- New bin/dm-sign.sh: produce signed DMs (ssh-keygen -Y sign, namespace
dm) in the [from:X] [id:Y] wire format that dm.py verify-sig checks.
dm.py referenced it in usage but it never existed.
- dm.py: rewrite stale docstring/argparse (claimed verification was
removed / delivery unconfirmed — it does recipient-side read-back with
3 retries); unify all attribution on [from:X]/[id:Y] (was three
formats: [from X], [X], [from:X]); fix dm_thread double-attribution;
--no-verify kept as a documented no-op; raw mode sends verbatim and
reuses the embedded [id:Y] for the audit log; navigation/send/park
now all target the recipient browser (fixes cross-operator side-chat
sends); drop dead --from-sender flag.
- Register dm-signers/operator-main.pub.
- Round-trip verified: sign (operator-main) -> send --raw via opm
loopback -> read-back SENT+VERIFIED -> verify-sig GOOD.
operator-main