feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3)

design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N
simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security
invariant preserved per-ring.

- proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped
  before the magic; the driver publisher refuses a cross-bound ring via the shared,
  unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index
  validation applied to frames, invariant #10); the host's wait_for_attach surfaces the
  refusal loudly and self-checks its own stamp.
- manager: the one-monitor MgrState becomes a slot map keyed by the client's identity
  slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts,
  slot-scoped begin_idd_setup (a different identity is an admission question, never a
  preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release.
- group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is
  never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in
  captures, last-out restores); desktop layout via CCD source origins from the pure
  layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure.
- admission: the Windows separate→reject override now sits behind the
  PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone —
  a second identity gets its own monitor + ring; default flips in W5 after soak);
  max_displays and NVENC session-unit budgets decline an unaffordable display AT
  admission; kick_dwm_compose is process-globally throttled and per-display — cursor
  jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current
  state at the next vsync tick).

On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors
streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean
(no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed
budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed.
V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up
(the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1
recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's
load-bearing unknown, answered yes.

Also carries the client-HDR EDID forwarding that shared this working tree
(Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block,
PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive
with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/msgs.rs

@@ -2,6 +2,7 @@
 //! (`CTL_MAGIC` + type byte), including the pairing-ceremony messages. Wire codecs only
 //! — no transport state.
 
+use super::datagram::HdrMeta;
 use super::{CTL_MAGIC, MAGIC};
 use crate::config::{
     CompositorPref, Config, FecConfig, FecScheme, GamepadPref, Mode, ProtocolPhase, Role,
@@ -73,6 +74,17 @@ pub struct Hello {
     /// [`Hello::gamepad`] preference pattern; the resolved codec is echoed in [`Welcome::codec`].
     /// Appended after `video_codecs` as a single trailing byte. Omitted by older clients (→ `0`).
     pub preferred_codec: u8,
+    /// The client's **display** HDR colour volume — primaries / white point / luminance range in
+    /// the ST.2086 units of [`HdrMeta`] — read from the client OS (e.g. Windows
+    /// `IDXGIOutput6::GetDesc1`) when it advertised [`VIDEO_CAP_HDR`]. The host forwards it into
+    /// the virtual display's EDID (the pf-vdisplay CTA-861.3 HDR static-metadata block), so host
+    /// apps and the OS tone-map to the CLIENT's real panel instead of the driver's built-in
+    /// ~1000-nit placeholder — the client can then present the PQ stream untouched. Also echoed
+    /// back as the session's `0xCE` mastering metadata. Appended after `preferred_codec` as a
+    /// fixed [`super::datagram::HDR_META_BODY_LEN`]-byte block (the [`HdrMeta`] wire body, no tag),
+    /// forcing the earlier placeholders. Omitted by older clients / when the client has no HDR
+    /// display (decodes to `None` — the host keeps its built-in EDID defaults).
+    pub display_hdr: Option<HdrMeta>,
 }
 
 /// [`Hello::video_caps`] bit: the client can decode a 10-bit (Main10) HEVC stream.
@@ -670,8 +682,9 @@ impl Hello {
         let ac_present = self.audio_channels != 2;
         let vcodecs_present = self.video_codecs != 0;
         let pref_present = self.preferred_codec != 0;
+        let hdr_present = self.display_hdr.is_some();
         let need_placeholders =
-            self.video_caps != 0 || ac_present || vcodecs_present || pref_present;
+            self.video_caps != 0 || ac_present || vcodecs_present || pref_present || hdr_present;
         match (&self.name, &self.launch) {
             (None, None) if !need_placeholders => {}
             (name, _) => {
@@ -688,21 +701,25 @@ impl Hello {
         }
         // video_caps: single trailing byte. Emitted when non-zero OR when a later field follows (so
         // that field lands at a deterministic offset right after it).
-        if self.video_caps != 0 || ac_present || vcodecs_present || pref_present {
+        if need_placeholders {
             b.push(self.video_caps);
         }
         // audio_channels: emitted when non-stereo OR a later field follows.
-        if ac_present || vcodecs_present || pref_present {
+        if ac_present || vcodecs_present || pref_present || hdr_present {
             b.push(self.audio_channels);
         }
-        // video_codecs: emitted when non-zero OR preferred_codec follows.
-        if vcodecs_present || pref_present {
+        // video_codecs: emitted when non-zero OR a later field follows.
+        if vcodecs_present || pref_present || hdr_present {
             b.push(self.video_codecs);
         }
-        // preferred_codec: single trailing byte. Last field; omitted when `0` (no preference).
-        if pref_present {
+        // preferred_codec: emitted when non-zero OR display_hdr follows.
+        if pref_present || hdr_present {
             b.push(self.preferred_codec);
         }
+        // display_hdr: fixed HDR_META_BODY_LEN-byte HdrMeta body. Last field; omitted when `None`.
+        if let Some(m) = &self.display_hdr {
+            super::datagram::write_hdr_meta_body(m, &mut b);
+        }
         b
     }
 
@@ -766,6 +783,11 @@ impl Hello {
             video_codecs: b.get(tail + 2).copied().unwrap_or(0),
             // `0` = no preference; the host decides by precedence.
             preferred_codec: b.get(tail + 3).copied().unwrap_or(0),
+            // Optional trailing HdrMeta body (fixed length) — absent on an older client / a
+            // client without an HDR display → `None` (the host keeps its EDID defaults).
+            display_hdr: b
+                .get(tail + 4..tail + 4 + super::datagram::HDR_META_BODY_LEN)
+                .map(super::datagram::read_hdr_meta_body),
         })
     }
 }