# WAX-SEAL W4 — todlando lane JIT (2026-08-24, doyle dispatch ~02:30)

## ✅ COMPLETE 2026-08-24 ~02:45 — head 145f3dff pushed, report SENT:doyle
Three commits (ce09a4e2 docs / bdf90881 CONTEXT / 145f3dff rigs), all legs exit 0
(treqs 821/821, gen drift-clean, clippy 0, daemon_unit 880/880 both rigs real-duration
PASS), warm W1-pool window claimed→used→released, 4 leaked rig daemons reaped by path,
IR-52 rider not triggered. Awaiting doyle's W4 verdict + milestone gate. Detail:
W4-REPORT-DOYLE.md.

Branch `build/wax-seal-w4` on 035c3fe6, worktree `.worktrees/wax-seal-w4`. Combined W2+W3
verdict: PASS-PENDING-CLIMB (twohost red = rig defect IR-29 2nd face → hertz; doyle re-climbs).

DISK REGIME: 24GB free at lane start (was 63GB at W3 report — doyle's gate run growth). NO cold
test pool. xtask-only narrow build OK. spt-daemon test legs run in the BIG warm pool (W1
worktree's target) sequentially after doyle's re-climb — or a window he hands me. Doyle messaged
this plan at lane start; no objection yet.

## Tasks (doyle's five)

- **T1 docs** (commit 1): NEW `docs-site/src/messaging/wax-seal.md` (user surface: mint /
  send --seal / verify / describe walkthrough, ceremony UX incl. 500-scalar cap + scrolling +
  Esc, subnet-binding rule in user terms, seal= on the receiving side) + SUMMARY.md nav +
  `messaging/overview.md` seal= attr statement (sender-authored class, survives strip, adapter
  MUST surface — trust-warning's obligation class; citation never authorization) + monics.md
  author-fields enumeration gains the seal token. Doc tags on the real sections. Then
  `xtask gen` + git diff = drift green (narrow xtask build only).
- **T2 CONTEXT.md** (commit 2): completeness over intake rulings 1-8. Missing: ruling 6 (no
  expiry/no revoke, newer seal supersedes) and ruling 7's verify/describe contract detail;
  FIDO2 deferral note (→ releases#217 SIGNET; overlay ships without `E`); `;;…;;` shortform
  deferral note in BOTH wax-seal entry-points para and IO-parser entry. Amend by replacement.
  Refresh tag parentheticals (1077/1078) in place.
- **T3 unit rigs** (commit 3): two arms in `crates/spt-daemon/src/broker.rs` tests, after
  `the_seal_gate_counts_throttles_first_cancels_free_and_mints_on_admit`:
  1. ledger-unwritable: occupy `seal_ceremony_gate_file()` path with a DIRECTORY (cross-platform
     unwritable, no ACL fragility), present the CORRECT member code → REFUSED "attempt ledger
     could not be written", store empty, ceremony ended. `[unit->REQ-SEAL-CEREMONY-TOTP]`
  2. unreadable-node-key: write garbage to `perch::node_key_file()` (exists+unparseable →
     NodeIdError::Corrupt), correct code → gate ADMITS, mint arm REFUSES "identity key could
     not be read", store empty, ledger reset to 0 (proves refusal came from the MINT arm, not
     the gate). `[unit->REQ-SEAL-CEREMONY-TOTP]`
  Aim each red at ONE arm, assert siblings intact. RUN deferred to warm-pool window.
- **T4 IR-52 rider**: docs work touches NO generator code (seal family already renders 2-deep
  at 035c3fe6: `## spt seal`, `### spt seal mint`, `### spt api seal`) → rider STAYS OPEN,
  state so in report + register stays untouched by me.
- **T5 REQ housekeeping**: doc tags ride T1/T2 commits; ESC-CANCEL toml comment already cites
  releases#19 ("Satisfies releases#19 — record on that issue at ship"; ship comment is doyle's).
  `traceable-reqs check` after tag edits (standalone, no cargo).

## Legs (all captured `> X.raw; echo $? > X.exit`, capture-first, verdict tokens up top)

W4_treqs (any time) · W4_gen + git diff (after T1, xtask narrow) · W4_clippy + W4_daemon_unit
(warm pool window ONLY — nextest, never bare cargo test; prebuild fixture bins if pool cold—it
is not, it is doyle's warm full pool).

## Report to doyle

Shas per commit, legs table, rider decision (open), condition: unit legs' pool provenance
(warm takeover window), any CONTEXT clauses he should re-review (ruling 6/7 additions are new
glossary text = design-surface, flag for his read).