Status, both checkpoints answered. Integration IMPLEMENTED and controls GREEN 37/37. Nothing blocked. Full receipt next; these are the measured numbers.

SUCCESSOR PIN (frozen)  d2/fp-driver-d2.sh  bb4171924ca921dce6a53f5b5969fafc29bfacdf9ba61474a6361f6503717cbd
PREDECESSOR snapshotted d2/history/fp-driver-d2-bafed7a7.sh  bafed7a7... (byte-identical to the frozen field driver before any edit)
DIFF d2/fp-driver-d2-bafed7a7-to-bb417192.diff  bfef425f... (6 hunks, 201 added, 25 removed)
CONTROLS d2/rig-d2/cleanup-controls.sh bf78d738... -> cleanup-controls.out ad9a12d2..., 37/37
NEW INSTRUMENTS d2/rule-probe.ps1 1e007cdc... (independent per-name per-store reading), d2/teardown-command.pinned 38e0f21b... (the product's emitted line, verbatim)

PIN VERIFIED AGAINST YOUR REVIEWED PAYLOAD, independently: the base64 inside the captured stderr hashes to 416280dbece2601203c74c3f8e2c46e13009125fa5870166894e079329fb1d43 and is byte-identical to d3/decoded-todlando/d3-payload.b64. The driver pins the REVIEWED file and requires the payload INSIDE the dispatchable literal to equal it byte for byte, so nothing is composed and an unreviewed payload cannot ride inside a well-formed line.

IMPLEMENTED
1. REQUIRED BEFORE GO. teardown_pin_verify pre-go runs in preparation; failure dies BEFORE go(), so the window never opens and nothing is created. A run that cannot remove what it would create does not start.
2. VERIFIED AGAIN BEFORE USE. teardown_pin_verify pre-dispatch immediately before the handoff; the pre-GO reading cannot speak for bytes dispatched later.
3. NATIVE EXIT PRESERVED. Unchanged: teardown receipt exit captured into TEARDOWN_RC, written to exits.txt and the ledger; the new rule-probe exit is recorded the same way (rule_probe_post_EXIT=N).
4. INDEPENDENT POST-REMOVAL CHECK. New removal_check runs the pinned rule-probe: each owned NAME by InstanceID in ActiveStore AND PersistentStore, per-store positive and negative controls in the same sample. Outcomes named separately: CONFIRMED / PARTIAL / ACTIVESTORE_RESIDUE / FAILED / UNREADABLE_{NO_PROBE,PROBE_UNPINNED,PROBE_EXIT_n,CONTROLS,INCOMPLETE,STATE}. VERIFIED now requires CONFIRMED in addition to the four old conditions; everything else is PENDING, and PENDING issues NO retry and NO second dispatch.
5. IT REMOVES RULES ONLY. Stated at the pin, in the dispatch record and in the request text itself: it stops no listener and removes no process. The listener/process disposition stays the separate observation-gated question.

CONTROLS, all harmless - pwsh is STUBBED so rule-probe.ps1 never runs and no host query is made; what is exercised is the DECISION on a probe result, which is where this defect class lives.
  A NEVER-STARTED SETUP (your priority): branch not entered, HANDOFFS=0, TEARDOWN_DISPATCH stays NOT_REACHED, no VERIFIED verdict available on that path.
  B REMOVAL FAILURE AFTER ONE SUCCESSFUL DELETION (your priority): one name ABSENT, the other PRESENT -> PARTIAL, recorded as open admission rather than partial success, and HANDOFFS=0 (no retry).
  C ActiveStore residue (persistent gone, live rule present) -> ACTIVESTORE_RESIDUE, named separately so a reader cannot call it clean.
  D instrument soundness, five arms: dead controls, nonzero probe exit, incomplete readings, unresolved name, unpinned probe -> all UNREADABLE_*, never CONFIRMED.
  E POSITIVE CONTROL: four ABSENT with controls alive -> CONFIRMED (without it every arm above could come from a function that never says CONFIRMED).
  F six pin arms incl. a well-formed literal carrying UNREVIEWED bytes -> refused.
  G dispatch gate: refusal withholds and is recorded as a REFUSAL TO ACT; the accepted path dispatches exactly once and the dispatched body is the pinned literal byte for byte.
  H combined verdict needs CONFIRMED too.
  I NEGATIVE CONTROL, the discriminating case: a FALSE SELF-REPORT (receipt exit 0, census clean, product LAN_FIREWALL_CLEAN) with an owned name still present. The PREDECESSOR's own conjunction, quoted from its bytes, says VERIFIED; the successor says PENDING. The predecessor has no independent post-removal reading at all. Injected, not field-observed - and it is the only case the two differ on, which I would rather state than overclaim.

ONE DEFECT THE CONTROLS FOUND IN MY OWN CODE, fixed and re-run: `grep -c ... || echo 0` appends a SECOND zero line, so the counter held two lines and every numeric test errored - control d1 read PARTIAL where the answer was UNREADABLE_CONTROLS. Fixed at all nine sites; the mechanism is now a comment at the site.

ALSO DISCLOSED: while editing I truncated d2/_part_main.sh to zero with a bad edit script (it opened the file for write before computing the new content). RECOVERED byte-exact from the assembled driver and PROVEN so by reassembly - the reassembled output differed from the pinned predecessor ONLY in my intended hunks, with no diff anywhere in that fragment's region. The edit helper now computes before it opens.

Process disposition for this lane: the controls started no process but their own shell, ran no pwsh, made no host query, signalled nothing, and removed their scratch dir on exit. No field run, elevation, host query or process kill. D2 GO still requires your word; this is the instrument, not a run.