Function check_wan_envelope 

pub fn check_wan_envelope(
    carried: &WanCarried<'_>,
    row_source_agent: &str,
    polled_agent_id: &str,
    now_secs: i64,
) -> Result<(), WanCheckFailure>

The checks that need no directory record, in the §2.3 order: the envelope binding, then freshness. row_source_agent is the cloud row’s source_agent; polled_agent_id is the agent the subscriber is delivering to — not a row field, so a cloud can’t move a message signed for one agent into another’s queue.