@@ -19,7 +19,8 @@ openstack_test_ote_run_serial: false
 # Keeps the bulk suite in batch to limit wall time. No-ops when the matchers
 # are absent (e.g. lb_tests allowlists). Requires OTE filtered run path.
 openstack_test_machines_leak_cluster_serial: true
-# Ordered substrings matched against list_of_tests_to_run.txt. For the
+# Ordered substrings matched against list_of_tests_to_run.txt (one phrase
+# each; written to a matchers file so shell never splits them). For the
 # MachineSet replica matcher, ControlPlane variants are skipped.
 openstack_test_machines_leak_cluster_matchers:
   - "Bugfix bz_2073398: [Serial] MachineSet scale-in does not leak OpenStack ports"
 
@@ -1,50 +1,63 @@
 #!/usr/bin/env python3
 """Split machines leak-cluster tests out of an OTE test list for serial coda.
 
-Reads the filtered list_of_tests_to_run.txt, writes:
+Reads the filtered list_of_tests_to_run.txt and an ordered matchers file
+(one substring per line), writes:
   - leak_cluster_serial.txt: ordered matches for Option B serial run
   - list_of_tests_to_run.txt: remaining tests for the batch suite
 
-Matchers are plain substrings. The MachineSet replica matcher skips any line
-that also contains "ControlPlane".
+Matchers are plain substrings (one full phrase per line). The MachineSet
+replica matcher skips any line that also contains "ControlPlane".
 """
 from __future__ import annotations
 
 import argparse
 import sys
 
 
+def load_matchers(path: str) -> list[str]:
+    with open(path, "r", encoding="utf-8") as f:
+        return [ln.strip() for ln in f if ln.strip() and not ln.strip().startswith("#")]
+
+
+def pick(remaining: list[str], matcher: str) -> str | None:
+    for ln in remaining:
+        if not ln.strip():
+            continue
+        if matcher not in ln:
+            continue
+        # Avoid ControlPlane MachineSet when matching worker MachineSet replica.
+        if "MachineSet replica number corresponds to the number of Machines" in matcher:
+            if "ControlPlane" in ln:
+                continue
+        return ln
+    return None
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("tests_to_run_path")
     parser.add_argument("leak_cluster_path")
     parser.add_argument(
-        "matchers",
-        nargs="+",
-        help="Ordered substrings to pull into the serial leak-cluster list",
+        "matchers_file",
+        help="File with one matcher substring per line (ordered)",
     )
     args = parser.parse_args()
 
+    matchers = load_matchers(args.matchers_file)
+    if not matchers:
+        print("leak_cluster=0 batch_remaining=unchanged (empty matchers file)")
+        open(args.leak_cluster_path, "w", encoding="utf-8").close()
+        return 0
+
     with open(args.tests_to_run_path, "r", encoding="utf-8") as f:
         lines = [ln.rstrip("\n") for ln in f]
 
     remaining = list(lines)
     selected: list[str] = []
 
-    for matcher in args.matchers:
-        found = None
-        for ln in remaining:
-            if not ln.strip():
-                continue
-            if matcher not in ln:
-                continue
-            if matcher.startswith("MachineSet replica") and "ControlPlane" in ln:
-                continue
-            if "MachineSet replica number corresponds to the number of Machines" in matcher:
-                if "ControlPlane" in ln:
-                    continue
-            found = ln
-            break
+    for matcher in matchers:
+        found = pick(remaining, matcher)
         if found is None:
             continue
         selected.append(found)
 
@@ -146,20 +146,32 @@
   ansible.builtin.set_fact:
     openstack_test_leak_cluster_path: >-
       {{ openstack_test_results_dir }}/machines_leak_cluster_serial.txt
+    openstack_test_leak_cluster_matchers_path: >-
+      {{ openstack_test_results_dir }}/machines_leak_cluster_matchers.txt
+  when:
+    - openstack_test_use_ote | bool
+    - openstack_test_machines_leak_cluster_serial | bool
+    - openstack_test_filtering | bool
+
+# Write matchers one-per-line so multi-word phrases are never shell-split.
+- name: Write machines leak-cluster matchers file
+  ansible.builtin.copy:
+    dest: "{{ openstack_test_leak_cluster_matchers_path }}"
+    mode: "0644"
+    content: "{{ openstack_test_machines_leak_cluster_matchers | map('trim') | join('\n') }}\n"
   when:
     - openstack_test_use_ote | bool
     - openstack_test_machines_leak_cluster_serial | bool
     - openstack_test_filtering | bool
 
 - name: Split machines leak-cluster tests from batch list for serial coda
-  ansible.builtin.shell: |
-    set -o pipefail
-    python3 "{{ role_path }}/files/split_machines_leak_cluster.py" \
-      "{{ tests_to_run_path }}" \
-      "{{ openstack_test_leak_cluster_path }}" \
-    {% for m in openstack_test_machines_leak_cluster_matchers %}
-      {{ m | quote }}{% if not loop.last %} \{% endif %}
-    {% endfor %}
+  ansible.builtin.command:
+    argv:
+      - python3
+      - "{{ role_path }}/files/split_machines_leak_cluster.py"
+      - "{{ tests_to_run_path }}"
+      - "{{ openstack_test_leak_cluster_path }}"
+      - "{{ openstack_test_leak_cluster_matchers_path }}"
   register: openstack_test_leak_cluster_split
   changed_when: true
   when: