## Scope and root cause
HANDED-FILE #318 W5, based on landed W4 `96f4effb`; head `41b1f0299c957ee328d2781058b05eeb2a51b508`.

The shortform mint already receives the real admitted ceremony token. `record_shortform_outcome` reduced that reply to a success bit, persisted unit `SealMinted`, and now-signal could render only `seal minted`. Detached stdout is intentionally not the author's confirmation surface.

- Carry the actual admitted token in additive optional `DispatchResult.seal_token`; render `-> (seal): seal minted seal=<token>` in DISPATCH_RESULTS.
- Preserve the existing `"status":"seal_minted"` wire representation. Historical tokenless rows deserialize without removal; ordinal+timestamp seen identities remain stable, preventing replay of later unrelated dispatches. Historical rows still render honestly without a fabricated token.
- Keep refusal outcome vocabulary, standalone mint stdout/stderr, ceremony authority and verification unchanged. No latest-seal lookup, seal-list command, authorization expansion or cross-node trust change.
- Register/tag `REQ-SEAL-SHORTFORM-RESULT-TOKEN`; update the wax-seal guide and generated changelog.

## Regression and real CLI proof
The permanent integration rig runs a private staged **real spt binary, broker/brain and PTY controller**. It provisions a Closed subnet, declares the controller's ceremony capability, ingests a closed Unicode/multiline passage through `spt api state`, and withholds the real TOTP response until the hook process has exited. The broker actually admits the ceremony. The token comes **only from DISPATCH_RESULTS**, then actual `spt api seal verify` proves:
- exact content => `SEAL_BOUND`, exit 0;
- a substantively changed decision => `SEAL_NOT_BOUND`, nonzero;
- second same-session poll => no replay.

The same rig covers historical tokenless rows and an anchored no-surface refusal. A persisted-delta unit protects pre-upgrade row identities; the store mixed-stream regression protects historical decode and additive token roundtrip. The rig is now registered in both existing HEAVY filters because it explicitly hosts a real daemon/PTY.

### Red/green, without conflating setup failures
- `red-resume`: delta unit failed as intended; integration failed **before admission** because capture EOF waited until the controller's 60-second timeout. This is not the bug reproduction.
- Corrected the rig to observe the hook's process exit (`try_wait`, regular-file stderr), not inherited capture-pipe EOF. No production async change. `red-hook-exit` then reached real broker admission and failed specifically on missing `seal=` (nextest 100, 5.438s).
- Applied the token handoff fix only after that real red. Initial green: 8/8; related store/midturn: 8/8.
- Initial duplicate nextest test-thread flags were an invocation error. An earlier build was deliberately interrupted at the old CI-window cutoff before tests. Neither is claimed as a bug red. Doyle subsequently relaxed the runner-leg concurrency hold for this milestone.

## Final rebased Windows verification
At `41b1f029` on `96f4effb`:
- Targeted nextest: **16/16 passed**, 1420 outside-filter skips; real ceremony integration 4.375s (`final-tests.json/log`).
- `cargo clippy --locked --workspace --all-targets -j 2 -- -D warnings`: **pass** (`final-clippy`).
- Own `spt` + `xtask` build: **pass** (`final-build`).
- Own `xtask gen` / `xtask check`: **pass** (`final-gen`, `final-docs-check`). The first pre-rebase docs check correctly required HEAVY registration; both filters were updated and the gate passed.
- `traceable-reqs check`: **941/941 complete, zero findings** (`final-trace.json`).
- Raw commit footer audited: `Co-authored by: todlando`.

Final build artifact SHA256: `2e8a87ac73bba648b90db6d919a4c09c139215a8a78dc0093969d4d7c4d0b1a7`. This identifies the later final-build artifact; final-tests exercised the same commit before that build, not a claimed byte-identical test artifact. No Linux, physical FIDO2 gesture or fleet rollout proof is claimed.

## Chronology and cleanup
#223 covered the separate sealed-send arm (v0.63, Aug 25); shortform shipped afterward (v0.64, Aug 27). Together with the source information loss, this strongly supports an uncovered arm rather than a demonstrated regression of #223. The historical patch was unavailable, so this is not a commit-diff proof that it never worked.

Rebased from original W5 commit `66dc4032`; the sole conflict was adjacent W4/W5 requirement registrations, retaining both. One Cargo at a time, jobs 2, own claimed pool and private SPT_HOME/TEMP. Pool released successfully at 03:26:04Z. Final scoped process census empty; private runner home, temp fixtures and consumed runner script removed. Own target retained. No resident lifecycle, credentials, trust or firewall changes; no cargo fmt.

Receipts: `.spt/preserved/318/todlando-w5/`. Doyle owns independent gate and ff-only landing; this report does not claim CI or merge completion.

Closes BigscreenVR/spt-bs-releases#311
Refs BigscreenVR/spt-bs-releases#318