As part of cross-signing, devices for the master, self-signing and user-signing cross-signing keys are created and stored in the devices table.

These devices should not be getting to_device messages sent to them, as they will never be read by any client. It turns out that it is possible to have to_device messages aimed at them in the device_inbox table through the following:

1. Clients can directly send to_device messages to one of your cross-signing public keys. These happen to be the device IDs of these hidden devices. Synapse doesn't condition on the device being hidden, and so will accept them. It should be doing so here:

2. Clients often send to_device messages to all devices of a user, by specifying * as the target. Synapse will then create a to_device message for all devices of a user, including hidden ones:

These messages were never getting read, and thus piling up in the database forever. In my testing they didn't seem to be using that much space however. Upon removing them for all users on my homeserver and vacuuming the table, the size of device_inbox only went from 3420MB to 3410MB. Edit: I don't think this is accurate. After deleting over half the table in a different cleanup and REINDEX+VACUUMing I also only dropped after 10MB.

Initially presumed as a client-side issue, before we discovered Synapse was at fault: element-hq/element-web#15638

Related: #3599