docs(train): what the phone can't check of relayed firmware (ADR 0030, D55)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0030-halkyon-train.md

@@ -1416,6 +1416,12 @@ Strava. What was found, 27 Oct:
   written, and the other version is offered instead (`LoopFailed('another update')`).
   The relay's calls to Polar have timeouts, caps on their size and https on every
   hop, one fetch per file at a time, and a limit per person.
+  What the phone can't check (30 Oct): Polar's SDK (8.3.0) unzips the file and writes
+  its parts to the band over PFTP as they come, with no hash or signature of its own
+  (its classes use neither `MessageDigest` nor `Signature`). Whether the band refuses
+  an image Polar didn't sign is to be seen from a file of Polar's; until then,
+  firmware through the instance trusts the instance as the direct way trusts Polar's
+  service, and the person choosing the relay chooses that.
 - **D56 The wheel learnt from GPS that covered the ride** (recommended, the developer's;
   30 Oct; revises D49's measure): a ride measures the wheel where precise fixes followed
   it for 95 % of its moving time (gaps of 30 s at most count, a pause cuts), not where