## Code review: Remozio ADB bridge, revision 31 (REVIEW-BUNDLE.md)

Scope reviewed: local ADB listener threat, session admission, Cloudflare ingress lifecycle, process/release boundaries, Android self-update, congestion priority, audit, protocol evolution. Most of these are coherent: the listener race and same-user host-key exposure are consistently disclosed (L69, L1682) and gated; admission is explicitly an open user decision (L25, L1690); the setup controller's typed bridge ingress/Access lifecycle matches the connection path (L1193, L1680, L1159); release-manifest and protocol-version treatment of bridge components is consistent (L104, L1436, L1563, L1568); audit is metadata-only with bounded rejection telemetry (L756–760, L1686).

Two substantive defects remain:

### 1. Medium — Congestion-priority mandate has no enforcing component
**Lines:** 1674 ("Give pending approvals precedence over ADB traffic: throttle or pause bridge frames when the shared uplink or phone radio is congested"), in tension with 1674 ("Keep deployment transport, rate limits… separate from approval messages") and 1680 (bridge endpoint runs under a separate account/process from the approval transport).

**Defect:** The precedence guarantee crosses two deliberately separated transports, but no component is designated to detect a pending approval and signal the bridge to yield. On the phone→Mac direction the single Android app owns both sockets, so enforcement is feasible but unstated. On the Mac→phone direction (APK bytes vs. approval requests sharing the tunnel/phone downlink), the bridge endpoint cannot know an approval is pending without a coordination channel the plan neither defines nor explicitly forbids. "Measure approval latency under a saturated install" (L1674) and the acceptance test (L1700) verify the symptom but don't supply the mechanism.

**Minimal correction:** Name the enforcer per direction: the Android app as priority point for phone-originated traffic, and an explicit local preemption/backpressure signal from the approval authority/transport to the bridge endpoint for Mac→phone traffic; or narrow the guarantee to phone-side enforcement and disclose the residual Mac-uplink contention.

### 2. Low — Self-deploy install result has no delivery path
**Lines:** 1674 ("report an interrupted install honestly if the ADB connection times out"), 1676 ("Updating the Remozio app that hosts this bridge terminates its own foreground service and connection"), 1700 ("Self-deploy the bridge-hosting app and verify session teardown, install result reporting…").

**Defect:** A self-deploy deterministically kills the phone-side proxy mid-install, so the ADB install result cannot reliably transit the connection that carries it — yet the acceptance criterion requires "install result reporting" for exactly this case, and L1674's honest-reporting rule covers only timeouts, not this deterministic self-interruption. The general unknown-outcome handling (L752) exists but is not wired into the self-deploy acceptance path.

**Minimal correction:** Extend L1674's interruption reporting beyond timeouts to cover self-update teardown, and in L1676/L1700 specify the reconciliation mechanism (e.g., record an interrupted/unknown outcome at teardown, then confirm installed package state after Ready-mode recovery via a new session).

No other substantive findings in the reviewed areas.