Fedora Workstation firewall zone defaults: which inbound ports should stay open across releases?

Fedora Workstation ships with firewalld enabled and a default zone (historically named FedoraWorkstation) that blocks unsolicited inbound traffic, yet has also allowed certain discovery-related ports such as mDNS and Samba client ranges. That choice sits between a fully closed inbound firewall and usability features like network discovery and media sharing, and the exact allowed set has shifted between releases and editions.

The unresolved decision is where that boundary should land. A workstation that starts a local service should not silently become reachable from the LAN, but a completely locked-down zone breaks discovery workflows users expect. Fedora change proposals have debated this without a settled final default, and Server adds its own deliberate exception by opening the Cockpit web console (TCP 9090) on fresh installs.

Assume a recent Fedora release; exact zone names and port lists are version-sensitive and need verification with firewall-cmd --get-default-zone and firewall-cmd --list-all on the target system.

Should the Workstation zone move to a fully closed inbound default, with discovery ports opened only on explicit user opt-in? How should upgrades handle machines whose existing zone configuration predates a changed default? And should the Cockpit exception on Server be documented more prominently in the default posture?