# PR #25709 capture matrix (lead-trimmed from proof-audit pass 1)

Head `ee9754767f` (after), merge-base `a9b513b50c` (before). Full pass-1 inventory: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/156e7416c2621075/fixture-matrix.md

Changes since pass 1 (pinned at c28e325e8d): `RedactedSensitiveText` is no longer changed (P24 obsolete); `/settings/secrets` search scope is `null`; under a project/checkout scope the Secrets page is read-only with the notice "Environment-wide setting. Select an environment to change it."; account input capped at 253, name at 64.

Before side: main has no Secrets page. One "before" set (B0) covers every new-page row: Settings sidebar Connections group, settings search for "1password", and navigating to `/settings/secrets`.

W-L = 1440×900 light, W-D = 1440×900 dark, N-L = 390×844 light.

| Row | Fixture | How to reach | Capture | Before cell |
|---|---|---|---|---|
| R0 | Flag off at head: no Secrets nav entry, no search results, `/settings/secrets` → General | head dev server without `T3CODE_FEATURE_SECRETS` | recording W-L (+ stills of sidebar) | B0 (identical expected) |
| R1 | Flag on: Secrets nav entry under Connections; settings search "1password" shows 2 results; select → page | head with `T3CODE_FEATURE_SECRETS=1` | recording W-L; still N-L | B0 |
| R2 | Command palette "1password" shows the Secrets actions | palette | still W-L | B0 |
| R3 | Editable empty state | fresh DB, admin pairing | still W-L, W-D, N-L | B0 |
| R4 | Populated (Personal, Work), account hidden then revealed by click | add via UI | recording W-L; stills W-L, W-D | B0 |
| R5 | Long data: 64-char label (spaced and unbroken), 253-char account | add via UI | still W-L, N-L | B0 |
| R6 | Read-only (no `providers:manage`): populated, no Add/Edit/Remove, reveal still works | second clean browser context paired with `node apps/server/src/bin.ts pair --scope orchestration:read` (check the CLI's flag name with `--help`) | still W-L; recording optional | B0 |
| R7 | Add dialog pristine, then submit empty → both field errors | Add provider | stills W-L, W-D, N-L | B0 |
| R8 | Name collision (`Personal!` when Personal exists) + `--help` account → both errors | Add provider | still W-L | B0 |
| R9 | Successful add via Enter, persisted after reload | Add, type, Enter, reload | recording W-L | B0 |
| R10 | Edit dialog: name read-only with hint, account change saved | Edit | still W-L, W-D; recording W-L of save | B0 |
| R11 | Remove confirmation, then provider gone | Remove | recording W-L; still W-D of dialog | B0 |
| R12 | Project scope: page read-only with the environment-wide notice | add a project (a temp git dir under the scratch dir) through the app, select it in the settings scope picker, open Secrets | still W-L | B0 |

Not captured (list as unverified in the PR body with the reason): P16 no environments, P17 disconnected/connecting, P19 two environments, P21 permission pending/error, P22 mutation failure/pending, P23 concurrent deletion — all need a second environment or a controlled RPC harness; P24 obsolete (shared component no longer changed).