where_woof/openspec/changes/scan-alert-hardening/tasks.md

1. Schema & Queries

• 1.1 db/schema.sql: idempotent ALTER TABLE scans ADD COLUMN IF NOT EXISTS fingerprint TEXT;; make db-up
• 1.2 queries.sql: add GetRecentScanByFingerprint (:one, fingerprint + 24 h window); make generate; build

2. Fingerprint JS

• 2.1 tag-public.html: compute fingerprint (UA/language/timezone/screen/platform hash), send with scan POST and contact form (hidden input)

3. Alert Logic

• 3.1 scan.go: ScanRequest gains phone + fingerprint; shouldAlert checks fingerprint block first, then different-phone re-alert within window; pass fingerprint/phone into InsertScan
• 3.2 FinderContact: accept + store fingerprint; dedup by phone within window; skip SMS when same phone or fingerprint-blocked

4. Verification

• 4.1 Unit-style checks via HTTP suite: same fingerprint within 24 h → no alert; fresh fingerprint → alert; different phone at same spot within window → alert; same phone re-submit → no alert
• 4.2 Existing suites still pass (Phase 1 + Phase 2) on fresh DB
• 4.3 openspec validate scan-alert-hardening; commit