feat(transport): Windows DSCP via qWAVE flows — PUNKTFUNK_DSCP now real on the wire there

Networking-audit deferred plan §4 (the qos.rs follow-up). On Windows
set_tos_v4 succeeds but the stack strips the mark without a qWAVE flow, so
PUNKTFUNK_DSCP=1 was a silent wire no-op there. Now (Apollo/Sunshine's
approach): QOSCreateHandle once per process; QOSAddSocketToFlow per
connected media socket — video → QOSTrafficTypeAudioVideo, audio →
QOSTrafficTypeVoice (QOS_NON_ADAPTIVE_FLOW) — then best-effort
QOSSetFlow(QOSSetOutgoingDSCPValue, 40/48) to pin the exact CS5/CS6 the
other platforms mark. The pin lands for elevated processes (the host runs
as the SYSTEM service — exactly where the video egress is) or under the
"allow non-admin DSCP" policy; otherwise the traffic-type default marking
stands (still WMM-useful). Gating + contract unchanged: opt-in via
dscp_enabled(), every step debug-logs and continues.

set_media_qos now returns an RAII QosFlow guard (QOSRemoveSocketFromFlow on
drop) that must outlive the socket's traffic: stored in UdpTransport
(declared before the socket, so drop order removes the flow first) and held
for the stream's scope by the GameStream video/audio senders — whose
tagging moved after connect(), since qWAVE derives the flow's 5-tuple from
the connected socket (behavior-neutral on Linux). Off-Windows the guard is
inert and never constructed.

Validated: cargo check -p punktfunk-core --target x86_64-pc-windows-msvc
green (the full host can't cross-check from Linux — aws-lc-sys needs MSVC
tooling; it builds on-box via deploy-host.ps1). Remaining on the next
Windows pass per plan: deploy to the RTX box and pktmon/Wireshark the
client side — DSCP ≠ 0 on video egress with PUNKTFUNK_DSCP=1, 0 without.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/transport/qos.rs

@@ -8,9 +8,10 @@
 //! QoS-aware path (Wi-Fi WMM access categories, a managed switch, a shaped uplink) can prioritize it
 //! over bulk flows. Mirrors what Apollo/Sunshine tag — DSCP **CS5** for video, **CS6** for audio. It
 //! is **opt-in** (`PUNKTFUNK_DSCP=1`, or [`set_dscp_default`] from an embedder — the Android client
-//! ties it to its experimental low-latency mode): DSCP can interact badly with some consumer ISPs/routers, and on
-//! Windows a plain `IP_TOS` is silently stripped unless a qWAVE policy is active (Apollo uses the
-//! qWAVE API there — that port is a follow-up; today this is a no-op on the wire on Windows).
+//! ties it to its experimental low-latency mode): DSCP can interact badly with some consumer
+//! ISPs/routers. On Windows a plain `IP_TOS` is silently stripped from the wire, so the marking
+//! goes through qWAVE flows instead (see [`super::qos_windows`]) — the caller holds the returned
+//! [`QosFlow`] guard for as long as the socket sends media.
 
 use std::net::UdpSocket;
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -60,7 +61,7 @@ pub enum MediaClass {
 
 impl MediaClass {
     /// DSCP code point (the high 6 bits of the IPv4 TOS / IPv6 traffic-class byte).
-    const fn dscp(self) -> u32 {
+    pub(super) const fn dscp(self) -> u32 {
         match self {
             MediaClass::Video => 40, // CS5
             MediaClass::Audio => 48, // CS6
@@ -92,20 +93,43 @@ pub(crate) fn dscp_enabled() -> bool {
     }
 }
 
+/// RAII token for a socket's QoS marking. On Windows it is the qWAVE flow membership
+/// ([`super::qos_windows::QosFlow`]) — dropping it removes the marking, so hold it for as long
+/// as the socket sends media. Elsewhere DSCP rides the socket option itself and the token is
+/// inert (and never constructed — [`set_media_qos`] returns `None`).
+#[cfg(windows)]
+pub use super::qos_windows::QosFlow;
+#[cfg(not(windows))]
+pub struct QosFlow {
+    _never: std::convert::Infallible,
+}
+
 /// Best-effort: tag `socket`'s outgoing packets for prioritized delivery of its media class. A no-op
 /// unless `PUNKTFUNK_DSCP=1`. Every step is best-effort (failures logged at debug, never fatal) — QoS
 /// is a nicety, not required for correctness.
 ///
-/// IPv4 only (all current media sockets bind `0.0.0.0`); a v6 socket simply isn't tagged. On Windows
-/// the `IP_TOS` set succeeds but the OS doesn't tag the wire without a qWAVE policy (follow-up).
-pub fn set_media_qos(socket: &UdpSocket, class: MediaClass) {
-    if dscp_enabled() {
+/// The socket must already be `connect`ed (Windows derives the qWAVE flow from the connected
+/// 5-tuple). IPv4 only (all current media sockets bind `0.0.0.0`); a v6 socket simply isn't
+/// tagged. Returns the [`QosFlow`] guard on Windows — keep it alive with the socket; `None`
+/// elsewhere (the marking is a plain socket option) and whenever a step refused.
+pub fn set_media_qos(socket: &UdpSocket, class: MediaClass) -> Option<QosFlow> {
+    if !dscp_enabled() {
+        return None;
+    }
+    #[cfg(windows)]
+    {
+        super::qos_windows::add_media_flow(socket, class)
+    }
+    #[cfg(not(windows))]
+    {
         apply_media_qos(socket, class);
+        None
     }
 }
 
 /// The unconditional QoS application, factored out of [`set_media_qos`] so it is directly testable
 /// without touching the process-global `PUNKTFUNK_DSCP` env. Best-effort (every step logs-and-continues).
+#[cfg_attr(windows, allow(dead_code))]
 fn apply_media_qos(socket: &UdpSocket, class: MediaClass) {
     let sock = socket2::SockRef::from(socket);
     // DSCP occupies the high 6 bits of the TOS byte → shift left 2.
@@ -143,8 +167,8 @@ mod tests {
     fn qos_and_buffer_growth_are_best_effort_and_never_panic() {
         let sock = UdpSocket::bind("127.0.0.1:0").unwrap();
         // No PUNKTFUNK_DSCP in the test env → early return; must not panic regardless.
-        set_media_qos(&sock, MediaClass::Video);
-        set_media_qos(&sock, MediaClass::Audio);
+        assert!(set_media_qos(&sock, MediaClass::Video).is_none());
+        assert!(set_media_qos(&sock, MediaClass::Audio).is_none());
         grow_socket_buffers(&sock);
     }