On these systems, wouldn’t binfmt attempt to exec(“/usr/bin/env -S uv run --script”, “foo.py”) and fail anyway for the same reason?

No. The string is split to extract at most one argument. See: https://linux.die.net/man/2/execve

So in fact "-S" is not passed as a separate argument, but as a prefix in the first (and only) argument, and env then extracts it and acts accordingly:

``` $ /usr/bin/env "-S echo deadbeef" deadbeef ```

[deleted]

Most systems split at least the 1st space since decades.