# Third-party notices and provenance

## Project license

Copyright 2026 Adam Asmaeil.

The project is distributed under the Apache License 2.0. The root [LICENSE](LICENSE) is the verbatim official Apache License 2.0 text at SHA-256 `cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30`. Project-specific copyright and attribution statements are intentionally kept in this notice and `AUTHORS.md`, not substituted into the license text.

## PCG32 XSH-RR

The `nextUint32` and `PCG32` logic in `phase-3-model.js`, also present in the HTML executable model source after excluding the script-wrapper whitespace, is treated conservatively as a JavaScript adaptation of the PCG minimal C reference implementation. The literal HTML script text is not byte-identical to the standalone file because the wrapper contributes one leading LF and one trailing LF plus two spaces; the executable source remaining after removal is exact.

- Original work: PCG Random Number Generation, Minimal C Edition.
- Original author and copyright notice: Copyright 2014 M.E. O'Neill.
- License: Apache License 2.0.
- Official implementation and notice: [PCG minimal implementation](https://www.pcg-random.org/download.html).
- Official source repository: [imneme/pcg-c-basic](https://github.com/imneme/pcg-c-basic).

The adapted logic retains the PCG32 64-bit linear-congruential state transition, XSH-RR output transformation, stream initialization, and deterministic seeding sequence. The surrounding JavaScript seed validation, open-interval conversion, Box-Muller pair caching, draw indexing, reset API, and simulation integration are part of this project. The entire project uses Apache-2.0, so the PCG-derived portion and the original project material share the same license identifier while this attribution is preserved.

## Box-Muller transform

The normal generator implements the published Box-Muller transform and cites the primary paper:

- G. E. P. Box and Mervin E. Muller (1958), [A Note on the Generation of Random Normal Deviates](https://doi.org/10.1214/aoms/1177706645).

No separately distributed Box-Muller software library or copied reference source file is included.

## Development-only dependencies

These packages are pinned by `package-lock.json` and are used only for development verification. They are not referenced by the self-contained offline HTML at runtime and are not included in the release ZIP as installed packages.

| Package | Pinned version | License recorded by lockfile | Role |
|---|---:|---|---|
| `axe-core` | 4.12.1 | MPL-2.0 | Automated accessibility checks in the browser suite |
| `playwright` | 1.62.1 | Apache-2.0 | Browser automation and engine management |
| `playwright-core` | 1.62.1 | Apache-2.0 | Transitive browser automation core |
| `fsevents` | 2.3.2 | MIT | Optional macOS development dependency |

Package licenses are recorded from the immutable lockfile and checked against the upstream project records during release-candidate preparation. Because `node_modules` and browser binaries are excluded from the release, their source distributions and license texts are not redistributed in this candidate.

## Other material

The author confirmed authority to license all other original, non-third-party material. The scientific and software references in the application and documentation support specific claims or provide context; they are not bundled third-party code.