docs(train): ADR 0030's D53–D55 as built, and the sidecars' downloads as they now retry

What the branch's review of 30 Oct 2026 decided: no backup or transfer of Train's data, Jellyfin over https alone but on the phone, only the firmware agreed to and the relay bounded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0030-halkyon-train.md

@@ -1274,9 +1274,10 @@ Strava. What was found, 27 Oct:
     to it (zoom 14 at least). The deploy: `deploy/photon/` (Photon 1.3.0 on Temurin 21;
     `data.sh` downloads GraphHopper's `photon-db-<region>-1.0-latest` monthly, unpacked
     as it streams and checked against its MD5, its archive never kept; `serve.sh` puts
-    a new database in place within the hour, Photon away a minute or two),
+    a new database in place within a minute, Photon away a minute or two),
     `compose.search.yaml` (Photon beside Train's server alone on an internal network,
-    unlogged; its downloads on their own network; `PHOTON_HEAP` 6g, `PHOTON_MEMORY`
+    unlogged; its downloads on the downloads' network, an ordinary bridge it shares with
+    BRouter's segments and the map's tiles; `PHOTON_HEAP` 6g, `PHOTON_MEMORY`
     8g), the operator's steps in the README's *Train's search*. Not run: any of the
     deploy, the size of Europe's database unpacked and Photon's memory on it, whether
     1.3.0 reads GraphHopper's `1.0` build (the folder GraphHopper offers for Photon's
@@ -1382,6 +1383,40 @@ Strava. What was found, 27 Oct:
     coming. Not tried against a real Jellyfin: that its transcoding answers this path
     with WebM, how long it takes for a track.
 
+## After the branch's review (30 Oct 2026, the developer's)
+
+- **D53 Nothing of Train's in a backup or a transfer to another phone** (the
+  developer's; 30 Oct): Train keeps unsealed on the phone what D7 seals everywhere
+  else: a recording while it runs (`recording.txt`, the track and the heart rate), the
+  Loop's days before they are sealed (`loop_days.txt`), the body's figures the band was
+  set up with (`loop.json`), the maps along routes. Android's backup (Google's, or
+  Seedvault on GrapheneOS and LineageOS) and its transfer to a new phone copied the
+  app's folders by default, outside the sealing. `allowBackup="false"` and
+  `fullBackupContent="false"` stop both through Android 11; from Android 12 on
+  `allowBackup` stops the backup alone, and `res/xml/data_extraction_rules.xml`
+  excludes every folder from the backup and from a transfer (`BackupRulesTest`). Over
+  excluding Train's unsealed files one by one, which a file added later would slip
+  through, and over moving them under `noBackupFilesDir`, which a transfer from
+  Android 12 on still takes; nothing is lost on a new phone that matters: what is
+  sealed comes back from the instance, the account's keys from signing in.
+- **D54 Jellyfin over https alone, but on the phone itself** (the developer's; 30 Oct;
+  revises D47's addresses): an address with `http://` to another machine is refused as
+  typed (`jellyfinInClear`, `MusicFailure.inClear`, *Train connects to Jellyfin over
+  https only*): over http the password, Quick Connect's token and the person's
+  listening go through the network in clear. `http://localhost` and `http://127.0.0.1`
+  stay, for a Jellyfin on the phone, the network security config letting the
+  downloads (`MusicFetcher`, `HttpURLConnection`, which Android holds to it, where
+  Dart's client isn't) reach those two and nothing else in clear. Over allowing http
+  on the local network too, which Android's network security config can't scope to a
+  network (it names hosts), so that the downloads would have to be allowed cleartext
+  everywhere.
+- **D55 Only the firmware the person agreed to** (the developer's; 30 Oct; D40):
+  relayed by the instance, the band gets the version the person was shown and agreed
+  to, or none: where the relay offers another by then, nothing is downloaded or
+  written, and the other version is offered instead (`LoopFailed('another update')`).
+  The relay's calls to Polar have timeouts, caps on their size and https on every
+  hop, one fetch per file at a time, and a limit per person.
+
 ## Consequences
 
 - Train's sensors are one pattern: open profiles read by the app itself, on the phone;