[soulteary]

The explicit Python policy could return from stop_polling() while a claimed poll still held the device transaction lane. Health generations could diverge from retained snapshots after reopen, and optional firmware degradation could leave the underlying timeout in recent_error.

• Remove unclaimed poll demand, release poll observers and wait for claimed polls for up to shutdown_timeout. Preserve coalesced active readers and other devices sharing the Session. A stop timeout leaves the device open with its desired polling plan disabled, including after recovery.
• Project Python-policy health, channel-age and recent-error generations onto the successful facade generation. Physical Session generations remain separate; Native health projection is unchanged.
• Associate final UnsupportedFirmwareError classification with the native failure revision. Reclassify recorded failures without double counting; record post-decode unsupported results once. Preserve newer native errors. Clear prior initialization errors only when no newer error followed the completed baseline.
• Add optional Python-only route_queue_capacity to direct and discovery runtime configuration. Unset selects 256 frames in the existing per-device Runtime inbox; positive overrides survive recovery. Native defaults remain 512. Reject zero and Native overrides before transport creation, and preserve existing route/capacity bindings.

Python-only helper ownership stays outside Native helper calls. O30 tactile reads use a saturating composite deadline under Python response windows; Native deadline calculation remains unchanged. Keep per-case communication/discovery duration output for failure diagnosis. Release patch version 0.3.8.

Existing C++ method signatures and Native defaults remain available. Public configuration additions require rebuilding the SDK and downstream consumers with matching headers and libraries; binary compatibility with earlier headers is not claimed. No additional receive layer, physical send queue, O20 support, Python binding or hand/arm integration is introduced.

The minimum and paired transport remain v0.3.4 (0e190032d65ed0b315337b45b3779cf4f650ed68). Python reference contracts use commit 3a63e723b9a0046e9a60a58339b9f064ef5b70fd; this does not identify the deployed Python build.

Validation on 73762438023cf0ab650faa15ea17195e40ad02aa:

• CI: GCC Debug/Release, Windows x64 Debug/Release and ASan/UBSan.
• Prebuilt transport consumers: x86_64 and ARM64 with transport v0.3.4.
• Complete static analysis: independently checked downloaded report, 613/613 formatting files, 358/358 units for each analyzer, A+, score 100, zero diagnostics.
• Release acceptance: twelve native Ubuntu/Windows targets and complete asset collection. All targets and collection passed.

Local checks include 16 new regression cases with 143 assertions, 90 selected policy regression cases with 824 assertions, all eight CTest groups, the installed consumer, compilation of 18 documented examples, 30 executable cross-language observations, 31 same-input outgoing-frame vectors, 40 pinned Python runtime reference tests and documentation checks. These observations do not establish complete Python behavioral equivalence.

Validation history: sanitizer testing exposed an O30 signed deadline overflow, now corrected on the Python response-window path. An intermediate implementation failed Windows ARM64 communication/discovery acceptance; both configurations passed after Python helper ownership was separated from Native calls. An unchanged v0.3.7 comparison also passed all twelve targets and asset collection. These results do not establish the underlying cause of the intermediate ARM64 failures or a compiler defect. A subsequent analyzer finding about adjacent Session parameters was corrected by separating those parameters with the configuration argument; no diagnostic was disabled.

All validation is offline unless a separate hardware record states otherwise. No new physical-device acceptance is claimed. Deployed adapters/drivers, firmware, physical timestamps, mixed CAN/FD topology and multi-device duration tests require separate hardware validation. Tactile-stage angle scheduling, extended identity parity and optional automatic reconnect remain separate work.

Published v0.3.8 from signed tag v0.3.8 on merge commit 65477aa8393e145b227063ad421ca8d395b4153e. The merge tree matches the verified PR head. Merged-source CI, prebuilt consumers, complete A+ analysis and release acceptance passed. The merged-source report was independently checked for complete 613/358/358 coverage and zero diagnostics. All 26 draft assets were independently downloaded and checked for twelve target identities, source revisions, object architectures, archive checksums and API digests before publication. Post-publication checks confirmed stable/latest status, exact English notes, the PR/tag source commit and all 26 asset digests and sizes. The release notes retain the intermediate validation failures and the hardware-validation/rebuild limits described above.