docs(commercial): the claim page was never needed, signing waits for revenue, and support is a filter

Four things derived this session superseded what the plan said twenty-four hours earlier,
and the docs are corrected where each one died:

**Licensing needs no server.** Polar's customer-portal endpoints authenticate on the key
itself plus the public organization_id; the org access token is only needed to create
products. Channel binding rides in `conditions: {channel_id}`, re-checked on every
validate — so the "claim page" (a hosted OAuth flow that wrote the UC id onto the key)
and the key database it implied are deleted. Device management, key rotation and
subscription auto-revocation are Polar's; four states, one lease, no callback endpoint.

**Signing is deferred until two subscribers.** It never removes the day-one SmartScreen
warning (EV's instant-bypass died in 2024), so buying it before revenue buys only the
publisher line. Renamed to Azure Artifact Signing, $9.99/mo Basic, and it requires a
paid Azure subscription. Year-one fixed cost drops from ~$135 to ~$15.

**The Store account is free.** Microsoft waived the $19 individual fee and removed the
$99 company fee in May 2026, which makes the Store the only zero-cost route to a
Microsoft-signed install — the free answer to SmartScreen, noted beside the paid one.

**Support is a filter, not a promise.** Email, best effort, no SLA, refunds on request
without argument; no training service, no helpdesk. A repeated question becomes a
training video on @llamacasty, which is content and monetization instead of a ticket.
GitHub issues on the releases repo are the deliberate friction.

Also settled: binaries live in a second Gitea repo (`llamacasty-releases`) push-mirrored
to a public GitHub repo — issues and assets public, code private, one publish direction
(a git mirror carries refs, not GitHub Release assets); `@llamacasty` is
standard-verified with intermediate features, so live streaming, >15 min uploads and
custom thumbnails work today and no SIM or ID is needed; and OAuth comes out of Testing
mode by publishing the app (100-user lifetime cap, no 7-day token death).

TASKS.md now opens with the four-day surge slice — artifact shape, output gate,
entitlement seam, real-machine day — because those are what the first public release
waits on. HANDOFF.md rewritten. MyMistakes.md gains the Polar recipe and the
"verify means three different things" entry. MARCOM.md gains the support→content loop
and the surface roles.

docs/ai/commercial.md

@@ -1,8 +1,10 @@
-# Commercial: pricing, entitlement, channels
+# Commercial: pricing, entitlement, channels, support
 
-The single source of truth for what LlamaCasty charges, what a licence entitles, and how it
-ships. Read before any pricing, licensing, distribution, storefront or promo work. Cause of death
-for every retired path: [`decisions.md`](decisions.md).
+The single source of truth for what LlamaCasty charges, what a licence entitles, how it ships and
+what support it does and does not include. Read before any pricing, licensing, distribution,
+storefront, support or promo work. Cause of death for every retired path:
+[`decisions.md`](decisions.md). Release mechanics (build, zip, mirror, winget):
+[`Distribution.md`](../../Distribution.md).
 
 ## Model
 
@@ -44,63 +46,111 @@ The cap is a pixel budget plus a frame rate, not the word "720p":
 ## Entitlement
 
 **Polar is the merchant of record and the only source of truth.** It takes the money, remits
-VAT/GST, handles refunds and chargebacks, and holds the keys. Nothing of ours sits in the middle.
+VAT/GST, handles refunds and chargebacks, and holds the keys. **There is no server of ours in the
+loop** — no claim page, no callback endpoint, no key database.
 
-- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoint are in `CREDENTIALS.md`. No
+- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoints are in `CREDENTIALS.md`. No
   product is created yet.
-- **Bound to the creator's YouTube channel ID** (`UC…` from `channels.list?mine=true`) — the
-  **active** brand account's channel, never the `@handle`. Written once through a **claim page**
-  after purchase (OAuth), not prefilled at checkout: the buyer's browser may be signed into a
-  different Google account, and that is manual reconciliation forever.
-- **Two activations**, any machine, one channel. A second channel is a second key. Two keys for
-  one channel is never sold — it doubles the support surface and invites "give one to a friend".
+- **The client talks to Polar directly.** The customer-portal endpoints authenticate on the **key
+  itself** plus the `organization_id` (a public identifier). The **org access token must never
+  ship in the app** — it is only needed to create products, not to activate them.
+- **Bound to the buyer's YouTube channel ID** (`UC…` from `channels.list?mine=true` — the
+  signed-in channel, never the `@handle`) through Polar's **`conditions`**, not through a browser
+  flow: `activate` is called with `conditions: { "channel_id": "UC…" }`, and every later `validate`
+  passes the same object. Polar compares them server-side, so the binding is enforced without us
+  hosting anything.
+- **Two activations**, any machine, one channel (`limit_activations: 2` on the benefit). A second
+  channel is a second key. Two keys for one channel is never sold — it doubles the support surface
+  and invites "give one to a friend".
 - **Runtime rule:** Pro requires `licence.channelId == connected.channelId`. Equal → Pro.
   Anything else → free tier, working normally, with *"This licence belongs to another channel"*
   and a link to the Polar customer portal. Never an error wall, never a blocked stream.
 - **Lease, not a permanent cache:** validate on launch and daily; **7–14 days offline grace**;
   no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS
   failure.
-- **Four states, and nothing else:** valid → Pro · expired → free with a banner · activation
-  limit reached → "manage devices" portal link · mismatch or offline → free, explained.
+- **Device management is Polar's** — the customer portal already lists and deactivates
+  activations, so we build no UI for it. A subscription key is **auto-revoked when the
+  subscription ends**, which is what makes a lapse a real state on the monthly SKU.
+- **Four states, and nothing else:** valid → Pro · expired/revoked → free with a banner ·
+  activation limit reached → "manage devices" portal link · mismatch or offline → free, explained.
 - **CLI activation** — `--activate LCYT-…` so silent and fleet installs never meet a dialog.
   Interactive entry in Settings is the secondary path.
 - **Notice cadence** — 7 days out, 1 day out, and on the day, inline in the go-live panel with a
   date and a portal link. Recording gets the banner only. Never modal, never blocking a Start,
   never orange (orange is the dev-only label colour).
 
+⛔ **`conditions` is agreement, not cryptography.** A patched client can send someone else's
+channel ID. That is accepted: the free tier is the defence, the licence is a lease, and a
+determined crack buys little. Do not propose a signed token, a hardware fingerprint or a server
+to "fix" it.
+
 ## Channels
 
-**One artifact, three ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
+**One artifact, several ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
 bundled `ffmpeg\` folder, zipped. No .NET install, no admin, no installer framework. Trimming
 stays off (WPF reflection), so expect ~110–150 MB.
 
-1. **Direct download** — `llamacasty.com` links the zip; the binaries live on **GitHub Releases**,
-   not the droplet (free CDN, durable URLs, release notes).
-2. **winget — the primary channel.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
+1. **Direct download** — `llamacasty.com` links the zip. **Binaries live in a second Gitea repo
+   (`llamacasty-releases`), push-mirrored to a public GitHub repo**, so the source repo stays
+   private and the handout repo contains nothing but a README, an issue template and the release
+   assets. The mirror carries refs, not GitHub Release assets — the zip is uploaded with
+   `gh release create`. Mechanics: [`Distribution.md`](../../Distribution.md).
+2. **winget — the primary install path.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
    portable`, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers
    exactly the published artifact or fails. One `wingetcreate update` PR per release. Optional:
    Scoop and Chocolatey manifests over the same zip.
 3. **Steam — parked at $100.** Lifetime Pro as DLC only (Steam has no subscriptions), page public
-   two weeks before release, 30% cut, and price parity with the site.
-4. **Microsoft Store — parked.** $19 Individual account; the only storefront that bills a
-   subscription natively and installs without a warning. Bans self-updaters, so a Store build
+   two weeks before release, 30% cut, and price parity with the site. It is the only channel with
+   discovery *and* an install that never meets SmartScreen, and it updates itself — which is why it
+   stays in the plan despite the cut.
+4. **Microsoft Store — parked, and now free.** Microsoft waived the **$19** individual developer
+   fee (and removed the **$99** company fee in May 2026). It is the only storefront that bills a
+   subscription natively *and* the only zero-cost route to a Microsoft-signed install with no
+   SmartScreen warning, because Microsoft signs the MSIX. Bans self-updaters, so a Store build
    ships without one.
 
 **Not channels, ever:** Patreon or any subscription platform of our own, paywalled early access,
-a paid beta, a Discord. Support is a public GitHub issue tracker. Content is the funnel; the
-channel is only the checkout.
+a paid beta, a Discord. Content is the funnel; the channel is only the checkout.
 
 **Portable mode:** a `portable.txt` marker beside the exe keeps the layout DB and settings in
 `.\data\` instead of `%APPDATA%\ytLlive` — the USB-stick case, hung off `LayoutPathOverride`.
+It is the reason the zip survives even if Steam becomes the primary channel.
 
-## Signing
+## Signing — deferred until there is revenue
 
-- **Azure Trusted Signing, ~$9.99/month**, is the intended certificate: Microsoft-issued, accrues
-  SmartScreen reputation, enrols individuals after identity verification.
-- **No EV certificate** — Microsoft removed the SmartScreen instant-bypass in March 2024.
-- Until it is in place, builds ship unsigned and the "unknown publisher" line is accepted. winget
-  spares the browser prompt, not the publisher warning.
-- Every release: same signing pass, SHA-256 in the manifest, licence ID visible in About.
+- **Not bought at launch.** Artifact Signing is listed in the costs as **deferred**: it is paid for
+  out of Pro revenue, and the trigger is **two subscribers**.
+- **What it actually buys:** a named publisher line, fewer antivirus false positives on a ~150 MB
+  self-extracting exe, and tamper evidence for hand-downloaded zips. It does **not** remove the
+  SmartScreen warning on day one — Microsoft deleted the EV instant-bypass in March 2024, so a new
+  certificate has zero reputation and clears only with download volume.
+- **Azure Artifact Signing** (renamed from "Trusted Signing"), **$9.99/month Basic**, up to 5,000
+  signatures, **requires a paid Azure subscription**. Individual identity validation exists and
+  must be renewed before it expires; it is the slow (days-to-weeks) part, so start it *when the
+  purchase is decided*, not before.
+- **Reputation accrues to the publisher, not the file.** Unsigned means the warning on **every**
+  release, forever, because SmartScreen ties reputation to each file hash. Signing is the only exit
+  from that per-release tax.
+- **The free alternative is the Store** (see Channels 4): a free developer account gets
+  Microsoft-signed installs with no certificate of ours.
+- **No EV certificate, ever** — $400+/yr for what OV buys, and the bypass is gone.
+- Every signed release: same pass, SHA-256 in the winget manifest, licence ID visible in About.
+
+## Support
+
+**Email. Best effort. No SLA. Refunds granted on request, without argument.**
+
+- **There is no training service.** "I want people to succeed" is not "I will train them". The app
+  teaches itself — one-click go-live, five scenes, nothing to configure. A how-to question means
+  the app or its docs fell short; the answer is a fix or a video, not a conversation.
+- **No helpdesk.** No ticketing system, no live chat, no onboarding calls, no hand-holding.
+- **A repeated question is a video, not a ticket** — see `MARCOM.md` → support → content loop. The
+  training channel is the support surface.
+- **The issue tracker is a filter, deliberately.** Bugs go to the public releases repo on GitHub,
+  which requires an account; Steam Discussions stay pinned and unread; Announcements carry known
+  issues and release notes. Steam refunds are Valve's own (2 h / 14 days) and cost us nothing.
+- **Nobody is locked out over a licence.** A billing hiccup drops the app to the free profile with
+  a banner and a portal link — never a blocked stream, never a modal.
 
 ## Founding 200 promo
 
@@ -122,16 +172,16 @@ Cash cost **$0**; it is priced in support time and forgone list revenue.
 
 | Item | Cost |
 |---|---|
-| Azure Trusted Signing | $9.99/month (~$120/yr) |
 | Domain | ~$15/yr |
 | Droplet | $0 — serves the existing site |
-| GitHub Releases, winget, Scoop, Chocolatey | $0 |
+| GitHub public repo (releases + issues), Gitea, winget, Scoop, Chocolatey | $0 |
 | Polar | 5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50 |
+| Azure Artifact Signing — **deferred** | $9.99/month (~$120/yr), bought at two subscribers |
 | Steam Direct (optional) | $100 once, recoupable after $1,000 AGR |
-| Microsoft Store (optional) | $19 once |
+| Microsoft Store (optional) | **$0** — the individual fee was waived |
 
-Fixed year one ≈ **$135**, and the same every year after. **Break-even is two subscribers**
-(15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.
+Fixed year one ≈ **$15** while unsigned, ≈ **$135** once signing starts. **Break-even is two
+subscribers** (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.
 
 ## Anti-piracy posture
 
@@ -140,8 +190,8 @@ pointless and a leak that is traceable — not an unbreakable binary.
 
 - **The free tier is the real defence.** If the only delta is pixels above 921,600, a cracked
   build buys almost nothing and forfeits updates, support and the publisher's signature.
-- **Hash-pinned delivery + signed builds** — a patched build cannot arrive through winget, and a
-  forged one is not signed as us.
+- **Hash-pinned delivery, signed once revenue exists** — a patched build cannot arrive through
+  winget, and a forged one is not signed as us. Until signing starts, the SHA-256 pin is the wall.
 - **Short leases** — a revoked or refunded key dies inside the grace window.
 - **Licence ID in About** — a leaked build traces back to a purchase.