[FelicianoAngulo2]

A session change asks the application to prepare it before the positive response, with the active and target sessions, and the application can refuse it or answer pending; MAY_RESPOND_PENDING becomes required, so this is a breaking change for implementers of DiagnosticSessionControl. A change that was prepared but not made (refused later, unconfirmed, link closed, tS3 first, mid-request transport error, step dropped) is reported through abandon, on DiagnosticSessionControl and EcuReset, empty by default; EcuReset::reset also gets the active session. Server::step and run return a StepError: Recoverable where the transport failed between requests, keeping a change that awaits its confirmation and letting the server be stepped again, Terminal otherwise.

Depends on #93.

Issue URL

Towards https://github.com/luminartech/halo/issues/5100

Testing

Run on this branch with the commits of the PRs below it, each commit alone and on the stack's top:

• tool self-tests, validate, governance, the Sphinx needs build, and prose (plain and CI's --strict crates/uds_c)
• cargo test --workspace --all-features; clippy on the host and for thumbv7em-none-eabihf
• just embedded builds on 1.91 for both targets and the size check (matches the baseline)
• cargo doc with -D warnings; pre-commit run --all-files
• On the stack's top also the uds_c Miri job from ci.yml and cargo package -p uds_c --no-verify

[JustinKovacich]

Stack review of #92–#96, this PR's part: 3 Required, 1 Question, 1 Optional.

Gate: fmt clean; clippy pedantic 0 hits; all tests pass; workspace powerset clean; cargo doc with -D missing_docs clean; the size check matches the baseline (text 54340, main frame 3320, which the commit message accounts for).

The new driver tests are good coverage: pending, refusal, a close mid-prepare, busy, and a suppressed response that pended.

Skills run for this review: rust-quality-gate, rust-principles, rust-api-design, rust-embedded, rust-design-review (change-scoped), /code-review, writing-for-customers.

[JustinKovacich]

Every Required from the first round is fixed:

• abandon on both traits, called from apply, from the step guard and on a failed confirmation, with tests for each path.
• prepare and reset are told the active session.
• The changelog snippet spells core::future::Future.
• The transport-error drop path is listed.

On MAY_RESPOND_PENDING and prepare: keep them required. I've answered on that thread.

1 Optional.

Gates at this head, run locally: cargo fmt --check, clippy pedantic on the workspace (0 hits), cargo test --workspace --all-features, the cargo hack powerset (depth 2), cargo doc with -D missing_docs and broken links denied, and just embedded with both size baselines. All clean.

Skills: rust-quality-gate, rust-principles, rust-api-design, rust-embedded, rust-design-review (change-scoped) and writing-for-customers. /code-review ran on this PR.

Security Audit is red on main too (RUSTSEC-2026-0110 and RUSTSEC-2026-0386), so its failure here is not this PR's.

[JustinKovacich]

The round-2 Optional is fixed, and the fix goes further than it asked:

• A drained failed confirmation now stays on the server (Unconfirmed::failed), and the step guard abandons it once when the step ends. a_failed_confirmation_drained_before_a_transport_error_is_abandoned_once covers it.
• A tS3_Server expiry the drains recorded but the step never applied is applied by the guard, and the confirmed session it overtook is abandoned. a_confirmed_session_a_timeout_overtakes_is_abandoned_when_the_step_fails covers it.
• step and run now fail with StepError. An error at the between-requests next_event is Recoverable: idle stays set there, so the change awaiting its confirmation is kept and the next step takes the confirmation. a_transport_error_between_requests_keeps_the_change_awaiting_confirmation covers it. Every other error is Terminal, as before. This is the second remedy suggested for #96's re-arm finding, and handle awaits nothing before between_requests, so Recoverable cannot be returned with anything half done.
• The step/run docs, both abandon docs, the changelog's breaking entry, service-traits.rst and the milestone-1 limits in stack-position.rst all describe the split.

No comments.

Gates at 237785e, run locally: cargo fmt --check, clippy pedantic on the workspace (0 hits), cargo test --workspace --all-features, the cargo hack powerset (depth 2), cargo doc with -D missing_docs and broken links denied, and just embedded with both size baselines. All clean.

Skills: rust-quality-gate, rust-principles, rust-api-design, rust-embedded, rust-design-review (change-scoped) and writing-for-customers. /code-review not run: the four fixups are small enough that I traced each changed path by hand.

Security Audit is red on main too (RUSTSEC-2026-0110 and RUSTSEC-2026-0386), so its failure here is not this PR's.