SIX-ID / NO-OVERWRITE GATE: PASS on v7. Not yet in a stub case; that is the next step and nothing is blocking it.

FROZEN FIRST, before anything ran. v7 = 927eafb9c21337de532230c77585ca4a28a9d498b259e8cc3e880b465c6ea8df, equal to your pin and todlando's. The five helpers are byte-identical both to my preserved v6 set and to todlando's LIVE fp-bin, so "unchanged" is verified against the live files, not just my copy. Diff v6->v7 is ONE hunk by my own measurement (diff -U0, one @@): the split declaration plus the identity guard, no other line.

THE RIG DRIVES THE SUBJECT'S OWN BYTES, not a retyped copy. The declaration block inside my CRLF toy hashes identical to the frozen v7 lines 869-885 (1234f21d2c74a5e0...). Caller shape is the subject's own global-n loop from lines 1037/1114. My harness sets no shell options because the subject sets none - measured, zero set-* and zero shopt lines in both versions.

RESULT, four arms:
  NEGCTRL v6 LF   : 6 trials -> 3 DISTINCT ids (-1 -2 -3), 12 paths, 12 ARM A lines altered by ARM B
  NEGCTRL v6 CRLF : identical
  SUBJECT v7 LF   : 6 trials -> 6 DISTINCT ids (a-1 a-2 a-3 b-1 b-2 b-3), 24 paths, 0 altered, 0 VOIDs
  SUBJECT v7 CRLF : identical
Six distinct ids PASS. Six distinct capture paths PASS (24 files = 6 x 4, no collision). No-overwrite PASS. The negative control is RED in the same rig, so the rig can see the defect it certifies absent, and the overwrite detector carries its own positive control that reports non-zero on the same comparison - the 0 is a measurement, not a dead instrument.

TODLANDO'S STATED CR EXPOSURE DOES NOT FIRE HERE, measured rather than assumed. His guard IS CR-sensitive (a genuinely CR-bearing id fails the case, proven with a control that makes the instrument capable of failing). But msys bash 5.2.21 strips raw CR bytes from script SOURCE: v="x<CR>Y" in source yields 2 bytes xY, while the same CR as a runtime escape yields 3 bytes x<CR>Y. So id never carries CR here and the CRLF arm ran 0 VOIDs. Real in principle, inert on this box, untested on any bash that does not strip source CRs. Fail-closed polarity agreed.

THREE INSTRUMENT FAILURES WERE MINE AND ARE ON RECORD IN THE RECEIPT, not hidden. The worst: my overwrite detector globbed *.out bare and sent stderr to /dev/null - and the v6 defect names artifacts "-1.out", which sha256sum parses as OPTIONS, so both snapshots came back EMPTY and the check reported "0 altered" in the arm that must be red. A clean zero from a dead instrument, in exactly the place you would have been asked to trust it. Fixed with -- and ./, errors kept, plus the positive control.

SECOND-ORDER FINDING ON v6, for the record: the defect does not only collide the arms, it names every artifact with a leading dash, so any downstream analysis of a v6 run is hostile to ordinary tooling. That is an additional reason no v6 arm-2 artifact should be read as evidence.

Receipt and rig preserved at .spt/preserved/hertz-fp-driver-review/v7-exercises/sixid/ (RECEIPT-sixid-nooverwrite.md, RIG.sha256). Proceeding to the three stub cases against v7 unless you say otherwise. Still no build, live probe, product execution, or elevation.