Yup, good clarifications. As you say, "fallback retries" are bad. But that is what browsers did, some years ago, when tls1.2 was less common ... and they added

Yup, good clarifications. As you say, "fallback retries" are bad. But that is what browsers did, some years ago, when tls1.2 was less common ... and they added the TLS_FALLBACK_SCSV "not-a-cipher-suite" to try to detect attacker-caused downgrades in a dumb-server-compatible way ...