LocationFusion build 2 — known notices supplement

StikDebug-derived project source
The frozen source root includes the full GNU Affero General Public License version 3 text, copied here as licenses/StikDebug-AGPL-3.0.txt. Its SHA-256 is 8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef. The frozen-project audit found the same bytes at StikDebug upstream commit 734361bb9d03817ed8dd82cb27cf8b2b3792b458.

AltStore source excerpt
StikDebug/Views/ProfileView.swift in the frozen source contains the comment “from AltStore” above `dateColor` and “the following 2 extensions are from AltStore” above the Color and Date extensions. The body of `Date.numberOfCalendarDays(since:)` matches the function in AltStore/AltStoreCore/Extensions/Date+RelativeDate.swift at AltStore commit 416a8b8f43428ec6e1855057f33391194550cdd5. That upstream file's header states Copyright (C) 2019 Riley Testut. The exact pinned upstream file is included at upstream/AltStore/AltStoreCore/Extensions/Date+RelativeDate.swift (SHA-256 59636d652b774635e650ca613995aa967a6bb8ecd299157fb0fcfdd00bd2de69); the full AGPL-3.0 license for this repository is included as licenses/AltStore-AGPL-3.0.txt (SHA-256 8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef). The adjacent Color extension is explicitly attributed to AltStore in the app source, but this review did not identify its exact upstream file or commit. This notice records source evidence and does not make a legal compliance determination.

CodeEditorView 0.15.4
Source snapshot: upstream/CodeEditorView; commit aba6c189bb2f6fd9d7b8e9f5739aeb3c8c7e3254. License: Apache-2.0. Full license: upstream/CodeEditorView/LICENSE; SHA-256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.

Rearrange 1.8.1
Source snapshot: upstream/Rearrange; commit 5ff7f3363f7a08f77e0d761e38e6add31c2136e1. License: BSD-3-Clause. Full license: upstream/Rearrange/LICENSE; SHA-256 72512faf072d3a4c0d9ae21552e0a3367e87b719ac511d06d2b5a0e427e8796d.

Known binary boundary
The frozen source ZIP includes StikDebug/idevice/libidevice_ffi.a (SHA-256 4db23fe1d342927b9480bb9a8577f219994365621dc28aa0018e23ea1990ecc8). Read-only Git object evidence ties these exact bytes to blob 3fb7e2dbfdb9db3d47bd6364a435bbc10d5581f9 at the audited StikDebug pin 734361bb9d03817ed8dd82cb27cf8b2b3792b458. History shows this blob first appears at StikDebug commit f76672838bef86791958b9b1c5a0e97de88cef1c. This establishes the binary's StikDebug repository ancestry, not the Rust source revision, build inputs, or all licenses of components statically included in it. No candidate idevice source is claimed as corresponding source. This known-source supplement is therefore partial and is not complete corresponding source.
