fix(client): timestamp probes after successful send

Moves the client userspace probe sent_at measurement to immediately
after a successful UDP send, improving raw RTT and the userspace
upstream-OWD fallback by excluding the socket send-call interval and
the small amount of local work preceding it.

All fallible probe-commit preflight (timeout deadline checked_add,
capacity/collision checks) still runs before the send, from a private
pre-send anchor (SessionMachine::finalize_probe_commit). The public
sent_at is now supplied afterward to an infallible
SessionMachine::commit_probe_sent, so DurationOverflow still guarantees
nothing was transmitted and a WouldBlock try_send still commits
nothing.

The operational probe timeout deadline stays anchored to the pre-send
timestamp on purpose, not to the new post-send sent_at, preserving
existing timeout/loss timing. Linux kernel TX_SOFTWARE plausibility
keeps its own pre-send wall-clock lower bound
(PendingProbe::tx_not_before_wall) instead of the post-send sent_at,
since a legitimate TX_SOFTWARE timestamp can be generated while the
send syscall is still in flight and would otherwise be wrongly
rejected.

Also flags (without touching production code) that irtt-stats'
ReplySample::from_reply_parts feeds the public sent_at directly into
IpdvSample.client_send_mono/client_send_wall_ns, so the upstream/send
IPDV component naturally shifts along with the sent_at semantics
change; per scope this is reported rather than compensated for.

crates/irtt-client/src/probe.rs

@@ -8,15 +8,38 @@ use crate::{error::ClientError, timing::ClientTimestamp};
 #[derive(Debug, Clone)]
 pub(crate) struct PendingProbe {
     pub wire_seq: u32,
+    /// Paired client wall/monotonic timestamp captured immediately after the
+    /// successful UDP send completed. This is the RTT endpoint (via
+    /// `compute_rtt`), the userspace fallback endpoint for upstream one-way
+    /// delay, `timer_error`'s basis, and the value surfaced on the public
+    /// `EchoSent`/`EchoReply`/`EchoLoss`/`LateReply` events. It is *not* the
+    /// input to `timeout_at` below — see that field's doc.
     pub sent_at: ClientTimestamp,
+    /// Operational timeout deadline, computed from the pre-send send
+    /// anchor's monotonic timestamp plus the configured probe timeout
+    /// (`SessionMachine::finalize_probe_commit`), not from `sent_at.mono`
+    /// above. Timeout semantics deliberately stay anchored to before the
+    /// socket send so that fallible deadline arithmetic (and its overflow
+    /// check) still runs, and a `PendingProbe` is only ever created, before
+    /// the datagram is transmitted.
     pub timeout_at: Instant,
+    /// Local wall-clock lower bound for validating an asynchronous Linux
+    /// kernel `TX_SOFTWARE` timestamp, sampled at the same pre-send send
+    /// anchor as `timeout_at` — i.e. before the socket send, not from
+    /// `sent_at.wall` above. A legitimate `TX_SOFTWARE` timestamp can be
+    /// generated during the send path and therefore observed earlier than
+    /// the post-send `sent_at.wall` sample; using this earlier pre-send
+    /// bound instead of `sent_at.wall` avoids rejecting such a timestamp
+    /// merely because userspace samples `sent_at` after `send()` returns.
+    /// See `compute_one_way`'s `preferred_send_wall`.
+    pub tx_not_before_wall: SystemTime,
     /// Observed Linux kernel TX_SOFTWARE wall timestamp for this probe's
     /// send, when the socket has TX timestamping enabled and a matching
     /// `MSG_ERRQUEUE` record has been drained. Optional observed metadata,
     /// eligible only for upstream one-way delay after local plausibility
-    /// validation (see `compute_one_way`'s `preferred_send_wall`). `sent_at`
-    /// remains authoritative for RTT, timeout, pacing/scheduling semantics,
-    /// and the userspace fallback for upstream one-way delay.
+    /// validation against `tx_not_before_wall` (see `compute_one_way`'s
+    /// `preferred_send_wall`). `sent_at` remains the userspace fallback for
+    /// upstream one-way delay when this is absent or implausible.
     pub kernel_tx_timestamp: Option<SystemTime>,
 }
 
@@ -386,10 +409,12 @@ mod tests {
     }
 
     fn pending(seq: u32, timeout_at: Instant) -> PendingProbe {
+        let sent_at = ts(timeout_at - Duration::from_secs(1));
         PendingProbe {
             wire_seq: seq,
-            sent_at: ts(timeout_at - Duration::from_secs(1)),
+            sent_at,
             timeout_at,
+            tx_not_before_wall: sent_at.wall,
             kernel_tx_timestamp: None,
         }
     }