protocol_matrix.csv

standard_part,module,type,encode,decode,state_machine,tests,golden_vectors,external_oracle,status,notes
ISO11783-2,src/net/can_bus_config.rs,CAN physical assumptions,yes,yes,no,unit+fixtures+standard-suite,yes,none,implemented-needs-external-oracle,"Bitrate/sample-point policy is fixture-backed for 250 kbit/s, nominal 80% sample point, 77%/83% acceptance bounds, non-finite sample-point rejection, local-only silent/loopback rejection, and stable rejection messages; needs hardware/vcan proof."
ISO11783-2,book/HARDWARE.md,SocketCAN/vcan trace tooling,yes,yes,no,example+replay+manifest+standard-suite,yes,none,implemented-needs-external-oracle,"vcan setup, SocketCAN address-claim/DM1 emitter, stack-based SocketCAN monitor, candump capture guidance, compact/bracketed/malformed standard-vs-extended candump parsing with DLC mismatch, overlong payload, bad hex, CAN-FD-looking token, and flag-looking ID rejection, make trace-replay-demo for compact seed, bracketed seed, malformed-line, plus standard-ID rejection candump fixtures, executable trace provenance manifest, executable hardware-evidence contract, concrete per-flow capture playbook, and adapter evidence matrix exist; standard-suite checks keep vcan from being treated as physical timing proof and require physical adapter rows to name 250000 bit/s setup, termination, reports, and known capture IDs; future completed rows must link to a named reduced-hardware trace and schema-complete capture report with commit/interface/bitrate fields; still needs real vcan/physical-bus captures wired into tests with reports."
ISO11783-3_J1939-21,src/net/identifier.rs,CAN extended identifier and PGN normalization,yes,yes,no,unit+property+fixture,yes,AgIsoStack,complete-by-tests,"identifier_round_trip_pdu1, pdu1_pdu2_boundary_table_normalizes_identifier_fields, and datalink_identifier_try_encode_rejects_out_of_range_pgn_before_wire_use cover PDU1 destination preservation, PDU1 PGN normalization, PDU2 group-extension preservation, PF 0xEF/0xF0 boundary behavior across all DP/EDP combinations, raw 29-bit bytes, arbitrary raw identifier masking/accessor properties, out-of-range PGN encode-input properties, PGN helper normalization/classification properties, high-level IsoNet send and Fast Packet registration invalid-PGN rejection before identifier normalization, encode/decode property round trips, and reduced candump standard-ID rejection fixture are covered; add live hardware/vcan rejection captures."
ISO11783-3_J1939-21,src/net/frame.rs,CAN frame wrapper,yes,yes,no,unit+fixtures+AgIsoStack,yes,AgIsoStack,complete-by-tests,"can_frame_wrapper_matches_agisostack_can_message_identity_subset, from_message_pads_with_ff, and standard_frame_is_rejected cover identifier/data-length/padding behavior plus reviewable raw-ID/data/length fixtures for PDU1 destination-specific and PDU2 broadcast frame construction; selected AgIsoStack CANMessage identity fields pin priority PGN source destination payload length timestamp and extended raw identifier behavior; fallible frame constructors reject over-8-byte lengths/payloads and invalid high-bit PGNs, while driver-frame conversion rejects standard/RTR/error frames and hostile DLC values instead of clamping them."
ISO11783-3_J1939-21,"src/net/message.rs;src/net/data_span.rs",decoded message accessors and defensive byte view,partial,yes,no,unit+property+AgIsoStack,yes,AgIsoStack,complete-by-tests,"Partial because Message/DataSpan is a decoded byte-view/accessor surface, not an owning serializer for a standalone wire PGN; message_data_accessors_match_agisostack_data_correctness_subset, read_helpers_match_data_span, and typed_reads_huge_offsets_return_all_ones_without_overflow cover byte reads, little-endian typed reads, checked-offset overflow resistance, out-of-bounds sentinel values, bit extraction, and subspan clamping; selected CANMessage DataCorrectness values from AgIsoStack now pin timestamp, little-endian u16/u32/u64, custom bitfield, and out-of-range custom-bit behavior; add external analyzer traces that exercise these accessor paths through real decoded CAN messages."
ISO11783-3_J1939-21,src/net/tp.rs,TP BAM/CMDT,yes,yes,yes,unit+fixtures+property+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"BAM/RTS/CTS/DT/EoMA fixtures plus selected AgIsoStack BroadcastMessageSending and DestinationSpecificMessageSending payload bytes, configurable RTS packet-window advertisement, receive allocation/session-cap bounds, DT endpoint-path exclusivity for concurrent PGNs, IsoNet same-path transmit queueing, protocol abort-code mapping, malformed RTS, deterministic malformed CM/DT corpus, bounded arbitrary CM/DT payload property tests, out-of-order DT, duplicate DT, wrong-peer DT isolation, two-peer interleaving, CTS zero-hold/resume, duplicate CTS retransmission of the same golden DT window with max-retransmit cap and MaxRetransmitsExceeded abort coverage, CTS_WHILE_SENDING connection-mode-error abort coverage, auxiliary timer CTS keepalive and timeout abort bytes, exact 50 ms BAM DT cadence and cleanup, BAM missing-packet drop, standard-suite sender/receiver timeout boundary checks with timeout abort and no partial session leak, receive-cap no-resource abort, 9/10/1784/1785/1786 byte threshold tests, invalid target-PGN rejection on TX and inbound TP.CM, NULL/broadcast source rejection, NULL destination rejection, destination-specific TP.CM broadcast rejection, and receiver abort direction added; add broader external transport traces and hardware retry captures."
ISO11783-3_J1939-21,src/net/etp.rs,ETP,yes,yes,yes,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"RTS/CTS/DPO/first-DT seed fixtures plus full 2000-byte EoMA stream, explicit 4096-byte receive-profile stream with first/last golden DPO+DT edges and EoMA cleanup, CTS hold/resume with near-timeout sender liveness, receiver Abort cancellation of sender, deterministic malformed CM/DT corpus, bounded arbitrary CM/DT payload property tests under caps, two-peer multi-window interleaving, receiver timeout/resource abort bytes, standard-suite timeout boundary check with timeout abort and no partial session leak, wrong-peer DPO isolation, CTS window variation, receive allocation/session-cap bounds, DT endpoint-path exclusivity for concurrent PGNs, allocation-free protocol-maximum receive-admission profile, bad DPO offset, TP-sized RTS, 1786-byte minimum, protocol-max+1 overflow rejection, invalid target-PGN rejection on TX and inbound ETP.CM, NULL/broadcast endpoint rejection, and receiver abort direction added; add external ETP traces."
ISO11783-3_J1939-21,src/j1939/pgn_request.rs,PGN request codec,yes,yes,no,unit+fixtures+property+standard-suite,yes,none,complete-by-tests,"fixture_j1939_request_and_ack_codecs_are_stable, datalink_request_rejects_prefix_compatible_garbage, and request_round_trips cover the canonical 3-byte request-address-claim payload and common 8-byte 0xFF-padded compatibility payload; standard-suite utility control PGN tests pin exact canonical request bytes and rejection of short overlong non-FF-tail and invalid high-PGN forms; decoder rejects short, malformed trailing, bad-padding, overlong prefix-compatible payloads, and invalid high PGN bits; encoder rejects invalid high PGN bits before the 3-byte wire field can truncate them; arbitrary-byte utility property coverage checks accepted PGNs canonicalize through the 3-byte encoder."
ISO11783-3_J1939-21,src/j1939/acknowledgment.rs,Acknowledgment codec,yes,yes,no,unit+fixtures+property+standard-suite,yes,none,complete-by-tests,"fixture_j1939_request_and_ack_codecs_are_stable, datalink_acknowledgement_rejects_invalid_acknowledged_pgn, and ack_round_trips cover fixture-backed positive ACK payload plus standard-suite coverage of all public control-byte values; short, overlong, reserved-control, reserved-padding, invalid high acknowledged-PGN bit rejection, and fallible encoder validation for invalid acknowledged PGNs are covered; arbitrary-byte utility property coverage checks accepted ACKs re-encode and decode canonically."
J1939,src/j1939/time_date.rs,Time/Date PGN 65254,yes,yes,no,unit+fixtures+property,yes,AgIsoStack,complete-by-tests,"time_date_decodes_agisostack_reference_payload, fixture_j1939_time_date_decodes_and_reencodes, and round_trip_full_fields cover the AgIsoStack Time/Date payload, default all-not-available bytes, first-day/upper-non-NA/clamped-high boundary vectors, exact re-encode, and strict short/overlong rejection; encoder clamps out-of-range Some values away from 0xFF sentinel collisions/wrap and UTC-hour upper-bound decode avoids debug overflow; arbitrary-byte utility property coverage checks canonical re-decodes."
ISO11783-3_J1939-21,"src/isobus/group_function.rs",Group Function codec/responder,yes,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"Command, request, and acknowledge payloads are fixture-backed; decoder rejects short/overlong fixed-size payloads, reserved/unknown type bytes, hidden non-FF bytes after parameter padding starts, and invalid target-PGN high bits; encoder rejects invalid target PGNs and over-four-byte parameter lists; arbitrary-byte property coverage exercises AUX and Group Function decode paths; a local responder policy returns no-error, unsupported-function, and unsupported-PGN acknowledgments, ignores reply-like/malformed/wrong-destination traffic, and avoids acknowledge loops; add external/reference responder captures."
ISO11783-3_J1939-21,"src/j1939/request2.rs",Request2/Transfer codec and responder,yes,yes,yes,unit+fixtures+property+workflow+standard-suite,yes,none,implemented-needs-external-oracle,"Request2 direct and extended-transfer 8-byte payloads plus Transfer wrapping are fixture-backed and standard-suite checked; a local Request2 responder registry returns direct replies or Transfer-wrapped replies and ignores wrong PGNs, malformed requests, unknown requested PGNs, NULL/broadcast source addresses, and invalid registered response PGNs; Request2 rejects short and overlong fixed-size payloads, reserved transfer-control bits, non-contiguous extended-ID padding, non-0xFF tail bytes, and invalid high requested-PGN bits on decode and encode; Request2 encode rejects overlong extended IDs; Transfer rejects invalid high original-PGN bits on decode and encode; arbitrary-byte utility property coverage checks accepted Request2 and Transfer messages re-encode and decode canonically; add external responder-workflow traces."
J1939,"src/j1939/language.rs",Language command codec/workflow,yes,yes,yes,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"Default English/metric and mixed German/unit payloads are fixture-backed using the AgIsoStack-compatible byte layout for decimal/time, date, unit packs, generic units, and country code; selected AgIsoStack LanguageCommandInterface transmit/decode vectors are covered; decoder rejects short and overlong fixed-size payloads, reserved unit values/bits, and malformed reserved low-nibble bytes; arbitrary-byte utility property coverage checks accepted language payloads re-encode and decode canonically; add language/reload traces."
J1939,"src/j1939/shortcut_button.rs",Shortcut button status codec,yes,yes,yes,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"Shortcut Button/ISB PGN 0xFD02 layout is pinned to selected AgIsoStack RX/TX examples: bytes 0..5 are 0xFF, byte 6 is the transition counter, and byte 7 carries stop/permit state with canonical transmit reserved bits set; decoder accepts AgIsoStack RX examples with zeroed reserved high bits, rejects short and overlong fixed-size payloads, partial reserved high bits, and non-0xFF fixed bytes; arbitrary-byte utility property coverage checks accepted states re-encode and decode canonically; add real shortcut-button interaction traces."
ISO11783-3_J1939-21,src/net/network_manager.rs,single-frame PGN dispatch/routing,yes,yes,yes,unit+fixtures+bindings,yes,none,implemented-needs-external-oracle,"Custom-PGN callback fan-out/isolation, callback registration invalid high-bit PGN rejection, C/Python subscription propagation, and Proprietary A/A2/B single-frame exact raw identifiers, destination/group-extension semantics, and payload classification are tested; add external proprietary traces and route edge cases."
ISO11783-4,src/net/niu.rs,Network interconnect unit,yes,yes,yes,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"Routing/filter behavior, bounded recent-forward loop guard for immediate echoed frames with configurable history depth, bounded storm-history tests, standard-suite line/fork/ring topology echo blocking, source/destination NAME-scoped filter predicates learned from Address Claimed frames, NIU control-message payloads, raw PGN 0xED00 addressing, malformed NIU control-message rejection for short/overlong, unknown function, reserved PGN high-bit, bad-padding, reserved filter-mode, bad port-stat tail payloads, and control payloads carried on non-NIU PGNs, with fallible public decode, NIU control encode rejection for invalid high-bit filter PGNs and saturated 16-bit port-stat counters, strict persistent filter-rule storage decode rejecting short/overlong records, reserved PGN/flag/policy bits, and hidden absent-NAME bytes, persistent FilterRule encode rejection for invalid high-bit PGNs and over-16-bit rates, persistent filter retention on local runtime clear plus explicit network-control delete-all, property-style fuzz smoke for arbitrary NIU control/filter-rule bytes, rate-limited monitor policy, config-aware stable NIU/Router policy snapshots including loop-guard capacity, fixture-backed TP/ETP session-frame raw-ID remapping/blocking, pump-style routed TP/ETP reassembly through the translation boundary, two-segment IsoNet virtual-CAN routed TP/ETP with translated Address Claimed traffic, address-claim NAME/address validation fixtures, translation-table admission guards for duplicate or reserved side-local addresses, bidirectional destination-specific translation, translated-output echo blocking, and Cannot Claim visibility through the Router are covered; add hardware-backed router traces, exported multi-NIU/hardware topology policy dumps, and external bridge oracles."
ISO11783-5_J1939-81,src/net/name.rs,NAME field packing,yes,yes,no,unit+integration+fixtures+property,yes,AgIsoStack,complete-by-tests,"name_field_layout_matches_agisostack_magic_constant, fixture_agisostack_name_magic_raw_matches_builder_layout, and each_field_round_trips cover the AgIsoStack magic raw NAME fixture; decode now requires the exact 8-byte NAME width, rejects prefix-compatible overlong payloads, and has arbitrary byte-slice exact-width property coverage plus masked field-setter property coverage."
ISO11783-5,"src/net/name_manager.rs",NAME Management,yes,yes,yes,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"Canonical 17-byte RequestCurrentResponse and NegativeAcknowledge payloads are fixture-backed; SetPending identity guard, pending/current request replies, AdoptPending ACK/NACK, event emission, targeted RequestAddressClaim Address Claimed response without PGN 0x9300 reply loops, malformed payload event-gating, and response-mode loop prevention are unit-tested so Acknowledge, NegativeAcknowledge, RequestCurrentResponse, and RequestPendingResponse do not trigger replies or pending-NAME mutation; AdoptPending replies before applying the pending NAME and restarting address claiming; decoder rejects short, overlong, unknown-mode, bad-padding, invalid-NACK-reason, and bad-NACK-padding payloads; property-style fuzz smoke feeds arbitrary NAME Management payloads through the codec; add real peer traces."
ISO11783-5_J1939-81,"src/net/address_claimer.rs;src/net/name_manager.rs;src/net/partner_cf.rs",address claim,yes,yes,yes,unit+integration+fixtures+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"Same-address arbitration, cannot-claim, claimed-node loss/reclaim, global/specific request-for-address-claim response, standard-suite claim-state responses for pre-claim wait claimed and failed states, standard-suite NAME-ordered contest tests with unrelated-claim no-mutation behavior, reclaim random-delay clamping before delayed self-configurable reclaims, delayed reclaim re-evaluation when the queued address becomes occupied during RTxD, delayed Cannot Claim when no reclaim address remains available, malformed request-for-address-claim PGN Request rejection before IsoNet response routing, address-violation reporting, restart-after-claimed behavior, pre-start silence, invalid local preferred-address Cannot Claim, equal-NAME echo handling, duplicate local-NAME rejection, distinguishable duplicate-NAME Cannot Claim behavior, pre-claim send gating, exact request/claim/cannot-claim frame fixtures, exact 9-byte Commanded Address acceptance/rejection, TP.BAM Commanded Address integration that retargets a claimed internal NAME and rebroadcasts Address Claimed from the new source matching AgIsoStack CoreTest::CommandedAddress, unanswered request-for-address-claim invalidation for online partner CFs matching AgIsoStack InvalidatingControlFunctions, observed occupied-address tracking for self-configurable reclaims, Cannot Claim ingress clears matching partner state without learning NULL as online and broadcast-source claims do not resurrect partners, selected AgIsoStack CannotClaim saturated-address behavior emitting source 0xFE, and selected AgIsoStack PartneredClaim FunctionCode-filtered partner discovery for CabClimateControl and SeatControl have tests; add hardware/reference trace fixtures."
ISO11783-6,"src/isobus/auxiliary.rs",AUX-O/AUX-N function codecs,yes,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"AUX-O and AUX-N function payloads are fixture-backed; decoders reject short, overlong, reserved function type/state, and non-FF tail payloads; arbitrary-byte property/fuzz smoke coverage exercises AUX decode paths; add VT auxiliary-assignment traces."
ISO11783-6,src/isobus/vt/client.rs,Virtual Terminal client,yes,yes,yes,unit+fixtures+smoke+AgIsoStack+session-suite,yes,AgIsoStack,implemented-needs-external-oracle,"Connect flow, fixture-backed status/GetMemory/upload/delayed-EndOfObjectPool pump handshake with Rust VT server, session two-node integration (`tests/standard/session_harness.rs`) where a VtClient connects to a VtServer and advances past Disconnected, command-code/layout matrix, selected AgIsoStack VT MessageConstruction ChangeActiveMask HideShow EnableDisable and GraphicsContext DrawText command payloads plus priority-5 PDU1 identifier, EndOfObjectPool error bitmask handling, UnsupportedVTFunction cache handling, version/audio/value command bytes, outbound string declared-length overflow rejection, GraphicsContext DrawText empty/over-u8 length rejection, classic/extended version-list count/length/padding rejection, strict extended Store/Load response length rejection, exact fixed-size inbound response/language handling, canonical activation-layout parsing plus bad activation code/tail rejection, inbound numeric-value reserved-byte rejection, bad string-tail rejection, truncated string-change rejection, invalid UTF-8 string-value rejection, unknown object-type rejection, malformed known child-list tail rejection, serialized object-pool body/child-count/body-plus-child-tail overflow rejection before upload, client-side connect/swap/update rejection of unserializable pools before zero-size GetMemory emission, checked signed/wide object-ID construction, malformed upload rejection before server-side client-state creation, type-aware object-pool fixtures, and VT v6 TouchGesture/GraphicsContext/ScaledBitmap helper exact-byte plus reserved/range rejection tested; add independent tool pools, external TP-backed upload traces, language/reload traces, and broader external VT traces."
ISO11783-6,src/isobus/vt/server.rs,Virtual Terminal server,yes,yes,yes,unit+fixtures+smoke+standard-suite,yes,AgIsoStack++ public VT command enum,implemented-needs-external-oracle,"Server status advertises VT version, GetMemory response uses client-compatible success-code layout, fixture-backed Rust client upload flow activates the working set, malformed empty/truncated/unknown-type object-pool uploads are rejected before client-state creation, memory negotiation gates object-pool transfer, upload windows are per client, stale active pools are not reused after failed reupload, EndOfObjectPool validates the uploaded pool graph before activation and emits error bytes on invalid pools, notification builders reject string declared-length overflow, Get Versions response construction caps overfilled stored-version caches to the one-byte count field instead of wrapping, UnsupportedVTFunction responses/loop avoidance, exact fixed-size ECU command rejection, Get Window Mask Data user-layout background colours, Get Supported WideChars minimum-set range responses, standard Get Supported Objects sorted-object-list response with AUX type-2 capability subquery preservation, Get Attribute Value responses for current body/retained state plus invalid-object/invalid-attribute error bits and Working Set Special Controls AID 1 byte-count reporting, standard Output Line/Rectangle/Ellipse shape AID ordering, Input Number/List enabled-bit overlays that preserve real-time-editing option bits, Container-only HideShow with Hidden AID 3 synchronization across HideShow and Change Attribute, and malformed no-response behavior, bad numeric reserved-byte rejection, numeric-target type and ObjectPointer key-slot context gating, canonical zero-padding for one- and two-byte numeric values, bad-tail/truncated/invalid-UTF-8 ECU string-change rejection, type-aware object-pool upload parsing, typed bodies now cover all 48 declared VT ObjectType variants, serialized object-pool body/child-count/body-plus-child-tail overflow rejection, exactly-one Working Set validation, NULL object ID rejection before it can become a real pool object, Working Set child type validation for DataMask/AlarmMask-only children, SoftKeyMask direct Key/ObjectPointer/ExternalObjectPointer child validation including NULL slot pointers plus ExternalObjectPointer default-object slot retarget validation, KeyGroup key-child validation, Change Priority AlarmMask target and priority-range gating, Change Attribute AID admission including unsupported/read-only AID, wrong-type reference-valued AID, one- and two-byte scalar/reference field width checks, finite numeric scale checks, Button Options latchable-bit preservation, and out-of-range scalar option/format/justification/boolean/shape-angle/state-relative min-max value rejection, GraphicsContext payload/reference target validation plus F.57 response/error emission for known object-reference subcommands including drawable Draw VT Object targets and non-NULL Picture Graphic copy targets, Change List Item target and item-index bounds checks, Change Polygon Point target and point-index bounds checks, Change Child Location/Position parent-child relationship checks, Select Input Object option, target, response, active-mask visibility, and hidden-container checks, zero-screen rejection, VT-version 3..=6 validation before status advertisement, and a server-side semantic state cache for accepted ECU-to-VT change commands are tested. The server now records SelectActiveWorkingSet, Esc, HideShow, standard-target-gated EnableDisable, option-checked SelectInputObject plus response, audio signal/volume, parent-checked child location/position, size, background colour, endpoint, fixed Font/Line/Fill Attributes object-value commands, active mask, soft-key mask, AID-checked raw attributes, priority, bounds-checked list item, delete pool, string/numeric values, object label, bounds-checked polygon point, polygon scale, reference-checked GraphicsContext with standard FF-padded short-command admission, colour map, mask lock, and macro execution while ignoring malformed bool/tail/length/index/AID/reference/scalar-value/wrong-target/invalid-option/non-parent forms without cache mutation; add independent trace fixtures. Remaining H11 VT gap: the working-set state cache is not a renderer/layout engine."
ISO11783-6,src/isobus/vt/render,Virtual Terminal render runtime,partial,partial,yes,unit+fixtures+standard-suite+book-ledger,yes,none,implemented-needs-external-oracle,"Hosted std-gated render/runtime coverage now includes ObjectPool-to-Scene layout, active-mask selection, standard Container-only HideShow replay through Container Hidden body state and parent-to-child scene visibility propagation, runtime state overlays, accepted server-effect replay, command-list rendering, input transaction semantics, VT-to-ECU bus-message lowering/parsing plus full PGN/addressed message wrapping with invalid endpoint rejection before stateful operator-event mutation or held-repeat timing consumption, checked payload admission for activation, numeric/string value, select-input, ESC, user-layout, and pointing notifications including VT6 TAN constructors for activation/numeric messages, NULL object-id rejection before bus payload/full-message emission, VT ESC error-code/TAN payloads plus server-side ESC Input to VT ESC responses, runtime/pool Macro Change String Value strict UTF-8 admission, runtime user-layout placement and host-persistable recall snapshots for Window Mask and Key Group nodes plus VT On User-Layout Hide/Show payload/full-message emission for visible placed nodes, VT Pointing Event payload/full-message emission for non-interactive Data Mask and free-form Window Mask touch areas, H.3/H.5/H.7/H.9/H.11/H.13/H.14/H.15/H.16/H.17/H.19/F.57 ECU response/error helpers for Soft Key Activation, Button Activation, Pointing Event, Select Input Object, VT ESC, Numeric Value Change, Change Active Mask, Change Soft Key Mask, String Value Change, and Graphics Context payload/full-message validation, Lock/Unlock Mask deferred active-mask refresh with host-driven timeout expiry, soft-key/page/window/key-group behavior including Soft Key Mask pointer children, NULL reserved slots, trailing NULL trimming, KeyGroup/SoftKeyMask ObjectPointer retarget validation, SoftKeyMask ExternalObjectPointer default-object retarget validation, over-reserved navigation-cell clamping, and Key-vs-mask background precedence, standard-aware retained attribute/value replay plus direct runtime numeric-value width gating including Alarm Mask Change Priority metadata, bounds-checked Change List Item and Change Polygon Point replay, Output Line Change End Point geometry/direction, open Output Ellipse arc/segment/section command emission and framebuffer rasterisation, output-shape line-width-zero no-stroke semantics through command emission and framebuffer replay, framebuffer shape/vector stroke-width and full two-byte LineAttributes line-art Change Attribute retention/rasterisation including even two-pixel strokes and paintbrush spot patterns, value-aware meter border/tick/needle and linear/arched bar graph rasterisation with standard target-value fields plus target/tick/border/value-line option bits, Input String options, and read-only Output List value handling, Output List selected drawable item materialisation clipped to the list rectangle plus no-display rules for NULL/hidden selected items, canonical graphics context replay primitives plus the full type-36 body, F.57 response parser/builder, pool-validated font/line/fill references, and AID 1..=17 generic attribute model with transparent-canvas transparency-colour preservation as the Copy Canvas/Viewport do-not-copy index, line-attribute stroke widths and line-art patterns preserved in backend commands and copied Picture Graphic pixels, plus malformed known-payload rejection, standard ColourPalette reserved-options/u16-count/B-G-R-A ARGB body validation with reserved Options AID zero-only Change Attribute handling, supported standard GraphicData PNG decode to RGBA image commands with malformed-vs-unsupported PNG diagnostics plus image/animation placeholders, object-identified indexed-image paths, host-loop animation tick scheduler hints, a repo-owned object render ledger, promoted VT3 and reduced seeder object-pool fixtures plus a reduced VT3 command trace that render through the hosted framebuffer with checked-in RGB888/RGB565 artifacts, and a deterministic runtime-aware software framebuffer consumer with Graphics Context Picture Graphic pixel updates including opaque canvas background copies plus RGB888/RGB565 byte export. This row is partial because the renderer is not a no_std embedded display stack, not an AEF-certified VT, and not calibrated pixel/font/bitmap output; broader target-display/commercial-VT comparisons remain future evidence. Real UI/GPU/window backends are deferred out of PLAN_VT scope."
ISO11783-6,src/isobus/vt/server_working_set.rs,VT server working-set storage,no,yes,yes,unit+fixtures,yes,none,implemented-needs-external-oracle,"Pool version store/load/delete is unit-tested with disk round trips; classic labels are bounded and path-safe, storage filenames are hex-encoded instead of raw labels, local VTP1 header/pool bytes are fixture-backed, mismatched on-disk labels are rejected, oversized headers are rejected before pool allocation, save rejects stale size metadata or oversized payloads before disk write, load rejects trailing bytes after the declared pool body, and cached/disk-loaded version lists are bounded to the one-byte Get Versions count while allowing replacement of existing labels; add external VT version-store/load/delete traces."
ISO11783-6,src/isobus/vt/update_helper.rs,VT client update helper,yes,no,partial,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"State-machine partial because the helper serializes local ECU-to-VT update operations and tracks pending cached slots, but it is not a full VT peer/session decoder by itself; UpdateOp dispatch to canonical ECU-to-VT command bytes is fixture-backed for numeric, string, hide/show, enable/disable, and active-mask commands; batch mode now coalesces duplicate slots to last-write-wins, removes pending updates when callers revert to the cached tracker value, checked scaled numeric conversion rejects non-finite/out-of-range raw values instead of saturating, oversized string updates reject before entering a batch or reaching serializer length wrap, and arbitrary operation property coverage bounds pending work by unique update slots; add external application-level VT update traces."
ISO11783-6,src/isobus/vt/state_tracker.rs,VT client state tracker,no,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"VT status/value/visibility/alarm mirror paths are unit-tested; fixture-backed value-change coverage checks exact fixed-size VT status/control handling, reserved-byte numeric-value rejection, bad string-tail rejection, truncated string-change rejection without mutating cached strings, invalid UTF-8 rejection without mutating cached strings or the accepted source address, hide/show plus enable/disable reserved-boolean rejection without mutating cached visibility/enabled state, malformed/unknown message source-address preservation, and reset of cached VT function code to not-available; arbitrary VT-to-ECU message property coverage is panic-free and bounded; add broader independent VT notification traces."
ISO11783-6,src/isobus/vt/auxiliary_caps.rs,VT v5 auxiliary capability discovery,yes,yes,yes,unit+fixtures,yes,none,implemented-needs-external-oracle,"Get Supported Objects auxiliary request and two-channel response are fixture-backed; wrong sub-function, truncated channel list, and trailing bytes are rejected without clearing the pending request; the VT client/server discovery codec exchanges configured auxiliary channels, emits typed events, and stays silent for malformed or NULL-source requests; add external VT auxiliary-capability traces."
ISO11783-6,src/net/iop_parser.rs,IOP byte walker,no,yes,no,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"Synthetic object parsing, clean-end validation, deterministic version hashing, fixture-backed container/number-variable/output-string/macro bodies, corrected Working Set language-tail and Window Mask required-object walking, standard VT5/VT6 extended object lengths for Graphic Context, External Object Definition/Reference/Pointer, Animation, Graphic Data PNG/u32 payloads, and Colour Palette, arbitrary-byte panic-free property coverage, and strict rejection of empty/short buffers, trailing partial headers, and truncated object bodies are covered; add real exported .iop fixtures from independent VT tooling."
ISO11783-7,"src/j1939/heartbeat.rs",Heartbeat protocol,yes,yes,yes,unit+integration+fixtures+property+AgIsoStack+session-suite,yes,AgIsoStack,implemented-needs-external-oracle,"INIT, first/last normal, sender error, shutdown, one-byte PGN metadata, AgIsoStack-compatible heartbeat request payload fixtures, and raw request/first-heartbeat identifier checks are covered; sender/receiver/tracker tests cover normal counter wrap, wrap jump limits, comm-error timeout edges, eight-frame recovery, tracker reset, raw tracker wrong-PGN NULL-source broadcast-source malformed-width and reserved-sequence rejection, long-tick multi-miss accounting, sender long-tick single emission with phase preservation, zero-interval disabled behavior, bounded tracker long-tick accounting/collapsed huge replay, and arbitrary sender/receiver/tracker state-machine property coverage; session two-node integration (`tests/standard/session_harness.rs`) has both nodes broadcast heartbeats on cadence, each tracking the other and observing sent/received events with a held peer sequence; add broader heartbeat PGN external/reference traces."
ISO11783-7,src/isobus/implement/guidance.rs,guidance machine info codec,yes,yes,no,unit+fixtures+property,yes,captured tractor frames,implemented-needs-external-oracle,"Curvature uses km^-1 units at 0.25 km^-1/bit with finite min/max clamping and not-available handling. The legacy top-level facade (CurvatureCommand, GuidanceSystemStatus) was removed: it sat on PGNs 0xFE44/0xFE45/0xFE46, none of which ISO 11783 defines, and 0xFE46 collided with PGN_AT2."
ISO11783-7,"src/isobus/implement/*",implement control/status codecs and session workflow,yes,yes,yes,unit+fixtures+session-suite+property+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"Rear-hitch raise plus broad first fixtures for PTO command/status, aux valve command/flow, tractor control mode, speed/distance, lighting, guidance, drive strategy, hitch roll/pitch, combined hitch/PTO, tractor facilities, expanded sentinel/default/not-available cases for guidance, drive/guidance commands, combined hitch/PTO, roll/pitch, speed, lighting, hitch/PTO, and aux commands, first min/max/error edges including drive-strategy upper-edge bytes, guidance curvature min/max raw bytes, and guidance machine/system max-error bytes, strict short/overlong fixed-size decoder rejection, tractor-command bad-padding/reserved-command/reserved-mode rejection, lighting/machine-speed bad-padding/reserved-bit rejection, speed/distance/hitch/PTO/aux-flow bad-padding/reserved-bit rejection, speed-distance status 0xFFFF speed and reserved hitch-position rejection, guidance machine/system/curvature bad-padding/reserved-control rejection, implement-guidance finite curvature clamping and 0xFFFF not-available rejection, speed/distance/status encode clamping for non-finite/negative/oversized scaled values, machine-speed command builder clamping without emitting 0xFFFF, guidance-system command curvature clamping, drive/guidance/combined-command bad-padding/reserved-control rejection, decode-time aux-valve index rejection, arbitrary-byte property coverage across implement decode paths, and TractorFacilities overlong rejection with 4-byte legacy subset decoding are covered; selected AgIsoStack SpeedMessages vectors now pin MachineDirection bit semantics, wheel speed byte-7 key/operation/reversed fields, and wheel/ground/selected-speed identifiers; selected AgIsoStack AgriculturalGuidanceInterface vectors now pin Agricultural Guidance Machine Info PGN 0xAC00, Guidance System Command PGN 0xAD00, priority-3 identifiers, curvature scale/offset, byte-2 machine status packing, byte-3 limit bits, byte-4 exit/remote-engage bits, command status reserved-one bits, listen-only decode payloads, and 8031.75 km^-1 guidance curvature upper clamp; aux-valve command builders reject indexes outside 0..=15; session two-node integration (`tests/standard/session_harness.rs`) has one node broadcast hitch/PTO/wheel-speed status and the peer Implement plugin cache and emit the matching ImplementEvents; add external/reference implement ECU traces."
ISO11783-8,src/j1939/engine.rs,engine messages,yes,yes,partial,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"State-machine partial because the powertrain plugin provides routing/cache/events but not an autonomous engine ECU model. Round trips, exact 8-byte short/overlong rejection across fixed-size engine codecs, bad reserved-tail padding rejection for every fixed-size engine codec with unused tail bytes, fixture-backed exact bytes for EEC1, EEC2, EEC3, ET1, ET2, Engine Fluid Level/Pressure, Engine Hours/Revolutions, Fuel Economy, TSC1, VEP1, Ambient Conditions, Dash Display, Vehicle Position, Fuel Consumption, Aftertreatment 1/2, Component Identification, and Vehicle Identification, arbitrary-byte property coverage with canonical re-encode/re-decode checks for successful fixed-size decodes plus a retained 32-bit scaled raw-value regression seed, standard-suite strict printable-ASCII exact-star-field Component/Vehicle Identification rejection and arbitrary-byte decode/re-encode properties for identification payloads, first raw min/upper edge vectors for EEC1/EEC2/EEC3, ET1/ET2, EngineFluidLP, EngineHours/Revolutions, TSC1, VEP1, AmbientConditions, DashDisplay, VehiclePosition, FuelEconomy, FuelConsumption, and Aftertreatment 1/2, EEC1 reserved-tail/starter-nibble and required-field sentinel rejection, EEC2 control reserved-nibble rejection while preserving status upper edges, TSC1 command round-trip plus speed/torque sentinel rejection, EEC3/ET1/ET2/EngineFluidLP/EngineHours/FuelEconomy/TSC1/VEP1/AmbientConditions/DashDisplay/VehiclePosition/FuelConsumption/Aftertreatment scalar not-available sentinel rejection for non-optional fields, encode clamping away from not-available sentinels for out-of-range or non-finite numeric inputs, and powertrain-plugin routing for EEC1 plus TP-sized VIN are tested; add external/public PGN traces."
ISO11783-8,src/j1939/transmission.rs,transmission and vehicle-speed messages,yes,yes,partial,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"State-machine partial because the powertrain plugin provides routing/cache/events but not an autonomous transmission ECU model. Round trips, exact 8-byte short/overlong rejection, ETC1 reserved-control-bit rejection, reserved-tail-padding rejection, standard-suite unrepresentable raw not-available sentinel rejection for ETC1 speed/gears, Transmission Oil Temperature, and Cruise Control wheel/set speed fields, fixture-backed exact bytes for ETC1, Transmission Oil Temperature, and Cruise Control / Vehicle Speed, arbitrary-byte property coverage with canonical re-encode/re-decode checks for successful decodes, first minimum/upper/status edge vectors, encode clamping away from not-available sentinels for out-of-range or non-finite inputs, and powertrain-plugin routing for ETC1 are tested; add external/public PGN traces."
ISO11783-8,src/j1939/speed_distance.rs,wheel/ground/machine speed-distance messages,yes,yes,no,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"Round trip, not-available sentinels, exact 8-byte short/overlong rejection, reserved-tail-padding rejection, fixture-backed exact bytes for the shared speed/distance payload, arbitrary-byte property coverage with canonical re-encode/re-decode checks for successful decodes, first zero/upper non-sentinel edge vectors, Some-value encode clamping away from not-available sentinels for out-of-range or non-finite inputs, and selected AgIsoStack SpeedMessages machine-selected/wheel/ground payloads parsed through the shared measurement-prefix decoder are tested; add physical/external PGN traces."
ISO11783-9,"src/j1939/maintain_power.rs",maintain-power lifecycle,yes,yes,yes,unit+fixtures+property+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"Maintain Power now uses the AgIsoStack-compatible ISO11783-9 payload layout for in-work, park, ready, transport, PWR, and ECU_PWR fields; exact active-request, inactive/no-request, and not-available/dont-care payload fixtures plus selected AgIsoStack 0x5F 0x55 and 0x0F 0x00 examples are covered; strict short/overlong fixed-size rejection, byte-0 low-nibble rejection, reserved 0xFF tail rejection, codec, key-off/key-on, valid-source ingress checks, no-request shutdown after minimum hold, fresh-request maintaining entry, standard-suite shutdown request freshness and CF repeat-cadence boundaries, wrong-PGN no-extension behavior, request expiry, CF periodic request broadcast, and max-extension forced shutdown are tested; arbitrary-byte utility property coverage checks accepted Maintain Power payloads re-encode and decode canonically; add external/reference protocol traces."
ISO11783-9,"src/isobus/implement/tractor_facilities.rs",Tractor facilities codec,yes,yes,yes,unit+fixtures+standard-suite,yes,none,implemented-needs-external-oracle,"TractorFacilities Required and Response PGNs are distinct and share the fixed 8-byte payload codec with reserved-byte rejection; class/front/guidance/powertrain bit matrix round-trip tests cover representative facility groups and canonical unused bytes; add external TECU/implement facility exchange traces."
ISO11783-9,src/isobus/tractor_ecu.rs,Tractor ECU/power management,yes,yes,yes,unit+fixtures,yes,none,implemented-needs-external-oracle,"Classification/addenda strings, default power/config intervals/currents, maintain-power request-expiry boundary, and default power-state semantic snapshots are fixture-backed; maintain-power wire bytes live under the j1939 maintain-power row; add external TECU/status/facility traces."
ISO11783-10,src/isobus/tc/client.rs,Task Controller client,yes,yes,yes,unit+fixtures+session-suite+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"AgIsoStack-compatible server TC Status byte 0xFE, canonical TC Status byte/width rejection before server-source binding, TechnicalCapabilities, RequestValue/Value, SetValueAndAcknowledge, ack error, wrong-PGN direct-handler rejection, NULL/broadcast source rejection, bound-TC source filtering, explicit try_handle_tc_message validation errors for wrong-PGN, invalid-source, bound-source, empty-frame, malformed fixed-size version-request frames, and malformed fixed-size lifecycle response frames, malformed process-data ingress rejection, reserved command-nibble rejection, explicit unsupported process-data command rejection, exact TechCapabilities request padding / response-command collision rejection, structure/localization label request workflow, canonical device descriptor mux bytes, command-prefixed DDOP transfer, activation/deactivation/delete, connected reupload workflow, strict rejection of short or bad-padding Version/StructureLabel/LocalizationLabel/ObjectPool/Activate/Delete responses before handshake transitions, and process-data/handshake collision fixtures exist; selected AgIsoStack MessageEncoding payloads pin Working Set Master, version request, status, version response, structure/localization/delete requests, PDACK, value command, and TC-identification request; session two-node integration (`tests/standard/session_harness.rs`) drives the TcClient↔TcServer handshake so the client advances past Disconnected and the server observes the client version; needs broader external/reference TC traces."
ISO11783-10,src/isobus/tc/server.rs,Task Controller server,yes,yes,yes,unit+fixtures+session-suite+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"Server status uses AgIsoStack-compatible byte 0xFE and now exposes BusyExecutingACommand bit plus current command source/command bytes, TechnicalCapabilities, structure/localization label responses, RequestValue/Value, SetValueAndAcknowledge, callback error ack, wrong-PGN direct-handler rejection, NULL/broadcast source rejection, explicit try_handle_client_message and try_handle_working_set_master validation errors for wrong-PGN, invalid-source, empty-frame, malformed fixed-size request, malformed client-version response, and malformed Working Set Master frames, malformed process-data ingress rejection before callbacks, reserved command-nibble rejection, explicit unsupported process-data command rejection, malformed peer-control rejection before callbacks/ACKs, exact TechCapabilities request padding / response-command collision rejection, canonical object-pool transfer/storage/activation/deactivation/delete, malformed activate/deactivate/delete lifecycle request bytes reject before low-nibble process-data fallback or client-state creation, short transfer rejection before client-state creation, malformed-transfer no-corruption after activation, duplicate accepted-transfer idempotence, fallible process-data and measurement command builders reject element numbers above the 12-bit command field before truncation, strict rejection of short or bad-padding object-pool lifecycle requests before client-state creation, activation-before-upload error, and command-collision fixtures exist; selected AgIsoStack MessageEncoding, B6CommandBusyState, and ClientVersionTracking payloads pin TC server Working Set Master registration, version requests, stored client-version updates/events, version response, structure/localization label response bytes, RequestValue, measurement interval/threshold, SetValueAndAcknowledge, SetValue bytes, busy-state status bytes, and priority-5/priority-3 PDU1 identifiers; the measurement-trigger runtime tracks configured time intervals, accumulated distance, min/max/change thresholds, on-change transitions, total observations, and latest values, then emits destination-specific RequestValue commands through update_measurements, record_measurement_distance, inbound Value handling, and server tick for time-based triggers; standard-suite threshold crossing tests pin change/min/max trigger boundaries and no retrigger while remaining outside a threshold; TcServer construction rejects zero-boom and zero/reserved-section topologies while preserving channel count as an opaque one-byte capability and exposes structure/localization label set/get/clear; session two-node integration (`tests/standard/session_harness.rs`) drives the TcClient↔TcServer handshake so the server observes the client's version during the DDOP handshake; needs official-spec review for stronger topology rules and broader external/reference TC traces."
ISO11783-10,src/isobus/tc/ddop.rs,Task Controller DDOP object pool,yes,yes,partial,unit+fixtures+property+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"State-machine partial because DDOP parsing/serialization/validation is covered locally while full TC upload, activation, and peer acceptance depend on external Task Controller behavior; sprayer-shaped all-object and metered-drill two-section scaled-rate exact-byte fixtures plus invalid unknown element-type, duplicate object-id, null object-id rejection, self-parent and self-child rejection, non-ASCII text, overlong text, non-finite value-presentation scale, process-data trigger reserved-bit rejection before validation or serialization success, checked signed DDI/element/object ID construction, auto-ID allocation that skips used/NULL IDs and rejects exhausted pools, standalone object serializer rejection for unencodable text/count/scale fields, hostile-count/string truncation, arbitrary-byte bounded parse/serialize/validate coverage, and selected AgIsoStack CreateSprayerDDOP object-ID/designator/DDI/presentation/trigger/scale expectations for DVC/DET/DPT/DVP/DPD objects are covered; add real exported implement pools and broader external oracle traces."
ISO11783-10,src/isobus/tc/ddop_helpers.rs,Task Controller DDOP helper extraction,no,yes,no,unit+fixtures+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"Geometry/rate/total extraction and parent lookup are unit-tested against sprayer-shaped DDOPs; fixture-backed two-section sprayer expectations lock connector/boom offsets, section IDs/numbers/widths, rate/total DDI classification, and parent lookup; property-backed rate/default/min/max constants now appear as non-editable RateInfo values; section-count helpers expose checked and usize variants and the legacy u16 count saturates instead of wrapping for invalid oversized pools; selected AgIsoStack DDOPHelper_NoFunctions section geometry and property-backed rate values plus DDOPHelper_SubBooms sub-boom section geometry and bin-hosted rate process data are covered; add external implement expectations."
ISO11783-10,src/isobus/tc/geo.rs,Task Controller GEO prescription helpers,yes,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"Position payload no-fix errors, exact 8-byte GNSS rapid-position decode, wrong-PGN rejection, NULL/broadcast source-address rejection, strict short/overlong GNSS payload rejection, explicit try_handle_gnss_position errors for wrong PGN/source/width/sentinel ingress, not-available sentinel rejection, out-of-range latitude/longitude raw-value rejection without cache overwrite, outgoing latitude/longitude process-data rejection for non-finite or out-of-range positions, arbitrary GNSS payload property coverage with finite bounded cached positions, exact latitude/longitude Value process-data payloads for a 0.5° position, DDI-aware prescription-rate engineering conversion and Process Data Value payload emission for known rate DDIs, rejection of unknown/non-rate/out-of-range rate DDIs, outer-boundary inclusion, degenerate/non-finite polygon rejection, holes, hole-boundary exclusion, overlap first-match behavior, and semantic fixture expectations exist; add TC-GEO task-data imports and external traces."
ISO11783-10,src/isobus/tc/peer_control.rs,Task Controller peer control,yes,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"Exact assignment payloads, including normal and max 12-bit element / 16-bit DDI encoding, checked encode rejection for unencodable source elements, fixture-backed strict decode rejection for short/overlong/wrong-command/invalid-source-or-destination payloads, arbitrary decode property coverage, address-scoped add/remove/activate, duplicate identity, ambiguous source-only lookup rejection, idempotent activation, and clear removal events are tested; add external peer-control traces."
ISO11783-11,src/isobus/tc/ddi_database.rs,DDI database,no,yes,no,unit+fixtures+AgIsoStack+source-manifest,yes,AgIsoStack,implemented-needs-external-oracle,"Generated table size, source version, deterministic FNV-1a fingerprint, first/last entry snapshot, lookup helpers, generated-unit description coverage for every unit symbol used by the table, source-provenance/staleness manifest alignment against the public ISOBUS database version, standard-suite source-policy coverage without copying dictionary tables, public example DDI-reference validation against the generated lookup table, AgIsoStack-compatible get_entry facade for selected DDI lookups plus unknown sentinel behavior, engineering conversions including non-finite/out-of-range clamp behavior, ordering, and category helpers are tested; still needs regeneration from the newer public DDI export under the applicable database terms and broader DDI value/category fixtures."
ISO11783-12,src/j1939/diagnostic.rs,diagnostics/DM codecs,yes,yes,partial,unit+integration+fixtures+AgIsoStack+session-suite+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"State-machine partial because local DM1/DM2/DM3/DM11 request handling and many diagnostic codecs are covered, but full diagnostic tool workflows, memory access, and ECU-specific state transitions need external service-tool traces; session two-node integration (`tests/standard/session_harness.rs`) has one node raise a DTC and the peer Diagnostics plugin observe the broadcast DM1; DM1 codec coverage includes single-frame and multi-packet TP/BAM reassembly; PGN Request responses for DM1/DM2, unsupported diagnostic request NACK/silence behavior including destination-specific VIN PGN requests, service-tool DM11/DM3 clear flows, malformed short DM11 ignore behavior, and strict DTC-list payload alignment are tested; exact diagnostic request/response fixtures now lock DM1/DM2 PGN Request payloads, multi-DTC DM1 response bytes, lamp-only DM2 response bytes, and DM11 clear-active bytes; selected AgIsoStack DiagnosticProtocol expectations now pin DTC bytes for SPNs 1234, 567, and 8910 plus all-off, amber slow-flash, red-stop solid lamp bytes, DM13 suspend announcement and network/current-link stop/start broadcast-control layout, DM22 clear/ack/NACK control reason reserved-byte and SPN/FMI layout, Product Identification field order, and count-free Software Identification strings; DTC max SPN/FMI/occurrence, active single-DTC DM1, lamp-only DM1, previous-DTC DM2, DM6 pending, DM12 emissions-related active, DM23 previous-MIL-off, DM3/DM11 clear-all, fixed-size DM5/DM7/DM8/DM13/DM22/DM25 utility fixtures with short/overlong rejection, Dm5Message alias coverage, DM9 VIN PGN-request bytes, DM10 printable-ASCII star-terminated VIN response bytes, DM5/DM7/DM13/DM25 reserved-tail rejection, DM13 bad suspend-signal rejection, DM22 reserved-padding/non-NACK-reason rejection, DM7/DM8/DM25 reserved SPN/FMI bit rejection, DTC/DM4/DM8/DM20/DM21/ProductIdentification/SoftwareIdentification/FreezeFrame variable diagnostic fixture rejection for prefix/truncated/trailing payloads, DTC reserved occurrence-bit rejection, nested SPN reserved-bit rejection, diagnostic SPN-bearing encoder clamping to the 19-bit maximum for DTC/DM7/DM8/DM20/DM22/DM25/FreezeFrame snapshots, classic DM DTC-list bad-tail rejection, transport-length partial-DTC rejection, DM4 reserved-byte/partial-DTC rejection, strict printable-ASCII star-delimited Product/Software/DM10 VIN Identification decode/encode rejection, standard-suite DM20 monitor-ratio complete-group and reserved-SPN-bit rejection, standard-suite FreezeFrame snapshot-count and reserved-snapshot-bit rejection, and FreezeFrame snapshot-count encode rejection above the u8 wire field are added; add full external diagnostic workflow traces."
J1939,"src/j1939/dm_memory.rs",DM14/DM15/DM16 memory access and ECU identification,yes,yes,yes,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"DM14 write/direct-virtual, DM15 completed, DM16 five-byte and exact larger data, and ECU-identification payloads are fixture-backed; selected AgIsoStack DiagnosticProtocol examples cover ECU Identification ISO mode with hardware ID and J1939 mode without hardware ID; DM14/DM15 reject short, overlong, reserved-control/status, and reserved-command/status fixed-size payloads and public encode rejects addresses above the 24-bit wire field; standard-suite coverage pins DM14 command/pointer-type combinations, reserved command rejection, DM16 exact seven-byte single-frame and reassembled-length boundaries, DM15 reserved high status bits, reserved low status values, and 24-bit address encode rejection; DM16 rejects hidden non-FF classic tails, classic counts above seven, and declared-length mismatches while public single-frame encode rejects over-seven counts and declared/data-length mismatches; ECU Identification rejects too-few, too-many, trailing, or non-ASCII star-delimited fields and public encode rejects delimiter/non-printable bytes; arbitrary-byte utility property coverage checks accepted DM14/DM15/DM16/ECU-identification decodes are bounded and canonical where single-frame encodable; add external service-tool memory access and broader ECU-identification traces."
ISO11783-13,src/isobus/fs/client.rs,File Server client,yes,yes,yes,unit+fixtures,yes,none,implemented-needs-external-oracle,"FS connect/read/write behavior plus property/status/volume/NACK/open/read/seek/write/close, directory change/current-directory, relative-open/read, volume-transition, and error-response byte fixtures exist; classic/v2 property/status/CCM/volume decoders reject short, overlong, bad-padding, reserved volume-state, truncated-name, and trailing payloads; v2 VolumeStatus encoding rejects non-ASCII or over-255-byte names instead of truncating; read/current-directory responses and volume-status broadcasts reject mismatched declared lengths, bad tails, or reserved states before state mutation; read/write success responses saturate local u32 file positions instead of overflowing after high seeks; solicited FileServerProperties/FileServerStatus responses now emit typed TAN-bearing events and update cached accessors, while raw FileServerStatus broadcasts update the client cache without a pending TAN; fallible raw request builders distinguish duplicate connects, invalid/overlong paths, unknown handles, oversized writes, and disconnected directory requests while preserving compatibility Option wrappers; duplicate/non-disconnected connect InvalidState errors and failed-connect rollback/retry are unit-tested; media-not-present and read-only errors are fixture-backed; add external reference traces."
ISO11783-13,src/isobus/fs/server.rs,File Server server,yes,yes,yes,unit+fixtures+standard-suite,yes,none,implemented-needs-external-oracle,"Server semantics plus property/status/volume/NACK/open/read/seek/write/close, directory change/current-directory, relative-open/read, MoveFile/DeleteFile/GetFileAttributes/SetFileAttributes/InitializeVolume, volume-transition, and error-response byte fixtures exist; malformed property/status/CCM/volume codec payloads, including reserved volume states, reject instead of default-decoding; v2 VolumeStatus encoding rejects non-ASCII or over-255-byte names instead of truncating; supported command requests now reject hidden non-FF tails and mismatched declared path/data lengths for CCM, OpenFile, ReadFile, WriteFile, ChangeDirectory, and MoveFile before connection or file-state mutation; path traversal rejection, root absolute paths, volume-label validation, server preload normalization/rejection, current-directory one-byte response length bounds, u32-saturated directory file-size reporting/read bounds, checked write-position growth rejection before oversized resize, relative OpenFile resolution against current directory, directory wildcard filtering, multi-client handle ownership, TAN cache expiry, same-TAN different-operation replay without side effects while cached, source-scoped TAN cache replay, canonical CCM keepalive connection gating, removed-volume cleanup, read-only write/delete denial, attribute get/set validation for read-only/hidden/system/archive bits, open-file safety checks before move/delete, and initialize-volume reset of files/directories/open handles are unit-tested; add external reference traces."
ISO11783-14,src/isobus/sc/master.rs,Section Control master,yes,yes,yes,unit+fixtures+standard-suite,yes,none,implemented-needs-external-oracle,"Ready/PlayBack status, wrong-message-code rejection, wrong-PGN direct-handler rejection, invalid NULL/broadcast source-address rejection, strict short/overlong status-payload rejection, explicit try_handle_client_status validation errors for wrong-PGN, invalid-source, and bad-width status frames, reserved master/client state-byte rejection, disabled-client status sequence-field rejection before active master mutation, reserved tail/busy/function-error byte rejection, Ready/PlayBack/Abort sequence-number validation including reserved high values, unsupported Recording/RecordingCompletion status rejection, busy-flag, pause/resume lifecycle including an active two-step pause/resume path, duplicate/out-of-range step-id rejection, wire-visible step-id emission for zero/non-zero/max ids, wrong-sequence PlayBack fixtures, configurable multi-client Ready/PlayBack acknowledgement gating, two-step PlayBack progression/completion, protocol-visible Abort status for explicit aborts plus standard-suite Ready and Active timeout boundaries, client-abort propagation, and SectionRouter step-id integration exist; active acknowledgements require all configured clients to report the current wire step id; needs external SC trace/oracle comparison."
ISO11783-14,src/isobus/sc/client.rs,Section Control client,yes,yes,yes,unit+fixtures+standard-suite,yes,none,implemented-needs-external-oracle,"Ready/PlayBack, wrong-message-code rejection, wrong-PGN direct-handler rejection, invalid NULL/broadcast source-address rejection, strict short/overlong status-payload rejection, explicit try_handle_master_status validation errors for wrong-PGN, invalid-source, and bad-width status frames, reserved master/client state-byte rejection, inactive-master status sequence-field rejection before active client mutation, reserved tail/busy/function-error byte rejection, Ready/PlayBack/Abort sequence-number validation including reserved high values, unsupported Recording/RecordingCompletion status rejection, pause/resume including an active two-step pause/resume path, two-step playback, Abort status, and busy-timeout Abort status fixtures exist; Active+Ready after playback pauses and PlayBack resumes; zero/non-zero/max step ids round-trip through client status; the SC client observes PlayBack step requests and sends active acknowledgement; needs external SC trace/oracle comparison."
ISO11783-12,"src/isobus/functionalities.rs",Control Function Functionalities PGN,yes,yes,yes,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"PGN 0xFC8E encode/decode is fixture-backed for the canonical leading-FF byte, per-function option-count bytes, single-frame FF padding, Minimum CF heartbeat/no-option examples, selected AgIsoStack UT Working Set, AUX-N Functions, and TC-SC Client advertisements, plus a mixed AUX-N/SC/TECU/TIM/FS capability advertisement; decoder rejects bad leading bytes, wrong option lengths, unknown functionality IDs, duplicate blocks, truncated option blocks, and non-FF trailing bytes; the PGN Request responder builds the advertised payload, including a TP/BAM response for the long capability-mix fixture, and ignores requests addressed to other CFs; property-style fuzz smoke feeds arbitrary bytes through the decoder; add physical/external capability-advertisement captures."
TIM,"src/isobus/tim.rs;src/isobus/functionalities.rs",TIM command/status codecs,yes,yes,yes,unit+fixtures+property+standard-suite,yes,none,implemented-needs-external-oracle,"First PTO state plus max-speed direction edge, hitch state plus min/max/out-of-range position edges, aux-valve command plus max-index/max-flow edge, malformed fixed-size rejection, invalid NULL/broadcast source-address rejection, reserved boolean-byte rejection, option-bit payload, option subset/missing-option, aux-valve index bounds, hitch position bounds, TIM functionality option-packing, authority/interlock guard fixtures/tests, revoked authority staying safe until a fresh request/grant cycle, and arbitrary-byte property coverage for TIM fixed-size decoders exist; add external/reference TIM command/status traces."
NMEA2000,src/net/fast_packet.rs,Fast Packet,yes,yes,yes,unit+fixtures+property+AgIsoStack+standard-suite,yes,AgIsoStack,implemented-needs-external-oracle,"10-byte two-frame, 9-byte minimum, 223-byte max first/last, reassembled-message timestamp propagation from the last received CAN frame, bad-counter, invalid-first-length, standard-suite malformed first-frame size rejection, standard-suite skipped-frame-counter discard without partial delivery, timeout cleanup including boundary checks and parallel non-zero sequence sessions, first-frame restart, two-source interleaving, same-source different-sequence fixtures, three-bit sequence wrap-around, direct transmit invalid high-bit PGN rejection before identifier normalization, NULL/broadcast source-address rejection, generated-stream final-frame completion properties, arbitrary raw RX frame boundedness under session caps, NMEA Product Info and Config Info reassembly into the management layer, GNSS Position Data PGN 129029 reassembly into NMEAInterface, GNSS Satellites in View PGN 129540 public stream reassembly, session-cap unit tests, and selected AgIsoStack NMEA2000MessageInterface Datum/GNSS Fast Packet wrapping vectors added; add external Fast Packet traces from public devices."
NMEA2000,src/nmea/interface.rs,NMEA2000 PGN interface,yes,yes,yes,unit+fixtures+property+AgIsoStack,yes,AgIsoStack,implemented-needs-external-oracle,"GNSS rapid position, rapid-position reserved coordinate rejection, COG/SOG reference and reserved numeric special-value rejection, PGN 129027 Position Delta High Precision Rapid Update signed 24-bit deltas, heading, magnetic variation, System Time, detailed position including PGN 129029 fast-packet reassembly, DOPs, and attitude byte fixtures exercise cache/event updates; selected AgIsoStack NMEA2000 navigation examples pin raw PositionRapidUpdate latitude/longitude, COG/SOG, PositionDeltaHighPrecisionRapidUpdate, RateOfTurn, and VesselHeading bytes/scaling plus reserved-reference and numeric special-value rejection; NULL/broadcast source addresses are rejected before cache mutation or event emission; Attitude rejects unavailable and reserved signed axes before cache mutation; Magnetic Variation fixtures cover exact bytes, unavailable sentinel, reserved-source rejection, reserved signed-value rejection, and bad-tail rejection; session two-node integration (`tests/standard/session_harness.rs`) has one node broadcast a GNSS position and the peer Gnss plugin observe and cache it; System Time unknown source bytes, reserved date/time numeric special values, detailed-position reserved fix methods, signed coordinate/altitude/DOP special-value rejection, reference-station count/tail-length mismatches, and GNSS DOPs reserved high bits/mode values and signed special values are rejected instead of prefix/default-decoded; GNSSBatch ECEF/ENU/NED helpers round-trip back to WGS and prove batch/per-sample equivalence; Wind Data, Temperature, Humidity, Pressure, and Outside Environmental Parameters exact-byte fixtures exercise event routing, unavailable-data sentinels, Temperature set-point and ShaftSeal source bytes, Temperature unknown-source rejection, Temperature reserved numeric special-value rejection, signed Humidity values/specials/min-max raw values, signed Humidity reserved numeric rejection, signed 0.1 Pa Actual Pressure scaling/min-max raw values, signed Pressure reserved numeric rejection, finite high clamping for unsigned environmental fields, Wind error-reference bytes, Wind reserved-reference rejection, Wind reserved numeric special-value rejection, Humidity reserved-source rejection, Pressure unknown-source rejection, high-end Outside Environmental pressure scaling, Outside Environmental encode/decode symmetry, Outside Environmental reserved numeric special-value rejection, and bad reserved-tail rejection; Engine Rapid reserved numeric special-value rejection is event-gated; Rate of Turn, Rudder, Water Depth, Fluid Level, Battery Status, Speed Water, and XTE fixtures exercise cache/event routing, signed scales, Battery Status signed reserved numeric rejection, Fluid Level valid/unavailable type bytes, reserved-type rejection, and reserved numeric special-value rejection, Speed Water valid/unavailable reference bytes, reserved-reference rejection, and reserved numeric special-value rejection, XTE mode/control bytes, reserved-mode rejection, and signed reserved numeric rejection, Rate of Turn signed upper/lower raw values and reserved signed-value rejection, Rudder field order and signed min/max clamping, Rudder reserved-control/reserved-direction rejection, Rudder reserved signed-value rejection, Rate of Turn/Rudder/Battery reserved-tail rejection, Water Depth reserved range-byte rejection, reserved depth/offset numeric special-value rejection, depth range/min-offset/high-depth bytes, and signed/clamped battery voltage/current values; fixed-size classic single-frame interface handlers reject short, overlong, bad reserved-tail, and bad reference/source/type/mode/control buffers instead of prefix/default-decoding malformed Message payloads; detailed-position unavailable-coordinate sentinels do not overwrite cache; arbitrary-payload property coverage spans enabled GNSS/environmental/navigation/power handlers and checks cached positions stay finite; needs recorded receiver/environmental/navigation/power sensor traces and external min/max/error captures."
NMEA2000,src/nmea/n2k_management.rs,NMEA2000 management PGNs,yes,yes,yes,unit+fixtures+property,yes,none,implemented-needs-external-oracle,"PGN 126996 Product Information has a 134-byte payload fixture, first/last Fast Packet golden frames, management request-clear coverage, non-134-byte rejection, printable-ASCII decode/encode validation, malformed non-printable text fixture, and over-wide field encode rejection; PGN 126998 Config Information has text golden fixtures, first/last Fast Packet golden frames into management routing, trailing-byte rejection, 70-byte declared-length rejection, truncated declared-length fixture, printable-ASCII decode/encode validation with malformed non-printable text fixture, and over-wide field encode rejection instead of truncation; PGN 126993 Heartbeat has text golden fixtures, routing coverage, exact 8-byte rejection, sequence-byte reserved-bit rejection, reserved-tail padding rejection, and encode rejection for non-50 ms intervals, above-u16 wire intervals, and over-four-bit sequence counters; arbitrary-byte property coverage spans Product/Config/Heartbeat decoders and bounded arbitrary management handle/update output; add public trace captures."
NMEA0183,src/nmea/serial_gnss.rs,serial GNSS parser,no,yes,yes,unit+fixtures,yes,none,implemented-needs-external-oracle,"Mixed and garbage-soak raw serial-log fixtures cover garbage before first fix, chunked/irregular GGA/GSA/RMC/VTG/GLL/GSV/ZDA parsing, invalid and malformed-checksum rejection, invalid-coordinate cache preservation, malformed GLL/GSV/ZDA no-mutation behavior, oversized-line recovery, satellites-in-view capture, UTC date/time validation, and final speed/course cache behavior; add recorded real-receiver logs."
Bindings,src/ffi.rs,C ABI,yes,yes,no,integration+smoke+layout+compile-surface,yes,none,complete-by-tests,"The C ABI is the `machbus_session_*` surface (38 exported functions) over a single opaque `MachbusSession*` handle pinned at `MACHBUS_C_ABI_VERSION = 3`; the sans-IO loop is feed (`machbus_session_feed`) / tick (`machbus_session_tick`) / drain transmit (`machbus_session_poll_transmit`) / drain events (`machbus_session_poll_event`), with errors surfaced through `machbus_session_last_error`; `make bind-c-check` checks the generated `include/machbus.h` for drift, `make c-demo` builds `examples/c_abi/demo.c` and the `compile_surface.c`/`layout.c` compile-surface probes (every prototype exercised, C-header static layout assertions), and `make c-full-demo` builds and runs `examples/c_abi/full_demo.c`; add broader external-trace-backed C workflows."
Bindings,src/python/mod.rs,Python binding,yes,yes,no,smoke+fixtures+pytest-style+wheel-install,yes,none,complete-by-tests,"The Python binding exposes a single `machbus.Session` class over the sans-IO `Session` core (advance timers with `Session.tick`, feed received CAN frames, drain transmit frames and events); `make python-demo` runs `examples/python_binding/basic.py` and the pytest-shaped dependency-free `examples/python_binding/regression.py` runner with golden expected values for constructor shape, claim state, diagnostic SPNs, event-drop accounting, subsystem flags, client guard/state methods, event subtypes, and helper clamp output; the Makefile gate also builds a wheel, installs it into a fresh disposable venv with pip install --no-deps, verifies metadata/export shape, and reruns the regression smoke against the non-editable wheel install; add a multi-interpreter wheel matrix if publishing beyond the local abi3 smoke."