added new property test for this mpfit regression.

Author: rocketmark

docs/property-tests.md

@@ -106,9 +106,12 @@ Fuzz math functions with adversarial and degenerate inputs to verify no crashes
 | `KabschCollinear` | Kabsch with collinear points doesn't crash, produces finite translation (rotation underdetermined) |
 | `KabschCoplanar` | Kabsch with coplanar points doesn't crash, produces finite pose (rotation underdetermined around normal axis) |
 | `LargeQuatNoOverflow` | `quatrotatevector` with very large quaternion components doesn't overflow |
+| `AggregateErrorOverCountGate` | `sqrtf(sum/cnt)` compared against a status gate: `cnt==0` must never take the success branch; finite `sum`/`cnt>0` always yields finite `sensor_error`; the gate's success/failure decision is self-consistent with `sensor_error <= max_cal_error` |
 
 `quatnormalize(zero)` and `normalize3d(zero)` produce NaN (documented, not a crash). Callers that may receive zero-magnitude input must guard against NaN propagation at their own boundary.
 
+`AggregateErrorOverCountGate` is a regression test for the `mpfit_nan_guard` gap (Stagehand project, `poser_mpfit.c::solve_global_scene`): two existing guards filtered non-finite *inputs* into the GSS error accumulator, but nothing checked the *output* of `sqrtf(stats.sensor_error / stats.sensor_error_cnt)` before the success/failure branch. When every measurement was filtered upstream, `sensor_error_cnt` reached 0, producing `NaN`, which compares false against any threshold — so a 0-measurement solve silently took the success branch and poisoned the Kalman filter. The test isolates the divide-then-gate arithmetic so any optimizer code with the same shape (`status_failure || !isfinite(x) || x > threshold`) is exercised without needing a full `SurviveContext`/GSS scene fixture.
+
 ### 6. Reprojection Residual / BSVD Pose Solver (`reproject_residual_props.c`)
 
 6 properties, 1,000 random trials each (6,000 total).
@@ -166,11 +169,11 @@ At the default threshold 0.0, sensors within 90° of the lighthouse are accepted
 | Reprojection | `reproject_props.c` | 13 | 65,000 |
 | Kabsch | `kabsch_props.c` | 5 | 25,000 |
 | Kalman Predict | `kalman_props.c` | 10 | ~74M steps |
-| Numeric Robustness | `numeric_props.c` | 10 | ~80,000 |
+| Numeric Robustness | `numeric_props.c` | 11 | ~90,000 |
 | Reprojection Residual | `reproject_residual_props.c` | 6 | 6,000 |
 | Event Queue | `event_queue_props.c` | 7 | ~3,500 |
 | Normal Filter | `normal_filter_props.c` | 3 | 30,000 |
-| **Total** | | **70** | |
+| **Total** | | **71** | |
 
 ## Running the Tests
 

src/test_cases/numeric_props.c

@@ -314,7 +314,63 @@ TEST(NumericProps, KabschCoplanar) {
 	return 0;
 }
 
-// 10. Large quaternion components don't cause overflow in quatrotatevector
+// 10. Aggregate-error-over-count gate: mirrors solve_global_scene()'s
+//     `sensor_error = sqrtf(sum / cnt); if (status_failure || !isfinite(sensor_error) || ...)`
+//     pattern. Any optimizer success path that divides an accumulated error
+//     by a measurement count must reject non-finite results — including the
+//     cnt==0 case, where 0/0 produces NaN that compares false against every
+//     threshold and would otherwise fall through to "success".
+//     Regression test for the mpfit_nan_guard gap: two upstream guards
+//     filtered non-finite *inputs* to the accumulator, but nothing checked
+//     the *output* of the division before the success/failure decision.
+TEST(NumericProps, AggregateErrorOverCountGate) {
+	unsigned seed = (unsigned)time(NULL);
+	srand(seed);
+
+	// cnt == 0: every measurement was filtered upstream (e.g. all NaN angles).
+	{
+		FLT sum = 0, cnt = 0;
+		FLT sensor_error = sqrtf(sum / cnt);
+		int status_failure = 0; // upstream solve "succeeded" on zero measurements
+		FLT max_cal_error = 1.0;
+		int took_success_branch = !(status_failure || !isfinite(sensor_error) || sensor_error > max_cal_error);
+		if (took_success_branch) {
+			fprintf(stderr, "AggregateErrorOverCountGate FAILED: cnt=0 took success branch "
+							"(sensor_error=%f)\n", sensor_error);
+			return -1;
+		}
+	}
+
+	// Random finite sum/cnt with cnt>0 must never spuriously fail the
+	// isfinite check, and the gate must be self-consistent regardless of
+	// where the threshold falls.
+	for (int trial = 0; trial < N_TRIALS; trial++) {
+		FLT sum = rand_range(0.0, 1e6);
+		FLT cnt = rand_range(1.0, 1e4);
+		FLT sensor_error = sqrtf(sum / cnt);
+		FLT max_cal_error = rand_range(0.0, 100.0);
+		int status_failure = 0;
+
+		if (!isfinite(sensor_error)) {
+			fprintf(stderr, "AggregateErrorOverCountGate FAILED (seed=%u, trial=%d): "
+							"finite sum=%f cnt=%f produced non-finite sensor_error\n",
+					seed, trial, sum, cnt);
+			return -1;
+		}
+
+		int took_success_branch = !(status_failure || !isfinite(sensor_error) || sensor_error > max_cal_error);
+		int should_succeed = sensor_error <= max_cal_error;
+		if (took_success_branch != should_succeed) {
+			fprintf(stderr, "AggregateErrorOverCountGate FAILED (seed=%u, trial=%d): "
+							"gate disagreement sensor_error=%f max_cal_error=%f\n",
+					seed, trial, sensor_error, max_cal_error);
+			return -1;
+		}
+	}
+	return 0;
+}
+
+// 11. Large quaternion components don't cause overflow in quatrotatevector
 TEST(NumericProps, LargeQuatNoOverflow) {
 	unsigned seed = (unsigned)time(NULL);
 	srand(seed);