ffmpeg-skill 2.17.4 → 2.19.0

package/README.md

@@ -393,12 +393,12 @@ The short list for humans. The agent-facing version, with the reasoning, is the
 - **Phrase-aware caption breaking (1.16).** `caption.py`/`graphics.py --wrap phrase` (the default) never breaks inside a word or on the wrong side of a hyphen, never leaves a lone digit, kana or punctuation pair on a line, prefers Japanese sentence ends and particles over a mid-word break, and never ends a line on an article or preposition. All four are penalties over break positions that already fit, so no line is widened and the line count never changes; `--wrap measured` restores 1.15's width-only wrap. The text itself is never rewritten or shortened. Since 1.16.1 a Thai run and a katakana word are never broken inside (Thai writes no space inside a phrase and there is no dictionary: the break goes where you put a space or `|`), and a line wider than the safe width is reported as `overlong` with the fix named.
 - **Caption size fitted to the cue (1.17, reachable from the templates since 1.17.1).** At a platform caption size a line holds about six em, so an ordinary sentence needs four lines and `--max-lines 2` used to cut it into consecutive cues — half the sentence arriving late. `caption.py --fit-size` (default `auto`) walks the size down until every cue fits, *before* laying the cues out, with a legibility floor of 4.5 % of the frame height (`--min-size`, default 13 ASS units). An explicit `--size` or a `brand.json` size is a statement about the look and is never overridden — which in 1.17.0 also silenced the fitter on every `render.py --template` run, since a template fills the size from the platform table; 1.17.1 marks that size as the default it is (`"fit_size": "on"` in the filled project), so the type shrinks and no cue is split. `--fit-size off` restores that earlier behaviour byte for byte, and the caption text is still never rewritten to make it fit.
 - **Beat-synced cuts (1.17).** `scenes.py --beats` reports the measured grid — tempo, beat times, and a confidence built from how far the winning autocorrelation lag stands above the others and how many onsets land on it. `cut.py --snap beats` (and a `"snap"` block in a `render.py` project) moves in/out points to the nearest beat within `--snap-tolerance` — and only onto the grid points a measured onset actually marks, never onto the regular grid's continuation through a passage with no music in it. Below `--min-confidence` it **refuses**: a cut point may move to a measured beat and may not appear from one, so speech and ambience get an honest "no steady pulse here" instead of an invented grid.
-- **Filler words (1.17).** `silence.py --filler --words transcript.json` removes "um" and "uh" through the same cut graph the silences use. Never without measured word timings — there is no heuristic that finds an "um" without them that would not also cut real speech — and `like`, `tipo` and `cioè` are deliberately not in the built-in lists, because a discourse marker is a content word. Whisper stays optional: `--transcribe` with no engine installed refuses and names the five installs.
+- **Filler words (1.17).** `silence.py --filler --words transcript.json` removes "um" and "uh" through the same cut graph the silences use. Never without measured word timings — there is no heuristic that finds an "um" without them that would not also cut real speech — and `like`, `tipo` and `cioè` are deliberately not in the built-in lists, because a discourse marker is a content word. Built-in lists since 2.19: English, Japanese, Korean, Chinese, Spanish, German, French, Portuguese, Italian, Dutch, Polish, Russian and Turkish; any other language takes `--filler-words FILE`. Whisper stays optional: `--transcribe` with no engine installed refuses and names the five installs.
 - **Throughput (1.17).** `batch.py --jobs N` runs several files at once, capped at `min(N, cpu_count, 8)` and sharing one `--timeout` budget rather than one per item; the per-item table keeps its order. `render.py --cache DIR` reuses stages whose inputs and arguments did not change, so swapping an export preset re-runs export only. The cache is opt-in with no default directory, and the ffmpeg, skill and contract versions are part of every key, so a cache is never reused across them.
 - **Audiogram (1.16).** `waveform.py --image cover.png` (or `render.py --template audiogram`) puts the waveform over a still plate for an episode that has no picture, with `--platform` for the frame, `--title` and burnt-in captions. The image is a local file you give: nothing is fetched and no cover art is ever invented.
 - **Emoji in captions and titles (1.15).** `caption.py`/`graphics.py --emoji-assets DIR` composites a PNG per emoji (Twemoji/Noto naming, `1f389.png`) on top of the text, because drawtext cannot load a colour emoji font at all and an installed one does not prove libass will draw it in colour — `doctor --json`'s `fonts.emoji` answers that from a render probe. Without assets the run still succeeds and reports `mode: mono`. Nothing is ever downloaded.
 - **Indic and Thai text shaped correctly in titles and lower-thirds (1.15).** `graphics.py` renders Devanagari, Bengali, Tamil, Thai and Lao through libass automatically (`text_renderer: "ass"`), because drawtext never reorders matras or re-clusters marks; Arabic and Hebrew were already correct on a fribidi build. `--text-render drawtext` with such a script is refused, never rendered wrongly.
-- **Non-Latin text picks a font by script (1.12).** Japanese, Chinese, Korean, Arabic, Hebrew, Devanagari, Thai, Cyrillic and Greek cues, titles and overlays resolve a font file that covers them automatically, and a machine with no such font fails the job (`kind: input`) instead of rendering boxes. `doctor --json`'s `fonts.scripts` says which languages this machine can render; `--lang ja|ko` disambiguates Han-only text; an explicit `--font`/`--font-file` is always kept.
+- **Non-Latin text picks a font by script (1.12).** Japanese, Chinese, Korean, Arabic, Hebrew, Devanagari, Thai, Cyrillic and Greek cues, titles and overlays resolve a font file that covers them automatically, and a machine with no such font fails the job (`kind: input`) instead of rendering boxes. `doctor --json`'s `fonts.scripts` says which languages this machine can render; `--lang ja|ko` disambiguates Han-only text, and `--lang zh-TW` (or `zh-HK`, `zh-Hant`) picks a Traditional Chinese face (2.19); an explicit `--font`/`--font-file` is always kept.
 - **Silence detection finds nothing?** The default threshold is −35 dBFS. The tool prints a hint with the track's measured level; raise the threshold (`silence.py --threshold -25`) or shorten `--min-silence`.
 - **Sync results carry a confidence.** Below 0.3, or an offset near the edge of the analysis window, is probably wrong: enlarge `--analyze-seconds` or find a clap. Recordings over ten minutes from separate devices need `sync.py --fix-drift`.
 - **Outputs are never overwritten silently.** An existing output path is refused (`kind: input`, `error.reason: output_exists`, before anything runs); pass `--overwrite` where a replacement is intended.

package/SKILL.md

@@ -34,7 +34,7 @@ Ask a short question only when the answer changes the output materially and the
 - **Duration** ("make it 60 s") without a method: speed up for ≤1.5× changes, trim otherwise, say which. Ask when the content is a talk (trimming loses words) and the change is large.
 - **Captions** without a text source: `--transcribe` if a local engine exists, else ask for the text or a timed file; never invent dialogue.
 - **Fonts and brand**: if the user mentions a brand, colours or "our font", ask for or create `brand.json` once, reuse it.
-- **CJK / non-Latin text**: let the tool pick the font by script (`--font` turns it off); `--lang ja|ko` for Han-only text. `doctor --json` `.fonts.scripts` says what renders here. Tofu is a failed job.
+- **CJK / non-Latin text**: let the tool pick the font by script (`--font` turns it off); `--lang ja|ko|zh-TW` for Han-only text. `doctor --json` `.fonts.scripts` says what renders here. Tofu is a failed job.
 - **Crop position** for `--fit crop`: centre by default, but when the request or the source names an off-centre subject ("keep the product on the right", someone visibly off-centre in the sheet) use `--crop-x`/`--crop-y` (0=left/top, 1=right/bottom) instead of guessing centre, or ask which edge to keep.
 - Anything else (transition type, caption style): pick the conventional default, say what you picked, offer the alternative in one line.
 
@@ -150,7 +150,6 @@ Timestamp flags (`--start`, `--end`, `--at`, `--from`, `--duration`, `--offset`,
 | "where does the subject move, so I can crop it myself" | `cropdetect.py input.mp4 --motion-centre` — motion centroid per second, report-only; the calling agent picks the crop |
 | "does it look like Log / S-Log?" | `probe.py clip.mp4 --analyze` (`looks_like_log`) then `color.py --lut` |
 | "test the tool on my real files" | `verify.py ~/Footage --report verify.md` |
-| "show me progress", "quick preview first" | any encoding script with `--progress` and/or `--fast` |
 | "it's a phone video with variable frame rate" | nothing extra: re-encodes conform VFR to constant fps; `fit.py --fps 30` picks the rate |
 
 ## Audio-only files
@@ -181,7 +180,7 @@ Look: final_sheet.png（字幕はセーフエリア内、ロゴは右上）
 Notes: 元は VFR だったので 30 fps に揃えた。音声はモノラルだったのでステレオにした
 ```
 
-Keep it to those five lines plus anything the user must decide. Never describe a fix you did not run.
+Keep it to those five lines plus anything the user must decide. Never describe a fix you did not run. `verified` covers only what was measured: in `Notes:` name any `unverified` item the user would assume checked. Report a step with `attribution: unresolved`; do not re-run it.
 
 When a step fails, replace `Done:` with `Failed:` and keep the rest honest:
 
@@ -196,9 +195,7 @@ Notes: send a valid .cube, or say if you want the clip left as is
 Those filler lines are sentences, not labels: the same report for a Japanese request ends
 `Check: 検証するものなし` / `Look: 不要`.
 
-A refusal uses the same shape: `Failed:` names what was refused and why, `Steps:` lists what did run, `Look: not needed`. A partial result is `Done:` with the shortfall in `Notes:`; a refusal that still delivers something is `Failed:` — never a third label like `Done (partially):`. Quote a failure's `error.hint` in `Notes:`.
-
-A failure's `--json` is `status: failed` plus `error.kind` and `error.message`; quote the message, never paraphrase it.
+A refusal uses the same shape: `Failed:` names what was refused and why, `Steps:` lists what did run, `Look: not needed`. A partial result is `Done:` with the shortfall in `Notes:`; a refusal that still delivers something is `Failed:` — never a third label like `Done (partially):`. A failure's `--json` is `status: failed` plus `error.kind`, `error.message` and `error.hint`: quote the message in `Failed:`, never paraphrase it, and the hint in `Notes:`.
 
 ## Things that look right but are wrong
 

package/docs/contract.md

@@ -21,7 +21,7 @@ The contract is derived from the code that runs, not maintained beside it:
 | Field | Meaning | Changes when |
 |---|---|---|
 | `contract_version` | shape of this document (`1.0`) | a key is renamed, removed or changes meaning |
-| `skill.version` | the npm / package.json version (`2.17.4`) | any release |
+| `skill.version` | the npm / package.json version (`2.19.0`) | any release |
 
 A release that adds a tool or a flag keeps `contract_version`; a breaking change to the
 ToolSpec shape bumps it. Consumers pin on `contract_version` and read `skill.version`
@@ -131,7 +131,7 @@ JSON would have been rewritten for that. The flat keys, typed per tool in `outpu
   "deprecated": [{"what": "running on Python 3.9 (the requirements.python floor)", "since": "2.10.9", "replacement": "Python 3.10 or later; ...", "removed_in": "3.0.0", "where": "behaviour"},
                  {"what": "running on FFmpeg 5.x (the requirements.ffmpeg floor)", "since": "2.14.0", "replacement": "FFmpeg 6.1 or later; ...", "removed_in": "3.0.0", "where": "behaviour"}],
   "removed": [{"what": "...", "since": "1.10.0", "replacement": "...", "removed_in": "2.0.0", "where": "cli | json | mcp | behaviour"}],
-  "skill": {"id": "ffmpeg-skill", "version": "2.17.4", "execution_mode": "local", "kind": "execution",
+  "skill": {"id": "ffmpeg-skill", "version": "2.19.0", "execution_mode": "local", "kind": "execution",
             "entrypoints": {"cli": "...", "mcp": "...", "contract": "...", "doctor": "..."},
             "not_provided": ["AI reasoning", "decisions", "production plans", "project IR", "approvals", "network access", "transcription engine"]},
   "requirements": {"python": ">=3.9 (standard library only; 3.9 deprecated since 2.10.9, removed in 3.0.0; 3.10+ recommended)", "ffmpeg": ">=5.0 (5.x deprecated since 2.14.0, removed in 3.0.0; 6.1+ recommended)", "ffprobe": ">=5.0"},
@@ -169,6 +169,7 @@ One entry per tool under `tools`, sorted by id. Tool ids are stable:
 | `produces_artifact` | writes a file (media, PNG, HTML, EDL) |
 | `verification` | `{required, tools}`: which tools to run on the output afterwards |
 | `requires_visual_verification` | the picture changed; run `ffmpeg-skill/look` and inspect the PNG |
+| `unverified_properties` | 2.18: the output properties this tool does not measure, the same list its results carry as `unverified` (empty when the tool names none) |
 | `reencodes_video`, `reencodes_audio` | `"always"` / `"never"` / `"conditional"`, meaning *when that stream is present in the input* — not whether the tool touches the file at all. `"conditional"` tools (`cut`, `export`, `render`, `batch`, `verify`, `caption`, `color`) carry a `reencode_note` explaining what it depends on — for `caption`, `--mode burn` (default) always re-encodes both streams, `--mode mux` copies both untouched; for `color`, `--strip-dovi` and `--retag` are a stream copy of both (retag only re-encodes if the copy attempt fails or ffprobe still reads the old tags on the copy), while `--to-sdr` / `--lut` / `--correct` always re-encode both. Several visual tools (`fit`, `overlay`, `graphics`, `join`, `multicam`, `silence`) are `"always"` on audio too: this codebase never mixes `-c:v` re-encode with `-c:a copy` in one call, so a caller cannot assume the original audio codec survives just because only the picture changed |
 | `audio_only` | accepts an audio-only input (WAV, MP3, M4A, FLAC, OGG, Opus) |
 | `video_required` | refuses an input without a video stream ("input has no video stream") |
@@ -685,6 +686,19 @@ Per-tool keys added after 2.2.2, all additive:
 | `vfr_check` | `cut.py` (a video input that could still stream-copy) | the sampled frame timing, `{heuristic: true, measured, method: "sampled", guard, windows, deltas}`; `measured` is `sampled_cfr`, `vfr` or `inconclusive`. `--vfr-guard average` (the default) keeps the 2.x guard: a source whose nominal and average frame rates differ (`variable_frame_rate_suspected`) re-encodes as `--accurate` (reason `vfr`, stderr says "variable-frame-rate"), and only then is the timing sampled and reported, with a `notes` line naming `--vfr-guard sampled` when it measured `sampled_cfr`; the key is absent otherwise. `--vfr-guard sampled` samples before every copy and re-encodes on `vfr` (reason `vfr`) or `inconclusive` (fewer than 20 intervals; `vfr_inconclusive`); `--vfr-guard off` samples and keeps the copy, with a `notes` line. Absent for audio-only input or output, `--accurate`, `--codec` and a pending `--dry-run` input |
 | `join_check`, `segment_end_snap_seconds` | `cut.py --segments` | `join_check`: a video stream-copy join measured by demuxing, `{packets, expected_packets, max_step_seconds, audio_offset_ms, audio_parts_checked, ok}`. `expected_packets` counts the source's video packets from each part's start keyframe to its end (or the end of the video); `max_step_seconds` is the largest presentation step, `null` when `vfr_check` measured anything but `sampled_cfr` (a `--vfr-guard off` join of variable timing: count only), and each step at a join must be the step its parts predict within 1 ms. `audio_offset_ms`: per part, its sound's shift minus its picture's in ms (+ = sound late), from audio packets matched by CRC32 to the source stream shaped like the joined audio (FFmpeg's default selection may copy one other than `a:0`; an MPEG-TS source's AAC is hashed without its ADTS headers); `null` for a part with no unique match (digital silence, a periodic tone), and as a whole when the source has no audio or the video check failed. `audio_parts_checked` counts the measured parts. `ok` is the conjunction (count, steps, every measured part within 5 ms); `ok: false` means the join was re-cut (`concat_fallback`) and this is the failed measurement. `null` for a single segment, audio, `--dry-run`, any re-encode forced for every segment, a segment that re-encoded, or a join re-cut before a copy was tried (open GOPs, a later B-frame segment starting between keyframes, parts that differ, a concat error). `segment_end_snap_seconds`: per segment, the signed seconds its end moved to the keyframe the copied part stops at, the first at or after the requested end (`null` for a part that reaches the end of the video, a part of a source with no B-frames, cut to its requested end as in 2.5.1, or a Matroska/MPEG-TS part, which is not snapped); `null` as a whole unless the output is those copied parts |
 
+Keys added in 2.18, all additive. They make a result carry what the VDC paper
+(Verification-Driven Coding) calls the co-reported items: what was measured against what, how far,
+from where the expected value came, and what was not measured.
+
+| key | tool | what it holds |
+|---|---|---|
+| `verification[].property`, `expected`, `measured`, `delta`, `tolerance`, `provenance` | steps that measure a property (join's `duration`, loudness's `loudness`, export's `loudness`, every `streams` step) | the property measured, its expected and measured values, their difference, the tolerance applied, and where the expected value came from: `specification` (the platform table), `user_specified` (a flag), `independent_measurement`, or `input_premeasurement` (the input's own probe) |
+| `verification[]` step `streams` | `cut.py`, `join.py`, `export.py` | the output's video/audio streams against the ones the input had and the operation was not told to drop (an audio extension drops the picture, a GIF the sound). A missing stream is `ok: false` with `missing`, so the result is `verified: false` (#367: a TS cut that lost its video) |
+| `verification[].attribution` | any step with `ok: false` | `unresolved` until a tool knows whether the artifact, the reference, the measuring instrument or the expected value's provenance is at fault. A caller does not re-run on an unresolved failure: a re-run can hide which one it was |
+| `unverified` | every writing tool `UNVERIFIED` names (`_common/emit.py`) | the output's properties this tool did not measure, e.g. `caption`'s `rendered_placement`, `sync`'s `lip_sync`. `verified` is about the measured properties only; a report that passes the verdict on must pass this list with it. The contract carries the same list per tool as `unverified_properties` |
+| `audio_substituted` | `join.py` (video join) | the clips that had no audio stream, whose span of the join is generated silence; `notes` says the same |
+| loudness `tolerance.tp` | `loudness.py`, `export.py`, and `check.py`'s true-peak row | the one dBTP margin every tool applies (`_platforms.TP_TOLERANCE_DB`, 0.1 dB); before 2.18 it was 0.1, 0.05 and 0.0 in the three tools |
+
 Per-tool keys added after 2.10.11 ("nothing happens silently"), all additive:
 
 | key | tool | what it holds |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ffmpeg-skill",
-  "version": "2.17.4",
+  "version": "2.19.0",
   "description": "Agent Skill that gives coding agents (Claude Code, Cursor, Codex) a local video editor: 42 FFmpeg tools with a machine-readable contract, contract-derived MCP server, FFmpeg capability detection, probe-first / verify-last workflow. Cut, join, silence removal, fit, captions and karaoke, overlays, motion graphics, HDR to SDR, LUTs, audio clean-up and typed dynamics, sync with drift correction, multicam, loudness, delivery checks, project rendering, batch. No API keys, no cloud, no dependencies.",
   "keywords": [
     "ffmpeg",

package/references/scripts.md

@@ -578,7 +578,7 @@ each shorter clip's last frame (with silence) out to the longest.
 ### silence.py — remove dead air / jump cuts
 ```
 silence.py INPUT [--threshold -35] [--min-silence 0.6] [--margin 0.15] [--min-keep 0.2] [--list] [--edl keep.txt] [--speech-aware] [-o OUT]
-silence.py INPUT --filler --words transcript.json [--filler-lang auto|en|ja|es|de|fr|pt|it]
+silence.py INPUT --filler --words transcript.json [--filler-lang auto|en|ja|ko|zh|es|de|fr|pt|it|nl|pl|ru|tr]
            [--filler-words FILE] [--filler-extra W,W] [--filler-keep W,W] [--filler-pad 0.02]
            [--transcribe] [--engine auto|parakeet-mlx|parakeet.cpp|whisper.cpp|faster-whisper|openai-whisper]
            [--model MODEL] [--filler-list] [--max-cuts 400]
@@ -598,6 +598,11 @@ per-word `start`/`end`) or `--transcribe` (the same local engine `caption.py`
 uses, never required). There is no heuristic fallback — finding an "um" by
 looking for short quiet blips would cut real speech, so the tool refuses
 instead. `--filler-list` reports what would go and writes nothing.
+Built-in lists (2.19): en, ja, ko, zh, es, de, fr, pt, it, nl, pl, ru, tr. They hold
+hesitation sounds only; words that are as often content (`like`, 저, 那个, ну) are
+`--filler-extra` material. Chinese and Japanese are cut only where the transcript shows
+a word boundary on each side (punctuation or a 0.1 s pause), because whisper splits them
+into tokens rather than words.
 `filler.matched_untimed` counts listed words the transcript gives no usable
 timing for (not removed, and a `filler_words_untimed` warning), and
 `matched_too_long` those longer than a filler (a held vowel, kept).
@@ -608,11 +613,17 @@ Built-in lists, one per language:
 |---|---|
 | en | um, uh, erm, hmm, mm, mhm, er, ah |
 | ja | えー, えーと, えっと, あの, あのー, その, そのー, まあ, なんか |
+| ko | 어, 어어, 에, 음, 음음, 으음, 흠 |
+| zh | 呃, 呃呃, 嗯, 嗯嗯, 唔 |
 | es | eh, este, esto, mmm |
 | de | äh, ähm, hm |
 | fr | euh, hein |
 | pt | é, hum |
 | it | ehm |
+| nl | eh, ehm, uh, uhm, hm |
+| pl | yy, yyy, ee, eee, em, emm, hmm |
+| ru | э, ээ, эм, эмм, мм, хм |
+| tr | ıı, ııı, ee, eee, hmm |
 
 **Discourse markers are not disfluencies.** `like`, `tipo` and `cioè` are
 deliberately *not* in the default lists: they are grammatical words in most

package/scripts/_common/asr.py

@@ -12,10 +12,11 @@ from __future__ import annotations
 import json
 import os
 import re
+import unicodedata
 from pathlib import Path
 from typing import Any, Dict, List, NamedTuple, Optional, Tuple
 
-from _common.decision import fmt_srt_time, parse_time
+from _common.decision import _unspaced_script, fmt_srt_time, parse_time
 from _common.emit import die, info, warn
 from _common.runner import read_text_or_die
 
@@ -502,7 +503,11 @@ def _words_from_whisper_cpp_json(path: str) -> "List[Dict[str, Any]]":
 
     Token text carries leading spaces and the model's special tokens ([_BEG_], [_TT_123]); those
     are dropped, and a token that is a word continuation (no leading space) is glued onto the
-    previous word so "un" + "believable" is one word with one span, not two.
+    previous word so "un" + "believable" is one word with one span, not two. Chinese, Japanese
+    and Thai have no spaces, so there every token would continue the one before and a whole
+    segment became one "word": between two whole characters of such a script the tokens stay
+    apart, as openai-whisper and faster-whisper split them (filler_spans() finds the word
+    boundaries). A token that is part of a character (U+FFFD) is still glued.
     """
     try:
         doc = json.loads(Path(path).read_text(encoding="utf-8"))
@@ -519,7 +524,14 @@ def _words_from_whisper_cpp_json(path: str) -> "List[Dict[str, Any]]":
                 start, end = float(offsets["from"]) / 1000.0, float(offsets["to"]) / 1000.0
             except (KeyError, TypeError, ValueError):
                 continue
-            if out and not text.startswith(" "):
+            prev = out[-1]["word"] if out else ""
+            # "嗯" + "，" + "呃": the comma stays with the word before it and ends that word
+            core = prev
+            while core and unicodedata.category(core[-1]).startswith("P"):
+                core = core[:-1]
+            unspaced = (core and _unspaced_script(core[-1]) and _unspaced_script(text.lstrip()[:1] or " ")
+                        and "\ufffd" not in prev[-1:] + text)
+            if out and not text.startswith(" ") and not unspaced:
                 out[-1]["word"] += text
                 out[-1]["end"] = end
             else:

package/scripts/_common/decision.py

@@ -1158,6 +1158,18 @@ FILLER_WORDS = {
     "fr": frozenset({"euh", "hein"}),
     "pt": frozenset({"é", "hum"}),
     "it": frozenset({"ehm"}),
+    # 2.19: Korean is written with spaces, so a whisper word is a word and the list works as the
+    # English one does. 그/저/뭐/이제 are fillers as often as they are "that"/"I"/"what"/"now":
+    # discourse markers below, not defaults.
+    "ko": frozenset({"음", "으음", "음음", "어", "어어", "에", "흠"}),
+    # Chinese has no spaces: these match only as a whole token with a boundary on each side
+    # (filler_spans), so the 额 of 金额 or the 呃 inside a word is never cut. 额 itself is left
+    # out: it is a common character in its own right.
+    "zh": frozenset({"嗯", "嗯嗯", "呃", "呃呃", "唔"}),
+    "ru": frozenset({"э", "ээ", "эм", "эмм", "мм", "хм"}),
+    "nl": frozenset({"eh", "ehm", "uh", "uhm", "hm"}),
+    "pl": frozenset({"yyy", "yy", "eee", "ee", "em", "emm", "hmm"}),
+    "tr": frozenset({"ıı", "ııı", "ee", "eee", "hmm"}),
 }
 
 # Words in a default list that are also ordinary vocabulary: every run that removes one says so.
@@ -1173,11 +1185,33 @@ FILLER_DISCOURSE_MARKERS = {
     "en": ("like", "you know"),
     "pt": ("tipo",),
     "it": ("cioè",),
+    "ko": ("그", "저", "뭐", "이제", "약간", "막", "그니까"),
+    "zh": ("那个", "这个", "就是", "然后"),
+    "ru": ("ну", "типа", "короче", "как бы"),
+    "nl": ("nou", "dus", "zeg maar"),
+    "pl": ("no", "jakby", "wiesz", "znaczy"),
+    "tr": ("şey", "yani", "işte"),
 }
 
 FILLER_MAX_WORD = 1.2   # a longer "uhhh" is a held vowel someone meant
 FILLER_MIN_GAP = 0.05   # spans closer than this become one span
 FILLER_PAD = 0.02       # trimmed either side of the word
+FILLER_MAX_TOKENS = 4   # a listed word may span this many engine tokens ("えー" + "と", "you" + "know")
+FILLER_BOUNDARY_GAP = 0.1  # a pause this long between two tokens is a word boundary
+
+
+def _unspaced_script(text: str) -> bool:
+    """True when `text` has a character of a script written without spaces between words (Han,
+    kana, Thai, Lao, Myanmar, Khmer). Whisper splits those languages into tokens, not words, so a
+    token boundary there says nothing about a word boundary. Hangul is spaced and not listed."""
+    for ch in text:
+        o = ord(ch)
+        if (0x3040 <= o <= 0x30FF or 0x31F0 <= o <= 0x31FF or 0xFF66 <= o <= 0xFF9F   # kana
+                or 0x3400 <= o <= 0x4DBF or 0x4E00 <= o <= 0x9FFF or 0xF900 <= o <= 0xFAFF  # Han
+                or 0x20000 <= o <= 0x323AF  # Han extensions B-H
+                or 0x0E00 <= o <= 0x0EFF or 0x1000 <= o <= 0x109F or 0x1780 <= o <= 0x17FF):  # Thai, Lao, Myanmar, Khmer
+            return True
+    return False
 
 
 def normalise_filler_token(word: str) -> str:
@@ -1195,37 +1229,89 @@ def filler_spans(words, wordlist, *, pad: float = FILLER_PAD, min_gap: float = F
                  max_word: float = FILLER_MAX_WORD, stats: "Optional[Dict[str, int]]" = None) -> "List[Dict[str, Any]]":
     """Time spans to remove, from measured word timings. Pure: no subprocess, no I/O.
 
-    `words` is [{"word", "start", "end"}] as whisper emits. A word is removed only when its
-    normalised form is in `wordlist` AND it carries a real start < end pair AND its length is
-    <= max_word. Adjacent spans closer than min_gap merge. Returns [{"start", "end", "word"}]
-    sorted and non-overlapping.
+    `words` is [{"word", "start", "end"}] as whisper emits. A run of up to FILLER_MAX_TOKENS
+    consecutive entries is removed only when the run, joined with or without spaces and
+    normalised, is in `wordlist` AND every entry carries a real start < end pair AND the run is
+    <= max_word long. The longest run wins. Adjacent spans closer than min_gap merge. Returns
+    [{"start", "end", "word"}] sorted and non-overlapping.
+
+    Whisper splits Chinese, Japanese and Thai into tokens rather than words ("えーと" arrives as
+    "えー" + "と", "金额" as "金" + "额"), so a run in such a script also needs a word boundary on
+    each side: the start or end of the transcript, punctuation, a spaced-script neighbour, or a
+    pause of FILLER_BOUNDARY_GAP. Without one the run is part of a longer word and is kept.
 
     `stats`, when given, receives the listed words that were kept anyway, so the caller can say
     so: `matched_untimed` (no usable start < end: nothing to cut on) and `matched_too_long`
     (longer than max_word: a held vowel someone meant).
     """
+    import unicodedata as _ud
     listed = {normalise_filler_token(w) for w in (wordlist or set())}
     listed.discard("")
-    hits = []
-    untimed = too_long = 0
+    toks = []
     for entry in words or []:
         if not isinstance(entry, dict):
             continue
-        token = normalise_filler_token(entry.get("word") or entry.get("text") or "")
-        if not token or token not in listed:
-            continue
+        raw = str(entry.get("word") or entry.get("text") or "").strip()
         try:
             start, end = float(entry["start"]), float(entry["end"])
+            timed = end > start
         except (KeyError, TypeError, ValueError):
-            untimed += 1
-            continue     # no measured timing: nothing to cut
-        if not (end > start):
-            untimed += 1
-            continue
-        if (end - start) > max_word:
-            too_long += 1
-            continue
-        hits.append({"start": max(0.0, start - pad), "end": end + pad, "word": token})
+            start = end = 0.0
+            timed = False
+        toks.append({"norm": normalise_filler_token(raw), "start": start, "end": end, "timed": timed,
+                     "punct_before": bool(raw) and _ud.category(raw[0]).startswith("P"),
+                     "punct_after": bool(raw) and _ud.category(raw[-1]).startswith("P")})
+
+    def _bounded(i: int, j: int) -> bool:
+        """A word boundary before toks[i] and after toks[j - 1]."""
+        left = (i == 0 or toks[i]["punct_before"] or toks[i - 1]["punct_after"] or not toks[i - 1]["norm"]
+                or not _unspaced_script(toks[i - 1]["norm"])
+                or (toks[i - 1]["timed"] and toks[i]["start"] - toks[i - 1]["end"] >= FILLER_BOUNDARY_GAP - 1e-6))
+        right = (j == len(toks) or toks[j - 1]["punct_after"] or toks[j]["punct_before"] or not toks[j]["norm"]
+                 or not _unspaced_script(toks[j]["norm"])
+                 or (toks[j]["timed"] and toks[j]["start"] - toks[j - 1]["end"] >= FILLER_BOUNDARY_GAP - 1e-6))
+        return left and right
+
+    hits = []
+    untimed = too_long = 0
+    i = 0
+    while i < len(toks):
+        found = 0
+        rejected = None
+        for k in range(min(FILLER_MAX_TOKENS, len(toks) - i), 0, -1):
+            run = toks[i:i + k]
+            norms = [t["norm"] for t in run]
+            if not all(norms):
+                continue
+            unspaced = any(_unspaced_script(n) for n in norms)
+            joined = ("" if unspaced else " ").join(norms)
+            if joined not in listed or (unspaced and not _bounded(i, i + k)):
+                continue
+            # punctuation inside the run ("えー、" + "と") ends the word: the shorter run decides
+            if any(run[m]["punct_after"] or run[m + 1]["punct_before"] for m in range(k - 1)):
+                continue
+            # so does a pause inside an unspaced run: the tokens were two words
+            if unspaced and any(run[m]["timed"] and run[m + 1]["timed"]
+                                and run[m + 1]["start"] - run[m]["end"] >= FILLER_BOUNDARY_GAP - 1e-6
+                                for m in range(k - 1)):
+                continue
+            # a run listed out of time order has no span to cut on
+            if not all(t["timed"] for t in run) or run[-1]["end"] <= run[0]["start"]:
+                rejected = rejected or ("untimed", k)
+                continue
+            if run[-1]["end"] - run[0]["start"] > max_word:
+                rejected = rejected or ("too_long", k)
+                continue
+            hits.append({"start": max(0.0, run[0]["start"] - pad), "end": run[-1]["end"] + pad, "word": joined})
+            found = k
+            break
+        if not found and rejected:
+            # the longest listed run that could not be cut is the one reported. Its prefixes were
+            # tried here; moving on by one token lets a listed word later in it be tried too
+            untimed += rejected[0] == "untimed"
+            too_long += rejected[0] == "too_long"
+            found = 1
+        i += found or 1
     hits.sort(key=lambda h: (h["start"], h["end"]))
     merged: "List[Dict[str, Any]]" = []
     for h in hits:

package/scripts/_common/emit.py

@@ -372,6 +372,45 @@ def steps_encoder_report(steps: Sequence["Tuple[str, Any]"]) -> Dict[str, Any]:
     return out
 
 
+# The properties each writing tool does NOT measure about its output, by tool name: the unverified
+# range U that every --json result reports (docs/contract.md "unverified"). A property listed here
+# is one a caller might assume was checked; naming it is the difference between "verified" meaning
+# "the listed properties were measured" and "everything is fine". Kept beside emit() so a tool
+# cannot report verified without this list travelling with it.
+UNVERIFIED: Dict[str, List[str]] = {
+    "cut": ["picture_content"],
+    "join": ["picture_content", "transition_look"],
+    "fit": ["subject_framing"],
+    "crop": ["subject_framing"],
+    "caption": ["rendered_placement", "legibility"],
+    "overlay": ["rendered_placement"],
+    "graphics": ["rendered_placement"],
+    "color": ["grade_look"],
+    "export": ["picture_content"],
+    "render": ["picture_content", "rendered_placement"],
+    "silence": ["removed_span_content"],
+    "audio": ["mix_balance"],
+    "loudness": ["perceived_loudness"],
+    "sync": ["lip_sync"],
+    "multicam": ["lip_sync", "shot_choice"],
+}
+
+
+def stream_inventory_step(meta: Dict[str, Any], expect: Dict[str, bool]) -> Dict[str, Any]:
+    """The output's stream composition checked against what the operation should have produced
+    (#367: a cut of an MPEG-TS source lost its whole video stream and still said verified: true,
+    because the only properties measured were duration and start skew). `expect` comes from the
+    input's own probe and the tool's arguments (provenance "input_premeasurement"): a stream the
+    input had and the operation was not told to drop must still be there."""
+    measured = {kind: bool(meta.get(kind)) for kind in expect}
+    missing = [k for k, want in expect.items() if want and not measured[k]]
+    step: Dict[str, Any] = {"step": "streams", "property": "stream_inventory", "expected": dict(expect),
+                            "measured": measured, "provenance": "input_premeasurement", "ok": not missing}
+    if missing:
+        step["missing"] = missing
+    return step
+
+
 def emit(output: Optional[str], *, ctx: "Optional[Context]" = None, **extra: Any) -> None:
     """Final stdout line: the output path, or a JSON document with --json.
 
@@ -392,13 +431,22 @@ def emit(output: Optional[str], *, ctx: "Optional[Context]" = None, **extra: Any
         # only when the file was written, probed, and every self-check met its target; a dry run
         # verified nothing. Spec failures the tool cannot fix on its own (export's loudness gap)
         # keep status completed and say verified: false, so a caller keys on one field.
+        expect_streams = extra.pop("expect_streams", None)
         steps: List[Dict[str, Any]] = ([{"step": "probe", "ok": True}] if meta else []) + list(extra.pop("verification", None) or [])
+        if meta and expect_streams:
+            steps.append(stream_inventory_step(meta, expect_streams))
         # a tool that ran others (render.py) verified what its stages verified too (absorb_stage())
         steps += [s for s in ctx.stage_verification if s not in steps]
         if output and not ctx.dry_run and os.path.splitext(output)[1].lower() not in MEDIA_EXT:
             steps.insert(0, {"step": "exists", "ok": True})
         doc["verified"] = not ctx.dry_run and bool(steps) and all(s.get("ok") for s in steps)
+        # a failed check asserts that something in artifact, reference, instrument or the expected
+        # value's provenance is wrong; until a tool knows which, it says it does not know
+        steps = [dict(s, attribution=s.get("attribution") or "unresolved") if s.get("ok") is False else s for s in steps]
         doc["verification"] = steps
+        tool = os.path.splitext(os.path.basename(sys.argv[0] or ""))[0]
+        if output and not ctx.dry_run and tool in UNVERIFIED and "unverified" not in extra:
+            doc["unverified"] = list(UNVERIFIED[tool])
         doc.update(_encoder_report(ctx))
         doc.update(extra)
         hw_notes = [n for n in _hw_notes_for(ctx) if n not in (doc.get("notes") or [])]

package/scripts/_common/fonts.py

@@ -147,13 +147,14 @@ LANGUAGE_NAMES = {
     "ja": "Japanese", "zh": "Chinese", "ko": "Korean", "ar": "Arabic", "he": "Hebrew",
     "hi": "Devanagari (Hindi/Marathi/Nepali)", "th": "Thai", "ru": "Cyrillic (Russian and others)",
     "el": "Greek", "latin": "Latin", "bn": "Bengali", "ta": "Tamil", "lo": "Lao",
+    "zh-hant": "Traditional Chinese",
 }
 
 
 # fontconfig's own :lang= codes for each script we detect (zh uses zh-cn, the Simplified subset
 # every CJK font that claims zh carries; the rest are the plain two-letter codes).
 FC_LANG = {"ja": "ja", "zh": "zh-cn", "ko": "ko", "ar": "ar", "he": "he", "hi": "hi", "th": "th", "ru": "ru", "el": "el",
-           "bn": "bn", "ta": "ta", "lo": "lo"}
+           "bn": "bn", "ta": "ta", "lo": "lo", "zh-hant": "zh-tw"}
 
 
 # Families tried in order, best first. The names are matched case-insensitively against the start
@@ -162,6 +163,8 @@ FC_LANG = {"ja": "ja", "zh": "zh-cn", "ko": "ko", "ar": "ar", "he": "he", "hi":
 PREFERRED_FAMILIES = {
     "ja": ["Noto Sans CJK JP", "Noto Serif CJK JP", "Noto Sans JP", "Source Han Sans", "IPAPGothic", "IPAGothic", "IPA", "VL Gothic", "TakaoGothic", "WenQuanYi Zen Hei"],
     "zh": ["Noto Sans CJK SC", "Noto Serif CJK SC", "Noto Sans SC", "Source Han Sans", "WenQuanYi Zen Hei", "WenQuanYi Micro Hei", "Droid Sans Fallback"],
+    "zh-hant": ["Noto Sans CJK TC", "Noto Serif CJK TC", "Noto Sans CJK HK", "Noto Sans TC", "Noto Sans HK", "Source Han Sans TW",
+                "Source Han Sans HC", "AR PL UMing TW", "AR PL UKai TW", "PingFang TC", "WenQuanYi Zen Hei", "Droid Sans Fallback"],
     "ko": ["Noto Sans CJK KR", "Noto Serif CJK KR", "Noto Sans KR", "Source Han Sans K", "NanumGothic", "Nanum Gothic", "Malgun Gothic", "WenQuanYi Zen Hei"],
     "ar": ["Noto Sans Arabic", "Noto Naskh Arabic", "Amiri", "Scheherazade", "DejaVu Sans", "FreeSans", "FreeSerif"],
     "he": ["Noto Sans Hebrew", "Noto Serif Hebrew", "DejaVu Sans", "FreeSans", "FreeSerif"],
@@ -179,6 +182,7 @@ PREFERRED_FAMILIES = {
 WINDOWS_FONTS = {
     "ko": [("malgun.ttf", "Malgun Gothic"), ("gulim.ttc", "Gulim"), ("batang.ttc", "Batang")],
     "zh": [("msyh.ttc", "Microsoft YaHei"), ("simhei.ttf", "SimHei"), ("simsun.ttc", "SimSun")],
+    "zh-hant": [("msjh.ttc", "Microsoft JhengHei"), ("mingliu.ttc", "MingLiU")],
     "ja": [("meiryo.ttc", "Meiryo"), ("YuGothM.ttc", "Yu Gothic Medium"), ("YuGothR.ttc", "Yu Gothic"), ("msgothic.ttc", "MS Gothic")],
     "ar": [("tahoma.ttf", "Tahoma"), ("arial.ttf", "Arial")],
     "he": [("tahoma.ttf", "Tahoma"), ("arial.ttf", "Arial")],
@@ -277,6 +281,22 @@ def detect_script(text: str, lang: "Optional[str]" = None) -> str:
     return best
 
 
+# 2.19: Han-only text is Chinese, and Chinese is written in two standard forms whose glyphs differ
+# (骨, 直, 角 are drawn differently in Taipei and Beijing). A Simplified face draws a Taiwanese
+# caption in the wrong form, so a --lang naming Traditional Chinese resolves a Traditional face.
+# The script stays "zh" for wrapping; only the font lookup changes.
+HANT_TAGS = ("zh-tw", "zh-hk", "zh-mo", "zh-hant", "yue")
+
+
+def font_key(script: str, lang: "Optional[str]" = None) -> str:
+    """The font-table key for `script` under the caller's `lang`: "zh-hant" for Chinese text the
+    caller says is Traditional (zh-TW, zh-HK, zh-MO, zh-Hant-*, yue), else `script` itself."""
+    tag = (lang or "").strip().lower().replace("_", "-")
+    if script == "zh" and any(tag == t or tag.startswith(t + "-") for t in HANT_TAGS):
+        return "zh-hant"
+    return script
+
+
 _SCRIPT_FONT_CACHE: "Dict[Tuple[str, Optional[str]], Optional[Tuple[str, str]]]" = {}
 
 
@@ -359,7 +379,11 @@ def _script_font_uncached(script: str, family_hint: "Optional[str]" = None):
         mono = 1 if "mono" in joined else 0
         # regular weights before Bold/Italic/Oblique cuts, so a default caption is not bold by accident
         styled = 1 if any(k in stem for k in ("bold", "italic", "oblique", "light", "thin", "black")) else 0
-        scored.append((last_resort, _family_rank(families, preferred), mono, styled, path, families[0]))
+        rank = _family_rank(families, preferred)
+        # a .ttc lists every face it holds (Noto CJK: JP, KR, SC, TC): name the one that ranked
+        family = next((f for f in families if rank < len(preferred) and f.lower().startswith(preferred[rank].lower())),
+                      families[0])
+        scored.append((last_resort, rank, mono, styled, path, family))
     scored.sort(key=lambda row: (row[0], row[1], row[2], row[3], row[4]))
     best = scored[0]
     return best[4], best[5]
@@ -453,6 +477,11 @@ def fonts_dir_covers_script(fonts_dir: str, script: str) -> "Optional[bool]":
     return False
 
 
+def _is_last_resort(entry: "Tuple[str, str]") -> bool:
+    """Unifont, fontconfig's code-point-box face: it covers every script and renders none."""
+    return "unifont" in " ".join(str(x) for x in entry).lower()
+
+
 def script_font_for_text(text: str, *, lang: "Optional[str]" = None, font: "Optional[str]" = None,
                          font_explicit: bool = False, font_file: "Optional[str]" = None,
                          fonts_dir: "Optional[str]" = None
@@ -476,30 +505,41 @@ def script_font_for_text(text: str, *, lang: "Optional[str]" = None, font: "Opti
         return script, None, None
     if font_file:
         return script, None, None
+    key = font_key(script, lang)
     if font_explicit and font:
-        if not font_covers_script(font, script):
-            warn(f"font: '{font}' does not cover {LANGUAGE_NAMES[script]} text on this machine; keeping it as asked "
+        if not font_covers_script(font, key):
+            warn(f"font: '{font}' does not cover {LANGUAGE_NAMES[key]} text on this machine; keeping it as asked "
                  f"(drop --font, or {FONT_FLAG_HINT}, to pick one by script automatically)", "font_lacks_script",
                  font=font, script=script)
         return script, None, None
     if fonts_dir:
-        covered = fonts_dir_covers_script(fonts_dir, script)
+        covered = fonts_dir_covers_script(fonts_dir, key)
         if covered:
             return script, None, None
         if covered is None:
-            warn(f"font: could not verify that {fonts_dir} covers {LANGUAGE_NAMES[script]} text "
+            warn(f"font: could not verify that {fonts_dir} covers {LANGUAGE_NAMES[key]} text "
                  "(no fc-scan on this machine); using it as given", "font_coverage_unverified", fonts_dir=fonts_dir, script=script)
             return script, None, None
-        record_fallback(f"font: no face in {fonts_dir} covers {LANGUAGE_NAMES[script]} text; "
+        record_fallback(f"font: no face in {fonts_dir} covers {LANGUAGE_NAMES[key]} text; "
                         "picking one by script instead (the directory is still searched first)", "fonts_dir_lacks_script",
                         fonts_dir=fonts_dir, script=script)
-    entry = _script_font_entry(script)
+    entry = _script_font_entry(key)
+    if key != script and (not entry or (entry is not FC_UNKNOWN and _is_last_resort(entry))):
+        # no Traditional face (Unifont's code-point boxes are none): the Simplified one still
+        # has the characters, in the other form
+        simplified = _script_font_entry(script)
+        if simplified and simplified is not FC_UNKNOWN and (not entry or not _is_last_resort(simplified)):
+            entry = simplified
+            record_fallback(f"font: no {LANGUAGE_NAMES[key]} face is installed; drawing with {entry[0]}, a "
+                            "Simplified Chinese face whose glyph forms differ in places "
+                            "(install fonts-noto-cjk or a TC font)", "font_variant_missing", lang=lang, file=entry[0])
+            key = script
     if entry is FC_UNKNOWN:
-        warn(f"font: could not verify that this machine can render {LANGUAGE_NAMES[script]} text "
+        warn(f"font: could not verify that this machine can render {LANGUAGE_NAMES[key]} text "
              "(no working fontconfig); rendering with the font as given -- "
              "doctor --json .fonts.scripts reports what is known", "font_coverage_unverified", script=script)
         return script, None, None
     if not entry:
-        die(f"no installed font covers {LANGUAGE_NAMES[script]} text on this machine — {FONT_INSTALL_HINT}", kind="input")
-    info(f"font: {entry[0]} (covers {script})")
+        die(f"no installed font covers {LANGUAGE_NAMES[key]} text on this machine — {FONT_INSTALL_HINT}", kind="input")
+    info(f"font: {entry[0]} (covers {key})")
     return script, entry[0], entry[1]

package/scripts/_contract.py

@@ -456,6 +456,7 @@ DIAGNOSTIC_CODES = {
     "font_path_copied": ("fallbacks", "a --font-file under a non-ASCII path was copied to an ASCII one, because drawtext cannot open it on Windows; {font, file}"),
     "font_path_not_ascii": ("warnings", "a --font-file under a non-ASCII path could not be given an ASCII form on Windows; drawtext may not open it; {font}"),
     "fonts_dir_lacks_script": ("fallbacks", "no face in --fonts-dir covers the text's script, so one was picked by script; {fonts_dir, script}"),
+    "font_variant_missing": ("fallbacks", "--lang named Traditional Chinese but no Traditional face is installed, so a Simplified one draws it (some glyph forms differ); {lang, file}"),
     "emoji_monochrome": ("warnings", "emoji drawn by the text font (monochrome at best): no colour path here"),
     "emoji_stripped": ("warnings", "overlay.py --emoji none: emoji removed from the drawn text; {mode}"),
     "emoji_assets_missing": ("warnings", "--emoji-assets has no PNG for these clusters; the text font draws them; {missing}"),
@@ -536,7 +537,8 @@ def output_schema(name: str, meta: Dict[str, Any], hw: bool = False) -> Dict[str
             "hw": {"type": "object", "description": "present when VideoToolbox was asked for (--hw, $FFMPEG_SKILL_HW, a render.py stage, a batch.py item), on export.py when $FFMPEG_SKILL_HW=1 is set but its delivery preset does not take it, and when this ffmpeg build has no libx264/libx265 and an encode ran on VideoToolbox instead: {requested: whether this run's encodes were asked onto VideoToolbox (false for that export, and for the build without libx264/libx265), source: flag|env|auto (auto: nobody asked, the build has no libx264/libx265 and this Apple Silicon machine ran VideoToolbox in its place), used: true|false whether the encoder that ran last is VideoToolbox, null under --dry-run (nothing ran) and when this process ran no encode itself (batch.py: its stages are child processes; its top-level hw gathers the items' requested/source/fallback/notes and each results row carries its item's encoder and hw), fallback: a job VideoToolbox refused (encoder open or compression session failure; nothing else is retried) was re-encoded on the CPU, notes: why an encode stayed on or fell back to the CPU, and, when $FFMPEG_SKILL_HW chose the GPU and it ran, what that costs and that --no-hw opts out}. A VideoToolbox encode also adds a top-level notes line: its quality is not CRF-equivalent. A kind: ffmpeg failure under --hw / $FFMPEG_SKILL_HW carries encoder and hw too"},
             "plan": {"type": "string", "description": "with --plan FILE: the plan document written (the run itself is a dry run)"},
             "verified": {"type": "boolean", "description": "true only when the artifact was written, probed, and every self-check the tool ran (verification) met its target; false under --dry-run"},
-            "verification": {"type": "array", "items": {"type": "object", "properties": {"step": {"type": "string"}, "ok": {"type": "boolean"}, "stage": {"type": "string"}}}, "description": "what the tool itself verified: probe, plus loudness (loudness.py, export platform presets; ok false with reason not_measured when it could not be read), check (render), report.py's sections (loudness, compliance, contact_sheet) and batch.py's items (item). render.py also lists every stage's own steps beyond its artifact probe, tagged with `stage` (a cached stage's as recorded), so its `verified` is the conjunction of every stage's"},
+            "verification": {"type": "array", "items": {"type": "object", "properties": {"step": {"type": "string"}, "ok": {"type": "boolean"}, "stage": {"type": "string"}, "property": {"type": "string"}, "expected": {}, "measured": {}, "delta": {}, "tolerance": {}, "provenance": {"enum": ["specification", "user_specified", "independent_measurement", "input_premeasurement"]}, "attribution": {"enum": ["artifact", "reference", "instrument", "provenance", "unresolved"]}}}, "description": "what the tool itself verified: probe, plus loudness (loudness.py, export platform presets; ok false with reason not_measured when it could not be read), check (render), report.py's sections (loudness, compliance, contact_sheet) and batch.py's items (item). render.py also lists every stage's own steps beyond its artifact probe, tagged with `stage` (a cached stage's as recorded), so its `verified` is the conjunction of every stage's. Since 2.18 a step may carry the property it measured with expected, measured, delta, tolerance and the provenance of the expected value; cut, join and export add a `streams` step comparing the output's video/audio streams with the input's; a step with ok false carries `attribution` (unresolved until a tool knows the cause)"},
+            "unverified": {"type": "array", "items": {"type": "string"}, "description": "2.18: the properties of the output this tool did not measure (the unverified range), e.g. caption's rendered_placement; `verified` covers the measured properties only"},
             "diagnostics": DIAGNOSTICS_SCHEMA}
     extra: Dict[str, Any] = {}
     if name == "check":
@@ -683,6 +685,13 @@ def output_schema(name: str, meta: Dict[str, Any], hw: bool = False) -> Dict[str
     return {"type": "object", "properties": props, "required": required, "additionalProperties": True}
 
 @functools.lru_cache(maxsize=1)
+def _unverified_table() -> Dict[str, List[str]]:
+    """emit()'s per-tool unverified range, read where the results are made so the two cannot differ."""
+    sys.path.insert(0, str(ROOT / "scripts"))
+    from _common.emit import UNVERIFIED
+    return UNVERIFIED
+
+
 def skill_examples() -> Dict[str, List[Dict[str, Any]]]:
     """1.20.0: per-tool `examples`, parsed from SKILL.md's "User says" / "Do" table -- the
     same facts that table already states, machine-readable instead of prose-only. A row
@@ -1547,6 +1556,8 @@ def tool_spec(name: str, version: str) -> Dict[str, Any]:
         "reencodes_audio": REENCODE_META.get(name, {}).get("audio", "conditional"),
         **({"reencode_note": REENCODE_META[name]["note"]} if REENCODE_META.get(name, {}).get("note") else {}),
         "requires_visual_verification": meta["visual"],
+        # 2.18: what `verified` does not cover for this tool (the result's `unverified`)
+        "unverified_properties": list(_unverified_table().get(name, [])),
         "audio_only": meta["audio_only"],
         "video_required": meta["video_required"],
         "deterministic_inputs": meta["deterministic"],

package/scripts/_platforms.py

@@ -55,6 +55,13 @@ _NO_SAFE = {"top": 0.0, "bottom": 0.0, "left": 0.0, "right": 0.0}
 _CAP_VERTICAL = {"size": 0.0833, "position": "bottom", "box": False, "outline": 2, "animate": "pop"}
 _CAP_WIDE = {"size": 0.0694, "position": "bottom", "box": False, "outline": 2, "animate": "none"}
 
+# The one true-peak tolerance every tool applies to a dBTP ceiling, reported beside the verdict.
+# Before 2.18 loudness.py allowed +0.1 dB, check.py +0.05 and export.py 0.0, so "verified" meant a
+# different scale in each tool and export could fail a file check passed (the VDC paper's
+# sensitivity run). 0.1 dB is loudness.py's margin: two loudnorm passes on the same encode differ
+# by up to that much, so a tighter rule fails a file on measurement noise.
+TP_TOLERANCE_DB = 0.1
+
 PLATFORMS: Dict[str, Dict[str, Any]] = {
     "tiktok": {
         "title": "TikTok",

package/scripts/check.py

@@ -34,7 +34,7 @@ import sys
 from fractions import Fraction
 from typing import Any, Dict, List
 
-from _platforms import PLATFORMS, PLATFORM_CHOICES, spec_of, resolve as resolve_platform
+from _platforms import PLATFORMS, PLATFORM_CHOICES, TP_TOLERANCE_DB, spec_of, resolve as resolve_platform
 from _common.probe import SILENT_PEAK_DBFS, detect_content, measured_level_dbfs
 from _common import STATE, add_common, apply_common, die, emit, info, probe, require_tool, run, run_analysis, dry_run_input_pending
 
@@ -249,7 +249,7 @@ def main() -> int:
                 diff = abs(lm["lufs"] - spec["lufs"])
                 row("loudness", "PASS" if diff <= spec["lufs_tol"] else "FAIL", f"{lm['lufs']:.1f} LUFS", f"{spec['lufs']:g} ± {spec['lufs_tol']:g} LUFS", f"loudness.py -I {spec['lufs']:g} for speech or music; leave ambience/near-silence (<= -40 LUFS) alone and say so",
                     reason="the platform will auto-normalise it to its own target anyway, which can pump or duck the mix in ways you did not choose")
-                row("true peak", "PASS" if lm["tp"] <= spec["tp"] + 0.05 else "FAIL", f"{lm['tp']:.1f} dBTP", f"<= {spec['tp']:g} dBTP", f"loudness.py --tp {spec['tp']:g}")
+                row("true peak", "PASS" if lm["tp"] <= spec["tp"] + TP_TOLERANCE_DB else "FAIL", f"{lm['tp']:.1f} dBTP", f"<= {spec['tp']:g} dBTP (+{TP_TOLERANCE_DB:g} dB tolerance)", f"loudness.py --tp {spec['tp']:g}")
             else:
                 # ffmpeg's loudnorm JSON didn't parse out of stderr (unexpected/garbled output).
                 # Dropping the loudness/true-peak rows silently here would report an overall PASS

package/scripts/cut.py

@@ -1677,7 +1677,11 @@ def main() -> int:
         notes.append(skew_note)
     info(f"wrote {output} ({fmt_secs(got)}, expected ~{expected:.3f}s, "
          + ("re-encoded" if reencoded else "lossless stream copy") + f", {precision} precision)")
+    # the streams the source had and this cut was not told to drop (an audio extension drops the
+    # picture): #367, a TS cut that lost its video must not say verified
+    expect_streams = {"video": bool(meta.get("video")) and not is_audio_output(output), "audio": bool(meta.get("audio"))}
     emit(output, expected_duration=round(expected, 6), duration_error_ms=error_ms, precision=precision, reencoded=reencoded,
+         expect_streams=expect_streams,
          dropped_non_av_streams=bool(DROPPED_STREAMS),
          requested_start=round(requested[0][0], 6) if len(requested) == 1 else None,
          requested_end=round(requested[0][1], 6) if len(requested) == 1 else None,

package/scripts/export.py

@@ -40,10 +40,22 @@ from _common import STATE, add_common, apply_common, bt709_matrix_args, bt709_ta
 from _common.decision import hw_preset_video, restate_last_swap
 from _common.emit import note, record_skip, warn
 from check import SPECS as PLATFORMS, measure_loudness
-from _platforms import ALIASES as _ALIASES, PLATFORMS as PLATFORM_TABLE, resolve as resolve_platform
+from _platforms import ALIASES as _ALIASES, PLATFORMS as PLATFORM_TABLE, TP_TOLERANCE_DB, resolve as resolve_platform
 # Frame and duration limit come from the one platform table (scripts/_platforms.py) rather than
 # from a literal restated here: before 1.14 they were typed twice and the facebook preset had
 # already drifted (no duration cap against the table's 14400 s).
+
+def _loudness_step(ok: bool, platform: str, spec: dict, m: dict) -> dict:
+    """export's loudness verification step: the platform's targets, what was measured, the
+    difference and the tolerance each was held to (docs/contract.md, 2.18 keys)."""
+    expected = {"lufs": spec["lufs"], "tp_max": spec["tp"]}
+    measured = {"lufs": m["lufs"], "tp": m["tp"]}
+    delta = {"lufs": round(m["lufs"] - spec["lufs"], 2) if math.isfinite(m["lufs"]) else None,
+             "tp": round(m["tp"] - spec["tp"], 2) if math.isfinite(m["tp"]) else None}
+    return {"step": "loudness", "ok": ok, "platform": platform, "property": "loudness",
+            "expected": expected, "measured": measured, "delta": delta,
+            "tolerance": {"lufs": spec["lufs_tol"], "tp": TP_TOLERANCE_DB}, "provenance": "specification"}
+
 def _from_table(dest: str, **over) -> Dict:
     """A preset's w/h/max read from PLATFORMS[dest], with the encoder settings given here.
 
@@ -268,9 +280,9 @@ def main() -> int:
         if not m:
             _loudness_unmeasured(extra, notes, platform, spec)
         if m:
-            ok = abs(m["lufs"] - spec["lufs"]) <= spec["lufs_tol"] and m["tp"] <= spec["tp"]
+            ok = abs(m["lufs"] - spec["lufs"]) <= spec["lufs_tol"] and m["tp"] <= spec["tp"] + TP_TOLERANCE_DB
             extra["loudness"] = {"lufs": m["lufs"], "tp": m["tp"], "target_lufs": spec["lufs"], "target_tp": spec["tp"], "ok": ok}
-            extra["verification"] = [{"step": "loudness", "ok": ok, "platform": platform}]
+            extra["verification"] = [_loudness_step(ok, platform, spec, m)]
             if not math.isfinite(m["lufs"]):
                 # a silent output measures -inf LUFS: no gain reaches the target, so recommending
                 # (or running, under --normalize) loudness.py only returns "nothing to normalise"
@@ -305,9 +317,9 @@ def main() -> int:
                     _loudness_unmeasured(extra, notes, platform, spec, normalized=True)
                     ok = True  # nothing more to say about a level that was not measured
                 else:
-                    ok = abs(m["lufs"] - spec["lufs"]) <= spec["lufs_tol"] and m["tp"] <= spec["tp"]
+                    ok = abs(m["lufs"] - spec["lufs"]) <= spec["lufs_tol"] and m["tp"] <= spec["tp"] + TP_TOLERANCE_DB
                     extra["loudness"] = {"lufs": m["lufs"], "tp": m["tp"], "target_lufs": spec["lufs"], "target_tp": spec["tp"], "ok": ok, "normalized": True}
-                    extra["verification"] = [{"step": "loudness", "ok": ok, "platform": platform}]
+                    extra["verification"] = [_loudness_step(ok, platform, spec, m)]
                 if not ok:
                     notes.append(f"loudness is still {m['lufs']:.1f} LUFS / {m['tp']:+.1f} dBTP after loudness.py (target {spec['lufs']:g} LUFS / {spec['tp']:g} dBTP): {child.get('result', {}).get('note') or 'the encoder overshoots the ceiling'}")
                     warn(notes[-1], "loudness_outside_spec", platform=platform, lufs=m["lufs"], tp=m["tp"], normalized=True)
@@ -323,6 +335,8 @@ def main() -> int:
         notes.append(f"[dry-run] --normalize: loudness.py -I {spec['lufs']:g} --tp {spec['tp']:g} would run on the written file if it misses {platform}'s spec")
     if notes:
         extra["notes"] = notes
+    # the delivery keeps the source's picture and, except as a GIF, its sound
+    extra["expect_streams"] = {"video": bool(meta.get("video")), "audio": has_audio and args.preset != "gif"}
     emit(output, **extra)
     return 0
 

package/scripts/graphics.py

@@ -294,7 +294,7 @@ def main(force_route: Optional[str] = None) -> int:
         if explicit:
             return font_family_of_file(explicit) or args.font or brand.get("font")
         if script_file:
-            return font_family_of_file(script_file) or font_family_for_script(_script)
+            return _family or font_family_of_file(script_file) or font_family_for_script(_script)
         return args.font or brand.get("font", "DejaVu Sans")
 
     def ass_fonts_dir() -> "Optional[str]":

package/scripts/join.py

@@ -565,11 +565,21 @@ def main() -> int:
     verification = []
     if expected is not None and measured is not None and not STATE.dry_run:
         tol = max(1.5 / fps, 0.05)
-        verification.append({"step": "duration", "ok": abs(measured - expected) <= tol,
-                             "measured": round(measured, 3), "expected": expected, "tolerance": round(tol, 3)})
+        verification.append({"step": "duration", "property": "video_duration", "ok": abs(measured - expected) <= tol,
+                             "measured": round(measured, 3), "expected": expected,
+                             "delta": round(measured - expected, 3), "tolerance": round(tol, 3),
+                             "provenance": "input_premeasurement"})
+    # a clip with no audio stream is joined over generated silence: the join is right to do that, but
+    # the report must say which clips' sound is not theirs (the paper's join finding: absence was
+    # filled and nothing in the result showed it)
+    substituted = [p for p, m in zip(args.inputs, metas) if not m.get("audio")]
+    if substituted:
+        STATE_NOTES.append(f"{len(substituted)} clip(s) had no audio stream; their span of the join is generated "
+                           "silence: " + ", ".join(os.path.basename(p) for p in substituted))
     info(f"wrote {output} ({fmt_secs(measured)}, {expected_text(expected)}, {w}x{h} @ {fps:g}fps, {n} clips, {args.transition})")
     emit(output, mode="video", **reported(), clips=n, transition=args.transition, expected_duration=expected,
-         verification=verification,
+         verification=verification, expect_streams={"video": True, "audio": True},
+         audio_substituted=substituted,
          dropped_non_av_streams=any(m.get("subtitle_streams") or m.get("data_streams") for m in metas))
     return 0
 

package/scripts/loudness.py

@@ -19,6 +19,7 @@ import os
 import re
 import sys
 
+from _platforms import TP_TOLERANCE_DB
 from _common import STATE, add_common, apply_common, emit, AUDIO_CODECS, audio_codec_for, default_output, die, ffmpeg_base, info, probe, require_tool, run, run_analysis, run_keeping_subtitles, dry_run_input_pending
 
 
@@ -128,7 +129,7 @@ def main() -> int:
     # integrated loudness -- reported, never hidden.
     ceiling, rounds = args.tp, 0
     steps = [] if bitrate_pinned or ext in AUDIO_CODECS and "aac" not in AUDIO_CODECS[ext] else [b for b in ("256k", "320k") if _kbps(b) > _kbps(bitrate)]
-    while not after.get("silent") and float(after["input_tp"]) > args.tp + 0.1 and rounds < 5:
+    while not after.get("silent") and float(after["input_tp"]) > args.tp + TP_TOLERANCE_DB and rounds < 5:
         rounds += 1
         overshoot = float(after["input_tp"]) - args.tp
         if steps:
@@ -152,7 +153,7 @@ def main() -> int:
         result["note"] = (f"integrated loudness is {float(after['input_i']) - args.lufs:+.1f} LU from the target because the "
                           f"true-peak ceiling had to absorb the encoder's overshoot; a lossless delivery (wav/flac) or a pinned "
                           f"higher --audio-bitrate keeps both")
-    if not after.get("silent") and float(after["input_tp"]) > args.tp + 0.1:
+    if not after.get("silent") and float(after["input_tp"]) > args.tp + TP_TOLERANCE_DB:
         die(f"true peak is still {float(after['input_tp']):.2f} dBTP after {rounds + 1} encodes (requested <= {args.tp:g}); "
             f"the encoder overshoots more than the loudnorm ceiling can absorb at this bitrate",
             kind="verification", output=output, result=result,
@@ -161,8 +162,12 @@ def main() -> int:
          measured={k: stats[k] for k in ("input_i", "input_tp", "input_lra", "input_thresh", "target_offset", "silent")},
          targets={"lufs": args.lufs, "tp": args.tp, "lra": args.lra},
          verification=[{"step": "loudness",
-                        "ok": bool(after.get("silent")) or (abs(float(after["input_i"]) - args.lufs) <= 1.0 and float(after["input_tp"]) <= args.tp + 0.1),
-                        "lufs": float(after["input_i"]), "tp": float(after["input_tp"]), "target_lufs": args.lufs, "target_tp": args.tp}])
+                        "ok": bool(after.get("silent")) or (abs(float(after["input_i"]) - args.lufs) <= 1.0 and float(after["input_tp"]) <= args.tp + TP_TOLERANCE_DB),
+                        "lufs": float(after["input_i"]), "tp": float(after["input_tp"]), "target_lufs": args.lufs, "target_tp": args.tp,
+                        "property": "loudness", "expected": {"lufs": args.lufs, "tp_max": args.tp},
+                        "measured": {"lufs": float(after["input_i"]), "tp": float(after["input_tp"])},
+                        "delta": {"lufs": round(float(after["input_i"]) - args.lufs, 2), "tp": round(float(after["input_tp"]) - args.tp, 2)},
+                        "tolerance": {"lufs": 1.0, "tp": TP_TOLERANCE_DB}, "provenance": "user_specified"}])
     return 0
 
 

package/scripts/silence.py

@@ -152,7 +152,10 @@ def resolve_filler(args, meta):
         # (or one that says "auto", which is no language either) keeps the English list it always had
         # the ISO 639-2 spellings of the languages that have a built-in list (the mux tag uses them)
         iso3 = {"eng": "en", "spa": "es", "deu": "de", "ger": "de", "fra": "fr", "fre": "fr",
-                "ita": "it", "jpn": "ja", "por": "pt"}
+                "ita": "it", "jpn": "ja", "por": "pt", "kor": "ko", "zho": "zh", "chi": "zh",
+                "rus": "ru", "nld": "nl", "dut": "nl", "pol": "pl", "tur": "tr"}
+        names = {"spanish": "es", "german": "de", "portuguese": "pt", "chinese": "zh", "mandarin": "zh",
+                 "dutch": "nl", "polish": "pl", "turkish": "tr"}
 
         def _code(value) -> str:
             value = str(value or "").strip().lower().replace("_", "-")
@@ -160,10 +163,13 @@ def resolve_filler(args, meta):
                 return ""
             # a regional tag names its primary language (ja-JP is ja); a three-letter code that is not
             # in the table stays as it is (est is Estonian, not the Spanish "es"); a word such as
-            # "english" is cut to its two-letter code
+            # "english" is cut to its two-letter code; a name whose first two letters are not its
+            # code ("spanish" is es, "chinese" zh) is looked up, as whisper's own language table spells it
             primary = value.split("-")[0]
             if primary in iso3:
                 return iso3[primary]
+            if primary in names:
+                return names[primary]
             return primary[:2] if len(primary) > 3 else primary
         spoken = _code((raw or {}).get("language")) if isinstance(raw, dict) else ""
         spoken = spoken or _code(transcription.get("language") or transcription.get("detected_language"))