feat(multistatic): make phase evidence explicit and gate coherent versus noncoherent fusion

Problem

The live multistatic bridge currently canonicalizes per node amplitude onto the 56 tone grid and constructs the corresponding phase vector as all zeros before passing the frame to MultistaticFuser.

That is a useful amplitude only compatibility path, but an all zero phase vector is not measured phase. If the downstream representation or a future consumer treats it as physically meaningful phase, the system can silently cross from noncoherent evidence into a coherent inference claim without the evidence needed to support that claim.

Fresh D MIMO ISAC research submitted 2026 08 27 makes the boundary explicit: coherent and noncoherent radio imaging have different synchronization regimes, and the preferred receiver changes with phase synchronization quality. Data aided asynchronous OFDM ISAC work from the same day independently shows that timing offset and carrier frequency offset can severely distort phase based sensing unless synchronization is modeled explicitly.

Research:

https://arxiv.org/abs/2608.27041

https://arxiv.org/abs/2608.27739

Why it matters

RuView is increasingly used as a multistatic sensing substrate. The live path must distinguish:

1. amplitude only evidence
2. measured but uncalibrated phase
3. sanitized phase
4. calibrated coherent phase
5. phase invalid because timing, CFO, calibration age, or clock quality is outside policy

A fabricated zero phase must never satisfy a coherent sensing requirement.

This is primarily a correctness and evidence quality issue. No sensing accuracy gain is claimed until real complex CSI and synchronization are measured on hardware.

Target repositories and packages

Primary:

v2/crates/wifi-densepose-sensing-server/src/multistatic_bridge.rs

v2/crates/wifi-densepose-signal/src/ruvsense/multistatic.rs

Related architecture:

docs/adr/ADR-138-linkgroup-array-coordinator-clock-quality.md

RuField freshness and evidence quality integration should reuse rufield-core after ruvnet/rufield PR 13 lands rather than creating a second timing policy system.

Current architecture

The server bridge:

1. selects a temporally coherent node cohort
2. chooses one timestamp domain for the cycle
3. canonicalizes amplitude to 56 tones
4. creates an all zero phase vector
5. sets single channel coherence to 1.0
6. invokes MultistaticFuser

Issue 1726 correctly fixed temporal cohort selection. Issue 1750 tracks freshness and aperture observability. This issue addresses a different dimension: whether the phase values themselves are real evidence and whether coherent processing is permitted.

Observed limitation

phase = vec![0.0; n_sub] is structurally indistinguishable from a real frame whose measured phase happens to be zero.

The current coherence scalar also represents single channel self coherence, not verified cross node phase coherence. It must not be used as proof that multiple radios share a valid phase reference.

Proposed architecture

Add an explicit phase evidence contract without changing raw RF storage semantics.

Suggested conceptual types:

pub enum PhaseEvidenceKind {
    Unavailable,
    MeasuredUncalibrated,
    Sanitized,
    Calibrated,
}

pub struct PhaseValidity {
    pub kind: PhaseEvidenceKind,
    pub timing_valid: bool,
    pub cfo_valid: bool,
    pub calibration_valid: bool,
    pub cross_node_coherent: bool,
}

pub enum MultistaticCombinerMode {
    Noncoherent,
    Coherent,
}

Exact wire placement should be decided in an ADR after checking compatibility with CanonicalCsiFrame, RuField, and any RVF persistence path.

Phase 1: honesty and gating

1. Mark the current sensing server bridge phase as Unavailable rather than semantically measured zero.
2. Default live amplitude only cohorts to Noncoherent processing.
3. Reject or abstain from Coherent mode unless every participating frame has acceptable phase evidence, timing quality, calibration validity, and one compatible phase reference.
4. Keep the existing amplitude person score path unchanged.
5. Expose aggregate phase validity and selected combiner mode in governed status and metrics. Do not expose raw phase over the normal status surface.

Phase 2: real complex CSI

1. Thread real I and Q or measured phase from the native CSI frame into the multistatic path.
2. Preserve native complex values locally before canonicalization.
3. Record phase sanitization and calibration transforms with provenance.
4. Measure CFO, timing offset, phase drift, and calibration age.
5. Permit coherent fusion only when the measured quality envelope passes policy.

Phase 3: measured coherent versus noncoherent benchmark

On the same real capture cohort compare:

1. amplitude only noncoherent baseline
2. measured phase noncoherent baseline
3. calibrated coherent fusion
4. deliberately phase corrupted coherent attempt, which must abstain or demote rather than appear valid

Expected measurable improvement

Phase 1 is a correctness improvement, not an accuracy claim.

Acceptance targets:

1. zero amplitude only frames can be reported as carrying measured or calibrated phase
2. coherent mode rejects every phase unavailable fixture deterministically
3. noncoherent results remain byte stable for existing amplitude only replay fixtures where the output contract is unchanged
4. future skew or timing incoherence cannot be repaired by phase mode selection
5. status and metrics overhead remains below 1 percent CPU and below 2 percent response bytes
6. p95 governed multistatic cycle latency regression remains below 2 percent

Phase 3 can define accuracy targets only after a real hardware baseline exists.

Dependencies

Existing multistatic fuser and issue 1726 temporal cohort selection.

RuField PR 13 for reusable freshness classification when merged.

ADR 138 clock quality concepts should be extended rather than duplicated.

No new external runtime dependency is required for Phase 1.

Security review

1. Treat phase, timing, and calibration metadata as untrusted sensor input until authenticated and bounded.
2. Malformed, nonfinite, or dimension mismatched phase must fail closed.
3. A client cannot set cross_node_coherent=true; it must be derived from trusted measurements and policy.
4. Replay or future timestamp evidence cannot renew calibration or coherence validity.
5. Do not weaken UDP source allowlisting or existing provenance checks.
6. Raw complex CSI remains P0 local data by default.
7. Bound metric labels to avoid cardinality exhaustion.
8. Coherent mode selection cannot lower privacy class or grant export permission.
9. Fuzz any new parser or wire extension that accepts complex phase or synchronization fields.

Privacy

Phase rich CSI may retain more fine grained biometric, localization, and environmental information than amplitude only derived state. Preserve the P0 edge boundary for raw complex measurements. Expose only bounded quality metadata by default.

Backward compatibility

Prefer additive metadata and an explicit combiner mode. Existing amplitude only hardware remains supported through the noncoherent path.

If a wire version must change, include deterministic migration and keep old replay fixtures readable. Do not reinterpret legacy zero phase arrays as measured phase.

Testing

Unit tests:

1. unavailable phase can use noncoherent mode
2. unavailable phase cannot use coherent mode
3. calibrated phase with valid synchronization can enter coherent mode
4. one invalid node demotes or rejects the coherent cohort according to policy
5. NaN and infinity reject
6. mixed phase evidence kinds fail closed for coherent mode

Property tests:

1. coherent implies every selected member is phase valid
2. selected node count never increases during phase quality filtering
3. noncoherent mode never reads phase values as a source of evidence

Regression tests:

1. current mixed width and mixed rate cohort fixtures
2. issue 1726 timestamp domain fixtures
3. issue 1750 freshness and aperture fixtures once available

Fuzz:

1. phase vector dimensions
2. complex sample conversion
3. calibration metadata
4. timing and CFO bounds

Benchmarks:

At least five repeated fixed replays for latency and allocation counts. Hardware phase experiments must report board model, firmware, AP or illuminator, room geometry, channel, sample rate, clock method, calibration method, number of runs, variance, and raw versus derived evidence class.

MetaHarness plan

Use stable metaharness v0.4.4 with a RuView specific evaluator. Darwin is allowed only for bounded threshold optimization after a real replay corpus exists. Hard gates are phase evidence correctness, zero security regressions, issue 1726 temporal correctness, latency budget, and unchanged noncoherent baseline behavior. Any mutation that obtains a better sensing score by relaxing the coherent evidence gate is invalid regardless of benchmark gain.

Rollback

Disable coherent mode and retain the explicit noncoherent amplitude path. Because Phase 1 should be additive, rollback should require no raw data migration.

Definition of done

A second engineer can run the existing amplitude only server, inspect the governed status and see that phase is unavailable and combiner mode is noncoherent, then replay a calibrated complex fixture and observe coherent mode only when synchronization and calibration gates pass. Deliberately corrupting phase, CFO, timing, or calibration must produce deterministic demotion or abstention rather than a coherent result.