Operator compose verb behind the fleet ingress boundary

Context

Phase-2 successor of #15376, split out under the operator's tempo directive (2026-07-17: parked branches and draft PRs are not reviewable units — ship what's done, honestly). #15376's MailboxService half (the senderPrincipalClass write-stamp, the one-rule read projection, and the operator-steering delivery class with inverted wake defaults) is delivered and review-ready on PR #15378 with Resolves #15376; this ticket carries the remaining verb-side ACs, which ride the #15320 ingress boundary. The split mirrors the #15333 → #15339 honest-close-target precedent exactly.

The Problem

The rails now stamp and project principal classes, and the operator's delivery class exists — but nothing lets the authenticated cockpit COMPOSE. FLEET_WIRE_METHODS has no write verb: the operator still cannot write a peer or broadcast from FM, which is the uber-feature's remaining Brain-side inch.

The Architectural Reality

• The compose verb is the first non-read-observe, non-lifecycle verb on FLEET_WIRE_METHODS — a NEW write seam on FleetControlBridge.
• It rides #15320's boundary: dispatch executes inside RequestContextService.run() with the server-stamped viewer identity (Clio's launch contract, on-branch at e56bd1ea09: fail-closed viewer binding + bearer intake). The verb must never accept, forward, or default a caller-supplied sender identity — MailboxService.addMessage already resolves sender + principal class from the bound request context (merged in the #15378 half), so the verb passes NO identity at all.
• The operator-steering class then derives server-side from the stamped principal (#15378) — the verb does not (and cannot) select it.

The Fix

1. composeOperatorMessage (name final at implementation) on FLEET_WIRE_METHODS + FleetControlBridge: {to, subject, body, priority?, wakeSuppressed?, relatedTickets?} → MailboxService.addMessage under the request-context identity. Target: one identity, several, or AGENT:*.
2. Sender-smuggling negative: any caller-supplied from/sender-shaped field is ignored-or-rejected; the stored message's from + senderPrincipalClass come exclusively from the transport-bound identity.
3. The per-principal falsifier (D#15372 AC-2): two distinct principals through the same deployment produce two distinct server-stamped identities.

Contract Ledger

Acceptance Criteria

• AC-1: an authenticated operator composes to a named peer AND broadcasts AGENT:* against a live FM server; stored messages carry the server-stamped sender + senderPrincipalClass: 'human' (witnessed end-to-end, smuggling negative included).
• AC-2: the per-principal falsifier — two distinct principals, two distinct server-stamped identities.
• AC-6 (shared with #15377): the consumption-behavior record — send an authenticated operator broadcast, observe a consuming agent, record verbatim as D#15372's retained-half entry evidence.

Out of Scope

The MailboxService half (delivered: PR #15378 / #15376) · the compose/inbox UI (#15377, Grace) · the identity-firewall verified-operator tier (D#15372 retained half) · threads/envelopes/read-receipts.

Decision Record impact

none (composition on the merged #15378 stamp + the #15320 boundary; the retained half owns any future ADR).

Related

Predecessor: #15376 (MailboxService half, PR #15378) · Blocked-by: #15320 · Sibling: #15377 (Grace) · Parent: #13015 · D#15372 (graduated record).

Live latest-open sweep: latest 20 checked at 2026-07-17T18:00Z (latest #15377); no equivalent. A2A claim window scanned — no competing claim; Grace holds the #15377 sibling.

Origin Session ID: 64f444d3-1042-4091-a56f-08332b6cc7a2

Retrieval Hint: "operator compose verb fleet bridge server-stamped sender smuggling negative per-principal falsifier"