Checksum the header and refuse sequence numbers the sender never sent

tx.go

@@ -8,6 +8,12 @@ import (
 
 type txStats struct {
 	errs atomic.Uint64
+
+	// The exclusive upper bound on any sequence number this stream can have put
+	// on the wire. Read by the receiving half of the same stream, which is the
+	// only thing that can tell a gap it must write off from a sequence number
+	// that was never sent at all.
+	sent atomic.Uint64
 }
 
 type txWorker struct {
@@ -46,6 +52,11 @@ func (w *txWorker) run(done *atomic.Bool) {
 			iovs[i].Len = uint64(size)
 		}
 
+		// Published before the send rather than after it, so it is never behind a
+		// frame already in flight. Overshooting a partial send is harmless: it is
+		// a bound, and one the next pass raises again.
+		w.stats.sent.Store(seq + uint64(w.batch))
+
 		n, err := sendmmsg(w.fd, hdrs)
 		if n > 0 {
 			seq += uint64(n)