Device distinct messaging: why I killed multi-device and how fingerprint hashing enforces it.

Most messaging apps let you log in on your phone, laptop, iDevice, and browser, with all of your messages synced. It's framed as convenience. It's also an attack surface. When I was designing my messenger, I made a deliberately unpopular call: one device per account, enforced at the server. This post is about how I implement that, why the enforcement matters more than the policy, and what the recovery story looks like when a user's device dies. Why one device? The pitch for multi-device is: "I w