Add inspected agent viewport export with policy-bound final release

docs/development-observability.md

@@ -193,3 +193,32 @@ fragments rather than relying on all-values concatenation. Current trace
 collector rejected writes remain zero. Evidence: `artifacts/controlled-login-native-proof.json`
 and `artifacts/controlled-login-receiver-proof-native.log`. Earlier native failures
 and the prior successful proof remain distinct local evidence.
+
+
+The screenshot increment used actual traces to separate capture, structural PNG
+validation, OCR, enterprise inspection, audit, projection and final release.
+The first native run (`2a2507264480c9ed8fdb585a5608d292`) spent 6953.918 ms in
+local inspection, with OCR 6469.757 ms, capture 358.558 ms and AV 5.039 ms.
+These local cold-run observations identify OCR as the largest measured child;
+they do not prove the cause of all remaining IPC/containment overhead.
+
+Independent review found unobserved open-shadow mutations and a late policy/tab
+release gap after the helper returned. Shadow roots now have private observers
+and pending-record draining; final encrypted reply requires a private actor-bound
+policy/native-frame release guard checked synchronously beside reply. Latest
+native trace `aad45c8a85f25619a233b78e132d7bad` verifies eight stages. The final
+`visual.release` takes 0.2507 ms under the outer agent request; the seven helper
+stages retain the inner screenshot action ancestry. Real tests reclassify the
+page while retaining the screenshot grants, switch the foreground after helper
+return and mutate/revert open-shadow content; all suppress image delivery.
+
+The native fixture also proves real contained OCR of a confidential canvas,
+mandatory ICAP PNG blocking and secret exclusion from ordinary ECS/OTLP output.
+Five PNG AV scans include one expected block; collector rejected writes are zero.
+Real OTLP regression tests prove responsible-stage ERROR status, redaction and
+central disable. No pixels, encoded images, raw DOM attributes or extracted OCR
+text are diagnostic attributes. The local receiver is protected and bounded,
+not a production forensic archive. The admin fixture's earlier 429 failure came
+from short synthetic cookies sharing the IP bucket; realistic-length synthetic
+capabilities resolved it without changing production limits. Its subsequent
+200 completed API requests all have correlated traces.