCarrySecurityHeaders checks that a page, a JSON route and a
@@ -102,219 +87,6 @@ func TestJSONValidationKeeps4xxWithoutBody(t *testing.T) {
 	checkJSONErrorMessage(t, name, rec, http.StatusText(http.StatusBadRequest))
 }

-// TestJSONAnswersPutNoUnitInAString sends a request to each JSON route and
-// checks each answer. Its @meta.execution_time_ms is a number, and none of its
-// strings is a number with a unit, such as "12 ms", "1.1 GB" or "1h18m34s"
-// (https://git.eeqj.de/sneak/routewatch/issues/199). The health check answers
-// 503, since the stream is not connected, and the last path matches no route.
-func TestJSONAnswersPutNoUnitInAString(t *testing.T) {
-	t.Parallel()
-
-	numberWithUnit := regexp.MustCompile(
-		`^([0-9]+(\.[0-9]+)? ?(ns|µs|ms|s|m|h|B|kB|MB|GB|TB))+$`)
-
-	s := newServerWithTestRoutes(t)
-	s.resolver = &fakeResolver{}
-	s.SetASNFetcher(fixedIntervalASNFetcher{interval: time.Second})
-
-	paths := []string{
-		statusJSONPath,
-		statsPath,
-		healthCheckPath,
-		"/api/v1/ip/" + untrustedPeerAddr,
-		"/ip/" + untrustedPeerAddr,
-		asJSONPath,
-		"/api/v1/prefix/" + testPrefixV4,
-		"/api/v1/search/as?q=google",
-		"/api/v1/no-such-route",
-	}
-
-	for _, path := range paths {
-		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, path, nil))
-
-		var answer map[string]any
-
-		err := json.Unmarshal(rec.Body.Bytes(), &answer)
-		if err != nil {
-			t.Errorf("%s: decoding the answer: %v; answer %s", path, err, rec.Body)
-
-			continue
-		}
-
-		meta, _ := answer["@meta"].(map[string]any)
-		if _, ok := meta["execution_time_ms"].(float64); !ok {
-			t.Errorf("%s: @meta.execution_time_ms is not a number: %s",
-				path, rec.Body)
-		}
-
-		for _, value := range stringsIn(answer) {
-			if numberWithUnit.MatchString(value) {
-				t.Errorf("%s: %q is a number with a unit in a string", path, value)
-			}
-		}
-	}
-}
-
-// TestJSONAnswersCarryMeta sends requests to every JSON route through the
-// server's router, and checks that each answer carries @meta with its three
-// fields. The answers include successes, and errors that the handlers, the
-// router and the middleware write. Before the fix a panic in a handler, and a
-// method /status.json or the health check does not take, answered with an
-// empty body (https://git.eeqj.de/sneak/routewatch/issues/201).
-func TestJSONAnswersCarryMeta(t *testing.T) {
-	t.Parallel()
-
-	// JSON routes whose handlers write nothing or panic, so that the JSON
-	// check on the route writes the error answer itself.
-	const (
-		writesNothingPath = "/writes-nothing.json"
-		panicsPath        = "/panics.json"
-	)
-
-	s := newServerWithTestRoutes(t)
-	s.resolver = &fakeResolver{}
-	s.streamer.GetMetricsTracker().SetConnected(true)
-	s.router.Get(writesNothingPath, JSONValidationMiddleware(http.HandlerFunc(
-		func(http.ResponseWriter, *http.Request) {})).ServeHTTP)
-	s.router.Get(panicsPath, JSONValidationMiddleware(http.HandlerFunc(
-		func(http.ResponseWriter, *http.Request) { panic(errDiskIO) })).ServeHTTP)
-
-	tests := []struct {
-		method   string
-		path     string
-		wantCode int
-	}{
-		// Answers that succeed
-		{http.MethodGet, statusJSONPath, http.StatusOK},
-		{http.MethodGet, healthCheckPath, http.StatusOK},
-		{http.MethodGet, "/ip", http.StatusOK},
-		{http.MethodGet, ownAddressPath, http.StatusOK},
-		{http.MethodGet, "/ip/" + addrInTestPrefixV4, http.StatusOK},
-		{http.MethodGet, statsPath, http.StatusOK},
-		{http.MethodGet, "/api/v1/ip/" + addrInTestPrefixV4, http.StatusOK},
-		{http.MethodGet, asJSONPath, http.StatusOK},
-		{http.MethodGet, "/api/v1/prefix/" + testPrefixV4, http.StatusOK},
-		{http.MethodGet, "/api/v1/search/as?q=google", http.StatusOK},
-		// Errors the handlers write
-		{http.MethodGet, "/ip/no-such-host.example", http.StatusBadRequest},
-		{http.MethodGet, "/api/v1/ip/no-such-host.example", http.StatusBadRequest},
-		{http.MethodGet, "/api/v1/as/foo", http.StatusBadRequest},
-		{http.MethodGet, "/api/v1/as/0", http.StatusNotFound},
-		{http.MethodGet, "/api/v1/prefix/192.0.2.0/33", http.StatusBadRequest},
-		{http.MethodGet, "/api/v1/prefix/198.51.100.0/24", http.StatusNotFound},
-		{http.MethodGet, "/api/v1/search/as", http.StatusBadRequest},
-		// Errors the router and the middleware write
-		{http.MethodGet, "/api/v1/no-such-route", http.StatusNotFound},
-		{http.MethodGet, "/ip/192.0.2.1/nothing", http.StatusNotFound},
-		{http.MethodPost, statsPath, http.StatusMethodNotAllowed},
-		{http.MethodPost, ownAddressPath, http.StatusMethodNotAllowed},
-		{http.MethodPost, statusJSONPath, http.StatusMethodNotAllowed},
-		{http.MethodPut, healthCheckPath, http.StatusMethodNotAllowed},
-		{http.MethodGet, writesNothingPath, http.StatusInternalServerError},
-		{http.MethodGet, panicsPath, http.StatusInternalServerError},
-	}
-
-	for _, tt := range tests {
-		checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
-			t.Context(), tt.method, tt.path, nil), tt.wantCode)
-	}
-
-	// A request whose time limit has already passed answers 504. The handlers
-	// write the answers of the first five routes, and the JSON check on the
-	// route writes the last.
-	pastTimeLimit, cancel := context.WithDeadline(t.Context(), time.Now())
-	defer cancel()
-
-	for _, path := range []string{
-		statusJSONPath, statsPath, "/ip/" + addrInTestPrefixV4,
-		"/api/v1/ip/" + addrInTestPrefixV4, asJSONPath, writesNothingPath,
-	} {
-		checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
-			pastTimeLimit, http.MethodGet, path, nil), http.StatusGatewayTimeout)
-	}
-
-	// With a store whose reads fail, the health check answers 503, and the
-	// handlers of the other routes 500.
-	failing := New(failingDB{}, newTestTable(),
-		streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-	failing.resolver = &fakeResolver{}
-
-	checkAnswerCarriesMeta(t, failing, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, healthCheckPath, nil),
-		http.StatusServiceUnavailable)
-
-	for _, path := range []string{
-		statusJSONPath, statsPath, asJSONPath,
-		"/api/v1/ip/" + addrInTestPrefixV4, "/ip/" + addrInTestPrefixV4,
-	} {
-		checkAnswerCarriesMeta(t, failing, httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, path, nil), http.StatusInternalServerError)
-	}
-}
-
-// checkAnswerCarriesMeta serves req through the server's router, and checks
-// that it answers wantCode with @meta and its three fields.
-func checkAnswerCarriesMeta(
-	t *testing.T, s *Server, req *http.Request, wantCode int,
-) {
-	t.Helper()
-
-	// The values README "API v1" gives the two fields that never change.
-	const (
-		wantTimeZone   = "UTC"
-		wantAPIVersion = 1
-	)
-
-	name := req.Method + " " + req.URL.String()
-
-	rec := httptest.NewRecorder()
-	s.router.ServeHTTP(rec, req)
-
-	if rec.Code != wantCode {
-		t.Errorf("%s: status %d, want %d; body %s", name, rec.Code, wantCode, rec.Body)
-	}
-
-	var answer map[string]any
-
-	err := json.Unmarshal(rec.Body.Bytes(), &answer)
-	if err != nil {
-		t.Errorf("%s: decoding the answer %q: %v", name, rec.Body, err)
-
-		return
-	}
-
-	meta, _ := answer[jsonKeyMeta].(map[string]any)
-	_, timeIsNumber := meta[metaKeyExecutionTimeMs].(float64)
-
-	if meta[metaKeyTimeZone] != wantTimeZone ||
-		meta[metaKeyAPIVersion] != float64(wantAPIVersion) || !timeIsNumber {
-		t.Errorf("%s: @meta %v, want time_zone %q, api_version %d and a "+
-			"number in execution_time_ms", name, meta, wantTimeZone, wantAPIVersion)
-	}
-}
-
-// stringsIn returns every string in a decoded JSON value, at any depth.
-func stringsIn(value any) []string {
-	var found []string
-
-	switch v := value.(type) {
-	case string:
-		found = append(found, v)
-	case []any:
-		for _, item := range v {
-			found = append(found, stringsIn(item)...)
-		}
-	case map[string]any:
-		for _, item := range v {
-			found = append(found, stringsIn(item)...)
-		}
-	}
-
-	return found
-}
-
 // TestPagesCarryTheCSPNonce checks that every script and style block of each
 // page carries the nonce its Content-Security-Policy header names, so that the
 // browser runs and applies them, that each answer has a nonce of its own, and
@@ -411,141 +183,6 @@ func TestForwardedForFromUntrustedPeerIsIgnored(t *testing.T) {
 	}
 }

-// TestDefaultTrustedProxiesGiveTheForwardedClient builds the server from the
-// configuration with TRUSTED_PROXIES unset. A request from a reverse proxy at
-// a private address must be looked up by /ip/, shown on the home page's card
-// and logged as the client its X-Forwarded-For names. A direct request from a
-// public address with a forged X-Forwarded-For keeps its own address. Before
-// the fix no proxy was trusted unless TRUSTED_PROXIES named it, so /ip/ gave
-// the proxy's address (https://git.eeqj.de/sneak/routewatch/issues/198).
-func TestDefaultTrustedProxiesGiveTheForwardedClient(t *testing.T) {
-	t.Setenv("PORT", "")
-	t.Setenv("XDG_DATA_HOME", "")
-
-	// t.Setenv puts the variable back when the test ends.
-	t.Setenv("TRUSTED_PROXIES", "")
-
-	err := os.Unsetenv("TRUSTED_PROXIES")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	cfg, err := config.New()
-	if err != nil {
-		t.Fatalf("config.New: %v", err)
-	}
-
-	var requestLog bytes.Buffer
-
-	s := newServerWithConfig(t, cfg, &requestLog)
-
-	tests := []struct {
-		name string
-		peer string
-		want string
-	}{
-		{"through a reverse proxy", reverseProxyPeer, forwardedClient},
-		{"direct from a public address", untrustedPeer, untrustedPeerAddr},
-	}
-
-	for _, tt := range tests {
-		requestLog.Reset()
-
-		get := func(path string) *httptest.ResponseRecorder {
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
-			req.RemoteAddr = tt.peer
-			req.Header.Set("X-Forwarded-For", forwardedClient)
-
-			rec := httptest.NewRecorder()
-			s.router.ServeHTTP(rec, req)
-
-			return rec
-		}
-
-		var answer struct {
-			Data IPLookupResponse `json:"data"`
-		}
-
-		rec := get("/ip/")
-
-		err := json.Unmarshal(rec.Body.Bytes(), &answer)
-		if err != nil {
-			t.Fatalf("%s: decoding the answer %q: %v", tt.name, rec.Body, err)
-		}
-
-		if answer.Data.Query != tt.want {
-			t.Errorf("%s: /ip/ looked up %q, want %q", tt.name, answer.Data.Query, tt.want)
-		}
-
-		page := get("/").Body.String()
-		if !strings.Contains(page, `data-client-ip="`+tt.want+`"`) {
-			t.Errorf("%s: the home page's card does not hold %s", tt.name, tt.want)
-		}
-
-		logged := loggedAddresses(requestLog.String())
-		if len(logged) == 0 {
-			t.Errorf("%s: the request log names no address", tt.name)
-		}
-
-		for _, addr := range logged {
-			if addr != tt.want {
-				t.Errorf("%s: the request log gives %s, want %s", tt.name, addr, tt.want)
-			}
-		}
-	}
-}
-
-// newServerWithConfig returns a server built with cfg, on a new database, that
-// reads the routes of newTestTable and logs its requests as JSON to
-// requestLog.
-func newServerWithConfig(
-	t *testing.T, cfg *config.Config, requestLog io.Writer,
-) *Server {
-	t.Helper()
-
-	cfg.StateDir = t.TempDir()
-
-	db, err := database.New(cfg, logger.New())
-	if err != nil {
-		t.Fatalf("database.New: %v", err)
-	}
-
-	t.Cleanup(func() { _ = db.Close() })
-
-	s := New(db, newTestTable(), streamer.New(logger.New(), metrics.New()),
-		&logger.Logger{Logger: slog.New(slog.NewJSONHandler(requestLog, nil))}, cfg)
-	s.resolver = &fakeResolver{}
-
-	return s
-}
-
-// loggedAddresses returns the address each line of the JSON request log
-// names, without the port a direct request is logged with.
-func loggedAddresses(requestLog string) []string {
-	var addrs []string
-
-	for line := range strings.Lines(requestLog) {
-		//nolint:tagliatelle // the field name is the key the request log uses
-		var entry struct {
-			RemoteAddr string `json:"remote_addr"`
-		}
-
-		err := json.Unmarshal([]byte(line), &entry)
-		if err != nil || entry.RemoteAddr == "" {
-			continue
-		}
-
-		addr, _, err := net.SplitHostPort(entry.RemoteAddr)
-		if err != nil {
-			addr = entry.RemoteAddr
-		}
-
-		addrs = append(addrs, addr)
-	}
-
-	return addrs
-}
-
 // TestRealIPMiddlewareTrustsOnlyConfiguredProxies checks which address
 // RealIPMiddleware gives a request: the TCP peer, unless the peer is a trusted
 // proxy; then the last X-Forwarded-For entry that is not a trusted proxy,
@@ -38,37 +38,30 @@ type PrefixDistribution struct {
 	Count      int `json:"count"`
 }

-// IPInfo is what the IP lookup knows about the route of an address and that
-// route's origin AS. A field is nil, null in JSON, when its value is not known.
-// Every field is nil for an address with no route.
+// IPInfo represents comprehensive IP information for the /ip endpoint
 //
 //nolint:tagliatelle // field names are the existing JSON API
 type IPInfo struct {
-	// Netblock is the most specific prefix that holds the address.
-	Netblock   *string `json:"netblock"`
-	MaskLength *int    `json:"mask_length"`
-	IPVersion  *int    `json:"ip_version"`
-	NumPeers   *int    `json:"num_peers"`
-	// ASN is the origin AS that the most peers carry the netblock with.
-	ASN *int `json:"asn"`
-	// NumOrigins and OriginASNs are how many origin ASes peers carry the
-	// netblock with, and which, in AS number order.
-	NumOrigins *int  `json:"num_origins"`
-	OriginASNs []int `json:"origin_asns"`
-	// The details the database holds about the AS in ASN.
-	ASName      *string `json:"as_name"`
-	Handle      *string `json:"handle"`
-	Description *string `json:"description"`
-	OrgName     *string `json:"org_name"`
-	OrgID       *string `json:"org_id"`
-	Address     *string `json:"address"`
-	CountryCode *string `json:"country_code"`
-	AbuseEmail  *string `json:"abuse_email"`
-	RIR         *string `json:"rir"`
-	// FirstSeen is when RouteWatch first saw the netblock. LastSeen is the
-	// time of the netblock's newest kept route.
-	FirstSeen *time.Time `json:"first_seen"`
-	LastSeen  *time.Time `json:"last_seen"`
+	IP         string `json:"ip"`
+	Netblock   string `json:"netblock"`
+	MaskLength int    `json:"mask_length"`
+	IPVersion  int    `json:"ip_version"`
+	NumPeers   int    `json:"num_peers"`
+	// AS information
+	ASN         int    `json:"asn"`
+	ASName      string `json:"as_name,omitempty"`
+	Handle      string `json:"handle,omitempty"`
+	Description string `json:"description,omitempty"`
+	OrgName     string `json:"org_name,omitempty"`
+	OrgID       string `json:"org_id,omitempty"`
+	Address     string `json:"address,omitempty"`
+	CountryCode string `json:"country_code,omitempty"`
+	AbuseEmail  string `json:"abuse_email,omitempty"`
+	RIR         string `json:"rir,omitempty"`
+	// Timestamps. LastSeen is zero, and left out of JSON, when the prefix
+	// keeps no route.
+	FirstSeen time.Time `json:"first_seen"`
+	LastSeen  time.Time `json:"last_seen,omitzero"`
 	// Indicates if WHOIS data needs refresh (not serialized)
 	NeedsWHOISRefresh bool `json:"-"`
 }
@@ -8,8 +8,8 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 )

-// The error messages the JSON routes answer with when no route matches the
-// path, and when the route does not take the method.
+// The error messages the JSON routes under /api/v1 and /ip answer with when no
+// route matches the path, and when none takes the method.
 const (
 	notFoundMessage         = "Not found"
 	methodNotAllowedMessage = "Method not allowed"
@@ -19,13 +19,6 @@ const (
 	jsonRoutesAllow = "GET, HEAD"
 )

-// The paths of the status figures and the health check, the two JSON routes
-// outside /api/v1 and /ip.
-const (
-	statusJSONPath  = "/status.json"
-	healthCheckPath = "/.well-known/healthcheck.json"
-)
-
 // setupRoutes configures the HTTP routes
 func (s *Server) setupRoutes() {
 	r := chi.NewRouter()
@@ -39,8 +32,6 @@ func (s *Server) setupRoutes() {
 	r.Use(middleware.RequestID)
 	r.Use(RealIPMiddleware(s.trustedProxies))
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
-	// Recoverer answers a panic on a page. JSONValidationMiddleware recovers a
-	// panic on a JSON route itself, so that the answer is JSON with @meta.
 	r.Use(middleware.Recoverer)
 	r.Use(JSONResponseMiddleware)
 	// Timeout must come after JSONResponseMiddleware, which sends its answer
@@ -52,6 +43,11 @@ func (s *Server) setupRoutes() {
 	// Routes
 	r.Get("/", s.handleIndex())
 	r.Get("/status", s.handleStatusHTML())
+	r.Get("/status.json", JSONValidationMiddleware(s.handleStatusJSON()).ServeHTTP)
+	r.Get(
+		"/.well-known/healthcheck.json",
+		JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP,
+	)

 	// AS and prefix detail pages
 	r.Get("/as/{asn}", s.handleASDetail())
@@ -74,21 +70,6 @@ func (s *Server) setupRoutes() {
 		s.writeJSONError(w, http.StatusMethodNotAllowed, methodNotAllowedMessage)
 	}

-	// The status figures and the health check. chi sets one 405 answer for a
-	// whole router. These two routes are on the pages' router, whose 405 stays
-	// chi's own. So each method they do not take is routed to the JSON 405
-	// here.
-	r.Get(statusJSONPath, JSONValidationMiddleware(s.handleStatusJSON()).ServeHTTP)
-	r.Get(healthCheckPath, JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP)
-
-	for _, method := range []string{
-		http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete,
-		http.MethodOptions, http.MethodTrace, http.MethodConnect,
-	} {
-		r.MethodFunc(method, statusJSONPath, jsonMethodNotAllowed)
-		r.MethodFunc(method, healthCheckPath, jsonMethodNotAllowed)
-	}
-
 	// IP info JSON endpoints (replaces old /ip redirect)
 	r.Route("/ip", func(r chi.Router) {
 		r.Use(JSONValidationMiddleware)
@@ -17,7 +17,7 @@ func TestRoutesAnswerHEAD(t *testing.T) {

 	s := newServerWithTestRoutes(t)

-	for _, path := range []string{"/", statusJSONPath, statsPath, "/ip", "/ip/"} {
+	for _, path := range []string{"/", statsPath, "/ip", "/ip/"} {
 		rec := httptest.NewRecorder()
 		s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
 			t.Context(), http.MethodHead, path, nil))
@@ -31,13 +31,10 @@ func TestRoutesAnswerHEAD(t *testing.T) {

 // TestJSONRoutesAnswerUnmatchedRequestsWithJSONErrors sends a method the JSON
 // routes do not take, and a path none of them matches, to each group of JSON
-// routes through the server's router. It also sends a method they do not take
-// to /status.json and the health check. Each must answer with the JSON error
+// routes through the server's router. Each must answer with the JSON error
 // body, and a 405 must name the methods the routes take in its Allow header.
 // Before the fix a 405 said "Internal server error" and a 404 was chi's plain
 // text answer (https://git.eeqj.de/sneak/routewatch/issues/111).
-// /status.json and the health check gave chi's empty 405
-// (https://git.eeqj.de/sneak/routewatch/issues/201).
 func TestJSONRoutesAnswerUnmatchedRequestsWithJSONErrors(t *testing.T) {
 	t.Parallel()

@@ -51,14 +48,6 @@ func TestJSONRoutesAnswerUnmatchedRequestsWithJSONErrors(t *testing.T) {
 	}{
 		{http.MethodPost, statsPath, http.StatusMethodNotAllowed, methodNotAllowedMessage},
 		{http.MethodPost, "/ip/", http.StatusMethodNotAllowed, methodNotAllowedMessage},
-		{
-			http.MethodDelete, statusJSONPath,
-			http.StatusMethodNotAllowed, methodNotAllowedMessage,
-		},
-		{
-			http.MethodOptions, healthCheckPath,
-			http.StatusMethodNotAllowed, methodNotAllowedMessage,
-		},
 		{http.MethodGet, "/api/v1/nothing", http.StatusNotFound, notFoundMessage},
 		{http.MethodGet, "/ip/192.0.2.1/nothing", http.StatusNotFound, notFoundMessage},
 	}
@@ -82,12 +82,6 @@ type Server struct {
 	// cards is the copy of the home page's cards that the pages serve, nil
 	// until the server first works them out
 	cards atomic.Pointer[homeCards]
-
-	// stopCards ends the goroutine that works out the cards, and
-	// cardsStopped is closed once it has returned. Both are nil until Start
-	// starts the goroutine.
-	stopCards    context.CancelFunc
-	cardsStopped chan struct{}
 }

 // New creates a new HTTP server that reads routes from table, the routing
@@ -117,8 +111,7 @@ func New(
 // Start listens on the configured port and serves HTTP in the background.
 // It returns an error if it cannot listen, for example because the port is
 // already in use. ctx bounds opening the port, not serving. Once listening,
-// the server works out the home page's cards every minute until Stop: the end
-// of ctx does not stop it.
+// the server works out the home page's cards every minute until ctx ends.
 func (s *Server) Start(ctx context.Context) error {
 	const (
 		network           = "tcp"
@@ -155,22 +148,16 @@ func (s *Server) Start(ctx context.Context) error {
 		}
 	}()

-	ctx, s.stopCards = context.WithCancel(context.WithoutCancel(ctx))
-	s.cardsStopped = make(chan struct{})
-
 	go func() {
-		defer close(s.cardsStopped)
-
 		s.keepHomeCardsFresh(ctx, homeCardsRefreshInterval)
 	}()

 	return nil
 }

-// Stop stops the goroutine that works out the home page's cards, and waits
-// until it has returned or ctx ends. It then stops the HTTP server. It waits,
-// until ctx ends, for the requests in progress to finish, and then closes the
-// connections of those still running and returns ctx's error.
+// Stop stops the HTTP server. It waits, until ctx ends, for the requests in
+// progress to finish, and then closes the connections of those still running
+// and returns ctx's error.
 func (s *Server) Stop(ctx context.Context) error {
 	if s.srv == nil {
 		return nil
@@ -178,16 +165,6 @@ func (s *Server) Stop(ctx context.Context) error {

 	s.logger.Info("Stopping HTTP server")

-	// Start returns before it starts the goroutine when it cannot listen.
-	if s.stopCards != nil {
-		s.stopCards()
-
-		select {
-		case <-s.cardsStopped:
-		case <-ctx.Done():
-		}
-	}
-
 	err := s.srv.Shutdown(ctx)
 	if err != nil {
 		return errors.Join(err, s.srv.Close())
@@ -714,8 +714,7 @@
                });
        });

-        // IP lookup: show the whole JSON answer, its @meta and an error answer
-        // included, as the IP information API card does.
+        // IP lookup
        document.getElementById('ip-form').addEventListener('submit', function(e) {
            e.preventDefault();
            const ip = document.getElementById('ip-input').value.trim();
@@ -731,11 +730,18 @@

            fetch('/ip/' + encodeURIComponent(ip))
                .then(response => response.json())
-                .then(answer => {
-                    contentEl.className = '';
-                    contentEl.textContent = JSON.stringify(answer, null, 2);
+                .then(response => {
+                    contentEl.classList.remove('loading');
+                    if (response.status === 'error') {
+                        contentEl.className = 'error';
+                        contentEl.textContent = 'Error: ' + response.error.msg;
+                    } else {
+                        contentEl.className = '';
+                        contentEl.textContent = JSON.stringify(response.data, null, 2);
+                    }
                })
                .catch(error => {
+                    contentEl.classList.remove('loading');
                    contentEl.className = 'error';
                    contentEl.textContent = 'Error: ' + error.message;
                });
@@ -166,7 +166,7 @@
                <td>
                    <ul class="origins">
                        {{ range .Origins }}
-                        <li>{{ if .ASN }}<a href="/as/{{ .ASN }}">AS{{ .ASN }}</a>{{ else }}No known origin{{ end }} <span class="peers">{{ .Peers }} {{ if eq .Peers 1 }}peer{{ else }}peers{{ end }}</span></li>
+                        <li>{{ if .ASN }}<a href="/as/{{ .ASN }}">AS{{ .ASN }}</a>{{ else }}No known origin{{ end }} <span class="peers">{{ .Peers }} peers</span></li>
                        {{ end }}
                    </ul>
                </td>
@@ -401,8 +401,6 @@
        const REFRESH_PERIOD_MS = 2000;
        const STALE_AFTER_REFRESHES = 3;
        const MS_PER_SECOND = 1000;
-        const SECONDS_PER_MINUTE = 60;
-        const SECONDS_PER_HOUR = 3600;
        const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
        const SPINNER_COLOURS = ['#e74c3c', '#e67e22', '#f1c40f', '#27ae60', '#3498db', '#9b59b6'];

@@ -445,18 +443,7 @@
        function formatNumber(num) {
            return num.toLocaleString();
        }
-
-        // formatDuration writes a number of seconds in hours, minutes and
-        // seconds, such as "1h 18m 34s" or "18.2s", with at most one decimal.
-        function formatDuration(totalSeconds) {
-            const hours = Math.floor(totalSeconds / SECONDS_PER_HOUR);
-            const minutes = Math.floor(totalSeconds % SECONDS_PER_HOUR / SECONDS_PER_MINUTE);
-            const seconds = parseFloat((totalSeconds % SECONDS_PER_MINUTE).toFixed(1));
-            if (hours > 0) return hours + 'h ' + minutes + 'm ' + seconds + 's';
-            if (minutes > 0) return minutes + 'm ' + seconds + 's';
-            return seconds + 's';
-        }
-
+        
        function formatProcessingTime(ms) {
            if (ms < 0.001) {
                return (ms * 1000).toFixed(0) + ' µs';
@@ -632,13 +619,11 @@
                    noteMessageCount(data.total_messages);

                    // Update all metrics
-                    document.getElementById('uptime').textContent = formatDuration(data.uptime_seconds);
+                    document.getElementById('uptime').textContent = data.uptime;
                    document.getElementById('go_version').textContent = data.go_version;
                    document.getElementById('goroutines').textContent = formatNumber(data.goroutines);
-                    document.getElementById('memory_usage').textContent = formatBytes(data.memory_usage_bytes);
-                    // connection_duration_seconds is null while the stream is not connected.
-                    document.getElementById('connection_duration').textContent =
-                        data.connection_duration_seconds === null ? 'disconnected' : formatDuration(data.connection_duration_seconds);
+                    document.getElementById('memory_usage').textContent = data.memory_usage;
+                    document.getElementById('connection_duration').textContent = data.connection_duration;
                    document.getElementById('reconnect_count').textContent = formatNumber(data.reconnect_count);
                    document.getElementById('total_messages').textContent = formatNumber(data.total_messages);
                    document.getElementById('messages_per_sec').textContent = formatNumber(Math.round(data.messages_per_sec));
@@ -687,7 +672,7 @@
                        const errorsEl = document.getElementById('whois_errors');
                        errorsEl.textContent = formatNumber(data.whois_stats.errors_last_hour);
                        errorsEl.className = 'metric-value' + (data.whois_stats.errors_last_hour > 0 ? ' disconnected' : '');
-                        document.getElementById('whois_interval').textContent = formatDuration(data.whois_stats.current_interval_seconds);
+                        document.getElementById('whois_interval').textContent = data.whois_stats.current_interval;
                    }

                    // Update handler stats