Ψ-W3 remediation: fix the verify doc's wrong render source, add missing content checks, soften unverified claims

Corrected the Render-dialog source name the refusal's evidence depends on, added a by-ear content check and a file-size channel proxy, and stopped two comments from overclaiming.

src/shell/capture/capture.cpp

@@ -231,23 +231,28 @@ CaptureName captureNameFor(const std::vector<std::string>& sourceNames,
 
 namespace {
 
-// One console line per genuine collapse failure. The capture itself is intact and was
-// measured after this step, so the failure costs only the size win — but silence here is
-// what made a failed rewrite read exactly like a legitimately stereo capture.
-void reportCollapseFailure(const std::string& absolutePath, const char* what) {
-    ShowConsoleMsg(("ReaSampler capture: the lossless mono collapse " + std::string(what) +
-                    " -- " + absolutePath +
-                    " landed intact, as captured.\n").c_str());
+// One console line per genuine collapse failure — silence here is what made a failed
+// rewrite read exactly like a legitimately stereo capture. Deliberately does NOT claim
+// the captured bytes are intact: a 0-byte render can reach this branch too (it passes the
+// exists/bounds gates upstream; see docs/TODO.md), and this path never verified the bytes
+// it's reporting on.
+void reportCollapseFailure(const std::string& absolutePath, const char* what,
+                           const char* consoleLabel) {
+    ShowConsoleMsg((std::string(consoleLabel) + ": the lossless mono collapse " +
+                    std::string(what) + " -- " + absolutePath +
+                    " already reached the bank; only the size win from the collapse "
+                    "was lost.\n").c_str());
 }
 
 }  // namespace
 
-MonoCollapseOutcome collapseCapturedFileToMono(const std::string& absolutePath) {
+MonoCollapseOutcome collapseCapturedFileToMono(const std::string& absolutePath,
+                                               const char* consoleLabel) {
     const std::vector<std::uint8_t> bytes = util::readFileBytes(absolutePath);
     if (bytes.empty()) {
         // Failed, not Declined: the read that would have decided never happened, so
         // "the channels differ" is a claim this path cannot make.
-        reportCollapseFailure(absolutePath, "could not read the captured file");
+        reportCollapseFailure(absolutePath, "could not read the captured file", consoleLabel);
         return MonoCollapseOutcome::Failed;
     }
 
@@ -265,7 +270,7 @@ MonoCollapseOutcome collapseCapturedFileToMono(const std::string& absolutePath)
     {
         std::ofstream out(tempPath, std::ios::binary | std::ios::trunc);
         if (!out) {
-            reportCollapseFailure(absolutePath, "could not open its temporary file");
+            reportCollapseFailure(absolutePath, "could not open its temporary file", consoleLabel);
             return MonoCollapseOutcome::Failed;
         }
         out.write(reinterpret_cast<const char*>(collapse.bytes.data()),
@@ -275,7 +280,7 @@ MonoCollapseOutcome collapseCapturedFileToMono(const std::string& absolutePath)
         if (!wroteOk) {
             std::error_code ec;
             std::filesystem::remove(tempPath, ec);
-            reportCollapseFailure(absolutePath, "could not write the rebuilt file");
+            reportCollapseFailure(absolutePath, "could not write the rebuilt file", consoleLabel);
             return MonoCollapseOutcome::Failed;
         }
     }
@@ -283,7 +288,7 @@ MonoCollapseOutcome collapseCapturedFileToMono(const std::string& absolutePath)
     std::filesystem::rename(tempPath, absolutePath, ec);
     if (ec) {
         std::filesystem::remove(tempPath, ec);  // don't leave litter on a failed rename
-        reportCollapseFailure(absolutePath, "could not replace the captured file");
+        reportCollapseFailure(absolutePath, "could not replace the captured file", consoleLabel);
         return MonoCollapseOutcome::Failed;
     }
     return MonoCollapseOutcome::Collapsed;
@@ -497,8 +502,9 @@ CaptureResult OfflineRenderBackend::capture(const CaptureRequest& request) {
     // (within a tolerance, see below) the requested window's frames, so a source
     // mode that silently widened the render fails loudly here instead of landing as
     // a successful capture. Auto and Manual add frames by design and are skipped.
-    // (The landed file is read three times on this path — this gate, the mono collapse,
-    // and stampCaptureSample — plus one rewrite when the collapse fires; a
+    // (On TailMode::None the landed file is read three times on this path — this gate,
+    // the mono collapse, and stampCaptureSample — plus one rewrite when the collapse
+    // fires; Auto/Manual skip this gate entirely, so they read it twice. A
     // once-per-capture cost on an already-warm file, judged acceptable.) A
     // bounded/header-only read is not a clean substitute: parseWavLayout only marks the
     // data chunk valid when the buffer holds the chunk's FULL declared body