docs+ui: cite every source in use; surface behavior & safety in the demo (#59)

Sources (SOURCES.md): full attribution for everything we actually pull in/use —
PubChem (name/CAS resolution + experimental BP/VP + CAS→InChIKey; public domain,
no commercial restriction), FDA SAF (GRAS, public domain), thermo (Joback eval,
rejected; 33 °C mean error), NIST GC/RI (paid, not used), Tox21 (public domain,
clean candidate, not yet built). BitterDB corrected: CC-BY-NC → academic only.
FEMA use levels noted as copyrighted (data-gated).

Workbench: new "Behavior & safety" card surfaces what predict.py already returns
but the UI hid — MW/logP, measured boiling point / vapor pressure (when the PubChem
table is built), volatility tier, food-use (GRAS) status, preliminary TTC tier, and
structural-alert caution chips. Defensive framing kept ("flags for review, never a
clearance").

Signed-off-by: Austin L. <86896075+rvnminers-A-and-N@users.noreply.github.com>

Author: rvnminers-A-and-N

docs/SOURCES.md

@@ -18,7 +18,9 @@ record of provenance, not legal advice. Get an IP/OSS-license review before ship
 - **NumPy**, **pandas** — arrays + dataframes. (BSD-3-Clause.)
 - **UMAP** — 2D odor/flavor-space map. (BSD-3-Clause.)
 - **skl2onnx** — exports the sklearn taste models to ONNX. (Apache-2.0.)
-- *(thermo — evaluated for Joback boiling point, then REJECTED for accuracy; not shipped. MIT.)*
+- **thermo** — used to evaluate Joback structure-based boiling point; **REJECTED** (mean
+  abs error 33 °C across 12 flavor molecules, max 89 °C). Not shipped. (MIT.)
+- **PubChem / FDA SAF** — data sources for measured properties + GRAS; cited under *Data sources*.
 
 **Product / serving side**
 - **ONNX** + **ONNX Runtime** — run taste models in-process in .NET. (MIT.)
@@ -39,17 +41,30 @@ record of provenance, not legal advice. Get an IP/OSS-license review before ship
 - **FartDB** — FartLabs (HuggingFace), ~31k tastants behind the 2025 *npj Science of Food* "FART" model — the largest public tastant set. Repo labeled **MIT**, but it **composites FlavorDB (CC-BY-NC-SA) + SciFinder (CAS, proprietary) + Tas2R-DB (ACS)**; the MIT badge cannot relicense data the authors don't own. **Excluded** (NonCommercial/proprietary upstream) — the same "downloadable ≠ usable" trap as OpenPOM's GS-LF.
 - **SweetenersDB v2.0** — Bouysset et al. (2020) *Food Chem.*, building on Chéron et al. (2017); relative-to-sucrose sweetness *intensity* for the regressor. Released **MIT** by the authors' own lab (ChemSenSim, `github.com/chemosim-lab/SweetenersDB`) — the paywall is only on the journal article, not the authors' own data. **In use.**
 - **PlantMolecularTasteDB** — Gradinaru et al. (2022), *Frontiers in Pharmacology* (DOI 10.3389/fphar.2021.751712); 1,527 taste-active phytochemicals. The **article** is CC-BY, but the **database** is web-only (plantmoleculartastedb.org) with **no open data license** and an **i-Depot** IP/authorship registration by the authors — article-CC-BY does **not** extend to the database. **Excluded** pending an explicit commercial grant; article-CC-BY ≠ database-CC-BY (same lesson as Pyrfume/OpenPOM).
-- **BitterDB** *(future)* — bitterness intensity, if/when added.
+- **BitterDB** — Niv lab (Hebrew U), >2,200 bitter compounds. License **CC BY-NC 3.0
+  (NonCommercial)** — commercial use needs a separate license. **Excluded from the
+  commercial edition**; a candidate for the **academic edition's** bitterness-intensity head.
 - **UMP442 / BIOPEP-UWM** — umami references. BIOPEP-UWM is web-only; the GitHub repost `Shoombuatong/Dataset-Code` carries **no license** (all-rights-reserved) and is umami *peptide* data (a different class from our small-molecule head). **Not used.**
 
 **Aroma**
 - **Pyrfume** + **Leffingwell / GoodScents (GS-LF)** odor datasets — the usual training data behind OpenPOM, but **RESTRICTED and NOT USED**: Leffingwell's manifest cites use restrictions (*John Leffingwell & Google*); GoodScents/Arctander/Flavornet (© Datu Inc.) are likewise proprietary. We **exclude all of them** (the demo may go to a customer / commercial use). The aroma model will use only commercial-clean **open** odor data (CC-BY sets like `keller_2016`; smaller — see `DATA-SOURCES.md`). The OpenPOM *code* is MIT.
 - **keller_2016** — Keller & Vosshall (2016), *BMC Neuroscience*, **CC-BY-4.0**; ~480 molecules with naive-subject odor-descriptor ratings. The only commercially-clean odor-descriptor set — evaluated for the aroma model and found too noisy to learn from (CV-R² ≤ 0 across all 20 descriptors; see `docs/AROMA.md`).
 
-**Safety / regulatory (lookups — data-gated)**
-- **FEMA GRAS list** — usual/maximum use levels for the dosing analyzer. (FEMA.)
+**Safety / regulatory / properties**
+- **FDA "Substances Added to Food" (SAF)** — the GRAS / recognized-food-ingredient
+  cross-check. **US-government work, public domain.** In use via `build_gras_reference.py`.
+- **FEMA usual/maximum use levels** — for *quantitative* dosing. Published in FEMA's
+  copyrighted GRAS papers — **not freely available in bulk**; data-gated (customer/licensed).
 - **EU declarable fragrance/flavor allergen annex** — the labeling flags. (EU regulation.)
-- **PubChem** — name↔SMILES↔CID resolution. (Public domain data; confirm API terms.)
+- **PubChem** (NIH/NCBI) — used three ways: name/CAS↔SMILES↔CID resolution; experimental
+  **boiling point / vapor pressure** (`build_properties.py`); and CAS→InChIKey for GRAS
+  (`build_gras_reference.py`). **Public domain — no restriction on use, incl. commercial**
+  (attribution appreciated).
+- **NIST GC/RI library** — Kovats retention indices. **PAID** (~$595 data-only FTP to
+  ~$2,850 single-seat) — *not used* (paywall); RI deferred to customer/licensed data. (RI
+  is **not** in PubChem — verified by probe.)
+- **Tox21** (NIH/NCATS · EPA · FDA · NTP) — public toxicity-assay data (public domain, on
+  PubChem / data.gov). A **clean candidate** for caution-only tox flags; **not yet built**.
 
 ---
 

training/workbench.html

@@ -66,6 +66,9 @@
   .aroma-lead b{color:var(--aroma)}
   .aroma-note{font-size:13px;color:var(--muted);margin:0;line-height:1.55;max-width:760px}
   .aroma-note b{color:var(--ink)}
+  .kv{display:grid;grid-template-columns:auto 1fr;gap:6px 16px;margin-bottom:10px}
+  .kv .k{font-weight:600;font-size:13px}
+  .kv .v{font-family:var(--mono);font-size:13px;color:var(--muted)}
 </style>
 </head>
 <body>
@@ -97,6 +100,11 @@ <h2>Substitution candidates</h2>
     </div>
   </div>
 
+  <div class="card" id="behaviorCard" style="display:none">
+    <h2>Behavior &amp; safety</h2>
+    <div id="behavior"></div>
+  </div>
+
   <div class="card aroma-card" id="aromaCard" style="display:none">
     <h2>Aroma</h2>
     <div class="aroma-lead">Aroma prediction unlocks with <b>your</b> data.</div>
@@ -152,7 +160,7 @@ <h2>Aroma</h2>
     if(p.error){ throw new Error(p.error); }
     render(p, n.neighbors||[]);
   }catch(e){
-    $('results').style.display='none'; $('aromaCard').style.display='none'; $('footnote').style.display='none';
+    $('results').style.display='none'; $('behaviorCard').style.display='none'; $('aromaCard').style.display='none'; $('footnote').style.display='none';
     $('err').textContent = e.message; $('err').style.display='block';
   }finally{
     go.disabled=false; go.textContent='Read flavor';
@@ -191,12 +199,32 @@ <h2>Aroma</h2>
       </div>`).join('');
   }
 
-  $('results').style.display='grid'; $('aromaCard').style.display='block'; $('footnote').style.display='block';
+  renderBehavior(p);
+  $('results').style.display='grid'; $('behaviorCard').style.display='block'; $('aromaCard').style.display='block'; $('footnote').style.display='block';
   // animate bar fills
   requestAnimationFrame(()=>document.querySelectorAll('.fill')
     .forEach(f=>f.style.width=f.dataset.w+'%'));
 }
 
+function renderBehavior(p){
+  const pc = p.physchem||{}, sf = p.safety||{};
+  const comp = pc.computed||{}, meas = pc.measured||{}, qual = pc.qualitative||{};
+  const MEAS = ' <span class="tag measured">measured</span>';
+  const rows = [];
+  if(typeof comp.mol_weight==='number') rows.push(['MW', comp.mol_weight+' g/mol']);
+  if(typeof comp.logP==='number') rows.push(['logP', comp.logP]);
+  if(typeof meas.boiling_point_c==='number') rows.push(['Boiling point', meas.boiling_point_c+' °C'+MEAS]);
+  if(qual.aroma_volatility) rows.push(['Volatility', qual.aroma_volatility]);
+  if(typeof meas.vapor_pressure_pa==='number') rows.push(['Vapor pressure', meas.vapor_pressure_pa+' Pa'+MEAS]);
+  if(sf.gras_status) rows.push(['Food-use status', sf.gras_status]);
+  if(sf.ttc_hint && sf.ttc_hint.preliminary_tier) rows.push(['TTC tier (prelim.)', sf.ttc_hint.preliminary_tier]);
+  let html = '<div class="kv">'+rows.map(r=>`<div class="k">${r[0]}</div><div class="v">${r[1]}</div>`).join('')+'</div>';
+  const alerts = sf.structural_alerts||[];
+  if(alerts.length) html += '<div class="chips">'+alerts.map(a=>`<span class="chip" style="background:#FBEDE9;color:#8A3A22;border-color:#E7C4B8">⚠ ${a}</span>`).join('')+'</div>';
+  html += '<div class="empty" style="font-size:12px">Defensive screen — flags for review, never a clearance.</div>';
+  $('behavior').innerHTML = html;
+}
+
 function chip(key, on, color, label){
   const style = on && color ? `style="background:${color}"` : '';
   return `<span class="chip ${on?'on':''}" ${style}>${label}</span>`;