Function clamp_offset 

fn clamp_offset(x: i32, root: u16) -> i16

Clamp a capture offset to the live root so a grab always has at least one root pixel in range: a past-end offset fails every shm_get_image with BadMatch and would burn out the failure budget with no chance of recovery. The upper clamp also keeps protocol-range roots (INT16 coordinates) from truncating a wider value through the as i16 cast.