# ADB bridge review disposition — revision 30 to 31

Pioneer ran independent reviews with `kimi-code/k3-256k` on the full revision 30 plan and `zai/glm-5.3` on an exact-text bundle of section 19 and the related approval, transport, update, and compatibility contracts. The first GLM full-plan attempt and its same-session resume ended without reports after the model hit its response-length limit; neither attempt counts as a review. The completed scoped GLM report and Kimi report are retained separately.

| Finding | Disposition in revision 31 |
| --- | --- |
| Local loopback ADB listener accepts a race from other Mac processes; a same-user process can use the host key | Confirmed. The plan now states the limitation and requires a stronger local boundary or independent phone-side session authorization before shipping. The unattended-versus-phone-confirmed policy remains a user decision. A loopback bind is not claimed to solve this. |
| Bridge ingress conflicts with section 16's sole approval endpoint and lacks cloud lifecycle | Corrected. The optional bridge gets a separate Access application and fixed ingress, with typed administrator-authorized setup, rotation, disable, verification, and uninstall operations. |
| One-phone wording conflicts with multi-phone approval enrollment | Corrected. The one-phone limit applies only to a bridge session; approval enrollment remains multi-phone. |
| Tailscale fallback is undefined in product scope | Clarified as the current development-only experiment, never a product requirement. |
| Bridge components missing from release identity and version manifests | Corrected. Mac endpoint and command enter the signed release manifest and protected activation rules. Both Android and Mac bridge roles declare stream/framing versions separately from approval protocol versions. |
| Bridge service shares approval transport authority | Corrected. It runs under a distinct unprivileged service account with protected binaries, configuration, and identity keys. |
| ADB session lifecycle absent from audit | Corrected. Start, stop, peer, and reason are metadata-only events; payloads and APK bytes remain excluded. |
| Byte-cap rationale implied Cloudflare Tunnel buffers data | Corrected to bound endpoint and intermediary buffering. |
| Bridge-hosting app self-update terminates Ready mode | Confirmed. The plan now records the outage and recovery UX as an open user decision and requires a self-deploy acceptance test. |
| Shared uplink/radio can delay approvals during APK transfer | Corrected. Approval traffic takes precedence; throttling or pausing the bridge and saturated-link latency measurements are required. |
| ADB pairing key account ambiguous | Corrected. The command runs as the paired administrator account, with no cross-account key copying or silently added elevation. Other-account UX remains a decision. |
| Foreground service type and Wi-Fi trust visibility overstated | Corrected. Ready mode is unavailable until a compliant service type is proven. The app reports reachability, not an asserted trusted-network state. |
| Edge WebSocket idle timeout omitted from feasibility gate | Corrected. The gate now includes edge idle behavior and keepalive design. |

Revision 31 remains a design draft. The local listener boundary, Android platform feasibility, and session-admission UX are explicit gates. A second review pass of the amended text is in progress; do not describe this disposition as convergence until those reports finish.