We used to use the event type/content in raw() when processing push rules, which will lead to them trying to match our "unable to decrypt" private events. This is fixed by using cleartext part for events that are not yet decrypted or unable to decrypt.

Type: fix

Adapted from output of OpenCode (DeepSeek V4 Pro). tusooa reviewed the code and takes full responsibility.

Send an undecryptable event (e.g. first setting the trust level of the target device to Blocked) to kazv and verify you have received the notification (which matches the "m.room.encrypted" rule).