docs: protocol audit 2026-05-25, update architecture + Obsidian vault

Audit:
- docs/AUDIT-2026-05-25.md: full protocol audit covering 8 findings
  (4 critical, 2 high, 5 medium, 4 low) with code references and fix
  effort estimates
- vault/Audit/Tasks.md: Obsidian Tasks plugin file tracking all audit
  items with priorities, due dates, and per-step checklists

Architecture docs updated for Wire format v2 and Wave 5/6 features:
- ARCHITECTURE.md: adds wzp-video to dependency graph and project
  structure; wire format updated to v2 (16B header, 5B MiniHeader);
  relay concurrency section corrected (DashMap+RwLock is current, not
  a future optimization); test count 571→702; Android note
- PROGRESS.md: Wave 5 and Wave 6 sections appended; test count 372→702;
  current status and open blockers as of 2026-05-25
- ROAD-TO-VIDEO.md: implementation status table inserted (✅/🟡/🔴/🔲
  per phase); 6-step critical path to first video call
- WZP-SPEC.md: MediaHeader updated to v2 (16B byte-aligned); MiniHeader
  updated to 5B with seq_delta; codec IDs 9-12 added (H.264/H.265/AV1);
  version negotiation section added

Obsidian vault (vault/):
- 114 files across Architecture/, PRDs/, Reports/, Android/,
  Reference/, Audit/ with YAML frontmatter
- 00 - Home.md index note with wiki links
- .obsidian/app.json config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vault/Reports/T2.2-report.md

@@ -0,0 +1,122 @@
+---
+tags: [report, wzp]
+type: report
+status: Approved
+---
+
+# T2.2 — `BandwidthEstimator` in `wzp-proto::bandwidth`
+
+**Status:** Approved
+**Agent:** Kimi Code CLI
+**Started:** 2026-05-11T17:05Z
+**Completed:** 2026-05-11T17:12Z
+**Commit:** (see git log)
+**PRD:** ../PRD-transport-feedback-bwe.md
+
+## What I changed
+
+- `crates/wzp-transport/src/quic.rs` — Extended `QuinnPathSnapshot`:
+  - Renamed `cwnd` → `cwnd_bytes` for clarity (already in bytes).
+  - Added `bytes_in_flight: u64` (set to 0 because quinn 0.11.14 `PathStats` does not expose this field yet; reserved for future upgrade).
+- `crates/wzp-proto/src/bandwidth.rs` — Extended `BandwidthEstimator` with transport-feedback BWE fields:
+  - Added `cwnd_bps: AtomicU64`, `peer_remb_bps: AtomicU64`, `smoothed_bps: AtomicU64`, `last_smoothed_ms: AtomicU64`.
+  - Added `update_from_path(cwnd_bytes, _bytes_in_flight, rtt_ms)` — computes `cwnd_bps = cwnd_bytes * 8 / rtt_s`.
+  - Added `update_from_peer(fb_remb_bps: u32)` — stores peer REMB.
+  - Added `target_send_bps(&self) -> u64` — returns `0.9 * min(cwnd_bps, peer_remb_bps)`.
+  - Added `smoothed_bps(&self) -> u64` — returns the EWMA-smoothed estimate.
+  - EWMA smoothing uses a 2-second half-life: `alpha = 1 - 0.5^(dt_ms / 2000)`.
+
+## Why these choices
+
+`QuinnPathSnapshot` lives in `wzp-transport`; `BandwidthEstimator` lives in `wzp-proto`. Since `wzp-proto` cannot depend on `wzp-transport`, `update_from_path` takes raw scalar values instead of the snapshot struct. Callers in `wzp-client` (T2.3) will destructure `QuinnPathSnapshot` and pass the fields through.
+
+`peer_remb_bps` defaults to `u64::MAX` so that before any peer feedback arrives, `target_send_bps` is gated purely by the local `cwnd_bps` estimate.
+
+## Deviations from the task spec
+
+- Task step 3 shows `update_from_quinn(&self, snap: &QuinnPathSnapshot)`. This signature is impossible because `QuinnPathSnapshot` is in `wzp-transport` and `wzp-proto` cannot depend on it. Replaced with `update_from_path(cwnd_bytes: u64, bytes_in_flight: u64, rtt_ms: u32)` which preserves the same computation.
+- `bytes_in_flight` is hard-coded to `0` in `QuinnPathSnapshot` because quinn 0.11.14 does not expose it on `PathStats`. A comment documents this.
+
+## Verification output
+
+```bash
+$ cargo test -p wzp-proto bandwidth
+running 15 tests
+...(all 15 pass)...
+
+test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 103 filtered out; finished in 0.11s
+```
+
+```bash
+$ cargo test -p wzp-transport
+running 11 tests
+...(all 11 pass)...
+
+test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+```
+
+## Test summary
+
+- Tests added: 3
+  - `target_send_bps_uses_min_of_cwnd_and_remb`
+  - `target_send_bps_with_zero_cwnd_uses_remb`
+  - `smoothed_bps_ewma_converges`
+- Tests modified: 0
+- `wzp-proto` test count: 115 (was 112 before Wave 2)
+- `wzp-transport` test count: 11 (unchanged)
+- `cargo clippy -p wzp-proto -p wzp-transport --all-targets -- -D warnings`: pass
+- `cargo fmt --all -- --check`: pass
+
+## Risks / follow-ups
+
+- `bytes_in_flight` is stubbed at 0. When quinn exposes it (or when we upgrade quinn), update `quinn_path_stats()` to populate the real value.
+- T2.3 will call `update_from_path` from the send loop and `update_from_peer` from the recv loop, so the atomic fields will be contended. `Relaxed` ordering is sufficient because the values are independent estimates; the worst race is a slightly stale `target_send_bps`.
+
+## Reviewer checklist (filled in by reviewer)
+
+- [x] Code matches PRD intent — `BandwidthEstimator` extended with cwnd/REMB fusion + EWMA smoothing
+- [x] Verification output is real — re-ran `cargo test -p wzp-proto bandwidth` (15 pass), clippy clean on `wzp-proto` + `wzp-transport`
+- [x] No backward-incompat surprises — additive change to an existing struct
+- [x] Tests cover the new behavior — 3 new tests cover cwnd-vs-remb min, zero-cwnd fallback, EWMA convergence
+- [x] Approved (with workflow note below)
+
+### Reviewer notes (2026-05-11)
+
+**Substance: solid.**
+
+- Cross-crate fix is correct: `wzp-proto` cannot depend on `wzp-transport`, so `update_from_path(cwnd_bytes, _bytes_in_flight, rtt_ms)` takes scalars instead of the snapshot. Cleaner than introducing a circular dep. Disclosed under "Deviations".
+- `peer_remb_bps` defaults to `u64::MAX` so that pre-feedback the target is gated purely by local cwnd. Right default.
+- EWMA half-life of 2 s matches the PRD spec.
+- `Relaxed` atomic ordering is justified — these are independent estimates, worst race is a slightly stale value. Agreed.
+- `bytes_in_flight: 0` stub is explicit and documented (quinn 0.11.14 doesn't expose it). Honest engineering.
+
+**Process — firm but final reminder on rule #7.**
+
+Workflow timeline:
+- 17:00Z agent claims T2.1
+- 17:04Z agent moves T2.1 → Pending Review (no commit existed)
+- 17:05Z agent claims T2.2 *without waiting for T2.1 approval*
+- (later) I flip T2.1 → Changes Requested (rule #5: never committed)
+- Agent commits T2.1 (`fe1f948`) but does NOT update T2.1 report/board, continues T2.2
+- 17:12Z agent moves T2.2 → Pending Review
+- 17:16Z agent commits T2.2 (`3de56cf`)
+
+**Two rule violations in one cycle:**
+
+1. **Rule #5/#6** (status-board-before-commit) — same as the T2.1 violation that prompted Changes Requested. Agent never appended the Rework section to T2.1; I wrote it for them.
+2. **Rule #7** — T2.2 was claimed and worked on before T2.1 was approved.
+
+I'm approving both retroactively because the substance is fine, both commits exist, and reverting to fix workflow technicalities after the fact would be net-negative.
+
+**This is the last time I will be lenient on the "claim next task before approval" violation.** Going forward:
+
+- If T2.x is `Pending Review`, do not claim T2.(x+1). Wait for `Approved`.
+- If your work is staged, run `git commit` BEFORE flipping the board status — do not flip-then-commit.
+- If you receive `Changes Requested`, address it on the SAME report (append Rework section, update status, fill in real commit SHA) before working on anything else.
+
+The substance from this agent has been consistently strong; the process discipline is what's drifting. Tighten it.
+
+### Closed retroactively (2026-05-11)
+
+Commit `3de56cf` verified: 15 bandwidth tests pass, clippy clean, fmt clean.
+- [ ] Approved