checkpoint: integrate authenticated transports

docs/PROTOCOL.md

@@ -49,20 +49,30 @@ starting limit is 1200 bytes.
 
 ## Encapsulated transports
 
-- **Direct UDP:** lowest overhead and native datagrams; uses the authenticated
-  protocol above and provides integrity but not outer confidentiality.
-- **QUIC DATAGRAM:** TLS 1.3 protects the transport; client shared-secret
-  challenge/response still authenticates the configured client.
-- **HTTP/3 CONNECT-UDP:** uses legitimate MASQUE CONNECT-UDP and HTTP Datagram
-  semantics over QUIC. It is for compatibility, not fingerprint spoofing.
-- **TLS/TCP:** uses the same client authentication model. Each datagram is
-  framed as a big-endian `u16` payload length followed by up to 65535 bytes;
-  the configured lower limit should normally apply. TCP head-of-line blocking
-  is expected.
+- **Direct UDP:** native datagrams; uses the authenticated protocol above and
+  provides integrity but not outer confidentiality.
+- **QUIC DATAGRAM:** TLS 1.3 protects the connection; a client shared-secret
+  challenge/response authenticates the configured client. Application
+  datagrams use QUIC DATAGRAM frames.
+- **HTTP/3 CONNECT-UDP:** uses extended CONNECT with `:protocol=connect-udp`
+  and HTTP Datagrams with the RFC 9297 context ID. The request path is
+  configurable. Capsules are used for the authentication exchange, not as the
+  application-data carrier.
+- **TLS/TCP:** uses the same client authentication model. Each application
+  datagram is framed by a big-endian `u16` payload length and opaque payload;
+  the configured maximum applies. TCP head-of-line blocking is expected.
 
-QUIC, HTTP/3, and TLS/TCP are planned by milestones 2, 4, and 5 respectively.
-The direct packet details are a protocol target; confirm the implementation and
-integration tests before treating them as interoperable guarantees.
+All four carriers are wired into the current client/server runtime. Client
+`mode = "auto"` probes its configured order, retries bounded probe attempts,
+and stops on authentication rejection. Reconnection after transport loss uses
+bounded exponential backoff with jitter; successful connection resets the
+backoff. This describes the current code path, not a claim that every v1
+acceptance criterion has passed.
+
+The control `reload` command is currently unsupported, including certificate
+or key reload. See the checklist for acceptance work that remains before a v1
+release. The direct packet details and the encapsulated transport APIs are
+project-specific; interoperability requires matching this protocol.
 
 ## Authentication and resource order