# Independent caret source-clock verification

## Verdict

**No defect found in the specified clock repair.** Verification completed on
September 13, 2026, at 04:43 UTC: 72 checks passed, with no failed checks. The
supplied seven regression tests also passed. This is a clock and data-integrity
finding, not aesthetic approval or a blind/moving review.

The supported claim is lossless timestamp restoration **relative to the retained
CFR crop**, using agreeing retained frame-start ledgers. It is not a new source
master extraction, a source-quality improvement, or reconstruction of the source
master's original encoding or decode schedule.

**Moving-source credit: 0. Native Resolve credit: 0. Temporal approval: 0.
Source-quality win: none.**

## Independent measurements

- Both ledgers identify the same 22 ordered frames, source interval `[263, 285)`.
  All 22 retained source PTS values agree exactly. The restored local origin is
  zero, corresponding to source PTS **8.775000 s**.
- All 22 remux packet PTS, DTS and durations equal the independently derived
  ledger-relative schedule. All 22 decoded-frame timestamps and durations agree
  too. Transport time base is **1/30000 s**; this does not claim reconstruction of
  the original source container's time base.
- The last included frame is local 21/source 284: source PTS **9.476000 s**, local
  PTS/DTS **21030 ticks = 0.701000 s**, duration **990 ticks = 0.033000 s**.
  Its exclusive end is **22020 ticks = 0.734000 s**, corresponding to source
  **9.509000 s**.
- Independent MP4 box parsing confirms 22 samples and the same `stts` durations:
  eight 1020-tick samples and fourteen 990-tick samples. `mdhd`, `mvhd`, `tkhd`,
  the edit-list duration, ffprobe stream duration and format duration all end at
  **0.734000 s**. The single edit starts at media time zero at rate 1; no empty
  edit, composition-offset table, start shift or final-frame clipping was found.
- The old crop really is CFR: all durations are 1001 ticks, ending at
  **22022/30000 = 0.734066666... s**. The repaired end is shorter by exactly
  **1/15000 s = 66.666... microseconds**, as the retained source clock requires;
  this is not truncation. Maximum frame-start correction is **0.000700 s**.
  The nominal `r_frame_rate` still reads `30000/1001`; packet/sample timing, not
  that nominal field, establishes the restored schedule.
- All **22 compressed packet payloads are byte-identical in order**. Each packet
  was read directly from its MP4 byte offset and size, hashed independently, and
  checked against ffprobe's SHA-256 and `mdat` bounds. Codec extradata also matches.
- Independent rawvideo decoding, streamed through pipes rather than saved frame
  files, confirms **22/22 byte-identical RGB24 frames** and **22/22 byte-identical
  YUV420P frames**. Every decoded frame remains **900 x 280**. Both movies contain
  exactly one H.264 video stream and **no audio stream**. All decoded hashes agree
  with the submitted proof.

## Event mapping

These are the retained guide's event labels, checked against unchanged ordered
frame identities, not newly judged visual semantics.

| Retained event | Local/source frame | Source PTS | Restored local interval |
| --- | --- | --- | --- |
| Initial caret hidden | 0 / 263 | 8.775 s | [0.000, 0.200) s |
| One-frame caret visible | 6 / 269 | 8.975 s | [0.200, 0.234) s |
| Placeholder/plus replacement; caret hidden | 7 / 270 | 9.009 s | [0.234, 0.534) s |
| Returned caret through the final sample | 16 / 279 | 9.309 s | [0.534, 0.734) s |

The one-frame appearance retains its full 34 ms duration. The replacement is not
shifted to a neighboring frame, and the returned caret is not cut short.

## Provenance and limits

- Input hashes match the old crop binding in `native-index.json` and all bindings
  in `clock-restoration.json`. The new movie's hash and byte count match its proof.
  All seven reviewed inputs retained their hashes, sizes and modification times
  throughout verification; no shared input was edited.
- **The exclusive end has one retained authority, not two.** The guide records
  9.509000 s; the index ends with frame 284 at 9.476000 s and contains no next-frame
  PTS or exclusive endpoint. The two-ledger agreement covers all 22 frame starts.
  The guide-derived final duration is restored exactly, but cannot independently
  be remeasured against the unavailable master. This bounds the finding; it is not
  evidence of a defective remux. See `BASE/restore_caret_clock.py:41` and
  `BASE/caret-public/timing.json:24`.
- The repository source-master path recorded by the index is absent. Neither its
  historical hash nor the original crop position can be independently established
  from that missing master. The retained crop geometry and its complete encoded
  and decoded contents are independently verified against the old crop.
- The submitted proof explicitly says `masterReextracted: false`, identifies the
  old movie as native-geometry **CFR**, and says the frozen static reviewers used
  that unchanged-pixel CFR version. It expressly denies temporal, moving-source
  and native Resolve approval (`REPAIR/clock-restoration.json:135`). Nothing in
  this verification upgrades that prior review or validates Remotion/Resolve
  playback. No output candidate or full source film was watched or re-rendered.

## Defect hypotheses checked

| Hypothesis | Counterevidence | Disposition |
| --- | --- | --- |
| Event shifted to the wrong frame | 22 ordered packet and RGB/YUV comparisons; exact frame 6/7/16 clock mapping | Not reproduced |
| Final sample clipped by remux or edit list | Final sample is 990 ticks; all stream/container/edit endpoints are 22020 ticks | Not reproduced |
| CFR timestamps incorrectly retained | Every packet, decoded timestamp and MP4 `stts` entry matches the retained source schedule | Not reproduced |
| Proof overstates master or temporal provenance | Explicit ledger-restored/CFR/static-review limitations; no new master or playback claim | No misleading claim found in the scoped proof |
| New pixels or compressed payloads concealed by proof | Independently compared actual bytes, including codec extradata and both raw pixel formats | Not reproduced |

## Commands and evidence

`verify.py` is an independent standard-library verifier. It does not import or run
the repair helper to calculate expected timestamps, compare payloads or compare
pixels. The supplied unit tests import the helper separately as a supplemental
test. Exact subprocess commands are in `commands.txt`; the principal commands are:

```sh
python3 -B "$REVIEW/verify.py"
ffprobe -v error -show_streams -show_format -show_packets -show_data_hash sha256 -of json "$MOVIE"
ffprobe -v error -select_streams v:0 -show_frames -show_entries frame=pts,pkt_dts,best_effort_timestamp,duration,pkt_duration,pkt_pos,pkt_size,width,height,pix_fmt,pict_type -of json "$MOVIE"
ffmpeg -v error -nostdin -threads 1 -i "$MOVIE" -map 0:v:0 -an -sn -dn -fps_mode passthrough -pix_fmt "$PIXEL_FORMAT" -c:v rawvideo -threads 1 -f rawvideo pipe:1
python3 -B -m unittest discover -s "$BASE" -p test_caret_clock.py -v
```

`MOVIE` was each of the old and new files; `PIXEL_FORMAT` was each of `rgb24` and
`yuv420p`. MP4 boxes and packet bytes were parsed directly by `verify.py`, outside
ffprobe's implementation. FFmpeg/ffprobe version was 9.0.1; Python was 3.14.7.
The verifier refuses to overwrite its existing evidence files.

Artifact labels use no private absolute paths. `BASE` is the repository directory
`benchmarks/motion-atom-loop/expansion-200/checkpoint-100/dual-toolkit`.
`REPAIR` is `RUN/workers/checkpoint100-dual-progress/caret-clock-r01`.
`SOURCE` is the retained `source` directory under the checkpoint-100-03
`gpt54-caret-reset/independent-review-05` evidence; its full run-relative label is
recorded in `input-sha256.txt`.

**Output directory:** `RUN/workers/checkpoint100-dual-caret-clock-critic`.

- `report.md`: this scoped verdict and its limitations.
- `verification.json`: all 72 checks, before/after input bindings and zero-credit record.
- `clock-ledger.tsv`, `event-mapping.json`: every frame boundary and the event mapping.
- `packet-equality.json`, `raw-frame-equality.json`: all packet/RGB/YUV hashes and byte-equality results.
- `old_movie-probe.json`, `new_movie-probe.json`, `old_movie-frames.json`, `new_movie-frames.json`, `container-tables.json`: independent media evidence.
- `commands.txt`, `tests.txt`, `input-sha256.txt`, `verify.py`: executed commands, seven-test result, input identities and verifier.
- `guard-before.json`, `guard-measurement.json`: unchanged canonical guard results before allocation and measurement.

All writes are restricted to this worker's 10,000,000-byte allowance. `TMPDIR`
remained `RUN/tmp`; no temporary files or symlinks were created. After the warning
about another builder's temporary dependency link, a read-only scan found zero
disallowed links (111 allowed Chromium metadata links), and the unchanged
canonical guard passed. Media probes/decodes ran under the existing encoder lock,
opened read-only. No movie was encoded, dependency installed or artifact published.

## Exact reviewed artifact hashes

SHA-256 values below are artifact checksums, not credentials.

| Artifact | SHA-256 |
| --- | --- |
| `REPAIR/reference-source-pts.mp4` (30,838 bytes) | `b817c5b54d6dddb7b1dbb03a7aca3e5c42cc1f497b0a3745972fc45b195ee5ad` |
| `REPAIR/clock-restoration.json` (5,531 bytes) | `604c4a641ddbad7cff1e4a2e12e0cf44d2aa62dcd9febac8b95977f992416d38` |
| `SOURCE/native-window.mp4` | `2de7005918a4a205d104065f635cae7b736767e939a2dd3965f1559ae211f9ca` |
| `SOURCE/native-index.json` | `c701689fac8d6370a9ecb04d0723ea45223271d443133d9a39a15f8d267272c1` |
| `BASE/caret-public/timing.json` | `0f7aa29f49c589cd88c532331460aa0d9fdd4952bc0749181db088cbf3267a3a` |
| `BASE/restore_caret_clock.py` | `11aa51a896f3538e316011c00fe67afb67154a1df897908c57bdcfdb15db950b` |
| `BASE/test_caret_clock.py` | `56b61240d5364ea4391093a36b5e609770141f00be92d1bb0ae9760e20b5b2e3` |