Narrow correction done, with the control that would have caught it.

SUCCESSOR d2/fp-driver-d2.sh e093e80dcf41247e0a855408661092602709131bdf34b44c072b41d81ac6575b
DIFF      d2/fp-driver-d2-2fd7d689-to-e093e80d.diff dd8eb2ff... - ONE hunk: the PREPARED instruction text. THE REDIRECT GUARD IS UNTOUCHED.
CONTROLS  d2/rig-d2/handoff-text-controls.sh 5b73f17c... -> .out 05023b36..., 15/15
MANIFEST  d2/D2-STAGING-MANIFEST.sha256 41a935e0d498ecbcc1fcc82c1b2d967906263eba6ba50fd5dbe4286a38a66d01, 40 entries, 40 OK 0 FAILED
2fd7d689 preserved at d2/history/fp-driver-d2-2fd7d689.sh with its receipts.

THE FIX is phrasing only: "executable_sha256= followed by the sha256 you measure of $EXE" instead of the bracketed placeholder, same for capture_sha256, plus a line in the text itself saying the brackets are absent DELIBERATELY and why - so the next person to improve the wording meets the reason before the guard does.

THE NEW CONTROL runs the SUBJECT'S OWN handoff_request against the SUBJECT'S OWN request texts, lifted from their call sites, in an isolated fixture. It never executes the command text - the text is written into a request file and read back as text.
  A the PREPARED text: generated not refused; request artifact exists; receipt path is the one the driver will later read; audience: the elevated executor; elevation REQUIRED; its own nonce present; run_exactly block written for a human.
  B the GO text: generated not refused; audience: doyle (the DRI); elevation NOT_REQUIRED; carries MUST NOT ANSWER for the executor; receipt path correct.
  C NEGATIVE CONTROL: the PREDECESSOR's bracketed text put to the same real guard is REFUSED with "redirect in its command text", and the reason is confirmed to be the angle bracket. Plus c3: the guard is still present in the subject, unaltered - this successor edits the TEXT, never the refusal.
  Without C this harness could not see the defect that halted the run; that is the whole point of it.

THE CLOSED ATTEMPT, native: run 20260913T070453Z, DRIVER_EXIT=1, ledger CLEANUP=PENDING, D2_T1=UNAVAILABLE ("the seq-001 request named the elevated capture and it did not run; the contract is NOT satisfied and no conclusion may rest on that observation"). Last passing gate: the 07:07:04Z pre-setup absence census (rules=1001 ctl_5470=1 ctl_sptexe=7 subj_group=0 subj_29470=0 valid=YES). Handoff directory EMPTY - no request, no receipt, no nonce ever issued. Evidence preserved at .../fp-run/20260913T070453Z. fp-home-d2-a2 still absent; fp-home-d2 untouched at 8 entries.
  Note on the PENDING: it is the correct verdict for a refusal-before-anything - VERIFIED was never available because nothing was created - not a report of residue. The residue scans found no process of this run was ever dispatched.

No accumulated battery rerun: only the new handoff-text controls ran. No host query, no elevation, no fresh PREP launch, and I am not requesting one - the next grant is yours to shape.