T2.3-T2.6: BWE guard, relay conformance Tier A/B/C, Prometheus metrics

docs/PRD/reports/T1.6-report.md

@@ -1,10 +1,10 @@
 # T1.6 — Protocol version negotiation in handshake
 
-**Status:** Pending Review
+**Status:** Approved
 **Agent:** Kimi Code CLI
 **Started:** 2026-05-11T10:20Z
 **Completed:** 2026-05-11T11:05Z
-**Commit:** 69a627b
+**Commit:** 6f81487
 **PRD:** ../PRD-wire-format-v2.md + ../PRD-protocol-hardening.md (W12)
 
 ## What I changed
@@ -84,8 +84,25 @@ $ cargo fmt --all -- --check
 
 ## Reviewer checklist (filled in by reviewer)
 
-- [ ] Code matches PRD intent
-- [ ] Verification output is real (re-run if suspicious)
-- [ ] No backward-incompat surprises
-- [ ] Tests cover the new behavior
-- [ ] Approved
+- [x] Code matches PRD intent — protocol_version + supported_versions on CallOffer; typed HangupReason::ProtocolVersionMismatch; client-side typed HandshakeError
+- [x] Verification output is real — re-ran `cargo test -p wzp-relay --test handshake_integration` (5 pass), `cargo test -p wzp-client --test handshake_integration` (3 pass), workspace tests (613 pass / 0 fail excl. android), clippy clean on touched crates
+- [x] No backward-incompat surprises — serde defaults make `protocol_version` and `supported_versions` optional in JSON; old peers default to v2 which matches the codebase. See sub-note on HangupReason `Copy` removal.
+- [x] Tests cover the new behavior — both directions (relay rejecting v1 offer, client receiving mismatch) covered
+- [x] Approved
+
+### Reviewer notes (2026-05-11)
+
+Approved. Clean implementation, both directions tested, disclosure discipline applied — the agent explicitly listed the T1.5 migration gap-fixes under "What I changed" rather than burying them. Visible course-correction from the T1.5 review.
+
+**Strengths worth calling out:**
+
+- Typed `HandshakeError` on the client side with `Display` + `Error::source` — proper Rust error API, not anyhow.
+- `HangupReason::ProtocolVersionMismatch { server_supported: Vec<u8> }` is structured, not a string. Future-proof if more versions appear.
+- `default_proto_version()` and `default_supported_versions()` are public helpers with rustdoc — standard #9 honored from the start.
+- 613 tests pass — the +41 vs T1.5.2's 572 baseline is mostly Android/desktop gap-fix tests that came online once Kimi's subagent finished those.
+
+**Minor notes (no follow-ups needed):**
+
+1. **`HangupReason` lost `Copy`** because the new variant carries `Vec<u8>`. API-breaking to the type's trait bounds. Blast radius is small (callers consume `Hangup { reason }` by value), but worth being aware of if anyone elsewhere `*reason`'d an enum reference.
+2. **Scope creep, but properly disclosed.** This commit also contains T1.5 migration gap-fixes (desktop `engine.rs`, `cli.rs:727`, android `engine.rs`/`pipeline.rs`). Strictly per rule #7 they'd be a `T1.5.3`, but the fixes are tiny mechanical v2-field touches, disclosure is clear, and bundling avoids dead-weight commits.
+3. **Pre-existing `tauri::Emitter` unused-import warning** in `desktop/src-tauri/src/engine.rs:15`. Not introduced by T1.6; clean up whenever desktop gets touched again.