Thank you!
That workaround is in fact what the app already does. It uses CLLocationSourceInformation to tell accessory fixes from the phone's own, keeps the last altitude it trusts, and carries it with CMAltimeter between fixes. It has been with my testers for abut one week and it works well. What I have learned since is where it gets hard, in case it is useful to anyone reading this later.
The anchor is the whole problem. CMAltimeter gives relative altitude, so the carry needs an absolute starting value, and the moment you would naturally take one — "before CarPlay connects" — often does not exist. On an affected car the app is frequently launched by the CarPlay connection itself, so its first fix is already the vehicle's. Across my fleet logs, 12 of 13 drives ended before CarPlay detached, so there is no phone fix at the end either. Some drives contain no phone fix at all. I now persist the last known altitude to a file and adopt it at launch if the car has not moved more than 50 m since it was written, which covers the common case of parking and driving off again.
Detecting "crazy" values is also harder than it looks, because the failure mode is not jumpy. An affected head unit reports exactly 0.0, with a positive verticalAccuracy, every second, for the whole drive. It is stable, plausible, and wrong. What catches it is not the altitude itself but the barometer: if the vehicle's altitude holds at exactly 0.0 while the phone's barometer says we climbed five meters and the car has left the spot, the reading is not a measurement. That rule cannot be built on 0.0 alone, since 0.0 is correct for a driver at sea level.
The phone is not always the safe source either. One tester's iPhone twice handed my app 1,823.8 m at a spot that is 271 m, with verticalAccuracy 30, the same value to the tenth of a meter five days apart — and Apple's Compass app showed the same number at the same spot. So the anchor needs its own sanity check; I now refuse a weak fix that disagrees with what the barometer has been tracking.
On door seals: in practice the carry has held up better than I expected. Re-anchor drifts on real drives are typically under two meters after twenty to thirty minutes of carrying.
On the DEM suggestion — agreed, and it is the direction I am heading. Measured against real drives, a 90m model agrees with a good phone fix to about 1.5m median. A worldwide set is about 7 GB, so it cannot ship inside the app, but regional tiles are a few megabytes.
One thing I noticed while capturing logs with Apple's Location Services profile, which may interest you: iOS already queries a DEM on every fix and logs the ground altitude with an uncertainty of 2.40m, alongside the vehicle's own value. It even appears to calibrate the barometric filter from it. None of that appears to be exposed to apps, which is a shame — it would be very handy right now to solve this problem.