When you made the change to the workflow model did you sync it to generate the runtime model? See : https://docs.adobe.com/content/help/en/experience-manager-65/developing/extending-aem/extending-workflows/workflows-models.html#configuring-a-workflow-for-multi-resource-support

If you manually change something via /system/console/configMgr then it will create an nt:file node corresponding to the PID of the thing configured under /apps/system/config But -- ideally you shouldn't be manually configuring things via the Web Console. You should have configs defined by runmodes S...

It has to do with resolving context-aware configuration stuff.  It's using an underlying service user cloudconfig-scripttags with jcr:read permissions to read the ScriptTagComponents from all cloud services.

The handles (highlighted in red) will only let you reorder if the underlying folder is of type sling:OrderedFolder.  Folders can be - sling:folder- nt:folder- sling:OrderedFolder two of those three won't re-order. much of /content/dam is sling:folders fyi -- so not reorderable  Open a Daycare ticket...

I don't expect you will get an answer here on this public community forum. The way this post is worded to me can be construed as a potential social-engineering attack trying to extract account information.  

Why step 3?  You don't need to restart AEM after installing a ServicePack. The main thing to be cognizant about for a Publish Service Pack install is you don't want live web traffic hitting that instance so a practical approach here is to remove each Publish one-by-one out of your load balancer and ...

Do you mean rep:Policy nodes?   

I just used  <?xml version="1.0" encoding="UTF-8"?> <workspaceFilter version="1.0"> <filter root="/apps/wknd"> <exclude pattern="/apps/wknd/i18n(.*)"/> </filter> </workspaceFilter> and it worked without any issues.  What version of AEM? 

what I'm saying is -- Adobe Customer Care has seen incidents with organizations who use Mutual SSL (always seems to be banks) where they encounter odd edge case scenarios where the Java JVM selects the wrong alias during handshake and this is leads to failed SSL connections.

Generally this is done by Apache Tika  https://tika.apache.org/