openspec: scan-alert-hardening change — different-finder re-alert + fingerprint 24h block

openspec/changes/scan-alert-hardening/specs/fingerprint-throttle/spec.md

@@ -0,0 +1,26 @@
+## ADDED Requirements
+
+### Requirement: Fingerprint on scans
+The tag page SHALL compute a lightweight browser fingerprint (UA, language, timezone, screen, platform hash) and include it with every scan POST and finder-contact POST. The scan SHALL store it in `scans.fingerprint`.
+
+#### Scenario: Scan carries fingerprint
+- **WHEN** the tag page scripts a scan POST
+- **THEN** the request includes a fingerprint and the scan row stores it
+
+### Requirement: 24-hour per-device alert block
+When a scan arrives with a fingerprint that was seen on an earlier scan within the last 24 hours, the system SHALL record the scan but SHALL NOT send an alert.
+
+#### Scenario: Same device within 24 h
+- **WHEN** a scan arrives with a fingerprint matching a scan from under 24 h ago
+- **THEN** the scan is recorded with `alert_sent = false` and no SMS is sent
+
+#### Scenario: Fresh device
+- **WHEN** a scan arrives with a fingerprint not seen in the last 24 h
+- **THEN** normal alert rules apply (an alert is sent if the throttle conditions permit)
+
+### Requirement: Contact path coverage
+The finder-contact submission SHALL also be subject to the fingerprint block when a fingerprint is provided.
+
+#### Scenario: Contact from a blocked device
+- **WHEN** a contact submission carries a fingerprint seen within 24 h
+- **THEN** the number is stored but no owner SMS is sent