1# Screenshot and visual-evidence protocol23Capture tool: `/usr/sbin/screencapture -x -o -l <CGWindowID>` (native window capture, macOS 27.0), window ids resolved through Quartz `CGWindowListCopyWindowInfo`. Every capture is recorded in the `screenshots` table with: screenshot_id, run/task/treatment/phase, event linkage, UTC timestamp, capture_mode (native_live / dashboard_live / viewer_postrun / transcript_replay), tool and version, source surface, original path + SHA-256, public path + SHA-256 (if published), redaction description, selection rule, caption, claim ids. Originals live in `evidence/restricted/` (not committed); public copies in `evidence/public_screenshots/` only after inspection for secrets (none expected: executors never see credentials; the controller never prints them).45Triggers (`configs/capture.yaml`): environment verification (once), live run (first smoke batch; one stratified block per family in the main benchmark), gate rejection (every controller gate failure in smoke/pilot; sampled in main), recovery (every fault-injection run: before/fault/after), dashboard status (end of pilot, end of main), results figure/table (after analysis), compiled manuscript (final).67Rules: no image generation, no reconstructed terminals, no editing of captured content other than cropping (recorded). Capture failures are logged (e.g. S001 live-dashboard attempt during the smoke batch failed because the Safari window was off-screen; a post-run viewer capture replaces it and is labelled `viewer_postrun`). Hashes attest file integrity relative to the manifest, not the moment of capture; captures are triangulated with event timestamps and session ids in the database. Screenshots document events; they are never used as statistical observations.8