docs: protocol audit 2026-05-25, update architecture + Obsidian vault

Audit:
- docs/AUDIT-2026-05-25.md: full protocol audit covering 8 findings
  (4 critical, 2 high, 5 medium, 4 low) with code references and fix
  effort estimates
- vault/Audit/Tasks.md: Obsidian Tasks plugin file tracking all audit
  items with priorities, due dates, and per-step checklists

Architecture docs updated for Wire format v2 and Wave 5/6 features:
- ARCHITECTURE.md: adds wzp-video to dependency graph and project
  structure; wire format updated to v2 (16B header, 5B MiniHeader);
  relay concurrency section corrected (DashMap+RwLock is current, not
  a future optimization); test count 571→702; Android note
- PROGRESS.md: Wave 5 and Wave 6 sections appended; test count 372→702;
  current status and open blockers as of 2026-05-25
- ROAD-TO-VIDEO.md: implementation status table inserted (✅/🟡/🔴/🔲
  per phase); 6-step critical path to first video call
- WZP-SPEC.md: MediaHeader updated to v2 (16B byte-aligned); MiniHeader
  updated to 5B with seq_delta; codec IDs 9-12 added (H.264/H.265/AV1);
  version negotiation section added

Obsidian vault (vault/):
- 114 files across Architecture/, PRDs/, Reports/, Android/,
  Reference/, Audit/ with YAML frontmatter
- 00 - Home.md index note with wiki links
- .obsidian/app.json config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vault/Reports/T1.5.2-report.md

@@ -0,0 +1,74 @@
+---
+tags: [report, wzp]
+type: report
+status: Approved
+---
+
+# T1.5.2 — Workspace clippy hygiene + document pre-existing debt
+
+**Status:** Approved
+**Agent:** Kimi Code CLI
+**Started:** 2026-05-11T10:15Z
+**Completed:** 2026-05-11T10:20Z
+**Commit:** 5cdb501
+**PRD:** ../PRD-wire-format-v2.md (process)
+
+## What I changed
+
+- `docs/PROTOCOL-AUDIT.md` — Added **"Known pre-existing clippy debt (as of T1.5.2)"** section. Documents 9 errors in `wzp-codec` (6 categories: implicit saturating sub, needless range loop, manual div_ceil, manual clamp, manual ASCII case-cmp, same-item push) and 3 errors in `warzone-protocol` submodule (clone_on_copy, new_without_default ×2). References commit `c93d302`.
+- `docs/PRD/TASKS.md` — Updated report template's "Test summary" section: changed `cargo clippy ...: pass / fail` to `pass / fail (or N known-debt errors in <crate>; see PROTOCOL-AUDIT.md)`.
+- `docs/PRD/TASKS.md` — Updated coding standard #3 and environment-setup conventions to clarify that pre-existing debt in untouched crates is not the agent's problem.
+
+## Why these choices
+
+The debt is pre-existing (verified against `HEAD~1`) and lives in crates not touched by Wave 1. Rather than forcing every agent to rediscover and re-discuss the same errors, we document them once and update the report template so agents can acknowledge them concisely. The submodule errors (`warzone-protocol`) are explicitly called out as out-of-scope since they're in a dependency.
+
+## Deviations from the task spec
+
+None. Skipped the optional `tools/` script (step 4) — the `PROTOCOL-AUDIT.md` table is sufficient for human agents to verify at a glance, and the verify commands in the task already pass without it.
+
+## Verification output
+
+```bash
+$ grep -c "Known pre-existing clippy debt" docs/PROTOCOL-AUDIT.md
+1
+```
+
+```bash
+$ grep -c "or N known-debt errors" docs/PRD/TASKS.md
+3
+```
+
+```bash
+$ cargo clippy --workspace --all-targets -- -D warnings 2>&1 | grep -E "^error\b" | wc -l
+12
+```
+
+(12 errors — 9 in `wzp-codec`, 3 in `warzone-protocol` — all pre-existing and documented.)
+
+## Test summary
+
+- Tests added: 0
+- Tests modified: 0
+- Workspace test count before: 572 / after: 572
+- `cargo clippy -p wzp-proto --all-targets -- -D warnings`: pass
+- `cargo fmt --all -- --check`: pass
+
+## Risks / follow-ups
+
+- A dedicated hygiene sprint should fix the 9 `wzp-codec` errors — they're all mechanical replacements (`saturating_sub`, `.div_ceil()`, `.clamp()`, `for x in &mut arr` instead of index loop, etc.).
+- The `warzone-protocol` submodule errors should be fixed upstream in `deps/featherchat`.
+
+## Reviewer checklist (filled in by reviewer)
+
+- [x] Code matches PRD intent — PROTOCOL-AUDIT.md known-debt section present with accurate per-crate breakdown; report template updated; standard #3 amended
+- [x] Verification output is real — re-confirmed the section, template wording, and 12-error count
+- [x] No backward-incompat surprises — docs-only
+- [x] Tests cover the new behavior — n/a (docs)
+- [x] Approved
+
+### Reviewer notes (2026-05-11)
+
+Approved. Skipping the optional `tools/` script was the right call — a 12-error table is self-documenting; a script for it would be over-engineering. Standard #3 amendment ("Pre-existing debt in other crates [...] is not your problem") is a clean, narrow exception that protects agents without weakening the rule.
+
+One forward note: the eventual `wzp-codec` hygiene work should fix all 9 errors in one focused commit — they're mechanical (`saturating_sub`, `div_ceil`, `clamp`, etc.) and want a single coherent change. Implicit in the "Policy" line of the new section; consider promoting to an explicit Wave-6 or post-V1 task entry when planning the next backlog.