preserve transport outage validation evidence

docs/binary-record-v1.md

@@ -81,12 +81,22 @@ before that first valid frame separately from CRC failures after synchronization
 Acquisition runs in a dedicated higher-priority task and writes complete samples
 to a 512-entry RAM queue. The lower-priority output task batches up to eight
 records per frame. At 100 Hz this queue represents about 5.12 seconds of
-decoupling from a blocked or disconnected transport. A failed write retains and
-retries the same encoded packet rather than dequeuing more samples, so the queue
-accumulates the outage backlog. After reconnection, the oldest retained data is
-sent first. If the queue fills, acquisition drops new samples rather than
-overwriting older ones; sequence gaps and the cumulative lost-sample counter
-expose that permanent loss.
+decoupling when the transport reports backpressure or failure accurately. A
+failed write retains and retries the same encoded packet rather than dequeuing
+more samples, so the queue accumulates the outage backlog. After reconnection,
+the oldest retained data is sent first. If the queue fills, acquisition drops
+new samples rather than overwriting older ones; sequence gaps and the cumulative
+lost-sample counter expose that permanent loss.
+
+That retry guarantee requires the transport's success result to mean that the
+complete frame was accepted for eventual delivery. The current USB Serial/JTAG
+VFS/stdio path does not fully satisfy that contract: if the host remains
+connected but stops draining, its internal timeout can discard bytes while the
+stdio write appears successful. CRC and sequence checks make that loss visible
+to a receiver, but it does not increment the device's drop counter. A direct
+driver path with bounded transmit-drain waits can report this condition; an
+application acknowledgement and replay window is required for end-to-end
+delivery confirmation.
 
 Receivers report bytes left in an incomplete trailing frame when capture ends.
 Those bytes cannot pass CRC validation and are not silently admitted as samples.