Fix Linux route probe contract and expose K1 verification after Wi-Fi apply

tests/test_node_k1_bridge.py

@@ -351,6 +351,58 @@ def test_wired_board_bridge_does_not_require_host_wifi_association(tmp_path, mon
     assert value["reason_code"] is None
 
 
+@pytest.mark.parametrize("route_changes", [False, True])
+def test_wired_board_real_service_correlates_route_and_control_endpoint(
+    tmp_path, monkeypatch, route_changes,
+):
+    from dataclasses import replace
+
+    from k1link.device_plugins.xgrids_k1 import facade, linux_host
+
+    sys_net = tmp_path / "sys-net"
+    (sys_net / "enp1s0").mkdir(parents=True)
+    probe = linux_host.LinuxWifiAssociationProbe(sys_net)
+    service = facade.XgridsK1CompatibilityService(
+        tmp_path / "runtime", host_wifi_association_probe=probe,
+    )
+    path = facade.HostPathProbeResult(
+        available=True, fingerprint="synthetic-route", interface="enp1s0",
+        source_ipv4="192.168.1.2", route_class="direct", reason_code=None,
+    )
+    monkeypatch.setattr(facade, "_inspect_host_path", lambda _target: path)
+    calls = []
+
+    def tcp(_target):
+        calls.append("tcp")
+        if route_changes:
+            monkeypatch.setattr(facade, "_inspect_host_path", lambda _target: replace(
+                path, fingerprint="new-route", source_ipv4="192.168.1.3",
+            ))
+        return True
+
+    monkeypatch.setattr(facade, "_control_endpoint_reachable", tcp)
+
+    def forbidden(*_args, **_kwargs):
+        raise AssertionError("Wired control bootstrap must not request host Wi-Fi")
+
+    monkeypatch.setattr(linux_host, "_run", forbidden)
+    try:
+        observed = service._sample_host_path("192.168.1.7")
+        assert observed.available is True
+        assert observed.interface == "enp1s0"
+        assert observed.reason_code is None
+        assert observed.fingerprint != path.fingerprint
+        assert service._sample_host_path("192.168.1.7").fingerprint == observed.fingerprint
+        endpoint = service._probe_control_endpoint("192.168.1.7")
+        assert calls == ["tcp"]
+        assert endpoint.reachable is (not route_changes)
+        assert endpoint.reason_code == (
+            "host-path-changed-during-tcp-probe" if route_changes else None
+        )
+    finally:
+        service.close()
+
+
 def test_linux_kernel_route_is_matched_route_not_resolved_host(monkeypatch):
     from k1link.device_plugins.xgrids_k1 import linux_host
     from k1link.device_plugins.xgrids_k1.facade import _classify_host_route