Guertin’s July 13, 2023 Finding of Incompetency was filed under seal as a genuinely reasoned, individually authored order. Two hours later, the same text was filed again on the same docket as an “Order-Other.” Two embedded font binaries — byte-for-byte identical, always appearing together — were injected into the clone. Its revision count jumped by exactly two, reaching rev_count = 11, unique in the entire 4,225-document signed corpus. The exact same two font binaries appear in a 2021 order for an unrelated defendant on a different case — and are removed, going forward in time, from a second order rendered from the same Word template for a third unrelated defendant filed seven days later.
FINDING. Two TrueType font binaries — COLNXP+ArialMT (55,072 bytes, SHA-256 prefix 1fa67c75…) and Arial (916,684 bytes, SHA-256 prefix b50a0345…) — appear as a bonded pair in 1,130 documents across 196 cases and 77 defendant clusters, spanning January 7, 2020 through July 2, 2025. In both template events documented here, the two binaries move together: added to one document, removed from another, with the revision-count delta always exactly +2.
This is the Tracking-Font-C1 / C2 signature of the Hennepin County Fourth Judicial District template-injection pipeline, operating at document-object granularity.
Before the federal framing, before the object-hash data, before the coverage tables: Matthew Guertin describing the forensic findings on this page in his own voice, on the record, during a November 18, 2025 attorney-client meeting before Judge Danielle C. Mercurio. He names the 137-document Gordon Sharp metadata cluster, the July 13, 2023 clone set this page is built around, and the two 1024-bit-RSA ESolutions-signed documents that the federal motion argues are cryptographically void under federal standards.
On October 5, 2025, the appellant filed Document 21.1 in 8th Circuit Case 25-2476 — Motion for Judicial Notice of Unlawful State Proceedings and Fraudulently Signed Court Orders. The motion asks the court to take judicial notice under Fed. R. Evid. 201(b)(2) of the following facts:
The federal motion characterizes the July 13, 2023 Finding of Incompetency as a forged document, void ab initio. It identifies predicate acts under 18 U.S.C. §§ 371, 505, 1341, 1343, 1519, and 242 and argues that judicial immunity is stripped under Mireles v. Waco, 502 U.S. 9 (1991) because the forged orders are not “judicial acts” within the meaning of the doctrine but fabrications of record.
This page extends that motion at the object-hash layer. What the motion reads as signature forgery, the MCRO forensic database reads as template-pipeline font injection operating at document-object granularity across the Hennepin County Fourth Judicial District corpus. The two readings describe the same operation from two different forensic vantage points.
At the heart of this finding are two specific TrueType font objects. They are not visible glyph content used to render text on the page — they are embedded binary payload referenced from the PDF font dictionary. Every document that carries one carries the other; they move as a bonded pair. Their presence or absence is the pipeline signature.
The children_tracking_groups table catalogs this pair under TTF-C / C1 — the dominant template-pipeline font fingerprint. TTF-C / C1 is the most-reused font-group assignment in the corpus, appearing in 1,089+ documents. Every document in TTF-C / C1 carries both SHA-256 hashes above. Documents outside TTF-C / C1 do not.
The presence of the pair is the pipeline’s signature. The absence of the pair is the pre-pipeline or post-scrubbing state.
On July 13, 2023 the Hennepin County Fourth Judicial District entered a Finding of Incompetency in 27-CR-23-1886 (State of Minnesota v. Guertin). Two PDFs were filed. Both were rendered from the same Word template at the same instant — XMP create date 2023-07-13 15:58:23 UTC, identical to the second on both files. Both carry the XMP title Conservator (All Powers; Unlimited Duration), a conservatorship template label unique to these two documents in the entire 4,251-PDF corpus.
Both were signed by Referee George Borer (11:00:00 CDT) and Judge Michael K. Browne (12:13:34 CDT, 73 minutes later), plus 7 cloned ESolutions signatures (all stamped 14:57:12 CDT). Ten signatures on each document. Same signers. Same signing times to the second. Same v_obj references (Borer = 140 0 obj, Browne = 148 0 obj, ESolutions = 158 0 obj).
Both PDFs share Microsoft Word document_id = af03a228-aeb1-4472-bcad-86c4b1c16418. That document_id appears in exactly these two documents in the entire 4,251-PDF corpus — a private 1:1 pairing, not part of a large template family. A single Word source file produced exactly these two PDFs and no others. The instance_id values differ, confirming two distinct save events against the same Word source.
Row-hash comparison of the hashpack_rows table returns:
The two PDFs are the same 7-page order. The same signers at the same minutes. The same text content. What differs is the post-signature state: two additional revisions, the Tracking-Font-C1 / C2 pair injected, the itv_dss flag flipped, and the total file size more than doubled.
Both PDFs reference the same signature byte streams by v_obj identifier. The signed byte ranges are identical in size. But the documents grew substantially after signing, and the signature coverage percentages reflect that:
| Signer | v_obj | Doc 1A coverage | Doc 1B coverage | Delta |
|---|---|---|---|---|
| Borer, George | 140 0 obj | 37.76% | 17.42% | −20.34 pp |
| Browne, Michael | 148 0 obj | 53.36% | 24.62% | −28.74 pp |
| ESolutions Dev CA (sigs 3–9) | 158 0 obj | 61.50% | 28.38% | −33.12 pp |
| MCRO Watermark (sig 10) | 207 0 obj | 96.79% | 98.52% | +1.73 pp |
Every judge, referee, and ESolutions signature covers substantially less of the clone than of the source. The MCRO Watermark — applied last, at download time (April 30, 2024, 07:23:55 CDT) — covers the final state of both files. The coverage drop confirms that the ~596 KB of additional content in the clone was added after all ten original signatures were applied. The Tracking-Font-C1 / C2 pair accounts for 971 KB gross; the net file-size increase is 596 KB, consistent with font embedding plus structural changes to the PDF cross-reference table.
Exactly 827 days before Guertin’s July 13, 2023 clone, in April 2021, the same two font binaries appeared in an Order for Conditional Release in case 27-CR-20-20788 — defendant LAWRENCE DURHEIM (cluster 1518), filed April 8, 2021. Seven days later, on April 15, 2021, a second Order for Conditional Release was filed in a completely unrelated case, 27-CR-20-27550 — defendant RODRICK CARPENTER (cluster 268).
Both orders were rendered from the same Word template, created at the identical instant 2021-02-20 04:10:13 UTC — 47 days before Durheim’s filing, 54 days before Carpenter’s. Both share Word document_id = 78ea734e-77dc-410f-b340-fcd5036afb56, and this document_id appears in exactly these two documents in the entire 4,251-PDF corpus. A single Word file produced exactly two PDFs, filed across two unrelated defendants’ cases seven days apart.
Both orders were signed by the same judge, Carolina Lamas. Both carry the itv_dss = true flag.
While Durheim’s order carries both Tracking-Font-C1 and C2, Carpenter’s order does not. In their place, Carpenter’s order carries one font object with SHA-256 prefix e668b6… that appears in exactly one document in the entire 4,251-PDF corpus. Present only in the variant that lacks the tracking fonts. Combined with the +2 revision jump, this is a perfect inverse relationship: tracking fonts swapped out, corpus-unique font swapped in.
Carpenter’s Order for Conditional Release received an ESolutions signature on 2021-04-16 at 08:46:12 CDT — the day after filing, 17 hours 39 minutes after Judge Lamas signed. This is the same “signed after filing date” pattern the federal motion documents on three of Guertin’s orders (Index #16, #81, #95). Only 134 of 4,251 PDFs in the corpus carry ESolutions signatures — a rare feature reserved for documents that passed through the template pipeline.
Compare the two events side by side. Both pairs share a Word-level document_id. Both show a rev_count delta of exactly +2 going forward in time. The Tracking-Font-C1 / C2 pair moves in opposite directions.
| Delta | Event A · Guertin (July 2023) | Event B · Durheim → Carpenter (April 2021) |
|---|---|---|
| Direction in time | forward (+1h 50m 41s) | forward (+7 days) |
| Defendant scope | Same defendant, one case, consecutive docket indexes | Two unrelated defendants, two cases, different clusters |
| Shared Word document_id | af03a228…16418 | 78ea734e…afb56 |
| XMP create timestamp | 2023-07-13 15:58:23 UTC (to the second) | 2021-02-20 04:10:13 UTC (to the second) |
| Template age at first filing | 0 days | 47 days |
| Tracking-Font-C1 / C2 pair | ADDED (absent in source, present in clone) | REMOVED (present in source, absent in clone) |
| rev_count delta | +2 (9 → 11) | +2 (8 → 10) |
| Coverage degradation | 20–33 pp on every original signature | Pair 2 has different signer counts; ESolutions layer added on clone |
Same two font binaries. Same +2 revision step. Opposite direction of font change. One operation stamps the pipeline signature onto a document that did not previously carry it; the other strips the pipeline signature off a document that did. Both operations are pipeline actions. They are the same pipeline, running in two directions 827 days apart.
The MCRO forensic database contains 4,251 children PDFs, of which 4,225 carry digital signatures. Two values measured in the four documents above appear in exactly one document each in the entire corpus.
| rev_count | Documents | Percentage | Cumulative % |
|---|---|---|---|
| 1 | 14 | 0.33% | 0.33% |
| 2 | 1 | 0.02% | 0.36% |
| 3 | 759 | 17.96% | 18.32% |
| 4 | 2,307 | 54.60% | 72.93% |
| 5 | 720 | 17.04% | 89.96% |
| 6 | 233 | 5.51% | 95.48% |
| 7 | 62 | 1.47% | 96.95% |
| 8 | 4 | 0.09% | 97.04% |
| 9 | 114 | 2.70% | 99.74% |
| 10 | 10 | 0.24% | 99.98% |
| 11 | 1 | 0.02% | 100.00% |
In Event A, the rarest value (rev_count = 11) lands on the clone that had fonts added. In Event B, the rarest value (the e668b6… font, appearing in exactly one document in the corpus) lands on the clone that had fonts removed.
One corpus-unique marker per event. Two events. The same template pipeline. Both events leave a one-in-the-corpus fingerprint on the document that passed through them.
Combine the four documents, the federal motion’s certificate-forgery framing, the 157-document Finding-of-Incompetency clone-template corpus, and the 1,130-document Tracking-Font-C1 / C2 population. A consistent operational reading emerges.
Typical Minnesota Fourth Judicial District signed orders carry rev_count 3–6 (95.48% of the signed corpus). A routine sequence: the Word file is saved (rev 1), converted to PDF (rev 2), receives a judicial signature (rev 3), and may receive an e-filing stamp (rev 4).
Documents with rev_count ≥ 8 account for only 3.05% of the signed corpus. All four documents on this page fall in that tail. The signed-corpus mode is rev_count = 4.
For documents entering the Tracking-Font-C1 / C2 population (1,130 docs, 26.6% of the full corpus), the pipeline introduces two additional post-signature revisions: one to inject the 971,756-byte font payload, one to finalize the resulting AcroForm / xref structure. Coverage percentages on the pre-pipeline signatures drop in proportion to the bytes added.
Documents leaving the Tracking-Font-C1 / C2 population (scrubbing direction) receive the same two additional revisions in reverse: strip the font payload, adjust the xref. Sometimes an ESolutions signature is layered on top as part of that operation.
Guertin’s Finding of Incompetency (Event A, source) is one of only two outliers in the entire 157-document Finding-of-Incompetency template corpus with substantive legal reasoning — 78% unique text rows, seven exclusive case citations including Bauer, 245 N.W.2d 848 and State v. Roberts, 876 that appear in no other Finding of Incompetency anywhere in the corpus. An individually reasoned order. The clone (Event A, target) is the same text refiled under a different filing_type label with the pipeline signature baked in — as though to create a docket twin that matches the template population statistically even while the source retains its individually reasoned content.
Rodrick Carpenter (Event B, clone) is already a named Aspose-cohort defendant — his August 15, 2022 Notice of Intent to Prosecute is one of the 17 documents sharing the February 26, 2019 15:05 UTC frozen Aspose creation timestamp documented on the Smoking Gun page. The April 2021 Conditional Release order on this page appears 15 months earlier, in a completely different case (27-CR-20-27550), under a completely different statutory mechanism. The pipeline signature, or its removal, travels with the cluster.
Treating the 2023 Guertin event as the canonical pipeline operation (Word template → signed PDF → font injection → rev_count +2), the 2021 event runs that sequence in reverse: signed PDF → font removal → rev_count +2 → ESolutions layer. “Backwards” not in the sense of time-reversed cause, but in the sense of template-preparation: taking a template-stamped document and stripping its signature before filing it for a different defendant in a different case. The 2021 event is 827 days earlier on the calendar. The 2023 event is the forward-running instance of the same pipeline.
Two specific TrueType font binaries — 971,756 bytes of always-together payload — appear in 1,130 Hennepin County court PDFs across 196 cases and 77 defendant clusters spanning five and a half years. Every document that carries one carries the other. Documents outside the Tracking-Font-C1 / C2 population do not.
On April 8, 2021, the pair is embedded in Lawrence Durheim’s Order for Conditional Release. Seven days later, on April 15, 2021, the pair is removed from Rodrick Carpenter’s Order for Conditional Release — a completely unrelated defendant, different case, rendered from the same Word template created at the same instant. Same judge. Same font pair. Revision count differential of exactly +2. The scrubbed clone receives a post-filing ESolutions signature the next morning.
On July 13, 2023 — 827 days later — the same two font binaries are injected into Matthew Guertin’s Order-Other clone, refiled under a different filing_type label on consecutive docket indexes 1 hour 50 minutes after the original Finding of Incompetency was signed. Same 10-signature stack. Revision count differential of exactly +2 — producing the only rev_count = 11 document in the entire 4,225-document signed corpus.
Either 1,130 MCRO PDFs coincidentally carry exactly the same 971,756-byte font payload because the Hennepin County Fourth Judicial District uses a Word template that happens to embed these two TrueType fonts, and the 2021 removal and 2023 addition are happening at the same template level with the same +2 revision signature as routine document maintenance — or there is a pipeline operating on specific documents at specific moments to stamp the same forensic signature onto orders that did not previously carry it and to strip that signature off of orders that did.
Both readings are damning. There is no third option.
The federal motion has already filed the forgery reading into the 8th Circuit record under Fed. R. Evid. 201(b)(2), asking the court to take judicial notice of the nine ESolutions-signed orders in Guertin’s case as void ab initio under the RSA-1024 cryptographic impossibility and the cloned-signature-object structural proof. What this page documents is the same operation at the font-object layer: two TrueType binaries moving as a bonded pair through 1,130 documents, two unrelated defendants receiving template operations 827 days apart, and two corpus-unique outliers — rev_count = 11 and an e668b6… font appearing in exactly one document — left behind as the pipeline’s fingerprint.
27 documents created by software that did not yet exist. Seven pre-existence creation dates. 17 Notices of Intent to Prosecute sharing a single frozen timestamp across 2.9 years.
Mechanism363 docket events. 313 cases. 172 defendants. 362 of 363 with no named prosecutor. All 363 with no named judge at the event row.
FrameworkThe 23-page statute that did not exist when Guertin’s prosecution began. “Neuroleptic” appears 37 times. “Rights,” “due process,” and “constitutional” appear zero times.
Signature CloningThe same Judge Barnette approval signature, byte-identical across 7 Rule 20.01 orders for 7 different defendants — issued under two different officers 521 days apart.
Every claim on this page is query-reproducible against the Supabase PostgreSQL forensic database (project ibfmjtwahkwqzcmeyqii, SELECT-only). The primary forensic report on these four documents is the Tracking-Font Injection & Revision-Count Anomalies report, with reproducible SQL queries in Appendix A and document provenance in Appendix B.