reading floor: a CRLF document whose excluded section is the LAST section is refused with 'ends line N with a lone carriage return': the redactor's output ends in a CR with no LF, and the verifier's lone-CR refusal then blames a CR the source does not carry. Fail-closed (no leak), but such a record can never be assembled. Fix: keep the tail's newline when the redactor drops the last section, or trim a trailing lone CR at EOF before the check; add the case to floor_lines_test's CRLF control.

reading floor: a CRLF document whose excluded section is the LAST section is refused with 'ends line N with a lone carriage return': the redactor's output ends in a CR with no LF, and the verifier's lone-CR refusal then blames a CR the source does not carry. Fail-closed (no leak), but such a record can never be assembled. Fix: keep the tail's newline when the redactor drops the last section, or trim a trailing lone CR at EOF before the check; add the case to floor_lines_test's CRLF control.

Grounds

• pursued: a CRLF document whose excluded section is first, in the middle or last redacts to its LF twin's bytes, line endings aside, with no lone CR; a lone CR in the redacted output of a source that has none, or a CRLF assembly refused for one, would show it wrong