feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3)

design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N
simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security
invariant preserved per-ring.

- proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped
  before the magic; the driver publisher refuses a cross-bound ring via the shared,
  unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index
  validation applied to frames, invariant #10); the host's wait_for_attach surfaces the
  refusal loudly and self-checks its own stamp.
- manager: the one-monitor MgrState becomes a slot map keyed by the client's identity
  slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts,
  slot-scoped begin_idd_setup (a different identity is an admission question, never a
  preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release.
- group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is
  never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in
  captures, last-out restores); desktop layout via CCD source origins from the pure
  layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure.
- admission: the Windows separate→reject override now sits behind the
  PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone —
  a second identity gets its own monitor + ring; default flips in W5 after soak);
  max_displays and NVENC session-unit budgets decline an unaffordable display AT
  admission; kick_dwm_compose is process-globally throttled and per-display — cursor
  jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current
  state at the next vsync tick).

On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors
streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean
(no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed
budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed.
V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up
(the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1
recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's
load-bearing unknown, answered yes.

Also carries the client-HDR EDID forwarding that shared this working tree
(Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block,
PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive
with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/pf-presenter/src/vk.rs

@@ -341,6 +341,11 @@ pub struct Presenter {
     hdr10_format: Option<vk::SurfaceFormatKHR>,
     /// PQ frames are on screen and the swapchain is in HDR10 mode.
     hdr_active: bool,
+    /// One-shot latch: a PQ frame arrived but the surface offers no HDR10 colorspace, so the
+    /// CSC pass silently tone-maps to SDR. Warned once — the single most useful signal for
+    /// diagnosing "HDR isn't advertised" (e.g. gamescope's WSI layer invisible in a flatpak
+    /// sandbox) vs. the host simply not sending PQ.
+    hdr_downgrade_warned: bool,
     /// `VK_EXT_hdr_metadata` device fns when the driver offers them (gamescope/KDE do).
     hdr_metadata_d: Option<ash::ext::hdr_metadata::Device>,
     /// The host's latest ST.2086/CLL metadata (the 0xCE plane) — pushed to the
@@ -739,6 +744,7 @@ impl Presenter {
             format,
             hdr10_format,
             hdr_active: false,
+            hdr_downgrade_warned: false,
             hdr_metadata_d,
             hdr_meta: None,
             video_format: vk::Format::R8G8B8A8_UNORM,
@@ -1066,6 +1072,19 @@ impl Presenter {
             FrameInput::D3d11(d) => Some(d.color.is_pq()),
         };
         if let Some(pq) = frame_pq {
+            // A PQ stream we can only tone-map (no HDR10 surface) is the silent failure behind
+            // "HDR isn't advertised": the compositor never sees an HDR-committing app. Say so
+            // once — its presence proves PQ IS arriving and the surface/compositor is the
+            // blocker (on the Deck: gamescope's WSI layer not visible in the flatpak sandbox);
+            // its absence, with a plain SDR stream, points back at the host not sending PQ.
+            if pq && self.hdr10_format.is_none() && !self.hdr_downgrade_warned {
+                self.hdr_downgrade_warned = true;
+                tracing::warn!(
+                    "PQ (HDR10) stream tone-mapped to SDR — the surface offers no HDR10 \
+                     colorspace, so no HDR is committed to the compositor. Under gamescope this \
+                     usually means the gamescope Vulkan WSI layer is not visible in the sandbox."
+                );
+            }
             let want = pq && self.hdr10_format.is_some();
             if want != self.hdr_active {
                 self.set_hdr_mode(window, want)?;