fix(tdr): safety and TDR guard leftovers (review batch 1)

[Maxaubert]

Closes #416. Batch 1 of the 2026-10-09 review: safety and TDR guard leftovers.

Fixed

• 12: while a transform session is live the main loop polls GetDeviceRemovedReason on the idle render device (RenderEngine::pollDeviceRemoved), so a TDR is attributed inside the 30 s churny-backstop window. The backstop now runs once per loss.
• 13: a render device that stays lost no longer freezes the loop. With a transform engine present the dead render session ends at 1x, the transform engine takes over and the loop keeps ticking; EnginePickInputs::renderLost forces picks to transform (unit tested). Recovery still retries on the 500 ms backoff (deferred to 1x if a transform session is live). Render-only builds keep the old skip-and-sleep path.
• 23: ParseConfig folds txSamplingMode 2..4 and any other value to 0 (keeps 1 and -1), so the MPO guard sees them as nearest. (There was no raw setter branch left to delete in main.cpp; the pass-through is only the 0/1/-1 values now.)
• 25: inputTransformAvailable_ is cleared permanently only on ERROR_ACCESS_DENIED; any other failed publish is re-armed from the UIAccess token probe at session end.
• 26: the MPO record is keyed on dwm.exe's creation time, read from NtQuerySystemInformation(SystemProcessInformation) so no handle to dwm.exe is opened. OS boot time is the fallback. Pure format and currency logic moved to src/mpo_boot_logic.h with tests/test_mpo_boot.cpp. Checked on this machine: the read matches Win32_Process.CreationDate of dwm.exe exactly.

Skipped

• None. Note for 25: no unit test, transform_model.cpp is not in the test build; covered by review only.
• Note for 26: an existing boot-keyed mpo_boot.txt is treated as not current once, so the first launch after upgrade re-records the registry value as it stands then.

Tests

• build.bat test: [doctest] test cases: 606 | 606 passed | 0 failed | 0 skipped, assertions: 97638 | 97638 passed | 0 failed
• build.bat: exit 0
• build.bat config: exit 0
• Playwright and build.bat uiaccess not run (no ui/ or WIND_UIACCESS changes). Not hardware-tested: a real TDR was not provoked.

No version bump: bumped at merge time.

🤖 Generated with Claude Code

https://claude.ai/code/session_011zPmivSAQeivGUdBjTsaMu