# Commercial: pricing, entitlement, channels

The single source of truth for what LlamaCasty charges, what a licence entitles, and how it
ships. Read before any pricing, licensing, distribution, storefront or promo work. Cause of death
for every retired path: [`decisions.md`](decisions.md).

## Model

- **Free tier — every feature, every scene, every overlay**, free forever, no account, no
  watermark, nothing nagged inside the output. It is not a trial.
- **Pro — $10/month or $400 lifetime.** No annual tier.
- **The only delta is output quality.** Features are never gated; a payment buys pixels.
- **No watermark, ever**, in either edition. The branding flash is retired as a paid delta and
  stays off (`ShowBrandFlash`, default `false`).
- **Clean numbers, no `.99`**, no discount codes, no countdowns, no fake scarcity.
- **The site publishes the model, never the numbers** — "free forever, every feature unlocked, a
  paid edition with higher output quality at launch". Price, tier name, cap and frame rate are
  published by the **app**, at the point of sale, not by the page.

## Output profile — the one entitlement rule

The cap is a pixel budget plus a frame rate, not the word "720p":

| | Free | Pro |
|---|---|---|
| Pixels | ≤ **921,600** | any shipped tier |
| Frame rate | ≤ **30 fps** | any shipped tier |
| Landscape | 1280×720 @30 | 1280×720 @60 · 1920×1080 @30 · @60 |
| Vertical 9:16 | 720×1280 @30 | 1080×1920 @60 |

- **Records too.** The cap governs the file the creator keeps as well as the stream; otherwise
  free 1080p recording is a re-upload hole. One `OutputProfile`, resolved once per session and
  consumed by **both** the stream encoder and the recorder — never two checks.
- **Fail closed.** Unresolved, unreadable or unvalidated entitlement = free tier. Never Pro.
- **Never downgrade a running stream.** The gate applies to the next start; pulling quality out
  of a live broadcast is a worse bug than one free 1080p session.
- **The greyed menu entry is the sales surface.** It stays clickable, says what it costs, opens
  checkout, and is labelled ("720p30 · free tier") — never silently missing, because silence
  reads as broken.
- **Activation is live**, not restart-gated: activating enables the high tiers and a lapse
  (cancel, revoke, sign-out, channel switch) greys them again on the next refresh.
- **Bitrate follows the profile** — a capped user is not offered a 1080p bitrate.

## Entitlement

**Polar is the merchant of record and the only source of truth.** It takes the money, remits
VAT/GST, handles refunds and chargebacks, and holds the keys. Nothing of ours sits in the middle.

- **Key** — `LCYT-` prefix; org `c05fb364-…` and the endpoint are in `CREDENTIALS.md`. No
  product is created yet.
- **Bound to the creator's YouTube channel ID** (`UC…` from `channels.list?mine=true`) — the
  **active** brand account's channel, never the `@handle`. Written once through a **claim page**
  after purchase (OAuth), not prefilled at checkout: the buyer's browser may be signed into a
  different Google account, and that is manual reconciliation forever.
- **Two activations**, any machine, one channel. A second channel is a second key. Two keys for
  one channel is never sold — it doubles the support surface and invites "give one to a friend".
- **Runtime rule:** Pro requires `licence.channelId == connected.channelId`. Equal → Pro.
  Anything else → free tier, working normally, with *"This licence belongs to another channel"*
  and a link to the Polar customer portal. Never an error wall, never a blocked stream.
- **Lease, not a permanent cache:** validate on launch and daily; **7–14 days offline grace**;
  no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS
  failure.
- **Four states, and nothing else:** valid → Pro · expired → free with a banner · activation
  limit reached → "manage devices" portal link · mismatch or offline → free, explained.
- **CLI activation** — `--activate LCYT-…` so silent and fleet installs never meet a dialog.
  Interactive entry in Settings is the secondary path.
- **Notice cadence** — 7 days out, 1 day out, and on the day, inline in the go-live panel with a
  date and a portal link. Recording gets the banner only. Never modal, never blocking a Start,
  never orange (orange is the dev-only label colour).

## Channels

**One artifact, three ways to get it.** A self-contained single-file `LlamaCasty.exe` plus the
bundled `ffmpeg\` folder, zipped. No .NET install, no admin, no installer framework. Trimming
stays off (WPF reflection), so expect ~110–150 MB.

1. **Direct download** — `llamacasty.com` links the zip; the binaries live on **GitHub Releases**,
   not the droplet (free CDN, durable URLs, release notes).
2. **winget — the primary channel.** Manifest in `microsoft/winget-pkgs`, `InstallerType:
   portable`, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers
   exactly the published artifact or fails. One `wingetcreate update` PR per release. Optional:
   Scoop and Chocolatey manifests over the same zip.
3. **Steam — parked at $100.** Lifetime Pro as DLC only (Steam has no subscriptions), page public
   two weeks before release, 30% cut, and price parity with the site.
4. **Microsoft Store — parked.** $19 Individual account; the only storefront that bills a
   subscription natively and installs without a warning. Bans self-updaters, so a Store build
   ships without one.

**Not channels, ever:** Patreon or any subscription platform of our own, paywalled early access,
a paid beta, a Discord. Support is a public GitHub issue tracker. Content is the funnel; the
channel is only the checkout.

**Portable mode:** a `portable.txt` marker beside the exe keeps the layout DB and settings in
`.\data\` instead of `%APPDATA%\ytLlive` — the USB-stick case, hung off `LayoutPathOverride`.

## Signing

- **Azure Trusted Signing, ~$9.99/month**, is the intended certificate: Microsoft-issued, accrues
  SmartScreen reputation, enrols individuals after identity verification.
- **No EV certificate** — Microsoft removed the SmartScreen instant-bypass in March 2024.
- Until it is in place, builds ship unsigned and the "unknown publisher" line is accepted. winget
  spares the browser prompt, not the publisher warning.
- Every release: same signing pass, SHA-256 in the manifest, licence ID visible in About.

## Founding 200 promo

Cash cost **$0**; it is priced in support time and forgone list revenue.

- **90 days free** — a 100%-off Polar coupon, `duration = repeating, months = 3`.
- **Founder price lock** — their $10/month stays $10 permanently.
- **Credits + in-app Founder badge** (opt-in channel name on the site).
- **30-day passes** — unique keys carrying the issuer's channel, issued **one per 30 active days,
  max 3 held**, activation limit 1–2, expiring 30 days **after activation**. Earned, never handed
  out: a pass nobody uses teaches nothing.
- Optional **$250 lifetime** window in the first 90 days — converting a founder beats three
  months of free.
- Reminders at day 75 and 85; the renewal cliff is where founders churn.
- Terms, one paragraph: one per person, passes expire 30 days after activation, no cash value,
  revoked for resale or abuse, price lock void if the subscription lapses.

## Costs

| Item | Cost |
|---|---|
| Azure Trusted Signing | $9.99/month (~$120/yr) |
| Domain | ~$15/yr |
| Droplet | $0 — serves the existing site |
| GitHub Releases, winget, Scoop, Chocolatey | $0 |
| Polar | 5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50 |
| Steam Direct (optional) | $100 once, recoupable after $1,000 AGR |
| Microsoft Store (optional) | $19 once |

Fixed year one ≈ **$135**, and the same every year after. **Break-even is two subscribers**
(15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.

## Anti-piracy posture

**Any check that runs on the user's machine can be removed.** The goal is a crack that is
pointless and a leak that is traceable — not an unbreakable binary.

- **The free tier is the real defence.** If the only delta is pixels above 921,600, a cracked
  build buys almost nothing and forfeits updates, support and the publisher's signature.
- **Hash-pinned delivery + signed builds** — a patched build cannot arrive through winget, and a
  forged one is not signed as us.
- **Short leases** — a revoked or refunded key dies inside the grace window.
- **Licence ID in About** — a leaked build traces back to a purchase.

⛔ **Rejected, do not re-propose:** a native helper DLL for "IP protection", obfuscation, hardware
locking, remote code that downloads and executes, and gating asset downloads as an auth check.
None of them make a licence enforceable; the first three add failure modes without buying
anything, the fourth needs the server this plan exists to avoid, and the fifth is Store policy
10.2.2.