# U2 independent frozen review

Reviewed commit `66b934a` on 2026-10-01. Scope: R1–R5, KTD2–KTD4/KTD8–KTD9, U2 scenarios and verification contract, `CLAUDE.md`, requirements brief, sensor API decisions, frozen adapter/clock/statistics/models/tests. No production edits, commits, device operations, or duplicate authoritative suites. U3 work is outside this review.

## Findings

**P2 — A detected matrix mismatch can leave the canonical convention verified.** Frozen `App/MotionCapture.swift:173–179` marks `matrixMismatch`, then returns when gravity cannot distinguish the directions. Assignment clearing `convention.verified` only occurs at line 187. Independent Swift checker extracted the unchanged method from the frozen commit: ten consistent 0.6-radian X-rotation observations establish verified identity mapping; next identity quaternion and gravity `(0,0,-1)` with matrix `m11=-1` produces `matrixMismatch=true, verified=true`. Expected: immediately unverified on a detected mismatch, regardless of ambiguous gravity. A snapshot/stop can expose the stale authorization indefinitely if subsequent observations remain neutral/yaw-only. Raw samples remain intact; the risk is allowing downstream calibration/analysis under a convention already contradicted by its own checker. Add this sequence as a regression and invalidate before the ambiguity return. No claim that a physical device produces this synthetic inconsistent matrix.

**P2 — Stop can cancel queued lifecycle operations without their completion.** Frozen `App/MotionCapture.swift:49–57,108–121` schedules snapshot/start/stop on the same OperationQueue supplied to Core Motion. Installed Xcode-beta iPhoneOS SDK `CoreMotion.framework/Headers/CMMotionManager.h:38–40` explicitly states that stopping updates cancels all operations in that queue and recommends a queue unused in other contexts. Given start already active, stop queued, and then next start/snapshot/another stop queued before first stop executes, the first stop may cancel those control operations. This loses the subsequent start or snapshot/stop completion, although the executing first stop's inline completion is safe. An isolated serial OperationQueue contract model with cancellation in the executing stop yielded only `["stop", "completion"]`; queued next start and snapshot completion never ran. This is documented-contract evidence and a deterministic Foundation reproduction, not an on-device Core Motion race reproduction. Keep lifecycle control immune to callback-queue cancellation or explicitly serialize new requests after stop completion; verify immediate restart and repeated stop completion behavior. The existing fixture bypasses real stop methods and cannot establish this property.

## Independent numeric evidence

Scratch directory: `/tmp/rideform-u2-independent`. Frozen Models.swift and SamplingStatistics.swift compiled with Xcode-beta `xcrun swiftc`, using a scratch module cache. `actual.jsonl` contains generated Swift outputs. `check.py` compares these against explicit analytical Python expectations at relative/absolute tolerance `1e-12`; all seven cases pass (69 field expectations).

| Input sensor times (seconds) | Key independent expectations | Result |
|---|---|---|
| 0 through 0.10 at 0.01 spacing | N=11, duration=.10, mean/median=100 Hz, population SD=0, p95/p99=.01 | Pass |
| 0,.01,.03,.06,.10 | mean/median=40 Hz, SD=sqrt(.000125), p95/p99=.04, zero gaps | Pass |
| 0,.01,.01,.005,.015 | two nonpositive intervals; positive summaries .01; mean=4/.015 per declared formula | Pass |
| 0,.01,.02,.12,.13 | mean=4/.13, median=100 Hz, SD=sqrt(.00151875), one gap=25%, nine estimated missing intervals | Pass |
| one sample at 1, receipt=1.2 | N=1; rates/duration/percentiles unavailable; validated delivery age=.2 | Pass |
| empty | N=0; rates/duration/percentiles unavailable | Pass |
| 1,1.01,1.02; receipts 1.02,1.03,1.22 | sensor rate remains 100 Hz; delivery ages .02,.02,.20 | Pass |

Original timestamps are untouched. Duplicate/backward timestamps inflate the declared endpoint mean formula, but are explicitly flagged/excluded from interval summaries; this matches the current documented definition rather than an undisclosed correction. Gap estimates are not writer-loss counts.

An isolated compile of frozen SessionClock.swift also passed ten-observation validation, sticky invalidation after progression discrepancy, and reset followed by revalidation. The fixed zero offset is transparent; sanity validation is not synchronization or physical latency proof. Raw-only validates gyro when present; if gyro is absent, mapping remains explicitly unvalidated instead of inferring mapping from accelerometer data.

## Other reviewed behavior and limits

One shared CMMotionManager, independent stream timestamps/sequence counts, .01-second requests, serial off-main callbacks, and synchronous consumer handoff preserve accepted records before the stop operation. Persistence still requires a separate writer queue and drain; U2 does not implement the U4 writer. Capabilities retain explicit unavailable reasons for frame/sensor/mode, acquisition errors are diagnostic records, heading is invalid for arbitrary frame, heading accuracy is runtime gated, and raw-only marks fused motion unavailable. No actionable loss of captured raw values was found in these paths.

Gravity evidence can distinguish identity from conjugate under nontrivial tilt while preserving the raw quaternion/matrix. Ten qualifying samples plus stringent residual checks are conservative compared with guessing a direction; identity/yaw-only cannot initially authorize it. Physical rider sign checks remain mandatory. The matrix-mismatch invalidation finding above must be resolved to preserve that conservatism after verification.

Matched physical fused-only/combined 30-second trials with UI/writer active, backlog/loss reconciliation, physical mounting/sign checks, interruptions, and garage transitions remain pending human/device gates. Simulator fixtures and this independent numeric review provide no hardware sampling or sensor-coexistence evidence.