S17/S18: send success and failure routes; Sphinx HTML/PDF

Python router + Go sm-leaf reject missing to, empty ct, plaintext body.
Summary logs never include ciphertext. MODULE.md.

MODULE.md

@@ -0,0 +1,40 @@
+# MODULE — secure-messaging
+
+Git: https://git.georgelambert.org/marchon/secure-messaging
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+sm-leaf (Go) and pfc-py-admin (Python sign/history).
+
+**Callers:** Console send, tests, systemd `pfc-sm-leaf`.
+
+## Messages — from / to
+
+- **From:** `verae.sm.send` envelopes (`to`, `from_lookup_id`, `alg`, `ct`).
+- **To:** Mailbox dest (clear); ack `lookup_id`. Failures → `verae.sm.error`, `verae.sm.dead`, `verae.sm.log.summary`.
+
+## Filters / security
+
+Missing `to`, empty `ct` (unless plain-lab), plaintext `body`, bad alg, summary `ct` field.
+
+## Errors and timeouts
+
+- **Errors:** Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.
+- **Timeouts:** NATS 5s; NPE seal 15s.
+
+## Where data is stored and how others use it
+
+Signed wrapper path; admin-history JSONL cube.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).