feat(core): Java's IP and ICMP threads, measured with Java FILIUS

Every packet that comes in goes through its node's IP thread (UDP, TCP) or
ICMP thread (ICMP), as Java's IPThread and ICMPThread: deliver, answer an
echo request or forward, one after the other; while one waits for ARP, the
next wait behind it. A packet a node sends to itself is delivered at once,
as Java's IP.senden does. The transport send threads and these are one
mechanism now (handToProtocolThread).

ArpRun has three stories through the router (routedUdpBehind,
routedPingBesideUdp, routedPingBehindPing); the oracle writes ICMP frames
with type, code, addresses and sequence number. All seven ArpRun stories
match Java FILIUS.

Measured and not taken: Java's ARP wakes one waiter with notify, not the
one whose answer came; the core wakes all that wait for the address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/test/engine.test.ts

@@ -1783,3 +1783,77 @@ describe('ARP', () => {
     expect(engine.state.packetTraces.filter((trace) => trace.layer === 'network' && trace.operation === 'sent')).toEqual([]);
   });
 });
+
+describe("Java's IP and ICMP threads", () => {
+  const twoPcs = (prefix: string, base: number, options: { secondIsGateway?: boolean; firewall?: FirewallConfiguration } = {}) => {
+    const [firstId, firstPortId, secondId, secondPortId] = [base, base + 1, base + 2, base + 3].map(uuid) as [string, string, string, string];
+    const engine = startedEngine({
+      nodes: [pc(firstId, firstPortId), pc(secondId, secondPortId)],
+      links: [link(firstId, firstPortId, secondId, secondPortId)],
+      deviceConfigurations: new Map([
+        [firstId, device(`${prefix}.1`, options.secondIsGateway === true ? { gateway: `${prefix}.2` } : {})],
+        [secondId, device(`${prefix}.2`)],
+      ]),
+      ...(options.firewall === undefined ? {} : { firewallConfigurationsByNodeId: new Map([[secondId, options.firewall]]) }),
+    });
+    return { engine, firstId, secondId };
+  };
+  const text = (payload: Uint8Array | undefined) => new TextDecoder().decode(payload ?? new Uint8Array());
+
+  it('holds the ICMP thread while an echo reply waits for ARP: the next echo request waits behind it', () => {
+    const { engine, firstId } = twoPcs('10.29.0', 0x1b01);
+    // An echo request from .99, which no card has: the answer waits for ARP.
+    engine.sendIPv4Packet(firstId, {
+      identity: engine.allocatePacketIdentity(),
+      senderIPAddress: '10.29.0.99',
+      receiverIPAddress: '10.29.0.2',
+      timeToLive: 64,
+      protocol: 'icmp',
+      payload: { kind: 'icmp', message: icmpMessage('echoRequest', { identifier: 7, sequenceNumber: 7, data: new Uint8Array() }) },
+    });
+    engine.handle({ type: 'advance', toMilliseconds: 200 });
+    const replies = () => (engine.state.icmpObservationsByNodeId.get(firstId) ?? []).filter((observation) => observation.message.kind === 'echoReply');
+
+    engine.sendIcmpEcho(firstId, '10.29.0.2');
+    expect(replies()).toEqual([]);
+    // The request came at 165 ms after ARP there and back; ARP for .99 gives up two round trips later, then the reply takes a cable.
+    engine.handle({ type: 'advance', toMilliseconds: 165 + 2 * 2_750 + 55 - 1 });
+    expect(replies()).toEqual([]);
+    engine.handle({ type: 'advance', toMilliseconds: 165 + 2 * 2_750 + 55 });
+    expect(replies().map((observation) => observation.nodeId)).toEqual([firstId]);
+  });
+
+  it('frees the IP thread of a PC that drops a packet it would have to forward', () => {
+    const { engine, firstId, secondId } = twoPcs('10.30.1', 0x1b11, { secondIsGateway: true });
+    const receiver = engine.bindUdpSocket(secondId, { localPort: 9 })!;
+    engine.sendUdp(engine.bindUdpSocket(firstId, { remoteIPAddress: '20.0.0.5', remotePort: 9 })!, new TextEncoder().encode('elsewhere'));
+    engine.sendUdp(engine.bindUdpSocket(firstId, { remoteIPAddress: '10.30.1.2', remotePort: 9 })!, new TextEncoder().encode('here'));
+
+    expect(text(engine.receiveUdp(receiver, 1_000)?.datagram.payload)).toBe('here');
+    expect(engine.state.packetTraces.some((trace) => trace.nodeId === secondId && trace.detail === 'IPv4 forwarding disabled')).toBe(true);
+  });
+
+  it('frees the IP thread of a PC whose firewall drops a packet', () => {
+    const firewall = firewallConfiguration({ isActive: true, defaultPolicy: 'drop', rules: [firewallRule({ port: 9, protocol: 'udp', action: 'accept' })] });
+    const { engine, firstId, secondId } = twoPcs('10.30.2', 0x1b21, { firewall });
+    const receiver = engine.bindUdpSocket(secondId, { localPort: 9 })!;
+    engine.bindUdpSocket(secondId, { localPort: 8 });
+    engine.sendUdp(engine.bindUdpSocket(firstId, { remoteIPAddress: '10.30.2.2', remotePort: 8 })!, new TextEncoder().encode('blocked'));
+    engine.sendUdp(engine.bindUdpSocket(firstId, { remoteIPAddress: '10.30.2.2', remotePort: 9 })!, new TextEncoder().encode('let in'));
+
+    expect(text(engine.receiveUdp(receiver, 1_000)?.datagram.payload)).toBe('let in');
+    expect(engine.state.firewallDecisions.some((decision) => !decision.accepted)).toBe(true);
+  });
+
+  it('delivers what a router sends to itself at once, while its IP thread waits for ARP', () => {
+    const { engine, sourceNodeId, routerNodeId } = routedTopology();
+    // The router forwards to 20.0.0.9, which no card has: its IP thread waits two round trips.
+    engine.sendUdp(engine.bindUdpSocket(sourceNodeId, { remoteIPAddress: '20.0.0.9', remotePort: 9 })!, new TextEncoder().encode('nobody'));
+    engine.handle({ type: 'advance', toMilliseconds: 500 });
+    const receiver = engine.bindUdpSocket(routerNodeId, { localPort: 9 })!;
+    engine.sendUdp(engine.bindUdpSocket(routerNodeId, { remoteIPAddress: '10.0.0.1', remotePort: 9 })!, new TextEncoder().encode('self'));
+
+    expect(text(engine.receiveUdp(receiver)?.datagram.payload)).toBe('self');
+    expect(engine.state.currentTimeMilliseconds).toBe(500);
+  });
+});