Bash's manifest reader stripped only the trailing newline, so a CRLF-terminated manifest left a stray \r on every hash, a UTF-8 BOM on the header line was folded into the "path" field, and an uppercase hash never matched sha256sum's lowercase output. Reproduced against a real manifest written by an earlier version of the PowerShell installer, where every single managed file was misreported as locally modified. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>