Define supported conversation types, membership, message edits/deletes, attachments, read receipts, offline history, retention, and encryption requirements. Core entities include users, conversations, memberships, messages, and device synchronization cursors.

A message record can contain a stable message ID, conversation ID, sender ID, sequence or creation position, content metadata, and server acceptance time. Enforce membership authorization on both sending and reading; knowing a conversation ID must not grant access.

Use cursor pagination for history and define per-conversation ordering. Global order across unrelated conversations adds coordination without improving most user experiences. Separate durable message history from ephemeral presence and typing indicators.

Clients connect to WebSocket gateways that authenticate sessions and maintain connection state. A message submission is authorized, persisted, assigned an ordering position, and then distributed to connected recipients. For durability, acknowledge only after the chosen persistence boundary succeeds.

Gateways may publish recipient events through a broker so any gateway can deliver to its connected clients. Maintain a mapping from user/device to gateway, but treat it as transient and repairable. Reconnection should resume from a cursor rather than assume every push was received.

Use per-conversation partitioning where it helps preserve order and distribute load. Large group chats can create fan-out spikes; batch deliveries, apply backpressure, and distinguish accepted, persisted, delivered, and read states. These are different events and should not be conflated.

When a device reconnects, it presents its last acknowledged cursor and fetches missing messages. Push notifications can alert offline users but should avoid leaking sensitive content when privacy settings require generic previews. Deduplicate by message ID because reconnect and replay can repeat delivery.

Apply rate limits, membership checks, attachment scanning, abuse reporting, and retention controls. End-to-end encryption requires careful key lifecycle and device enrollment; it also limits server-side content inspection and search. Make these trade-offs explicit rather than treating encryption as a single toggle.

Scale gateways horizontally while planning connection counts, file descriptors, heartbeat traffic, memory per connection, and uneven room sizes. Monitor connection churn, delivery lag, reconnect success, message persistence latency, and per-partition skew.