tighten transport failure semantics

main/trikke_transport.c

@@ -24,20 +24,29 @@ trikke_transport_status_t trikke_transport_sender_step(
         return TRIKKE_TRANSPORT_FATAL;
     }
 
-    const trikke_transport_status_t status = sender->pending
+    const bool was_pending = sender->pending;
+    const trikke_transport_status_t status = was_pending
         ? transport->poll(transport->context)
         : transport->begin(transport->context, packet, packet_size);
     if (!status_is_valid(status)) {
-        sender->pending = false;
+        sender->pending = was_pending;
         return TRIKKE_TRANSPORT_FATAL;
     }
 
     if (status == TRIKKE_TRANSPORT_PENDING) {
         sender->pending = true;
-    } else {
-        // RETRY from poll is allowed only when the backend has discarded or
-        // otherwise resolved the old transfer and knows resubmission is safe.
+    } else if (status == TRIKKE_TRANSPORT_COMPLETE) {
         sender->pending = false;
+    } else if (status == TRIKKE_TRANSPORT_RETRY) {
+        if (was_pending) {
+            // Once accepted, generic transport code cannot prove that retrying
+            // the whole frame is duplicate-safe. Fail closed and keep ownership.
+            sender->pending = true;
+            return TRIKKE_TRANSPORT_FATAL;
+        }
+        sender->pending = false;
+    } else {
+        sender->pending = was_pending;
     }
     return status;
 }