checkpoint: integrate authenticated transports

docs/ARCHITECTURE.md

@@ -49,10 +49,12 @@ STARTING → RESOLVING → PROBING → AUTHENTICATING → CONNECTED
                                                         └→ PROBING
 ```
 
-In `auto` mode the target order is direct UDP, QUIC DATAGRAM, HTTP/3
-CONNECT-UDP, then TLS/TCP. Authentication rejection is a configuration error,
-not permission to probe indefinitely. Network failures use bounded exponential
-backoff with jitter.
+In `auto` mode the configured order defaults to direct UDP, QUIC DATAGRAM,
+HTTP/3 CONNECT-UDP, then TLS/TCP. Authentication rejection is a configuration
+error, not permission to probe indefinitely. Network failures use bounded
+exponential backoff with jitter (250 ms to 30 s), reset after a successful
+connection. These transports are wired into the current runtime; the
+acceptance checklist distinguishes implementation from completed v1 sign-off.
 
 ## Server isolation
 
@@ -69,5 +71,7 @@ Normal operation uses ordinary UDP/TCP/Unix sockets and needs no root,
 reviewed deployment must bind a port below 1024. The control socket is local
 and protected by filesystem ownership/mode; it is not a network listener.
 
-This document describes the intended v1 architecture. Check the milestone
-matrix before relying on a transport or control command in a particular build.
+Configuration reload and certificate/key reload are not implemented. The
+control `reload` command returns an explicit unsupported response. The
+`reconnect` command applies to the client, while the server supports `status`,
+`stats`, and graceful `shutdown`.