Consul LAN gossip port limits for multi-agent clusters

Moving from a single-agent development setup to a production Consul cluster introduces network requirements that are not exercised locally. A dev agent operates without inter-agent communication, while a multi-agent deployment relies on Serf LAN gossip and server RPC for membership and catalog consistency.

The documented capability specifies Serf gossip on port 8301 for LAN membership and port 8300 for server RPC, with WAN gossip on 8302. Gossip encryption is configured via the encrypt key, and rotation is supported by listing multiple keys where agents accept messages encrypted with any listed key but transmit with the first.

There is uncertainty about the practical limits of partial reachability and key ordering in a rolling change.

Does TCP-only reachability on 8301 satisfy membership requirements, or is UDP 8301 also required for stable LAN gossip? What membership behavior is expected when gossip ports are partially blocked between agents? Is the transmit key selection strictly the first key in the encrypt list for all agents during rotation?