fix(udps): stop packets being dated from an earlier time base

Reported as samples sporadically carrying a previous packet's timestamp:
holes on one side of the stream and collisions on the other, in both the
Go and the MARTe2 receiver. That it appeared in both is what located it
-- the shared cause is upstream of either client. Four independent
defects, all of which end in a packet's values being placed at a time
that is not theirs.

Reassembly slot exhaustion (the "Reassembly slots full; evicting oldest"
flood). Chunk size was learnt only from fragment 0, so an out-of-order
burst destroyed a packet whose bytes had all arrived and left the slot
occupied until the 2 s GC. Slots were keyed on the counter alone, but
DATA and CONFIG number independently, so equal counters merged the two
streams. The 32-byte received-mask covered 256 of the 512 fragments the
client accepts, so a duplicate above 255 was counted as new and the
packet was delivered with a hole of stale bytes in it. And one datagram
was read per Execute(), which cannot drain a fast producer. Fixed with a
pendingTail deferral, (counter, type) keying, a 64-byte mask, a
256-datagram drain, counter-age slot reclamation, and a 1 Hz aggregated
warning in place of the per-eviction flood.

UDPStreamer dropping whole Accumulate batches. EventSem::ResetWait is
Reset-then-Wait, so a Post() landing while the sender thread was inside
ServiceClients()/SendData() was destroyed by the next Reset. The batch
was then skipped with dataReady false, readyFill was never cleared, and
the following flush overwrote it: an entire run of RT cycles never
reached the wire. The record of pending work now lives in the buffers
rather than in the semaphore edge, which also removes up to
UDPS_DATA_WAIT_MS of latency; genuine backpressure overwrites are
counted and reported. Against the unfixed code the new test sees
2999/3000 batches never consumed.

Period inflation after loss. Accumulated scalars carry no SamplingRate,
so the receiver derives dt from the sender-clock gap -- but dividing it
by the previous packet's sample count is only right while nothing is
lost. One loss doubles the reported period, which spreads a batch a full
batch past its own end and into the range the next packet claims. That
is the hole and the collision, exactly. Inferring the cycle count from
the estimate's own period is not a way out: it has a stable fixed point
wherever gap/dt is an integer, so a real rate change locks it at the old
one for good (AccumDtGTest.FollowsSustainedRateChange).

The packet counter removes the ambiguity, so all three receivers now
order on it: a DATA packet that does not advance the counter is dropped
rather than delivered, because its values are older than data already
handed over. Ordering is on the signed difference so it survives the
uint32 wrap, and the sequence resets on reconnect, where the producer's
counter restarts independently of ours. The loss count that falls out of
the same delta feeds the period estimate as cycles = prevN * (1 + lost),
which reduces exactly to gap/prevN when nothing is lost and therefore
still tracks a genuine rate change. UDPSClient::AcceptDataCounter (C++),
udpsprotocol.SequenceGate (Go), decode_data (C).

The C client's existing gap counter was wrap-unsafe and let a stale
packet rewind last_counter, which made every subsequent gap wrong; it
uses the same code now. Docs/Protocol.md gains an Ordering DATA section
stating the requirement for any receiver, including ones outside this
repository.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Common/Client/go/wshub/hub.go

@@ -1216,15 +1216,24 @@ func (h *Hub) buildBinaryDataMessageForSource(src *sourceHubState, batch []udpsp
 				wallNs := s.WallTime.UnixNano()
 				wallSec := float64(wallNs) / 1e9
 				var dtSec float64
+				// A gap spans the elements of every packet that went missing
+				// inside it as well as this packet's own, so the divisor has
+				// to widen with it. Without this a single loss halves the
+				// apparent rate and the elements overrun into the next
+				// packet's range. The loss count belongs to the packet the
+				// gap ends at.
 				if bi+1 < len(batch) {
 					// Two consecutive packets in this tick → exact dt.
-					dtSec = (float64(batch[bi+1].WallTime.UnixNano()) - float64(wallNs)) / 1e9 / float64(n)
+					span := float64(n) * float64(1+batch[bi+1].Lost)
+					dtSec = (float64(batch[bi+1].WallTime.UnixNano()) - float64(wallNs)) / 1e9 / span
 				} else if bi > 0 {
 					// Last of multiple packets → use diff from previous.
-					dtSec = (float64(wallNs) - float64(batch[bi-1].WallTime.UnixNano())) / 1e9 / float64(n)
+					span := float64(n) * float64(1+s.Lost)
+					dtSec = (float64(wallNs) - float64(batch[bi-1].WallTime.UnixNano())) / 1e9 / span
 				} else if prevNs, ok2 := src.lastPktNs[sig.Name]; ok2 && prevNs > 0 && wallNs > prevNs {
 					// Single packet this tick → gap from the previous tick's packet.
-					dtSec = (float64(wallNs) - float64(prevNs)) / 1e9 / float64(n)
+					span := float64(n) * float64(1+s.Lost)
+					dtSec = (float64(wallNs) - float64(prevNs)) / 1e9 / span
 				} else {
 					// Truly first packet ever — inter-packet timing unknown.
 					// Skip to avoid poisoning the ring with wrongly-spaced timestamps;

Common/Client/go/wshub/packet_dt_loss_test.go

@@ -0,0 +1,139 @@
+package wshub
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"marte2/common/udpsprotocol"
+)
+
+// pktSignal is a 4-element array with no time signal and no declared sampling
+// rate, i.e. the TimeModePacket path where dt has to be inferred from the gap
+// between packets.
+func pktSignal(name string) udpsprotocol.SignalInfo {
+	return udpsprotocol.SignalInfo{
+		Name:          name,
+		TypeCode:      8, // float64
+		NumDimensions: 1,
+		NumRows:       4,
+		NumCols:       1,
+		TimeMode:      udpsprotocol.TimeModePacket,
+		TimeSignalIdx: udpsprotocol.NoTimeSignal,
+	}
+}
+
+// newPacketDtHub builds a Hub with a ring for one packet-timed array signal and
+// returns both. It does not start Run(): buildBinaryDataMessageForSource is
+// called directly so the timestamps it produces can be read back verbatim.
+func newPacketDtHub(t *testing.T, sigName string) (*Hub, *sourceHubState, *sigRing) {
+	t.Helper()
+	h := NewHub()
+	src := &sourceHubState{
+		id:                "s1",
+		signals:           []udpsprotocol.SignalInfo{pktSignal(sigName)},
+		timeSigCalib:      map[string]float64{},
+		lastPktNs:         map[string]int64{},
+		lastFrameMeasured: map[string]float64{},
+		lastFrameEndT:     map[string]float64{},
+		gapEMA:            map[string]float64{},
+	}
+	rb := newSigRing(4096)
+	h.rings["s1:"+sigName] = rb
+	return h, src, rb
+}
+
+// packet builds a one-signal batch entry arriving at t0 with the given loss
+// count; the values are irrelevant, only the timestamps are under test.
+func packet(sigName string, at time.Time, lost uint32, n int) udpsprotocol.DataSample {
+	vals := make([]float64, n)
+	return udpsprotocol.DataSample{WallTime: at, Values: map[string][]float64{sigName: vals}, Lost: lost}
+}
+
+// ringTimes returns the timestamps written to the ring, in order.
+func ringTimes(rb *sigRing) []float64 {
+	rb.mu.RLock()
+	defer rb.mu.RUnlock()
+	out := make([]float64, 0, rb.size)
+	start := (rb.head - rb.size + rb.cap) % rb.cap
+	for i := 0; i < rb.size; i++ {
+		out = append(out, rb.t[(start+i)%rb.cap])
+	}
+	return out
+}
+
+// A lost packet widens the inter-packet gap without adding elements to the
+// packet that follows it. Dividing the gap by that packet's element count
+// alone reports a period too long by exactly the number of packets missing,
+// which walks the elements past their own end and into the range the next
+// packet claims: they collide there, and the span they vacated stays empty.
+func TestPacketDtIgnoresLostPacketWidening(t *testing.T) {
+	const sig = "Wave"
+	const n = 4
+	const dt = 1 * time.Millisecond
+	base := time.Unix(1700000000, 0)
+
+	h, src, rb := newPacketDtHub(t, sig)
+
+	// One clean packet establishes lastPktNs.
+	h.buildBinaryDataMessageForSource(src, []udpsprotocol.DataSample{
+		packet(sig, base, 0, n)})
+
+	// The next producer packet is lost, so the one after it arrives a full
+	// extra batch later and reports Lost=1.
+	arrival := base.Add(2 * n * dt)
+	h.buildBinaryDataMessageForSource(src, []udpsprotocol.DataSample{
+		packet(sig, arrival, 1, n)})
+
+	ts := ringTimes(rb)
+	if len(ts) != n {
+		t.Fatalf("ring holds %d points, want %d (the first packet is skipped: no gap yet)", len(ts), n)
+	}
+	got := ts[1] - ts[0]
+	if !nearSec(got, dt.Seconds()) {
+		t.Errorf("dt = %v s, want %v s (the gap spans two batches, not one)", got, dt.Seconds())
+	}
+	// Elements run forward from the packet's own arrival, so a doubled dt
+	// would stretch this batch across two batch periods and into the range the
+	// next packet claims.
+	span := ts[len(ts)-1] - ts[0]
+	if !nearSec(span, float64(n-1)*dt.Seconds()) {
+		t.Errorf("batch spans %v s, want %v s: it overruns into the next packet's range",
+			span, float64(n-1)*dt.Seconds())
+	}
+}
+
+// nearSec compares two intervals in seconds. The hub carries timestamps as
+// float64 seconds derived from UnixNano, whose spacing near the current epoch
+// is a couple of hundred nanoseconds, so exact equality is not available. The
+// defect under test moves the period by a factor of two, three orders of
+// magnitude outside this tolerance.
+func nearSec(got, want float64) bool { return math.Abs(got-want) <= 1e-6 }
+
+// The correction must be driven by the reported loss and nothing else: with no
+// packet missing the period still comes straight from the gap, so a producer
+// that genuinely slows down is followed rather than second-guessed.
+func TestPacketDtFollowsGapWhenNothingIsLost(t *testing.T) {
+	const sig = "Wave"
+	const n = 4
+	base := time.Unix(1700000000, 0)
+
+	h, src, rb := newPacketDtHub(t, sig)
+
+	h.buildBinaryDataMessageForSource(src, []udpsprotocol.DataSample{
+		packet(sig, base, 0, n)})
+
+	// Same widened gap as the test above, but reported as no loss: the
+	// producer really is running at half the rate.
+	slowDt := 2 * time.Millisecond
+	h.buildBinaryDataMessageForSource(src, []udpsprotocol.DataSample{
+		packet(sig, base.Add(n*slowDt), 0, n)})
+
+	ts := ringTimes(rb)
+	if len(ts) != n {
+		t.Fatalf("ring holds %d points, want %d", len(ts), n)
+	}
+	if got := ts[1] - ts[0]; !nearSec(got, slowDt.Seconds()) {
+		t.Errorf("dt = %v s, want %v s: a real rate change must be followed", got, slowDt.Seconds())
+	}
+}

Common/Client/go/wshub/sources.go

@@ -341,6 +341,9 @@ func (u *UDPClient) runSession() error {
 	}
 
 	reassembler := udpsprotocol.NewReassembler(2 * time.Second)
+	// Per-session: the producer's counter restarts independently of ours, so
+	// the gate must not carry a counter over from the previous connection.
+	var gate udpsprotocol.SequenceGate
 	buf := make([]byte, readBufSize)
 	var currentSigs []udpsprotocol.SignalInfo
 	var currentPublishMode uint8
@@ -414,11 +417,20 @@ func (u *UDPClient) runSession() error {
 			if len(currentSigs) == 0 {
 				continue
 			}
+			fresh, lost := gate.Accept(hdr.Counter)
+			if !fresh {
+				continue
+			}
 			samples, err := udpsprotocol.ParseData(complete, currentSigs, currentPublishMode, arrivalTime)
 			if err != nil {
 				log.Printf("[%s] udp: parse data: %v", u.sourceID, err)
 				continue
 			}
+			// The gap precedes the packet, so it belongs to its first slot only;
+			// the slots after it are consecutive cycles of the same batch.
+			if len(samples) > 0 {
+				samples[0].Lost = lost
+			}
 			for _, s := range samples {
 				u.hub.PushDataForSource(u.sourceID, s)
 			}
@@ -589,6 +601,9 @@ func (u *UDPClient) runMulticastSession() error {
 	}()
 
 	reassembler := udpsprotocol.NewReassembler(2 * time.Second)
+	// Per-session, as in runSession(): a counter from the previous connection
+	// would reject the whole new stream.
+	var gate udpsprotocol.SequenceGate
 	buf := make([]byte, readBufSize)
 
 	for {
@@ -629,11 +644,18 @@ func (u *UDPClient) runMulticastSession() error {
 			if len(currentSigs) == 0 {
 				continue
 			}
+			fresh, lost := gate.Accept(hdr.Counter)
+			if !fresh {
+				continue
+			}
 			samples, parseErr := udpsprotocol.ParseData(complete, currentSigs, currentPublishMode, arrivalTime)
 			if parseErr != nil {
 				log.Printf("[%s] multicast: parse data: %v", u.sourceID, parseErr)
 				continue
 			}
+			if len(samples) > 0 {
+				samples[0].Lost = lost
+			}
 			for _, s := range samples {
 				u.hub.PushDataForSource(u.sourceID, s)
 			}