# HANDOFF — current state

**Branch:** `main` (pre-1.0, no feature branches — creator ruling 2026-08-24).
**Last pushed:** `938c5b3` (alert ticker). This unit (distribution/certification research) is
**docs-only** — no code touched, no build, no tests run.

## This unit: distribution & Store certification research is WRITTEN DOWN

The session's open question was "how do we get this in front of users without a SmartScreen
scarewall" and it had been answered **in conversation only** — which meant the next session
would re-derive it. It is now in the map, and the conversation can be dropped.

| File | What it is |
|---|---|
| `TASKS/research-store-certification.md` | **new** — the authoritative research. Store Policies **7.20** (effective 2026-10-22, re-check the version), MSIX full-trust vs AppContainer, cert economics, a ⛔/✅ table of which policies bind and which don't, the camera/mic gating layers, the YouTube age + COPPA analysis, the 11.12 UGC judgment call, and the filter design constraints |
| `TASKS/task-48-distribution-msix.md` | **new** — the executable checklist. Carved out of TASK 36 item 6 (code signing / installer / Velopack URL) so distribution has one owner |
| `TASKS/task-49-chat-profanity-filter.md` | **new** — the chat filter checklist. Not blocked |
| `Distribution.md` §4.3 | **corrected** — the EV recommendation was dead (§ below) |
| `ai.md` | new "Windows packaging & distribution" section (durable invariants) + a correction on the FFmpeg locator |
| `MyMistakes.md` | the policy-applicability lesson |
| `TASKS.md` | rows 48/49, a research index, and the TASK 36 item 6 split |
| `MARCOM.md` | ⛔ **privacy-copy guard — gitignored, so this edit is local-only and did not travel with the push** |

### Two real defects the research surfaced (both now recorded, neither fixed — no code this unit)

1. **⛔ `FfmpegLocator` downloads an unsigned exe from GitHub and runs it.** That is Store
   policy **10.2.2** (dynamic code inclusion) verbatim, *and* it is the root cause of the
   2026-09-01 failure: the previous daily pin aged out of BtbN's 14-day retention and the
   download **404'd on the creator's first real recording attempt**. `FfmpegLocator.cs:30-35`
   records the incident but still reads like a design choice. → **TASK 48 item 1.** Not
   Store-conditional: bundling kills this whole class of cold-start failure and deletes the
   startup network dependency. **This is the highest-value unblocked item in the repo.**
2. **⛔ `Distribution.md:318` recommended a $400+/yr EV certificate for a benefit Microsoft
   deleted in March 2024.** Fixed. Had it shipped, it would have cost $400+/yr to buy exactly
   what $150 buys. Lesson in `MyMistakes.md` — the recurring shape is *citing a policy or a
   platform fact from memory instead of re-verifying it in the document itself.*

### ⛔ The decision that is NOT made, and belongs to the creator

**The distribution route.** Research is done and MSIX is the front-runner (full trust is viable;
we trip **none** of the four MSIX disqualifiers — no driver installed, no per-user service, no
elevation, no shell extension). Four real combinations, costed in
`TASKS/research-store-certification.md` §3:

| # | Route | Cert/yr | SmartScreen | Notes |
|---|---|---|---|---|
| A | Store MSIX + Store IAP | **$0** | none | Polar gets deleted; revenue cut; public listing |
| B | Store MSIX + **Polar** | **$0** | none | free signing **and** keep 100% — two systems to maintain |
| C | **Polar file hosting** + own cert | $120–300 | warning ramp | **the status quo already sketched in `Distribution.md:14`/`:296`** |
| D | Store EXE (policy 10.2.9) | $120–300 | warning ramp | **dominated** — cert anyway, silent install, own URL |

**Nothing else was allowed to block on this** — the user is right that most of the research is
route-independent and worth banking regardless. So: research banked, dead line fixed, and only
the packaging work is parked.

**Also still open, deliberately:** pricing (one-time vs one-time+monthly), the license provider,
and therefore all licensing copy. `OverlayHost.xaml` still claims Polar unlocks alerts — wrong,
alerts are not gated. Unresolved, queued, **not** to be papered over.

### The two findings most likely to be forgotten

- **Distribution and licensing are independent.** Policy 10.8.1 lets a **Store-distributed**
  app verify licenses with **Polar**. So "should we use the Store?" does not imply "drop Polar?"
  Only route A removes Polar, and that is a licensing decision riding on a distribution one.
- **⛴ Two invariants that will break silently if touched:**
  - **Full trust, or recording breaks.** `DefaultRecordFolder()` writes to Downloads/MyVideos;
    that passes through unvirtualized **only** at `mediumIL`. Flip the manifest to
    `appContainer` and output vanishes with no error. A comment is owed there **when the
    manifest lands** (TASK 48 item 6) — not before.
  - **Chat is rendered, never stored.** That non-persistence half is the load-bearing part of
    the 11.12 certification answer. No chat history, moderation log, analytics, or crash payload
    may be added without re-arguing 11.12 first.

## Landmines

- **Stale fact inside `TASKS.md` (left alone, flagged here per the Scope Lock).** The "1.0 gates"
  section asserts "**TASK 36 is now shipped**", but the catalog row 36 reads **☐ Queued** and
  `task-36-gold-pass.md` still shows items 1–6 unchecked. The line most likely means *item 2*
  (branding flash goes live) shipped at `9761b1d`. **Needs a one-line fix, not a code change** —
  flagging rather than fixing because it is not this unit's job.
- **A stale `ytLive.exe` (PID 2544) locked `bin/.../ytLive.exe`** and broke `dotnet run` with
  MSB3027. Killed. **If the build fails to copy `ytLive.exe`, check for a running instance first.**
- **`LayerReorderPersistenceTests.RealMouseDrag_OnTheLayerList_PersistsTheReorder` is flaky by
  environment** (needs an interactive desktop session; 2 fail / 1 pass in isolation). **Run the
  suite with ytLive CLOSED.** Not a regression.
- **`RealAppHost.RunAsync` exists for a reason** — a frame-pump test MUST `await` inside it. A
  blocking wait occupies the one shared STA thread and **hangs the whole suite with no output.**
  Always background a `vstest` run and poll the log; a foreground piped `vstest` returns nothing
  in this shell even on success.
- **`GlobalHotkeys`: two instances registering the SAME global hotkey** — Windows refuses the
  second. Left alone deliberately.
- **MSIX writes under a real package identity are unverified.** The docs say full trust passes
  user-profile writes through, but confirm on a real packaged build before trusting it with
  recordings (TASK 48 item 6).

## Test state

**367/367 as of `938c5b3`.** Not re-run for this unit — docs only, no code touched.

## Uncommitted / untracked

- `MARCOM.md` — the privacy-copy guard was added but the file is **gitignored by design**
  (confidential business file, `.gitignore:11`). It stays local, as intended. Same for
  `MONETIZATION.md` and `CREDENTIALS.md` — **never commit those.**

## Next

1. **Bundle ffmpeg (TASK 48 item 1)** — unblocked, recommended on every route, and it fixes a
   real user-facing failure. *This is the next code unit.*
2. **The route decision** (creator) — A/B/C above, once the ffmpeg fix is out of the way.
3. **Vertical recording verification** — the compositor tier is proven by
   `Render_VerticalTier_Outputs_1080x1920_From_The_Center_Crop`; the *record* path has never
   been run. `FramePump.cs:645` flags off-size tiers as a known follow-up.
4. **Multi-instance** — route `FfmpegLocator._toolsDir` through `InstanceProfile` (same shared
   extraction race as #1, and it becomes moot if ffmpeg is bundled). Confirm the launch method:
   `$env:YTLIVE_INSTANCE=2` + `dotnet run --no-build` in a second shell is the known-good path.
5. **Post-session efficacy report** — roll up `CurrentHealth` (dropped frames, duration, health
   message) when a stream or recording ends. `SessionTeardownTests` is the natural home.
6. **`scripts/publish.sh` + Debug-only `InternalsVisibleTo` + the `LlamaCasty.exe` rename** —
   still queued from 2026-09-26; do **NOT** add `-p:PublishTrimmed=true` (WPF fails at runtime,
   not build time). See `TASKS.md` → "Shipping / release build".
7. **The alert-gating copy** (`OverlayHost.xaml`) — fix the copy or gate the alerts; do not leave
   it lying. Blocked behind the pricing ruling.
8. **The camera-privacy measurement** — does the Win11 desktop-app camera toggle actually gate a
   DShow webcam and a capture card? Gates all privacy-forward copy (`MARCOM.md` guard).
9. **TASK 36:212 stale "shipped" line** — one-line fix, needs a hand.
10. Ship-checklist items live in `TASKS.md` → "1.0 gates".