feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3)

design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N
simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security
invariant preserved per-ring.

- proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped
  before the magic; the driver publisher refuses a cross-bound ring via the shared,
  unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index
  validation applied to frames, invariant #10); the host's wait_for_attach surfaces the
  refusal loudly and self-checks its own stamp.
- manager: the one-monitor MgrState becomes a slot map keyed by the client's identity
  slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts,
  slot-scoped begin_idd_setup (a different identity is an admission question, never a
  preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release.
- group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is
  never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in
  captures, last-out restores); desktop layout via CCD source origins from the pure
  layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure.
- admission: the Windows separate→reject override now sits behind the
  PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone —
  a second identity gets its own monitor + ring; default flips in W5 after soak);
  max_displays and NVENC session-unit budgets decline an unaffordable display AT
  admission; kick_dwm_compose is process-globally throttled and per-display — cursor
  jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current
  state at the next vsync tick).

On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors
streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean
(no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed
budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed.
V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up
(the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1
recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's
load-bearing unknown, answered yes.

Also carries the client-HDR EDID forwarding that shared this working tree
(Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block,
PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive
with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/client.rs

@@ -552,6 +552,11 @@ impl NativeClient {
         // it emits from these and echoes it in [`NativeClient::codec`].
         video_codecs: u8,
         preferred_codec: u8,
+        // The client display's HDR colour volume (primaries/white/luminance), read from the OS
+        // (e.g. DXGI `GetDesc1`) when presenting HDR. The host forwards it into the virtual
+        // display's EDID so host apps tone-map to the client's real panel; `None` = unknown/SDR
+        // (the host keeps its built-in EDID defaults). See [`crate::quic::Hello::display_hdr`].
+        display_hdr: Option<HdrMeta>,
         launch: Option<String>,
         pin: Option<[u8; 32]>,
         identity: Option<(String, String)>,
@@ -618,6 +623,7 @@ impl NativeClient {
                     audio_channels,
                     video_codecs,
                     preferred_codec,
+                    display_hdr,
                     launch,
                     pin,
                     identity,
@@ -1118,6 +1124,33 @@ impl Drop for NativeClient {
     }
 }
 
+/// Test/A-B hatch shared by the client shells: `PUNKTFUNK_CLIENT_PEAK_NITS=<nits>` synthesizes a
+/// display colour volume at that peak (BT.2020 primaries, D65, a 0.005-nit floor, frame-average
+/// unknown) for [`Hello::display_hdr`](crate::quic::Hello::display_hdr), overriding whatever the
+/// shell read from the OS — so the host-side tone-map target (the virtual display's EDID volume)
+/// can be pinned exactly for validation, and shells with no OS display-volume query get a manual
+/// knob. `None` when unset/unparsable/zero.
+pub fn display_hdr_env_override() -> Option<HdrMeta> {
+    let nits: u32 = std::env::var("PUNKTFUNK_CLIENT_PEAK_NITS")
+        .ok()?
+        .trim()
+        .parse()
+        .ok()
+        .filter(|&n| n > 0)?;
+    tracing::info!(
+        nits,
+        "PUNKTFUNK_CLIENT_PEAK_NITS: overriding the advertised display volume"
+    );
+    Some(HdrMeta {
+        display_primaries: [[8500, 39850], [6550, 2300], [35400, 14600]], // BT.2020 G, B, R
+        white_point: [15635, 16450],                                      // D65
+        max_display_mastering_luminance: nits.saturating_mul(10_000),
+        min_display_mastering_luminance: 50, // 0.005 nits
+        max_cll: 0,
+        max_fall: 0,
+    })
+}
+
 struct WorkerArgs {
     host: String,
     port: u16,
@@ -1129,6 +1162,7 @@ struct WorkerArgs {
     audio_channels: u8,
     video_codecs: u8,
     preferred_codec: u8,
+    display_hdr: Option<HdrMeta>,
     launch: Option<String>,
     pin: Option<[u8; 32]>,
     identity: Option<(String, String)>,
@@ -1171,6 +1205,7 @@ async fn worker_main(args: WorkerArgs) {
         audio_channels,
         video_codecs,
         preferred_codec,
+        display_hdr,
         launch,
         pin,
         identity,
@@ -1250,6 +1285,9 @@ async fn worker_main(args: WorkerArgs) {
                 // resolves the emitted codec from these and reports it in `Welcome::codec`.
                 video_codecs,
                 preferred_codec,
+                // The client display's HDR volume → the host's virtual-display EDID (host apps
+                // tone-map to the client's real panel). `None` = unknown/SDR.
+                display_hdr,
             }
             .encode(),
         )