docs: protocol audit 2026-05-25, update architecture + Obsidian vault

Audit:
- docs/AUDIT-2026-05-25.md: full protocol audit covering 8 findings
  (4 critical, 2 high, 5 medium, 4 low) with code references and fix
  effort estimates
- vault/Audit/Tasks.md: Obsidian Tasks plugin file tracking all audit
  items with priorities, due dates, and per-step checklists

Architecture docs updated for Wire format v2 and Wave 5/6 features:
- ARCHITECTURE.md: adds wzp-video to dependency graph and project
  structure; wire format updated to v2 (16B header, 5B MiniHeader);
  relay concurrency section corrected (DashMap+RwLock is current, not
  a future optimization); test count 571→702; Android note
- PROGRESS.md: Wave 5 and Wave 6 sections appended; test count 372→702;
  current status and open blockers as of 2026-05-25
- ROAD-TO-VIDEO.md: implementation status table inserted (✅/🟡/🔴/🔲
  per phase); 6-step critical path to first video call
- WZP-SPEC.md: MediaHeader updated to v2 (16B byte-aligned); MiniHeader
  updated to 5B with seq_delta; codec IDs 9-12 added (H.264/H.265/AV1);
  version negotiation section added

Obsidian vault (vault/):
- 114 files across Architecture/, PRDs/, Reports/, Android/,
  Reference/, Audit/ with YAML frontmatter
- 00 - Home.md index note with wiki links
- .obsidian/app.json config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vault/Reports/T5.4-report.md

@@ -0,0 +1,85 @@
+---
+tags: [report, wzp]
+type: report
+status: Pending Review
+---
+
+# T5.4 — H.265 encoder/decoder (reuse framer from T4.1)
+
+**Status:** Pending Review
+**Agent:** Kimi Code CLI
+**Started:** 2026-05-12T17:40Z
+**Completed:** 2026-05-12T18:15Z
+**Commit:** b197651
+**PRD:** ../PRD-video-multicodec.md
+
+## What I changed
+
+- `crates/wzp-proto/src/codec_id.rs:21` — Added `H265Main = 11` to `CodecId` enum.
+- `crates/wzp-proto/src/codec_id.rs:55-65` — Updated `bitrate_bps()`, `frame_duration_ms()`, `sample_rate_hz()`, `is_video()` to handle `H265Main` (returns 0 for audio-specific methods, `true` for `is_video()`).
+- `crates/wzp-video/src/videotoolbox.rs:300-480` — Added `VideoToolboxHevcEncoder` (macOS) wrapping `shiguredo_video_toolbox::Encoder` with `HevcEncoderConfig` / `HevcProfile::Main`.
+- `crates/wzp-video/src/videotoolbox.rs:490-640` — Added `VideoToolboxHevcDecoder` (macOS) with lazy init on VPS/SPS/PPS extraction.
+- `crates/wzp-video/src/videotoolbox.rs:650-700` — Added `extract_vps_sps_pps()` and `HevcParameterSets` type alias.
+- `crates/wzp-video/src/mediacodec.rs:400-680` — Added `MediaCodecHevcEncoder` and `MediaCodecHevcDecoder` (Android-only) using `video/hevc` MIME type. Non-Android targets return `VideoError::NotInitialized`.
+- `crates/wzp-video/src/lib.rs` — Re-exported the four new HEVC types.
+- `crates/wzp-codec/src/opus_enc.rs`, `crates/wzp-client/src/call.rs`, `crates/wzp-relay/src/conformance.rs` — Added `H265Main` match arms to fix exhaustive-match breakage.
+
+## Why these choices
+
+Reused the existing `H264Framer` / `H264Depacketizer` for H.265 because both codecs use Annex-B NAL start codes and FU-A fragmentation (RFC 7798 mirrors RFC 6184). The only codec-specific difference is parameter-set extraction: HEVC needs VPS + SPS + PPS instead of SPS + PPS alone. `CodecId::H265Main` is slotted at `11`, leaving `10` for `H264Main` (reserved).
+
+## Deviations from the task spec
+
+None.
+
+## Verification output
+
+```bash
+$ cargo test -p wzp-video -- hevc
+   Compiling wzp-video v0.1.0
+    Finished `test` profile [unoptimized + debuginfo] target(s) in 2.29s
+     Running unittests src/lib.rs (target/debug/deps/wzp_video-...)
+
+running 8 tests
+test mediacodec::tests::hevc_is_keyframe_detects_idr ... ok
+test mediacodec::tests::hevc_mediacodec_decoder_returns_not_initialized_on_non_android ... ok
+test videotoolbox::tests::hevc_decoder_instantiates ... ok
+test mediacodec::tests::hevc_mediacodec_encoder_returns_not_initialized_on_non_android ... ok
+test videotoolbox::tests::extract_vps_sps_pps_finds_hevc_params ... ok
+test videotoolbox::tests::hevc_is_keyframe_detects_idr ... ok
+test videotoolbox::tests::hevc_request_keyframe_sets_flag ... ok
+test videotoolbox::tests::hevc_encoder_instantiates ... ok
+
+test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 53 filtered out
+```
+
+```bash
+$ cargo fmt --all -- --check
+# pass
+```
+
+```bash
+$ cargo clippy -p wzp-video --all-targets -- -D warnings
+# pass
+```
+
+## Test summary
+
+- Tests added: 7
+- Tests modified: 0
+- Workspace test count before: 53 / after: 61 (wzp-video)
+- `cargo clippy -p wzp-video --all-targets -- -D warnings`: pass
+- `cargo fmt --all -- --check`: pass
+
+## Risks / follow-ups
+
+1. **Android HEVC not validated on device** — `MediaCodecHevcEncoder/Decoder` compile but return `NotInitialized` on non-Android targets. Real validation requires the Android builder (T4.3.1.1).
+2. **Keyframe detection for HEVC** — Uses NAL types 19/20/32 (IDR/CRA/RAP). May need refinement if we encounter non-IDR keyframes in the wild.
+
+## Reviewer checklist (filled in by reviewer)
+
+- [ ] Code matches PRD intent
+- [ ] Verification output is real (re-run if suspicious)
+- [ ] No backward-incompat surprises
+- [ ] Tests cover the new behavior
+- [ ] Approved