docs: distribution route decided — Microsoft Store MSIX + Store IAP

Creator ruling 2026-09-27. Criteria, verbatim: "zero headaches, minimal
maintenance (for me) while still providing accountability and a reasonably
easy upgrade flow." Route A is the only combination where all four are solved
by handing the work to Microsoft rather than to a certificate vendor: $0/yr,
no certificate, no HSM, no annual renewal, no SmartScreen ramp — plus Store
auto-update, Store-side payments/entitlements/refunds/support, and Microsoft
review as the accountability layer.

The rejected options and their reasons stay in research-store-certification.md
§3 so a later session reads the ruling instead of re-deriving it.

What this deletes:
- The entire licensing backend. PolarLicenseService, PolarLicense,
  MainViewModel.License.cs (PremiumUrl, customer portal, the OfflineGracePeriod
  = 14 days subscription-era artifact, renewal/lapse copy) and the wrong
  "Polar unlocks alerts" string all become dead code. IsPremium is derived from
  the Store entitlement instead of an HTTP call, which also removes the whole
  "network flaky -> app thinks I'm expired" bug class.
- Velopack, the update URL, and the self-hosted droplet — the Store updates.
- Distribution.md's premise: Polar as the distribution backbone, Polar file
  hosting, and code signing as our problem. The IP-protection sections (1, 5,
  6, 7) still stand and the build-posture ceiling is unchanged.

What does NOT change: the entitlement. Free gets everything; the branding
flash stays the only paid delta. Store IAP changes how IsPremium is obtained,
never what it gates.

Still open, deliberately: the price. The Store revenue share is unverified (do
not assume a percentage), and MONETIZATION.md's $29 -> $49 one-time decision is
re-opened against a fresh instinct toward ~$99/yr. No price encoded yet.

The first code unit is unchanged: bundle ffmpeg (TASK 48 item 1). That clears
the one hard certification gate and fixes a real user-facing 404.

MARCOM.md and MONETIZATION.md were edited too but are gitignored by design, so
those changes stayed local.

Distribution.md

@@ -1,12 +1,42 @@
 # Distribution & IP Protection Plan
 
-> 360-degree protection strategy for LlamaCasty (.NET 8 / WPF), built around Polar.sh.
+> 360-degree protection strategy for LlamaCasty (.NET 8 / WPF).
+
+> ## ⛔ SUPERSEDED IN PART — 2026-09-27
+>
+> **Distribution is now the Microsoft Store: MSIX package + Store IAP.** The creator's criteria
+> were *"zero headaches, minimal maintenance (for me) while still providing accountability and
+> a reasonably easy upgrade flow"*, and that ruling deleted this document's central premise.
+>
+> **What still stands below:** §1 (code architecture / IP protection), §5 (obfuscation posture),
+> §6 (legal), §7 (hardening) — those are about protecting the *binary*, and an MSIX package is
+> still a binary. **§1.2's build-posture ceiling (HARDENED + MOCK_REWARDS, additive-only)
+> remains the agreed ceiling.**
+>
+> **What is dead:**
+> - **Polar as the distribution backbone** — the entire section below. Store IAP handles
+>   checkout, entitlements, refunds, tax, and the customer portal. So does **file hosting**:
+>   the Store is the delivery mechanism, so "upload `LlamaCasty.exe` to Polar as a File
+>   Download benefit" (§2) no longer exists as a step.
+> - **Code signing as our problem** — MSIX is signed by **Microsoft**. There is no certificate
+>   to buy, no HSM, no annual renewal. See §4.3, which was already corrected to say this, and
+>   `TASKS/research-store-certification.md` §2–3.
+> - **Velopack / the update URL / the DO droplet** — Store auto-update.
+>
+> **The authoritative plan is now [`TASKS/task-48-distribution-msix.md`](TASKS/task-48-distribution-msix.md).**
+> Keep this file for the protection sections; do not re-derive a delivery strategy from it.
 
 ---
 
-## Polar.sh as the Distribution Backbone
+## Polar.sh as the Distribution Backbone — ⛔ OBSOLETE (2026-09-27)
 
-Polar handles everything between "customer wants to pay" and "customer has a working license key." We don't build any of that. What Polar gives us:
+> **Historical record only.** Retained because the fee tables and the reasoning about *why*
+> one-time beat subscription were worth working out. **None of the "How We Use It" rows are
+> current**, with one exception worth keeping: the Merchant-of-Record point — *someone else
+> collects and remits VAT/GST* — is still true under Store IAP, because **Microsoft** is now
+> that someone. That fact alone was the strongest argument for the ruling.
+
+Polar handled everything between "customer wants to pay" and "customer has a working license key." We didn't build any of that. What Polar *was* going to give us:
 
 | Capability | How We Use It |
 |------------|---------------|
@@ -18,9 +48,11 @@ Polar handles everything between "customer wants to pay" and "customer has a wor
 | **Merchant of Record** | Polar collects and remits VAT/GST/sales tax globally. We never touch tax compliance. |
 | **Webhooks** | Polar notifies our backend on purchase, cancellation, key rotation. Used for optional telemetry (section 6.3). |
 
-**Polar pricing (2026):** 5% + $0.50 per transaction (Starter plan). No monthly fee.
+**Polar pricing (2026):** 5% + $0.50 per transaction (Starter plan). No monthly fee. ⛔ *No
+longer paid to anyone — the equivalent cost is now inside the Store revenue share, whose rate
+is unverified (see `TASKS/research-store-certification.md` §11).*
 
-**What Polar does NOT handle:** Obfuscation, code signing, anti-tamper, runtime protection, EULA, DMCA. That's all us — sections 1-3, 5-7 below.
+**What Polar did NOT handle:** Obfuscation, code signing, anti-tamper, runtime protection, EULA, DMCA. That's all us — sections 1-3, 5-7 below.
 
 ---