Clarify licensing and release provenance

.github/workflows/release.yml

@@ -0,0 +1,172 @@
+name: Build and publish release
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - '*'
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'GitHub Release tag to publish'
+        required: true
+        default: '0.7.3'
+      source_ref:
+        description: 'Source branch/tag/commit to compile'
+        required: true
+        default: 'main'
+
+permissions:
+  contents: write
+
+env:
+  ZIG_VERSION: '0.16.0'
+  CUSTOM_WEIRDPERFORMANCE_TAG: '0.7.3'
+
+jobs:
+  release:
+    name: Build DLLs and publish release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Resolve build metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "RELEASE_TAG=${{ inputs.release_tag }}" >> "$GITHUB_ENV"
+            echo "SOURCE_DESCRIPTION=${{ inputs.source_ref }}" >> "$GITHUB_ENV"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "RELEASE_TAG=${GITHUB_REF_NAME}" >> "$GITHUB_ENV"
+            echo "SOURCE_DESCRIPTION=${GITHUB_REF_NAME}" >> "$GITHUB_ENV"
+          else
+            echo "RELEASE_TAG=dev" >> "$GITHUB_ENV"
+            echo "SOURCE_DESCRIPTION=${GITHUB_SHA}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.source_ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Install Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Build public DLL variants
+        shell: bash
+        run: |
+          set -euo pipefail
+          zig build all-variants -Doptimize=ReleaseSmall \
+            -Dweirdperformance=false \
+            -Doutline=true \
+            -Dframecrash=true \
+            -Ddpslog=true
+
+      - name: Collect release DLLs
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p release
+
+          dlls=(
+            bigcursor.dll
+            clickthrough.dll
+            customassets.dll
+            dpslog.dll
+            framecrash.dll
+            healtextfix.dll
+            interact.dll
+            logsessions.dll
+            minimapicons.dll
+            outline.dll
+            pngscreenshots.dll
+            transmogfix.dll
+            worldmarkers.dll
+          )
+
+          for dll in "${dlls[@]}"; do
+            src="zig-out/variants/$dll"
+            if [[ ! -s "$src" ]]; then
+              echo "Missing expected DLL: $src" >&2
+              exit 1
+            fi
+            cp "$src" "release/$dll"
+          done
+
+      - name: Add custom WeirdPerformance v0.7.3
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          api_url="https://codeberg.org/api/v1/repos/Dusk92/WeirdUtils/releases/tags/${CUSTOM_WEIRDPERFORMANCE_TAG}"
+          release_json="$(curl --retry 3 --retry-all-errors -fsSL "$api_url")"
+
+          download_url="$(printf '%s' "$release_json" | python3 -c '
+          import json, sys
+          data = json.load(sys.stdin)
+          for asset in data.get("assets", []):
+              if asset.get("name", "").lower() == "weirdperformance.dll":
+                  print(asset.get("browser_download_url", ""))
+                  break
+          ')"
+
+          if [[ -z "$download_url" ]]; then
+            echo "Could not find weirdperformance.dll in Codeberg release ${CUSTOM_WEIRDPERFORMANCE_TAG}" >&2
+            exit 1
+          fi
+
+          curl --retry 3 --retry-all-errors -fsSL "$download_url" -o release/weirdperformance.dll
+
+          python3 - <<'PY'
+          from pathlib import Path
+          p = Path('release/weirdperformance.dll')
+          data = p.read_bytes()
+          if len(data) < 1024 or data[:2] != b'MZ':
+              raise SystemExit('Downloaded weirdperformance.dll is not a valid-looking Windows DLL')
+          print(f'Custom WeirdPerformance: {len(data)} bytes, PE header OK')
+          PY
+
+      - name: Create checksums and ZIP
+        shell: bash
+        run: |
+          set -euo pipefail
+          (
+            cd release
+            sha256sum *.dll > SHA256SUMS.txt
+          )
+          zip -j "WeirdUtils-${RELEASE_TAG}.zip" release/*.dll release/SHA256SUMS.txt
+
+      - name: Publish GitHub Release
+        if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          cat > release-notes.md <<EOF
+          WeirdUtils ${RELEASE_TAG}
+
+          - Standard module DLLs are compiled from `${SOURCE_DESCRIPTION}` with Zig ${ZIG_VERSION} in ReleaseSmall mode.
+          - The upstream WeirdPerformance variant is intentionally excluded.
+          - `weirdperformance.dll` is the custom Dusk-92 v${CUSTOM_WEIRDPERFORMANCE_TAG} build from the Codeberg release.
+          - `SHA256SUMS.txt` is included for integrity checks.
+          EOF
+
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "Release $RELEASE_TAG already exists; replacing assets."
+          else
+            gh release create "$RELEASE_TAG" \
+              --title "WeirdUtils ${RELEASE_TAG}" \
+              --notes-file release-notes.md
+          fi
+
+          gh release upload "$RELEASE_TAG" \
+            release/*.dll \
+            release/SHA256SUMS.txt \
+            "WeirdUtils-${RELEASE_TAG}.zip" \
+            --clobber

Docs/ASSET_PROVENANCE.md

@@ -0,0 +1,115 @@
+# WeirdUtils asset provenance
+
+Audit date: 2026-08-31
+
+No visual or font asset is intended to be modified during this documentation
+pass.
+
+The root WeirdUtils public-domain dedication does **not** automatically apply
+to bundled third-party or game-facing assets.
+
+## MinimapIcons assets
+
+Path:
+
+- `src/minimapicons/assets/`
+
+Git tree SHA-1:
+
+- `4d3848aa2ba1e32b8cfb5a8d4d67eaf4ead09e31`
+
+The tracking directory contains 21 BLP resources under a game-style path:
+
+- `Interface/Minimap/Tracking/`
+
+Examples include `Banker.blp`, `FlightMaster.blp`,
+`QuestAvailable.blp`, `Repair.blp`, and `ObjectIcons.blp`.
+
+Immediate repository provenance is known, but this audit does not establish
+the original creator or redistribution license of every underlying image.
+
+## WorldMarkers assets
+
+Path:
+
+- `src/worldmarkers/assets/`
+
+Known subtrees:
+
+- `Spells/`:
+  `5a3628820673332f3fdd481e80f3f6e81efed9e8`
+- `World/`:
+  `9783e9c15f31a527c9d6f81e45b6c7ba251f27e3`
+
+Files include game-facing names such as raid-target textures, spell/VFX
+textures, and resources under:
+
+- `World/Expansion01/Doodads/Zulaman/Doors/`
+
+These paths strongly indicate compatibility with game resource naming, but the
+documentation does not assert a specific extraction history without stronger
+evidence.
+
+No ownership or public-domain claim is made over underlying Blizzard or other
+third-party artwork.
+
+## WeirdDPSMate fonts
+
+Path:
+
+- `src/dpslog/WeirdDPSMate/fonts/`
+
+Git tree SHA-1:
+
+- `48374570b2c9659e1d781d4014c17fecd1b0f7f1`
+
+The directory contains 13 TTF/OTF font files.
+
+Their individual font licenses were not independently established during this
+audit. They are therefore not treated as public-domain material merely because
+they are bundled in WeirdUtils or inside the GPL-licensed DPSMate subtree.
+
+## WeirdDPSMate images
+
+Path:
+
+- `src/dpslog/WeirdDPSMate/images/`
+
+Git tree SHA-1:
+
+- `bd649c1cffffc9b7d9b92fc001748531cb4ffa92`
+
+The directory includes UI images, class icons, status-bar textures, and other
+TGA resources.
+
+The immediate bundled provenance is documented, while underlying visual rights
+remain separate from the WeirdUtils root license.
+
+## GraphLib textures
+
+WeirdDPSMate also bundles GraphLib texture resources under:
+
+- `src/dpslog/WeirdDPSMate/libs/GraphLib/GraphTextures/`
+
+These include pie/line/triangle and related TGA resources. Their presence is
+not used to infer a new license from WeirdUtils.
+
+## Rights boundary
+
+World of Warcraft, Warcraft, Blizzard Entertainment, and associated names,
+marks, artwork, interface resources, client data, and game assets remain the
+property of their respective rights holders.
+
+An exact Git tree or blob hash establishes file identity/provenance at a point
+in history. It does not by itself establish ownership or a right to relicense
+the underlying work.
+
+## Maintenance
+
+When assets are added, removed, or replaced:
+
+1. record source and creation history where known;
+2. record hashes/tree identity where practical;
+3. preserve font/image license notices when available;
+4. do not place unresolved third-party/game-facing assets under the root
+   public-domain dedication by implication.

Docs/BINARY_PROVENANCE.md

@@ -0,0 +1,76 @@
+# WeirdUtils binary and release provenance
+
+Audit date: 2026-08-31
+
+## Source repository
+
+At the audited pre-documentation head
+`947056f1c22c4816f85038dfb78abe61c1e4133b`, the source tree contains no
+committed release `.dll` or `.exe` files.
+
+Release DLLs are packaging/build outputs rather than checked-in binaries.
+
+## GitHub Actions release workflow
+
+`.github/workflows/release.yml` builds the standard public module DLLs with:
+
+- Zig 0.16.0
+- target/build configuration defined by the repository source
+- `zig build all-variants -Doptimize=ReleaseSmall`
+
+The workflow collects the generated DLLs and creates `SHA256SUMS.txt` before
+publishing release assets.
+
+## WeirdPerformance release exception
+
+The GitHub release workflow intentionally excludes the normal
+`weirdperformance` variant from the standard source build.
+
+Instead, it downloads:
+
+- `weirdperformance.dll`
+- from a Codeberg release under `Dusk92/WeirdUtils`
+- tag `0.7.3` as configured by
+  `CUSTOM_WEIRDPERFORMANCE_TAG`
+
+The workflow validates that the downloaded file has a plausible Windows PE
+header and then includes it in the generated SHA-256 manifest.
+
+Therefore a GitHub WeirdUtils release is not composed exclusively of DLLs
+compiled in that same workflow: `weirdperformance.dll` is a separately
+sourced prebuilt release artifact.
+
+This distinction should remain documented whenever the release workflow
+changes.
+
+## Build-time zhook dependency
+
+`build.zig.zon` pins zhook to:
+
+- source:
+  `https://codeberg.org/marcelinevq/zhook/archive/f1b252ed61ad839f00310c386761d068f293ad0f.tar.gz`
+- Zig package hash:
+  `zhook-0.1.0-pFkSYC6FAACAnkqu0k_DJBWdL0gJjrM22IfXeQPJAMov`
+
+The source is fetched during a build and is not vendored into this GitHub
+repository.
+
+## Vendored libdeflate
+
+`src/weirdperformance/libdeflate/` contains libdeflate source code (version
+1.25 according to the bundled header). The build compiles the required C files
+into the WeirdPerformance module.
+
+libdeflate is MIT-licensed and is documented separately in
+`THIRD_PARTY_NOTICES.md` and `LICENSES/libdeflate-MIT.txt`.
+
+## Release maintenance rule
+
+For each release:
+
+1. retain the exact source ref used for compiled DLLs;
+2. retain the source/tag of any prebuilt imported DLL;
+3. publish or retain SHA-256 checksums;
+4. keep third-party license records alongside the source project;
+5. do not describe a prebuilt imported artifact as compiled from the current
+   GitHub commit unless that has actually been verified.

Docs/SOURCE_PROVENANCE.md

@@ -0,0 +1,63 @@
+# WeirdUtils source provenance
+
+Audit date: 2026-08-31
+
+## Imported source history
+
+The repository is not marked by GitHub as a fork, but its imported Git history
+contains extensive source development authored by MarcelineVQ.
+
+The repository documentation points to the historical/source project at:
+
+- https://codeberg.org/MarcelineVQ/WeirdUtils
+
+## Dusk-92 GitHub maintenance boundary
+
+A comparison was made from the last inspected MarcelineVQ-authored baseline:
+
+- base: `41191ce9a5b50cf38fc48f138b8339ed17f9cae8`
+- pre-audit GitHub head:
+  `947056f1c22c4816f85038dfb78abe61c1e4133b`
+
+GitHub reports that the Dusk-92 head is four commits ahead of that baseline.
+
+Only two paths differ in that comparison:
+
+- `.github/workflows/release.yml`
+- `src/main.zig`
+
+The relevant later commits are:
+
+- `82dc02e2e78ca43496286c14a732a562d2448570`
+  — Add automated DLL release workflow
+- `f4cbacb7f9e91f99e7409b3aa48a61fe6d96d978`
+  — Fix DllMain return type for Zig 0.16
+- `c4d133887a9730e346d0654031cfeefb7a77e065`
+  — Run release build CI on main and support source refs
+- `947056f1c22c4816f85038dfb78abe61c1e4133b`
+  — Test full release packaging on main
+
+This makes the authorship boundary unusually clear: the GitHub maintenance
+layer should not be presented as authorship of the entire imported WeirdUtils
+source tree.
+
+## Third-party source boundaries
+
+Known third-party or reference-derived areas include:
+
+- `src/dpslog/WeirdDPSMate/` — DPSMate fork, GPL-3.0
+- `src/dpslog/WSBT/` — Mik/Athene material, license unresolved in this audit
+- `src/weirdperformance/libdeflate/` — libdeflate 1.25, MIT
+- `src/weirdperformance/timer_fix.zig` — ported from VanillaFixes, MIT
+- `src/ssemaths/math_sse.zig` — UnitXP_SP3 and libSiliconPatch references
+- external `zhook` build dependency — pinned in `build.zig.zon`
+
+See `THIRD_PARTY_NOTICES.md`.
+
+## Documentation-pass boundary
+
+No Zig, C, Lua, XML, build workflow, BLP, TGA, font, or other runtime asset is
+intended to be modified by the 2026-08-31 licensing/provenance pass.
+
+The final compare against the pre-audit head is the authoritative check for
+that statement.

LICENSE

@@ -25,7 +25,57 @@ For more information, please refer to <https://unlicense.org/>
 
 ---
 
-EXCEPTION: src/dpslog/WeirdDPSMate/ is a fork of DPSMate by Shino
-<Synced> and is licensed under the GNU General Public License v3.
-See src/dpslog/WeirdDPSMate/LICENSE. The dedication above does not
-apply to that directory.
+SCOPE AND THIRD-PARTY EXCEPTIONS
+
+The public-domain dedication above applies only to material for which the
+applicable WeirdUtils author or authors hold the rights necessary to make that
+dedication.
+
+It does not override or replace the copyright, license, trademark, or other
+rights applicable to third-party code, external dependencies, reference-derived
+material, fonts, artwork, game-facing resources, or other assets included in or
+referenced by this repository.
+
+Known exclusions and separate terms include, without limitation:
+
+1. src/dpslog/WeirdDPSMate/
+   This is a fork of DPSMate by Shino <Synced> and is licensed under the GNU
+   General Public License v3. See src/dpslog/WeirdDPSMate/LICENSE.
+
+2. src/dpslog/WSBT/
+   This contains historical Mik's Scrolling Battle Text / Combat Event Helper
+   material credited to Mik and Athene. No standalone license for this bundled
+   subtree was independently established during the 2026-08-31 audit. The
+   public-domain dedication above does not claim to relicense it.
+
+3. src/weirdperformance/libdeflate/
+   This contains vendored libdeflate source under the MIT License. See
+   LICENSES/libdeflate-MIT.txt.
+
+4. VanillaFixes-derived material
+   src/weirdperformance/timer_fix.zig explicitly identifies itself as ported
+   from VanillaFixes, which is MIT-licensed. See
+   LICENSES/VanillaFixes-MIT.txt.
+
+5. External zhook dependency
+   zhook is fetched at build time from its upstream Codeberg repository. It is
+   not relicensed by this file.
+
+6. UnitXP_SP3 / libSiliconPatch references
+   Source comments identify these projects as behavioral, formula, or symbol
+   references for some SSE work. This file does not make a public-domain claim
+   over material whose applicable rights are held by those projects or other
+   third parties.
+
+7. Fonts, BLP/TGA artwork, and game-facing assets
+   Bundled fonts and visual resources, including assets under minimapicons,
+   worldmarkers, and WeirdDPSMate, remain subject to their respective rights.
+   They are not placed in the public domain by this repository merely because
+   they are included in the source tree.
+
+See THIRD_PARTY_NOTICES.md, PROJECT_IDENTITY.md, Docs/, and LICENSES/ for the
+current provenance and scope record.
+
+World of Warcraft, Warcraft, Blizzard Entertainment, and associated names,
+marks, artwork, client data, and game assets remain the property of their
+respective rights holders.

LICENSES/README.md

@@ -0,0 +1,36 @@
+# Third-party license records
+
+The root `LICENSE` contains the WeirdUtils public-domain dedication, but its
+scope is limited to material for which the applicable WeirdUtils authors have
+the rights to make that dedication.
+
+Third-party material keeps its own terms.
+
+## Preserved records
+
+- `libdeflate-MIT.txt`
+  - applies to vendored `src/weirdperformance/libdeflate/`
+  - upstream: https://github.com/ebiggers/libdeflate
+
+- `VanillaFixes-MIT.txt`
+  - relevant to the timer implementation explicitly ported from VanillaFixes
+  - upstream: https://github.com/hannesmann/vanillafixes
+
+## Existing in-tree license
+
+- `../src/dpslog/WeirdDPSMate/LICENSE`
+  - GNU GPL v3
+  - applies to the WeirdDPSMate / DPSMate code as documented by that subtree
+
+## Unresolved / external
+
+The 2026-08-31 audit did not independently establish a project-wide license
+for:
+
+- bundled `src/dpslog/WSBT/` material;
+- `brues-code/UnitXP_SP3`, used as a behavior/formula reference;
+- the externally fetched Codeberg `zhook` dependency.
+
+No license is invented for those components.
+
+See `../THIRD_PARTY_NOTICES.md` for scope and provenance.

LICENSES/VanillaFixes-MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Hannes Mann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

LICENSES/libdeflate-MIT.txt

@@ -0,0 +1,22 @@
+Copyright 2016 Eric Biggers
+Copyright 2024 Google LLC
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation files
+(the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of the Software,
+and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

PROJECT_IDENTITY.md

@@ -0,0 +1,51 @@
+# WeirdUtils project identity
+
+## Current maintained GitHub repository
+
+The current GitHub repository maintained and packaged by Dusk-92 is:
+
+- https://github.com/Dusk-92/WeirdUtils
+
+The source history in this repository substantially predates the GitHub
+packaging work and contains development by MarcelineVQ. The historical/source
+project referenced by the repository is:
+
+- https://codeberg.org/MarcelineVQ/WeirdUtils
+
+A mirror, release package, or compatibility target does not imply that its
+maintainer authored every component present in the tree.
+
+## Independent community project
+
+WeirdUtils is an independent community project for the World of Warcraft
+1.12.1 client.
+
+It is not affiliated with, sponsored by, approved by, or endorsed by Blizzard
+Entertainment, Turtle WoW, OctoWoW, SuperWoW, DPSMate, MikScrollingBattleText,
+VanillaFixes, UnitXP_SP3, libdeflate, or any other referenced project unless
+explicitly stated by that party.
+
+Compatibility and reverse-engineering references do not imply endorsement,
+partnership, ownership, or official status.
+
+World of Warcraft, Warcraft, Blizzard Entertainment, and associated names,
+marks, artwork, client data, and game assets remain the property of their
+respective rights holders.
+
+## Maintainer boundary
+
+The imported Git history identifies MarcelineVQ as the principal author of the
+source project prior to the GitHub packaging work.
+
+Dusk-92's GitHub-specific commits after the imported source baseline primarily
+cover release automation/packaging and a small Zig 0.16 compatibility change.
+
+See `Docs/SOURCE_PROVENANCE.md` for the exact comparison.
+
+## Support boundary
+
+Dusk-92 is responsible only for the GitHub releases, packaging choices, and
+changes published from the maintained GitHub repository.
+
+Third-party authors and compatibility-target projects are not responsible for
+this packaging or for downstream modifications.

README.md

@@ -1,6 +1,6 @@
 # WeirdUtils
 
-> **This project is no longer actively developed.** The full source is published here, in the public domain (see `LICENSE`), so it can be forked, salvaged, or learned from rather than bit-rotting on a private disk. See [Source Code](#source-code) for details and caveats.
+> **This project is no longer actively developed.** Project-authored source is published under the public-domain dedication in `LICENSE`, subject to the documented third-party code and asset exceptions. See [Source Code](#source-code) and [Licensing & provenance](#licensing--provenance) for details.
 
 This package provides many pre-built DLLs for enhancing the vanilla 1.12 client WoW gameplay experience, aimed in particular at ease of use and accessibility but also bug fixes.
 
@@ -261,12 +261,15 @@ Most noticeable in cities, raids, during zone transitions, and in addon-heavy se
 
 ## Source Code
 
-This project is no longer actively developed. The full source is now published here,
-in the public domain (see `LICENSE`), so it can be forked, salvaged, or learned from
-rather than bit-rotting on a private disk.
+This project is no longer actively developed. Project-authored source is published
+under the public-domain dedication in `LICENSE`, subject to the documented
+third-party code, dependency, font, and asset exceptions.
 
-Earlier releases shipped as pre-built DLLs only. That is no longer the case - the
-binaries on the releases page and the source in this repo are the same project.
+Earlier releases shipped as pre-built DLLs only. Standard public module DLLs are now
+compiled from source by the GitHub release workflow. The current workflow treats
+`weirdperformance.dll` specially: it imports the configured Dusk92 Codeberg v0.7.3
+prebuilt and includes it in the generated SHA-256 manifest. See
+`Docs/BINARY_PROVENANCE.md` for the exact release boundary.
 
 Fair warning to anyone building on this: these DLLs hook deeply into the client's
 internals - memory layout, function addresses, rendering pipeline, input handling.
@@ -301,10 +304,37 @@ running under Wine/DXVK. Per-module build flags are listed by `zig build --help`
 | `docs/`, `src/*/RESEARCH.md` | Reverse-engineering notes for the subsystems being hooked |
 
 `src/dpslog/WeirdDPSMate/` is a fork of DPSMate and stays under GPL-3.0 - see its
-own `LICENSE`. Everything else is unlicensed/public domain.
+own `LICENSE`. Other documented third-party code, dependencies, fonts, visual
+assets, and reference-derived material retain their own rights or unresolved status;
+the root public-domain dedication does not override them.
 
 ---
 
+## Licensing & provenance
+
+The root `LICENSE` public-domain dedication applies only to material for which the
+applicable WeirdUtils authors have the rights to make that dedication.
+
+Important separate boundaries include:
+
+- **WeirdDPSMate / DPSMate** — GPL-3.0.
+- **libdeflate 1.25** — vendored under the MIT License.
+- **VanillaFixes-derived timer work** — upstream MIT notice preserved.
+- **WSBT / Mik material** — bundled historical third-party code; no standalone
+  license was independently established in this audit.
+- **zhook** — external pinned build dependency from Codeberg, not vendored here.
+- **BLP/TGA/fonts and game-facing resources** — not placed in the public domain
+  merely by inclusion in this repository.
+
+For the full record, see:
+
+- [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)
+- [PROJECT_IDENTITY.md](PROJECT_IDENTITY.md)
+- [Docs/SOURCE_PROVENANCE.md](Docs/SOURCE_PROVENANCE.md)
+- [Docs/BINARY_PROVENANCE.md](Docs/BINARY_PROVENANCE.md)
+- [Docs/ASSET_PROVENANCE.md](Docs/ASSET_PROVENANCE.md)
+- [LICENSES/](LICENSES/)
+
 ## Developer Notes
 ### Runtime Module Control API
 

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,189 @@
+# WeirdUtils third-party notices
+
+Audit date: 2026-08-31
+
+The root `LICENSE` contains a public-domain dedication for WeirdUtils-authored
+material. That dedication does **not** override the licenses or rights of
+third-party code, assets, fonts, game-derived media, or reference material.
+
+## Source project history
+
+The Git history imported into this repository contains substantial development
+by MarcelineVQ and references the source project at:
+
+- https://codeberg.org/MarcelineVQ/WeirdUtils
+
+The later Dusk-92 GitHub commits are documented separately in
+`Docs/SOURCE_PROVENANCE.md`.
+
+## libdeflate
+
+Vendored path:
+
+- `src/weirdperformance/libdeflate/`
+
+The bundled headers identify libdeflate version 1.25.
+
+Upstream:
+
+- https://github.com/ebiggers/libdeflate
+
+License:
+
+- MIT
+- Copyright 2016 Eric Biggers
+- Copyright 2024 Google LLC
+
+A verbatim copy of the upstream license is preserved at:
+
+- `LICENSES/libdeflate-MIT.txt`
+
+The WeirdUtils public-domain dedication does not replace libdeflate's MIT
+notice.
+
+## VanillaFixes
+
+The performance timer implementation explicitly identifies itself as:
+
+- `src/weirdperformance/timer_fix.zig`
+- "ported from VanillaFixes"
+
+Upstream:
+
+- https://github.com/hannesmann/vanillafixes
+
+License:
+
+- MIT
+- Copyright (c) 2022 Hannes Mann
+
+A verbatim copy is preserved at:
+
+- `LICENSES/VanillaFixes-MIT.txt`
+
+## WeirdDPSMate / DPSMate
+
+Bundled path:
+
+- `src/dpslog/WeirdDPSMate/`
+
+The subtree identifies DPSMate as originally by Shino <Synced> - Kronos, with
+later contributors including Torio.
+
+License:
+
+- GNU General Public License v3
+
+The authoritative license is already bundled at:
+
+- `src/dpslog/WeirdDPSMate/LICENSE`
+
+The root public-domain dedication does not apply to this subtree.
+
+The subtree also contains fonts, images, GraphLib textures, and bundled
+libraries. The presence of the DPSMate GPL file is not used here to make an
+unsupported claim about the separate underlying rights of every font or visual
+asset. See `Docs/ASSET_PROVENANCE.md`.
+
+## WSBT / Mik's Scrolling Battle Text material
+
+Bundled path:
+
+- `src/dpslog/WSBT/`
+
+The source headers identify:
+
+- Title: Mik's Combat Event Helper / Mik's Scrolling Battle Text
+- Author: Mik
+- Maintainer: Athene
+
+No standalone license file was identified in this bundled WSBT subtree during
+this audit.
+
+Accordingly, the WeirdUtils public-domain dedication does not claim to
+relicense this inherited material. Its exact licensing status remains
+unresolved unless stronger upstream evidence is later preserved.
+
+## zhook
+
+Build dependency:
+
+- https://codeberg.org/marcelinevq/zhook
+- pinned commit: `f1b252ed61ad839f00310c386761d068f293ad0f`
+- Zig package hash:
+  `zhook-0.1.0-pFkSYC6FAACAnkqu0k_DJBWdL0gJjrM22IfXeQPJAMov`
+
+`build.zig.zon` downloads zhook at build time; it is not committed as a
+vendored source tree in this repository.
+
+Its license was not independently verified during this GitHub-focused audit.
+The WeirdUtils root license therefore makes no licensing claim over zhook.
+
+## UnitXP_SP3 reference material
+
+`src/ssemaths/math_sse.zig` explicitly identifies
+`brues-code/UnitXP_SP3/polyfill.cpp` as a reference source for some function
+behavior and formulas.
+
+Reference repository:
+
+- https://github.com/brues-code/UnitXP_SP3
+
+No root project-wide license file was identified in UnitXP_SP3 during this
+audit. Reference provenance is preserved without asserting that UnitXP_SP3
+material is public domain under WeirdUtils' root license.
+
+## libSiliconPatch reference
+
+The SSE research comments also identify libSiliconPatch as a closed-source
+symbol/export reference.
+
+No libSiliconPatch binary is identified as a vendored dependency in the
+WeirdUtils source tree. Reference to its symbols or behavior does not imply
+ownership, affiliation, or a right to relicense that project.
+
+## Game-facing visual assets
+
+WeirdUtils bundles BLP/TGA assets under areas including:
+
+- `src/minimapicons/assets/`
+- `src/worldmarkers/assets/`
+- `src/dpslog/WeirdDPSMate/images/`
+- `src/dpslog/WeirdDPSMate/libs/GraphLib/GraphTextures/`
+
+It also bundles fonts under:
+
+- `src/dpslog/WeirdDPSMate/fonts/`
+
+These materials are excluded from the root public-domain dedication unless a
+specific file's rights are independently established.
+
+Some paths and filenames correspond closely to World of Warcraft client
+resource naming. This provenance audit does not claim that Dusk-92 or
+MarcelineVQ owns the underlying Blizzard or third-party artwork.
+
+See `Docs/ASSET_PROVENANCE.md`.
+
+## SuperWoW and server compatibility
+
+WeirdUtils contains compatibility logic and references for SuperWoW and
+community-server environments.
+
+Compatibility does not imply affiliation or endorsement. SuperWoW itself is
+not relicensed by WeirdUtils.
+
+## World of Warcraft / Blizzard
+
+World of Warcraft, Warcraft, Blizzard Entertainment, and associated names,
+marks, artwork, client data, and game assets remain the property of their
+respective rights holders.
+
+## Preservation rule
+
+When third-party material is updated, replaced, or removed:
+
+1. preserve its source and attribution;
+2. preserve the applicable license or permission where known;
+3. do not expand the root public-domain dedication to material whose rights are
+   not held by WeirdUtils contributors;
+4. keep provenance records even when a component stops being bundled.

src/main.zig

@@ -943,11 +943,11 @@ pub export fn DllMain(
     _: ?*anyopaque,
     reason: u32,
     _: ?*anyopaque,
-) callconv(WINAPI) i32 {
+) callconv(WINAPI) std.os.windows.BOOL {
     switch (reason) {
         1 => install(),
         0 => uninstall(),
         else => {},
     }
-    return 1;
+    return @enumFromInt(1);
 }