This page is in roughly chronological order.
No fan spin, brief pulse on S0 rails, no SMC_DELAYED_PWRGD, no obvious shorts. Eventually, I noticed PPVIN_S0_CPUVR_VIN missing and found R7202 was disconnected from PPBUS_S5_HS_COMPUTING_ISNS.
Fixed by wiring R7202 to C7316 (unpopulated), which had continuity to that rail.
Thank you dosdude1 for tips. This was very confusing for me.
It only worked in SMC bypass mode, because PP3V3_S5_AVREF_SMC was shorted to ground. The cause was C5125; removing it let the laptop turn on normally.
Thanks to this post.
This (disgustingly dirty) laptop's PPBUS_G3H was shorted. Injecting 5 V caused C7431 (on PPBUS_S5_HS_COMPUTING_ISNS) to smoke, and removing it cleared the short on both rails.
It still didn't turn on, because F7140 was burned (I don't think by me; it's upstream of PPBUS_G3H). Fixed by replacing with a wire.
No power or charger light, missing PPBUS_G3H but not shorted, PPDCIN_G3H_CHGR present but no CHGR_PHASE. This meant Q7130 wasn't turned on (CHGR_LGATE) by U7100, which finally clued me in to PP3V42_G3H being shorted.
Injecting 3.3 V caused C5002 to heat up; removing it fixed the laptop.
Powered on inconsistently, no force touch feedback (touchpad worked otherwise), PPVIN_S4_TPAD_FUSE shorted (but F4800 intact). The short and unreliability went away with the touchpad disconnected.
Found a visibly burnt capacitor on the underside of the touchpad board (bottom-right here; I don't have a schematic). Fixed by crushing it with pliers, oops.
It turned on, but restores failed with "error 29" and update_gas_gauge messages in logs. Found that R61/BATTERY_SWI lacked continuity to the corresponding pin on the battery connector. Soldering a wire resolved this.
Also (accidentally) learned that disconnecting R153/BATTERY_NTC blocks charging but doesn't affect booting or restores; I re-soldered it after.
It intermittently acted like the power button was held down. SMC_ONOFF_L was around 1.5 V (expected 3.3 V) and 8 KΩ to SMC_LSOC_RST (expected no connection).
Resolved by cleaning corrosion on the touchpad board.
It didn't work due to a short on PP3V3_S5, which was cleared by removing C3380.
This had suffered liquid damage to the display assembly; it still showed an image, but the backlight didn't work. Neither a known-good board nor screen helped.
The logic board's PPVOUT_S0_LCDBKLT wasn't connected to the little display board. It turned out the eDP cable's pin #1 was completely missing on the LCD side. Swapping the cable restored continuity, but now it was shorted to ground. I eventually found burned debris (of the pin??) inside the eDP socket; replacing the socket fixed the short.
The original board still didn't work, with PPVOUT_S0_LCDBKLT only around 12 V. LCD_BKLT_EN and the I2C lines seemed correct, but U7701 wasn't pulling BKLT_SD/LCDBKLT_EN_L low, so Q7706 wasn't on. I don't know why; the traces and resistors were okay; dosdude1 said U7701 itself was probably damaged.
I worked around this by wiring BKLT_SD (at R7702) to ground. The backlight turns on (and off) as expected now, but it's definitely a hack...