Four items done. Narrow diff and resolved staging below.

PIN   d2/fp-driver-d2.sh  4229f9ac47e3f491b27f21df51543e2e439c196dff80ed9980c3ff2bbeda2b7a
DIFF  d2/fp-driver-d2-355e3e62-to-4229f9ac.diff (3 hunks, +26/-9)
STAGING d2/D2-STAGING-RESOLVED.md + D2-STAGING-MANIFEST.sha256 7a5f8381cc54ee6b11bb661d3be5b66a07b80bf13be18469d6c63cc7490fad6b, 32 entries, verified 32 OK 0 FAILED
355e3e62 preserved at d2/history/fp-driver-d2-355e3e62.sh; every predecessor of this lane now snapshotted with its own step diff.

1. EXACT WHOLE-LINE TOKENS. grep -qx -F against whole lines for PREPARED, NOT_STARTED, executable_sha256=<exact>, capture_sha256=<exact>, GO_AUTHORIZED. Hash fields matched ENTIRE, so a truncated or prefixed hash satisfies nothing. Nonce keeps its substring match deliberately - it is quoted inside a sentence the executor writes in its own words and is run-scoped.
   ONE THING I ADDED BECAUSE THE TIGHTENING NEEDED IT: CR is stripped before matching. The receipt is written by a Windows elevated leg, so its lines end CRLF, and a whole-line match against a line ending in CR matches NOTHING - the tightening would have refused every honest receipt. The positive controls now write CRLF receipts so that failure mode cannot hide.
   Request texts updated to match the checks: each token on a line of its own, and refuse IN WORDS - there is no negative token either check reads.

2. THE TWO MISLEADING-TOKEN CONTROLS, and only those two:
   p1 NOT_PREPARED does not satisfy PREPARED - refused, naming PREPARED.
   p2/p2b NOT_GO_AUTHORIZED does not open the window - refused, naming GO_AUTHORIZED.
   Positive controls unchanged and still green (both hashes accepted, GO with THIS nonce opens), now over CRLF receipts.

3. b2 NO LONGER ASSERTS AGAINST PROSE. It asserts the observable contract: PARTIAL, verdict PENDING, the remover's own exit preserved (t_rc=1, not laundered), no retry. A control pinned to a sentence needs re-pinning every time the sentence is narrowed and tests the wording rather than the behaviour - your point, and I removed it rather than re-pinning again.

4. FRESH HOME. H is now $SP/fp-home-d2-a2, attempt-specific. fp-home-d2 is PRESERVED as the retained failed run's evidence - not reused, not cleared - and measured PRESENT with 8 entries. fp-home-d2-a2 measured ABSENT. S0b's pre-existence refusal is KEPT unchanged and now bites on a prior attempt of this successor rather than on anyone else's evidence.

RESOLVED RUNTIME REFERENCES, every path the driver reaches at run time, measured now:
  EXE 72d30901... matches EXE_SHA | $BIN/d2_capture.ps1 a0e7afbe... matches the new CAPTURE_SHA | RULE_PROBE be016198... matches RULE_PROBE_SHA256 | TEARDOWN_B64_FILE 416280db... matches your reviewed pin | TEARDOWN_COMMAND_FILE 38e0f21b... carries that payload verbatim | H ABSENT | retained home PRESERVED.

CONTROLS ON 4229f9ac: go-and-silent 29/29, cleanup 50/50, declined-setup 16/16. Re-run because this change edits the code they cover, not a blanket rerun.

ONE HARNESS DEFECT, disclosed: my edit put an unterminated quote in the controls' disposition echo (a triple-quote terminator ate a character); the file failed to parse and I fixed it before reading any verdict.

PROCESS DISPOSITION: pwsh only in the fixture harnesses and the argument receiver; no host query, no rule read or written on this host, no elevation, no field execution, no kill, nothing signalled. Scratch dirs removed on exit.

Ready for your source review. todlando is holding to review against the accepted schedule + cleanup gate once you rule.