# Proof audit, pass 1 — GitLab discovery

PR [#27840](https://git.cafe/pingdotgg/t3code/pull/27840), branch `fix/issue-27811`, reviewed head [e9312167e2](https://github.com/pingdotgg/t3code/commit/e9312167e26f2de6984c604c7f07902e287caa58), base [c6ef3b46eb](https://github.com/pingdotgg/t3code/commit/c6ef3b46ebed34fbefa1706674fe5748254cee18). This is a code-derived capture specification, not a completed visual or correctness audit. No capture, browser, server, test execution, or glab authentication request was run in this pass.

## Findings

1. **All affected fixtures lack capture proof.** The PR description's manual results and existing green checks are not visual evidence. Pass 1 is expected to be insufficient.
2. **The diff is server-only, but its consumers extend beyond Settings.** The complete three-file diff changes the generic CLI auth probe, opts GitLab into a signed-out-only retry, and adds three tests. Web/desktop publish, Add project, and New project consume the changed result. Native mobile Add project and New project also consume it; native mobile does not render the web GitLab Settings status row.
3. **A gitlab.com current host is not the latency fixture.** The checked-in comment and installed glab help describe current-context probing; the glab behavior called out by the PR specially treats gitlab.com. To prove the successful-current-host path avoids a stalled other host, use a signed-in self-hosted current host. The supplied gitlab.com login alone cannot provide that case. Use an existing authorized self-hosted login or the explicitly labelled harness below.
4. **Do not equate unknown with signed out.** Settings uses a gray dot and verification text for unknown, but both publish and Add project accept an available provider unless its auth status is specifically `unauthenticated`. This behavior predates the diff. The retry must retain the *first* signed-out result when the retry is unknown, fails, times out, or rejects `--all`.
5. **One host/account survives, not a host list.** GitLab parsing chooses the first reported signed-in host/account, even if the combined CLI exit code is nonzero because another host failed. GitLab emits no `accounts` array and its definition has no Settings editor. There is no per-host expansion or count-based Settings layout to capture. Host names are not displayed in the authenticated Settings summary; account visibility is a separate reveal/hide interaction.

## Source trace and render-path census

All source links below are pinned to the audited head.

- Changed [core probe](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-core/src/server/discovery.ts#L235): `managed-cli` and `api` short-circuit unchanged; CLI specs without `authRetryArgs` run the original check once; specs with retry args retry only the first `unauthenticated` answer. First authenticated or unknown means no retry. A retry replaces the first result only when authenticated. Probe exceptions become unknown; a missing/failed version probe overrides auth to unknown and `status: missing`. Version and auth probes run concurrently; each glab command has the existing 5,000 ms timeout and 8,000-byte output limit. A retry is sequential after the first auth request, not a single shared five-second budget.
- Changed [GitLab spec and parser](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts#L55): `auth status`, then optional `auth status --all`; account implies authenticated even on nonzero exit, nonzero without account implies unauthenticated, zero without parseable account implies unknown. The [host parser](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-gitlab/src/server/gitLabAuthStatus.ts#L14) supplies the first signed-in host. Host-specific unknown-remote refinement still uses its own `--hostname` path and does not take the retry.
- Direct production callers of the shared probe: [registry discovery](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/server/src/sourceControl/SourceControlProviderRegistry.ts#L350), [GitHub CLI fallback](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-github/src/server/GitHubSourceControlProvider.ts#L233), [GitCafe CLI fallback](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts#L112), and [Forgejo fj/tea probing](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.ts#L97). Only GitLab supplies retry args. Bitbucket and Azure DevOps do not acquire the new retry. Coding-agent providers (Codex, Claude, Cursor, Grok, OpenCode, Antigravity) are unrelated to this source-control-provider change.
- Transport: [discovery service](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/server/src/sourceControl/SourceControlDiscovery.ts#L120) → [thin WebSocket handler](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/server/src/ws.ts#L2520) → [shared environment discovery query](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/client-runtime/src/state/sourceControl.ts#L20). No wire schema changed. The read-only `server.discoverSourceControl` RPC has `{}` input. Its [auth result](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/contracts/src/sourceControl.ts#L117) carries `status`, optional account/host/detail, and an optional account list that GitLab does not populate.
- Web/desktop Settings: sole route [/_chat/settings/source-control](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/routes/_chat.settings.source-control.tsx#L5), URL `/settings/source-control`, renders [SourceControlSettingsPanel](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/settings/SourceControlSettings.tsx#L369). It reaches `DiscoveryItemRow` for VCS items and provider items. For GitLab: available/authenticated → success dot, `Authenticated as` plus initially blurred account, checked disabled availability switch; available/unauthenticated → gray dot, `Not authenticated` badge, generic sign-in guidance, unchecked disabled switch; available/unknown → gray dot, `Could not verify GitLab` plus detail/fallback, unchecked disabled switch; missing → install guidance, no version, unchecked disabled switch. Version is shown only when nonempty. An authenticated GitLab result always has an account and no detail under the current parser. `auth.host` has no visible element. The [account button](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/settings/RedactedSensitiveText.tsx#L36) toggles blur/reveal and tooltips; long accounts affect wrapping. `sm` (640 px with the normal breakpoint) switches row controls from stacked to horizontal. Light/dark styling and hover/focus are shared, not new logic.
- Settings envelope: disconnected/no selected environment → connection guidance; first query pending with no data → two skeleton sections; nonempty data → VCS/provider lists; no items → empty/error panel with Scan. The built-in registry ordinarily returns six provider rows and two VCS rows even when tools are missing, so empty/error is not a no-glab fixture. Existing data remains the render input while a refresh is pending. Multiple environments change the section suffix and query target, not the GitLab item shape. No Settings expand/collapse, credential editor, account picker, token form, host toggles, app sign-in, or authenticated/unauthenticated account-list branches apply to GitLab, because its [definition](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/source-control-gitlab/src/shared/definition.ts#L27) supplies neither `settings` nor `credentials`.
- Web/desktop publish: [ThreadDetailsPanel](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/chat/ThreadDetailsPanel.tsx#L223) is the caller of `GitActionsControl`, whose [PublishRepositoryDialog](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/GitActionsControl.tsx#L430) consumes discovery when actions are mounted. Requires a writable Git repository with no primary remote; compact/full density changes the launcher, not the dialog. Missing provider/missing executable/unauthenticated → disabled card, Setup Required and a hint tooltip; unknown or authenticated available → selectable card, sorted into ready providers. Selected/unselected styles differ. Next needs a ready selected provider. Repository step prefills `<account>/` and still shows `gitlab.com` as host; GitLab's publish host is not taken from the newly discovered `auth.host`. Busy/error/success publishing, private/public visibility, advanced protocol/remote controls and repository-name validation are unchanged and require no external publish for this audit.
- Web/desktop Add project: [CommandPalette source groups](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/CommandPalette.tsx#L917), reached by sidebar Add project, the command palette Add project action, and configured palette/add-project shortcuts. All lead to the same source-selection renderer. GitLab unavailable/signed-out → disabled `GitLab repository` row with Setup Required; ready → enabled, moves into ready alphabetical group, selection opens repository input. Setup Required navigates to `/settings/source-control`; tooltip exposes `auth.detail`. Source selection is rebuilt from the latest discovery data. Browser/desktop-local/WSL directory pickers are downstream unchanged branches, not auth variants.
- Web/desktop New project: [CommandPalette option groups](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/CommandPalette.tsx#L2147), using [shared target derivation](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/packages/client-runtime/src/operations/projects.ts#L212). Requires configured `newProjectsRoot` and a connected environment. Zero ready providers → no publish option; one → `Create private repository on GitLab`; multiple → generic title plus [host picker](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/web/src/components/CommandPaletteAddProject.tsx#L77). Off/on checkbox, closed/open picker, selected peer/GitLab, empty/name-filled input change visible content. Account propagates into owner/repository preview. At two or more providers, additional counts only lengthen the same picker and are covered by the existing-peer variant.
- Native mobile: [AddProjectSourceScreen](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/mobile/src/features/projects/AddProjectScreen.tsx#L515) uses the same readiness function: disabled hint row vs enabled `Clone GitLab group/project` and navigation to `AddProjectRepository`. [AddProjectNewScreen](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/mobile/src/features/projects/AddProjectScreen.tsx#L1008) has zero/one/many targets: no publish section, one target switch row, or (only while publishing is on) a list of target rows with checkmark. Empty/name-filled input changes the owner/repository subtitle. iOS/Android branches set icon sizes/platform controls; these are separate native renders. [SourceControlSignInSection](https://github.com/pingdotgg/t3code/blob/e9312167e26f2de6984c604c7f07902e287caa58/apps/mobile/src/features/settings/components/SourceControlSignInSection.tsx#L30) only renders app-sign-in definitions, excluding GitLab. `useSelectedThreadGitState` subscribes to discovery but no consumer reads its returned `sourceControlDiscovery`, so it creates no additional GitLab auth UI row.
- Local server, remote environment, relay and tunnel carry the same typed result. The glab config belongs to the destination server environment, not the browser/device. No Electron IPC or OS-specific auth handling changed. A web rendering covers desktop's shared UI; no native desktop-shell-specific capture is required for this server diff. Agent/scheduled-task source-control operations do not introduce a separate rendering or a changed command path here.

## Seed recipes and evidence rules

Use the actual application at each head, not a hand-rendered imitation. All seed data/configs/drivers/binaries/logs belong under a *new timestamped capture-agent subdirectory* of `/tmp/lead-27840-r1/`; use the approved isolated T3 home, never the live database. This audit does not own or remove the lead's checkout. Capture pairing and browser authorization belong to the lead/capturer.

- **REAL-MIXED**: real glab 1.124; private copy of the existing config into `GLAB_CONFIG_DIR=<run>/glab`, keeping the supplied valid gitlab.com login. Only in that copy, add a self-hosted host such as `gitlab.gnome.org` with an intentionally invalid token, set it as global `host`, and use HTTPS. Clear inherited token and host overrides *in the server launch environment* if present (`GITLAB_TOKEN`, `GITLAB_ACCESS_TOKEN`, `OAUTH_TOKEN`, `GITLAB_HOST`, `GITLAB_URI`, `GL_HOST`; also remove API/proxy overrides if they contradict the fixture). `GLAB_CONFIG_DIR` must reach the dev-server process. Verify the current host under the server's `config.cwd`, not just a terminal in another repository: glab's current context also considers git remotes. First `auth status` must show only the failing current host; `--all` must contain the real signed-in host and may exit 1. Do not change the lead checkout's remotes to force this. If its remotes override the chosen host, choose a dedicated scratch Git cwd or explicit process-scoped host override and record the context. Rescan or remount the shared discovery query after changing scratch config.
- **REAL-OUT**: scratch config with no valid hosts (no copied token), first modern auth output nonzero/no account. Retry `--all` also has no sign-in. Capture a sanitized transcript with argv, exit status and first safe output line; Settings intentionally shows generic sign-in help, while publish/Add project's hints expose the first probe's detail.
- **REAL-OLD**: put a genuine glab 1.53 or 1.78 binary at the front of the *dev server's* PATH; record its version. With REAL-OUT, first signed-out output survives `unknown flag: --all`. With REAL-MIXED, old glab's initial all-host result is already authenticated and no retry should run. **These rows need an old binary for a real compatibility claim.** A script printing an old version string is only a labelled UI harness, not compatibility proof.
- **HARNESS-PROBE**: when credentials/network behavior cannot produce a deterministic condition, put a scratch `glab` executable shim on server PATH. It logs argv/cwd/exit milestones without secrets, returns an ordinary version line for `--version`, and selects canned output by exact auth argv. This still drives the unmodified real application's discovery and rendering; label every asset **HARNESS: glab probe output**, never claim real GitLab compatibility. Use a different output file/state for each run rather than overwriting evidence. A controlled local GitLab-like `/api/v4/user` endpoint with dummy tokens is also a backend harness and needs that label.
- **P-FIRST-OK** (HARNESS-PROBE unless a real self-hosted login is available): plain auth returns a signed-in self-hosted block; an `--all` invocation would stall on another host. Verify argv transcript has **no** `--all` and discovery completes without waiting for that host. A successful gitlab.com default is not a substitute.
- **P-RETRY-FAIL**: first returns a nonzero signed-out block; retry variants return (a) nonzero/no account, (b) zero/unparseable output, (c) process failure, (d) stall until the server's real five-second timeout. The original auth result must survive in all four. (a) is REAL-OUT; (b)–(d) normally need HARNESS-PROBE. A deterministic non-authenticated retry success/failure has the same settled appearance as REAL-OUT; only the timeout adds a distinct pending interval.
- **P-LONG**: HARNESS-PROBE returns two or more host blocks, with one signed-in account of about 64 characters; keep all relevant output below 8,000 bytes. Reverse which host block signs in to verify the displayed account follows the first reported signed-in block. No host count UI exists, so 2 vs 5 vs 20 hosts with the same selected account collapse into the same visual fixture. Real output beyond the output limit is not an additional render shape; whether it still contains a parseable sign-in maps to authenticated/unauthenticated/unknown fixtures.
- **P-UNKNOWN**: HARNESS-PROBE first exits zero with unparseable auth output, or first probe throws/times out; no retry. Use a short and a long detail for wrapping coverage if needed. Available unknown stays selectable in publish/Add project; no account prefix.
- **P-MISSING**: HARNESS-PROBE fails the version request and auth request; item missing, no version, install hint. This is a pre-existing control, not the new recovery path.
- **PEERS-0 / PEERS-1**: control other provider readiness for target-count fixtures. On a normally signed-in maintainer machine, REAL-MIXED alone does not guarantee GitLab is the sole ready provider. Use scratch per-provider configs or labelled CLI/API discovery fixtures for all other providers. For PEERS-1, make exactly one other provider ready (GitHub is suitable), keep that provider's state identical in before/after, then make GitLab go from signed out to recovered. Count *ready publish targets*, not installed binaries.
- Publish seeding: isolated scratch Git repository, existing commit/branch, **no remote**, add it as a project through the real app, open its thread/draft with Git actions visible and source-control write permission. Open Publish repository; stop at the repository form. Do not submit an external publish. For Add project, stop at the repository-input screen; no clone is needed. New project requires `newProjectsRoot`; name preview can be exercised without creating/publishing.
- Prefer UI navigation plus Rescan; the read-only `server.discoverSourceControl` RPC may verify shape, but merely calling the RPC does not seed a mounted query. A driver must await its completion/invalidate or remount the actual query. Record first-load and settled data separately. Capture before/after at the supplied base/head with the same config and peer state, not an unrelated nightly.
- Every affected recording includes enough surrounding UI to identify route/environment. Include sanitized CLI argv/results for decision/compatibility/timing claims; a picture cannot prove which executable/flags ran. Never upload configs, tokens, full environments, pairing URLs or cookies. For static endpoints of a recording, export labelled Before and After stills as helpful review evidence.

## Capture coordinates

- **D-dark** = web 1440×1000 CSS px, dark; **D-light** = same, light.
- **N-dark** = web 390×844 CSS px, dark; exercises the Settings `sm` layout branch. This is mobile web, not native mobile.
- **I-dark** = iOS native phone 393×852 logical points, dark; **A-dark** = Android native phone about 412×915 logical dp, dark. Use actual device logical dimensions and report them if these exact sizes are unavailable. Native light is optional because this diff changes no native theme/style logic.
- `recording` means moving evidence is required; endpoint stills alone are insufficient. Static rows require labelled base/head stills unless explicitly designated control. A short movie may cover several rows, provided its labelled timestamps map to each row.
- Minimum is the union of each affected row's coordinates below, not the full cross-product. Long-name, themes, widths and counts are sampled where they change the visible shape. No additional full desktop-shell or OS matrix is required by this diff.

## Fixture matrix

| ID | Named fixture and required input | Expected visible branch / action | Diff affected? | Minimum viewport × theme × row | Evidence type and seeding | Pass-1 status |
|---|---|---|---|---|---|---|
| F01 | Recovered other host; current self-host signed out, gitlab.com signed in, short account; REAL-MIXED | Base: Not authenticated + gray dot + unchecked disabled switch. Head: Authenticated as blurred account + success dot + checked disabled switch. Exactly one GitLab row; host names are not listed. | Yes: auth result changes | D-dark, D-light | **stills**, same real scratch config/glab 1.124 at both heads; `/settings/source-control`; first/`--all` transcript | **MISSING** |
| F02 | Recovered long account; P-LONG, alternate first signed-in host, account hidden/revealed/hidden | Account selected from first signed-in block; reveal and re-hide work; narrow wrapping does not obscure label/switch. Counts with identical selected account collapse here. | Yes: newly propagated account; interaction unchanged | N-dark | **recording**; labelled HARNESS-PROBE through real Settings, click account twice; no real login/binary version claim | **MISSING** |
| F03 | Successful current self-host + stalled noncurrent host; P-FIRST-OK | Authenticated row settles without querying every host; no unnecessary stalled scan. Plain auth runs once; `--all` must be absent from argv transcript. | Yes: protects retry guard / latency claim, same settled UI | D-dark | **recording** from initial scan or Rescan through settled Settings + sanitized argv milestones; labelled harness unless real signed-in self-host exists | **MISSING** |
| F04 | Modern all-signed-out; REAL-OUT; also retry returns unknown/process failure variants of P-RETRY-FAIL | Settings stays Not authenticated. Publish/Add project stay Setup Required and preserve the *first* detail, never the retry's error. Zero/unparseable retry must not enable GitLab. | Yes: new retry with retained first answer | D-dark, D-light; N-dark for Settings guidance | **recording** for Setup Required tooltip and Settings navigation; real glab 1.124 for signed-out baseline, labelled harness for unknown/process-failure variants; reuse F07/F08 for dependent surfaces | **MISSING** |
| F05 | Signed-out first answer, stalled `--all`; P-RETRY-FAIL timeout | Initial skeleton or retained prior rows + disabled Rescan while pending, then original signed-out result. Partial retry success text is not enough if the process times out. Error/unknown retry must not replace first result. | Yes: extra sequential probe/time path | D-dark | **recording** of complete pending→settled interval; labelled harness driving server's real timeout; capture initial-no-data and refresh-with-data as two segments; sanitized argv/RPC results | **MISSING** |
| F06 | Legacy signed out, unsupported `--all`; REAL-OLD + REAL-OUT | Not authenticated and original glab sign-out hint retained; no `unknown flag: --all` leaked into hint or Unknown state. | Yes: new retry compatibility path | D-dark | **recording** of Setup Required hint plus Settings; genuine glab 1.53 or 1.78 **required** for compatibility; version/argv/exit transcript | **MISSING** |
| F07 | Publish provider unavailable→recovered; REAL-MIXED, peer state fixed, scratch Git repo without remote | Base disabled GitLab card + Setup Required; head enabled/unselected then selected card; Next opens repository step with account prefix. Preserve gitlab.com host label. Exercise tooltip/setup navigation before, select/Next/Back/Cancel after. | Yes: readiness + account prefill | D-dark; N-dark for disabled/selected chooser | **recording**, real app thread → Git actions → Publish repository; may share F04/F06 hint segments; no publish submission | **MISSING** |
| F08 | Add-project GitLab source disabled→ready; REAL-MIXED, at least one peer state held fixed | Base Setup Required/disabled hint; head enabled GitLab repository in ready sorted group; click/tap opens GitLab repository input. URL path remains available. | Yes: readiness and ordering | D-dark, I-dark, A-dark | **recording**, web sidebar and palette/shortcut entries reach same source renderer; native `AddProject` (`new/add-project`) → `AddProjectRepository`; same destination environment/config; no clone | **MISSING** |
| F09 | New project zero→one ready target; REAL-MIXED + PEERS-0, configured newProjectsRoot | Base no publish option. Head sole GitLab publish option: web specific title + checkbox, native switch row; empty name shows owner, typed name shows owner/name. Toggle on/off. | Yes: zero/one count branch | D-dark, I-dark, A-dark | **recording**, web palette New project and native `AddProjectNew`; labelled harness if peer suppression is synthetic; no create/publish | **MISSING** |
| F10 | New project one→multiple targets; REAL-MIXED + PEERS-1 | Web goes from sole peer title/no picker to generic title + host picker; open picker and select GitLab, preview updates. Native shows target choices only after publish toggle on; select GitLab then turn off. Empty/typed name and GitLab selected/unselected covered. | Yes: multi-target count/selection branch | D-dark, N-dark, I-dark, A-dark | **recording**, same New project paths; keep peer state fixed. If >2 targets, one representative longer open list is optional, not a separate branch. | **MISSING** |
| F11 | Rescan both directions, correct environment; recovered→all-out→recovered; one and then two connected environment scopes | Settled Settings label/account/switch tracks new result in both directions; rescans disable while pending; reopened publish/Add project/New project use current result. With two environments, changing selected target uses that server's auth and correct heading suffix. | Yes: shared query refresh and reverse state | D-dark | **recording**, change only scratch config between scans, select target scope. Use labelled dual-environment harness if a second isolated environment is unavailable; do not touch a live server. Reuse F07–F10 segments for action endpoints. | **MISSING** |
| C01 | First auth unknown; P-UNKNOWN | Settings Could not verify GitLab + detail/fallback, gray dot, unchecked switch; publish/Add project remain selectable, New project can have null owner. No retry. | No expected delta; guard control | Optional D-dark; N-dark for long detail | **recording**, including pending/settled and selectable action endpoint; labelled harness | **NOT CAPTURED — control** |
| C02 | Missing/failed version probe; P-MISSING | No version, Not available/install guidance; availability off, provider actions unavailable even if auth output claims sign-in. | No expected delta; result-precedence control | Optional D-dark | **still**, labelled missing-executable/probe harness or isolated PATH without glab | **NOT CAPTURED — control** |
| C03 | Old glab already sees signed-in host; REAL-OLD + REAL-MIXED | Same authenticated Settings row as F01; old initial all-host output is enough and `--all` not invoked. | No expected delta; compatibility control | Optional D-dark | **still + argv transcript**; genuine glab 1.53 or 1.78 **required** for real compatibility; UI shim alone cannot satisfy it | **NOT CAPTURED — control** |

The minimum affected set is F01–F11. All are pending. The control rows prevent false inferences but do not add new affected visual layouts. No capture is requested for Settings empty/no-environment/error envelopes, GitLab account/credential editor, native GitLab Settings status, agent-provider setup, publish completion, or downstream cloning: these are unchanged, unreachable for this provider, or outside this diff. F05/F11 cover the only relevant pending/refresh envelopes. Native captures may share F08–F10's fixture data with web but are separate assets, not screenshots of mobile web relabelled as native.

## Verification limits and handoff

- Local checkout head matched the requested head; `git merge-base HEAD origin/main` matched the supplied base. The local `main` ref was stale/different, so it was not used for the diff.
- Read GitCafe PR metadata, description, reviews/comments and revision-bound status. At inspection it reported 40 successful checks and zero pending/failing checks; conflict observation was stale. This pass does not establish merge readiness or adopt the bot's request for per-host Settings UI as this PR's scope.
- Installed `glab version` reported 1.124.0; `auth status --help` documents `--all` and current-context selection. No private configuration contents, token values, auth endpoint responses or browser data were collected/uploaded.
- Existing test source covers recovery, skipping `--all` on initial success, and legacy signed-out detail retention. It does not substitute for captures and was not executed in this read-only proof-planning pass.
- No server, browser, emulator, lease or checkout was started/created. No edits to the lead's worktree, pushes or comments. The only created file is this audit artifact; it is uploaded before audit-step scratch cleanup.

FRICTION:
- tool | Python urllib upload-verification GET returned HTTP 403; curl verified HTTP 200 and the expected content length | Use curl to verify ghdrop URLs on this VM.

VERDICT: INSUFFICIENT F01 F02 F03 F04 F05 F06 F07 F08 F09 F10 F11