Run on 2026-10-14 against origin/main 0c5ee8fc's Electron 44.7.0 (Chromium 152.0.7977.130), under xvfb-run on Linux. A standalone Electron script served this page from 127.0.0.1, loaded it in a hidden BrowserWindow, waited 1.5 s, and called webContents.savePage(path, 'MHTML'), the same call backgroundRenderer.ts makes. Each image response was a 1x1 PNG with TAG:<request path> appended after IEND, so the bytes in each MHTML part name the request that served them.

The server log never shows a request for /src-fallback.png.

Call sites that use the Blink MHTML serializer: src/main/services/backgroundRenderer.ts (wc.savePage(tmpPath, 'MHTML')) and extension/src/background.ts (chrome.pageCapture.saveAsMHTML). The extension path was not run.

Related records: ADR-0004 already says MHTML is a browser representation and not a complete transaction record, and ADR-0035 puts a WARC transaction record beside the MHTML. Whether that record should be the answer for these bytes is part of the open decision.

Agent Brief

Category: bug Summary: A background Recapture pins each srcset image to the source it displayed before saving the MHTML, and records Image Source Pinning in the signed capture entry's inventory.

Current behavior: Reproduced on Electron 44.7.0 during the 2026-10-15 triage (method and table in the earlier triage comment). The MHTML serializer drops srcset from every <img>. An <img> with srcset and no src (either x or w descriptors) has no part in the MHTML, although the browser fetched and displayed it. An <img> with src and srcset is saved with the bytes it displayed (currentSrc), filed under Content-Location of its src, which the browser never requested. <picture> and plain <img src> save correctly.

Desired behavior:

• After the screenshot is taken and before the page is saved, the render rewrites each <img> that is not inside <picture>, carries srcset, and has a non-empty currentSrc. Its src becomes its currentSrc, and its srcset and sizes attributes are removed. An <img> with an empty currentSrc is left untouched.
• The save waits for each pinned image to finish loading, bounded by the render's existing time budget. It never extends the render past its deadline.
• The capture entry's inventory carries, in its MHTML part, pinnedImages (the images rewritten) and pinnedImagesNotLoaded (the pinned images not loaded when the save ran). Both are always written, 0 when nothing applied, and both are whole numbers. The Capture row mirrors them the way it mirrors the rest of the inventory.
• The report's per-Capture detail adds a row next to the consent overlay row, reading Image sources: N pinned to the displayed image, and , M not loaded when saved when M is nonzero. The row is absent when N is 0.
• CONTEXT.md gains the Image Source Pinning entry below, and the decision record below lands as the next free ADR number.

Key interfaces:

• RenderedPage carries the two counts from the background renderer to ingest, the way it carries consentSuppression.
• The inventory in the capture entry (the first-slice plan's D4) holds them under inventory.mhtml. #1904 adds both fields to the schema and the verifier, at the schema number it takes. If #1904 merges without them, stop and take the give-up path rather than adding a schema step here.
• The verifier refine #1904 adds rejects pinnedImagesNotLoaded greater than pinnedImages.
• Consent Suppression is the pattern to follow end to end: render, RenderedPage, ingest, signed entry, Capture row, report row.

Acceptance criteria:

• An end-to-end Recapture of a local page with five images (srcset only with x descriptors, src plus srcset, srcset only with w descriptors, <picture>, plain src) stores an MHTML that has a part for each image's displayed source, and no part under an address the server never served.
• That Capture's signed entry has inventory.mhtml.pinnedImages 3 and pinnedImagesNotLoaded 0, and the report shows Image sources: 3 pinned to the displayed image.
• A renderer test asserts the order: the screenshot is captured, then the rewrite runs, then the page is saved.
• A page with no srcset image gets both counts 0 and no report row.
• A test in which a pinned image cannot load before the budget ends counts it in pinnedImagesNotLoaded, and the render still finishes within its deadline.
• The package from such a Capture verifies in the app and passes verify.sh.
• Captures made by the extension are unchanged.

Verification path:

• pnpm test tests/main/services/backgroundRenderer.test.ts and pnpm test tests/main/services/recapture.test.ts
• pnpm test:e2e, with a new spec beside the existing Recapture specs that serves the five-image page
• pnpm preflight, green at the PR head

Starting points (as of main 5509cff8, may move):

• src/main/services/backgroundRenderer.ts: render(), between captureFullPageScreenshot and wc.savePage.
• src/main/services/recapture.ts: RenderedPage and the ingest call.
• src/main/services/reportHtml.ts: the Consent overlay row.
• e2e/recapture-consent.spec.ts: the pattern for a served local page.
• The inventory writer #1928 adds, and the schema fields #1904 adds.

Evidence-affecting: yes. The change alters the MHTML a Capture stores and adds signed fields.

Out of scope:

• The browser extension's save path. If you test it and it drops images too, record it in the PR's findings.
• Operator-witnessed Captures.
• Rewriting stored Captures made before this change.
• Any change to how <picture> or plain images are saved.

Blocked by: #1904 and #1928.

Image Source Pinning: The record that a background Recapture pointed each image offered as a set of alternatives at the one it displayed before saving the MHTML, with how many images that covered and how many were still loading when the page was saved. Absent for operator-witnessed Captures and for Captures made before it existed. Avoid: srcset rewrite, image fix.

A local draft of this text is committed on drafts/2026-10-21-image-source-pinning-adr, which has not been pushed, so the text is reproduced here.

A background render pins image sources before it saves the MHTML

Status: Accepted. Date: 2026-10-21. Source: the maintainer's ruling in the triage of #1843.

Context. The MHTML serializer drops srcset from every <img>: an image offered only through srcset is missing from the saved page, and an image with both src and srcset is filed under an address the browser never requested. ADR-0004 treats MHTML as a browser-oriented representation and requires a Capture to record the limitations that applied. The planned Transaction Record (ADR-0035) holds the true bytes only when recording was on before the page loaded, and does not correct an address the MHTML states wrongly.

Considered options. Stating the gap as a limitation never changes captured content but leaves a wrong origin in the saved page. Relying on the Transaction Record builds nothing now and leaves the wrong address in every MHTML. Pinning the image sources before the save was chosen.

Decision. After the screenshot and before the save, each <img> outside <picture> that carries srcset and displayed an image has its src set to the source it displayed and its srcset and sizes removed. The Capture records Image Source Pinning as two always-written counts in the MHTML part of the signed inventory, following Consent Suppression. Background renders only: the extension is untested, and a change there would alter the Operator's own tab.

Consequences. The saved MHTML is no longer exactly what the serializer would have written from the page as loaded; the signed counts are what a reader relies on. The counts join the schema number the first-slice verifier takes (#1904), because a released verifier cannot be recalled. A verifier rejects a not-loaded count above the pinned count.