perf: sync protocol and core hardening updates

deploy/migrations/0068_private_message_send_receipt.up.sql

@@ -0,0 +1,15 @@
+-- Exact random_id replay must not rebuild the original send result from mutable message_boxes:
+-- edit advances box pts/body and delete hides the row. Keep the immutable allocation receipt on
+-- the shared private message instead; 0073 adds the immutable first snapshot/delete receipt used
+-- to build the client acknowledgement without allocating new pts or update facts.
+ALTER TABLE public.private_messages
+    ADD COLUMN sender_box_id integer NOT NULL DEFAULT 0 CHECK (sender_box_id >= 0),
+    ADD COLUMN sender_pts integer NOT NULL DEFAULT 0 CHECK (sender_pts >= 0),
+    ADD COLUMN recipient_box_id integer NOT NULL DEFAULT 0 CHECK (recipient_box_id >= 0),
+    ADD COLUMN recipient_pts integer NOT NULL DEFAULT 0 CHECK (recipient_pts >= 0);
+
+-- Keep zero defaults for writers released before this migration.  Zero is not
+-- a valid immutable receipt: when a row has a valid request fingerprint but a
+-- legacy writer omitted these columns, the new replay path fails fast instead
+-- of deriving the first response from mutable message_boxes.  New writers
+-- always persist positive sender receipt values before commit.