fix(timestamp): compute control dt in the integer domain (precision; attempted synth dodge)

[avrabe]

What

relay-rate, relay-ekf and relay-pos each computed their control period as time.as_secs_f32() - last_time.as_secs_f32() — differencing two absolute f32 epoch times. Replaced with Timestamp::secs_since_f32(earlier), which subtracts in the integer domain and converts once.

Primary win — precision (this is why it should land)

Subtracting two large absolute f32 times catastrophically cancels: at t ≈ 1e6 s an f32 ULP is ~0.06 s, which swamps a 1 ms control period. Differencing in integers and converting the small result is strictly more accurate, and "elapsed since" states the intent better than the subtraction. Saturates at zero on non-monotonic input rather than wrapping (u64 underflow) or panicking; callers clamp to their dt band anyway.

Secondary — and it did not work: the synth GI-FPU-001 dodge

jess's per-stage lowering sweep (jess#167) found f32.convert_i64_u skipping the public entry point of exactly the three stages that call this helper (rate#tick, position#tick, ekf#estimate), and suggested narrowing the u64→u32 to unblock them without waiting on synth.

The diagnosis correlated exactly — relay-att defines Timestamp but never calls as_secs_f32, and attitude is blocked by the other defect (GI-FPU-002, VFP exhaustion). But the op survives:

attempt	result
if/else cap at u32::MAX	LLVM converts u64, caps in float domain
u64::min(..) as u32	compiled to an i64 select + f32.convert_i64_u
mask-truncate (whole & 0xFFFF_FFFF)	same
small-cap early narrowing	same

Verified by disassembling the built component after each attempt (wasm-tools print | grep f32.convert_i64), and by deleting as_secs_f32 entirely to rule it out — the op persisted, proving it's this expression, not the old helper.

So this PR does NOT unblock those stages. GI-FPU-001 looks genuinely synth-side. Reporting the negative result to jess so they don't wait on a source-level fix that isn't coming.

Tests

16 + 13 pass across the three crates, including rate_p03_step_response_drives_error_to_zero (closed-loop convergence) — behaviour preserved.

Refs: jess#167 (per-stage skip report, GI-FPU-001 / synth#369).

🤖 Generated with Claude Code