Function resolve_output 

pub fn resolve_output(
    declared: Option<EolMode>,
    autocrlf: Option<&str>,
    eol: Option<&str>,
) -> EolMode

What the working tree should receive, given the declaration and git’s config.

The table is measured, not guessed: autocrlf=true yields CRLF and ignores core.eol, autocrlf=input yields LF and ignores it too, and only autocrlf=false lets core.eol decide.

One row deliberately departs from git’s own table, since 2026-08-11: with core.autocrlf false or unset and core.eol unset, this writes the stored bytes back unchanged rather than the platform’s own ending. That is the configuration in which git converts nothing, and until this change declaring a path secret opted it into a conversion the same file would never have received while stored in the clear. Measured on git 2.55, two throwaway repositories, a declared path and an undeclared one holding identical bytes:

config	undeclared, git decides	declared, we decided	agreed?
autocrlf=true	LF in, CRLF out	CRLF out	yes
autocrlf=input	CRLF in, LF out	LF out	yes
autocrlf=false, eol unset	LF in, LF out	CRLF out	no
autocrlf=false, eol=lf	CRLF in, CRLF out	LF out	no

git status was clean in all four, so nothing signalled either mismatch. The third row is what this arm fixes; the fourth is the check-in half — clean normalises before the header can record which ending was there — and no choice made here can bring that back, so it stays a documented limit rather than a fixed one. What the change does buy for it is that the answer stops depending on the platform: after this, a declared path on Windows and on Linux receives identical bytes unless something explicitly asks otherwise, which is what §Non-Functional Requirements means by no differences across machines.

An explicit core.eol=native still selects the platform’s ending, because that is a user asking for it rather than a default nobody chose, and it is the way back to the previous behaviour without editing .git-xcrypt. So is eol=native on the pattern, which outranks all of this.

Nothing here touches a stored byte: clean never reads configuration, the ciphertext is unchanged, and whatever this writes normalises back to the same plaintext — so the repository stays clean across the change.