Add reliable stream retransmission

docs/NATIVE_V1_SPEC.md

@@ -13,17 +13,16 @@
 >   the default with explicit, visible SSH fallback. Local and Docker benchmark gates
 >   cover cached attach, SSH fallback, and native cold auth (Track C /
 >   `BENCHMARKS.md`).
-> - Milestone 4 — forwarding: **implemented with one reliability caveat.** Stream
->   mux, `-L`, `-R`, `-D`, `-N`, `-f`, and per-stream flow control exist;
->   terminal-priority/load and replay/reorder regressions are covered. Dropped
->   `StreamData` recovery still needs stream retransmission before lossy-link
->   forwarding parity is claimed.
+> - Milestone 4 — forwarding: **implemented.** Stream mux, `-L`, `-R`, `-D`, `-N`,
+>   `-f`, per-stream flow control, ordered stream offsets/ACKs, and stream-data
+>   retransmission exist. Terminal-priority/load, replay/reorder, and dropped
+>   server-to-client `StreamData` recovery regressions are covered.
 > - Milestone 5 — hardening: **partly done.** Per-IP token-bucket rate limiting,
 >   fail-closed protocol-version checks with a documented v1 policy, parser fuzz
 >   targets, fuzz-smoke/deep CI entry points, scripted TUI transport tests,
->   forwarding load/priority/replay tests, and independent persistent session restart
->   tests exist. External review and published long-soak evidence are not yet
->   complete. The threat model is published (`docs/THREAT_MODEL.md`).
+>   forwarding load/priority/replay/loss tests, and independent persistent session
+>   restart tests exist. Published long-soak evidence is not yet complete. The threat
+>   model is published (`docs/THREAT_MODEL.md`).
 > - Milestone 6 — workflow parity: **mostly done.** `dosh doctor`, host-trust
 >   management, and the encrypted-key prompt flow exist; cross-OS daily-driver soak is
 >   ongoing.
@@ -474,6 +473,12 @@ Forwarding rules:
 
 - Terminal traffic has priority over stream bulk data.
 - Each stream has independent flow control.
+- `StreamData` carries a per-stream byte offset and is delivered to TCP in order.
+- `StreamWindowAdjust` carries a cumulative received byte offset; peers free
+  retransmit buffers and replenish send credit only for acknowledged contiguous
+  bytes.
+- Unacknowledged stream bytes are retransmitted as newly encrypted transport packets
+  with fresh packet sequence numbers/nonces.
 - Backpressure must not block PTY input or output.
 - Server enforces `no-port-forwarding` and `permitopen=`.
 - Remote listeners bind to loopback by default.
@@ -601,7 +606,7 @@ Milestone 5: hardening
 
 - Fuzz packet parsing, authorized-key parsing, known-host parsing, and handshake state.
 - Add hostile-network integration tests.
-- Add external review checklist before public security claims.
+- Keep a public hardening checklist and threat model before public security claims.
 
 Milestone 6: workflow parity