Function delete_by_id 

pub async fn delete_by_id(
    pool: &Pool,
    id: i64,
    caller_agent_instance_hierarchy: &str,
) -> Result<DeleteOutcome, Error>

Atomically soft-delete the message_queue row with the given id (flips active = FALSE) and return its reconstructed shape — but only when caller_agent_instance_hierarchy is the row’s sender or an ancestor of it. The authorization decision happens inside the transaction, before the flip, so an unauthorized attempt leaves the row untouched.

The row + its message_queue_contents children survive in the table for audit purposes even on delete — they’re invisible to readers via active = FALSE.