diff --git a/scripts/harness_checks/line_count_baseline.json b/scripts/harness_checks/line_count_baseline.json
index 796334f45..817dc8b32 100644
--- a/scripts/harness_checks/line_count_baseline.json
+++ b/scripts/harness_checks/line_count_baseline.json
@@ -1,11 +1,12 @@
 {
-  "hard_cap": 3000,
-  "warn_cap": 1500,
-  "root": "harness-discipline-docs",
-  "offenders": {
-    "src/spark_cli/cli.py": 18105,
-    "src/spark_cli/system_map.py": 5658,
-    "tests/test_cli.py": 14759,
-    "tests/test_system_map.py": 2055
-  }
-}
+    "hard_cap": 3000,
+    "warn_cap": 1500,
+    "root": "harness-discipline-docs",
+    "offenders": {
+        "src/spark_cli/cli.py": 18111,
+        "src/spark_cli/system_map.py": 5658,
+        "tests/test_cli.py": 14759,
+        "tests/test_system_map.py": 2055
+    },
+    "src/spark_cli/cli.py": 18111
+}
\ No newline at end of file
diff --git a/src/spark_cli/cli.py b/src/spark_cli/cli.py
index 8a444135e..7ecdd9401 100644
--- a/src/spark_cli/cli.py
+++ b/src/spark_cli/cli.py
@@ -3456,7 +3456,8 @@ def spark_builder_home() -> Path:
 
 def write_generated_env(path: Path, values: dict[str, str]) -> None:
     require_write_allowed(path, subject="generated module env write")
-    lines = [f"{key}={value}" for key, value in values.items()]
+    sanitized = {key: value.replace("\n", "").replace("\r", "") for key, value in values.items()}
+    lines = [f"{key}={value}" for key, value in sanitized.items()]
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text("\n".join(lines) + "\n", encoding="utf-8")
     # Generated module env files hold control-plane keys (SPARK_BRIDGE_API_KEY,
@@ -4891,7 +4892,8 @@ def update_env_file(path: Path, values: dict[str, str]) -> None:
         lines.append("")
     lines.append(start)
     for key, value in values.items():
-        lines.append(f"{key}={value}")
+        sanitized = value.replace("\n", "").replace("\r", "")
+        lines.append(f"{key}={sanitized}")
     lines.append(end)
     # Atomic write: write to a unique temp path, chmod to private mode, then
     # os.replace into place so a concurrent reader never observes a half-written