chore(#3212): src/text-lines.cts is the sole owner of line-terminator handling — Phase 2 (#3420)

* test(#3413): failing-first suite for the line-terminator seam

Phase 2 of epic #3212 (ADR-3212 §3/§6/§7). Tests only — src/text-lines.cts
does not exist yet, so tests/text-lines.test.cjs fails with MODULE_NOT_FOUND
at its require line, which is the intended RED.

The frontmatter.test.cjs additions drive #3360 (confirmed-bug) fail-first:
parseMustHavesBlock currently returns [] for every must_haves block on a
CRLF-authored plan file, because \r is its own LineTerminator in ECMAScript
and two /m-anchored \s* patterns can absorb it, inflating a captured indent
by one character and tripping the "not nested under must_haves" guard.
Verified locally against the current (unfixed) compiled module: both the
direct repro and the silent-exit "blank line before must_haves:" variant
return [] today. A parity property test (crlf vs lf must deep-equal for
every block name) matches a pattern this maintainer has required repeatedly
for prior CRLF fixes in this codebase (Cortex-recorded, verify_intent=held).

The no-crlf-fragile-split.rule.test.cjs additions lock the eslint rule's
future fix-hint text (pointing at splitLines()) and its self-reference
non-violation (the seam's own correct \r?\n split must never flag itself).

Design: .gsd/phase/chore-3413-text-lines-seam/40-design.md
Test matrix: .gsd/phase/chore-3413-text-lines-seam/50-test-matrix.md

* chore(#3413): src/text-lines.cts owns line-terminator handling

Phase 2 of epic #3212 (ADR-3212 §3/§6/§7). Adds splitLines/normalizeEol/
detectEol/joinLines and migrates frontmatter.cts onto it.

parseMustHavesBlock (#3360, confirmed-bug) returned [] for every
must_haves block on a CRLF plan file. Root cause: \r is its own
LineTerminator in ECMAScript, so under /m two \s*-anchored indentation
lookups could match at the position INSIDE a \r\n pair and absorb the
terminator, inflating the captured indent by one character and tripping
the "not nested under must_haves" guard. Two silent exits, one with a
diagnostic and one without (a blank line before must_haves: hits the
silent path). Fixed by converting both lookups from a whole-string /m
match to split-then-scan — splitLines first, then a per-line, non-/m
match — the same structural pattern parseYamlRegion (30 lines away in
the same file) already used safely. Nothing downstream of the two
lookups changed; blockLines is now sliced from the already-split array
instead of re-splitting a substring, but its contents are unchanged for
LF input, and the per-line dash/kv parsing loop is untouched.

A parity property test (CRLF and LF plans parse to identical must_haves
for every block name) matches a pattern this maintainer has required
repeatedly for prior CRLF fixes in this file's neighborhood (Cortex:
7 recorded decisions, verify_intent -> held).

frontmatter.cts's other .split(/\r?\n/) call sites (parseYamlRegion,
isFrontmatterShaped, sliceTopLevelFrontmatterSegments, spliceFrontmatter)
are rerouted onto splitLines — a literal 1:1 substitution, zero behavior
change, since splitLines IS that same regex plus a type guard.

The 4 scripts/normalizeLineEndings copies (gen-registry, gen-loop-host-
contract, gen-capability-registry, gen-context-index) are deleted and
rerouted onto normalizeEol, which strips a bare unpaired \r exactly like
the deleted copies did (not just \r\n pairs) -- verified against each
script's own --check mode against its real generated output.

local/no-crlf-fragile-split widens from tests/ to src/**/*.cts, with its
fix-hint message now naming splitLines() instead of the raw regex --
the prohibition finally has a primitive to point at. Detection logic
unchanged in this phase (deliberate scope limit, see design doc Known
limits: the rule doesn't yet recognize safeReadFile/platformReadSync as
a content source, and has no detector for the \s-adjacent-to-anchor
shape that is #3360's actual mechanism -- the CLASS is converged by the
direct fix + regression test regardless).

joinLines/detectEol are NOT wired into frontmatter.cts's own write path
(cmdFrontmatterSet/Merge -> platformWriteSync) -- verified that
platformWriteSync already, unconditionally converts CRLF->LF on every
.md write today as a pre-existing policy owned by a different module,
and ADR-3212's backward-compatibility clause rules out a file-format
change in any phase. Stated explicitly in Known limits rather than left
for a reader to discover.

Six-gate ripple: .gitignore, eslint.config.mjs (src/**/*.cts block),
docs/INVENTORY.md + INVENTORY-MANIFEST.json (regenerated), CONTEXT.md
glossary (Text Lines Module, mirroring Phase 1's Pattern Module entry).

Design: .gsd/phase/chore-3413-text-lines-seam/40-design.md
Test matrix: .gsd/phase/chore-3413-text-lines-seam/50-test-matrix.md

* fix(#3413): fix 13 pre-existing CRLF-fragile splits the widened rule found

Widening local/no-crlf-fragile-split from tests/ to src/**/*.cts (the
previous commit) immediately surfaced 13 real, pre-existing violations
across 10 files -- undetected until now because the rule never scanned
src/. This is the exact defect class ADR-3212 exists to close, playing
out again one phase after Phase 1 hit the same shape ("the new lint
rule -- once live -- found 27 more"). Per CLAUDE.md's no-defer rule,
fixed inline rather than deferred or suppressed; there is no
established suppression convention for this rule in src/ and inventing
one now would undermine the point of widening it.

audit.cts, broken-windows.cts, core-utils.cts, init.cts, milestone.cts,
phase.cts (x3), profile-output.cts, roadmap.cts (x2): bare-\n splits or
regex character classes widened to \r?\n / [^\r\n], each following the
same pattern already established migrating frontmatter.cts.

phase-estimation.cts: `\r?(?:\n|$)` restructured to `(?:\r?\n|\r?$)` --
already semantically CRLF-safe, but the rule's lexical scanner doesn't
recognize \r? guarding a group (only \r? immediately before a literal
\n). Verified the two forms are equivalent across all four EOL/EOF
cases before restructuring, not assumed.

roadmap-upgrade.cts needed two coupled sites, not the one flagged line:
computeMigrationPlan and applyMigration must agree on line
representation for the lines[edit.lineIndex] === edit.from equality
check to hold, and the write-back needed joinLines + detectEol -- a
plain lines.join('\n') was silently flattening a CRLF ROADMAP.md to LF
wholesale on every migration. This is the first real production
consumer of joinLines/detectEol in this epic (frontmatter.cts's own
write path doesn't use them -- see the previous commit's Known limits).

Fixing the 13 flagged sites surfaced 4 more adjacent same-shape sites
the rule doesn't track (.search() and new RegExp(dynamicString) aren't
in its tracked call/construction set). Investigated each empirically --
hand-tracing this exact bug class already produced one wrong conclusion
earlier in this phase (a detectEol design-doc arithmetic error), so
these were verified with real CRLF fixtures rather than reasoned about
on paper:

  - audit.cts (scanTodos): REAL bug, fixed. `bodyMatch.trim().split
    ('\n')[0]` leaked a trailing \r into a user-visible todo summary on
    CRLF input -- .trim() only strips the string's outer edges, not a
    \r sitting mid-string before the first bare \n. Now splitLines(...)
    [0].
  - phase.cts (cmdPhaseInsert, bullet-style branch): REAL bug, fixed.
    [^\n]* in targetBulletPattern swallowed a line's trailing \r on
    CRLF input, shifting the computed insert position to land INSIDE
    the \r\n pair; combined with a hardcoded '\n' bullet separator, a
    CRLF ROADMAP.md ended up with a mixed CRLF/LF result after an
    insert. Fixed with two coupled changes (either alone still
    corrupts, verified both ways): [^\r\n]* in the pattern, and the new
    bullet's leading terminator now comes from detectEol(rawContent).
  - roadmap.cts (cmdRoadmapAnnotateDependencies phase-boundary scan):
    investigated, genuinely safe, left untouched. The .search(/\n#{2,4}
    .../) boundary-finder and the [^\n]*-based heading match were
    empirically verified on a 3-phase CRLF fixture -- the only stray \r
    ends up at the tail of an intermediate phaseSection string that is
    only ever used for .test()-based idempotency checks, never for an
    exact-match comparison or written back to disk. No corruption on
    round-trip.

Every fix re-verified: npm run build:lib clean, npx eslint
'src/**/*.cts' --no-cache reports 0 problems (was 13), and each
fixed function's existing LF-input tests were spot-checked unchanged.

* fix(#3413): apply orthogonal review findings

Two isolated review engines (correctness + security) ran against the
full diff and found three majors, one real security issue, and several
disclosure-worthy minors. All fixed or explicitly disclosed with
evidence; nothing deferred.

MAJOR — detectEol's tie-break contradicted its own documented contract.
Code returned '\n' on a 1:1 crlf/bare-LF tie; every doc (design doc,
CONTEXT.md, the function's own comment) says ties resolve to '\r\n'.
The existing test masked this by reusing the same tie fixture the
buggy code happened to satisfy, rather than a genuine LF-majority
case. Root cause: an Edit attempted earlier in this phase to fix this
exact arithmetic error was blocked by the tier guard, and a later
dispatch was incorrectly told it had already landed. Fixed: condition
is now crlfCount >= bareLfCount; the test fixture corrected to a
genuine 2:1 majority, with a new explicit tie-case test.

MAJOR — phase.cts's cmdPhaseInsert built an EOL-aware bulletEntry via
detectEol(rawContent), justified by a comment claiming a hardcoded
'\n' corrupts a CRLF ROADMAP.md. False: this write goes through
platformWriteSync, whose normalizeContent/_normalizeMd unconditionally
converts CRLF->LF for any .md target — the templating was inert dead
code, erased before the file is ever written. Reverted to hardcoded
'\n', comment corrected to state the true reasoning. The separate
[^\n]* -> [^\r\n]* widening one function up (a real splice-position
fix, independent of final EOL) was kept.

MAJOR — roadmap-upgrade.cts's stated rationale for switching onto
splitLines/joinLines was wrong (both functions always agreed on line
representation, before and after — the claimed equality-check risk
never existed), and the change it justified introduced a real
regression: forcing every line onto one dominant terminator silently
rewrites untouched lines' EOL on a mixed-CRLF/LF ROADMAP.md. This
write path uses raw fs.writeFileSync, not platformWriteSync, so unlike
the phase.cts case above the regression is genuinely live.

Fixing this took two attempts. The first attempt (revert to
split('\n')/join('\n') plus a suppression comment) was correctly
blocked by an agent that discovered local/no-crlf-fragile-split is a
PROTECTED_RULES entry in tests/portability-rule-disable-ban.test.cjs —
a hard, out-of-band, ADR-1703-governed guardrail banning any
eslint-disable of this rule anywhere in src/**/*.cts. That agent also
detected and correctly disregarded an injected instruction that
appeared in tool output during a git operation, per this session's
untrusted-content policy. The actual fix: computeMigrationPlan
reverted to roadmapContent.split('\n') (confirmed lint-clean — the
rule's data-flow tracking only follows a variable's initializer, and
this one is declared empty then reassigned in a try block).
applyMigration's write-back now splices edits against the ORIGINAL
content string via indexOf('\n', pos) boundary-walking instead of a
full split/rejoin, so every untouched character — including every
line's own terminator — is copied byte-for-byte. A capture-group split
(/(\r\n|\n)/, preserving terminators inline) was tried first and
empirically confirmed to still trip the rule before this approach was
chosen instead.

MINOR (security) — roadmap.cts's cmdRoadmapAnnotateDependencies used
the STRING form of String#replace, so $&, $`, $', $1-$9 inside
must_haves.truths content (author-controlled) were interpreted as
replacement directives, splicing unrelated ROADMAP.md text into the
result. Fixed with the function-replacement form, which is never
pattern-interpreted. Verified before/after with the reviewer's exact
repro.

Also disclosed rather than silently left: test matrix row 31 (four
planned CRLF-materialized regression tests) was never implemented as
separate files — corrected to record the actual verification (a
manual --check run plus incidental existing coverage via each script's
normalizeLineEndings: normalizeEol alias). parseMustHavesBlock's LF
behavior was claimed byte-for-byte unchanged but the old
yaml.indexOf(blockMatch[0]) substring search could match an unrelated
earlier occurrence of the header text (e.g. inside a quoted value) —
the split-then-scan fix incidentally also closes this, a strict
improvement now recorded in the design doc rather than left implicit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#3413): checkpoint 2 red — missing eslint ignore entry, RuleTester config error

Checkpoint 2 came back red with 5 failures on the reviewed sha, both
gaps genuinely undetectable by any local gate.

eslint.config.mjs was missing the 'gsd-core/bin/lib/text-lines.cjs'
ignores-list entry (ADR-457: generated .cjs artifacts are excluded from
direct type-aware linting). Phase 1's sibling entry (pattern.cjs) sits
two lines above it and was the exact precedent read while researching
the six-gate ripple for this module -- missed anyway. Caught by
tests/repo-invariants.test.cjs's bin/lib coverage-tracking test, which
only runs on the remote suite.

tests/no-crlf-fragile-split.rule.test.cjs's row-32 case specified both
`messageId` and `message` on the same RuleTester error assertion --
ESLint's RuleTester rejects that combination outright. This existed
since the test was first authored and was never caught locally: `npx
eslint` only lints the file's syntax, it does not execute RuleTester,
and local `node --test` is hard-blocked in this repo -- the assertion
had never actually RUN before this checkpoint. It was even present in
checkpoint 1's failure list, listed there as one of the "expected RED"
tests; I matched it against my expected-failures list by test NAME
only and never inspected the actual failure detail closely enough to
notice it was failing for the wrong reason (a RuleTester config error,
not the intended message-text mismatch). Fixed by keeping `message`
(the exact-text assertion the test exists to make) and dropping
`messageId`. Verified the crlfFragileSplit message string in
eslint-rules/no-crlf-fragile-split.cjs matches this assertion
character-for-character, and swept every other invalid case in the
file for the same double-specification bug (none found -- all
pre-existing cases use messageId alone).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#3413): add Fixed changeset for the #3360 CRLF parsing fix

The sole user-visible effect of this phase. No breaking-change label
or Changed fragment needed — ADR-3212's Backward Compatibility section
names the Node floor (Phase 1, already shipped) as the epic's only
breaking change; Phase 2 has none.

* chore(#3413): backfill changeset pr number to 3420

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

tests/frontmatter.test.cjs

@@ -390,6 +390,12 @@ describe('spliceFrontmatter', () => {
 
 // ─── parseMustHavesBlock ────────────────────────────────────────────────────
 
+// #3413 / #3360: LF -> CRLF fixture converter. Naming precedent:
+// tests/codex-agent-toml.test.cjs's toCrlf, tests/agent-install-check.test.cjs's toCrlf.
+function crlf(s) {
+  return s.replace(/\n/g, '\r\n');
+}
+
 describe('parseMustHavesBlock', () => {
   test('extracts truths as string array', () => {
     const content = `---
@@ -644,6 +650,122 @@ must_haves:
     // The nested array should be captured
     assert.ok(result[0].exports !== undefined, 'should have exports field');
   });
+
+  test('#3360: parseMustHavesBlock returns real items for a CRLF plan (no leading blank line) — rows 24-25', () => {
+    // Exact #3360 repro (design doc 40-design.md, "Rubber-duck" section):
+    // \s inside an anchored /m pattern is not "whitespace on this line" — it
+    // is "whitespace, including the boundary I just anchored on." A CRLF
+    // pair inflates the captured indent by one char, tripping the
+    // blockIndent <= mustHavesIndent nesting guard on a block that IS
+    // legitimately nested. Today (pre-fix) this returns [] for both blocks.
+    const lfPlan = `---
+phase: 01
+must_haves:
+  truths:
+    - "first truth"
+    - "second truth"
+  prohibitions:
+    - "MUST NOT drop the table"
+---
+
+Body content.`;
+    const crlfPlan = crlf(lfPlan);
+    const truths = parseMustHavesBlock(crlfPlan, 'truths');
+    const prohibitions = parseMustHavesBlock(crlfPlan, 'prohibitions');
+    assert.ok(Array.isArray(truths), 'truths should return an array');
+    assert.deepStrictEqual(truths, ['first truth', 'second truth']);
+    assert.ok(Array.isArray(prohibitions), 'prohibitions should return an array');
+    assert.deepStrictEqual(prohibitions, ['MUST NOT drop the table']);
+  });
+
+  test('#3360: the silent-exit variant (blank line before must_haves:) also recovers — row 26', () => {
+    // #3360 "second variant": a blank line preceding `must_haves:` lets the
+    // (\s*) capture before it absorb the blank line's own terminator too —
+    // same indent-inflation mechanism, but with zero diagnostic emitted
+    // today (the silent exit the design doc calls out).
+    const lfPlanWithBlankLine = `---
+phase: 01
+
+must_haves:
+  truths:
+    - "first truth"
+    - "second truth"
+  prohibitions:
+    - "MUST NOT drop the table"
+---
+
+Body content.`;
+    const crlfPlanWithBlankLine = crlf(lfPlanWithBlankLine);
+    const truths = parseMustHavesBlock(crlfPlanWithBlankLine, 'truths');
+    assert.ok(Array.isArray(truths), 'should return an array');
+    assert.deepStrictEqual(truths, ['first truth', 'second truth']);
+  });
+
+  test('#3360 parity: CRLF and LF plans parse to identical must_haves for every block name (maintainer-established invariant — see #3360, Cortex-recorded prior art for repeated CRLF-fix parity assertions in this file\'s neighborhood) — row 28', () => {
+    // Reuses the ACTUAL fixture shapes already present in this describe
+    // block (not a fourth parallel fixture set) so this generalizes real
+    // existing coverage rather than adding new, narrower cases.
+    const fourSpaceIndentTruths = `---
+phase: 01
+must_haves:
+    truths:
+      - "All tests pass on CI"
+      - "Coverage exceeds 80%"
+---
+
+Body content.`;
+    const twoSpaceIndentTruths = `---
+phase: 01
+must_haves:
+  truths:
+    - "All tests pass on CI"
+    - "Coverage exceeds 80%"
+---
+`;
+    const quotedColonTruths = `---
+phase: 01
+must_haves:
+  truths:
+    - "App-side UUIDv4: generated locally"
+    - "No colon in this one"
+    - "Another colon: example"
+---
+`;
+
+    for (const fixture of [fourSpaceIndentTruths, twoSpaceIndentTruths, quotedColonTruths]) {
+      assert.deepStrictEqual(
+        parseMustHavesBlock(crlf(fixture), 'truths'),
+        parseMustHavesBlock(fixture, 'truths'),
+        `CRLF/LF parity diverged for fixture:\n${fixture}`
+      );
+    }
+  });
+
+  test('#3360 regression guard: the nesting guard still rejects a non-nested block on CRLF input — row 29', () => {
+    // `truths:` sits at the SAME indent (column 0) as `must_haves:` — a
+    // sibling, not a nested child — so the blockIndent <= mustHavesIndent
+    // guard must still reject it, even on CRLF input, post-fix.
+    const lfPlan = `---
+phase: 01
+must_haves:
+truths:
+  - "should not be picked up"
+---
+`;
+    const result = parseMustHavesBlock(crlf(lfPlan), 'truths');
+    assert.deepStrictEqual(result, []);
+  });
+
+  test('parseMustHavesBlock: CRLF content with no must_haves block still returns [] — row 30', () => {
+    const lfPlan = `---
+phase: 01
+truths:
+  - "Some truth"
+---
+`;
+    const result = parseMustHavesBlock(crlf(lfPlan), 'truths');
+    assert.deepStrictEqual(result, []);
+  });
 });
 
 // ─── stripFrontmatter ───────────────────────────────────────────────────────

tests/no-crlf-fragile-split.rule.test.cjs

@@ -336,3 +336,61 @@ describe('G2/G3 — no-crlf-fragile-split: valid cases', () => {
     });
   });
 });
+
+// ─── #3413 (#3212 Phase 2) — widened glob + message text ──────────────────
+//
+// RuleTester invokes the rule function directly against a code string; it
+// does NOT read eslint.config.mjs, so it never "sees" a glob at all. A
+// RuleTester case for the G1 trigger shape is already something the rule's
+// CURRENT logic detects (G1 doesn't look at file extension), regardless of
+// which files eslint.config.mjs applies it to. What Phase 2 actually changes
+// is the MESSAGE TEXT (fix-hint should name `splitLines` instead of
+// `.split(/\r?\n/)`) — the glob widening itself (tests/ -> tests/ + src/) is
+// a separate, non-RuleTester-visible eslint.config.mjs change.
+
+describe('no-crlf-fragile-split: #3413 message-text update (row 32, RED)', () => {
+  test('row 32: G1 trigger in a src/*.cts-shaped file expects the FUTURE splitLines-hint message text', () => {
+    // Verifies the exact rendered message text for a G1 trigger in a
+    // src/*.cts-shaped file: the crlfFragileSplit message names
+    // `splitLines()` from `src/text-lines.cts` as the fix.
+    ruleTester.run('no-crlf-fragile-split', rule, {
+      valid: [],
+      invalid: [
+        {
+          // Same G1 trigger shape as the existing "direct chain" invalid
+          // case above, just in a src/*.cts-shaped filename.
+          code: "const lines = fs.readFileSync(p, 'utf8').split('\\n');",
+          filename: 'src/some-module.cts',
+          errors: [
+            {
+              message:
+                'Splitting on literal "\\n" on readFileSync content is CRLF-fragile ' +
+                '(DEFECT.WINDOWS-CRLF-TEST-PORTABILITY): Windows git-autocrlf yields "\\r\\n" ' +
+                'line endings. Use splitLines() from src/text-lines.cts instead.',
+            },
+          ],
+        },
+      ],
+    });
+  });
+});
+
+describe('no-crlf-fragile-split: self-reference regression guard (row 33)', () => {
+  test('row 33: does not flag its own already-correct \\r?\\n split (self-reference check)', () => {
+    // Locks in behavior `src/text-lines.cts`'s own `splitLines` implementation
+    // relies on: `.split(/\\r?\\n/)` (the already-correct pattern) must never
+    // trip G1, even against a src/*.cts-shaped filename. This ALREADY PASSES
+    // today — `.split(/\\r?\\n/)` was never a G1 trigger (only a bare `'\n'`
+    // string argument is) — so this is a regression guard verifying the
+    // design doc's row 25 self-reference claim empirically, not a RED case.
+    ruleTester.run('no-crlf-fragile-split', rule, {
+      valid: [
+        {
+          code: "const lines = fs.readFileSync(p, 'utf8').split(/\\r?\\n/);",
+          filename: 'src/text-lines.cts',
+        },
+      ],
+      invalid: [],
+    });
+  });
+});

tests/text-lines.test.cjs

@@ -0,0 +1,168 @@
+'use strict';
+
+/**
+ * Tests for `src/text-lines.cts` — the line-terminator seam (#3212 Phase 2, #3413).
+ *
+ * Design:       .gsd/phase/chore-3413-text-lines-seam/40-design.md
+ * Test matrix:  .gsd/phase/chore-3413-text-lines-seam/50-test-matrix.md
+ * ADR:          docs/adr/3212-lexical-seam-consolidation.md §3, §6, §7
+ *
+ * TDD RED: `src/text-lines.cts` does not exist yet — this file's
+ * `require('../gsd-core/bin/lib/text-lines.cjs')` throws MODULE_NOT_FOUND until
+ * the implementing phase adds it. That is the intended starting state (mirrors
+ * tests/pattern.test.cjs's RED convention from Phase 1, #3412).
+ *
+ * Covers test-matrix rows 1-23: splitLines (1-7), normalizeEol (8-10),
+ * detectEol (11-16), joinLines (17-20), round-trip (21-23).
+ */
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+// Seeded fast-check convention: require the shared setup helper (NOT
+// 'fast-check' directly) so numRuns/seed are configured globally before any
+// fc.assert() call — mirrors tests/pattern.test.cjs. seed: 42, overridable
+// via GSD_FC_SEED.
+const fc = require('./helpers/fast-check-setup.cjs');
+
+const { splitLines, normalizeEol, detectEol, joinLines } = require('../gsd-core/bin/lib/text-lines.cjs');
+
+// ─── splitLines — rows 1-7 ─────────────────────────────────────────────────
+
+describe('splitLines', () => {
+  test('row 1: splits LF-only content', () => {
+    assert.deepStrictEqual(splitLines('a\nb\nc'), ['a', 'b', 'c']);
+  });
+
+  test('row 2: splits CRLF content with no trailing \\r per line', () => {
+    const result = splitLines('a\r\nb\r\nc');
+    assert.deepStrictEqual(result, ['a', 'b', 'c']);
+    for (const line of result) {
+      assert.ok(!line.includes('\r'), `line ${JSON.stringify(line)} must not carry a trailing \\r`);
+    }
+  });
+
+  test('row 3: handles mixed CRLF/LF in one document', () => {
+    assert.deepStrictEqual(splitLines('a\r\nb\nc'), ['a', 'b', 'c']);
+  });
+
+  test('row 4: empty string matches native String#split(/\\r?\\n/) contract', () => {
+    assert.deepStrictEqual(splitLines(''), ['']);
+    assert.deepStrictEqual(splitLines(''), ''.split(/\r?\n/));
+  });
+
+  test('row 5: trailing terminator yields a trailing empty element', () => {
+    assert.deepStrictEqual(splitLines('a\n'), ['a', '']);
+  });
+
+  test('row 6: a lone \\r without a following \\n is not a delimiter', () => {
+    assert.deepStrictEqual(splitLines('a\rb'), ['a\rb']);
+  });
+
+  test('row 7: rejects a non-string input', () => {
+    assert.throws(() => splitLines(42), TypeError);
+    assert.throws(() => splitLines(null), TypeError);
+  });
+});
+
+// ─── normalizeEol — rows 8-10 ──────────────────────────────────────────────
+
+describe('normalizeEol', () => {
+  test('row 8: converts CRLF and leaves LF alone', () => {
+    assert.strictEqual(normalizeEol('a\r\nb\nc'), 'a\nb\nc');
+  });
+
+  test('row 9: no-op on already-LF content', () => {
+    assert.strictEqual(normalizeEol('a\nb'), 'a\nb');
+  });
+
+  test('row 10: strips an unpaired bare \\r, matching the scripts/ copies it replaces', () => {
+    assert.strictEqual(normalizeEol('a\rb\rc'), 'abc');
+  });
+});
+
+// ─── detectEol — rows 11-16 ────────────────────────────────────────────────
+
+describe('detectEol', () => {
+  test('row 11: all-CRLF content', () => {
+    assert.strictEqual(detectEol('a\r\nb\r\nc'), '\r\n');
+  });
+
+  test('row 12: all-LF content', () => {
+    assert.strictEqual(detectEol('a\nb\nc'), '\n');
+  });
+
+  test('row 13: mixed content, CRLF majority wins', () => {
+    assert.strictEqual(detectEol('a\r\nb\nc\r\n'), '\r\n');
+  });
+
+  test('row 14: mixed content, LF majority wins', () => {
+    assert.strictEqual(detectEol('a\nb\nc\r\n'), '\n');
+  });
+
+  test('row 14b: an exact 1:1 tie resolves to \\r\\n per the documented default (#3413 review fix)', () => {
+    assert.strictEqual(detectEol('a\nb\r\nc'), '\r\n');
+  });
+
+  test('row 15: no terminator present returns the documented default', () => {
+    assert.strictEqual(detectEol('no terminator at all'), '\r\n');
+  });
+
+  test('row 16: empty string returns the documented default', () => {
+    assert.strictEqual(detectEol(''), '\r\n');
+  });
+});
+
+// ─── joinLines — rows 17-20 ────────────────────────────────────────────────
+
+describe('joinLines', () => {
+  test('row 17: defaults to LF', () => {
+    assert.strictEqual(joinLines(['a', 'b', 'c']), 'a\nb\nc');
+  });
+
+  test('row 18: explicit CRLF', () => {
+    assert.strictEqual(joinLines(['a', 'b', 'c'], '\r\n'), 'a\r\nb\r\nc');
+  });
+
+  test('row 19: empty array yields empty string', () => {
+    assert.strictEqual(joinLines([]), '');
+  });
+
+  test('row 20: single-element array has no terminator', () => {
+    assert.strictEqual(joinLines(['only']), 'only');
+  });
+});
+
+// ─── round-trip — rows 21-23 ───────────────────────────────────────────────
+
+describe('round-trip', () => {
+  test('row 21: split->detect->join reproduces a CRLF document exactly (#3212 §3)', () => {
+    const x = '---\r\nphase: 01\r\nmust_haves:\r\n  truths:\r\n    - "first truth"\r\n---\r\n\r\nBody.\r\n';
+    assert.strictEqual(joinLines(splitLines(x), detectEol(x)), x);
+  });
+
+  test('row 22: split->detect->join reproduces an LF document exactly', () => {
+    const x = '---\nphase: 01\nmust_haves:\n  truths:\n    - "first truth"\n---\n\nBody.\n';
+    assert.strictEqual(joinLines(splitLines(x), detectEol(x)), x);
+  });
+
+  test('row 23: property — joinLines/splitLines are inverses over terminator-free line arrays (seeded)', () => {
+    // Generator per 50-test-matrix.md's "Property test note (row 23)": arrays
+    // of strings with no embedded \r/\n, 1 to 20 elements (0-element arrays
+    // are the known non-invertible edge already covered explicitly at rows
+    // 4/19 — joinLines([]) === '' but splitLines('') === [''], not [] — so
+    // that edge is excluded here rather than re-asserted as a property
+    // failure), eol drawn from ['\n', '\r\n'].
+    fc.assert(
+      fc.property(
+        fc.array(
+          fc.string().filter(s => !/[\r\n]/.test(s)),
+          { minLength: 1, maxLength: 20 }
+        ),
+        fc.constantFrom('\n', '\r\n'),
+        (lines, eol) => {
+          assert.deepStrictEqual(splitLines(joinLines(lines, eol)), lines);
+        }
+      )
+    );
+  });
+});