Volatile detection:
- Remove single-record restriction (count<=1) that missed multi-record
  domains like youtube.com with 4 rotating AAAA records
- Add diff-resolvers check: domain is volatile if local and extra DNS
  return different IPs (catches cached TTL > threshold cases)
- expand_volatile_subnets now also processes domains with accumulated
  volatile_ips from prior runs, not only current volatile_domains
  (fixes race where cached TTL > threshold causes empty volatile_domains
  but IPs were already collected)

IP validation:
- Validate resolved IPs with python3 ipaddress before ip-batch loading
- Filter out invalid entries (e.g. malformed IPv6) with WARNING log
- Prevents ip-batch failures from corrupting route tables
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace grep '[g-zG-Z]' with list_has_domains() that filters out
IPv4 (digits/dots/slashes) and IPv6 (hex/colons/slashes) patterns,
then checks if anything remains. This correctly handles IPv6 IP-only
lists where hex digits a-f caused false positive domain detection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

[a-zA-Z] matches hex digits a-f in IPv6 addresses, causing IP-only
lists like antifilter-ip6 (127k entries) to be treated as domain lists.
This triggered useless history merge (sort -u on ~2.5M lines = 77 min)
and DNS resolution attempts. Use [g-zG-Z] instead, which correctly
distinguishes domain names from IPv6 hex notation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Resolve history accumulation (20 snapshots + sort -u) is only useful
for domain lists where DNS round-robin returns different IPs each time.
For IP/subnet-only lists (like antifilter-ip6 with 127k entries),
every snapshot is identical, making the merge a waste of ~77 minutes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

detect_volatile_domains() and expand_volatile_subnets() now run dig
queries in parallel (10 concurrent) via temp script + xargs -P.
Reduces wall time from ~3min to ~20sec for lists with 200+ domains
(telegram 135 + whatsapp 69).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Volatile domain detection (short TTL, single record) was IPv4-only.
Now works for both A and AAAA records. For IPv6 volatile domains
(e.g. Akamai CDN rotation), computes covering /48+ subnets from
accumulated IPs across runs, so new rotated IPs hit the bypass route
instead of default gateway.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Shows what users actually get from the office via policy routing,
without going through any SOCKS5 proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fetch HTML once to find asset URLs, then download the asset through
every gateway in parallel. Show SLOW badge on each throttled gateway.
Throttle details section lists all affected gateways with sizes/times.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Override dgw gateway status from OK to SLOW in the badge when
TSPU throttling is detected. Tooltip shows asset name, size and time.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Download the HTML page via dgw, parse CSS/JS asset URLs, and try
downloading them. If an asset stalls at ~16KB after timeout — report
as TSPU throttling (typical TCP initial window cutoff signature).
Runs in parallel with existing gateway checks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Protect read-modify-write cycles in handle_add/remove/move and
consistent reads in /api/list with _list_lock to prevent data loss
when multiple users modify lists simultaneously.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Replace per-entry move/remove buttons with single dropdown button (⇄)
- Add context menu on right-click (check, move, remove)
- Move "remove" into dropdown/context menu as last item (red)
- Keep "?" check button inline for quick access
- Add CSS spinner animation on check result block during loading
- Show check result block immediately with domain name and spinner
- Align sidebar IPs with flexbox columns
- Reduce button padding for compact 3-column layout
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add third list "geo" (web-geo.list) for geo-blocked domains routed via gre
- Add warp gateway to CHECK_GATEWAYS for site availability checks
- Add left sidebar with all egw/ogw proxy servers (17 egw + 4 ogw)
- Replace "Без правила" button with "Geo (gre)" button
- Update makeEntry() to show two move buttons per entry (to other two lists)
- Update OpenAPI spec with geo mode in all endpoints
- Update documentation with web-geo.list and gre symlinks
- Widen layout from 900px to 1300px for sidebar + 3 columns
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Helps accumulate more DNS round-robin IPs over time.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Filter out invalid entries after DNS resolve:
- IPv4: validate format and octet range (0-255)
- IPv6: validate hex:colon format
- Log WARNING when garbage entries are filtered

Prevents broken IPs like 1886.110.224.97 from entering routing tables.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

route-health.sh creates gw-* state directories for per-gateway health
tracking inside .state/routes.d/GROUP/. route-update.sh was incorrectly
treating them as orphaned list-state and deleting them every run.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

New container cloned from xray.hetzner, traffic routed via gre.beget
to Cloudflare WARP. Exit via Cloudflare PoP (ARN Stockholm).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Flush routes per dead gateway instead of waiting for entire group to die
- Add iperf3 bandwidth (success=0 → dead) as third health signal
- Ping threshold: >=50% loss is now dead (was 100%)
- State tracking per gateway (.state/GROUP/gw-TAG/)
- GRE detection: use link UP instead of RX bytes delta (fixes false
  disconnected status on idle tunnels)
- Timer interval: 20s (was 1min)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Query vpn_status (connected=0/1) alongside ping data. If VPN tunnel
is reported disconnected, gateway is immediately marked dead without
waiting for ping loss to accumulate. VPN status is checked with 1m
window (vs 3m for ping) since it updates every 10s.

Shows vpn=DOWN marker in --show output for affected gateways.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Auto-detects VPN type and reports status to InfluxDB via Telegraf exec:
- IKEv2/strongSwan: swanctl or ipsec* interface + RX bytes
- OpenVPN: process + tun0 interface
- GRE: gre1 interface + RX bytes changing
- OpenConnect: process + vpns/tun interface
- Xray: process + SOCKS port listening
- AmneziaWG/WireGuard: interface + recent handshake

Deployed to all 11 egw/ogw containers with Telegraf integration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Check domain accessibility through all gateways via SOCKS5 in parallel
- Resolve domain IPs (v4+v6) and find matches in active route lists
- Distinguish proxy errors (PROXY?) from site blocks (BLOCK)
- Show whois summary (registrar, org, dates, nameservers)
- Add per-entry check button in bypass/direct lists
- Rate-limit: one check at a time (threading.Lock)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Switch bandwidth source from net.bytes_recv (current traffic) to
iperf3.recv_bps (tunnel throughput). Add gre.vdska gateway (91.232.225.127).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rename gre.beget/ikev2.beget to gre.beget.ogw/ikev2.beget.ogw to match
telegraf gateway names. Add /api/bandwidth endpoint querying InfluxDB
for 30-min average throughput. Display as first table row.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add --json FILE option to check-blocked.sh for machine-readable output.
Add check-blocked-web.py: minimal web server displaying results as a
color-coded HTML table with auto-refresh every 5 min.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Use eget --get-response to get HTTP status code when --check-url fails.
Shows HTTP403 (Cloudflare challenge) vs BLOCK (no connection).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Tests site availability and download speed through different egw/ogw
gateways via their SOCKS5 proxies. Uses eget --check-url and --speedtest.
Default sites: instagram.com, facebook.com, youtube.com, rutracker.org,
flibusta.is. Gateway list is easily extensible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

New GET /api/status returns:
- updated: last apply timestamp
- pending: true if list files modified since last apply
- remaining: seconds until next route-update cycle

JS countdown now uses /api/status (lighter than /api/active) and shows
different messages depending on whether there are pending changes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Show exact remaining time until next route-update.sh run (every 5 min)
with a live JS countdown, instead of static "в течение 5 минут" text.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace the full active routes listing with a lightweight timestamp
fetched from /api/active, shown inline in the footer note.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add OpenAPI 3.0 spec (OPENAPI_SPEC) describing all API endpoints
- Add /swagger page with Swagger UI loaded from CDN (unpkg.com)
- Add /api/openapi.json endpoint serving the spec
- Add "API docs" link on the main page
- Use ThreadingHTTPServer for concurrent requests
- Document Swagger UI in route-web-api.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Python web API (route-web-api.py) on port 80 for adding domains to
egw bypass or dgw direct lists. Runs as unprivileged routeweb user,
list files are picked up by route-update.sh via symlinks.

Features:
- Add/remove/move domains between bypass and direct lists
- Auto-remove from other list when adding (mutual exclusion)
- "No rule" button to remove from input field
- Active routes section showing all applied rules from route-update
- Last update timestamp from all-routes.json mtime

route-update.sh: generate_web_json() exports all list entries
as JSON for the web UI after each run.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ip rule show format is "PREF:\tfrom ... lookup TABLE", not "... pref PREF".
The awk was looking for a "pref"/"priority" field that doesn't exist, so
old rules were never removed and new prefs were never applied.

Also fix grep -c/-q "lookup TABLE" to use -w (word boundary) to prevent
"lookup 2" from matching "lookup 200".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Pref was calculated as table_number × 10, meaning moving a .list between
groups didn't change its priority. Now pref is assigned sequentially by
group/list processing order (base=1000, group_step=100, list_step=10).

Also improves cleanup_state to detect .list files moved between groups —
only removes old state dir without flushing the shared routing table.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>