V8 PINNED, exactly the three hunks doyle authorized. V7 IS UNTOUCHED (927eafb9... re-measured), as are v6 and v5.

PIN
  fp-driver-v8.sh  sha256 21ded908e2b2609b4ff3aa857d6d6dc7217d7a096e037b06fd670072c8fc59f1
  path C:\Users\decid\AppData\Local\Temp\claude\C--Users-decid-Documents-projects-spt-core\291081e5-a375-43ea-81a8-f0e1b7e15a41\scratchpad\fp-driver-v8.sh
  71874 bytes, CRLF throughout (1139/1139/1139), zero control bytes outside CR/LF/TAB, bash -n clean.
  handoff_request lines 303-343, 2084 bytes, sha256 3aa9c6577c0597b5fca0b9fe8cb9571f62f11c7f06e025c5bf566c56c05d4f00 - hertz can pin the block alone.
  The five helpers are UNCHANGED: census 7a50b14e, cpubracket fc10031d, portfields 283386e7, runner-census 0d8b67ed, d1_render 3b984493.

THE THREE HUNKS, and nothing else in the diff.
  1. handoff_request composes the command AFTER allocating HO_OUT/HO_ERR: local cmd_exact="$3 > \"$HO_OUT\" 2> \"$HO_ERR\"" - quoted, so a path with a space survives.
  2. run_exactly emits $cmd_exact instead of $3, so it cannot disagree with redirect_stdout_to / redirect_stderr_to.
  3. The setup caller drops its own redirects and passes the bare command. The teardown caller was already bare and now gains correct redirects for free - that is why the fix went in the shared function rather than at the two call sites.
  Plus a fail-closed refusal inside handoff_request: a command text containing > dies, so no future caller can reintroduce the defect from the outside.

I VERIFIED THE DEFECT IN MY OWN SOURCE FIRST, and then the fix, in four arms on extracted bytes - I did not retype the function.
  ARM 1 (defect, v7 function + the v7 caller's own argument shape): run_exactly emitted "... --bootstrap >  2>" - empty targets, confirmed with cat -A. Reproduces hertz's finding independently.
  ARM 2 (refusal, v8 + a caller smuggling a redirect): DIE, exit 1, zero request files written.
  ARM 3 (the fix executes): ran each emitted run_exactly against a harmless stub printing distinct stdout/stderr and exiting 7. Setup AND teardown: exit 7 preserved, STDOUT_MARKER in the DECLARED redirect_stdout_to file, STDERR_MARKER in the DECLARED redirect_stderr_to file, both non-empty.
  ARM 4 (negative control, same executor over v7's setup request): bash syntax error, executor exit 2, declared out file ABSENT. So the executor is not what makes arm 3 pass.
  doyle: arm 3 is mine on a toy stub and does NOT stand in for hertz's assignment - hertz owns that proof against the real generated requests with the pinned instrument.

SAME-FAMILY AUDIT, whole driver, not just the reported site. Predicate: for every function, the globals it assigns; then every line that passes one of those names as an ARGUMENT to that same function. Globals assigned inside functions: ABORT, CLEANUP_ENTERED, D1_OK, HANDOFF_SEQ, HO_SEQ, HO_NONCE, HO_RECEIPT, HO_OUT, HO_ERR, ORIGINAL_RC, ORIGINAL_WHY. Exactly ONE call-site instance existed - line 1053, the reported one. Every other HO_* read is either INSIDE handoff_request (322-324) or AFTER it returns (346, 381, 445, 1054), where the values are the ones that request allocated. 1054 is correct and stays: it captures SETUP_OUT/SETUP_ERR before a later handoff rebinds HO_*.

WHAT I AM NOT CLAIMING. hertz's arm-2 result stands on its five path-independent assertions only; FACE_COUNTS and the teardown verdict from that run are not evidence, and I am not treating them as such. Nothing here was built, probed, executed against the product, or elevated. v8 is frozen from my side the moment doyle names it the subject.