hertz -> doyle. INTEGRATED DIFF, RESOLVED PINS AND CONTROL PLAN — all three, together, before any control runs. Records in .spt/preserved/hertz-fp-driver-review/d2/: fp-driver-d2-r2.sh 67913bd653667ca7ae19a41df4dd9be713fe1b0c1177a0fe50a1f04f78899e7a provision-rig.sh 7add2d4ad9be0419d2e18bcd1a6121d9ac19a02c401407d912331b9b4b450bae fp-driver-d2-r1-to-r2.diff bc4dc32410b57d5a7c013caf53fc6e1fe5fec46625a6058ab7838a77f92ae827 R2-PINS-AND-CONTROL-PLAN.md pins + the plan, in full e093e80d is untouched and hash-verified as an INPUT on every build. NOTHING HAS RUN: no control, no provisioning, no signing, no key generation, no apply, no daemon, no host query, no field action. Parsing is not behavioural verification and I claim none. THE DIFF: 25 hunks, +483/-51. The successor is BUILT, not edited — three anchored builders read the frozen file, assert its sha256 first, and assert every anchor matches EXACTLY ONCE, so a drifted anchor fails the build instead of landing a partial edit. WHAT IS IN IT. bounded() as the single enforced bound, with OUT/ERR as parameters because record tees to stdout (IR-123's shape); the bound is deadline-now-KILL_GRACE so TERM+KILL completes BY the deadline and a step that cannot cover the grace is NOT STARTED. Every host-touching child now runs under it: both portfields probes, both censuses, the identity capture, both D1 stages, and the captures. The launch register distinguishes kind=wrapper from kind=native (msys pid mapped to WINPID via ps, then ONE bounded child query while the wrapper is still alive — after timeout returns there is no parent edge left), and a child that exited before registration is ATTRIBUTION_INCOMPLETE, never CONFIRMED_GONE. measure_termination re-queries by pid PLUS creation instant. I withdrew the :895 clause claiming a survivor is counted BY CONSTRUCTION via -IsolatedHome on its command line — that is the predicate the r10 residuals defeated. Deadline instants EXP/REPORT/WORK plus PREP_DEADLINE, with one cur_deadline() so a probe called from three phases cannot re-grant itself the wrong budget. Handoff cap 120s and its expiry path: no kill, no second nonce, no post-mutation readings, straight to cleanup. t1/t2 validation deferred to the reporting window beside t3's. R6 computed once at cleanup entry and gating ALL THREE mutations — listener stop, teardown, daemon stop — with PROVEN requiring nonce, exactly one exit= record, a parseable setup-return stamp and TS_ORDER=OK, where a NONZERO exit is a COMPLETED outcome. The ledger gets the reserved 30s and prints outstanding identities rather than waiting on them. Capture 69b8506a pinned with all five exit meanings written out. S0b inverted: the home is no longer created-and-refused-if-present but VERIFIED and CONSUMED — atomic mkdir of .consumed (test-then-create leaves a window), provenance fields, bytes measured HERE rather than taken from the record, canonical path comparison, and the applied-state EVIDENCE required to exist and name the version. Binder equality is NOT there: it is a post-setup question, as you ruled. ONE DEFECT I CAUGHT IN MY OWN CODE, reported because the mechanism recurs: I wrote a withholding message that QUOTED the autostarting stop verb in backticks inside a double-quoted string — which in bash is command substitution, so the refusal-to-act line would have EXECUTED the very command it was refusing to issue. bash -n does not see it. Fixed in the builder and re-built from frozen; the successor now has zero backticks outside comments, audited. THE ONE PRODUCT COUPLING, stated rather than hidden: spt update has no local-stage verb (Apply, Fetch - GitHub origin only - and Adapters). A rig-signed set cannot be staged through a verb, so provision-rig.sh places release.json and artifacts/.bin in the cache layout (relcache.rs:35-50, :266-283). That is a PLACEMENT, not a trust decision: the product re-verifies those bytes twice, at apply and at the gate, under the home's own policy. The applied record is never written by the rig — it polls for a genuine Applied, reports AppliedPending and RolledBack as themselves, and refuses rather than writing one. The coupling is to the cache's on-disk layout; if those constants move, this step moves with them. UNRESOLVED PINS, each a refusal to start rather than a default: RIG_ROOT (nothing provisioned); SET_FILE/SET_SHA/SET_VERSION (no signed set exists — signing authority not granted, and nothing here mints one); TRUST_KEY_ID/TRUST_KEY_HEX (no key generated — not granted); FLEET_EXE (the installed binary's path, needed so it can be refused BY NAME, and reading it is a host query I have no grant for — one command, or todlando's answer). Resolved: capture 69b8506a, validator fe950722 unmodified, EXE_SHA 72d30901, teardown 416280db, the rule/port/control constants, 600/300/180 unchanged, 30/5/120 new, HOST_TRIPLE x86_64-pc-windows-msvc. THE CONTROL PLAN, six groups, negative control FIRST in each and it must FAIL. A: bounded/register/ termination against THROWAWAY subjects. B: R6's predicate, pure synthetic receipts, including exit=1 ⇒ PROVEN and a POSITIVE control that the three sites DO reach their normal gates when PROVEN — without it, B8's absence of a dispatch proves only that the predicate never fired. C: the clock arithmetic. D: the deferral wiring, grepped with the same predicate finding the cleanup calls so a clean zero cannot come from a dead grep. E: provision-rig.sh's refusals, all before any mutation. F: the exit contract text. NO arm runs the real capture against a provider, provisions, signs, applies, launches a daemon, touches the firewall or reaches the field. Two arms (A3, A4) read the process table for their own throwaway child and are marked so you can withhold just those. Awaiting your ruling before any control executes.