M9: monetisation decision - one-time paid, no billing code, verified in release APK

docs/MONETISATION.md

@@ -0,0 +1,85 @@
+# Monetisation
+
+## The decision
+
+**File Manager is a one-time paid app.** No ads, no subscription, no in-app purchases, no
+free tier and no trial. The price lives on the Play listing, not in the build — so there is
+no Billing client, no `com.android.vending.BILLING` permission, and no purchase code in the
+APK.
+
+That is not a detail: it is what keeps the "no network permission, nothing leaves your
+device" claim true in the *shipped artefact* rather than merely in the source.
+
+## Price
+
+| | Value |
+|---|---|
+| Base price | **€4.49** |
+| Launch price | **€2.29** (≈49% off) for the first **14 days** |
+| Model | One-time purchase, all features, no unlocks |
+
+Both are set in the Play Console under *Products › App pricing*. Nothing about them is in
+this repository, and nothing about them needs to be: changing the number is a Console edit,
+not a release.
+
+### Why €4.49
+
+- **Anchors.** The only comparable *pure-paid* file manager on Play is MiXplorer Silver at
+  **€6.99**. Everything else is free with ads or free with a €3–5 one-time unlock (Solid
+  Explorer, FX+, X-plore, Cx). €4.49 sits below the premium paid rival and above the
+  free tier's unlock price, which is where "no ads, no account, no network" earns its keep.
+- **Scope.** A file manager is a daily-use tool across every app on the device, not a
+  single-purpose utility. A one-shot photo-deduplication tool is reasonably priced at
+  €2.99; a file manager does more, more often.
+- **Headroom.** It is much easier to discount a €4.49 base than to raise a €2.49 one. The
+  base price anchors future sales; the sale cannot anchor the base.
+
+### Why a launch price
+
+A temporary lower price gives early adopters a reason to commit and — more importantly —
+produces the first reviews, which a paid app needs far more than a free one does. Once the
+window closes, the price returns to €4.49. The same discount can be repeated for any later
+milestone; the base price never has to move.
+
+**Keep it honest:** the launch price is a genuine time-boxed reduction, not a permanent
+"discount" — a base price that never applies is just a two-tier price with extra steps.
+
+### ⚠️ This decision is irreversible in one direction
+
+Play's own wording: *"You can change your app from paid to free. Once your app has been
+offered for free, the app can't be changed to paid."* So:
+
+- The price **must be set before the first upload**.
+- Paid → free remains possible later if the strategy changes.
+- Free → paid never does.
+
+## Why not the alternatives
+
+| Option | Rejected because |
+|---|---|
+| Free with ads | The product's whole pitch is "no clutter". Ads in a file manager are also a privacy problem — every ad SDK wants `INTERNET` and an advertising ID. |
+| Free with a one-time unlock (IAP) | Would add the Billing client and the `BILLING` permission, require purchase-state plumbing and a restore path, and make the app's own "works offline forever" promise contingent on a Play check. |
+| Subscription | Nothing here is a recurring service. Users are paying for a tool they already own a copy of. |
+| Free | M9 exists to fund the work. See the irreversibility note: once free, never paid. |
+
+## What is in the build — verified, not assumed
+
+```bash
+# None of these may return anything:
+grep -rniE 'billing|vending' app/src gradle/ app/build.gradle.kts
+$ANDROID_HOME/build-tools/36.0.0/aapt2 dump permissions \
+  app/build/outputs/apk/release/app-release.apk | grep -i billing
+```
+
+Checked 2026-10-14 against the release APK: **no billing reference in the source, no Billing
+dependency in the version catalog, no `com.android.vending.BILLING` permission, and no
+`INTERNET`**. See [PLAY_RELEASE_CHECKLIST](PLAY_RELEASE_CHECKLIST.md) step 7.
+
+## Console steps
+
+1. Create a **payments profile** (identity, tax, bank details) for the developer account.
+2. In the Play Console, on the app's *App pricing* page, set the base price to **€4.49**
+   (Play fills in local equivalents; review the suggested prices rather than accepting
+   them blindly).
+3. Set the **launch price of €2.29**, and diarise changing it back after 14 days.
+4. Do all of the above **before the first upload**.

docs/PLAY_RELEASE_CHECKLIST.md

@@ -122,8 +122,14 @@ factor too).
 
 - [ ] Create the app, complete *App content*, then roll out
       **internal → closed → production**, checking the pre-launch report on the way.
-- [ ] ⚠️ **Set the price before the first upload** (M9). Once an app has been offered for
-      free it can never be made paid, and this app is a **one-time paid** app: no ads, no
-      subscription, no in-app purchases — and therefore no Billing code and no
-      `com.android.vending.BILLING` permission in the APK. The price lives on the listing,
-      not in the build.
+- [ ] ⚠️ **Set the price before the first upload.** Play's own wording: *"You can change your
+      app from paid to free. Once your app has been offered for free, the app can't be
+      changed to paid."* So:
+      1. Create a **payments profile** (identity, tax, bank details).
+      2. *Products › App pricing*: base price **€4.49**.
+      3. Launch price **€2.29** for the first **14 days**, then diarise changing it back.
+      4. Do every step above **before uploading**.
+- [x] **[code] no Billing client and no `BILLING` permission** — the price lives on the
+      listing, not in the build, so the APK contains no purchase code at all. Verified
+      2026-10-14 against the release APK. Full rationale and the rejected alternatives:
+      [MONETISATION](MONETISATION.md).

docs/ROADMAP.md

@@ -18,7 +18,7 @@ Legend: ✅ done · 🚧 in progress · ⏳ not started · 💡 candidate (propo
 | M6 | Release config & Play readiness | ✅ | Upload keystore generated (4096-bit RSA, `CN=Hadrian Burkhardt`) and wired through the git-ignored `keystore.properties`; `bundleRelease` + `assembleRelease` verified — **4 682 814-byte `.aab`** (`sha256 9014627a…`), 2 081 955-byte APK signed by the upload key, R8 mapping kept. [PLAY_RELEASE_CHECKLIST](PLAY_RELEASE_CHECKLIST.md) (incl. the **Permissions Declaration Form** for "All files access", the Data safety answers and the shipped-permission audit) and [PRIVACY.md](../PRIVACY.md) written for a restricted-permission app. Shipped permission set audited: **no `INTERNET`** |
 | M7 | On-device validation & hardening | ✅ | Run on a real **Xiaomi M2101K7AG** (Android 12 / MIUI V140) — see [EDGE_CASE_TESTING](EDGE_CASE_TESTING.md). Verified on hardware: the first-run permission prompt, granting "All files access" while the app is alive (picked up on resume), browsing real storage, the text editor's read **and** write path (independently checked with `adb shell cat`), the storage-usage screen, landscape layout, and **graceful degradation when access is revoked mid-use**. Found and fixed two real defects: misleading first-run copy ("Full access was declined" on a device where nothing had been declined), and a usage screen that stayed blank for **~45–60 s** on a 55 GB volume — now one listing per directory instead of a `stat` per node, with rows streamed out as they are measured. **142 JVM tests** |
 | M8 | Localisation groundwork | ✅ | Every user-visible string is in `res/values/strings.xml` with real `<plurals>`, and `text/TextRes.kt` maps **both** `OperationKind` and `FileKind` onto resources so the screen, the notification and the details sheet cannot drift. The audit found a genuine miss: the details sheet rendered `FileKind.name`, i.e. untranslatable English — now a resource. `isPseudoLocalesEnabled = true` on the debug build makes "did every string come from resources?" mechanically checkable; verified `en-rXA` is present in the debug APK and the flag is debug-only. Byte units and the timestamp pattern are deliberately unlocalised, and the README says why. **142 JVM tests** |
-| M9 | Monetisation | ⏳ | **one-time paid** — price set only in the Play Console before the first upload; no Billing code and no `BILLING` permission |
+| M9 | Monetisation | ✅ | **Decided: one-time paid — €4.49 base with a 14-day launch price of €2.29**, both set in the Play Console (*Products › App pricing*), so there is **no Billing client, no `com.android.vending.BILLING` permission and no purchase code**. Rationale, market anchors and Console steps: [MONETISATION](MONETISATION.md). Verified against the release APK: zero billing and zero `INTERNET` references. **The price must be set before the first upload** — Play allows paid → free but never free → paid |
 | M10 | Store assets | ⏳ | icon/feature-graphic generators, per-form-factor screenshots, [STORE_LISTING](STORE_LISTING.md); display name confirmed |
 
 ## Key decisions
@@ -28,7 +28,7 @@ Legend: ✅ done · 🚧 in progress · ⏳ not started · 💡 candidate (propo
 | Language / UI | Kotlin + Jetpack Compose | Mirrors the sibling app's proven, installed toolchain; no NDK |
 | Storage access | `MANAGE_EXTERNAL_STORAGE` first, SAF fallback | Google Play explicitly permits "All files access" for file managers; SAF keeps the app usable if the user declines |
 | Connectivity | Local-first (no `INTERNET` in v1) | Preserves the "nothing leaves the device" claim and keeps the Data Safety form trivial |
-| Monetisation | One-time paid, price in Console | No Billing code; free → paid is impossible after the first upload, so the price must be set beforehand |
+| Monetisation | One-time paid (€4.49; €2.29 launch price), set in the Console | No Billing client, no `BILLING` permission, no purchase code — which is what keeps "nothing leaves the device" true in the shipped APK. Free → paid is impossible after the first upload, so the price must be set beforehand. See [MONETISATION](MONETISATION.md) |
 
 ## Deliberately deferred (post-1.0)