tighten transport failure semantics

main/trikke_transport.h

@@ -36,7 +36,12 @@ void trikke_transport_sender_init(trikke_transport_sender_t *sender);
 
 // Advances one bounded transport operation. The packet storage must remain valid
 // and unchanged from the first PENDING result through COMPLETE. While pending,
-// only poll is called: an ambiguous timeout can never duplicate a frame.
+// only poll is called: an ambiguous timeout can never duplicate a frame. RETRY
+// is valid only from begin, where it guarantees that no bytes were accepted.
+//
+// COMPLETE is backend-specific. USB uses endpoint drain, which does not prove
+// application receipt. A reliable BLE backend must reserve COMPLETE for an
+// application acknowledgement covering this exact frame.
 trikke_transport_status_t trikke_transport_sender_step(
     trikke_transport_sender_t *sender,
     const trikke_transport_t *transport,