## Code review — revision 33 bridge bundle

Reviewed the two renewed mechanisms (priority lease, line 1674; self-update operation-record reconciliation, line 1676) and cross-checked all supplied section 19 text (1668–1702) plus the threat/UX preamble for contradictions.

### Finding 1 (substantive): "verified different state ⇒ failure" is an unsound reconciliation verdict

**Line 1676:**
> "matching expected state means success; **a verified old or different state means failure with retry guidance**; unavailable or inconclusive verification retains unknown. Never use a later install's artifact as evidence for the earlier operation."

A verified device state that matches **neither** the expected post-install state **nor** the recorded previously-observed state does not establish that the earlier operation failed. The plan's own next sentence concedes a later install can intervene ("never use a later install's artifact as evidence"), and an out-of-band update (Play Store, another ADB path) between teardown and reconciliation produces exactly this "different" state. In that case:

- the earlier self-update may have succeeded and then been superseded — reporting **failure** is factually wrong;
- worse, attaching **retry guidance** to that verdict steers the user toward reinstalling the older artifact over a newer install (a downgrade/overwrite of externally changed state).

This is also internally inconsistent with the acceptance criteria on **line 1700**, which enumerate only "observed-new success, verified-old failure, inconclusive unknown" — the "verified different" branch is untested and unrepresented there.

**Minimal fix (line 1676):** split the verdict —
> "a verified state equal to the recorded prior state means failure with retry guidance; a verified state matching neither expected nor prior state retains **unknown** (package changed externally) and must not produce retry guidance"

and add the "verified-different retains unknown" case to the acceptance list on line 1700.

### Finding 2 (minor gap): reconciliation trigger is only specified for the self-update path

**Line 1674** requires *any* "interrupted, timed-out, or self-update-terminated install" to be reported as unknown until independent package-state verification. But **line 1676** provides an automatic reconciliation trigger only for the self-update case ("After the user restores Ready mode, a new paired ADB session automatically reconciles **that operation** before another install to the same package"). For an ordinary interrupted/timed-out install, no session-start or pre-install reconciliation step is specified, so the retained operation record (which 1676 mandates for *every* install) may never be reconciled — the "unknown" report has no defined resolution path.

**Minimal fix:** state that the "reconcile any unreconciled operation record for the target package before another install to that package, on any new session" rule applies to all interrupted/timed-out installs, not only self-updates.

### Priority lease (line 1674): no substantive defect

The lease is sound as written: it is metadata-only and grants no ADB authority (consistent with the credential-separation rule in the same paragraph), fail-closed on renewal loss (pause persists until an authenticated attestation of no-pending-request), and the two directions of shared-link contention are covered by complementary mechanisms — Mac-side outbound pause via the lease, phone-side app-local send pause via the approval socket — with the irreducible residual contention explicitly disclosed ("shared link contention cannot be eliminated completely"). No contradiction with lines 1680, 1682, 1686, or 1700.

### Other section 19 contradictions

None found. Product boundary (1672), connection path (1680–1686), availability/controls (1690–1694), feasibility/acceptance (1698–1700), the open session-admission decision (1690 vs. line 25), and the residual same-user ADB-key exposure (1682 vs. line 69) are mutually consistent, aside from the 1676/1700 mismatch folded into Finding 1.

**Summary:** one substantive defect (reconciliation verdict for verified-different state, line 1676) and one minor specification gap (reconciliation trigger scope, lines 1674/1676); the renewed priority lease and the remainder of section 19 have no substantive findings.