In its sealed state, the DE partition is marked as the 'active' partition in the partition table. Thus, the first time the computer boots from the hard disk it will boot the DE partition, not the Windows partition.
(Note to self: it doesn't seem to matter whether the partition-type byte is 06h, 0Eh or DEh.)
At boot time, config.sys automatically launches seal.exe. Since this is launched directly from config.sys, no autoexec.bat file is needed. Support files for seal.exe include seal.ini and a small collection of files in the c:\dell directory, including the following graphic bitmap images. Seal.exe first displays this graphic about the Dell EULA, then displays this graphic for desktops or this graphic for laptops. The white area in the middle is superimposed with the Dell Service Tag and Express Service Code. (Note to reader: USA versions are shown here.) Believe it or not, the characters for the Service Tag and Express Service Code are cut-and-pasted from this font graphic. (Shades of the rub-on transfer letters we used as kids!) The Service Tag is not read from the hardware itself, but from the seal.ini file, so is only as reliable as that text file. The Express Service Code is not read from anywhere, it is calculated from the Service Tag. Change the Service Tag in seal.ini and a new Express Service Code is generated.
(Note to self: the delldiag.exe utility doesn't appear to use seal.ini and queries the hardware to get the real Service Tag.)

Next, the batch file copyup.bat is run, replacing config.sys (and autoexec.bat, if it exists) by copying them from config.up and autoexec.up (think: "Utility Partition"). The computer is now 'unsealed', and on subsequent boots of the DE partition these replacement files will run delldiag.exe instead of seal.exe. Note this means seal.exe is run only once, and thereafter booting the partition will always run delldiag.exe.

Seal.exe modifies the partition table, setting the partition-type byte to DEh (if it wasn't already) and changing the active boot flag to the next partition (which should be the main OS partition), and then the computer proceeds to boot the main partition.
(Note to self: Experimental results seem to suggest seal.exe fiddles with the MBR boot code while it's doing all this--specifically, I noticed 33h at offset 01h in the MBR sector changed to 80h, but afterward it was changed back to 33h. Also, does seal.exe require DE to be first partition on disk, or listed first in partition table?)

For the record, the file config.bts (think: "Break The Seal") is a duplicate of the sealed version of config.sys. The sealed state can be restored by copying config.bts to config.sys and resetting the DE partition as active. (Note to reader: this doesn't return the Windows partition back to its original state, though.)

Warning: If your computer is equipped with a Dell PC-Restore partition, that function expects to find the config.bts file in the DE partition so that it can return the computer to a sealed state following a restore of the operating system.