v0.3.10

Added

• Multiple device addresses and historical names, with provenance.
  LAN Fence now retains every address and name a device has presented,
  not just the latest - each tagged with its source (arp, ipv6_nd,
  dhcp_ack, or legacy_snapshot for pre-upgrade data; names additionally
  dhcp_option_12/reverse_dns), the interface it was seen on, and when
  it was first/most recently observed. Device.ip/Device.hostname (and
  lanfence devices/device) now show a preferred value computed from
  this evidence - directly-observed addresses always outrank a DHCP-
  reported lease or imported legacy data regardless of recency, and a
  DHCP-reported name always outranks reverse-DNS - rather than simply
  whatever was written most recently. A dual-stack device correctly
  retains both its IPv4 and IPv6 addresses (previously, sighting it via
  both mechanisms in the same sweep silently discarded one). A DHCP
  client's own request/offer is deliberately never trusted as address
  evidence (only a confirmed server ACK, or a direct ARP/ND observation,
  is) - it still counts as the device being alive on the network. lanfence device <MAC> shows the full retained history in new Addresses/Names
  sections (and --format json in new addresses/names arrays); an
  existing database's ip/hostname are imported once as
  legacy_snapshot evidence, timestamped as of the import (not backdated),
  the first time it's opened after upgrading.

• User-managed device inventory metadata. lanfence device <MAC> now
  accepts --owner/--purpose/--group/--location (and matching
  --clear-* flags) to attach your own notes to a device - who owns it,
  what it's for, its group, and where it lives. Entirely separate from
  observed hostname/vendor and from trust/review/presence; edits never
  scan, alert, or create a lifecycle event. lanfence devices gained
  matching --owner/--group/--location filters (exact,
  case-insensitive) and an opt-in --details flag adding metadata columns
  to the table; JSON output always includes metadata. The interactive
  lanfence review queue offers an optional "Add device details?" step
  after trusting a device. Owner/group appear as brief context in
  lanfence digest device rows (purpose/location are left out to keep
  rows terse). lanfence reset clears metadata along with the rest of a
  device's history.

• Passive advertised-service discovery (mDNS/DNS-SD, SSDP/UPnP).
  Enriches inventory with services a device advertises about itself
  (printing, AirPlay, remote audio, cast, generic web service, and any
  other valid service type retained with its raw name) - opt-in via
  discovery.mdns/discovery.ssdp, narrowly extending the existing
  passive capture filter (UDP 5353/1900); needs scan.passive too, and
  monitor warns if enabled without it. Strictly passive: no mDNS query,
  SSDP M-SEARCH, or other discovery traffic is ever sent, and an SSDP
  LOCATION URL is never fetched. Attribution to a device is deliberately
  conservative - a service's target address (or, for SSDP, its packet
  source) is matched only against directly-observed (ARP/IPv6 ND)
  address evidence, never the transmitting frame's own Ethernet/IP source
  (an mDNS proxy/reflector can advertise on behalf of other hosts) and
  never an ambiguous or merely historical IP association; unmatched
  services are shown as unassociated rather than guessed. TTL/ssdp:byebye/
  goodbye semantics are honored per-record, independently, with a small
  documented allowlist for mDNS TXT attributes (bounded count/size, never a
  raw TXT blob) - all advertised claims, never verified capabilities.
  lanfence device <MAC> shows a new "Advertised services" section (and
  --format json a new services array); a new lanfence services
  command lists everything observed (--protocol, --unassociated,
  --include-expired). New-device digest rows get a terse services
  summary; no new findings/alerts are raised by this feature.

Full changelog: https://github.com/rosscooney/LanFence/blob/main/CHANGELOG.md