From the #4360 review round (2026-08-19 audit):
- Fee reserve blind to per-input fees: the preflight scales a flat ~1.84x headroom regardless of input count — wallets with many small inputs sit in a halt-adjacent band where the preflight passes but the build fails (or vice versa).
- Per-address shortfall mislabeled as account-level capacity in the error surface.
- Max selection should be largest-first (not lexicographic) with a reason string.
- Android preflight JNI binding still missing (iOS has the surface; Kotlin does not).
A fix exists on branch fix/shield-preflight-hardening (former PR #4429, closed to keep the open-PR queue focused on migration-critical work): input-aware fee model, per-input error mapping, least-sound reserve fixed-point with a two-cycle counterexample test.
Open adjudication: the review gate's preliminary pass disputes the reserve resolver (claims valid low-input shields are still rejected when additional admitted candidates are unnecessary for the requested amount); the branch's counterexample test defends the current fixed-point as the sound choice. This disagreement is unresolved — park until there is bandwidth to adjudicate, then reopen.
From the #4360 review round (2026-08-19 audit):
A fix exists on branch
fix/shield-preflight-hardening(former PR #4429, closed to keep the open-PR queue focused on migration-critical work): input-aware fee model, per-input error mapping, least-sound reserve fixed-point with a two-cycle counterexample test.Open adjudication: the review gate's preliminary pass disputes the reserve resolver (claims valid low-input shields are still rejected when additional admitted candidates are unnecessary for the requested amount); the branch's counterexample test defends the current fixed-point as the sound choice. This disagreement is unresolved — park until there is bandwidth to adjudicate, then reopen.