fix(license)!: remove expiration-based license validation

.github/workflows/ci.yml

@@ -132,7 +132,7 @@ jobs:
         with:
           allowUpdates: false
           body: ${{ needs.setup_release.outputs.release_body }}
-          draft: true
+          draft: false
           generateReleaseNotes: ${{ needs.setup_release.outputs.release_generate_release_notes }}
           name: ${{ needs.setup_release.outputs.release_tag }}
           prerelease: true

docs/usage.md

@@ -112,17 +112,24 @@ an online request per controller. The broker validates in the background at
 startup and once per day. If Polar cannot be reached, it retries every 60
 seconds. Existing gamepads are retained for one hour, but a new gamepad can be
 created only when no licensed gamepad is active. When the outage reaches one
-hour, the broker removes excess licensed gamepads and retains at most one.
+hour, the broker removes excess licensed gamepads and retains at most one. A
+yearly subscription must validate successfully within 25 hours of its previous
+validation, so the remaining gamepad is removed when that deadline passes. A
+lifetime license can retain the one-gamepad fallback until validation succeeds.
 If the broker service restarts, it removes gamepads left by the previous broker
 instance before accepting new creation requests. Failed removals are retried.
-Yearly licenses stop at their exact `expires_at`; this outage behavior never
-extends expiration. Lifetime licenses have no expiration. Polar server time,
-Windows uptime, and a per-boot marker track time without relying on the
-user-adjustable Windows date. After Windows restarts, a yearly license must
-reconnect to Polar before gamepad creation; lifetime licenses can use the
-one-gamepad outage fallback. A confirmed missing, revoked, disabled, expired, or
-mismatched entitlement invalidates the license and removes all licensed gamepads. Purchase and
-account-management buttons use the compiled URLs in
+Both supported plans rely on Polar's entitlement status rather than a locally
+enforced calendar expiration. A granted yearly license follows its subscription
+benefit, which Polar revokes when the entitlement ends. Polar's public license
+response does not include the subscription renewal date; the linked Polar account
+portal remains authoritative instead of the broker estimating a date. Polar
+server time, Windows uptime, and a per-boot marker track subscription validation
+age without relying on the user-adjustable Windows date. After Windows restarts,
+a yearly subscription must reconnect to Polar before gamepad creation; a lifetime
+license can use the one-gamepad outage fallback. A confirmed missing, revoked,
+disabled, or mismatched entitlement invalidates the license and removes all
+licensed gamepads.
+Purchase and account-management buttons use the compiled URLs in
 `src/platform/windows/shared/lvh_windows_broker_config.hpp`.
 Enable `Lock buttons` to click-to-toggle behavior for held inputs.
 The resizable window supports a compact width. Its device and control panels

docs/windows-driver.md

@@ -311,21 +311,30 @@ provider failure, the broker retries every 60 seconds. Controllers that already
 exist are retained for one hour unless the broker service restarts, but no
 additional controller can be created while at least one licensed controller
 remains active. When the outage reaches one hour, the broker removes excess
-licensed controllers and retains at most one until online validation succeeds.
-Failed driver destruction requests remain tracked and are retried instead of
-being treated as successful revocations.
+licensed controllers and retains at most one. A yearly subscription authorization
+is current for at most the daily validation interval plus that one-hour outage
+allowance; after 25 hours without successful validation, the remaining licensed
+controller is also removed. A lifetime license can retain the one-controller
+fallback until online validation succeeds. Failed driver destruction requests
+remain tracked and are retried instead of being treated as successful revocations.
 
 Polar's HTTPS `Date` response header supplies trusted time when a new
-authorization is issued. A yearly license ends exactly at its reported
-`expires_at`; the one-hour outage retention does not extend that expiration. A
-lifetime license has no calendar expiration. The broker advances Polar's trusted
-timestamp using Windows uptime and stores a random marker in a volatile registry
-key for the current boot session. This works across broker service restarts and
-includes sleep or hibernation, but never consults the user-adjustable Windows
-date. After Windows restarts, the marker changes, so a yearly license must
-reconnect to Polar before gamepad creation; lifetime licenses can use the
-one-gamepad outage fallback. Explicit validation requests always contact the
-provider. The sole exception to normal licensing is
+authorization is issued. Both supported plans rely on Polar's entitlement status
+rather than a locally enforced calendar expiration. Subscription keys remain
+granted while their subscription is billable, and Polar revokes the benefit when
+the subscription entitlement ends. Polar's public license validation response
+does not include the subscription renewal date, so the broker does not fabricate
+one; customers can see the authoritative date in the linked Polar account portal.
+The one-hour outage retention does not extend the yearly subscription's 25-hour
+validation deadline.
+
+The broker advances Polar's trusted timestamp using Windows uptime and stores a
+random marker in a volatile registry key for the current boot session. This works
+across broker service restarts and includes sleep or hibernation, but never
+consults the user-adjustable Windows date. After Windows restarts, the marker
+changes, so a yearly subscription must reconnect to Polar before gamepad creation;
+a lifetime license can use the one-gamepad outage fallback. Explicit validation
+requests always contact the provider. The sole exception to normal licensing is
 for CI runners where the broker service itself has the `GITHUB_ACTIONS`
 environment marker. That environment receives one machine-scoped five-minute
 evaluation window beginning with its first unlicensed creation attempt. The
@@ -336,15 +345,17 @@ separately running service.
 
 Polar's `limit_activations` value is the machine limit and is configured as `5`
 on both license-key benefits. The broker gives yearly and lifetime licenses the
-same full local access when the provider reports the key status as `granted`. Polar
-revokes a subscription benefit when its entitlement ends. Licensed access has
-no local active-device cap after successful validation. A definitive missing
-activation, revoked or disabled key, activation mismatch, disallowed benefit,
-explicit deactivation, or exact yearly expiration prevents new gamepads and
-causes the broker to destroy existing licensed gamepads. A timeout or other
+same full local access when the provider reports the key status as `granted`.
+Polar revokes a subscription benefit when its entitlement ends. Licensed access
+has no local active-device cap after successful validation. A definitive missing
+activation, revoked or disabled key, activation mismatch, disallowed benefit, or
+explicit deactivation prevents new gamepads and causes the broker to destroy
+existing licensed gamepads. A timeout or other
 transient provider failure starts the one-hour retention period and one-gamepad
-creation limit instead of immediately revoking existing controllers. WinHTTP resolve, connect, send, and receive
-operations have explicit timeouts of 5, 5, 5, and 10 seconds respectively.
+creation limit instead of immediately revoking existing controllers. A yearly
+subscription that cannot validate for 25 hours is also denied until it reconnects.
+WinHTTP resolve, connect, send, and receive operations have explicit timeouts of
+5, 5, 5, and 10 seconds respectively.
 
 ## Profile Compatibility
 
@@ -393,9 +404,10 @@ label because VHF does not provide a product/manufacturer string callback.
   packages require a Microsoft dashboard signing path that is not part of the
   current Azure Trusted Signing workflow.
 - A temporary Polar outage limits a previously activated machine to one active
-  licensed gamepad until validation succeeds. Yearly licenses receive no
-  post-expiration grace. Definitive invalidation or exact expiration prevents
-  new gamepads and removes active licensed gamepads.
+  licensed gamepad. Yearly subscriptions must reconnect within 25 hours of their
+  last successful validation; lifetime licenses can retain one gamepad until
+  validation succeeds. Definitive invalidation prevents new gamepads and removes
+  active licensed gamepads.
 
 ## Signing
 

src/include/libvirtualhid/license.hpp

@@ -37,7 +37,6 @@ namespace lvh {
     std::uint32_t activation_usage = 0;  ///< Machine activations currently used by the license.
     std::string plan_name;  ///< Human-readable plan name, when available.
     std::string customer_email;  ///< Customer email associated with the license, when available.
-    std::string expires_at;  ///< Provider-formatted expiration timestamp, when applicable.
     std::string message;  ///< Human-readable license service status.
     std::string purchase_url;  ///< Hosted page where a license can be purchased.
     std::string manage_account_url;  ///< Hosted page where the customer can manage activations.