detect_volatile_domains() was resolving every domain via dig on each run,
which took 30+ minutes for large lists (e.g. 2097 whatsapp domains).

Cache domains confirmed as non-volatile (stable TTL, same IPs from
different resolvers) and skip them on subsequent runs. Cache expires
after 7 days and is ignored with --force.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Tool to read, parse, modify and write ZFS vdev labels.
Allows recovering a detached disk back into a mirror
by copying labels between devices.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- route-health.sh: query net_response from InfluxDB for SOCKS5 proxy
  status, include per-gateway proxy field and global proxy map in
  health.json
- route-web-api.py: add proxy-dot indicators in egw/ogw/routers
  sidebar sections, updated from health.json proxy data
- Telegraf net_response on telegraf CT (682) checks port 1080 on all
  gateway IPs every 30s
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Check TCP connectivity to port 1080 on each gateway IP.
Result is included as "proxy":true/false in health.json
for web UI display.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Instead of showing separate egw and egw.v6 groups in health JSON,
merge v6 gateways into the corresponding v4 group for cleaner
web UI display.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warp gateway uses Cloudflare speedtest instead of iperf3 (no iperf3
server on Cloudflare side). Skip iperf3 check for warp tag to avoid
false dead status.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Process route groups in parallel using background subshells.
Each group runs independently with its own pref base computed
from the group's alphabetical index. Table allocation in
/etc/iproute2/rt_tables is protected by flock to prevent races.

On local-test with 3 groups: 163% CPU utilization confirms
parallel execution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

route-update.sh:
- After loading routes, detect and remove routes via gateways that were
  commented out or removed from the gateway file. Previously only stale
  destination IPs were cleaned up, leaving routes via disabled gateways.

route-health.sh:
- For tunnel gateways (ikev2/gre/openconnect/ovpn/xray/amneziawg/cloak/warp),
  require VPN status and iperf3 data — missing data means dead, not skip.
- Use base (v4) tag for VPN/iperf3 lookups on .v6 gateways (they share tunnel).
- Reduce ping query window from 3m to 1m (matches Telegraf 30s interval).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove old parallel gateway check (check_site, _check_one, _find_assets,
_check_throttle) and dead JS SSE handlers (gateway, throttle events).
Both SSE and JSON paths now use the same run_speed_test with identical
gateway order and early-exit logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

All check operations use curl to /dev/null with -w for results,
no temp files or shared state between requests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Browser fires two parallel requests:
- POST /api/check (SSE) — streams gateway availability live
- POST /api/resolve (JSON) — returns IPs, routes, whois independently

No SSE dependency between columns — each loads on its own.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Send initial "check" event immediately (just domain name), then
resolve IPs, find routes, fetch whois and gateway checks all run
in parallel. Each result streams via its own SSE event:
- resolve: IPs + routes
- gateway: per-gateway availability
- whois: domain registration info
- throttle: slow download detection

Eliminates all delay before first visible response.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Split check_site into phases for SSE mode:
1. IPs + routes sent instantly (check event)
2. Each gateway result streamed as it completes (gateway event)
3. Whois streamed when ready (whois event)
4. Throttle results streamed per gateway (throttle event)

This eliminates the 10-18s spinner delay before any results appear.
JSON mode (/api/check without Accept: text/event-stream) unchanged.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Reorder check results: gateways first, then IPs, routes, whois.
Change gateway layout from horizontal badges to vertical list.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When file URL is given, speed test replaces gateway HTTP checks as the
availability indicator — one unified section instead of two separate lists.

Support dual response format: SSE for browsers (Accept: text/event-stream),
JSON for curl/scripts (default). This prevents breaking existing API clients.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace batch speed check with Server-Sent Events. Gateway check
results appear immediately, then speed test results stream in
one by one as each gateway is tested. Colors applied after all
tests complete.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Test gateways one by one in order: igw, dgw, gre.hetzner,
gre.beget, ikev2.hetzner, warp. Stop after two consecutive
successful downloads. Reduces total check time from ~2min to ~15s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mark gateway as SLOW (instead of OK) in accessibility section when
file download speed is less than 10% of the fastest gateway.
Also show speed in the gateway status line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a file URL is entered (e.g. https://xpra.org/src/xpra-6.4.3.tar.xz),
download it via curl through each gateway proxy in parallel and display
speed comparison. Highlights slow gateways (<10% of max) in red and
fast ones (>50% of max) in green.

Also add dark mode CSS support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove check_passwords/ (john the ripper scripts) and nx/get-list.pl
(contains hardcoded DB credentials).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Kernels 6.x output "I/O error, dev sde, sector ..." without the
blk_update_request/end_request prefix. Add this format to the grep
pattern so --list works on modern kernels.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Remove "direct" gateway, use socks5:// proxies for all checks
- Add IPv6 proxy addresses for dual-stack gateway checking
- beget nodes have no IPv6 (proxy_v6=None), correctly shown as NOIP
- Add egw/dgw/igw to sidebar under Маршрутизаторы section
- Sort all sidebar items alphabetically within sections
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Prevents loss of comments and preserves file order.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- route-health.sh: collect per-gateway status (loss, vpn, iperf) into JSON
- route-health.sh: write health.json for web-api consumption
- web-api: add GET /api/health endpoint serving health.json
- web-api: add POST/GET /api/googlevideo for CDN pattern management
- web-api: add health status sidebar with auto-refresh (30s)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add POST/GET /api/googlevideo endpoints for pattern management
- Add collect-googlevideo.sh daemon (tails BIND query log for CDN domains)
- Normalizes rr3---sn-XXX.googlevideo.com to rr[1-8]---sn-XXX pattern
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- route-update.sh: add flock to prevent concurrent runs
- route-update.sh: measure and save execution duration
- route-web-api.py: skip IPv6 checks for domains without AAAA (NOIP)
- route-web-api.py: move "Проверить" button first, add Enter key handler
- route-web-api.py: show update duration in status bar
- route-web-api.py: expose duration in /api/status
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Volatile detection:
- Remove single-record restriction (count<=1) that missed multi-record
  domains like youtube.com with 4 rotating AAAA records
- Add diff-resolvers check: domain is volatile if local and extra DNS
  return different IPs (catches cached TTL > threshold cases)
- expand_volatile_subnets now also processes domains with accumulated
  volatile_ips from prior runs, not only current volatile_domains
  (fixes race where cached TTL > threshold causes empty volatile_domains
  but IPs were already collected)

IP validation:
- Validate resolved IPs with python3 ipaddress before ip-batch loading
- Filter out invalid entries (e.g. malformed IPv6) with WARNING log
- Prevents ip-batch failures from corrupting route tables
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace grep '[g-zG-Z]' with list_has_domains() that filters out
IPv4 (digits/dots/slashes) and IPv6 (hex/colons/slashes) patterns,
then checks if anything remains. This correctly handles IPv6 IP-only
lists where hex digits a-f caused false positive domain detection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

[a-zA-Z] matches hex digits a-f in IPv6 addresses, causing IP-only
lists like antifilter-ip6 (127k entries) to be treated as domain lists.
This triggered useless history merge (sort -u on ~2.5M lines = 77 min)
and DNS resolution attempts. Use [g-zG-Z] instead, which correctly
distinguishes domain names from IPv6 hex notation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Resolve history accumulation (20 snapshots + sort -u) is only useful
for domain lists where DNS round-robin returns different IPs each time.
For IP/subnet-only lists (like antifilter-ip6 with 127k entries),
every snapshot is identical, making the merge a waste of ~77 minutes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

detect_volatile_domains() and expand_volatile_subnets() now run dig
queries in parallel (10 concurrent) via temp script + xargs -P.
Reduces wall time from ~3min to ~20sec for lists with 200+ domains
(telegram 135 + whatsapp 69).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Volatile domain detection (short TTL, single record) was IPv4-only.
Now works for both A and AAAA records. For IPv6 volatile domains
(e.g. Akamai CDN rotation), computes covering /48+ subnets from
accumulated IPs across runs, so new rotated IPs hit the bypass route
instead of default gateway.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>