v0.1.15

Four changes from @Jason-Morcos, completing the connection surface described in #75.

A dropped device-tree resource (#74)

StateCache.index_device_tree() skipped entry zero of a /device/0 batch unconditionally, on the assumption that the slot always holds the device container. Some layouts put an ordinary resource there instead. The href identifies the container; its position does not, so indexing now inspects every href-bearing entry and excludes /device/0 by name.

This is the one change here that alters existing behaviour. On my reference oven it recovers /connectionconfig/vs/0, discarded on every sweep since the function was written: seeded and swept link counts moved 16 to 17 after deploying. My dryer stays at 25, since its entry zero carries no href at all. The sweep response already contained the resource, so nothing extra goes on the wire.

First-use server identity (#76)

SamsungServerProfile.bound_device() needs a certificate UUID that a caller lacks before the first manufacturer-certificate session. SamsungServerProfile.discover_device() covers that one step. It keeps CA chain verification, the exact C=KR and O=Samsung Electronics and selected OU role checks, and rejects a missing, malformed, or nil UUID. Only the pin is relaxed.

DtlsCoapSession.server_certificate_identity exposes the verified subject UUID after connect() succeeds. The profile retains no learned identity, so it stays reusable.

The certificate UUID and the OCF device UUID from /oic/d are separate identities. Bind the two over the same authenticated session before persisting, then use bound_device() for later connections.

Opt-in HVR peer cleanup (#77)

On @Jason-Morcos's two WD53-family appliances, a failed initial certificate handshake can stop after the DTLS HelloVerifyRequest, leaving a half-open peer that swallows a clean retry.

connect(cleanup_hvr_peer=True) sends one epoch-zero fatal handshake_failure alert for that peer and raises HandshakePeerCleanupError, leaving the settle delay and any retry to the caller. It requires a SamsungServerProfile and a fixed non-zero local port, fires only after the deadline has already expired, and acts only when the whole observed transcript is ClientHellos out and complete HelloVerifyRequests in. A malformed, fragmented, mixed, or oversized transcript stays an ordinary SessionTimeoutError.

HandshakePeerCleanupError subclasses SessionTimeoutError, so existing handlers keep working. The flag defaults off, and the default path is unchanged.

Stock RT-OCF corroborates the mechanism. rt_ssl_error_check frees the peer with ssl_remove_peer_from_list on any non-exempt negative return and suppresses the return alert, so the peer goes and the server stays quiet. In that 2023 tree the return code is BAD_HS_CLIENT_HELLO: ssl_parse_client_hello reads the record header itself and rejects every content type other than handshake, ahead of the alert path. Samsung's shipped firmware differs from that source, and the appliances in #75 are the evidence this recovers them.

Supported import contract (#78)

The README documents the module-by-module public API and the additive 0.1.x compatibility policy. A compatibility test imports the exact symbols LocalThings, the reference bridge, and the downstream integration rely on, and every Python block in the README is syntax-checked.

718 tests pass. The library tree in this release ran five clean poll windows on both reference appliances, at 0 err and 0 timeouts.