v0.3.9

Added

• Per-device presence policies. lanfence device <MAC> --presence unspecified|intermittent|always-on (plus --offline-after/--clear-offline-after) lets you tell LAN Fence what "normal" presence looks like for a device, separate from trust. Intermittent devices suppress only the routine "it came back" lifecycle finding (first discoveries and real security findings are never suppressed); always-on devices get a medium-severity absence finding once gone past an effective delay, plus one info recovery finding on return, persisted per-episode. lanfence devices --presence ... filters, and interactive review asks about it after trusting a device.
• lanfence digest. A concise, side-effect-free summary of recent activity - new devices, review/investigation queues, missing always-on devices - as an alternative to per-event notifications. Rolling window (default 24h), preview by default, --send delivers via digest.channels (email/webhook/Slack/Discord/Teams/ntfy), independent of the immediate-alert pipeline.
• Unexpected DHCP server detection. Passively detects a DHCPOFFER/ACK/NAK reply from a server not on dhcp_servers.approved for the interface it answered on. Scoped by interface (VLAN sub-interfaces like eth0.20 supported natively), independent of device trust. lanfence dhcp-servers lists observed servers; Finding.mac is now optional for this non-device finding type.
• lanfence reset permanently wipes scanned device history (and, optionally, the allowlist).
• LAN Fence now identifies and trusts itself on the interface it's using, so its own traffic is never treated as an unknown device.

Fixed

• lanfence monitor could crash on a real DHCP hostname delivered as raw bytes by some scapy versions/platforms.
• lanfence link falsely refused a normal pipx install under sudo - it now resolves the real invoking user via SUDO_UID.

Full changelog: https://github.com/rosscooney/LanFence/blob/main/CHANGELOG.md