Disabling an environment in the mobile app only closed its connection. The
relay kept sending that environment's alerts and activity cards, and the
Android receiver shows them without JS.

The device registration now carries the environments disabled on that phone.
The mobile app re-registers whenever the catalog's disabled set changes, even
during an in-flight registration. The relay hides those rows from that
device's card and skips their alerts, rechecking current preferences when a
queued delivery runs. Re-enabling replays the card silently as the new
baseline. Older app builds omit the field and keep today's behavior.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…nabled deliveries

Review found three gaps in the per-device environment filter. Queued iOS
Live Activity jobs kept the aggregate they were built with, so an older job
could put a just-disabled environment back on the card. After re-enabling, an
event that reached the phone before the silent replay compared against a
baseline that never had that environment's rows, so old approvals alerted.
Foreground priming read an unfiltered snapshot, and the fresh-card grace kept
a card that only had hidden work.

Each delivery baseline now records the environments it hid, and rows from
those environments are not treated as new transitions. Queued iOS jobs carry
the filter they were built under and are skipped when it no longer matches;
the registration replay supersedes them. The snapshot endpoint takes an
optional deviceId and applies that device's filter, and the grace period only
covers cards with no work at all, not work the device hides.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…seline

…ds are off

…ilent after re-enable

A notification-only Android job decides its alert when consumed. If the
re-enable replay was consumed first, it cleared the device's hidden list and
left no baseline, so an approval queued while the environment was hidden then
alerted. Jobs now record whether their environment was hidden on that device
when queued, and such jobs never alert, matching iOS, which decides at enqueue.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…gle lands last

Preference updates and the notification-permission refresh registered outside
the queue, so a registration holding an older environment snapshot could reach
the relay after a newer toggle and restore its filter. Every device
registration now takes a per-account lock and reads the catalog and
preferences only once it holds it. A preference override stays applied to
later registrations for that account, because Settings saves it only after its
registration finishes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

An approval queued while an environment was enabled could still alert after
the user disabled and re-enabled it, if the re-enable replay was consumed
first. The job-level hidden flag only covered jobs queued while hidden. The
device row now records when each environment was re-enabled, and a
notification-only job queued before that time stays silent, like the
replay baseline that activity cards already use. Other environments'
pending alerts and later events are unaffected. Entries expire with the
five-minute job lifetime.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…log reads

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tion

Android alerts queued before an environment was re-enabled could still
fire when no delivery reached the phone while it was hidden, and a real
event queued right after the re-enable stayed silent until a later
delivery recorded the reveal. The device registration now records when
each environment leaves the disabled list, in the same upsert that saves
the new preferences, so delivery workers only read it. Entries expire
with the five-minute job lifetime.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…regressions

Each removed row failed only on mutations a kept row also catches.

AI-assisted; verified with the tests and tools listed above.

The iOS hidden baseline skipped every row from an environment the last card
hid, so an approval requested after the environment was re-enabled (but before
the registration replay landed) was delivered without its alert. Rows from a
previously hidden environment now count as new when they changed after the
device's persisted re-enable time, matching the Android filter.

AI-assisted; verified with the tests and tools listed above.

…nments

A queued Live Activity update was skipped whenever the device's disabled
environment set changed at all, so disabling or re-enabling an unrelated
environment dropped a pending approval alert for one that stayed enabled; the
silent registration replay never re-sent it. A queued card is now skipped only
when it shows an environment the device now hides, or when it was filtered for
a re-enabled environment and carries no alert, in which case the replay
repaints it.

AI-assisted; verified with the tests and tools listed above.