@@ -2,7 +2,7 @@
 
 Guidance for writing, changing, and reviewing Cozystack's end-to-end (E2E) tests and the CI that runs them. Read this **before** touching anything under `hack/e2e-chainsaw/`, the bootstrap/OpenAPI BATS (`hack/e2e-*.bats`), `hack/*.sh` test helpers, either E2E CI workflow (`.github/workflows/pull-requests.yaml` for same-repo pull requests, `.github/workflows/e2e-fork.yaml` for forks), or `packages/core/testing/`. §10 covers how the two split the work and which invariants hold them together.
 
-The app suite is **Kyverno Chainsaw** (`hack/e2e-chainsaw/`, one directory per app, each with a `chainsaw-test.yaml`; §7 lists the other layouts Chainsaw accepts). Cluster bootstrap (`hack/e2e-install-cozystack.bats`, `hack/e2e-prepare-cluster.bats`) and the OpenAPI checks (`hack/e2e-test-openapi.bats`) remain BATS.
+The app suite is **Kyverno Chainsaw** (`hack/e2e-chainsaw/`, one directory per app, usually with a `chainsaw-test.yaml`; the README there describes the layouts a suite can take, and §7 how they are selected). Cluster bootstrap (`hack/e2e-install-cozystack.bats`, `hack/e2e-prepare-cluster.bats`) and the OpenAPI checks (`hack/e2e-test-openapi.bats`) remain BATS.
 
 ## The core principle
 
 
@@ -434,6 +434,42 @@ baseline_of_platform() {
   rm -rf "$FIX"
 }
 
+@test "an allowlist entry is accepted for every suite layout the selectors see" {
+  # hack/select-e2e.sh enumerates a suite as a directory in or below which
+  # Chainsaw finds a Test: chainsaw-test.yaml, chainsaw-test.yml, numbered step
+  # files, or a Test nested in a subdirectory. The allowlist has to accept the
+  # same set, or a suite that runs cannot be exempted and the run stops before
+  # the first suite.
+  new_fixture
+  mkdir -p "$FIX/root/plain" "$FIX/root/yml" "$FIX/root/steps" "$FIX/root/nested/sub"
+  : >"$FIX/root/plain/chainsaw-test.yaml"
+  : >"$FIX/root/yml/chainsaw-test.yml"
+  : >"$FIX/root/steps/01-install.yaml"
+  : >"$FIX/root/nested/sub/chainsaw-test.yaml"
+  printf 'plain cozystack/cozystack#1\nyml cozystack/cozystack#1\nsteps cozystack/cozystack#1\nnested cozystack/cozystack#1\n' >"$FIX/allow"
+  lg lg_allowlist_validate "$FIX/allow" "$FIX/root"
+  rm -rf "$FIX"
+}
+
+@test "a parked, empty or step-file-less suite directory cannot be allowlisted" {
+  # A chainsaw-test.yaml.disabled is registered nowhere and runs nowhere, so an
+  # exemption for it would exempt nothing today and a real suite the day the
+  # suffix goes. A file that only looks like a step file (no digits before the
+  # dash) is not one to Chainsaw either.
+  new_fixture
+  mkdir -p "$FIX/root/parked" "$FIX/root/empty" "$FIX/root/notsteps"
+  : >"$FIX/root/parked/chainsaw-test.yaml.disabled"
+  : >"$FIX/root/notsteps/install-01.yaml"
+  for suite in parked empty notsteps; do
+    printf '%s cozystack/cozystack#1\n' "$suite" >"$FIX/allow"
+    if lg lg_allowlist_validate "$FIX/allow" "$FIX/root" 2>/dev/null; then
+      echo "an allowlist entry for '$suite' was accepted" >&2
+      return 1
+    fi
+  done
+  rm -rf "$FIX"
+}
+
 @test "an allowlist whose last line has no newline still has that line validated" {
   new_fixture
   mkdir -p "$FIX/root/kafka"
 
@@ -18,7 +18,15 @@ hack/e2e-chainsaw/
 └── ...
 ```
 
-Suites: `postgres`, `bucket`, `mariadb`, `mongodb`, `redis`, `valkey`, `qdrant`, `clickhouse`, `kafka`, `kafka-metadata`, `rabbitmq`, `etcd`, `openbao`, `harbor`, `foundationdb`, `external-dns`, `kuberture`, `vminstance`, `gateway`, `opensearch`, `monitoring`, `kubernetes-latest`, `kubernetes-previous`, `securitygroup`, `seaweedfs`, `computeplane`.
+A suite is a directory directly under `hack/e2e-chainsaw/` in or below which Chainsaw finds a Test. Three layouts do that, and the selector (`hack/select-e2e.sh`), the runner (`hack/e2e-chainsaw-run.sh`) and the leak-guard allowlist all recognise the same three:
+
+- `chainsaw-test.yaml`, the usual one, or `chainsaw-test.yml` when the `.yaml` is absent;
+- numbered step files such as `01-install.yaml`, which Chainsaw turns into a Test on its own when neither of the above exists;
+- either of those in a subdirectory of the suite, since Chainsaw walks every subdirectory of the directory it is handed.
+
+A parked `chainsaw-test.yaml.disabled` is none of these: the directory is then not a suite, is selected by nothing and cannot be allowlisted.
+
+Suites: `postgres`, `bucket`, `mariadb`, `mongodb`, `redis`, `valkey`, `qdrant`, `clickhouse`, `kafka`, `kafka-metadata`, `rabbitmq`, `etcd`, `openbao`, `harbor`, `foundationdb`, `external-dns`, `kuberture`, `vminstance`, `gateway`, `opensearch`, `monitoring`, `kubernetes-latest`, `kubernetes-previous`, `securitygroup`, `seaweedfs`, `computeplane`. `kubernetes-proxmox` is parked as `chainsaw-test.yaml.disabled` and runs only in `.github/workflows/e2e-proxmox.yaml`, which needs a Proxmox hypervisor.
 
 ## What Chainsaw buys over the BATS suite
 
@@ -30,7 +38,7 @@ Suites: `postgres`, `bucket`, `mariadb`, `mongodb`, `redis`, `valkey`, `qdrant`,
 
 ## Test anatomy
 
-Each suite is a directory with a `chainsaw-test.yaml` (one or more `Test` docs) plus the manifests it applies. A step has `try` (operations: `apply`, `assert`, `error`, `script`, `delete`, …), optional `catch` (diagnostics on failure), and optional `finally` (teardown regardless of outcome).
+Each suite is a directory with one or more `Test` docs (in one of the layouts above, usually a `chainsaw-test.yaml`) plus the manifests it applies. A step has `try` (operations: `apply`, `assert`, `error`, `script`, `delete`, …), optional `catch` (diagnostics on failure), and optional `finally` (teardown regardless of outcome).
 
 Declarative suites assert on `status.conditions` and concrete fields. Inherently imperative suites keep their logic in `script` steps:
 
 
@@ -175,9 +175,30 @@ lg_allowlisted() {
     awk -v s="$1" '$1 !~ /^#/ && $1 == s { print $2; exit }' "$2"
 }
 
+# lg_suite_has_test ROOT SUITE — true when ROOT/SUITE is a directory in or
+# below which Chainsaw would find a Test: a chainsaw-test.yaml, a
+# chainsaw-test.yml, or a numbered step file such as 01-install.yaml. This is
+# the rule hack/select-e2e.sh enumerates the suites with (the find and sed that
+# build all_apps there), spelled the same way on purpose: a layout one side
+# accepts and the other refuses would run a suite the selector never selects,
+# or make a suite that runs impossible to allowlist. Change both together. A
+# parked chainsaw-test.yaml.disabled matches none of the names.
+lg_suite_has_test() {
+    local root=$1 suite=$2 path
+    [ -d "$root/$suite" ] || return 1
+    while IFS= read -r path; do
+        case ${path##*/} in
+            chainsaw-test.yaml|chainsaw-test.yml) return 0 ;;
+        esac
+        [[ ${path##*/} =~ ^[0-9]+-[^/]*\.ya?ml$ ]] && return 0
+    done < <(find "$root/$suite" -mindepth 1 ! -type d \( -name chainsaw-test.yaml -o -name chainsaw-test.yml -o -name '[0-9]*-*.yaml' -o -name '[0-9]*-*.yml' \) 2>/dev/null)
+    return 1
+}
+
 # lg_allowlist_validate ALLOWLIST ROOT — every entry must name an existing suite
 # directory under ROOT and carry an issue ref, so a renamed or removed suite
-# cannot keep an exemption nobody reads.
+# cannot keep an exemption nobody reads. A suite directory is one Chainsaw
+# would find a Test in, whatever its layout (lg_suite_has_test).
 lg_allowlist_validate() {
     local list=$1 root=$2 bad=0 suite ref rest
     # `|| [ -n "$suite" ]` keeps a last line with no newline, which `read`
@@ -189,8 +210,8 @@ lg_allowlist_validate() {
             echo "leak-guard: allowlist line for '$suite' must be '<suite-dir> <issue-ref>'" >&2
             bad=1
         fi
-        if [ ! -f "$root/$suite/chainsaw-test.yaml" ] && [ ! -f "$root/$suite/chainsaw-test.yml" ]; then
-            echo "leak-guard: allowlist names '$suite', which is not a suite directory under $root" >&2
+        if ! lg_suite_has_test "$root" "$suite"; then
+            echo "leak-guard: allowlist names '$suite', which is not a suite directory under $root (no chainsaw-test.yaml, chainsaw-test.yml or numbered step file in or below it)" >&2
             bad=1
         fi
     done <"$list"