Function event_authenticates 

pub fn event_authenticates(event: &Event, channel: &Channel) -> bool

Does this wire event authenticate against the channel’s keys — now (open + MAC) or on a prior sight (dedup ledgers)? The outer created_at is otherwise unauthenticated relay input: sync cursors must only ever advance over events that pass this, or one junk event stamped far-future/past at the channel’s cleartext pseudonym wedges the session’s fetch floor/ceiling. Ledger hits skip decryption, so steady-state re-syncs stay cheap.

CAVEAT: the ledger half is keyed by event id, NOT channel-scoped — a relay replaying channel A’s real events into channel B’s page authenticates here. Cursor skew from that is bounded by genuinely-authored (signature-pinned) times, roughly equivalent to the relay’s existing withholding power; do not repurpose this as a channel-membership check.