Record accepting per-path msg2 resends to replayed msg1s

docs/pq-handshake.md

@@ -357,6 +357,11 @@ Implemented in `handshake/fragment` (`Sender`, `Assembly`, and the capped `Table
   a resend costs the initiator K packets on that path and the answer is held to the 3x
   budget below. That is TFTP's Sorcerer's Apprentice bound, per path rather than per
   handshake.
+  A path is only an address and port, so a recently answered msg1 replayed from spoofed
+  sources draws one cached msg2 to each, at about 1.2-1.4x the bytes sent and never over 3x,
+  for as long as the answered msg1 is remembered (the handshake timeout). Accepted
+  (2026-10-15): classical IX already resends its stored msg2 to any source that replays msg1,
+  with no clock at all, and a per-handshake clock is what broke a path that only works one way.
 - Duplicate msg1 detection compares the decoded message to the cached one **before**
   running Noise or certificate verification.
 - Before an address is validated, a responder sends at most 3x the bytes it received from