docs(commercial): the claim page was never needed, signing waits for revenue, and support is a filter

Four things derived this session superseded what the plan said twenty-four hours earlier,
and the docs are corrected where each one died:

**Licensing needs no server.** Polar's customer-portal endpoints authenticate on the key
itself plus the public organization_id; the org access token is only needed to create
products. Channel binding rides in `conditions: {channel_id}`, re-checked on every
validate — so the "claim page" (a hosted OAuth flow that wrote the UC id onto the key)
and the key database it implied are deleted. Device management, key rotation and
subscription auto-revocation are Polar's; four states, one lease, no callback endpoint.

**Signing is deferred until two subscribers.** It never removes the day-one SmartScreen
warning (EV's instant-bypass died in 2024), so buying it before revenue buys only the
publisher line. Renamed to Azure Artifact Signing, $9.99/mo Basic, and it requires a
paid Azure subscription. Year-one fixed cost drops from ~$135 to ~$15.

**The Store account is free.** Microsoft waived the $19 individual fee and removed the
$99 company fee in May 2026, which makes the Store the only zero-cost route to a
Microsoft-signed install — the free answer to SmartScreen, noted beside the paid one.

**Support is a filter, not a promise.** Email, best effort, no SLA, refunds on request
without argument; no training service, no helpdesk. A repeated question becomes a
training video on @llamacasty, which is content and monetization instead of a ticket.
GitHub issues on the releases repo are the deliberate friction.

Also settled: binaries live in a second Gitea repo (`llamacasty-releases`) push-mirrored
to a public GitHub repo — issues and assets public, code private, one publish direction
(a git mirror carries refs, not GitHub Release assets); `@llamacasty` is
standard-verified with intermediate features, so live streaming, >15 min uploads and
custom thumbnails work today and no SIM or ID is needed; and OAuth comes out of Testing
mode by publishing the app (100-user lifetime cap, no 7-day token death).

TASKS.md now opens with the four-day surge slice — artifact shape, output gate,
entitlement seam, real-machine day — because those are what the first public release
waits on. HANDOFF.md rewritten. MyMistakes.md gains the Polar recipe and the
"verify means three different things" entry. MARCOM.md gains the support→content loop
and the surface roles.

docs/ai/decisions.md

@@ -2,8 +2,36 @@
 
 One dated line per decision that **no longer governs**, plus the reason it died. Read only when
 you are about to re-open one of them. **Live commercial rules (prices, entitlement, channels,
-signing, promo) are in [`commercial.md`](commercial.md)**; the other live rules live in the
-subsystem files. This is the graveyard with cause of death.
+signing, support, promo) are in [`commercial.md`](commercial.md)**; the other live rules live in
+the subsystem files. This is the graveyard with cause of death.
+
+## Commercial mechanics — died 2026-10-31 (same week they were written)
+
+- **The licence "claim page" is dead.** The binding was going to be an OAuth web page that wrote
+  the buyer's `UC…` channel ID onto the key, because we assumed binding needed a browser. Polar's
+  **`conditions`** object does it natively: the client calls `activate` with
+  `conditions: { channel_id }` and repeats it on every `validate`. **No claim page, no hosted
+  endpoint, no key database, no OAuth redirect URI.**
+- **"Signing is a year-one cost" is dead.** Artifact Signing is **deferred until two subscribers**
+  — it never removes the day-one SmartScreen warning, so buying it before revenue buys nothing but
+  the publisher line. It is also now called **Azure Artifact Signing** and **requires a paid Azure
+  subscription**.
+- **"The Store developer account costs $19" is dead.** Microsoft waived the individual fee (and
+  removed the $99 company fee in May 2026), which makes the Store the **only zero-cost route to a
+  Microsoft-signed install** — the free answer to SmartScreen.
+- **"Binaries on GitHub Releases" was half a plan.** There was no GitHub presence at all (the only
+  remote is Gitea). The route is a separate **`llamacasty-releases`** Gitea repo push-mirrored to a
+  public GitHub repo: issues and assets public, code private, one publish direction.
+
+## Support — decided 2026-10-31
+
+- **No training service, no helpdesk, no SLA.** Email, best effort, refunds on request without
+  argument. A repeated question becomes a training video on `@llamacasty`, which is content and
+  monetization rather than a ticket. See `commercial.md` → Support and `MARCOM.md` → support →
+  content loop.
+- **Rejected as support surfaces:** a paid Discord, live chat, onboarding calls, a ticketing system.
+  GitHub issues on the releases repo is the deliberate filter — an account is enough friction to
+  keep the list short.
 
 ## Monetization