perf(host/windows): SendInput retry-on-failure model (two-process step 2)

The injector reattached the input desktop (OpenInputDesktop + SetThreadDesktop,
two syscalls) before EVERY event. Now it stays bound to its desktop and only
reattaches on a SendInput short write (the input desktop switched into UAC/lock)
+ retries once — Sunshine's model. No steady-state per-event overhead; still
follows the desktop across the secure boundary, serving both desktops.

Validated on the RTX 4090 (host as SYSTEM): client-rs --input-test injected for
~6s with no "blocked desktop" errors. Completes all 6 steps of the two-process
secure-desktop build; only a real-UAC user smoke test remains.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/windows-secure-desktop.md

@@ -1,11 +1,12 @@
 # Windows secure-desktop capture — two-process design
 
-Status: **steps 1, 3, 4, 5, 6 implemented and live-validated on the RTX 4090 (2026-06-16).** The
+Status: **all steps (1–6) implemented and live-validated on the RTX 4090 (2026-06-16).** The
 two-process path works end to end (host as SYSTEM): the user-session WGC helper relays video, the mux
-switches to the host's DDA on the secure desktop, and a dead helper is rebuilt automatically. Only the
-SendInput retry-refactor (step 2) and a *real* UAC/lock smoke test remain. The earlier user-mode WGC
-animation fix still ships; this is the SYSTEM-mode design that adds secure-desktop (UAC/lock/login)
-coverage, since WGC and the secure desktop need conflicting process tokens.
+switches to the host's DDA on the secure desktop, a dead helper is rebuilt automatically, and the
+SendInput injector follows desktop switches lazily. Only a *real* UAC/lock smoke test remains (can't
+be triggered headless over SSH). The earlier user-mode WGC animation fix still ships; this is the
+SYSTEM-mode design that adds secure-desktop (UAC/lock/login) coverage, since WGC and the secure desktop
+need conflicting process tokens.
 
 Implemented so far:
 - **Step 1 — DesktopWatcher** (`capture/desktop_watch.rs`): polls the input-desktop name → atomic
@@ -36,11 +37,16 @@ Implemented so far:
   / 0 early-ends / 465 frames decoded. (Recovery rebuilds the whole output, not a same-target respawn,
   which storm-failed with "no DXGI output for target N yet" after an abrupt kill.)
 
-Remaining: **step 2** (SendInput retry-on-failure refactor — input works today via the existing path;
-this hardens it across the desktop boundary) and a **final user-driven smoke test**: trigger a *real*
-UAC/lock on the box during a session and confirm the dialog appears on the client (the box's UAC
+- Step 2: SendInput now uses the retry-on-failure model (`inject/sendinput.rs`) — the thread stays
+  bound to its desktop and only reattaches (`OpenInputDesktop`/`SetThreadDesktop`) on a `SendInput`
+  short write (desktop switched), instead of two syscalls per event. Validated: `client-rs --input-test`
+  injected for ~6s with no `blocked desktop` errors (steady-state path); the reattach-on-switch path
+  is the same `OpenInputDesktop` call the old per-event code used, now lazy.
+
+Remaining: a **final user-driven smoke test** — trigger a *real* UAC/lock on the box during a session
+and confirm the dialog appears on the client AND that clicking/typing on it lands (the box's UAC
 auto-elevates admins, so a real prompt can't be triggered headless over SSH; the mux switch itself is
-proven by the timed toggle, and DDA-on-Winlogon capture by the single-process secure path).
+proven by the timed toggle, and DDA-on-Winlogon capture + input by the single-process secure path).
 
 > **Note:** the two-process path requires the host to run as SYSTEM (`run.cmd.sysbak` → `-s -i 1`).
 > As SYSTEM, WASAPI loopback audio (session 0) does not capture the user session's audio — a known