Event Ingest Flow

External systems can publish events directly to NATS, bypassing the HTTP API. The EventRouter durable consumer picks them up and routes them through the same dispatch pipeline as emit() — once the event row is written, an ingested event is indistinguishable from an emitted one.

The consumer is named and durable (event-router), filters ironflow.*.*.events.ingest.>, and uses explicit acks with a 30-second ack wait and MaxDeliver of 5 — one initial delivery plus four retries. Permanent errors are terminated immediately rather than retried: an unmarshal failure, a rejected event name (#1733), and a schema validation failure (#1951) all describe bytes that will never become valid, so redelivering them would only burn the five attempts before dead-lettering anyway. msg.Nak() negatively acknowledges transient errors and triggers immediate redelivery, ignoring AckWait. The 30-second wait applies when no acknowledgement arrives, so repeated transient failures can exhaust all five deliveries without a 30-second gap.

Reaching this path needs publish rights on the internal ironflow.> subject space, and no in-tree producer writes to events.ingest.> — it is an operator door, not an anonymous one. The event name still arrives unmarshaled straight off the wire, so it is bounds-checked here rather than relying on the deployment property.