diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md
index c8da444..9fd0fbf 100644
--- a/notes/fresh-workspace-handoff.md
+++ b/notes/fresh-workspace-handoff.md
@@ -36,6 +36,7 @@ Do not trust this file for the exact live HEAD. Always check git.
 - `E:\Projects\gamecult-access\docs\architecture.md` is the future shared design for reusable GameCult-hosted access across experiments.
 - `E:\Projects\gamecult-access\docs\app-profiles\repixelizer.md` is the Repixelizer-specific binding onto that future shared access layer.
 - current hosted-demo truth is still just the queue and limit machinery in `src/repixelizer/gui.py` plus the frontend runtime-config plumbing.
+- product strategy is hosted convenience first: keep the code open, let self-hosters suffer voluntarily, and do not burn time on native desktop packaging unless it clearly beats hosting on revenue, support, or strategy.
 
 ## Critical Doctrine
 
@@ -67,6 +68,7 @@ The exact current control flow is documented in
 - Do not let cleanup become the real solver.
 - Do not let `state/evidence.jsonl` turn into an activity feed.
 - Do not restart broad exploratory surgery when the current weak spot is still one bounded tapered-contour blemish.
+- Do not drift into desktop-app fantasies just because the web GUI is nice now. The default commercial path is still hosted access.
 
 ## Verification Guardrails
 
diff --git a/state/evidence.jsonl b/state/evidence.jsonl
index b5b3e42..dc78bb2 100644
--- a/state/evidence.jsonl
+++ b/state/evidence.jsonl
@@ -3,3 +3,4 @@
 {"ts":"2026-04-26T00:00:00Z","type":"regression","status":"rejected","note":"The d9fa411 phase-field tuning pass was a real regression on the pinned badge case; reverting it restores the known-good badge result exactly."}
 {"ts": "2026-04-26T03:57:11+00:00", "type": "docs", "status": "ok", "note": "Audit pass clarified note boundaries: the algorithm map remains the live control-flow truth, the implementation plan remains the forward hypothesis ledger, and hosted-auth-architecture is explicitly future design rather than landed auth machinery."}
 {"ts": "2026-04-26T04:05:06+00:00", "type": "design", "status": "accepted", "note": "Hosted auth was split into a reusable GameCult hosted-access architecture plus a thin Repixelizer-specific access profile. Recommended extraction path is an embedded shared gamecult_access layer first, with dedicated service only after a second app proves the need."}
+{"ts": "2026-04-26T04:52:53+00:00", "type": "design", "status": "accepted", "note": "Hosted convenience is the monetization path for Repixelizer; keep the code open, let self-hosting remain the escape hatch, and do not prioritize native desktop packaging unless it clearly beats hosted access on revenue, support burden, or strategy."}
diff --git a/state/map.yaml b/state/map.yaml
index 05bcd21..af0eb06 100644
--- a/state/map.yaml
+++ b/state/map.yaml
@@ -22,6 +22,7 @@ constraints:
   - Use visible structure and focused fixtures, not just lattice proxy metrics.
   - Keep compare mode, diagnostics, tuning, and GUI observer surfaces working.
   - Avoid reviving trays, portrait layers, or multi-stage solver religions.
+  - Treat hosted convenience as the product path; do not prioritize native desktop packaging unless it clearly beats hosted access on revenue, support burden, or strategy.
 
 invariants:
   - The map is canonical and slow-changing.
@@ -69,6 +70,7 @@ accepted_design:
   - `source_fidelity` is useful but incomplete; `source_structure` exists because visible structure can improve while lattice-only scoring complains.
   - The tracked badge fixture and sword-tip focus are the current reality check for solver changes.
   - The algorithm map and forward plan must stay separate from scratch and evidence so the notes do not congeal into one giant lying blob.
+  - The open-source distribution story is self-hosting; the paid offer is hosted convenience, not a desktop-app paywall.
 
 landed_baseline:
   - Lattice inference with fixed or searched target dimensions and optional low-confidence phase rerank.