The client's direct WS connection to remote instances (via Connections) delivered DM events independently of S2S peering. Added activePeerOrigins allowlist to ready payload — all DM event handlers now silently drop events from non-home origins without an active peer. This prevents notifications, sounds, previews, typing indicators, calls, and channel updates from instances where peering was revoked or never established.