feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3)

design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N
simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security
invariant preserved per-ring.

- proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped
  before the magic; the driver publisher refuses a cross-bound ring via the shared,
  unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index
  validation applied to frames, invariant #10); the host's wait_for_attach surfaces the
  refusal loudly and self-checks its own stamp.
- manager: the one-monitor MgrState becomes a slot map keyed by the client's identity
  slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts,
  slot-scoped begin_idd_setup (a different identity is an admission question, never a
  preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release.
- group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is
  never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in
  captures, last-out restores); desktop layout via CCD source origins from the pure
  layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure.
- admission: the Windows separate→reject override now sits behind the
  PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone —
  a second identity gets its own monitor + ring; default flips in W5 after soak);
  max_displays and NVENC session-unit budgets decline an unaffordable display AT
  admission; kick_dwm_compose is process-globally throttled and per-display — cursor
  jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current
  state at the next vsync tick).

On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors
streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean
(no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed
budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed.
V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up
(the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1
recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's
load-bearing unknown, answered yes.

Also carries the client-HDR EDID forwarding that shared this working tree
(Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block,
PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive
with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/windows/src/present.rs

@@ -834,6 +834,52 @@ pub fn display_supports_hdr() -> bool {
     false
 }
 
+/// The HDR display's colour volume from `IDXGIOutput6::GetDesc1` — the first output currently in
+/// HDR (BT.2020 PQ) mode, as [`HdrMeta`](punktfunk_core::quic::HdrMeta) for `Hello::display_hdr`.
+/// The host writes this volume into its virtual display's EDID, so host apps tone-map to THIS
+/// panel and the PQ stream needs no client-side rescue. Chromaticities come as CIE xy floats
+/// (×50000 → ST.2086 units, G/B/R order); luminances as nits floats (max ×10000 → 0.0001-cd/m²
+/// units); `MaxFullFrameLuminance` → MaxFALL (whole nits); MaxCLL stays 0 (a display has no
+/// content light level). Same ANY-output coarseness as [`display_supports_hdr`] — the session
+/// gates on that check first, so both look at the same panel in the single-HDR-display case.
+pub fn display_hdr_volume() -> Option<punktfunk_core::quic::HdrMeta> {
+    let to_2086 = |v: f32| (v * 50000.0).round().clamp(0.0, 65535.0) as u16;
+    unsafe {
+        let factory: IDXGIFactory1 = CreateDXGIFactory1().ok()?;
+        let mut ai = 0u32;
+        while let Ok(adapter) = factory.EnumAdapters1(ai) {
+            ai += 1;
+            let mut oi = 0u32;
+            while let Ok(output) = adapter.EnumOutputs(oi) {
+                oi += 1;
+                let Ok(o6) = output.cast::<IDXGIOutput6>() else {
+                    continue;
+                };
+                let Ok(desc) = o6.GetDesc1() else { continue };
+                if desc.ColorSpace != DXGI_COLOR_SPACE_RGB_FULL_G2084_NONE_P2020 {
+                    continue;
+                }
+                return Some(punktfunk_core::quic::HdrMeta {
+                    // ST.2086 order is G, B, R.
+                    display_primaries: [
+                        [to_2086(desc.GreenPrimary[0]), to_2086(desc.GreenPrimary[1])],
+                        [to_2086(desc.BluePrimary[0]), to_2086(desc.BluePrimary[1])],
+                        [to_2086(desc.RedPrimary[0]), to_2086(desc.RedPrimary[1])],
+                    ],
+                    white_point: [to_2086(desc.WhitePoint[0]), to_2086(desc.WhitePoint[1])],
+                    max_display_mastering_luminance: (desc.MaxLuminance.max(0.0) * 10_000.0).round()
+                        as u32,
+                    min_display_mastering_luminance: (desc.MinLuminance.max(0.0) * 10_000.0).round()
+                        as u32,
+                    max_cll: 0,
+                    max_fall: desc.MaxFullFrameLuminance.max(0.0).round() as u16,
+                });
+            }
+        }
+    }
+    None
+}
+
 /// Generic HDR10 mastering metadata: BT.2020 primaries + D65 white, a 1000-nit mastering display,
 /// MaxCLL 1000 / MaxFALL 400. The fallback used only until the host's real `0xCE` metadata arrives.
 fn generic_hdr10_metadata() -> DXGI_HDR_METADATA_HDR10 {

clients/windows/src/session.rs

@@ -144,6 +144,7 @@ pub fn run_speed_probe(
         2, // audio_channels: stereo baseline
         crate::video::decodable_codecs(),
         0,    // preferred_codec: no preference
+        None, // display_hdr: probe connect, nothing presents
         None, // launch: no game
         pin,
         Some(identity),
@@ -235,6 +236,34 @@ fn pump(
     frame_rx: FrameRx,
     stop: Arc<AtomicBool>,
 ) {
+    // Advertise 10-bit + HDR10 only when the user enabled HDR AND a display is actually in HDR
+    // mode: the host then upgrades HDR content to a Main10/PQ stream (its own 10-bit gate still
+    // applies). On an SDR display we advertise `0` so the host sends a proper 8-bit BT.709 stream
+    // rather than PQ the panel would mis-tone-map (washed-out/dark). The presenter handles BT.2020
+    // PQ frames (P010 / X2BGR10).
+    let hdr_active = params.hdr_enabled && crate::present::display_supports_hdr();
+    if params.hdr_enabled && !hdr_active {
+        tracing::info!("HDR enabled in settings but no HDR display detected — requesting SDR");
+    }
+    // With HDR active, also report the panel's real colour volume (GetDesc1): the host writes it
+    // into its virtual display's EDID, so host apps tone-map to THIS panel and the PQ stream
+    // arrives already inside its volume — the client presents it untouched.
+    // PUNKTFUNK_CLIENT_PEAK_NITS pins a synthetic volume for A/B runs.
+    let display_hdr = if hdr_active {
+        let vol = punktfunk_core::client::display_hdr_env_override()
+            .or_else(crate::present::display_hdr_volume);
+        if let Some(m) = vol {
+            tracing::info!(
+                max_nits = m.max_display_mastering_luminance / 10_000,
+                min_millinits = m.min_display_mastering_luminance / 10,
+                max_fall = m.max_fall,
+                "advertising this display's HDR volume to the host"
+            );
+        }
+        vol
+    } else {
+        None
+    };
     let connector = match NativeClient::connect(
         &params.host,
         params.port,
@@ -242,25 +271,16 @@ fn pump(
         params.compositor,
         params.gamepad,
         params.bitrate_kbps,
-        // Advertise 10-bit + HDR10 only when the user enabled HDR AND a display is actually in HDR
-        // mode: the host then upgrades HDR content to a Main10/PQ stream (its own 10-bit gate still
-        // applies). On an SDR display we advertise `0` so the host sends a proper 8-bit BT.709 stream
-        // rather than PQ the panel would mis-tone-map (washed-out/dark). An HDR display self-tone-maps
-        // from the mastering metadata we apply. The presenter handles BT.2020 PQ frames (P010 / X2BGR10).
-        if params.hdr_enabled && crate::present::display_supports_hdr() {
+        if hdr_active {
             punktfunk_core::quic::VIDEO_CAP_10BIT | punktfunk_core::quic::VIDEO_CAP_HDR
         } else {
-            if params.hdr_enabled {
-                tracing::info!(
-                    "HDR enabled in settings but no HDR display detected — requesting SDR"
-                );
-            }
             0
         },
         params.audio_channels,
         crate::video::decodable_codecs(), // codecs FFmpeg can decode (HEVC/H.264/AV1)
         params.preferred_codec,           // the user's soft codec preference (0 = auto)
-        None,                             // launch: the Windows client has no library picker yet
+        display_hdr,
+        None, // launch: the Windows client has no library picker yet
         params.pin,
         Some(params.identity),
         params.connect_timeout,