[soulteary]

Scope

Add native CAN compatibility options and isolated pre-integration proofs. The existing Python implementation remains the accepted business baseline. This PR does not import or modify the Python transport, hand or arm SDKs and is not a production Python binding.

Native behavior

• Add Message::format for explicit classic/FD selection. An explicit classic frame on an FD channel uses classic wire encoding and rejects FD/BRS conflicts or more than eight bytes. The unspecified default preserves each backend's existing behavior. Session validates before admission or latest replacement; existing resolver and SocketCAN constructor signatures remain available.
• Preserve optional receive timestamp value, unit, clock, source and counter width through Session routing. SocketCAN requests kernel software or raw hardware timestamps. PCAN preserves driver microseconds and identifies the clock as driver-specific, including the Classic overflow field and all FD timestamp bits. Vendor CAN FD preserves the raw 32-bit counter without guessing its unit or epoch. Missing timestamps are not replaced with host read time.
• Add opt-in receive_own_messages for SocketCAN and PCAN using native kernel/driver options, with optional direction metadata. Defaults remain false. PCAN's setter is optional unless echo is requested; setter failures follow the resource cleanup/retry protocol. Vendor and SLCAN opt-in is explicitly rejected because their exposed interfaces do not establish an equivalent control. No software echo or additional TX scheduling queue is added.

These are source-compatible additions, not a promise of binary compatibility with precompiled consumers after public structures grow. Rebuild with matching headers and library. Clock correlation, hardware timestamp provenance, actual echo delivery and mixed-frame traffic remain deployment-specific physical validation items. The SLCAN profiles do not provide receive timestamps.

Pre-integration proofs

The installed-library CPython probe establishes bounded Future/receipt ownership before native admission. Selected allocation/wrapping faults, GIL-releasing waits and close, callback reentry/errors, peer completion, retained Futures, destruction and cooperative interpreter shutdown run in isolated subprocesses. Two probe consumers observe one connection and one native writer. They are not the real SDKs, whose Runtime sharing and business equivalence remain unproved until integration.

The deployment-evidence gate checks exact revisions, resolved accepted-Python/native options, configuration hashes and backend-specific capabilities. Required features need enabled settings and matching feature-specific native hardware checks. Synthetic records, historical/Python-only reports and inspected source revisions do not substitute for the deployed native hardware result.

Local validation

• Native CTest: 351/351 passed.
• Production line coverage: 5627/5677 (99.11925% before rounding).
• CPython 3.12.3/Linux ARM64: ten subprocess scenarios and 26 deployment-gate tests passed.
• Clang 18 checks passed on the changed backend logic and regression seams; Cppcheck completed the local compilation database without findings.
• Regressions include explicit wire formats and invalid admission/latest preservation, timestamp overflow/raw-counter retention and routing, native echo setup and cleanup, real kernel software timestamps, absent hardware timestamps and truncated metadata/datagrams.

CI validation

All 46 checks passed on 4e3fdc55b53874ac63a9d0f2f60aa9f6314bf2d8, including Linux/Windows, x86_64/ARM64, native ABI/installed consumers, sanitizer jobs and the Python proof matrix. Complete quality analysis passed with A+, 100/100: formatting 80/80 files, Cppcheck 62/62 units and Clang-Tidy 62/62 units, with no findings.

Merged as e130f920c2b023f9922fe42b57c3e3108b356519. Physical hardware acceptance and actual hand/arm Runtime sharing remain separately unverified. A subsequent documentation cleanup is tracked independently and is not part of this PR's validated source.