feat: isolate simultaneous RDP fixture profiles

test/rdp-access/README.md

@@ -125,6 +125,7 @@ All fixture-specific values have embedded, working defaults: the
 `rvboxtest`, the browser listener (`127.0.0.1:5002`), and the private tunnel
 port (`54001`). They can be overridden without editing tracked files through
 `RVBOX_TEST_VBOX_HOST`, `RDP_ACCESS_VRDE_HOST`, `RDP_ACCESS_VRDE_PORT`,
+`RDP_ACCESS_PROFILE`,
 `RDP_ACCESS_WEB_USER`, `RDP_ACCESS_RDP_USER`, `RDP_ACCESS_BIND`,
 `RDP_ACCESS_HTTP_PORT`, `RDP_ACCESS_TUNNEL_PORT`, and
 `RDP_ACCESS_PUBLIC_HOST`, `RDP_ACCESS_IPV6_BIND`, and
@@ -134,6 +135,36 @@ turn the diagnostic server into a remote target.
 Set `RDP_ACCESS_GUACD_LOG_LEVEL=debug` temporarily when collecting detailed
 guacd/RDP negotiation diagnostics; the default is `info`.
 
+The VM selector and the gateway profile are separate. Set the matching
+`RVBOX_TEST_VBOX_*` identity variables (and `RDP_ACCESS_VRDE_PORT`) for the
+VM you want; the complete identity set is listed in
+[`docs/testing-vm.md`](../../docs/testing-vm.md). For two already-running VMs,
+give the second gateway a distinct profile and listener ports, for example:
+
+```sh
+RDP_ACCESS_PROFILE=vm-b \
+RVBOX_TEST_VBOX_HOST=helium-remote-b \
+RDP_ACCESS_VRDE_PORT=3391 \
+RDP_ACCESS_HTTP_PORT=5003 \
+RDP_ACCESS_TUNNEL_PORT=54002 \
+test/rdp-access/rdp-access up --bind 0.0.0.0 --public-host vm-b.example.net
+```
+
+Replace `helium-remote-b`, `3391`, and the public hostname with the second
+fixture's recorded values, and export its matching VM/snapshot UUID variables
+before running `up` or `status`. A non-`default` profile stores its verifier,
+certificate, tunnel state, and logs under `.runtime/<profile>/` and uses the
+Compose project `rvbox-rdp-access-<profile>`. Keep the HTTP port, public
+hostname, and profile unique so IPv4/IPv6 listeners and browser sessions do
+not collide. Inspect, repair, stop, or clean that instance by repeating the
+same `RDP_ACCESS_PROFILE` and endpoint variables on `status`, `repair`,
+`down`, or `clean`.
+
+Profile isolation does not bypass the native controller's exclusive lease:
+`test-host prepare`/`reset` must still be coordinated when VMs share one
+fixture host and staging root. For VMs that are already running, the profile
+and matching identity/VRDE variables are sufficient to select the endpoint.
+
 When `--bind 0.0.0.0` is used, `up` also starts a tracked `socat` listener on
 `[::]:$RDP_ACCESS_HTTP_PORT` and forwards it to the IPv4 gateway listener. This
 matters when the public hostname has an AAAA record: some browsers choose IPv6