# One Wikimedia image through two Timeline Studio tracks

Recorded September 7, 2026. Timeline Studio source is pinned to commit `68980d142cce421eab86cd4ef26a4475a6affd56` (the prior article's reviewed snapshot), not the current checkout or a verified hosted release.

This case combines a real public Wikimedia search response and downloaded JPEG with an offline execution of the production mapping, drop, cache, visual-track, overlay, project-export and archive-read functions. No hosted browser session or final video render was performed for this case.

## What actually happened

1. A read-only Commons API query for `Earth NASA filetype:bitmap`, namespace 6, returned three records. The request used the production query fields with `gsrlimit=3` instead of the UI's 24. The complete response is `inputs/commons-search-response.json`; it contains an API warning that `derivatives` is not a recognized `imageinfo` property. The chosen image response is otherwise usable.
2. Commons page 233702, *Earth's City Lights by DMSP, 1994–1995 (large)*, supplied a creator, description page and `Public domain` label. The source page was also read, including its NASA public-domain statement for the United States. This is a historical composite, not a current Earth-at-night observation.
3. curl downloaded the API's exact 1280px thumbnail URL. The HTTP 200 JPEG is 125,060 bytes, 1280 × 640. SHA-256: `fd17c3ac48805c370605453b994bba01487303a878db4c6042f7a71b9ad19574`. `inputs/image-response.headers` preserves response headers after removing `Set-Cookie`, `X-Client-IP` and `X-Request-ID`; it is deliberately sanitized. `inputs/ffprobe-image.json` independently records the JPEG dimensions.
4. The offline runner replayed those exact JPEG bytes through production `getRemoteAssetBlob` and `createAssetDropActions`. The main visual track preserves provider, creator, sourceUrl, license and licenseUrl after the remote-placeholder update. The overlay constructor retains none of those five fields. Both tracks reuse the same cached Blob with one fetch call.
5. Production `useProjectFiles().handleExportProject()` created a real `.timeline` download. `readProjectArchive` reopened it; both embedded media entries have the input JPEG's SHA-256. Main-track source fields survive; overlay source fields remain absent. An additional overlay-only archive contains none of the five named provenance fields anywhere in its payload.
6. A separately controlled HTTP 503 response removed its preparing main-track segment and preserved the previous clip's content. That is a synthetic failure injected into production control flow, not a reported Wikimedia outage.

All assertions pass when those specific behaviors, including the omissions, are reproduced. Passing the verifier does not mean all product expectations pass.

## Reproduce offline

Install Node.js 22 or later, extract this kit, then run inside its directory:

```sh
node reproduce.mjs
```

No package installation, account, API key or network is needed. The runner writes only the kit's `results/` directory. It checks all 21 production/vendor file fingerprints before running. JPEG dimensions are read from its actual SOF marker, so the dimension mismatch assertion does not rely only on the filename or cached ffprobe report. Optional independent inspection:

```sh
ffprobe -v error -show_entries stream=codec_name,width,height -of json inputs/earth-city-lights-1280.jpg
```

`load-source.mjs` rewrites import locations to local data-URL modules and adds an export for the otherwise internal `mapCommonsPage`. Production function bodies remain unchanged. The complete reviewed source files and licenses are included under `upstream/`; their URLs and hashes are in `source-manifest.json`.

### Disclosed host substitutions

- `fetch` accepts only the selected asset URL and returns the recorded JPEG or the explicitly synthetic HTTP 503 response. Node's actual Response, Blob and object URL APIs run. CORS and real request/referrer behavior are not enforced by this replay.
- The selected record's Artist field is already plain text. The `document.createElement` substitute only passes plain text and throws if angle-bracket markup is present. This is not an HTML parsing test.
- React's `useCallback` returns the callback and `useRef` returns a mutable object. Unused hook APIs throw. Minimal in-memory state setters execute the actual production reducers; no React scheduling, DOM dragging or rendering is claimed.
- Icon imports are inert. The media decoding and smart-frame boundaries throw if invoked. `downloadBlob` captures the actual archive Blob, instead of opening a browser download prompt.
- The drop compatibility predicate accepts this known image on the two intended visual destinations. Track rejection, audio/video decoding, keyboard/pointer behavior and UI compatibility gating are outside scope.

The full raw image is never altered by this runner. Archive ZIP bytes and generated segment IDs can vary across runs because production uses timestamps and random IDs; source media hashes and the documented field-level results are the acceptance values.

## Inspect the delivered artifacts

- `results/media-provenance-case.timeline`: a four-second main image and four-second overlay, both containing the real JPEG. This is an editable archive, not a rendered or browser-reviewed video.
- `results/overlay-only.timeline`: same overlay with no main clip; demonstrates that merely saving the project does not reconstruct missing source fields.
- `results/reopened-project.json` and `results/overlay-only-project.json`: metadata parsed by the production archive reader.
- `results/source-ledger.json` and `results/credits.txt`: a deliberately separate source record prepared by this experiment. They are not an editor-generated credits feature and are not embedded automatically in the project.
- `results/verification-report.json`: exact mapped dimensions, normalized track state, retained media paths/hashes, request options, notifications, warnings, checks and boundaries.
- `results/execution-log.txt`: captured successful execution summary from the publication run.
- `acquisition.json`: public query, selected source, download URL and input fingerprints.

## Source record and practical interpretation

Image title: Earth's City Lights by DMSP, 1994–1995 (large).

Data: Marc Imhoff/NASA GSFC; Christopher Elvidge/NOAA NGDC. Image: Craig Mayhew and Robert Simmon/NASA GSFC.

Source page: https://commons.wikimedia.org/wiki/File:Earth%27s_City_Lights_by_DMSP,_1994-1995_(large).jpg

The individual source page marks this image public domain in the United States. The API's `LicenseUrl` is absent for this record, so the production mapper falls back to that description page. The saved ledger retains this distinction and a credit for traceability. It does not turn a source-page label into a universal permission decision for unrelated assets or uses.

The actionable finding is specific: retain a companion source record before placing this kind of library image in an overlay. In the tested snapshot, the main remote-drop update happens to preserve fields that the overlay constructor omits. A UI preview, a successfully downloaded JPEG and a successfully saved archive answer different questions. The case does not measure Pexels/Openverse availability, browser decode quality, final rendering or a hosted release.