@the-inclusionist/engine 10.0.0 → 11.0.0

package/docs/CREDITS.md

@@ -61,10 +61,7 @@ Credit follows what was used. Until that date neural narration relied on:
   **Fangjun Kuang** ([@csukuangfj](https://github.com/csukuangfj)), who packaged Piper voices in the sherpa format.
 - **[Piper](https://github.com/rhasspy/piper)** (Michael Hansen / rhasspy, **MIT**) and the `@mintplex-labs/piper-tts-web` runtime (MIT).
 - **[eSpeak NG](https://github.com/espeak-ng/espeak-ng)** (**GPL-3.0**) — the voices' phonemization (`piper_phonemize`).
-  ⚠️ **Staged for the mirror on 2026-09-22 and ON HOLD** (issue #192): the WebAssembly build of `espeak-ng` 1.0.2 sits in
-  `the-inclusionist-lfs/espeak-ng-1.0.2/`, but the **matching source** the GPL requires beside it (`espeak-ng-1.0.2/source/`)
-  has not been staged, so the upload script skips the folder. A binary served without its source would breach the licence,
-  and a mirror is distribution. What `source/` needs is written in that folder's `LICENSE.md`.
+  It still phonemizes the neural voice, now in the project's own build (under Kokoro, below).
 - **The voices and their dataset licences**, read on 2026-09-14: `pt_BR-faber-medium` (NabuCasa/voice-datasets, CC0),
   `es_MX-claude-high` (HirCoir/Piper-TTS-Spanish, Apache-2.0), `en_US-amy-medium` (MycroftAI/mimic3-voices, «See URL»),
   `en_US-ryan-medium` (roholazandie/ryanspeech, CC BY-NC-SA 4.0). The Dev's answer on Ryan — «nosso projeto não tem fins
@@ -76,16 +73,21 @@ The weights are **Apache-2.0** (`huggingface.co/hexgrad/Kokoro-82M`), trained on
 audio: **Koniwa** (CC BY 3.0) and **SIWIS** (CC BY 4.0), credited here. The ONNX export used is `onnx-community/Kokoro-82M-v1.0-ONNX`.
 
 What speaks it, fetched by the engine beside the model: **[eSpeak NG](https://github.com/espeak-ng/espeak-ng)**
-(`espeak-ng` 1.0.2, **GPL-3.0-or-later**) turns the sentence into phonemes, and
+(by Jonathan Duddington, Reece H. Dunn and its contributors; **GPL-3.0-or-later**) turns the sentence into phonemes, and
 **[ONNX Runtime Web](https://github.com/microsoft/onnxruntime)** (`onnxruntime-web` 1.27.0, **MIT**, Microsoft) runs the graph.
 
 - **Kokoro-82M** (catalogue `voz:kokoro:*`: the fp32 model, the tokenizer and one style table per voice) — **Apache-2.0**.
   Licence statement and NOTICE: `the-inclusionist-lfs/kokoro-82m-v1.0-onnx/LICENSE.md` and `NOTICE.md`; the Apache-2.0 text
   itself is upstream (`huggingface.co/hexgrad/Kokoro-82M`), not held in that folder.
-- **eSpeak NG in WebAssembly** (catalogue `voz:runtime:fonemas*`: `espeak-ng.js` and `espeak-ng.wasm` from the npm package
-  `espeak-ng` 1.0.2, built by the `ianmarmour/espeak-ng.js` repository) — **GPL-3.0-or-later**, as its `package.json`
-  declares. The package carries the GPL-3.0 text (`LICENSE`) and no copyright line of its own; the eSpeak NG revision the
-  build was made from is not stated in the package. The source obligation is the one written under Piper above.
+- **eSpeak NG in WebAssembly** (catalogue `voz:runtime:fonemas*`: `espeak-ng.js` and `espeak-ng.wasm`) — **GPL-3.0-or-later**,
+  **built by the project** from eSpeak NG commit `530bf0ab` (issue #192) with `scripts/models/build-espeak-ng.ps1`, which pins
+  that commit, the Emscripten image and every flag; its data is cut to the pt, es and en voices (and the de and fr
+  dictionaries Portuguese hands words to). It replaces the npm package `espeak-ng` 1.0.2 (`ianmarmour/espeak-ng.js`), whose
+  eSpeak NG revision the package never stated: built from `530bf0ab`, the project's build carries that package's data byte for
+  byte and gives the same phonemes (`docs/6-DevOps-SRE/models.md`). **Corresponding Source** (GPL-3.0 §6): the commit and the
+  recipe, both staged beside the build in `the-inclusionist-lfs/espeak-ng-530bf0a/corresponding-source/` with `LICENSE`, `NOTICE` and a
+  `LICENSE.md` naming them; every delivery's folder carries a `SOURCE` note saying where they are
+  (`scripts/licences/third-party.mjs`). The copyright lines are those of the C files compiled into it, listed in its `NOTICE`.
 - **ONNX Runtime Web** (catalogue `voz:runtime:onnx*`: `ort.webgpu.bundle.min.mjs` and the `ort-wasm-simd-threaded.jsep` pair)
   — **MIT**. The bundle's own header: «Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT
   License.» Mirror notice: `the-inclusionist-lfs/onnxruntime-web-1.27.0/LICENSE.md`; the MIT text itself is upstream
@@ -93,7 +95,7 @@ What speaks it, fetched by the engine beside the model: **[eSpeak NG](https://gi
 
 > The voice's files are **downloaded once** — by the build into the delivery's `heavy/` folder, and from there into the
 > device's cache — and run **100% locally** afterwards: no child's audio leaves the device. See ADR-0216 (the engine loads
-> the voice), ADR-0198 and ADR-0207 in `the-inclusionist-docs · docs/2-Architecture/adr/`.
+> the voice), ADR-0198 and ADR-0207 in `docs/2-Architecture/adr/`.
 
 ## The other runtimes and models the engine downloads
 
@@ -183,6 +185,116 @@ The command models (catalogue `commands:model:*`): `vosk-model-small-pt-0.3`, `v
 - **Copyright lines, as each archive's `README` states them:** en-us 0.15 «Copyright 2020 Alpha Cephei Inc»; es 0.42
   «Copyright 2022-2050 AC Technologies LLC»; pt 0.3 **none** (its `README` says only what the model is).
 
+## VLibras translator — LAViD-UFPB `vlibras-translator` 1.3.3 — LGPL-3.0 — BUILD TIME ONLY
+
+What turns the Portuguese a child is shown into the Libras glosses the player signs (ADR-0234, plan item 5b):
+`inclusionist-heavy --libras` runs it once, on the build machine, over the engine's Portuguese dictionary and the game's
+(`scripts/libras-glosses.mjs`, `scripts/libras-glosses/gloss.py`), in its **rule-based mode only** — the neural mode fetches a
+model that declares no licence, and is never asked for. Published on test.pypi.org only; pinned with its hashes in
+`scripts/libras-glosses/uv.lock`.
+
+- **Licence:** **LGPL-3.0**, the `LICENSE` in its 1.3.3 source distribution.
+- **Distributed: none of it.** It runs in an environment outside the repository and nothing of it enters a delivery or the npm
+  package; what a delivery carries is its OUTPUT, `libras/avatar/glosses.json`.
+- **Copyright line** as its sources state it: «Copyright (c) Laboratório de Aplicações de Vídeo Digital - LAViD».
+
+## VLibras sign sources — LAViD-UFPB `vlibras-dictionary-sources`, `.blend` files — GPL-3.0 — EXPORTED, DISTRIBUTED BY `--libras`
+
+What the Libras player deaf mode signs with is built from (ADR-0234, route B, phase B1; the engine's interpreter since phase B3): each sign's Blender 2.79 source,
+`FILES/BLENDS/BR/<NAME>.blend` of the same repository at the same commit `f8ddb378affd0d6da42f04c9fc888dafe1cc1299` — the whole
+avatar (meshes, armature, shape keys, materials) plus one Action named after the sign. Only the signs the engine's glosses use
+and the manual alphabet's letters the player fingerspells from: **655 files, 1,194,114,310 bytes** — the 632 of the glosses
+(1,141,253,870 bytes, with A, D, M and O among them) and the alphabet's 23 other letters, B–Z but those four, and Ç
+(52,860,440 bytes) — each pinned by sha256 and byte count in `scripts/libras-export/sources.json`. Downloaded with the Dev's
+permission (route B's first step; the 23 letters on 2026-09-25) into a folder outside the repository; none is committed.
+
+- **Licence:** the repository declares **GPL-3.0**. What `scripts/libras-export.mjs` makes of them — **one avatar**
+  (`avatar.glb`, glTF 2.0) and **one clip per sign** (three.js AnimationClip JSON) — are **derivatives under GPL-3.0**, and a
+  delivery that carries them carries the GPL-3.0 text and a NOTICE naming the pinned source.
+- **Corresponding source of the exports:** the pinned `.blend` files plus `scripts/libras-export.mjs` and
+  `scripts/libras-export/export.py`, run with the Blender version the export's `manifest.json` names (5.2.2 LTS for the first
+  export).
+- **Changed by this project**, all in the export, none in the sources: the avatar's Blender Internal materials rebuilt as one
+  colour each, with the head's and the body's image (`cabecaAvatarCartoon.png`, `TxCorpo.png`) taken from the sign file `0`,
+  one of the twelve that pack them — most files only point at them by a path on LAViD's machines; the hair's normal map, which
+  no file carries, and two secondary texture slots are left out; the sign's constraints baked into bone tracks and its face's
+  driver-moved shape keys sampled into morph tracks; keys reduced within a stated tolerance; node names as three.js's glTF
+  loader renames them.
+- **Distributed: by a delivery built with `inclusionist-heavy --libras`** (phase B3): the avatar and 655 clips — the
+  632 signs of the first export and the manual alphabet's 23 other letters — **34,283,274 bytes**, each pinned by sha256 in
+  `scripts/libras-avatar.json`, into `libras/avatar/` with the
+  GPL-3.0 text and a NOTICE naming LAViD, the pinned commit and where the Corresponding Source is (`scripts/libras-avatar.mjs`).
+  The npm package carries none of them. One clip is played from a later point than its file starts: FALA's `.blend` action
+  begins at a stray keyframe 1404 frames before the sign, and the pins name the sign's start (46.8 s) with why.
+- **Copyright line: UNVERIFIED** — the `.blend` files carry none that was read, and the repository's own `LICENSE` and README
+  were not read.
+
+## three.js 0.186.1 — mrdoob and the three.js authors — MIT
+
+What the free Libras player of route B draws with (ADR-0234 errata, route B, phase B2; the Dev decided it on 2026-09-25): the
+`three` npm package, the one run-time `dependency` of the engine, pinned to exactly `0.186.1`. Only `app/js/ui/libras-avatar-stage.ts`
+imports it — `three` and its glTF loader, `three/addons/loaders/GLTFLoader.js` — and only the player's dynamic `import()` reaches
+that module, at the first sign in deaf mode; a bundler cuts it into a chunk of its own (627 KB, 158 KB gzip), which the service
+worker does not precache.
+
+- **Licence:** **MIT** («Copyright © 2010-2026 three.js authors», the package's `LICENSE`). The npm package names it as a
+  dependency, so a consumer's `node_modules/three` carries that `LICENSE`. The built chunk carries the notice too: the build
+  keeps legal comments (`comments: { legal: true }` in `vite.config.ts`), and 📏 the minified
+  `assets/libras-avatar-stage-<hash>.js` holds three.js's two `@license` headers (it held none before the setting; gate
+  `tests/three-arrives-late.node.test.js`). A game that bundles the engine with its own build keeps the notice only if its
+  bundler keeps legal comments too.
+- **Types:** not `@types/three` (not authorised); `app/js/ui/three-subset.d.ts` declares the few classes the stage uses, written
+  here from three.js's documentation.
+- **Changed by this project:** nothing.
+
+## spaCy and its Portuguese model `pt_core_news_md` 3.8.0 — MIT and CC BY-SA 4.0 — BUILD TIME ONLY
+
+The Portuguese pipeline the translator's rules read (part of speech, morphology, dependencies, entities): spaCy 3.8 (Explosion,
+**MIT**) and the model `pt_core_news_md` 3.8.0 (Explosion, **CC BY-SA 4.0**, from the GitHub release of `explosion/spacy-models`),
+both pinned in `scripts/libras-glosses/uv.lock` with the other Python packages they pull.
+
+- **Distributed: none of it** — build time only, outside the repository, like the translator.
+- ⚠️ **Whether a gloss the model helped produce is a derivative of the model** (and so under CC BY-SA 4.0) is **not determined**;
+  this project believes it is not, and that is not a legal opinion. The glosses a delivery writes say what made them
+  (`"made"` in `glosses.json`).
+
+## Fonts — the engine's 19 families and the font library's 194 — SIL OFL 1.1, Apache-2.0 and the Ubuntu Font Licence 1.0
+
+Two homes since ADR-0255:
+
+- **The engine's own faces** — every family `app/public/vendor/fonts.css` declares, 19 families in 29 `.woff2` files in
+  `app/public/vendor/fonts/`: Atkinson Hyperlegible, Atkinson Hyperlegible Mono (Braille Institute), Andika (SIL), Lexend (the
+  Lexend Project) and the fifteen Playwrite hands the typography button can pick (TypeTogether), the latin and latin-ext subsets
+  `fonts.gstatic.com` serves. The service worker precaches them into every install and the npm package ships them, so each copy
+  of the engine redistributes them; `app/public/vendor/fonts-licences/NOTICE.txt` lists each family's copyright line as read
+  from the font, beside `OFL-1.1.txt`. All 19 are under the **SIL OFL 1.1**.
+- **The font library** — every other family, 194 in 291 files, one folder per family in `the-inclusionist-lfs/fonts/`, each
+  folder with its licence text, a `NOTICE.txt` and a `SHA256SUMS`, catalogued with each face's sha256 in
+  `app/js/platform/font-library.json`. A delivery carries only the families its games declare (`inclusionist-heavy --fonts`),
+  each with the same licence text and notice.
+
+- **Licences, as each font states its own** (name IDs 14, 13 and 0 of its `name` table, read on 2026-09-27): **SIL OFL 1.1**
+  for every family but three, all in the library: **Apache-2.0** for Luckiest Guy and Smokum (Brian J. Bonislawsky DBA
+  Astigmatic) and the **Ubuntu Font Licence 1.0** for Ubuntu (Canonical Ltd.). ⚠️ The typographic catalogue
+  (`research/catalogo_tipografico.json`) records «OFL 1.1» for those three as well; the fonts say otherwise, and the fonts are
+  what ships.
+- **Three families stated no licence in their files** — iA Writer Quattro, Monoton and Yatra One — and LEFT the package on
+  2026-09-27 until their licence is established (ADR-0251); none is declared by hand any more.
+- **Licence texts:** the web subsets strip the licence text (only OpenDyslexic keeps it, in name ID 13), so the texts travel as
+  files, kept in `scripts/licences/` and copied beside every family — `OFL-1.1.txt` (copied from OpenDyslexic's licence field,
+  byte-identical to three upstream `OFL.txt` copies held locally), `Apache-2.0.txt` (the heavy files' text) and `UFL-1.0.txt`
+  (decoded from the Debian `fonts-ubuntu` package's copyright file, and verified byte for byte on 2026-09-27 against
+  `google/fonts` `ufl/ubuntu/UFL.txt`).
+- **Reserved Font Names (ADR-0254):** the 21 library families whose name is a Reserved Font Name — Lato, Lora, OpenDyslexic,
+  Playfair Display, Press Start 2P, Quicksand, Source Sans 3, Source Serif 4, UnifrakturMaguntia, Abril Fatface, Alfa Slab One,
+  Bowlby One SC, Cookie, Lilita One, Lobster, Monofett, Petit Formal Script, Plaster, Ranchers, Sancreek, Titan One — and Ubuntu
+  are their AUTHORS' ORIGINALS: OpenDyslexic its author's `compiled/OpenDyslexic-Regular.woff2` (antijingoist/opendyslexic),
+  the others the files `google/fonts` distributes, converted to WOFF2 by compression alone (every table byte-identical to the
+  author's but the two `head` fields WOFF2 writes, and without the `DSIG` a WOFF2 cannot carry), each folder with the author's
+  `OFL.txt` or `UFL.txt` beside its own. **Merriweather** is no longer offered: its original is a 4.5 MB variable font. The
+  other library families are the Google Fonts web subsets, none of them presented under a Reserved Font Name (ADR-0254 measured
+  the 22 that were).
+
 ## Arrow icons — Lucide, derived from Feather (Cole Bemis) — MIT
 
 The eye control draws four arrows over the game (`app/js/ui/gaze-overlay.ts`): Lucide's `arrow-up`, `arrow-right`, `arrow-down` and

package/docs/LICENSES.md

@@ -63,8 +63,9 @@ request `g` of the filing asks to be put on record: the itemized list of those e
 - **Third-party code** — eSpeak NG (GPL-3.0). Clarity (MIT) left this repository with the platformer, and its
   credit travels with `game-platformer`; Piper and sherpa-onnx left (ADR-0207). Detail and attribution in
   [`CREDITS.md`](CREDITS.md).
-  The engine itself loads the neural voice's runtime (ADR-0216): `espeak-ng` 1.0.2 (eSpeak NG in WebAssembly,
-  **GPL-3.0-or-later**, compatible with the AGPL-3.0-or-later) and `onnxruntime-web` 1.27.0 (**MIT**) are catalogued
+  The engine itself loads the neural voice's runtime (ADR-0216): eSpeak NG in WebAssembly (**GPL-3.0-or-later**,
+  compatible with the AGPL-3.0-or-later; built by the project from commit `530bf0ab` with `scripts/models/build-espeak-ng.ps1`,
+  which with that commit is its Corresponding Source, issue #192) and `onnxruntime-web` 1.27.0 (**MIT**) are catalogued
   heavy files (`app/js/platform/heavy-catalogue.ts`), fetched by the build into the delivery's `heavy/` folder and read
   from the page's own origin — only for a game that declares `uses: { neuralVoice: true }`. The published npm package
   carries neither. The other runtimes and models in the same catalogue, each credited in `CREDITS.md`:
@@ -73,20 +74,48 @@ request `g` of the filing asks to be put on record: the itemized list of those e
     here): **MIT**;
   - **commands** — the Vosk browser runtime built here from vosk-browser, vosk-api and Kaldi: **Apache-2.0**, with the
     BSD, Zlib and MIT parts its `NOTICE` lists; the Vosk small models (pt, en-us, es): **Apache-2.0**.
+  - **Libras** — the Libras player deaf mode signs with (ADR-0234, route B), only in a delivery built with
+    `inclusionist-heavy --libras`: one avatar and one clip per sign, which `scripts/libras-export.mjs` exports from LAViD's
+    `vlibras-dictionary-sources` `.blend` files (**GPL-3.0**, pinned in `scripts/libras-export/sources.json`) — **GPL-3.0
+    derivatives** whose Corresponding Source is those `.blend` files plus the two export scripts. The delivery carries them
+    (`libras/avatar/`, pinned in `scripts/libras-avatar.json`) with the GPL-3.0 text and a NOTICE naming that source; the npm
+    package carries none. **Nothing closed and nothing patched is served**: the VLibras Unity player of route A — Unity
+    Technologies' proprietary runtime, with its `eval` rewritten at delivery time — was a declared, temporary exception, and
+    it left the engine and the delivery in phase B3.
+    The Libras **glosses** that delivery carries (`libras/avatar/glosses.json`) are made at build time by LAViD's
+    `vlibras-translator` 1.3.3 (**LGPL-3.0**, rule-based mode only) over spaCy (**MIT**) and its Portuguese model
+    `pt_core_news_md` 3.8.0 (**CC BY-SA 4.0**) — tools the build machine runs, **none of which is distributed**
+    (`scripts/libras-glosses/`). Whether a gloss is a derivative of the model is **not determined**; the project believes it
+    is not, which is not a legal opinion. See `CREDITS.md`.
+    The player that draws the avatar runs on **three.js** 0.186.1 (**MIT**), the engine's one run-time npm `dependency`,
+    pinned exactly and reached only by a dynamic `import()` at the first sign in deaf mode (ADR-0234 errata); the built chunk
+    that carries it keeps three.js's `@license` headers (`CREDITS.md`).
 
   ⚠️ For most of these the project holds a statement of the licence, not its upstream text, and several copyright
   lines are marked **UNVERIFIED** in `CREDITS.md`, which says what each line rests on.
 - **Voices** — only **Kokoro-82M** (Apache-2.0 weights trained on permissive audio; `CREDITS.md`). A voice enters when its licence
   AND its starting point's (the model it was fine-tuned from, and that model's data) have been read — that chain took the Piper
   voices out (ADR-0207, [`notices/2026-09-14-piper-voices-withdrawn.md`](notices/2026-09-14-piper-voices-withdrawn.md)).
-- **Pictograms** — the layer is decided by the **LICENCE and nothing else** (**ADR-0028**): Mulberry,
-  Blissymbolics and Tawasol under CC BY-SA are embeddable; ARASAAC is **downloaded, never redistributed**; Sclera,
-  PCS, SymbolStix and Widgit appear in the menu as **unavailable, awaiting negotiation**.
-  ⚠️ And the **SA** reaches what we alter: a pictogram readjusted to the high-contrast palette
-  (ADR-0011) or to the pixel grid stays CC BY-SA.
+- **Pictograms** — **none is used** (**ADR-0233**, replacing ADR-0028's roster): the only candidates are
+  **ARASAAC** and **PCS**, each only once a licence is obtained, and no licence exists today. Both appear in the menu
+  **locked, with the reason «no licence»**; a set with no recorded licence can never be selected
+  (`tests/aac-sets.node.test.js`).
 - **Typefaces** — roster and restrictions in **ADR-0012**. ⚠️ Ronde and the alternatives OPTIFrench-Script and
   Merveille are **free for personal use only and CANNOT be packaged**: a download is offered, and the
   option stays disabled when none of them is present.
+  The engine **packages** only the faces it draws with itself (ADR-0255) — every family `app/public/vendor/fonts.css`
+  declares, **19 families in 29 `.woff2` files**, all under the **SIL OFL 1.1** — which the service worker precaches into every
+  install and the npm package ships. Every other family is the **font library**, **194 families in 291 files** in
+  `the-inclusionist-lfs/fonts/`: **191 under the SIL OFL 1.1**, **2 under Apache-2.0** (Luckiest Guy, Smokum) and **1 under the
+  Ubuntu Font Licence 1.0** (Ubuntu), each as its own font states it, delivered only where a game declares it
+  (`inclusionist-heavy --fonts`). Every licence asks for the notice and the text to travel **with each copy**, so they sit
+  **beside the fonts**: in `app/public/vendor/fonts-licences/` for the engine's (beside `fonts/`, so the notice revalidates while
+  the fonts keep their year of cache: `NOTICE.txt`, every family with its files, its licence and its copyright line as read from
+  the font, and `OFL-1.1.txt`), and in each library folder and each delivered family's folder for the library's (its licence
+  text and its `NOTICE.txt`; the mirror's folders also carry a `SHA256SUMS`). Made by `scripts/licences/fonts.mjs`, which keeps
+  the three texts; a family without an entry, or under a licence whose text is not kept, is refused
+  (`tests/font-licences.node.test.js`). The library's reserved-name families are their authors' originals (ADR-0254).
+  Attribution in [`CREDITS.md`](CREDITS.md).
 - **Third-party art — THREE DOORS, and what decides is compatibility with the project** (**ADR-0133**), not the
   family a name belongs to. Four questions: may we **derive**? may it be used **commercially**?
   may we **convey** the file in what we publish? does anything **travel** from the source to our output?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-inclusionist/engine",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "type": "module",
   "description": "Accessibility-first (WCAG 2.2 + GAG) engine for educational 2D pixel-art games, built with PixiJS. Screen reader, sonar, high contrast by role, colour-vision filters, remappable input as intent, i18n and offline PWA — the parts every game inherits (ADR-0035, ADR-0036).",
   "comment:exports": [
@@ -35,7 +35,11 @@
     "seventeen families of which none loaded — the child picks one, the menu marks it active, and the browser",
     "draws the system font. No error anywhere. `app/quiz.html` links it now, and",
     "`tests/an-offered-font-loads.node.test.js` holds both halves: no offerable font without a `@font-face`, and",
-    "the host actually loading the sheet."
+    "the host actually loading the sheet.",
+    "`./build` IS A BUILD SCRIPT, NOT ENGINE CODE (ADR-0253): the game's `vite.config` wraps its config in `defineGameBuild`,",
+    "so `vite build` builds its app and `vite build --mode cartridge` its cartridge; `inclusionist-check-cartridge` (bin) runs",
+    "the boot's own refusals on the built cartridge. Both live in `scripts/` and import no package: the types are emitted with",
+    "the game's own `typescript`. `tests/the-engine-builds-both-targets.node.test.js` holds them."
   ],
   "exports": {
     ".": {
@@ -70,6 +74,10 @@
       "types": "./dist-pkg/i18n/*.d.ts",
       "default": "./dist-pkg/i18n/*.js"
     },
+    "./build": {
+      "types": "./scripts/game-build.d.mts",
+      "default": "./scripts/game-build.mjs"
+    },
     "./style.css": "./app/css/style.css",
     "./assets/vendor/*": "./app/public/vendor/*",
     "./package.json": "./package.json"
@@ -109,21 +117,37 @@
     "docs/LICENSES.md",
     "docs/CREDITS.md",
     "scripts/heavy-into-the-delivery.mjs",
-    "scripts/licences"
+    "scripts/game-build.mjs",
+    "scripts/game-build.d.mts",
+    "scripts/check-cartridge.mjs",
+    "scripts/licences",
+    "scripts/libras-glosses.mjs",
+    "scripts/libras-glosses/pyproject.toml",
+    "scripts/libras-glosses/uv.lock",
+    "scripts/libras-glosses/gloss.py",
+    "scripts/libras-avatar.mjs",
+    "scripts/libras-avatar.json"
   ],
   "bin": {
-    "inclusionist-heavy": "scripts/heavy-into-the-delivery.mjs"
+    "inclusionist-heavy": "scripts/heavy-into-the-delivery.mjs",
+    "inclusionist-check-cartridge": "scripts/check-cartridge.mjs"
   },
-  "comment:no-dependencies": [
-    "⚠️ THIS PACKAGE HAS NO `dependencies`, AND THAT IS A MEASURED DECISION (ADR-0094), not an accident.",
+  "comment:dependencies": [
+    "⚠️ THIS PACKAGE HAS ONE `dependency`, AND EACH ONE IS A RECORDED DECISION (ADR-0094), never an accident.",
     "Embedded code that names a package the consumer's npm does not install publishes an engine that does not compile (ADR-0093);",
     "a neural provider in `dependencies` lands its runtime in every consumer, a game that never speaks neurally included.",
-    "The engine now LOADS that voice itself (ADR-0216) and still declares nothing: espeak-ng and onnxruntime-web are catalogued heavy",
+    "The engine LOADS that voice itself (ADR-0216) and declares nothing for it: espeak-ng and onnxruntime-web are catalogued heavy",
     "files, fetched by the build into `heavy/` and read from the page's own origin — so they are in nobody's `node_modules`, here",
     "included. A game says `uses: { neuralVoice: true }`, and a game that does not say it downloads none of it.",
-    "`tests/engine-package.node.test.js` holds both directions: no embedded module names an undeclared package, and nothing declared",
-    "is left without a module naming it."
+    "THE ONE: three.js 0.186.1 (MIT), pinned exactly — the free Libras player draws with it (ADR-0234 errata, route B). It is",
+    "reached only by the dynamic `import()` of `ui/libras-avatar-stage` at the first sign in deaf mode, so a bundler cuts it into",
+    "a chunk of its own and a child who never turns deaf mode on never downloads it.",
+    "`tests/engine-package.node.test.js` holds both directions — no embedded module names an undeclared package, and nothing declared",
+    "is left without a module naming it — and that no dependency enters without a recorded reason, at an exact version."
   ],
+  "dependencies": {
+    "three": "0.186.1"
+  },
   "comment:peerDependencies": [
     "PixiJS is a PEER, not a dependency. Measured on the emitted package (2026-09-05): exactly TWO shipped",
     "modules import it — `render/canvas` and `render/minimap` — plus their two `.d.ts`. A consumer that",
@@ -144,6 +168,7 @@
     "prepare": "npm run build:pkg",
     "prepack": "npm run build:pkg",
     "heavy:delivery": "npm run build:pkg && node scripts/heavy-into-the-delivery.mjs dist --kokoro",
+    "libras:setup": "node scripts/heavy-into-the-delivery.mjs --libras-setup",
     "preview": "vite preview",
     "typecheck": "tsc --noEmit",
     "validate": "npm run typecheck && vitest run && npm run build:pkg && vite build",

package/scripts/check-cartridge.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// THE CARTRIDGE CHECKER — `inclusionist-check-cartridge [built entry]` (ADR-0253). Default entry: `dist-lib/cartridge.js`, where
+// the engine's build (`@the-inclusionist/engine/build`, `vite build --mode cartridge`) puts it.
+//
+// It IMPORTS the built cartridge and runs on what it exports the SAME list `createGame` and `mount()` refuse a cartridge with —
+// `cartridgeRefusals`, from the engine this script ships in. A cartridge that compiles and breaks the contract is refused here,
+// in the game's CI, instead of in the platform the day it is installed. One line per problem, in the `problems` shape: the subject
+// by name, and the fix.
+//
+// ⚠️ WHAT IT READS IS ADR-0139 §2's `Cartridge`, as the entry's DEFAULT export: `{ slug, declaration, hooks, create }`. The
+// declaration and the hooks are read at import, before `create(ctx)` runs, because that is when `createGame` reads them too.
+// ⚠️ AND IT IMPORTS IN NODE, WITH NO PAGE. A cartridge runs nothing until `create(ctx)` (ADR-0139 §2): one whose import needs a
+// `document` would already be touching the platform's page when it is merely installed, and the import's error is the line.
+//
+// Exit codes: 0 the contract holds · 1 the cartridge is refused (the lines say why) · 2 this engine was never built (`dist-pkg/`).
+import { existsSync, realpathSync } from 'node:fs';
+import { relative, resolve, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+/** Where the engine's build writes the cartridge — `CARTRIDGE_DIR/CARTRIDGE_FILE` of `game-build.mjs`. */
+export const DEFAULT_ENTRY = 'dist-lib/cartridge.js';
+
+/** The compiled composition root of the package this script ships in, which owns the refusals. */
+export const REFUSALS_MODULE = new URL('../dist-pkg/boot/create-game.js', import.meta.url);
+
+/**
+ * The problems of a built cartridge, EMPTY when it holds. `refusals` is the engine's `cartridgeRefusals`.
+ * The four shape lines come first because without them there is nothing to hand the engine's list.
+ */
+export async function checkCartridge(entryPath, refusals) {
+  const shown = shownPath(entryPath);
+  if (!existsSync(entryPath)) {
+    return [`${shown}: missing - this game does not build its cartridge with the engine's build: wrap vite.config in defineGameBuild from @the-inclusionist/engine/build and run \`vite build --mode cartridge\` (ADR-0253)`];
+  }
+  let mod;
+  try {
+    mod = await import(pathToFileURL(entryPath).href);
+  } catch (e) {
+    return [`importing the cartridge threw: ${messageOf(e)} - a cartridge runs nothing until create(ctx) (ADR-0139 §2), so importing it must need no page`];
+  }
+  const cartridge = mod.default;
+  if (!cartridge || typeof cartridge !== 'object') {
+    return ['default export: missing - the built entry exports the cartridge as its default, { slug, declaration, hooks, create } (ADR-0139 §2)'];
+  }
+  const shape = [];
+  if (typeof cartridge.slug !== 'string' || !cartridge.slug.trim()) shape.push('slug: missing - the repository and package name, one word (ADR-0082 §1)');
+  if (typeof cartridge.create !== 'function') shape.push('create: must be a function - the shell calls create(ctx) to start the game, and nothing runs before it (ADR-0139 §2)');
+  try {
+    return [...shape, ...refusals(cartridge.declaration, cartridge.hooks)];
+  } catch (e) {
+    return [...shape, `the declaration threw while the engine checked it: ${messageOf(e)} - createGame and mount read it at boot, before create(ctx) runs`];
+  }
+}
+
+/** A path as the reader typed it: relative to where the check runs, with forward slashes on every system. */
+const shownPath = (p) => (relative(process.cwd(), p) || p).split(sep).join('/');
+
+const messageOf = (e) => (e instanceof Error ? e.message : String(e));
+
+// Run as a program (directly, or through the `inclusionist-check-cartridge` shim, which may be a symlink): compare real paths.
+const run = (() => { try { return realpathSync(process.argv[1] ?? '') === realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+if (run) {
+  if (!existsSync(fileURLToPath(REFUSALS_MODULE))) {
+    console.error('dist-pkg/boot/create-game.js is missing beside this script: in the engine repository, run `npm run build:pkg` first');
+    process.exit(2);
+  }
+  const { cartridgeRefusals } = await import(REFUSALS_MODULE.href);
+  const entry = resolve(process.argv[2] ?? DEFAULT_ENTRY);
+  const problems = await checkCartridge(entry, cartridgeRefusals);
+  const shown = shownPath(entry);
+  if (problems.length) {
+    console.error(`✗ cartridge ${shown}: ${problems.length} problem(s) — createGame and mount would refuse it (ADR-0253):`);
+    for (const p of problems) console.error(`  · ${p}`);
+    process.exit(1);
+  }
+  console.log(`✓ cartridge ${shown}: the engine's contract holds.`);
+}

package/scripts/game-build.d.mts

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// The types of `@the-inclusionist/engine/build` (`scripts/game-build.mjs`, ADR-0253). Written by hand because the module is a
+// build script the game's Vite loads in Node, not a module of the engine's browser code that `tsconfig.pkg.json` compiles.
+// `vite` is named only as a TYPE: the game has it, since it is what the game builds with.
+import type { ConfigEnv, UserConfig, UserConfigFnPromise } from 'vite';
+
+/** The Vite mode that builds the cartridge; every other mode is the app, Vitest's `test` included. */
+export declare const CARTRIDGE_MODE: 'cartridge';
+/** Where the cartridge lands, relative to the game's root. */
+export declare const CARTRIDGE_DIR: 'dist-lib';
+/** The cartridge's module inside `CARTRIDGE_DIR`; `cartridge.d.ts` is its types. */
+export declare const CARTRIDGE_FILE: 'cartridge.js';
+/** The engine and the shared render libraries (ADR-0140 §4): external in the cartridge, as prefixes. */
+export declare const CARTRIDGE_EXTERNAL: readonly RegExp[];
+
+export interface GameBuild {
+  /** The cartridge's entry, relative to the game's root — e.g. `src/index.ts`. Its default export is the cartridge. */
+  readonly cartridge: string;
+  /** The game's Vite config for the APP (the standalone PWA), exactly as it would be written without this wrapper. */
+  readonly config?: UserConfig | ((env: ConfigEnv) => UserConfig | Promise<UserConfig>);
+}
+
+/** The one declaration a game writes: `vite build` builds its app, `vite build --mode cartridge` its cartridge. */
+export declare function defineGameBuild(build: GameBuild): UserConfigFnPromise;
+

package/scripts/game-build.mjs

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// THE BUILD OF BOTH TARGETS OF A GAME — published as `@the-inclusionist/engine/build` (ADR-0253, ADR-0140 §1).
+//
+// ========================= WHAT A GAME WRITES =========================
+// Its `vite.config.ts` wraps the config it already has and names its cartridge's entry — one declaration:
+//
+//     import { defineGameBuild } from '@the-inclusionist/engine/build';
+//     export default defineGameBuild({ cartridge: 'src/index.ts', config: { root: 'app', plugins: [VitePWA({ … })], … } });
+//
+//   · `vite build`                  → the APP: the game's own config, untouched — the standalone PWA with the engine bundled.
+//   · `vite build --mode cartridge` → the CARTRIDGE: `dist-lib/cartridge.js` + `dist-lib/cartridge.d.ts`, the engine and the
+//                                     shared render libraries external. Everything else in the game's config (plugins,
+//                                     `define`, `resolve`, `css`) still applies, so a plugin both targets need is written once.
+//
+// ========================= WHY THE ENGINE OWNS THE CARTRIDGE AND NOT THE APP =========================
+// Measured on 2026-09-27, before this existed: five of seven games declared a `build:lib`, each differently — a mode, a second
+// config file, an npm lifecycle variable, an environment variable, a script — and one had none. What they were all writing is
+// the same four decisions, and each is the engine's to make, because each is about what the PLATFORM receives:
+//   1. the engine, PixiJS and Zdog stay EXTERNAL, matched as PREFIXES — an exact string externalises the bare name and silently
+//      inlines every subpath, which is how every game imports (the 15-puzzle measured 35 kB turning into 74.5 kB);
+//   2. no `public/`: Vite copies it into every build, and a cartridge declares no delivery (ADR-0117) — chess once shipped 7 MB;
+//   3. no service worker: the PWA plugin is dropped, since a second worker would claim the platform's origin (ADR-0140 §1);
+//   4. types emitted, for the one entry: a platform that cannot type the cartridge has a contract that is a comment.
+// The APP stays the game's: its manifest, colours and precache budget are statements about THAT game (ADR-0140 §3).
+//
+// ⚠️ THIS FILE IMPORTS NO PACKAGE, on purpose. A Vite config is data, so nothing here needs `vite`; the types are emitted with the
+// GAME's own `typescript`, resolved from the game's root, because a game builds with its own tools and the engine declares no
+// build-time dependency on anyone's behalf (ADR-0119).
+import { createRequire } from 'node:module';
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
+
+/** The Vite mode that builds the cartridge. The app is every other mode, which is what keeps `vite build` and Vitest untouched. */
+export const CARTRIDGE_MODE = 'cartridge';
+
+/** Where the cartridge lands, relative to the game's root — one place, so the shared CI and the checker need no argument. */
+export const CARTRIDGE_DIR = 'dist-lib';
+
+/** The cartridge's module; its types are `cartridge.d.ts` beside it, and its stylesheet, when it has one, `cartridge.css`. */
+export const CARTRIDGE_FILE = 'cartridge.js';
+
+/**
+ * What a cartridge never carries: the engine and the shared render libraries of ADR-0140 §4. A platform installs ONE of each for
+ * every game, and one bundled into a cartridge is a second copy of its module state — two blind-mode flags, two dictionary
+ * tables, two random streams on one page.
+ */
+export const CARTRIDGE_EXTERNAL = [/^@the-inclusionist\/engine(\/|$)/, /^pixi\.js(\/|$)/, /^zdog(\/|$)/];
+
+/**
+ * THE ONE DECLARATION. `cartridge` is the entry, relative to the game's root (where `package.json` is and where npm and CI run);
+ * `config` is the game's Vite config for the app, an object or a function of Vite's `env`, exactly as it was written before.
+ */
+export function defineGameBuild({ cartridge, config } = {}) {
+  if (typeof cartridge !== 'string' || !cartridge.trim()) {
+    throw new Error('defineGameBuild: `cartridge` must name the cartridge entry, e.g. "src/index.ts" - it is the one thing the engine cannot guess (ADR-0253)');
+  }
+  return async (env) => {
+    const app = (typeof config === 'function' ? await config(env) : config) ?? {};
+    return env.mode === CARTRIDGE_MODE ? cartridgeConfig(app, cartridge, process.cwd()) : app;
+  };
+}
+
+/** The app's config turned into the cartridge's: the game's settings, with the four decisions above laid over them. */
+function cartridgeConfig(app, cartridge, root) {
+  const entry = resolve(root, cartridge);
+  return {
+    ...app,
+    publicDir: false,
+    plugins: [...withoutServiceWorker(app.plugins), cartridgeTypes(entry, root)],
+    build: {
+      outDir: join(root, CARTRIDGE_DIR),
+      emptyOutDir: true,
+      target: 'es2022',
+      lib: { entry, formats: ['es'], fileName: () => CARTRIDGE_FILE, cssFileName: 'cartridge' },
+      rolldownOptions: { external: CARTRIDGE_EXTERNAL },
+    },
+  };
+}
+
+/**
+ * The game's plugins minus `vite-plugin-pwa` (every plugin it registers is named `vite-plugin-pwa` or `vite-plugin-pwa:…`).
+ * Arrays are flattened, because `VitePWA()` returns one; a plugin that is still a promise is kept, since its name is unknown.
+ */
+function withoutServiceWorker(plugins) {
+  return [plugins ?? []].flat(Infinity).filter((p) => !(p && typeof p === 'object' && /^vite-plugin-pwa(:|$)/.test(String(p.name ?? ''))));
+}
+
+/** The plugin that writes the cartridge's types once the bundle is on disk. */
+function cartridgeTypes(entry, root) {
+  return { name: 'inclusionist:cartridge-types', apply: 'build', writeBundle: () => emitCartridgeTypes(entry, root) };
+}
+
+/**
+ * THE TYPES OF THE CARTRIDGE, from the game's own `tsconfig.json`, for the entry's import graph and nothing else — the tests and
+ * the standalone shell are not reached from the entry, so they are not published (a platform would be invited to call the shell).
+ *
+ * ⚠️ `.ts` SPECIFIERS ARE REWRITTEN TO `.js` IN THE EMITTED `.d.ts`. The games import `./board.ts` with the extension, and
+ * TypeScript 5.9 keeps a type-only re-export's specifier as written (measured in `game-2048`): a consumer resolving it finds no
+ * `.ts`, and the package installs cleanly with no types.
+ */
+function emitCartridgeTypes(entry, root) {
+  const ts = createRequire(join(root, 'package.json'))('typescript');
+  const configPath = join(root, 'tsconfig.json');
+  if (!existsSync(configPath)) throw new Error(`cartridge types: there is no tsconfig.json in ${root} - the cartridge's types are emitted with the game's own settings`);
+  const host = { getCanonicalFileName: (f) => f, getCurrentDirectory: () => root, getNewLine: () => '\n' };
+  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+    ...ts.sys,
+    onUnRecoverableConfigFileDiagnostic: (d) => { throw new Error(`cartridge types: ${ts.formatDiagnostics([d], host)}`); },
+  });
+  const outDir = join(root, CARTRIDGE_DIR, 'types');
+  const options = {
+    ...parsed.options,
+    noEmit: false, declaration: true, emitDeclarationOnly: true, declarationMap: false, sourceMap: false,
+    inlineSourceMap: false, composite: false, incremental: false, tsBuildInfoFile: undefined, noEmitOnError: false,
+    outDir, rootDir: root,
+  };
+  const program = ts.createProgram({ rootNames: [entry], options });
+  const result = program.emit();
+  const failures = [...program.getOptionsDiagnostics(), ...result.diagnostics];
+  if (failures.length) throw new Error(`cartridge types: ${ts.formatDiagnostics(failures, host)}`);
+
+  for (const file of declarationsUnder(outDir)) {
+    const before = readFileSync(file, 'utf8');
+    const after = before.replace(/((?:from|import\()\s*['"])(\.{1,2}\/[^'"]*?)\.([cm]?)ts(['"])/g, '$1$2.$3js$4');
+    if (after !== before) writeFileSync(file, after);
+  }
+
+  const entryTypes = join(outDir, relative(root, entry)).replace(/\.[cm]?[jt]sx?$/, '.d.ts');
+  if (!existsSync(entryTypes)) throw new Error(`cartridge types: TypeScript emitted no declaration for ${relative(root, entry)}`);
+  const from = './' + relative(join(root, CARTRIDGE_DIR), entryTypes).split(sep).join('/').replace(/\.d\.ts$/, '.js');
+  const hasDefault = /\bexport\s+default\b|\bas\s+default\b/.test(readFileSync(entryTypes, 'utf8'));
+  writeFileSync(join(root, CARTRIDGE_DIR, 'cartridge.d.ts'),
+    `export * from '${from}';\n${hasDefault ? `export { default } from '${from}';\n` : ''}`);
+}
+
+/** Every `.d.ts` under a folder, at any depth. */
+function declarationsUnder(dir) {
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).flatMap((name) => {
+    const path = join(dir, name);
+    if (statSync(path).isDirectory()) return declarationsUnder(path);
+    return path.endsWith('.d.ts') ? [path] : [];
+  });
+}