package app

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"hash/fnv"
	"net"
	"net/netip"
	"os"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"time"
)

// ---------------------------------------------------------------------
// Go resolver
// ---------------------------------------------------------------------

// EN: Go-based domain resolver pipeline used by routes update.
// EN: Handles cache reuse, concurrent DNS lookups, PTR labeling for static entries,
// EN: and returns deduplicated IP sets plus IP-to-label mapping artifacts.
// RU: Go-резолвер, используемый пайплайном обновления маршрутов.
// RU: Обрабатывает кэш, конкурентные DNS-запросы, PTR-лейблы для static entries
// RU: и возвращает дедуплицированный список IP и IP-to-label mapping.

type dnsErrorKind string

const (
	dnsErrorNXDomain  dnsErrorKind = "nxdomain"
	dnsErrorTimeout   dnsErrorKind = "timeout"
	dnsErrorTemporary dnsErrorKind = "temporary"
	dnsErrorOther     dnsErrorKind = "other"
)

type dnsUpstreamMetrics struct {
	Attempts  int
	OK        int
	NXDomain  int
	Timeout   int
	Temporary int
	Other     int
}

type dnsMetrics struct {
	Attempts  int
	OK        int
	NXDomain  int
	Timeout   int
	Temporary int
	Other     int

	PerUpstream map[string]*dnsUpstreamMetrics
}

func (m *dnsMetrics) ensureUpstream(upstream string) *dnsUpstreamMetrics {
	if m.PerUpstream == nil {
		m.PerUpstream = map[string]*dnsUpstreamMetrics{}
	}
	if us, ok := m.PerUpstream[upstream]; ok {
		return us
	}
	us := &dnsUpstreamMetrics{}
	m.PerUpstream[upstream] = us
	return us
}

func (m *dnsMetrics) addSuccess(upstream string) {
	m.Attempts++
	m.OK++
	us := m.ensureUpstream(upstream)
	us.Attempts++
	us.OK++
}

func (m *dnsMetrics) addError(upstream string, kind dnsErrorKind) {
	m.Attempts++
	us := m.ensureUpstream(upstream)
	us.Attempts++
	switch kind {
	case dnsErrorNXDomain:
		m.NXDomain++
		us.NXDomain++
	case dnsErrorTimeout:
		m.Timeout++
		us.Timeout++
	case dnsErrorTemporary:
		m.Temporary++
		us.Temporary++
	default:
		m.Other++
		us.Other++
	}
}

func (m *dnsMetrics) merge(other dnsMetrics) {
	m.Attempts += other.Attempts
	m.OK += other.OK
	m.NXDomain += other.NXDomain
	m.Timeout += other.Timeout
	m.Temporary += other.Temporary
	m.Other += other.Other

	for upstream, src := range other.PerUpstream {
		dst := m.ensureUpstream(upstream)
		dst.Attempts += src.Attempts
		dst.OK += src.OK
		dst.NXDomain += src.NXDomain
		dst.Timeout += src.Timeout
		dst.Temporary += src.Temporary
		dst.Other += src.Other
	}
}

func (m dnsMetrics) totalErrors() int {
	return m.NXDomain + m.Timeout + m.Temporary + m.Other
}

func (m dnsMetrics) formatPerUpstream() string {
	if len(m.PerUpstream) == 0 {
		return ""
	}
	keys := make([]string, 0, len(m.PerUpstream))
	for k := range m.PerUpstream {
		keys = append(keys, k)
	}
	sort.Strings(keys)
	parts := make([]string, 0, len(keys))
	for _, k := range keys {
		v := m.PerUpstream[k]
		parts = append(parts, fmt.Sprintf("%s{attempts=%d ok=%d nxdomain=%d timeout=%d temporary=%d other=%d}", k, v.Attempts, v.OK, v.NXDomain, v.Timeout, v.Temporary, v.Other))
	}
	return strings.Join(parts, "; ")
}

func (m dnsMetrics) formatResolverHealth() string {
	if len(m.PerUpstream) == 0 {
		return ""
	}
	keys := make([]string, 0, len(m.PerUpstream))
	for k := range m.PerUpstream {
		keys = append(keys, k)
	}
	sort.Strings(keys)
	parts := make([]string, 0, len(keys))
	for _, k := range keys {
		v := m.PerUpstream[k]
		if v == nil || v.Attempts <= 0 {
			continue
		}
		okRate := float64(v.OK) / float64(v.Attempts)
		timeoutRate := float64(v.Timeout) / float64(v.Attempts)
		score := okRate*100.0 - timeoutRate*50.0
		state := "bad"
		switch {
		case score >= 70 && timeoutRate <= 0.05:
			state = "good"
		case score >= 35:
			state = "degraded"
		default:
			state = "bad"
		}
		parts = append(parts, fmt.Sprintf("%s{score=%.1f state=%s attempts=%d ok=%d timeout=%d nxdomain=%d temporary=%d other=%d}", k, score, state, v.Attempts, v.OK, v.Timeout, v.NXDomain, v.Temporary, v.Other))
	}
	return strings.Join(parts, "; ")
}

type wildcardMatcher struct {
	exact  map[string]struct{}
	suffix []string
}

type dnsAttemptPolicy struct {
	TryLimit     int
	DomainBudget time.Duration
	StopOnNX     bool
}

const (
	domainStateActive       = "active"
	domainStateStable       = "stable"
	domainStateSuspect      = "suspect"
	domainStateQuarantine   = "quarantine"
	domainStateHardQuar     = "hard_quarantine"
	domainScoreMin          = -100
	domainScoreMax          = 100
	defaultQuarantineTTL    = 24 * 3600
	defaultHardQuarantineTT = 7 * 24 * 3600
)

type resolverTimeoutRecheckStats struct {
	Checked      int
	Recovered    int
	RecoveredIPs int
	StillTimeout int
	NowNXDomain  int
	NowTemporary int
	NowOther     int
	NoSignal     int
}

// Empty by default: primary resolver pool comes from DNS upstream pool state.
// Optional fallback list can still be provided via RESOLVE_DNS_FALLBACKS env.
var resolverFallbackDNS []string

func normalizeWildcardDomain(raw string) string {
	d := strings.TrimSpace(strings.SplitN(raw, "#", 2)[0])
	d = strings.ToLower(d)
	d = strings.TrimPrefix(d, "*.")
	d = strings.TrimPrefix(d, ".")
	d = strings.TrimSuffix(d, ".")
	return d
}

func newWildcardMatcher(domains []string) wildcardMatcher {
	seen := map[string]struct{}{}
	m := wildcardMatcher{exact: map[string]struct{}{}}
	for _, raw := range domains {
		d := normalizeWildcardDomain(raw)
		if d == "" {
			continue
		}
		if _, ok := seen[d]; ok {
			continue
		}
		seen[d] = struct{}{}
		m.exact[d] = struct{}{}
		m.suffix = append(m.suffix, "."+d)
	}
	return m
}

func (m wildcardMatcher) match(host string) bool {
	if len(m.exact) == 0 {
		return false
	}
	h := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(host)), ".")
	if h == "" {
		return false
	}
	if _, ok := m.exact[h]; ok {
		return true
	}
	for _, suffix := range m.suffix {
		if strings.HasSuffix(h, suffix) {
			return true
		}
	}
	return false
}

// ---------------------------------------------------------------------
// EN: `runResolverJob` runs the workflow for resolver job.
// RU: `runResolverJob` - запускает рабочий процесс для resolver job.
// ---------------------------------------------------------------------
func runResolverJob(opts ResolverOpts, logf func(string, ...any)) (resolverResult, error) {
	res := resolverResult{
		DomainCache: map[string]any{},
		PtrCache:    map[string]any{},
	}

	domains := loadList(opts.DomainsPath)
	metaSpecial := loadList(opts.MetaPath)
	staticLines := readLinesAllowMissing(opts.StaticPath)
	wildcards := newWildcardMatcher(opts.SmartDNSWildcards)

	cfg := loadDNSConfig(opts.DNSConfigPath, logf)
	if !smartDNSForced() {
		cfg.Mode = normalizeDNSResolverMode(opts.Mode, opts.ViaSmartDNS)
	}
	if addr := normalizeSmartDNSAddr(opts.SmartDNSAddr); addr != "" {
		cfg.SmartDNS = addr
	}
	if cfg.SmartDNS == "" {
		cfg.SmartDNS = smartDNSAddr()
	}
	if cfg.Mode == DNSModeSmartDNS && cfg.SmartDNS != "" {
		cfg.Default = []string{cfg.SmartDNS}
		cfg.Meta = []string{cfg.SmartDNS}
	}
	if logf != nil {
		switch cfg.Mode {
		case DNSModeSmartDNS:
			logf("resolver dns mode: SmartDNS-only (%s)", cfg.SmartDNS)
		case DNSModeHybridWildcard:
			logf("resolver dns mode: hybrid_wildcard smartdns=%s wildcards=%d default=%v meta=%v", cfg.SmartDNS, len(wildcards.exact), cfg.Default, cfg.Meta)
		default:
			logf("resolver dns mode: direct default=%v meta=%v", cfg.Default, cfg.Meta)
		}
	}

	ttl := opts.TTL
	if ttl <= 0 {
		ttl = 24 * 3600
	}
	// safety clamp: 60s .. 24h
	if ttl < 60 {
		ttl = 60
	}
	if ttl > 24*3600 {
		ttl = 24 * 3600
	}
	workers := opts.Workers
	if workers <= 0 {
		workers = 80
	}
	// safety clamp: 1..500
	if workers < 1 {
		workers = 1
	}
	if workers > 500 {
		workers = 500
	}
	dnsTimeoutMs := envInt("RESOLVE_DNS_TIMEOUT_MS", 1800)
	if dnsTimeoutMs < 300 {
		dnsTimeoutMs = 300
	}
	if dnsTimeoutMs > 5000 {
		dnsTimeoutMs = 5000
	}
	dnsTimeout := time.Duration(dnsTimeoutMs) * time.Millisecond

	domainCache := loadDomainCacheState(opts.CachePath, logf)
	ptrCache := loadJSONMap(opts.PtrCachePath)
	now := int(time.Now().Unix())
	precheckEverySec := envInt("RESOLVE_PRECHECK_EVERY_SEC", 24*3600)
	if precheckEverySec < 0 {
		precheckEverySec = 0
	}
	precheckMaxDomains := envInt("RESOLVE_PRECHECK_MAX_DOMAINS", 3000)
	if precheckMaxDomains < 0 {
		precheckMaxDomains = 0
	}
	if precheckMaxDomains > 50000 {
		precheckMaxDomains = 50000
	}
	timeoutRecheckMax := envInt("RESOLVE_TIMEOUT_RECHECK_MAX", precheckMaxDomains)
	if timeoutRecheckMax < 0 {
		timeoutRecheckMax = 0
	}
	if timeoutRecheckMax > 50000 {
		timeoutRecheckMax = 50000
	}
	precheckStatePath := opts.CachePath + ".precheck.json"
	precheckLastRun := loadResolverPrecheckLastRun(precheckStatePath)
	precheckEnvForced := resolvePrecheckForceEnvEnabled()
	precheckFileForced := resolvePrecheckForceFileEnabled(precheckForcePath)
	precheckDue := precheckEnvForced || precheckFileForced || (precheckEverySec > 0 && (precheckLastRun <= 0 || now-precheckLastRun >= precheckEverySec))
	precheckScheduled := 0
	staleKeepSec := envInt("RESOLVE_STALE_KEEP_SEC", 48*3600)
	if staleKeepSec < 0 {
		staleKeepSec = 0
	}
	if staleKeepSec > 7*24*3600 {
		staleKeepSec = 7 * 24 * 3600
	}
	negTTLNX := envInt("RESOLVE_NEGATIVE_TTL_NX", 6*3600)
	negTTLTimeout := envInt("RESOLVE_NEGATIVE_TTL_TIMEOUT", 15*60)
	negTTLTemporary := envInt("RESOLVE_NEGATIVE_TTL_TEMPORARY", 10*60)
	negTTLOther := envInt("RESOLVE_NEGATIVE_TTL_OTHER", 10*60)
	clampTTL := func(v int) int {
		if v < 0 {
			return 0
		}
		if v > 24*3600 {
			return 24 * 3600
		}
		return v
	}
	negTTLNX = clampTTL(negTTLNX)
	negTTLTimeout = clampTTL(negTTLTimeout)
	negTTLTemporary = clampTTL(negTTLTemporary)
	negTTLOther = clampTTL(negTTLOther)

	cacheSourceForHost := func(host string) domainCacheSource {
		switch cfg.Mode {
		case DNSModeSmartDNS:
			return domainCacheSourceWildcard
		case DNSModeHybridWildcard:
			if wildcards.match(host) {
				return domainCacheSourceWildcard
			}
		}
		return domainCacheSourceDirect
	}

	timeoutRecheck := resolverTimeoutRecheckStats{}
	if precheckDue && timeoutRecheckMax > 0 {
		timeoutRecheck = runTimeoutQuarantineRecheck(
			domains,
			cfg,
			metaSpecial,
			wildcards,
			dnsTimeout,
			&domainCache,
			cacheSourceForHost,
			now,
			timeoutRecheckMax,
			workers,
		)
	}

	if logf != nil {
		logf("resolver start: domains=%d ttl=%ds workers=%d dns_timeout_ms=%d", len(domains), ttl, workers, dnsTimeoutMs)
		directPolicy := directDNSAttemptPolicy(len(cfg.Default))
		wildcardPolicy := wildcardDNSAttemptPolicy(1)
		logf(
			"resolver policy: direct_try=%d direct_budget_ms=%d wildcard_try=%d wildcard_budget_ms=%d nx_early_stop=%t stale_keep_sec=%d precheck_every_sec=%d precheck_max=%d precheck_forced_env=%t precheck_forced_file=%t",
			directPolicy.TryLimit,
			directPolicy.DomainBudget.Milliseconds(),
			wildcardPolicy.TryLimit,
			wildcardPolicy.DomainBudget.Milliseconds(),
			resolveNXEarlyStopEnabled(),
			staleKeepSec,
			precheckEverySec,
			precheckMaxDomains,
			precheckEnvForced,
			precheckFileForced,
		)
	}
	start := time.Now()

	fresh := map[string][]string{}
	cacheNegativeHits := 0
	quarantineHits := 0
	staleHits := 0
	var toResolve []string
	for _, d := range domains {
		source := cacheSourceForHost(d)
		if ips, ok := domainCache.get(d, source, now, ttl); ok {
			fresh[d] = ips
			if logf != nil {
				logf("cache hit[%s]: %s -> %v", source, d, ips)
			}
			continue
		}
		// Quarantine has priority over negative TTL cache so 24h quarantine
		// is not silently overridden by shorter negative cache windows.
		if state, age, ok := domainCache.getQuarantine(d, source, now); ok {
			kind, hasKind := domainCache.getLastErrorKind(d, source)
			timeoutKind := hasKind && kind == dnsErrorTimeout
			if precheckDue && precheckScheduled < precheckMaxDomains {
				// Timeout-based quarantine is rechecked in background batch and should
				// not flood trace with per-domain debug lines.
				if timeoutKind {
					quarantineHits++
					if staleKeepSec > 0 {
						if staleIPs, staleAge, ok := domainCache.getStale(d, source, now, staleKeepSec); ok {
							staleHits++
							fresh[d] = staleIPs
							if logf != nil {
								logf("cache stale-keep (quarantine)[age=%ds]: %s -> %v", staleAge, d, staleIPs)
							}
						}
					}
					continue
				}
				precheckScheduled++
				toResolve = append(toResolve, d)
				if logf != nil {
					logf("precheck schedule[quarantine/%s age=%ds]: %s (%s)", state, age, d, source)
				}
				continue
			}
			quarantineHits++
			if logf != nil {
				logf("cache quarantine hit[%s age=%ds]: %s (%s)", state, age, d, source)
			}
			if staleKeepSec > 0 {
				if staleIPs, staleAge, ok := domainCache.getStale(d, source, now, staleKeepSec); ok {
					staleHits++
					fresh[d] = staleIPs
					if logf != nil {
						logf("cache stale-keep (quarantine)[age=%ds]: %s -> %v", staleAge, d, staleIPs)
					}
				}
			}
			continue
		}
		if kind, age, ok := domainCache.getNegative(d, source, now, negTTLNX, negTTLTimeout, negTTLTemporary, negTTLOther); ok {
			if precheckDue && precheckScheduled < precheckMaxDomains {
				if kind == dnsErrorTimeout {
					cacheNegativeHits++
					continue
				}
				precheckScheduled++
				toResolve = append(toResolve, d)
				if logf != nil {
					logf("precheck schedule[negative/%s age=%ds]: %s (%s)", kind, age, d, source)
				}
				continue
			}
			cacheNegativeHits++
			if logf != nil {
				logf("cache neg hit[%s/%s age=%ds]: %s", source, kind, age, d)
			}
			continue
		}
		toResolve = append(toResolve, d)
	}

	resolved := map[string][]string{}
	for k, v := range fresh {
		resolved[k] = v
	}

	if logf != nil {
		logf("resolve: domains=%d cache_hits=%d cache_neg_hits=%d quarantine_hits=%d stale_hits=%d precheck_due=%t precheck_scheduled=%d to_resolve=%d", len(domains), len(fresh), cacheNegativeHits, quarantineHits, staleHits, precheckDue, precheckScheduled, len(toResolve))
	}

	dnsStats := dnsMetrics{}
	resolvedNowDNS := 0
	resolvedNowStale := 0
	unresolvedAfterAttempts := 0

	if len(toResolve) > 0 {
		type job struct {
			host string
		}
		jobs := make(chan job, len(toResolve))
		results := make(chan struct {
			host  string
			ips   []string
			stats dnsMetrics
		}, len(toResolve))

		for i := 0; i < workers; i++ {
			go func() {
				for j := range jobs {
					ips, stats := resolveHostGo(j.host, cfg, metaSpecial, wildcards, dnsTimeout, logf)
					results <- struct {
						host  string
						ips   []string
						stats dnsMetrics
					}{j.host, ips, stats}
				}
			}()
		}
		for _, h := range toResolve {
			jobs <- job{host: h}
		}
		close(jobs)
		for i := 0; i < len(toResolve); i++ {
			r := <-results
			dnsStats.merge(r.stats)
			hostErrors := r.stats.totalErrors()
			if hostErrors > 0 && logf != nil {
				logf("resolve errors for %s: total=%d nxdomain=%d timeout=%d temporary=%d other=%d", r.host, hostErrors, r.stats.NXDomain, r.stats.Timeout, r.stats.Temporary, r.stats.Other)
			}
			if len(r.ips) > 0 {
				resolved[r.host] = r.ips
				resolvedNowDNS++
				source := cacheSourceForHost(r.host)
				domainCache.set(r.host, source, r.ips, now)
				if logf != nil {
					logf("%s -> %v", r.host, r.ips)
				}
			} else {
				staleApplied := false
				if hostErrors > 0 {
					source := cacheSourceForHost(r.host)
					domainCache.setErrorWithStats(r.host, source, r.stats, now)
					if staleKeepSec > 0 && shouldUseStaleOnError(r.stats) {
						if staleIPs, staleAge, ok := domainCache.getStale(r.host, source, now, staleKeepSec); ok {
							staleHits++
							resolvedNowStale++
							staleApplied = true
							resolved[r.host] = staleIPs
							if logf != nil {
								logf("cache stale-keep (error)[age=%ds]: %s -> %v", staleAge, r.host, staleIPs)
							}
						}
					}
				}
				if !staleApplied {
					unresolvedAfterAttempts++
				}
				if logf != nil {
					if _, ok := resolved[r.host]; !ok {
						logf("%s: no IPs", r.host)
					}
				}
			}
		}
	}

	staticEntries, staticSkipped := parseStaticEntriesGo(staticLines, logf)
	staticLabels, ptrLookups, ptrErrors := resolveStaticLabels(staticEntries, cfg, ptrCache, ttl, logf)

	ipSetAll := map[string]struct{}{}
	ipSetDirect := map[string]struct{}{}
	ipSetWildcard := map[string]struct{}{}

	ipMapAll := map[string]map[string]struct{}{}
	ipMapDirect := map[string]map[string]struct{}{}
	ipMapWildcard := map[string]map[string]struct{}{}

	add := func(set map[string]struct{}, labels map[string]map[string]struct{}, ip, label string) {
		if ip == "" {
			return
		}
		set[ip] = struct{}{}
		m := labels[ip]
		if m == nil {
			m = map[string]struct{}{}
			labels[ip] = m
		}
		m[label] = struct{}{}
	}

	isWildcardHost := func(host string) bool {
		switch cfg.Mode {
		case DNSModeSmartDNS:
			return true
		case DNSModeHybridWildcard:
			return wildcards.match(host)
		default:
			return false
		}
	}

	for host, ips := range resolved {
		wildcardHost := isWildcardHost(host)
		for _, ip := range ips {
			add(ipSetAll, ipMapAll, ip, host)
			if wildcardHost {
				add(ipSetWildcard, ipMapWildcard, ip, host)
			} else {
				add(ipSetDirect, ipMapDirect, ip, host)
			}
		}
	}
	for ipEntry, labels := range staticLabels {
		for _, lbl := range labels {
			add(ipSetAll, ipMapAll, ipEntry, lbl)
			// Static entries are explicit operator rules; keep them in direct set.
			add(ipSetDirect, ipMapDirect, ipEntry, lbl)
		}
	}

	appendMapPairs := func(dst *[][2]string, labelsByIP map[string]map[string]struct{}) {
		for ip := range labelsByIP {
			labels := labelsByIP[ip]
			for lbl := range labels {
				*dst = append(*dst, [2]string{ip, lbl})
			}
		}
		sort.Slice(*dst, func(i, j int) bool {
			if (*dst)[i][0] == (*dst)[j][0] {
				return (*dst)[i][1] < (*dst)[j][1]
			}
			return (*dst)[i][0] < (*dst)[j][0]
		})
	}
	appendIPs := func(dst *[]string, set map[string]struct{}) {
		for ip := range set {
			*dst = append(*dst, ip)
		}
		sort.Strings(*dst)
	}

	appendMapPairs(&res.IPMap, ipMapAll)
	appendMapPairs(&res.DirectIPMap, ipMapDirect)
	appendMapPairs(&res.WildcardIPMap, ipMapWildcard)
	appendIPs(&res.IPs, ipSetAll)
	appendIPs(&res.DirectIPs, ipSetDirect)
	appendIPs(&res.WildcardIPs, ipSetWildcard)

	res.DomainCache = domainCache.toMap()
	res.PtrCache = ptrCache

	if logf != nil {
		dnsErrors := dnsStats.totalErrors()
		logf(
			"resolve summary: domains=%d cache_hits=%d cache_neg_hits=%d quarantine_hits=%d stale_hits=%d resolved_now=%d unresolved=%d static_entries=%d static_skipped=%d unique_ips=%d direct_ips=%d wildcard_ips=%d ptr_lookups=%d ptr_errors=%d dns_attempts=%d dns_ok=%d dns_nxdomain=%d dns_timeout=%d dns_temporary=%d dns_other=%d dns_errors=%d timeout_recheck_checked=%d timeout_recheck_recovered=%d timeout_recheck_recovered_ips=%d timeout_recheck_still_timeout=%d timeout_recheck_now_nxdomain=%d timeout_recheck_now_temporary=%d timeout_recheck_now_other=%d timeout_recheck_no_signal=%d duration_ms=%d",
			len(domains),
			len(fresh),
			cacheNegativeHits,
			quarantineHits,
			staleHits,
			len(resolved)-len(fresh),
			len(domains)-len(resolved),
			len(staticEntries),
			staticSkipped,
			len(res.IPs),
			len(res.DirectIPs),
			len(res.WildcardIPs),
			ptrLookups,
			ptrErrors,
			dnsStats.Attempts,
			dnsStats.OK,
			dnsStats.NXDomain,
			dnsStats.Timeout,
			dnsStats.Temporary,
			dnsStats.Other,
			dnsErrors,
			timeoutRecheck.Checked,
			timeoutRecheck.Recovered,
			timeoutRecheck.RecoveredIPs,
			timeoutRecheck.StillTimeout,
			timeoutRecheck.NowNXDomain,
			timeoutRecheck.NowTemporary,
			timeoutRecheck.NowOther,
			timeoutRecheck.NoSignal,
			time.Since(start).Milliseconds(),
		)
		if perUpstream := dnsStats.formatPerUpstream(); perUpstream != "" {
			logf("resolve dns upstreams: %s", perUpstream)
		}
		if health := dnsStats.formatResolverHealth(); health != "" {
			logf("resolve dns health: %s", health)
		}
		if stateSummary := domainCache.formatStateSummary(now); stateSummary != "" {
			logf("resolve domain states: %s", stateSummary)
		}
		logf(
			"resolve breakdown: resolved_now_total=%d resolved_now_dns=%d resolved_now_stale=%d skipped_neg=%d skipped_quarantine=%d unresolved_after_attempts=%d",
			len(resolved)-len(fresh),
			resolvedNowDNS,
			resolvedNowStale,
			cacheNegativeHits,
			quarantineHits,
			unresolvedAfterAttempts,
		)
		if precheckDue {
			logf("resolve precheck done: scheduled=%d state=%s", precheckScheduled, precheckStatePath)
		}
	}
	if precheckDue {
		saveResolverPrecheckState(precheckStatePath, now, timeoutRecheck)
	}
	if precheckFileForced {
		_ = os.Remove(precheckForcePath)
		if logf != nil {
			logf("resolve precheck force-file consumed: %s", precheckForcePath)
		}
	}
	return res, nil
}

// ---------------------------------------------------------------------
// DNS resolve helpers
// ---------------------------------------------------------------------

func resolveHostGo(host string, cfg dnsConfig, metaSpecial []string, wildcards wildcardMatcher, timeout time.Duration, logf func(string, ...any)) ([]string, dnsMetrics) {
	useMeta := false
	for _, m := range metaSpecial {
		if host == m {
			useMeta = true
			break
		}
	}
	dnsList := cfg.Default
	if useMeta {
		dnsList = cfg.Meta
	}
	primaryViaSmartDNS := false
	switch cfg.Mode {
	case DNSModeSmartDNS:
		if cfg.SmartDNS != "" {
			dnsList = []string{cfg.SmartDNS}
			primaryViaSmartDNS = true
		}
	case DNSModeHybridWildcard:
		if cfg.SmartDNS != "" && wildcards.match(host) {
			dnsList = []string{cfg.SmartDNS}
			primaryViaSmartDNS = true
		}
	}
	policy := directDNSAttemptPolicy(len(dnsList))
	if primaryViaSmartDNS {
		policy = wildcardDNSAttemptPolicy(len(dnsList))
	}
	ips, stats := digAWithPolicy(host, dnsList, timeout, logf, policy)
	if len(ips) == 0 &&
		!primaryViaSmartDNS &&
		cfg.SmartDNS != "" &&
		smartDNSFallbackForTimeoutEnabled() &&
		shouldFallbackToSmartDNS(stats) {
		if logf != nil {
			logf(
				"dns fallback %s: trying smartdns=%s after errors nxdomain=%d timeout=%d temporary=%d other=%d",
				host,
				cfg.SmartDNS,
				stats.NXDomain,
				stats.Timeout,
				stats.Temporary,
				stats.Other,
			)
		}
		fallbackPolicy := wildcardDNSAttemptPolicy(1)
		fallbackIPs, fallbackStats := digAWithPolicy(host, []string{cfg.SmartDNS}, timeout, logf, fallbackPolicy)
		stats.merge(fallbackStats)
		if len(fallbackIPs) > 0 {
			ips = fallbackIPs
			if logf != nil {
				logf("dns fallback %s: resolved via smartdns (%d ips)", host, len(fallbackIPs))
			}
		}
	}
	out := []string{}
	seen := map[string]struct{}{}
	for _, ip := range ips {
		if isPrivateIPv4(ip) {
			continue
		}
		if _, ok := seen[ip]; !ok {
			seen[ip] = struct{}{}
			out = append(out, ip)
		}
	}
	return out, stats
}

// smartDNSFallbackForTimeoutEnabled controls direct->SmartDNS fallback behavior.
// Default is disabled to avoid overloading SmartDNS on large unresolved batches.
// Set RESOLVE_SMARTDNS_TIMEOUT_FALLBACK=1 to enable.
func smartDNSFallbackForTimeoutEnabled() bool {
	v := strings.ToLower(strings.TrimSpace(os.Getenv("RESOLVE_SMARTDNS_TIMEOUT_FALLBACK")))
	switch v {
	case "1", "true", "yes", "on":
		return true
	case "0", "false", "no", "off":
		return false
	default:
		return false
	}
}

// Fallback is useful only for transport-like errors. If we already got NXDOMAIN,
// SmartDNS fallback is unlikely to change result and only adds latency/noise.
func shouldFallbackToSmartDNS(stats dnsMetrics) bool {
	if stats.OK > 0 {
		return false
	}
	if stats.NXDomain > 0 {
		return false
	}
	if stats.Timeout > 0 || stats.Temporary > 0 {
		return true
	}
	return stats.Other > 0
}

func classifyHostErrorKind(stats dnsMetrics) (dnsErrorKind, bool) {
	if stats.Timeout > 0 {
		return dnsErrorTimeout, true
	}
	if stats.Temporary > 0 {
		return dnsErrorTemporary, true
	}
	if stats.Other > 0 {
		return dnsErrorOther, true
	}
	if stats.NXDomain > 0 {
		return dnsErrorNXDomain, true
	}
	return "", false
}

func shouldUseStaleOnError(stats dnsMetrics) bool {
	if stats.OK > 0 {
		return false
	}
	return stats.Timeout > 0 || stats.Temporary > 0 || stats.Other > 0
}

func runTimeoutQuarantineRecheck(
	domains []string,
	cfg dnsConfig,
	metaSpecial []string,
	wildcards wildcardMatcher,
	timeout time.Duration,
	domainCache *domainCacheState,
	cacheSourceForHost func(string) domainCacheSource,
	now int,
	limit int,
	workers int,
) resolverTimeoutRecheckStats {
	stats := resolverTimeoutRecheckStats{}
	if limit <= 0 || now <= 0 {
		return stats
	}
	if workers < 1 {
		workers = 1
	}
	if workers > 200 {
		workers = 200
	}
	seen := map[string]struct{}{}
	capHint := len(domains)
	if capHint > limit {
		capHint = limit
	}
	candidates := make([]string, 0, capHint)
	for _, raw := range domains {
		host := strings.TrimSpace(strings.ToLower(raw))
		if host == "" {
			continue
		}
		if _, ok := seen[host]; ok {
			continue
		}
		seen[host] = struct{}{}
		source := cacheSourceForHost(host)
		if _, _, ok := domainCache.getQuarantine(host, source, now); !ok {
			continue
		}
		kind, ok := domainCache.getLastErrorKind(host, source)
		if !ok || kind != dnsErrorTimeout {
			continue
		}
		candidates = append(candidates, host)
		if len(candidates) >= limit {
			break
		}
	}
	if len(candidates) == 0 {
		return stats
	}
	recoveredIPSet := map[string]struct{}{}

	type result struct {
		host   string
		source domainCacheSource
		ips    []string
		dns    dnsMetrics
	}
	jobs := make(chan string, len(candidates))
	results := make(chan result, len(candidates))
	for i := 0; i < workers; i++ {
		go func() {
			for host := range jobs {
				src := cacheSourceForHost(host)
				ips, dnsStats := resolveHostGo(host, cfg, metaSpecial, wildcards, timeout, nil)
				results <- result{host: host, source: src, ips: ips, dns: dnsStats}
			}
		}()
	}
	for _, host := range candidates {
		jobs <- host
	}
	close(jobs)

	for i := 0; i < len(candidates); i++ {
		r := <-results
		stats.Checked++
		if len(r.ips) > 0 {
			for _, ip := range r.ips {
				ip = strings.TrimSpace(ip)
				if ip == "" {
					continue
				}
				recoveredIPSet[ip] = struct{}{}
			}
			domainCache.set(r.host, r.source, r.ips, now)
			stats.Recovered++
			continue
		}
		if r.dns.totalErrors() > 0 {
			domainCache.setErrorWithStats(r.host, r.source, r.dns, now)
		}
		kind, ok := classifyHostErrorKind(r.dns)
		if !ok {
			stats.NoSignal++
			continue
		}
		switch kind {
		case dnsErrorTimeout:
			stats.StillTimeout++
		case dnsErrorNXDomain:
			stats.NowNXDomain++
		case dnsErrorTemporary:
			stats.NowTemporary++
		default:
			stats.NowOther++
		}
	}
	stats.RecoveredIPs = len(recoveredIPSet)

	return stats
}

// ---------------------------------------------------------------------
// EN: `digA` contains core logic for dig a.
// RU: `digA` - содержит основную логику для dig a.
// ---------------------------------------------------------------------
func digA(host string, dnsList []string, timeout time.Duration, logf func(string, ...any)) ([]string, dnsMetrics) {
	return digAWithPolicy(host, dnsList, timeout, logf, defaultDNSAttemptPolicy(len(dnsList)))
}

func digAWithPolicy(host string, dnsList []string, timeout time.Duration, logf func(string, ...any), policy dnsAttemptPolicy) ([]string, dnsMetrics) {
	stats := dnsMetrics{}
	if len(dnsList) == 0 {
		return nil, stats
	}

	tryLimit := policy.TryLimit
	if tryLimit <= 0 {
		tryLimit = 1
	}
	if tryLimit > len(dnsList) {
		tryLimit = len(dnsList)
	}
	budget := policy.DomainBudget
	if budget <= 0 {
		budget = time.Duration(tryLimit) * timeout
	}
	if budget < 200*time.Millisecond {
		budget = 200 * time.Millisecond
	}
	deadline := time.Now().Add(budget)

	start := pickDNSStartIndex(host, len(dnsList))
	for attempt := 0; attempt < tryLimit; attempt++ {
		remaining := time.Until(deadline)
		if remaining <= 0 {
			if logf != nil {
				logf("dns budget exhausted %s: attempts=%d budget_ms=%d", host, attempt, budget.Milliseconds())
			}
			break
		}
		entry := dnsList[(start+attempt)%len(dnsList)]
		server, port := splitDNS(entry)
		if server == "" {
			continue
		}
		if port == "" {
			port = "53"
		}
		addr := net.JoinHostPort(server, port)
		r := &net.Resolver{
			PreferGo: true,
			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
				d := net.Dialer{}
				return d.DialContext(ctx, "udp", addr)
			},
		}
		perAttemptTimeout := timeout
		if remaining < perAttemptTimeout {
			perAttemptTimeout = remaining
		}
		if perAttemptTimeout < 100*time.Millisecond {
			perAttemptTimeout = 100 * time.Millisecond
		}
		ctx, cancel := context.WithTimeout(context.Background(), perAttemptTimeout)
		records, err := r.LookupHost(ctx, host)
		cancel()
		if err != nil {
			kind := classifyDNSError(err)
			stats.addError(addr, kind)
			if logf != nil {
				logf("dns warn %s via %s: kind=%s attempt=%d/%d err=%v", host, addr, kind, attempt+1, tryLimit, err)
			}
			if policy.StopOnNX && kind == dnsErrorNXDomain {
				if logf != nil {
					logf("dns early-stop %s: nxdomain via %s (attempt=%d/%d)", host, addr, attempt+1, tryLimit)
				}
				break
			}
			continue
		}
		var ips []string
		for _, ip := range records {
			if isPrivateIPv4(ip) {
				continue
			}
			ips = append(ips, ip)
		}
		if len(ips) == 0 {
			stats.addError(addr, dnsErrorOther)
			if logf != nil {
				logf("dns warn %s via %s: kind=other err=no_public_ips", host, addr)
			}
			continue
		}
		stats.addSuccess(addr)
		return uniqueStrings(ips), stats
	}
	return nil, stats
}

func defaultDNSAttemptPolicy(dnsCount int) dnsAttemptPolicy {
	tryLimit := envInt("RESOLVE_DNS_TRY_LIMIT", 2)
	if tryLimit < 1 {
		tryLimit = 1
	}
	if dnsCount > 0 && tryLimit > dnsCount {
		tryLimit = dnsCount
	}
	budgetMS := envInt("RESOLVE_DNS_DOMAIN_BUDGET_MS", 1200)
	if budgetMS < 200 {
		budgetMS = 200
	}
	if budgetMS > 15000 {
		budgetMS = 15000
	}
	return dnsAttemptPolicy{
		TryLimit:     tryLimit,
		DomainBudget: time.Duration(budgetMS) * time.Millisecond,
		StopOnNX:     resolveNXEarlyStopEnabled(),
	}
}

func directDNSAttemptPolicy(dnsCount int) dnsAttemptPolicy {
	tryLimit := envInt("RESOLVE_DIRECT_TRY_LIMIT", 2)
	if tryLimit < 1 {
		tryLimit = 1
	}
	if tryLimit > 3 {
		tryLimit = 3
	}
	if dnsCount > 0 && tryLimit > dnsCount {
		tryLimit = dnsCount
	}
	budgetMS := envInt("RESOLVE_DIRECT_BUDGET_MS", 1200)
	if budgetMS < 200 {
		budgetMS = 200
	}
	if budgetMS > 15000 {
		budgetMS = 15000
	}
	return dnsAttemptPolicy{
		TryLimit:     tryLimit,
		DomainBudget: time.Duration(budgetMS) * time.Millisecond,
		StopOnNX:     resolveNXEarlyStopEnabled(),
	}
}

func wildcardDNSAttemptPolicy(dnsCount int) dnsAttemptPolicy {
	tryLimit := envInt("RESOLVE_WILDCARD_TRY_LIMIT", 1)
	if tryLimit < 1 {
		tryLimit = 1
	}
	if tryLimit > 2 {
		tryLimit = 2
	}
	if dnsCount > 0 && tryLimit > dnsCount {
		tryLimit = dnsCount
	}
	budgetMS := envInt("RESOLVE_WILDCARD_BUDGET_MS", 1200)
	if budgetMS < 200 {
		budgetMS = 200
	}
	if budgetMS > 15000 {
		budgetMS = 15000
	}
	return dnsAttemptPolicy{
		TryLimit:     tryLimit,
		DomainBudget: time.Duration(budgetMS) * time.Millisecond,
		StopOnNX:     resolveNXEarlyStopEnabled(),
	}
}

func resolveNXEarlyStopEnabled() bool {
	switch strings.ToLower(strings.TrimSpace(os.Getenv("RESOLVE_NX_EARLY_STOP"))) {
	case "0", "false", "no", "off":
		return false
	default:
		return true
	}
}

func resolvePrecheckForceEnvEnabled() bool {
	switch strings.ToLower(strings.TrimSpace(os.Getenv("RESOLVE_PRECHECK_FORCE"))) {
	case "1", "true", "yes", "on":
		return true
	default:
		return false
	}
}

func resolvePrecheckForceFileEnabled(path string) bool {
	if strings.TrimSpace(path) == "" {
		return false
	}
	_, err := os.Stat(path)
	return err == nil
}

func classifyDNSError(err error) dnsErrorKind {
	if err == nil {
		return dnsErrorOther
	}
	var dnsErr *net.DNSError
	if errors.As(err, &dnsErr) {
		if dnsErr.IsNotFound {
			return dnsErrorNXDomain
		}
		if dnsErr.IsTimeout {
			return dnsErrorTimeout
		}
		if dnsErr.IsTemporary {
			return dnsErrorTemporary
		}
	}
	msg := strings.ToLower(err.Error())
	switch {
	case strings.Contains(msg, "no such host"), strings.Contains(msg, "nxdomain"):
		return dnsErrorNXDomain
	case strings.Contains(msg, "i/o timeout"), strings.Contains(msg, "timeout"):
		return dnsErrorTimeout
	case strings.Contains(msg, "temporary"):
		return dnsErrorTemporary
	default:
		return dnsErrorOther
	}
}

// ---------------------------------------------------------------------
// EN: `splitDNS` splits dns into structured parts.
// RU: `splitDNS` - разделяет dns на структурированные части.
// ---------------------------------------------------------------------
func splitDNS(dns string) (string, string) {
	if strings.Contains(dns, "#") {
		parts := strings.SplitN(dns, "#", 2)
		host := strings.TrimSpace(parts[0])
		port := strings.TrimSpace(parts[1])
		if host == "" {
			host = "127.0.0.1"
		}
		if port == "" {
			port = "53"
		}
		return host, port
	}
	return strings.TrimSpace(dns), ""
}

// ---------------------------------------------------------------------
// static entries + PTR labels
// ---------------------------------------------------------------------

func parseStaticEntriesGo(lines []string, logf func(string, ...any)) (entries [][3]string, skipped int) {
	for _, ln := range lines {
		s := strings.TrimSpace(ln)
		if s == "" || strings.HasPrefix(s, "#") {
			continue
		}
		comment := ""
		if idx := strings.Index(s, "#"); idx >= 0 {
			comment = strings.TrimSpace(s[idx+1:])
			s = strings.TrimSpace(s[:idx])
		}
		if s == "" || isPrivateIPv4(s) {
			continue
		}

		// validate ip/prefix
		rawBase := strings.SplitN(s, "/", 2)[0]
		if strings.Contains(s, "/") {
			if _, err := netip.ParsePrefix(s); err != nil {
				skipped++
				if logf != nil {
					logf("static skip invalid prefix %q: %v", s, err)
				}
				continue
			}
		} else {
			if _, err := netip.ParseAddr(rawBase); err != nil {
				skipped++
				if logf != nil {
					logf("static skip invalid ip %q: %v", s, err)
				}
				continue
			}
		}

		entries = append(entries, [3]string{s, rawBase, comment})
	}
	return entries, skipped
}

// ---------------------------------------------------------------------
// EN: `resolveStaticLabels` resolves static labels into concrete values.
// RU: `resolveStaticLabels` - резолвит static labels в конкретные значения.
// ---------------------------------------------------------------------
func resolveStaticLabels(entries [][3]string, cfg dnsConfig, ptrCache map[string]any, ttl int, logf func(string, ...any)) (map[string][]string, int, int) {
	now := int(time.Now().Unix())
	result := map[string][]string{}
	ptrLookups := 0
	ptrErrors := 0
	dnsForPtr := ""
	if len(cfg.Default) > 0 {
		dnsForPtr = cfg.Default[0]
	} else {
		dnsForPtr = defaultDNS1
	}
	for _, e := range entries {
		ipEntry, baseIP, comment := e[0], e[1], e[2]
		var labels []string
		if comment != "" {
			labels = append(labels, "*"+comment)
		}
		if comment == "" {
			if cached, ok := ptrCache[baseIP].(map[string]any); ok {
				names, _ := cached["names"].([]any)
				last, _ := cached["last_resolved"].(float64)
				if len(names) > 0 && last > 0 && now-int(last) <= ttl {
					for _, n := range names {
						if s, ok := n.(string); ok && s != "" {
							labels = append(labels, "*"+s)
						}
					}
				}
			}
			if len(labels) == 0 {
				ptrLookups++
				names, err := digPTR(baseIP, dnsForPtr, 3*time.Second, logf)
				if err != nil {
					ptrErrors++
				}
				if len(names) > 0 {
					ptrCache[baseIP] = map[string]any{"names": names, "last_resolved": now}
					for _, n := range names {
						labels = append(labels, "*"+n)
					}
				}
			}
		}
		if len(labels) == 0 {
			labels = []string{"*[STATIC-IP]"}
		}
		result[ipEntry] = labels
		if logf != nil {
			logf("static %s -> %v", ipEntry, labels)
		}
	}
	return result, ptrLookups, ptrErrors
}

// ---------------------------------------------------------------------
// DNS config + cache helpers
// ---------------------------------------------------------------------

type domainCacheSource string

const (
	domainCacheSourceDirect   domainCacheSource = "direct"
	domainCacheSourceWildcard domainCacheSource = "wildcard"
)

type domainCacheEntry struct {
	IPs             []string `json:"ips,omitempty"`
	LastResolved    int      `json:"last_resolved,omitempty"`
	LastErrorKind   string   `json:"last_error_kind,omitempty"`
	LastErrorAt     int      `json:"last_error_at,omitempty"`
	Score           int      `json:"score,omitempty"`
	State           string   `json:"state,omitempty"`
	QuarantineUntil int      `json:"quarantine_until,omitempty"`
}

type domainCacheRecord struct {
	Direct   *domainCacheEntry `json:"direct,omitempty"`
	Wildcard *domainCacheEntry `json:"wildcard,omitempty"`
}

type domainCacheState struct {
	Version int                          `json:"version"`
	Domains map[string]domainCacheRecord `json:"domains"`
}

func newDomainCacheState() domainCacheState {
	return domainCacheState{
		Version: 4,
		Domains: map[string]domainCacheRecord{},
	}
}

func normalizeCacheIPs(raw []string) []string {
	seen := map[string]struct{}{}
	out := make([]string, 0, len(raw))
	for _, ip := range raw {
		ip = strings.TrimSpace(ip)
		if ip == "" || isPrivateIPv4(ip) {
			continue
		}
		if _, ok := seen[ip]; ok {
			continue
		}
		seen[ip] = struct{}{}
		out = append(out, ip)
	}
	sort.Strings(out)
	return out
}

func normalizeCacheErrorKind(raw string) (dnsErrorKind, bool) {
	switch strings.ToLower(strings.TrimSpace(raw)) {
	case string(dnsErrorNXDomain):
		return dnsErrorNXDomain, true
	case string(dnsErrorTimeout):
		return dnsErrorTimeout, true
	case string(dnsErrorTemporary):
		return dnsErrorTemporary, true
	case string(dnsErrorOther):
		return dnsErrorOther, true
	default:
		return "", false
	}
}

func normalizeDomainCacheEntry(in *domainCacheEntry) *domainCacheEntry {
	if in == nil {
		return nil
	}
	out := &domainCacheEntry{}
	ips := normalizeCacheIPs(in.IPs)
	if len(ips) > 0 && in.LastResolved > 0 {
		out.IPs = ips
		out.LastResolved = in.LastResolved
	}
	if kind, ok := normalizeCacheErrorKind(in.LastErrorKind); ok && in.LastErrorAt > 0 {
		out.LastErrorKind = string(kind)
		out.LastErrorAt = in.LastErrorAt
	}
	out.Score = clampDomainScore(in.Score)
	if st := normalizeDomainState(in.State, out.Score); st != "" {
		out.State = st
	}
	if in.QuarantineUntil > 0 {
		out.QuarantineUntil = in.QuarantineUntil
	}
	if out.LastResolved <= 0 && out.LastErrorAt <= 0 {
		if out.Score == 0 && out.QuarantineUntil <= 0 {
			return nil
		}
	}
	return out
}

func parseAnyStringSlice(raw any) []string {
	switch v := raw.(type) {
	case []string:
		return append([]string(nil), v...)
	case []any:
		out := make([]string, 0, len(v))
		for _, x := range v {
			if s, ok := x.(string); ok {
				out = append(out, s)
			}
		}
		return out
	default:
		return nil
	}
}

func parseAnyInt(raw any) (int, bool) {
	switch v := raw.(type) {
	case int:
		return v, true
	case int64:
		return int(v), true
	case float64:
		return int(v), true
	case json.Number:
		n, err := v.Int64()
		if err != nil {
			return 0, false
		}
		return int(n), true
	default:
		return 0, false
	}
}

func parseLegacyDomainCacheEntry(raw any) (domainCacheEntry, bool) {
	m, ok := raw.(map[string]any)
	if !ok {
		return domainCacheEntry{}, false
	}
	ips := normalizeCacheIPs(parseAnyStringSlice(m["ips"]))
	if len(ips) == 0 {
		return domainCacheEntry{}, false
	}
	ts, ok := parseAnyInt(m["last_resolved"])
	if !ok || ts <= 0 {
		return domainCacheEntry{}, false
	}
	return domainCacheEntry{IPs: ips, LastResolved: ts}, true
}

func loadDomainCacheState(path string, logf func(string, ...any)) domainCacheState {
	data, err := os.ReadFile(path)
	if err != nil || len(data) == 0 {
		return newDomainCacheState()
	}

	var st domainCacheState
	if err := json.Unmarshal(data, &st); err == nil && st.Domains != nil {
		if st.Version <= 0 {
			st.Version = 4
		}
		normalized := newDomainCacheState()
		for host, rec := range st.Domains {
			host = strings.TrimSpace(strings.ToLower(host))
			if host == "" {
				continue
			}
			nrec := domainCacheRecord{}
			nrec.Direct = normalizeDomainCacheEntry(rec.Direct)
			nrec.Wildcard = normalizeDomainCacheEntry(rec.Wildcard)
			if nrec.Direct != nil || nrec.Wildcard != nil {
				normalized.Domains[host] = nrec
			}
		}
		return normalized
	}

	// Legacy shape: { "domain.tld": {"ips":[...], "last_resolved":...}, ... }
	var legacy map[string]any
	if err := json.Unmarshal(data, &legacy); err != nil {
		if logf != nil {
			logf("domain-cache: invalid json at %s, ignore", path)
		}
		return newDomainCacheState()
	}

	out := newDomainCacheState()
	migrated := 0
	for host, raw := range legacy {
		host = strings.TrimSpace(strings.ToLower(host))
		if host == "" || host == "version" || host == "domains" {
			continue
		}
		entry, ok := parseLegacyDomainCacheEntry(raw)
		if !ok {
			continue
		}
		rec := out.Domains[host]
		rec.Direct = &entry
		out.Domains[host] = rec
		migrated++
	}
	if logf != nil && migrated > 0 {
		logf("domain-cache: migrated legacy entries=%d into split cache (direct bucket)", migrated)
	}
	return out
}

func (s domainCacheState) get(domain string, source domainCacheSource, now, ttl int) ([]string, bool) {
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return nil, false
	}
	var entry *domainCacheEntry
	switch source {
	case domainCacheSourceWildcard:
		entry = rec.Wildcard
	default:
		entry = rec.Direct
	}
	if entry == nil || entry.LastResolved <= 0 {
		return nil, false
	}
	if now-entry.LastResolved > ttl {
		return nil, false
	}
	ips := normalizeCacheIPs(entry.IPs)
	if len(ips) == 0 {
		return nil, false
	}
	return ips, true
}

func (s domainCacheState) getNegative(domain string, source domainCacheSource, now, nxTTL, timeoutTTL, temporaryTTL, otherTTL int) (dnsErrorKind, int, bool) {
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return "", 0, false
	}
	var entry *domainCacheEntry
	switch source {
	case domainCacheSourceWildcard:
		entry = rec.Wildcard
	default:
		entry = rec.Direct
	}
	if entry == nil || entry.LastErrorAt <= 0 {
		return "", 0, false
	}
	kind, ok := normalizeCacheErrorKind(entry.LastErrorKind)
	if !ok {
		return "", 0, false
	}
	age := now - entry.LastErrorAt
	if age < 0 {
		return "", 0, false
	}
	cacheTTL := 0
	switch kind {
	case dnsErrorNXDomain:
		cacheTTL = nxTTL
	case dnsErrorTimeout:
		cacheTTL = timeoutTTL
	case dnsErrorTemporary:
		cacheTTL = temporaryTTL
	case dnsErrorOther:
		cacheTTL = otherTTL
	}
	if cacheTTL <= 0 || age > cacheTTL {
		return "", 0, false
	}
	return kind, age, true
}

func (s domainCacheState) getStoredIPs(domain string, source domainCacheSource) []string {
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return nil
	}
	entry := getCacheEntryBySource(rec, source)
	if entry == nil {
		return nil
	}
	return normalizeCacheIPs(entry.IPs)
}

func (s domainCacheState) getLastErrorKind(domain string, source domainCacheSource) (dnsErrorKind, bool) {
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return "", false
	}
	entry := getCacheEntryBySource(rec, source)
	if entry == nil || entry.LastErrorAt <= 0 {
		return "", false
	}
	return normalizeCacheErrorKind(entry.LastErrorKind)
}

func (s domainCacheState) getQuarantine(domain string, source domainCacheSource, now int) (string, int, bool) {
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return "", 0, false
	}
	entry := getCacheEntryBySource(rec, source)
	if entry == nil || entry.QuarantineUntil <= 0 {
		return "", 0, false
	}
	if now >= entry.QuarantineUntil {
		return "", 0, false
	}
	state := normalizeDomainState(entry.State, entry.Score)
	if state == "" {
		state = domainStateQuarantine
	}
	age := 0
	if entry.LastErrorAt > 0 {
		age = now - entry.LastErrorAt
	}
	return state, age, true
}

func (s domainCacheState) getStale(domain string, source domainCacheSource, now, maxAge int) ([]string, int, bool) {
	if maxAge <= 0 {
		return nil, 0, false
	}
	rec, ok := s.Domains[strings.TrimSpace(strings.ToLower(domain))]
	if !ok {
		return nil, 0, false
	}
	entry := getCacheEntryBySource(rec, source)
	if entry == nil || entry.LastResolved <= 0 {
		return nil, 0, false
	}
	age := now - entry.LastResolved
	if age < 0 || age > maxAge {
		return nil, 0, false
	}
	ips := normalizeCacheIPs(entry.IPs)
	if len(ips) == 0 {
		return nil, 0, false
	}
	return ips, age, true
}

func (s *domainCacheState) set(domain string, source domainCacheSource, ips []string, now int) {
	host := strings.TrimSpace(strings.ToLower(domain))
	if host == "" || now <= 0 {
		return
	}
	norm := normalizeCacheIPs(ips)
	if len(norm) == 0 {
		return
	}
	if s.Domains == nil {
		s.Domains = map[string]domainCacheRecord{}
	}
	rec := s.Domains[host]
	prev := getCacheEntryBySource(rec, source)
	prevScore := 0
	if prev != nil {
		prevScore = prev.Score
	}
	entry := &domainCacheEntry{
		IPs:             norm,
		LastResolved:    now,
		LastErrorKind:   "",
		LastErrorAt:     0,
		Score:           clampDomainScore(prevScore + envInt("RESOLVE_DOMAIN_SCORE_OK", 8)),
		QuarantineUntil: 0,
	}
	entry.State = domainStateFromScore(entry.Score)
	switch source {
	case domainCacheSourceWildcard:
		rec.Wildcard = entry
	default:
		rec.Direct = entry
	}
	s.Domains[host] = rec
}

func getCacheEntryBySource(rec domainCacheRecord, source domainCacheSource) *domainCacheEntry {
	switch source {
	case domainCacheSourceWildcard:
		return rec.Wildcard
	default:
		return rec.Direct
	}
}

func clampDomainScore(v int) int {
	if v < domainScoreMin {
		return domainScoreMin
	}
	if v > domainScoreMax {
		return domainScoreMax
	}
	return v
}

func domainStateFromScore(score int) string {
	switch {
	case score >= 20:
		return domainStateActive
	case score >= 5:
		return domainStateStable
	case score >= -10:
		return domainStateSuspect
	case score >= -30:
		return domainStateQuarantine
	default:
		return domainStateHardQuar
	}
}

func normalizeDomainState(raw string, score int) string {
	switch strings.TrimSpace(strings.ToLower(raw)) {
	case domainStateActive:
		return domainStateActive
	case domainStateStable:
		return domainStateStable
	case domainStateSuspect:
		return domainStateSuspect
	case domainStateQuarantine:
		return domainStateQuarantine
	case domainStateHardQuar:
		return domainStateHardQuar
	default:
		if score == 0 {
			return ""
		}
		return domainStateFromScore(score)
	}
}

func domainScorePenalty(stats dnsMetrics) int {
	if stats.NXDomain >= 2 {
		return envInt("RESOLVE_DOMAIN_SCORE_NX_CONFIRMED", -15)
	}
	if stats.NXDomain > 0 {
		return envInt("RESOLVE_DOMAIN_SCORE_NX_SINGLE", -7)
	}
	if stats.Timeout > 0 {
		return envInt("RESOLVE_DOMAIN_SCORE_TIMEOUT", -3)
	}
	if stats.Temporary > 0 {
		return envInt("RESOLVE_DOMAIN_SCORE_TEMPORARY", -2)
	}
	return envInt("RESOLVE_DOMAIN_SCORE_OTHER", -2)
}

func (s *domainCacheState) setErrorWithStats(domain string, source domainCacheSource, stats dnsMetrics, now int) {
	host := strings.TrimSpace(strings.ToLower(domain))
	if host == "" || now <= 0 {
		return
	}
	kind, ok := classifyHostErrorKind(stats)
	if !ok {
		return
	}
	normKind, ok := normalizeCacheErrorKind(string(kind))
	if !ok {
		return
	}
	penalty := domainScorePenalty(stats)
	quarantineTTL := envInt("RESOLVE_QUARANTINE_TTL_SEC", defaultQuarantineTTL)
	if quarantineTTL < 0 {
		quarantineTTL = 0
	}
	hardQuarantineTTL := envInt("RESOLVE_HARD_QUARANTINE_TTL_SEC", defaultHardQuarantineTT)
	if hardQuarantineTTL < 0 {
		hardQuarantineTTL = 0
	}
	if s.Domains == nil {
		s.Domains = map[string]domainCacheRecord{}
	}
	rec := s.Domains[host]
	entry := getCacheEntryBySource(rec, source)
	if entry == nil {
		entry = &domainCacheEntry{}
	}
	prevKind, _ := normalizeCacheErrorKind(entry.LastErrorKind)
	entry.Score = clampDomainScore(entry.Score + penalty)
	entry.State = domainStateFromScore(entry.Score)

	// Timeout-only failures are treated as transient transport noise by default.
	// Keep them in suspect bucket (no quarantine) unless we have NX signal.
	if normKind == dnsErrorTimeout && prevKind != dnsErrorNXDomain {
		if entry.Score < -10 {
			entry.Score = -10
		}
		entry.State = domainStateSuspect
	}
	entry.LastErrorKind = string(normKind)
	entry.LastErrorAt = now
	switch entry.State {
	case domainStateHardQuar:
		entry.QuarantineUntil = now + hardQuarantineTTL
	case domainStateQuarantine:
		entry.QuarantineUntil = now + quarantineTTL
	default:
		entry.QuarantineUntil = 0
	}
	switch source {
	case domainCacheSourceWildcard:
		rec.Wildcard = entry
	default:
		rec.Direct = entry
	}
	s.Domains[host] = rec
}

func (s domainCacheState) toMap() map[string]any {
	out := map[string]any{
		"version": 4,
		"domains": map[string]any{},
	}
	domainsAny := out["domains"].(map[string]any)
	hosts := make([]string, 0, len(s.Domains))
	for host := range s.Domains {
		hosts = append(hosts, host)
	}
	sort.Strings(hosts)
	for _, host := range hosts {
		rec := s.Domains[host]
		recOut := map[string]any{}
		if rec.Direct != nil {
			directOut := map[string]any{}
			if len(rec.Direct.IPs) > 0 && rec.Direct.LastResolved > 0 {
				directOut["ips"] = rec.Direct.IPs
				directOut["last_resolved"] = rec.Direct.LastResolved
			}
			if kind, ok := normalizeCacheErrorKind(rec.Direct.LastErrorKind); ok && rec.Direct.LastErrorAt > 0 {
				directOut["last_error_kind"] = string(kind)
				directOut["last_error_at"] = rec.Direct.LastErrorAt
			}
			if rec.Direct.Score != 0 {
				directOut["score"] = rec.Direct.Score
			}
			if st := normalizeDomainState(rec.Direct.State, rec.Direct.Score); st != "" {
				directOut["state"] = st
			}
			if rec.Direct.QuarantineUntil > 0 {
				directOut["quarantine_until"] = rec.Direct.QuarantineUntil
			}
			if len(directOut) > 0 {
				recOut["direct"] = directOut
			}
		}
		if rec.Wildcard != nil {
			wildOut := map[string]any{}
			if len(rec.Wildcard.IPs) > 0 && rec.Wildcard.LastResolved > 0 {
				wildOut["ips"] = rec.Wildcard.IPs
				wildOut["last_resolved"] = rec.Wildcard.LastResolved
			}
			if kind, ok := normalizeCacheErrorKind(rec.Wildcard.LastErrorKind); ok && rec.Wildcard.LastErrorAt > 0 {
				wildOut["last_error_kind"] = string(kind)
				wildOut["last_error_at"] = rec.Wildcard.LastErrorAt
			}
			if rec.Wildcard.Score != 0 {
				wildOut["score"] = rec.Wildcard.Score
			}
			if st := normalizeDomainState(rec.Wildcard.State, rec.Wildcard.Score); st != "" {
				wildOut["state"] = st
			}
			if rec.Wildcard.QuarantineUntil > 0 {
				wildOut["quarantine_until"] = rec.Wildcard.QuarantineUntil
			}
			if len(wildOut) > 0 {
				recOut["wildcard"] = wildOut
			}
		}
		if len(recOut) > 0 {
			domainsAny[host] = recOut
		}
	}
	return out
}

func (s domainCacheState) formatStateSummary(now int) string {
	type counters struct {
		active     int
		stable     int
		suspect    int
		quarantine int
		hardQuar   int
	}
	add := func(c *counters, entry *domainCacheEntry) {
		if entry == nil {
			return
		}
		st := normalizeDomainState(entry.State, entry.Score)
		if entry.QuarantineUntil > now {
			// Keep hard quarantine state if explicitly marked,
			// otherwise active quarantine bucket.
			if st == domainStateHardQuar {
				c.hardQuar++
				return
			}
			c.quarantine++
			return
		}
		switch st {
		case domainStateActive:
			c.active++
		case domainStateStable:
			c.stable++
		case domainStateSuspect:
			c.suspect++
		case domainStateQuarantine:
			c.quarantine++
		case domainStateHardQuar:
			c.hardQuar++
		}
	}
	var c counters
	for _, rec := range s.Domains {
		add(&c, rec.Direct)
		add(&c, rec.Wildcard)
	}
	total := c.active + c.stable + c.suspect + c.quarantine + c.hardQuar
	if total == 0 {
		return ""
	}
	return fmt.Sprintf(
		"active=%d stable=%d suspect=%d quarantine=%d hard_quarantine=%d total=%d",
		c.active, c.stable, c.suspect, c.quarantine, c.hardQuar, total,
	)
}

func digPTR(ip, upstream string, timeout time.Duration, logf func(string, ...any)) ([]string, error) {
	server, port := splitDNS(upstream)
	if server == "" {
		return nil, fmt.Errorf("upstream empty")
	}
	if port == "" {
		port = "53"
	}
	addr := net.JoinHostPort(server, port)
	r := &net.Resolver{
		PreferGo: true,
		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
			d := net.Dialer{}
			return d.DialContext(ctx, "udp", addr)
		},
	}
	ctx, cancel := context.WithTimeout(context.Background(), timeout)
	names, err := r.LookupAddr(ctx, ip)
	cancel()
	if err != nil {
		if logf != nil {
			logf("ptr error %s via %s: %v", ip, addr, err)
		}
		return nil, err
	}
	seen := map[string]struct{}{}
	var out []string
	for _, n := range names {
		n = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(n)), ".")
		if n == "" {
			continue
		}
		if _, ok := seen[n]; !ok {
			seen[n] = struct{}{}
			out = append(out, n)
		}
	}
	return out, nil
}

// ---------------------------------------------------------------------
// EN: `loadDNSConfig` loads dns config from storage or config.
// RU: `loadDNSConfig` - загружает dns config из хранилища или конфига.
// ---------------------------------------------------------------------
func loadDNSConfig(path string, logf func(string, ...any)) dnsConfig {
	cfg := dnsConfig{
		Default:  []string{defaultDNS1, defaultDNS2},
		Meta:     []string{defaultMeta1, defaultMeta2},
		SmartDNS: smartDNSAddr(),
		Mode:     DNSModeDirect,
	}
	activePool := loadEnabledDNSUpstreamPool()
	if len(activePool) > 0 {
		cfg.Default = activePool
		cfg.Meta = activePool
	}

	// 1) Если форсируем SmartDNS — вообще игнорим файл и ходим только через локальный резолвер.
	if smartDNSForced() {
		addr := smartDNSAddr()
		cfg.Default = []string{addr}
		cfg.Meta = []string{addr}
		cfg.SmartDNS = addr
		cfg.Mode = DNSModeSmartDNS

		if logf != nil {
			logf("dns-config: SmartDNS forced (%s), ignore %s", addr, path)
		}
		return cfg
	}

	// 2) Читаем dns-upstreams.conf для legacy-совместимости и smartdns/mode значений.
	data, err := os.ReadFile(path)
	if err != nil {
		if logf != nil {
			logf("dns-config: can't read %s: %v", path, err)
		}
		cfg.Default = mergeDNSUpstreamPools(cfg.Default, resolverFallbackPool())
		cfg.Meta = mergeDNSUpstreamPools(cfg.Meta, resolverFallbackPool())
		return cfg
	}

	var def, meta []string
	lines := strings.Split(string(data), "\n")
	for _, ln := range lines {
		s := strings.TrimSpace(ln)
		if s == "" || strings.HasPrefix(s, "#") {
			continue
		}
		parts := strings.Fields(s)
		if len(parts) < 2 {
			continue
		}
		key := strings.ToLower(parts[0])
		vals := parts[1:]
		switch key {
		case "default":
			for _, v := range vals {
				if n := normalizeDNSUpstream(v, "53"); n != "" {
					def = append(def, n)
				}
			}
		case "meta":
			for _, v := range vals {
				if n := normalizeDNSUpstream(v, "53"); n != "" {
					meta = append(meta, n)
				}
			}
		case "smartdns":
			if len(vals) > 0 {
				if n := normalizeSmartDNSAddr(vals[0]); n != "" {
					cfg.SmartDNS = n
				}
			}
		case "mode":
			if len(vals) > 0 {
				cfg.Mode = normalizeDNSResolverMode(DNSResolverMode(vals[0]), false)
			}
		}
	}
	if len(activePool) == 0 {
		if len(def) > 0 {
			cfg.Default = def
		}
		if len(meta) > 0 {
			cfg.Meta = meta
		}
	}
	cfg.Default = mergeDNSUpstreamPools(cfg.Default, resolverFallbackPool())
	cfg.Meta = mergeDNSUpstreamPools(cfg.Meta, resolverFallbackPool())
	if logf != nil {
		logf("dns-config: accept %s: mode=%s smartdns=%s default=%v; meta=%v", path, cfg.Mode, cfg.SmartDNS, cfg.Default, cfg.Meta)
	}
	return cfg
}

// ---------------------------------------------------------------------
// EN: `readLinesAllowMissing` reads lines allow missing from input data.
// RU: `readLinesAllowMissing` - читает lines allow missing из входных данных.
// ---------------------------------------------------------------------
func readLinesAllowMissing(path string) []string {
	data, err := os.ReadFile(path)
	if err != nil {
		return nil
	}
	return strings.Split(strings.ReplaceAll(string(data), "\r\n", "\n"), "\n")
}

// ---------------------------------------------------------------------
// EN: `loadJSONMap` loads json map from storage or config.
// RU: `loadJSONMap` - загружает json map из хранилища или конфига.
// ---------------------------------------------------------------------
func loadJSONMap(path string) map[string]any {
	data, err := os.ReadFile(path)
	if err != nil {
		return map[string]any{}
	}
	var out map[string]any
	if err := json.Unmarshal(data, &out); err != nil {
		return map[string]any{}
	}
	return out
}

func loadResolverPrecheckLastRun(path string) int {
	m := loadJSONMap(path)
	if len(m) == 0 {
		return 0
	}
	v, ok := parseAnyInt(m["last_run"])
	if !ok || v <= 0 {
		return 0
	}
	return v
}

func saveResolverPrecheckState(path string, ts int, timeoutStats resolverTimeoutRecheckStats) {
	if path == "" || ts <= 0 {
		return
	}
	state := loadJSONMap(path)
	if state == nil {
		state = map[string]any{}
	}
	state["last_run"] = ts
	state["timeout_recheck"] = map[string]any{
		"checked":       timeoutStats.Checked,
		"recovered":     timeoutStats.Recovered,
		"recovered_ips": timeoutStats.RecoveredIPs,
		"still_timeout": timeoutStats.StillTimeout,
		"now_nxdomain":  timeoutStats.NowNXDomain,
		"now_temporary": timeoutStats.NowTemporary,
		"now_other":     timeoutStats.NowOther,
		"no_signal":     timeoutStats.NoSignal,
	}
	saveJSON(state, path)
}

// ---------------------------------------------------------------------
// EN: `saveJSON` saves json to persistent storage.
// RU: `saveJSON` - сохраняет json в постоянное хранилище.
// ---------------------------------------------------------------------
func saveJSON(data any, path string) {
	tmp := path + ".tmp"
	b, err := json.MarshalIndent(data, "", "  ")
	if err != nil {
		return
	}
	_ = os.WriteFile(tmp, b, 0o644)
	_ = os.Rename(tmp, path)
}

// ---------------------------------------------------------------------
// EN: `uniqueStrings` contains core logic for unique strings.
// RU: `uniqueStrings` - содержит основную логику для unique strings.
// ---------------------------------------------------------------------
func uniqueStrings(in []string) []string {
	seen := map[string]struct{}{}
	var out []string
	for _, v := range in {
		if _, ok := seen[v]; !ok {
			seen[v] = struct{}{}
			out = append(out, v)
		}
	}
	return out
}

func pickDNSStartIndex(host string, size int) int {
	if size <= 1 {
		return 0
	}
	h := fnv.New32a()
	_, _ = h.Write([]byte(strings.ToLower(strings.TrimSpace(host))))
	return int(h.Sum32() % uint32(size))
}

func resolverFallbackPool() []string {
	raw := strings.TrimSpace(os.Getenv("RESOLVE_DNS_FALLBACKS"))
	switch strings.ToLower(raw) {
	case "off", "none", "0":
		return nil
	}

	candidates := resolverFallbackDNS
	if raw != "" {
		candidates = nil
		fields := strings.FieldsFunc(raw, func(r rune) bool {
			return r == ',' || r == ';' || r == ' ' || r == '\n' || r == '\t'
		})
		for _, f := range fields {
			if n := normalizeDNSUpstream(f, "53"); n != "" {
				candidates = append(candidates, n)
			}
		}
	}
	return uniqueStrings(candidates)
}

func mergeDNSUpstreamPools(primary, fallback []string) []string {
	maxUpstreams := envInt("RESOLVE_DNS_MAX_UPSTREAMS", 12)
	if maxUpstreams < 1 {
		maxUpstreams = 1
	}
	out := make([]string, 0, len(primary)+len(fallback))
	seen := map[string]struct{}{}
	add := func(items []string) {
		for _, item := range items {
			if len(out) >= maxUpstreams {
				return
			}
			n := normalizeDNSUpstream(item, "53")
			if n == "" {
				continue
			}
			if _, ok := seen[n]; ok {
				continue
			}
			seen[n] = struct{}{}
			out = append(out, n)
		}
	}
	add(primary)
	add(fallback)
	return out
}

// ---------------------------------------------------------------------
// text cleanup + IP classifiers
// ---------------------------------------------------------------------

var reANSI = regexp.MustCompile(`\x1B\[[0-9;]*[A-Za-z]`)

func stripANSI(s string) string {
	return reANSI.ReplaceAllString(s, "")
}

// ---------------------------------------------------------------------
// EN: `isPrivateIPv4` checks whether private i pv4 is true.
// RU: `isPrivateIPv4` - проверяет, является ли private i pv4 истинным условием.
// ---------------------------------------------------------------------
func isPrivateIPv4(ip string) bool {
	parts := strings.Split(strings.Split(ip, "/")[0], ".")
	if len(parts) != 4 {
		return true
	}
	vals := make([]int, 4)
	for i, p := range parts {
		n, err := strconv.Atoi(p)
		if err != nil || n < 0 || n > 255 {
			return true
		}
		vals[i] = n
	}
	if vals[0] == 10 || vals[0] == 127 || vals[0] == 0 {
		return true
	}
	if vals[0] == 192 && vals[1] == 168 {
		return true
	}
	if vals[0] == 172 && vals[1] >= 16 && vals[1] <= 31 {
		return true
	}
	return false
}