diff --git a/scripts/ci/codeql-retrace-vendored.sh b/scripts/ci/codeql-retrace-vendored.sh
index 51e33402e8..eaf4e3353f 100755
--- a/scripts/ci/codeql-retrace-vendored.sh
+++ b/scripts/ci/codeql-retrace-vendored.sh
@@ -80,6 +80,8 @@ fi
 printf '%s\n' "$changed" |
     bash "$ROOT/scripts/ci/select-lanes.sh" --codeql-scope c-cpp |
     while IFS= read -r path; do
+        # Native Windows Python writes CRLF; read removes only the LF.
+        path="${path%$'\r'}"
         entrypoints=()
         case "$path" in
         internal/cbm/grammar_*.c | internal/cbm/ts_runtime.c)
diff --git a/tests/test_language_count_contract.sh b/tests/test_language_count_contract.sh
index 33c9a01cb9..93d171d6fc 100644
--- a/tests/test_language_count_contract.sh
+++ b/tests/test_language_count_contract.sh
@@ -46,14 +46,12 @@ if [[ "$manifest_count" != "$expected" ]]; then
 fi
 
 # --- 3. Every published surface must claim exactly that number. ---
+# The #2729 messaging refresh dropped the count from docs/index.html,
+# docs/llms.txt, pkg/npm/README.md, scripts/package-release.sh and server.json;
+# section 4 below still fails if any of them states a count again unregistered.
 SURFACES=(
     README.md
-    docs/index.html
-    docs/llms.txt
-    pkg/npm/README.md
     pkg/chocolatey/codebase-memory-mcp.nuspec
-    scripts/package-release.sh
-    server.json
 )
 
 # Files that legitimately say "<N> languages" about something OTHER than the
diff --git a/tests/test_select_lanes.sh b/tests/test_select_lanes.sh
index 175ff88d89..4c8183fdcb 100755
--- a/tests/test_select_lanes.sh
+++ b/tests/test_select_lanes.sh
@@ -275,6 +275,31 @@ if proc.returncode != 0 or got != ["internal/cbm/grammar_go.c",
                                    "vendored/sqlite3/sqlite3.c"]:
     failures.append(f"codeql (c): the retrace helper must list the translation units for "
                     f"changed vendored code and wrappers, got {got} (exit {proc.returncode})")
+# Native Windows Python emits CRLF even when the change list uses LF. Pin
+# that producer/consumer boundary on every platform, including direct wrapper
+# paths that must survive verbatim rather than being mapped to a family name.
+crlf_root = work / "crlf-selector"
+crlf_scripts = crlf_root / "scripts" / "ci"
+crlf_scripts.mkdir(parents=True)
+(crlf_scripts / retrace.name).write_bytes(retrace.read_bytes())
+expected_retrace = ["internal/cbm/grammar_go.c", "internal/cbm/grammar_json.c",
+                    "internal/cbm/ts_runtime.c", "vendored/sqlite3/sqlite3.c"]
+for path in expected_retrace:
+    fixture = crlf_root / path
+    fixture.parent.mkdir(parents=True, exist_ok=True)
+    fixture.touch()
+(crlf_scripts / "select-lanes.sh").write_bytes(
+    b"#!/usr/bin/env bash\nprintf '%s\\r\\n' "
+    b"internal/cbm/vendored/grammars/go/parser.c internal/cbm/grammar_json.c "
+    b"internal/cbm/ts_runtime.c vendored/sqlite3/sqlite3.c\n")
+proc = subprocess.run([bash, str(crlf_scripts / retrace.name),
+                       "--changed", str(changed), str(listed)],
+                      capture_output=True, text=True, env=env)
+got = listed.read_bytes() if listed.exists() else None
+if proc.returncode != 0 or got != ("\n".join(expected_retrace) + "\n").encode("utf-8"):
+    failures.append(f"codeql CRLF: the retrace helper must preserve every changed "
+                    f"wrapper and write LF entrypoints, got {got!r} (exit {proc.returncode})")
+
 for label, args in (("an unreadable change list", ["--changed", str(work / "missing.txt")]),
                     ("no pull request", [])):
     listed.write_text("stale\n", encoding="utf-8")