verify: DID signing-key cache backed by zat's DidResolver (PLC url configurable — the simulator serves DID docs itself); commit signatures checked via zat.verifyCommitCar. signature mismatch evicts the key, re-resolves once (rotation), and drops the event if still bad (new drop reason invalid_signature); resolution failure passes unverified and counts. #identity events evict the cached key. upstream runs full Sync 1.1 (MST-diff verify, per-DID rev chains, getRepo resync, per-DID worker pool) — those are tracked TODOs in verify.zig's doc comment. cursor: last seen upstream seq persisted to <data-dir>/cursor (tmp+fsync+rename, 5s interval) and loaded at startup, so restarts resume instead of re-tailing live. flags: --plc, --data-dir, --no-verify. verified against the simulator: e2e suite green with verification on, zero invalid-signature drops on honest traffic, restart resumes from the persisted cursor. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>