Module inbound 

Inbound processing: turn a verified, opened Community message into a Message in STATE under its channel chat (→ app state). Pure conversion (build_message) is separated from the STATE mutation (ingest_message) so the conversion is unit-testable without any global state.

Enums

IncomingEvent

The result of processing an inbound wire event: a brand-new message (3300), an update to an existing message (a reaction 3301 / edit 3302 applied to its target), or a tombstone (a delete 3305 that removed its target). New/Updated surface as a UI message_new / message_update; Removed surfaces as a message_removed.

Functions

build_message

event_authenticates

Does this wire event authenticate against the channel’s keys — now (open + MAC) or on a prior sight (dedup ledgers)? The outer created_at is otherwise unauthenticated relay input: sync cursors must only ever advance over events that pass this, or one junk event stamped far-future/past at the channel’s cleartext pseudonym wedges the session’s fetch floor/ceiling. Ledger hits skip decryption, so steady-state re-syncs stay cheap.

ingest_message

Ingest a verified Community message into STATE under its channel chat, creating the chat (as ChatType::Community) if absent. Returns the added Message (so the caller can persist + emit it), or None if it was a duplicate (dedup on the inner message id).

process_channel_batch

Process a fetched batch of raw channel events (backfill / cold-start) in a SAFE order: messages (3300) first so a reaction/edit (3301/3302) finds its target already in STATE before its reference applies — relay return order is arbitrary, and a control event whose target hasn’t been ingested yet is silently dropped. Each event goes through process_incoming (open + verify + dedup), so undecryptable/forged/duplicate events yield nothing. Returns the applied events in processing order for the caller to persist + emit.

process_incoming

Open a single incoming wire event against channel, verify the binding, and apply it to STATE by sub-kind: a message is ingested, a reaction/edit is applied to its target. Events that fail to open (wrong key, splice, forged sig, bad version) or that dedup/target-miss are dropped (returns None). This is the per-event handler the real-time subscription routes each arriving 3300/3301/3302 event through.

route_incoming

Route an incoming wire event by its z pseudonym tag to the matching channel in routes, then open + ingest it. Returns the added Message, or None if the event carries no z tag, names a pseudonym we don’t route, or fails to open/dedup. Pure over the passed state + routes, so the routing is unit-testable without the live subscription loop.