# Code review — REVIEW-BUNDLE.md (revision 32), amended ADB bridge clauses

Scope honored: read-only, no edits. Citations use the bundle's embedded source line numbers (they match the source lines shown). Omitted plan text (sections 3, 5, 16, REVIEW-LOG) treated as unknown; the rev-29 "no findings" result explicitly does not cover section 19 (L3).

## Focus question 1 — Who enforces approval priority across isolated transports?

Coherent; no substantive defect. Enforcement is assigned per egress direction to trusted Remozio components:

- **Mac→phone egress**: the separate bridge endpoint pauses/throttles outbound frames on the unprivileged approval transport's bounded pending/clear signal over authenticated local IPC (L1674). No network signal is needed, so transport isolation is preserved.
- **Phone→Mac egress**: the Android app pauses bridge sends from its own approval-socket pending state — internal to one process, no cross-transport signal required (L1674).
- Signal expiry bounds a lost/crashed signal (L1674), and residual link contention is honestly acknowledged ("shared link contention cannot be eliminated completely," L1674), consistent with acceptance tests for both directions, expiry, and saturated-install precedence (L1700).

## Focus question 2 — Self-update yielding and reconciling an unknown install

Flow is sound: teardown marks the install **outcome unknown**, never inferring success from a dropped socket (L1674, L1676); reconciliation requires the user to restore Ready mode and a *new* admitted ADB session checking package identity, signature, version, and artifact digest; only matching observed state resolves it; reconnection/verification failure retains unknown (L1676); the recurring-phone-action recovery UX is properly recorded as a pending decision (L1676, consistent with L25/L27). One gap in the outcome model, below.

## Substantive finding (1)

**S1 — Reconciliation can never resolve to *failure*, only success or perpetual unknown.** L1676: "only matching observed state resolves the outcome. If reconnection or verification fails, retain unknown." A successful check that observes the **old** artifact (the likely case: mid-stream abort leaves the previous version installed) is definitive evidence of failure, yet under this text it stays "unknown" indefinitely — there is no terminal failure state, no retry guidance, and no stated repair route for it in the supplied text. This conflicts with the plan's own three-outcome contract for the phone ("success, failure, or an uncertain outcome," L15) and its state-honesty principle (cf. L1157, another subsystem, requiring explicit remaining-cleanup and a repair route rather than an ambiguous claim). Acceptance (L1700) also omits the verified-old-state case, so the gap would survive testing. Impact: the pending recovery-UX decision (L1676) is being designed against an outcome model missing its failure leg. Recommendation (no edits made): define match-new → success; verified mismatch/old state → failure with retry guidance; check unavailable → unknown; add the mismatch case to acceptance.

## Minor notes (explicitly non-substantive)

1. **L1674** "pauses **or** throttles" — throttling alone may not deliver precedence; the binding criterion is the saturated-install test (L1700). Wording should match the intended strictness.
2. **L1674 vs L1700** — L1674 defines a single Mac-*local* signal (transport→bridge IPC), yet acceptance requires testing "Mac-to-phone and phone-to-Mac priority **signals**"; no such network signals exist in the design (phone-side pause is app-internal). Terminology drift risks testing the wrong artifact.
3. **L1676** ambiguity enabling S1: "matching observed state" does not state matched against what (deployed artifact only, or either known state).

## Consistency checks that passed

- Bridge is not an approval request type: L21 ↔ L1672.
- Session-admission policy is an open user decision, not assumed: L3/L25 ↔ L1690 ↔ L1700 (tests "the selected" policy).
- Same-user Mac residual exposure stated, gated before shipping, and surfaced in the UX choice: L69 ↔ L1682 ↔ L1690.
- Bridge is the only additional ingress, separately authenticated, own Access app, phone never gets management credentials: L1159 ↔ L1680 ↔ L1694.
- One-Mac/one-phone bridge vs multi-phone approval enrollment: L1676.
- Unknown-result, reconciliation, teardown, and no-approval-payload-leakage tests present: L1700.

**Verdict**: one narrow substantive defect (S1) in the self-update reconciliation outcome model; priority-enforcement clause is substantively sound. All other open items in the supplied text are already recorded as pending decisions or feasibility gates, which the plan itself does not count as review convergence (L27).