fix(quality): enumeration guard sees naming, not comments — F1/F2/F3 from 20155

F1 (demonstrated defect): surface 2 was a regex over raw YAML text, so a
commented-out ci.yml invocation still counted as enumerated — #1017's own
failure mode reproduced inside the fix, in the most common disable path
there is. Comment lines are now skipped before matching; needles n8/c4
pin both polarities (a comment is not enumeration; a comment naming an
absent path raises no false stale-enumeration). The residual trailing-
comment limit is documented where the grep lives.

F2 (structural): the guard was link [0] of the six-hop pnpm chain it
guards, so severing that chain silenced guard and guarded together.
ci.yml now invokes it directly from the sanitization step too — reachable
from both surfaces it audits, so either path alone keeps one instrument
running.

F3 (vocabulary): failure line and header said 'reachable'; F1/F2 prove
the guard measures NAMING. It now says 'enumerated' everywhere, matching
the success line.

Needles: 14 passed / 0 failed. Real tree: population 44, enumerated 25,
excluded (signed) 19, surfaces 38, unchanged — F2's line adds redundancy,
not membership. F1 demo replayed against the fix: commenting out
test-install-migration.sh now fails loud (UNENUMERATED, rc=1).

Written-by: pepper (sb-it-1-dt)
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/quality/scripts/test-check-test-enumeration.sh

@@ -13,7 +13,10 @@
 #   n6 is the 20124 boundary file (a suite the strict prefix cannot name);
 #   n2b proves surface 2 is PARSED, not line-ranged (three seats mis-scoped
 #       hand-written ranges against ci.yml);
-#   n5/n7 keep the exclusions file honest so it cannot become the next silent cap.
+#   n5/n7 keep the exclusions file honest so it cannot become the next silent cap;
+#   n8/c4 are F1 (20155): a commented-out ci.yml line is NOT enumeration —
+#       commenting-out is the most common way a suite actually gets disabled,
+#       and it must fail loud in one direction without false-staling the other.
 
 set -uo pipefail
 
@@ -142,6 +145,17 @@ R="$(fixture n5)"
 excl "$R" "packages/mosaic/framework/tools/git/test-a.sh | already in CI but excluded anyway"
 expect NEEDLE 1 "contradictory exclusion rejected" --out "CONTRADICTORY EXCLUSION" -- "$R"
 
+echo "=== n8/c4: a commented-out ci.yml line is not enumeration (F1, 20155) ==="
+R="$(fixture n8)"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$R/packages/mosaic/framework/tools/git/test-disabled.sh"
+printf '      # - bash packages/mosaic/framework/tools/git/test-disabled.sh\n' >> "$R/.woodpecker/ci.yml"
+expect NEEDLE 1 "suite named only in a commented-out invocation is UNENUMERATED" \
+    --out "UNENUMERATED: 'packages/mosaic/framework/tools/git/test-disabled.sh'" -- "$R"
+R="$(fixture c4)"
+printf '      # - bash packages/mosaic/framework/tools/git/test-vanished.sh\n' >> "$R/.woodpecker/ci.yml"
+expect CONTROL 0 "comment naming an absent path raises no false stale-enumeration" \
+    --out "enumeration guard: OK" -- "$R"
+
 echo "=== n7: excluding a file outside the population is dead weight, not coverage ==="
 R="$(fixture n7)"
 excl "$R" "packages/mosaic/framework/tools/quality/scripts/verify-thing.sh | not a suite but signing it anyway"