## Verification scope after the encoded-frame repair

The current checker compares **every decoded encoded frame**, not only PNG
sidecars and the final frame. It checks actual frame PTS, frame count, codec,
dimensions, cadence, silence and (by default) all four BT.709 metadata fields.
Its expected frames come from `frame_at` at each presentation time, including
extended holds. The tolerance is mean RGB error below 4/255 and every 64×64 tile
below 18/255. This allows lossy encoding; it is not a universal perceptual test.

Bounded verification is explicit:

```bash
python verify.py --renders renders --only interaction-to-result --report check.json
python verify.py --renders extended --only context-detail --report extended-check.json
```

Without `--only`, every declared recipe and sequence must exist. Every invocation
replaces its report with a fresh running/passed/failed status and input/output
hashes. An invalid selection cannot leave an old successful report looking fresh.

The bounded repair tests retain the unchanged 6 s context study and 18 s
interaction sequence. They pass all-frame content checks under the explicitly
named `--profile legacy-study`. That profile is **not a delivery-profile pass**:
those historical files lack encoded primaries/transfer tags. The repaired
encoder writes H.264 bitstream metadata as well as requesting encoder tags; its
new 6 s study passes the strict default profile. A blacked-out encoded middle
second, a wrong middle prompt region, an invalid join and movement in a protected
quiet hold all fail even when correct sidecars/final frames are retained.

Run continuous normal-speed playback and a meeting-size reading check separately.
The extended Remotion project also supplies actual-capture packet, approval,
encoded-file and playback checks; see its `PRODUCTION_PACKET.md`.

## Historical verification record

**Historical September 5, 2026 record, before the repair.** Its original table
describes the checks then run, not the stronger verifier's coverage. In
particular, “BT.709 tags” checked only matrix/range and “decoded frames” meant
the final frame. The audit demonstrated a false acceptance in that predicate.
Retain this history without treating it as a current all-frame or delivery pass.

| Check | Result |
| --- | --- |
| Data and provenance | 12 recipe IDs, 19 evidence records and three sequences validate; references resolve against retained source datasets and checksums. 6 deliberately malformed records are rejected, including invalid parameter units/types. |
| Original renders | 15 H.264 MP4s decode with exact frame counts, declared durations, BT.709 tags and no audio streams. Final decoded frames remain within the stated RGB-error threshold. |
| Reproduction | The three sequences render from the public ZIP in an otherwise empty directory, with no research corpus or application code. All 20 RGB checkpoints and PNG files match. MP4 hashes also match in this pinned environment. |
| Choreography | 16 checks include quiet holds, exact continuous segment joins, retained opaque object pixels, request/submit/result order, text fit and overflow rejection. Too-short durations fail; extra time extends the last hold. |
| Browser | 24 page/width/theme combinations; all 12 recipe players; full 1× playback of all three sequences; half-speed, checkpoints, keyboard scrubbing, no-JavaScript details and reduced-motion/no-autoplay pass. No page or local HTTP errors. |
| Source playback | Nine existing official-channel excerpts play to completion at 1× with decoded-video callbacks and saved playback screenshots. New source inspection is limited to the documented windows. |
| Existing library | All 100 film routes remain; 100 source motion clips, opening/logo/lower-third media and internal references pass the retained static suite. Bounded browser regression checks 16 layouts, three film routes, three source players, six lab experiments and three complete clip playbacks. |
| Preservation | 2,807 existing files are byte-identical, including 2,793 media/data/font files. 112 existing HTML pages change for navigation. No files are removed. The integration baseline includes the concurrent lower-third/font updates. |
| Publication boundary | Public text and structured data are scanned; archive members are allowlisted and scanned after opening the ZIP. The full prose scan requires no redactions. No internal code, catalogs, recordings, full source movies or raw downloader metadata are included. |
| Readability | The original title/interface, result and ending are visually checked at 640 × 360. The result's eight essential words remain readable; this is a fixture check, not a universal reading-speed guarantee. |

Open a sequence's checkpoint images for composition evidence and its `render.json` for frame indices, RGB hashes, input/font checksums and settings. The linked JSON holds the machine-readable results. `comparison.md` explains the decisions against the references rather than claiming a pixel match to a source film.

The shared preview host explicitly reported itself unavailable. Browser verification therefore used local Chromium through the existing Playwright environment. No alternate publishing path was used.

**Still required for production:** authentic product behavior, actual recorded speech and pauses, rehearsed manual offset, a genuine ending tail, approved export settings, an audience reading check and the consolidated storyboard review. The research does not pass those gates.