fix(geo numerical): parse_hgt underflow/inf-grid (HIGH) + haversine asin-NaN; pointcloud confirmed-robust (NaN-poisoning class, 3rd find) (#1081)

* fix(geo numerical robustness): parse_hgt underflow panic + haversine asin-domain NaN

Targeted numerical-robustness audit of wifi-densepose-geo (ADR-154-class sweep).

Two real bugs, each pinned by a fails-on-old test:

1. terrain.rs parse_hgt — usize underflow panic on degenerate input.
   `side = sqrt(n_samples)`; for empty / sub-2x2 buffers side <= 1, so
   `1.0 / (side - 1)` underflows `usize` (panic "attempt to subtract with
   overflow" in debug; wraps to a huge value in release → garbage/inf
   cell_size_deg that poisons every ElevationGrid::get). A truncated HTTP
   body or a 404 HTML page reaches parse_hgt. Now bails with a clear error
   when side < 2.

2. coord.rs haversine — asin domain overflow → NaN for (near-)antipodal
   points. Floating rounding can push `h.sqrt()` to 1.0 + ~4e-16, and
   `asin(>1)` is NaN (verified: pair (-44.4994,-178.95722)→(44.49939999,
   1.04278001) yields h=1.0000000000000004). A NaN distance silently breaks
   all downstream `<`/`>` comparisons. Clamp into [0,1] before asin.

Also pins the ±90° pole-singularity (cos(lat)=0 division) as no-panic; the
ENU transform itself is unchanged (no behavior change for valid inputs).

Tests: wifi-densepose-geo 9→15 lib (6 new), 8 integration unchanged. 0 failed.

Co-Authored-By: claude-flow <ruv@ruv.net>

* test(pointcloud robustness): pin NaN-state-poisoning resistance + degenerate voxel fusion

Numerical-robustness audit of wifi-densepose-pointcloud. No bug found — the
crate is confirmed-robust against the proven NaN-state-poisoning class that bit
calibration/vitals. This adds regression pins documenting why:

1. csi_pipeline.rs — persistent auto-accumulating state (occupancy EMA,
   vitals) is provably self-healing. The UDP parser only emits finite
   amplitudes/phases (sqrt/atan2 of i8), and even an adversarial hand-built
   CsiFrame with NaN/inf amplitudes+phases cannot latch non-finite state:
   motion_score = (NaN/100).min(1.0) → 1.0; breathing path → 0 → clamp(5,40)
   → 5.0; tomography EMA uses only integer rssi. The new test injects 40
   poisoned frames and asserts occupancy/vitals stay finite AND the pipeline
   recovers to an in-range estimate afterward — so a future refactor that drops
   a `.min`/`.clamp` self-heal would fail this pin.

2. fusion.rs — fuse_clouds voxel averaging is div-by-zero-safe (per-voxel
   count >= 1 by construction). Pins empty / single-point / all-coincident
   inputs as no-panic with finite output.

No behavior change. Tests: wifi-densepose-pointcloud 18→22 (4 new), 0 failed.

Co-Authored-By: claude-flow <ruv@ruv.net>

* docs(geo/pointcloud robustness): CHANGELOG + ADR-154 sibling-crate sweep note

Record the wifi-densepose-geo + wifi-densepose-pointcloud numerical-robustness
audit under CHANGELOG [Unreleased] → Fixed, and a sibling-crate-extension note
on the ADR-154 horizon ledger (these crates are outside ADR-154's signal scope
but the sweep is the same ADR-154 class).

Co-Authored-By: claude-flow <ruv@ruv.net>

v2/crates/wifi-densepose-geo/src/coord.rs

@@ -15,7 +15,11 @@ pub fn haversine(a: &GeoPoint, b: &GeoPoint) -> f64 {
     let lat1 = a.lat.to_radians();
     let lat2 = b.lat.to_radians();
     let h = (dlat / 2.0).sin().powi(2) + lat1.cos() * lat2.cos() * (dlon / 2.0).sin().powi(2);
-    2.0 * WGS84_A * h.sqrt().asin()
+    // `asin` is only defined on [-1, 1]. For (near-)antipodal points floating
+    // rounding can push `h.sqrt()` to 1.0 + epsilon, and `asin(>1)` is NaN —
+    // which would silently poison any distance-based comparison downstream.
+    // Clamp into domain so the result is always a finite distance.
+    2.0 * WGS84_A * h.sqrt().clamp(0.0, 1.0).asin()
 }
 
 /// WGS84 to local ENU (East-North-Up) relative to origin, in meters.
@@ -83,3 +87,73 @@ pub fn tiles_for_bbox(bbox: &GeoBBox, zoom: u8) -> Vec<TileCoord> {
     }
     tiles
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // ── haversine asin-domain robustness ───────────────────────────────────
+    //
+    // For (near-)antipodal points, floating rounding can push the haversine
+    // term `h` to 1.0 + ~4e-16, and `asin(sqrt(h)) = asin(>1)` is NaN. A NaN
+    // distance silently breaks every downstream comparison (all `<`/`>` become
+    // false), so the result must stay finite. This exact pair produced
+    // h = 1.0000000000000004 pre-fix (verified empirically).
+
+    #[test]
+    fn haversine_near_antipodal_is_finite_not_nan() {
+        let a = GeoPoint {
+            lat: -44.4994,
+            lon: -178.957_22,
+            alt: 0.0,
+        };
+        let b = GeoPoint {
+            lat: 44.499_399_99,
+            lon: 1.042_780_01,
+            alt: 0.0,
+        };
+        let d = haversine(&a, &b);
+        assert!(d.is_finite(), "near-antipodal haversine must be finite, got {d}");
+        // Half-circumference is ~20_037 km; result must be close to that.
+        assert!(
+            (19_000_000.0..21_000_000.0).contains(&d),
+            "antipodal distance should be ~half-circumference, got {d}"
+        );
+    }
+
+    #[test]
+    fn haversine_identical_points_is_zero() {
+        let p = GeoPoint {
+            lat: 43.65,
+            lon: -79.38,
+            alt: 0.0,
+        };
+        let d = haversine(&p, &p);
+        assert!(d.is_finite() && d < 1e-6, "identical points → 0, got {d}");
+    }
+
+    // ── pole-singularity robustness (degenerate geometry) ──────────────────
+    //
+    // The ENU transforms divide by cos(lat); at the poles cos(±90°) = 0, so
+    // the longitude term is non-finite. We do not change the transform (that
+    // would alter near-pole results), but we pin that the call does NOT panic.
+
+    #[test]
+    fn wgs84_to_enu_at_pole_does_not_panic() {
+        let origin = GeoPoint {
+            lat: 90.0,
+            lon: 0.0,
+            alt: 0.0,
+        };
+        let point = GeoPoint {
+            lat: 89.99,
+            lon: 10.0,
+            alt: 0.0,
+        };
+        // Must return without panicking. North/up stay finite; east may be
+        // non-finite at the exact pole — assert the bounded components only.
+        let enu = wgs84_to_enu(&point, &origin);
+        assert!(enu[1].is_finite(), "north component must be finite");
+        assert!(enu[2].is_finite(), "up component must be finite");
+    }
+}

v2/crates/wifi-densepose-geo/src/terrain.rs

@@ -68,6 +68,21 @@ pub fn parse_hgt(data: &[u8], origin_lat: f64, origin_lon: f64) -> Result<Elevat
     let n_samples = data.len() / 2;
     let side = (n_samples as f64).sqrt() as usize;
 
+    // A valid SRTM grid is at least 2x2 — anything smaller has no cell spacing.
+    // Without this guard, `side - 1` underflows (panic in debug, wraps to a
+    // huge value in release) and `1.0 / (side - 1)` yields a garbage/inf
+    // `cell_size_deg` that then poisons every `ElevationGrid::get` lookup. A
+    // truncated download, a 404 HTML body, or an empty response can all reach
+    // here, so fail loudly instead of corrupting the persisted grid.
+    if side < 2 {
+        anyhow::bail!(
+            "HGT data too small: {} bytes ({} samples, side {}) — need at least a 2x2 grid",
+            data.len(),
+            n_samples,
+            side
+        );
+    }
+
     let heights: Vec<f32> = data
         .chunks_exact(2)
         .map(|c| {
@@ -129,3 +144,42 @@ pub fn extract_subgrid(grid: &ElevationGrid, center: &GeoPoint, radius_m: f64) -
         heights,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // ── parse_hgt degenerate-input robustness ──────────────────────────────
+    //
+    // Before the `side < 2` guard, an empty or sub-2x2 buffer made
+    // `1.0 / (side - 1)` underflow `side` (panic in debug / huge wrap in
+    // release) and produce a garbage `cell_size_deg`. A truncated download or
+    // a 404 HTML page reaches `parse_hgt`, so these must Err, not panic/poison.
+
+    #[test]
+    fn parse_hgt_empty_data_errors_not_panics() {
+        let res = parse_hgt(&[], 40.0, -75.0);
+        assert!(res.is_err(), "empty HGT must Err, got {res:?}");
+    }
+
+    #[test]
+    fn parse_hgt_single_sample_errors() {
+        // 2 bytes = 1 sample → side 1 → div-by-zero cell_size (inf) pre-fix.
+        let res = parse_hgt(&[0u8, 0u8], 40.0, -75.0);
+        assert!(res.is_err(), "1-sample HGT must Err, got {res:?}");
+    }
+
+    #[test]
+    fn parse_hgt_minimal_2x2_is_finite() {
+        // 4 samples = 8 bytes → side 2 → cell_size = 1.0 (finite, valid).
+        let data = vec![0u8; 8];
+        let grid = parse_hgt(&data, 40.0, -75.0).expect("2x2 HGT should parse");
+        assert_eq!(grid.cols, 2);
+        assert_eq!(grid.rows, 2);
+        assert!(
+            grid.cell_size_deg.is_finite() && grid.cell_size_deg > 0.0,
+            "cell_size must be finite positive, got {}",
+            grid.cell_size_deg
+        );
+    }
+}

v2/crates/wifi-densepose-pointcloud/src/csi_pipeline.rs

@@ -700,4 +700,79 @@ mod tests {
             assert!(conf > 0.7, "self-similarity should exceed match threshold");
         }
     }
+
+    // ── NaN-state-poisoning guard (the proven recurring bug class) ──────────
+    //
+    // The calibration/vitals crates were both bitten by a single non-finite
+    // sample latching into persistent state and freezing all outputs forever.
+    // Here the auto-accumulating persistent state is `occupancy` (an EMA:
+    // `*occ = *occ*0.7 + new*0.3`) and `vitals` (motion/breathing/heart).
+    //
+    // The UDP parser can only ever emit finite amplitudes/phases (sqrt and
+    // atan2 of i8 values), so the realistic ingress is already safe. This test
+    // is stronger: it injects an adversarial hand-built `CsiFrame` carrying
+    // NaN/inf amplitudes and phases (possible because the fields are public),
+    // and pins that the persistent state self-heals to finite values rather
+    // than latching NaN and silently freezing — i.e. the bug class is absent.
+    #[test]
+    fn nonfinite_frame_does_not_poison_persistent_state() {
+        let mut s = CsiPipelineState::default();
+        // Warm up with valid frames so vitals/occupancy are populated.
+        seed_state_with_frames(&mut s, 60);
+
+        // A valid baseline must be finite to start.
+        assert!(s.occupancy.iter().all(|d| d.is_finite()));
+        assert!(s.vitals.breathing_rate.is_finite());
+        assert!(s.vitals.motion_score.is_finite());
+
+        // Inject a stream of poisoned frames: NaN/inf amplitudes + phases on a
+        // valid header (node_id 1, finite rssi). Mimics a corrupt sensor.
+        for i in 0..40 {
+            let nan_frame = CsiFrame {
+                node_id: 1,
+                n_antennas: 1,
+                n_subcarriers: 32,
+                channel: 6,
+                rssi: -50,
+                noise_floor: -90,
+                timestamp_us: 10_000 + i,
+                iq_data: vec![0i8; 64],
+                amplitudes: vec![f32::NAN; 32],
+                phases: vec![f32::INFINITY; 32],
+            };
+            s.process_frame(nan_frame);
+        }
+
+        // Persistent auto-accumulating state must remain finite — a single
+        // poisoned frame (or 40) must not permanently corrupt outputs.
+        assert!(
+            s.occupancy.iter().all(|d| d.is_finite()),
+            "occupancy EMA must not latch NaN/inf"
+        );
+        assert!(
+            s.vitals.breathing_rate.is_finite(),
+            "breathing_rate must stay finite, got {}",
+            s.vitals.breathing_rate
+        );
+        assert!(
+            s.vitals.heart_rate.is_finite(),
+            "heart_rate must stay finite, got {}",
+            s.vitals.heart_rate
+        );
+        assert!(
+            s.vitals.motion_score.is_finite(),
+            "motion_score must stay finite, got {}",
+            s.vitals.motion_score
+        );
+
+        // And the pipeline must recover: feeding valid frames again yields a
+        // finite, in-range breathing estimate (not a frozen NaN).
+        seed_state_with_frames(&mut s, 60);
+        assert!(s.vitals.breathing_rate.is_finite());
+        assert!(
+            (0.0..=40.0).contains(&s.vitals.breathing_rate),
+            "breathing must be in clamp range after recovery, got {}",
+            s.vitals.breathing_rate
+        );
+    }
 }

v2/crates/wifi-densepose-pointcloud/src/fusion.rs

@@ -184,4 +184,43 @@ mod tests {
         let fused = fuse_clouds(&[&a], 0.5);
         assert_eq!(fused.points.len(), 1, "three close points → one voxel");
     }
+
+    // ── degenerate-input robustness (no panic, sensible output) ────────────
+    //
+    // These pin that the voxel accumulators handle empty / single / all-
+    // coincident inputs without dividing by zero or panicking. The per-voxel
+    // count is always >= 1 (the entry is created on first insert), so the
+    // `/n` averaging is safe — but make that contract explicit so a future
+    // refactor cannot silently reintroduce a div-by-zero.
+
+    #[test]
+    fn fuse_clouds_empty_input_is_empty() {
+        let fused = fuse_clouds(&[], 0.1);
+        assert!(fused.points.is_empty(), "no clouds → no points");
+        let empty = PointCloud::new("empty");
+        let fused2 = fuse_clouds(&[&empty], 0.1);
+        assert!(fused2.points.is_empty(), "empty cloud → no points");
+    }
+
+    #[test]
+    fn fuse_clouds_single_point_is_finite() {
+        let a = cloud_with("a", &[(1.0, 2.0, 3.0)]);
+        let fused = fuse_clouds(&[&a], 0.1);
+        assert_eq!(fused.points.len(), 1);
+        let p = &fused.points[0];
+        assert!(
+            p.x.is_finite() && p.y.is_finite() && p.z.is_finite() && p.intensity.is_finite(),
+            "single-point voxel must average to a finite point"
+        );
+    }
+
+    #[test]
+    fn fuse_clouds_all_coincident_collapses_finite() {
+        // Many identical points → one voxel, finite averaged centroid.
+        let a = cloud_with("a", &[(0.5, 0.5, 0.5); 100]);
+        let fused = fuse_clouds(&[&a], 0.25);
+        assert_eq!(fused.points.len(), 1, "coincident points → one voxel");
+        let p = &fused.points[0];
+        assert!((p.x - 0.5).abs() < 1e-4 && p.x.is_finite());
+    }
 }