{
  "id": "joseph_covariance",
  "title": "Joseph covariance update \u2014 PSD for any gain, 4 DSPs on silicon",
  "blurb": "The numerically-robust covariance step P+ = (I-K)P(I-K)^T + K R K^T \u2014 four 2x2 matrix products \u2014 time-multiplexed through ONE shared MAC. Proven to stay PSD for any gain (so recursing it is safe), and the whole four-product update costs 4 DSP48s on real fabric at 100 MHz (vs ~128 unrolled).",
  "emit_targets": 14,
  "proofs": [
    {
      "theorem": "kalman2_joseph_psd",
      "claim": "P+ = (I-K)P(I-K)^T + K R K^T stays symmetric positive-semidefinite for ANY gain K",
      "clean": true,
      "trail": "kalman2_joseph_psd.axioms.txt"
    },
    {
      "theorem": "fxerr_dot2_fullwidth",
      "claim": "the full-width scheduled dot's forward error is a single rounding (<= 2^-FRAC per dot)",
      "clean": true,
      "trail": "fxerr_dot2_fullwidth.axioms.txt"
    }
  ],
  "checks": [
    {
      "quantity": "P+ stays PSD over 500 random (P,R,K)",
      "value": "all PSD",
      "relation": "=",
      "bound": "PSD",
      "holds": true
    },
    {
      "quantity": "P+ off-diagonal symmetry (max |P01-P10|)",
      "value": "6.10e-05",
      "relation": "<",
      "bound": "1e-3",
      "holds": true
    }
  ],
  "silicon": [
    "joseph2_update",
    "seq_mac_fw"
  ],
  "silicon_hw": {
    "board": "Arty A7-100T",
    "clock_mhz": 100,
    "anchors": [
      [
        "joseph2_update",
        "+1.350"
      ]
    ],
    "summary": "4 DSP48s for the whole four-product update (vs ~128 unrolled); 6/6 cases bit-exact; closes 100 MHz after registering the shared operand mux.",
    "evidence_ref": "monogate-research/electronics_intake/joseph_arty/evidence/FINDINGS.md"
  },
  "closing": "**Proved, simulated, and on silicon.** The Joseph form is PSD-preserving for any gain (kalman2_joseph_psd, sorryAx-free) \u2014 the property that makes recursing the covariance safe \u2014 and the whole four-product update runs in 4 DSP48s at 100 MHz. The full-width dot's forward-error bound is re-derived against the scheduled accumulation order (fxerr_dot2_fullwidth, proven); the deployed per-product order is bit-identical to the unrolled matmul. The shared scheduler/operand-mux control is verified bit-exact (Verilator + silicon), not proven \u2014 see docs/streaming_kalman_filter.md \u00a74b."
}