fix: sync scoped connection and outbox exclusion updates

deploy/migrations/0001_init.up.sql

@@ -2061,7 +2061,8 @@ CREATE TABLE public.dispatch_outbox (
     last_error text DEFAULT ''::text NOT NULL,
     created_at timestamp with time zone DEFAULT now() NOT NULL,
     updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT dispatch_outbox_status_check CHECK (((status)::text = ANY (ARRAY[('pending'::character varying)::text, ('dispatching'::character varying)::text, ('failed'::character varying)::text])))
+    CONSTRAINT dispatch_outbox_status_check CHECK (((status)::text = ANY (ARRAY[('pending'::character varying)::text, ('dispatching'::character varying)::text, ('failed'::character varying)::text]))),
+    CONSTRAINT dispatch_outbox_exclusion_pair_check CHECK ((((exclude_auth_key_id = 0) AND (exclude_session_id = 0)) OR ((exclude_auth_key_id <> 0) AND (exclude_session_id <> 0))))
 );
 
 

deploy/migrations/0082_dispatch_outbox_exclusion_pair.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE dispatch_outbox
+    DROP CONSTRAINT IF EXISTS dispatch_outbox_exclusion_pair_check;

deploy/migrations/0082_dispatch_outbox_exclusion_pair.up.sql

@@ -0,0 +1,33 @@
+-- Excluding the originating device requires the exact physical
+-- (raw auth_key_id, session_id) tuple. Install the guard first so no new
+-- half-pair can race the explicit cleanup of legacy invalid online tasks.
+DO $$
+BEGIN
+    -- Fresh databases already receive this constraint from 0001_init; upgraded
+    -- databases do not. Keep one migration stream valid for both shapes.
+    IF NOT EXISTS (
+        SELECT 1
+        FROM pg_constraint
+        WHERE conrelid = 'dispatch_outbox'::regclass
+          AND conname = 'dispatch_outbox_exclusion_pair_check'
+    ) THEN
+        ALTER TABLE dispatch_outbox
+            ADD CONSTRAINT dispatch_outbox_exclusion_pair_check
+            CHECK (
+                (exclude_auth_key_id = 0 AND exclude_session_id = 0)
+                OR
+                (exclude_auth_key_id <> 0 AND exclude_session_id <> 0)
+            ) NOT VALID;
+    END IF;
+END
+$$;
+
+-- dispatch_outbox is only an online delivery task queue. Its durable source
+-- remains user_update_events through the existing (target_user_id, pts) FK,
+-- and the delete trigger promotes the next per-user head. Missing tuple parts
+-- cannot be reconstructed safely, so remove rather than normalize bad rows.
+DELETE FROM dispatch_outbox
+WHERE (exclude_auth_key_id = 0) <> (exclude_session_id = 0);
+
+ALTER TABLE dispatch_outbox
+    VALIDATE CONSTRAINT dispatch_outbox_exclusion_pair_check;