fix: normalize GaussMarkov secondary seed to 32 bits [#1460]

[robotrocketscience]

• Tickets addressed: follow-up to coarseSunSensor senNoiseStd produces an unbounded random walk by default (walkBounds=-1 disables clamping; comment says the opposite) #1460
• Review: By commit
• Merge strategy: Merge (no squash)

Description

GaussMarkov::deriveSecondarySeed() (added in #1526, commit 8c0f4ba) XORs the base seed with a 64-bit discriminator:

constexpr uint64_t secondaryStreamDiscriminator = 0x9E3779B97F4A7C15ULL;
const uint64_t candidateSeed = baseSeed ^ secondaryStreamDiscriminator;

SysModel::RNGSeed is uint32_t (sys_model.h:50), so the returned value always carries 0x9E3779B9 in its upper word. Every consumer then narrows it with static_cast<std::minstd_rand::result_type>, and that type is std::uint_fast32_t, whose width is implementation defined. The secondary engine therefore seeds differently depending on the standard library Basilisk was built against:

	macOS 25.6 / Apple libc++	Linux (CachyOS) / libstdc++
sizeof(std::minstd_rand::result_type)	4	8
narrowed seed, default RNGSeed	0x0000000064e7b6c4	0x9e3779b964e7b6c4
first draw	128424993	1147871987

That contradicts the function's own contract at gauss_markov.h:54 ("Seed for a distinct, repeatable secondary random stream"). It affects the four derived streams: CSS fault noise (coarseSunSensor.cpp:40), IMU gyro error (imuSensor.cpp:36), and the magnetometer and tempMeasurement spike generators.

The fix masks both seeds to 32 bits so the narrowing casts are no-ops on every platform. The primary stream is untouched — it is seeded directly from the 32-bit RNGSeed.

Scope note

This is not a regression in observable noise values. The consuming distributions are implementation-defined regardless: from an identical engine state, std::normal_distribution yields -0.078154 on libc++ against -0.077279 on libstdc++, so per-platform noise output already differed and still will. What changes is that the engine seed is now derived identically everywhere, which is what the function documents.

A related pre-existing case is left alone deliberately: setRNGSeed() and initializeRNG() narrow a uint64_t seed the same way, so a caller passing a seed above 2^32 directly still gets platform-dependent behavior. That predates #1526 and changing it would alter existing results, so it seemed better raised separately than folded in here.

Verification

Built and run on Linux (GCC 16.2.1, Release):

• test_gaussMarkov: 7/7 pass, including the new secondarySeedIsPlatformIndependent.
• Mutation check — reverting only the mask and rebuilding makes the new test fail (6 pass / 1 fail), reporting first draw 1147871987 against the expected 128424993, and flagging every probe seed as wider than 32 bits. The test fails on both platforms without the fix, since the unmasked candidate is returned in full.
• Seed consumers: 63 tests pass across coarseSunSensor, magnetometer, imuSensor, starTracker and tempMeasurement unit tests.
• src/utilities/MonteCarlo/_UnitTests: 36 pass.
• test_saturate, test_discretize: pass.
• pre-commit on all four touched files: pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_012CrRpn7XEWBLLHagNPzQxP

[schaubh]

The seed-width diagnosis is correct for the current uint32_t sensor callers. Please address the two inline findings: preserve the public utility's distinct-stream guarantee for 64-bit input seeds, and qualify the release note's portability and compatibility claims.

Validation on the PR head: 7 GaussMarkov tests and 63 sensor tests passed. The 64-bit collision was reproduced on macOS with an explicit equivalent 64-bit linear congruential engine, rather than a native Linux build.

[schaubh]

Good catch. Found small edge case and documentation update that is needed.

[schaubh]

@robotrocketscience , I had addressed the two PR issues on this branch. Please let me know if you agree, I can then approve and merge this branch.

[schaubh]

@robotrocketscience , are you good with my edits?