Keeping Licenses & Credits current

The menu page, standalone licenses.html and download notices are generated
from app/license-registry.json and app/licenses/*.txt by license_tools.py.
Do not edit the built HTML, ledger.mjs or game.html.gz to change attribution.

Whenever adding or replacing a dependency, snippet, image, font, soundfont,
music track or recording:
1. Record the actual creator, source URL, version and applicable license.
   Separate original project material, inspiration, and bundled third-party
   material. Do not apply a library's license to unrelated artwork or music.
2. Preserve full copyright/permission/NOTICE text in app/licenses. Add it to
   the registry with its SHA-256 and component entry. Retain vendor headers.
3. For a vendor/art/runtime upgrade, review the new upstream license before
   updating the registry's inventory checksum and version. Add/remove frontend
   modules/styles in the reviewed lists only after checking their provenance.
   Build errors are a review reminder, not permission to merely refresh hashes.
4. Record music by its content SHA-256, with creator/source/license in its credit.
   New or replaced files automatically appear as Credits pending at build time.
   Owner-supplied media with unknown rights must remain pending until documented.
   Runtime audio replacement does not perform license research; rebuild credits.
5. Rebuild both maintained editions with app/runtime/python.exe -B app/build_all.py.
   A portable downloaded copy can rebuild itself with python -B app/build.py.
   Rebuild the public download ZIP with download_bundle.py after reviewing music.
6. Verify the menu, full license text, portrait/landscape scrolling and dropdown
   state. Include licenses.html in website deployment and backup inventories.

Only public code/art/audio inputs are inventoried. Never add statement PDFs,
session names, merchant rules, personal data or backup directories to notices.
The credits registry is not a blanket public license for the ledger itself.
