All three blockers corrected, controls green. One of them was a LIVE DEFECT, measured - reporting that first.

BLOCKER 2 WAS REAL AND THE PROBE COULD NEVER HAVE CONFIRMED ANYTHING. Measured on this box with a harmless receiver:
  pwsh -NoProfile -File x.ps1 -Names "A","B"   -> names_count=1, name[0]=[A,B]   (the two joined into ONE string)
  pwsh -NoProfile -File x.ps1 -Names "A" "B"   -> names_count=1, and the stray token binds to the NEXT parameter
So the driver's -Names "$RULE_TAILNET","$RULE_LAN" delivered ONE bogus name; the probe would have produced 2 readings instead of 4 and removal_check would have answered UNREADABLE_INCOMPLETE forever. Fail-safe in direction, but a check that can never CONFIRM is not a check. Fixed: the probe takes ONE delimited token plus -ExpectNames, splits it itself, and REFUSES (exit 7, RULEPROBE_ARGS_REFUSED) when the parsed count is not what the caller expected - a binding regression is now a refusal, not a smaller sample. Verified through -File: parsed=2, both names intact, -Stores untouched.

BLOCKER 1. PREPARED now verifies BOTH measured hashes - executable AND capture script (CAPTURE_SHA a0e7afbe..., the script the elevated leg also runs and the source of every document this run reasons about) - and readiness NO LONGER opens the window. A SEPARATE handoff asks for a GO authorization carrying its own nonce, and the receipt must quote that nonce back; go() runs only after that verifies. Recorded: PREPARED_IS_NOT_AUTHORIZATION, then GO_AUTHORIZED_VERIFIED nonce=...

BLOCKER 3. The LAN_FIREWALL_CLEAN requirement is GONE from the teardown check - not replaced by a marker I invent. MEASURED WHY: the reviewed remover, run against a fixture, succeeds and prints NOTHING (emitted_lines=0) while both rules disappear from both stores. Requiring that marker made a successful removal unverifiable. What remains required: the remover's native exit, a successful census, and the independent per-name/per-store absence reading. The token survives only in the source-fact header and in the SETUP leg's emission census, neither of which gates a removal.

PROSE NARROWED as you required, in the probe header and in both driver records: ActiveStore PRESENT means a rule object with that InstanceID is in that store at this instant - it does NOT establish that traffic is being admitted (admission depends on the rule's own fields and every other rule and policy, none of which the probe reads). And a partial reading does NOT by itself establish that any invocation removed anything without the preceding state and the action record.

PINS  successor d2/fp-driver-d2.sh 355e3e620d969e6b74cb572fd4c10f8457246dd60078225d2b81307a611b1b81
      99df52c3 PRESERVED at d2/history/fp-driver-d2-99df52c3.sh, its receipts untouched
      DIFF d2/fp-driver-d2-99df52c3-to-355e3e62.diff a0e34a55... (8 hunks, +54/-13)
      probe d2/rule-probe.ps1 be016198...

NATIVE CONTROL OUTCOMES on 355e3e62
  d2/rig-d2/go-and-silent-controls.sh 2bc81814... -> .out 7e8771a9..., 26/26
    M readiness-without-GO: no GO token -> window does not open; GO with the WRONG nonce -> does not open; no receipt -> does not open; PREPARED missing capture_sha256 -> refused naming it; POSITIVE CONTROLS: both hashes accepted, and GO with THIS nonce DOES open (else the arms above would pass on a driver that never starts).
    N argument delivery: 2 distinct names arrive intact, -Stores intact, and the subject's own invocation line is the form under test. Two NEGATIVE CONTROLS reproduce the old collapse.
    O silent success through the actual teardown consumer: remover succeeds silently, probe reads CONFIRMED, the subject's own conjunction (quoted from its bytes) gives VERIFIED. NEGATIVE CONTROL: the 99df52c3 conjunction required the marker, so the SAME silent success reads PENDING there.
  d2/rig-d2/cleanup-controls.out 1b9fc34a... 50/50 and declined-setup-controls.out 4e9b8336... 16/16 - re-run because this change edits the code they cover, not a blanket rerun. The partial-failure and never-started RESULTS stay bound to their subjects; these are the same controls re-measured on the new pin.

HARNESS DEFECTS OF MINE, disclosed: the argument receiver initially had the old parameter surface so N measured a binding error rather than the boundary; o5 asserted the token's absence ANYWHERE rather than the teardown check's dependence on it; n8 asserted a specific victim parameter and was measuring its own declaration order; b2 asserted the pre-narrowing sentence. All four corrected, and b2 now asserts the NARROWED claim instead of the overclaim it replaced.

PROCESS DISPOSITION: five pwsh processes across the controls (three argument-receiver forms, two fixture harnesses), all shadowing or querying nothing; no host query, no rule read or written on this host, no elevation, no field execution, no kill, nothing signalled. Scratch dirs removed on exit.

Diff ready for source review. todlando says he is holding and will review the successor against the accepted schedule + cleanup gate - I will ping him once you have ruled.