From b2277151439d815ddca5812b0608db92afde66e0 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Thu, 6 Aug 2026 14:55:31 +0200
Subject: [PATCH 1/8] queueing: add the IDynamicInputScheduler contract

Schedulers that get their inputs wired up at runtime -- rather than from
the NED topology -- need a way to be told about a newly connected input
gate, so that they start considering it. ~DynamicClassifier creates and
connects the gate; addInput() is how the scheduler learns about it.

This makes it possible for a dynamic classifier to build pull-based
per-class structures (queue + scheduler), not just push-based demux/remux
chains terminating in a ~PacketMultiplexer.
---
 .../contract/IDynamicInputScheduler.h         | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 src/inet/queueing/contract/IDynamicInputScheduler.h

diff --git a/src/inet/queueing/contract/IDynamicInputScheduler.h b/src/inet/queueing/contract/IDynamicInputScheduler.h
new file mode 100644
index 00000000000..eea21bb3ba1
--- /dev/null
+++ b/src/inet/queueing/contract/IDynamicInputScheduler.h
@@ -0,0 +1,38 @@
+//
+// Copyright (C) 2026 OpenSim Ltd.
+//
+// SPDX-License-Identifier: LGPL-3.0-or-later
+//
+
+
+#ifndef __INET_IDYNAMICINPUTSCHEDULER_H
+#define __INET_IDYNAMICINPUTSCHEDULER_H
+
+#include "inet/common/INETDefs.h"
+
+namespace inet {
+namespace queueing {
+
+/**
+ * Interface for packet schedulers whose set of inputs grows at runtime, so that a dynamic
+ * classifier (see ~DynamicClassifier) can add an input branch on demand. The classifier
+ * creates and connects the new input gate; the scheduler is then told to start considering
+ * it via addInput().
+ */
+class INET_API IDynamicInputScheduler
+{
+  public:
+    virtual ~IDynamicInputScheduler() {}
+
+    /**
+     * Registers an input gate that was created and connected at runtime: the scheduler sets
+     * up the corresponding provider reference and notifies its downstream collector that a
+     * new packet may become available.
+     */
+    virtual void addInput(cGate *inputGate) = 0;
+};
+
+} // namespace queueing
+} // namespace inet
+
+#endif

From eea77e76bcb766f15d12cbdda8e11cc8a6b01b61 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Thu, 6 Aug 2026 14:55:46 +0200
Subject: [PATCH 2/8] queueing: generalize DynamicClassifier

~DynamicClassifier could only build one shape: create a submodule of the
configured type in a preexisting submodule vector, and wire it to a
submodule literally named "multiplexer". Three generalizations:

- The downstream aggregator is now named by the aggregatorSubmoduleName
  parameter (still "multiplexer" by default). If it implements
  ~IDynamicInputScheduler, the newly created input gate is registered
  with it, so the aggregator can be a pull scheduler instead of a push
  multiplexer.

- With spliceBranchSubmodules, a compound moduleType forming a linear
  in -> a -> b -> ... -> out chain is flattened: its inner submodules are
  reparented into the classifier's parent as vector elements named after
  them (a[k], b[k]), rather than staying behind the compound's boundary.
  A downstream matched-pair scheduler can then address them directly,
  which a compound boundary would prevent.

- forwardMatchingParams() copies same-named parameters from the enclosing
  module into the created branch before it is finalized, so a per-class
  compound picks up the enclosing queue's configuration.

Branch module initialization is deferred until the whole chain, including
the aggregator connection, is wired -- a module that resolves its
downstream peer in initialize() would otherwise see a dangling gate.

submoduleName is now optional (it is unused when splicing), and the
missing-submodule-vector and missing-aggregator cases fail with a clear
error instead of a null dereference.
---
 .../queueing/classifier/DynamicClassifier.cc  | 141 ++++++++++++++----
 .../queueing/classifier/DynamicClassifier.h   |  31 +++-
 .../queueing/classifier/DynamicClassifier.ned |  15 +-
 3 files changed, 153 insertions(+), 34 deletions(-)

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index 43d6fe71c02..a207fe7932e 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -9,6 +9,7 @@
 
 #include "inet/common/INETUtils.h"
 #include "inet/common/ModuleAccess.h"
+#include "inet/queueing/contract/IDynamicInputScheduler.h"
 
 namespace inet {
 namespace queueing {
@@ -21,44 +22,126 @@ void DynamicClassifier::initialize(int stage)
     if (stage == INITSTAGE_LOCAL) {
         submoduleName = par("submoduleName");
         moduleType = cModuleType::get(par("moduleType"));
-        if (!getParentModule()->hasSubmoduleVector(submoduleName))
-             throw cRuntimeError("The submodule vector '%s' missing from %s", submoduleName, getParentModule()->getFullPath().c_str());
-     }
+        aggregatorSubmoduleName = par("aggregatorSubmoduleName");
+        spliceBranchSubmodules = par("spliceBranchSubmodules");
+        if (!spliceBranchSubmodules && (submoduleName == nullptr || submoduleName[0] == '\0'))
+            throw cRuntimeError("The submoduleName parameter must be set when spliceBranchSubmodules is false (it names the submodule vector that holds each branch)");
+        if (!spliceBranchSubmodules && !getParentModule()->hasSubmoduleVector(submoduleName))
+            throw cRuntimeError("The submodule vector '%s' is missing from %s", submoduleName, getParentModule()->getFullPath().c_str());
+        if (getParentModule()->getSubmodule(aggregatorSubmoduleName) == nullptr)
+            throw cRuntimeError("The aggregator submodule '%s' is missing from %s", aggregatorSubmoduleName, getParentModule()->getFullPath().c_str());
+    }
 }
 
 int DynamicClassifier::classifyPacket(Packet *packet)
 {
     int index = PacketClassifier::classifyPacket(packet);
     auto it = classIndexToGateItMap.find(index);
-    if (it == classIndexToGateItMap.end()) {
-        auto parentModule = getParentModule();
-        int submoduleIndex = gateSize("out");
-        int origVectorSize = parentModule->getSubmoduleVectorSize(submoduleName);
-        parentModule->setSubmoduleVectorSize(submoduleName, std::max(origVectorSize, submoduleIndex + 1));
-        auto module = moduleType->create(submoduleName, parentModule, submoduleIndex);
-        auto moduleInputGate = module->gate("in");
-        auto moduleOutputGate = module->gate("out");
-        auto multiplexer = parentModule->getSubmodule("multiplexer");
-        multiplexer->setGateSize("in", multiplexer->gateSize("in") + 1);
-        auto multiplexerInputGate = multiplexer->gate("in", multiplexer->gateSize("in") - 1);
-        setGateSize("out", submoduleIndex + 1);
-        auto classifierOutputGate = gate("out", gateSize("out") - 1);
-        classifierOutputGate->connectTo(moduleInputGate);
-        outputGates.push_back(classifierOutputGate);
-        PassivePacketSinkRef consumer;
-        consumer.reference(classifierOutputGate, false);
-        consumers.push_back(consumer);
-        moduleOutputGate->connectTo(multiplexerInputGate);
-        module->finalizeParameters();
-        module->buildInside();
+    if (it != classIndexToGateItMap.end())
+        return it->second;
+    int branchIndex = createBranch();
+    classIndexToGateItMap[index] = branchIndex;
+    return branchIndex;
+}
+
+int DynamicClassifier::createBranch()
+{
+    cModule *parent = getParentModule();
+    int index = gateSize("out");
+    // grow this classifier's output gate vector
+    setGateSize("out", index + 1);
+    cGate *classifierOutputGate = gate("out", index);
+    outputGates.push_back(classifierOutputGate);
+    PassivePacketSinkRef consumer;
+    consumer.reference(classifierOutputGate, false);
+    consumers.push_back(consumer);
+    ActivePacketSinkRef collector;
+    collector.reference(classifierOutputGate, false);
+    collectors.push_back(collector);
+    // build the branch and collect the modules whose initialization is deferred until the
+    // whole chain (including the aggregator connection) is wired
+    std::vector<cModule *> modulesToInitialize;
+    cGate *branchOutputGate = spliceBranchSubmodules ?
+        spliceBranch(index, classifierOutputGate, modulesToInitialize) :
+        createModuleBranch(index, classifierOutputGate, modulesToInitialize);
+    // wire the branch output into the aggregator's next input gate
+    cModule *aggregator = parent->getSubmodule(aggregatorSubmoduleName);
+    aggregator->setGateSize("in", aggregator->gateSize("in") + 1);
+    cGate *aggregatorInputGate = aggregator->gate("in", aggregator->gateSize("in") - 1);
+    branchOutputGate->connectTo(aggregatorInputGate);
+    for (auto module : modulesToInitialize)
         module->callInitialize();
-        classIndexToGateItMap[index] = submoduleIndex;
-        return submoduleIndex;
+    // if the aggregator is a pull scheduler with runtime-added inputs, register the new one
+    if (auto scheduler = dynamic_cast<IDynamicInputScheduler *>(aggregator))
+        scheduler->addInput(aggregatorInputGate);
+    return index;
+}
+
+void DynamicClassifier::forwardMatchingParams(cModule *module)
+{
+    // copy the value of every parameter the created module shares (by name) with this
+    // classifier's parent -- so e.g. a per-class compound picks up the enclosing queue's
+    // configuration before it (and its own submodules) are finalized
+    cModule *parent = getParentModule();
+    for (int i = 0; i < module->getNumParams(); i++) {
+        cPar& param = module->par(i);
+        if (parent->hasPar(param.getName()))
+            param = parent->par(param.getName());
     }
-    else
-        return it->second;
+}
+
+cGate *DynamicClassifier::createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize)
+{
+    cModule *parent = getParentModule();
+    parent->setSubmoduleVectorSize(submoduleName, index + 1);
+    cModule *module = moduleType->create(submoduleName, parent, index);
+    classifierOutputGate->connectTo(module->gate("in"));
+    module->finalizeParameters();
+    module->buildInside();
+    modulesToInitialize.push_back(module);
+    return module->gate("out");
+}
+
+cGate *DynamicClassifier::spliceBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize)
+{
+    cModule *parent = getParentModule();
+    // build the branch template compound
+    cModule *compound = moduleType->create("splicetmp", parent);
+    forwardMatchingParams(compound);
+    compound->finalizeParameters();
+    compound->buildInside();
+    // walk the linear inner chain: compound.in -> chain[0].in, chain[i].out -> chain[i+1].in,
+    // chain.back().out -> compound.out. Each chain module is expected to have a single in/out.
+    std::vector<cModule *> chain;
+    std::vector<std::string> names;
+    for (cGate *g = compound->gate("in")->getNextGate(); g != nullptr && g->getOwnerModule() != compound; g = g->getOwnerModule()->gate("out")->getNextGate()) {
+        chain.push_back(g->getOwnerModule());
+        names.push_back(g->getOwnerModule()->getName());
+    }
+    if (chain.empty())
+        throw cRuntimeError("spliceBranchSubmodules: compound '%s' has no linear in->out submodule chain", moduleType->getFullName());
+    // disconnect all internal connections so the submodules can be reparented
+    compound->gate("in")->disconnect();
+    for (cModule *module : chain)
+        if (module->gate("out")->isConnectedOutside())
+            module->gate("out")->disconnect();
+    // reparent each chain module into parent.<name>[index]: move the scalar under a temporary
+    // unique name (so it does not clash with the target vector), then rename it into the slot
+    for (size_t i = 0; i < chain.size(); i++) {
+        cModule *module = chain[i];
+        module->setName(("splicetmp_" + names[i]).c_str());
+        parent->setSubmoduleVectorSize(names[i].c_str(), index + 1);
+        module->changeParentTo(parent);
+        module->setNameAndIndex(names[i].c_str(), index);
+        modulesToInitialize.push_back(module);
+    }
+    compound->deleteModule();
+    // rewire the chain at the branch level
+    classifierOutputGate->connectTo(chain.front()->gate("in"));
+    for (size_t i = 0; i + 1 < chain.size(); i++)
+        chain[i]->gate("out")->connectTo(chain[i + 1]->gate("in"));
+    return chain.back()->gate("out");
 }
 
 } // namespace queueing
 } // namespace inet
-
diff --git a/src/inet/queueing/classifier/DynamicClassifier.h b/src/inet/queueing/classifier/DynamicClassifier.h
index e1907fe1e55..2af47330c5d 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.h
+++ b/src/inet/queueing/classifier/DynamicClassifier.h
@@ -8,6 +8,8 @@
 #ifndef __INET_DYNAMICCLASSIFIER_H
 #define __INET_DYNAMICCLASSIFIER_H
 
+#include <vector>
+
 #include "inet/queueing/classifier/PacketClassifier.h"
 
 namespace inet {
@@ -15,20 +17,43 @@ namespace queueing {
 
 using namespace inet::queueing;
 
+/**
+ * A packet classifier that creates the branch for each traffic class on demand, the first
+ * time a packet of that class is seen. Each branch is one submodule of a configurable type
+ * (moduleType), wired between this classifier's output and a downstream aggregator submodule
+ * (aggregatorSubmoduleName).
+ *
+ * The aggregator may be either a push ~PacketMultiplexer (the traditional use) or a pull
+ * scheduler; if it implements ~IDynamicInputScheduler the newly created input is registered
+ * with it via addInput(). This lets the same classifier build both push demux/remux chains
+ * and pull per-class queue/scheduler structures.
+ *
+ * If spliceBranchSubmodules is set and moduleType is a compound module forming a linear
+ * chain (in -> a -> b -> ... -> out), its inner submodules are *spliced* directly into this
+ * classifier's parent (as vector elements named after the inner submodules) instead of being
+ * kept behind the compound's boundary -- so a downstream matched-pair scheduler can address
+ * them directly. See the corresponding NED file for more details.
+ */
 class INET_API DynamicClassifier : public PacketClassifier
 {
   protected:
-    const char *submoduleName = nullptr;
-    cModuleType *moduleType = nullptr;
+    const char *submoduleName = nullptr; // submodule vector for the branch module (non-splice); unused when splicing
+    cModuleType *moduleType = nullptr; // type of the per-class branch module (may be a compound)
+    const char *aggregatorSubmoduleName = nullptr; // downstream aggregator submodule (multiplexer or scheduler)
+    bool spliceBranchSubmodules = false; // flatten the (compound) branch module's submodules into the branch
     std::map<int, int> classIndexToGateItMap;
 
   protected:
     virtual void initialize(int stage) override;
     virtual int classifyPacket(Packet *packet) override;
+
+    virtual int createBranch();
+    virtual void forwardMatchingParams(cModule *module);
+    virtual cGate *createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
+    virtual cGate *spliceBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
 };
 
 } // namespace queueing
 } // namespace inet
 
 #endif
-
diff --git a/src/inet/queueing/classifier/DynamicClassifier.ned b/src/inet/queueing/classifier/DynamicClassifier.ned
index 9a679e097ce..efdb8a26bb5 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.ned
+++ b/src/inet/queueing/classifier/DynamicClassifier.ned
@@ -7,10 +7,21 @@
 
 package inet.queueing.classifier;
 
+//
+// A packet classifier that creates the branch for each traffic class on demand. Each branch
+// is a submodule of type `moduleType`, wired between this classifier's output and a downstream
+// aggregator submodule (`aggregatorSubmoduleName`, a push multiplexer by default). When the
+// aggregator is a pull scheduler implementing ~IDynamicInputScheduler, the new input is
+// registered with it. With `spliceBranchSubmodules`, a compound `moduleType` forming a linear
+// in->...->out chain is flattened: its inner submodules are instantiated directly in the
+// parent (as vector elements named after them) so a matched-pair scheduler can address them.
+//
 simple DynamicClassifier extends PacketClassifier
 {
     parameters:
-        string submoduleName;
-        string moduleType;
+        string moduleType; // NED type of the per-class branch module (may be a compound)
+        string submoduleName = default(""); // submodule vector for the branch module (non-splice); unused when splicing
+        string aggregatorSubmoduleName = default("multiplexer"); // downstream aggregator submodule to wire branches into
+        bool spliceBranchSubmodules = default(false); // if true, flatten the compound moduleType's submodules into the branch
         @class(DynamicClassifier);
 }

From 1f2dd8ba5afadbbfe2279f190ed228a95a083319 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Mon, 10 Aug 2026 15:49:36 +0200
Subject: [PATCH 3/8] queueing: replace the IDynamicInputScheduler contract
 with a model change notification

An aggregator that has to take notice of an input appearing at runtime can
learn about it from the POST_MODEL_CHANGE notification of the connection
being made (cPostPathCreateNotification), so ~DynamicClassifier needs no
contract with it beyond wiring the gate. Drop the interface and the
dynamic_cast that went with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../queueing/classifier/DynamicClassifier.cc  |  9 ++---
 .../queueing/classifier/DynamicClassifier.h   |  8 ++--
 .../queueing/classifier/DynamicClassifier.ned |  8 ++--
 .../contract/IDynamicInputScheduler.h         | 38 -------------------
 4 files changed, 14 insertions(+), 49 deletions(-)
 delete mode 100644 src/inet/queueing/contract/IDynamicInputScheduler.h

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index a207fe7932e..b1ece2a0838 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -9,7 +9,6 @@
 
 #include "inet/common/INETUtils.h"
 #include "inet/common/ModuleAccess.h"
-#include "inet/queueing/contract/IDynamicInputScheduler.h"
 
 namespace inet {
 namespace queueing {
@@ -64,16 +63,16 @@ int DynamicClassifier::createBranch()
     cGate *branchOutputGate = spliceBranchSubmodules ?
         spliceBranch(index, classifierOutputGate, modulesToInitialize) :
         createModuleBranch(index, classifierOutputGate, modulesToInitialize);
-    // wire the branch output into the aggregator's next input gate
+    // Wire the branch output into the aggregator's next input gate. An aggregator that has
+    // to take notice of a runtime-added input (a pull scheduler, for example) learns about
+    // it from the model change notification of this very connection, so nothing here needs
+    // to know what kind of aggregator it is.
     cModule *aggregator = parent->getSubmodule(aggregatorSubmoduleName);
     aggregator->setGateSize("in", aggregator->gateSize("in") + 1);
     cGate *aggregatorInputGate = aggregator->gate("in", aggregator->gateSize("in") - 1);
     branchOutputGate->connectTo(aggregatorInputGate);
     for (auto module : modulesToInitialize)
         module->callInitialize();
-    // if the aggregator is a pull scheduler with runtime-added inputs, register the new one
-    if (auto scheduler = dynamic_cast<IDynamicInputScheduler *>(aggregator))
-        scheduler->addInput(aggregatorInputGate);
     return index;
 }
 
diff --git a/src/inet/queueing/classifier/DynamicClassifier.h b/src/inet/queueing/classifier/DynamicClassifier.h
index 2af47330c5d..f8ec854dc6b 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.h
+++ b/src/inet/queueing/classifier/DynamicClassifier.h
@@ -24,9 +24,11 @@ using namespace inet::queueing;
  * (aggregatorSubmoduleName).
  *
  * The aggregator may be either a push ~PacketMultiplexer (the traditional use) or a pull
- * scheduler; if it implements ~IDynamicInputScheduler the newly created input is registered
- * with it via addInput(). This lets the same classifier build both push demux/remux chains
- * and pull per-class queue/scheduler structures.
+ * scheduler. An aggregator that needs to take notice of an input appearing at runtime picks
+ * it up from the POST_MODEL_CHANGE notification of the connection itself (see
+ * cPostPathCreateNotification), so no extra contract is needed between the two. This lets the
+ * same classifier build both push demux/remux chains and pull per-class queue/scheduler
+ * structures.
  *
  * If spliceBranchSubmodules is set and moduleType is a compound module forming a linear
  * chain (in -> a -> b -> ... -> out), its inner submodules are *spliced* directly into this
diff --git a/src/inet/queueing/classifier/DynamicClassifier.ned b/src/inet/queueing/classifier/DynamicClassifier.ned
index efdb8a26bb5..615acdad024 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.ned
+++ b/src/inet/queueing/classifier/DynamicClassifier.ned
@@ -10,9 +10,11 @@ package inet.queueing.classifier;
 //
 // A packet classifier that creates the branch for each traffic class on demand. Each branch
 // is a submodule of type `moduleType`, wired between this classifier's output and a downstream
-// aggregator submodule (`aggregatorSubmoduleName`, a push multiplexer by default). When the
-// aggregator is a pull scheduler implementing ~IDynamicInputScheduler, the new input is
-// registered with it. With `spliceBranchSubmodules`, a compound `moduleType` forming a linear
+// aggregator submodule (`aggregatorSubmoduleName`, a push multiplexer by default). The
+// aggregator may also be a pull scheduler; one that has to take notice of an input appearing
+// at runtime learns about it from the model change notification of the connection being made,
+// so no extra contract is needed between the two.
+// With `spliceBranchSubmodules`, a compound `moduleType` forming a linear
 // in->...->out chain is flattened: its inner submodules are instantiated directly in the
 // parent (as vector elements named after them) so a matched-pair scheduler can address them.
 //
diff --git a/src/inet/queueing/contract/IDynamicInputScheduler.h b/src/inet/queueing/contract/IDynamicInputScheduler.h
deleted file mode 100644
index eea21bb3ba1..00000000000
--- a/src/inet/queueing/contract/IDynamicInputScheduler.h
+++ /dev/null
@@ -1,38 +0,0 @@
-//
-// Copyright (C) 2026 OpenSim Ltd.
-//
-// SPDX-License-Identifier: LGPL-3.0-or-later
-//
-
-
-#ifndef __INET_IDYNAMICINPUTSCHEDULER_H
-#define __INET_IDYNAMICINPUTSCHEDULER_H
-
-#include "inet/common/INETDefs.h"
-
-namespace inet {
-namespace queueing {
-
-/**
- * Interface for packet schedulers whose set of inputs grows at runtime, so that a dynamic
- * classifier (see ~DynamicClassifier) can add an input branch on demand. The classifier
- * creates and connects the new input gate; the scheduler is then told to start considering
- * it via addInput().
- */
-class INET_API IDynamicInputScheduler
-{
-  public:
-    virtual ~IDynamicInputScheduler() {}
-
-    /**
-     * Registers an input gate that was created and connected at runtime: the scheduler sets
-     * up the corresponding provider reference and notifies its downstream collector that a
-     * new packet may become available.
-     */
-    virtual void addInput(cGate *inputGate) = 0;
-};
-
-} // namespace queueing
-} // namespace inet
-
-#endif

From f03585e59082512e0d424bf0f6eb7b84b9e25732 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Mon, 10 Aug 2026 15:50:11 +0200
Subject: [PATCH 4/8] queueing: fix DynamicClassifier taking sink references on
 an unconnected gate

The PassivePacketSinkRef/ActivePacketSinkRef of a newly created branch were
resolved right after setGateSize(), while the new out[index] gate was still
unconnected -- the branch and the aggregator are only wired afterwards.
ModuleRefByGate::reference() resolves the peer eagerly by walking the
connection, and with mandatory=false it stores a nullptr without complaint,
which nothing ever re-resolves.

The result was a permanently null consumers[index]: canPushPacket() and
canPushSomePacket() threw on the null dereference, and pushPacket() quietly
degraded to send(), bypassing the push API and its back-pressure.

Take the references only after the whole path, up to and including the
aggregator connection, has been wired.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../queueing/classifier/DynamicClassifier.cc     | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index b1ece2a0838..4dd8b54bb78 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -50,13 +50,6 @@ int DynamicClassifier::createBranch()
     // grow this classifier's output gate vector
     setGateSize("out", index + 1);
     cGate *classifierOutputGate = gate("out", index);
-    outputGates.push_back(classifierOutputGate);
-    PassivePacketSinkRef consumer;
-    consumer.reference(classifierOutputGate, false);
-    consumers.push_back(consumer);
-    ActivePacketSinkRef collector;
-    collector.reference(classifierOutputGate, false);
-    collectors.push_back(collector);
     // build the branch and collect the modules whose initialization is deferred until the
     // whole chain (including the aggregator connection) is wired
     std::vector<cModule *> modulesToInitialize;
@@ -71,6 +64,15 @@ int DynamicClassifier::createBranch()
     aggregator->setGateSize("in", aggregator->gateSize("in") + 1);
     cGate *aggregatorInputGate = aggregator->gate("in", aggregator->gateSize("in") - 1);
     branchOutputGate->connectTo(aggregatorInputGate);
+    // the sink references resolve the far end of the path eagerly, so they can only be taken
+    // now that the whole branch, up to and including the aggregator, is connected
+    outputGates.push_back(classifierOutputGate);
+    PassivePacketSinkRef consumer;
+    consumer.reference(classifierOutputGate, false);
+    consumers.push_back(consumer);
+    ActivePacketSinkRef collector;
+    collector.reference(classifierOutputGate, false);
+    collectors.push_back(collector);
     for (auto module : modulesToInitialize)
         module->callInitialize();
     return index;

From 680d9c8a13e734ce3f122841c26065ed75ff0b05 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Mon, 10 Aug 2026 15:55:37 +0200
Subject: [PATCH 5/8] queueing: never shrink the branch submodule vector in
 DynamicClassifier

The vector was resized to exactly index + 1, where index is the classifier's
current out gate count -- not necessarily at least the size the vector was
declared with in NED. setSubmoduleVectorSize() refuses to remove a range that
still holds submodules, so a parent declaring a larger vector than the
classifier has output gates would abort the run.

Route both resize sites through growSubmoduleVector(), which only ever
extends, and which reports a missing vector by name (the splice path resizes
vectors named after the spliced submodules, which initialize() cannot check
up front).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 src/inet/queueing/classifier/DynamicClassifier.cc | 13 +++++++++++--
 src/inet/queueing/classifier/DynamicClassifier.h  |  1 +
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index 4dd8b54bb78..ba66938014f 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -78,6 +78,15 @@ int DynamicClassifier::createBranch()
     return index;
 }
 
+void DynamicClassifier::growSubmoduleVector(cModule *parent, const char *name, int size)
+{
+    // the vector is only ever extended: it may have been declared larger in NED, and shrinking
+    // one that still holds submodules is an error
+    if (!parent->hasSubmoduleVector(name))
+        throw cRuntimeError("The submodule vector '%s' is missing from %s", name, parent->getFullPath().c_str());
+    parent->setSubmoduleVectorSize(name, std::max(parent->getSubmoduleVectorSize(name), size));
+}
+
 void DynamicClassifier::forwardMatchingParams(cModule *module)
 {
     // copy the value of every parameter the created module shares (by name) with this
@@ -94,7 +103,7 @@ void DynamicClassifier::forwardMatchingParams(cModule *module)
 cGate *DynamicClassifier::createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize)
 {
     cModule *parent = getParentModule();
-    parent->setSubmoduleVectorSize(submoduleName, index + 1);
+    growSubmoduleVector(parent, submoduleName, index + 1);
     cModule *module = moduleType->create(submoduleName, parent, index);
     classifierOutputGate->connectTo(module->gate("in"));
     module->finalizeParameters();
@@ -131,7 +140,7 @@ cGate *DynamicClassifier::spliceBranch(int index, cGate *classifierOutputGate, s
     for (size_t i = 0; i < chain.size(); i++) {
         cModule *module = chain[i];
         module->setName(("splicetmp_" + names[i]).c_str());
-        parent->setSubmoduleVectorSize(names[i].c_str(), index + 1);
+        growSubmoduleVector(parent, names[i].c_str(), index + 1);
         module->changeParentTo(parent);
         module->setNameAndIndex(names[i].c_str(), index);
         modulesToInitialize.push_back(module);
diff --git a/src/inet/queueing/classifier/DynamicClassifier.h b/src/inet/queueing/classifier/DynamicClassifier.h
index f8ec854dc6b..162469f389a 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.h
+++ b/src/inet/queueing/classifier/DynamicClassifier.h
@@ -50,6 +50,7 @@ class INET_API DynamicClassifier : public PacketClassifier
     virtual int classifyPacket(Packet *packet) override;
 
     virtual int createBranch();
+    virtual void growSubmoduleVector(cModule *parent, const char *name, int size);
     virtual void forwardMatchingParams(cModule *module);
     virtual cGate *createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
     virtual cGate *spliceBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);

From 21fc255974edbbfd323f456b216a4e4619a800be Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Wed, 12 Aug 2026 11:28:11 +0200
Subject: [PATCH 6/8] queueing: record spliced branch statistics under the
 final module path

The submodules DynamicClassifier splices into a branch are built inside the
template compound, and only reparented and renamed afterwards. The result
recorders of a module are created at the end of its buildInside(), however, and
an output vector remembers the module's full path from the moment it is
registered, so every branch recorded its vectors under the same
...splicetmp.<name> path -- indistinguishable from each other. Scalars were
unaffected, being recorded at finish() under the name the module has by then.
Per-statistic configuration (recording modes, vector recording, recording
intervals) was matched against the temporary path as well.

Recreate the result recorders of each spliced submodule once it is at its final
place, submodules first, so that a @statistic taking its source from a submodule
signal is put back by the module that declares it. The discarded recorders take
their output vectors with them, but a vector is declared in the result file when
it is registered, so an empty declaration is left behind under the temporary
name; the NED documentation says how to suppress those.
---
 .../queueing/classifier/DynamicClassifier.cc  | 23 +++++++++++++++++++
 .../queueing/classifier/DynamicClassifier.h   |  1 +
 .../queueing/classifier/DynamicClassifier.ned |  4 ++++
 3 files changed, 28 insertions(+)

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index ba66938014f..651477f9807 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -87,6 +87,28 @@ void DynamicClassifier::growSubmoduleVector(cModule *parent, const char *name, i
     parent->setSubmoduleVectorSize(name, std::max(parent->getSubmoduleVectorSize(name), size));
 }
 
+void DynamicClassifier::refreshResultRecorders(cModule *module)
+{
+    // The @statistic result recorders of a module are created while it is built, that is, while
+    // a spliced module is still inside the template compound, and an output vector remembers the
+    // module's full path from the moment it is registered. Left alone, every branch would record
+    // its vectors under the same ...<template>.<name> path, indistinguishable from each other,
+    // and per-statistic configuration (recording modes, vector recording, intervals) would be
+    // matched against that path as well. Recreate the recorders now that the module is at its
+    // final place; the discarded ones take their output vectors with them, although a vector is
+    // declared in the result file when it is registered, so with vector-record-empty on (the
+    // default) an empty declaration is left behind under the temporary name. Submodules come
+    // first, because a @statistic of this module may take its source from a submodule signal:
+    // such a listener is removed together with the rest, and it is this module that puts it back.
+    for (cModule::SubmoduleIterator it(module); !it.end(); ++it)
+        refreshResultRecorders(*it);
+    for (simsignal_t signal : module->getLocalListenedSignals())
+        for (cIListener *listener : module->getLocalSignalListeners(signal))
+            if (dynamic_cast<cResultListener *>(listener) != nullptr)
+                module->unsubscribe(signal, listener);
+    cStatisticBuilder(getEnvir()->getConfig()).addResultRecorders(module);
+}
+
 void DynamicClassifier::forwardMatchingParams(cModule *module)
 {
     // copy the value of every parameter the created module shares (by name) with this
@@ -143,6 +165,7 @@ cGate *DynamicClassifier::spliceBranch(int index, cGate *classifierOutputGate, s
         growSubmoduleVector(parent, names[i].c_str(), index + 1);
         module->changeParentTo(parent);
         module->setNameAndIndex(names[i].c_str(), index);
+        refreshResultRecorders(module);
         modulesToInitialize.push_back(module);
     }
     compound->deleteModule();
diff --git a/src/inet/queueing/classifier/DynamicClassifier.h b/src/inet/queueing/classifier/DynamicClassifier.h
index 162469f389a..b90f9578a2d 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.h
+++ b/src/inet/queueing/classifier/DynamicClassifier.h
@@ -51,6 +51,7 @@ class INET_API DynamicClassifier : public PacketClassifier
 
     virtual int createBranch();
     virtual void growSubmoduleVector(cModule *parent, const char *name, int size);
+    virtual void refreshResultRecorders(cModule *module);
     virtual void forwardMatchingParams(cModule *module);
     virtual cGate *createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
     virtual cGate *spliceBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
diff --git a/src/inet/queueing/classifier/DynamicClassifier.ned b/src/inet/queueing/classifier/DynamicClassifier.ned
index 615acdad024..24d48c9e250 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.ned
+++ b/src/inet/queueing/classifier/DynamicClassifier.ned
@@ -17,6 +17,10 @@ package inet.queueing.classifier;
 // With `spliceBranchSubmodules`, a compound `moduleType` forming a linear
 // in->...->out chain is flattened: its inner submodules are instantiated directly in the
 // parent (as vector elements named after them) so a matched-pair scheduler can address them.
+// Their statistics are recorded under the final path; the result recorders that were created
+// while a submodule was still inside the compound are discarded, but the output vectors those
+// registered leave an empty declaration behind in the result file, which can be suppressed with
+// `**.splicetmp.**.vector-record-empty = false`.
 //
 simple DynamicClassifier extends PacketClassifier
 {

From 643a5dd07fba2d65d4ad02a35ebb68bd2ff2c8b5 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Wed, 12 Aug 2026 11:37:02 +0200
Subject: [PATCH 7/8] queueing: add a module test for splicing in
 DynamicClassifier

The test builds two branches, one per class, and checks that the statistics of
the spliced submodules are recorded under their final module path (first[k],
second[k]). Empty output vectors are turned off, so a vector appears in the
result file only if data was recorded into it. On the parent commit the test
fails, both branches recording under the same ...splicetmp.<name> path.

The producer needs a back pressure barrier in front of the classifier: a
classifier that has no branch yet reports that it cannot accept a packet, which
stops an active source before the first branch is ever created.
---
 tests/queueing/DynamicClassifier_1.test | 124 ++++++++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 tests/queueing/DynamicClassifier_1.test

diff --git a/tests/queueing/DynamicClassifier_1.test b/tests/queueing/DynamicClassifier_1.test
new file mode 100644
index 00000000000..0c2e3242cca
--- /dev/null
+++ b/tests/queueing/DynamicClassifier_1.test
@@ -0,0 +1,124 @@
+%description:
+
+In this test, packets are produced periodically by an active packet source (ActivePacketSource)
+and are classified into two classes by a dynamic classifier (DynamicClassifier). The classifier
+creates the branch of a class when the first packet of that class arrives. The branch compound
+(TestBranch) is a linear chain of two packet flow modules (BackPressureBarriers), and it is
+spliced, so those are created directly in the classifier's parent, as first[k] and second[k].
+
+The test checks that the statistics of the spliced submodules are recorded under their final
+module path, and not under the temporary name the branch is built with. Empty output vectors
+are turned off, so a vector appears in the result file only if data was recorded into it.
+
+%file: test.ned
+
+import inet.queueing.classifier.DynamicClassifier;
+import inet.queueing.common.BackPressureBarrier;
+import inet.queueing.common.PacketMultiplexer;
+import inet.queueing.sink.PassivePacketSink;
+import inet.queueing.source.ActivePacketSource;
+
+module TestBranch
+{
+    gates:
+        input in;
+        output out;
+    submodules:
+        first: BackPressureBarrier {
+            @display("p=100,100");
+        }
+        second: BackPressureBarrier {
+            @display("p=200,100");
+        }
+    connections:
+        in --> first.in;
+        first.out --> second.in;
+        second.out --> out;
+}
+
+module TestDemultiplexer
+{
+    gates:
+        input in;
+        output out;
+    submodules:
+        classifier: DynamicClassifier {
+            moduleType = "TestBranch";
+            spliceBranchSubmodules = true;
+            @display("p=100,100");
+        }
+        first[0]: BackPressureBarrier { // grown on demand, one per class
+            @display("p=200,100,column,80");
+        }
+        second[0]: BackPressureBarrier { // grown on demand, one per class
+            @display("p=300,100,column,80");
+        }
+        multiplexer: PacketMultiplexer {
+            @display("p=400,100");
+        }
+    connections allowunconnected:
+        in --> classifier.in;
+        multiplexer.out --> out;
+}
+
+network TestDynamicClassifier
+{
+    submodules:
+        producer: ActivePacketSource {
+            @display("p=100,100");
+        }
+        // a classifier without any branch reports that it cannot accept a packet, which would
+        // stop the producer before the first branch is ever created
+        barrier: BackPressureBarrier {
+            @display("p=200,100");
+        }
+        demultiplexer: TestDemultiplexer {
+            @display("p=300,100");
+        }
+        consumer: PassivePacketSink {
+            @display("p=400,100");
+        }
+    connections:
+        producer.out --> barrier.in;
+        barrier.out --> demultiplexer.in;
+        demultiplexer.out --> consumer.in;
+}
+
+%file: Test.cc
+#include "inet/queueing/function/PacketClassifierFunction.h"
+#include "inet/common/packet/Packet.h"
+
+using namespace inet;
+
+static int testClassify(Packet *packet)
+{
+    return packet->getId() % 2;
+}
+
+Register_Packet_Classifier_Function(TestClassifier, testClassify);
+
+%inifile: omnetpp.ini
+
+[General]
+network = TestDynamicClassifier
+sim-time-limit = 10s
+cmdenv-event-banners = false
+**.vector-record-empty = false
+*.producer.packetLength = 1B
+*.producer.productionInterval = 1s
+*.demultiplexer.classifier.classifierClass = "TestClassifier"
+
+%#--------------------------------------------------------------------------------------------------------------
+%# the modules that have data in an output vector, and the spliced ones among them
+%postrun-command: grep "^vector " results/*.vec | cut -d ' ' -f 3 | sort -u > modules.out
+%postrun-command: grep -E "\.(first|second)\[" modules.out > splicedmodules.out || true
+%#--------------------------------------------------------------------------------------------------------------
+%contains: splicedmodules.out
+TestDynamicClassifier.demultiplexer.first[0]
+TestDynamicClassifier.demultiplexer.first[1]
+TestDynamicClassifier.demultiplexer.second[0]
+TestDynamicClassifier.demultiplexer.second[1]
+%#--------------------------------------------------------------------------------------------------------------
+%not-contains: modules.out
+splicetmp
+%#--------------------------------------------------------------------------------------------------------------

From 2ad83451989626f2bb3900b29e783dc500de93e4 Mon Sep 17 00:00:00 2001
From: Gyorgy Szaszko <adam.szaszko@gmail.com>
Date: Wed, 12 Aug 2026 11:55:01 +0200
Subject: [PATCH 8/8] queueing: let DynamicClassifier accept a packet before it
 has any branch

canPushSomePacket() is inherited as "one of the existing branches can take a
packet", which is false for a classifier that has not built any branch yet. An
active source in front of such a classifier stops, waits for the notification
that would tell it packets can be pushed again, and never gets it, because
nothing else creates the first branch. Answer true instead: a packet of a class
that has not been seen yet is taken by the branch created for it, and the range
of the classifier function is not known here, so there may always be such a
class.

canPushPacket() is worse than useless in its inherited form here: it classifies
the packet, and for this classifier classifying creates the branch of a new
class, so a query that is supposed to be a query builds submodules, grows gate
vectors, wires connections and initializes the new modules. Look the class up
instead, and only delegate to the branch that already exists. (The pull side
classifies in canPullPacket() too, and is left alone: there the query is what
drives branch creation, and this classifier has no pull user.)

Classification for the map is taken directly from the classifier function
rather than through PacketClassifier::classifyPacket(), whose reverseOrder
mapping is relative to the current number of output gates -- which grows with
each branch, so the same class would be looked up under a different key later
and get a second branch.

The module test no longer needs the BackPressureBarrier that hid the missing
back pressure answer, so it now covers this as well: without the fix the
producer never produces and no branch is built.
---
 .../queueing/classifier/DynamicClassifier.cc  | 31 ++++++++++++++++++-
 .../queueing/classifier/DynamicClassifier.h   |  5 +++
 tests/queueing/DynamicClassifier_1.test       | 16 +++++-----
 3 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/src/inet/queueing/classifier/DynamicClassifier.cc b/src/inet/queueing/classifier/DynamicClassifier.cc
index 651477f9807..19575c79f62 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.cc
+++ b/src/inet/queueing/classifier/DynamicClassifier.cc
@@ -32,9 +32,19 @@ void DynamicClassifier::initialize(int stage)
     }
 }
 
+int DynamicClassifier::getClassIndex(Packet *packet) const
+{
+    // the class of the packet, with no side effect -- unlike classifyPacket() below, which
+    // creates the branch of a class that is seen for the first time. Note that the class index
+    // is taken as it is, and not mapped through getOutputGateIndex(): that mapping depends on
+    // the number of output gates, which grows with each branch, so the same class would end up
+    // under a different key over time, and get a second branch.
+    return packetClassifierFunction->classifyPacket(packet);
+}
+
 int DynamicClassifier::classifyPacket(Packet *packet)
 {
-    int index = PacketClassifier::classifyPacket(packet);
+    int index = getClassIndex(packet);
     auto it = classIndexToGateItMap.find(index);
     if (it != classIndexToGateItMap.end())
         return it->second;
@@ -43,6 +53,25 @@ int DynamicClassifier::classifyPacket(Packet *packet)
     return branchIndex;
 }
 
+bool DynamicClassifier::canPushSomePacket(const cGate *gate) const
+{
+    // Not the inherited "one of the existing branches can take a packet": a packet of a class
+    // that has not been seen yet is taken by the branch created for it, and there may always be
+    // such a class, the range of the classifier function not being known here. Without this, a
+    // classifier that has no branch yet answers that it cannot accept anything, and an active
+    // source in front of it stops before the first branch is ever created. Whether a particular
+    // packet can be pushed is answered by canPushPacket() below.
+    return true;
+}
+
+bool DynamicClassifier::canPushPacket(Packet *packet, const cGate *gate) const
+{
+    // deliberately not the inherited implementation: that one classifies the packet, which
+    // creates the branch of a new class as a side effect of what is supposed to be a query
+    auto it = classIndexToGateItMap.find(getClassIndex(packet));
+    return it == classIndexToGateItMap.end() || consumers[it->second].canPushPacket(packet);
+}
+
 int DynamicClassifier::createBranch()
 {
     cModule *parent = getParentModule();
diff --git a/src/inet/queueing/classifier/DynamicClassifier.h b/src/inet/queueing/classifier/DynamicClassifier.h
index b90f9578a2d..223fcd2314d 100644
--- a/src/inet/queueing/classifier/DynamicClassifier.h
+++ b/src/inet/queueing/classifier/DynamicClassifier.h
@@ -47,6 +47,7 @@ class INET_API DynamicClassifier : public PacketClassifier
 
   protected:
     virtual void initialize(int stage) override;
+    virtual int getClassIndex(Packet *packet) const;
     virtual int classifyPacket(Packet *packet) override;
 
     virtual int createBranch();
@@ -55,6 +56,10 @@ class INET_API DynamicClassifier : public PacketClassifier
     virtual void forwardMatchingParams(cModule *module);
     virtual cGate *createModuleBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
     virtual cGate *spliceBranch(int index, cGate *classifierOutputGate, std::vector<cModule *>& modulesToInitialize);
+
+  public:
+    virtual bool canPushSomePacket(const cGate *gate) const override;
+    virtual bool canPushPacket(Packet *packet, const cGate *gate) const override;
 };
 
 } // namespace queueing
diff --git a/tests/queueing/DynamicClassifier_1.test b/tests/queueing/DynamicClassifier_1.test
index 0c2e3242cca..db0b602e992 100644
--- a/tests/queueing/DynamicClassifier_1.test
+++ b/tests/queueing/DynamicClassifier_1.test
@@ -6,6 +6,10 @@ creates the branch of a class when the first packet of that class arrives. The b
 (TestBranch) is a linear chain of two packet flow modules (BackPressureBarriers), and it is
 spliced, so those are created directly in the classifier's parent, as first[k] and second[k].
 
+The producer is connected to the classifier directly, so the test also covers that a classifier
+which has no branch yet accepts a packet, rather than stopping the producer before the first
+branch is created.
+
 The test checks that the statistics of the spliced submodules are recorded under their final
 module path, and not under the temporary name the branch is built with. Empty output vectors
 are turned off, so a vector appears in the result file only if data was recorded into it.
@@ -67,20 +71,14 @@ network TestDynamicClassifier
         producer: ActivePacketSource {
             @display("p=100,100");
         }
-        // a classifier without any branch reports that it cannot accept a packet, which would
-        // stop the producer before the first branch is ever created
-        barrier: BackPressureBarrier {
-            @display("p=200,100");
-        }
         demultiplexer: TestDemultiplexer {
-            @display("p=300,100");
+            @display("p=200,100");
         }
         consumer: PassivePacketSink {
-            @display("p=400,100");
+            @display("p=300,100");
         }
     connections:
-        producer.out --> barrier.in;
-        barrier.out --> demultiplexer.in;
+        producer.out --> demultiplexer.in;
         demultiplexer.out --> consumer.in;
 }