@@ -1355,12 +1355,35 @@ jobs:
       # the throttle would simply stop throttling — which is the shape
       # `check:self-test-wired` requires this step for.
       #
-      # Its last battery is the wiring: the five write transports each call both
+      # Its last battery is the wiring: the seven write transports each call both
       # halves, and the roster IS the set of files under scripts/pm that issue a
-      # write verb, so a SIXTH write path cannot land unpaced.
+      # write verb, so an EIGHTH write path cannot land unpaced. Two batteries
+      # run REAL child processes: the lease that keeps one write in flight
+      # fleet-wide, and the batch gap one process announces and two others obey,
+      # are claims about separate processes and are measured on separate
+      # processes, by their timestamps.
       - name: Write-pace throttle self-test
         run: pnpm check:pm-write-pace
 
+      # The fleet identity and the two doors — same family, same split. The
+      # minter's LIVE path is a POST to the platform signed with a private key,
+      # so the offline half is all CI can hold: a throwaway RSA pair, a fake
+      # platform through every branch, and the assertion that matters most — a
+      # known token and a known key fed through every output path and grepped
+      # out of ALL of them. The card-creation door and the shell wrapper both
+      # pin their wiring into the throttle above; the wrapper's self-test reads a
+      # fixture cache in place of the platform and proves what git sees (the
+      # bot as committer, no token in any remote or config file, a credential
+      # helper reached from the environment alone).
+      - name: Fleet token minter self-test
+        run: pnpm check:pm-fleet-token
+
+      - name: Issue-create door self-test
+        run: pnpm check:pm-issue-create
+
+      - name: with-fleet wrapper self-test
+        run: pnpm check:pm-with-fleet
+
       - name: Stamped-post helper self-test
         run: pnpm check:pm-post-stamped
 
 
@@ -413,6 +413,13 @@ and posts a `Release:` line. Findings are filed unassigned; assign at the moment
 maintainer's own work under the shared account carries no claim comment and is indistinguishable
 from a dispatch — an accepted blind spot; per-seat identities are not introduced.
 
+**Every GitHub write leaves through `scripts/pm/`, as `objectstack-fleet[bot]`, behind the shared write
+gate.** `fleet-token.mjs` mints the App token from `OS_FLEET_APP_ID` / `OS_FLEET_INSTALLATION_ID` /
+`OS_FLEET_PRIVATE_KEY`; `write-pace.mjs` serialises and spaces every write verb fleet-wide; `issue-create`,
+`label-write`, `post-stamped` and `close-cards` own their writes; `with-fleet.sh -- <command…>` runs anything
+else behind the gate (`--read` for reads). ⛔ Never a bare `curl` / `fetch` / `gh api -X POST|PATCH|PUT|DELETE`
+write; never a token in a remote URL, a `git config` value on disk or a log line. Each header is the authority.
+
 **State on your PR that you did not set belongs to another actor — ask, never "correct"
 it.** Under one shared identity every other participant's write arrives unsigned: the PM
 flipping your draft to ready and arming auto-merge, a bot re-labelling, the platform
 
@@ -88,6 +88,9 @@
     "check:pm-closed-card-sweep": "node scripts/pm/sweep-closed-cards.mjs --self-test",
     "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-write-pace": "node scripts/pm/write-pace.mjs --self-test",
+    "check:pm-fleet-token": "node scripts/pm/fleet-token.mjs --self-test",
+    "check:pm-issue-create": "node scripts/pm/issue-create.mjs --self-test",
+    "check:pm-with-fleet": "bash scripts/pm/with-fleet.sh --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",
     "check:pm-close-cards": "node scripts/pm/close-cards.mjs --self-test",
 
@@ -1495,7 +1495,17 @@ export const CEILINGS = new Map([
   // standing letter-C ruling 5716260390 left unruled when it named the text.
   // AGENTS.md is not a CROSS_FILE_MOVES destination, so no `ruledRaises` record
   // applies. Landed count, headroom 0, same convention.
-  ['AGENTS.md', 1109],
+  //
+  // 1109 → 1116 (card #19641, PR #19642): the six-line rule that every GitHub
+  // write leaves through scripts/pm/ as the fleet's App identity, behind the
+  // shared write gate — bought by CONTENT (a rule with no prior spelling
+  // anywhere in the file), after the paragraph was first compressed from
+  // sixteen lines to six. Maintainer ruling, verbatim and untranslated:
+  // 「同意 A（推荐）」 — the maintainer's live instruction to the desktop session
+  // that raised it, recorded on #19641 comment 5771401251 together with the
+  // option A text it accepted (raise to 1116, ruling quoted in the PR body).
+  // Landed count, headroom 0, same convention.
+  ['AGENTS.md', 1116],
   // #9965: root CLAUDE.md is the other repo-root instruction file — same read
   // path (every seat session), same governance (Prime Directive #14). It is
   // structurally growth-prone in the way the ratchet is built for: it exists to
 
@@ -141,7 +141,7 @@ import {
   resolveSweepRepo,
 } from './check-half-states.mjs';
 import { classifyHttp, parseOptions as parseLabelWriteOptions, runLabelWrite } from './label-write.mjs';
-import { isWriteMethod, noteResponse, paceWrite } from './write-pace.mjs';
+import { isWriteMethod, noteResponse, paceWrite, releaseWriteLease } from './write-pace.mjs';
 import {
   EXIT_NOT_STORED as POST_STAMPED_EXIT_NOT_STORED,
   STAMP_TOKEN,
@@ -455,6 +455,7 @@ async function rest(path, { method = 'GET', body = null } = {}) {
       ...(body ? { body: JSON.stringify(body) } : {}),
     });
   } catch (e) {
+    if (paced) releaseWriteLease(); // ⏱ rule ④: no response will come, so the fleet's turn ends here
     return { status: 0, rateRemaining: null, json: null, detail: e?.message ?? 'fetch threw', call: `${method} ${path}` };
   }
   const rateRemaining = res.headers.get('x-ratelimit-remaining');
 
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# fleet-git-credential.sh — the git credential helper `with-fleet.sh` hands git
+# through the ENVIRONMENT, so a push can act as the fleet's App identity with
+# nothing on disk: no token in a remote URL, no `git config` value in any file,
+# and `git remote -v` unchanged.
+#
+#   printf 'protocol=https\nhost=github.com\n' | GITHUB_TOKEN=… fleet-git-credential.sh get
+#     → username=x-access-token
+#       password=…
+#
+# git calls it as `<helper> get` with the request on stdin. It answers ONLY for
+# github.com (and its subdomains), ONLY for `get`, and ONLY when `GITHUB_TOKEN`
+# is set — every other case prints nothing, which git reads as "this helper has
+# no opinion" and moves on. `store` and `erase` are ignored on purpose: a token
+# that lives fifty-five minutes has nothing to store and nothing to erase.
+#
+# ⛔ The token is read from the environment at the moment git asks and is
+# written to stdout for git alone. It appears in no argument, no file and no
+# log line of this script.
+
+set -euo pipefail
+
+op="${1:-get}"
+[[ "$op" == get ]] || exit 0
+
+host=''
+while IFS= read -r line; do
+  case "$line" in
+    host=*) host="${line#host=}" ;;
+  esac
+done
+
+case "$host" in
+  github.com | *.github.com) ;;
+  *) exit 0 ;;
+esac
+
+[[ -n "${GITHUB_TOKEN:-}" ]] || exit 0
+
+printf 'username=x-access-token\npassword=%s\n' "$GITHUB_TOKEN"