Harden resolver and expand traffic runtime controls

selective-vpn-api/app/routes_update.go

@@ -189,6 +189,13 @@ func routesUpdate(iface string) cmdResult {
 	bases := loadList(domainDir + "/bases.txt")
 	subs := loadList(domainDir + "/subs.txt")
 	wildcards := loadSmartDNSWildcardDomains(logp)
+	wildcardBaseSet := make(map[string]struct{}, len(wildcards))
+	for _, d := range wildcards {
+		d = strings.TrimSpace(d)
+		if d != "" {
+			wildcardBaseSet[d] = struct{}{}
+		}
+	}
 	wildcardBasesAdded := 0
 	for _, d := range wildcards {
 		d = strings.TrimSpace(d)
@@ -212,7 +219,10 @@ func routesUpdate(iface string) cmdResult {
 	twitterAdded := 0
 	for _, d := range bases {
 		domainSet[d] = struct{}{}
-		if !isGoogleLike(d) {
+		_, wildcardBase := wildcardBaseSet[d]
+		// Wildcard bases are now resolved "as-is" (no subs fan-out) to keep
+		// SmartDNS wildcard behavior transparent and avoid synthetic host noise.
+		if !wildcardBase && !isGoogleLike(d) {
 			limit := len(subs)
 			if subsPerBaseLimit > 0 && subsPerBaseLimit < limit {
 				limit = subsPerBaseLimit
@@ -258,6 +268,14 @@ func routesUpdate(iface string) cmdResult {
 	)
 	if wildcardBasesAdded > 0 {
 		logp("domains wildcard seed added: %d base domains from smartdns.conf state", wildcardBasesAdded)
+		appendTraceLineTo(
+			smartdnsLogPath,
+			"smartdns",
+			fmt.Sprintf(
+				"wildcard plan: base_domains=%d sub_expanded=0 (routes update uses pure wildcard bases; subs fan-out only in aggressive prewarm)",
+				wildcardBasesAdded,
+			),
+		)
 	}
 
 	domTmp, _ := os.CreateTemp(stateDir, "domains-*.txt")
@@ -612,19 +630,27 @@ func logWildcardSmartDNSTrace(mode DNSMode, source string, pairs [][2]string, wi
 	}
 	sort.Strings(hosts)
 
+	const maxHostsLog = 200
+	omitted := 0
+	if len(hosts) > maxHostsLog {
+		omitted = len(hosts) - maxHostsLog
+	}
+
 	appendTraceLineTo(
 		smartdnsLogPath,
 		"smartdns",
-		fmt.Sprintf("wildcard sync: mode=%s source=%s domains=%d ips=%d", mode.Mode, source, len(hosts), wildcardIPCount),
+		fmt.Sprintf(
+			"wildcard sync: mode=%s source=%s domains=%d ips=%d logged=%d omitted=%d map=%s",
+			mode.Mode, source, len(hosts), wildcardIPCount, len(hosts)-omitted, omitted, lastIPsMapDyn,
+		),
 	)
 
-	const maxHostsLog = 200
 	for i, host := range hosts {
 		if i >= maxHostsLog {
 			appendTraceLineTo(
 				smartdnsLogPath,
 				"smartdns",
-				fmt.Sprintf("wildcard sync: +%d domains omitted", len(hosts)-maxHostsLog),
+				fmt.Sprintf("wildcard sync: trace truncated, %d domains not shown (see %s)", omitted, lastIPsMapDyn),
 			)
 			return
 		}