@@ -187,6 +187,12 @@ A backend-owned accessibility value before snapshot presentation.
 **Snapshot acquisition**:
 One backend attempt's raw accessibility nodes and attempt-level capture facts.
 
+**Snapshot producer**:
+The acquisition component that produced a snapshot's raw tree — the third identity axis beside
+the platform channel and the in-plan capture strategy. Producers on one channel carry different
+guarantees, so presentation, scope, and geometry logic keys on the producer, never the channel
+alone.
+
 **Presentation options**:
 The policy input controlling how one snapshot acquisition becomes a public projection.
 
 
@@ -12,8 +12,8 @@ import type {
   RawSnapshotNode,
   Point,
   Rect,
-  SnapshotBackend,
   SnapshotOptions as BaseSnapshotOptions,
+  SnapshotProvenance,
 } from '@agent-device/kernel/snapshot';
 
 export type RunnerContext = {
@@ -239,13 +239,15 @@ export type KeyboardEnterResult =
   | Readonly<{ kind: 'android-acknowledged' }>
   | Readonly<{ kind: 'harmonyos-acknowledged' }>;
 
+/**
+ * Every acquisition carries its provenance pair atomically: the channel alone cannot say who
+ * acquired the tree or which guarantees it carries, and `SnapshotProvenance`
+ * (`@agent-device/kernel/snapshot`) makes a cross-channel `backend`/`producer` combination
+ * fail to compile.
+ */
 export type SnapshotResult = Omit<BackendSnapshotResult, 'backend' | 'nodes'> & {
   nodes?: RawSnapshotNode[];
-  backend: Extract<
-    SnapshotBackend,
-    'android' | 'harmonyos-arkui' | 'xctest' | 'linux-atspi' | 'macos-helper' | 'web'
-  >;
-};
+} & SnapshotProvenance;
 
 export type Interactor = {
   open(
 
@@ -0,0 +1,35 @@
+import { expect, test } from 'vitest';
+import {
+  snapshotStateProvenance,
+  type SnapshotProvenance,
+  type SnapshotStateProvenance,
+} from './snapshot.ts';
+
+// The negative half of this test is type-level: each @ts-expect-error line fails `pnpm
+// typecheck` the moment the provenance table would accept a cross-channel pair again.
+test('the provenance table rejects cross-channel pairs at compile time', () => {
+  const shared: SnapshotProvenance = { backend: 'xctest', producer: 'appium-source' };
+  // @ts-expect-error the android channel cannot carry the apple-runner producer
+  const crossChannel: SnapshotProvenance = { backend: 'android', producer: 'apple-runner' };
+  // @ts-expect-error the web channel has exactly one producer
+  const foreignProducer: SnapshotProvenance = { backend: 'web', producer: 'limrun-ios-tree' };
+  // @ts-expect-error a state pair may omit the producer but not carry a foreign one
+  const stateMismatch: SnapshotStateProvenance = {
+    backend: 'macos-helper',
+    producer: 'linux-atspi',
+  };
+  const stateWithoutProducer: SnapshotStateProvenance = { backend: 'android' };
+
+  expect([shared, crossChannel, foreignProducer, stateMismatch, stateWithoutProducer]).toHaveLength(
+    5,
+  );
+});
+
+test('snapshotStateProvenance extracts exactly the pair', () => {
+  expect(snapshotStateProvenance(undefined)).toEqual({});
+  expect(snapshotStateProvenance({})).toEqual({});
+  expect(snapshotStateProvenance({ backend: 'xctest', producer: 'limrun-ios-tree' })).toEqual({
+    backend: 'xctest',
+    producer: 'limrun-ios-tree',
+  });
+});
@@ -147,13 +147,69 @@ export type SnapshotNode = RawSnapshotNode & {
   inheritsIdentifier?: true;
 };
 
-export type SnapshotBackend =
-  | 'xctest'
-  | 'android'
-  | 'harmonyos-arkui'
-  | 'macos-helper'
-  | 'linux-atspi'
-  | 'web';
+/**
+ * The channel↔producer pairs that can actually occur. One channel is fed by several producers
+ * with different guarantees: `xctest` trees come from the local Apple runner, Appium
+ * page-source XML, or a limrun element tree, and only the runner's output has been through the
+ * runner's presentation (clip fold, effective geometry, scope). Logic that assumes
+ * presentation, scope, or geometry guarantees must key on the producer, never on the channel
+ * alone.
+ *
+ * This table is the single owner of both vocabularies: the platform channel
+ * (`SnapshotBackend` is its `backend` projection) and the acquisition producer (the third
+ * axis beside the channel and the in-plan capture strategy `SnapshotCaptureBackend`). Every
+ * carrier embeds the pair atomically — a cross-channel pair does not compile (pinned by
+ * snapshot-provenance.test.ts).
+ */
+export type SnapshotProvenance =
+  | { backend: 'xctest'; producer: 'apple-runner' | 'appium-source' | 'limrun-ios-tree' }
+  | { backend: 'android'; producer: 'android-uiautomator' | 'appium-source' }
+  | { backend: 'harmonyos-arkui'; producer: 'harmonyos-uitest' }
+  | { backend: 'macos-helper'; producer: 'macos-helper' }
+  | { backend: 'linux-atspi'; producer: 'linux-atspi' }
+  | { backend: 'web'; producer: 'agent-browser' };
+
+export type SnapshotBackend = SnapshotProvenance['backend'];
+
+type OptionalProducerProvenance<Pair> = Pair extends {
+  backend: infer Backend;
+  producer: infer Producer;
+}
+  ? { backend: Backend; producer?: Producer }
+  : never;
+
+/**
+ * The provenance carrier for {@link SnapshotState}: the producer may be absent (legacy states
+ * and fixtures predate it), but a present pair still has to come from the
+ * {@link SnapshotProvenance} table — the channel may not carry a foreign producer.
+ */
+export type SnapshotStateProvenance =
+  | OptionalProducerProvenance<SnapshotProvenance>
+  | { backend?: undefined; producer?: undefined };
+
+/**
+ * Narrows a provenance-carrying value to just its pair without decorrelating the two fields
+ * (reading `backend` and `producer` separately would lose the pairing for the type system).
+ */
+export function snapshotStateProvenance(
+  value: SnapshotStateProvenance | undefined,
+): SnapshotStateProvenance {
+  if (value === undefined || value.backend === undefined) return {};
+  switch (value.backend) {
+    case 'xctest':
+      return { backend: value.backend, producer: value.producer };
+    case 'android':
+      return { backend: value.backend, producer: value.producer };
+    case 'harmonyos-arkui':
+      return { backend: value.backend, producer: value.producer };
+    case 'macos-helper':
+      return { backend: value.backend, producer: value.producer };
+    case 'linux-atspi':
+      return { backend: value.backend, producer: value.producer };
+    case 'web':
+      return { backend: value.backend, producer: value.producer };
+  }
+}
 
 export function isSnapshotBackend(value: unknown): value is SnapshotBackend {
   return (
@@ -179,7 +235,6 @@ export type SnapshotState = {
   nodes: SnapshotNode[];
   createdAt: number;
   truncated?: boolean;
-  backend?: SnapshotBackend;
   snapshotQuality?: SnapshotQualityVerdict;
   comparisonSafe?: boolean;
   presentationKey?: string;
@@ -189,7 +244,7 @@ export type SnapshotState = {
    * occlusion (see core/android-system-surface-disclosure.ts).
    */
   systemSurfaceOnly?: boolean;
-};
+} & SnapshotStateProvenance;
 
 export type SnapshotUnchanged = {
   ageMs: number;
 
@@ -249,6 +249,7 @@ test.each(['frontmost-app', 'desktop', 'menubar'] as const)(
     const host = platformRuntimeHostFixture();
     const captureSurface = vi.fn(async () => ({
       backend: 'macos-helper' as const,
+      producer: 'macos-helper' as const,
       nodes: [],
       truncated: false,
     }));
@@ -551,6 +552,7 @@ test('the macOS surface branch composes the per-capture signal with the binding
   const host = platformRuntimeHostFixture();
   const captureSurface = vi.fn<SnapshotRuntimeHost['captureSurface']>(async () => ({
     backend: 'macos-helper' as const,
+    producer: 'macos-helper' as const,
     nodes: [],
     truncated: false,
   }));
 
@@ -79,6 +79,7 @@ test.each([
   async ({ device, legacy }) => {
     const captureSurface = vi.fn(async () => ({
       backend: 'linux-atspi' as const,
+      producer: 'linux-atspi' as const,
       nodes: [],
       truncated: false,
     }));
@@ -144,6 +145,7 @@ test.each([
 function lifecycleHost(
   captureSurface: SnapshotRuntimeHost['captureSurface'] = async () => ({
     backend: 'linux-atspi' as const,
+    producer: 'linux-atspi' as const,
     nodes: [],
     truncated: false,
   }),
@@ -209,6 +211,7 @@ function expectLinuxNavigationAndKeyboardFacts(
 test('the Linux surface capture composes the per-capture signal with the request scope signal', async () => {
   const captureSurface = vi.fn<SnapshotRuntimeHost['captureSurface']>(async () => ({
     backend: 'linux-atspi' as const,
+    producer: 'linux-atspi' as const,
     nodes: [],
     truncated: false,
   }));
 
@@ -0,0 +1,21 @@
+import { expect, test } from 'vitest';
+import { createLimrunIosInteractor, type LimrunIosSession } from './ios.ts';
+
+test('limrun iOS snapshot stamps the xctest channel with its own producer', async () => {
+  const session = {
+    platform: 'ios',
+    client: {
+      elementTree: async () =>
+        JSON.stringify({
+          elementType: 'Application',
+          children: [{ elementType: 'Button', label: 'Continue', enabled: true }],
+        }),
+    },
+  } as unknown as LimrunIosSession;
+
+  const result = await createLimrunIosInteractor(session).snapshot();
+
+  expect(result.backend).toBe('xctest');
+  expect(result.producer).toBe('limrun-ios-tree');
+  expect(result.nodes?.map((node) => node.label)).toEqual([undefined, 'Continue']);
+});
@@ -257,7 +257,7 @@ class LimrunIosInteractor implements Interactor {
   async snapshot(_options?: SnapshotOptions): Promise<SnapshotResult> {
     const treeJson = await this.session.client.elementTree();
     const parsed = JSON.parse(treeJson) as IosTreeNode | IosTreeNode[];
-    return { nodes: flattenIosTree(parsed), backend: 'xctest' };
+    return { nodes: flattenIosTree(parsed), backend: 'xctest', producer: 'limrun-ios-tree' };
   }
 
   async back(): Promise<void> {
 
@@ -280,8 +280,11 @@ class WebDriverInteractor implements Interactor {
 
   async snapshot(_options?: SnapshotOptions): Promise<SnapshotResult> {
     this.requireSupport('snapshot');
+    // Spelled as a correlated pair per channel so the SnapshotProvenance union accepts it.
     return {
-      backend: this.backend,
+      ...(this.backend === 'xctest'
+        ? { backend: 'xctest' as const, producer: 'appium-source' as const }
+        : { backend: 'android' as const, producer: 'appium-source' as const }),
       nodes: parseWebDriverSource(await this.client.source()),
     };
   }
 
@@ -2,6 +2,7 @@ import {
   attachRefs,
   type RawSnapshotNode,
   type SnapshotState,
+  type SnapshotStateProvenance,
 } from '@agent-device/kernel/snapshot';
 
 export function buildNodes(raw: RawSnapshotNode[]) {
@@ -10,7 +11,9 @@ export function buildNodes(raw: RawSnapshotNode[]) {
 
 export function makeSnapshotState(
   raw: RawSnapshotNode[],
-  overrides?: Partial<SnapshotState>,
+  // The provenance pair stays correlated: overrides carry it as one value, never as two
+  // independently typed fields.
+  overrides?: Omit<Partial<SnapshotState>, 'backend' | 'producer'> & SnapshotStateProvenance,
 ): SnapshotState {
   return {
     nodes: attachRefs(raw),
Original file line number	Diff line number	Diff line change
`@@ -257,7 +257,7 @@ class LimrunIosInteractor implements Interactor {`
`257`	`257`	`async snapshot(_options?: SnapshotOptions): Promise<SnapshotResult> {`
`258`	`258`	`const treeJson = await this.session.client.elementTree();`
`259`	`259`	`const parsed = JSON.parse(treeJson) as IosTreeNode \| IosTreeNode[];`
`260`		`- return { nodes: flattenIosTree(parsed), backend: 'xctest' };`
	`260`	`+ return { nodes: flattenIosTree(parsed), backend: 'xctest', producer: 'limrun-ios-tree' };`
`261`	`261`	`}`
`262`	`262`
`263`	`263`	`async back(): Promise<void> {`