docs(commercial): the claim page was never needed, signing waits for revenue, and support is a filter

Four things derived this session superseded what the plan said twenty-four hours earlier,
and the docs are corrected where each one died:

**Licensing needs no server.** Polar's customer-portal endpoints authenticate on the key
itself plus the public organization_id; the org access token is only needed to create
products. Channel binding rides in `conditions: {channel_id}`, re-checked on every
validate — so the "claim page" (a hosted OAuth flow that wrote the UC id onto the key)
and the key database it implied are deleted. Device management, key rotation and
subscription auto-revocation are Polar's; four states, one lease, no callback endpoint.

**Signing is deferred until two subscribers.** It never removes the day-one SmartScreen
warning (EV's instant-bypass died in 2024), so buying it before revenue buys only the
publisher line. Renamed to Azure Artifact Signing, $9.99/mo Basic, and it requires a
paid Azure subscription. Year-one fixed cost drops from ~$135 to ~$15.

**The Store account is free.** Microsoft waived the $19 individual fee and removed the
$99 company fee in May 2026, which makes the Store the only zero-cost route to a
Microsoft-signed install — the free answer to SmartScreen, noted beside the paid one.

**Support is a filter, not a promise.** Email, best effort, no SLA, refunds on request
without argument; no training service, no helpdesk. A repeated question becomes a
training video on @llamacasty, which is content and monetization instead of a ticket.
GitHub issues on the releases repo are the deliberate friction.

Also settled: binaries live in a second Gitea repo (`llamacasty-releases`) push-mirrored
to a public GitHub repo — issues and assets public, code private, one publish direction
(a git mirror carries refs, not GitHub Release assets); `@llamacasty` is
standard-verified with intermediate features, so live streaming, >15 min uploads and
custom thumbnails work today and no SIM or ID is needed; and OAuth comes out of Testing
mode by publishing the app (100-user lifetime cap, no 7-day token death).

TASKS.md now opens with the four-day surge slice — artifact shape, output gate,
entitlement seam, real-machine day — because those are what the first public release
waits on. HANDOFF.md rewritten. MyMistakes.md gains the Polar recipe and the
"verify means three different things" entry. MARCOM.md gains the support→content loop
and the surface roles.

MyMistakes.md

@@ -111,6 +111,61 @@ survives YunoHost regenerating the `.conf`; never edit the `.conf` itself.
 %{redirect_url}' https://www.llamacasty.com/privacy.html` → `301 https://llamacasty.com/privacy.html`;
 the cert must read `CN=www.llamacasty.com`, issuer Let's Encrypt.
 
+### LICENSING WITHOUT A SERVER — POLAR'S CUSTOMER-PORTAL API (RECIPE, 2026-10-31)
+
+**Problem:** the plan carried a "claim page" — a hosted OAuth flow that wrote the buyer's channel ID
+onto the licence key — plus an implied server to hold keys. Both were invented from an assumption
+that binding needs a browser.
+
+**It does not.** Polar's customer-portal endpoints authenticate on the **key itself** plus the
+`organization_id` (a public identifier, safe in the binary). The **org access token is only needed
+to create products** and must never ship.
+
+```bash
+# activate (label is required; conditions are re-checked on every validate)
+POST https://api.polar.sh/v1/customer-portal/license-keys/activate
+{ "key": "LCYT-…", "organization_id": "c05fb364-…", "label": "DESKTOP-NAME",
+  "conditions": { "channel_id": "UC…" } }
+
+# validate on launch + daily, with the SAME conditions object
+POST https://api.polar.sh/v1/customer-portal/license-keys/validate
+{ "key": "LCYT-…", "organization_id": "c05fb364-…", "activation_id": "…",
+  "conditions": { "channel_id": "UC…" } }
+```
+
+- `limit_activations` on the benefit = the device cap (2). Polar's **customer portal** already does
+  deactivation, key rotation and "where is my key", so build no UI for it.
+- A **subscription key is auto-revoked when the subscription ends** — that is what makes lapse a
+  real state; check `status`, not `expires_at`.
+- ⚠️ `conditions` is **agreement, not cryptography**: a patched client can send someone else's ID.
+  Accepted — the free tier is the defence, not the check.
+- ⚠️ There is **no push to a desktop app**: delivery is email or the customer portal. Auto-delivery
+  needs a webhook plus an endpoint *you* host, holding keys. Not worth it for one copy-paste.
+
+### YOUTUBE "VERIFIED" — THREE DIFFERENT THINGS (2026-10-31)
+
+`youtube.com/verify` saying "your account is verified" answers only the first tier. The tiers live
+in Studio → Settings → Channel → **Feature eligibility**:
+
+| Tier | Requires | Gives |
+|---|---|---|
+| Standard | nothing | uploads, playlists, posts (low daily limits) |
+| **Intermediate** | phone verification | >15 min videos, **live streaming on a computer**, custom thumbnails |
+| Advanced | **channel history** or ID/video verification | higher daily limits, clickable description links, chapters, pin comments, monetization application |
+
+- **Live streaming is intermediate, not advanced** — a verified channel can stream; the API's
+  "live streaming not enabled" error means the *user's* channel is unverified, so the app must map
+  it to "verify at youtube.com/verify".
+- **2 channels per phone number per year**, 365-day reset; VoIP/Google Voice numbers are refused.
+  That is the "used too many times" wall, and there is no appeal.
+- Verification is **sticky** — it survives the phone being removed, which is why an old account can
+  read "verified" while no number on it will pass today.
+- Advanced via **ID/video verification** is a privacy trade with a 24 h review; channel history is
+  free and usually sufficient within ~2 months of normal activity. Prefer history.
+- ⚠️ Only the **primary owner** can do ID/video verification, and brand-account managers hit
+  *"Advanced YouTube features aren't available for this account"*. If ID verification is ever
+  wanted on a personal channel, do it **before** converting to a brand account.
+
 ### CONVERTING A MEDIAPIPE .tflite (WITH CUSTOM OPS) TO ONNX — AND PROVING IT (RECIPE, TASK 51)
 
 **Problem:** MediaPipe segmentation models end in the custom op `Convolution2DTransposeBias`;