diff --git a/scripts/tests/test_workflow_job_guards.py b/scripts/tests/test_workflow_job_guards.py
index e7fc09c58..4757a2ef4 100644
--- a/scripts/tests/test_workflow_job_guards.py
+++ b/scripts/tests/test_workflow_job_guards.py
@@ -64,6 +64,15 @@ ROLES = frozenset({GUARD, ADVISORY, NONE})
 # role -> the Kind the row must carry. `none` is absent by construction: it takes no row.
 ROLE_KIND = {GUARD: "GUARD", ADVISORY: "ADVISORY"}
 
+# Keyed on the `<workflow>.yml::<job>` shape of the first cell, so this cannot match a row of the
+# file-guard table (or any other) even before `inventory_section()` narrows the text.
+#
+# A MALFORMED ROW FAILS CLOSED, which is the property that makes a regex acceptable here at all.
+# `[^|]*` for the Blocks cell means a raw `|` inside it (a code span such as `grep … | cut …`)
+# stops the row matching — and an unmatched row is an ABSENT row, which the set equality reports as
+# a guard job with no entry. Measured: injecting a pipe into one Blocks cell reddens
+# `test_the_inventory_covers_exactly_the_guard_JOBS_that_exist` naming that job. The failure is a
+# loud red on a correct-looking table, never a silently skipped row.
 _ROW = re.compile(r"^\|\s*`([a-z0-9.-]+\.ya?ml::[A-Za-z0-9_-]+)`\s*\|([^|]*)\|\s*([A-Z]+)\s*\|", re.M)