Stop kopia snapshotting comment lines as paths

SETUP.md

@@ -4374,6 +4374,47 @@ is on by default (not optional, unlike rclone which needs `crypt` bolted on),
 snapshots are content-defined-chunked so repeat backups only upload what
 changed, and scheduling is automatic.
 
+### Comment lines were being snapshotted as paths (fixed 2026-08-09)
+
+**The alert read as though Super Productivity's only durable copy had failed
+to back up. It hadn't.** The failing "sources" were the *comment lines* from
+`backup.sh`'s `SOURCES` list, being handed to kopia as paths:
+
+```
+FAILED: # Super Productivity's synced tasks. This is the ONLY durable copy — the app
+  unable to get local filesystem entry: lstat /# Super Productivity's synced tasks...
+```
+
+The notification quoted the comment text back, which is why it read like a
+description of lost data rather than a parse bug. The real directories two
+lines below —`copyparty/sp-sync` and `fizzy/storage`— snapshotted normally in
+the same run, seconds apart, with snapshot IDs.
+
+**Cause:** the loop skipped blank lines but not comments. The `SOURCES` list
+is deliberately commented inline (the notes explaining *why* sp-sync and
+fizzy/storage matter sit with the paths), so the first run after those
+comments were added — the night of 2026-08-09 — reported five failures.
+
+**Fix:** trim leading whitespace, then skip `''` and `#*`. Applies to
+`local-sources.txt` too, which may equally be commented.
+
+**Scope, checked rather than assumed:**
+
+- Runs happened every night (5th–9th) and all finished cleanly until the 9th
+  — **one night of noise, no missed backups**.
+- **No phantom sources entered the repository.** They failed at *prepare
+  source*, so nothing was registered — `kopia snapshot list` shows 47
+  sources, zero beginning `/#`. The alert's warning that the verifier would
+  flag them as stale was therefore moot.
+- `verify-backups.sh` does **not** share the bug: it derives active sources
+  from kopia's own policies, never from this list.
+- Verified by a real run: 0 FAILED lines, empty `.backup-failures`, and both
+  critical sources snapshotted.
+
+**Pre-existing cosmetic noise, left alone:** successful runs emit
+`Terminated: 15` lines to stderr as each per-source timeout killer is
+cleaned up after its `wait` returns. Harmless, unrelated to this fix.
+
 ### Database dumps run BEFORE every snapshot (added 2026-07-30)
 
 **The problem this fixes.** Until this was added, every database in this

kopia-mac/backup.sh

@@ -275,7 +275,16 @@ FAILED_FILE="$REPO_ROOT/kopia-mac/.backup-failures"
 : > "$FAILED_FILE"
 
 printf '%s\n' "$SOURCES" | while IFS= read -r source; do
-    [ -n "$source" ] || continue
+    # Skip blanks AND comments. The SOURCES list above is commented — the
+    # notes explaining WHY sp-sync and fizzy/storage matter sit inline with
+    # the paths — and local-sources.txt may be too. Without this, kopia is
+    # handed "# Super Productivity's synced tasks..." as a path, tries to
+    # snapshot /# Super Productivity's..., and the run reports FAILURES
+    # every night while the real directory two lines below backs up
+    # perfectly. Found 2026-08-09; the alert quoted the comment text back,
+    # which read alarmingly like the SP data itself had failed.
+    _trimmed=${source#"${source%%[![:space:]]*}"}
+    case "$_trimmed" in ''|'#'*) continue ;; esac
     log "snapshotting $source"
     _timeout_marker="$REPO_ROOT/kopia-mac/.timed-out.$$"
     rm -f "$_timeout_marker"