route-update.sh:
- After loading routes, detect and remove routes via gateways that were
  commented out or removed from the gateway file. Previously only stale
  destination IPs were cleaned up, leaving routes via disabled gateways.

route-health.sh:
- For tunnel gateways (ikev2/gre/openconnect/ovpn/xray/amneziawg/cloak/warp),
  require VPN status and iperf3 data — missing data means dead, not skip.
- Use base (v4) tag for VPN/iperf3 lookups on .v6 gateways (they share tunnel).
- Reduce ping query window from 3m to 1m (matches Telegraf 30s interval).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove old parallel gateway check (check_site, _check_one, _find_assets,
_check_throttle) and dead JS SSE handlers (gateway, throttle events).
Both SSE and JSON paths now use the same run_speed_test with identical
gateway order and early-exit logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

All check operations use curl to /dev/null with -w for results,
no temp files or shared state between requests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Browser fires two parallel requests:
- POST /api/check (SSE) — streams gateway availability live
- POST /api/resolve (JSON) — returns IPs, routes, whois independently

No SSE dependency between columns — each loads on its own.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Send initial "check" event immediately (just domain name), then
resolve IPs, find routes, fetch whois and gateway checks all run
in parallel. Each result streams via its own SSE event:
- resolve: IPs + routes
- gateway: per-gateway availability
- whois: domain registration info
- throttle: slow download detection

Eliminates all delay before first visible response.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Split check_site into phases for SSE mode:
1. IPs + routes sent instantly (check event)
2. Each gateway result streamed as it completes (gateway event)
3. Whois streamed when ready (whois event)
4. Throttle results streamed per gateway (throttle event)

This eliminates the 10-18s spinner delay before any results appear.
JSON mode (/api/check without Accept: text/event-stream) unchanged.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Reorder check results: gateways first, then IPs, routes, whois.
Change gateway layout from horizontal badges to vertical list.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When file URL is given, speed test replaces gateway HTTP checks as the
availability indicator — one unified section instead of two separate lists.

Support dual response format: SSE for browsers (Accept: text/event-stream),
JSON for curl/scripts (default). This prevents breaking existing API clients.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace batch speed check with Server-Sent Events. Gateway check
results appear immediately, then speed test results stream in
one by one as each gateway is tested. Colors applied after all
tests complete.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Test gateways one by one in order: igw, dgw, gre.hetzner,
gre.beget, ikev2.hetzner, warp. Stop after two consecutive
successful downloads. Reduces total check time from ~2min to ~15s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mark gateway as SLOW (instead of OK) in accessibility section when
file download speed is less than 10% of the fastest gateway.
Also show speed in the gateway status line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a file URL is entered (e.g. https://xpra.org/src/xpra-6.4.3.tar.xz),
download it via curl through each gateway proxy in parallel and display
speed comparison. Highlights slow gateways (<10% of max) in red and
fast ones (>50% of max) in green.

Also add dark mode CSS support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove check_passwords/ (john the ripper scripts) and nx/get-list.pl
(contains hardcoded DB credentials).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Kernels 6.x output "I/O error, dev sde, sector ..." without the
blk_update_request/end_request prefix. Add this format to the grep
pattern so --list works on modern kernels.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Remove "direct" gateway, use socks5:// proxies for all checks
- Add IPv6 proxy addresses for dual-stack gateway checking
- beget nodes have no IPv6 (proxy_v6=None), correctly shown as NOIP
- Add egw/dgw/igw to sidebar under Маршрутизаторы section
- Sort all sidebar items alphabetically within sections
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Prevents loss of comments and preserves file order.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- route-health.sh: collect per-gateway status (loss, vpn, iperf) into JSON
- route-health.sh: write health.json for web-api consumption
- web-api: add GET /api/health endpoint serving health.json
- web-api: add POST/GET /api/googlevideo for CDN pattern management
- web-api: add health status sidebar with auto-refresh (30s)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add POST/GET /api/googlevideo endpoints for pattern management
- Add collect-googlevideo.sh daemon (tails BIND query log for CDN domains)
- Normalizes rr3---sn-XXX.googlevideo.com to rr[1-8]---sn-XXX pattern
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- route-update.sh: add flock to prevent concurrent runs
- route-update.sh: measure and save execution duration
- route-web-api.py: skip IPv6 checks for domains without AAAA (NOIP)
- route-web-api.py: move "Проверить" button first, add Enter key handler
- route-web-api.py: show update duration in status bar
- route-web-api.py: expose duration in /api/status
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Volatile detection:
- Remove single-record restriction (count<=1) that missed multi-record
  domains like youtube.com with 4 rotating AAAA records
- Add diff-resolvers check: domain is volatile if local and extra DNS
  return different IPs (catches cached TTL > threshold cases)
- expand_volatile_subnets now also processes domains with accumulated
  volatile_ips from prior runs, not only current volatile_domains
  (fixes race where cached TTL > threshold causes empty volatile_domains
  but IPs were already collected)

IP validation:
- Validate resolved IPs with python3 ipaddress before ip-batch loading
- Filter out invalid entries (e.g. malformed IPv6) with WARNING log
- Prevents ip-batch failures from corrupting route tables
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace grep '[g-zG-Z]' with list_has_domains() that filters out
IPv4 (digits/dots/slashes) and IPv6 (hex/colons/slashes) patterns,
then checks if anything remains. This correctly handles IPv6 IP-only
lists where hex digits a-f caused false positive domain detection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

[a-zA-Z] matches hex digits a-f in IPv6 addresses, causing IP-only
lists like antifilter-ip6 (127k entries) to be treated as domain lists.
This triggered useless history merge (sort -u on ~2.5M lines = 77 min)
and DNS resolution attempts. Use [g-zG-Z] instead, which correctly
distinguishes domain names from IPv6 hex notation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Resolve history accumulation (20 snapshots + sort -u) is only useful
for domain lists where DNS round-robin returns different IPs each time.
For IP/subnet-only lists (like antifilter-ip6 with 127k entries),
every snapshot is identical, making the merge a waste of ~77 minutes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

detect_volatile_domains() and expand_volatile_subnets() now run dig
queries in parallel (10 concurrent) via temp script + xargs -P.
Reduces wall time from ~3min to ~20sec for lists with 200+ domains
(telegram 135 + whatsapp 69).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Volatile domain detection (short TTL, single record) was IPv4-only.
Now works for both A and AAAA records. For IPv6 volatile domains
(e.g. Akamai CDN rotation), computes covering /48+ subnets from
accumulated IPs across runs, so new rotated IPs hit the bypass route
instead of default gateway.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Shows what users actually get from the office via policy routing,
without going through any SOCKS5 proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fetch HTML once to find asset URLs, then download the asset through
every gateway in parallel. Show SLOW badge on each throttled gateway.
Throttle details section lists all affected gateways with sizes/times.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Override dgw gateway status from OK to SLOW in the badge when
TSPU throttling is detected. Tooltip shows asset name, size and time.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Download the HTML page via dgw, parse CSS/JS asset URLs, and try
downloading them. If an asset stalls at ~16KB after timeout — report
as TSPU throttling (typical TCP initial window cutoff signature).
Runs in parallel with existing gateway checks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Protect read-modify-write cycles in handle_add/remove/move and
consistent reads in /api/list with _list_lock to prevent data loss
when multiple users modify lists simultaneously.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Replace per-entry move/remove buttons with single dropdown button (⇄)
- Add context menu on right-click (check, move, remove)
- Move "remove" into dropdown/context menu as last item (red)
- Keep "?" check button inline for quick access
- Add CSS spinner animation on check result block during loading
- Show check result block immediately with domain name and spinner
- Align sidebar IPs with flexbox columns
- Reduce button padding for compact 3-column layout
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add third list "geo" (web-geo.list) for geo-blocked domains routed via gre
- Add warp gateway to CHECK_GATEWAYS for site availability checks
- Add left sidebar with all egw/ogw proxy servers (17 egw + 4 ogw)
- Replace "Без правила" button with "Geo (gre)" button
- Update makeEntry() to show two move buttons per entry (to other two lists)
- Update OpenAPI spec with geo mode in all endpoints
- Update documentation with web-geo.list and gre symlinks
- Widen layout from 900px to 1300px for sidebar + 3 columns
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>