feat(net): N5 - loss observability, lossy decorator, the connected loss gate

Campaign N Slice N5 (docs/plans/2026-07-29-network-transport-campaign.md
section 8 rung 3): the permanent removal of the loopback blindness that let
#260 ship. Local ACE never drops a datagram, so every historical connected
gate was structurally incapable of exercising the N1-N4 recovery machinery;
from this slice on, tools/run-connected-loss-gate.ps1 runs the standard
lifecycle route through deterministic seeded loss and passes only on proven
non-zero recovery.

Observability:
- [net-tick] gains resend/s nak-out/s nak-in/s rej-in/s dup-drop/s parked/s
  reclaim/s cache= nakset= - TransportStats window deltas mirroring the
  acks/s cumulative-delta pattern, plus the two instantaneous depths (the
  unbounded-like-retail sent-packet cache watchdog and the inbound NAK set).
  TransportStats gains RejectsReceived (inbound RejectRetransmit packets).
  Counters increment unconditionally; every string is behind
  NetDiagnostics.ProbeNet (Code Structure Rule 5).
- WorldSession.Dispose emits one cumulative [net-final] totals line so the
  loss gate asserts exact counters instead of reconstructing them from
  rounded per-second rates.
- LinkStatusSnapshot.PacketLossPercentage is deliberately NOT wired: filed
  #261 - retail's CLinkStatusAverages formula
  (LinkStatusHolder::GetPacketLossPercentage @ 0x00411370) must be located
  first; inventing a ratio is forbidden.

N4-review F3 fold-in:
- Fresh reliable sends stamp Header.Iteration = the session iteration
  through the same shared retail header build already cited for Time (N3)
  and the N4 control packets: FlowQueue::TransmitNewPackets @ 0x00547A60,
  the stack build at 0x00547A84/0x00547AA8. The control-header rule now
  holds across all three send shapes (fresh reliable, ack, NAK). ACE reads
  neither Time nor Iteration inbound (campaign section 3) - wire-safe, and
  resends keep the stamp verbatim per the N1 rebuild rule.

Loss injection (Transport/LossyTransportDecorator):
- IWorldSessionTransport wrapper with deterministic seeded per-direction
  loss. Config via NetDiagnostics typed env properties read once:
  ACDREAM_NET_DROP_PCT (0 = off = default), ACDREAM_NET_DROP_SEED (default
  1), ACDREAM_NET_DROP_DIR (out|in|both, default both).
- Arming gate: NOTHING drops in either direction until the decorator has
  FORWARDED the first ENCRYPTED outbound datagram - parse-free check on
  length > 20 with EncryptedChecksum set in the LE flags word at bytes
  4..8. The cleartext handshake always survives and the arming datagram is
  never a casualty; handshake-loss testing belongs to N6's ConnectResponse
  0.333 s retransmit.
- Structurally absent at 0%: WrapIfConfigured returns the raw transport -
  WorldSession's default factory is the only production seam and a normal
  run never constructs the decorator.

Root-cause fix the gate immediately exposed:
- The logoff-confirmation wait in Dispose processed inbound datagrams but
  never pumped the transport, so a lost S2C logoff confirmation was
  gap-detected but its healing NAK never went out. Retail's pump
  (Client::UseTime @ 0x00411C40 -> PacketController::UseTime @ 0x005410D0)
  runs until LogOffServer; the wait now sweeps per processed datagram,
  making the logoff wait the third covered blocking pump (after Tick and
  the handshake loops). A lost C2S logoff REQUEST remains unrecoverable by
  ACE design (arrival-driven NAK; a quiet client is never NAKed - campaign
  section 3 row 1), recorded in the gate header.

Gates:
- tools/run-connected-loss-gate.ps1 (-DropPct 2 -Seed 1): PASS vs local
  ACE - the first automated observation of packet loss in project history.
  Decorator ledger: dropped out=3 in=10 of forwarded out=183 in=496.
  [net-final] resends=2 nak-in=2 nak-out=6 rej-in=0 acks-out=114
  acks-in=119 dup-drop=0 sanity-drop=0 cksum-fail=0 parked=9 reclaimed=0
  uncached-nak=0 cache=1 nakset=0. Every injected loss healed: both
  ACE-driven C2S resend recovery (nak-in=2 -> resends=2) and client-driven
  S2C NAK recovery (parked=9 -> nak-out=6) fired on a real connected
  route, all six checkpoints validated, graceful logout confirmed, ACE
  recorded the transport Disconnect.
- tools/run-connected-world-lifecycle-gate.ps1 (decorator absent): PASS -
  zero behavior change on the no-loss baseline; the gate now defensively
  clears the drop env vars.
- Core.Net Release: 747/747 (737 + 10 N5: decorator determinism/direction/
  arming/structural-absence/env parsing, the 5% seeded WorldSession lossy
  lifecycle with zero message loss both ways + ACE Headroom 256, the
  [net-tick] field pins, the Iteration stamps).
- Full solution Release: 9,763 passed / 5 skipped / 0 failed.

Test-fixture note: FakeAceTransport gains AutoAdvanceOnBlockingReceive so
virtual time can move during the blocking Connect()/EnterWorld() pumps -
with the clock frozen there, a dropped handshake-window datagram could
never be NAK-healed (a fixture artifact, not a transport property).

Campaign section 9 ledger row added (SHA recorded at N6 kickoff).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/AcDream.Core.Net.Tests/Transport/OutboundReliableTransportTests.cs

@@ -20,6 +20,7 @@ public sealed class OutboundReliableTransportTests
     private const uint ClientSeed = 0x11AA22BBu;
     private const uint ServerSeed = 0x33CC44DDu;
     private const uint ClientId = 0x1234u;
+    private const ushort SessionIteration = 0x0007;
     private const ulong Cookie = 0xFEEDFACECAFEBABEUL;
 
     // =====================================================================
@@ -183,6 +184,10 @@ public sealed class OutboundReliableTransportTests
         // N3 fold-in: fresh sends stamp the current interval id (the clock
         // starts at 1) — FlowQueue::TransmitNewPackets @ 0x00547A60.
         Assert.Equal((ushort)1, originalHeader.Time);
+        // N5 fold-in (N4 review F3): fresh sends stamp the session iteration
+        // through the same shared header build (0x00547A84/0x00547AA8),
+        // completing the control-header rule across all three send shapes.
+        Assert.Equal(SessionIteration, originalHeader.Iteration);
 
         // 1.2 s later (interval id 1 → 3) the server NAKs sequence 2.
         virtualClock.Advance(TimeSpan.FromSeconds(1.2));
@@ -345,7 +350,11 @@ public sealed class OutboundReliableTransportTests
         clock.Update();
         Assert.Equal((ushort)6, clock.IntervalId);
         queue.SendGameMessage(MakeMessage(0xA1), GameMessageGroup.UIQueue);
-        Assert.Equal((ushort)6, PacketHeader.Unpack(Assert.Single(sent)).Time);
+        PacketHeader freshHeader = PacketHeader.Unpack(Assert.Single(sent));
+        Assert.Equal((ushort)6, freshHeader.Time);
+        // N5 fold-in (N4 review F3): the fresh send carries the session
+        // iteration, and the resend below keeps it verbatim.
+        Assert.Equal(SessionIteration, freshHeader.Iteration);
 
         // The interval advances again; the resend carries the CURRENT id,
         // newer than the fresh-send stamp.
@@ -355,7 +364,9 @@ public sealed class OutboundReliableTransportTests
         Nak(queue, 2u);
         sent.Clear();
         queue.TransmitPendingResends();
-        Assert.Equal((ushort)8, PacketHeader.Unpack(Assert.Single(sent)).Time);
+        PacketHeader resentHeader = PacketHeader.Unpack(Assert.Single(sent));
+        Assert.Equal((ushort)8, resentHeader.Time);
+        Assert.Equal(SessionIteration, resentHeader.Iteration);
     }
 
     [Fact]
@@ -528,6 +539,7 @@ public sealed class OutboundReliableTransportTests
         var queue = new OutboundFlowQueue(
             MakeIsaac(ClientSeed),
             (ushort)ClientId,
+            SessionIteration,
             clock,
             stats,
             static _ => { });
@@ -572,6 +584,7 @@ public sealed class OutboundReliableTransportTests
         var queue = new OutboundFlowQueue(
             MakeIsaac(ClientSeed),
             (ushort)ClientId,
+            SessionIteration,
             clock,
             stats,
             datagram => sent.Add(datagram.ToArray()));