@@ -7,6 +7,17 @@
 > RetroAchievements, and Lua** to a follow-up point release. A shared **`rustynes-mobile`**
 > bridge crate is factored here and reused by the v1.9.0 iOS plan.
 
+> **Monetization LOCKED by the maintainer (2026-06-19):** ship on the **Google Play Store**
+> as a **free download with a one-time in-app "Full Unlock" purchase priced at $2.99 USD**
+> (a managed/non-consumable IAP via Play Billing — the modern single-listing freemium model,
+> NOT two separate paid/free listings). The **free tier is a time-limited demo**: a **10-minute
+> play session per launch**, and with **save-states, save-on-background/resume, and on-cart
+> battery-backed SRAM persistence all disabled**. Everything else (full emulation accuracy,
+> video, audio, input, pause/fast-forward, the whole ROM library) is **identical to the paid
+> tier** — the demo is feature-complete except the three persistence gates + the session timer.
+> Purchasing the Full Unlock removes the timer and enables save-states / resume / SRAM. See the
+> "Monetization / licensing (Workstream M)" section below.
+
 Research backing: [`research/v1.8.0-research-android.md`](research/v1.8.0-research-android.md).
 
 ## Context
@@ -161,6 +172,41 @@ language + the 2026–27 developer-verification rollout by (1) preparing dev ver
 depends solely on Play (also the home for the egui-debugger power-user build). **Effort: M;
 approval/calendar risk is outside our control.**
 
+### M — Monetization / licensing (freemium $2.99 unlock)  → rc.1
+A **single free Play listing** with a **one-time, non-consumable in-app purchase** ("Full
+Unlock", product id `full_unlock`, **$2.99 USD**) via the **Play Billing Library** (`com.android.
+billingclient:billing-ktx`, v7+). NOT a paid app and NOT a second "demo" listing — Play's modern
+guidance is one free app + an unlock IAP. Pieces:
+
+- **`Entitlement` / `BillingManager`** (new Kotlin): on start, connect `BillingClient`, query the
+  `full_unlock` product + the user's purchases, and expose a `@Volatile isUnlocked` the shell
+  reads. A purchase must be **acknowledged** (`acknowledgePurchase`) or Play auto-refunds in 3
+  days. Entitlement is cached locally (DataStore) for offline launches but is **re-verified
+  against Play** on each connect (the cache is a convenience, not the source of truth). No
+  server: a non-consumable IAP is owned forever and restored via `queryPurchasesAsync` (handles
+  reinstall / new device / "restore purchases").
+- **Demo gating (the three locks + the timer), all enforced in the shell, core untouched:**
+  1. **10-minute session timer** — a monotonic per-launch budget; on expiry, pause the emulator
+     and show a non-dismissable "Demo time's up — Unlock full version for $2.99" sheet with the
+     Buy + Restore buttons. Resets on next launch (per-session, not per-day).
+  2. **Save-states disabled** — the Save/Load slot buttons are hidden/disabled in demo.
+  3. **Save-on-background + auto-resume disabled** — `onPause` writes no `auto` state and a ROM
+     never auto-resumes in demo.
+  4. **Battery-backed SRAM not persisted** — the on-cart save RAM is never written to disk in
+     demo (a battery save inside the snapshot is fine in-session, but nothing survives close).
+  When `isUnlocked` flips true (purchase or restore), all four lift immediately, no restart.
+- **UI:** an always-visible "Unlock ($2.99)" affordance in demo; a "Restore purchase" entry; a
+  subtle "Demo — N:MM left" indicator. After unlock, these disappear.
+- **Determinism-safe / accuracy-safe:** every gate is a *host* policy over persistence + pacing;
+  the emulated framebuffer/audio for a given input is **byte-identical** in demo and paid (the
+  demo is the same emulator, just without the persistence features + a session clock). The core,
+  the `.rns` format, and AccuracyCoin are untouched.
+- **Maintainer-manual (can't be CI-self-certified):** create the `full_unlock` managed product
+  in the Play Console, the pricing ($2.99) + tax, a license-tested account, and the closed-track
+  upload to exercise the real purchase flow (Play Billing can't be fully tested on a sideloaded
+  build). A **`BuildConfig`/debug override** (`debug.force_unlocked` / `debug.force_demo`) lets the
+  gating + timer + UI be verified on-device without Play. **Effort: M.**
+
 ### Perf / thermal / battery  *(cross-cutting, in B/C/F)*
 Perf is **not** the gate (the NES is light: ≤2 ms/frame headless, ample on modern arm64) —
 **thermals/battery** are. Default run-ahead **off or 1** on Android (keep the budget-throttle
@@ -177,7 +223,7 @@ run-ahead/fast-forward. **Determinism-safe** — all frontend pacing/scheduling
 | **beta.3 — Audio + input + touch** | C + D | (c) | audio lifecycle/latency; input determinism (touch + gamepad → one mask) |
 | **beta.4 — Storage + SAF + states** | E | (c) | **Risk #3** no-bundled-ROM/SAF + persistable grants; `.rns` cross-device |
 | **beta.5 — Compose shell + feature port** | F | (c) | native feel + parity (shaders/TAS/palettes); RA/netplay/Lua marked deferred |
-| **rc.1 — Store/legal/signing** | G | (c) | **Risk #2** Play policy (partial) + signing + 16 KB align + AAB in CI |
+| **rc.1 — Store/legal/signing + monetization** | G + M | (c) | **Risk #2** Play policy (partial) + signing + 16 KB align + AAB in CI; **freemium $2.99 unlock + 10-min demo gating** |
 | **v1.8.0 release** | docs (`docs/android.md`), CHANGELOG, `rustynes-mobile`+`rustynes-android`+Gradle committed, signed AAB on a closed track + sideload APK | (c) | full host-CI gate suite green; AccuracyCoin 100%/139 |
 
 ## Critical files / crates