From 23d04521570a42598437dc088c52a916be5e0a6c Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Tue, 11 Aug 2026 20:21:16 +0200
Subject: [PATCH] feat(host): GameStream opt-in on every route; the native
 plane is deny(unsafe_code)-enforced
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user direction after WP0: ENet exists only for Moonlight, so the native
plane must be provably safe and the compat planes a deliberate choice.

Opt-in, everywhere. Windows already was (unchecked installer task). The three
opt-out surfaces are flipped: the shipped systemd user unit (deb/RPM/Arch/
sysext) no longer bakes --gamestream into ExecStart — a new
PUNKTFUNK_GAMESTREAM=1 host.env knob (pf-host-config, OR-ed with the CLI
flag) is the packaged opt-in; the NixOS module default goes true→false, with
a module-check assertion that unset = native-only; the Deck installer takes
--gamestream to opt in (--no-gamestream kept as explicit-off). Docs
(quickstart, running-as-a-service, moonlight, ubuntu/fedora/arch firewall
sections, gnome/sway, how-it-works) rewritten to the opt-in shape; the
CHANGELOG carries the upgrade note.

Enforced-safe. punktfunk-core is #![deny(unsafe_code)] crate-wide — every
module that parses network bytes is safe Rust as a compile error, not a
census result. Carve-outs are exactly two documented classes, neither of
which interprets attacker bytes: the client surface (abi, client) and the
transport syscall-batching shims (udp/{apple,linux,windows}, qos_windows).
In punktfunk-host, the modules a secure-default host exposes — native
(cfg-not-test: its tests exercise the client C ABI on purpose),
native_pairing, mgmt, mgmt_token, discovery, wol — are #[forbid(unsafe_code)].

Gates: Linux amd64 container clippy --all-targets -D warnings clean over
core+host-config+host; core 204 tests green under the deny; mgmt 46/46,
control 6/6. .133 Windows clippy (shipped features, clean-first,
sentinel-checked) clean — covers the qos_windows/udp-windows carve-outs.
macOS + iOS cargo check green (the apple.rs carve-out compiles for real).
---
 CHANGELOG.md                                  | 38 +++++++++++++++++
 crates/pf-host-config/src/lib.rs              | 10 +++++
 crates/punktfunk-core/src/abi.rs              |  5 +++
 crates/punktfunk-core/src/client/mod.rs       |  5 +++
 crates/punktfunk-core/src/lib.rs              | 10 +++++
 .../src/transport/qos_windows.rs              |  4 ++
 .../punktfunk-core/src/transport/udp/apple.rs |  4 ++
 .../punktfunk-core/src/transport/udp/linux.rs |  4 ++
 .../src/transport/udp/windows.rs              |  4 ++
 crates/punktfunk-host/src/main.rs             | 20 ++++++++-
 docs-site/content/docs/arch.md                | 14 ++++---
 docs-site/content/docs/fedora.md              | 13 +++---
 docs-site/content/docs/gnome.md               |  6 +--
 docs-site/content/docs/how-it-works.md        |  5 ++-
 docs-site/content/docs/moonlight.md           | 25 ++++++-----
 docs-site/content/docs/quickstart.md          | 11 ++---
 .../content/docs/running-as-a-service.md      | 42 ++++++++++---------
 docs-site/content/docs/sway.md                |  6 +--
 docs-site/content/docs/ubuntu.md              | 20 ++++-----
 packaging/kde/host.env                        |  4 ++
 packaging/nix/module-check.nix                | 11 +++++
 packaging/nix/nixos-module.nix                |  8 ++--
 scripts/host.env.example                      |  7 ++++
 scripts/punktfunk-host.service                | 13 +++---
 scripts/steamdeck/install.sh                  | 15 +++----
 25 files changed, 222 insertions(+), 82 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67317f3c..ad393341 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,44 @@ with the version table of the release you are moving to, then read **Breaking ch
 
 ## v0.27.1 — in development
 
+### GameStream is now opt-in on EVERY route (⚠ packager-visible default change)
+
+The secure native-only host is the default everywhere; the Moonlight-compat planes (plain-HTTP
+pairing + the legacy GCM path, security-review #5/#9) are enabled only by an explicit choice:
+
+- **The shipped systemd user unit** (`scripts/punktfunk-host.service`, installed by deb/RPM/Arch/
+  sysext) runs bare `serve` — `--gamestream` is no longer baked into `ExecStart`. Opt in via the
+  new **`PUNKTFUNK_GAMESTREAM=1`** knob in `host.env` (pf-host-config; equivalent to the flag —
+  either source enables), so no unit editing survives-upgrades dance is needed.
+  ⚠ **Upgrade note:** a packaged host that served Moonlight by default becomes native-only until
+  the operator sets the knob (a hand-made `ExecStart` drop-in keeps winning as before).
+- **NixOS module**: `services.punktfunk.host.gamestream` default flipped `true` → `false`
+  (module-check gained a "default is native-only" assertion); enabling it still opens the
+  GameStream firewall ports.
+- **Steam Deck installer**: `--gamestream` opts in (was on-by-default with `--no-gamestream`;
+  the old flag is still accepted as explicit-off).
+- Windows was already opt-in (unchecked installer task) and is unchanged.
+
+### The ENet control port now exists only while a pairing does (rust-safety WP0)
+
+`rusty_enet` — a c2rust-style transpile of C ENet, and the host's only pre-auth-reachable unsafe
+surface — no longer listens unconditionally: UDP 47999 binds when the paired-client list becomes
+non-empty and is torn down when the last pairing is removed (a live client gets the same
+TERMINATION+disconnect farewell as a host-side session end). Pairing itself is HTTPS on nvhttp and
+never touches the port, so a never-paired `--gamestream` host exposes no ENet at all. En route:
+the management API's unpair endpoint never persisted (`save_paired` was missing), so an unpair
+lasted only until the next restart — fixed. `rusty_enet` is now pinned `=0.4.0`.
+
+### Memory-safety, compiler-enforced (embedder-visible lint tightening)
+
+`punktfunk-core` now carries `#![deny(unsafe_code)]` crate-wide: everything that parses network
+bytes is safe Rust by compiler-enforced invariant. The documented `#![allow]` carve-outs are the
+client surface (`abi`, `client`) and the platform syscall-batching shims under `transport`
+(`udp/{apple,linux,windows}`, `qos_windows`) — none of which interpret attacker bytes. In
+`punktfunk-host`, the modules a secure-default host exposes (`native`, `native_pairing`, `mgmt`,
+`mgmt_token`, `discovery`, `wol`) are `#[forbid(unsafe_code)]`. If you embed `punktfunk-core` and
+patch it, new unsafe outside the carve-outs is now a compile error.
+
 ### NixOS + KDE — session detection, the other half
 
 🛑 **v0.27.0's NixOS session-detection fix did not reach a stock NixOS + Plasma 6 box.** It resolved
diff --git a/crates/pf-host-config/src/lib.rs b/crates/pf-host-config/src/lib.rs
index b532dcfe..fcdb4b9e 100644
--- a/crates/pf-host-config/src/lib.rs
+++ b/crates/pf-host-config/src/lib.rs
@@ -144,6 +144,13 @@ pub struct HostConfig {
     /// text ("Living Room PC"); the DNS-level `<label>.local.` target keeps using a sanitized
     /// machine-safe label, so a spacey display name can't produce an invalid mDNS record.
     pub host_name: Option<String>,
+    /// `PUNKTFUNK_GAMESTREAM` — enable the GameStream/Moonlight-compat planes (nvhttp pairing,
+    /// RTSP, ENet control, `_nvstream` mDNS) from `host.env`, equivalent to the `--gamestream`
+    /// CLI flag (either source turns it on). **Default OFF** — the secure native-only host: the
+    /// compat planes carry plain-HTTP pairing + the legacy GCM-nonce path (security-review
+    /// #5/#9), so stock-Moonlight support is opt-in on every route, and the packaged units ship
+    /// without the flag so this knob is how a package user opts in.
+    pub gamestream: bool,
     /// `PUNKTFUNK_ENCODER` — explicit encoder-backend override (lowercased; empty = auto-detect by GPU vendor).
     pub encoder_pref: String,
     /// `PUNKTFUNK_RENDER_ADAPTER` — discrete render-GPU pin by description substring (`Some` even when empty:
@@ -356,6 +363,9 @@ impl HostConfig {
             host_name: val("PUNKTFUNK_HOST_NAME")
                 .map(|s| s.trim().to_string())
                 .filter(|s| !s.is_empty()),
+            // Default OFF, explicit-on grammar: the Moonlight-compat planes are opt-in
+            // everywhere (see the field doc); `--gamestream` on the CLI also turns them on.
+            gamestream: env_on("PUNKTFUNK_GAMESTREAM").unwrap_or(false),
             encoder_pref: std::env::var("PUNKTFUNK_ENCODER")
                 .unwrap_or_default()
                 .to_ascii_lowercase(),
diff --git a/crates/punktfunk-core/src/abi.rs b/crates/punktfunk-core/src/abi.rs
index 1723a8be..d90a53c7 100644
--- a/crates/punktfunk-core/src/abi.rs
+++ b/crates/punktfunk-core/src/abi.rs
@@ -14,6 +14,11 @@
 //!   because they cannot panic: [`punktfunk_abi_version`] returns a constant, and the
 //!   `punktfunk_connect*` shims forward every argument unchanged into a guarded implementation.
 
+// The crate denies `unsafe_code` (lib.rs): the network plane is safe Rust by compiler-enforced
+// invariant. This module is one of the two documented carve-outs — an `extern "C"` surface for
+// the platform clients cannot exist without unsafe, and every site below carries its proof.
+#![allow(unsafe_code)]
+
 // THE ABI CONTRACT, stated once - most `// SAFETY:` proofs below are an instance of it.
 //
 // Every pointer crossing this boundary is C memory the CALLER owns, and the header
diff --git a/crates/punktfunk-core/src/client/mod.rs b/crates/punktfunk-core/src/client/mod.rs
index 258df579..b49afde8 100644
--- a/crates/punktfunk-core/src/client/mod.rs
+++ b/crates/punktfunk-core/src/client/mod.rs
@@ -11,6 +11,11 @@
 //! invariant) plus a blocking data-plane pump; frames cross to the embedder over a bounded
 //! channel. All methods are safe to call from any single embedder thread.
 
+// The crate denies `unsafe_code` (lib.rs); this client-side module is one of the two documented
+// carve-outs (with `abi`) — its few sites are platform glue (thread ids, priorities) for the
+// embedders, each with its `// SAFETY:` proof. The host serves nothing from this module.
+#![allow(unsafe_code)]
+
 use crate::clipboard::{ClipCommand, ClipEventCore};
 use crate::config::{CompositorPref, GamepadPref, Mode};
 use crate::error::{PunktfunkError, Result};
diff --git a/crates/punktfunk-core/src/lib.rs b/crates/punktfunk-core/src/lib.rs
index ef61b356..42780f77 100644
--- a/crates/punktfunk-core/src/lib.rs
+++ b/crates/punktfunk-core/src/lib.rs
@@ -36,6 +36,16 @@
 // Unsafe-proof program: every `unsafe {}` / `unsafe impl` in this crate carries a `// SAFETY:`
 // proof. The bulk lives in `abi.rs`, whose sites are instances of the ABI contract stated once at
 // the top of that file rather than 141 independent arguments.
+//
+// Beyond the proofs: `unsafe` is DENIED crate-wide, making the census result a compiler-enforced
+// invariant (rust-safety programme): **everything that PARSES network bytes is safe Rust** —
+// quic, packet, session, fec, crypto, tls, and the rest. The documented `#![allow(unsafe_code)]`
+// carve-outs are exactly two classes, and neither interprets attacker bytes:
+//   * the CLIENT surface — `abi` (the `extern "C"` boundary itself) and `client` (embedder glue);
+//   * the platform syscall-batching shims under `transport` (`udp/{apple,linux,windows}`,
+//     `qos_windows`) — sendmmsg/recvmsg_x/USO/qWAVE move caller-owned buffers, nothing more.
+// A new module parsing wire data may NOT add a carve-out.
+#![deny(unsafe_code)]
 #![deny(clippy::undocumented_unsafe_blocks)]
 #![forbid(unsafe_op_in_unsafe_fn)]
 
diff --git a/crates/punktfunk-core/src/transport/qos_windows.rs b/crates/punktfunk-core/src/transport/qos_windows.rs
index 6e0f0e0d..05e85f17 100644
--- a/crates/punktfunk-core/src/transport/qos_windows.rs
+++ b/crates/punktfunk-core/src/transport/qos_windows.rs
@@ -13,6 +13,10 @@
 //! Same contract as the rest of [`super::qos`]: opt-in (`dscp_enabled`), and every step
 //! debug-logs and continues — QoS is a nicety, never required for correctness.
 
+// Crate-wide deny(unsafe_code) carve-out (lib.rs): platform syscall glue — qWAVE FFI moves
+// flow handles, never network bytes; each site carries its proof.
+#![allow(unsafe_code)]
+
 use super::qos::MediaClass;
 use std::net::UdpSocket;
 use std::os::windows::io::AsRawSocket;
diff --git a/crates/punktfunk-core/src/transport/udp/apple.rs b/crates/punktfunk-core/src/transport/udp/apple.rs
index c990adef..ea456813 100644
--- a/crates/punktfunk-core/src/transport/udp/apple.rs
+++ b/crates/punktfunk-core/src/transport/udp/apple.rs
@@ -1,6 +1,10 @@
 //! Apple/BSD batched UDP receive: Darwin `recvmsg_x`, `recv`-loop fallback on other BSDs.
 //! The platform body of [`super::UdpTransport`]'s `recv_batch` override.
 
+// Crate-wide deny(unsafe_code) carve-out (lib.rs): platform syscall-batching glue — `recvmsg_x`
+// fills caller-owned buffers; nothing here interprets network bytes. Proofs at each site.
+#![allow(unsafe_code)]
+
 use super::{is_transient_io, UdpTransport};
 
 /// Apple (macOS/iOS) batched-receive enable state. Darwin has no `recvmmsg(2)`, so without this our
diff --git a/crates/punktfunk-core/src/transport/udp/linux.rs b/crates/punktfunk-core/src/transport/udp/linux.rs
index 67b04298..5062acbb 100644
--- a/crates/punktfunk-core/src/transport/udp/linux.rs
+++ b/crates/punktfunk-core/src/transport/udp/linux.rs
@@ -2,6 +2,10 @@
 //! The platform bodies of [`super::UdpTransport`]'s `send_batch`/`send_gso`/`recv_batch`
 //! overrides live here (called by the cfg-gated delegators in the parent `impl Transport`).
 
+// Crate-wide deny(unsafe_code) carve-out (lib.rs): platform syscall-batching glue —
+// `sendmmsg`/`recvmmsg`/GSO move caller-owned buffers; nothing here interprets network bytes.
+#![allow(unsafe_code)]
+
 use super::{is_transient_io, UdpTransport};
 
 #[cfg(target_os = "android")]
diff --git a/crates/punktfunk-core/src/transport/udp/windows.rs b/crates/punktfunk-core/src/transport/udp/windows.rs
index 161e357d..e8f88526 100644
--- a/crates/punktfunk-core/src/transport/udp/windows.rs
+++ b/crates/punktfunk-core/src/transport/udp/windows.rs
@@ -1,6 +1,10 @@
 //! Windows batched UDP send: `WSASendMsg` UDP Send Offload (USO). The platform body of
 //! [`super::UdpTransport`]'s `send_gso` override, plus the standalone [`send_uso_all`].
 
+// Crate-wide deny(unsafe_code) carve-out (lib.rs): platform syscall-batching glue — `WSASendMsg`
+// USO sends caller-owned buffers; nothing here interprets network bytes. Proofs at each site.
+#![allow(unsafe_code)]
+
 use super::{is_transient_io, UdpTransport};
 use crate::transport::Transport;
 
diff --git a/crates/punktfunk-host/src/main.rs b/crates/punktfunk-host/src/main.rs
index 209e7e88..0218d5ba 100644
--- a/crates/punktfunk-host/src/main.rs
+++ b/crates/punktfunk-host/src/main.rs
@@ -29,7 +29,10 @@ mod bringup;
 mod capture;
 mod detect;
 mod devtest;
+// Network-facing on the secure default host (see the forbid block at `mod mgmt` below).
+#[forbid(unsafe_code)]
 mod discovery;
+#[forbid(unsafe_code)]
 mod wol;
 // Goal-1 stage 6: top-level platform-only modules live under `src/linux/` and `src/windows/`; `#[path]`
 // keeps the `crate::*` module names flat (every existing path is unchanged).
@@ -77,9 +80,18 @@ mod interactive;
 mod launchreg;
 mod library;
 mod log_capture;
+// The native punktfunk/1 plane and the management API — everything a SECURE-DEFAULT host
+// exposes — are safe Rust by compiler-enforced invariant (rust-safety programme): `forbid`
+// here means a future edit cannot quietly introduce unsafe into a network-facing module.
+// (`native` carves out its `#[cfg(test)]` C-ABI roundtrip tests, which exercise the CLIENT
+// side of punktfunk-core against this host in-process and are unsafe by nature.)
+#[forbid(unsafe_code)]
 mod mgmt;
+#[forbid(unsafe_code)]
 mod mgmt_token;
+#[cfg_attr(not(test), forbid(unsafe_code))]
 mod native;
+#[forbid(unsafe_code)]
 mod native_pairing;
 mod osinfo;
 mod pipeline;
@@ -831,6 +843,10 @@ fn parse_serve(args: &[String]) -> Result<(mgmt::Options, native::NativeServe, b
         data_port,
         mdns: !no_mdns && discovery::mdns_enabled(),
     };
+    // The Moonlight-compat planes are opt-in from EITHER source: the `--gamestream` CLI flag or
+    // `PUNKTFUNK_GAMESTREAM` in host.env — the packaged systemd units ship a fixed native-only
+    // ExecStart, so the env knob is how a package user opts in without editing the unit.
+    let gamestream = gamestream || pf_host_config::config().gamestream;
     Ok((opts, native, gamestream))
 }
 
@@ -980,7 +996,9 @@ SERVE OPTIONS:
     --gamestream  (--moonlight)  ALSO run the GameStream/Moonlight-compat planes (nvhttp pairing,
                                  RTSP, ENet control, _nvstream mDNS). OFF by default — they carry
                                  inherent on-path weaknesses (plain-HTTP pairing + legacy GCM nonce
-                                 reuse, security-review #5/#9); enable only on a TRUSTED LAN
+                                 reuse, security-review #5/#9); enable only on a TRUSTED LAN.
+                                 Also PUNKTFUNK_GAMESTREAM=1 in host.env (how a packaged install
+                                 opts in — the shipped units run native-only)
     --native                     no-op (the native punktfunk/1 plane always runs in `serve` now)
     --native-port <PORT>         native QUIC port (default 9777)
     --data-port <PORT>           pin the per-session video data plane to this fixed UDP port and
diff --git a/docs-site/content/docs/arch.md b/docs-site/content/docs/arch.md
index 5e276418..0cd0a811 100644
--- a/docs-site/content/docs/arch.md
+++ b/docs-site/content/docs/arch.md
@@ -144,19 +144,21 @@ stock [Moonlight](/docs/moonlight) clients, and needs **both** openers:
 ```sh
 # ufw — CachyOS (and Ubuntu, once you enable ufw):
 sudo ufw allow punktfunk-native
-sudo ufw allow punktfunk-gamestream
 
 # firewalld — Fedora-like spins (EndeavourOS, …):
 sudo firewall-cmd --reload                                        # load the installed definitions
 sudo firewall-cmd --permanent --add-service=punktfunk-native
-sudo firewall-cmd --permanent --add-service=punktfunk-gamestream
 sudo firewall-cmd --reload
 ```
 
-Switched the host to **native-only** — dropped `--gamestream` with a
-`systemctl --user edit punktfunk-host` drop-in, or you run `punktfunk-host serve` by hand? Then open
-`punktfunk-native` alone and leave `punktfunk-gamestream` closed. `systemctl --user cat
-punktfunk-host` shows which one yours is.
+Enabled **GameStream/Moonlight compat** (`PUNKTFUNK_GAMESTREAM=1` in `host.env` — see
+[What the unit starts](/docs/running-as-a-service#what-the-unit-starts)), or you pass
+`--gamestream` by hand? Then also open its service:
+
+```sh
+sudo ufw allow punktfunk-gamestream                               # ufw
+sudo firewall-cmd --permanent --add-service=punktfunk-gamestream && sudo firewall-cmd --reload
+```
 
 `punktfunk-native` opens the QUIC control port (UDP 9777), mDNS discovery and the mgmt/library API
 (TCP 47990); `punktfunk-gamestream` opens the fixed Moonlight ports — TCP 47984, 47989 and 48010,
diff --git a/docs-site/content/docs/fedora.md b/docs-site/content/docs/fedora.md
index ce16403e..5d0d4e1c 100644
--- a/docs-site/content/docs/fedora.md
+++ b/docs-site/content/docs/fedora.md
@@ -157,21 +157,22 @@ binary path — so a host you enabled with `systemctl --user enable --now punktf
 ```sh
 sudo firewall-cmd --reload                                            # load the installed definitions
 sudo firewall-cmd --permanent --add-service=punktfunk-native
-sudo firewall-cmd --permanent --add-service=punktfunk-gamestream
 sudo firewall-cmd --reload
 ```
 
+Enabled **GameStream/Moonlight compat** (`PUNKTFUNK_GAMESTREAM=1` in `host.env` — see
+[What the unit starts](/docs/running-as-a-service#what-the-unit-starts))? Then also:
+
+```sh
+sudo firewall-cmd --permanent --add-service=punktfunk-gamestream && sudo firewall-cmd --reload
+```
+
 `punktfunk-native` opens UDP 9777 (QUIC control), UDP 5353 (mDNS discovery) and TCP 47990 (the
 mgmt/library API — HTTPS + mTLS, read-only off loopback). `punktfunk-gamestream` opens the fixed
 Moonlight ports — TCP 47984, 47989 and 48010, UDP 47998–48000 — plus the same mDNS. The media
 **data plane** uses an ephemeral UDP port the client opens with a hole-punch, so there is nothing
 fixed to open for video.
 
-Switched the host to **native-only** — dropped `--gamestream` with a
-`systemctl --user edit punktfunk-host` drop-in, or you run `punktfunk-host serve` by hand? Then add
-`punktfunk-native` alone and leave `punktfunk-gamestream` out. `systemctl --user cat punktfunk-host`
-shows which one yours is.
-
 And if you want the web console reachable from another device, open **TCP 47992**:
 
 ```sh
diff --git a/docs-site/content/docs/gnome.md b/docs-site/content/docs/gnome.md
index 6a729e61..a972a648 100644
--- a/docs-site/content/docs/gnome.md
+++ b/docs-site/content/docs/gnome.md
@@ -64,9 +64,9 @@ systemctl --user enable --now punktfunk-host
 journalctl --user -u punktfunk-host -f   # watch it come up and print its identity fingerprint
 ```
 
-This unit runs `serve --gamestream`, so it serves stock [Moonlight](/docs/moonlight) clients as well
-as the native ones. For a native-only host, see
-[What the unit starts](/docs/running-as-a-service#what-the-unit-starts).
+This unit runs the secure native-only host. To also serve stock [Moonlight](/docs/moonlight)
+clients, GameStream compat is opt-in (`PUNKTFUNK_GAMESTREAM=1` in `host.env`, trusted LANs only) —
+see [What the unit starts](/docs/running-as-a-service#what-the-unit-starts).
 
 A desktop-login host should also follow your session's lifetime, or restarting GNOME Shell leaves the
 host wired to a compositor that is gone — it keeps answering, and every session after that fails at
diff --git a/docs-site/content/docs/how-it-works.md b/docs-site/content/docs/how-it-works.md
index a3470c11..34b67037 100644
--- a/docs-site/content/docs/how-it-works.md
+++ b/docs-site/content/docs/how-it-works.md
@@ -63,8 +63,9 @@ Punktfunk speaks two protocols over the same host:
   on imperfect networks, and it's what the [native clients](/docs/clients) (Apple, Linux, Windows,
   Android) use.
 
-The native `punktfunk/1` plane runs by default (the secure default); add `--gamestream` and both planes
-serve from a single host process — Moonlight clients use GameStream, the native clients use punktfunk/1.
+The native `punktfunk/1` plane runs by default (the secure default); add `--gamestream` (or
+`PUNKTFUNK_GAMESTREAM=1` in `host.env` for a packaged install) and both planes serve from a single
+host process — Moonlight clients use GameStream, the native clients use punktfunk/1.
 
 ## Pairing and trust
 
diff --git a/docs-site/content/docs/moonlight.md b/docs-site/content/docs/moonlight.md
index a5f95952..9bbd42bf 100644
--- a/docs-site/content/docs/moonlight.md
+++ b/docs-site/content/docs/moonlight.md
@@ -13,18 +13,21 @@ a browser, a smart TV, or any device without a native client.
 
 ## 1. Make sure the host is running with GameStream enabled
 
-Moonlight needs the GameStream planes, which are **opt-in** on the host — but most installs already
-enable them:
+Moonlight needs the GameStream planes, which are **opt-in on every install route** (the default is
+the secure native-only host):
 
-- **Linux packages, NixOS, SteamOS / Steam Deck** — already on: the shipped `punktfunk-host` user
-  unit runs `serve --gamestream`. To turn it *off*, override `ExecStart` with a drop-in so a package
-  upgrade doesn't undo it — see
-  [What the unit starts](/docs/running-as-a-service#what-the-unit-starts) — or set
-  `services.punktfunk.host.gamestream = false` on NixOS, or re-run the Deck installer with
-  `--no-gamestream`.
-- **Windows** — off unless you ticked the installer's *Enable GameStream (Moonlight) compatibility*
-  checkbox. To turn it on afterwards, run this from an **elevated** prompt (`=off` puts it back) —
-  see [Windows Host](/docs/windows-host):
+- **Linux packages (apt / dnf / pacman / sysext)** — add `PUNKTFUNK_GAMESTREAM=1` to
+  `~/.config/punktfunk/host.env` and `systemctl --user restart punktfunk-host` — see
+  [What the unit starts](/docs/running-as-a-service#what-the-unit-starts). (Installs from before
+  the opt-in change served Moonlight by default; an upgrade switches them to native-only until you
+  set the knob.)
+- **NixOS** — set `services.punktfunk.host.gamestream = true;` (also opens the GameStream firewall
+  ports).
+- **SteamOS / Steam Deck** — run the installer with `--gamestream` (re-running it is safe and
+  keeps the rest of your config).
+- **Windows** — tick the installer's *Enable GameStream (Moonlight) compatibility* checkbox, or
+  turn it on afterwards from an **elevated** prompt (`=off` puts it back) — see
+  [Windows Host](/docs/windows-host):
 
   ```powershell
   punktfunk-host service install --gamestream=on
diff --git a/docs-site/content/docs/quickstart.md b/docs-site/content/docs/quickstart.md
index a060d6dc..5c9d4b7b 100644
--- a/docs-site/content/docs/quickstart.md
+++ b/docs-site/content/docs/quickstart.md
@@ -52,14 +52,15 @@ journalctl --user -u punktfunk-host -f   # watch it come up and print its identi
 Once up, the host advertises itself on your local network, so clients find it by name. It works out
 where your compositor is by itself, so there is nothing to export.
 
-That unit runs `serve --gamestream`: the native `punktfunk/1` plane **plus** the
-GameStream/Moonlight-compatible planes, so stock [Moonlight](/docs/moonlight) clients work too. Those
-extra planes pair over plain HTTP and belong on a trusted LAN only — for a native-only host, see
+That unit runs the **secure native-only host** (Punktfunk clients + the management API). Want stock
+[Moonlight](/docs/moonlight) clients too? GameStream compat is **opt-in** — add
+`PUNKTFUNK_GAMESTREAM=1` to `~/.config/punktfunk/host.env` and restart the unit (trusted LANs only;
+its pairing runs over plain HTTP) — see
 [What the unit starts](/docs/running-as-a-service#what-the-unit-starts).
 
 If the host runs a firewall (Fedora enables firewalld, CachyOS enables ufw), open its ports — the
-firewall step in your distro guide has the exact commands, for **both** `punktfunk-native` and
-`punktfunk-gamestream`, because the packaged unit serves both planes.
+firewall step in your distro guide has the exact commands: `punktfunk-native` always, plus
+`punktfunk-gamestream` only if you enabled Moonlight compat.
 
 On **SteamOS** even that is done for you — the install script wrote its own `punktfunk-host` user
 service and started it (GameStream on by default there too; pass `--no-gamestream` to the install
diff --git a/docs-site/content/docs/running-as-a-service.md b/docs-site/content/docs/running-as-a-service.md
index 31c7959a..a6c76237 100644
--- a/docs-site/content/docs/running-as-a-service.md
+++ b/docs-site/content/docs/running-as-a-service.md
@@ -9,36 +9,38 @@ desktop you log into and a fully headless box.
 
 ## What the unit starts
 
-The bundled unit runs `serve --gamestream`, so it serves both the native `punktfunk/1` plane and
-stock [Moonlight](/docs/moonlight) clients. Every Linux package installs that unit as it ships and
-only rewrites the binary path, so a host you installed from apt, dnf, pacman or the Bazzite sysext
-has **GameStream on**. See what yours starts:
+The bundled unit runs `serve`: the **secure native-only host** — the `punktfunk/1` plane plus the
+management API. Stock [Moonlight](/docs/moonlight) (GameStream) support is **opt-in** on every
+install route: its pairing runs over plain HTTP and its legacy encryption is weaker (see
+[Security & Safe Use](/docs/security)), so it belongs on trusted LANs you chose to enable it on.
+See what yours starts:
 
 ```sh
 systemctl --user cat punktfunk-host
 ```
 
-For a **native-only** host (no GameStream — its pairing runs over plain HTTP and its legacy
-encryption is weaker; see [Security & Safe Use](/docs/security)), drop the flag. The packaged unit is
-a package file that an upgrade replaces, so override `ExecStart` with a drop-in rather than editing
-it:
-
-```sh
-systemctl --user edit punktfunk-host
-```
+To serve stock Moonlight clients too, add one line to `~/.config/punktfunk/host.env` (the unit's
+`EnvironmentFile` — no drop-in or unit editing needed) and restart:
 
 ```ini
-[Service]
-ExecStart=
-ExecStart=/usr/bin/punktfunk-host serve
+PUNKTFUNK_GAMESTREAM=1
 ```
 
-The empty `ExecStart=` is required — without it systemd adds a second command instead of replacing
-the first — and the path must match the one `systemctl --user cat` printed (the distro packages use
-`/usr/bin`). Save, then `systemctl --user restart punktfunk-host`.
+```sh
+systemctl --user restart punktfunk-host
+```
 
-Windows is the other way round: an install from the setup `.exe` leaves GameStream **off** unless you
-tick it, and it is configured differently — see [Windows](#windows) below.
+Then also open the `punktfunk-gamestream` firewall service alongside `punktfunk-native` — the
+firewall step in your distro guide has the exact commands.
+
+> **Upgrading?** Earlier releases baked `--gamestream` into the unit's `ExecStart`, so a packaged
+> host served Moonlight by default. The upgrade replaces that unit with the native-only one — if
+> you relied on Moonlight, add `PUNKTFUNK_GAMESTREAM=1` to `host.env` as above. (A hand-made
+> `systemctl --user edit` drop-in that sets its own `ExecStart` keeps winning either way —
+> `systemctl --user cat punktfunk-host` shows what is in effect.)
+
+Windows works the same way: an install from the setup `.exe` leaves GameStream **off** unless you
+tick it, configured through its own mechanism — see [Windows](#windows) below.
 
 ## A. A desktop you log into
 
diff --git a/docs-site/content/docs/sway.md b/docs-site/content/docs/sway.md
index 0794a333..361c2cf2 100644
--- a/docs-site/content/docs/sway.md
+++ b/docs-site/content/docs/sway.md
@@ -91,9 +91,9 @@ systemctl --user enable --now punktfunk-host
 journalctl --user -u punktfunk-host -f
 ```
 
-This unit runs `serve --gamestream`, so it serves stock [Moonlight](/docs/moonlight) clients as well
-as the native ones. For a native-only host, see
-[What the unit starts](/docs/running-as-a-service#what-the-unit-starts).
+This unit runs the secure native-only host. To also serve stock [Moonlight](/docs/moonlight)
+clients, GameStream compat is opt-in (`PUNKTFUNK_GAMESTREAM=1` in `host.env`, trusted LANs only) —
+see [What the unit starts](/docs/running-as-a-service#what-the-unit-starts).
 
 ## Bring up the console and pair
 
diff --git a/docs-site/content/docs/ubuntu.md b/docs-site/content/docs/ubuntu.md
index 47f25e0e..2fbbde51 100644
--- a/docs-site/content/docs/ubuntu.md
+++ b/docs-site/content/docs/ubuntu.md
@@ -152,27 +152,27 @@ Ubuntu installs `ufw` but leaves it **inactive**, so out of the box
 there is nothing to open. If you did enable one — common on Ubuntu Server — the package ships the
 openers for both, because a package never edits your firewall itself.
 
-The packaged unit runs `serve --gamestream` — the `.deb` installs it as it ships and only rewrites
-the binary path — so a host you enabled with `systemctl --user enable --now punktfunk-host` serves
-**both** the native `punktfunk/1` plane and stock [Moonlight](/docs/moonlight) clients, and needs
-**both** openers:
+The packaged unit runs the **secure native-only host** (`serve`, no GameStream), so a host you
+enabled with `systemctl --user enable --now punktfunk-host` needs only the native opener:
 
 ```sh
 # ufw:
 sudo ufw allow punktfunk-native
-sudo ufw allow punktfunk-gamestream
 
 # firewalld:
 sudo firewall-cmd --reload                                        # load the installed definitions
 sudo firewall-cmd --permanent --add-service=punktfunk-native
-sudo firewall-cmd --permanent --add-service=punktfunk-gamestream
 sudo firewall-cmd --reload
 ```
 
-Switched the host to **native-only** — dropped `--gamestream` with a
-`systemctl --user edit punktfunk-host` drop-in, or you run `punktfunk-host serve` by hand? Then open
-`punktfunk-native` alone and leave `punktfunk-gamestream` closed. `systemctl --user cat
-punktfunk-host` shows which one yours is.
+Enabled **GameStream/Moonlight compat** (`PUNKTFUNK_GAMESTREAM=1` in `host.env` — see
+[What the unit starts](/docs/running-as-a-service#what-the-unit-starts)), or you pass
+`--gamestream` by hand? Then also open its service:
+
+```sh
+sudo ufw allow punktfunk-gamestream                               # ufw
+sudo firewall-cmd --permanent --add-service=punktfunk-gamestream && sudo firewall-cmd --reload
+```
 
 `punktfunk-native` opens UDP 9777 (QUIC control), UDP 5353 (mDNS discovery) and TCP 47990 (the
 mgmt/library API — HTTPS + mTLS, read-only off loopback). `punktfunk-gamestream` opens the fixed
diff --git a/packaging/kde/host.env b/packaging/kde/host.env
index 0cedeece..5e23ea58 100644
--- a/packaging/kde/host.env
+++ b/packaging/kde/host.env
@@ -15,6 +15,10 @@ WAYLAND_DISPLAY=wayland-kde
 XDG_CURRENT_DESKTOP=KDE
 PUNKTFUNK_COMPOSITOR=kwin
 PUNKTFUNK_VIDEO_SOURCE=virtual
+# Stock-Moonlight (GameStream) compat is OPT-IN (the host is native-only by default). Uncomment
+# on a TRUSTED LAN if this appliance should serve Moonlight clients too (plain-HTTP pairing +
+# legacy GCM caveats — security-review #5/#9 — and the punktfunk-gamestream firewall ports).
+#PUNKTFUNK_GAMESTREAM=1
 # GPU zero-copy (dmabuf → CUDA → NVENC) is ON by default; auto-falls back to CPU. Set =0 to force CPU.
 PUNKTFUNK_INPUT_BACKEND=libei
 # UDP Generic Segmentation Offload on the send path: coalesce a frame's equal-size packets into
diff --git a/packaging/nix/module-check.nix b/packaging/nix/module-check.nix
index c085e1ec..8397120c 100644
--- a/packaging/nix/module-check.nix
+++ b/packaging/nix/module-check.nix
@@ -82,6 +82,9 @@ let
     services.punktfunk.host = {
       enable = true;
       users = [ "alice" ];
+      # Explicit: gamestream defaults to false now (opt-in on every route) — this fixture
+      # is the one that proves opting IN still reaches the argv and the firewall.
+      gamestream = true;
       gamescopeHdr = false;
       desktopSession = true;
     };
@@ -187,6 +190,14 @@ let
         && !(lib.elem 47984 nativeOnly.networking.firewall.allowedTCPPorts)
         && lib.elem 47990 nativeOnly.networking.firewall.allowedTCPPorts;
     }
+    {
+      # The DEFAULT is the secure native-only host — gamestream unset must behave like
+      # gamestream=false (opt-in on every package route; the appliance fixture leaves it unset).
+      name = "gamestream default (unset) is native-only";
+      ok =
+        !(has appliance "punktfunk-host" "--gamestream")
+        && !(lib.elem 47984 appliance.networking.firewall.allowedTCPPorts);
+    }
     {
       name = "openFirewall opens the console AND its plugin origin";
       ok =
diff --git a/packaging/nix/nixos-module.nix b/packaging/nix/nixos-module.nix
index c1f8fd5c..9efd742b 100644
--- a/packaging/nix/nixos-module.nix
+++ b/packaging/nix/nixos-module.nix
@@ -89,11 +89,13 @@ in
 
       gamestream = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = ''
           Advertise the GameStream/Moonlight-compatible planes (`serve --gamestream`) so a stock
-          Moonlight client can pair. Set to `false` for a native-only, more secure host (no
-          plain-HTTP pairing / legacy GCM path) and drop the GameStream firewall ports.
+          Moonlight client can pair, and open their firewall ports. OPT-IN (default `false`,
+          matching every other package route): the compat planes carry plain-HTTP pairing and the
+          legacy GCM-nonce path (security-review #5/#9), so the default is the secure native-only
+          host — Punktfunk clients only. Enable only on a trusted LAN.
         '';
       };
 
diff --git a/scripts/host.env.example b/scripts/host.env.example
index 1f17208a..792c575a 100644
--- a/scripts/host.env.example
+++ b/scripts/host.env.example
@@ -14,6 +14,13 @@
 #     Mode mid-stream then kills the stream instead of being followed), and stale session vars
 #     point detection at dead sockets. Those knobs are for CI and dedicated appliances (below).
 
+# GameStream/Moonlight compatibility — OPT-IN (the shipped unit runs the secure native-only
+# host). Set =1 so stock Moonlight clients can pair and stream; TRUSTED LANs only — the compat
+# planes carry plain-HTTP pairing + the legacy GCM-nonce path (security-review #5/#9), and need
+# their extra firewall ports (TCP 47984/47989/48010, UDP 47998-48000/48002/48010; the packages
+# ship a `punktfunk-gamestream` firewalld service / ufw profile for exactly this).
+#PUNKTFUNK_GAMESTREAM=1
+
 # Video source (GameStream/Moonlight sessions only): `virtual` creates a per-client virtual
 # output at the client's exact resolution+refresh (the flagship mode, and the default);
 # `portal` captures an existing monitor.
diff --git a/scripts/punktfunk-host.service b/scripts/punktfunk-host.service
index e437e438..32c835c1 100644
--- a/scripts/punktfunk-host.service
+++ b/scripts/punktfunk-host.service
@@ -1,6 +1,9 @@
-# punktfunk streaming host — systemd USER unit (`serve --gamestream` = native punktfunk/1 + the
-# GameStream/Moonlight-compat planes). For a SECURE native-only host (no plain-HTTP pairing / legacy
-# GCM nonce reuse — security-review #5/#9; native clients only), drop `--gamestream` from ExecStart.
+# punktfunk streaming host — systemd USER unit. Runs the SECURE native-only host by default
+# (punktfunk/1 clients + the management API; no plain-HTTP pairing / legacy GCM nonce reuse —
+# security-review #5/#9). Stock-Moonlight (GameStream) compat is OPT-IN: add
+#   PUNKTFUNK_GAMESTREAM=1
+# to ~/.config/punktfunk/host.env (the EnvironmentFile below) and restart — no unit editing
+# needed. Only do that on a TRUSTED LAN; it opens the compat planes' extra ports too.
 #
 # Install (against an already-running compositor session — the host auto-detects and follows it,
 # so host.env needs no backend config):
@@ -35,7 +38,7 @@
 # unit (when present) just needs to be up by the time a client streams (seconds later, user-driven).
 # A missing After= unit (e.g. gamescope backend, no kde-session installed) is simply ignored.
 [Unit]
-Description=punktfunk GameStream + punktfunk/1 host
+Description=punktfunk streaming host (punktfunk/1; +GameStream when PUNKTFUNK_GAMESTREAM=1)
 After=pipewire.service punktfunk-kde-session.service
 # PartOf the kwin session (when present): the host's libei input uses the RemoteDesktop portal,
 # whose D-Bus connection goes stale if the compositor session restarts the portal under it — the
@@ -52,7 +55,7 @@ PartOf=punktfunk-kde-session.service
 # `punktfunk-host serve` by hand already does. Contrast punktfunk-web.service, which marks
 # mgmt-token mandatory ON PURPOSE so Restart waits for the host to write it — this is not that.
 EnvironmentFile=-%h/.config/punktfunk/host.env
-ExecStart=%h/punktfunk/target/release/punktfunk-host serve --gamestream
+ExecStart=%h/punktfunk/target/release/punktfunk-host serve
 Restart=on-failure
 RestartSec=2
 
diff --git a/scripts/steamdeck/install.sh b/scripts/steamdeck/install.sh
index 43e2ecb4..f0cf5498 100755
--- a/scripts/steamdeck/install.sh
+++ b/scripts/steamdeck/install.sh
@@ -10,8 +10,8 @@
 # Run it on the Deck (Desktop Mode "Konsole", or over ssh). Idempotent — safe to re-run to update
 # config or pick up new options. To rebuild after pulling new source, use update.sh.
 #
-#   bash scripts/steamdeck/install.sh                 # PIN pairing required; Moonlight compat ON
-#   bash scripts/steamdeck/install.sh --no-gamestream # SECURE native-only (no Moonlight/#5/#9 surface)
+#   bash scripts/steamdeck/install.sh                 # PIN pairing required; SECURE native-only
+#   bash scripts/steamdeck/install.sh --gamestream    # ALSO serve Moonlight clients (opt-in; #5/#9 caveats)
 #   bash scripts/steamdeck/install.sh --open          # trusted LAN: accept unpaired clients (TOFU)
 #   bash scripts/steamdeck/install.sh --no-web        # skip the management web console
 #   PUNKTFUNK_SRC=~/src/punktfunk bash scripts/steamdeck/install.sh   # source elsewhere
@@ -39,12 +39,13 @@ MGMT_PORT="${PUNKTFUNK_MGMT_PORT:-47990}"
 WEB_PORT="${PUNKTFUNK_WEB_PORT:-47992}"
 OPEN=0
 WITH_WEB=1
-GAMESTREAM=1 # Moonlight/GameStream compat on by default; --no-gamestream for a secure native-only host
+GAMESTREAM=0 # SECURE native-only by default (opt-in on every route); --gamestream adds Moonlight compat
 for arg in "$@"; do
     case "$arg" in
         --open) OPEN=1 ;;
         --no-web) WITH_WEB=0 ;;
-        --no-gamestream) GAMESTREAM=0 ;;
+        --gamestream) GAMESTREAM=1 ;;
+        --no-gamestream) GAMESTREAM=0 ;; # explicit-off kept for old command lines / re-runs
         --src=*) SRC="${arg#--src=}" ;;
         -h|--help) sed -n '2,20p' "$0"; exit 0 ;;
         *) die "unknown option: $arg (try --help)" ;;
@@ -426,15 +427,15 @@ fi
 log "Installing systemd user services"
 mkdir -p "$UNITS"
 # The native punktfunk/1 plane is always on; --gamestream additionally enables the Moonlight-compat
-# planes (the Deck commonly streams to Moonlight too). --no-gamestream → secure native-only (no #5/#9
-# surface; native clients only).
+# planes — OPT-IN, matching every other install route (#5/#9 surface; the default is the secure
+# native-only host, native clients only).
 SERVE_ARGS="serve --mgmt-bind 0.0.0.0:$MGMT_PORT"
 [ "$GAMESTREAM" = 1 ] && SERVE_ARGS="$SERVE_ARGS --gamestream"
 [ "$OPEN" = 1 ] && SERVE_ARGS="$SERVE_ARGS --open"
 cat > "$UNITS/punktfunk-host.service" <<EOF
 # Generated by scripts/steamdeck/install.sh — punktfunk Steam Deck host (native binary).
 [Unit]
-Description=punktfunk host (GameStream + punktfunk/1)
+Description=punktfunk host (punktfunk/1; +GameStream when installed with --gamestream)
 After=pipewire.service
 
 [Service]