SoundMatt · SoundMatt · Jul 30, 2026 · Jul 30, 2026
diff --git a/.fusa-hara.json b/.fusa-hara.json
@@ -14,7 +14,7 @@
       "severity": "S2",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-LIN-001, REQ-LIN-002: protect_id verified by unit tests with golden vectors",
       "fmea_refs": ["FMEA-001", "FMEA-002"],
       "status": "mitigated"
@@ -26,7 +26,7 @@
       "severity": "S2",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-LIN-003 through REQ-LIN-006: checksum algorithm verified by unit tests",
       "fmea_refs": ["FMEA-003", "FMEA-004"],
       "status": "mitigated"
@@ -38,7 +38,7 @@
       "severity": "S1",
       "exposure": "E2",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-LIN-009: validate_frame enforces ClassicChecksum for diagnostic IDs",
       "fmea_refs": ["FMEA-005"],
       "status": "mitigated"
@@ -50,7 +50,7 @@
       "severity": "S1",
       "exposure": "E3",
       "controllability": "C3",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-LIN-008: validate_frame rejects len > 8",
       "fmea_refs": ["FMEA-007"],
       "status": "mitigated"
@@ -62,7 +62,7 @@
       "severity": "S1",
       "exposure": "E3",
       "controllability": "C3",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-LIN-007: validate_frame rejects id > 0x3F",
       "fmea_refs": ["FMEA-006"],
       "status": "mitigated"
@@ -74,7 +74,7 @@
       "severity": "S2",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-LIN-014, REQ-LIN-021: NoResponse returned and maps to relay::Error::Timeout",
       "fmea_refs": ["FMEA-008", "FMEA-009"],
       "status": "mitigated"
@@ -86,7 +86,7 @@
       "severity": "S2",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "mitigation": "REQ-SAFETY-005, REQ-SAFETY-008: CRC-16/CCITT-FALSE verified by golden-vector unit test; CrcMismatch returned on detection",
       "fmea_refs": ["FMEA-011", "FMEA-012"],
       "status": "mitigated"
@@ -98,7 +98,7 @@
       "severity": "S2",
       "exposure": "E2",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-SAFETY-009: Receiver::unwrap returns SequenceGap when counter != last+1",
       "fmea_refs": ["FMEA-013"],
       "status": "mitigated"
@@ -110,7 +110,7 @@
       "severity": "S1",
       "exposure": "E2",
       "controllability": "C3",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-SEOOC-006: integrator must validate LDF-derived IDs before passing to MasterNode; MasterNode set_schedule enforces ID ≤ 0x3F (REQ-LIN-013)",
       "fmea_refs": ["FMEA-020"],
       "status": "mitigated"
@@ -122,7 +122,7 @@
       "severity": "S1",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-SLAVE-008: tokio::sync::Mutex serialises all publish/response operations; set_response atomically replaces entry",
       "fmea_refs": ["FMEA-021", "FMEA-022"],
       "status": "mitigated"
@@ -134,7 +134,7 @@
       "severity": "S1",
       "exposure": "E3",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-MASTER-004: MasterNode::run checks ctx.done() at top of each loop iteration",
       "fmea_refs": ["FMEA-025"],
       "status": "mitigated"
@@ -146,7 +146,7 @@
       "severity": "S2",
       "exposure": "E2",
       "controllability": "C2",
-      "asil": "ASIL-B",
+      "asil": "QM",
       "mitigation": "REQ-ADAPT-002, REQ-SEC-002: from_message validates protocol field == Protocol::Lin (3) before constructing Frame",
       "fmea_refs": ["FMEA-028"],
       "status": "mitigated"

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -77,7 +77,7 @@ jobs:
           d = json.load(sys.stdin)
           assert d['tool'] == 'rust-lin', f'bad tool: {d}'
           assert d['protocol'] == 'LIN', f'bad protocol: {d}'
-          assert d['spec_version'] == '1.11', f'bad spec_version: {d}'
+          assert d['spec_version'] == '2.0', f'bad spec_version: {d}'
           print('version JSON OK')
           "
           ./target/release/rust-lin capabilities | python3 -c "

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -3,7 +3,7 @@
 ## Overview
 
 rust-LIN is an ASIL-B Rust library for LIN bus communication. It implements
-the RELAY v1.11 protocol adapter contract for LIN (Protocol::Lin = 3).
+the RELAY v2.0 protocol adapter contract for LIN (Protocol::Lin = 3).
 The library is a Safety Element Out Of Context (SEOOC) per ISO 26262-10:2018 §9.
 
 ```
@@ -48,7 +48,7 @@ Public surface. Re-exports all stable types and the `RELAY_SPEC_VERSION`
 constant. Declares module tree.
 
 ### `src/relay.rs`
-RELAY v1.11 primitives: `Protocol`, `Version`, `Message`, `Context`,
+RELAY v2.0 primitives: `Protocol`, `Version`, `Message`, `Context`,
 `BackPressurePolicy`, `SubscriberOptions`, `Health`, `Metrics`, `Node`,
 `Caller`. Protocol::Lin = 3.
 
@@ -240,7 +240,7 @@ rust-LIN targets ASIL-B (ISO 26262 Part 6) as a SEOOC component. Safety measures
 - **30 FMEA entries** (`fmea.json`), highest RPN = 36.
 - **12 TARA scenarios** (`tara.json`), one residual risk accepted (TARA-006).
 - **IEC 62443-4-1 SL-2** compliance (`.fusa-iec62443.json`).
-- **148 tests**: 100 unit + 46 integration + 2 doc, all passing.
+- **155 tests**: 107 unit + 46 integration + 2 doc, all passing.
 
 ---
 

diff --git a/BOUNDARY_DIAGRAM.md b/BOUNDARY_DIAGRAM.md
@@ -1,4 +1,4 @@
-# System Boundary Diagram — rust-LIN v0.2.0
+# System Boundary Diagram — rust-LIN v0.4.2
 
 **Standard:** ISO 26262-10:2018 §9 (SEOOC)
 **ASIL:** ASIL-B
@@ -18,7 +18,7 @@
 ║  └────────────────────────┬────────────────────────────────────────┘ ║
 ║                           │ Rust API                                  ║
 ║  ┌────────────────────────▼────────────────────────────────────────┐ ║
-║  │              rust-LIN v0.2.0  [ASIL-B SEOOC]                    │ ║
+║  │              rust-LIN v0.4.2  [ASIL-B SEOOC]                    │ ║
 ║  │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────────┐   │ ║
 ║  │  │ frame.rs │ │ safety/  │ │  ldf/    │ │  adapt.rs        │   │ ║
 ║  │  │ (PID,CS) │ │(CRC-16)  │ │ (parser) │ │  (RELAY bridge)  │   │ ║

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -84,7 +84,7 @@ Pull requests are reviewed against:
 
 - CODING_STANDARD.md
 - SAFETY_PLAN.md §4
-- RELAY spec v1.11 §5 (protocol adapter contract)
+- RELAY spec v2.0 §5 (protocol adapter contract)
 - ISO 26262 Part 6 §8 (coding guidelines)
 
 ---

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rust-lin"
-version = "0.4.1"
+version = "0.4.2"
 edition = "2021"
 description = "rust-LIN: Rust library for LIN bus (Local Interconnect Network) — LIN 2.x, virtual bus, LDF parser, master/slave nodes, safety E2E"
 license = "MPL-2.0"

diff --git a/DO178C_ALIGNMENT.md b/DO178C_ALIGNMENT.md
@@ -1,4 +1,4 @@
-# DO-178C / ED-12C Alignment — rust-LIN v0.2.0
+# DO-178C / ED-12C Alignment — rust-LIN v0.4.2
 
 **Reference standard:** DO-178C / ED-12C (Software Considerations in Airborne Systems)
 **Applicable level:** DAL-C (equivalent to ASIL-B for cross-standard mapping)
@@ -46,7 +46,7 @@ Table A-7 and maps it to the rust-LIN artefact that satisfies it.
 
 | Obj | Description | rust-LIN evidence |
 |---|---|---|
-| A2-1 | High-level requirements developed | `requirements.json` (94 requirements), `SAFETY_PLAN.md §4` |
+| A2-1 | High-level requirements developed | `requirements.json` (99 requirements), `SAFETY_PLAN.md §4` |
 | A2-2 | Derived high-level requirements identified | All REQ-NNN with `"source": "internal"` |
 | A2-3 | Software architecture developed | `ARCHITECTURE.md`, `BOUNDARY_DIAGRAM.md` |
 | A2-4 | Low-level requirements (source code) developed | All `src/` modules with `//fusa:req` annotations |
@@ -67,7 +67,7 @@ Table A-7 and maps it to the rust-LIN artefact that satisfies it.
 
 | Obj | Description | rust-LIN evidence |
 |---|---|---|
-| A4-1 | Executable code is correct | `cargo test --locked` (140 tests, all passing) |
+| A4-1 | Executable code is correct | `cargo test --locked` (155 tests, all passing) |
 | A4-2 | Executable code is robust | Integration tests cover error/edge paths |
 | A4-3 | Test coverage — statement | `cargo-llvm-cov` in CI (future); currently 100% req coverage |
 | A4-4 | Test coverage — decision | `rsfusa comp` verifies V(G) ≤ 10; MC/DC not required at DAL-C |
@@ -106,7 +106,7 @@ Table A-7 and maps it to the rust-LIN artefact that satisfies it.
 DO-178C requires Modified Condition/Decision Coverage (MC/DC) at DAL-A and DAL-B.
 At DAL-C (ASIL-B equivalent), **decision coverage** is required. rust-LIN provides:
 
-- Statement and branch coverage via `cargo test` (100 tests cover all branches in
+- Statement and branch coverage via `cargo test` (155 tests cover all branches in
   the safety-critical `calc_checksum`, `protect_id`, `validate_frame` functions).
 - Cyclomatic complexity V(G) ≤ 10 per function (enforced by `rsfusa comp --strict`).
 - MC/DC is **not required** at DAL-C but can be measured with `cargo-llvm-cov` if

diff --git a/README.md b/README.md
@@ -7,7 +7,7 @@ The `Bus` and `MasterBus` traits are stable. Implementations are swappable witho
 
 [![CI](https://github.com/SoundMatt/rust-LIN/actions/workflows/ci.yml/badge.svg)](https://github.com/SoundMatt/rust-LIN/actions/workflows/ci.yml)
 
-**RELAY spec:** v1.11 · **Safety:** ASIL-B (ISO 26262) · **Language:** Rust 2021
+**RELAY spec:** v2.0 · **Safety:** ASIL-B (ISO 26262) · **Language:** Rust 2021
 
 ---
 
@@ -22,7 +22,7 @@ The `Bus` and `MasterBus` traits are stable. Implementations are swappable witho
 | `slave` | `SlaveNode` — registers/removes slave response registrations | All |
 | `ldf` | LIN Description File (LDF) parser — nodes, frames, signals, schedule tables | All |
 | `safety` | ISO 26262 ASIL-B end-to-end (E2E) data protection — `Protector`/`Receiver` | All |
-| `adapt` | RELAY v1.11 adapter — `adapt()`, `to_message()`, `from_message()` | All |
+| `adapt` | RELAY v2.0 adapter — `adapt()`, `to_message()`, `from_message()` | All |
 
 ---
 
@@ -115,6 +115,12 @@ rust-lin subscribe --count 10
 rust-lin convert --protocol LIN
 ```
 
+> **Note:** `send` and `subscribe` each construct their own in-process
+> `VirtualBus`. They cannot communicate across two separate CLI processes
+> (there is no shared transport/IPC). Use them from a single process via the
+> library API, or back them with a real shared transport, if you need a
+> `send` → `subscribe` round-trip.
+
 ---
 
 ## Docker

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -6,7 +6,7 @@
 - `VirtualBus` in-process implementation.
 - `MockBus` test double with frame injection.
 - `MasterNode` schedule table executor.
-- RELAY v1.11 adapter (`adapt`, `to_message`, `from_message`).
+- RELAY v2.0 adapter (`adapt`, `to_message`, `from_message`).
 - LIN 2.x PID computation and checksum (classic and enhanced).
 - Frame validation (ID, length, diagnostic checksum enforcement).
 - ASIL-B FuSa annotations on all exported functions and tests.
@@ -96,7 +96,7 @@ testing, the same role `vcan`+`can-utils` plays for CAN and CycloneDDS plays
 for DDS. The two are separable; only the first is being scoped as real work
 below.
 
-### What exists today (rust-LIN v0.4.1)
+### What exists today (rust-LIN v0.4.2)
 
 Confirmed directly against the current `main` branch (an earlier
 ecosystem-audit note is superseded by this read — the LDF parser and E2E

diff --git a/SAFETY_MANUAL.md b/SAFETY_MANUAL.md
@@ -1,4 +1,4 @@
-# Safety Manual — rust-LIN v0.2.0
+# Safety Manual — rust-LIN v0.4.2
 
 **Standard:** ISO 26262-10:2018 (SEOOC) / ISO 26262-6:2018
 **ASIL:** ASIL-B
@@ -275,6 +275,8 @@ master.set_schedule(entries).await?;
 |---|---|---|
 | 0.1.0 | 2026-06-19 | Initial release: core LIN frame, VirtualBus, MasterNode, RELAY adapter |
 | 0.2.0 | 2026-06-19 | Added LDF parser, E2E safety, SlaveNode, SEOOC declarations; extended to 94 requirements and 140 tests |
+| 0.4.1 | 2026-07-27 | 99 requirements, 155 tests (107 unit + 46 integration + 2 doc) |
+| 0.4.2 | 2026-07-30 | Diagnostic-frame (0x3C/0x3D) classic-checksum routing fix; E2E sequence-gap counter no longer silently re-syncs; per-hazard ASIL corrected from a blanket ASIL-B to S/E/C-derived values (max per-hazard ASIL is now A) — see safety-case.md for the resulting SEOOC classification follow-up; 156 tests (108 unit + 46 integration + 2 doc) |
 
 ---
 

diff --git a/SAFETY_PLAN.md b/SAFETY_PLAN.md
@@ -1,7 +1,7 @@
 # Safety Plan — rust-LIN
 
 **ASIL-B — ISO 26262 Part 6 — Software Unit Design and Implementation**
-**Version:** 0.2.0
+**Version:** 0.4.2
 **Date:** 2026-06-19
 **Author:** Matt Jones
 
@@ -10,7 +10,7 @@
 ## 1. Scope and objectives
 
 This safety plan covers the rust-LIN software library (`rust_lin` crate,
-version 0.2.0) and its CLI binary (`rust-lin`). The library implements:
+version 0.4.2) and its CLI binary (`rust-lin`). The library implements:
 
 - LIN bus traits (`Bus`, `MasterBus`) — `src/bus.rs`
 - LIN 2.x frame encoding/decoding (PID, classic and enhanced checksum) — `src/frame.rs`
@@ -203,4 +203,4 @@ release and re-reviewed for any subsequent release that adds scope.
 
 **Author:** Matt Jones <matt@jellybaby.com>
 **Date:** 2026-06-19
-**Version:** 0.2.0
+**Version:** 0.4.2
diff --git a/safety-case.md b/safety-case.md
@@ -1,4 +1,4 @@
-# Safety Case — rust-LIN v0.2.0
+# Safety Case — rust-LIN v0.4.2
 
 **Standard:** ISO 26262-6:2018 / ISO 26262-10:2018 (SEOOC)
 **ASIL:** ASIL-B
@@ -9,11 +9,28 @@
 
 ## Top-level claim
 
-> rust-LIN v0.2.0 is acceptably safe for use as an ASIL-B SEOOC software
+> rust-LIN v0.4.2 is acceptably safe for use as an ASIL-B SEOOC software
 > component implementing LIN bus communication, LIN Description File parsing,
 > end-to-end safety protection, and master/slave node management, in
 > accordance with ISO 26262-6:2018 and ISO 26262-10:2018.
 
+> **Open safety-case item (2026-07-30):** `.fusa-hara.json` previously
+> assigned a blanket `ASIL-B` to all twelve hazards without deriving it from
+> each hazard's own S/E/C rating. Correcting each hazard's ASIL per
+> ISO 26262-3:2018 Table 4 (see `.fusa-hara.json` v0.4.2) yields a maximum
+> per-hazard ASIL of **A** (several hazards compute to QM). Per
+> ISO 26262-3:2018 6.4.4.2, the ASIL assigned to a safety goal is the
+> highest ASIL among the hazardous events it covers — on the corrected HARA
+> that is ASIL-A, not ASIL-B. This top-level claim, the `**ASIL:** ASIL-B`
+> header above, and the matching ASIL-B claims in `SAFETY_PLAN.md`,
+> `SAFETY_MANUAL.md`, `BOUNDARY_DIAGRAM.md`, and `DO178C_ALIGNMENT.md`
+> have **not** been changed to match, because doing so is a safety-case
+> classification decision (either genuinely downgrade the SEOOC claim to
+> ASIL-A, or re-justify higher S/E/C values for specific hazards) that
+> requires a safety engineer's review, not a mechanical documentation
+> edit. Tracked for follow-up; do not treat this file's ASIL-B claim as
+> re-verified until that review closes.
+
 ---
 
 ## Sub-claim SC-01 — Core LIN requirements satisfied
@@ -224,4 +241,4 @@ Integrators targeting ASIL-C or ASIL-D must perform ASIL decomposition.
 
 **Author:** Matt Jones <matt@jellybaby.com>
 **Date:** 2026-06-19
-**Version:** 0.2.0
+**Version:** 0.4.2
diff --git a/src/bin/main.rs b/src/bin/main.rs
@@ -380,14 +380,14 @@ fn cmd_convert(protocol: String, _format: OutputFormat) -> Result<i32, Box<dyn s
         Ok(f) => f,
         Err(e) => {
             eprintln!("{}", e);
-            eprintln!("INVALID_ARGUMENT");
+            eprintln!("ErrInvalidFrame");
             return Ok(1);
         }
     };
 
     if let Err(e) = rust_lin::validate_frame(&frame) {
         eprintln!("{}", e);
-        eprintln!("INVALID_ARGUMENT");
+        eprintln!("ErrInvalidFrame");
         return Ok(1);
     }
 

diff --git a/src/lib.rs b/src/lib.rs
@@ -6,7 +6,7 @@
 //! rust-LIN — LIN bus library for Rust.
 //!
 //! Provides a virtual bus, master/slave node support, LDF parser, and safety
-//! E2E protection. Conforms to RELAY spec v1.11.
+//! E2E protection. Conforms to RELAY spec v2.0.
 //!
 //! # Quick start
 //!
@@ -61,7 +61,7 @@ pub use frame::{
 };
 
 /// The RELAY spec version this implementation targets.
-pub const SPEC_VERSION: &str = "1.11";
+pub const SPEC_VERSION: &str = "2.0";
 
 /// Alias for `SPEC_VERSION` for explicitness in CLI contexts.
-pub const RELAY_SPEC_VERSION: &str = "1.11";
+pub const RELAY_SPEC_VERSION: &str = "2.0";
diff --git a/src/relay.rs b/src/relay.rs
@@ -5,7 +5,7 @@
 
 //! RELAY protocol types bundled locally until a relay-rs crate is published.
 //!
-//! These types mirror the RELAY spec v1.11 definitions for Rust (§18.3).
+//! These types mirror the RELAY spec v2.0 definitions for Rust (§18.3).
 
 use std::collections::BTreeMap;
 use std::time::{Duration, Instant};