As fas as I know, the basic and most common cases are something like this:

1. X11: Grabbed keys, e.g. hotkey daemons or dmenu.
   
2. X11: Window that has input focus.
   
3. Terminal: Is a regular X11 client, first of all. Translates X11 key events into bytes that are fed into the master end of a pseudo terminal.
   
4. tmux: Reads from its pseudo terminal slave, has no idea about X11. Doesn't see "Ctrl" or "Alt", really, it's either an XOR 0x40 (for Ctrl) or a sequence (for Alt). tmux processes its own hotkeys and passes anything else on a second pseudo terminal master to the application (probably, haven't checked, but it wouldn't make a lot of sense otherwise).
   

As for the pseudo terminal stuff, eduterm might be interesting.

And then there is stuff like XInput2, which can just read everything, ignoring that hierarchy. Just run `xinput --test-xi2 --root`.

There's also XRecord, IIRC. (Maybe that's implemented via XInput2 these days, no idea.) Lots of ways to write key loggers on X11.