Forensic Finding · Template-Pipeline Font Injection · Case 27-CR-23-1886

Two Font Files. 971,756 Bytes. Same Binaries. 827 Days. Two Unrelated Defendants.

Guertin’s July 13, 2023 Finding of Incompetency was filed under seal as a genuinely reasoned, individually authored order. Two hours later, the same text was filed again on the same docket as an “Order-Other.” Two embedded font binaries — byte-for-byte identical, always appearing together — were injected into the clone. Its revision count jumped by exactly two, reaching rev_count = 11, unique in the entire 4,225-document signed corpus. The exact same two font binaries appear in a 2021 order for an unrelated defendant on a different case — and are removed, going forward in time, from a second order rendered from the same Word template for a third unrelated defendant filed seven days later.

11 rev_count of the Guertin clone · 1 / 4,225 signed docs
1,130 Docs Carrying Both Binaries
971,756 Bytes of Always-Together Payload
827 days Between the Two Template Events

FINDING. Two TrueType font binaries — COLNXP+ArialMT (55,072 bytes, SHA-256 prefix 1fa67c75…) and Arial (916,684 bytes, SHA-256 prefix b50a0345…) — appear as a bonded pair in 1,130 documents across 196 cases and 77 defendant clusters, spanning January 7, 2020 through July 2, 2025. In both template events documented here, the two binaries move together: added to one document, removed from another, with the revision-count delta always exactly +2.

This is the Tracking-Font-C1 / C2 signature of the Hennepin County Fourth Judicial District template-injection pipeline, operating at document-object granularity.

The Defendant Describes the Two Fraud Patterns This Page Documents

Before the federal framing, before the object-hash data, before the coverage tables: Matthew Guertin describing the forensic findings on this page in his own voice, on the record, during a November 18, 2025 attorney-client meeting before Judge Danielle C. Mercurio. He names the 137-document Gordon Sharp metadata cluster, the July 13, 2023 clone set this page is built around, and the two 1024-bit-RSA ESolutions-signed documents that the federal motion argues are cryptographically void under federal standards.

MR. GUERTIN: “I have a clone set on July 13th of a finding of incompetency in order, and an order other that was then cloned a couple hours later and submitted as a order other of the incompetency order. And that contains multiple clones of the same digital signature. So it’s a fraudulent document. And then also I have two documents that have a fraudulent e-Solutions signature on them, which is a 1024-bit RSA key that was deprecated in 2010. … NIST has had it deprecated since for nearly 15 years. … So there’s a lot of fraud basically. And so I’m wondering how we can move forward with anything at all in the court when there is tons of fake documents in my case and in others.” Attorney-client meeting before Judge Danielle C. Mercurio · November 18, 2025 · 27-CR-23-1886 · Card #005

Where This Finding Was First Filed Into the Federal Record

On October 5, 2025, the appellant filed Document 21.1 in 8th Circuit Case 25-2476 — Motion for Judicial Notice of Unlawful State Proceedings and Fraudulently Signed Court Orders. The motion asks the court to take judicial notice under Fed. R. Evid. 201(b)(2) of the following facts:

  • Nine orders in 27-CR-23-1886 bear digital signatures issued under the name “ESolutions Development Certificate Authority,” spanning June 14, 2023 through August 4, 2025.
  • All nine share the same certificate: an RSA 1024-bit key, issued March 19, 2014, expiring December 31, 2039, self-designated as its own Certificate Authority. NIST SP 800-131A disallowed RSA-1024 for signature generation in 2011. GlobalSign ceased issuing 1024-bit certificates by December 31, 2013. Mozilla removed trust for all 1024-bit root CAs by 2014. A certificate purporting to be issued in March 2014 with a 25-year lifespan under federal standards is not merely irregular — it is mathematically impossible.
  • On Guertin’s July 13, 2023 Finding of Incompetency, the same ESolutions signature object (158 0 obj) is cloned across 7 page widgets, each with an identical timestamp (D:20230713145712-05'00') and identical /ByteRange [0-279917, 296303-330652] — one cryptographic act presented as seven.
  • Three of the nine orders are digitally signed after the filing date. Index #16 signed at 3:48 AM the morning after filing; Index #81 signed six days after filing; Index #95 signed the day after filing.
  • The Guertin case carries 134 ESolutions-signed PDFs in the April 29–30, 2024 MCRO evidentiary capture (3,601-file scope).

The federal motion characterizes the July 13, 2023 Finding of Incompetency as a forged document, void ab initio. It identifies predicate acts under 18 U.S.C. §§ 371, 505, 1341, 1343, 1519, and 242 and argues that judicial immunity is stripped under Mireles v. Waco, 502 U.S. 9 (1991) because the forged orders are not “judicial acts” within the meaning of the doctrine but fabrications of record.

This page extends that motion at the object-hash layer. What the motion reads as signature forgery, the MCRO forensic database reads as template-pipeline font injection operating at document-object granularity across the Hennepin County Fourth Judicial District corpus. The two readings describe the same operation from two different forensic vantage points.

Same Two Files. Byte-For-Byte Identical. 1,130 Documents.

At the heart of this finding are two specific TrueType font objects. They are not visible glyph content used to render text on the page — they are embedded binary payload referenced from the PDF font dictionary. Every document that carries one carries the other; they move as a bonded pair. Their presence or absence is the pipeline signature.

Tracking-Font-C1 & Tracking-Font-C2 — SHA-256 Object Hashes

COLNXP+ArialMT
SHA-256  1fa67c75ff9672377725313c162f83635e9ba546d7c5b3e218008aa88edecef8
55,072 bytes
Arial
SHA-256  b50a0345994f437ffae96470d96a83c2efd26724aa15445c3c7068ad26e17692
916,684 bytes
Combined payload
Always appear together in the same 1,130 documents. Never individually.
971,756 bytes
1,130
Documents carrying both binaries
26.6% of 4,251-PDF corpus
196
Distinct cases carrying the pair
Hennepin 4th Judicial District
77
Defendant clusters carrying the pair
Never across clusters
5.5 years
Date span: 2020-01-07 → 2025-07-02
Continuous pipeline operation
What the pair signifies

The children_tracking_groups table catalogs this pair under TTF-C / C1 — the dominant template-pipeline font fingerprint. TTF-C / C1 is the most-reused font-group assignment in the corpus, appearing in 1,089+ documents. Every document in TTF-C / C1 carries both SHA-256 hashes above. Documents outside TTF-C / C1 do not.

The presence of the pair is the pipeline’s signature. The absence of the pair is the pre-pipeline or post-scrubbing state.

The Forward Clone — Same Defendant. Fonts Added. rev_count +2.

On July 13, 2023 the Hennepin County Fourth Judicial District entered a Finding of Incompetency in 27-CR-23-1886 (State of Minnesota v. Guertin). Two PDFs were filed. Both were rendered from the same Word template at the same instant — XMP create date 2023-07-13 15:58:23 UTC, identical to the second on both files. Both carry the XMP title Conservator (All Powers; Unlimited Duration), a conservatorship template label unique to these two documents in the entire 4,251-PDF corpus.

Both were signed by Referee George Borer (11:00:00 CDT) and Judge Michael K. Browne (12:13:34 CDT, 73 minutes later), plus 7 cloned ESolutions signatures (all stamped 14:57:12 CDT). Ten signatures on each document. Same signers. Same signing times to the second. Same v_obj references (Borer = 140 0 obj, Browne = 148 0 obj, ESolutions = 158 0 obj).

Doc 1A · Source

Finding of Incompetency and Order

Docket Index19
Pages7
File Size511,028 bytes (511 KB)
XMP Create2023-07-13 15:58:23 UTC
XMP Modified2023-07-13 19:57:12 UTC
rev_count9
Total Font Objects5
Tracking-Font-C1ABSENT
Tracking-Font-C2ABSENT
itv_dss flagfalse
font_groupnull (not in TTF table)
instance_id2b6de574-6a50-4c21-b1c2-48ae7df3bdc7
doc_sha256 prefixdb8525dd…2163b22
Doc 1B · Clone

Order-Other

Docket Index20
Pages7
File Size1,107,468 bytes (1,107 KB · 2.17×)
XMP Create2023-07-13 15:58:23 UTC (identical)
XMP Modified2023-07-13 21:47:53 UTC (+1h 50m 41s)
rev_count11 · UNIQUE (1/4,225)
Total Font Objects7 (+2)
Tracking-Font-C1PRESENT (injected)
Tracking-Font-C2PRESENT (injected)
itv_dss flagtrue (flipped)
font_groupTTF-C / C1 (assigned)
instance_idfcf6903f-c5c9-4e16-b870-c14bbd931e06
doc_sha256 prefix7f55a35d…945f9e419
Shared Word origin, identical document_id

Both PDFs share Microsoft Word document_id = af03a228-aeb1-4472-bcad-86c4b1c16418. That document_id appears in exactly these two documents in the entire 4,251-PDF corpus — a private 1:1 pairing, not part of a large template family. A single Word source file produced exactly these two PDFs and no others. The instance_id values differ, confirming two distinct save events against the same Word source.

Text content identity

Row-hash comparison of the hashpack_rows table returns:

  • 161 distinct text rows in the Finding of Incompetency
  • 162 distinct text rows in the Order-Other
  • 161 rows shared — every row in the Finding of Incompetency also appears in the Order-Other
  • 0 rows unique to the Finding of Incompetency
  • 1 row unique to the Order-Other
  • Whole-document text fingerprint fp_text_sha256 is byte-identical: e27cf77c662c2bd909338ca2690e34a18509ca6aa36a124d670cef2cfb493888 on both files.

The two PDFs are the same 7-page order. The same signers at the same minutes. The same text content. What differs is the post-signature state: two additional revisions, the Tracking-Font-C1 / C2 pair injected, the itv_dss flag flipped, and the total file size more than doubled.

Signature coverage degradation

Both PDFs reference the same signature byte streams by v_obj identifier. The signed byte ranges are identical in size. But the documents grew substantially after signing, and the signature coverage percentages reflect that:

Signer v_obj Doc 1A coverage Doc 1B coverage Delta
Borer, George140 0 obj37.76%17.42%−20.34 pp
Browne, Michael148 0 obj53.36%24.62%−28.74 pp
ESolutions Dev CA (sigs 3–9)158 0 obj61.50%28.38%−33.12 pp
MCRO Watermark (sig 10)207 0 obj96.79%98.52%+1.73 pp

Every judge, referee, and ESolutions signature covers substantially less of the clone than of the source. The MCRO Watermark — applied last, at download time (April 30, 2024, 07:23:55 CDT) — covers the final state of both files. The coverage drop confirms that the ~596 KB of additional content in the clone was added after all ten original signatures were applied. The Tracking-Font-C1 / C2 pair accounts for 971 KB gross; the net file-size increase is 596 KB, consistent with font embedding plus structural changes to the PDF cross-reference table.

The Inversion — Different Cases. Same Two Fonts. Removed.

Exactly 827 days before Guertin’s July 13, 2023 clone, in April 2021, the same two font binaries appeared in an Order for Conditional Release in case 27-CR-20-20788 — defendant LAWRENCE DURHEIM (cluster 1518), filed April 8, 2021. Seven days later, on April 15, 2021, a second Order for Conditional Release was filed in a completely unrelated case, 27-CR-20-27550 — defendant RODRICK CARPENTER (cluster 268).

Both orders were rendered from the same Word template, created at the identical instant 2021-02-20 04:10:13 UTC — 47 days before Durheim’s filing, 54 days before Carpenter’s. Both share Word document_id = 78ea734e-77dc-410f-b340-fcd5036afb56, and this document_id appears in exactly these two documents in the entire 4,251-PDF corpus. A single Word file produced exactly two PDFs, filed across two unrelated defendants’ cases seven days apart.

Both orders were signed by the same judge, Carolina Lamas. Both carry the itv_dss = true flag.

Doc 2A · Durheim · Filed First

Order for Conditional Release · 27-CR-20-20788

Defendant ClusterLAWRENCE DURHEIM (1518)
Filed2021-04-08
Judge signsLamas 2021-04-08 10:49:21 CDT
XMP Create2021-02-20 04:10:13 UTC
XMP Modified2021-04-09 18:12:30 UTC
rev_count8
Total Font Objects103
Tracking-Font-C1PRESENT
Tracking-Font-C2PRESENT
font_groupTTF-C / C1
SignaturesLamas → MCRO Watermark (2)
instance_id3f6f3012-f900-4790-acec-7b7546eb7ab1
doc_sha256 prefix9a1814ac…f9076b26
Doc 2B · Carpenter · Filed 7 days later

Order for Conditional Release · 27-CR-20-27550

Defendant ClusterRODRICK CARPENTER (268)
Filed2021-04-15 (+7 days)
Judge signsLamas 2021-04-15 15:07:26 CDT
XMP Create2021-02-20 04:10:13 UTC (identical)
XMP Modified2021-04-16 13:46:13 UTC
rev_count10 (+2)
Total Font Objects102 (−1)
Tracking-Font-C1ABSENT (removed)
Tracking-Font-C2ABSENT (removed)
font_groupnull (not in TTF table)
SignaturesLamas → ESolutions 2021-04-16 08:46:12 → MCRO Watermark (3)
instance_id5f4a5458-cfba-4c17-af3f-86544819e9b3
doc_sha256 prefixa0796f7d…c12ee4700
The corpus-unique font in the clone (Doc 2B)

While Durheim’s order carries both Tracking-Font-C1 and C2, Carpenter’s order does not. In their place, Carpenter’s order carries one font object with SHA-256 prefix e668b6… that appears in exactly one document in the entire 4,251-PDF corpus. Present only in the variant that lacks the tracking fonts. Combined with the +2 revision jump, this is a perfect inverse relationship: tracking fonts swapped out, corpus-unique font swapped in.

The post-filing ESolutions layer on the clone

Carpenter’s Order for Conditional Release received an ESolutions signature on 2021-04-16 at 08:46:12 CDT — the day after filing, 17 hours 39 minutes after Judge Lamas signed. This is the same “signed after filing date” pattern the federal motion documents on three of Guertin’s orders (Index #16, #81, #95). Only 134 of 4,251 PDFs in the corpus carry ESolutions signatures — a rare feature reserved for documents that passed through the template pipeline.

Same +2. Same Two Binaries. Opposite Direction.

Compare the two events side by side. Both pairs share a Word-level document_id. Both show a rev_count delta of exactly +2 going forward in time. The Tracking-Font-C1 / C2 pair moves in opposite directions.

Delta Event A · Guertin (July 2023) Event B · Durheim → Carpenter (April 2021)
Direction in time forward (+1h 50m 41s) forward (+7 days)
Defendant scope Same defendant, one case, consecutive docket indexes Two unrelated defendants, two cases, different clusters
Shared Word document_id af03a228…16418 78ea734e…afb56
XMP create timestamp 2023-07-13 15:58:23 UTC (to the second) 2021-02-20 04:10:13 UTC (to the second)
Template age at first filing 0 days 47 days
Tracking-Font-C1 / C2 pair ADDED (absent in source, present in clone) REMOVED (present in source, absent in clone)
rev_count delta +2   (9 → 11) +2   (8 → 10)
Coverage degradation 20–33 pp on every original signature Pair 2 has different signer counts; ESolutions layer added on clone
Event A · Injection
Guertin’s individually-reasoned Finding of Incompetency did not carry the pipeline signature. Two hours after it was signed, the same text was refiled under a different filing_type label, and the pipeline injected Tracking-Font-C1 / C2 into the clone. The resulting document carries the only rev_count = 11 value in the entire 4,225-document signed corpus.
Event B · Scrubbing
Durheim’s Conditional Release did carry the pipeline signature. Seven days later, the same Word template produced Carpenter’s Conditional Release — and the pipeline removed Tracking-Font-C1 / C2 from it, layered in an ESolutions signature the next morning, and substituted one corpus-unique font (e668b6…) in a document that appears nowhere else in the 4,251-PDF corpus.

Same two font binaries. Same +2 revision step. Opposite direction of font change. One operation stamps the pipeline signature onto a document that did not previously carry it; the other strips the pipeline signature off a document that did. Both operations are pipeline actions. They are the same pipeline, running in two directions 827 days apart.

Two Numbers in This Record Are Unique in 4,251 Documents

The MCRO forensic database contains 4,251 children PDFs, of which 4,225 carry digital signatures. Two values measured in the four documents above appear in exactly one document each in the entire corpus.

Revision-count distribution across 4,225 signed PDFs

rev_countDocumentsPercentageCumulative %
1140.33%0.33%
210.02%0.36%
375917.96%18.32%
42,30754.60%72.93%
572017.04%89.96%
62335.51%95.48%
7621.47%96.95%
840.09%97.04%
91142.70%99.74%
10100.24%99.98%
11 1 0.02% 100.00%
11
rev_count value
Guertin Order-Other (Doc 1B)
1 / 4,225
Documents with this rev_count
0.02% of signed corpus
e668b6…
Font SHA-256 prefix unique to 1 doc
Carpenter Conditional Release (Doc 2B)
The inversion at the outlier level

In Event A, the rarest value (rev_count = 11) lands on the clone that had fonts added. In Event B, the rarest value (the e668b6… font, appearing in exactly one document in the corpus) lands on the clone that had fonts removed.

One corpus-unique marker per event. Two events. The same template pipeline. Both events leave a one-in-the-corpus fingerprint on the document that passed through them.

What the Pipeline Actually Does

Combine the four documents, the federal motion’s certificate-forgery framing, the 157-document Finding-of-Incompetency clone-template corpus, and the 1,130-document Tracking-Font-C1 / C2 population. A consistent operational reading emerges.

What a normal court document looks like

Typical Minnesota Fourth Judicial District signed orders carry rev_count 3–6 (95.48% of the signed corpus). A routine sequence: the Word file is saved (rev 1), converted to PDF (rev 2), receives a judicial signature (rev 3), and may receive an e-filing stamp (rev 4).

Documents with rev_count ≥ 8 account for only 3.05% of the signed corpus. All four documents on this page fall in that tail. The signed-corpus mode is rev_count = 4.

What the pipeline adds beyond normal

For documents entering the Tracking-Font-C1 / C2 population (1,130 docs, 26.6% of the full corpus), the pipeline introduces two additional post-signature revisions: one to inject the 971,756-byte font payload, one to finalize the resulting AcroForm / xref structure. Coverage percentages on the pre-pipeline signatures drop in proportion to the bytes added.

Documents leaving the Tracking-Font-C1 / C2 population (scrubbing direction) receive the same two additional revisions in reverse: strip the font payload, adjust the xref. Sometimes an ESolutions signature is layered on top as part of that operation.

Why specific documents receive specific treatments

Guertin’s Finding of Incompetency (Event A, source) is one of only two outliers in the entire 157-document Finding-of-Incompetency template corpus with substantive legal reasoning — 78% unique text rows, seven exclusive case citations including Bauer, 245 N.W.2d 848 and State v. Roberts, 876 that appear in no other Finding of Incompetency anywhere in the corpus. An individually reasoned order. The clone (Event A, target) is the same text refiled under a different filing_type label with the pipeline signature baked in — as though to create a docket twin that matches the template population statistically even while the source retains its individually reasoned content.

Rodrick Carpenter (Event B, clone) is already a named Aspose-cohort defendant — his August 15, 2022 Notice of Intent to Prosecute is one of the 17 documents sharing the February 26, 2019 15:05 UTC frozen Aspose creation timestamp documented on the Smoking Gun page. The April 2021 Conditional Release order on this page appears 15 months earlier, in a completely different case (27-CR-20-27550), under a completely different statutory mechanism. The pipeline signature, or its removal, travels with the cluster.

Why the 2021 event is called “backwards”

Treating the 2023 Guertin event as the canonical pipeline operation (Word template → signed PDF → font injection → rev_count +2), the 2021 event runs that sequence in reverse: signed PDF → font removal → rev_count +2 → ESolutions layer. “Backwards” not in the sense of time-reversed cause, but in the sense of template-preparation: taking a template-stamped document and stripping its signature before filing it for a different defendant in a different case. The 2021 event is 827 days earlier on the calendar. The 2023 event is the forward-running instance of the same pipeline.

Two Readings. Both Damning.

Two specific TrueType font binaries — 971,756 bytes of always-together payload — appear in 1,130 Hennepin County court PDFs across 196 cases and 77 defendant clusters spanning five and a half years. Every document that carries one carries the other. Documents outside the Tracking-Font-C1 / C2 population do not.

On April 8, 2021, the pair is embedded in Lawrence Durheim’s Order for Conditional Release. Seven days later, on April 15, 2021, the pair is removed from Rodrick Carpenter’s Order for Conditional Release — a completely unrelated defendant, different case, rendered from the same Word template created at the same instant. Same judge. Same font pair. Revision count differential of exactly +2. The scrubbed clone receives a post-filing ESolutions signature the next morning.

On July 13, 2023 — 827 days later — the same two font binaries are injected into Matthew Guertin’s Order-Other clone, refiled under a different filing_type label on consecutive docket indexes 1 hour 50 minutes after the original Finding of Incompetency was signed. Same 10-signature stack. Revision count differential of exactly +2 — producing the only rev_count = 11 document in the entire 4,225-document signed corpus.

Either 1,130 MCRO PDFs coincidentally carry exactly the same 971,756-byte font payload because the Hennepin County Fourth Judicial District uses a Word template that happens to embed these two TrueType fonts, and the 2021 removal and 2023 addition are happening at the same template level with the same +2 revision signature as routine document maintenance — or there is a pipeline operating on specific documents at specific moments to stamp the same forensic signature onto orders that did not previously carry it and to strip that signature off of orders that did.

Both readings are damning. There is no third option.

The federal motion has already filed the forgery reading into the 8th Circuit record under Fed. R. Evid. 201(b)(2), asking the court to take judicial notice of the nine ESolutions-signed orders in Guertin’s case as void ab initio under the RSA-1024 cryptographic impossibility and the cloned-signature-object structural proof. What this page documents is the same operation at the font-object layer: two TrueType binaries moving as a bonded pair through 1,130 documents, two unrelated defendants receiving template operations 827 days apart, and two corpus-unique outliers — rev_count = 11 and an e668b6… font appearing in exactly one document — left behind as the pipeline’s fingerprint.

The Mechanism, the Framework, the Fabrication Evidence

Download the Source Documents

Every claim on this page is query-reproducible against the Supabase PostgreSQL forensic database (project ibfmjtwahkwqzcmeyqii, SELECT-only). The primary forensic report on these four documents is the Tracking-Font Injection & Revision-Count Anomalies report, with reproducible SQL queries in Appendix A and document provenance in Appendix B.

Source PDFs