fix: a reserved hole is addressed by the counters actually missing, not one past the frame that revealed them

src/acquisition.cpp

@@ -797,7 +797,13 @@ void Acquisition::reserve_hole(std::uint32_t missing, const Partition& part,
   Hole h;
   h.tick_begin = tick_;
   h.slot_begin = store.time().produced();
-  h.counter_first = last_counter_ + 1u;
+  // `lost` counts the packets missing *immediately before* the frame that revealed them
+  // (see `udps_frame_t::lost`), and the counter mark at the top of `on_data` has already
+  // moved `last_counter_` to that frame's own counter -- so the hole spans
+  // [counter - missing, counter). This read `last_counter_ + 1u`, which addressed a span
+  // one past the revealing frame and `missing + 1` too high: no late packet's counter could
+  // fall in it, so every backfill lookup missed and `backfilled` read 0 against 154 holes.
+  h.counter_first = last_counter_ - missing;
   h.packets = missing;
 
   double dt = part.base_dt;