# Review report — REVIEW-BUNDLE.md revision 32, section 19 amended clauses

Two substantive findings remain.

## Finding 1 — Priority enforcement has no phone→Mac leg and silently lapses on signal expiry

The normative design (line 1674) defines exactly one priority mechanism on the Mac side: the unprivileged approval transport sends a bounded pending/clear signal over local IPC to the bridge endpoint, which "pauses or throttles outbound frames while pending" and resumes "after the signal clears or expires." The phone side is purely local behavior: "The Android app prioritizes its approval socket and pauses bridge sends while an approval is pending" (1674). No phone→Mac priority signal is specified anywhere in the normative text — the Mac bridge has no way to learn that an approval is still pending on the phone once the Mac-side signal expires.

This creates two defects:

- **Expired-signal precedence loss.** If the user deliberates longer than the (unspecified) signal expiry, the Mac bridge resumes outbound frames mid-approval. No refresh/heartbeat or re-signal requirement is defined, so the unconditional guarantee "Give pending approvals precedence over ADB traffic" (1674) is actually a time-bounded best effort. Since the transports and accounts are deliberately isolated (1680: bridge service account "distinct from the approval transport account"), the bridge endpoint cannot independently observe pending state — the signal is its only input, and its lifecycle is undefined.
- **Acceptance/normative mismatch.** Line 1700 requires testing "Mac-to-phone and phone-to-Mac priority signals, their expiry," but no phone-to-Mac signal exists in the plan. Either the mechanism is missing from section 19's normative clauses, or the acceptance criterion is untestable as written.

## Finding 2 — Self-update reconciliation has no specified retained reference state

Line 1676 requires that after a self-update teardown, "a new paired ADB session checks the installed package identity, signature, version, and artifact digest…; only matching observed state resolves the outcome. If reconnection or verification fails, retain unknown." But nothing specifies what the Mac must persist about the pending unknown outcome — expected package identity, version, and artifact digest correlated to that specific interrupted install. Two adjacent clauses narrow the obvious storage locations: line 1686 keeps "APK bytes and ADB payloads out of application logs and audit history," and line 1694 limits bridge status to "the paired Mac and last session… not ADB command contents." The expected digest is therefore homeless: "matching observed state" (1676) has no defined reference value to match against in a later, independently initiated session. Nor does any clause require a subsequent on-demand session (1682: "The Mac command starts a session on demand") to reconcile the retained unknown before beginning new deploy work — a later unrelated deploy could verify against the wrong artifact, or the unknown can persist indefinitely with no trigger to resolve it. The acceptance line (1700: "independent package-state reconciliation after a new session") presumes this state exists but the plan never creates it.

## Consistency checks that pass

- Threat boundary (line 69) ↔ admission-policy decision (1690) ↔ race/standalone-boundary gate (1682): the same-user ADB host-key exposure is consistently disclosed and gated on a pending user decision, satisfying the consultation rule (lines 25, 27).
- Self-update kill of the approval path (1676) is covered by the product contract's manual-approval fallback (line 15), and "outcome unknown… never infer install success from a dropped socket" (1674) is internally consistent with "Mark that install unknown at teardown" (1676).
- Ingress separation (1159), credential custody (1680), and payload-free priority signal (1674 vs. 1700 "without approval payload leakage") are consistent.

No files were modified.