[zunda-pixel]

beginFirmwareUpdate waits for the watch to answer FirmwareUpdateStart with no deadline. If the answer never comes, it sits on the await: _firmwareUpdateState keeps whatever value it held, nothing is reported as failed, and interruptedUpdates is never told about the attempt. It only unblocks when the connection scope is cancelled from somewhere else.

Everything else in this path already has a deadline:

wait	deadline	where
requestWatchVersion → requestWatchColor	20s	Negotiator.negotiate, which catches TimeoutCancellationException and returns a null WatchInfo
requestFirmwareUpdateStatus	15s	its own withTimeoutOrNull, returning null so the transfer starts from scratch
sendFirmwareUpdateStart	—	nothing

So this gives it the same 15 seconds, and an unanswered start now takes the path a refused one already took — error(...), caught by the IllegalStateException branch below, Idle(e).

Why withTimeoutOrNull and not withTimeout

The try this sits in has

} catch (e: CancellationException) {
   _firmwareUpdateState.value =
      FirmwareUpdateStatus.NotInProgress.ErrorStarting(FirmwareUpdateErrorStarting.ErrorDownloading)
   throw e
}

TimeoutCancellationException is a CancellationException, so withTimeout here would be reported as a download failure — neither what happened nor recoverable the same way. There is a comment on the call saying so, since the next person to touch it will reach for withTimeout first.