fix route-health: bulk route flush + wider health window

router/route-health.sh

@@ -47,12 +47,12 @@ trap 'rm -f "$HEALTH_DATA" "$VPN_DATA" "$IPERF_DATA" "$PROXY_DATA"' EXIT
 
 response=$(curl -sG "$INFLUXDB_URL" \
     --data-urlencode "db=$INFLUXDB_DB" \
-    --data-urlencode "q=SELECT last(percent_packet_loss) FROM ping WHERE time > now() - 1m GROUP BY gateway" \
+    --data-urlencode "q=SELECT last(percent_packet_loss) FROM ping WHERE time > now() - 3m GROUP BY gateway" \
     --max-time 5 2>/dev/null)
 
 vpn_response=$(curl -sG "$INFLUXDB_URL" \
     --data-urlencode "db=$INFLUXDB_DB" \
-    --data-urlencode "q=SELECT last(connected) FROM vpn_status WHERE time > now() - 1m GROUP BY gateway" \
+    --data-urlencode "q=SELECT last(connected) FROM vpn_status WHERE time > now() - 3m GROUP BY gateway" \
     --max-time 5 2>/dev/null)
 
 iperf_response=$(curl -sG "$INFLUXDB_URL" \
@@ -279,11 +279,14 @@ flush_gw_routes()
         [ -d "$list_state" ] || continue
         [ -f "$list_state/table" ] || continue
         local t ; read -r t < "$list_state/table"
-        # TODO: routes are deleted one-by-one in a loop; consider separate
-        # tables per gateway so flush_gw_routes becomes a single "ip route flush table"
-        $ipcmd route show table "$t" 2>/dev/null | grep "via $dead_gw" | while read -r route ; do
-            $ipcmd route del $route table "$t" 2>/dev/null
-        done
+        # Bulk-remove only this gateway's routes from the shared table.
+        # Same idiom route-update.sh uses for stale-gateway cleanup (a single
+        # "ip route flush table T via GW"), not a per-route delete loop — the
+        # loop was O(n) over 120k+ routes and hung the service via netlink
+        # contention. Verified on igw: "ip -6 route show table 202 via <gw>"
+        # selects exactly that gateway's routes (same count as grep "via <gw>");
+        # a different gateway returns 0 (it filters, not a full-table dump).
+        timeout 60 $ipcmd route flush table "$t" via "$dead_gw" 2>/dev/null
     done
 }