docs: say where the report goes when a scan is too big for the terminal

CHANGELOG.md

@@ -13,6 +13,12 @@ reader, not the mechanism or the weakness it closed.
 
 ## [Unreleased]
 
+### Added
+- **Documented where the report goes when a scan is too large for the terminal.** A big sweep prints
+  a summary and writes the full per-finding report to a file; the reference now says where that file
+  lands with and without `-d`, that its evidence is redacted like any copy on disk, and that a
+  temporary one is left for your operating system to clear rather than deleted by `saw`.
+
 ### Added
 - **The documentation is now published as a searchable, versioned site** at
   <https://ndevu12.github.io/stayAwakeBot/>, with light and dark themes. Because `saw` ships pinned

docs/reference/cli/scan.md

@@ -38,5 +38,7 @@ saw scan -d /tmp/saw-reports              # opt-in redacted latest.json + latest
 ```
 
 On a terminal, a long sweep streams each target as it completes. A large sweep keeps the terminal to
-a bounded dashboard and moves per-finding evidence into the written report, whose path is printed on
-stderr — nothing is lost to scrollback, and you are never dropped into a pager.
+a bounded dashboard and moves per-finding evidence into a written report, whose path is printed on
+stderr — nothing is lost to scrollback, and you are never dropped into a pager. See
+[the report a long scan writes for you](sinks.md#the-report-a-long-scan-writes-for-you) for where
+that file lands and how long it survives.

docs/reference/cli/sinks.md

@@ -11,3 +11,25 @@ so a report on disk can never re-distribute a live payload.
 | SARIF | `--sarif FILE` | redacted | `FILE`, for GitHub code scanning |
 | Alert | `--alert` | evidence-free | GitHub issue + Slack |
 | Reports dir | `-d DIR` | redacted | `DIR/latest.{json,md}` |
+
+## The report a long scan writes for you
+
+A scan whose result is too large for a terminal — many repositories, or a lot of findings and
+advisories between them — stops printing per-finding detail and shows the summary table only. The
+full report is written to a file instead, so nothing is lost to scrollback, and the path is printed
+on stderr in a ruled block (clickable when your terminal supports it).
+
+Where it lands:
+
+| You passed | Written to |
+| --- | --- |
+| `-d DIR` | `DIR/latest.md` and `DIR/latest.json` |
+| nothing | a fresh temporary directory named `sab-report-…`, printed with the report |
+
+Two things worth knowing about the temporary copy. Its evidence is **redacted**, like any artifact
+on disk — the full evidence stayed on your terminal. And `saw` never deletes it; your operating
+system clears its temporary directory on its own schedule, which may be at reboot or not at all. If
+you want the report kept somewhere you chose, pass `-d DIR` and it goes there instead.
+
+`--json` turns the spill off: that payload already carries every finding in full, so there is
+nothing to rescue from scrollback. A `-d DIR` you asked for is still written.