Restructure stats into delta, mask, and aggregate layers

docs/measurement.md

@@ -4,7 +4,7 @@ Hard-won rules about measuring correctly. Violating these produces numbers that
 
 ## Rate buckets: stamp at read time, never at ticker-fire time
 
-- `direction.capture()` stamps each bucket with `time.Now()` taken immediately after reading the counters — never a timestamp passed in from the sampler ticker.
+- `direction.sample()` reads the clock immediately after reading the counters — never a timestamp passed in from the sampler ticker.
 - Why: a rate is Δcounters/Δt. The sampler runs a variable delay after its tick, so a tick-time label pairs a right numerator with a wrong denominator — and because E[1/x] > 1/E[x], the error biases the rate **upward**; it doesn't cancel.
 - Measured: tick-time stamping read 27.55 G / 4.88 Mpps against a true 19.86 G — 35% high. Read-time stamping read within 2%.
 - A 1 s console interval hides it (jitter < 0.2%); a 16 ms panel window exposes it.
@@ -22,7 +22,7 @@ This rule covers the **NIC-counter** buckets and the per-stream receive buckets
 
 - `/sys/class/net/*/statistics/*` run from boot, not process start, and reset to zero on driver stats resets.
 - In unsigned arithmetic that bites twice: a zero baseline charges the machine's whole lifetime to the run; a backward step underflows `now - base` to ~2^64.
-- Rule: accumulate only forward motion into a process-local total, then take every baseline from that total — never from a raw reading. Establish all baselines in one place before traffic starts.
+- Rule: only forward motion counts — the delta layer clamps a backward step to zero and re-bases, never handing a raw difference upward. Establish all baselines in one place before traffic starts.
 - Debugging tell: when a panel's background disagrees with rows drawn from the same value, suspect two vintages of one counter before a color bug.
 
 ## Only zero-baseline-loss runs count; small frames measure the host