v1.6.0

What's Changed

Fixed

• Eliminated same-device identity churn signal. The same_device_multi_identity scoring check used User-Agent hashes as a device fingerprint — UA strings are shared by millions of users and caused cascading false positives. Signal removed entirely; same_ip_multi_identity provides equivalent coverage using a more reliable identifier.
• Fixed blocked_attempts_recent matching. The repeat-after-blocks counter previously matched visitors by ua_hash (coarse and shared). Now matches only by ip_hash and email_hash.
• Manual IP blocks now logged to history. checkout_process_guard() was blocking manually-listed IPs but skipping event logging, making those blocks invisible in the History tab. Now logs a manual_ip_block event with score 999.

Changed

• Auto-purge block tokens on upgrade. On first load after upgrading to 1.6.0, all stored block tokens are cleared to remove contaminated ua_hash and payment_hash entries from earlier versions.
• Removed "Same device identity churn" weight and threshold fields from Advanced Detection Controls UI (settings keys kept for backward compatibility).