v0.2.0

The WASM decode paths are unchanged — results remain byte-parity gated against the stock acquisition path in the bench, and web consumers see identical behavior. This release is about native consumers.

C ABI (iOS / Android)

• wrapper/decimen_codec.h: decimen_read_full, decimen_read_tracked, decimen_version, decimen_build. Two rules keep Swift/Kotlin interop boring — the image is a real pointer (a wasm32 heap offset fits in an int; a 64-bit pointer does not), and the caller owns every buffer, so there is no allocation contract to get wrong across the language boundary. A short buffer is a clean DECIMEN_ERR_CAPACITY, never an overrun.
• The position quad is reported even when a decode fails (DECIMEN_ERR_DECODE) — a detected-but-undecoded symbol is still where the next tracked call should aim.
• Threading: readTracked keeps its adaptive-skip state in function-local statics — per-worker under wasm, shared and racy in a native decode pool (confirmed under ThreadSanitizer). Serialise calls, or give each thread its own instance, until that state moves into a caller-owned handle.

One engine, two bindings

• The decode core (readFullPtr/readTrackedPtr, plain C++20 over const uint8_t*, no JS types) is split from the embind layer, which now sits behind #ifdef __EMSCRIPTEN__. There is exactly one implementation of the engine rather than one per platform; the JS API is unchanged.
• Native CMake target: plain cmake with no emscripten produces libdecimen_codec.a; every wasm-specific flag is confined to the emscripten branch. CI builds the native target on every push, so the #ifndef __EMSCRIPTEN__ half of the wrapper cannot rot behind the wasm-only workflow.

What this library still does not do

• Decimen framing. The engine returns the bytes inside a QR symbol and knows nothing about what they mean. The wire contract — 22-byte header, wire version, feature flags, fountain parameters — is specified with conformance vectors in decimen-optical-transfer: docs/technical/versioning.md and docs/technical/golden-vectors.md. A native client implements that layer against those vectors; a client that silently ignores an unknown version is the failure mode the format exists to prevent.

Repo

• CLA workflow hardened: the comment gate tolerates quoting and trailing punctuation, and the bot action is SHA-pinned — third-party code running with a write-scoped token in a pull_request_target context must be immutable.