Lanework Pro is a subscription — the tier seam, StoreKit 2, and Settings

Phase 3 of the one-app pivot (DESIGN 12 ▸ The entitlement / Distribution,
ruled 2026-07-30; card c3a3ddd5). New Kanban/Tier/: Tier (.free/.pro —
deliberately no .lapsed case; unsubscribed and lapsed are one state) and
the pure decision Tier.resolve(from:now:) over SubscriptionFacts
(expiration + willAutoRenew), unit-tested through all five named states:
free, active, lapsed, offline-grace, never-online.

The facts are a persisted cache (standard defaults), not a live view:
StoreKit ages an expired subscription out of currentEntitlements locally,
so an offline device and a real lapse are indistinguishable from that
property alone — the cache holds the last answer, empty entitlements
read as silence, and holds end only on a definitive answer (revocation,
or the subscription-group status read Settings performs). That is 12's
offline-grace trade, resolved toward the paying user.

ProEntitlement is the local adapter (currentEntitlements +
Transaction.updates, started from launch, never from a test host);
ProStorefront holds everything networked (product load, purchase,
AppStore.sync) and only the Settings section ever constructs one — the
split is the enforcement of "never network on the open path".
beginSession reads the tier once at composition; BoardSession.tier is a
let with no path back in, so a lapse never rebinds an open session.
makeHistoryProvider now takes the tier; both tiers bind the native stack
until pro-m1 builds the git provider — the seam's consumer is named, not
invented early.

Settings gains the Pro section (subscribe with localized price, manage,
restore; a quiet unreachable line, no indefinite spinner) — the third of
the exactly-three Pro mentions; the About line gains its "…in Settings"
pointer now that there is a Settings to point at. A successful purchase
or restore offers once to reopen open boards (close + reopen through the
ordinary paths). Configuration.storekit wired into the scheme's run
action for ASC-free exercise; RELEASE.md gains the pro-m1 store-side
steps and the rule that the product must not be configured before then.

1901 tests in 319 suites green.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/AppDelegate.swift

@@ -16,6 +16,21 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "app-delegate")
 
+    /// Starts the Pro entitlement's transaction listener (12-editions.md ▸ The entitlement).
+    ///
+    /// **Here rather than in `AppModel.init`**, and the distinction matters: a unit-test host *is*
+    /// this app, so `KanbanApp.init()` and therefore `AppModel.init` run on every test launch
+    /// (`AppStateHome.isUnitTestHost`). Building the entitlement there costs one `UserDefaults` read;
+    /// acquiring a StoreKit listener there would give every test run a live `Transaction.updates`
+    /// subscription for no reason. Launch is the honest home for a listener, and this is the app's.
+    ///
+    /// It starts nothing the board-open path waits on: the listener writes cached facts that a
+    /// *later* composition may read, and never reaches into a session that is already open
+    /// (`ProEntitlement`).
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        appModel?.entitlement.start()
+    }
+
     /// **The close is respected.** "Closing the last board window leaves the app windowless (menu bar
     /// alive)" — a document-shaped app whose windows are boards has no business quitting because the
     /// user tidied one away, and welcome is one Dock click or one menu item back.