WAX-SEAL W2 REPORT (todlando, 2026-08-23)

SHA: 8079987a on build/wax-seal-w2 (off 0244c5d2), worktree .worktrees/wax-seal-w1, pool claimed label wax-seal-w2 from the lane. One delivering commit, 20 files, +2413/-32; the five REQs ride it with their evidence.

DELIVERED (T0-T5 per the JIT + your rulings + operator ruling 8):
- Registry: REQ-SEAL-CEREMONY-TOTP / -CONTENT-SHOWN / -ESC-CANCEL / -NO-CEREMONY-SURFACE / -CEREMONY-RC-CLIENT, doc/impl/unit active. CONTENT-SHOWN amended BY REPLACEMENT in-lane to ruling 8: 500-scalar cap at the ceremony seam (named SEAL_CEREMONY_CONTENT_TOO_LONG, never truncated), scrolling overlay (content never shrinks), submit never gated on scroll, UTF-8-only (named SEAL_CEREMONY_CONTENT_NOT_UTF8).
- spt-store: seal_ceremony_gate_file() = trust/seal-ceremony-gate.json, its own file beside bring-up + empower.
- spt-net: SealCeremony / SealCeremonyCode / SealCeremonyResult additive variants + default-false seal_ceremony bit on Request (skip-serialized: pre-W2 wires byte-identical; N-1 decodes to undeclared).
- spt-daemon: KIND_SEAL_CEREMONY req/reply + Brain::seal_ceremony (requester blocks client-side; broker holds no timeout queue, no pending-mint state). Dispatch arm: empty/UTF-8/cap refusals at the seam -> seeds check -> session -> seat off the LIVE SEAT TABLE under the log lock (never the perch stamp; capability recorded on ControllerSink, stamped conn-keyed after the ladder so the ladder stays capability-blind). Ceremony open rides a new CtrlMsg::Ceremony arm down the controller writer (ordered, no cursor advance). Code arrival: honored only from the opening controller conn; both-seeds bitwise verify; throttle-before-verify on the seal ledger; refused counts + re-prompts; loud alert past third (ER-alert sibling); admitted mints under dispatch's SEAL_APPLY in the daemon process, minter = subnet:endpoint@os_hostname, ceremony_kind totp. Abort arms: Esc/cancel uncounted; controller detach (unsubscribe) and either conn's death abort, answering whoever remains.
- rc: top-half byte-emit overlay (DECSC/abs/DECRC, content verbatim + binding subnet named, per-frame sticky repaint), arrow-key scrolling with clamped window + off-screen indicator, shared fold_code_key grammar via a byte->KeyEvent bridge (lone-Esc cancels, escape SEQUENCES never cancel), ships the presented code only. Capability bit set true at the one rc establish site.

LEGS (captures at main root, exits read from their own .exit files):
- W2_clippy2: cargo clippy --workspace --all-targets, EXIT 0.
- W2_treqs2: traceable-reqs check, EXIT 0; all five REQs [OK] +doc +impl +unit.
- W2_nextest4: env-scrubbed cargo nextest run --workspace --no-fail-fast, EXIT 0, Summary 3161/3161 passed (1 slow, 10 leaky), 1 skipped.

CONDITIONS NAMED SEPARATELY:
1. ENV-RED PAIR: first sweep (W2_nextest.raw) red on daemon_stop_convoy_e2e + attach_wedge_e2e — both panics name DAEMON_STOP_REFUSED / $OWL_SESSION_ID (my live-agent perch env). Delta test W2_envdelta2: the same two tests GREEN with only OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID scrubbed, nothing else varied. All sweep verdicts above are env-scrubbed runs. The two rigs lack the identity-var scrub other broker-stop rigs carry — rig-hygiene candidate, not W2 scope.
2. LEAKED RIG DAEMONS: each full sweep left 4 daemons running FROM the worktree's target/debug/spt.exe (2x daemon run --detached + 2x brain), pinning the exe and failing later builds with os error 5. Reaped by exact path twice (8 total; installed-fleet processes untouched, verified by census before each kill). Pre-existing class; also a rig-hygiene candidate.
3. OVERSIZE ARM MOVED DAEMON-SIDE: ruling 8's cap/UTF-8 refusals are enforced at the broker seam, so the REQUESTER gets the named refusal directly; the rc client no longer refuses anything (my earlier flag (a) had proposed client-side). Unit boundary: 500 THREE-BYTE scalars pass the cap and land on the next arm (proves scalar counting), 501 refuse.
4. UNIT-TIER SCOPE: "ceremony round-trips over the attach machinery" is covered at unit tier as (a) wire round-trip of the triple (spt-net) and (b) a real-broker/real-PTY-session test where a capable seat receives the open push on its conn while all three no-surface arms refuse by name. The full push/code-up/result-down TWO-NODE leg is W3's int per dispatch.
5. UNCOVERED CONDITIONS, BY NAME (arms implemented, not unit-pinned): seal-ledger-unwritable refusal (needs an unwritable trust-dir rig) and no-hostname minter refusal. Neither was presented by any run.
6. INCIDENTAL TOUCHES: 9 daemon test files + engine_room_bringup_e2e.rs changed only for the new struct-literal fields / one added arg; no behavior edits there.

Gate rig is yours; the worktree + pool stay parked for the lane per dispatch. releases#19 gets its ESC-CANCEL satisfaction note at ship per the JIT.