feat(video): 4:4:4 defaults — the host allows it, the client chooses it

Capability now lives on the host, choice on the client. PUNKTFUNK_444 flips
to DEFAULT ON with an explicit-off grammar (0/false/off/no — the old
presence-only flag() would have read =0 as on); every existing gate still
applies (client advertisement, HEVC, full-chroma capture, encode probe,
Windows HDR-display downgrade), so an unset host merely stops refusing. The
Apple client's "Full chroma (4:4:4)" toggle flips to DEFAULT OFF: full chroma
is a per-session trade — a clear win for desktop/text, but at a fixed bitrate
game content spends those bits better at 4:2:0, and the encode/decode pixel
rate rises. Persisted user choices survive both flips.

Live-verified on the CachyOS VM: host with no env negotiates
chroma_format_idc=3 for a 4:4:4-advertising client; PUNKTFUNK_444=0 resolves
4:2:0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/config.rs

@@ -51,9 +51,12 @@ pub struct HostConfig {
     pub zerocopy: Option<bool>,
     /// `PUNKTFUNK_10BIT` — host policy gate for HEVC Main10 (only honored when the client also advertised 10-bit).
     pub ten_bit: bool,
-    /// `PUNKTFUNK_444` — host policy gate for full-chroma HEVC 4:4:4 (Range Extensions). Honored only
-    /// when the client also advertised 4:4:4, the codec is HEVC, and the GPU/driver supports a 4:4:4
-    /// encode (probed) — otherwise the session stays 4:2:0. Independent of `ten_bit` (chroma vs depth).
+    /// `PUNKTFUNK_444` — host policy gate for full-chroma HEVC 4:4:4 (Range Extensions).
+    /// **Default ON** (since the pipeline went zero-copy + honest end-to-end, 2026-07-10): the
+    /// host merely *allows* 4:4:4 — a session only becomes 4:4:4 when the client explicitly
+    /// advertised it (a client-side setting, default OFF), the codec is HEVC, the capture can
+    /// deliver full chroma, and the GPU/driver passed the encode probe — otherwise 4:2:0.
+    /// `PUNKTFUNK_444=0`/`false`/`off`/`no` disables. Independent of `ten_bit` (chroma vs depth).
     pub four_four_four: bool,
     /// `PUNKTFUNK_PERF` — per-stage timing instrumentation.
     pub perf: bool,
@@ -102,7 +105,16 @@ impl HostConfig {
                 )
             }),
             ten_bit: flag("PUNKTFUNK_10BIT"),
-            four_four_four: flag("PUNKTFUNK_444"),
+            // Default ON, explicit-off grammar (the client's own 4:4:4 setting — default OFF —
+            // is the real switch; see the field doc).
+            four_four_four: val("PUNKTFUNK_444")
+                .map(|s| {
+                    !matches!(
+                        s.trim().to_ascii_lowercase().as_str(),
+                        "0" | "false" | "off" | "no"
+                    )
+                })
+                .unwrap_or(true),
             perf: flag("PUNKTFUNK_PERF"),
             video_source: val("PUNKTFUNK_VIDEO_SOURCE"),
             compositor: val("PUNKTFUNK_COMPOSITOR"),

crates/punktfunk-host/src/punktfunk1.rs

@@ -933,13 +933,15 @@ async fn serve_session(
             "encode bit depth"
         );
 
-        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host opted in
-        // (PUNKTFUNK_444), the client advertised VIDEO_CAP_444, the session is single-process (the
-        // two-process WGC relay encodes 4:2:0 in v1), and the active GPU/driver actually supports a
-        // 4:4:4 encode (probed, cached). The native path always encodes HEVC. We resolve this BEFORE
-        // the Welcome so `chroma_format` reflects what we'll really emit — the honest-downgrade
-        // channel: if any gate fails the client is told 4:2:0 before it builds its decoder. The probe
-        // opens a tiny encoder; it runs only when both opt-ins are set and is cached after the first.
+        // Resolve the chroma subsampling: full-chroma HEVC 4:4:4 only when ALL of — the host
+        // allows it (PUNKTFUNK_444, default ON; the CLIENT's 4:4:4 setting — default OFF — is the
+        // per-session policy switch behind VIDEO_CAP_444), the client advertised VIDEO_CAP_444,
+        // the session is single-process (the two-process WGC relay encodes 4:2:0 in v1), and the
+        // active GPU/driver actually supports a 4:4:4 encode (probed, cached). The native path
+        // always encodes HEVC. We resolve this BEFORE the Welcome so `chroma_format` reflects
+        // what we'll really emit — the honest-downgrade channel: if any gate fails the client is
+        // told 4:2:0 before it builds its decoder. The probe opens a tiny encoder; it runs only
+        // when the earlier gates pass and is cached after the first.
         let host_wants_444 = crate::config::config().four_four_four;
         let client_supports_444 = hello.video_caps & punktfunk_core::quic::VIDEO_CAP_444 != 0;
         // The active capturer must be able to deliver a full-chroma (RGB) source — the honest-downgrade