Add embedded license viewer and AVIF notice guards

.github/workflows/ci.yml

@@ -57,6 +57,9 @@ jobs:
       - name: Check updater dependency notices
         run: make check-updater-notices
 
+      - name: Check AVIF payload and dependency notices
+        run: make check-avif-notices
+
       - name: Install Linux GUI build dependencies
         run: |
           sudo apt-get update

AGENTS.md

@@ -109,7 +109,7 @@ precedence over its default handoff procedure.
 ## Project Conventions
 
 - Prefer code that makes its intent clear to human readers over terse shorthand where possible. For example, write byte sizes as `256 * 1024 * 1024` (or `256 * MiB` with a named unit) instead of `256 << 20`.
-- Check the license and shipped dependency closure before selecting or upgrading a dependency, including native runtimes and model assets. Record the exact source/version, distribution obligations, and notice delivery in the implementation plan before calling the feature release-ready; unchanged dependencies still carry obligations.
+- Check the license and shipped dependency closure before selecting or upgrading a dependency, including native runtimes and model assets. Record the exact source/version, distribution obligations, and notice delivery in the implementation plan before calling the feature release-ready; unchanged dependencies still carry obligations. AVIF, ONNX and other bundled native/WASM changes must include corresponding third-party notice updates in the same change. Follow [the notice checks](scripts/avifnotices/README.md) for AVIF payload/source review; retain upstream ONNX license/notices alongside its runtime.
 - Every user-visible string is `lang.L("English text")`; add that exact key to every `translations/*.json` bundle. English is an identity map and `main_test.go` enforces locale parity.
 - No Unicode arrows in anything the app draws — not in `lang.L` keys or catalogue values, not in the manuals, not even inside backticks. The theme font (NotoSans) has no arrow glyphs, the shaper falls back to a 23-glyph symbol subset with no space, `/` or `-`, and the character *after* the arrow is painted as `�`. Write menu paths and cycles as ASCII `->` and keys as `Left` / `Right` / `Up` / `Down`. Guarded by `TestManualHasNoUnicodeArrows` and `TestTranslationsHaveNoUnicodeArrows`.
 - Report UI-boundary failures with `fyne.LogError`; viewer-independent packages return errors. Mark intentionally ignored errors explicitly (`_ =` or `_, _ =`) so IDE/`errcheck` inspections see intent.

ARCHITECTURE.md

@@ -15,8 +15,9 @@ subprocess mode before desktop startup, calls `openwith.Install` (first
 statement after that, see `internal/openwith`), skips GitHub-update predecessor
 cleanup for Store-managed builds and explicit Explorer trials, asks `launch.Options.ApplicationID` to validate and select the app identity before
 building the `fyne.App`, loads embedded
-`translations/*.json`, converts CLI paths to URIs (`argsToURIs`), and calls
-`ui.Run`. `main_darwin_test.go` asserts the graft landed — this is the only
+`translations/*.json`, embeds `THIRD-PARTY-NOTICES.md`, converts CLI paths to URIs
+(`argsToURIs`), and passes the immutable notices to `ui.Run`, which supplies
+Help's offline Licenses window before startup. `main_darwin_test.go` asserts the graft landed — this is the only
 test binary that links the Cocoa driver.
 
 ### `scripts/historymovie`
@@ -262,8 +263,14 @@ Generation uses local `cwebp`; the application keeps its existing image decoders
 `scripts/updaternotices` reconciles the six-target production updater dependency
 union with its reviewed `manifest.json`, checks source-file hashes and generates
 the bounded updater section of `THIRD-PARTY-NOTICES.md`. `artifacts.go` verifies
-byte-identical license/privacy/notices inside finished ZIP/tar.gz archives and
-both MSIX bundle payloads; CI runs this before release publication/Store upload.
+byte-identical license/privacy/notices and the complete notice document embedded
+in each executable inside finished ZIP/tar.gz archives and both MSIX bundle
+payloads; CI runs this before release publication/Store upload.
+
+`scripts/avifnotices` checks resolved AVIF/wazero versions and hashes of the
+reviewed WASM payload, build recipe and retained source license texts against
+`manifest.json`; it generates the AVIF section of `THIRD-PARTY-NOTICES.md` offline.
+Its README records the libyuv/WASI source-provenance limits.
 
 `packaging/tools.mk` owns reviewed CLI versions and multiarchitecture image
 digests consumed by Makefile and the release/Store workflows.
@@ -564,6 +571,10 @@ The concurrency invariant: see `AGENTS.md` § Concurrency and Fyne.
 | `internal/ui/widgets/` | Shared UI mechanics: `ChoicePanel` / `ChoiceCard` (+ its optional `ExtraRows` slot above the button row, Up/Down between them, Return offered to the focused row before it commits, and `SetSelectionActive` muting the button ring so only one mark is ever at full strength), `TappableArea`, `Singleton` (+ geometry memory), `NewSizeTracker`, focus-ring style. `gaze.go` extracts the compact single-row atlas and owns the 16-direction/neutral portrait presenter shared by Trane and Finis; callers own artwork preparation, hosting and face-relative coordinates. `circlegesture.go` recognizes timestamped head-relative pointer turns; hosts own independent instances, geometry normalization and lifecycle reset. | Leaf aside from `internal/winpos`. |
 | `internal/ui/assets/` | Embedded viewer artwork, including `ExplorerIntroPNG` for first use. | Leaf. |
 
+Help's `licenses.go` displays the complete immutable release notice document
+supplied by `main.go` through `ui.Run` and `Help.SetLicenses`. Help -> Licenses
+opens a scrollable Markdown singleton, with no runtime file reads or downloads.
+
 ### `internal/imaging`
 
 Viewer-independent probe → decode → EXIF-orient → cache pipeline (JPEG, PNG,

Makefile

@@ -49,7 +49,7 @@ COVERAGE_HTML := $(COVERAGE_DIR)/coverage.html
 
 .PHONY: all build build-linux-all run fmt fmt-check vet test coverage ci-failures update-test-image enter-test-container test-native test-race test-race-direct test-race-non-ui-direct test-race-ui-direct verify golden tidy clean package-mac warm-fyne-cross-windows warm-fyne-cross-linux package-windows package-windows-store package-windows-debug package-linux package-linux-debug build-all install-tools install-fyne install-fyne-cross install-linux-tools security security-govulncheck security-github bump-version release check-tuf-root sync-tuf-root sync-qodana-test-exclusions check-qodana-test-exclusions check-test-shards check-test-shards-direct help
 .PHONY: verify-build --skip-local-tests
-.PHONY: generate-updater-notices check-updater-notices
+.PHONY: generate-updater-notices check-updater-notices generate-avif-notices check-avif-notices
 
 all: build
 
@@ -59,6 +59,12 @@ generate-updater-notices: ## Regenerate updater notices from the reviewed source
 check-updater-notices: ## Check all six updater dependency targets and exact license/NOTICE text
 	go run ./scripts/updaternotices
 
+generate-avif-notices: ## Regenerate AVIF/WASM notices from the reviewed payload/source manifest
+	go run ./scripts/avifnotices -write
+
+check-avif-notices: ## Check pinned AVIF/WASM payload, runtime versions and complete notice text
+	go run ./scripts/avifnotices
+
 .PHONY: generate-tag-vectors check-tag-vectors generate-app-assets check-app-assets
 generate-tag-vectors: ## Generate exact embedded float32 vectors from the authoritative JSON (offline)
 	go run ./scripts/tagvectors
@@ -401,7 +407,7 @@ test-race: ## Run the guarded race partitions concurrently in one Linux/amd64 Do
 	@bash scripts/testshards/docker-race.sh "$(CURDIR)" "$(TEST_IMAGE)" \
 		"$(TEST_MEMORY_GIB)" "$(TEST_CONTAINER_LABEL)" "$(TEST_LOCALE)" "$(TEST_ARTIFACTS_DIR)"
 
-verify-build: fmt-check check-tuf-root check-qodana-test-exclusions check-tag-vectors check-app-assets check-updater-notices ## Run local verification without the test suite (format, TUF root, generated assets, notices, Qodana exclusions, vet, build)
+verify-build: fmt-check check-tuf-root check-qodana-test-exclusions check-tag-vectors check-app-assets check-updater-notices check-avif-notices ## Run local verification without the test suite (format, TUF root, generated assets, notices, Qodana exclusions, vet, build)
 	go vet -tags "$(APP_TAGS)" ./...
 	go build -tags "$(APP_TAGS)" ./...