@@ -35,7 +35,10 @@ coverage:
       Actions are on), and selected_actions with no allowed_actions infers allowed_actions:
       selected. RISK: a key GitHub adds that belongs on a NEW sub-endpoint gets routed to the base
       PUT where GitHub ignores it; audit the routing whenever GitHub adds a permissions
-      sub-endpoint.
+      sub-endpoint. Snapshot reads every endpoint back onto its key (the allowlist only under the
+      selected policy; the read-only fields each GET adds, like maximum_allowed_days, fall away); a
+      sub-endpoint the token cannot read, such as the OIDC template under a token without the
+      Actions permission, is noted and left out rather than failing the section.
 schema:
   SettingsFile.actions: GitHub Actions permissions for the repository.
   ActionsConfig: GitHub Actions settings, routed to the right endpoint by key.
 
@@ -6,6 +6,7 @@ import { MockApi } from "../../../test/mock-api.js";
 import { provePlanIdempotent } from "../../../test/sections/plan-idempotence.js";
 import { REPO } from "../../../test/sections/section-run.js";
 import { PermissionDenied } from "../contract/errors.js";
+import { sectionGrant } from "../contract/module.js";
 import { grantFor } from "../contract/permissions.js";
 import { actionsSection, endpointRouted } from "./index.js";
 // The casts on some plan() inputs below simulate keys GitHub adds: the
@@ -572,6 +573,7 @@ describe("actions", () => {
       label: "actions.access",
       applied: "applied",
       body: (value) => ({ access_level: value }),
+      read: () => "none",
     });
     expect(typeof paired.plan).toBe("function");
     endpointRouted<"access_level", "Access">({
@@ -581,13 +583,15 @@ describe("actions", () => {
       label: "actions.access",
       applied: "applied",
       body: (value) => ({ access_level: value }),
+      read: () => "none",
     });
     // @ts-expect-error an enum-valued key cannot be PUT bare: body is required
     endpointRouted<"access_level", "Access">({
       get: "getAccess",
       put: "putAccess",
       label: "actions.access",
       applied: "applied",
+      read: () => "none",
     });
   });
 
@@ -601,3 +605,127 @@ describe("actions", () => {
     const _silent: Op = silent;
   });
 });
+
+describe("actions snapshot", () => {
+  const snapshot = (api: GithubClient) =>
+    actionsSection.snapshot(planContext(actionsSection, api, REPO));
+  /** The note a sub-read the fake has no body for produces: its 404 classifies as a denial. */
+  const leftOut = (key: string, path: string, grant = sectionGrant(actionsSection)) =>
+    `actions.${key}: left out of the snapshot - the token was denied GET ${path}: 404 Not Found (a 404 here can also mean the resource does not exist). To fix, ${grant}`;
+
+  test("reads every endpoint back onto its key, dropping the server fields each GET adds", async () => {
+    const api = liveActions({
+      [BASE]: {
+        enabled: true,
+        allowed_actions: "selected",
+        selected_actions_url: `https://api.github.com${BASE}/selected-actions`,
+      },
+      [`${BASE}/selected-actions`]: {
+        github_owned_allowed: true,
+        verified_allowed: false,
+        patterns_allowed: ["actions/*"],
+      },
+      [`${BASE}/workflow`]: {
+        default_workflow_permissions: "read",
+        can_approve_pull_request_reviews: false,
+      },
+      [`${BASE}/access`]: { access_level: "organization" },
+      [`${BASE}/artifact-and-log-retention`]: { days: 30, maximum_allowed_days: 400 },
+      "/repos/o/r/actions/cache/retention-limit": { max_cache_retention_days: 5 },
+      "/repos/o/r/actions/cache/storage-limit": { max_cache_size_gb: 20 },
+      "/repos/o/r/actions/oidc/customization/sub": {
+        use_default: false,
+        include_claim_keys: ["repo", "context"],
+      },
+      [`${BASE}/fork-pr-contributor-approval`]: { approval_policy: "first_time_contributors" },
+      [`${BASE}/fork-pr-workflows-private-repos`]: {
+        run_workflows_from_fork_pull_requests: true,
+        send_write_tokens_to_workflows: false,
+        send_secrets_and_variables: false,
+        require_approval_for_fork_pr_workflows: true,
+      },
+    });
+    expect(await snapshot(api)).toEqual({
+      value: {
+        enabled: true,
+        allowed_actions: "selected",
+        default_workflow_permissions: "read",
+        can_approve_pull_request_reviews: false,
+        selected_actions: {
+          github_owned_allowed: true,
+          verified_allowed: false,
+          patterns_allowed: ["actions/*"],
+        },
+        access_level: "organization",
+        artifact_and_log_retention: { days: 30 },
+        cache: { max_cache_retention_days: 5, max_cache_size_gb: 20 },
+        oidc_customization_sub: { use_default: false, include_claim_keys: ["repo", "context"] },
+        fork_pr_contributor_approval: { approval_policy: "first_time_contributors" },
+        fork_pr_workflows_private_repos: {
+          run_workflows_from_fork_pull_requests: true,
+          send_write_tokens_to_workflows: false,
+          send_secrets_and_variables: false,
+          require_approval_for_fork_pr_workflows: true,
+        },
+      },
+      notes: [],
+    });
+    expect(api.writes).toEqual([]);
+  });
+
+  test("a denied sub-read is a note naming its key with the read's own grant; the allowlist is skipped off the selected policy", async () => {
+    const live = liveActions({
+      [BASE]: { enabled: true, allowed_actions: "all" },
+      [`${BASE}/artifact-and-log-retention`]: { days: 90, maximum_allowed_days: 400 },
+      "/repos/o/r/actions/cache/retention-limit": { max_cache_retention_days: 7 },
+      "/repos/o/r/actions/cache/storage-limit": { max_cache_size_gb: 10 },
+      [`${BASE}/fork-pr-contributor-approval`]: { approval_policy: "all_external_contributors" },
+    });
+    const requested: string[] = [];
+    const api: GithubClient = {
+      tryRequest: (method, path, payload) => {
+        requested.push(`${method} ${path}`);
+        return live.tryRequest(method, path, payload);
+      },
+      tryGraphql: live.tryGraphql,
+    };
+    const read = await snapshot(api);
+    expect(read).toEqual({
+      value: {
+        enabled: true,
+        allowed_actions: "all",
+        artifact_and_log_retention: { days: 90 },
+        cache: { max_cache_retention_days: 7, max_cache_size_gb: 10 },
+        fork_pr_contributor_approval: { approval_policy: "all_external_contributors" },
+      },
+      notes: [
+        leftOut(
+          "default_workflow_permissions/can_approve_pull_request_reviews",
+          `${BASE}/workflow`,
+        ),
+        leftOut("access_level", `${BASE}/access`),
+        leftOut(
+          "oidc_customization_sub",
+          "/repos/o/r/actions/oidc/customization/sub",
+          grantFor({ repo: ["actions"] }, undefined, "write"),
+        ),
+        `${leftOut("fork_pr_workflows_private_repos", `${BASE}/fork-pr-workflows-private-repos`)}. Note: the fork PR workflow settings are documented for private repositories, so a denial here can also mean the repository is public`,
+      ],
+    });
+    // Off the "selected" policy there is no allowlist to read, so the GET is never issued.
+    expect(requested).not.toContain(`GET ${BASE}/selected-actions`);
+    expect(live.writes).toEqual([]);
+  });
+
+  test("a denied primary read fails the section like any other, carrying the grant advice", async () => {
+    const api = liveActions({});
+    let thrown: unknown;
+    try {
+      await snapshot(api);
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown).toBeInstanceOf(PermissionDenied);
+    expect((thrown as PermissionDenied).detail).toContain(sectionGrant(actionsSection));
+  });
+});
@@ -20,6 +20,7 @@ import {
   plainData,
   type SectionPlan,
 } from "../contract/plan.js";
+import { projectOntoSchema, readOrNote } from "../shared/snapshot-helpers.js";
 import { ActionsConfig } from "./schema.js";
 
 const permission: SectionPermission = { repo: ["administration"] };
@@ -205,10 +206,13 @@ function sameClaimKeyOrder(declared: readonly string[], live: readonly string[])
  */
 const LiveOidcSub = z.looseObject({ include_claim_keys: z.array(z.string()).nullish() });
 
+/** The base-permissions keys as the primary read reports them; the allowlist read hangs off the policy. */
+type BasePermissions = Pick<ActionsConfig, "enabled" | "allowed_actions">;
+
 /**
- * A key served by its own endpoint pair. The routing table holds the handler
- * itself, so a routed key without a handler cannot exist; a function-valued
- * property, not method shorthand, so the per-key value types check strictly.
+ * A key served by its own endpoint pair. The routing table holds the handlers
+ * themselves, so a routed key without one cannot exist; function-valued
+ * properties, not method shorthand, so the per-key value types check strictly.
  */
 interface RoutedDestination<K extends keyof ActionsConfig> {
   /** Read the live state and plan the write the declared value is due. */
@@ -218,12 +222,18 @@ interface RoutedDestination<K extends keyof ActionsConfig> {
     declared: NonNullable<ActionsConfig[K]>,
     plan: ActionsPlan,
   ) => Promise<void>;
+  /** Read the live state back as the settings file would declare it; undefined when none applies. */
+  snapshot: (
+    ctx: ActionsContext,
+    section: SectionMeta,
+    base: BasePermissions,
+  ) => Promise<ActionsConfig[K]>;
 }
 
 /**
- * The standard routed key: GET, diff under `label`, PUT the body on drift.
- * `N` is inferred from the GET alone so a PUT of another name does not
- * compile; a non-object value (access_level) must say how it becomes a body.
+ * The standard routed key: GET, diff under `label`, PUT the body on drift; the snapshot is the
+ * GET read back through `read`. `N` is inferred from the GET alone so a PUT of another name does
+ * not compile; a non-object value (access_level) must say how it becomes a body.
  */
 export function endpointRouted<K extends keyof ActionsConfig, N extends string>(
   wiring: {
@@ -237,6 +247,8 @@ export function endpointRouted<K extends keyof ActionsConfig, N extends string>(
     applied: string;
     /** describe prose for the PUT, where the section spells one. */
     describe?: string;
+    /** The GET body as the settings file declares the key (the inverse of `body`). */
+    read: (live: unknown) => ActionsConfig[K];
   } & (NonNullable<ActionsConfig[K]> extends Record<string, unknown>
     ? { body?: (declared: NonNullable<ActionsConfig[K]>) => Record<string, unknown> }
     : { body: (declared: NonNullable<ActionsConfig[K]>) => Record<string, unknown> }),
@@ -259,9 +271,16 @@ export function endpointRouted<K extends keyof ActionsConfig, N extends string>(
         });
       }
     },
+    snapshot: async (ctx) => wiring.read(await ctx.read[wiring.get].call()),
   };
 }
 
+/** The live body of one routed key projected onto its slice of the section shape. */
+function sliceOf<K extends keyof ActionsConfig>(key: K): (live: unknown) => ActionsConfig[K] {
+  const slice: z.ZodType = ActionsConfig.shape[key];
+  return (live) => projectOntoSchema(slice, live) as ActionsConfig[K];
+}
+
 // Forward-compatible key routing: every DECLARED ActionsConfig key names its
 // destination here - "base" and "workflow" keys merge into those two PUT
 // bodies, and a key with its own endpoint pair carries the HANDLER that
@@ -294,6 +313,15 @@ const KEY_DESTINATION = {
         });
       }
     },
+    // The allowlist exists only under the "selected" policy (the GET 409s otherwise), so no
+    // other policy reads it: an allowlist beside another policy is a document the shape rejects.
+    snapshot: async (ctx, _section, base) => {
+      if (base.allowed_actions !== "selected") {
+        return undefined;
+      }
+      const probe = await ctx.read.getSelected.probeAbsent();
+      return "missing" in probe ? undefined : sliceOf("selected_actions")(probe.data);
+    },
   },
   default_workflow_permissions: "workflow",
   can_approve_pull_request_reviews: "workflow",
@@ -303,13 +331,15 @@ const KEY_DESTINATION = {
     label: "actions.access",
     applied: "applied workflows access level",
     body: (value) => ({ access_level: value }),
+    read: (live) => sliceOf("access_level")((live as { access_level?: unknown }).access_level),
   }),
   artifact_and_log_retention: endpointRouted({
     get: "getRetention",
     put: "putRetention",
     label: "actions.artifact_and_log_retention",
     applied: "applied artifact and log retention",
     describe: "setting the artifact and log retention window",
+    read: sliceOf("artifact_and_log_retention"),
   }),
   cache: {
     plan: async (ctx, _section, declared, plan) => {
@@ -332,6 +362,14 @@ const KEY_DESTINATION = {
         }
       }
     },
+    // Each limit is its own GET; merged, the strict cache slice keeps exactly the two keys.
+    snapshot: async (ctx) => {
+      const limits: Record<string, unknown> = {};
+      for (const wiring of Object.values(CACHE_ENDPOINT_BY_KEY)) {
+        Object.assign(limits, await ctx.read[wiring.get].call());
+      }
+      return sliceOf("cache")(limits);
+    },
   },
   oidc_customization_sub: {
     plan: async (ctx, section, declared, plan) => {
@@ -370,20 +408,26 @@ const KEY_DESTINATION = {
         });
       }
     },
+    snapshot: async (ctx, section) =>
+      sliceOf("oidc_customization_sub")(
+        parseLive(section, ENDPOINTS.getOidcSub, LiveOidcSub, await ctx.read.getOidcSub.call()),
+      ),
   },
   fork_pr_contributor_approval: endpointRouted({
     get: "getForkPrApproval",
     put: "putForkPrApproval",
     label: "actions.fork_pr_contributor_approval",
     applied: "applied the fork PR contributor approval policy",
     describe: "setting the fork PR contributor approval policy",
+    read: sliceOf("fork_pr_contributor_approval"),
   }),
   fork_pr_workflows_private_repos: endpointRouted({
     get: "getForkPrPrivate",
     put: "putForkPrPrivate",
     label: "actions.fork_pr_workflows_private_repos",
     applied: "applied the private-repo fork PR workflow settings",
     describe: "setting the private-repo fork PR workflow settings",
+    read: sliceOf("fork_pr_workflows_private_repos"),
   }),
 } satisfies { [K in keyof ActionsConfig]-?: "base" | "workflow" | RoutedDestination<K> };
 
@@ -426,6 +470,20 @@ async function planRouted<K extends RoutedKey>(
   await ROUTED_DESTINATIONS[key].plan(ctx, section, declared, plan);
 }
 
+/** Read one routed key back; generic so the handler and the value stay correlated to one key. */
+async function snapshotRouted<K extends RoutedKey>(
+  key: K,
+  ctx: ActionsContext,
+  section: SectionMeta,
+  base: BasePermissions,
+  notes: string[],
+): Promise<ActionsConfig[K]> {
+  const read = await readOrNote(notes, `actions.${key}`, () =>
+    ROUTED_DESTINATIONS[key].snapshot(ctx, section, base),
+  );
+  return "denied" in read ? undefined : read.value;
+}
+
 function keysTo(destination: "base" | "workflow"): Set<string> {
   return new Set(
     Object.entries(KEY_DESTINATION)
@@ -520,4 +578,27 @@ export const actionsSection = {
     }
     return plan;
   },
+  /**
+   * The base permissions (the primary read; a denial classifies like any section's), the workflow
+   * token defaults, and every routed key read back onto its slice of the shape. A key the token
+   * cannot read is a note naming it, never a failure of the section.
+   */
+  async snapshot(ctx) {
+    const notes: string[] = [];
+    const base = projectOntoSchema(ActionsConfig, await ctx.read.getPermissions.call());
+    const value: Record<string, unknown> = { ...base };
+    const workflow = await readOrNote(notes, `actions.${[...WORKFLOW_KEYS].join("/")}`, () =>
+      ctx.read.getWorkflow.call(),
+    );
+    if (!("denied" in workflow)) {
+      Object.assign(value, projectOntoSchema(ActionsConfig, workflow.value));
+    }
+    for (const key of ROUTED_KEYS) {
+      const read = await snapshotRouted(key, ctx, this, base, notes);
+      if (read !== undefined) {
+        value[key] = read;
+      }
+    }
+    return { value: value as ActionsConfig, notes };
+  },
 } satisfies SectionModule<"actions", typeof ENDPOINTS>;