What the sign-in found: "fresh" (no sessions restored), "resumed",
or "sessionsDiscarded" (a restored state was older than one already
seen, so its sessions were dropped and the identity kept). This head
has no sealed restore, so it reports the first two.
Look a username up in the tenant; the address to send to, or undefined.
Send to an address (user/device): bytes, or text encoded as UTF-8.
Fetch and decrypt what is waiting.
Inbound messages one at a time, as they arrive: receive flattened,
for for await (const m of client.inbound()). A message goes to
whichever loop is running, so run one per client. It ends only by
throwing.
The identity and live sessions, to persist and resume with
Tacenta.signInWithState. Keeping the same identity across runs is
what lets conversations continue.
The bytes carry private keys: keep them app-private and encrypted at rest (IndexedDB is neither on its own), store only the latest copy, and export again after every send and receive, since a restore of an older copy rewinds sessions.
A signed-in client: one user on one device.