# U4 independent artifact verification

2026-10-01. Independent reviewer inspected Models, SessionCodec, SessionIO, CSVExport, schema v1 and U4/R9/R12–14/AE2–3/KTD7. No device or simulator motion is hardware evidence.

## Actual independent evidence

Input: `/tmp/rideform-u4-export-2DCFBC03-B42C-4B8F-AD25-43E36E46B1AE` (real storage/export API fixture). Python standard-library `json`, `csv`, `zipfile`, `hashlib`, and `struct` parsed the generated outputs independently of Swift. Durable checker: `scripts/verify-export.py`.

| Check | Observed result |
| --- | --- |
| Archive CRC and exact bytes | PASS, 6 master files, exactly matching bundle names and bytes; no extra/duplicate ZIP entries |
| Motion | PASS, 2 rows × 42 cells |
| Accelerometer | PASS, 1 row × 6 cells |
| Gyroscope | PASS, 1 row × 6 cells |
| Events | PASS, 1 row × 8 cells |
| Calibration metadata | PASS, 1 row × 19 cells; full configuration JSON and calibration JSON match |
| Calibration inputs | PASS, neutral 1, left gesture 1, forward gesture 2; 42 cells per row |
| Total CSV | PASS, 10 rows, 291 cells |
| Manifest | PASS, full parsed metadata equality, each stream's accepted/written/loss counts reconcile, statistics counts and event count match |
| Numeric precision | PASS, binary64 bits compared for every captured numeric measurement, quaternion, all matrix cells, gravity, rates, acceleration, magnetic/heading values, receipt/sensor/event times and calibration metadata |
| Optional values and text | PASS, status/reason/raw code preserved, absent values stay empty; exact string equality after CSV parsing preserves fixture Unicode, commas, quotes and embedded newline |
| Checker sensitivity | PASS, copied CSV sensor timestamp changed to 99.0 fails with `motion.csv[0].sensor_timestamp_seconds_since_boot: binary64 differs` |
| Master unchanged by verification | PASS, hashes match `/tmp/u4-independent-master-hashes.json` on subsequent verification |

The checker compares independent stream row order and original timestamps without joining/resampling. Available-empty and unavailable remain distinct manifest capability states; zero-row CSV headers are checked. This fixture includes available/invalid magnetic and heading values, unavailable heading accuracy, and invalid heading accuracy without a value. It does not exercise every possible SDK/device state.

Command (replace the artifact root for future U8 device exports):

```sh
python3 scripts/verify-export.py \
  --bundle /tmp/rideform-u4-export-2DCFBC03-B42C-4B8F-AD25-43E36E46B1AE/11111111-1111-4111-8111-111111111111.rideform \
  --export-dir /tmp/rideform-u4-export-2DCFBC03-B42C-4B8F-AD25-43E36E46B1AE/CSV \
  --zip /tmp/rideform-u4-export-2DCFBC03-B42C-4B8F-AD25-43E36E46B1AE/master.zip \
  --hashes-before /tmp/u4-independent-master-hashes.json
```

Use `--hashes-out` before repeated exports, then `--hashes-before` after them to prove the same completed master was preserved. Repeated API exports against that same master are **pending authoritative verification**; separate fixture generations are not proof of this property. Strict artifact checking rejects unexplained loss; it does not claim to recover incomplete bundles.

## Recovery findings and resolution

Two concrete correctness failures were reported to the main coordinator from the initial source inspection:

1. **P1:** `SessionIO.load` never reconciled event count. A missing `events.jsonl` could silently return zero events while retaining the expected count and completed status if sensor rows remained intact.
2. **P1:** Sensor-tail recovery reduced written count but retained zero loss, making accepted ≠ written + loss and understating known missing rows.

The coordinator's actual RED evidence `/tmp/rideform-u4-red-recovery.log` reports expected events 0 versus actual 1, expected sensor loss 1 versus actual 0, and missing event mismatch diagnostic. The U4 worker corrected the source: event mismatch now marks incomplete, reports expected/recovered counts and unknown tail acceptance, and updates recovered event count; sensor mismatch preserves accepted count, updates written/loss, marks incomplete, and explicitly reports unknown tail acceptance. The coordinator reports final 19 core plus 2 targeted app tests GREEN. This independent role did not run authoritative Swift tests or edit production code.

## Source review boundaries

Writer mutations, timer checkpoints, enqueue operations and finalization serialize on one queue. Finalize flushes before reading/statistics and atomic manifest replacement; sealed writers reject checkpoint/finalize and ignore new enqueue. Pending data is retained on failed flush, successful stream writes clear only their own pending entries, and a failed partial append attempts truncation to the prior offset before retry. Real conflicting-directory retry is covered by the existing Swift test; forced mid-write failure/failed rollback and process death between flush and checkpoint have not been independently injected here. Count mismatches after reload must stay incomplete; any not-yet-checkpointed acceptance remains unknown.

Derived sidecars hash sorted-key session input and carry configuration plus algorithm version. `isCurrent` compares session ID, current configuration equality, and recomputed input hash; current tests exercise input and configuration changes. `configurationSHA256` is stored but not consulted by `isCurrent`, so it is descriptive metadata rather than a validated independent field. No sidecar artifact was generated for Python verification, and no sidecar artifact pass is claimed.

AE3 actual UI export cancellation/relaunch and mounted hardware checks remain their later integration/human gates. This report validates generated persistence/export evidence, not physical sensor fidelity.