fix(core): reordering no longer reads as packet loss — net late shards out of the loss estimate

Reversed/reordered delivery lets a FEC block reconstruct EARLY
(data + recovery >= k), counting still-in-flight shards into
fec_recovered_shards; window_loss_ppm then reported pure reordering as
loss, inflating LossReports — which size adaptive FEC and, since the
Automatic overhaul, feed the ABR controller (one severe window ends slow
start FOR GOOD, so a reorder burst could permanently kneecap a session's
climb).

Early reconstruct stays (it's the latency-right choice); the accounting
now nets it out. The reassembler counts a new fec_late_shards stat when a
parity-restored data shard ARRIVES after all — matched exactly: the
completed/abandoned-frame memory (ReassemblyWindow::completed, now a map)
remembers which shards each terminal frame reconstructed, and a late
arrival must match one (removed on hit), so wire duplicates of delivered
shards and stragglers of failed blocks count nothing. In-flight blocks
dedup via have_data. window_loss_ppm takes the late delta and estimates
from (recovered - late), saturating across window boundaries; both
callers (client core + probe) pass it.

The e2e reorder tests now assert the NET equals the true kill count in
both delivery orders, dup included (previously documented as a known
inflation). Not mirrored into the C-ABI PunktfunkStats — the loss windows
run in-core on every platform.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/client.rs

@@ -1934,7 +1934,8 @@ async fn worker_main(args: WorkerArgs) {
                                           // size FEC to the link. Suppressed during a speed test (its FLAG_PROBE filler would skew it).
         const ADAPT_REPORT_INTERVAL: Duration = Duration::from_millis(750);
         let mut last_report = Instant::now();
-        let (mut last_recovered, mut last_received, mut last_dropped) = (0u64, 0u64, 0u64);
+        let (mut last_recovered, mut last_late, mut last_received, mut last_dropped) =
+            (0u64, 0u64, 0u64, 0u64);
         // PUNKTFUNK_PERF: per-window pump observability — the Session's receive stage split
         // (recv / decrypt / reassemble+FEC, see `Session::take_pump_perf`) and completed-AU
         // inter-arrival jitter. Smoothness has no metric otherwise: jump-to-live counters only
@@ -2091,6 +2092,7 @@ async fn worker_main(args: WorkerArgs) {
                 let window_dropped = st.frames_dropped.wrapping_sub(last_dropped);
                 let loss_ppm = window_loss_ppm(
                     st.fec_recovered_shards.wrapping_sub(last_recovered),
+                    st.fec_late_shards.wrapping_sub(last_late),
                     st.packets_received.wrapping_sub(last_received),
                     window_dropped,
                 );
@@ -2117,6 +2119,7 @@ async fn worker_main(args: WorkerArgs) {
                 flush_in_window = false;
                 last_report = Instant::now();
                 last_recovered = st.fec_recovered_shards;
+                last_late = st.fec_late_shards;
                 last_received = st.packets_received;
                 last_dropped = st.frames_dropped;
                 if pump_perf_on {