Certainty is about not received

Change the text to emphasize that the requirement is that packet numbers
have never been accepted before, not that duplicates be detected.

Detecting duplicates requires an insane amount of state.  Providing
assurance that a packet has never been accepted before is easier, and
that's all we need.

Also qualify with packet number space, because the same packet number
can be sent in each of the three packet number spaces.

draft-ietf-quic-transport.md

@@ -1066,12 +1066,11 @@ sending a packet with a number of 0x6b2d79 requires a packet number encoding
 with 14 bits or more; whereas the 30-bit packet number encoding is needed to
 send a packet with a number of 0x6bc107.
 
-An endpoint MUST discard packets with duplicate packet numbers.  After
-unprotecting a packet, the receiver MUST check that it has not already processed
-a packet with this PN and if so discard it. Duplicate suppression MUST happen
-after the packet has been unprotected for the reasons described in Section 9.3
-of {{QUIC-TLS}}. An efficient algorithm for duplicate suppression can be found
-in Section 3.4.3 of {{?RFC2406}}.
+A receiver MUST discard a newly unprotected packet unless it is certain that it
+has not received another packet with the same packet number from the same packet
+number space. Duplicate suppression MUST happen after removing packet protection
+for the reasons described in Section 9.3 of {{QUIC-TLS}}. An efficient algorithm
+for duplicate suppression can be found in Section 3.4.3 of {{?RFC2406}}.
 
 A Version Negotiation packet ({{packet-version}}) does not include a packet
 number.  The Retry packet ({{packet-retry}}) has special rules for populating