feat(host/windows,packaging): installer overhaul - branding, VB-CABLE, GameStream choice, driver uninstall

- Modern branded wizard: WizardStyle=modern dynamic windows11 (Inno >= 6.6, plain-modern fallback for older compilers; CI provisioning upgrades a pre-6.6 Inno). Brand-mark wizard side panels + header tiles (100-200% DPI) and a multi-size punktfunk.ico (SetupIconFile + Apps & Features), generated AND committed by branding/gen-branding.ps1 from the canonical brand geometry. Gotcha encoded in the script: ISCC rejects all-PNG icons, so entries <= 64px are classic DIBs (PNG only at 128/256), and the ICO is load-verified. - VB-CABLE actually ships now: windows-host.yml never set VBCABLE_DIR, so every published installer silently omitted the virtual mic (broken mic passthrough in the field). CI provisions the pinned, SHA-256-verified official Pack45 (provision-windows-punktfunk-extras.ps1) and the pack now FAILS on a supplied-but-invalid dir instead of shipping mic-less again. Attribution per VB-Audio's bundling grant surfaced in the visible wizard task text (vendor, vb-cable.com, donationware) on top of the licenses notice. - GameStream (Moonlight) compat is a wizard task (checked by default) -> service install --gamestream=on|off writes PUNKTFUNK_HOST_CMD= serve[ --gamestream] into host.env. Only the two canonical values are ever rewritten - a hand-customized command line survives upgrades. Silent installs: /MERGETASKS="!gamestream". - Driver uninstall (field report: our virtual-device drivers survived uninstall): new `driver uninstall [--gamepad]` removes the pf-vdisplay device node(s) + the pf-vdisplay/pf-dualsense/pf-xusb driver-store packages, wired into [UninstallRun] after service uninstall. Locale-safe by construction: devices matched on unlocalized VALUES (never pnputil's localized labels), packages found by INF content scan - validated against a German-locale box ("Instanz-ID:" parse; 7/7 punktfunk INFs matched, no foreign hits). VB-CABLE is deliberately left installed (shared third-party component with its own uninstaller). Installer compile, cargo check/clippy/fmt, and the ASCII locale gate are green; the wizard look + uninstall flow still need one on-glass pass on a disposable box (this box runs the live host). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 12:16:11 +02:00
parent 9074781acd
commit f48dc5dfce
20 changed files with 568 additions and 29 deletions
@@ -47,16 +47,31 @@ parse breakage that silently failed installs on non-English boxes.
  **`PunktfunkWeb`** scheduled task (boot, SYSTEM, restart-on-failure → `web-run.cmd` → `bun` on
  `:3000`), opens TCP 3000, and starts it. It proxies the host's loopback mgmt API with the host's
  own `%ProgramData%\punktfunk\mgmt-token`.
+- **GameStream (Moonlight) compatibility is a wizard task** (checked by default): the choice is passed
+  to `service install --gamestream=on|off`, which writes `PUNKTFUNK_HOST_CMD=serve --gamestream` (or
+  `serve`, the secure native-only host) into `host.env`. Upgrade-safe: a hand-customized
+  `PUNKTFUNK_HOST_CMD` is never overwritten.
+- **Branded, modern wizard**: `WizardStyle=modern dynamic windows11` (Inno ≥ 6.6 — Windows-11-style
+  controls following the system light/dark theme; pre-6.6 compilers fall back to plain `modern`), with
+  the punktfunk lens mark on the side panel / header tile and a multi-size `punktfunk.ico`
+  (`SetupIconFile` + the Apps & features entry). Assets are generated **and committed** by
+  `branding/gen-branding.ps1` from the canonical brand geometry (`web/src/components/brand-mark.tsx`);
+  re-run it only when the brand changes.
 - **Upgrade:** stops a running `PunktfunkHost` service and waits for `STOPPED` before replacing files
  (otherwise the locked exe / respawning supervisor would block the copy), then re-points the service;
  the existing console password is kept (the wizard page is skipped).
 - **Uninstall** (Add/Remove Programs): runs `service uninstall` (stop + delete service + remove
-  firewall rules) and removes the `PunktfunkWeb` task + its firewall rule. The pf-vdisplay driver and the
-  `%ProgramData%\punktfunk` config (incl. `web-password`) are intentionally left in place.
+  firewall rules), removes the `PunktfunkWeb` task + its firewall rule, then `driver uninstall` (+
+  `--gamepad`) removes the punktfunk virtual-device drivers — the pf-vdisplay device node(s) and the
+  pf-vdisplay / pf-dualsense / pf-xusb driver-store packages (the field report was that they survived
+  uninstall). **VB-CABLE is intentionally NOT removed** (a third-party shared component the user may
+  use elsewhere — its own uninstaller is `VBCABLE_Setup_x64.exe -u -h`); the `%ProgramData%\punktfunk`
+  config (incl. `web-password`) is also left in place.

 Silent install: `punktfunk-host-setup-<ver>.exe /VERYSILENT` (omit the driver with
-`/MERGETASKS="!installdriver"`). A silent fresh install uses the generated random console password —
-read it from `%ProgramData%\punktfunk\web-password`.
+`/MERGETASKS="!installdriver"`; disable Moonlight compat with `/MERGETASKS="!gamestream"`). A silent
+fresh install uses the generated random console password — read it from
+`%ProgramData%\punktfunk\web-password`.

 ## Prerequisites on the target box

@@ -70,18 +85,24 @@ read it from `%ProgramData%\punktfunk\web-password`.
  Output` capture endpoint surfaces as a host mic. A Windows audio device can only be created by a
  **kernel-mode** driver (no UMDF path exists), so unlike our self-signed UMDF drivers we cannot ship our
  own — VB-CABLE is a vendor-signed cable that loads with no test-signing. It is **donationware** by
-  VB-Audio, redistributed under VB-Audio's bundling grant (only the single base cable); see
-  `licenses/VB-CABLE-NOTICE.txt`. The package binary is **not** in the repo — supply it to the packer via
-  `-VbCableDir` / `$env:VBCABLE_DIR` (the extracted official package, containing `VBCABLE_Setup_x64.exe`).
-  Absent → the installer is built without it and the host falls back to auto-installing the Steam
-  Streaming pair. *(Endgame: attestation-sign our own MIT virtual-audio driver to drop this dependency.)*
+  VB-Audio, redistributed under VB-Audio's bundling grant (only the single base cable) — the grant
+  requires the end user to see VB-CABLE's origin + donationware status, which the wizard task text and
+  `licenses/VB-CABLE-NOTICE.txt` surface. The package binary is **not** in the repo — CI provisions the
+  **pinned, SHA-256-verified official package** onto the runner (`scripts/ci/provision-windows-punktfunk-extras.ps1`
+  → `C:\Users\Public\vbcable`) and `windows-host.yml` passes it via `$env:VBCABLE_DIR`, so **published
+  installers always bundle it**; locally supply `-VbCableDir` / `$env:VBCABLE_DIR` (the extracted
+  official package, containing `VBCABLE_Setup_x64.exe`). Unset → the installer is built without it and
+  the host falls back to auto-installing the Steam Streaming pair; set-but-invalid → the pack **fails**
+  (a broken provisioning must not silently ship a mic-less installer again). *(Endgame:
+  attestation-sign our own MIT virtual-audio driver to drop this dependency.)*

 ## Files here

 | File | Role |
 |------|------|
 | `punktfunk-host.iss` | Inno Setup script (the installer definition). |
-| `pack-host-installer.ps1` | Orchestrator: cert + sign exe, **build + sign the drivers from source**, stage them + FFmpeg + the **web console** (`.output` + bun) + the HDR layer, run ISCC, sign setup.exe. |
+| `branding/` | Wizard branding: `gen-branding.ps1` renders the brand mark into the committed `wizard-image-*.bmp` / `wizard-small-*.bmp` (100–200% DPI) + `punktfunk.ico`. Re-run only on a brand change. |
+| `pack-host-installer.ps1` | Orchestrator: cert + sign exe, **build + sign the drivers from source**, stage them + FFmpeg + VB-CABLE + the **web console** (`.output` + bun) + the HDR layer + branding, run ISCC, sign setup.exe. |
 | `build-pf-vdisplay.ps1` | Build pf-vdisplay from source (the `drivers/` workspace) + clear FORCE_INTEGRITY + sign `.dll`/`.cat` + export `.cer`. |
 | `build-gamepad-drivers.ps1` | Sign + catalog the gamepad drivers (`pf-dualsense` + `pf-xusb`) from the same workspace build (`-SkipBuild`), one shared cert. |
 | `install-vbcable.ps1` | On-target: seed VB-Audio's cert into `TrustedPublisher`, silently install the bundled VB-CABLE (`-i -h`). Run by the installer's *Install VB-CABLE virtual audio* task; idempotent + always exits 0 (non-fatal). |
@@ -0,0 +1,235 @@
+<#
+.SYNOPSIS
+  Generate the punktfunk host installer branding assets (wizard BMPs + setup .ico).
+
+.DESCRIPTION
+  Renders the punktfunk brand mark - the two overlapping circles ("lens") from
+  web/src/components/brand-mark.tsx (the canonical flattened geometry, shared with the Apple icon,
+  the marketing site and the docs) - into the assets Inno Setup consumes:
+
+    wizard-image-*.bmp   welcome/finish page side panel (164x314 base, 100..200% DPI variants);
+                         dark violet gradient panel + the mark + the lowercase wordmark. The panel
+                         is self-contained dark, so it reads correctly in BOTH the light and dark
+                         (WizardStyle=dynamic) wizard appearances.
+    wizard-small-*.bmp   header tile on the inner pages (55x55 base, 100..200% DPI variants);
+                         the square brand tile (mark on #1C1530), matching the MSIX client tile.
+    punktfunk.ico        multi-size icon (16..256, PNG-compressed entries - Vista+ format, we
+                         require Windows 10) for SetupIconFile + the Apps & Features entry.
+
+  Outputs are COMMITTED next to this script (like include/punktfunk_core.h, generated-but-checked-in);
+  re-run only when the brand changes. Everything is drawn 4x supersampled and downscaled
+  (System.Drawing regions/clips do not antialias), so edges stay clean at every size.
+
+.EXAMPLE
+  pwsh -File packaging/windows/branding/gen-branding.ps1
+#>
+[CmdletBinding()]
+param([string]$OutDir = $PSScriptRoot)
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Drawing
+
+# --- brand constants (colors from brand-mark.tsx; tile background from the MSIX assets) -------
+$colLight = [System.Drawing.Color]::FromArgb(255, 0xA7, 0x9F, 0xF8)   # large circle
+$colDeep = [System.Drawing.Color]::FromArgb(255, 0x6C, 0x5B, 0xF3)   # small circle
+$colHi = [System.Drawing.Color]::FromArgb(255, 0xD2, 0xC9, 0xFB)   # lens overlap highlight
+$colTile = [System.Drawing.Color]::FromArgb(255, 0x1C, 0x15, 0x30)   # brand tile background
+$colPanelTop = [System.Drawing.Color]::FromArgb(255, 0x27, 0x1E, 0x46)   # wizard panel gradient
+$colPanelBot = [System.Drawing.Color]::FromArgb(255, 0x11, 0x0D, 0x1F)
+$colText = [System.Drawing.Color]::FromArgb(255, 0xEA, 0xE6, 0xFB)   # wordmark on the panel
+
+# Mark geometry in the 1000-unit viewbox of brand-mark.tsx: two r=194.41 circles at (403.04,597.26)
+# (light, behind) and (597.81,402.85) (deep, in front), their intersection filled as the highlight.
+$R = 194.41
+$c1x = 403.037; $c1y = 597.262
+$c2x = 597.8075; $c2y = 402.8525
+# Mark bounding box -> center/span, so callers can place it by center + size.
+$bbMinX = $c1x - $R; $bbMaxX = $c2x + $R
+$bbMinY = $c2y - $R; $bbMaxY = $c1y + $R
+$markCx = ($bbMinX + $bbMaxX) / 2.0
+$markCy = ($bbMinY + $bbMaxY) / 2.0
+$markSpan = $bbMaxX - $bbMinX   # == $bbMaxY - $bbMinY (the bbox is square)
+
+# Draw the mark onto $g centered at ($cx,$cy) with bounding-box size $size (device pixels).
+function Draw-Mark([System.Drawing.Graphics]$g, [double]$cx, [double]$cy, [double]$size) {
+    $s = $size / $markSpan
+    function ellRect([double]$ecx, [double]$ecy) {
+        $r = $R * $s
+        [System.Drawing.RectangleF]::new(
+            [float]($cx + ($ecx - $markCx) * $s - $r), [float]($cy + ($ecy - $markCy) * $s - $r),
+            [float](2 * $r), [float](2 * $r))
+    }
+    $r1 = ellRect $c1x $c1y
+    $r2 = ellRect $c2x $c2y
+    $b = New-Object System.Drawing.SolidBrush($colLight)
+    $g.FillEllipse($b, $r1); $b.Dispose()
+    $b = New-Object System.Drawing.SolidBrush($colDeep)
+    $g.FillEllipse($b, $r2); $b.Dispose()
+    # Highlight = intersection: clip to circle 1, fill circle 2. The clip edge is not antialiased,
+    # but every caller renders 4x supersampled and downscales, which smooths it.
+    $p1 = New-Object System.Drawing.Drawing2D.GraphicsPath
+    $p1.AddEllipse($r1)
+    $g.SetClip($p1)
+    $b = New-Object System.Drawing.SolidBrush($colHi)
+    $g.FillEllipse($b, $r2); $b.Dispose()
+    $g.ResetClip(); $p1.Dispose()
+}
+
+# New 32bpp canvas + antialiased Graphics.
+function New-Canvas([int]$w, [int]$h) {
+    $bmp = New-Object System.Drawing.Bitmap($w, $h, [System.Drawing.Imaging.PixelFormat]::Format32bppArgb)
+    $g = [System.Drawing.Graphics]::FromImage($bmp)
+    $g.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::AntiAlias
+    $g.TextRenderingHint = [System.Drawing.Text.TextRenderingHint]::AntiAlias
+    @($bmp, $g)
+}
+
+# Downscale $src to $w x $h (high-quality bicubic) - the supersample resolve.
+function Resize-Bitmap([System.Drawing.Bitmap]$src, [int]$w, [int]$h) {
+    $dst = New-Object System.Drawing.Bitmap($w, $h, [System.Drawing.Imaging.PixelFormat]::Format32bppArgb)
+    $g = [System.Drawing.Graphics]::FromImage($dst)
+    $g.InterpolationMode = [System.Drawing.Drawing2D.InterpolationMode]::HighQualityBicubic
+    $g.PixelOffsetMode = [System.Drawing.Drawing2D.PixelOffsetMode]::HighQuality
+    $g.DrawImage($src, (New-Object System.Drawing.Rectangle(0, 0, $w, $h)),
+        0, 0, $src.Width, $src.Height, [System.Drawing.GraphicsUnit]::Pixel)
+    $g.Dispose()
+    $dst
+}
+
+# Save as 24bpp BMP (opaque - what Inno's wizard image loader expects by default).
+function Save-Bmp24([System.Drawing.Bitmap]$bmp, [string]$path) {
+    $b24 = $bmp.Clone((New-Object System.Drawing.Rectangle(0, 0, $bmp.Width, $bmp.Height)),
+        [System.Drawing.Imaging.PixelFormat]::Format24bppRgb)
+    $b24.Save($path, [System.Drawing.Imaging.ImageFormat]::Bmp)
+    $b24.Dispose()
+    Write-Host "  wrote $path ($($bmp.Width)x$($bmp.Height))"
+}
+
+$SS = 4   # supersample factor
+
+# --- wizard side panel (welcome/finish page): gradient + mark + wordmark ----------------------
+# Base size 164x314 (Inno's classic canvas); DPI variants via the wizard-image-*.bmp wildcard.
+foreach ($pct in 100, 125, 150, 175, 200) {
+    $w = [int][Math]::Round(164 * $pct / 100.0)
+    $h = [int][Math]::Round(314 * $pct / 100.0)
+    $bmp, $g = New-Canvas ($w * $SS) ($h * $SS)
+    $rect = New-Object System.Drawing.Rectangle(0, 0, ($w * $SS), ($h * $SS))
+    $grad = New-Object System.Drawing.Drawing2D.LinearGradientBrush($rect, $colPanelTop, $colPanelBot, 90.0)
+    $g.FillRectangle($grad, $rect); $grad.Dispose()
+    # Mark: 58% of the panel width, centered horizontally, optical center at ~40% height.
+    Draw-Mark $g ($w * $SS / 2.0) ($h * $SS * 0.40) ($w * $SS * 0.58)
+    # Wordmark: lowercase brand name under the mark.
+    $font = New-Object System.Drawing.Font('Segoe UI Semibold', [float](13.0 * $SS * $pct / 100.0), [System.Drawing.FontStyle]::Regular, [System.Drawing.GraphicsUnit]::Pixel)
+    $tb = New-Object System.Drawing.SolidBrush($colText)
+    $fmt = New-Object System.Drawing.StringFormat
+    $fmt.Alignment = [System.Drawing.StringAlignment]::Center
+    $g.DrawString('punktfunk', $font, $tb,
+        (New-Object System.Drawing.PointF([float]($w * $SS / 2.0), [float]($h * $SS * 0.60))), $fmt)
+    $fmt.Dispose(); $tb.Dispose(); $font.Dispose(); $g.Dispose()
+    $out = Resize-Bitmap $bmp $w $h
+    $bmp.Dispose()
+    Save-Bmp24 $out (Join-Path $OutDir ("wizard-image-{0}.bmp" -f $pct))
+    $out.Dispose()
+}
+
+# --- wizard header tile (inner pages): the square brand tile --------------------------------
+# Base size 55x55; DPI variants via the wizard-small-*.bmp wildcard. Opaque square (BMP has no
+# alpha here): the same full-bleed dark tile as the client's MSIX logo assets.
+foreach ($pct in 100, 125, 150, 175, 200) {
+    $sz = [int][Math]::Round(55 * $pct / 100.0)
+    $bmp, $g = New-Canvas ($sz * $SS) ($sz * $SS)
+    $b = New-Object System.Drawing.SolidBrush($colTile)
+    $g.FillRectangle($b, 0, 0, ($sz * $SS), ($sz * $SS)); $b.Dispose()
+    Draw-Mark $g ($sz * $SS / 2.0) ($sz * $SS / 2.0) ($sz * $SS * 0.74)
+    $g.Dispose()
+    $out = Resize-Bitmap $bmp $sz $sz
+    $bmp.Dispose()
+    Save-Bmp24 $out (Join-Path $OutDir ("wizard-small-{0}.bmp" -f $pct))
+    $out.Dispose()
+}
+
+# --- punktfunk.ico: rounded brand tile at 16..256 --------------------------------------------
+# Small sizes are classic 32bpp DIB entries (Inno's SetupIconFile resource updater and older shell
+# consumers reject an all-PNG icon); only 128/256 use PNG compression (the standard Vista+ layout).
+function New-IconTile([int]$sz) {
+    $bmp, $g = New-Canvas ($sz * $SS) ($sz * $SS)
+    # Rounded-rect tile (22% corner radius - the Windows 11 app-icon look).
+    $S = $sz * $SS; $rad = [int]($S * 0.22)
+    $path = New-Object System.Drawing.Drawing2D.GraphicsPath
+    $path.AddArc(0, 0, 2 * $rad, 2 * $rad, 180, 90)
+    $path.AddArc($S - 2 * $rad, 0, 2 * $rad, 2 * $rad, 270, 90)
+    $path.AddArc($S - 2 * $rad, $S - 2 * $rad, 2 * $rad, 2 * $rad, 0, 90)
+    $path.AddArc(0, $S - 2 * $rad, 2 * $rad, 2 * $rad, 90, 90)
+    $path.CloseFigure()
+    $b = New-Object System.Drawing.SolidBrush($colTile)
+    $g.FillPath($b, $path); $b.Dispose(); $path.Dispose()
+    Draw-Mark $g ($S / 2.0) ($S / 2.0) ($S * 0.74)
+    $g.Dispose()
+    $out = Resize-Bitmap $bmp $sz $sz
+    $bmp.Dispose()
+    $out
+}
+
+# PNG-compressed entry payload (used for the 128/256 entries). The leading comma keeps the byte[]
+# a single pipeline object (PowerShell would otherwise unroll it into individual bytes).
+function ConvertTo-IconPng([System.Drawing.Bitmap]$tile) {
+    $ms = New-Object System.IO.MemoryStream
+    $tile.Save($ms, [System.Drawing.Imaging.ImageFormat]::Png)
+    return , $ms.ToArray()
+}
+
+# Classic ICO DIB entry payload: BITMAPINFOHEADER (height doubled) + bottom-up 32bpp BGRA XOR data
+# + an all-zero 1bpp AND mask (32bpp icons carry transparency in the alpha channel).
+function ConvertTo-IconDib([System.Drawing.Bitmap]$tile) {
+    $s = $tile.Width
+    $rect = New-Object System.Drawing.Rectangle(0, 0, $s, $s)
+    $data = $tile.LockBits($rect, [System.Drawing.Imaging.ImageLockMode]::ReadOnly,
+        [System.Drawing.Imaging.PixelFormat]::Format32bppArgb)
+    $px = New-Object byte[] ($data.Stride * $s)
+    [System.Runtime.InteropServices.Marshal]::Copy($data.Scan0, $px, 0, $px.Length)
+    $tile.UnlockBits($data)
+    $maskStride = [int][Math]::Ceiling($s / 32.0) * 4     # 1bpp rows padded to 32 bits
+    $ms = New-Object System.IO.MemoryStream
+    $w = New-Object System.IO.BinaryWriter($ms)
+    $w.Write([uint32]40); $w.Write([int]$s); $w.Write([int]($s * 2))   # biSize, biWidth, biHeight (XOR+AND)
+    $w.Write([uint16]1); $w.Write([uint16]32); $w.Write([uint32]0)     # biPlanes, biBitCount, BI_RGB
+    $w.Write([uint32]($s * $s * 4 + $maskStride * $s))                 # biSizeImage
+    $w.Write([int]0); $w.Write([int]0); $w.Write([uint32]0); $w.Write([uint32]0)
+    for ($y = $s - 1; $y -ge 0; $y--) { $w.Write($px, $y * $data.Stride, $s * 4) }   # XOR, bottom-up
+    $w.Write((New-Object byte[] ($maskStride * $s)))                   # AND mask: all opaque
+    $w.Flush()
+    $bytes = $ms.ToArray()
+    $w.Dispose(); $ms.Dispose()
+    return , $bytes   # leading comma: emit the byte[] as ONE object, not unrolled bytes
+}
+
+$icoSizes = 16, 20, 24, 32, 40, 48, 64, 128, 256
+$pngs = @(foreach ($s in $icoSizes) {
+    $tile = New-IconTile $s
+    if ($s -ge 128) { ConvertTo-IconPng $tile } else { ConvertTo-IconDib $tile }
+    $tile.Dispose()
+})
+$ico = New-Object System.IO.MemoryStream
+$bw = New-Object System.IO.BinaryWriter($ico)
+# ICONDIR
+$bw.Write([uint16]0); $bw.Write([uint16]1); $bw.Write([uint16]$icoSizes.Count)
+# ICONDIRENTRYs (width/height byte 0 means 256)
+$offset = 6 + 16 * $icoSizes.Count
+for ($i = 0; $i -lt $icoSizes.Count; $i++) {
+    $s = $icoSizes[$i]
+    $dim = if ($s -ge 256) { 0 } else { $s }
+    $bw.Write([byte]$dim); $bw.Write([byte]$dim)          # width, height
+    $bw.Write([byte]0); $bw.Write([byte]0)                # colors, reserved
+    $bw.Write([uint16]1); $bw.Write([uint16]32)           # planes, bitcount
+    $bw.Write([uint32]$pngs[$i].Length); $bw.Write([uint32]$offset)
+    $offset += $pngs[$i].Length
+}
+foreach ($p in $pngs) { $bw.Write([byte[]]$p) }
+$bw.Flush()
+$icoPath = Join-Path $OutDir 'punktfunk.ico'
+[IO.File]::WriteAllBytes($icoPath, $ico.ToArray())
+$bw.Dispose(); $ico.Dispose()
+# Self-check: a malformed container here would only surface later as ISCC "Icon file is invalid".
+$probe = New-Object System.Drawing.Icon($icoPath)
+$probe.Dispose()
+Write-Host "  wrote $icoPath ($($icoSizes -join ',')) - verified loadable"
+Write-Host "==> branding assets generated in $OutDir"
@@ -132,6 +132,13 @@ $issLocal = Join-Path $OutDir 'punktfunk-host.iss'
 Copy-Item -LiteralPath $hostEnvSrc -Destination $hostEnv -Force
 Copy-Item -LiteralPath $readmeSrc -Destination $readme -Force
 Copy-Item -LiteralPath $iss -Destination $issLocal -Force
+# Branding (wizard BMPs + punktfunk.ico, committed outputs of branding/gen-branding.ps1): the .iss
+# references them as "branding\" relative to itself, so stage the dir next to the staged .iss.
+$brandStage = Join-Path $OutDir 'branding'
+if (Test-Path $brandStage) { Remove-Item $brandStage -Recurse -Force }
+New-Item -ItemType Directory -Force -Path $brandStage | Out-Null
+Copy-Item (Join-Path $here 'branding\*.bmp') $brandStage -Force
+Copy-Item (Join-Path $here 'branding\punktfunk.ico') $brandStage -Force

 # License/attribution payload bundled into {app}\licenses: the project's own MIT/Apache texts and the
 # generated third-party crate notices. The FFmpeg LGPL notice + license text are added to this same
@@ -198,7 +205,13 @@ if (-not $NoDriver) {
 # shipped intact); supply it via -VbCableDir / $env:VBCABLE_DIR pointing at the extracted official
 # package (must contain VBCABLE_Setup_x64.exe). Absent -> installer built WITHOUT the bundled cable; the
 # host then auto-installs the Steam Streaming pair as a fallback and mic passthrough needs a manual cable.
-if ($VbCableDir -and (Test-Path $VbCableDir) -and (Get-ChildItem -Path $VbCableDir -Filter 'VBCABLE_Setup*.exe' -ErrorAction SilentlyContinue)) {
+if ($VbCableDir -and -not ((Test-Path $VbCableDir) -and (Get-ChildItem -Path $VbCableDir -Filter 'VBCABLE_Setup*.exe' -ErrorAction SilentlyContinue))) {
+    # An explicitly-supplied dir that doesn't hold the package is a broken provisioning, not an
+    # opt-out - fail loudly instead of silently shipping an installer without the virtual mic
+    # (exactly the field regression this bundling fixes). Opt out by leaving VBCABLE_DIR unset.
+    throw "VbCableDir '$VbCableDir' has no VBCABLE_Setup*.exe - re-run scripts/ci/provision-windows-punktfunk-extras.ps1 (or unset VBCABLE_DIR to build without the virtual mic)"
+}
+if ($VbCableDir) {
    $vbStage = Join-Path $OutDir 'vbcable'
    if (Test-Path $vbStage) { Remove-Item -Recurse -Force $vbStage }
    New-Item -ItemType Directory -Force -Path $vbStage | Out-Null
@@ -211,7 +224,7 @@ if ($VbCableDir -and (Test-Path $VbCableDir) -and (Get-ChildItem -Path $VbCableD
    Copy-Item (Join-Path $here 'licenses\VB-CABLE-NOTICE.txt') -Destination $licStage -Force
    Write-Host "==> bundling VB-CABLE (virtual mic) from $VbCableDir -> $vbStage"
 }
-else { Write-Host "no -VbCableDir/`$env:VBCABLE_DIR (or no VBCABLE_Setup*.exe in it) -> installer built WITHOUT the bundled VB-CABLE virtual mic" }
+else { Write-Host "no -VbCableDir/`$env:VBCABLE_DIR -> installer built WITHOUT the bundled VB-CABLE virtual mic (CI always bundles it; see provision-windows-punktfunk-extras.ps1)" }

 # --- stage the FFmpeg shared DLLs (AMD/Intel AMF/QSV build) ------------------------------------
 # A host built with --features amf-qsv link-imports avcodec/avutil/swscale/... so the shared DLLs
@@ -28,6 +28,13 @@
 #ifndef Readme
  #define Readme "README.md"
 #endif
+; Branding assets (wizard side panel + header tile BMPs, setup/app icon), generated + committed by
+; branding/gen-branding.ps1 from the canonical brand-mark geometry. Relative to this script's dir:
+; works from the repo checkout AND from the staged copy (pack-host-installer.ps1 stages branding\
+; next to the staged .iss).
+#ifndef BrandingDir
+  #define BrandingDir "branding"
+#endif
 ; The web console launcher (the PunktfunkWeb task action) + its post-install provisioner - committed
 ; scripts staged next to the .iss by pack-host-installer.ps1 (absolute paths passed in).
 #ifndef WebRunCmd
@@ -85,9 +92,23 @@ OutputDir={#OutputDir}
 OutputBaseFilename=punktfunk-host-setup-{#MyAppVersion}
 Compression=lzma2/max
 SolidCompression=yes
+; Modern branded wizard: Windows-11-style controls that follow the system light/dark theme
+; (Inno Setup >= 6.6; CI provisions current 6.x via choco). An older local compiler falls back
+; to the plain modern style so a dev pack still builds.
+#if VER >= EncodeVer(6,6,0)
+WizardStyle=modern dynamic windows11
+#else
 WizardStyle=modern
+#endif
+; Brand assets (branding/gen-branding.ps1): the violet lens mark on a dark panel/tile - self-
+; contained dark art, so it reads correctly in both the light and dark wizard appearance. The
+; wildcard names carry 100..200% DPI variants; Setup picks the closest.
+SetupIconFile={#BrandingDir}\punktfunk.ico
+WizardImageFile={#BrandingDir}\wizard-image-*.bmp
+WizardSmallImageFile={#BrandingDir}\wizard-small-*.bmp
 UninstallDisplayName=punktfunk host {#MyAppVersion}
-UninstallDisplayIcon={app}\punktfunk-host.exe
+; The branded multi-size .ico (installed below) - the host exe embeds no icon resource.
+UninstallDisplayIcon={app}\punktfunk.ico

 [Languages]
 Name: "english"; MessagesFile: "compiler:Default.isl"
@@ -100,17 +121,26 @@ Name: "installdriver"; Description: "Install the pf-vdisplay virtual display dri
 Name: "installgamepad"; Description: "Install the virtual gamepad drivers (DualSense / DualShock 4 / Xbox 360 - no ViGEmBus needed)"
 #endif
 #ifdef WithAudioCable
-Name: "installaudiocable"; Description: "Install VB-CABLE virtual audio (microphone passthrough - VB-Audio donationware, www.vb-cable.com)"
+; VB-Audio's bundling grant requires the end user to see VB-CABLE's origin + donationware status
+; at install time - keep the vendor, URL, and donationware wording in this visible task text (the
+; full notice ships in {app}\licenses\VB-CABLE-NOTICE.txt).
+Name: "installaudiocable"; Description: "Install VB-CABLE virtual audio for microphone passthrough (VB-CABLE by VB-Audio, www.vb-cable.com - donationware, all participations welcome)"
 #endif
 #ifdef WithVkLayer
 Name: "installhdrlayer"; Description: "Install the HDR Vulkan layer (lets Vulkan games like Doom use HDR on the virtual display)"
 #endif
+; Host-config choice, applied via `service install --gamestream=on|off` (writes PUNKTFUNK_HOST_CMD
+; in host.env; a hand-customized value is left alone). Checked = the Moonlight-compatible unified
+; host (the common Windows setup); unchecked = the secure native-only host (punktfunk clients only).
+Name: "gamestream"; Description: "Enable GameStream (Moonlight) compatibility - lets stock Moonlight clients connect (uses legacy plain-HTTP pairing; for trusted LANs)"
 Name: "startservice"; Description: "Start the punktfunk host service now (also starts on every boot)"

 [Files]
 Source: "{#BinDir}\punktfunk-host.exe"; DestDir: "{app}"; Flags: ignoreversion
 Source: "{#HostEnv}"; DestDir: "{app}"; Flags: ignoreversion
 Source: "{#Readme}"; DestDir: "{app}"; DestName: "README.txt"; Flags: ignoreversion
+; The branded icon, referenced by UninstallDisplayIcon (Apps & features shows it for the entry).
+Source: "{#BrandingDir}\punktfunk.ico"; DestDir: "{app}"; Flags: ignoreversion
 #ifdef LicensesDir
 ; License/attribution payload -> {app}\licenses: the project's MIT/Apache texts, the generated
 ; THIRD-PARTY-NOTICES (permissive crate attributions), and (on an amf-qsv build) the FFmpeg LGPL
@@ -184,7 +214,8 @@ Filename: "powershell.exe"; \
 #endif
 ; Register (or re-point, on upgrade - idempotent) the SYSTEM service from its FINAL {app} location:
 ; service install records current_exe() as the SCM binPath, so it must run from {app}, not {tmp}.
-Filename: "{app}\punktfunk-host.exe"; Parameters: "service install"; WorkingDir: "{app}"; \
+; --gamestream=on|off carries the wizard's GameStream task choice into host.env's PUNKTFUNK_HOST_CMD.
+Filename: "{app}\punktfunk-host.exe"; Parameters: "service install {code:GamestreamParam}"; WorkingDir: "{app}"; \
  StatusMsg: "Registering the punktfunk host service..."; Flags: runhidden waituntilterminated
 Filename: "{app}\punktfunk-host.exe"; Parameters: "service start"; WorkingDir: "{app}"; \
  StatusMsg: "Starting the punktfunk host service..."; Flags: runhidden waituntilterminated; Tasks: startservice
@@ -198,6 +229,14 @@ Filename: "{app}\punktfunk-host.exe"; Parameters: "web setup {code:WebSetupParam

 [UninstallRun]
 Filename: "{app}\punktfunk-host.exe"; Parameters: "service uninstall"; Flags: runhidden waituntilterminated; RunOnceId: "PunktfunkHostServiceUninstall"
+; Remove the punktfunk drivers we installed (pf-vdisplay devnode + driver package, then the gamepad
+; driver packages). AFTER service uninstall so the host no longer holds the devices. Unconditional
+; (not #ifdef'd on this build's bundled payload - an upgrade may have dropped a payload the original
+; install laid down); `driver uninstall` is best-effort and no-ops when nothing is installed.
+; VB-CABLE is deliberately NOT removed: it is a third-party shared component the user may use
+; elsewhere - see licenses\VB-CABLE-NOTICE.txt for its own uninstall.
+Filename: "{app}\punktfunk-host.exe"; Parameters: "driver uninstall"; Flags: runhidden waituntilterminated; RunOnceId: "PunktfunkVdisplayDriverUninstall"
+Filename: "{app}\punktfunk-host.exe"; Parameters: "driver uninstall --gamepad"; Flags: runhidden waituntilterminated; RunOnceId: "PunktfunkGamepadDriverUninstall"
 #ifdef WithWeb
 ; Stop + remove the PunktfunkWeb task and its firewall rule (leaves %ProgramData%\punktfunk config,
 ; like the host uninstall does).
@@ -207,6 +246,17 @@ Filename: "powershell.exe"; \
 #endif

 [Code]
+{ The GameStream task choice, forwarded to `service install` (which writes host.env's
+  PUNKTFUNK_HOST_CMD - only if it is unset or still one of the two canonical values, so a
+  hand-customized command line survives upgrades). }
+function GamestreamParam(Param: String): String;
+begin
+  if WizardIsTaskSelected('gamestream') then
+    Result := '--gamestream=on'
+  else
+    Result := '--gamestream=off';
+end;
+
 #ifdef WithWeb
 var
  WebPwPage: TInputQueryWizardPage;