docs: purge the dead $29/$49 + Polar model from every tracked file, add the Y1 forecast

The pricing ruling landed twice (2026-09-21 one-time, then 2026-09-27 Store IAP
$10/mo + $400 lifetime) and the map never caught up. Six tracked files still told
a future session that billing was Polar and the price was $29/$49. A stale memory
map is worse than a stale comment: it is the file every session trusts, and this
one was actively steering work toward a deleted provider.

MONETIZATION.md (gitignored, so not in this commit) was rebuilt first:
- "Revenue projections" now carries a modelled Year 1 forecast —
  pessimistic $4.0K / base $15.4K / optimistic $53.3K net, ~$22K weighted.
  Funnel is installs -> 35-45% activate -> 1.5-3% of active users pay.
- Three findings recorded: Year 1 is ~97% lifetime transactions (subs net $392
  of $15.4K, so MRR is not a Year-1 planning input); conversion dominates price
  (~1pp of conversion = ~$7K net, and ADA 6(h) locks $10 anyway); subscriber
  churn moves Year 1 by under $200 and is a Year-2 problem.
- Break-even restated for $400: $25K net = 74 lifetime buyers, not 862.
  The price cut the volume requirement ~10x and raised the skill requirement
  to match.
- Market sizing willingness-to-pay row rewritten. The 100K-400K TAM was
  price-bound to $29-49 and is wrong at $400; revised ~20K-60K, flagged as an
  estimate rather than a sourced number.
- Flagged a real contradiction: $500K ARR needs ~4,900 concurrent subscribers,
  so the Exit section's ARR multiples do not describe what Years 1-3 produce.
  The defensible asset there is lifetime cash flow, not ARR.

Tracked files corrected to match:
- ai.md: paid-delta, pricing and billing bullets rewritten; Polar product id,
  org id, LCYT- key prefix and LLAMAFOUNDER/LLAMA50 marked as deleted;
  15% share + net-after-tax recorded with the ADA 6(b)(i) citation.
- TASKS.md: catalog row retitled as a teardown; the "still to verify — the
  price is not decided" note closed (it contradicted the ruling 20 lines
  below it); the OverlayHost "Polar unlocks alerts" open question marked
  resolved; Polar file-hosting deliverable removed from the release build.
- task-10: reframed as a teardown. Steps 4-5 marked as surviving, 1-2-3-6-7 as
  deleting, 8 as a compliance action (Velopack downloads AND executes, which
  Store policy 10.2.2 does not permit).
- task-36 item 5 (license-expiry reminders) struck — no key, no expiry, no
  lapse under Store IAP, so there is nothing to remind anyone about.
- Distribution.md 4.2 / 4.4 / 4.5 marked obsolete; 4.5's "already implemented"
  corrected, since PolarLicenseService is being deleted rather than shipped.
- README: "one-time license" -> "paid tier".

Historical Polar sections are retained deliberately — the reasoning is reusable
(merchant-of-record, fee comparison), only the conclusions are dead. Each is now
labelled so it cannot be mistaken for the plan.

No code touched.

Distribution.md

@@ -318,9 +318,17 @@ Single-file means everything is inside the `.exe`. No DLLs, no runtime dependenc
 
 **Caveat:** Self-contained single-file means ~80-120MB due to bundled .NET runtime. For smaller size, use framework-dependent publishing (requires .NET 8 runtime on user machines) — drops to ~5-10MB.
 
-### 4.2 Distribution via Polar
+### 4.2 Distribution via Polar — ⛔ OBSOLETE (2026-09-27)
 
-**Product setup on Polar:**
+> **Superseded by Microsoft Store MSIX + Store IAP** (ruling in
+> `TASKS/task-48-distribution-msix.md` item 0). The Store re-signs, hosts, updates, and takes
+> payment — so file hosting, license keys, checkout, the customer portal, device deactivation and
+> key rotation are **all** handled by Microsoft and none of it needs building. Retained below as a
+> record of the model that was designed and abandoned. ⚠️ **The `$29`/`$49` one-time prices in this
+> section are dead** — the settled pricing is **`$10/mo` or `$400` lifetime**, net of a verified
+> 15% Store share.
+
+**Product setup on Polar (as designed, never shipped):**
 
 1. Create a product: "LlamaCasty" — **one-time purchase** (perpetual license; $29 founder / $49 list).
 2. Add two benefits:
@@ -345,6 +353,11 @@ Single-file means everything is inside the `.exe`. No DLLs, no runtime dependenc
 - If a key is compromised, customer or merchant can rotate it via Polar.
 - Previous key stops validating immediately. Status, usage, limits, expiry preserved.
 
+**What the Store does instead:** the customer installs from the Store listing, pays through Store
+checkout, and the app reads the entitlement the OS already holds. There is no key to enter, no
+activation call, no portal to visit, and no offline-grace period to maintain — which also retires
+the whole "network flaky → app thinks I'm expired" bug class in §4.5.
+
 ### 4.3 Code Signing
 
 > ⚠️ **The cert choice below is a live decision, and the old plan's EV recommendation is
@@ -393,7 +406,13 @@ Set-AuthenticodeSignature -FilePath "LlamaCasty.exe" `
 
 **Storage:** Certificate `.pfx` file stored in GitHub Secrets (or Azure DevOps secure files). Never committed to the repo.
 
-### 4.4 Update Mechanism
+### 4.4 Update Mechanism — ⛔ OBSOLETE (2026-09-27)
+
+> **Superseded by Store updates.** Microsoft delivers and updates the app from the listing, so
+> there is nothing to check and no manifest to host. The Velopack updater currently in
+> `App.xaml.cs` **downloads *and executes***, which Store policy **10.2.2** does not permit — its
+> removal is a **compliance action**, not optional cleanup (TASK 48 item 3). The Polar-native design
+> below is retained as a record of the approach that was rejected; it is not an option.
 
 **Polar-native approach (no custom infrastructure):**
 
@@ -428,10 +447,18 @@ public class UpdateCheckService
 - Download link points to Polar's customer portal (not direct download).
 - This adds one external dependency (GitHub) but keeps Polar as the source of truth.
 
-### 4.5 Licensing Logic (already implemented)
+### 4.5 Licensing Logic — ⛔ BEING DELETED (2026-09-27)
+
+> ⚠️ **"Already implemented" was true as of 2026-09-21 and is no longer.** `PolarLicenseService`
+> and `Helpers/PolarLicense.cs` are being **removed** as part of the TASK 10 teardown (TASK 48 item 0).
+> Store IAP replaces the whole validation hop: `IsPremium` is derived from the **OS-supplied Store
+> entitlement**, so there is no network call, no key, and — importantly — **no 14-day offline-grace
+> machine to protect**, which retires the entire "network flaky → app thinks I'm expired" bug class.
+> What survives is only `IsPremium` → `BrandFlashEnabled = !value`. Retained below as the record of
+> what shipped and why it no longer applies.
 
 ```csharp
-// Services/PolarLicenseService.cs — already ships
+// Services/PolarLicenseService.cs — shipped under Polar; being deleted
 // Calls Polar's customer-portal validation endpoint (no auth required)
 // Survives obfuscation — property names excluded via [Obfuscation(Exclude = true)]
 [Obfuscation(Exclude = true)]
@@ -444,11 +471,11 @@ public class LicenseValidationResult
 }
 ```
 
-**What's already done:**
-- `PolarLicenseService` validates keys against Polar API.
-- `OrganizationId` is hardcoded (safe — it's public knowledge, tied to our Polar account).
-- License state persists in `LayoutStore.Settings` (SQLite) with offline grace period.
-- `PremiumUrl` points to Polar checkout.
+**What shipped under Polar (now being deleted):**
+- `PolarLicenseService` validated keys against the Polar API.
+- `OrganizationId` was hardcoded.
+- License state persisted in `LayoutStore.Settings` (SQLite) with an offline grace period.
+- `PremiumUrl` pointed to Polar checkout.
 
 **What survives obfuscation:** The validation logic in `Services.dll` is obfuscated. An attacker who decompiles the exe sees only the UI calling an interface — the actual Polar API call is in the obfuscated DLL.