@@ -25,9 +25,9 @@
 
 - 活性惰性半边在接管冲突时评估一次:Routine 座位查调度器 `last_fired` 与 `next_run`。
 - 会话座位查最近一条产出评论的时间戳;回收 = 改正文 + 审计评论。
-- 常设半边是总监席摘要的座位贴活性巡查,同一判据,细则见 `dispatch-runbook.md`。
 - 可跑读法:本车道 `pm:dispatched` 卡按 `updated_at` 降序一搜,或读最近一条认领评论。
 - 写侧刷新三时刻:派发、收班、暂停或交接前;时间戳恒取自 `scripts/pm/post-stamped.mjs`。
+- 帖与卡正文首行恒为署名 `LANE#N · ACCOUNT · SESSION`;缺即写工具拒发(`post-stamped.mjs` 头注)。
 - 刷新前回执敲门;`--body` 拦截:评论晚于末次戳 ⇒ `--ack-through=ID`;空座欠账无卡号 ⇒ 拒写。
 - 耐久状态只住正文或以 App 写入;正文守中继上限 60,000 字节,超大贴由半状态巡查浮出。
 - 协议升级迁移状态、或巡检发现正文不符时,当场改正文 + 审计评论。
 
@@ -1358,7 +1358,8 @@ export function signatureRefusal(body) {
   const lines = String(body ?? '').split(/\r?\n/);
   const at = firstNonBlankIndex(lines);
   const line = at < 0 ? '(the body is empty)' : lines[at].trim();
-  const near = at >= 0 && /·/u.test(line) && /\bsession_/u.test(line);
+  // A line naming a seat number AND a session id is a signature typed wrong — named as such, so the fix is the spelling.
+  const near = at >= 0 && /#[1-9]/u.test(line) && /\bsession_/u.test(line);
   return {
     line: line.length > 160 ? `${line.slice(0, 160)}…` : line,
     why: near
 
@@ -34,7 +34,13 @@
  *   - a repo not shaped `owner/name` (the default is the board the sweep
  *     tooling resolves, so a card never lands on a repo nobody named);
  *   - a body carrying `{{NOW}}` / `{{WAS:…}}` — those are `post-stamped.mjs`'s
- *     contract for comments and body EDITS; a new card is dated by the platform.
+ *     contract for comments and body EDITS; a new card is dated by the platform;
+ *   - a body whose first non-empty line is not the seat's signature,
+ *     `LANE#N · ACCOUNT · SESSION` (#27113) — read by `signatureRefusal`
+ *     (`check-half-states.mjs`, whose banner carries the shape and the ruling),
+ *     listed beside the token refusal when both apply. Every card this door
+ *     creates is seat-authored: the workflow-generated cards are written by
+ *     their workflows, never through here.
  *
  * ## The transport — `OS_FLEET_TRANSPORT` direct | dispatch | auto
  *
@@ -87,7 +93,7 @@ import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
 import { isEntrypoint } from '../invoked-as.mjs';
-import { EXIT_PREREQUISITE_NOT_MET, PROXY_FLAG, proxyRearmPlan, resolveSweepRepo } from './check-half-states.mjs';
+import { EXIT_PREREQUISITE_NOT_MET, PROXY_FLAG, SEAT_SIGNATURE_SHAPE, proxyRearmPlan, resolveSweepRepo, signatureRefusal } from './check-half-states.mjs';
 import { EXIT_UNCONFIRMED, exitForResult, matchRunAnnotations, packRequest, parseRelayAnnotation, relayAnnotationMessage, resolveRoute, sendFleetWrite, unconfirmedText } from './fleet-write/dispatch.mjs';
 import { refusalText as relayRefusalText } from './fleet-write/validate.mjs';
 import { classifyHttp } from './label-write.mjs';
@@ -200,7 +206,12 @@ export function planFrom(opts, { read = (p) => readFileSync(p, 'utf8'), env = pr
   if (body !== null) {
     body = String(body).replace(/\r\n/g, '\n').trim();
     if (!body) errors.push('the body is empty — a card names its evidence');
-    else if (STAMP_TOKEN.test(body)) errors.push('the body carries a {{NOW}} / {{WAS:…}} token — those are post-stamped.mjs\'s contract for comments; a new card is dated by the platform');
+    else {
+      if (STAMP_TOKEN.test(body)) errors.push('the body carries a {{NOW}} / {{WAS:…}} token — those are post-stamped.mjs\'s contract for comments; a new card is dated by the platform');
+      // The signature (#27113), judged beside the token rule so a body breaking both hears both.
+      const unsigned = signatureRefusal(body);
+      if (unsigned !== null) errors.push(`the body carries no signature line — ${unsigned.why}; its first line reads \`${unsigned.line}\`. Write ${SEAT_SIGNATURE_SHAPE} as the FIRST line; nothing inserts it for you`);
+    }
   }
 
   const labels = dedupe(opts.labels);
@@ -421,13 +432,14 @@ export async function relayMissProbe({ route, send, pace }) {
 const SELF_TEST_BATTERIES = Object.freeze({
   'the arguments: files not argv for prose, exactly one title source, a repo shape': 10,
   'the payload: title trimmed to one line, labels and assignees de-duplicated, nothing invented': 5,
+  "the signature: a card body opens with the seat's signature line, or the plan is refused before any request": 8,
   'the transport: a fake platform, and what each answer does to the exit code': 9,
   'dry-run: no request leaves, and the plan is printed': 3,
   'the wiring: both halves around the one POST, on the write verb only': 4,
   'the relay transport: ONE dispatch carrying the create, the card found by title since the dispatch, and an accepted dispatch with no run UNCONFIRMED under auto too — never the direct POST': 9,
   "the relay annotation: the number the relay run's annotation carries is read first — the card read back at it with NO list; absent, the title finds it as before; the read-back still judges the annotated card": 5,
 });
-const SELF_TEST_BATTERY_FLOOR = 7;
+const SELF_TEST_BATTERY_FLOOR = 8;
 const UNATTRIBUTED_BATTERY = '(unattributed)';
 
 const batteryCases = new Map();
@@ -450,7 +462,18 @@ export async function selfTest() {
   const { tmpdir } = await import('node:os');
   const { join } = await import('node:path');
 
-  const files = { 'title.txt': '  A card with `backticks` and $HOME in it \n', 'body.md': 'Evidence: a repro.\n\n- step one\n', 'empty.md': '   \n', 'stamped.md': 'Reading time {{NOW}}\n' };
+  // Every body a seat hands this door opens with the seat's signature (#27113), so the fixtures that must plan do too.
+  const SIG = 'domain:skills#2 · os-justin · session_01ABCDEFGHJKMNPQRSTVWXYZ';
+  const files = {
+    'title.txt': '  A card with `backticks` and $HOME in it \n',
+    'body.md': `${SIG}\nEvidence: a repro.\n\n- step one\n`,
+    'empty.md': '   \n',
+    'stamped.md': `${SIG}\nReading time {{NOW}}\n`,
+    'unsigned.md': 'Evidence: a repro.\n\n- step one\n',
+    'unsigned-stamped.md': 'Reading time {{NOW}}\n',
+    'near-miss.md': 'domain:skills#2 - os-justin - session_01ABCDEFGHJKMNPQRSTVWXYZ\nEvidence.\n',
+    'second-line.md': 'Evidence: a repro.\n\ndomain:skills#2 · os-justin · session_01ABCDEFGHJKMNPQRSTVWXYZ\n',
+  };
   const read = (p) => {
     if (!(p in files)) throw new Error('ENOENT');
     return files[p];
@@ -486,6 +509,32 @@ export async function selfTest() {
     t('a body carrying a stamp token is refused — that is post-stamped\'s contract', planFrom(parseArgs(['--title', 'x', '--body-file', 'stamped.md']), { read, env }).errors.some((e) => e.includes('{{NOW}}')));
   }
 
+  // ── the signature ─────────────────────────────────────────────────────────
+  battery('the signature: a card body opens with the seat\'s signature line, or the plan is refused before any request');
+  {
+    const plan = (file) => planFrom(parseArgs(['--title', 'x', '--body-file', file]), { read, env });
+    const unsigned = plan('unsigned.md');
+    t('an unsigned body is refused — the plan is not ok', unsigned.ok, false);
+    t('…and the refusal names the shape to write and the line it read', unsigned.errors.some((e) => e.includes('no signature line') && e.includes('LANE#N · ACCOUNT · SESSION') && e.includes('`Evidence: a repro.`')));
+    t('a signed body plans, and the signature is SENT as written — nothing stripped, nothing inserted', [plan('body.md').ok, plan('body.md').payload.body.split('\n')[0]], [true, SIG]);
+    t('a near miss (hyphens for the ` · ` separator) is refused, and named as one', plan('near-miss.md').errors.some((e) => e.includes('reads like a signature and is not one')));
+    t('⛔ a signature on a LATER line is not a signature: the first non-empty line decides', plan('second-line.md').ok, false);
+    const both = plan('unsigned-stamped.md').errors;
+    t('a body breaking BOTH rules hears both, in one refusal', [both.some((e) => e.includes('{{NOW}}')), both.some((e) => e.includes('no signature line'))], [true, true]);
+    t('an empty body is told it is empty, once — not also unsigned', plan('empty.md').errors.filter((e) => e.includes('body is empty') || e.includes('signature')).length, 1);
+    const dir2 = mkdtempSync(join(tmpdir(), 'issue-create-sig-'));
+    try {
+      writeFileSync(join(dir2, 'u.md'), 'A body.\n', 'utf8');
+      const cli = spawnSync(process.execPath, [SELF_PATH, '--dry-run', '--repo', 'o/r', '--title', 'Dry', '--body-file', join(dir2, 'u.md')], {
+        encoding: 'utf8',
+        env: { ...process.env, OS_PM_WRITE_PACE_FILE: join(dir2, 'pace.jsonl'), GITHUB_TOKEN: 'ghs_FixtureTokenNotRealAtAll0000000000000', GH_TOKEN: '', HTTPS_PROXY: '', https_proxy: '' },
+      });
+      t('⛔ the CLI refuses an unsigned body on a DRY RUN too — usage, nothing printed as sent, nothing paced', [cli.status, cli.stdout.includes('NOTHING was sent'), existsSync(join(dir2, 'pace.jsonl'))], [EXIT_USAGE, false, false], cli.stderr.slice(-300));
+    } finally {
+      rmSync(dir2, { recursive: true, force: true });
+    }
+  }
+
   const dir = mkdtempSync(join(tmpdir(), 'issue-create-'));
   try {
     // One pace file PER CASE: a stop marker one answer writes must not refuse
@@ -556,7 +605,7 @@ export async function selfTest() {
     // ── dry-run ─────────────────────────────────────────────────────────────
     battery('dry-run: no request leaves, and the plan is printed');
     {
-      writeFileSync(join(dir, 'b.md'), 'A body.\n', 'utf8');
+      writeFileSync(join(dir, 'b.md'), `${SIG}\nA body.\n`, 'utf8');
       const spawned = spawnSync(process.execPath, [SELF_PATH, '--dry-run', '--repo', 'o/r', '--title', 'Dry', '--body-file', join(dir, 'b.md')], {
         encoding: 'utf8',
         env: { ...process.env, OS_PM_WRITE_PACE_FILE: join(dir, 'dry-pace.jsonl'), GITHUB_TOKEN: TOKEN_FIXTURE, GH_TOKEN: '', HTTPS_PROXY: '', https_proxy: '' },
 
@@ -1563,7 +1563,7 @@ const SELF_TEST_BATTERIES = Object.freeze({
   'the remaining exits: refusal, mismatch, the ONE-OF block and the dry run': 5,
   'the CLI: what a typo must never be allowed to mean': 8,
   'the relay transport: ONE dispatch carrying the whole stroke, the same read-back, and an accepted dispatch with no run UNCONFIRMED under auto too — never a direct write': 14,
-  'the release: a silent claim reclaimed in ONE relay stroke — Release: comment → pm:queue on → pm:dispatched off → unassign — on the knock\'s SERVER-clock age, RELAY-ONLY, never a direct write': 30,
+  'the release: a silent claim reclaimed in ONE relay stroke — Release: comment → pm:queue on → pm:dispatched off → unassign — on the knock\'s SERVER-clock age, RELAY-ONLY, never a direct write': 32,
 });
 const SELF_TEST_BATTERY_FLOOR = 11;
 const UNATTRIBUTED_BATTERY = '(unattributed)';
@@ -1819,6 +1819,10 @@ export async function selfTest() {
       { op: 'unassign', issue: 7, assignees: ['os-tesla'] },
     ]);
     t('the release text is judged by the owning `Release:` reader on its FIRST line, and may not pre-write the resume line', [releaseTextRefusal(RELEASE_TEXT), typeof releaseTextRefusal('Released: x'), typeof releaseTextRefusal('note\nRelease: x'), typeof releaseTextRefusal('Release: x\nResume-from: a@b'), typeof releaseTextRefusal('')], [null, 'string', 'string', 'string', 'string']);
+    // One leading signature line (#27113) stands ABOVE the first-line key, never in its place.
+    const SIG = 'domain:skills#2 · os-justin · session_01ABCDEFGHJKMNPQRSTVWXYZ';
+    t('a signed knock reads by the key on the line after its signature; a key on a later line, or under a near-miss signature, still does not', [isRecheckComment(`${SIG}\nOwned-24h re-check: x`), isRecheckComment(`${SIG}\n\n## Owned-24h re-check: x`), isRecheckComment(`${SIG}\nTriage\nOwned-24h re-check: x`), isRecheckComment('domain:skills#2 - os-justin - session_01ABCDEFGHJKMNPQRSTVWXYZ\nOwned-24h re-check: x')], [true, true, false, false]);
+    t('…and a signed release text is judged by its `Release:` line: accepted signed as unsigned, refused when no `Release:` line follows the signature', [releaseTextRefusal(`${SIG}\n${RELEASE_TEXT}`) === releaseTextRefusal(RELEASE_TEXT), typeof releaseTextRefusal(`${SIG}\nnote\nRelease: x`)], [true, 'string']);
 
     // The fixture card the protocol names, younger than the clock.
     const young = await driveRelease(RELEASE_ARGV, silentCard(5));
 
@@ -932,7 +932,9 @@
 
 import process from 'node:process';
 import { spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isEntrypoint } from '../invoked-as.mjs';
 import {
@@ -4067,8 +4069,9 @@ const SELF_TEST_BATTERIES = Object.freeze({
   'the decision facets: a decision analysis carries its marker, and a delta, a record or a quotation is not one': 22,
   'the relay transport: the same act as one op, the comment found on the board, the exit register kept apart': 13,
   "the size route: over the relay's body cap under auto THIS write goes direct with one line naming bytes, cap and identity; at or under it the relay; explicit dispatch refuses naming the bytes; nothing else re-routes": 13,
+  'the signature: every body opens with LANE#N · ACCOUNT · SESSION or is refused, beside the stamp contract; one leading signature changes no reading': 11,
 });
-const SELF_TEST_BATTERY_FLOOR = 17;
+const SELF_TEST_BATTERY_FLOOR = 18;
 const UNATTRIBUTED_BATTERY = '(unattributed)';
 
 let selfTestReachedVerdict = false;
@@ -5521,6 +5524,40 @@ export function selfTest() {
     t('⛔ the proxy re-exec at the entrypoint is UNCONDITIONAL — a dry run resolves the route, which is a read, so it re-execs too', entrySource.includes('rearmThroughProxy(process.argv.slice(2))') && /--dry-run'\)\s*\?\s*null\s*:\s*rearmThroughProxy/.test(entrySource) === false);
   }
 
+  // ── the signature (#27113) ─────────────────────────────────────────────────
+  battery('the signature: every body opens with LANE#N · ACCOUNT · SESSION or is refused, beside the stamp contract; one leading signature changes no reading');
+  {
+    const SIG = 'domain:skills#2 · os-justin · session_01QSeKYmhU5KEj1nukYhp1Tg';
+    t('a signed body has no refusal row; an unsigned one has one naming the line it read', signatureRefusal(`${SIG}\nbody`) === null && signatureRefusal('Hello\nbody')?.line === 'Hello');
+    t('the refusal text prints the shape to write and says nothing was written', signatureRefusalText(signatureRefusal('Hello'), { tool: 'post-stamped' }).includes('LANE#N · ACCOUNT · SESSION') && signatureRefusalText(signatureRefusal('Hello'), { tool: 'post-stamped' }).includes('Nothing was written'));
+    t('⛔ the positional stamp rule still reads the ACT\'s line: a bare stamp on the claim line under a signature is refused', kinds(`${SIG}\nClaim: seat 2026-09-10T06:37Z`, NOW_MS).join() === 'positional');
+    t('…and `{{NOW}}` there is accepted, the signature sent as written above it', renderBody(`${SIG}\nClaim: seat {{NOW}}`, NOW_MS).ok && renderBody(`${SIG}\nClaim: seat {{NOW}}`, NOW_MS).body.split('\n')[0] === SIG);
+    const PLAIN = ['Decision record: who lands the gate', '', '- **A**: the seat lands it', '- **B**: the maintainer lands it', '', 'This seat recommends **A**.'].join('\n');
+    t('a decision analysis framed on its plain OPENING line is refused unsigned and signed alike — the frame is the line after the signature', decisionFacetRefusals(PLAIN).length === 1 && decisionFacetRefusals(`${SIG}\n${PLAIN}`).length === 1);
+    const dir = mkdtempSync(join(tmpdir(), 'post-stamped-sig-'));
+    try {
+      const run = (args, body) => {
+        writeFileSync(join(dir, 'b.md'), body, 'utf8');
+        return spawnSync(process.execPath, [SELF_PATH, ...args, `--file=${join(dir, 'b.md')}`], { encoding: 'utf8', env: { ...process.env, HTTPS_PROXY: '', https_proxy: '', GITHUB_TOKEN: '', GH_TOKEN: '' } });
+      };
+      const comment = run(['--dry-run', '--comment=1', '--repo=o/r'], 'Hello {{NOW}}\n');
+      t('⭐ the CLI refuses an unsigned COMMENT on a dry run: exit 2, the signature refusal on stderr, nothing on stdout', comment.status === EXIT_REFUSED && comment.stderr.includes('opens with no signature line') && comment.stdout === '');
+      const body = run(['--dry-run', '--body=1', '--repo=o/r'], '**This post is the single authoritative registration.**\n');
+      t('⭐ …and an unsigned card BODY too — both modes, the seat post above all', body.status === EXIT_REFUSED && body.stderr.includes('opens with no signature line'));
+      const both = run(['--dry-run', '--comment=1', '--repo=o/r'], 'Claim: seat 2026-09-10T06:37Z\n');
+      t('a body breaking the stamp contract AND unsigned hears BOTH, under one exit', both.status === EXIT_REFUSED && both.stderr.includes('stamp-contract problem') && both.stderr.includes('opens with no signature line'));
+      const empty = run(['--dry-run', '--comment=1', '--repo=o/r'], '  \n');
+      t('an empty body is told it is empty, once — not also unsigned', empty.status === EXIT_REFUSED && empty.stderr.includes('the body is empty') && !empty.stderr.includes('signature'));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+    // The slice the size-route battery takes: main, up to the self-test's banner.
+    const ownText = readFileSync(SELF_PATH, 'utf8');
+    const mainSource = ownText.slice(ownText.indexOf('async function main(argv)'), ownText.indexOf('// --self-test — offline'));
+    t('structural: the signature is judged on BOTH modes, before the keyed lines and before the route is resolved', /const unsigned = rendered\.kind === 'empty' \? null : signatureRefusal\(input\);/u.test(mainSource) && mainSource.indexOf('signatureRefusal(input)') < mainSource.indexOf('claimKeyedLineRefusals(') && mainSource.indexOf('signatureRefusal(input)') < mainSource.indexOf('await resolveRoute('));
+    t('the usage says it, with the shape', USAGE.includes('signature') && USAGE.includes(SEAT_SIGNATURE_SHAPE));
+  }
+
   // The floor, evaluated last: a battery that stops running names itself here.
   const failed = cases.filter((c) => !c.ok);
   for (const c of cases) console.log(`  ${c.ok ? '✓' : '✗'} ${c.name}`);