docs: state in every package README what is validated and what is not

src/CanKit.Pro.Actor/README.md

@@ -11,6 +11,12 @@ tagged there is no listed version to install, so the `dotnet add package` line b
 nothing and the withdrawn releases come back only on an exact version pin. The public surface
 can still change until then. See [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** Mailbox ordering (dedicated-thread mode), serialization under concurrent callers (dedicated-thread and thread-pool modes), and, for the synchronization-context mode, marshaling through the supplied context, failure surfacing, timers and dispose — not its ordering or concurrent serialization. Also the timer queue, the background-exception channel, dispose semantics and cancellation of a queued `PostAsync`, by the test suite in `tests/CanKit.Pro.Tests`. Much of the time-dependent behaviour is tested on a virtual clock; the rest measures real elapsed time.
+
+**Not validated:** Real-time scheduling on a loaded production host: timers carry the operating system's scheduling latency and there is no hard real-time guarantee. The package handles no CAN frames, so hardware and foreign stacks do not apply to it.
+
 This package has **no dependency on any other CanKit package** — it is a plain, reusable
 single-writer executor plus an event-driven timer queue. Protocol layers compose it; it does not
 know about CAN frames, buses, or adapters.

src/CanKit.Pro.Addressing/README.md

@@ -12,6 +12,12 @@ tagged there is no listed version to install, so the `dotnet add package` line b
 nothing and the withdrawn releases come back only on an exact version pin. The public surface
 can still change until then. See [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** CAN-ID limits and construction, J1939 PGN/priority/PDU/source-address composition and decomposition, NAME fields and PGN classification, by unit tests in `tests/CanKit.Pro.Tests`, against the values of the J1939 tables as this repository reads them.
+
+**Not validated:** The results have not been compared with a third-party J1939 implementation. The package handles no frames on a bus, so hardware does not apply to it.
+
 This generalizes logic that previously only existed as one hard-coded case inside
 `IsoTpEndpoint.CreateNormalFixed` (a single fixed diagnostics PGN) into reusable helpers any
 protocol layer (ISO-TP, J1939, CANopen, ...) can call directly.

src/CanKit.Pro.CANopen/README.md

@@ -7,6 +7,12 @@ nothing and the withdrawn releases come back only on an exact version pin. The
 public surface can still change until then. See
 [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** The communication profile as this repository reads CiA 301 — SDO server and client, PDO, NMT, heartbeat, node and life guarding, SYNC, EMCY, EDS/DCF loading — by the test suite in `tests/CanKit.Pro.Tests`, between instances of this implementation and against raw frames the tests send, over `CanKit.Adapter.Virtual`.
+
+**Not validated:** CiA 301 conformance as a tester would judge it, and any real CANopen device or third-party master. Device descriptions are tested against files and descriptions written for the tests, not against ones shipped by real devices. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 **CANopen (CiA 301)** node implementation for CanKit.Pro. Provides an in-process
 `ICanOpenNode` whose object dictionary carries the CiA 301 communication profile and drives the
 node's behaviour: an SDO server and client, a PDO engine with every transmission type of

src/CanKit.Pro.IsoTp/README.md

@@ -19,6 +19,12 @@ public surface can still change until then. See
 [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 CAN-FD long-payload cases still get the least coverage of the two halves.
 
+## What is validated, and what is not
+
+**Validated:** The frame codec (unit and property tests), and the channel over `CanKit.Adapter.Virtual`, directly or through a controllable bus double: segmentation, Flow Control (BS, STmin, Wait, Overflow), the N_As/N_Bs/N_Cr timers, reassembly, functional addressing and CAN-FD, by the test suite in `tests/CanKit.Pro.Tests`. STmin pacing is tested on a clock the test drives, so the interval is checked exactly and no real elapsed time is measured.
+
+**Not validated:** Conformance to ISO 15765-2 as a tester or a foreign ISO-TP stack would judge it, and STmin spacing in real time, on any host or adapter, where it carries scheduling and adapter latency. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 ## Scope
 
 - `IsoTpFrameCodec` — bounds-safe PCI parser, `BuildSingleFrame` / `BuildFirstFrame` /

src/CanKit.Pro.J1939/README.md

@@ -141,6 +141,12 @@ nothing and the withdrawn releases come back only on an exact version pin. The
 public surface can still change until then. See
 [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** PGN send and receive, SPN extraction and its indicator values, address claiming and its fallback, Request-PGN and periodic sends, by the test suite in `tests/CanKit.Pro.Tests`, between nodes of this implementation over `CanKit.Adapter.Virtual`, directly or through a controllable bus double.
+
+**Not validated:** Address-claim arbitration against third-party ECUs and behaviour on a real J1939 network. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 ## Install
 
 ```bash

src/CanKit.Pro.J1939Tp/README.md

@@ -8,6 +8,12 @@ tagged there is no listed version to install, so the `dotnet add package` line b
 nothing and the withdrawn releases come back only on an exact version pin. The public surface
 can still change until then. See [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** TP.BAM and TP.CM sessions, the T1–T4 timers, Connection Abort codes and retransmission, by the test suite in `tests/CanKit.Pro.Tests`, between instances of this implementation over `CanKit.Adapter.Virtual`, directly or through a controllable bus double.
+
+**Not validated:** Interoperation with third-party J1939 nodes and J1939-21 conformance testing. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 - **TP.BAM** (Broadcast Announce Message) — one sender pushes an up-to-1785-byte PDU to every node on the bus, no acknowledgement (FR-TP-030).
 - **TP.CM** (Connection Mode: RTS / CTS / EndOfMsgAck / Connection Abort) — point-to-point, with block-size negotiation and end-of-message acknowledgement (FR-TP-031).
 

src/CanKit.Pro.RawCan/README.md

@@ -10,6 +10,12 @@ tagged there is no listed version to install, so the `dotnet add package` line b
 nothing and the withdrawn releases come back only on an exact version pin. The public surface
 can still change until then. See [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** Demultiplexing and subscriptions, filter overlap, TX confirmation and concurrency, by the test suite in `tests/CanKit.Pro.Tests`, over `CanKit.Adapter.Virtual` and in-repository bus doubles.
+
+**Not validated:** The behaviour of real adapters. TX echo as SocketCAN, Kvaser and Vector deliver it is modelled by a test double (`ControllableBus.EchoCapable`), not observed on those adapters; the "accepted by the driver" approximation for adapters without echo has not been checked against a real driver. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 One `ICanBusService` wraps one `ICanBus` and turns its single `FrameObserved` RX stream into
 N independent, filtered, read-only `ISubscription`s — so several protocol instances (ISO-TP,
 J1939, CANopen, …) can each see their own view of the same bus **without competing over

src/CanKit.Pro.Reliability/README.md

@@ -12,6 +12,12 @@ tagged there is no listed version to install, so the `dotnet add package` line b
 nothing and the withdrawn releases come back only on an exact version pin. The public surface
 can still change until then. See [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** Deadline expiry and the bus-state monitor, by the test suite in `tests/CanKit.Pro.Tests`, largely on a virtual clock, and with bus states set by a software-controlled bus double (`ControllableBus`, built on a virtual-adapter session) rather than reported by an adapter.
+
+**Not validated:** Bus-off and error-passive transitions as a real controller produces them. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 This package depends only on `CanKit.Abstractions` (for `ICanBus`/`BusState`) and `CanKit.Pro.Actor` (for
 `IProtocolActor`). Every protocol instance already runs on a `ProtocolActor` (FR-RAW-020), so a
 deadline is not an independent standalone timer — it is scheduled through the actor's own

src/CanKit.Pro.Uds/README.md

@@ -13,6 +13,12 @@ public surface can still change until then — `SendRawAsync`, the timing option
 NRC-mapping types most of all. See
 [Versioning](https://github.com/dborgards/CanKit.Pro/blob/main/docs/decisions/0001-versioning-and-api-stability.md).
 
+## What is validated, and what is not
+
+**Validated:** Each service listed under *Service coverage* (some of them thinly), negative-response handling and the timing options, by the test suite in `tests/CanKit.Pro.Tests`, against `SimulatedUdsEcu` — a scripted ECU simulation in this repository whose responses each test defines — over `CanKit.Adapter.Virtual`.
+
+**Not validated:** Any real ECU, whose timing, negative-response usage and deviations from the standard the simulation does not reproduce, and conformance as a tester would judge it. Nothing in this package has run against real CAN hardware, a conformance tester or a third-party implementation: the test project references `CanKit.Adapter.Virtual` and no hardware adapter.
+
 ## Service coverage (SRS FR-UDS-001..012)
 
 | SRS ID | Service | MVP support |