fix(core): reordering no longer reads as packet loss — net late shards out of the loss estimate

Reversed/reordered delivery lets a FEC block reconstruct EARLY
(data + recovery >= k), counting still-in-flight shards into
fec_recovered_shards; window_loss_ppm then reported pure reordering as
loss, inflating LossReports — which size adaptive FEC and, since the
Automatic overhaul, feed the ABR controller (one severe window ends slow
start FOR GOOD, so a reorder burst could permanently kneecap a session's
climb).

Early reconstruct stays (it's the latency-right choice); the accounting
now nets it out. The reassembler counts a new fec_late_shards stat when a
parity-restored data shard ARRIVES after all — matched exactly: the
completed/abandoned-frame memory (ReassemblyWindow::completed, now a map)
remembers which shards each terminal frame reconstructed, and a late
arrival must match one (removed on hit), so wire duplicates of delivered
shards and stragglers of failed blocks count nothing. In-flight blocks
dedup via have_data. window_loss_ppm takes the late delta and estimates
from (recovered - late), saturating across window boundaries; both
callers (client core + probe) pass it.

The e2e reorder tests now assert the NET equals the true kill count in
both delivery orders, dup included (previously documented as a known
inflation). Not mirrored into the C-ABI PunktfunkStats — the loss windows
run in-core on every platform.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/tests.rs

@@ -707,15 +707,22 @@ fn loss_report_roundtrip() {
 #[test]
 fn window_loss_ppm_estimates_and_caps() {
     // No traffic → 0. A clean window (nothing recovered) → 0.
-    assert_eq!(window_loss_ppm(0, 0, 0), 0);
-    assert_eq!(window_loss_ppm(0, 1000, 0), 0);
+    assert_eq!(window_loss_ppm(0, 0, 0, 0), 0);
+    assert_eq!(window_loss_ppm(0, 0, 1000, 0), 0);
     // 50 recovered of 1000 total (950 received + 50 recovered) = 5%.
-    assert_eq!(window_loss_ppm(50, 950, 0), 50_000);
+    assert_eq!(window_loss_ppm(50, 0, 950, 0), 50_000);
     // An unrecoverable frame adds the +5% bump (push FEC past the current cap).
-    assert_eq!(window_loss_ppm(50, 950, 1), 100_000);
+    assert_eq!(window_loss_ppm(50, 0, 950, 1), 100_000);
     // A total-loss window with a drop but nothing received still reports the bump, capped at 1e6.
-    assert_eq!(window_loss_ppm(0, 0, 3), 50_000);
-    assert!(window_loss_ppm(u64::MAX, 1, 9) <= 1_000_000);
+    assert_eq!(window_loss_ppm(0, 0, 0, 3), 50_000);
+    assert!(window_loss_ppm(u64::MAX, 0, 1, 9) <= 1_000_000);
+    // Reordering: shards "recovered" early that then arrived are late, not lost — netted out, so
+    // a pure-reorder window reads 0. Partially late nets to the true loss (20 of 1000 = 2%).
+    assert_eq!(window_loss_ppm(50, 50, 1000, 0), 0);
+    assert_eq!(window_loss_ppm(50, 30, 980, 0), 20_000);
+    // `late` can outrun `recovered` across a window boundary (reorder straddling the report
+    // tick) or via a rare wire duplicate — saturate at a clean window, never underflow.
+    assert_eq!(window_loss_ppm(10, 25, 1000, 0), 0);
 }
 
 #[test]