[hexsecs]

Summary

DBC signal-only streams lose source timing, MCP clients receive misleading success flags and oversized results, non-finite CLI limits bypass bounds, and piped dashboard launchers cannot discover their URL. This change fixes those five reliability defects while retaining the canonical JSON envelope and existing guided-fuzz error codes.

Closes #525, closes #520, closes #523, closes #524, closes #522.

Changes

• Preserve source-frame timestamps on DBC signal events across file, stdin, and MCP decoding, including zero and unknown timestamps.
• Set the MCP failure flag whenever the canonical envelope reports failure; document SDK schema-validation errors separately.
• Reject NaN and infinities before command dispatch, file processing, archive creation, or transport access; validate DoIP URL timeouts too.
• Enforce the final serialized MCP JSON byte cap, including warnings and surviving truncation metadata, on successes, early refusals, and exception results. Document and reject positive caps below 1024 bytes before server startup.
• Flush the complete dashboard startup output before serving so piped launchers can read the resolved URL and ephemeral port in every output format.

Test plan

• Focused regression suite: 382 passed and 10 subtests passed.

• Full pytest tests/ -q suite: 1925 passed, 1 skipped, 1 deselected, 306 subtests passed.

• ruff check and ruff format --check.

• mkdocs build --strict.

• Real SDK stdio recovery and byte limits at 1024 and 512000 bytes, including oversized exception diagnostics.

• Piped dashboard startup and HTTP access using ephemeral local ports for JSON, JSONL, text, and table modes.

• Strict JSON validation for invalid limits; source timing retained without parent-event joins.

• GitHub CI: Python 3.12/3.13 full suites, Windows smoke, lint, strict docs build, and all four bounded Atheris fuzz jobs passed.

Documentation

• Changelog updated under [Unreleased] for all five issues.
• Command specification and event-schema examples updated.
• Relevant EARS design requirements and Gherkin test specifications updated with traceability.
• AGENTS.md and docs/agents.md updated for affected agent workflows.
• Dashboard tutorial and troubleshooting guidance updated.