Files

T

gramps 57ef9e7a5e docs(commercial): the claim page was never needed, signing waits for revenue, and support is a filter

Four things derived this session superseded what the plan said twenty-four hours earlier,
and the docs are corrected where each one died:

**Licensing needs no server.** Polar's customer-portal endpoints authenticate on the key
itself plus the public organization_id; the org access token is only needed to create
products. Channel binding rides in `conditions: {channel_id}`, re-checked on every
validate — so the "claim page" (a hosted OAuth flow that wrote the UC id onto the key)
and the key database it implied are deleted. Device management, key rotation and
subscription auto-revocation are Polar's; four states, one lease, no callback endpoint.

**Signing is deferred until two subscribers.** It never removes the day-one SmartScreen
warning (EV's instant-bypass died in 2024), so buying it before revenue buys only the
publisher line. Renamed to Azure Artifact Signing, $9.99/mo Basic, and it requires a
paid Azure subscription. Year-one fixed cost drops from ~$135 to ~$15.

**The Store account is free.** Microsoft waived the $19 individual fee and removed the
$99 company fee in May 2026, which makes the Store the only zero-cost route to a
Microsoft-signed install — the free answer to SmartScreen, noted beside the paid one.

**Support is a filter, not a promise.** Email, best effort, no SLA, refunds on request
without argument; no training service, no helpdesk. A repeated question becomes a
training video on @llamacasty, which is content and monetization instead of a ticket.
GitHub issues on the releases repo are the deliberate friction.

Also settled: binaries live in a second Gitea repo (`llamacasty-releases`) push-mirrored
to a public GitHub repo — issues and assets public, code private, one publish direction
(a git mirror carries refs, not GitHub Release assets); `@llamacasty` is
standard-verified with intermediate features, so live streaming, >15 min uploads and
custom thumbnails work today and no SIM or ID is needed; and OAuth comes out of Testing
mode by publishing the app (100-user lifetime cap, no 7-day token death).

TASKS.md now opens with the four-day surge slice — artifact shape, output gate,
entitlement seam, real-machine day — because those are what the first public release
waits on. HANDOFF.md rewritten. MyMistakes.md gains the Polar recipe and the
"verify means three different things" entry. MARCOM.md gains the support→content loop
and the surface roles.

2026-10-31 10:08:05 -07:00

13 KiB

Raw Blame History

Commercial: pricing, entitlement, channels, support

The single source of truth for what LlamaCasty charges, what a licence entitles, how it ships and what support it does and does not include. Read before any pricing, licensing, distribution, storefront, support or promo work. Cause of death for every retired path: decisions.md. Release mechanics (build, zip, mirror, winget): Distribution.md.

Model

Free tier — every feature, every scene, every overlay, free forever, no account, no watermark, nothing nagged inside the output. It is not a trial.
Pro — $10/month or $400 lifetime. No annual tier.
The only delta is output quality. Features are never gated; a payment buys pixels.
No watermark, ever, in either edition. The branding flash is retired as a paid delta and stays off (ShowBrandFlash, default false).
Clean numbers, no .99, no discount codes, no countdowns, no fake scarcity.
The site publishes the model, never the numbers — "free forever, every feature unlocked, a paid edition with higher output quality at launch". Price, tier name, cap and frame rate are published by the app, at the point of sale, not by the page.

Output profile — the one entitlement rule

The cap is a pixel budget plus a frame rate, not the word "720p":

	Free	Pro
Pixels	≤ 921,600	any shipped tier
Frame rate	≤ 30 fps	any shipped tier
Landscape	1280×720 @30	1280×720 @60 · 1920×1080 @30 · @60
Vertical 9:16	720×1280 @30	1080×1920 @60

Records too. The cap governs the file the creator keeps as well as the stream; otherwise free 1080p recording is a re-upload hole. One OutputProfile, resolved once per session and consumed by both the stream encoder and the recorder — never two checks.
Fail closed. Unresolved, unreadable or unvalidated entitlement = free tier. Never Pro.
Never downgrade a running stream. The gate applies to the next start; pulling quality out of a live broadcast is a worse bug than one free 1080p session.
The greyed menu entry is the sales surface. It stays clickable, says what it costs, opens checkout, and is labelled ("720p30 · free tier") — never silently missing, because silence reads as broken.
Activation is live, not restart-gated: activating enables the high tiers and a lapse (cancel, revoke, sign-out, channel switch) greys them again on the next refresh.
Bitrate follows the profile — a capped user is not offered a 1080p bitrate.

Entitlement

Polar is the merchant of record and the only source of truth. It takes the money, remits VAT/GST, handles refunds and chargebacks, and holds the keys. There is no server of ours in the loop — no claim page, no callback endpoint, no key database.

Key — LCYT- prefix; org c05fb364-… and the endpoints are in CREDENTIALS.md. No product is created yet.
The client talks to Polar directly. The customer-portal endpoints authenticate on the key itself plus the organization_id (a public identifier). The org access token must never ship in the app — it is only needed to create products, not to activate them.
Bound to the buyer's YouTube channel ID (UC… from channels.list?mine=true — the signed-in channel, never the @handle) through Polar's conditions, not through a browser flow: activate is called with conditions: { "channel_id": "UC…" }, and every later validate passes the same object. Polar compares them server-side, so the binding is enforced without us hosting anything.
Two activations, any machine, one channel (limit_activations: 2 on the benefit). A second channel is a second key. Two keys for one channel is never sold — it doubles the support surface and invites "give one to a friend".
Runtime rule: Pro requires licence.channelId == connected.channelId. Equal → Pro. Anything else → free tier, working normally, with "This licence belongs to another channel" and a link to the Polar customer portal. Never an error wall, never a blocked stream.
Lease, not a permanent cache: validate on launch and daily; 7–14 days offline grace; no network past grace = free tier until Polar answers. Never lock a paying user out on a DNS failure.
Device management is Polar's — the customer portal already lists and deactivates activations, so we build no UI for it. A subscription key is auto-revoked when the subscription ends, which is what makes a lapse a real state on the monthly SKU.
Four states, and nothing else: valid → Pro · expired/revoked → free with a banner · activation limit reached → "manage devices" portal link · mismatch or offline → free, explained.
CLI activation — --activate LCYT-… so silent and fleet installs never meet a dialog. Interactive entry in Settings is the secondary path.
Notice cadence — 7 days out, 1 day out, and on the day, inline in the go-live panel with a date and a portal link. Recording gets the banner only. Never modal, never blocking a Start, never orange (orange is the dev-only label colour).

⛔ conditions is agreement, not cryptography. A patched client can send someone else's channel ID. That is accepted: the free tier is the defence, the licence is a lease, and a determined crack buys little. Do not propose a signed token, a hardware fingerprint or a server to "fix" it.

Channels

One artifact, several ways to get it. A self-contained single-file LlamaCasty.exe plus the bundled ffmpeg\ folder, zipped. No .NET install, no admin, no installer framework. Trimming stays off (WPF reflection), so expect ~110–150 MB.

Direct download — llamacasty.com links the zip. Binaries live in a second Gitea repo (llamacasty-releases), push-mirrored to a public GitHub repo, so the source repo stays private and the handout repo contains nothing but a README, an issue template and the release assets. The mirror carries refs, not GitHub Release assets — the zip is uploaded with gh release create. Mechanics: Distribution.md.
winget — the primary install path. Manifest in microsoft/winget-pkgs, InstallerType: portable, pinned SHA-256. That hash pin is the anti-tamper wall: the official channel delivers exactly the published artifact or fails. One wingetcreate update PR per release. Optional: Scoop and Chocolatey manifests over the same zip.
Steam — parked at $100. Lifetime Pro as DLC only (Steam has no subscriptions), page public two weeks before release, 30% cut, and price parity with the site. It is the only channel with discovery and an install that never meets SmartScreen, and it updates itself — which is why it stays in the plan despite the cut.
Microsoft Store — parked, and now free. Microsoft waived the $19 individual developer fee (and removed the $99 company fee in May 2026). It is the only storefront that bills a subscription natively and the only zero-cost route to a Microsoft-signed install with no SmartScreen warning, because Microsoft signs the MSIX. Bans self-updaters, so a Store build ships without one.

Not channels, ever: Patreon or any subscription platform of our own, paywalled early access, a paid beta, a Discord. Content is the funnel; the channel is only the checkout.

Portable mode: a portable.txt marker beside the exe keeps the layout DB and settings in .\data\ instead of %APPDATA%\ytLlive — the USB-stick case, hung off LayoutPathOverride. It is the reason the zip survives even if Steam becomes the primary channel.

Signing — deferred until there is revenue

Not bought at launch. Artifact Signing is listed in the costs as deferred: it is paid for out of Pro revenue, and the trigger is two subscribers.
What it actually buys: a named publisher line, fewer antivirus false positives on a ~150 MB self-extracting exe, and tamper evidence for hand-downloaded zips. It does not remove the SmartScreen warning on day one — Microsoft deleted the EV instant-bypass in March 2024, so a new certificate has zero reputation and clears only with download volume.
Azure Artifact Signing (renamed from "Trusted Signing"), $9.99/month Basic, up to 5,000 signatures, requires a paid Azure subscription. Individual identity validation exists and must be renewed before it expires; it is the slow (days-to-weeks) part, so start it when the purchase is decided, not before.
Reputation accrues to the publisher, not the file. Unsigned means the warning on every release, forever, because SmartScreen ties reputation to each file hash. Signing is the only exit from that per-release tax.
The free alternative is the Store (see Channels 4): a free developer account gets Microsoft-signed installs with no certificate of ours.
No EV certificate, ever — $400+/yr for what OV buys, and the bypass is gone.
Every signed release: same pass, SHA-256 in the winget manifest, licence ID visible in About.

Support

Email. Best effort. No SLA. Refunds granted on request, without argument.

There is no training service. "I want people to succeed" is not "I will train them". The app teaches itself — one-click go-live, five scenes, nothing to configure. A how-to question means the app or its docs fell short; the answer is a fix or a video, not a conversation.
No helpdesk. No ticketing system, no live chat, no onboarding calls, no hand-holding.
A repeated question is a video, not a ticket — see MARCOM.md → support → content loop. The training channel is the support surface.
The issue tracker is a filter, deliberately. Bugs go to the public releases repo on GitHub, which requires an account; Steam Discussions stay pinned and unread; Announcements carry known issues and release notes. Steam refunds are Valve's own (2 h / 14 days) and cost us nothing.
Nobody is locked out over a licence. A billing hiccup drops the app to the free profile with a banner and a portal link — never a blocked stream, never a modal.

Cash cost $0; it is priced in support time and forgone list revenue.

90 days free — a 100%-off Polar coupon, duration = repeating, months = 3.
Founder price lock — their $10/month stays $10 permanently.
Credits + in-app Founder badge (opt-in channel name on the site).
30-day passes — unique keys carrying the issuer's channel, issued one per 30 active days, max 3 held, activation limit 1–2, expiring 30 days after activation. Earned, never handed out: a pass nobody uses teaches nothing.
Optional $250 lifetime window in the first 90 days — converting a founder beats three months of free.
Reminders at day 75 and 85; the renewal cliff is where founders churn.
Terms, one paragraph: one per person, passes expire 30 days after activation, no cash value, revoked for resale or abuse, price lock void if the subscription lapses.

Costs

Item	Cost
Domain	~$15/yr
Droplet	$0 — serves the existing site
GitHub public repo (releases + issues), Gitea, winget, Scoop, Chocolatey	$0
Polar	5% + 50¢ per sale → $10 nets $9.00, $400 nets $379.50
Azure Artifact Signing — deferred	$9.99/month (~$120/yr), bought at two subscribers
Steam Direct (optional)	$100 once, recoupable after $1,000 AGR
Microsoft Store (optional)	$0 — the individual fee was waived

Fixed year one ≈ $15 while unsigned, ≈ $135 once signing starts. Break-even is two subscribers (15 subscriber-months ≈ $135); one $400 lifetime sale covers nearly three years.

Anti-piracy posture

Any check that runs on the user's machine can be removed. The goal is a crack that is pointless and a leak that is traceable — not an unbreakable binary.

The free tier is the real defence. If the only delta is pixels above 921,600, a cracked build buys almost nothing and forfeits updates, support and the publisher's signature.
Hash-pinned delivery, signed once revenue exists — a patched build cannot arrive through winget, and a forged one is not signed as us. Until signing starts, the SHA-256 pin is the wall.
Short leases — a revoked or refunded key dies inside the grace window.
Licence ID in About — a leaked build traces back to a purchase.

⛔ Rejected, do not re-propose: a native helper DLL for "IP protection", obfuscation, hardware locking, remote code that downloads and executes, and gating asset downloads as an auth check. None of them make a licence enforceable; the first three add failure modes without buying anything, the fourth needs the server this plan exists to avoid, and the fifth is Store policy 10.2.2.

13 KiB Raw Blame History Unescape Escape