v0.3.8

• Remove unclaimed Python-policy poll demand, release poll observers and wait up to shutdown_timeout for already-claimed polls. Preserve coalesced active readers and other devices sharing the Session. A stop timeout leaves the device open with its polling intent disabled, including after recovery.
• Project Python-policy health and channel-age generations onto the facade's successful open/recovery generation, matching retained snapshots across close, reopen and recovery. Physical Session generations remain separate. Native health projection is unchanged.
• Record an optional query's final UnsupportedFirmwareError in health without counting its underlying failure twice. Count post-decode unsupported results once when native metadata reads succeeded. Associate the update with that native failure's revision so a later error cannot be overwritten. Successful initialization clears prior errors only when no newer native error followed its last successful transaction.
• Add optional route_queue_capacity to device and discovery runtime configuration for the Python policy. The unset Python value selects 256 routed receive frames per device; a positive override reaches the existing Runtime inbox and survives recovery. Native defaults remain 512, and Native configurations reject the new Python-only override. Invalid capacity is rejected before transport creation. No receive layer or physical send queue is added.

Existing C++ method signatures and Native defaults remain available. Public configuration additions require rebuilding the SDK and downstream consumers with matching headers and libraries; binary compatibility with earlier headers is not claimed. The minimum and paired transport remain v0.3.4 (0e190032d65ed0b315337b45b3779cf4f650ed68).

Validation uses offline FakeTransport lifecycle, coalesced-reader, shared-Session isolation, error-ordering and inbox-overflow regressions, source/prebuilt/installed consumers, sanitizers, complete static analysis and the twelve-target release matrix. These checks do not add physical-device acceptance. Deployed adapters/drivers, firmware, physical timestamps, mixed CAN/FD topology and multi-device duration tests require separate hardware validation. O20, Python bindings and hand/arm integration are outside this patch; tactile-stage angle scheduling, extended identity parity and optional automatic reconnect remain separate work.

The no-sensor O30 regression exposed a signed overflow while reconstructing an unbounded Python-policy composite deadline. That response-window path now uses the saturating deadline helper; Native deadline calculation remains unchanged.

Validation for hand source 65477aa8393e145b227063ad421ca8d395b4153e and paired transport source 0e190032d65ed0b315337b45b3779cf4f650ed68:

• CI: GCC Debug/Release, Windows x64 Debug/Release and ASan/UBSan passed. Released-transport consumers passed on x86_64 and ARM64.
• Complete static analysis: A+, score 100, zero diagnostics. The downloaded report was independently checked: 613/613 formatting files and 358/358 units for each of cppcheck and clang-tidy.
• Release acceptance: all twelve targets, asset collection and exact-source draft verification passed. The packages cover Ubuntu 20.04/22.04/24.04/26.04 x86_64/ARM64 Release and Windows x64/ARM64 Debug/Release.
• Local regression coverage includes 16 new cases with 143 assertions, all eight CTest groups, the installed consumer and compilation of 18 documented examples. Reference checks include 30 executable observations, 31 same-input outgoing-frame vectors and 40 Python runtime tests using Python SDK commit 3a63e723b9a0046e9a60a58339b9f064ef5b70fd. This reference pin does not identify the deployed build or establish complete Python behavioral equivalence.

All 26 draft assets were downloaded and independently verified against the twelve target identities, source revisions, object architectures, archive checksums and GitHub asset digests. Use release-manifest.json and SHA256SUMS.txt to verify the selected package.

Validation history: an intermediate PR revision exposed the Python-policy O30 deadline overflow described above. Another intermediate revision failed Windows ARM64 communication/discovery acceptance. After Python helper ownership was separated from Native calls, both configurations passed on the final PR and release sources. An unchanged v0.3.7 comparison also passed all twelve targets. These results do not establish the underlying cause of the intermediate ARM64 failures or a compiler defect. The adjacent-Session-parameter analyzer finding was corrected without disabling its diagnostic.

See PR #22 for implementation and regression coverage. Select the matching platform, architecture and Windows runtime configuration; vendor drivers are not bundled. Existing physical-device acceptance records retain their original scope.