feat(windows): parallel virtual displays — proto v3 ring binding, manager slot map, group topology (W0–W3)

design/windows-parallel-virtual-displays.md (display-management Stage 7 / §6.6): N
simultaneously-live pf-vdisplay monitors, one sealed ring each, every idd-push-security
invariant preserved per-ring.

- proto v3: SharedHeader._pad → target_id — the ring NAMES its monitor, host-stamped
  before the magic; the driver publisher refuses a cross-bound ring via the shared,
  unit-tested frame::check_attach (new DRV_STATUS_BIND_FAIL — the gamepad pad_index
  validation applied to frames, invariant #10); the host's wait_for_attach surfaces the
  refusal loudly and self-checks its own stamp.
- manager: the one-monitor MgrState becomes a slot map keyed by the client's identity
  slot (0 = anonymous/GameStream); per-slot reconnect + dead-WUDFHost preempts,
  slot-scoped begin_idd_setup (a different identity is an admission question, never a
  preempt), ONE device-level watchdog pinger, per-slot /display/state + /display/release.
- group topology: isolate_displays_ccd takes the managed target SET (a sibling slot is
  never deactivated); SavedConfig + the DDC/PnP axes move to the group record (first-in
  captures, last-out restores); desktop layout via CCD source origins from the pure
  layout::arrange (auto-row default, manual pins win), re-applied on create + reconfigure.
- admission: the Windows separate→reject override now sits behind the
  PUNKTFUNK_WIN_SEPARATE=1 validation hatch (the wedge it guarded is structurally gone —
  a second identity gets its own monitor + ring; default flips in W5 after soak);
  max_displays and NVENC session-unit budgets decline an unaffordable display AT
  admission; kick_dwm_compose is process-globally throttled and per-display — cursor
  jump + 35 ms dwell (a sub-tick jump composes nothing; DWM reads dirties from current
  state at the next vsync tick).

On-glass on the RTX box: V1/V2/V4/V5/V6/V9 green — two paired clients on two monitors
streaming ~60 fps each with zero mismatches and zero bind failures, churn-hammer clean
(no 0x80070490), per-ring mode-change recreate leaves the sibling untouched, typed
budget rejection, fault-injected cross-bind refused loudly with the sibling undisturbed.
V7: WUDFHost-kill shared fate is clean; in-process device recovery is a known follow-up
(the retired-never-closed control handles block the adapter cycle — reset-pf-vdisplay.ps1
recovers). DWM composes two IDD monitors concurrently at 60 fps — the plan's
load-bearing unknown, answered yes.

Also carries the client-HDR EDID forwarding that shared this working tree
(Hello::display_hdr → AddRequest luminance tail → the monitor's CTA-861.3 HDR block,
PUNKTFUNK_CLIENT_PEAK_NITS hatch) and the Deck client fixes (40 ms rumble keep-alive
with 1-LSB jitter, HDR self-diagnosing presenter warn, flatpak HDR env).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/windows/drivers/pf-vdisplay/src/control.rs

@@ -127,7 +127,7 @@ unsafe fn set_render_adapter(request: WDFREQUEST) {
 /// `request` is the framework `WDFREQUEST`.
 unsafe fn add(request: WDFREQUEST) {
     // SAFETY: `request` is the framework WDFREQUEST.
-    let Some(req) = (unsafe { read_input::<control::AddRequest>(request) }) else {
+    let Some(req) = (unsafe { read_add_request(request) }) else {
         complete(request, STATUS_INVALID_PARAMETER);
         return;
     };
@@ -141,6 +141,11 @@ unsafe fn add(request: WDFREQUEST) {
         req.height,
         req.refresh_hz,
         req.preferred_monitor_id,
+        crate::edid::ClientLuminance {
+            max_nits: req.max_luminance_nits,
+            max_frame_avg_nits: req.max_frame_avg_nits,
+            min_millinits: req.min_luminance_millinits,
+        },
     ) else {
         complete(request, STATUS_NOT_FOUND);
         return;
@@ -207,6 +212,41 @@ unsafe fn remove(request: WDFREQUEST) {
     complete(request, STATUS_SUCCESS);
 }
 
+/// Read an [`control::AddRequest`], accepting BOTH wire sizes: the full struct, or an un-upgraded
+/// host's [`ADD_REQUEST_LEGACY_SIZE`](control::ADD_REQUEST_LEGACY_SIZE)-byte prefix (no client-HDR
+/// luminance tail), whose missing tail zero-fills to "unknown" — so a new driver keeps serving an
+/// old host (see the `AddRequest` size-compatibility docs).
+///
+/// # Safety
+/// `request` is the framework `WDFREQUEST`.
+unsafe fn read_add_request(request: WDFREQUEST) -> Option<control::AddRequest> {
+    let mut buf: *mut core::ffi::c_void = core::ptr::null_mut();
+    let mut len: usize = 0;
+    // SAFETY: `request` valid; `buf`/`len` are out-params written by the framework.
+    let st = unsafe {
+        call_unsafe_wdf_function_binding!(
+            WdfRequestRetrieveInputBuffer,
+            request,
+            control::ADD_REQUEST_LEGACY_SIZE,
+            &mut buf,
+            &mut len
+        )
+    };
+    if !nt_success(st) || buf.is_null() || len < control::ADD_REQUEST_LEGACY_SIZE {
+        return None;
+    }
+    let take = len.min(core::mem::size_of::<control::AddRequest>());
+    // Pod contract (pf-driver-proto derives Zeroable): all-zero = every optional tail field "unknown".
+    let mut req = pod_init!(control::AddRequest);
+    // SAFETY: `buf` has >= `take` readable bytes (framework contract: `len` bytes are valid);
+    // `req` is a Pod struct at least `take` bytes long; the ranges don't overlap (stack vs the
+    // framework's request buffer).
+    unsafe {
+        core::ptr::copy_nonoverlapping(buf.cast::<u8>(), (&raw mut req).cast::<u8>(), take);
+    }
+    Some(req)
+}
+
 /// Read a `Copy`/`Pod` input struct from the request's input buffer (None if too small / unavailable).
 ///
 /// # Safety