[dborgards]

What does this change?

A slow RawCan subscriber silently lost its oldest buffered frames. Built-in subscriptions now implement the optional ILossAwareSubscription, exposing an independent lifetime overflow count and SubscriptionFrame sequence numbers. An exclusive reader can locate a gap before a retained frame and invalidate pending pairing/timing evidence.

ISubscription keeps its existing members, so external implementations remain compatible. Legacy and sequenced reads share one bounded buffer. Sequence assignment and enqueue order are serialized across writers; dispatch never waits for a reader or invokes arbitrary consumer continuations. Filtering, echo exclusion, reads, cancellation and disposal do not count as overflow. Documentation defines counter saturation, sequence wrap, competing-reader limitations and recovery of fresh evidence; zero local drops do not prove upstream capture completeness.

Closes #402. Refs #401; the SRDO monitor and its protocol recovery policy remain separate.

Type of change

• feat — new behaviour (minor release)
• fix / perf — bug or performance fix (patch release)
• docs / test / refactor / chore / ci — no release
• Breaking change

Checklist

• Build with -p:CI=true, test (net10.0), dotnet format --verify-no-changes, and pack + eng/verify-packages.py all pass locally
• Public API changes are documented with XML comments
• New behaviour is covered by a test
• The requirement or ADR this relates to is referenced — FR-RAW-016 in both SRS editions

Validation

• Full Release CI build: zero warnings/errors. All 2894 net10.0 tests passed, including 12 new small-buffer cases covering exact drops, independent subscribers, ordered concurrent overflow, exclusions, cancellation/disposal, a gap followed by fresh contiguous evidence, metadata ownership, saturation/wrap and waiting reader continuations.
• Four source mutations failed the corresponding tests: disabling drop counting, disabling sequence advancement, enabling synchronous consumer continuations, and removing writer serialization. Source restored before the full gate.
• Local Cobertura: all 32 changed executable lines in Subscription.cs and all 5 executable lines in SubscriptionFrame.cs covered; no missing/partial changed line. Inspected every class entry, including async state machines.
• API baseline copied from the generated received file; only the optional interface and frame envelope were added.
• net48 CI build passed. Windows CI subsequently passed all 2882 net48 tests on the original feature head. Format verification passed. Fresh pack verified all 9 packages. All 50 verification-script tests passed; requirement traceability found no new gaps.

CI and coverage on the final head

The HTTP 409 setup failures are fixed by merged PR #457 (#456 closed). Main was incorporated at head e65d5b42; its only tree difference from the locally tested feature head is the eight exact SDK pins in four workflows. All 50 verification-script tests passed again after that update.

On this final head, CI passes on Linux, macOS and Windows: 2894 net10.0 tests per platform and 2882 net48 tests on Windows. Format, CodeQL, documentation, release configuration, requirements traceability and the package/SBOM gate pass. The Codecov patch check passes. Both CI Cobertura copies were inspected across every class/state-machine entry: all 37 changed executable lines are covered, with no missing or partial changed entry.

Codex completed review of the final head without findings. Bugbot reports the reviewed patch unchanged and reuses its completed review. No review threads remain open.

[cursor]

PR Summary

Medium Risk
Changes the hot-path dispatch/enqueue path for every built-in subscription (locking, channel type, drop callback); behavior is well tested but affects all demux consumers on the shared bus service.

Overview
Adds FR-RAW-016 to the SRS and implements optional local buffer-loss diagnostics on built-in RawCan subscriptions (#402).

CanBusService subscriptions now also implement ILossAwareSubscription: a monotonic DroppedFrameCount (evictions only; filters, reads, cancel/dispose excluded) and per-enqueued-frame SubscriptionFrame.SequenceNumber via FramesWithSequence / TryReadWithSequence. Legacy ISubscription reads share the same bounded buffer; an exclusive reader can spot sequence gaps and treat capture as incomplete. Subscription assigns sequence and enqueues under a writer lock, counts drops via the bounded channel’s drop callback, disables synchronous continuations on dispatch, and documents saturation/wrap and competing-reader limits in XML and README.md.

SubscriptionFrame is the new public envelope; API approval baseline and SubscriptionLossTests cover overflow accounting, isolation between subscribers, exclusions, concurrency, lifetime, and dispatch-not-blocking-readers behavior.

^{Reviewed by Cursor Bugbot for commit a5816cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T20:40:48.559820Z	e65d5b4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!