[Vivswan]

Before

- The document follows in the one canonical order every rendered document has (`mode: render` writes the same one): the sections in the order the action applies them, each section's keys as the schema declares them, the entries of every keyed list sorted by their identity (a label's `name`, a webhook's `config.url`, a deploy key's `title`; `branches` keep their order, since GitHub applies overlapping wildcard rules in creation order, pinned environments keep theirs, since it is the pin rank, and the next paragraph names the lists with no identity), every knobbed list section (the sections the undeclared policy counts) in its `{_undeclared, entries}` wrapper form with the section's default policy spelled out, and `environments`, `branches`, and `workflows` as bare lists, since their wrapper takes no policy. An apply from the file does exactly what the header says, and two snapshots of one repository are the same bytes. The lists left as written keep the order GitHub lists them in: ... (212 words)

After

- The document follows in the one canonical order every rendered document has (`mode: render` writes the same one), stated below. An apply from the file does exactly what the header says, and two snapshots of one repository are the same bytes.

The canonical order, outermost first:

- **Sections:** in the order the action applies them.
- **Each section's keys:** as the schema declares them.
- **Every knobbed list section:** in its `{_undeclared, entries}` wrapper form with the section's default policy spelled out. `environments`, `branches`, and `workflows` are bare lists, since their wrapper takes no policy.
- **The entries of every keyed list:** sorted by their identity (a label's `name`, a webhook's `config.url`, a deploy key's `title`). Two lists keep their order instead: `branches`, since GitHub applies overlapping wildcard rules in creation order, and pinned environments, since it is the pin rank.
- **The lists with no identity:** left as written, in the order GitHub lists them in.

How

• Every over-cap unit on the four pages becomes the device that shows it fastest: split paragraphs, bold-lead-in bullets, a result-and-exit table, numbered steps.
• Six restated facts (the warn-to-partial rule, the preflight probe, the 404 reading, bypass_actors visibility, issue channels in check mode, the GITHUB_TOKEN limit) now link to the page that owns each, keeping only the clause the local reader needs.
• No fact lost or added: the cross-model review listed facts absent on each side of every page; both lists empty, three rounds.

Proof

• Probe: findings 3, 7, 2, 5 on the four pages, now 0 each; headings byte-identical before and after.
• Tests: bun test test/docs 383 green; every added link resolves to an existing heading.

Technical details

• Line accounting: docs +119 -26, nothing else; prose grew because paragraphs became lists and a table.
• Kept local on purpose: the "GitHub hides the resource rather than admit it exists" reason behind a 404, the write-grade token clause for bypass_actors, and "delivery touches only its report issue, marker label, or encrypted artifact", since no owner page states them.
• Reviewer note (Copilot): the generated regions on check-mode.md are untouched; heading text is frozen because other pages link to the anchors.
• Files: docs/operate/{check-mode,private-repositories,snapshot,troubleshooting}.md.

[github-actions]

File size check

0 over a hard cap (fails), 34 warning(s).

File	Size	Tier	Cap
.github/actions/setup/action.yml:7	169 chars	warn	150
.github/scripts/gen-inputs-table.ts:54	11 comment lines	warn	10
.github/scripts/generated.ts:28	191 chars	warn	150
.github/scripts/release-pipeline.ts:7	156 chars	warn	150
.github/scripts/release-pipeline.ts:458	151 chars	warn	150
.github/scripts/release-pipeline.ts:1252	153 chars	warn	150
.github/scripts/release-pipeline.ts:1	35 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:454	14 comment lines	warn	10
.github/workflows/post-green.yml:29	153 chars	warn	150
.github/workflows/update-release-pr.yml:110	14 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1276 lines	warn	1040
src/engine/layers.ts:217	157 chars	warn	150
src/flows/settings-write.ts:142	159 chars	warn	150
src/flows/settings-write.ts:30	11 comment lines	warn	10
src/flows/snapshot.ts:189	13 comment lines	warn	10
src/github/secret-scan.ts:43	11 comment lines	warn	10
src/schema.ts:186	153 chars	warn	150
src/schema.ts:197	176 chars	warn	150
src/sections/contract/errors.ts:14	14 comment lines	warn	10
src/sections/contract/module.ts:963	185 chars	warn	150
src/sections/contract/module.ts:627	12 comment lines	warn	10
src/sections/contract/module.ts:897	12 comment lines	warn	10
src/sections/secret_scanning_custom_patterns/compilable-form.ts:382	161 chars	warn	150
src/sections/shared/roles.ts:43	13 comment lines	warn	10
src/types.ts:16	156 chars	warn	150
test/docs/guides.test.ts:451	155 chars	warn	150
test/e2e/generators.ts	2634 lines	warn	2560
test/e2e/generators.ts:1704	166 chars	warn	150
test/e2e/generators.ts:1858	161 chars	warn	150
test/e2e/generators.ts:1667	12 comment lines	warn	10
test/engine/execute.test.ts:617	152 chars	warn	150
test/flows/merge-parity.test.ts:63	164 chars	warn	150
test/scripts/auto-fix-allowlist.test.ts:12	12 comment lines	warn	10
test/sections/refusal-messages.test.ts:61	19 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

Copilot review overview

🟡 Changes recommended

The check-mode result table does not name the documented failed output value for section errors.

Review effort: Balanced
Findings: 1

Open (1)

• Document the literal failed result for non-permission API errors · New

What changed in this PR

Reshapes four operations guides for faster scanning without changing their documented behavior.

Changes:

• Splits dense prose into tables, lists, and steps.
• Replaces repeated details with links to authoritative reference pages.
• Preserves existing headings and generated regions.

File	Description
docs/​operate/​check-mode.md	Clarifies check outcomes, previews, and limitations.
docs/​operate/​private-repositories.md	Restructures redaction and private-report guidance.
docs/​operate/​snapshot.md	Clarifies canonical ordering and private snapshot handling.
docs/​operate/​troubleshooting.md	Makes common errors and remedies easier to scan.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The check-mode outcome table incorrectly promises partial when another section has failed.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Document the literal failed result for non-permission API errors

Previously missed (1)

In code that hasn't changed since last review

Report failure when warned denial accompanies another section error

docs/​operate/​check-mode.md:20

This row reports the wrong outcome when a warned denial is accompanied by another section error. For example, one skipped 403 plus one non-permission API error and no drift produces failed with exit 1, not partial with exit 0. Require that nothing else is failing as well.