Tours v2 · Implementation plan · September 7, 2026

Keep the feature
the script is talking about.

Bring the crop reviewer into the scene-rendering workflow, with durable raw footage, bounded model calls and a fallback when the framing is uncertain.

First: shadow mode and a small project allowlist.Preserve: paid footage, timing and Resume budgets.Separate: hallucination detection and regeneration.
Proposed scene flowSave raw footage → read scene intent → locate essential subject → crop → check framing → apply or fall back

Status: reviewed implementation proposal. Two independent reviews and rechecks completed; no outstanding P1/P2 plan findings. Updated September 7, 2026. Repository snapshot: 03c75a95. Scope: crop assistance for portrait output only. Landscape mode must not crop. Landscape requirement added after the two reviewer rechecks. This document does not authorize a production deployment or expand the experiment spending budget.

Outcome and evidence

A scene whose narration describes a shower should keep the shower visible as the camera moves. A scene describing windows should preserve a useful view of those windows without requiring every window to fit inside portrait. The model identifies the essential subject; application code chooses and validates a bounded crop path.

The human preferred the proposed crop in the one available A/B comparison, for framing and movement. Two existing compositions were judged adequate even though the experiment rejected their broad subject boxes. Four fresh synthetic scenes repeated twice passed geometric retention checks. Fixture legibility and the prompt changed together, so this does not isolate a prompt improvement. The fractional tail control maintained measurable subject motion through the fade. These are implementation leads, not proof of production accuracy. No real-footage model hallucination review has been validated.

Recommended first release: internal shadow mode, then an explicit project allowlist for applying accepted crop plans. Preserve the existing renderer as a labeled fallback. No automatic video regeneration, general hallucination gate, customer approval screen, or dynamic multi-agent framework in this slice. The earlier 75% hallucination threshold and two-video-candidate repair policy remain separate future work.

Landscape mode is a hard bypass

User requirement, September 7: the upcoming landscape output mode must not crop. Apply this gate before crop-model work, crop evidence extraction, proposal lookup or portrait-asset reuse. The gate uses the resolved output presentation mode, not the provider clip aspect ratio: provider footage is normally landscape even when the requested result is portrait.

For landscape output, preserve the full source frame and use the landscape renderer's timing/encoding path. No crop-review calls, crop budget reservations, crop proposals, virtual-camera crop/pan, or zoom that trims image edges. If source and target aspect ratios differ, fit the full image with padding as needed instead of cover-cropping. Do not route landscape through the existing portrait fallback filter. Tail-duration handling must use the landscape feature's uncropped policy; the portrait motion rules below do not authorize cropping or zooming a landscape ending.

Coordinate with the orientation implementation on the explicit shared field outputOrientation: "portrait" | "landscape". Carry it through the persisted production render job and scene task inputs. The crop implementation consumes the saved job value, not source-photo or provider dimensions, and does not introduce a competing orientation flag. Legacy jobs with the field absent default to portrait; reject explicitly invalid values, including null or unrecognized strings. Enforce this resolver and the landscape bypass in application code before model dispatch or cached crop selection, not just in model prompts. Portrait makes a scene eligible for the normal crop rollout rules; it does not force cropping. Landscape bypass applies even when crop rollout is shadow, the project is allowlisted, or a prior portrait proposal is cached.

Persist requested output mode and target dimensions in output-selection fingerprints and verify them before normalized-asset reuse. A landscape render cannot reuse a portrait scene clip, proposal or joined output. Raw footage may be reused when the generation request remains identical; output orientation alone must not force another provider generation. Resume retains the original resolved presentation mode. An explicit portrait/landscape change is a new presentation operation with a new output identity, not a way to reset an existing review budget. Record skipped_landscape with cropApplied: false, without creating a paid crop-review job.

Current code and the integration seam

Proposed execution

For portrait output only: provider output → durable raw checkpoint → timed landscape evidence → script intent → independent frame localization → deterministic crop → local duration/encoding/motion validation → framing check on finalized portrait → output selection → final-composition validation.

There are two model roles, implemented as fixed calls: intent/localization and a final framing check. The second check sees the portrait output that will be used. It checks whether the intended feature survives cropping, not whether every visual detail is true. Out-of-screen details do not independently fail a crop, but selecting a crop to hide an invented subject is not permitted. Source evidence establishes what can be a focal subject; narration expresses intent and is not proof of existence.

After the landscape bypass, portrait output selection is crop-rollout-mode-specific. off and non-allowlisted runs return the current renderer without crop calls. shadow can save a proposal and its verdict, but always returns the exact current-renderer scene asset for composition. apply_allowlist may select a sufficient proposal only for an eligible project. Store proposalVerdict separately from selectedOutcome and the selected artifact ID. A passing shadow proposal is shadow_sufficient, never applied.

A shadow artifact uses a distinct asset kind scene_crop_proposal and is excluded from normal scene_clip reuse and final composition. Shadow mode must not change selected clip IDs, fingerprints or customer-visible pixels compared with the same current-renderer run. An explicit later apply operation can reuse the exact successful proposal/review without model calls, then create/select an apply-mode output reference. The selection identity records mode, policy and chosen artifact hash. A changed rollout mode alone never reruns a terminal decision on Resume.

Keep provider generation, source acquisition, admission, scene timing, joins, narration and avatars in their existing owners. Models return structured data only, never FFmpeg commands, paths, URLs to fetch, arbitrary tools or unbounded instructions.

Intent and geometry contract

Add cropIntent to the scene batch item with scene ID, exact spoken text, planning asset/hash, requested full clip duration, visible interval excluding transition handles, handle lengths, target dimensions and policy version. Missing or mismatched script means fallback; it must not launch script planning again.

One intent request uses the exact narration and selected source photos. It returns a stable subject description, a source-grounded essential visual region, optional surrounding context, source IDs and specific_object, broad_feature, multiple_essentials or uncertain. A physical object such as a handheld shower is normally an entire object. A broad feature such as windows can be represented by a useful window section. This distinction needs human evaluation before applying it to customer output. Do not mechanically shrink oversized boxes. If two essential features cannot fit together, return cannot_frame in this slice.

Measure each candidate frame independently using the same frozen intent and source references. Return the requested frame ID and timestamp, essential box, optional context box, visibility/occlusion state, source reference and uncertainty reason. Coordinates use normalized top-left x/y/width/height in the timed landscape frame. Source images and candidate frames have explicit after-image labels. Never interpolate model responses or copy source-photo coordinates as candidate coordinates.

Validate with Zod and domain checks: finite values, in-bounds nonempty rectangles, exact requested frame IDs, essential region inside its optional context when present, valid source IDs, consistent intent ID and no missing sampled frames. No confidence percentage overrides a failed check. An uncertain essential region falls back; context may be clipped.

Sampling and bounded calls

Proposed initial operational limits, to verify in shadow mode: one intent call; three independent localization calls at the first, middle and last real-motion frame; additional independent measurements until sample gaps are at most one second, including transition-visible boundaries, with eight localization calls maximum; one portrait framing-check call. Maximum ten model requests per crop identity, including any failed calls. The final portrait request must also fit the complete evidence and token manifest below; an image limit cannot silently reduce coverage. If the required sample schedule exceeds eight localizations, fall back instead of silently dropping evidence. Repeated cloned-tail frames do not require repeated model localization; local motion validation covers that interval.

Every localization call contains exactly one candidate frame. All share the same intent and source selection. Scene children remain parallel in the existing parent batch. Use a dedicated crop model task queue with a proposed global concurrency of six, and local batches of at most two per scene. Inside Trigger tasks use batchTriggerAndWait and inspect every ok result; never Promise.all around Trigger waits. Batch boundaries propagate cancellation and the remaining budget. New crop model children authorize under the existing admitted tour.scene_clip:<sceneId> stage, with the current owning render-run ID, actual child Trigger run ID and attempt. Do not invent a new tour.crop_review stage that existing reservations do not allow. Request slots and cost limits are separate from admission retry ordinals. Saved complete evidence may be reused after the parent checks current continuation; every new dispatch requires current approval and cannot reuse an earlier run's authorization.

Use Gemini 3 Flash Preview through the existing OpenRouter chat adapter, with a pinned provider, structured output via generateText plus Output.object, and maxRetries: 0. Pin and record the resolved model/provider, prompt, schema, decoding options and token ceilings. Schema validation handles shape; our domain validator owns geometry, identity, completeness and the decision table. Do not copy the private experiment's filesystem lock or environment-file loader into production.

Proposed call timeout 20 seconds, parent crop-stage wall-clock deadline 90 seconds including queue waiting, ten dispatches maximum. Deadline expiry chooses fallback and cancels outstanding crop work where supported. Late results may settle their accounting but cannot change the finalized scene decision.

Deterministic crop and extended endings

Use actual probed dimensions and decoded presentation timestamps. Build the same retimed, trimmed, padded landscape timeline as the production normalizer before taking evidence. Hash its timing recipe. Source duration, scene handles and output-frame rounding are part of that recipe. Never crop an already portrait-normalized video.

In this slice, solve a full-height 9:16 window moving horizontally on landscape footage. Other source geometries for a confirmed portrait target use the existing portrait normalizer. Landscape targets always take the separate full-frame bypass. At measured frames the crop must fully include the essential region plus a 2.5% crop-width margin where physically feasible. Prefer a stable crop when one safe interval covers the subject across the clip. Otherwise interpolate a smooth path within safe bounds. Optional context influences centering but cannot exclude the essential region.

A proposed initial real-motion limit is 10% crop width/second and 20% crop width/second squared. These are tuning proposals, not experimentally established thresholds. If keeping the subject requires faster movement or an unverified passage through occlusion, use fallback. Do not clamp the motion and silently lose the subject. Use additional measurements within the eight-frame cap before deciding. No overshooting the image bounds or switching focal objects during localization.

On a cloned tail, start from the prior path's position and velocity and choose a subject-preserving continuation inside its safe interval. Cap speed at 2% crop width/second and acceleration at 4% crop width/second squared. Reserve enough safe travel for the entire extension and fade. Avoid easing to a stop while the cloned image remains visible. Fractional-pixel rendering must preserve movement rather than quantizing several final frames to one crop position. The private perspective-filter prototype is a candidate, subject to worker binary support and timing/cost checks. If no continuous safe motion exists, fall back to the current motion renderer; do not claim the fallback is subject-preserving.

Add a minimum decoded-motion gate as well as maximum geometric speed. Proposed starting threshold: throughout the visible extended tail, total registered translation must reach at least max(2 output pixels, 4 output pixels/second × visible-tail duration), and no decoded stationary interval may exceed 0.25 seconds. Evaluate contrast-normalized image registration inside the essential region against an unfaded rendering control. A frame below 10% of unfaded reference luminance is outside this motion measurement, not evidence that the preceding frame moved. Unreliable registration or insufficient safe travel means fallback. Validate these thresholds on fixed, tiny-positive-travel, no-fade and fade controls at the actual output resolution/FPS/encoder before apply mode. The numbers are proposed tuning values, not established by the earlier experiment.

Keep narration timing, slowdown caps, handle placement and the final visual fade under their existing policies. Complete all local duration correction, encoding and deterministic validation before dispatching the single portrait framing check. A pre-review correction rerenders from raw/timed landscape; reuse localization only if its exact timestamps, frame bytes and intent still match, otherwise use any remaining localization slots or fall back. Never clone an already-finalized portrait frame after motion validation. Any change to the selected scene clip bytes after the portrait check invalidates that verdict and selects fallback in v1; do not reuse stale approval or buy a second semantic review. Test both isolated clips and decoded final composition through the real fade; brightness changes alone do not count as motion.

Final portrait verification contract

The one final request contains the exact spoken text, frozen intent and source references, the final portrait content hash, crop/timing recipe hash, and an explicit portrait-frame manifest. Include every required localization timestamp, plus the first extended-tail frame and last visible rendered frame when present; deduplicate only identical timestamps. Each item carries its frame ID, timestamp and content hash. Source photographs and portrait frames have distinct labels. Evidence packaging must fit the entire manifest under the request's token/image ceiling before reservation and dispatch. If it cannot fit, return fallback without omitting frames.

Return exactly one result per requested portrait frame: frame ID, sufficient, insufficient or uncertain, and a short evidence reason. The response contains no authoritative overall approval. Application code derives acceptance only when all requested frames are sufficient and no reason/finding contradicts sufficiency. Validate IDs, count, source references and the input/output hash binding. This is framing sufficiency at the declared sampled times; local geometry and decoded-motion checks cover their own separate guarantees. It does not prove unseen-frame semantic correctness.

Complete decision table

Condition Action Durable outcome
Landscape output, regardless of crop rollout or cached proposal Full-frame landscape path; no crop work, calls or reservations skipped_landscape, cropApplied: false
Confirmed portrait output with crop feature disabled or unsupported source geometry Existing portrait normalizer, no model work disabled or unsupported
Legacy job omits outputOrientation Resolve to portrait, then normal eligibility/rollout rules Explicit legacy default
Explicitly invalid outputOrientation Reject the job before crop work or asset selection Configuration error
Exact completed crop identity, media readable and hashes match Reuse the recorded applied crop or fallback Reused prior decision, no calls
Missing source/script, ambiguous intent, invalid schema or frame IDs Stop dependent calls, existing normalizer fallback_invalid_evidence
Oversized or conflicting essential regions; excessive movement; insufficient samples Existing normalizer fallback_cannot_frame
Valid geometry and every required portrait frame is sufficient; local checks pass Apply mode selects proposal; shadow retains current output applied or shadow_sufficient
Portrait check says insufficient or uncertain, contradicts findings, or lacks required evidence Existing normalizer; no crop regeneration loop fallback_review
Model error, timeout, exhausted budget, unknown-charge request Stop new dispatches; existing normalizer fallback_service or fallback_budget
Proposed encoding or duration/motion validation fails Render existing path from saved raw; validate that normally fallback_render
Raw source corrupt, raw unavailable, or fallback also fails existing technical validation Existing render failure behavior; preserve available checkpoints Technical failure, not accepted output
Render cancelled or continuation denied Cancel work; no new model calls, fallback upload or provider submit Cancellation/denial, not success

Fallback is a framing decision, not a hallucination acceptance verdict. A fallback never marks this clip as model-approved. Conflicting final-review fields resolve to fallback. There is no borderline confidence band or additional semantic retry to implement in v1.

Persistence, Resume and cost

Create reusable raw asset kind scene_provider_clip and non-composition proposal kind scene_crop_proposal in the render-asset type and database kind constraint. Store app-owned raw bytes, SHA-256, provider job ID, actual generation request fingerprint and model/provider metadata before review or spatial normalization. Add storage/retention handling and run-asset usage for both kinds, including shadow proposals and active review references. Never keep an expiring provider URL or authorization headers as the checkpoint. Validate authorization and content on every reuse.

Separate three identities. Generation identity describes the actual visual request, source content hashes, source selection/order, provider/model, prompt and provider duration bucket. It excludes narration or crop choices unless those altered the provider request. Review identity includes the exact raw candidate hash, all source content hashes and selection/order, exact spoken script, stable intent, planning provenance, sampled frames/timestamps and hashes, timing recipe, model/provider/decoding settings, schema/prompt/policy and frame budget. Crop-output identity includes raw candidate hash, review decision and result hash, full numeric path, output settings, normalizer/renderer versions, duration, handles and fade policy. Signed URL refreshes must not invalidate byte-identical evidence.

Use a small durable tour_scene_crop_reviews record per project + candidate + base review-input identity, with immutable input manifest, frozen intent/results, request slots, reservations, actual/unknown spend, terminal decision, crop recipe and artifact IDs. An atomic repository/RPC claim reserves each numbered request slot before dispatch; a unique key and lease token prevent duplicate owners from making paid calls. Intent and per-frame request hashes extend the base identity as outputs become known. Do not make the initial lookup depend on an intent result that has not been generated yet.

Persist a crop generation lineage ID and the resolved output-presentation mode/target dimensions and crop-rollout mode/model/policy/limit snapshot through the actual production job contract. Update contracts/render-job.ts (TourRenderProductionDecisions, pickTourRenderProductionDecisions, persisted-job decoding and resolveTourRenderPipelineOptions), the initial/Resume creation service and admission persistence. A field added only to in-memory options is insufficient because the current serializer copies an explicit allowlist.

Bind Resume to a specific authorized failed/cancelled predecessor run in the same project/user. Resolve that predecessor server-side under the creation lock and persist its ID, rather than taking a caller-supplied lineage or choosing a new default on each retry. The existing service's allowable Resume states remain authoritative; do not expand eligibility. Resume inherits the predecessor's crop configuration, lineage and budgets. Legacy predecessor jobs without crop state resume with crop off and existing legacy reuse. Tests must round-trip these fields through creation, admission, persistence and worker decoding, including concurrent/repeated Resume and a deployment-default change. A new explicit render gets a new lineage; unchanged Resume inputs cannot reset the limits. Changing script invalidates the review but reuses the raw clip when its actual visual request is unchanged. The lineage budget still spans the replacement review. Fresh generation when reuse is explicitly disabled retains today's user intent. No global renderer-version bump should force paid regeneration of otherwise reusable old clips.

Proposed launch ceilings: $0.25 per scene crop lineage and $3 per tour crop lineage, with an explicit deployment configuration limit as well. These are product limits, not spend authorization. Bound each request to 16,000 billed input tokens and 1,024 output tokens, using a documented conservative image-token estimator plus provider price ceilings of $1/M input and $5/M output. Reserve at least $0.02112 per call before sending. If the chosen model/adapter cannot enforce and account for those ceilings, do not enable paid shadow work. Charge known usage; retain the reservation for unknown outcomes and stop new requests in that lineage until reconciled. Ten calls fit under the proposed scene cap. Ledger enforcement must be transactional across concurrently running scenes.

Trigger keys use a global, environment-scoped key containing tenant/project, candidate/base review hash and request slot, with 30-day TTL. Database state remains authoritative after TTL or Resume; Trigger idempotency is not a permanent budget ledger. Model tasks have one attempt; network failures consume their slot, with no automatic paid retries. A crash after dispatch but before saving the response leaves that slot unresolved and falls back without redispatch. Local deterministic rendering may retry from saved raw media without model calls. Persist fallback decisions so Resume does not keep buying reviews for an exhausted identity.

Existing pre-checkpoint video-submission/import crash ambiguity is not solved by this slice. The guarantee starts once raw bytes are durably checkpointed: crop errors cannot invoke video generation again. Legacy normalized clips remain reusable under their existing identity when no raw checkpoint exists; label them legacy_unreviewed. Do not regenerate legacy footage merely to obtain a crop candidate.

Implementation sequence and file map

  1. Contract and behavior tests, starting with the canonical output-mode boundary supplied by the landscape feature. Add scenes/crop-review/contracts.ts, policy.ts, identity.ts and crop-path.ts. Pass the exact script from generation orchestration into SceneClipBatchItem. Encode the landscape hard bypass, orientation-safe asset reuse, decision table, broad-subject representation, sample schedule and bounded tail path. Exit: deterministic contract/path tests and frozen experiment fixtures pass, including unresolved cases.
  2. Raw checkpoint and durable accounting, including contracts/render-job.ts compatibility and initial/Resume creation/admission persistence. Refactor scene-clip-media.ts to expose acquisition and timed normalization separately. Add repository methods, raw/proposal asset kinds and one focused migration for review state, atomic slot/lineage reservations and permissions. Extend storage and retention handling. Exit: Resume and concurrent-claim tests prove crop retries cannot re-buy raw generation or exceed reservations. Apply and test the migration locally; do not reset the database without permission.
  3. Model adapter and Trigger seam. Add crop-review/model.ts, evidence.ts, controller.ts and triggers/review-tour-scene-crop.ts. Inject a crop runner into scene rendering so unit/workbench execution does not dispatch Trigger. The existing scene task supplies the Trigger adapter; each model child verifies the existing admitted scene stage and current run ownership before dispatch. Preserve avatar admission. Exit: production adapter mocked tests, actual SDK schema contract tests, and worker staging tests pass without a full paid render.
  4. Rendering, reuse and observability. Extend the normalizer/filter input with a validated numeric crop recipe; separate generation and presentation reuse in scene-clips.ts/scene-clip-fingerprint.ts. Update post-normalization duration repair, final-composition validation and artifact provenance. Add configuration off, shadow, apply_allowlist, snapshotted into the render options. Exit: mode/cancellation/legacy-cache tests and decoded FFmpeg tests pass; current path remains the default.
  5. Shadow and canary. Freeze a revised broad-subject prompt before new labels. Run copied real clips through the production adapter with upstream generation mocked/cached. Evaluate at least 20 new scenes across five properties, with specific objects, broad features, off-center motion, occlusion and extended tails. Obtain simple blind human crop/motion judgments without box drawing. Then deploy shadow mode and a small allowlist only after the gates below. No automatic public rollout.

Production modules may use the experiment's ideas and fixtures, but must not import .private code or private absolute paths. Keep new modules focused. Any oversized existing file encountered during implementation should receive a separate cleanliness note, not an unrelated rewrite.

Verification and rollout gates

Unit/repository cases: script/source-content/order/candidate/policy changes invalidate only the appropriate identity; supporting-photo URL renewal does not; source IDs and hashes cannot cross tenants; duplicate workers and Resume share counters; unknown costs remain reserved; cancelled work does not fall through to upload; a late result cannot overwrite fallback; legacy assets do not cause fresh generation; an absent outputOrientation resolves to portrait while explicit null/invalid strings reject; invalid/borderline/conflicting responses follow the table exactly; shadow never selects its proposal for composition; off/shadow/apply transitions cannot mix selection fingerprints; persisted crop decisions survive current defaults changing; admission rejects the wrong scene/project or stale Resume binding; portrait evidence omission and post-review mutation cannot retain approval; landscape in off/shadow/apply modes makes zero crop calls/reservations even with a cached portrait crop, bypasses intent/localization/proposals/portrait framing review/portrait fallback, records skipped_landscape plus cropApplied false and cannot select portrait assets; raw landscape media still triggers crop work for a portrait target; Resume round-trips output mode; explicit orientation changes reuse only compatible raw footage.

Decoded-media cases: left/right subject; broad windows versus whole-wall box; multiple essential features; deliberate model/source coordinate mismatch; occluded subject; source shorter than requested; tail begins while the crop is already moving; zero safe travel; tiny positive travel that encodes stationary; durations near frame rounding; non-portrait target; portrait source; final handle/fade interaction; duration repair after crop; source and output aspect correctness. Compare geometry and visible edge displacement against fixed and existing-pan controls. Test no last-frame cloning after successful motion validation. For landscape output, verify all four source edges remain visible, differing aspect ratios use fit/padding, no crop or edge-trimming zoom appears in the filtergraph, and final composition/Resume cannot substitute a cached portrait output.

Predeclared canary gates: no technical duration/decode failures introduced; no duplicate review or generation calls in crash/Resume tests; all applied crops satisfy deterministic geometry/motion checks; no human-labeled loss of an essential feature among canary-applied scenes; proposed crop at least ties the current crop in 90% of judged A/B cases and wins at least 60% of pre-labeled off-center opportunities. Report abstention/fallback rate over every eligible scene and human motion uncertainty separately. At least 70% of the sampled eligible scenes must produce a proposal, or revise the policy rather than report only its successful minority. These are launch criteria, not measured outcomes.

Measure p50/p95 added latency, actual dollars per scene/tour, fallback reasons, proposal coverage and human preference by property and scene type. Proposed p95 budget is 90 seconds for the crop stage; more than 5% deadline fallbacks pauses expansion. Twenty scenes can justify only an internal canary, not calibrated production accuracy. Do not claim source-truth verification, off-screen hallucination handling, or regeneration efficacy from crop results.

Rollback disables new model work and returns portrait runs to the existing spatial renderer while landscape runs retain the full-frame path, without deleting raw checkpoints or accepted artifacts. In-flight runs retain their recorded mode but check an emergency stop before paid calls; the stop finalizes fallback. Resume reuses its terminal crop decision. A requested reframe or fresh render is an explicit new operation, not an endless Resume loop.

Decisions and review record

Recommended decisions: bypass all crop work for landscape output; use the existing AI SDK; Trigger provides fixed durable orchestration; select a script-specific essential region; permit optional context to be clipped; one final framing check; no semantic repair loop; preserve paid raw media; persist all request limits across Resume; fallback rather than fail an otherwise usable tour for crop-review uncertainty.

The precise model route, token/image ceilings, timing limits and acceptance thresholds must be validated during shadow rollout. Product rollout spend limits are proposed and require deployment configuration; the earlier $20 authorization covers experiments only. Implementation can proceed with mocked providers and cached media while these are verified.

Two independent subagents reviewed the initial draft against the checkout and experiment evidence. Both reported no P1 or architectural blocker. Five P2 clarifications were incorporated:

Review Finding Resolution
Integration Crop lineage/mode would be dropped by persisted job narrowing Explicit serializer/decoder changes, authorized Resume predecessor and legacy compatibility tests
Integration Successful shadow proposal could be selected as normal output Separate proposal asset/verdict from mode-specific selected clip, with composition/reuse tests
Integration New child stage could be denied by frozen admission Reuse admitted scene stage with current run binding and separate crop ledger
Visual behavior Single final review lacked exact evidence and could approve pre-repair bytes Full portrait manifest and per-frame results; review after local corrections; changed bytes fall back
Visual behavior Tiny fractional motion could still encode a frozen tail Minimum decoded travel and maximum hold criterion, with tiny-travel and fade controls

Both reviewers rechecked the revisions and reported their P2 findings resolved, with no new P1/P2 findings. The visual reviewer also requested that the overview place local validation before the portrait check; that editorial correction is included. The initial draft, detailed reviews and rechecks are preserved locally. These reviews assess the plan only; implementation and production verification remain necessary. The user subsequently specified that landscape mode must not crop. That requirement is now a hard bypass with explicit persistence, reuse and validation rules; it was added after those rechecks.

Sources