dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing '# service' on a data line becomes a hostname token. The inventory's Pi-hole renderer now emits pure IP-name lines (attribution lives in the inventory) and the tracked file is re-rendered to match; pihole.bats line-validity seams are green on the rendered artifact.