# U2 capture correctness fixes

2026-10-01. Reviewed frozen baseline `66b934a`, `CLAUDE.md`, KTD2/KTD4 and U2 scenarios, capture adapter/tests, and installed Xcode-beta iOS SDK `CMMotionManager.h` lines 38–40. The header states stopping updates cancels all operations in the supplied operation queue. The cancellation correction follows that SDK contract; no hardware cancellation reproduction is claimed.

RED: Added three regressions before changing capture behavior, with simulator-only seams modeling sensor-queue cancellation and retaining a prior-generation callback. Focused simulator execution ran six tests with eight assertions/expectations failing across the three regressions. Ten valid tilted quaternion/matrix/gravity samples verified the mapping; subsequent ambiguous neutral matrix mismatch/nonfinite inputs left stale verification. A retained callback entered the restarted session (count 2 instead of 1). Canceling the shared queue during stop dropped queued snapshot and second-stop completions. Log: `/tmp/rideform-u2-fix-red.log`.

Fix: One shared motion manager retains one serial off-main sensor OperationQueue, now dedicated to Core Motion. A separate serial dispatch queue owns start/snapshot/stop, capture state, acceptance, diagnostic delivery, clock validation, and convention inspection. Sensor callbacks copy values and receipt uptime before asynchronously entering control/state; they never synchronously wait for that queue. Each start/stop advances a generation, and old-generation callbacks are rejected before affecting state. The stop boundary is execution of the serial control block: previously accepted records finish entering the consumer; later work is suppressed. A callback receipt can precede stop while its asynchronous handoff is queued after the stop block; such a record is outside the accepted boundary and is suppressed. The adapter does not count all hardware-delivered callbacks or claim zero hardware-delivered losses. Accepted rows are the consumer/writer obligation, and their receipt timestamp stays the original callback arrival time. Sensor cancellation cannot cancel pending controls. No acquisition filtering, throttling, interpolation, or stream merging was added.

Convention inspection now invalidates immediately on quaternion/matrix mismatch, nonfinite attitude/gravity/rate/acceleration vectors, or nonfinite derived residuals before the ambiguous-pose early return. Invalidity remains sticky until a new capture resets validation. Raw sample values remain preserved.

Focused command (isolated build output):

```sh
DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer xcodebuild -project RideForm.xcodeproj -scheme RideForm -destination 'platform=iOS Simulator,id=2315A3BD-AC4F-46A2-89E3-2C96AD7B1A37' -derivedDataPath /tmp/rideform-u2-fix-red -only-testing:RideFormTests/MotionCaptureTests CODE_SIGNING_ALLOWED=NO test
```

GREEN: six focused tests, zero failures; `TEST SUCCEEDED`. Evidence is recorded in `/tmp/rideform-u2-fix-green.log`. The focused suite covers initial stop completion, queued restart/snapshot/repeated stop under cancellation, stale-generation suppression, independent stream persistence/counts/sequence, clock validation, both convention directions, and immediate/sticky invalidation. Expanded fixtures also cover nonfinite rate, acceleration, and Euler attitude. An intermediate build caught a test initializer argument-order typo, corrected before the final run.

These are deterministic simulator workflow tests only. Coordinator-authoritative integrated app/package tests remain separate. Physical mounting/sign checks, sustained sensor/clock checks, fused/combined matched trials, and garage transitions remain human/device verification gates.