[dborgards]

What does this change?

Applications can opt into EMCY 8130h for heartbeat-consumer and local life-guarding timeouts with CanOpenNodeOptions.EmitGuardingErrorEmcy. It defaults to false, preserving the existing timeout-event-only behavior. Existing options-copy signatures remain binary-compatible and preserve the new setting; the generated API approval adds only this property.

An enabled lapse uses the existing communication-error aggregation: bits 4/0 of 1001h while active, one EMCY per error event, and 0000h only when the last communication cause ends, retaining application bits. Heartbeat reception, watch removal/change, a guarding poll, disabling life guarding and NMT reset retire the appropriate state. Re-enabling an EMCY producer reports only faults that remain active; toggling it does not duplicate a reported lapse. Reset ends the causes without an error-reset EMCY. No new event subscriptions or controller polling are introduced.

Refs #423 (not Closes). This PR implements 8130h only. Optional controller-state EMCYs remain separate: 8120h can use the observed passive state; overrun clear semantics and the 8140h bus-off-recovery/reset sequence require their explicit evidence/scope decision. Node-guarding-consumer timeout behavior remains unchanged.

Type of change

• feat — new opt-in behaviour (minor release)

Validation

19 new clocked wire-level cases cover default opt-out with existing events, repeated lapses, multiple producers, application-bit preservation, guarded-reply recovery, unchanged/changed/removed watches, disabled/re-enabled producer, life-guard recovery/mode changes, reset with restored watch, and existing copy methods.

Nine actual source mutations were runtime-red and restored: enable by default; duplicate a lapse; omit heartbeat recovery; clear another producer's cause; omit watch reconciliation; omit life-guard disable reset; omit reporting on re-enable; retain pre-reset heartbeat lapse history; incorrectly clear an unchanged watch when another is added. Runners: /private/tmp/cankit-423-guarding-mutations.py and /private/tmp/cankit-423-guarding-filter-mutation.py.

Full local gates passed: 3062 net10 tests with coverage, net48 compilation, CI build, formatting, nine verified packages, 50 engineering tests and traceability. All 36 changed executable Cobertura entries across every class/nested type are covered with no missing/partials. The API received file was generated by PublicApiSurfaceTests, its one-property diff reviewed, then copied to the approval. README and FR-CO-011 describe the opt-in and its boundaries.

Checklist

• Build with -p:CI=true, test (net10.0), dotnet format --verify-no-changes, and pack + eng/verify-packages.py all pass locally
• Public API changes are documented with XML comments
• New behaviour is covered by a test
• The requirement or ADR this relates to is referenced (FR-CO-011, CANopen: optionally raise EMCY 8130h (life guard/heartbeat) and 81xxh (CAN controller state) #423)

[cursor]

PR Summary

Medium Risk
Touches EMCY/error-register and heartbeat/life-guarding paths on the actor loop; default-off limits blast radius, but enabled behavior affects monitoring semantics and bus traffic.

Overview
Adds CanOpenNodeOptions.EmitGuardingErrorEmcy (default false) so applications can optionally raise 8130h EMCYs for heartbeat-consumer timeouts and this node’s local life-guarding timeout, while existing HeartbeatTimeout / LifeGuardingEvent behavior stays unchanged when the flag is off.

When enabled, those lapses join the existing FR-CO-011 communication-error model: 1001h bits 0/4 while active, one EMCY per error event (no duplicate on repeated timeouts), 0000h only when the last cause clears, with application register bits preserved. Causes end on heartbeat reception, watch removal or timeout change, life-guard poll/recovery/disable/heartbeat-producer mode, EMCY producer re-enable (reports only still-active faults), and NMT reset (clears state without an error-reset EMCY). With* option copies preserve the new setting.

SRS FR-CO-011, README, public API approval, and wire-level CanOpenGuardingEmcyTests document and cover the opt-in and edge cases (#423).

^{Reviewed by Cursor Bugbot for commit 5f76359. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T08:07:01.276990Z	5f76359	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dborgards]

@codex review

Please review current head 5f76359, including the explicit watch filter and the additional unchanged-watch wire regression. The earlier review was requested for 6a3ac6b; final clearance must cover this head.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 5f763596d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".