fix(#1264): preserve portable standalone launch

docs/DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md

@@ -16,8 +16,8 @@ The fix remains at `checkSoul()` and does not add flags to `yolo`, fleet command
 
 1. A present, nonblank, whitespace-exact `MOSAIC_AGENT_NAME` selects the fleet path.
 2. `resolveFleetIdentity()` must resolve that exact member through the existing roster/helper
-   boundary, and any ambient `MOSAIC_AGENT_CLASS` must canonicalize to the roster class, before any
-   identity seed.
+   boundary, and any defined `MOSAIC_AGENT_CLASS` (including blank/whitespace) must canonicalize to
+   the roster class, before any identity seed. Only undefined means absent.
 3. `lstatSync()` preflights every destination directory entry without following links, so a dangling
    link is rejected before its counterpart can be published.
 4. Safe bounded snapshots are read from only the missing contracts under `defaults/`.
@@ -26,10 +26,12 @@ The fix remains at `checkSoul()` and does not add flags to `yolo`, fleet command
    concurrent seat or operator won; the existing path is preserved and revalidated.
 7. Temporary files are removed, and both installed contracts are re-opened through the no-symlink
    secure-file reader before launch continues.
-8. `composeContract()` independently re-resolves the roster, securely reads `USER.md` through a
-   descriptor at the point of use, and injects exact member identity and communications data.
+8. `composeContract()` independently re-resolves the roster, securely reads fleet `USER.md` through
+   a Linux descriptor at the point of use, and injects exact member identity and communications data.
 
-A standalone launch with no `MOSAIC_AGENT_NAME` retains the interactive wizard.
+A standalone launch with no `MOSAIC_AGENT_NAME` retains the portable tolerant USER read and the
+interactive wizard. Fleet-only no-follow enforcement must not make supported standalone macOS
+composition depend on Linux `/proc` descriptor traversal.
 
 ## Identity and authority
 
@@ -42,9 +44,9 @@ not the source of a fleet seat's identity. The canonical roster controls:
 - tmux socket and helper target; and
 - communications generation.
 
-An unknown/padded ambient name or mismatched ambient class fails before any file is seeded. This
-avoids replacing the interactive wall with a fleet of indistinguishable or ambiently invented
-identities.
+An unknown/padded ambient name, mismatched class, or explicitly blank/whitespace class fails before
+any file is seeded. This avoids replacing the interactive wall with a fleet of indistinguishable or
+ambiently invented identities.
 
 ## Concurrency and filesystem properties
 
@@ -64,8 +66,9 @@ no-TTY subprocess, not a direct wizard test. The package `test:vitest` gate buil
 Vitest, while the clean-checkout command builds its workspace dependencies first, so ignored
 `dist/cli.js` cannot be absent or stale. A fake lease launcher records whether execution reached the
 runtime boundary and captures the composed prompt.
-Positive and negative cases prove the check can both proceed and refuse. Composition coverage also
-replaces a previously validated `USER.md` with an external symlink and proves point-of-use refusal.
+Positive and negative cases prove the check can both proceed and refuse. Fleet composition coverage
+replaces a previously validated `USER.md` with an external symlink and proves point-of-use refusal;
+a standalone unreadable-optional-USER case proves the portable tolerant branch remains separate.
 
 Real Pi authentication and provider task execution remain environment tests, not claims of this
 fixture.