MLS state at rest on a TPM-less host must land on disk under the software-sealed seed, not in memory (#676 follow-up)

[emooreatx]

Depends on the persist issue filed alongside; surface the custody class from open_mls_state, keep ephemeral() for no-seed only, fix the FSD wording.

[emooreatx]

Target shape corrected to persist's ruling (#920 writeup, 2026-09-26). Not a new seed file — that would be a third root on software hosts, where persist keeps its software masters as persisted keys (ContentMasterSource::SoftwareFallback, federation_content_master with key_kind='software'), per FSD/BLOB_ENCRYPTION_AT_REST.md §4.3/§10.2 ("a software fallback that is honest about being software"). On a software host open_mls_state will derive the MLS-state key from the persisted content software master under MLS_STATE_CONTEXT (MLS state is content at rest) and return the custody kind; HardwareCustodyUnavailable stays only for §11.7 (a row recorded hardware-rooted whose seed is unreachable). Lands in persist v50 (one MAJOR with #919/#916/#917).

Edge's change, restated for that shape:

• mls::scope_state::open_mls_state returns the store and its custody kind (hardware / software, from persist's descriptor); the boot ReaddressReport carries it; a software open logs one line by name.
• ScopeStateProvider::ephemeral() stays as the no-store fallback only (persist refused: §11.7), documented as such to the host.
• FSD/MLS_STATE_AT_REST.md §0/§5: two custody kinds, both durable on disk; one refusal. S2 becomes: on a TPM-less host open_mls_state opens on disk with kind software; only the §11.7 case refuses — the current witness (which accepted either posture) is replaced by two named ones.
• CIRISServer#630 already told to treat today's refusal as temporary; after v50 + this, no host wires in-memory for lack of a TPM.

Adopts with edge's v33.0.0 (persist v50).

[emooreatx]

Signature note from persist (#920 locked for v50.0.0): the opener must read the content-master row to resolve the root (hardware seed where present, else the persisted software content master), so it becomes an Engine-level entry, not a bare path opener — exact name in the v50 notice. Edge's mls::scope_state::open_mls_state(path) therefore changes shape in v33.0.0 (takes the engine handle the bridge already holds, plus the path), and the host's call changes with it. S2 asserts the software branch derives from the content master, not an on-disk seed; ephemeral() only on the §11.7 refusal; the identity seed is not a root.

[emooreatx]

Shipped in v33.0.0: open_mls_state wraps persist's Engine::open_mls_state (#920) and returns (ScopeStateProvider, MlsStateCustody); on a TPM-less host the store opens ON DISK with custody kind Software (witnessed); ephemeral() only on persist's §11.7 refusal; FSD updated.