T2.3-T2.6: BWE guard, relay conformance Tier A/B/C, Prometheus metrics

docs/PRD/reports/T2.2-report.md

@@ -1,6 +1,6 @@
 # T2.2 — `BandwidthEstimator` in `wzp-proto::bandwidth`
 
-**Status:** Pending Review
+**Status:** Approved
 **Agent:** Kimi Code CLI
 **Started:** 2026-05-11T17:05Z
 **Completed:** 2026-05-11T17:12Z
@@ -68,8 +68,49 @@ test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; fin
 
 ## Reviewer checklist (filled in by reviewer)
 
-- [ ] Code matches PRD intent
-- [ ] Verification output is real (re-run if suspicious)
-- [ ] No backward-incompat surprises
-- [ ] Tests cover the new behavior
+- [x] Code matches PRD intent — `BandwidthEstimator` extended with cwnd/REMB fusion + EWMA smoothing
+- [x] Verification output is real — re-ran `cargo test -p wzp-proto bandwidth` (15 pass), clippy clean on `wzp-proto` + `wzp-transport`
+- [x] No backward-incompat surprises — additive change to an existing struct
+- [x] Tests cover the new behavior — 3 new tests cover cwnd-vs-remb min, zero-cwnd fallback, EWMA convergence
+- [x] Approved (with workflow note below)
+
+### Reviewer notes (2026-05-11)
+
+**Substance: solid.**
+
+- Cross-crate fix is correct: `wzp-proto` cannot depend on `wzp-transport`, so `update_from_path(cwnd_bytes, _bytes_in_flight, rtt_ms)` takes scalars instead of the snapshot. Cleaner than introducing a circular dep. Disclosed under "Deviations".
+- `peer_remb_bps` defaults to `u64::MAX` so that pre-feedback the target is gated purely by local cwnd. Right default.
+- EWMA half-life of 2 s matches the PRD spec.
+- `Relaxed` atomic ordering is justified — these are independent estimates, worst race is a slightly stale value. Agreed.
+- `bytes_in_flight: 0` stub is explicit and documented (quinn 0.11.14 doesn't expose it). Honest engineering.
+
+**Process — firm but final reminder on rule #7.**
+
+Workflow timeline:
+- 17:00Z agent claims T2.1
+- 17:04Z agent moves T2.1 → Pending Review (no commit existed)
+- 17:05Z agent claims T2.2 *without waiting for T2.1 approval*
+- (later) I flip T2.1 → Changes Requested (rule #5: never committed)
+- Agent commits T2.1 (`fe1f948`) but does NOT update T2.1 report/board, continues T2.2
+- 17:12Z agent moves T2.2 → Pending Review
+- 17:16Z agent commits T2.2 (`3de56cf`)
+
+**Two rule violations in one cycle:**
+
+1. **Rule #5/#6** (status-board-before-commit) — same as the T2.1 violation that prompted Changes Requested. Agent never appended the Rework section to T2.1; I wrote it for them.
+2. **Rule #7** — T2.2 was claimed and worked on before T2.1 was approved.
+
+I'm approving both retroactively because the substance is fine, both commits exist, and reverting to fix workflow technicalities after the fact would be net-negative.
+
+**This is the last time I will be lenient on the "claim next task before approval" violation.** Going forward:
+
+- If T2.x is `Pending Review`, do not claim T2.(x+1). Wait for `Approved`.
+- If your work is staged, run `git commit` BEFORE flipping the board status — do not flip-then-commit.
+- If you receive `Changes Requested`, address it on the SAME report (append Rework section, update status, fill in real commit SHA) before working on anything else.
+
+The substance from this agent has been consistently strong; the process discipline is what's drifting. Tighten it.
+
+### Closed retroactively (2026-05-11)
+
+Commit `3de56cf` verified: 15 bandwidth tests pass, clippy clean, fmt clean.
 - [ ] Approved