Monetization policy locked + dev pause recorded (docs changeset, 2026-08-14): the one paid line becomes an annual subscription — early access $49.99/yr → $99/yr list at GA, grandfather-while-subscribed with lapse → list on renewal (no escalation matrix); free tier unchanged (branding flash is the free tier's billboard + no Alerts, which is the one paid feature); billing NOT locked to itch.io (hunted fact: itch.io has no native subscription billing — candidates Gumroad, whose native affiliate program is the tiebreaker, and Lemon Squeezy); support = in-app bug-report → git issues with a when-I-get-around-to-it cadence + emergency patches. ai.md Monetization section rewritten + stale paid-unlock seams fixed (L115 subscription-entitlement wording, the About hub's tabled billing PremiumUrl seam); TASKS.md gains TASK 23 (Monetization — billing provider decision, unlock mechanism with lapse→flash-returns enforcement, in-app bug-report loop, Unlock Premium seam lighting, Alerts gating, and line-item pointers for the early-access strategy, affiliate/ads phase 2, and the channel revival); HANDOFF.md records the decisions + the development pause (resume streaming = pair-programming dev streams via OBS + The Division 2 under the gramps/GOAT persona, 67 and gaming since 1981, 3D-printing content retired; dogfood switch to ytLlive once TASK 5 lands; resume point = TASK 5). Stale itch.io assertions corrected across comments and indexes (MainViewModel.cs PremiumUrl/IsPremium seams, MainWindow.xaml tooltip, AboutHubTests comment, ViewModels/index.md, TASK 9 out-of-scope note). Build 0 warnings, 196 tests passing

HANDOFF.md

@@ -7,35 +7,39 @@
 
 ## Session state (last updated: 2026-08-14)
 
-- **Branch:** `main` (audio milestone work is uncommitted, see "Uncommitted").
-- **AUDIO MILESTONE (TASK 9) — SHIPPED this session.** Real stream audio + voice filters + auto-duck
-  + free TRAX background music. Build **0 warnings**, full suite **196 passing** (ONE integration
-  test: `AudioPipelineTests.Mix_WithFiltersDuckAndGain_Lands_On_AudioPipe`). Everything below in the
-  milestone section is DONE. **NOT yet committed** — next step is review + commit (with `ai.md`/
-  `TASKS.md`/this file already updated in the same changeset).
-- **Two build-time deviations from the settled plan (both recorded in ai.md + TASKS.md):**
-  1. `MusicPlayer` uses **`WaveOutEvent`** (new sibling package `NAudio.WinMM` 2.2.1) — not `WasapiOut`
-     as planned; `WaveOutEvent` isn't in `NAudio.Wasapi`/`NAudio.Core`.
-  2. No forced 48 kHz capture — NAudio 2.2.1's `WasapiCapture` has no overridable
-     `GetDefaultMixFormat`, so both sources run the device mix format and the mixer's
-     `TinyResampler` normalizes any rate to 48 kHz (resampler IS the design, not a fallback).
-  3. `FfmpegEncoder.cs` is **untouched** — the VM closes the audio pipe (`_audioMixer.StopLive()`) in
-     `StopStream` BEFORE the frame pump stops (audio EOF then video EOF, in order).
-- **SERVER RECOVERY (llamachile.tube / YunoHost / DO droplet) — done earlier session.** Side task
-  complete; **rotate the DO API token** (control-panel only) and any password no longer trusted.
-- **Shipped, all pushed before this session:** TASK 21 (creator-hub About, `3d92bd0`), TASK 8 (meter
-  +10 dB), TASK 4 ship step 7 (one-click go-live + private-only). **174 tests passing, 0 warnings.**
-- **Uncommitted (whole TASK 9 milestone):** `Services/Audio/` (new `VoiceFilterChain.cs`,
-  `AudioRingBuffer.cs`, `AutoDucker.cs`, `TinyResampler.cs`, `MusicPlayer.cs`, `NamedPipeAudioWriter.cs`,
-  rewritten `AudioMixer.cs`, simplified `WasapiMicAudioSource.cs`), `Models/Music.cs` (new),
-  `FfmpegArgs.cs`, `EncoderOptions.cs`, `LayoutStore.cs` (v9), `MainViewModel.cs`, `MainWindow.xaml`,
-  `MainWindow.xaml.cs`, `ytLive.csproj` (NAudio.WinMM), `ytLive.Tests/` (`AudioPipelineTests.cs` new,
-  `FfmpegEncoderTests.cs` + `LayoutStorePersistenceTests.cs` updated), and docs `ai.md`, `TASKS.md`,
-  `HANDOFF.md`.
-- **Next step:** commit the milestone (docs already staged in the same changeset), push, then start
-  **TASK 5** (reusable stream → `_rtmpUrlProvider` — the last blocker before go-live actually encodes).
-  Then **itch.io product page setup** (premium URL lands in `MainViewModel.PremiumUrl`, lights up
-  Unlock Premium). Optional, not queued: rewriting the healed entry's `ProfileUrl` to
+- **Branch:** `main`, tracking `origin/main` at **`f2f6401`** (pushed). Working tree was clean until the
+  monetization docs changeset below.
+- **AUDIO MILESTONE (TASK 9) — SHIPPED + COMMITTED + PUSHED this session.** Real stream audio + voice
+  filters + auto-duck + free TRAX background music. Build **0 warnings**, full suite **196 passing**
+  (ONE integration test: `AudioPipelineTests.Mix_WithFiltersDuckAndGain_Lands_On_AudioPipe`). Commits
+  **`6d71ace`** (milestone) + **`f2f6401`** (secrets cleanup), force-pushed (`725f5a7...f2f6401`).
+- **Secrets scrubbed from git history.** The DO token + passwords recorded in `HANDOFF.md` were removed
+  from the working file and **purged from all history** via `git filter-branch` over `3d92bd0..main`
+  + `git gc --prune=now --aggressive` (scan of all refs = 0 hits). They still exist in chat — **keep
+  treating as compromised**; rotate the DO API token. Old objects remain in llgit's store until server
+  GC (unreachable, not fetchable). If a value is ever needed, `git reflog` is expired — it's gone.
+- **MONETIZATION LOCKED (2026-08-14, creator).** One paid line = **annual subscription**: early access
+  **$49.99/yr** → **$99/yr list at GA**, **grandfather-while-subscribed**, lapse → list on renewal.
+  Free tier unchanged (branding flash = the billboard + no Alerts; Alerts is the paid feature).
+  **Billing NOT itch-locked** — itch.io has no native subscription billing; candidates Gumroad (native
+  affiliates = tiebreaker) / Lemon Squeezy. Support = in-app bug-report → git issues, "when I get
+  around to it" + emergency patches. Full policy in `ai.md` → Monetization; scoped plan + line-items
+  in `TASKS.md` **TASK 23**.
+- **DEVELOPMENT PAUSED (creator's call 2026-08-14) — resuming streaming instead.** Channel revival =
+  **pair-programming dev streams via OBS** (ytLlive can't go live yet: private-only + `_rtmpUrlProvider`
+  null) + **The Division 2** gaming streams under the **"gramps/GOAT"** persona (67, gaming since 1981).
+  3D-printing content retired (printer hard down, novelty gone). **Dogfood switch** later: when TASK 5 +
+  go-live capability land, stream *with* ytLlive — Division 2 (loud game + voice) is the demo for the
+  ducking/voice-filter story. Early-access strategy + affiliate/ads are their own future line-item tasks.
+- **Docs changeset in flight (THIS changeset):** `ai.md` Monetization rewritten + stale paid-unlock seams
+  fixed; `TASKS.md` TASK 23 added + TASK 21's itch.io URL mention corrected; this file rewritten. Commit
+  + push as one change.
+- **Shipped, all pushed:** TASK 21 (creator-hub About, `3d92bd0`), TASK 8 (meter +10 dB), TASK 4 ship
+  step 7 (one-click go-live + private-only), TASK 9 audio milestone (`6d71ace`), secrets cleanup
+  (`f2f6401`).
+- **Resume point (when dev starts again):** **TASK 5** — reusable stream → `_rtmpUrlProvider` (the last
+  blocker before go-live actually encodes + pushes). Then TASK 23 (billing + unlock + support).
+  Optional, not queued: rewriting the healed entry's `ProfileUrl` to
   `https://mastodon.llamachile.tube/@gramps` (user must say the word).
 
 ## TASK 9 audio milestone — SHIPPED 2026-08-14 (what changed)
@@ -67,7 +71,7 @@ and `ai.md` ("Live audio capture"). Highlights:
   start-of-stream silence race was seen and eliminated).
 
 **Out of scope this branch:** IP webcam, chat box, alt-key crop, credits, bg removal, music-off-VOD
-track (YouTube mutes VODs with copyrighted music — future feature), itch.io `PremiumUrl`.
+track (YouTube mutes VODs with copyrighted music — future feature), `PremiumUrl` (TASK 23 seam).
 
 - **Landmines:**
   - Never add another test that constructs `new App()` — use `RealAppHost.Run(...)` (shared STA host