fix(router): late AARP/LLAP claims never join the routing table

Runtime.Start attaches and seeds each [Router].members port synchronously
right after StartAll returns, but a real EtherTalk/LToUDP/TashTalk port's
node-address claim (AARP/LLAP) finishes in a background goroutine and Start
never waits for it. When the claim lands after Attach already ran with
NetworkMin()==0, router.Attach's own nonzero guard skips installing the
directly-connected route and seedZone's zero-range guard skips the ZIT too
— and nothing ever retried either install.

The port still announces its claimed range correctly over RTMP and answers
same-network traffic fine (Inbound's same-network fast path needs no
routing-table entry), but any service reply that must round-trip through
router.Reply->Route (ZIP's ATP zone queries, AFP's ASP session reads) does
RoutingTable.GetByNetwork and gets a silent, permanent nil — the reply is
dropped with no error, forever. This reproduced as: Chooser showing only
the AFP server's own zone via GetLocalZones (expected) but never all zones
via GetZoneList, and AFP connections stalling on ASP GetStatus with zero
replies.

Poll briefly (bounded, cancelled on Stop) for a late claim after Attach and
re-run the same route/zone install once it lands; both installs are
idempotent so this is a no-op on the fast path where the claim already
beat Attach.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: pgodwin

compose/runtime/runtime.go

@@ -22,6 +22,8 @@ package runtime
 import (
 	"context"
 	"fmt"
+	"sync"
+	"time"
 
 	"github.com/ObsoleteMadness/ClassicStack/compose/registry"
 	"github.com/ObsoleteMadness/ClassicStack/compose/supervisor"
@@ -161,6 +163,9 @@ type Runtime struct {
 	transports *transportWiring               // retained IPX/NetBEUI mini-routers + MacIP egress; drives runtime port attach + egress lifecycle
 	comps      map[string]component.Component // built components by name, for compose-edge lookups (diagnostics wiring)
 	log        log.Logger
+
+	claimWatchStop chan struct{}  // closed by Stop to cancel any still-polling late-claim watchers (§ late-claim fix)
+	claimWatchWG   sync.WaitGroup // Stop waits on this so no watcher touches the router after Stop returns
 }
 
 // Load builds a config.Model from a Store + Codec. A missing store file yields the
@@ -534,6 +539,7 @@ func (r *Runtime) Start(ctx context.Context) error {
 		eg.Start()
 	}
 	if r.rtr != nil {
+		r.claimWatchStop = make(chan struct{})
 		for _, p := range r.members {
 			if err := r.rtr.Attach(p); err != nil {
 				if r.log != nil {
@@ -543,6 +549,26 @@ func (r *Runtime) Start(ctx context.Context) error {
 				continue
 			}
 			seedZone(r.rtr, p)
+			if p.NetworkMin() == 0 {
+				// A real AARP/LLAP claim (EtherTalk/LToUDP/TashTalk) finishes in a
+				// background goroutine well after Start returns (runport/aarp never
+				// blocks Start on the probe burst) — Attach ran above with
+				// NetworkMin()==0, so its own directly-connected route was skipped
+				// (router.go's `if nmin != 0 && nmax != 0` guard) and seedZone's own
+				// zero-range guard skipped the ZIT too. Nothing else ever retries
+				// either install: the port later announces its claimed range fine
+				// over RTMP and answers same-network traffic fine (Inbound's
+				// same-network fast path needs no routing-table entry), but every
+				// service reply that must round-trip through router.Reply→Route
+				// (ZIP's ATP zone queries, AFP's ASP session) does
+				// RoutingTable.GetByNetwork and gets a silent, permanent nil. Poll
+				// briefly for the claim to land and (re)run the same install once it
+				// does — SetPortRange/AddNetworksToZone are both idempotent against
+				// an already-correct entry, so this is a no-op on the fast path where
+				// the claim beat Attach.
+				r.claimWatchWG.Add(1)
+				go r.awaitLateClaim(p, r.claimWatchStop)
+			}
 		}
 	}
 	// Begin the telemetry stats flush once the stack is up: it polls every Statful
@@ -552,10 +578,50 @@ func (r *Runtime) Start(ctx context.Context) error {
 	return nil
 }
 
+// claimWatchInterval is the poll period awaitLateClaim uses while waiting for a
+// member port's AARP/LLAP claim to land.
+const claimWatchInterval = 100 * time.Millisecond
+
+// claimWatchAttempts bounds how long awaitLateClaim polls before giving up (30 ×
+// 100ms = 3s — generous over AARP's normal probe-burst duration; a port that has not
+// claimed by then logs a warning and is left for its own retry/conflict logic).
+const claimWatchAttempts = 30
+
+// awaitLateClaim polls p for its AARP/LLAP claim to land, then installs its
+// directly-connected route + seed zone (see the Start comment for why this install
+// can be skipped at Attach time). Runs until the claim lands, claimWatchAttempts is
+// exhausted, or stop is closed by Runtime.Stop. r.claimWatchWG.Done is deferred so
+// Stop can wait out any watcher still polling before it detaches ports.
+func (r *Runtime) awaitLateClaim(p router.RoutedPort, stop chan struct{}) {
+	defer r.claimWatchWG.Done()
+	for range claimWatchAttempts {
+		select {
+		case <-stop:
+			return
+		case <-time.After(claimWatchInterval):
+		}
+		if p.NetworkMin() == 0 {
+			continue
+		}
+		r.rtr.RoutingTable().SetPortRange(p, p.NetworkMin(), p.NetworkMax())
+		seedZone(r.rtr, p)
+		return
+	}
+	if r.log != nil {
+		r.log.Log1(log.Warn, "router member never claimed an address; routing table has no directly-connected entry for it",
+			log.Str("member", p.Name()))
+	}
+}
+
 // Stop detaches the router members (reversing Start's attach) and then brings the
 // whole stack down in reverse dependency order. Detach is best-effort — a member
 // already withdrawn (e.g. by an individual Stop) must not block shutdown.
 func (r *Runtime) Stop(ctx context.Context) error {
+	if r.claimWatchStop != nil {
+		close(r.claimWatchStop)
+		r.claimWatchWG.Wait()
+		r.claimWatchStop = nil
+	}
 	if r.log != nil && r.log.Enabled(log.Info) {
 		r.log.Log0(log.Info, "shutdown: stopping telemetry stats flush")
 	}

compose/runtime/runtime_test.go

@@ -6,6 +6,7 @@ import (
 	"sort"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/ObsoleteMadness/ClassicStack/compose/registry"
 	"github.com/ObsoleteMadness/ClassicStack/core/bus"
@@ -435,6 +436,95 @@ func (p *fakeSeedPort) NetworkMin() uint16 { return p.nmin }
 func (p *fakeSeedPort) NetworkMax() uint16 { return p.nmax }
 func (p *fakeSeedPort) SeedZone() string   { return p.zone }
 
+// lateClaimPort simulates a real AARP-based EtherTalk port: NetworkMin/Max are 0 when
+// Start returns (matching runport/aarp's async claimLoop, which probes over the wire in
+// a background goroutine and calls SetAddress only once a node address is accepted —
+// Start itself never blocks on it). The range becomes available `delay` after Start.
+type lateClaimPort struct {
+	fakeRoutedPort
+	mu         sync.Mutex
+	nmin, nmax uint16
+	zone       string
+	delay      time.Duration
+}
+
+func (p *lateClaimPort) Start(ctx context.Context) error {
+	go func() {
+		time.Sleep(p.delay)
+		p.mu.Lock()
+		p.nmin, p.nmax = 3, 5
+		p.mu.Unlock()
+	}()
+	return p.fakeRoutedPort.Start(ctx)
+}
+func (p *lateClaimPort) NetworkMin() uint16 { p.mu.Lock(); defer p.mu.Unlock(); return p.nmin }
+func (p *lateClaimPort) NetworkMax() uint16 { p.mu.Lock(); defer p.mu.Unlock(); return p.nmax }
+func (p *lateClaimPort) SeedZone() string   { return p.zone }
+
+// TestStart_LateClaimingMemberNeverJoinsRoutingTable is the regression guard for the
+// dead-ZIP/ASP-reply bug: Runtime.Start attaches + seeds each router member SYNCHRONOUSLY
+// right after StartAll returns (runtime.go's Start loop), but a real EtherTalk port's AARP
+// claim finishes in a background goroutine — Start does not wait for it. When the claim
+// lands after Attach already ran with NetworkMin()==0, router.Attach's own
+// `if nmin != 0 && nmax != 0 { SetPortRange }` guard skips installing the directly-connected
+// route, and nothing ever retries it: the port later announces its range correctly over RTMP
+// and answers same-network unicast fine, but any reply that must round-trip through
+// router.Reply→Route (ZIP's ATP zone queries, AFP's ASP session reads) does
+// `RoutingTable.GetByNetwork(net)` and gets a permanent nil — the reply is dropped with no
+// error, forever, even though the port is otherwise live. This proves the race exists today.
+func TestStart_LateClaimingMemberNeverJoinsRoutingTable(t *testing.T) {
+	m := config.NewModel()
+	m.Router = config.RouterSection{Members: []string{"et0"}}
+	port := &lateClaimPort{
+		fakeRoutedPort: fakeRoutedPort{name: "et0"},
+		zone:           "EtherTalk Network",
+		delay:          20 * time.Millisecond,
+	}
+	src := fakeSource{
+		router.Name: func(*registry.BuildContext) (component.Component, error) {
+			return router.New(log.New(router.Name)), nil
+		},
+		"et0": func(*registry.BuildContext) (component.Component, error) { return port, nil },
+	}
+	rt, err := Build(Options{Model: m, source: src})
+	if err != nil {
+		t.Fatalf("Build = %v", err)
+	}
+	if err := rt.Start(context.Background()); err != nil {
+		t.Fatalf("Start = %v", err)
+	}
+	t.Cleanup(func() { rt.Stop(context.Background()) })
+
+	// Give the AARP-simulating goroutine time to land its claim (well past `delay`) and
+	// the runtime's late-claim watcher (which polls every claimWatchInterval) a full
+	// cycle to notice and install the route.
+	time.Sleep(250 * time.Millisecond)
+
+	if got := port.NetworkMin(); got != 3 {
+		t.Fatalf("port never claimed its range in this test setup: NetworkMin=%d", got)
+	}
+
+	rtr := rt.router()
+	// GetByNetwork's second return is a "marked bad" flag, not a found/ok flag (every
+	// caller in router.go checks entry == nil instead) — a fresh entry is state-good,
+	// so that bool is false here even on success.
+	if entry, _ := rtr.RoutingTable().GetByNetwork(3); entry == nil {
+		t.Errorf("REGRESSION: network 3 has no routing-table entry even after the port claimed" +
+			" range 3-5 — router.Reply()'s Route() call will silently drop any service reply" +
+			" addressed to this network forever, because Attach ran while NetworkMin() was still 0")
+	}
+	found := false
+	for _, z := range rtr.Zones().Zones() {
+		if string(z) == "EtherTalk Network" {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("REGRESSION: seed zone never installed into the ZIT — seedZone() also ran while" +
+			" NetworkMin() was still 0 and its own `if nmin == 0 { return }` guard skipped it")
+	}
+}
+
 // TestStart_SeedsMemberZoneIntoZIT is the regression guard for the empty-Chooser bug:
 // when a seed member port attaches, the runtime must install its network range into the
 // router's Zone Information Table under the port's seed zone, so a self-contained seed