Integrated successor: GO routing + M1 + M2 + the daemon-stop gate, one pin.

PIN      d2/fp-driver-d2.sh  2fd7d68952587f121fb4f6cac81dc8fb50b891a5e5160cd0cb2c04216f3c37b3
DIFF     d2/fp-driver-d2-4229f9ac-to-2fd7d689.diff 252f3709... (10 hunks, +71/-7)
STAGING  d2/D2-STAGING-RESOLVED.md 1cb66a95... + D2-STAGING-MANIFEST.sha256 b3cdee7ba158a07c173e603b23d537ddfe78886ac41090f7bfa7b5166b1abf85, 35 entries, 35 OK 0 FAILED
4229f9ac PRESERVED at d2/history/fp-driver-d2-4229f9ac.sh with its receipts untouched.

GO ROUTING. handoff_request stamped EVERY request "elevation: REQUIRED", which addressed all of them - including the authorization - to the elevated executor. It is retained text, so the audience became a 4th argument through an assembler IN-PLACE CORRECTION, the way this rig corrects retained text (third such correction, visible in the diff). The GO request now carries audience: doyle (the DRI) - THE ELEVATED EXECUTOR MUST NOT ANSWER THIS REQUEST, and elevation: NOT_REQUIRED. The receipt must carry whole-line authorizer=doyle alongside GO_AUTHORIZED and the existing nonce check. Recorded as a routing and consistency check, NOT authentication - the record says so in the ledger line itself, and the request text tells the DRI to refuse in words.

M1 - AND IT WAS WORSE THAN A STALE CONSTANT. RULE_PROBE_SHA256 named the probe as it was BEFORE the argument-transport fix, so removal_check would have hashed the shipped probe, returned UNREADABLE_PROBE_UNPINNED before invoking it, taken the withheld arm at the pre-teardown gate and reported PENDING on EVERY run - the reviewed instrument verified, pinned, and then unreachable. Fixed to the shipped value. Control r1 now reads the pin OUT OF THE DRIVER with sed and compares it to the file; r2/r3/r4 do the same for the executable, capture script and reviewed payload; r5 is the negative control that the comparison can fail. No harness recompute anywhere in R.
  THE STAGING CLAIM IS CORRECTED, not quietly repaired: D2-STAGING-RESOLVED.md now opens with the correction, in those words - I had compared the file to the MANIFEST rather than to the driver's constant, and a manifest verifying itself proves internal consistency only.
  todlando filed the same finding independently from his read-only contract review, with the same consequence chain and the same suggested arm. His read and yours agree; the fix predates neither.

M2. Both preparation waits are now bounded by prep_left (HANDOFF_WAIT_S defaults to 900s against a 600s preparation budget), and prep_check window-open re-reads the deadline immediately before go(). Control S uses a CONTROLLED CLOCK - date is shadowed, no 600-second sleeps: inside the budget prep_left reports what remains and prep_check permits; at the deadline prep_check exits 8 so a late receipt opens nothing; s6 shows the driver re-reads the deadline before go().

DAEMON STOP GATE, retained as you authorized. Attributed LIVE -> ADMITTED and the EXISTING stop path is entered unchanged; measured absent -> NOT_NEEDED, no command; unreadable -> WITHHELD_UNREADABLE, verdict PENDING, no action; no marker -> the question is never asked. No new mechanism, no guard bypass, no kill authority. The comment states explicitly that this is NOT a claim that daemon stop spawns anything - nothing here measures that, and the gating mismatch alone would not establish it; the reason is only that acting on a marker that was never a measurement is unjustified.

CONTROLS on 2fd7d689: go-and-silent 55/55 (adds Q authorizer routing, R shipped-pin agreement, S late PREPARED/GO, T daemon-stop gating), cleanup 50/50, declined-setup 16/16. Re-run because this change edits the code they cover.

HARNESS CORRECTIONS DISCLOSED: m5's positive control needed the authorizer line once the receipt required three things; and the controls file labelled 99df52c3 "PREDECESSOR" when it is the MARKER-ERA ancestor kept only for the o6/o7 negative control - relabelled rather than left misleading.

PROCESS DISPOSITION: four pwsh (argument receiver x3 forms, payload fixture harness); no host query, no rule read or written on this host, no elevation, no field execution, no kill, nothing signalled. Scratch dirs removed on exit.

D2 GO unrequested. Awaiting your contract review; todlando is holding for the successor and I will ping him when you rule.