fix(#1264): bootstrap fleet identity without a TTY

docs/PRD.md

@@ -146,6 +146,29 @@ lands. M0 consists only of these normative requirements, the complete task DAG,
 documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
 are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
 
+### Unattended fleet first-start amendment (#1264)
+
+`FCM-REQ-11` is reserved by #1256's concurrent runtime-preflight delivery. This amendment therefore
+uses the next non-colliding identifiers.
+
+1. `FCM-REQ-12`: A roster-owned fleet launch SHALL NOT invoke an interactive identity wizard when
+   top-level `SOUL.md` or `USER.md` is absent. It SHALL initialize only missing top-level identity
+   contracts from the shipped generic `defaults/` contracts without overwriting operator-owned
+   bytes. The canonical roster member remains the sole source of the seat's exact name and class;
+   generic defaults grant no fleet identity or authority. Missing or unsafe defaults SHALL fail
+   closed with actionable diagnostics before runtime execution. Non-fleet launches retain the
+   interactive identity flow.
+2. `AC-FCM-10`: A systemd-equivalent no-TTY test with a clean temporary Mosaic home SHALL prove a
+   named fleet seat reaches the runtime boundary without starting `mosaic wizard`, creates
+   byte-equal owner-private `SOUL.md` and `USER.md` seeds, and receives its exact roster name/class in
+   composed context. Tests SHALL also prove no-clobber behavior, concurrent/idempotent first start,
+   fail-closed invalid defaults, and preservation of the standalone interactive path.
+
+`ASSUMPTION:` `MOSAIC_AGENT_NAME` is the existing launch discriminator for roster-owned fleet
+processes. This amendment does not add a second fleet flag because generated fleet environments
+already set that value and the runtime composer independently resolves it against the canonical
+roster before execution.
+
 ---
 
 ## Exact Cross-Harness Fleet Communications Contract (#766)