Validate obfuscation regular port advertisement

docs/CHANGELOG.md

@@ -22,6 +22,9 @@ For dev or build tags, use the same logical version string embedded in the tag.
 
 ## [Unreleased]
 
+- Soulseek obfuscation configuration now rejects disabling regular-port
+  advertisement before runtime construction instead of terminating during
+  application startup.
 - The web footer and README now offer direct PayPal and Ko-fi links for
   supporting slskdN development.
 - GitLab CI configuration now keeps the Arch package-smoke sudoers command as

src/slskd/Core/Options.cs

@@ -2707,6 +2707,13 @@ public IEnumerable<ValidationResult> Validate(ValidationContext validationContex
                             [nameof(ListenPort)]));
                     }
 
+                    if (Enabled && !AdvertiseRegularPort)
+                    {
+                        results.Add(new ValidationResult(
+                            "Soulseek obfuscation requires the regular peer port to remain advertised for legacy compatibility.",
+                            [nameof(AdvertiseRegularPort)]));
+                    }
+
                     if (Enabled && mode == SoulseekObfuscationMode.Only)
                     {
                         results.Add(new ValidationResult(

tests/slskd.Tests.Unit/SoulseekOptionsValidationTests.cs

@@ -126,6 +126,31 @@ public void Options_RejectsObfuscationOnlyModeWithRegularFallback()
         AssertRejectsUnsupportedOnlyMode(results);
     }
 
+    [Fact]
+    public void Options_RejectsEnabledObfuscationWithoutRegularPortAdvertisement()
+    {
+        var options = new Options
+        {
+            Soulseek = new Options.SoulseekOptions
+            {
+                Obfuscation = new Options.SoulseekOptions.ObfuscationOptions
+                {
+                    Enabled = true,
+                    Mode = SoulseekObfuscationMode.Compatibility.ToString(),
+                    AdvertiseRegularPort = false,
+                },
+            },
+        };
+
+        var results = options.Validate(new ValidationContext(options)).ToList();
+
+        Assert.Contains(
+            results,
+            result => result.ErrorMessage!.Contains(
+                "regular peer port to remain advertised",
+                System.StringComparison.Ordinal));
+    }
+
     [Fact]
     public void SoulseekObfuscationPlan_ReportsConfiguredActiveRuntime()
     {