@the-inclusionist/engine 8.0.0 → 10.0.0

package/dist-pkg/ui/where-the-child-is.js

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// ui/where-the-child-is — WHERE THE CHILD IS NOW, AND WHAT THAT PLACE SAYS (ADR-0159 rule 3; ADR-0221 step 7c).
+//
+// «Opening a menu or panel speaks its title; closing it speaks where the child is back to; entering play is announced.»
+// 📏 Measured in the dist on 2026-09-12, before that rule was built: SELECT opened the card in silence, and a panel
+// opened, closed and went back to the root without a word. A child who plays by ear was moved without being told.
+//
+// WHAT THIS ANSWERS, AND WHY IT IS ONE QUESTION
+// Two things at once, and they belong together: a KEY, which is what «did she move?» is decided on, and the SENTENCE
+// to say when she did. Splitting them would let a caller compare one and speak the other, which is the defect the key
+// exists to prevent — an arrow inside a menu changes no `hidden`, so it must not read as a change of place.
+//
+// WHY IT IS NOT IN THE COMPOSITION ROOT
+// It used to be, and it was the densest function in `boot/create-game` after the root's own body: 19 branches in 24
+// lines. A root holds WIRING (ADR-0221's erratum: its debt is paid when the BRANCHES tend to zero), and «is this a
+// panel, a list of the pause card, or play, and what is its name» is a rule with a reason, not a wire.
+//
+// ⚠️ THE DOM ARRIVES BY QUESTION AND NOT BY GLOBAL: the overlay on top, the open card and the focused element are
+// asked of whoever owns the document. That is what lets a case drive it without a root, and what keeps the module out
+// of the `globalReach` ratchet (ADR-0221 step 7d).
+import { navigableItems } from './menu-items.js';
+import { announceItem } from './item-announcement.js';
+import { controlParts } from './menu-nav.js';
+import { PM_VISIBLE_ITEMS } from './pause-icons.js';
+import { accessibleLabel } from '../core/accessible-label.js';
+/** Title and item joined the way a screen reader reads them: the place first, then where the cursor is in it. */
+const say = (title, item) => [title, item].filter(Boolean).join('. ');
+/** A PANEL: its title, and the item the focus is on — not the first, because the child may have walked into it. */
+function panelPlace(panel, ctx) {
+    const title = panel.querySelector('h2')?.textContent?.trim() ?? '';
+    const items = navigableItems(panel.querySelector('.overlay__card') ?? panel);
+    const focused = items.indexOf(ctx.focused());
+    const n = focused >= 0 ? focused : 0;
+    const item = items[n] ? announceItem(ctx.t, { ...controlParts(ctx.t, items[n]), position: n + 1, total: items.length }, ctx.withIndex()) : '';
+    // ⚠️ THE KEY NAMES WHICH PANEL. Two panels reading as the same place is a child moving from the sound panel to the
+    // visual one in silence — and going from one panel straight to another is a real path: «map the keyboard» opens the
+    // controls panel on top of the motor one.
+    return { key: `painel:${panel.id}`, sentence: say(title, item) };
+}
+/** THE PAUSE CARD: which list of it is showing, named by the item that opens it, and the item under the cursor. */
+function cardPlace(card, ctx) {
+    const sub = card.querySelector('.pause-menu:not([hidden])')?.dataset.sub ?? 'raiz';
+    // a submenu is named by the item that opens it; the root by the card's title
+    const door = sub === 'opcoes' ? 'options' : sub === 'jogo' ? 'opcoesdojogo' : null;
+    const button = door ? card.querySelector(`.pm-btn[data-act="${door}"]`) : null;
+    const title = button ? accessibleLabel(button) : (card.querySelector('h2')?.textContent?.trim() ?? '');
+    const items = [...card.querySelectorAll(PM_VISIBLE_ITEMS)];
+    // 📌 THE MARKED ITEM AND NOT THE FIRST: coming back from a panel, the cursor is on the row that opened it. Naming
+    // the first row would send a child who cannot see the mark looking where she is not.
+    const marked = card.querySelector('.pm-sel') ?? items[0];
+    const item = marked ? announceItem(ctx.t, { label: accessibleLabel(marked), position: items.indexOf(marked) + 1, total: items.length }, ctx.withIndex()) : '';
+    // ⚠️ AND THE KEY CARRIES THE LIST: the root and a submenu are the same card with different rows, so a key that
+    // stopped at the card's id would make entering the settings a non-event.
+    return { key: `cartao:${card.id}:${sub}`, sentence: say(title, item) };
+}
+/**
+ * The place, in the order the screen reads: a panel sits over the card, the card sits over the game.
+ *
+ * 📌 PLAY HAS NO SENTENCE HERE and that is deliberate: «back to the game» is the caller's word for its own world, and
+ * this module has no business naming a game it does not know.
+ */
+export function whereTheChildIs(ctx) {
+    const panel = ctx.topVisibleOverlay();
+    if (panel)
+        return panelPlace(panel, ctx);
+    const card = ctx.pauseCard();
+    if (card)
+        return cardPlace(card, ctx);
+    return { key: 'jogo', sentence: null };
+}

package/docs/CREDITS.md

@@ -1,18 +1,23 @@
-# Créditos e atribuições de terceiros
+# Credits and third-party attributions
 
-O código de **The Inclusionist** é AGPL-3.0-or-later. Partes de terceiros abaixo mantêm suas próprias licenças.
+The code of **The Inclusionist** is AGPL-3.0-or-later. The third-party parts below keep their own licences.
 
 ## Clarity — Adam Brooks (dissimulate) — MIT
 
-As **mecânicas de plataforma** partiram do projeto **Clarity**, de Adam Brooks (dissimulate), sob licença
-**MIT**. O **mapa** (`app/assets/levels/clarity.map.txt`, batizado em homenagem) foi **fortemente adaptado** do
-nível do Clarity — com modificações cirúrgicas de layout e mudança de significado de vários tiles — não é uma
-cópia, mas uma obra derivada. A atribuição abaixo cobre a porção de origem.
+The **platform mechanics** started from the **Clarity** project, by Adam Brooks (dissimulate), under the
+**MIT** licence. The **map** (`clarity.map.txt`, named in its honour) was **heavily adapted** from
+Clarity's level — with surgical layout changes and a change of meaning of several tiles — it is not a
+copy, but a derived work. The attribution below covers the original portion.
 
-- Código: https://github.com/dissimulate/Clarity
-- Jogável: https://codepen.io/dissimulate/pen/AGYEby
+⚠️ **Neither the mechanics nor the map are in this repository any more.** They left with the platformer
+(the cartridge's departure, issue #111) and live in `game-platformer`, whose credits carry this attribution;
+the engine published from here contains no code derived from Clarity. The credit stays here as the record of
+where the project's platform code came from.
 
-Texto da licença MIT (aplicável às porções derivadas do Clarity):
+- Code: https://github.com/dissimulate/Clarity
+- Playable: https://codepen.io/dissimulate/pen/AGYEby
+
+Text of the MIT licence (applicable to the portions derived from Clarity):
 
 ```
 MIT License
@@ -38,48 +43,187 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-> Nota: confirmar o ano/linha exata de copyright no `LICENSE` do repositório do Clarity e alinhar aqui antes de
-> qualquer distribuição formal. MIT é compatível com AGPL-3.0 (as porções MIT mantêm seu aviso; o todo é AGPL-3.0).
-
-## Voz neural (TTS) — Next-gen Kaldi, Piper, eSpeak NG
-
-A narração por voz roda **inteiramente no navegador/offline** graças ao trabalho excepcional de:
-
-- **[sherpa-onnx](https://github.com/k2-fsa/sherpa-onnx)** (projeto **Next-gen Kaldi / k2-fsa**, **Apache-2.0**) — o motor
-  de inferência TTS em WebAssembly. Um agradecimento especial a **Fangjun Kuang** ([@csukuangfj](https://github.com/csukuangfj)),
-  engenheiro-líder do Next-gen Kaldi (sherpa-onnx, k2, icefall, kaldi-native-fbank; coautor de trabalhos como
-  [ZipVoice](https://github.com/k2-fsa/ZipVoice)), que **empacotou as vozes Piper no formato ONNX/sherpa** (repositórios
-  `vits-piper-*`) — inclusive **portando a `dii` de pt-PT para pt-BR** — tornando este uso possível. Obrigado.
-- **[Piper](https://github.com/rhasspy/piper)** (Michael Hansen / rhasspy, **MIT**) — o sistema TTS VITS por trás das vozes.
-- **[eSpeak NG](https://github.com/espeak-ng/espeak-ng)** (**GPL-3.0**) — a fonemização (`espeak-ng-data`) usada pelas vozes.
-- **Vozes pt-BR** (`faber`, `jeff`, `miro`, `cadu`) e pt-PT (`dii`) — treinadas pela comunidade Piper a partir de datasets
-  de locutores; a licença de cada voz está no `MODEL_CARD` do respectivo pacote e deve ser confirmada por voz antes de
-  distribuição formal.
-  **O que o jogo de fato embarca hoje é uma voz:** `pt_BR-faber-medium`. As demais permanecem no repositório como
-  material de laboratório (`docs/research/sherpa-wasm/`) e continuam creditadas por isso — crédito acompanha o que
-  está no repositório, e não apenas o que é distribuído no pacote. O roster de entrega decidido é `en_US`, `pt_BR` e
-  `es_MX` (ADR-0065, que supersede o ADR-0022).
-
-> Os pesos das vozes são **baixados uma vez** (de um host público) e rodam **100% localmente** depois — nenhum áudio de
-> criança sai do dispositivo. Ver `the-inclusionist-docs · docs/2-Architecture/adr/ADR-0065-three-neural-voices-owned-by-the-engine-and-cached-on-first-use.yaml`.
-
-## Arte importada — CC0, CC BY 3.0, CC BY 4.0 ou OGA-BY
-
-A atribuição da arte que vem de fora é **por recurso**, e por isso não cabe nesta página em prosa: a autoria de um
-acervo lê-se recurso a recurso, e a cadeia de derivações com ela.
-
-**Ela mora em [`../art/ATTRIBUTION.csv`](../art/ATTRIBUTION.csv)** — caminho, autor, **URL da fonte**, licença e de
-que recursos cada um derivou. É a mesma forma que o `LICENSES.md` §4 já usa para as 100 gerações do PixelLab: um
-ficheiro tabular ao lado do apontador em prosa, porque um livro-razão que cresce com o catálogo não se mantém à mão.
-
-⚠️ **Atribuição aqui é condição de uso, não linha de crédito.** Três das quatro licenças exigem-na, e um recurso
-sem autor conhecido **não entra** — «não consegui descobrir» não é licença. O gate
-`tests/arte-licencas-aceites.node.test.js` reprova a entrada vazia, a entrada órfã, o recurso sem entrada, a fonte
-sem URL e **qualquer licença fora das quatro** — com ND, NC e share-alike recusados por nome e com o motivo de
-cada um, que o [`LICENSES.md`](LICENSES.md) §3 e o **ADR-0133** explicam.
-
-📌 **Não há quarentena, e já houve.** Até 2026-09-09 o Liberated Pixel Cup ia entrar sob CC BY-SA 3.0 atrás de uma
-parede (ADR-0107). O Dev recusou o share-alike e a parede saiu com ele: sem arte cujo copyleft viaje, não há o que
-segregar.
-
-**Hoje o livro está vazio** — nenhum recurso entrou nunca.
+> Note: confirm the exact copyright year/line in the `LICENSE` of the Clarity repository and align it here before
+> any formal distribution. MIT is compatible with AGPL-3.0 (the MIT portions keep their notice; the whole is AGPL-3.0).
+
+## Neural voice (TTS) — until 2026-09-14: Piper and sherpa-onnx (WITHDRAWN)
+
+🔴 **The Piper voices left the engine on 2026-09-14** (ADR-0207, issue #193) — see the public notice
+[`notices/2026-09-14-piper-voices-withdrawn.md`](notices/2026-09-14-piper-voices-withdrawn.md). `pt_BR-faber-medium`,
+`en_US-amy-medium` and `en_US-ryan-medium` start from the `lessac` voice («Finetuned from U.S. English lessac voice», in their
+`MODEL_CARD`s), trained on the **Blizzard 2013** dataset (CSTR, University of Edinburgh), whose licence limits use to research and
+forbids distributing the materials; `es_MX-claude-high` states no starting checkpoint. We could not show a licence for what the project
+does with them.
+
+Credit follows what was used. Until that date neural narration relied on:
+
+- **[sherpa-onnx](https://github.com/k2-fsa/sherpa-onnx)** (Next-gen Kaldi / k2-fsa, **Apache-2.0**) — in the TTS lab; thanks to
+  **Fangjun Kuang** ([@csukuangfj](https://github.com/csukuangfj)), who packaged Piper voices in the sherpa format.
+- **[Piper](https://github.com/rhasspy/piper)** (Michael Hansen / rhasspy, **MIT**) and the `@mintplex-labs/piper-tts-web` runtime (MIT).
+- **[eSpeak NG](https://github.com/espeak-ng/espeak-ng)** (**GPL-3.0**) — the voices' phonemization (`piper_phonemize`).
+  ⚠️ **Staged for the mirror on 2026-09-22 and ON HOLD** (issue #192): the WebAssembly build of `espeak-ng` 1.0.2 sits in
+  `the-inclusionist-lfs/espeak-ng-1.0.2/`, but the **matching source** the GPL requires beside it (`espeak-ng-1.0.2/source/`)
+  has not been staged, so the upload script skips the folder. A binary served without its source would breach the licence,
+  and a mirror is distribution. What `source/` needs is written in that folder's `LICENSE.md`.
+- **The voices and their dataset licences**, read on 2026-09-14: `pt_BR-faber-medium` (NabuCasa/voice-datasets, CC0),
+  `es_MX-claude-high` (HirCoir/Piper-TTS-Spanish, Apache-2.0), `en_US-amy-medium` (MycroftAI/mimic3-voices, «See URL»),
+  `en_US-ryan-medium` (roholazandie/ryanspeech, CC BY-NC-SA 4.0). The Dev's answer on Ryan — «nosso projeto não tem fins
+  lucrativos» — met its non-commercial clause; the `lessac` chain is what took them out.
+
+## Kokoro-82M — hexgrad — Apache-2.0
+
+The weights are **Apache-2.0** (`huggingface.co/hexgrad/Kokoro-82M`), trained only on permissive audio — among it, **CC BY**
+audio: **Koniwa** (CC BY 3.0) and **SIWIS** (CC BY 4.0), credited here. The ONNX export used is `onnx-community/Kokoro-82M-v1.0-ONNX`.
+
+What speaks it, fetched by the engine beside the model: **[eSpeak NG](https://github.com/espeak-ng/espeak-ng)**
+(`espeak-ng` 1.0.2, **GPL-3.0-or-later**) turns the sentence into phonemes, and
+**[ONNX Runtime Web](https://github.com/microsoft/onnxruntime)** (`onnxruntime-web` 1.27.0, **MIT**, Microsoft) runs the graph.
+
+- **Kokoro-82M** (catalogue `voz:kokoro:*`: the fp32 model, the tokenizer and one style table per voice) — **Apache-2.0**.
+  Licence statement and NOTICE: `the-inclusionist-lfs/kokoro-82m-v1.0-onnx/LICENSE.md` and `NOTICE.md`; the Apache-2.0 text
+  itself is upstream (`huggingface.co/hexgrad/Kokoro-82M`), not held in that folder.
+- **eSpeak NG in WebAssembly** (catalogue `voz:runtime:fonemas*`: `espeak-ng.js` and `espeak-ng.wasm` from the npm package
+  `espeak-ng` 1.0.2, built by the `ianmarmour/espeak-ng.js` repository) — **GPL-3.0-or-later**, as its `package.json`
+  declares. The package carries the GPL-3.0 text (`LICENSE`) and no copyright line of its own; the eSpeak NG revision the
+  build was made from is not stated in the package. The source obligation is the one written under Piper above.
+- **ONNX Runtime Web** (catalogue `voz:runtime:onnx*`: `ort.webgpu.bundle.min.mjs` and the `ort-wasm-simd-threaded.jsep` pair)
+  — **MIT**. The bundle's own header: «Copyright (c) Microsoft Corporation. All rights reserved. Licensed under the MIT
+  License.» Mirror notice: `the-inclusionist-lfs/onnxruntime-web-1.27.0/LICENSE.md`; the MIT text itself is upstream
+  (`github.com/microsoft/onnxruntime`), not held in that folder or in the npm package.
+
+> The voice's files are **downloaded once** — by the build into the delivery's `heavy/` folder, and from there into the
+> device's cache — and run **100% locally** afterwards: no child's audio leaves the device. See ADR-0216 (the engine loads
+> the voice), ADR-0198 and ADR-0207 in `the-inclusionist-docs · docs/2-Architecture/adr/`.
+
+## The other runtimes and models the engine downloads
+
+Every file below is listed in `app/js/platform/heavy-catalogue.ts` with its address and sha256, fetched by the build into the
+delivery's `heavy/` folder (or from the project's mirror, `the-inclusionist-lfs/`, with the same bytes) and run on the device.
+The published npm package carries none of them. How each one is used and rebuilt: `docs/6-DevOps-SRE/models.md`.
+
+⚠️ **What the licence lines rest on.** Only the Vosk runtime's folder holds the upstream licence text and NOTICE. The other
+folders hold a `LICENSE.md` the project wrote from the upstream page it read, not the upstream text: the
+licence is stated, and the copyright line an MIT or Apache-2.0 notice carries is, where marked **UNVERIFIED**, not held
+anywhere in this project yet.
+
+## MediaPipe tasks-vision and its face, gesture and hand models — Google — Apache-2.0
+
+The eye, face and hand control (`platform/vision`; catalogue `visao:*`): the `@mediapipe/tasks-vision` 1.0.1 runtime
+(`vision_bundle.mjs`, `vision_wasm_internal.js`, `vision_wasm_internal.wasm`, from jsDelivr) and the float16 **Face
+Landmarker**, **Gesture Recognizer** and **Hand Landmarker** models (`storage.googleapis.com/mediapipe-models`).
+
+- **Licence:** `Apache-2.0`, as stated in `the-inclusionist-lfs/mediapipe-tasks-vision-1.0.1/LICENSE.md` and in ADR-0203's
+  erratum (the runtime, and the face model card with its blendshapes).
+- **Copyright line: UNVERIFIED.** The runtime files carry no licence header, the `.task` bundles carry no licence file, and the
+  package is not installed here. The Apache-2.0 text lives upstream, with the MediaPipe project.
+- ⚠️ **The hand and gesture model cards were not read** (the mirror's `LICENSE.md` says so; issue #192). Their terms are
+  UNVERIFIED until they are.
+
+## Whisper small — OpenAI — Apache-2.0
+
+The Portuguese reading model (catalogue `reading:pt:*`): `openai/whisper-small`, **exported to ONNX and quantized by this
+project** (`scripts/models/export-whisper-small.py`), with the upstream tokenizer, configuration and mel filterbank copied
+unchanged. The export was made here because the ready-made `onnx-community/whisper-small` states no licence of its own.
+
+- **Licence:** `Apache-2.0`, as stated in `the-inclusionist-lfs/whisper-small-onnx/LICENSE.md` and in ADR-0203's erratum.
+- **Copyright line: UNVERIFIED** — not held locally. The Apache-2.0 text lives upstream (`huggingface.co/openai/whisper-small`).
+- The ONNX files are a derivative work (converted and quantized); `whisper-small-onnx/README.md` says what was changed.
+
+## Moonshine streaming small — Useful Sensors / Moonshine AI — MIT
+
+The English and Spanish reading models (catalogue `reading:en:*`, `reading:es:*`):
+
+- **English:** the ONNX export `Workmind/moonshine-streaming-small-ONNX` (base model `UsefulSensors/moonshine-streaming-small`),
+  copied unchanged. Licence `MIT`, as the export declares (`license: mit`), read on 2026-09-18 and stated in
+  `the-inclusionist-lfs/moonshine-streaming-small-onnx/LICENSE.md`.
+- **Spanish:** `moonshine-ai/moonshine-streaming-small-es` at revision `8cb0974f29ca24d6b645518c430efc8c57cd0073`, **exported to
+  ONNX by this project** (`scripts/models/export-moonshine-streaming-es.py`; the decoders quantized to q8). Licence `MIT`, as the
+  upstream model declares, stated in `the-inclusionist-lfs/moonshine-streaming-small-es-onnx/LICENSE.md`.
+- **Copyright line: UNVERIFIED** for both. MIT requires its copyright notice and permission notice to travel with every copy,
+  and neither folder holds that text yet; it lives upstream, on each model's Hugging Face page.
+
+## Vosk for the browser — vosk-browser, vosk-api and Kaldi — Apache-2.0
+
+The command runtime (catalogue `commands:runtime*`: `vosk.wasm.js`, `vosk.worker.js`, `vosk.wasm`), **built by this project**
+(`scripts/models/build-vosk-browser.ps1`) from `lichess-org/vosk-browser` `50a6347` and `alphacep/vosk-api` `d714dff`, with one
+change: the link flag `-s DYNAMIC_EXECUTION=0` (`scripts/models/vosk-browser-dynamic-execution.patch`), so it runs under the
+engine's Content-Security-Policy.
+
+- **Licence:** `Apache-2.0`. The full text is `the-inclusionist-lfs/vosk-browser-dynamic-execution-0/LICENSE`, and the attribution
+  notices are that folder's `NOTICE`, which opens:
+
+  ```
+  Vosk-Browser
+  Copyright 2020-2022 Ciaran O'Reilly
+
+  The Initial Developer of the the WASM bindings
+  (https://github.com/dtreskunov/tiny-kaldi) for the VOSK API is Denis
+  Treskunov (https://github.com/dtreskunov).
+  Copyright 2020, Denis Treskunov
+
+  The Developer of the VOSK API (https://github.com/alphacep/vosk-api) is
+  Alpha Cephei Inc (https://alphacephei.com/en/).
+  Copyright 2019-2022 Alpha Cephei Inc. All Rights Reserved.
+  ```
+
+- **What the binary also contains**, each with its notice in the same `NOTICE`: **Kaldi** (Apache-2.0, per-file authors listed
+  there), **OpenFst** (Apache-2.0, Copyright 2005-2010 Google, Inc.), **CLAPACK** (BSD-3-Clause, Copyright (c) 1992-2008 The
+  University of Tennessee), **clapack-wasm** (Apache-2.0, INRIA), **zlib** (Zlib), **libarchive** (BSD-2-Clause) and
+  **Emscripten and musl** (MIT). The `NOTICE` is the full list and its text governs; this page only points at it.
+
+## Vosk small models — Alpha Cephei — Apache-2.0
+
+The command models (catalogue `commands:model:*`): `vosk-model-small-pt-0.3`, `vosk-model-small-en-us-0.15` and
+`vosk-model-small-es-0.42`, **repacked unchanged** from alphacephei's zips into the `.tar.gz` vosk-browser loads
+(`scripts/models/repack-vosk-models.py`).
+
+- **Licence:** `Apache-2.0`, as stated in `the-inclusionist-lfs/vosk-models/LICENSE.md` (from `alphacephei.com/vosk/models`).
+  ⚠️ **The archives themselves state no licence**: their `README`s carry only a copyright line, and the Apache-2.0 text is not
+  held locally.
+- **Copyright lines, as each archive's `README` states them:** en-us 0.15 «Copyright 2020 Alpha Cephei Inc»; es 0.42
+  «Copyright 2022-2050 AC Technologies LLC»; pt 0.3 **none** (its `README` says only what the model is).
+
+## Arrow icons — Lucide, derived from Feather (Cole Bemis) — MIT
+
+The eye control draws four arrows over the game (`app/js/ui/gaze-overlay.ts`): Lucide's `arrow-up`, `arrow-right`, `arrow-down` and
+`arrow-left` (lucide.dev). Lucide is ISC, but its LICENSE lists these four among the icons derived from the Feather project, which carry
+Feather's MIT notice:
+
+> The MIT License (MIT) (for the icons listed above)
+>
+> Copyright (c) 2013-present Cole Bemis
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR
+> ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH
+> THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Imported art — through the three doors of ADR-0133
+
+The attribution of art that comes from outside is **per resource**, and so it does not fit on this page as prose: the
+authorship of a collection is read resource by resource, and the chain of derivations with it.
+
+**It lives in [`../art/ATTRIBUTION.csv`](../art/ATTRIBUTION.csv)** — path, author, **source URL**, door, licence,
+delivery and which resources each one derived from. It is the same shape `LICENSES.md` §4 already uses for the 100
+PixelLab generations: a tabular file beside the prose pointer, because a ledger that grows with the catalogue cannot be
+kept by hand.
+
+⚠️ **Attribution here is a condition of use, not a credit line.** Most of the admitted licences require it, and a
+resource with no known author **does not come in** — *I could not find out* is not a licence. The gate
+`tests/art-licences-accepted.node.test.js` fails the empty entry, the orphan entry, the resource with no entry, the source
+with no URL, a row with no valid door, and ND and NC, refused by name with the reason for each, which
+[`LICENSES.md`](LICENSES.md) §3 and **ADR-0133** explain. A licence name not yet measured is referred, not refused, and
+share-alike comes in only through the bridge, converted to `GPL-3.0-only`.
+
+📌 **There is no quarantine, and there was one.** Until 2026-09-09 the Liberated Pixel Cup was to come in under CC BY-SA 3.0
+behind a wall (ADR-0107). ADR-0133 replaced the wall with the bridge: art whose copyleft would travel comes in only as an
+adaptation under `GPL-3.0-only`, and the bridge stays closed while the modifiable source it requires does not exist.
+
+**Today the ledger is empty** — no resource has ever come in.