docs(commercial): the claim page was never needed, signing waits for revenue, and support is a filter

Four things derived this session superseded what the plan said twenty-four hours earlier,
and the docs are corrected where each one died:

**Licensing needs no server.** Polar's customer-portal endpoints authenticate on the key
itself plus the public organization_id; the org access token is only needed to create
products. Channel binding rides in `conditions: {channel_id}`, re-checked on every
validate — so the "claim page" (a hosted OAuth flow that wrote the UC id onto the key)
and the key database it implied are deleted. Device management, key rotation and
subscription auto-revocation are Polar's; four states, one lease, no callback endpoint.

**Signing is deferred until two subscribers.** It never removes the day-one SmartScreen
warning (EV's instant-bypass died in 2024), so buying it before revenue buys only the
publisher line. Renamed to Azure Artifact Signing, $9.99/mo Basic, and it requires a
paid Azure subscription. Year-one fixed cost drops from ~$135 to ~$15.

**The Store account is free.** Microsoft waived the $19 individual fee and removed the
$99 company fee in May 2026, which makes the Store the only zero-cost route to a
Microsoft-signed install — the free answer to SmartScreen, noted beside the paid one.

**Support is a filter, not a promise.** Email, best effort, no SLA, refunds on request
without argument; no training service, no helpdesk. A repeated question becomes a
training video on @llamacasty, which is content and monetization instead of a ticket.
GitHub issues on the releases repo are the deliberate friction.

Also settled: binaries live in a second Gitea repo (`llamacasty-releases`) push-mirrored
to a public GitHub repo — issues and assets public, code private, one publish direction
(a git mirror carries refs, not GitHub Release assets); `@llamacasty` is
standard-verified with intermediate features, so live streaming, >15 min uploads and
custom thumbnails work today and no SIM or ID is needed; and OAuth comes out of Testing
mode by publishing the app (100-user lifetime cap, no 7-day token death).

TASKS.md now opens with the four-day surge slice — artifact shape, output gate,
entitlement seam, real-machine day — because those are what the first public release
waits on. HANDOFF.md rewritten. MyMistakes.md gains the Polar recipe and the
"verify means three different things" entry. MARCOM.md gains the support→content loop
and the surface roles.

docs/ai/commercial.md

@@ -1,8 +1,10 @@
-# Commercial: pricing, entitlement, channels
+# Commercial: pricing, entitlement, channels, support
 
-The single source of truth for what LlamaCasty charges, what a licence entitles, and how it
-ships. Read before any pricing, licensing, distribution, storefront or promo work. Cause of death
-for every retired path: [`decisions.md`](decisions.md).
+The single source of truth for what LlamaCasty charges, what a licence entitles, how it ships and
+what support it does and does not include. Read before any pricing, licensing, distribution,
+storefront, support or promo work. Cause of death for every retired path:
+[`decisions.md`](decisions.md). Release mechanics (build, zip, mirror, winget):
+[`Distribution.md`](../../Distribution.md).
 
 ## Model
 
@@ -44,63 +46,111 @@ The cap is a pixel budget plus a frame rate, not the word "720p":
 ## Entitlement
 
 **Polar is the merchant of record and the only source of truth.** It takes the money, remits
-VAT/GST, handles refunds and chargebacks, and holds the keys. Nothing of ours sits in the middle.
+VAT/GST, handles refunds and chargebacks, and holds the keys. **There is no server of ours in the
+loop** — no claim page, no callback endpoint, no key database.
 
-- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoint are in `CREDENTIALS.md`. No
+- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoints are in `CREDENTIALS.md`. No
   product is created yet.
-- **Bound to the creator's YouTube channel ID** (`UC…` from `channels.list?mine=true`) — the
-  **active** brand account's channel, never the `@handle`. Written once through a **claim page**
-  after purchase (OAuth), not prefilled at checkout: the buyer's browser may be signed into a
-  different Google account, and that is manual reconciliation forever.
-- **Two activations**, any machine, one channel. A second channel is a second key. Two keys for
-  one channel is never sold — it doubles the support surface and invites "give one to a friend".
+- **The client talks to Polar directly.** The customer-portal endpoints authenticate on the **key
+  itself** plus the `organization_id` (a public identifier). The **org access token must never
+  ship in the app** — it is only needed to create products, not to activate them.
+- **Bound to the buyer's YouTube channel ID** (`UC…` from `channels.list?mine=true` — the
+  signed-in channel, never the `@handle`) through Polar's **`conditions`**, not through a browser
+  flow: `activate` is called with `conditions: { "channel_id": "UC…" }`, and every later `validate`
+  passes the same object. Polar compares them server-side, so the binding is enforced without us
+  hosting anything.
+- **Two activations**, any machine, one channel (`limit_activations: 2` on the benefit). A second
+  channel is a second key. Two keys for one channel is never sold — it doubles the support surface
+  and invites "give one to a friend".
 - **Runtime rule:** Pro requires `licence.channelId == connected.channelId`. Equal → Pro.
   Anything else → free tier, working normally, with *"This licence belongs to another channel"*
   and a link to the Polar customer portal. Never an error wall, never a blocked stream.
 - **Lease, not a permanent cache:** validate on launch and daily; **7–14 days offline grace**;
   no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS
   failure.
-- **Four states, and nothing else:** valid → Pro · expired → free with a banner · activation
-  limit reached → "manage devices" portal link · mismatch or offline → free, explained.
+- **Device management is Polar's** — the customer portal already lists and deactivates
+  activations, so we build no UI for it. A subscription key is **auto-revoked when the
+  subscription ends**, which is what makes a lapse a real state on the monthly SKU.
+- **Four states, and nothing else:** valid → Pro · expired/revoked → free with a banner ·
+  activation limit reached → "manage devices" portal link · mismatch or offline → free, explained.
 - **CLI activation** — `--activate LCYT-…` so silent and fleet installs never meet a dialog.
   Interactive entry in Settings is the secondary path.
 - **Notice cadence** — 7 days out, 1 day out, and on the day, inline in the go-live panel with a
   date and a portal link. Recording gets the banner only. Never modal, never blocking a Start,
   never orange (orange is the dev-only label colour).
 
+⛔ **`conditions` is agreement, not cryptography.** A patched client can send someone else's
+channel ID. That is accepted: the free tier is the defence, the licence is a lease, and a
+determined crack buys little. Do not propose a signed token, a hardware fingerprint or a server
+to "fix" it.
+
 ## Channels
 
-**One artifact, three ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
+**One artifact, several ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
 bundled `ffmpeg\` folder, zipped. No .NET install, no admin, no installer framework. Trimming
 stays off (WPF reflection), so expect ~110–150 MB.
 
-1. **Direct download** — `llamacasty.com` links the zip; the binaries live on **GitHub Releases**,
-   not the droplet (free CDN, durable URLs, release notes).
-2. **winget — the primary channel.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
+1. **Direct download** — `llamacasty.com` links the zip. **Binaries live in a second Gitea repo
+   (`llamacasty-releases`), push-mirrored to a public GitHub repo**, so the source repo stays
+   private and the handout repo contains nothing but a README, an issue template and the release
+   assets. The mirror carries refs, not GitHub Release assets — the zip is uploaded with
+   `gh release create`. Mechanics: [`Distribution.md`](../../Distribution.md).
+2. **winget — the primary install path.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
    portable`, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers
    exactly the published artifact or fails. One `wingetcreate update` PR per release. Optional:
    Scoop and Chocolatey manifests over the same zip.
 3. **Steam — parked at $100.** Lifetime Pro as DLC only (Steam has no subscriptions), page public
-   two weeks before release, 30% cut, and price parity with the site.
-4. **Microsoft Store — parked.** $19 Individual account; the only storefront that bills a
-   subscription natively and installs without a warning. Bans self-updaters, so a Store build
+   two weeks before release, 30% cut, and price parity with the site. It is the only channel with
+   discovery *and* an install that never meets SmartScreen, and it updates itself — which is why it
+   stays in the plan despite the cut.
+4. **Microsoft Store — parked, and now free.** Microsoft waived the **$19** individual developer
+   fee (and removed the **$99** company fee in May 2026). It is the only storefront that bills a
+   subscription natively *and* the only zero-cost route to a Microsoft-signed install with no
+   SmartScreen warning, because Microsoft signs the MSIX. Bans self-updaters, so a Store build
    ships without one.
 
 **Not channels, ever:** Patreon or any subscription platform of our own, paywalled early access,
-a paid beta, a Discord. Support is a public GitHub issue tracker. Content is the funnel; the
-channel is only the checkout.
+a paid beta, a Discord. Content is the funnel; the channel is only the checkout.
 
 **Portable mode:** a `portable.txt` marker beside the exe keeps the layout DB and settings in
 `.\data\` instead of `%APPDATA%\ytLlive` — the USB-stick case, hung off `LayoutPathOverride`.
+It is the reason the zip survives even if Steam becomes the primary channel.
 
-## Signing
+## Signing — deferred until there is revenue
 
-- **Azure Trusted Signing, ~$9.99/month**, is the intended certificate: Microsoft-issued, accrues
-  SmartScreen reputation, enrols individuals after identity verification.
-- **No EV certificate** — Microsoft removed the SmartScreen instant-bypass in March 2024.
-- Until it is in place, builds ship unsigned and the "unknown publisher" line is accepted. winget
-  spares the browser prompt, not the publisher warning.
-- Every release: same signing pass, SHA-256 in the manifest, licence ID visible in About.
+- **Not bought at launch.** Artifact Signing is listed in the costs as **deferred**: it is paid for
+  out of Pro revenue, and the trigger is **two subscribers**.
+- **What it actually buys:** a named publisher line, fewer antivirus false positives on a ~150 MB
+  self-extracting exe, and tamper evidence for hand-downloaded zips. It does **not** remove the
+  SmartScreen warning on day one — Microsoft deleted the EV instant-bypass in March 2024, so a new
+  certificate has zero reputation and clears only with download volume.
+- **Azure Artifact Signing** (renamed from "Trusted Signing"), **$9.99/month Basic**, up to 5,000
+  signatures, **requires a paid Azure subscription**. Individual identity validation exists and
+  must be renewed before it expires; it is the slow (days-to-weeks) part, so start it *when the
+  purchase is decided*, not before.
+- **Reputation accrues to the publisher, not the file.** Unsigned means the warning on **every**
+  release, forever, because SmartScreen ties reputation to each file hash. Signing is the only exit
+  from that per-release tax.
+- **The free alternative is the Store** (see Channels 4): a free developer account gets
+  Microsoft-signed installs with no certificate of ours.
+- **No EV certificate, ever** — $400+/yr for what OV buys, and the bypass is gone.
+- Every signed release: same pass, SHA-256 in the winget manifest, licence ID visible in About.
+
+## Support
+
+**Email. Best effort. No SLA. Refunds granted on request, without argument.**
+
+- **There is no training service.** "I want people to succeed" is not "I will train them". The app
+  teaches itself — one-click go-live, five scenes, nothing to configure. A how-to question means
+  the app or its docs fell short; the answer is a fix or a video, not a conversation.
+- **No helpdesk.** No ticketing system, no live chat, no onboarding calls, no hand-holding.
+- **A repeated question is a video, not a ticket** — see `MARCOM.md` → support → content loop. The
+  training channel is the support surface.
+- **The issue tracker is a filter, deliberately.** Bugs go to the public releases repo on GitHub,
+  which requires an account; Steam Discussions stay pinned and unread; Announcements carry known
+  issues and release notes. Steam refunds are Valve's own (2 h / 14 days) and cost us nothing.
+- **Nobody is locked out over a licence.** A billing hiccup drops the app to the free profile with
+  a banner and a portal link — never a blocked stream, never a modal.
 
 ## Founding 200 promo
 
@@ -122,16 +172,16 @@ Cash cost **$0**; it is priced in support time and forgone list revenue.
 
 | Item | Cost |
 |---|---|
-| Azure Trusted Signing | $9.99/month (~$120/yr) |
 | Domain | ~$15/yr |
 | Droplet | $0 — serves the existing site |
-| GitHub Releases, winget, Scoop, Chocolatey | $0 |
+| GitHub public repo (releases + issues), Gitea, winget, Scoop, Chocolatey | $0 |
 | Polar | 5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50 |
+| Azure Artifact Signing — **deferred** | $9.99/month (~$120/yr), bought at two subscribers |
 | Steam Direct (optional) | $100 once, recoupable after $1,000 AGR |
-| Microsoft Store (optional) | $19 once |
+| Microsoft Store (optional) | **$0** — the individual fee was waived |
 
-Fixed year one ≈ **$135**, and the same every year after. **Break-even is two subscribers**
-(15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.
+Fixed year one ≈ **$15** while unsigned, ≈ **$135** once signing starts. **Break-even is two
+subscribers** (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.
 
 ## Anti-piracy posture
 
@@ -140,8 +190,8 @@ pointless and a leak that is traceable — not an unbreakable binary.
 
 - **The free tier is the real defence.** If the only delta is pixels above 921,600, a cracked
   build buys almost nothing and forfeits updates, support and the publisher's signature.
-- **Hash-pinned delivery + signed builds** — a patched build cannot arrive through winget, and a
-  forged one is not signed as us.
+- **Hash-pinned delivery, signed once revenue exists** — a patched build cannot arrive through
+  winget, and a forged one is not signed as us. Until signing starts, the SHA-256 pin is the wall.
 - **Short leases** — a revoked or refunded key dies inside the grace window.
 - **Licence ID in About** — a leaked build traces back to a purchase.
 

docs/ai/decisions.md

@@ -2,8 +2,36 @@
 
 One dated line per decision that **no longer governs**, plus the reason it died. Read only when
 you are about to re-open one of them. **Live commercial rules (prices, entitlement, channels,
-signing, promo) are in [`commercial.md`](commercial.md)**; the other live rules live in the
-subsystem files. This is the graveyard with cause of death.
+signing, support, promo) are in [`commercial.md`](commercial.md)**; the other live rules live in
+the subsystem files. This is the graveyard with cause of death.
+
+## Commercial mechanics — died 2026-10-31 (same week they were written)
+
+- **The licence "claim page" is dead.** The binding was going to be an OAuth web page that wrote
+  the buyer's `UC…` channel ID onto the key, because we assumed binding needed a browser. Polar's
+  **`conditions`** object does it natively: the client calls `activate` with
+  `conditions: { channel_id }` and repeats it on every `validate`. **No claim page, no hosted
+  endpoint, no key database, no OAuth redirect URI.**
+- **"Signing is a year-one cost" is dead.** Artifact Signing is **deferred until two subscribers**
+  — it never removes the day-one SmartScreen warning, so buying it before revenue buys nothing but
+  the publisher line. It is also now called **Azure Artifact Signing** and **requires a paid Azure
+  subscription**.
+- **"The Store developer account costs $19" is dead.** Microsoft waived the individual fee (and
+  removed the $99 company fee in May 2026), which makes the Store the **only zero-cost route to a
+  Microsoft-signed install** — the free answer to SmartScreen.
+- **"Binaries on GitHub Releases" was half a plan.** There was no GitHub presence at all (the only
+  remote is Gitea). The route is a separate **`llamacasty-releases`** Gitea repo push-mirrored to a
+  public GitHub repo: issues and assets public, code private, one publish direction.
+
+## Support — decided 2026-10-31
+
+- **No training service, no helpdesk, no SLA.** Email, best effort, refunds on request without
+  argument. A repeated question becomes a training video on `@llamacasty`, which is content and
+  monetization rather than a ticket. See `commercial.md` → Support and `MARCOM.md` → support →
+  content loop.
+- **Rejected as support surfaces:** a paid Discord, live chat, onboarding calls, a ticketing system.
+  GitHub issues on the releases repo is the deliberate filter — an account is enough friction to
+  keep the list short.
 
 ## Monetization
 

docs/ai/index.md

@@ -14,7 +14,7 @@ Read the file whose row matches the task. There is no required reading order.
 | [`output.md`](output.md) | The bundled `ffmpeg.exe` and the encoder subprocess (args, probe order, seams), local recording (REC/ON-AIR, filenames, private-broadcast close-out), and the WASAPI capture → filter → mix → named-pipe audio chain (TRAX, sync offset, ducking, limiter) | Touching ffmpeg args/bundling, encoder or recording behaviour, REC/ON-AIR, the audio mix and its meters, or loudness/sync problems |
 | [`environment.md`](environment.md) | LAN hosts/IPs/SSH and the Gitea push recipe, the Windows `dotnet.exe` build + run commands, the test suite map, and the hermetic real-`MainWindow` test rule | Before building, running, adding a test, or reaching any box on the LAN |
 | [`product.md`](product.md) | Brand/naming split, AI transparency, the licensing prohibitions, the freemium posture, auth/account assumptions, and packaging behaviour | Branding, naming, packaging, or a legal/third-party obligation |
-| [`commercial.md`](commercial.md) | The live commercial policy: model and prices, the output-profile cap (stream **and** recording), Polar entitlement and channel binding, the channels (winget, Steam, Store), signing, the Founding 200 promo, costs, anti-piracy posture | Any question about money: pricing, licence keys, what free gets, how it ships, what a sale costs |
+| [`commercial.md`](commercial.md) | The live commercial policy: model and prices, the output-profile cap (stream **and** recording), Polar entitlement via `conditions` (no server, no claim page), the channels (releases repo → winget → Steam → Store), signing (deferred), the Founding 200 promo, costs, **support policy**, anti-piracy posture | Any question about money or support: pricing, licence keys, what free gets, how it ships, what a sale costs |
 | [`youtube-api.md`](youtube-api.md) | Go-live ordering + the broadcast-binding fix, the private-only lock, health parsing, end-stream pre-flight, Test mode, and chat-insert shape | Touching go-live, broadcast lifecycle, health polling, streaming close-out, or the chat service |
 | [`overlays.md`](overlays.md) | The social bar, the native alert box (six animations, alert clip, ticker) and the chat box conventions — everything composited over the frame | Adding or changing anything drawn on top of the output |
 | [`decisions.md`](decisions.md) | Retired paths with cause of death: the paid-tier history and pricing, the free-forever era, Store IAP, the Store ordering, rejected monetization and anti-piracy ideas, and the permanent out-of-product list | You are about to re-open a decision that was already settled |

docs/ai/product.md

@@ -192,12 +192,15 @@ YouTube" button; going live is unreachable until an account is connected.
 ## Windows packaging & distribution (winget primary; Steam + Store parked)
 
 Live channel policy, the artifact and signing costs: [`commercial.md`](commercial.md). Build
-mechanics (publish flags, GitHub Releases, the winget manifest): [`Distribution.md`](../../Distribution.md).
-Retired routes and cause of death: [`decisions.md`](decisions.md).
+mechanics (publish flags, the releases repo mirror, the winget manifest):
+[`Distribution.md`](../../Distribution.md). Retired routes and cause of death:
+[`decisions.md`](decisions.md).
 
-**The channels, in order:** direct download from `llamacasty.com` (binaries on GitHub Releases) →
-**winget**, the primary install path → Steam (parked, $100, lifetime Pro as DLC only) → Microsoft
-Store (parked, $19 Individual account — the only storefront that bills a subscription natively).
+**The channels, in order:** direct download from `llamacasty.com` (binaries in a separate
+`llamacasty-releases` repo, push-mirrored to public GitHub) → **winget**, the primary install path →
+Steam (parked, $100, lifetime Pro as DLC only; the only channel with discovery *and* an install
+that never meets SmartScreen) → Microsoft Store (parked, **free** account since the $19 individual
+fee was waived — the only zero-cost route to a Microsoft-signed install).
 
 **Consequences that are architecture, not packaging detail:**
 
@@ -205,8 +208,8 @@ Store (parked, $19 Individual account — the only storefront that bills a subsc
   2026-10-22 (TASK 48 slice 3) because it downloaded *and executed*, which Store policy 10.2.2
   forbids — and the same rule would close the Store for good if it came back. Updates arrive
   through the package manager (`winget upgrade`) plus an in-app "newer version exists" banner read
-  from a version file on GitHub Releases. `ytLive.Tests/StorePackagingTests.cs` must keep asserting
-  that no self-updater returns.
+  from a version file in the releases repo. `ytLive.Tests/StorePackagingTests.cs` must keep
+  asserting that no self-updater returns.
 - **The MSIX package stays buildable** via `scripts/package-msix.sh` (TASK 48 slice 2) — publish
   `Release -r win-x64 --self-contained` into `artifacts/msix-stage`, copy
   `Packaging/Package.appxmanifest` in as `AppxManifest.xml` + `Packaging/Assets/`, then
@@ -249,15 +252,23 @@ trust. No `broadFileSystemAccess` capability is needed, and none should be added
 error.** A comment at `DefaultRecordFolder()` is owed **when the manifest lands** (TASK 48
 item 6) — not before; a comment describing a manifest that doesn't exist is worse than none.
 
-### Signing — Azure Trusted Signing, never EV
+### Signing — deferred until revenue; Azure Artifact Signing, never EV
 
 Microsoft **removed the SmartScreen instant-bypass for EV certificates in March 2024**, so EV
 ($400+/yr) buys what OV (~$150–300/yr) buys; both need an HSM or hardware token and renew inside
-**460 days**. The 2026-10-31 ruling is **Azure Trusted Signing (~$9.99/month)**: Microsoft-issued,
-individuals eligible after identity verification, and it accrues reputation without a certificate
-purchase. Until the profile exists, builds ship unsigned and the "unknown publisher" line is
-accepted. Signing never clears the warning on day one either way — only download volume does.
-Signing steps: [`Distribution.md`](../../Distribution.md).
+**460 days**. The 2026-10-31 ruling was **Azure Trusted Signing (~$9.99/month)**; the later ruling
+the same week is that it is **deferred until two subscribers exist**, because it never removes the
+warning on day one — only download volume does — and the storefront alternative is now free.
+
+- **Renamed**: it is **Azure Artifact Signing** now. Basic is $9.99/month, 5,000 signatures, and it
+  **requires a paid Azure subscription**; individual identity validation exists and must be
+  renewed, and it is the slow (days-to-weeks) part — start it when the purchase is decided.
+- **Unsigned is a per-release tax**: SmartScreen ties reputation to the file hash, so an unsigned
+  product warns on **every** release, forever. Signing is the only exit from that loop.
+- **The free exit is the Microsoft Store** — the individual developer account fee was waived, and
+  Microsoft signs the MSIX, so a Store install never meets the wall.
+- **Never EV, never a certificate with an HSM**, for this product.
+Signing steps: [`Distribution.md`](../../Distribution.md). Costs: [`commercial.md`](commercial.md).
 
 ### Distribution and licensing are independent — the channel never decides billing
 

docs/ai/youtube-api.md

@@ -256,6 +256,22 @@ These are the hard facts behind every decision. Full list in `TASKS.md`.
 
 ## Auth & session (YouTube OAuth)
 
+- **Publishing status, not phone verification, is what kills sessions.** An OAuth project in
+  **Testing** with user type *External* expires every authorization **and its refresh token after
+  7 days** — so every user re-signs in weekly. **Publish app** (→ *In production*) removes that
+  expiry. It does **not** require Google's verification review, but an unverified production app
+  shows the "unverified app" warning and carries a **100-new-user cap for the lifetime of the
+  project, which cannot be reset** — so publish when strangers are expected, not while testing.
+  Verification review only removes the warning and the cap. Source:
+  <https://support.google.com/cloud/answer/15549945>, and `commercial.md` → Entitlement is unrelated.
+- **A channel must be verified before it can stream.** YouTube's feature tiers:
+  *standard* (nothing) → *intermediate* (**phone verification**: >15 min uploads, **live streaming
+  on a computer**, custom thumbnails) → *advanced* (channel history **or** ID/video verification:
+  higher daily limits, clickable description links, chapters, pin comments, monetization
+  application). Live streaming is **intermediate**, not advanced — a user without it gets a
+  live-streaming-disabled error from the API. Map that error in the go-live path to one sentence:
+  *"Verify your channel at youtube.com/verify, then try again — it takes a minute."* A raw Google
+  error here reads as "the app is broken". Source: <https://support.google.com/youtube/answer/9890437>.
 - `Helpers/OAuthCredentials.cs` holds the real ClientId/ClientSecret. Auth is complete and the
   session **persists via Windows DPAPI** (`Helpers/TokenStore.cs` → `%APPDATA%\ytLlive\ytLlive.auth`,
   CurrentUser scope), reloaded best-effort at startup with a proactive refresh of a near-expiry