S17/S18: send success and failure routes; Sphinx HTML/PDF

Python router + Go sm-leaf reject missing to, empty ct, plaintext body.
Summary logs never include ciphertext. MODULE.md.

tests/test_sm.py

@@ -89,5 +89,43 @@ class HistoryTests(unittest.TestCase):
                 h.append_change(actor="", prev_text="", new_text="x")
 
 
+class RouterTests(unittest.TestCase):
+    def test_good_passthrough(self):
+        from secure_messaging.envelope import seal
+        from secure_messaging.router import handle_send
+
+        env = seal(to="npe.inbox.abc", sender="alice", body={"note": "hello"}, mode="lab-xor", lab_key=b"lab")
+        r = handle_send(json.dumps(env.wire()).encode())
+        self.assertTrue(r.accepted)
+        self.assertEqual(r.ack()["lookup_id"], env.from_lookup_id)
+        self.assertNotIn("ct", r.ack())
+        self.assertEqual(r.events, [])
+
+    def test_missing_to_failure_path(self):
+        from secure_messaging.router import handle_send
+        from secure_messaging.error_bundle import open_sender, open_system
+
+        r = handle_send(b'{"alg":"lab-xor","ct":"ab","from_lookup_id":"lid-x"}')
+        self.assertFalse(r.accepted)
+        self.assertEqual(r.error_code, "SM-MISSING-TO")
+        subjects = [e["subject"] for e in r.events]
+        self.assertEqual(subjects, ["verae.sm.log.summary", "verae.sm.error", "verae.sm.dead"])
+        summary = r.events[0]["body"]
+        self.assertNotIn("ct", summary)
+        self.assertNotIn("detail", summary)
+        s = open_sender(r.bundle, b"sender-pub")
+        sysb = open_system(r.bundle, b"system-pub")
+        self.assertEqual(s["error_code"], "SM-MISSING-TO")
+        self.assertNotIn("note", sysb)
+
+    def test_empty_ct_and_plaintext_body(self):
+        from secure_messaging.router import handle_send
+
+        r = handle_send(b'{"to":"npe.inbox.x","alg":"lab-xor","ct":""}')
+        self.assertEqual(r.error_code, "SM-EMPTY-CT")
+        r2 = handle_send(b'{"to":"npe.inbox.x","alg":"lab-xor","ct":"ab","body":{"secret":1}}')
+        self.assertEqual(r2.error_code, "SM-PLAINTEXT-BODY")
+
+
 if __name__ == "__main__":
     unittest.main()