From af861d87726e4b14f77e2bed7e4689462506a06d Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:23:54 +0300
Subject: [PATCH 01/19] fix(templates): refuse a template name BIRD already has
 a symbol for

BIRD keeps protocols, templates, defines, functions and filters in one
namespace. A template named like a peer (`template bgp TRANSIT` beside
`protocol bgp TRANSIT`), a prefix set, a community, an RPKI server or
anything birdy generates saved without complaint, then failed every
apply with "Symbol 'TRANSIT' already defined".

store.SymbolUses lists every owner of a name: the tables whose rows
render a symbol, the built-ins birdy renders itself, and the prefixes of
derived names (imp_, ebgp_in_, originate_, ...). A template save refuses
a name any of them holds, and a peer save refuses a template's name, so
the clash cannot be built from either side.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates_test.go       | 39 +++++++++++
 internal/store/symbols.go                   | 78 +++++++++++++++++++++
 internal/web/helpers.go                     | 17 +++++
 internal/web/peer_templates.go              | 13 ++++
 internal/web/peer_templates_handler_test.go | 42 +++++++++++
 internal/web/peers.go                       | 12 ++++
 6 files changed, 201 insertions(+)
 create mode 100644 internal/store/symbols.go

diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index be626bb..cba9d48 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -599,3 +599,42 @@ func TestMigrateBFDTimersFromV38(t *testing.T) {
 		t.Errorf("the template save should reach the linked peer: %+v", p)
 	}
 }
+
+// BIRD keeps protocols, templates, defines and functions in one namespace, so
+// a template named like a peer, a set or a community fails `bird -p` with
+// "Symbol already defined" — after the save, on the next apply. SymbolUses is
+// how a save finds out first.
+func TestSymbolUsesFindsEveryOwnerOfAName(t *testing.T) {
+	s := openTest(t)
+	tmpl, _, _, _ := seedTemplateFixture(t, s)
+	p := validPeer()
+	p.Name = "TRANSIT"
+	if _, err := s.CreatePeer(p); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tc := range []struct{ name, kind string }{
+		{"TRANSIT", "peer"},
+		{tmpl.Name, "peer template"},
+		{"BOGONS_V4", "prefix set"},
+		{"LOCAL_ASN", "built-in"},
+		{"BOGON_ASNS", "built-in"},
+		{"kernel4", "built-in"},
+		{"imp_FOO_v4", "built-in"},
+		{"ebgp_in_edge_v4", "built-in"},
+	} {
+		uses, err := s.SymbolUses(tc.name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(uses) != 1 || uses[0].Kind != tc.kind {
+			t.Errorf("%s: want one %s, got %+v", tc.name, tc.kind, uses)
+		}
+	}
+	if uses, err := s.SymbolUses("FREE_NAME"); err != nil || len(uses) != 0 {
+		t.Errorf("an unused name should have no owner: %+v %v", uses, err)
+	}
+	if uses, _ := s.SymbolUses("TRANSIT"); uses[0].String() != `peer "TRANSIT"` {
+		t.Errorf("an owner should describe itself for the form error, got %q", uses[0].String())
+	}
+}
diff --git a/internal/store/symbols.go b/internal/store/symbols.go
new file mode 100644
index 0000000..78b7af3
--- /dev/null
+++ b/internal/store/symbols.go
@@ -0,0 +1,78 @@
+package store
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+)
+
+// SymbolUse is one thing in the model that renders a BIRD symbol of a given
+// name. BIRD keeps protocols, templates, defines, functions and filters in a
+// single namespace, so two of them sharing a name fail `bird -p` with "Symbol
+// already defined" — the whole config, not just the one block.
+type SymbolUse struct {
+	Kind string // "peer", "peer template", "prefix set", "AS set", "community", "RPKI server", "BMP station" or "built-in"
+	ID   int64  // 0 for a built-in
+	Name string
+}
+
+func (u SymbolUse) String() string {
+	if u.Kind == "built-in" {
+		return "a name birdy generates itself"
+	}
+	return fmt.Sprintf("%s %q", u.Kind, u.Name)
+}
+
+// builtinSymbols are the names birdy renders on its own, outside any table.
+var builtinSymbols = map[string]bool{
+	"LOCAL_ASN": true, "FROM_UPSTREAM": true, "FROM_IX": true, "FROM_CUSTOMER": true, "RPKI_INVALID": true,
+	"BOGON_ASNS": true, "BOGON_ASNS_EXCEPT_PRIVATE": true,
+	"rpki4": true, "rpki6": true,
+	"device1": true, "direct1": true, "kernel4": true, "kernel6": true, "bfd1": true,
+	"static_v4": true, "static_v6": true,
+}
+
+// generatedSymbolPrefixes start the names birdy derives from other objects:
+// policy functions, per-peer filters, originator protocols.
+var generatedSymbolPrefixes = []string{"imp_", "exp_", "ebgp_in_", "ebgp_out_", "ibgp_in_", "ibgp_out_", "originate_"}
+
+// symbolTables are the tables whose rows each render a symbol named by their
+// name column.
+var symbolTables = []struct{ table, kind string }{
+	{"peers", "peer"},
+	{"peer_templates", "peer template"},
+	{"prefix_sets", "prefix set"},
+	{"as_sets", "AS set"},
+	{"communities", "community"},
+	{"rpki_servers", "RPKI server"},
+	{"bmp_stations", "BMP station"},
+}
+
+// SymbolUses lists everything that already renders a BIRD symbol called name,
+// so a save can refuse a name the config could not load with. The caller
+// ignores its own row when renaming in place.
+func (s *Store) SymbolUses(name string) ([]SymbolUse, error) {
+	var out []SymbolUse
+	if builtinSymbols[name] {
+		out = append(out, SymbolUse{Kind: "built-in", Name: name})
+	}
+	for _, prefix := range generatedSymbolPrefixes {
+		if strings.HasPrefix(name, prefix) {
+			out = append(out, SymbolUse{Kind: "built-in", Name: name})
+			break
+		}
+	}
+	for _, st := range symbolTables {
+		var id int64
+		// The table name comes from the fixed list above, never from input.
+		err := s.db.QueryRow(`SELECT id FROM `+st.table+` WHERE name = ?`, name).Scan(&id)
+		if err == nil {
+			out = append(out, SymbolUse{Kind: st.kind, ID: id, Name: name})
+			continue
+		}
+		if err != sql.ErrNoRows {
+			return nil, fmt.Errorf("store: symbol uses in %s: %w", st.table, err)
+		}
+	}
+	return out, nil
+}
diff --git a/internal/web/helpers.go b/internal/web/helpers.go
index d226743..555e3d8 100644
--- a/internal/web/helpers.go
+++ b/internal/web/helpers.go
@@ -146,3 +146,20 @@ func tabParam(r *http.Request, allowed ...string) string {
 func isUniqueViolation(err error) bool {
 	return err != nil && strings.Contains(err.Error(), "UNIQUE constraint failed")
 }
+
+// symbolClash returns the form error for a name the config could not load
+// with: BIRD keeps protocols, templates and defines in one namespace, so a
+// second owner fails `bird -p` with "Symbol already defined". counts picks
+// which existing owners matter to this save; "" means the name is free.
+func (s *Server) symbolClash(name string, counts func(store.SymbolUse) bool) (string, error) {
+	uses, err := s.store.SymbolUses(name)
+	if err != nil {
+		return "", err
+	}
+	for _, u := range uses {
+		if counts(u) {
+			return "BIRD keeps every name in one namespace, and " + u.String() + " already uses this name.", nil
+		}
+	}
+	return "", nil
+}
diff --git a/internal/web/peer_templates.go b/internal/web/peer_templates.go
index 37d27c9..0015ae7 100644
--- a/internal/web/peer_templates.go
+++ b/internal/web/peer_templates.go
@@ -186,6 +186,19 @@ func (s *Server) handlePeerTemplateSave(w http.ResponseWriter, r *http.Request)
 	if msg := s.checkCommunityRefs(t.ImportCommunities); msg != "" {
 		errs["importCommunities"] = msg
 	}
+	// A template renders `template bgp NAME`, so its name must not already be a
+	// peer, a set, a community or anything birdy generates. Another template
+	// with it is the unique index's to report.
+	if _, taken := errs["name"]; !taken {
+		msg, err := s.symbolClash(t.Name, func(u store.SymbolUse) bool { return u.Kind != "peer template" })
+		if err != nil {
+			s.serverError(w, "check template name", err)
+			return
+		}
+		if msg != "" {
+			errs["name"] = msg
+		}
+	}
 
 	var rewrote int
 	if len(errs) == 0 {
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index c913fdc..2cb9e39 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -437,3 +437,45 @@ func TestPeerTemplateBFDTimersShowInListAndPreview(t *testing.T) {
 		t.Error("the template preview should render the BFD timers")
 	}
 }
+
+// BIRD has one namespace for protocols, templates and defines; a clash only
+// surfaced as "Symbol already defined" on the next apply. Both saves refuse it.
+func TestTemplateAndPeerNamesCannotShareABIRDSymbol(t *testing.T) {
+	env := newTestEnv(t, false)
+	withIdentity(t, env)
+	peer := peerForm()
+	peer.Set("name", "TRANSIT")
+	if rec := env.do(t, "POST", "/peers/new", peer); rec.Code != http.StatusSeeOther {
+		t.Fatalf("peer create: %d %s", rec.Code, rec.Body)
+	}
+
+	for _, clash := range []struct{ name, owner string }{{"TRANSIT", "peer"}, {"BOGONS_V4", "prefix set"}, {"LOCAL_ASN", "birdy generates"}} {
+		form := templateForm(env, t)
+		form.Set("name", clash.name)
+		rec := env.do(t, "POST", "/peers/templates/new", form)
+		if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "already uses this name") || !strings.Contains(rec.Body.String(), clash.owner) {
+			t.Errorf("template %s should be refused for clashing with a %s: %d", clash.name, clash.owner, rec.Code)
+		}
+		if _, err := env.store.GetPeerTemplateByName(clash.name); err == nil {
+			t.Errorf("template %s must not be stored", clash.name)
+		}
+	}
+
+	// Saving a template under its own name is not a clash with itself.
+	tmpl := createTemplate(env, t)
+	form := templateForm(env, t)
+	form.Set("importLimit", "60000")
+	if rec := env.do(t, "POST", "/peers/templates/"+tmpl.Name+"/edit", form); rec.Code != http.StatusSeeOther {
+		t.Errorf("re-saving a template under its own name: %d", rec.Code)
+	}
+
+	// And from the other side: a peer cannot take a template's name.
+	peer.Set("name", tmpl.Name)
+	rec := env.do(t, "POST", "/peers/new", peer)
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "already uses this name") {
+		t.Errorf("a peer named like a template should be refused: %d", rec.Code)
+	}
+	if _, err := env.store.GetPeerByName(tmpl.Name); err == nil {
+		t.Error("the clashing peer must not be stored")
+	}
+}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index 36d31b3..f0f4c7e 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -300,6 +300,18 @@ func (s *Server) handlePeerSave(w http.ResponseWriter, r *http.Request) {
 	if msg := s.checkCommunityRefs(p.ImportCommunities); msg != "" {
 		errs["importCommunities"] = msg
 	}
+	// Another peer with the name is the unique index's to report; a template
+	// with it would be a second `bgp` symbol of the same name.
+	if _, taken := errs["name"]; !taken {
+		msg, err := s.symbolClash(p.Name, func(u store.SymbolUse) bool { return u.Kind == "peer template" })
+		if err != nil {
+			s.serverError(w, "check peer name", err)
+			return
+		}
+		if msg != "" {
+			errs["name"] = msg
+		}
+	}
 
 	if len(errs) == 0 {
 		var err error

From 0e3f5407ed26f97b5ba0c39e7c64e9961dd1c4f3 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:24:33 +0300
Subject: [PATCH 02/19] fix(templates): a community a template references is in
 use

The delete guard scanned peers and policies but not templates, so a
community named only by a template (say one with no peers linked yet)
could be deleted. Every peer attached to that template afterwards then
referenced an undefined symbol: danger findings on Changes, `bird -p`
failing the apply, and a template that would not save until someone
recreated the community. Templates now count as users.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/library_communities.go         | 14 +++++++++++-
 internal/web/peer_templates_handler_test.go | 25 +++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/internal/web/library_communities.go b/internal/web/library_communities.go
index b4237df..9014e26 100644
--- a/internal/web/library_communities.go
+++ b/internal/web/library_communities.go
@@ -173,7 +173,9 @@ func (s *Server) checkCommunityRefs(text string) string {
 	return "Unknown community: " + strings.Join(missing, ", ") + ". Define it under Library → Communities."
 }
 
-// communityInUse lists the peers and policies that reference a community by name.
+// communityInUse lists the peers, peer templates and policies that reference a
+// community by name. A template counts even with no peers linked: attaching one
+// later copies its references onto the peer.
 func (s *Server) communityInUse(name string) ([]string, error) {
 	var users []string
 	peers, err := s.store.ListPeers()
@@ -188,6 +190,16 @@ func (s *Server) communityInUse(name string) ([]string, error) {
 			users = append(users, "peer "+p.Name)
 		}
 	}
+	templates, err := s.store.ListPeerTemplates()
+	if err != nil {
+		return nil, err
+	}
+	for _, t := range templates {
+		if slices.Contains(store.NamedCommunityRefs(t.ExportCommunities), name) ||
+			slices.Contains(store.NamedCommunityRefs(t.ImportCommunities), name) {
+			users = append(users, "peer template "+t.Name)
+		}
+	}
 	policies, err := s.store.ListPolicies()
 	if err != nil {
 		return nil, err
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index 2cb9e39..5e339d1 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -479,3 +479,28 @@ func TestTemplateAndPeerNamesCannotShareABIRDSymbol(t *testing.T) {
 		t.Error("the clashing peer must not be stored")
 	}
 }
+
+// A template's community references are copied onto every peer linked later,
+// so a community only a template names is still in use: deleting it would
+// make the next attach render an undefined symbol.
+func TestCommunityUsedOnlyByATemplateCannotBeDeleted(t *testing.T) {
+	env := newTestEnv(t, false)
+	withIdentity(t, env)
+	if rec := env.do(t, "POST", "/library/communities/new", url.Values{"name": {"NO_EXPORT_X"}, "value": {"65000:7"}}); rec.Code != http.StatusSeeOther {
+		t.Fatalf("community create: %d %s", rec.Code, rec.Body)
+	}
+	form := templateForm(env, t)
+	form.Set("exportCommunities", "NO_EXPORT_X")
+	if rec := env.do(t, "POST", "/peers/templates/new", form); rec.Code != http.StatusSeeOther {
+		t.Fatalf("template create: %d %s", rec.Code, rec.Body)
+	}
+
+	env.do(t, "POST", "/library/communities/NO_EXPORT_X/delete", nil)
+	if _, err := env.store.GetCommunityDefByName("NO_EXPORT_X"); err != nil {
+		t.Errorf("a community a template references must not be deleted: %v", err)
+	}
+	users, err := env.srv.communityInUse("NO_EXPORT_X")
+	if err != nil || len(users) != 1 || users[0] != "peer template IX_PEERS" {
+		t.Errorf("the template should be named as the user: %v %v", users, err)
+	}
+}

From 51baf441eb121052487a0d697dfe9eccf99d44d2 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:25:03 +0300
Subject: [PATCH 03/19] fix(templates): clear the drain when a template makes a
 peer iBGP

validateShape clears Drained on an iBGP peer, but a template save or a
link rewrites a peer's shape without the peer form running. A drained
eBGP peer attached to an iBGP template, or linked to a template whose
role became ibgp, stayed drained. With chains attached, its iBGP filters
then set local-pref 0 and tagged exports with GRACEFUL_SHUTDOWN, from a
switch the form hides on iBGP. updatePeerShape now clears it for iBGP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates_test.go | 53 +++++++++++++++++++++++++++
 internal/store/peers.go               | 12 +++++-
 2 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index cba9d48..2e7361d 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -638,3 +638,56 @@ func TestSymbolUsesFindsEveryOwnerOfAName(t *testing.T) {
 		t.Errorf("an owner should describe itself for the form error, got %q", uses[0].String())
 	}
 }
+
+// Drain is an eBGP signal; validateShape clears it when a peer is iBGP. A
+// template can make a peer iBGP without the peer form ever running, so the
+// shape write clears it too — or the iBGP filters would carry graceful
+// shutdown and local-pref 0, from a switch the form then hides.
+func TestTemplatePathsClearDrainWhenThePeerBecomesIBGP(t *testing.T) {
+	s := openTest(t)
+	ibgp := PeerTemplate{Name: "CORE", Role: RoleIBGP, ImportLimitAction: "restart"}
+	if errs := ibgp.Validate(); len(errs) != 0 {
+		t.Fatal(errs)
+	}
+	id, err := s.CreatePeerTemplate(ibgp, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	p := validPeer()
+	p.Drained = true
+	pid, err := s.CreatePeer(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.LinkPeerToTemplate(pid, id); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := s.GetPeer(pid); got.Role != RoleIBGP || got.Drained {
+		t.Errorf("linking to an iBGP template should clear the drain: %+v", got)
+	}
+
+	// The same through a template save that changes the role.
+	ix, sanity, _, _ := seedTemplateFixture(t, s)
+	q := validPeer()
+	q.Name, q.Drained = "rs1_v4", true
+	qid, err := s.CreatePeer(q)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.LinkPeerToTemplate(qid, ix.ID); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := s.GetPeer(qid); !got.Drained {
+		t.Fatalf("an eBGP template should leave the drain alone: %+v", got)
+	}
+	ix.Role = RoleIBGP
+	if errs := ix.Validate(); len(errs) != 0 {
+		t.Fatal(errs)
+	}
+	if _, err := s.UpdatePeerTemplate(ix, []int64{sanity.ID}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ := s.GetPeer(qid); got.Drained {
+		t.Errorf("a template turned iBGP should clear its peers' drain: %+v", got)
+	}
+}
diff --git a/internal/store/peers.go b/internal/store/peers.go
index a754f8a..dd848e9 100644
--- a/internal/store/peers.go
+++ b/internal/store/peers.go
@@ -499,18 +499,26 @@ func (s *Store) UpdatePeer(p Peer) error {
 // and the link itself. It is how a template save and a link reach into a peer
 // without touching its identity, password or operational state, and it runs
 // inside the caller's transaction so thirty peers change together or not at all.
+//
+// The one exception to "shape only" is the drain. It is the peer's own switch,
+// but an eBGP one: validateShape clears it on an iBGP peer, and a template can
+// make a peer iBGP without the peer form ever running, so the shape write
+// clears it too rather than leave graceful shutdown on an internal session.
 func updatePeerShape(tx *sql.Tx, p Peer) error {
+	if p.IsIBGP() {
+		p.Drained = false
+	}
 	res, err := tx.Exec(`
 		UPDATE peers SET role = ?, multihop = ?, passive = ?, import_limit = ?, import_limit_action = ?,
 		                 import_communities = ?, export_communities = ?, prepend_count = ?,
 		                 enforce_first_as = ?, origin_peer_only = ?, bgp_role = ?, gtsm = ?, bfd = ?, bfd_interval = ?, bfd_multiplier = ?, graceful_restart = ?,
-		                 next_hop_self = ?, rr_client = ?, ibgp_export_default = ?,
+		                 next_hop_self = ?, rr_client = ?, ibgp_export_default = ?, drained = ?,
 		                 template_id = ?, template_overrides = ?, updated_at = ?
 		WHERE id = ?`,
 		p.Role, p.Multihop, p.Passive, p.ImportLimit, p.ImportLimitAction,
 		p.ImportCommunities, p.ExportCommunities, p.PrependCount,
 		p.EnforceFirstAS, p.OriginPeerOnly, p.BGPRole, p.GTSM, p.BFD, p.BFDInterval, p.BFDMultiplier, p.GracefulRestart,
-		p.NextHopSelf, p.RRClient, p.IBGPExportDefault,
+		p.NextHopSelf, p.RRClient, p.IBGPExportDefault, p.Drained,
 		p.TemplateID, p.TemplateOverrides, now(), p.ID)
 	if err != nil {
 		return fmt.Errorf("store: update peer shape: %w", err)

From cec60038673623a0da6ae000357fb241ad7e7748 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:25:44 +0300
Subject: [PATCH 04/19] fix(lint): name the peers a template-folded finding is
 about

Folding replaced the peer names with "IX_PEERS (2 peers)". That is fine
for a finding the template can fix, but not for one it cannot: two
drained sessions, or two link-local neighbors without an interface,
folded into a line that sent the operator to the template and left no
way to tell which sessions to fix. The count was also of findings, not
peers, so one peer tripping a check twice showed as "(2 peers)".

A folded line now reads "IX_PEERS: rs3_v4, rs7_v4" (the first five,
then "and N more"), and a group folds only across two or more distinct
peers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/USAGE.md                         |  3 ++-
 internal/render/lint.go               | 22 ++++++++++++++++-----
 internal/render/peer_template_test.go | 28 ++++++++++++++++++++++++++-
 3 files changed, 46 insertions(+), 7 deletions(-)

diff --git a/docs/USAGE.md b/docs/USAGE.md
index 1f9eb1b..b372275 100644
--- a/docs/USAGE.md
+++ b/docs/USAGE.md
@@ -517,7 +517,8 @@ until you have looked.
   deleted while a template chains it. A linked peer's protocol block in the rendered
   config carries a comment naming its template. On the Changes page, identical lint
   findings about peers of one template fold into a single line attributed to the
-  template — thirty peers missing an import limit is one thing to fix, once.
+  template and naming the peers — thirty peers missing an import limit is one thing
+  to fix, once.
 
 In the rendered config a template is BIRD's own `template bgp NAME { … }`, carrying the
 session options every linked peer shares — multihop, passive, BFD and its timers, GTSM, graceful restart,
diff --git a/internal/render/lint.go b/internal/render/lint.go
index b22aa3d..1534758 100644
--- a/internal/render/lint.go
+++ b/internal/render/lint.go
@@ -3,6 +3,7 @@ package render
 import (
 	"fmt"
 	"net/netip"
+	"slices"
 	"strings"
 
 	"github.com/floreabogdan/birdy/internal/store"
@@ -387,14 +388,25 @@ func foldByTemplate(ws []Warning, peers []store.Peer) []Warning {
 	folded := map[int]Warning{} // first member's index -> the one finding that replaces the group
 	drop := map[int]bool{}
 	for k, idx := range members {
-		if len(idx) < 2 {
+		// Fold by distinct peer: one peer tripping the same check twice is not a
+		// pattern across the template.
+		var names []string
+		for _, i := range idx {
+			if !slices.Contains(names, ws[i].Peer) {
+				names = append(names, ws[i].Peer)
+			}
+		}
+		if len(names) < 2 {
 			continue
 		}
-		folded[idx[0]] = Warning{
-			Severity: k.severity,
-			Peer:     fmt.Sprintf("%s (%d peers)", k.template, len(idx)),
-			Message:  k.message,
+		// The line still names its peers: the finding may be one the template
+		// cannot fix (a drain, a link-local neighbor), and the operator has to
+		// find the sessions either way.
+		label := k.template + ": " + strings.Join(names[:min(len(names), 5)], ", ")
+		if len(names) > 5 {
+			label += fmt.Sprintf(" and %d more", len(names)-5)
 		}
+		folded[idx[0]] = Warning{Severity: k.severity, Peer: label, Message: k.message}
 		for _, i := range idx[1:] {
 			drop[i] = true
 		}
diff --git a/internal/render/peer_template_test.go b/internal/render/peer_template_test.go
index 163a1c1..2604575 100644
--- a/internal/render/peer_template_test.go
+++ b/internal/render/peer_template_test.go
@@ -61,7 +61,7 @@ func TestLintFoldsIdenticalFindingsByTemplate(t *testing.T) {
 	var folded, perPeer, ownLines, private int
 	for _, w := range ws {
 		switch {
-		case w.Peer == "IX_PEERS (3 peers)" && strings.HasPrefix(w.Message, "No import limit"):
+		case w.Peer == "IX_PEERS: rs1_v4, rs2_v4, rs3_v4" && strings.HasPrefix(w.Message, "No import limit"):
 			folded++
 		case strings.HasPrefix(w.Peer, "rs") && strings.HasPrefix(w.Message, "No import limit"):
 			perPeer++
@@ -264,3 +264,29 @@ func TestTemplateBlockCarriesBFDTimers(t *testing.T) {
 		t.Errorf("a linked peer must leave BFD to the template:\n%s", blk)
 	}
 }
+
+// A folded line still has to say which sessions it is about: the finding may be
+// one the template cannot fix (a drain, a link-local neighbor), and the
+// operator has to find the peers. It folds by distinct peer, so one peer that
+// trips the same check twice is not "2 peers".
+func TestFoldNamesThePeersAndCountsThemOnce(t *testing.T) {
+	var peers []store.Peer
+	for _, n := range []string{"rs1_v4", "rs2_v4", "rs3_v4", "rs4_v4", "rs5_v4", "rs6_v4", "rs7_v4"} {
+		peers = append(peers, store.Peer{Name: n, TemplateName: "IX_PEERS"})
+	}
+	w := func(peer string) Warning { return Warning{Severity: "warning", Peer: peer, Message: "same thing"} }
+
+	if got := foldByTemplate([]Warning{w("rs1_v4"), w("rs1_v4")}, peers); len(got) != 2 || got[0].Peer != "rs1_v4" {
+		t.Errorf("one peer's repeated finding must not fold as if it were two peers: %+v", got)
+	}
+	if got := foldByTemplate([]Warning{w("rs1_v4"), w("rs1_v4"), w("rs2_v4")}, peers); len(got) != 1 || got[0].Peer != "IX_PEERS: rs1_v4, rs2_v4" {
+		t.Errorf("two distinct peers should fold into one line naming both: %+v", got)
+	}
+	var all []Warning
+	for _, p := range peers {
+		all = append(all, w(p.Name))
+	}
+	if got := foldByTemplate(all, peers); len(got) != 1 || got[0].Peer != "IX_PEERS: rs1_v4, rs2_v4, rs3_v4, rs4_v4, rs5_v4 and 2 more" {
+		t.Errorf("a long group should name the first five and count the rest: %+v", got)
+	}
+}

From 40370adffe629f8d5fa2d62a2aab88370cefb657 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:26:29 +0300
Subject: [PATCH 05/19] fix(peers): the bulk bar has no default action

The bulk select's first option, and so its default, was "Attach to
<first template>", and "Detach" posted an empty value. Selecting twenty
peers and pressing "Apply to selected" without touching the select, past
a generic confirm, linked all twenty to whichever template sorted first,
overwriting their chains, limits and safeguards.

The select now starts on a disabled "Choose an action" placeholder and
is required. Detach posts an explicit "detach". The handler refuses an
empty choice instead of reading it as detach.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/peer_templates_followups_test.go | 13 ++++++++++++-
 internal/web/peers.go                         | 16 ++++++++++++----
 internal/web/templates/peers.html             |  5 +++--
 3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/internal/web/peer_templates_followups_test.go b/internal/web/peer_templates_followups_test.go
index dd93db7..0d6e7b1 100644
--- a/internal/web/peer_templates_followups_test.go
+++ b/internal/web/peer_templates_followups_test.go
@@ -143,7 +143,9 @@ func TestBulkAttachAndDetach(t *testing.T) {
 		}
 	}
 	body := env.do(t, "GET", "/peers", nil).Body.String()
-	for _, want := range []string{`id="bulk-attach"`, `name="peer" value="rs1_v4" form="bulk-attach"`, `Attach to IX_PEERS`, `data-check-all`} {
+	for _, want := range []string{`id="bulk-attach"`, `name="peer" value="rs1_v4" form="bulk-attach"`, `Attach to IX_PEERS`, `data-check-all`,
+		// No action is preselected: "Apply" with the default must not attach anything.
+		`<select name="templateId" required`, `<option value="" disabled selected>Choose an action</option>`, `<option value="detach">Detach from template</option>`} {
 		if !strings.Contains(body, want) {
 			t.Errorf("peers list should carry the bulk bar, missing %q", want)
 		}
@@ -169,7 +171,16 @@ func TestBulkAttachAndDetach(t *testing.T) {
 		t.Errorf("unselected peer must be untouched: %+v", p)
 	}
 
+	// No choice made is not "detach": nothing changes and the operator is asked.
 	rec = env.do(t, "POST", "/peers/attach", url.Values{"peer": {"rs1_v4"}, "templateId": {""}})
+	if flash := flashOf(rec); !strings.Contains(flash, "Choose whether to attach") {
+		t.Errorf("an empty choice should be refused: %q", flash)
+	}
+	if p, _ := env.store.GetPeerByName("rs1_v4"); !p.TemplateID.Valid {
+		t.Error("an empty choice must not detach")
+	}
+
+	rec = env.do(t, "POST", "/peers/attach", url.Values{"peer": {"rs1_v4"}, "templateId": {"detach"}})
 	if flash := flashOf(rec); !strings.Contains(flash, "Detached 1 peer") {
 		t.Errorf("detach flash: %q", flash)
 	}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index f0f4c7e..92c64ec 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -367,10 +367,19 @@ func (s *Server) handlePeersAttach(w http.ResponseWriter, r *http.Request) {
 		s.flashRedirect(w, r, "/peers", "Select at least one peer first.", true)
 		return
 	}
+	// The action is explicit: "detach", or a template id. An empty choice is
+	// the select's placeholder, and must never fall through to either.
+	choice := r.FormValue("templateId")
+	if choice == "" {
+		s.flashRedirect(w, r, "/peers", "Choose whether to attach the selected peers to a template or detach them.", true)
+		return
+	}
 	var tmpl store.PeerTemplate
-	if id := formNullInt(r, "templateId"); id.Valid {
-		t, err := s.store.GetPeerTemplate(id.Int64)
-		if err == store.ErrNotFound {
+	if choice != "detach" {
+		id, perr := strconv.ParseInt(choice, 10, 64)
+		var err error
+		tmpl, err = s.store.GetPeerTemplate(id)
+		if perr != nil || err == store.ErrNotFound {
 			s.flashRedirect(w, r, "/peers", "That template no longer exists.", true)
 			return
 		}
@@ -378,7 +387,6 @@ func (s *Server) handlePeersAttach(w http.ResponseWriter, r *http.Request) {
 			s.serverError(w, "get peer template", err)
 			return
 		}
-		tmpl = t
 	}
 
 	var done, missing []string
diff --git a/internal/web/templates/peers.html b/internal/web/templates/peers.html
index 5da2567..5cf3e20 100644
--- a/internal/web/templates/peers.html
+++ b/internal/web/templates/peers.html
@@ -104,9 +104,10 @@
 				     per-row toggle forms rule out wrapping it. */}}
 				<form id="bulk-attach" method="post" action="/peers/attach" class="bulk-bar" data-confirm="Attach or detach the selected peers? Attaching replaces each peer's policy chains, limit and safeguards with the template's. Nothing reaches the router until you apply.">
 					<span class="text-muted" data-selected-count>none selected</span>
-					<select name="templateId" aria-label="Template to attach the selected peers to">
+					<select name="templateId" required aria-label="Attach the selected peers to a template, or detach them">
+						<option value="" disabled selected>Choose an action</option>
 						{{range .Templates}}<option value="{{.ID}}">Attach to {{.Name}}</option>{{end}}
-						<option value="">Detach from template</option>
+						<option value="detach">Detach from template</option>
 					</select>
 					<button type="submit" class="btn">Apply to selected</button>
 					<span class="hint">Attaching gives each selected peer the template's chains, limit and safeguards; detaching leaves every value in place and makes the peer own it.{{if not .Templates}} No templates yet &mdash; <a href="/peers/templates/new">create one</a>.{{end}}</span>

From edca30bd81d6de637fb45dedfd8c2a70587be66c Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:27:33 +0300
Subject: [PATCH 06/19] fix(templates): attach and link in one transaction,
 reading inside it

LinkPeerToTemplate read the template and the peer before opening its
transaction, so a template save committing in between (which rewrites
only the peers linked at its own commit) missed the newly linked peer.
That peer kept the old chain and limit while rendering session options
from the new template block, until the next template save. The bulk bar
also committed one transaction per peer and audited only after the loop,
so an error on peer 12 of 30 left 11 rewritten and none audited.

store.AttachPeers links (or, with template 0, detaches) a whole
selection in one transaction, reading the template and each peer
through it. LinkPeerToTemplate and DetachPeer are its one-peer cases,
and the bulk handler resolves names first, then makes one call.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates.go      | 75 +++++++++++++++++++--------
 internal/store/peer_templates_test.go | 44 ++++++++++++++++
 internal/web/peers.go                 | 17 +++---
 3 files changed, 107 insertions(+), 29 deletions(-)

diff --git a/internal/store/peer_templates.go b/internal/store/peer_templates.go
index 8d4aa7e..448a1ea 100644
--- a/internal/store/peer_templates.go
+++ b/internal/store/peer_templates.go
@@ -180,14 +180,25 @@ func (s *Store) GetPeerTemplateByName(name string) (PeerTemplate, error) {
 }
 
 func (s *Store) getTemplate(query string, arg any) (PeerTemplate, error) {
-	t, err := scanTemplate(s.db.QueryRow(query, arg))
+	return s.getTemplateIn(s.db, query, arg)
+}
+
+// rowQuerier is querier plus single-row reads, so a template or a peer can be
+// read inside the transaction that is about to write from it.
+type rowQuerier interface {
+	querier
+	QueryRow(query string, args ...any) *sql.Row
+}
+
+func (s *Store) getTemplateIn(q rowQuerier, query string, arg any) (PeerTemplate, error) {
+	t, err := scanTemplate(q.QueryRow(query, arg))
 	if err == sql.ErrNoRows {
 		return PeerTemplate{}, ErrNotFound
 	}
 	if err != nil {
 		return PeerTemplate{}, fmt.Errorf("store: get peer template: %w", err)
 	}
-	if t.ImportPolicies, t.ExportPolicies, err = s.chainFor(s.db, "template_policies", "template_id", t.ID); err != nil {
+	if t.ImportPolicies, t.ExportPolicies, err = s.chainFor(q, "template_policies", "template_id", t.ID); err != nil {
 		return PeerTemplate{}, err
 	}
 	return t, nil
@@ -293,26 +304,52 @@ func (s *Store) UpdatePeerTemplate(t PeerTemplate, importIDs, exportIDs []int64)
 // template's shape over the peer's own. Overrides are cleared: a peer that
 // changes template takes the new template's word for everything.
 func (s *Store) LinkPeerToTemplate(peerID, templateID int64) error {
-	t, err := s.GetPeerTemplate(templateID)
-	if err != nil {
-		return err
-	}
-	p, err := s.GetPeer(peerID)
-	if err != nil {
-		return err
-	}
-	p.TemplateOverrides = ""
-	t.ApplyTo(&p)
+	return s.AttachPeers([]int64{peerID}, templateID)
+}
+
+// AttachPeers links every peer to a template — or, with templateID 0, detaches
+// them — in one transaction. The template and each peer are read inside it, so
+// a template save that commits meanwhile cannot leave a peer linked to the
+// shape it replaced, and one peer that cannot be linked leaves the rest as
+// they were rather than half the selection rewritten.
+func (s *Store) AttachPeers(peerIDs []int64, templateID int64) error {
 	tx, err := s.db.Begin()
 	if err != nil {
 		return err
 	}
 	defer tx.Rollback()
-	if err := updatePeerShape(tx, p); err != nil {
-		return err
+	var t PeerTemplate
+	if templateID != 0 {
+		if t, err = s.getTemplateIn(tx, `SELECT `+templateCols+` FROM peer_templates WHERE id = ?`, templateID); err != nil {
+			return err
+		}
 	}
-	if err := replaceChain(tx, "peer_policies", "peer_id", p.ID, PolicyIDs(t.ImportPolicies), PolicyIDs(t.ExportPolicies)); err != nil {
-		return err
+	for _, id := range peerIDs {
+		if templateID == 0 {
+			res, err := tx.Exec(`UPDATE peers SET template_id = NULL, template_overrides = '', updated_at = ? WHERE id = ?`, now(), id)
+			if err != nil {
+				return fmt.Errorf("store: detach peer: %w", err)
+			}
+			if err := affectedOne(res); err != nil {
+				return err
+			}
+			continue
+		}
+		p, err := scanPeer(tx.QueryRow(`SELECT `+peerCols+` FROM peers WHERE id = ?`, id))
+		if err == sql.ErrNoRows {
+			return ErrNotFound
+		}
+		if err != nil {
+			return fmt.Errorf("store: get peer: %w", err)
+		}
+		p.TemplateOverrides = ""
+		t.ApplyTo(&p)
+		if err := updatePeerShape(tx, p); err != nil {
+			return err
+		}
+		if err := replaceChain(tx, "peer_policies", "peer_id", p.ID, PolicyIDs(t.ImportPolicies), PolicyIDs(t.ExportPolicies)); err != nil {
+			return err
+		}
 	}
 	return tx.Commit()
 }
@@ -322,11 +359,7 @@ func (s *Store) LinkPeerToTemplate(peerID, templateID int64) error {
 // on the peers list and nothing else goes through here; the form detaches by
 // saving the peer with no template.
 func (s *Store) DetachPeer(peerID int64) error {
-	res, err := s.db.Exec(`UPDATE peers SET template_id = NULL, template_overrides = '', updated_at = ? WHERE id = ?`, now(), peerID)
-	if err != nil {
-		return fmt.Errorf("store: detach peer: %w", err)
-	}
-	return affectedOne(res)
+	return s.AttachPeers([]int64{peerID}, 0)
 }
 
 // PolicyIDs lists a chain's ids in order, for the chain writers.
diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index 2e7361d..e558304 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -691,3 +691,47 @@ func TestTemplatePathsClearDrainWhenThePeerBecomesIBGP(t *testing.T) {
 		t.Errorf("a template turned iBGP should clear its peers' drain: %+v", got)
 	}
 }
+
+// A bulk attach is all or nothing: one peer that cannot be linked leaves every
+// other peer in the request as it was, instead of half the selection rewritten.
+func TestAttachPeersIsAllOrNothing(t *testing.T) {
+	s := openTest(t)
+	tmpl, _, _, _ := seedTemplateFixture(t, s)
+	var ids []int64
+	for _, name := range []string{"rs1_v4", "rs2_v4"} {
+		p := validPeer()
+		p.Name, p.ImportLimit = name, 7
+		id, err := s.CreatePeer(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ids = append(ids, id)
+	}
+
+	if err := s.AttachPeers([]int64{ids[0], 9999}, tmpl.ID); err != ErrNotFound {
+		t.Fatalf("attaching a missing peer should be ErrNotFound, got %v", err)
+	}
+	if p, _ := s.GetPeer(ids[0]); p.TemplateID.Valid || p.ImportLimit != 7 {
+		t.Errorf("a failed bulk attach must not have linked anyone: %+v", p)
+	}
+
+	if err := s.AttachPeers(ids, tmpl.ID); err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range ids {
+		if p, _ := s.GetPeer(id); !p.TemplateID.Valid || p.ImportLimit != 50000 {
+			t.Errorf("both peers should be linked with the template's shape: %+v", p)
+		}
+	}
+	if err := s.AttachPeers(ids, 0); err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range ids {
+		if p, _ := s.GetPeer(id); p.TemplateID.Valid || p.ImportLimit != 50000 {
+			t.Errorf("detaching keeps the values and drops the link: %+v", p)
+		}
+	}
+	if err := s.AttachPeers(ids, 9999); err != ErrNotFound {
+		t.Errorf("attaching to a missing template should be ErrNotFound, got %v", err)
+	}
+}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index 92c64ec..1a42799 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -390,6 +390,7 @@ func (s *Server) handlePeersAttach(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var done, missing []string
+	var ids []int64
 	for _, name := range names {
 		p, err := s.store.GetPeerByName(name)
 		if err == store.ErrNotFound {
@@ -400,16 +401,16 @@ func (s *Server) handlePeersAttach(w http.ResponseWriter, r *http.Request) {
 			s.serverError(w, "get peer", err)
 			return
 		}
-		if tmpl.ID != 0 {
-			err = s.store.LinkPeerToTemplate(p.ID, tmpl.ID)
-		} else {
-			err = s.store.DetachPeer(p.ID)
-		}
-		if err != nil {
-			s.serverError(w, "attach peer to template", err)
+		ids, done = append(ids, p.ID), append(done, name)
+	}
+	// One transaction for the whole selection: either every peer moves, or —
+	// on any error — none does, so a failure never leaves a half-attached,
+	// unaudited group.
+	if len(ids) > 0 {
+		if err := s.store.AttachPeers(ids, tmpl.ID); err != nil {
+			s.serverError(w, "attach peers to template", err)
 			return
 		}
-		done = append(done, name)
 	}
 
 	var msg string

From bc78ff0b2bd717161ded81d12ad02532bd9545b2 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:28:16 +0300
Subject: [PATCH 07/19] fix(templates): an iBGP template previews on an iBGP
 neighbor

The template editor renders the shape on a sample neighbor, always
AS64496. For an iBGP template that is an eBGP session: the preview
showed `neighbor 192.0.2.1 as 64496` and a danger finding against the
template, "marked iBGP but its remote AS is 64496", on every iBGP
template. The sample now uses our own AS when the template is iBGP.

The sample was also named "<template>_example", which exceeds BIRD's
63-character limit for any template name of 56 characters or more, so
those templates showed "Fix the errors above" with nothing to fix. The
template part is now trimmed to fit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/peer_templates.go              | 21 +++++++++++--
 internal/web/peer_templates_handler_test.go | 34 +++++++++++++++++++++
 internal/web/peers.go                       |  2 +-
 internal/web/preview_test.go                |  2 +-
 4 files changed, 54 insertions(+), 5 deletions(-)

diff --git a/internal/web/peer_templates.go b/internal/web/peer_templates.go
index 0015ae7..4e9b228 100644
--- a/internal/web/peer_templates.go
+++ b/internal/web/peer_templates.go
@@ -282,7 +282,7 @@ func (s *Server) handlePeerTemplatePreview(w http.ResponseWriter, r *http.Reques
 	t := templateFromForm(r)
 	t.ImportPolicies = s.resolvePolicies(policiesAll, idList(r.Form["importPolicyIds"]))
 	t.ExportPolicies = s.resolvePolicies(policiesAll, idList(r.Form["exportPolicyIds"]))
-	sample := samplePeer(t)
+	sample := samplePeer(t, s.localASN())
 	preview, previewErr, warnings, err := s.previewWithLibrary(sample, policiesAll, []store.PeerTemplate{t})
 	if err != nil {
 		writeJSON(w, previewResp{Err: "could not load the library"})
@@ -307,14 +307,29 @@ func attributeToTemplate(ws []birdconf.Warning, sampleName, templateName string)
 // preview renders, declared "from" the template so the preview shows exactly
 // what a linked peer's block will look like. It is named after the template
 // with an _example suffix: a protocol cannot share the template's own name.
-func samplePeer(t store.PeerTemplate) store.Peer {
+func samplePeer(t store.PeerTemplate, localASN int64) store.Peer {
 	if t.Name == "" {
 		t.Name = "template"
 	}
 	p := displayPeer(t)
 	p.NeighborIP, p.RemoteASN = sampleNeighborIP, sampleRemoteASN
-	p.Name = t.Name + "_example"
+	// An internal session's neighbor is in our own AS; anything else renders an
+	// eBGP session and trips the "marked iBGP" lint on the template's own sample.
+	if t.IsIBGP() && localASN > 0 {
+		p.RemoteASN = localASN
+	}
+	// Named after the template, within BIRD's 63-character limit.
+	const suffix = "_example"
+	p.Name = t.Name[:min(len(t.Name), 63-len(suffix))] + suffix
 	// A template being created has no id yet; the preview links to it by name.
 	p.TemplateID, p.TemplateName = sql.NullInt64{Int64: max(t.ID, 1), Valid: true}, t.Name
 	return p
 }
+
+// localASN is our own AS from settings, or 0 before the router identity is set.
+func (s *Server) localASN() int64 {
+	if st, ok, err := s.store.GetSettings(); err == nil && ok && st.LocalASN.Valid {
+		return st.LocalASN.Int64
+	}
+	return 0
+}
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index 5e339d1..3fa77bc 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -504,3 +504,37 @@ func TestCommunityUsedOnlyByATemplateCannotBeDeleted(t *testing.T) {
 		t.Errorf("the template should be named as the user: %v %v", users, err)
 	}
 }
+
+// The template preview renders the shape on a sample neighbor. For an iBGP
+// template that neighbor has to be in our own AS, or the preview shows an eBGP
+// session and a false "marked iBGP but its remote AS is…" danger.
+func TestIBGPTemplatePreviewUsesOurOwnAS(t *testing.T) {
+	env := newTestEnv(t, false)
+	withIdentity(t, env)
+	form := templateForm(env, t)
+	form.Set("name", "CORE")
+	form.Set("role", "ibgp")
+	form.Del("importPolicyIds")
+	form.Del("exportPolicyIds")
+	body := env.do(t, "POST", "/peers/templates/preview", form).Body.String()
+	if strings.Contains(body, "is marked iBGP but its remote AS") {
+		t.Errorf("an iBGP template preview must not flag its own sample peer:\n%s", body)
+	}
+	if !strings.Contains(body, "as 65551;") {
+		t.Errorf("the sample iBGP neighbor should be in our own AS:\n%s", body)
+	}
+}
+
+// BIRD names are at most 63 characters. The sample peer is named after the
+// template, so a long template name must still give the preview a valid one.
+func TestLongTemplateNamePreviews(t *testing.T) {
+	env := newTestEnv(t, false)
+	withIdentity(t, env)
+	form := templateForm(env, t)
+	long := "T" + strings.Repeat("x", 59) // 60 characters: valid, but not with "_example" appended
+	form.Set("name", long)
+	body := env.do(t, "POST", "/peers/templates/preview", form).Body.String()
+	if strings.Contains(body, "Fix the errors above") || !strings.Contains(body, "protocol bgp ") {
+		t.Errorf("a valid long template name should still preview:\n%s", body)
+	}
+}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index 1a42799..f9577e0 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -531,7 +531,7 @@ func (s *Server) renderPeerForm(w http.ResponseWriter, v peerFormView) {
 		// declared "from" the template as it is on the form right now.
 		t := store.TemplateFromPeer(v.Peer)
 		t.Name, t.Description = v.Peer.Name, v.Peer.Description
-		subject, templates = samplePeer(t), []store.PeerTemplate{t}
+		subject, templates = samplePeer(t, s.localASN()), []store.PeerTemplate{t}
 	}
 	var perr error
 	if v.Preview, v.PreviewErr, v.Warnings, perr = s.previewWithLibrary(subject, policies, templates); perr != nil {
diff --git a/internal/web/preview_test.go b/internal/web/preview_test.go
index dc41952..4b31151 100644
--- a/internal/web/preview_test.go
+++ b/internal/web/preview_test.go
@@ -248,7 +248,7 @@ func TestPreview(t *testing.T) {
 
 	templateFormV := peerFormView{Active: "peers", IsTemplate: true, Template: ixTemplate, Peer: displayPeer(ixTemplate),
 		Usage: 31, Imports: formV.Imports, Exports: formV.Exports}
-	templateSample := samplePeer(ixTemplate)
+	templateSample := samplePeer(ixTemplate, 0)
 	templateFormV.Preview, templateFormV.PreviewErr, templateFormV.Warnings = previewPeer(templateSample, previewLibrary{sets: sets, policies: allPolicies, templates: []store.PeerTemplate{ixTemplate}, localASN: 65551})
 	templateFormV.Warnings = attributeToTemplate(templateFormV.Warnings, templateSample.Name, ixTemplate.Name)
 

From 4054ed2ad96f47de340148d7a41c1cd09b22340e Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:29:08 +0300
Subject: [PATCH 08/19] fix(forms): a failed rename posts back to the stored
 name

When a template rename failed validation (say IX_PEERS to IX_RS with a
bad community), the form re-rendered with the typed name and built its
action from it: /peers/templates/IX_RS/edit. The corrected resubmit went
to a template that did not exist, got "not found", and lost the edit.
The peer form had the same bug. Both now post to the name the record is
stored under while still showing what the operator typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/peer_templates.go              |  2 +-
 internal/web/peer_templates_handler_test.go | 29 +++++++++++++++++++++
 internal/web/peers.go                       |  6 ++++-
 internal/web/templates/peer_form.html       |  2 +-
 4 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/internal/web/peer_templates.go b/internal/web/peer_templates.go
index 4e9b228..4f1489e 100644
--- a/internal/web/peer_templates.go
+++ b/internal/web/peer_templates.go
@@ -253,7 +253,7 @@ func (s *Server) handlePeerTemplateSave(w http.ResponseWriter, r *http.Request)
 		t.ImportPolicies, t.ExportPolicies = s.resolvePolicies(all, importIDs), s.resolvePolicies(all, exportIDs)
 	}
 	v := s.templateFormView(t, isNew)
-	v.Errs, v.LinkSource = errs, r.FormValue("from")
+	v.Errs, v.LinkSource, v.StoredName = errs, r.FormValue("from"), r.PathValue("name")
 	s.renderPeerForm(w, v)
 }
 
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index 3fa77bc..fea6989 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -538,3 +538,32 @@ func TestLongTemplateNamePreviews(t *testing.T) {
 		t.Errorf("a valid long template name should still preview:\n%s", body)
 	}
 }
+
+// A rename that fails validation re-renders the form with the typed name, but
+// the record is still stored under the old one: the form must post back there,
+// or the corrected resubmit hits a 404 and the edit is lost.
+func TestFailedRenameStillPostsToTheStoredName(t *testing.T) {
+	env := newTestEnv(t, false)
+	createTemplate(env, t)
+	form := templateForm(env, t)
+	form.Set("name", "IX_RS")
+	form.Set("exportCommunities", "NO_SUCH_COMMUNITY")
+	body := env.do(t, "POST", "/peers/templates/IX_PEERS/edit", form).Body.String()
+	if !strings.Contains(body, `action="/peers/templates/IX_PEERS/edit"`) {
+		t.Errorf("a failed template rename should post back to the stored name")
+	}
+	if !strings.Contains(body, `value="IX_RS"`) {
+		t.Errorf("the form should keep what the operator typed")
+	}
+
+	peer := peerForm()
+	if rec := env.do(t, "POST", "/peers/new", peer); rec.Code != http.StatusSeeOther {
+		t.Fatalf("peer create: %d", rec.Code)
+	}
+	peer.Set("name", "transit2_v4")
+	peer.Set("multihop", "999")
+	body = env.do(t, "POST", "/peers/transit_v4/edit", peer).Body.String()
+	if !strings.Contains(body, `action="/peers/transit_v4/edit"`) {
+		t.Errorf("a failed peer rename should post back to the stored name")
+	}
+}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index f9577e0..fe14c73 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -36,6 +36,10 @@ type peerFormView struct {
 	// ClonedFrom names the peer a new form was pre-filled from, so the operator
 	// knows the shape came from somewhere and only the identity needs its values.
 	ClonedFrom string
+	// StoredName is the name the record is saved under, which the form posts
+	// back to. It differs from the shown name only when a rename failed
+	// validation and the form re-renders with what the operator typed.
+	StoredName string
 	// PeeringDB reports whether the PeeringDB lookup is enabled, so the form can
 	// show the "look up ASN" button.
 	PeeringDB bool
@@ -348,7 +352,7 @@ func (s *Server) handlePeerSave(w http.ResponseWriter, r *http.Request) {
 	if all, aerr := s.store.ListPolicies(); aerr == nil {
 		p.ImportPolicies, p.ExportPolicies = s.resolvePolicies(all, importIDs), s.resolvePolicies(all, exportIDs)
 	}
-	s.renderPeerForm(w, peerFormView{Active: "peers", ReadOnly: s.readOnly, IsNew: isNew, Peer: p, Errs: errs})
+	s.renderPeerForm(w, peerFormView{Active: "peers", ReadOnly: s.readOnly, IsNew: isNew, StoredName: r.PathValue("name"), Peer: p, Errs: errs})
 }
 
 // handlePeersAttach links every selected peer to one template — or, with no
diff --git a/internal/web/templates/peer_form.html b/internal/web/templates/peer_form.html
index 84d2969..c33886a 100644
--- a/internal/web/templates/peer_form.html
+++ b/internal/web/templates/peer_form.html
@@ -94,7 +94,7 @@ <h1>{{if .IsTemplate}}{{if .IsNew}}Add peer template{{else}}Edit template {{.Pee
 			</div>
 			{{end}}
 
-			<form method="post" action="{{if .IsTemplate}}{{if .IsNew}}/peers/templates/new{{else}}/peers/templates/{{.Template.Name}}/edit{{end}}{{else if .IsNew}}/peers/new{{else}}/peers/{{.Peer.Name}}/edit{{end}}" data-preview-url="{{if .IsTemplate}}/peers/templates/preview{{else}}/peers/preview{{end}}" data-editor data-peer-form{{if .IsTemplate}} data-template-form{{end}}>
+			<form method="post" action="{{if .IsTemplate}}{{if .IsNew}}/peers/templates/new{{else}}/peers/templates/{{or .StoredName .Template.Name}}/edit{{end}}{{else if .IsNew}}/peers/new{{else}}/peers/{{or .StoredName .Peer.Name}}/edit{{end}}" data-preview-url="{{if .IsTemplate}}/peers/templates/preview{{else}}/peers/preview{{end}}" data-editor data-peer-form{{if .IsTemplate}} data-template-form{{end}}>
 			{{if and .IsTemplate .LinkSource}}<input type="hidden" name="from" value="{{.LinkSource}}">{{end}}
 			<div class="split">
 				<div>

From 93730b945d9dcf0cac377498a0defd778d041dc2 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:29:36 +0300
Subject: [PATCH 09/19] fix(policies): count template chains on the policies
 list

DeletePolicy refuses a policy a template's chain holds, but the list
counted only peer chains. A policy used only by a template with no
peers linked showed "Used by: nothing", and Delete then failed with
"attached to 1 peer template(s)" without the list ever naming it. The
list now shows template use beside peer use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/peer_templates_handler_test.go | 11 +++++++++++
 internal/web/policies.go                    | 16 +++++++++++++++-
 internal/web/templates/policies.html        |  4 ++--
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index fea6989..179473c 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -567,3 +567,14 @@ func TestFailedRenameStillPostsToTheStoredName(t *testing.T) {
 		t.Errorf("a failed peer rename should post back to the stored name")
 	}
 }
+
+// Delete refuses a policy a template chains; the list must say so too, not
+// show "nothing" beside a policy that cannot be deleted.
+func TestPoliciesListCountsTemplateUse(t *testing.T) {
+	env := newTestEnv(t, false)
+	createTemplate(env, t) // chains IMPORT_SANITY and EXPORT_OWN, with no peers linked
+	body := env.do(t, "GET", "/policies", nil).Body.String()
+	if got := strings.Count(body, `<span class="badge badge-warning">1 template</span>`); got != 2 {
+		t.Errorf("both policies the template chains should show 1 template, found %d", got)
+	}
+}
diff --git a/internal/web/policies.go b/internal/web/policies.go
index 2b630ce..b028fe1 100644
--- a/internal/web/policies.go
+++ b/internal/web/policies.go
@@ -20,6 +20,7 @@ type policiesView struct {
 	ImportPager Pager
 	ExportPager Pager
 	InUse       map[int64]int // policy id -> peers attached
+	TemplateUse map[int64]int // policy id -> peer templates chaining it
 	SetNames    map[int64]string
 	Flash       string
 }
@@ -60,6 +61,19 @@ func (s *Server) handlePoliciesList(w http.ResponseWriter, r *http.Request) {
 			inUse[pol.ID]++
 		}
 	}
+	// A template's chain holds the policy too: delete refuses it, so the list
+	// must not call it unused.
+	templates, err := s.store.ListPeerTemplates()
+	if err != nil {
+		s.serverError(w, "list peer templates", err)
+		return
+	}
+	templateUse := map[int64]int{}
+	for _, t := range templates {
+		for _, pol := range append(t.ImportPolicies, t.ExportPolicies...) {
+			templateUse[pol.ID]++
+		}
+	}
 	sets, err := s.store.ListPrefixSets()
 	if err != nil {
 		s.serverError(w, "list prefix sets", err)
@@ -70,7 +84,7 @@ func (s *Server) handlePoliciesList(w http.ResponseWriter, r *http.Request) {
 		names[ps.ID] = ps.Name
 	}
 
-	v := policiesView{Active: "policies", ReadOnly: s.readOnly, InUse: inUse, SetNames: names,
+	v := policiesView{Active: "policies", ReadOnly: s.readOnly, InUse: inUse, TemplateUse: templateUse, SetNames: names,
 		Flash: s.flashMsg(w, r)}
 	var imports, exports []store.Policy
 	for _, p := range policies {
diff --git a/internal/web/templates/policies.html b/internal/web/templates/policies.html
index 6753975..f801740 100644
--- a/internal/web/templates/policies.html
+++ b/internal/web/templates/policies.html
@@ -61,7 +61,7 @@
 								{{if eq .BogonASNs "all"}}<span class="chip">no bogon ASNs</span>
 								{{else if eq .BogonASNs "except_private"}}<span class="chip chip-info">private ASNs ok</span>{{end}}
 							</td>
-							<td>{{$n := index $.InUse .ID}}{{if $n}}<span class="badge badge-warning">{{$n}} peer{{if ne $n 1}}s{{end}}</span>{{else}}<span class="text-muted">nothing</span>{{end}}</td>
+							<td>{{$n := index $.InUse .ID}}{{$tn := index $.TemplateUse .ID}}{{if $n}}<span class="badge badge-warning">{{$n}} peer{{if ne $n 1}}s{{end}}</span>{{end}}{{if $tn}}{{if $n}} {{end}}<span class="badge badge-warning">{{$tn}} template{{if ne $tn 1}}s{{end}}</span>{{end}}{{if not (or $n $tn)}}<span class="text-muted">nothing</span>{{end}}</td>
 							<td class="row-actions">
 								<a class="icon-action a-primary" href="/policies/{{.Name}}/edit" title="Edit {{.Name}}" aria-label="Edit {{.Name}}">{{template "icon-edit"}}</a>
 								<form method="post" action="/policies/{{.Name}}/delete" data-confirm="Delete policy {{.Name}}?">
@@ -105,7 +105,7 @@
 									{{if .AnnounceFromCustomer}}<span class="chip">from customers</span>{{end}}
 								{{end}}
 							</td>
-							<td>{{$n := index $.InUse .ID}}{{if $n}}<span class="badge badge-warning">{{$n}} peer{{if ne $n 1}}s{{end}}</span>{{else}}<span class="text-muted">nothing</span>{{end}}</td>
+							<td>{{$n := index $.InUse .ID}}{{$tn := index $.TemplateUse .ID}}{{if $n}}<span class="badge badge-warning">{{$n}} peer{{if ne $n 1}}s{{end}}</span>{{end}}{{if $tn}}{{if $n}} {{end}}<span class="badge badge-warning">{{$tn}} template{{if ne $tn 1}}s{{end}}</span>{{end}}{{if not (or $n $tn)}}<span class="text-muted">nothing</span>{{end}}</td>
 							<td class="row-actions">
 								<a class="icon-action a-primary" href="/policies/{{.Name}}/edit" title="Edit {{.Name}}" aria-label="Edit {{.Name}}">{{template "icon-edit"}}</a>
 								<form method="post" action="/policies/{{.Name}}/delete" data-confirm="Delete policy {{.Name}}?">

From 904b757899e7c03b35b6d962a508c07601006a12 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:30:23 +0300
Subject: [PATCH 10/19] fix(templates): only tell the operator to detach when
 that is the fix

A failed template delete always appended "Detach those peers first",
including for a database error or a template that had just been deleted
elsewhere, sending the operator to detach peers from a template with
none linked. DeletePeerTemplate now returns a TemplateInUseError for
linked peers, and only that gets the hint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates.go            | 18 +++++++++++++-----
 internal/store/peer_templates_test.go       |  6 ++++++
 internal/web/peer_templates.go              | 10 ++++++++--
 internal/web/peer_templates_handler_test.go | 14 ++++++++++++++
 4 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/internal/store/peer_templates.go b/internal/store/peer_templates.go
index 448a1ea..dd2d9da 100644
--- a/internal/store/peer_templates.go
+++ b/internal/store/peer_templates.go
@@ -409,6 +409,18 @@ func (s *Store) TemplateUsage() (map[int64]int, error) {
 	return out, rows.Err()
 }
 
+// TemplateInUseError is DeletePeerTemplate refusing a template that peers
+// still link to — the one failure the operator fixes by detaching them.
+type TemplateInUseError struct{ Peers []string }
+
+func (e *TemplateInUseError) Error() string {
+	shown := e.Peers
+	if len(shown) > 5 {
+		shown = append(shown[:5:5], "…")
+	}
+	return fmt.Sprintf("store: template is used by %d peer(s): %s", len(e.Peers), strings.Join(shown, ", "))
+}
+
 // DeletePeerTemplate refuses while any peer still links to the template:
 // detaching them silently would leave thirty sessions owning a shape nobody
 // chose for them on purpose. The foreign key is the backstop; this is the
@@ -419,11 +431,7 @@ func (s *Store) DeletePeerTemplate(id int64) error {
 		return err
 	}
 	if len(users) > 0 {
-		shown := users
-		if len(shown) > 5 {
-			shown = append(shown[:5:5], "…")
-		}
-		return fmt.Errorf("store: template is used by %d peer(s): %s", len(users), strings.Join(shown, ", "))
+		return &TemplateInUseError{Peers: users}
 	}
 	res, err := s.db.Exec(`DELETE FROM peer_templates WHERE id = ?`, id)
 	if err != nil {
diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index e558304..185949b 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -2,6 +2,7 @@ package store
 
 import (
 	"database/sql"
+	"errors"
 	"path/filepath"
 	"reflect"
 	"slices"
@@ -376,6 +377,11 @@ func TestDeleteGuardsNameWhatStandsInTheWay(t *testing.T) {
 	if err == nil || !strings.Contains(err.Error(), "1 peer(s): edge_v4") {
 		t.Errorf("deleting a linked template should refuse and name the peer, got %v", err)
 	}
+	// Typed, so the UI can tell "detach these first" from any other failure.
+	var inUse *TemplateInUseError
+	if !errors.As(err, &inUse) || len(inUse.Peers) != 1 || inUse.Peers[0] != "edge_v4" {
+		t.Errorf("the refusal should be a TemplateInUseError naming edge_v4, got %#v", err)
+	}
 	// NO_DEFAULT is in the template's chain and, through it, the peer's.
 	err = s.DeletePolicy(noDefault.ID)
 	if err == nil || !strings.Contains(err.Error(), "1 peer(s) and 1 peer template(s)") {
diff --git a/internal/web/peer_templates.go b/internal/web/peer_templates.go
index 4f1489e..49b4257 100644
--- a/internal/web/peer_templates.go
+++ b/internal/web/peer_templates.go
@@ -2,6 +2,7 @@ package web
 
 import (
 	"database/sql"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -263,8 +264,13 @@ func (s *Server) handlePeerTemplateDelete(w http.ResponseWriter, r *http.Request
 		return
 	}
 	if err := s.store.DeletePeerTemplate(t.ID); err != nil {
-		msg := strings.TrimPrefix(err.Error(), "store: ")
-		s.flashRedirect(w, r, "/peers/templates", "Could not delete "+t.Name+": "+msg+". Detach those peers first (choose \"none\" as their template).", true)
+		msg := "Could not delete " + t.Name + ": " + strings.TrimPrefix(err.Error(), "store: ") + "."
+		// Only a template peers still link to is fixed by detaching them.
+		var inUse *store.TemplateInUseError
+		if errors.As(err, &inUse) {
+			msg += " Detach those peers first (choose \"none\" as their template)."
+		}
+		s.flashRedirect(w, r, "/peers/templates", msg, true)
 		return
 	}
 	s.audit(r, "deleted peer template "+t.Name)
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index 179473c..145bdc8 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -578,3 +578,17 @@ func TestPoliciesListCountsTemplateUse(t *testing.T) {
 		t.Errorf("both policies the template chains should show 1 template, found %d", got)
 	}
 }
+
+func TestDeletingALinkedTemplateSaysToDetachFirst(t *testing.T) {
+	env := newTestEnv(t, false)
+	tmpl := createTemplate(env, t)
+	peer := peerForm()
+	peer.Set("templateId", strconv.FormatInt(tmpl.ID, 10))
+	if rec := env.do(t, "POST", "/peers/new", peer); rec.Code != http.StatusSeeOther {
+		t.Fatalf("peer create: %d", rec.Code)
+	}
+	rec := env.do(t, "POST", "/peers/templates/IX_PEERS/delete", nil)
+	if flash := flashOf(rec); !strings.Contains(flash, "used by 1 peer(s): transit_v4") || !strings.Contains(flash, "Detach those peers first") {
+		t.Errorf("a linked template's delete should name the peers and say to detach them: %q", flash)
+	}
+}

From 703690fe8018c6978acdbfa4a4d5bfe830534034 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:30:43 +0300
Subject: [PATCH 11/19] docs: CHANGELOG for the peer template review fixes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41764d9..a2e285b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,7 +32,11 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   - **Import from BIRD** offers a template per row, so adopted sessions arrive with
     the template's role, chains, limit and safeguards instead of bare identities.
   - Lint findings that are identical across peers of one template **fold into one
-    line** attributed to the template.
+    line** attributed to the template and naming the peers.
+  - A template's name has to be free across BIRD's single namespace: it may not
+    be a peer's, a prefix or AS set's, a community's or one birdy generates, and
+    a peer may not take a template's — a clash would fail every apply with
+    "Symbol already defined".
 - **Per-session BFD timers.** A peer (or template) with BFD on can set its own
   **interval** (ms) and **multiplier**, rendered as `bfd { interval …; multiplier …; };`
   on that session alone. BIRD's default 100 ms × 5 declares a session dead after
@@ -51,6 +55,9 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - The peer form's role-specific checkbox group for the *other* role (the iBGP
   switches on an eBGP peer, and vice versa) was visible, greyed out, instead of
   hidden: the group's flex layout overrode the `hidden` attribute.
+- A peer rename that failed validation re-rendered the form posting to the new
+  name, so the corrected resubmit hit "not found" and the edit was lost. The form
+  now posts back to the name the peer is stored under.
 - **Generated filters no longer log every route a catch-all drops.** BIRD logs a
   reject's message once per route it drops. Export filters ended in
   `reject "not permitted by any export policy"`, and import policies rejected

From 6e6b97e0a6aa1a6b5b05b8ab29eb681a0f260c7f Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:44:30 +0300
Subject: [PATCH 12/19] fix(render): refuse a model that declares one BIRD
 symbol twice

The save-time name check covered only the template and peer forms. A
prefix set, AS set, community, RPKI server or BMP station named like a
template, a session imported from BIRD under a template's name, or data
that already clashed, all still reached `bird -p` and failed with
"Symbol already defined".

The renderer is the one place that sees every symbol, so Sections now
scans what it rendered for declarations (define, function, filter,
template bgp, named protocols and tables, plus BIRD's own master4 and
master6) and refuses a duplicate with a message naming both
declarations. Preview, Changes and apply all show it before BIRD is
asked. Raw configuration is left to BIRD: it is free text, and a
commented-out block there is not a clash.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/render/render.go      |  3 +++
 internal/render/render_test.go | 31 +++++++++++++++++++++++++
 internal/render/symbols.go     | 41 ++++++++++++++++++++++++++++++++++
 3 files changed, 75 insertions(+)
 create mode 100644 internal/render/symbols.go

diff --git a/internal/render/render.go b/internal/render/render.go
index 359f7c7..32d879f 100644
--- a/internal/render/render.go
+++ b/internal/render/render.go
@@ -273,6 +273,9 @@ func Sections(in Input) ([]Section, error) {
 	if ferr != nil {
 		return nil, ferr
 	}
+	if err := checkSymbols(secs); err != nil {
+		return nil, err
+	}
 	return secs, nil
 }
 
diff --git a/internal/render/render_test.go b/internal/render/render_test.go
index 7f1890b..cb9c608 100644
--- a/internal/render/render_test.go
+++ b/internal/render/render_test.go
@@ -1143,3 +1143,34 @@ func TestOnlyVetoRejectsCarryAMessage(t *testing.T) {
 		}
 	}
 }
+
+// BIRD keeps defines, functions, filters, templates and protocols in one
+// namespace. Two of them sharing a name pass every per-object check but fail
+// `bird -p` with "Symbol already defined"; the renderer is the one place that
+// sees every symbol, so it refuses the model with a message naming both.
+func TestRenderRefusesTwoSymbolsOfOneName(t *testing.T) {
+	in := baseInput()
+	p := ebgpPeer()
+	p.Name = "TRANSIT"
+	in.PrefixSets = append(bogonSets(), store.PrefixSet{ID: 40, Name: "TRANSIT", Family: store.FamilyV4,
+		Entries: []store.PrefixEntry{{Prefix: "192.0.2.0/24"}}})
+	in.Peers = []store.Peer{p}
+	_, err := Config(in)
+	if err == nil || !strings.Contains(err.Error(), `"TRANSIT"`) || !strings.Contains(err.Error(), "define") || !strings.Contains(err.Error(), "protocol bgp") {
+		t.Fatalf("a peer and a prefix set of one name should be refused, naming both: %v", err)
+	}
+
+	// BIRD's own implicit tables count too.
+	p.Name = "master4"
+	in.PrefixSets, in.Peers = bogonSets(), []store.Peer{p}
+	if _, err := Config(in); err == nil || !strings.Contains(err.Error(), "master4") {
+		t.Errorf("a peer named like BIRD's master4 table should be refused: %v", err)
+	}
+
+	// Raw config is BIRD's to judge: a commented-out block there is not a clash.
+	p.Name = "edge_v4"
+	in.Peers, in.RawConfig = []store.Peer{p}, "/*\ndefine LOCAL_ASN = 1;\n*/"
+	if _, err := Config(in); err != nil {
+		t.Errorf("raw config must not be scanned for symbols: %v", err)
+	}
+}
diff --git a/internal/render/symbols.go b/internal/render/symbols.go
new file mode 100644
index 0000000..b2ddde2
--- /dev/null
+++ b/internal/render/symbols.go
@@ -0,0 +1,41 @@
+package render
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// symbolDecl matches a line that declares a BIRD symbol: a define, function,
+// filter, BGP template, named protocol or table. Every writer starts these at
+// the beginning of a line; a body line never does (it starts with a keyword
+// such as "import" or "if", or a comment).
+var symbolDecl = regexp.MustCompile(`(?m)^[ \t]*(define|function|filter|template bgp|protocol [a-z]+|roa[46] table|ipv[46] table)[ \t]+([A-Za-z_][A-Za-z0-9_]*)`)
+
+// birdSymbols are names BIRD defines on its own, before reading the file.
+var birdSymbols = map[string]string{"master4": "BIRD's own master4 table", "master6": "BIRD's own master6 table"}
+
+// checkSymbols refuses a model whose rendered sections declare one name twice.
+// BIRD keeps defines, functions, filters, templates and protocols in a single
+// namespace, so such a config fails `bird -p` with "Symbol already defined" —
+// every per-object check passes, and only here are all symbols in one place.
+// Raw configuration is left to BIRD: it is free text, and a commented-out block
+// there is not a clash.
+func checkSymbols(secs []Section) error {
+	seen := map[string]string{}
+	for name, what := range birdSymbols {
+		seen[name] = what
+	}
+	for _, s := range secs {
+		if s.Path == "raw" {
+			continue
+		}
+		for _, m := range symbolDecl.FindAllStringSubmatch(s.Body, -1) {
+			what, name := m[1], m[2]
+			if first, dup := seen[name]; dup {
+				return fmt.Errorf("%q is declared twice, by %s and by %s: BIRD keeps every name in one namespace, so rename one of them", name, first, what)
+			}
+			seen[name] = what
+		}
+	}
+	return nil
+}

From 147c897e7403d898b8b70645c6afa6d19f0ad412 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:45:18 +0300
Subject: [PATCH 13/19] fix(store): derived names clash only while their source
 exists

SymbolUses refused any name starting with imp_, exp_, ebgp_in_,
originate_ and so on, though only an exact derived name clashes:
`exp_transit` was refused although no policy "transit" existed. A
derived name now counts as taken only while the policy, peer or prefix
set it derives from exists. BIRD's own master4/master6 tables join the
built-ins, which they were missing.

Library community validation kept its own shorter list of reserved
names and let BOGON_ASNS, rpki4 and the rest through. It now checks the
same built-in list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/communities.go            | 14 +++-------
 internal/store/communities_test.go       | 11 ++++++++
 internal/store/peer_templates_test.go    | 13 ++++++---
 internal/store/symbols.go                | 34 +++++++++++++++++++-----
 internal/web/communities_handler_test.go |  2 +-
 5 files changed, 52 insertions(+), 22 deletions(-)

diff --git a/internal/store/communities.go b/internal/store/communities.go
index 6ff572c..f63ed88 100644
--- a/internal/store/communities.go
+++ b/internal/store/communities.go
@@ -28,20 +28,14 @@ func (cd CommunityDef) Value() Community {
 // Pattern renders the value the way BIRD writes it, e.g. "(65535, 666)".
 func (cd CommunityDef) Pattern() string { return cd.Value().BIRD() }
 
-// reservedSymbols are the define names birdy generates itself; a library
-// community must not shadow one, or the rendered config has two defines of the
-// same name.
-var reservedSymbols = map[string]bool{
-	"LOCAL_ASN": true, "FROM_UPSTREAM": true, "FROM_IX": true,
-	"FROM_CUSTOMER": true, "RPKI_INVALID": true,
-}
-
 // Validate checks the name and the community value, returning field-keyed errors.
 func (cd *CommunityDef) Validate() map[string]string {
 	name, errs := validateNameDesc(cd.Name, cd.Description)
 	cd.Name = name
-	if reservedSymbols[name] {
-		errs["name"] = name + " is a name birdy uses for a built-in define; pick another."
+	// A library community must not shadow a name birdy or BIRD defines itself,
+	// or the rendered config declares it twice.
+	if builtinSymbols[name] {
+		errs["name"] = name + " is a name birdy or BIRD defines itself; pick another."
 	}
 
 	parts := []int64{cd.A, cd.B}
diff --git a/internal/store/communities_test.go b/internal/store/communities_test.go
index d8495ed..493207a 100644
--- a/internal/store/communities_test.go
+++ b/internal/store/communities_test.go
@@ -17,3 +17,14 @@ func TestParseMatchCommunity(t *testing.T) {
 		t.Error("out-of-range should be rejected")
 	}
 }
+
+// A community renders `define NAME`, so it cannot take any name birdy defines
+// itself — the same list the template check uses, not a shorter copy of it.
+func TestCommunityCannotTakeABuiltinName(t *testing.T) {
+	for _, name := range []string{"LOCAL_ASN", "BOGON_ASNS", "rpki4", "master6"} {
+		cd := CommunityDef{Name: name, A: 65000, B: 1}
+		if _, bad := cd.Validate()["name"]; !bad {
+			t.Errorf("a community named %s should be refused", name)
+		}
+	}
+}
diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index 185949b..87cbca2 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -626,8 +626,11 @@ func TestSymbolUsesFindsEveryOwnerOfAName(t *testing.T) {
 		{"LOCAL_ASN", "built-in"},
 		{"BOGON_ASNS", "built-in"},
 		{"kernel4", "built-in"},
-		{"imp_FOO_v4", "built-in"},
-		{"ebgp_in_edge_v4", "built-in"},
+		{"master4", "built-in"},
+		// Derived names clash only when what they derive from exists.
+		{"imp_IMPORT_SANITY_v4", "built-in"},
+		{"ebgp_in_TRANSIT", "built-in"},
+		{"originate_BOGONS_V4", "built-in"},
 	} {
 		uses, err := s.SymbolUses(tc.name)
 		if err != nil {
@@ -637,8 +640,10 @@ func TestSymbolUsesFindsEveryOwnerOfAName(t *testing.T) {
 			t.Errorf("%s: want one %s, got %+v", tc.name, tc.kind, uses)
 		}
 	}
-	if uses, err := s.SymbolUses("FREE_NAME"); err != nil || len(uses) != 0 {
-		t.Errorf("an unused name should have no owner: %+v %v", uses, err)
+	for _, free := range []string{"FREE_NAME", "imp_NO_SUCH_POLICY_v4", "exp_transit", "ebgp_in_nobody", "originate_NOTHING"} {
+		if uses, err := s.SymbolUses(free); err != nil || len(uses) != 0 {
+			t.Errorf("%s should have no owner: %+v %v", free, uses, err)
+		}
 	}
 	if uses, _ := s.SymbolUses("TRANSIT"); uses[0].String() != `peer "TRANSIT"` {
 		t.Errorf("an owner should describe itself for the form error, got %q", uses[0].String())
diff --git a/internal/store/symbols.go b/internal/store/symbols.go
index 78b7af3..a5a14e9 100644
--- a/internal/store/symbols.go
+++ b/internal/store/symbols.go
@@ -3,7 +3,7 @@ package store
 import (
 	"database/sql"
 	"fmt"
-	"strings"
+	"regexp"
 )
 
 // SymbolUse is one thing in the model that renders a BIRD symbol of a given
@@ -23,18 +23,28 @@ func (u SymbolUse) String() string {
 	return fmt.Sprintf("%s %q", u.Kind, u.Name)
 }
 
-// builtinSymbols are the names birdy renders on its own, outside any table.
+// builtinSymbols are the names birdy renders on its own, outside any table,
+// and the tables BIRD defines before reading the file.
 var builtinSymbols = map[string]bool{
 	"LOCAL_ASN": true, "FROM_UPSTREAM": true, "FROM_IX": true, "FROM_CUSTOMER": true, "RPKI_INVALID": true,
 	"BOGON_ASNS": true, "BOGON_ASNS_EXCEPT_PRIVATE": true,
 	"rpki4": true, "rpki6": true,
 	"device1": true, "direct1": true, "kernel4": true, "kernel6": true, "bfd1": true,
 	"static_v4": true, "static_v6": true,
+	"master4": true, "master6": true,
 }
 
-// generatedSymbolPrefixes start the names birdy derives from other objects:
-// policy functions, per-peer filters, originator protocols.
-var generatedSymbolPrefixes = []string{"imp_", "exp_", "ebgp_in_", "ebgp_out_", "ibgp_in_", "ibgp_out_", "originate_"}
+// derivedSymbols are the names birdy builds from another object's name —
+// policy functions, per-peer filters, originator protocols. Such a name is
+// taken only while the object it derives from exists.
+var derivedSymbols = []struct {
+	pattern *regexp.Regexp
+	table   string
+}{
+	{regexp.MustCompile(`^(?:imp|exp)_(.+)_v[46]$`), "policies"},
+	{regexp.MustCompile(`^(?:ebgp|ibgp)_(?:in|out)_(.+)$`), "peers"},
+	{regexp.MustCompile(`^originate_(.+)$`), "prefix_sets"},
+}
 
 // symbolTables are the tables whose rows each render a symbol named by their
 // name column.
@@ -56,11 +66,21 @@ func (s *Store) SymbolUses(name string) ([]SymbolUse, error) {
 	if builtinSymbols[name] {
 		out = append(out, SymbolUse{Kind: "built-in", Name: name})
 	}
-	for _, prefix := range generatedSymbolPrefixes {
-		if strings.HasPrefix(name, prefix) {
+	for _, d := range derivedSymbols {
+		m := d.pattern.FindStringSubmatch(name)
+		if m == nil {
+			continue
+		}
+		var one int
+		// The table name comes from the fixed list above, never from input.
+		err := s.db.QueryRow(`SELECT 1 FROM `+d.table+` WHERE name = ?`, m[1]).Scan(&one)
+		if err == nil {
 			out = append(out, SymbolUse{Kind: "built-in", Name: name})
 			break
 		}
+		if err != sql.ErrNoRows {
+			return nil, fmt.Errorf("store: symbol uses in %s: %w", d.table, err)
+		}
 	}
 	for _, st := range symbolTables {
 		var id int64
diff --git a/internal/web/communities_handler_test.go b/internal/web/communities_handler_test.go
index d30deb4..aa7f05b 100644
--- a/internal/web/communities_handler_test.go
+++ b/internal/web/communities_handler_test.go
@@ -106,7 +106,7 @@ func TestCommunityValidation(t *testing.T) {
 	env := applyReady(t)
 
 	body := env.do(t, "POST", "/library/communities/new", url.Values{"name": {"FROM_UPSTREAM"}, "value": {"65551:1"}}).Body.String()
-	if !strings.Contains(body, "built-in define") {
+	if !strings.Contains(body, "a name birdy or BIRD defines itself") {
 		t.Error("a reserved name should be rejected")
 	}
 	if _, err := env.store.GetCommunityDefByName("FROM_UPSTREAM"); err != store.ErrNotFound {

From bfcd263777d85767c28f45fed1a64a02f40ee8f8 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:46:38 +0300
Subject: [PATCH 14/19] fix(web): every named save refuses a template's name

The save-time check ran only on the template and peer forms. A prefix
set, AS set, community, RPKI server or BMP station named like a template
saved, and so did a session imported from BIRD under a template's name;
each then declared the name twice. The renderer now catches that, but
the form is where it should be refused. refuseTemplateName runs on each
of those saves, on the peer form, and on import (which skips the
session).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/assets.go                      |  4 ++++
 internal/web/bmp.go                         |  4 ++++
 internal/web/helpers.go                     | 17 ++++++++++++++++
 internal/web/library.go                     |  4 ++++
 internal/web/library_communities.go         |  4 ++++
 internal/web/peer_templates_handler_test.go | 22 +++++++++++++++++++++
 internal/web/peers.go                       | 12 +++--------
 internal/web/rpki.go                        |  4 ++++
 internal/web/seed.go                        |  8 +++++++-
 internal/web/seed_handler_test.go           | 20 +++++++++++++++++++
 10 files changed, 89 insertions(+), 10 deletions(-)

diff --git a/internal/web/assets.go b/internal/web/assets.go
index 97bfddc..c6fad2e 100644
--- a/internal/web/assets.go
+++ b/internal/web/assets.go
@@ -117,6 +117,10 @@ func (s *Server) handleASSetSave(w http.ResponseWriter, r *http.Request) {
 	}
 
 	errs := as.Validate()
+	if err := s.refuseTemplateName(as.Name, errs); err != nil {
+		s.serverError(w, "check name", err)
+		return
+	}
 	for k, v := range entryErrs {
 		errs[k] = v
 	}
diff --git a/internal/web/bmp.go b/internal/web/bmp.go
index 1eea196..cfd7563 100644
--- a/internal/web/bmp.go
+++ b/internal/web/bmp.go
@@ -86,6 +86,10 @@ func (s *Server) handleBMPSave(w http.ResponseWriter, r *http.Request) {
 	}
 
 	errs := st.Validate()
+	if err := s.refuseTemplateName(st.Name, errs); err != nil {
+		s.serverError(w, "check name", err)
+		return
+	}
 	if len(errs) == 0 {
 		var err error
 		if isNew {
diff --git a/internal/web/helpers.go b/internal/web/helpers.go
index 555e3d8..653e366 100644
--- a/internal/web/helpers.go
+++ b/internal/web/helpers.go
@@ -163,3 +163,20 @@ func (s *Server) symbolClash(name string, counts func(store.SymbolUse) bool) (st
 	}
 	return "", nil
 }
+
+// refuseTemplateName records a name error when a peer template already uses
+// the name: the object being saved would render a second BIRD symbol of it.
+// A name the form already rejected is left with that error.
+func (s *Server) refuseTemplateName(name string, errs map[string]string) error {
+	if _, taken := errs["name"]; taken {
+		return nil
+	}
+	msg, err := s.symbolClash(name, func(u store.SymbolUse) bool { return u.Kind == "peer template" })
+	if err != nil {
+		return err
+	}
+	if msg != "" {
+		errs["name"] = msg
+	}
+	return nil
+}
diff --git a/internal/web/library.go b/internal/web/library.go
index 8298582..b598423 100644
--- a/internal/web/library.go
+++ b/internal/web/library.go
@@ -124,6 +124,10 @@ func (s *Server) handlePrefixSetSave(w http.ResponseWriter, r *http.Request) {
 	}
 
 	errs := ps.Validate()
+	if err := s.refuseTemplateName(ps.Name, errs); err != nil {
+		s.serverError(w, "check name", err)
+		return
+	}
 	if len(errs) == 0 {
 		var err error
 		if isNew {
diff --git a/internal/web/library_communities.go b/internal/web/library_communities.go
index 9014e26..6e7efa8 100644
--- a/internal/web/library_communities.go
+++ b/internal/web/library_communities.go
@@ -92,6 +92,10 @@ func (s *Server) handleCommunitySave(w http.ResponseWriter, r *http.Request) {
 	}
 
 	errs := cd.Validate()
+	if err := s.refuseTemplateName(cd.Name, errs); err != nil {
+		s.serverError(w, "check name", err)
+		return
+	}
 	if valueErr != "" {
 		errs["value"] = valueErr
 	}
diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index 145bdc8..d4b0fde 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -592,3 +592,25 @@ func TestDeletingALinkedTemplateSaysToDetachFirst(t *testing.T) {
 		t.Errorf("a linked template's delete should name the peers and say to detach them: %q", flash)
 	}
 }
+
+// Every library object that renders a BIRD symbol refuses a template's name at
+// save, not only at the next render.
+func TestLibraryObjectsCannotTakeATemplatesName(t *testing.T) {
+	env := newTestEnv(t, false)
+	createTemplate(env, t)
+	for _, c := range []struct {
+		route string
+		form  url.Values
+	}{
+		{"/library/prefix-sets/new", url.Values{"name": {"IX_PEERS"}, "family": {"ipv4"}, "entries": {"192.0.2.0/24"}}},
+		{"/library/as-sets/new", url.Values{"name": {"IX_PEERS"}, "entries": {"64600"}}},
+		{"/library/communities/new", url.Values{"name": {"IX_PEERS"}, "value": {"65000:1"}}},
+		{"/rpki/new", url.Values{"name": {"IX_PEERS"}, "host": {"rtr.example.net"}, "port": {"8282"}, "refresh": {"900"}, "expire": {"172800"}, "enabled": {"on"}}},
+		{"/bmp/new", url.Values{"name": {"IX_PEERS"}, "address": {"203.0.113.5"}, "port": {"1790"}, "enabled": {"on"}}},
+	} {
+		rec := env.do(t, "POST", c.route, c.form)
+		if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "already uses this name") {
+			t.Errorf("%s should refuse a template's name: %d", c.route, rec.Code)
+		}
+	}
+}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index fe14c73..c026ae0 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -306,15 +306,9 @@ func (s *Server) handlePeerSave(w http.ResponseWriter, r *http.Request) {
 	}
 	// Another peer with the name is the unique index's to report; a template
 	// with it would be a second `bgp` symbol of the same name.
-	if _, taken := errs["name"]; !taken {
-		msg, err := s.symbolClash(p.Name, func(u store.SymbolUse) bool { return u.Kind == "peer template" })
-		if err != nil {
-			s.serverError(w, "check peer name", err)
-			return
-		}
-		if msg != "" {
-			errs["name"] = msg
-		}
+	if err := s.refuseTemplateName(p.Name, errs); err != nil {
+		s.serverError(w, "check peer name", err)
+		return
 	}
 
 	if len(errs) == 0 {
diff --git a/internal/web/rpki.go b/internal/web/rpki.go
index 2d85154..68cf5a1 100644
--- a/internal/web/rpki.go
+++ b/internal/web/rpki.go
@@ -202,6 +202,10 @@ func (s *Server) handleRPKISave(w http.ResponseWriter, r *http.Request) {
 	}
 
 	errs := srv.Validate()
+	if err := s.refuseTemplateName(srv.Name, errs); err != nil {
+		s.serverError(w, "check name", err)
+		return
+	}
 	// Disabling the last RTR server while a policy still validates would render
 	// a config in which nothing is checked. Refuse, and say why.
 	if len(errs) == 0 && !srv.Enabled {
diff --git a/internal/web/seed.go b/internal/web/seed.go
index 1708c77..f3f6fb2 100644
--- a/internal/web/seed.go
+++ b/internal/web/seed.go
@@ -250,7 +250,13 @@ func (s *Server) handleSeedSave(w http.ResponseWriter, r *http.Request) {
 				t.ApplyTo(&p)
 			}
 		}
-		if errs := p.Validate(); len(errs) > 0 {
+		errs := p.Validate()
+		// A session named like a template would declare that name twice.
+		if err := s.refuseTemplateName(p.Name, errs); err != nil {
+			s.serverError(w, "check peer name", err)
+			return
+		}
+		if len(errs) > 0 {
 			skipped = append(skipped, proto.Name)
 			continue
 		}
diff --git a/internal/web/seed_handler_test.go b/internal/web/seed_handler_test.go
index 5d89277..5943659 100644
--- a/internal/web/seed_handler_test.go
+++ b/internal/web/seed_handler_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/floreabogdan/birdy/internal/birdc"
+	"github.com/floreabogdan/birdy/internal/store"
 )
 
 // seedDetail is the fake client's ProtocolDetail for a discovered session.
@@ -82,3 +83,22 @@ func TestSeedDetectsIBGP(t *testing.T) {
 		t.Error("a seeded iBGP peer should default to next-hop-self")
 	}
 }
+
+// A live session named like a template cannot be imported as a peer: the model
+// would then declare that name twice. It is skipped, not created.
+func TestSeedSkipsASessionNamedLikeATemplate(t *testing.T) {
+	env := applyReady(t)
+	env.fc.details["edge_v4"] = seedDetail("edge_v4", "198.51.100.1", "64500", "65551", "external")
+	tmpl := store.PeerTemplate{Name: "edge_v4", Role: store.RoleUpstream, ImportLimitAction: "restart"}
+	if errs := tmpl.Validate(); len(errs) != 0 {
+		t.Fatal(errs)
+	}
+	if _, err := env.store.CreatePeerTemplate(tmpl, nil, nil); err != nil {
+		t.Fatal(err)
+	}
+
+	env.do(t, "POST", "/peers/seed", url.Values{"include": {"edge_v4"}, "role_edge_v4": {"upstream"}})
+	if _, err := env.store.GetPeerByName("edge_v4"); err != store.ErrNotFound {
+		t.Errorf("a session named like a template must not be imported: %v", err)
+	}
+}

From b2835d57626a3d00cca47c25fb915bb7a5a8079e Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:48:01 +0300
Subject: [PATCH 15/19] fix(store): AttachPeers takes the write lock first and
 reads only in its tx

Review of the transactional attach found two hazards. It opened a
deferred transaction and read before writing: under WAL, a commit from
another connection in between makes the first write fail with
SQLITE_BUSY_SNAPSHOT, which busy_timeout does not retry. It now opens
by touching the template's row, which takes the write lock (waiting its
turn) and proves the template exists, as the store's other transactions
already do by writing first. And chainFor read each export policy's set
IDs through the pool, not the transaction: a second connection held
while the first waited, which deadlocks once the pool is exhausted.
policySetIDs now takes the querier (TestAttachPeersReadsOnlyThroughItsTransaction
hangs without it).

LinkPeerToTemplate(peer, 0) silently detached, because 0 is AttachPeers'
detach; it is now ErrNotFound. DetachPeer had no callers left and is
gone. The bulk handler turns a peer or template deleted mid-request into
"nothing was changed" instead of a 500.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates.go      | 23 +++++++++-----
 internal/store/peer_templates_test.go | 44 +++++++++++++++++++++++++++
 internal/store/policies.go            | 11 ++++---
 internal/web/peers.go                 |  9 +++++-
 4 files changed, 73 insertions(+), 14 deletions(-)

diff --git a/internal/store/peer_templates.go b/internal/store/peer_templates.go
index dd2d9da..eabc795 100644
--- a/internal/store/peer_templates.go
+++ b/internal/store/peer_templates.go
@@ -304,6 +304,9 @@ func (s *Store) UpdatePeerTemplate(t PeerTemplate, importIDs, exportIDs []int64)
 // template's shape over the peer's own. Overrides are cleared: a peer that
 // changes template takes the new template's word for everything.
 func (s *Store) LinkPeerToTemplate(peerID, templateID int64) error {
+	if templateID == 0 {
+		return ErrNotFound // 0 is AttachPeers' "detach", never a template
+	}
 	return s.AttachPeers([]int64{peerID}, templateID)
 }
 
@@ -320,6 +323,18 @@ func (s *Store) AttachPeers(peerIDs []int64, templateID int64) error {
 	defer tx.Rollback()
 	var t PeerTemplate
 	if templateID != 0 {
+		// Write before reading: SQLite takes the write lock at the first write,
+		// and a transaction that read first cannot upgrade once another
+		// connection has committed since (SQLITE_BUSY_SNAPSHOT, which
+		// busy_timeout does not retry). Touching the template's own row takes
+		// the lock, waiting its turn, and proves the template exists.
+		res, err := tx.Exec(`UPDATE peer_templates SET updated_at = updated_at WHERE id = ?`, templateID)
+		if err != nil {
+			return fmt.Errorf("store: lock peer template: %w", err)
+		}
+		if err := affectedOne(res); err != nil {
+			return err
+		}
 		if t, err = s.getTemplateIn(tx, `SELECT `+templateCols+` FROM peer_templates WHERE id = ?`, templateID); err != nil {
 			return err
 		}
@@ -354,14 +369,6 @@ func (s *Store) AttachPeers(peerIDs []int64, templateID int64) error {
 	return tx.Commit()
 }
 
-// DetachPeer clears a peer's link and its overrides, leaving every value it
-// inherited in place: the peer now owns the shape it had. The bulk "detach"
-// on the peers list and nothing else goes through here; the form detaches by
-// saving the peer with no template.
-func (s *Store) DetachPeer(peerID int64) error {
-	return s.AttachPeers([]int64{peerID}, 0)
-}
-
 // PolicyIDs lists a chain's ids in order, for the chain writers.
 func PolicyIDs(chain []Policy) []int64 {
 	out := make([]int64, 0, len(chain))
diff --git a/internal/store/peer_templates_test.go b/internal/store/peer_templates_test.go
index 87cbca2..92f0d72 100644
--- a/internal/store/peer_templates_test.go
+++ b/internal/store/peer_templates_test.go
@@ -8,6 +8,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"time"
 )
 
 // Every field of Peer is either identity — it stays the peer's own — or shape,
@@ -746,3 +747,46 @@ func TestAttachPeersIsAllOrNothing(t *testing.T) {
 		t.Errorf("attaching to a missing template should be ErrNotFound, got %v", err)
 	}
 }
+
+// Everything AttachPeers reads goes through its transaction. A read through the
+// pool while the transaction holds a connection waits for a second one, and
+// with the pool exhausted that wait never ends.
+func TestAttachPeersReadsOnlyThroughItsTransaction(t *testing.T) {
+	s := openTest(t)
+	tmpl, _, _, _ := seedTemplateFixture(t, s) // its chain has an export policy
+	id, err := s.CreatePeer(validPeer())
+	if err != nil {
+		t.Fatal(err)
+	}
+	s.db.SetMaxOpenConns(1)
+	done := make(chan error, 1)
+	go func() { done <- s.AttachPeers([]int64{id}, tmpl.ID) }()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatal(err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("AttachPeers blocked on a second connection while holding its transaction")
+	}
+}
+
+// Template 0 means "detach" only to AttachPeers, which says so. Linking to an
+// unset template is a caller's mistake, not a detach.
+func TestLinkingToTemplateZeroIsNotADetach(t *testing.T) {
+	s := openTest(t)
+	tmpl, _, _, _ := seedTemplateFixture(t, s)
+	id, err := s.CreatePeer(validPeer())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.LinkPeerToTemplate(id, tmpl.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.LinkPeerToTemplate(id, 0); err != ErrNotFound {
+		t.Errorf("linking to template 0 should be ErrNotFound, got %v", err)
+	}
+	if p, _ := s.GetPeer(id); !p.TemplateID.Valid {
+		t.Error("a failed link must leave the peer linked as it was")
+	}
+}
diff --git a/internal/store/policies.go b/internal/store/policies.go
index 6025690..6fd486b 100644
--- a/internal/store/policies.go
+++ b/internal/store/policies.go
@@ -212,7 +212,7 @@ func (s *Store) ListPolicies() ([]Policy, error) {
 		if out[i].IsImport() {
 			continue
 		}
-		ids, err := s.policySetIDs(out[i].ID)
+		ids, err := s.policySetIDs(s.db, out[i].ID)
 		if err != nil {
 			return nil, err
 		}
@@ -231,15 +231,16 @@ func (s *Store) GetPolicyByName(name string) (Policy, error) {
 		return Policy{}, fmt.Errorf("store: get policy: %w", err)
 	}
 	if !p.IsImport() {
-		if p.SetIDs, err = s.policySetIDs(p.ID); err != nil {
+		if p.SetIDs, err = s.policySetIDs(s.db, p.ID); err != nil {
 			return Policy{}, err
 		}
 	}
 	return p, nil
 }
 
-func (s *Store) policySetIDs(policyID int64) ([]int64, error) {
-	rows, err := s.db.Query(`SELECT set_id FROM policy_prefix_sets WHERE policy_id = ? ORDER BY position, set_id`, policyID)
+// policySetIDs reads through q, so a chain read inside a transaction stays in it.
+func (s *Store) policySetIDs(q querier, policyID int64) ([]int64, error) {
+	rows, err := q.Query(`SELECT set_id FROM policy_prefix_sets WHERE policy_id = ? ORDER BY position, set_id`, policyID)
 	if err != nil {
 		return nil, fmt.Errorf("store: policy prefix sets: %w", err)
 	}
@@ -396,7 +397,7 @@ func (s *Store) chainFor(q querier, table, key string, id int64) (imports, expor
 		return nil, nil, err
 	}
 	for i := range exports {
-		if exports[i].SetIDs, err = s.policySetIDs(exports[i].ID); err != nil {
+		if exports[i].SetIDs, err = s.policySetIDs(q, exports[i].ID); err != nil {
 			return nil, nil, err
 		}
 	}
diff --git a/internal/web/peers.go b/internal/web/peers.go
index c026ae0..6af132d 100644
--- a/internal/web/peers.go
+++ b/internal/web/peers.go
@@ -405,7 +405,14 @@ func (s *Server) handlePeersAttach(w http.ResponseWriter, r *http.Request) {
 	// on any error — none does, so a failure never leaves a half-attached,
 	// unaudited group.
 	if len(ids) > 0 {
-		if err := s.store.AttachPeers(ids, tmpl.ID); err != nil {
+		err := s.store.AttachPeers(ids, tmpl.ID)
+		if err == store.ErrNotFound {
+			// A peer or the template was deleted between the lookups above and
+			// the transaction; it rolled back, so say so rather than fail.
+			s.flashRedirect(w, r, "/peers", "A selected peer or the template was deleted meanwhile, so nothing was changed. Try again.", true)
+			return
+		}
+		if err != nil {
 			s.serverError(w, "attach peers to template", err)
 			return
 		}

From 8fef211c66e65ff48ceeff6f564e4d6febc71fbd Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:48:26 +0300
Subject: [PATCH 16/19] fix(communities): refuse a delete when the in-use check
 fails

handleCommunityDelete went ahead with the delete whenever communityInUse
returned an error, so a transient failure in that check, which now also
reads templates, deleted a community that peers or templates still
referenced. A failed check now refuses the delete.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/library_communities.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/internal/web/library_communities.go b/internal/web/library_communities.go
index 6e7efa8..2dfd2ab 100644
--- a/internal/web/library_communities.go
+++ b/internal/web/library_communities.go
@@ -135,9 +135,15 @@ func (s *Server) handleCommunityDelete(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	// Refuse to delete a community a peer or policy still references by name, or
-	// the next render would emit an undefined symbol.
-	if users, err := s.communityInUse(cd.Name); err == nil && len(users) > 0 {
+	// Refuse to delete a community a peer, template or policy still references
+	// by name, or the next render would emit an undefined symbol. If the check
+	// itself fails, refuse too: deleting blind is how that happens.
+	users, err := s.communityInUse(cd.Name)
+	if err != nil {
+		s.serverError(w, "check community use", err)
+		return
+	}
+	if len(users) > 0 {
 		s.flashRedirect(w, r, "/library/communities", "Could not delete "+cd.Name+": still used by "+strings.Join(users, ", "), false)
 		return
 	}

From da9cebcc94510dffc766bfdda363837f0d64bd08 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:48:38 +0300
Subject: [PATCH 17/19] fix(forms): every link on a failed-rename form uses the
 stored name

The rename fix moved only the form's action to the stored name. "Save as
template" (?from=), and on a template the "peers linked to it" and "add
a new peer from it" links, still used the typed name, which matches no
peer or template until the rename saves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/web/peer_templates_handler_test.go | 6 ++++++
 internal/web/templates/peer_form.html       | 6 +++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/internal/web/peer_templates_handler_test.go b/internal/web/peer_templates_handler_test.go
index d4b0fde..a315f3a 100644
--- a/internal/web/peer_templates_handler_test.go
+++ b/internal/web/peer_templates_handler_test.go
@@ -555,6 +555,9 @@ func TestFailedRenameStillPostsToTheStoredName(t *testing.T) {
 	if !strings.Contains(body, `value="IX_RS"`) {
 		t.Errorf("the form should keep what the operator typed")
 	}
+	if !strings.Contains(body, `/peers/new?template=IX_PEERS`) {
+		t.Errorf("the template's own links should use the stored name too")
+	}
 
 	peer := peerForm()
 	if rec := env.do(t, "POST", "/peers/new", peer); rec.Code != http.StatusSeeOther {
@@ -566,6 +569,9 @@ func TestFailedRenameStillPostsToTheStoredName(t *testing.T) {
 	if !strings.Contains(body, `action="/peers/transit_v4/edit"`) {
 		t.Errorf("a failed peer rename should post back to the stored name")
 	}
+	if !strings.Contains(body, `/peers/templates/new?from=transit_v4`) {
+		t.Errorf("Save as template should start from the stored peer")
+	}
 }
 
 // Delete refuses a policy a template chains; the list must say so too, not
diff --git a/internal/web/templates/peer_form.html b/internal/web/templates/peer_form.html
index c33886a..fad3d15 100644
--- a/internal/web/templates/peer_form.html
+++ b/internal/web/templates/peer_form.html
@@ -32,7 +32,7 @@ <h1>{{if .IsTemplate}}{{if .IsNew}}Add peer template{{else}}Edit template {{.Pee
 				{{if and (not .IsTemplate) (not .IsNew)}}
 				<div class="page-header-actions">
 					{{if $inh}}<a class="btn" href="/peers/templates/{{.Peer.TemplateName}}/edit">{{template "icon-edit"}}Edit template {{.Peer.TemplateName}}</a>
-					{{else}}<a class="btn" href="/peers/templates/new?from={{.Peer.Name}}" title="Capture this peer's policy chains, limits and safeguards as a template other peers can link to">{{template "icon-copy"}}Save as template</a>{{end}}
+					{{else}}<a class="btn" href="/peers/templates/new?from={{or .StoredName .Peer.Name}}" title="Capture this peer's policy chains, limits and safeguards as a template other peers can link to">{{template "icon-copy"}}Save as template</a>{{end}}
 				</div>
 				{{end}}
 			</div>
@@ -55,9 +55,9 @@ <h1>{{if .IsTemplate}}{{if .IsNew}}Add peer template{{else}}Edit template {{.Pee
 				<div class="panel-head">{{template "icon-info"}}{{if .Usage}}{{.Usage}} peer{{if ne .Usage 1}}s{{end}} linked{{else}}No peers linked yet{{end}}</div>
 				<div class="card-body">
 					{{if .Usage}}Saving this template rewrites the policy chains, limits and safeguards of
-					<a href="/peers?template={{.Peer.Name}}">{{if eq .Usage 1}}the peer linked to it{{else}}all {{.Usage}} peers linked to it{{end}}</a>.
+					<a href="/peers?template={{or .StoredName .Peer.Name}}">{{if eq .Usage 1}}the peer linked to it{{else}}all {{.Usage}} peers linked to it{{end}}</a>.
 					Nothing reaches the router until you review the result under <a href="/changes">Changes</a> and apply.
-					{{else}}Link peers to it from the <strong>Template</strong> field on each peer's form, or <a href="/peers/new?template={{.Peer.Name}}">add a new peer from it</a>.{{end}}
+					{{else}}Link peers to it from the <strong>Template</strong> field on each peer's form, or <a href="/peers/new?template={{or .StoredName .Peer.Name}}">add a new peer from it</a>.{{end}}
 				</div>
 			</div>
 			{{end}}

From 96418a685096a6cffe49d46b2c422477fd76c79a Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:48:55 +0300
Subject: [PATCH 18/19] perf(policies): count template use with one query

The policies list loaded every template with its chains (a query per
template, and one per chained export policy for its sets) only to count
how many templates chain each policy. One GROUP BY over template_policies
gives the same counts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 internal/store/peer_templates.go | 19 +++++++++++++++++++
 internal/web/policies.go         | 10 ++--------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/internal/store/peer_templates.go b/internal/store/peer_templates.go
index eabc795..2f3f97b 100644
--- a/internal/store/peer_templates.go
+++ b/internal/store/peer_templates.go
@@ -416,6 +416,25 @@ func (s *Store) TemplateUsage() (map[int64]int, error) {
 	return out, rows.Err()
 }
 
+// TemplatePolicyUsage counts, per policy id, the templates whose chain holds it.
+func (s *Store) TemplatePolicyUsage() (map[int64]int, error) {
+	rows, err := s.db.Query(`SELECT policy_id, COUNT(*) FROM template_policies GROUP BY policy_id`)
+	if err != nil {
+		return nil, fmt.Errorf("store: template policy usage: %w", err)
+	}
+	defer rows.Close()
+	out := map[int64]int{}
+	for rows.Next() {
+		var id int64
+		var n int
+		if err := rows.Scan(&id, &n); err != nil {
+			return nil, err
+		}
+		out[id] = n
+	}
+	return out, rows.Err()
+}
+
 // TemplateInUseError is DeletePeerTemplate refusing a template that peers
 // still link to — the one failure the operator fixes by detaching them.
 type TemplateInUseError struct{ Peers []string }
diff --git a/internal/web/policies.go b/internal/web/policies.go
index b028fe1..5e952e4 100644
--- a/internal/web/policies.go
+++ b/internal/web/policies.go
@@ -63,17 +63,11 @@ func (s *Server) handlePoliciesList(w http.ResponseWriter, r *http.Request) {
 	}
 	// A template's chain holds the policy too: delete refuses it, so the list
 	// must not call it unused.
-	templates, err := s.store.ListPeerTemplates()
+	templateUse, err := s.store.TemplatePolicyUsage()
 	if err != nil {
-		s.serverError(w, "list peer templates", err)
+		s.serverError(w, "template policy usage", err)
 		return
 	}
-	templateUse := map[int64]int{}
-	for _, t := range templates {
-		for _, pol := range append(t.ImportPolicies, t.ExportPolicies...) {
-			templateUse[pol.ID]++
-		}
-	}
 	sets, err := s.store.ListPrefixSets()
 	if err != nil {
 		s.serverError(w, "list prefix sets", err)

From 1417cc8e9f0b4b1fe7b10a59956648762e61f597 Mon Sep 17 00:00:00 2001
From: Bogdan FLOREA <bogdan@florea.xyz>
Date: Thu, 1 Oct 2026 10:49:05 +0300
Subject: [PATCH 19/19] docs: CHANGELOG for the namespace checks

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2e285b..ead2782 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -58,6 +58,13 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - A peer rename that failed validation re-rendered the form posting to the new
   name, so the corrected resubmit hit "not found" and the edit was lost. The form
   now posts back to the name the peer is stored under.
+- **Two objects with one BIRD name are caught before BIRD is.** BIRD keeps
+  defines, filters, functions, templates and protocols in one namespace, so a peer
+  and a prefix set (or community, AS set, RPKI server, BMP station) of the same
+  name failed `bird -p` with "Symbol already defined". The renderer now refuses
+  such a model with a message naming both, so Preview and Changes show it before
+  any apply. A library community also refuses every name birdy or BIRD defines
+  itself (`BOGON_ASNS`, `rpki4`, `master4`, …), not only the five it checked.
 - **Generated filters no longer log every route a catch-all drops.** BIRD logs a
   reject's message once per route it drops. Export filters ended in
   `reject "not permitted by any export policy"`, and import policies rejected