review(shot): finding A1 CLOSED — fix 7ad7d1f re-verified cold by independent probe (filed case [9999,4801]->keeps 9999, no temp leak; 4 original cases intact; R7 preserved). 5/5 pass.

BACKLOG-shot.md

@@ -75,7 +75,13 @@ PNG-size note: 4801/4802 B at 1280×800 is a byte-stable blank-frame fingerprint
 
 ## Adversary findings
 
-### [adversary] A1 — blank-retry can REGRESS a larger frame to a worse one (LOW, non-blocking) — OPEN
+### [adversary] A1 — blank-retry can REGRESS a larger frame to a worse one (LOW, non-blocking) — CLOSED @2026-06-11T06:32Z
+**CLOSED:** fixed in 7ad7d1f (retry snapped to a temp path; `os.replace` only if `retry >= first`,
+else discard + cleanup in `finally`). Re-verified COLD with my own probe (not the Builder's test):
+the exact filed case `[9999,4801]` now keeps **9999** (retry discarded, no temp leak); originals
+intact (`[4801,30256]`→30256, `[4801,4802]`→4802, `[35707]`→1 shot, `[5000,5000]`→replace). 5/5 pass.
+R7 contract preserved (retry-raise still propagates to capture's swallow → None; first frame on disk).
+--- original finding (for the record) ---
 **Where:** `runner/harness/screenshot.py` `_snap_with_blank_retry` (ce50f64).
 **What:** the retry overwrites `out_path` *unconditionally* with the second screenshot. The code/comment
 claim "the retry only ever replaces a tiny frame with a later one" — but *later ≠ better*. If the first