# RideForm V0 verification matrix

Prepared 2026-10-01 against the original brief and unified plan. This is a verification contract, **not a record of passing results**. All execution and hardware gates below are pending until the coordinator attaches commands, output, artifact identities, and observations in `docs/execution-state.md` or an acceptance report. Simulator data is synthetic evidence only.

Run from the RideForm directory with `DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer`. Portable command: `swift test --package-path Packages/RideFormCore`. Build: `xcodebuild -project RideForm.xcodeproj -scheme RideForm -destination 'generic/platform=iOS Simulator' build`. App/UI tests use an actually installed simulator destination. These are intended commands; this document does not assert they have run.

## Requirements to evidence

| Requirement | Locally executable evidence | Physical/device evidence still required |
|---|---|---|
| R1 one manager, 100 Hz request, actual samples | Adapter ownership review; irregular callback fixture; persisted count/timestamp equality | iPhone delivered frequency and no unexplained writer loss |
| R2 complete fused fields/capabilities | SDK compilation; all fields round-trip, invalid/unavailable distinct from zero | Device values and capability/error records; arbitrary-frame heading invalid |
| R3 separate simultaneous raw streams | Different timestamp offsets survive serialization/export; capability failures retain fused data | Three matched fused-only and combined trials per mode; rates, p99, noise, delivery age, backlog/loss |
| R4 sampling statistics | Independent fixture calculation of count/duration/rates/min/max/population SD/nearest-rank p95/p99/gaps | Independent calculation from exported device streams; never label estimated intervals as known drops |
| R5 clock/boundary/event metadata | Clock names/units/anchors; delayed callback does not change sensor intervals; stop reconciliation | Validate sensor-to-host clock mapping at start/end; receipt age is not physical latency or cross-device synchronization |
| R6 multi-sample neutral | 2.5 s duration, quaternion hemisphere/wrap cases, moving/short input rejection; prior reference survives | Still neutral capture and repeat-neutral check |
| R7 oblique mount/rider axes | Known ±20° lateral/±15° forward/axial under oblique mounts recover within 0.1°; reject collinear gestures | Physical left/right/forward/back/axial sign checks; verify mount remains rigid |
| R8 recording controls/status | State/UI assertions for status/rates/count/elapsed/angles/indicator and large controls | Torso-mounted usability and live measured rate |
| R9 durability/interruption | Two sessions, relaunch/share cancellation, write failure, interrupted recovery, double stop/start; hash completed masters | Real backgrounding, relaunch, save-error presentation and share cancellation |
| R10 five markers | Every tap yields one labeled monotonic event inside boundaries | Inspect device event file after actual marker taps |
| R11 audible cues | Delayed dispatch records actual and scheduled times; stop cancels remaining sequence | Audible sequence and device event file; acoustic onset remains unmeasured |
| R12 versioned complete master | iPhone/Watch schema, metadata, calibration inputs, all independent streams/events and summaries; unknown-version rejection | Device/OS/app/frame/rate/capability metadata agrees with actual capture |
| R13 exact master/CSV export | Independent parser compares all counts/times/fields/Double round trips; CSV units/frames | Files/AirDrop export and reopen outside app |
| R14 reproducible separate analysis | Core builds without UIKit/Core Motion; configuration/version/input identity; repeat-run equality; input hashes unchanged | Representative exported device data independently recomputed |
| R15 timelines/boundaries | Fixture UI values/units, gyro velocity, irregular derivatives, acceleration and user acceleration, gap/marker overlays | Review device recording and identify uncertain boundaries |
| R16 phases/descriptors | Labeled synthetic outbound/hold/return/direct-side, overshoot/correction fixtures and gap/truncation flags | Independently labeled subset measures misses/false positives/onset error |
| R17 candidate smoothness | Analytic jerk/integration; units/normalization; spectral perturbation; unavailable short/gapped/near-zero cases; limitations visible | Inspect simple versus intentional-correction subsets without asserting validated rider quality |
| R18 distributions/asymmetry | Known left/right variance/distributions; missing side/near-zero returns unavailable; group outbound/return separately | Report observed samples/variance/asymmetry without a composite score |
| R19 diagnostics | Known stationary bias/noise/drift; movement excluded; insufficient data unavailable | Approximately 30 s stationary plus controlled slow/rapid movement protocol |
| R20 common Watch pipeline | Synthetic `apple_watch` fixture uses same package/analyzer; no platform imports in core | Watch target/runtime/hardware follow-up, not V0 proof |
| R21 comparison evidence | Format contains independent clocks/rates/noise/drift/onset/peak/range/smoothness/repeatability and configurations | Matched future Ultra 2 trials, mount equivalence, off-wrist/runtime checks, explicit latency limitations |
| R22 iPhone 16 Pro acceptance | Capture/reload/export accounting tools and labeled fixture | Install, roughly 50 transitions, relaunch/review/export; observed/labeled research report |

## Every planned unit scenario

IDs follow scenario order in the plan. Record an evidence artifact for each ID, including explicit pending hardware checks.

| Unit | Scenario obligations | Local versus physical gate |
|---|---|---|
| U1.1–4 | iPhone/Watch equivalence; difficult Double/asynchronous timestamp round-trip; empty versus unavailable/unknown schema; explicit nonfinite diagnostics | Package tests plus simulator shell build |
| U2.1–5 | Eleven samples/100 Hz fixture; irregular/duplicate/backward/empty/single timestamps; delayed callback age; independent raw offsets/capability reasons; stop race persisted counts | Local adapter/statistics/artifact tests; actual sampling/raw coexistence and clock mapping on device |
| U3.1–5 | q/−q and ±π; known oblique rotations/signs; motion/collinear rejection preserves reference; attitude/matrix agreement and reload; short calibration/recording recalibration blocked | Analytic fixtures and integration checks; U3.4 physical sign check mandatory |
| U4.1–5 | All fields/times through disk/CSV; two masters/share cancel/relaunch; save failure/retry; truncated tail recovery; buffered drain and current configuration identity | Persisted-file tests and independent CSV parser; actual Files/AirDrop/relaunch |
| U5.1–5 | Full state path/readouts; every marker; actual delayed cue time/cancellation; background interruption/idle restoration; UI durability/double taps | Simulator deterministic UI/app tests; real calibration/marker/cue/interruption/share and file inspection |
| U6.1–7 | Irregular analytic derivatives/jerk/integrals; phase fixtures; two corrections/overshoot exclude return; gap/noise/abort/direct-side/no hold; reproducibility/hash; asymmetry/unavailable; high-frequency perturbation and duration/amplitude normalization | Numeric package fixtures with declared tolerances; representative real metrics independently recomputed |
| U7.1–4 | All charts/overlays/gaps/summary fixture; stationary bias/noise/drift; insufficient data unavailable; reopened filter setting agrees with export, input unchanged | Rendered fixture/UI and diagnostics tests; stationary/controlled device capture |
| U8.1–4 | End-to-end exact reload/export; account for ~50 movements incl. misses/uncertainty; Watch-format pipeline; R21 fields and latency limitation | Local parsing/Watch fixture; installed iPhone garage trial and independent labels are human gates |

AE1 = U3 physical and synthetic mount checks; AE2 = U2/U4 irregular stream round-trip; AE3 = U4/U5 durability; AE4 = U6 phase/quality fixtures plus labeled device data; AE5 = U1/U2 unavailable capability records. DoD requires all rows, installation/garage/export, explicit analysis limitations, Watch readiness and setup/schema/axis/metric/API documentation. A favorable research conclusion is not a gate; complete evidence and an honest inconclusive conclusion are valid.

## Apple API checks and high-risk assumptions

Read-only SDK inspection and current Apple documentation were performed on 2026-10-01. Apple HTML pages expose Markdown links; content was retrieved from corresponding `.md` URLs when the web reader rejected that MIME type. No device observations were performed.

SDK root abbreviations: **I** = `/Applications/Xcode-beta.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/System/Library/Frameworks`; **W** = corresponding `Platforms/WatchOS.platform/Developer/SDKs/WatchOS.sdk/System/Library/Frameworks` directory.

| Topic and inspected source | Contract supported / assumption requiring evidence |
|---|---|
| [Attitude matrix](https://developer.apple.com/documentation/coremotion/cmattitude/rotationmatrix), [quaternion](https://developer.apple.com/documentation/coremotion/cmattitude/quaternion), [relative attitude API](https://developer.apple.com/documentation/coremotion/cmattitude/multiply(byinverseof:)); I/CoreMotion.framework/Headers/CMAttitude.h | Quaternion is x/y/z vector plus w scalar; matrix/quaternion represent attitude. Relative-attitude docs describe multiplying the reference inverse by the receiver; header describes receiver multiplied by inverse without specifying order. These inspected descriptions do **not** resolve active device→reference versus reference→device direction. Prove adapter conjugation/transpose with captured matrix/quaternion/gravity and physical ±axis gestures; noiseless self-consistent fixtures alone cannot prove Apple convention. Noncommuting neutral/current rotations must distinguish multiplication order. |
| [Sensor timestamp](https://developer.apple.com/documentation/coremotion/cmlogitem/timestamp), [systemUptime](https://developer.apple.com/documentation/foundation/processinfo/systemuptime); I/CoreMotion.framework/Headers/CMLogItem.h | Docs describe sensor seconds since boot; header identifies Mach absolute time. Uptime docs describe awake time since restart. Do not assume a continuous clock shares sleep behavior/epoch. Use and record an explicit clock mapping, test offset/drift/nonnegative receipt age across a sustained capture and interruptions; persist unavailable delivery age if mapping is unvalidated. Uptime use needs the applicable required-reason privacy manifest entry. |
| [Motion usage description](https://developer.apple.com/documentation/bundleresources/information-property-list/nsmotionusagedescription), [motion manager](https://developer.apple.com/documentation/coremotion/cmmotionmanager); I/CoreMotion.framework/Headers/CMMotionManager.h | Include usage description; manager has availability/active checks but no generic authorizationStatus member in inspected header. Do not borrow a pedometer/activity authorization status as proof of fused authorization. Test clean-install/restricted/denied behavior of APIs actually used and preserve callback failures. |
| [Heading](https://developer.apple.com/documentation/coremotion/cmdevicemotion/heading), [heading accuracy](https://developer.apple.com/documentation/coremotion/cmdevicemotion/headingaccuracy); I/CoreMotion.framework/Headers/CMDeviceMotion.h | Header returns negative heading for both arbitrary frames; accuracy added iOS 27 and negative accuracy is invalid. Gate optional access by runtime availability and preserve invalid/unavailable reason. Check Watch header/platform availability independently before port; do not assume availability from iOS declaration. |
| [Manager](https://developer.apple.com/documentation/coremotion/cmmotionmanager); I/CoreMotion.framework/Headers/CMMotionManager.h | One manager supports separate raw/fused methods; header explicitly permits starting types together. It does not guarantee unaffected achieved rates. Stop methods cancel queue operations: use dedicated sensor queue, ensure writer accepted records drain separately, test stop races and count boundaries. Execute KTD9 matched trials: combined fused mean decrease ≤5%, p99 increase ≤20%, zero writer loss; thresholds are provisional, investigate overlap/variance. |
| [Watch extended runtime](https://developer.apple.com/documentation/watchkit/using-extended-runtime-sessions); W/WatchKit.framework/Headers/WKExtendedRuntimeSession.h | Runtime must use a category fitting actual activity; foreground start, expiration/invalidation/resource errors matter. Docs describe screen-off continuation for eligible sessions, not this experiment's off-wrist validity. Verify Ultra 2 mounted at torso with screen off/off-wrist/lock/expiration in follow-up; no invented eligibility or workout/therapy entitlement workaround. |
| [Watch batched sensors](https://developer.apple.com/documentation/coremotion/cmbatchedsensormanager); W/CoreMotion.framework/Headers/CMBatchedSensorManager.h | Header declares watchOS 10 API, separate support/frequency/authorization and batch callbacks. This does not establish device support, delivered timing or V0 rate/latency. Query support and inspect per-sample timestamps on actual Ultra 2; compare batch receipt versus validity time and capture expiration/error records. |

Further independent-review targets: serial writer acceptance versus stop boundaries; nonfinite diagnostics preserving valid prior rows; completed-master immutability on retry/export/filter changes; sensor gaps never bridged by differentiation; gyroscope frame conversion kept distinct from Euler-angle derivative; detector duration ending before settled dwell; intentional return excluded from corrections; spectral grid/resampling disclosed as derived data; markers/cues never used as movement ground truth.

For authoritative frozen-output checks, retain input/master hashes, schema and analysis versions/configuration, generated CSVs and numeric expected values. Independently parse exact artifacts rather than reusing production serialization/statistics code. Record unresolved physical gates separately from passing software evidence.