END - THE ATTEMPT IS SPENT. The driver REFUSED at its own guard, before any handoff was written. Nothing was created, dispatched, elevated or changed. No retry and no bypass attempted.

HALT, verbatim from the driver: "HALT: handoff_request got a redirect in its command text: [ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with these four tokens ... executable_sha256=<the sha256 you measure of C:/...spt.exe>, capture_sha256=<the sha256 you measure of C:/...d2_capture.ps1>. ...]. Capture paths are composed here, after allocation; callers pass the bare command."

THE DEFECT IS MINE AND IT IS IN THE REQUEST TEXT, NOT THE GUARD. handoff_request refuses any command text containing '>' (fp-driver-d2.sh:502) because capture paths are composed inside it and a caller-supplied redirect would disagree with the declared redirect_* paths. My PREPARED instruction uses ANGLE-BRACKET PLACEHOLDERS - executable_sha256=<the sha256 you measure of ...> - and the '>' in those placeholders is what the guard saw. The guard did exactly its job.
  IT IS LATENT, NOT NEW: the same angle brackets are in bafed7a7 and every successor since (grep count above), so this text has never once passed the guard. It could not have been caught by any control that stubs handoff_request - all of mine do - and the first LIVE PREP is exactly what surfaced it. That is the class of thing PREP exists to find, but I should have caught it: the guard and the text are both in the file I edited.

STATE, measured after the refusal:
  RUN 20260913T070453Z, evidence .../fp-run/20260913T070453Z, preserved.
  PREP_BUDGET at the refusal: 468s of 600s remained. The deadline was never reached and was never extended.
  Gates that PASSED before it, all recorded: elevation self=False; instruments hashed (6); CI axis ok at preflight AND pre-diagnostic (five non-terminal statuses each, by name, all zero); box gate ok at both; subject 85f84d73 clean; 5470 baseline taken read-only; executable 72d30901 pinned, no build; pre-setup absence census reached and PREP_BUDGET recorded before the acknowledgment step.
  CLEANUP ran through the EXIT trap and found NOTHING to clean: no fw_mutation, no listener, no daemon state was ever marked - "no process of this run was ever dispatched". CLEANUP=VERIFIED is correctly NOT available: nothing was created, so nothing's removal could be measured.
  fp-home-d2-a2 still ABSENT - the run never reached the point of creating it. fp-home-d2 untouched, still 8 entries.
  No firewall rule, no listener, no process, no elevation, no GO request written, no nonce to report.

WHAT I AM NOT DOING: not retrying, not editing the frozen driver, not working around the guard. The fix is one line of TEXT in _part_main.sh - phrase the placeholders without angle brackets (e.g. "report executable_sha256= followed by the sha256 you measure of ...") - and it needs a successor pin, your review, and a fresh grant. I will also add the control that would have caught it: run the real handoff_request against the real request texts and assert it does not refuse.
Say the word and I will prepare that successor; nothing moves here until you do.