@@ -699,13 +699,19 @@ parameter that `paramcheck` requires to be passed by value. An endpoint is
 therefore checked without any extra annotation, and coverage grows as pointer
 bodies are converted to by-value ones.
 
+A struct that some method returns describes an API response as well as,
+sometimes, a request body, so a field of one that no request body schema has is
+not reported: it is usually a field that the server sets and the client only
+reads. `-verbose` counts those fields, so that the exemption is visible in the
+summary without being a finding.
+
 A run ends with a summary of the state of the tree rather than of the run, so
 that a maintainer reads what there is to do rather than what happened:
 how many of the methods that take a struct request body were checked, what was
-not checked and why (bodies passed by pointer, and operations that the pinned
-revision does not document), and what the findings are, counting the ones that
-`exceptions.txt` grandfathers alongside the new ones. It also reports what
-`-fix` can do about them, including the repairs that the exceptions file is
+not checked and why (bodies passed by pointer, and operations that none of the
+descriptions the tool loads documents), and what the findings are, counting the
+ones that `exceptions.txt` grandfathers alongside the new ones. It also reports
+what `-fix` can do about them, including the repairs that the exceptions file is
 holding back, and the errors that no mechanical repair settles. A body that is
 not a struct has no fields for a schema check to apply to, so it is left out of
 those counts and named by `-verbose` instead.
 
@@ -102,6 +102,9 @@ type stats struct {
 	usesUnreadable    int
 	fieldsChecked     int
 	fieldsConditional int
+	// fieldsResponse is the fields that no request body schema has and that are left
+	// alone because a method returns their struct.
+	fieldsResponse int
 }
 
 type checker struct {
@@ -212,6 +215,10 @@ func (c *checker) run() {
 	})
 }
 
+// checkStruct reports the fields of si that disagree with the request body schemas of the
+// operations that send it. A field that no schema has is reported unless a method returns the
+// struct: a struct that the API answers with is a model of a response as well, so its
+// server-set fields have no place in a request body schema.
 func (c *checker) checkStruct(si *structInfo, uses []*structUse) {
 	for _, f := range si.fields {
 		c.stats.fieldsChecked++
@@ -238,6 +245,14 @@ func (c *checker) checkStruct(si *structInfo, uses []*structUse) {
 		}
 
 		if !inSchema {
+			if si.response {
+				// The struct describes an API response as well as a request body, so
+				// a field that no request body schema has is usually one the server
+				// sets, and not a mistake. The summary counts these rather than
+				// reporting them.
+				c.stats.fieldsResponse++
+				continue
+			}
 			c.add(&diagnostic{
 				sev: sevWarn, rule: ruleNotInSchema, file: f.file, line: f.line,
 				owner: si.name, field: f.goName, info: f,
 
@@ -75,7 +75,10 @@ func TestCheck(t *testing.T) {
 	}
 	assertContains(t, err.Error(), "6 schema field issue(s) found")
 	assertEqual(t, wantFindings, stdout)
-	assertContains(t, stderr, "checked 17 of 18 methods that take a struct request body (13 body structs, 22 fields)")
+	// The field of the struct that the operation returns is left alone: the request body
+	// schema does not have it, but a response may, so it is not a mistake.
+	assertNotContains(t, stdout, "CommentRequest.URL")
+	assertContains(t, stderr, "checked 18 of 19 methods that take a struct request body (14 body structs, 24 fields)")
 	assertContains(t, stderr, "not checked: 1 method whose body is passed by pointer (run paramcheck to convert it)")
 	assertContains(t, stderr, "not checked: 1 operation use with no JSON request body")
 	assertContains(t, stderr, "11 findings (5 warn, 6 error)")
@@ -98,7 +101,7 @@ func TestSummary(t *testing.T) {
 		stats: stats{
 			files: 209, methods: 7981, methodsWithOps: 1301,
 			bodyValue: 206, bodyPointer: 62,
-			structsChecked: 141, fieldsChecked: 618, fieldsConditional: 13,
+			structsChecked: 141, fieldsChecked: 618, fieldsConditional: 13, fieldsResponse: 34,
 			usesResolved: 193, usesNotInPlan: 10,
 		},
 		byRule: map[string]int{ruleNotInSchema: 1, ruleRequiredOmit: 1, ruleMissingRequiredProp: 1},
@@ -119,8 +122,9 @@ func TestSummary(t *testing.T) {
 	// The coverage lines are the same whatever the findings are.
 	const coverage = `checked 206 of 268 methods that take a struct request body (141 body structs, 618 fields)
   not checked: 62 methods whose body is passed by pointer (run paramcheck to convert them)
-  not checked: 10 operation uses that the pinned revision does not document
-    a newer openapi_commit in openapi_operations.yaml would check them
+  not checked: 10 operation uses that the descriptions this tool loads do not document
+    each is documented by a plan this tool does not load, such as an older GHES release,
+    or by none at all; a newer openapi_commit may not help
 `
 
 	var buf bytes.Buffer
@@ -147,6 +151,7 @@ func TestSummary(t *testing.T) {
 	assertContains(t, got, "scanned 209 files, 7981 methods (1301 with //meta:operation)")
 	assertContains(t, got, "resolved operation uses: 193")
 	assertContains(t, got, "conditionally required, and left alone: 13 of the 618 fields")
+	assertContains(t, got, "in no request body schema, and left alone because a method returns the struct: 34 of the 618 fields")
 	assertContains(t, got, "1  not-in-request-schema: the Go field is not in the request body schema")
 
 	// A checkout with nothing to report says so, rather than counting a baseline of nothing.
@@ -187,11 +192,14 @@ func TestCheckGithubFormat(t *testing.T) {
 func TestCheckVerbose(t *testing.T) {
 	t.Parallel()
 	_, stderr, _ := runOnFixture(t, "-verbose")
-	assertContains(t, stderr, "no //meta:operation annotation: github/issues.go:54: Untracked (UntrackedRequest)")
+	assertContains(t, stderr, "no //meta:operation annotation: github/issues.go:72: Untracked (UntrackedRequest)")
 	// -verbose is the full breakdown of the summary, which the default output leaves out.
-	assertContains(t, stderr, "scanned 4 files, 18 methods (16 with //meta:operation)")
-	assertContains(t, stderr, "resolved operation uses: 15")
-	assertContains(t, stderr, "conditionally required, and left alone: 1 of the 22 fields")
+	assertContains(t, stderr, "scanned 4 files, 19 methods (17 with //meta:operation)")
+	assertContains(t, stderr, "resolved operation uses: 16")
+	assertContains(t, stderr, "conditionally required, and left alone: 1 of the 24 fields")
+	// The field that no schema has and that the returned struct explains is counted rather
+	// than reported, so that the exemption is visible.
+	assertContains(t, stderr, "in no request body schema, and left alone because a method returns the struct: 1 of the 24 fields")
 	assertContains(t, stderr, "4  required-but-omittable: the schema REQUIRES the property, but the tag lets it be omitted")
 	// The default output leaves the breakdown out, so that it reads as a verdict.
 	if _, plain, _ := runOnFixture(t); strings.Contains(plain, "scanned 4 files") {
 
@@ -11,43 +11,12 @@
 # Run "script/check-schema-fields.sh -fix" to repair the error-severity findings
 # that no line here grandfathers. It drops the lines that no finding needs any
 # more, so the file can only shrink.
-ActionsPermissions.SelectedActionsURL
-ActionsPermissionsEnterprise.SelectedActionsURL
-ActionsPermissionsRepository.SelectedActionsURL
-Blob.NodeID
-Blob.SHA
-Blob.Size
-Blob.URL
-CodeSecurityConfiguration.CreatedAt
 CodeSecurityConfiguration.Description
-CodeSecurityConfiguration.HTMLURL
-CodeSecurityConfiguration.ID
-CodeSecurityConfiguration.TargetType
-CodeSecurityConfiguration.URL
-CodeSecurityConfiguration.UpdatedAt
 CreateCheckSuiteOptions.HeadBranch
 CreateTeamRequest.LDAPDN
-CustomProperty.PropertyName
-CustomProperty.RequireExplicitValues
-CustomProperty.SourceType
-CustomProperty.URL
 IDPGroupList.Groups
-OIDCSubjectClaimCustomTemplate.SubClaimPrefix
 OIDCSubjectClaimCustomTemplate.UseDefault
-RepositoryRuleset.CreatedAt
-RepositoryRuleset.CurrentUserCanBypass
-RepositoryRuleset.ID
-RepositoryRuleset.Links
-RepositoryRuleset.NodeID
-RepositoryRuleset.Source
-RepositoryRuleset.SourceType
-RepositoryRuleset.UpdatedAt
 ReviewCustomDeploymentProtectionRuleRequest.Comment
 ReviewCustomDeploymentProtectionRuleRequest.State
-SCIMEnterpriseGroupAttributes.ID
-SCIMEnterpriseGroupAttributes.Meta
-SCIMEnterpriseUserAttributes.Groups
-SCIMEnterpriseUserAttributes.ID
-SCIMEnterpriseUserAttributes.Meta
 UpdateCheckRunOptions.Name
 UpdateTeamRequest.Name
@@ -23,6 +23,11 @@
 // "body" and passed by value, so every by-value body parameter is checked against the request
 // body schema of its operation. Coverage grows as pointer bodies are converted, and a
 // contributor adding an endpoint is checked without having to do anything extra.
+//
+// A struct that some method returns describes an API response as well as, sometimes, a request
+// body, so a field of one that no request body schema has is left alone rather than reported:
+// it is usually a field the server sets. -verbose counts them, and CONTRIBUTING.md has the
+// rule.
 package main
 
 import (
@@ -415,10 +420,10 @@ func printSummary(w io.Writer, c *checker, o *options, exc *exceptions) {
 			s.usesNoJSONBody, plural(s.usesNoJSONBody, "use", "uses"))
 	}
 	if s.usesNotInPlan > 0 {
-		fmt.Fprintf(w, "  not checked: %v operation %v that the pinned revision does not document\n",
+		fmt.Fprintf(w, "  not checked: %v operation %v that the descriptions this tool loads do not document\n",
 			s.usesNotInPlan, plural(s.usesNotInPlan, "use", "uses"))
-		fmt.Fprintf(w, "    a newer openapi_commit in %v would check %v\n",
-			operationsFile, plural(s.usesNotInPlan, "it", "them"))
+		fmt.Fprint(w, "    each is documented by a plan this tool does not load, such as an older GHES release,\n"+
+			"    or by none at all; a newer openapi_commit may not help\n")
 	}
 	if s.usesUnreadable > 0 {
 		fmt.Fprintf(w, "  not checked: %v operation %v whose description could not be read\n",
@@ -428,6 +433,8 @@ func printSummary(w io.Writer, c *checker, o *options, exc *exceptions) {
 		fmt.Fprintf(w, "  resolved operation uses: %v\n", s.usesResolved)
 		fmt.Fprintf(w, "  conditionally required, and left alone: %v of the %v fields\n",
 			s.fieldsConditional, s.fieldsChecked)
+		fmt.Fprintf(w, "  in no request body schema, and left alone because a method returns the struct: %v of the %v fields\n",
+			s.fieldsResponse, s.fieldsChecked)
 	}
 
 	// A finding the exceptions file does not name is the only kind a change can be told about,
 
@@ -215,16 +215,17 @@ func (d *description) flatten(s *schema, visiting map[string]bool) (*flat, error
 }
 
 // bodyReason says why an operation has, or has not, a request body schema to check the fields
-// of a request body struct against. The two ways of having none are worth keeping apart: a
-// newer pinned revision can check one of them, and nothing can check the other.
+// of a request body struct against. The two ways of having none are worth keeping apart: the
+// plans this tool loads account for one of them, and for the other they never will.
 type bodyReason int
 
 const (
 	// bodyFound: the operation's application/json request body schema is available.
 	bodyFound bodyReason = iota
-	// bodyNotInPlan: the descriptions do not document the operation at all, which is what a
-	// pinned revision older than the operation looks like. Advancing the pin in
-	// openapi_operations.yaml makes it checkable.
+	// bodyNotInPlan: none of the descriptions this tool loads documents the operation. Either
+	// a plan it does not load has the operation and the three it reads do not, which is what
+	// an endpoint of an older GHES release looks like, or no plan has it at all. Advancing the
+	// pin in openapi_operations.yaml helps only when the newer revision documents it too.
 	bodyNotInPlan
 	// bodyNoJSONBody: the operation is documented but has no application/json object request
 	// body, so it has no fields to check.
@@ -286,9 +287,9 @@ func (d *description) requestSchema(op *opRef) (*flat, bodyReason, error) {
 type descriptions struct{ files []*description }
 
 // requestSchema returns the request body schema from the first plan that documents the
-// operation, so GHEC-only and GHES-only operations resolve as well. When no plan has one, it
-// reports whether any plan documents the operation at all: an operation no plan documents is
-// the one a newer pinned revision would check.
+// operation, so GHEC-only and GHES-only operations resolve as well. When none of them has one,
+// it reports which kind of gap this is: an operation a plan documents without an
+// application/json body, or one that none of the plans this tool loads documents.
 func (ds *descriptions) requestSchema(op *opRef) (*flat, bodyReason, error) {
 	reason := bodyNotInPlan
 	for _, d := range ds.files {
 
@@ -93,6 +93,9 @@ type structInfo struct {
 	file   string
 	line   int
 	fields []*fieldInfo
+	// response is set when some method of the package returns the struct, which makes
+	// its fields the fields of an API response as well as, sometimes, of a request body.
+	response bool
 }
 
 // field returns the field with the given JSON name, if the struct has one.
@@ -128,12 +131,19 @@ type repoInfo struct {
 	structs map[string]*structInfo
 	methods []*methodInfo
 	files   int
+	// resultTypes names every type that a method returns, whether or not this package
+	// declares it. scanRepo settles the ones that do onto structInfo once every file
+	// has been read.
+	resultTypes map[string]bool
 }
 
 // scanRepo parses the Go sources under <repo>/github and returns the structs and the
 // methods that take a body.
 func scanRepo(repo string) (*repoInfo, error) {
-	info := &repoInfo{structs: map[string]*structInfo{}}
+	info := &repoInfo{
+		structs:     map[string]*structInfo{},
+		resultTypes: map[string]bool{},
+	}
 	fset := token.NewFileSet()
 	dir := filepath.Join(repo, "github")
 
@@ -189,6 +199,9 @@ func scanRepo(repo string) (*repoInfo, error) {
 					m.bodyType, m.bodyPtr = body, ptr
 				}
 				info.methods = append(info.methods, m)
+				for _, name := range resultTypeNames(d.Type.Results) {
+					info.resultTypes[name] = true
+				}
 			}
 		}
 		return nil
@@ -197,8 +210,11 @@ func scanRepo(repo string) (*repoInfo, error) {
 		return nil, err
 	}
 
-	// A field's type is only known to be a struct once every file has been read.
+	// A field's type is only known to be a struct once every file has been read, and the
+	// same goes for a result type: the method that returns it can be read before the
+	// declaration of the struct it names.
 	for _, si := range info.structs {
+		si.response = info.resultTypes[si.name]
 		for _, f := range si.fields {
 			if f.typeName != "" {
 				_, f.isStruct = info.structs[f.typeName]
@@ -251,6 +267,36 @@ func findBodyParam(fn *ast.FuncDecl) (name string, pointer bool) {
 	return "", false
 }
 
+// resultTypeNames returns the names of the types that a result list mentions. A name from
+// another package (io.ReadCloser, *http.Response) names no struct this repository declares,
+// so collecting it costs nothing.
+func resultTypeNames(results *ast.FieldList) []string {
+	if results == nil {
+		return nil
+	}
+	var names []string
+	for _, r := range results.List {
+		names = append(names, typeNames(r.Type)...)
+	}
+	return names
+}
+
+// typeNames returns the names that t mentions, looking through the pointers and slices that
+// a result is built from.
+func typeNames(t ast.Expr) []string {
+	switch e := t.(type) {
+	case *ast.Ident:
+		return []string{e.Name}
+	case *ast.StarExpr:
+		return typeNames(e.X)
+	case *ast.ArrayType:
+		return typeNames(e.Elt)
+	case *ast.ParenExpr:
+		return typeNames(e.X)
+	}
+	return nil
+}
+
 // collectStruct returns the exported fields of a struct declaration.
 func collectStruct(fset *token.FileSet, file string, ts *ast.TypeSpec, st *ast.StructType) *structInfo {
 	si := &structInfo{