[Vivswan]

What this specifies

.github/scripts/post-green-steps.ts          DRY_RUN_PUSH         how the dry run judges the token: origin's receive-pack
                                                                  advertisement, over the real push's channel
src/sections/contract/endpoints.ts           ReadPhase            an execution-phase read, for one: the Codespaces sealing key
src/sections/environments/schema.ts          the flags rule       GitHub answers 422 to both flags true and to both false;
                                                                  "any branch may deploy" is deployment_branch_policy: null
src/sections/shared/secrets-and-variables/   SegmentOfSecretsKey  a fifth family breaking `<segment>_secrets` must say so here
  repo-secrets.ts

How

• Comment-only: no code moves; each fact sits beside the thing it explains, one line where the member-shape rule wants one.
• Found by an audit of the 1944 comment lines the floor sweep removed: 427 carried a risk word, 21 survived nowhere verbatim, and these 4 had lost the fact rather than the wording.

Proof

• Fleet gates, locally with the platform's actions: member-shape 0, line cap 0 errors, biome 0 under the floor.
• Gate: typecheck and biome ci clean.

[github-actions]

File size check

0 over a hard cap (fails), 6 warning(s).

File	Size	Tier	Cap
src/engine/diff.ts:56	11 comment lines	warn	10
src/github/api-error.ts:9	11 comment lines	warn	10
src/problem.ts:73	18 comment lines	warn	10
src/sections/contract/errors.ts:13	11 comment lines	warn	10
src/sections/contract/module.ts:55	12 comment lines	warn	10
src/sections/shared/list/decl.ts:265	14 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

🟢 Approval recommended

The changes only clarify existing behavior, and no unresolved defects were identified.

No open issues 🎉

What changed in this PR

Restores four explanatory facts removed during the lint-floor sweep, documenting existing behavior in the settings action and its workflow helpers. All changes are comment-only.

Changes:

• Clarifies how the dry-run push checks token access.
• Documents execution-only reads and valid deployment branch policy flags.
• Explains the naming constraint for repository secret families.

File	Description
src/​sections/​shared/​secrets-and-variables/​repo-secrets.ts	Documents the secret-family naming constraint.
src/​sections/​environments/​schema.ts	Explains rejected flag combinations and the unrestricted deployment setting.
src/​sections/​contract/​endpoints.ts	Adds the Codespaces sealing key as an execution-only read example.
.github/​scripts/​post-green-steps.ts	Explains the dry-run push channel and probe ref.

_{Review effort: Balanced}