v3.5.0

Added

• PipeDecoder now uses the last validated airborne position as a local CPR
  reference for subsequent BDS 0,5 frames. This makes a position available on
  the current streaming decode() call when no fresh global even/odd pair is
  available, instead of relying on retroactive mutation of an earlier result.
• local_ref_window configures the maximum reference age (30 seconds by
  default); set it to zero to disable local airborne decoding.
  PipeDecoder.stats["local_positions"] reports positions produced by this
  path.
• Position bootstrap now locks as soon as three candidates are pairwise
  motion-consistent instead of always waiting for all five candidate slots.
  The five-candidate limit still allows two unrelated outliers to be ignored.
• The mixed-traffic benchmark now reports immediate streaming position yield
  and frame-by-frame coordinate agreement for v2.21.1, released v3.4.0, and
  v3.5.0 in addition to throughput.

Changed

• crc_valid is now None when an address-parity message cannot be checked
  independently. It remains True or False for frames whose parity can be
  validated without assuming the address derived from that same parity.
• PipeDecoder uses each message's source timestamp for state validity while
  retaining a monotonic high-water mark for eviction. Reordered capture data
  therefore cannot revive expired observations or prematurely evict newer
  state.
• Plausibility and position validation are isolated in a dedicated internal
  module, keeping the streaming pipeline and its decision comments easier to
  follow without changing the public API.
• Release publishing now runs only after the full test matrix succeeds, checks
  that the Git tag matches the package version, and smoke-tests the exact wheel
  artifact that will be uploaded.

Fixed

• Surface references remain optional and are used only for BDS 0,6 surface
  positions. Positions derived from surface_ref can never seed local
  airborne CPR decoding.
• Rejected global position candidates cannot become local CPR references; a
  separate last-accepted airborne reference is maintained and TTL-evicted.
• Bootstrap promotion, including flush(), initializes the latest accepted
  airborne reference while keeping surface-derived positions separate.
• Globally decoded surface CPR positions now select the correct longitude zone
  across the antimeridian and other CPR zone boundaries.
• Beast stream input resynchronizes after malformed or truncated frames instead
  of losing subsequent valid messages.
• Beast receiver timestamps are back-projected from the current wall clock with
  rollover-safe receiver-tick deltas, avoiding dates near the Unix epoch and
  preserving correct timing across the 12 MHz counter rollover.
• BDS inference compares headings using circular angular distance, so values
  around 0/360 degrees are scored correctly.
• Trusted ICAO observations expire according to the configured state TTL and
  cannot be refreshed by older, reordered messages.
• Integer messages outside the valid 56-bit and 112-bit Mode S frame ranges are
  rejected instead of being silently truncated or misclassified.
• Network endpoint and surface-reference CLI arguments are validated before a
  stream starts, and network sources are closed deterministically on normal
  exit, errors, and interruption.
• The live terminal UI synchronizes access to shared aircraft state, preventing
  concurrent decoder and renderer updates from racing.