tx.report at rate: attribute the coverage collapse (53% @ ~2.3k fps), deterministic SPE_RPT sampling, windowed RX receipts

[josephnef]

Context (measured, #359)

CCX report coverage is ~100% at 1 k fps and collapses to 53% at ~2.3 k fps (219,452 reports / 410,820 submitted) — while staying 100% on the retry-dropped population (no-ACK frames burn retries, throttling the sender so the fw reporter keeps up). Delivery still happened (ledger identity held delta-0), but half the frames get no per-packet verdict: any accounting scheme built on tx.report silently loses resolution exactly when the link is busiest.

Steps

1. [measure] Attribute the loss. Analyzer pass over the recorded drone.jsonl runs: sum the missed field deltas vs the unreported count — fw-emission drop vs C2H-path loss. Then a rate sweep (1/2/3/4 k fps) for the coverage-vs-rate envelope. One bench evening; changes what the fix can be.
2. [build] Deterministic sampling. DEVOURER_TX_REPORT=N semantics: SPE_RPT requested on every Nth descriptor (tag still stamped on all), so coverage becomes a designed 1/N with binomial confidence instead of load-dependent decay. Analyzer support for sampled ledgers.
3. [build] Windowed RX receipts — the truth tier. The ACK horizon is chip-FIFO admission and SIFS timing means it can never move (ARQ end-to-end delivery bench: three-ledger harness; count spsc-fat pool-exhaustion drops #359); end-to-end delivery truth belongs to the app layer. Receiver side: per-TA seq bitmap over a window (extend cell::UeRxAttribution); a compact receipt frame (own 802.11 data frame, versioned TLV) injected on the existing feedback path; TX side reconciles receipts into a delivered-set. Wire into duplex/txdemo for the bench.

Acceptance

• (1) coverage curve + attribution documented.
• (2) sampled mode measured on the bench: estimated delivery within CI of the rx.seq ground truth.
• (3) receipts agree frame-exactly with the DUT rx.seq ledger on tests/arq_e2e_delivery.sh — the receipt path is only useful if it is as trustworthy as the ledger it replaces in the field.

Refs: #359, docs/scheduled-mac.md (ACK/TxReport contract), cell::UeRxAttribution.

[josephnef]

Step 1 done (PR pending): the collapse is a fw CCX emission ceiling ≈1.3–1.4k reports/s (coverage ≈ min(1, ceiling/fps), fits all 4 measured points 1.0–2.4k fps); drops are per-report and interleaved (99.3% of unreported frames in tag gaps ≤2 — emission-time rate limiting, not transport-batch loss); MISSED_RPT_NUM is stuffed constant (4) on this fw even at 100% coverage — parse verified bit-exact against the 8822B/C/E vendor headers, so tag gaps are the only drop signal. Step 2 (SPE_RPT 1-in-N) is now precisely justified: pick N ≥ fps/1300 and coverage is deterministic.