[qmohsu]

Fixes the two Chapter 8 BLOCKERs from the ION GNSS+ pre-conference audit.

BLOCKER 1 — the shipped accelerometer was map-frame

imu.npz/accel_xy was np.gradient(v_xy)/dt written out unrotated, while
core/fusion/tc_models.py rotates u = [ax, ay, .] by the state yaw before
adding it to map-frame velocity — so every Chapter 8 filter rotated it twice.
Same defect Chapter 6's strapdown generator had; that chapter's guard listed
its two datasets by hand and had never covered Chapter 8.

residual of accel_xy vs	before	after
map-frame truth	[0.1002, 0.1001] (= declared 0.1)	[0.2193, 0.3872]
body-frame truth	[0.2228, 0.3913]	[0.1002, 0.1001]

All three datasets regenerated from their recorded recipes. Only accel_xy
moved — truth, gyro_z, uwb_ranges, uwb_anchors bit-identical, so the
RNG stream is undisturbed. Attribution established first per CLAUDE.md: with
the edit stashed, a clean-tree regeneration reproduced the shipped bytes
exactly.

BLOCKER 2 — P inflation after S made the covariance indefinite

AdaptiveGatingManager doubles P after S is formed for the gate; both
runners then built the gain from that stale S and applied the short form
(I − K H) P, valid only at the optimal gain. Measured on the corrected data
with the short form still in place:

run	min trace(P)	negative samples
LC, NLOS	−0.0123	11 / 6587
TC, NLOS	−2.10e+07	600 / 8271

core.fusion.tuning.kalman_update derives S from the covariance it is handed
(a stale S is not expressible) and uses the Joseph form (PSD at any gain). All
five hand-rolled sites now share it; the two in examples were correct copies
and are verified numerically inert.

Downstream — everything re-measured, both sides run this session

	before	after
TC RMSE	0.167 m	0.025 m
LC RMSE	0.143 m	0.027 m
TC mean |yaw err|	70.89°	2.23°
TC mean NIS (expect 1)	1.71	1.08
TC normalized-innovation std	1.307	1.037
TC innovation autocorr, lags 2/4/8	−0.52 / +0.63 / +0.46	−0.01 / +0.08 / +0.07

Three headline claims reversed, each recorded in place rather than quietly
replaced:

• The anchor-outage mirror-branch flip does not happen. The 43.9 m
  excursion was real, but what should have broken the two-fold ambiguity was
  the IMU prediction — which was also wrong. TC now peaks at 0.06 m and wins
  at all five windows checked. The test that pinned the flip now fails if it
  returns.
• Chi-square gating is the best method, not the worst. It was written up
  as "collapsing" to 24–26 m through a starvation loop. It is the only
  strategy here that tests its input against a distributional assumption, so
  it failed loudest under bad data and looked like the culprit. It now accepts
  95% of a clean run — its nominal confidence — and takes NLOS 0.680 → 0.033 m.
• The "LC NIS 1.93 vs Q-tuning" open item is re-attributed: TC's mean NIS
  is 1.14, so ~4/5 of the excess was the frame, not the process noise.

Robust thresholds re-decided by measurement, keeping the three-scenario
acceptance frame (clean not degraded / sporadic improved / persistent-NLOS
untouched). The clean tail collapsed (p99 14.51 → 2.73σ, max 17.23 → 3.76σ),
so the old "just above the measured maximum" rule now gives 4 — but δ=4 costs
10.0% on NLOS. δ=10 is the smallest value meeting all three criteria; Cauchy
50 → 20 by the same rule.

δ	clean	sporadic	NLOS
1.345	−3.7%	−92.8%	+16.2%
4	+0.0%	−90.0%	+10.0%
10	+0.0%	−81.0%	−0.3%

Guards, red before green

• Frame guard now discovers its datasets by scanning for an accelerometer
  rather than listing them. Red on the old bytes (std 0.3208 vs 0.15 bound).
  It also gained a second trajectory assertion, because the existing one is
  blind here — the broken rectangular walk integrates to an extent ratio of
  1.00; only the circle in Chapter 6 made that check bite.
• New test_covariance_stays_positive_semidefinite.py: both runners, both
  datasets, plus a guard-the-guard that the inflation branch still fires on
  NLOS (it fires zero times on the baseline now, so a baseline-only test
  would be vacuous).

Verification (all foreground)

tests/core/fusion + tests/ch8_sensor_fusion        243 passed
tests/docs/test_readme_example_output.py -k ch8      9 passed
tests/test_datasets_reproduce_from_their_recipe.py  43 passed
tests/test_repo_conventions.py + lint ratchet      483 passed
mypy/black/doctest guards                           28 passed
docs path/flag/module-form/architecture guards     708 passed

Nine transcripts re-pasted from real runs. Six figure sets regenerated and
every changed PNG opened — covariance panels now decay monotonically and never
cross zero. example_observability and example_calibration figures are
untouched, which is correct: neither reads the accelerometer.

Also fixed

The audit's MAJOR falsehoods, each re-measured on the fixed data: the TC mode
table (all four rows and a wrong "Best" bold), the extrinsic-alignment
residual (0.05 m against this same README's own correct 0.10 m derivation two
sections above), temporal-calibration gain 12.5% → 62.7% (kinematic bound
unchanged), "TC ~10-20% better" → measured 8%, the NLOS gating table, and
example_comparison's trade-off sentence — whose guard tested max_error
while the sentence also asserted something about mean_error.
docs/ch8_comparison_tool_summary.md was an empty 3-byte file that
docs/README.md advertised as documentation; it and its references are gone.

Suspected issues, not fixed here

• AdaptiveGatingManager harms persistent NLOS. example_tc_fusion
  measures 1.469 m with adaptive gating against 0.690 m ungated, because the
  manager reads permanent bias as its own mis-tuning: it inflates R on 97.5%
  of updates to its 5× ceiling, widening the gate until the biased ranges pass
  again. A plain 95% gate reaches 0.033 m on the same data. Design question,
  not a blocker.
• The Metrics Comparison bar panels in lc_tc_comparison and
  temporal_calibration_demo plot metres beside percentages on one linear
  axis, so the RMSE bars render at zero height. Pre-existing.
• core/fusion/tuning.py is not in the doctest allowlist; two of its
  docstrings (cauchy_R_scale, huber_weight) fail as pre-existing drift.
  The new kalman_update doctest passes.