feat(video): 4:4:4 defaults — the host allows it, the client chooses it

Capability now lives on the host, choice on the client. PUNKTFUNK_444 flips
to DEFAULT ON with an explicit-off grammar (0/false/off/no — the old
presence-only flag() would have read =0 as on); every existing gate still
applies (client advertisement, HEVC, full-chroma capture, encode probe,
Windows HDR-display downgrade), so an unset host merely stops refusing. The
Apple client's "Full chroma (4:4:4)" toggle flips to DEFAULT OFF: full chroma
is a per-session trade — a clear win for desktop/text, but at a fixed bitrate
game content spends those bits better at 4:2:0, and the encode/decode pixel
rate rises. Persisted user choices survive both flips.

Live-verified on the CachyOS VM: host with no env negotiates
chroma_format_idc=3 for a 4:4:4-advertising client; PUNKTFUNK_444=0 resolves
4:2:0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/msgs.rs

@@ -80,11 +80,13 @@ pub const VIDEO_CAP_10BIT: u8 = 0x01;
 /// [`Hello::video_caps`] bit: the client can present BT.2020 PQ HDR10 (implies 10-bit).
 pub const VIDEO_CAP_HDR: u8 = 0x02;
 /// [`Hello::video_caps`] bit: the client can decode a full-chroma **4:4:4** HEVC stream (HEVC
-/// Range Extensions / Rec.ITU-T H.265 `chroma_format_idc = 3`). The host emits 4:4:4 ONLY when this
-/// bit is set, the host opted in (`PUNKTFUNK_444`), the codec is HEVC, **and** the GPU/driver
-/// actually supports a 4:4:4 encode (probed) — otherwise the session stays 4:2:0 and
-/// [`Welcome::chroma_format`] reflects the real resolved value. Independent of 10-bit/HDR (4:4:4 is a
-/// chroma decision, bit depth is a depth decision; the two may combine where the hardware allows).
+/// Range Extensions / Rec.ITU-T H.265 `chroma_format_idc = 3`) AND its user turned 4:4:4 on (a
+/// client-side setting, default OFF — the per-session policy switch). The host emits 4:4:4 ONLY
+/// when this bit is set, the host allows it (`PUNKTFUNK_444`, default on), the codec is HEVC,
+/// **and** the GPU/driver actually supports a 4:4:4 encode (probed) — otherwise the session stays
+/// 4:2:0 and [`Welcome::chroma_format`] reflects the real resolved value. Independent of
+/// 10-bit/HDR (4:4:4 is a chroma decision, bit depth is a depth decision; the two may combine
+/// where the hardware allows).
 pub const VIDEO_CAP_444: u8 = 0x04;
 /// [`Hello::video_caps`] bit: the client consumes per-AU host-timing datagrams
 /// ([`HOST_TIMING_MAGIC`], 0xCF) — the host's capture→send duration per frame, letting the client

crates/punktfunk-host/src/config.rs

@@ -51,9 +51,12 @@ pub struct HostConfig {
     pub zerocopy: Option<bool>,
     /// `PUNKTFUNK_10BIT` — host policy gate for HEVC Main10 (only honored when the client also advertised 10-bit).
     pub ten_bit: bool,
-    /// `PUNKTFUNK_444` — host policy gate for full-chroma HEVC 4:4:4 (Range Extensions). Honored only
-    /// when the client also advertised 4:4:4, the codec is HEVC, and the GPU/driver supports a 4:4:4
-    /// encode (probed) — otherwise the session stays 4:2:0. Independent of `ten_bit` (chroma vs depth).
+    /// `PUNKTFUNK_444` — host policy gate for full-chroma HEVC 4:4:4 (Range Extensions).
+    /// **Default ON** (since the pipeline went zero-copy + honest end-to-end, 2026-07-10): the
+    /// host merely *allows* 4:4:4 — a session only becomes 4:4:4 when the client explicitly
+    /// advertised it (a client-side setting, default OFF), the codec is HEVC, the capture can
+    /// deliver full chroma, and the GPU/driver passed the encode probe — otherwise 4:2:0.
+    /// `PUNKTFUNK_444=0`/`false`/`off`/`no` disables. Independent of `ten_bit` (chroma vs depth).
     pub four_four_four: bool,
     /// `PUNKTFUNK_PERF` — per-stage timing instrumentation.
     pub perf: bool,
@@ -102,7 +105,16 @@ impl HostConfig {
                 )
             }),
             ten_bit: flag("PUNKTFUNK_10BIT"),
-            four_four_four: flag("PUNKTFUNK_444"),
+            // Default ON, explicit-off grammar (the client's own 4:4:4 setting — default OFF —
+            // is the real switch; see the field doc).
+            four_four_four: val("PUNKTFUNK_444")
+                .map(|s| {
+                    !matches!(
+                        s.trim().to_ascii_lowercase().as_str(),
+                        "0" | "false" | "off" | "no"
+                    )
+                })
+                .unwrap_or(true),
             perf: flag("PUNKTFUNK_PERF"),
             video_source: val("PUNKTFUNK_VIDEO_SOURCE"),
             compositor: val("PUNKTFUNK_COMPOSITOR"),

crates/punktfunk-host/src/punktfunk1.rs

@@ -933,13 +933,15 @@ async fn serve_session(
             "encode bit depth"
         );
 
-        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host opted in
-        // (PUNKTFUNK_444), the client advertised VIDEO_CAP_444, the session is single-process (the
-        // two-process WGC relay encodes 4:2:0 in v1), and the active GPU/driver actually supports a
-        // 4:4:4 encode (probed, cached). The native path always encodes HEVC. We resolve this BEFORE
-        // the Welcome so `chroma_format` reflects what we'll really emit — the honest-downgrade
-        // channel: if any gate fails the client is told 4:2:0 before it builds its decoder. The probe
-        // opens a tiny encoder; it runs only when both opt-ins are set and is cached after the first.
+        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host
+        // allows it (PUNKTFUNK_444, default ON; the CLIENT's 4:4:4 setting — default OFF — is the
+        // per-session policy switch behind VIDEO_CAP_444), the client advertised VIDEO_CAP_444,
+        // the session is single-process (the two-process WGC relay encodes 4:2:0 in v1), and the
+        // active GPU/driver actually supports a 4:4:4 encode (probed, cached). The native path
+        // always encodes HEVC. We resolve this BEFORE the Welcome so `chroma_format` reflects
+        // what we'll really emit — the honest-downgrade channel: if any gate fails the client is
+        // told 4:2:0 before it builds its decoder. The probe opens a tiny encoder; it runs only
+        // when the earlier gates pass and is cached after the first.
         let host_wants_444 = crate::config::config().four_four_four;
         let client_supports_444 = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_444 != 0;
         // The active capturer must be able to deliver a full-chroma (RGB) source — the honest-downgrade