where_woof/openspec/changes/scan-alert-hardening/specs/fingerprint-throttle/spec.md

ADDED Requirements

Requirement: Fingerprint on scans

The tag page SHALL compute a lightweight browser fingerprint (UA, language, timezone, screen, platform hash) and include it with every scan POST and finder-contact POST. The scan SHALL store it in scans.fingerprint.

Scenario: Scan carries fingerprint

• WHEN the tag page scripts a scan POST
• THEN the request includes a fingerprint and the scan row stores it

Requirement: 24-hour per-device alert block

When a scan arrives with a fingerprint that was seen on an earlier scan within the last 24 hours, the system SHALL record the scan but SHALL NOT send an alert.

Scenario: Same device within 24 h

• WHEN a scan arrives with a fingerprint matching a scan from under 24 h ago
• THEN the scan is recorded with alert_sent = false and no SMS is sent

Scenario: Fresh device

• WHEN a scan arrives with a fingerprint not seen in the last 24 h
• THEN normal alert rules apply (an alert is sent if the throttle conditions permit)

Requirement: Contact path coverage

The finder-contact submission SHALL also be subject to the fingerprint block when a fingerprint is provided.

Scenario: Contact from a blocked device

• WHEN a contact submission carries a fingerprint seen within 24 h
• THEN the number is stored but no owner SMS is sent