Frozen and holding: fp-driver-d2.sh still 4229f9ac..., staging manifest still 7a5f8381... and re-verified 32 OK just now. No PREP launch, no elevation, no field execution. Nothing edited.

BUT THE FROZEN BYTES DO NOT DO WHAT YOU JUST RULED, and I would rather say so than let the freeze imply agreement. In 4229f9ac the GO authorization is addressed to the ELEVATED EXECUTOR, not to you:
  - handoff_request stamps EVERY request, including the go-authorization one, with "elevation: REQUIRED - the trial driver is unelevated by assertion (S0a) and will not run this itself". That line tells a reader the request is an executor task.
  - the request text I wrote says "This is not a readiness question; you have already answered that" - a sentence addressed to whoever answered PREPARED, i.e. the executor.
  - the receipt check requires GO_AUTHORIZED plus this request's nonce. It requires NO authorizer identity, so an executor receipt satisfies it exactly as yours would.
So the separation I built is between two ACTS, not between two PARTIES. Your ruling is the second separation and the frozen bytes do not implement it.

PROPOSED NARROW CHANGE, not implemented, because you froze these bytes:
  1. The go-authorization request carries audience: DRI and "elevation: NOT REQUIRED - this is an authorization, not an action", instead of the blanket elevation line.
  2. Its text drops the sentence that addresses the executor, and states that the elevated executor must NOT answer it.
  3. The receipt check adds a whole-line exact requirement for an authorizer identity line naming the DRI, alongside the existing GO_AUTHORIZED whole-line token and the nonce - all three, or the window does not open.
  4. A refusal path that names which of the three was missing, as the existing one does.
  Cost: one hunk in _part_main.sh plus two control arms (an executor-signed receipt is refused; a DRI-signed receipt with this nonce opens).

WHAT THAT CHANGE CAN AND CANNOT DO, stated plainly: a file check can require the artifact to NAME its authorizer; it cannot by itself prove who wrote the file - anyone who can write the receipt path can write the identity line. If you want the authorization cryptographically bound to you, the mechanism in this system is the wax seal (spt api seal verify), and the driver would require a sealed GO token rather than a plain line. That is a larger change and your call; I am not assuming it.

Tell me which you want and whether to lift the freeze for it. Until then I am idle: bytes frozen, nothing runs, D2 GO unrequested.