# Screenshot and visual-evidence protocol

Capture tool: /usr/sbin/screencapture -x -o -l <CGWindowID> (native window capture, macOS 27.0), window ids resolved through Quartz CGWindowListCopyWindowInfo. Every capture is recorded in the screenshots table with: screenshot_id, run/task/treatment/phase, event linkage, UTC timestamp, capture_mode (native_live / dashboard_live / viewer_postrun / transcript_replay), tool and version, source surface, original path + SHA-256, public path + SHA-256 (if published), redaction description, selection rule, caption, claim ids. Originals live in evidence/restricted/ (not committed); public copies in evidence/public_screenshots/ only after inspection for secrets (none expected: executors never see credentials; the controller never prints them).

Triggers (configs/capture.yaml): environment verification (once), live run (first smoke batch; one stratified block per family in the main benchmark), gate rejection (every controller gate failure in smoke/pilot; sampled in main), recovery (every fault-injection run: before/fault/after), dashboard status (end of pilot, end of main), results figure/table (after analysis), compiled manuscript (final).

Rules: no image generation, no reconstructed terminals, no editing of captured content other than cropping (recorded). Capture failures are logged (e.g. S001 live-dashboard attempt during the smoke batch failed because the Safari window was off-screen; a post-run viewer capture replaces it and is labelled viewer_postrun). Hashes attest file integrity relative to the manifest, not the moment of capture; captures are triangulated with event timestamps and session ids in the database. Screenshots document events; they are never used as statistical observations.