Review: [#19931](https://github.com/pingdotgg/t3code/pull/19931), local rebuilt a40886cd3ea261a882798790838b8f2f1e8213a3, base ab6be13d438abeace7617e8d789d59cf2e880f42. The upstream PR still points to contributor head 1cf3a9e103b75eced44174e023902313c9c55d61; this review covers the clean local rebuild, not an unpublished PR revision.

Verdict: HOLD FOR NATIVE ACCEPTANCE. Worth pursuing: it directly targets stale/failing native captures for hidden backgrounds, and retained earlier native comparisons showed improvement, but those comparisons are not proof for this head. No concrete source bug or unnecessary abstraction found in the 2-file origin/main...HEAD diff. No code fix requested before native verification.

Source trace:
- Manager.ts:2410-2548 uses a unique symbol consumer per screenshot with acquire/use/release. It starts shared rendering ownership, runs bounded isolated-world double-rAF paint readiness alongside a discarded warmup native capture, then writes only a separate final native capture. Warmup operation errors and paint-probe errors fall back to available pixels; final capture errors or a replaced/destroyed guest fail.
- Manager.ts:604-637 validates the guest before/after each native capture and bounds/retries attempts. Manager.ts:757-815,2695-2784 shares host/guest throttling leases across screenshots, recording, and PiP; last release restores throttling. Manager.ts:1703-1773,1775-1935,1620-1649 cover close, replacement, and main-window lifecycle. No focus/raise call was introduced.
- The desktop IPC method delegates to Manager and the web preview's desktop bridge invokes it; no wire schema, provider, mobile, or server path changed.
- Five added regression cases exercise saved post-probe pixels on paint/deadline, overlapping screenshot interruption, and recording/PiP ending during a pending screenshot. Existing capture and guest-replacement tests also exercise final errors and artifact suppression. These are behavior-oriented, though mocks cannot prove Chromium compositor freshness or native request disposal.

Historical feedback: CodeRabbit's old Runtime.evaluate pending-promise finding is addressed by the in-page timer that resolves false and cancels the pending animation frame; double-rAF success clears the timer. A fully frozen renderer also pauses that timer. The outer Effect timeout bounds the caller and semaphore permit, but outstanding native CDP/capture promises are not forcibly canceled. This is a known proof limit, not a confirmed regression or a claimed wall-clock disposal guarantee.

Evidence: Reviewed complete diff and relevant callers/session lifecycle. Existing verification logs for this exact head record 116 focused Manager/IPC tests passed, desktop typecheck, scoped lint/format, and diff check passed; I did not rerun them. The prior red-on-main result for all five added cases is reported in the implementation verification, not independently repeated here. Current upstream CI and review comments apply to 1cf3a9e, not a40886cd3e.

Remaining acceptance before publication: on supported native Electron hosts, mutate a visible marker just before capture and independently decode the final saved PNG while hidden, minimized, and display-off/locked; verify focus remains unchanged. Repeat with overlap, recording/PiP, interruption, guest replacement, and app close to confirm remaining consumers render and final throttling cleanup. Exercise unavailable/foreign debugger and timeout fallback, reporting available pixels with mutation freshness unconfirmed. Headless Linux cannot establish these native outcomes. No edits, push, review posts, browser/native apps, or dev servers were used.
