• debian/copyright read in full: DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), header Upstream-Name: gcsa2, Source: https://github.com/jltsiren/gcsa2, Files-Excluded: paper; stanzas Files: * (Jouni Siren, Genome Research Ltd., Expat), Files: debian/* (Michael R. Crusoe, Expat), and a complete stand-alone Expat License text.
• Pre-review scan listed only the dfg-author-check result: 31 files scanned, and it concluded every holder found is named in debian/copyright; it flagged no non-free wording and no built/binary/minified files. Accounted for in full.
• Full-tree glob (46 files, .pc/ and debian/ excluded) shows only C++ sources/headers, Makefiles, README.md, LICENSE, install.sh and .gitignore: no binaries, minified code, fonts/images, PDFs, archives or generated files, so no preferred-form-of-modification issue. The paper/ directory is absent, consistent with Files-Excluded: paper and the 1.4+dfsg repack.
• LICENSE is the complete Expat text listing only Jouni Siren (2018,2019,2021,2025,2026) and Genome Research Ltd. (2015-2017). Every src/.cpp, include/gcsa/.h and benchmark/*.cpp either carries that identical MIT header or (src/dbg.cpp, src/internal.cpp, src/lcp.cpp, src/path_graph.cpp, src/support.cpp, include/gcsa/{dbg,files,gcsa,internal,lcp,path_graph,support,utils}.h) has none, and is covered by the top-level LICENSE, so none is unlicensed; holders are only Siren/GRL. debian/copyright's condensed years are minor drift, not a missing holder.
• No embedded third-party code: patches use Debian's libsdsl (use_debian_sdsl removes the ../sdsl-lite references) and drop the divsufsort link line; Debian's libsdsl3 carries no runtime libdivsufsort dependency, so -ldivsufsort is genuinely unneeded.
• Packaging verified from the tree and reference tools: debian/control split (gcsa2 / libgcsa2-1 libs / libgcsa2-dev libdevel, all Architecture: any, Multi-Arch: same on both library packages), Build-Depends debhelper-compat (= 14), d-shlibs, libsdsl-dev (>= 2.4); apt-cache shows libsdsl-dev at 2.1.1+dfsg-6+b1 with a 2.4+dfsg-1 upload in NEW that satisfies the versioned dependency, runtime lib is libsdsl3.
• debian/rules: dh $@, compat 14 via debhelper-compat, hardening=+all exported (also set in the patched Makefile through buildflags.mk, so CPPFLAGS/CXXFLAGS/LDFLAGS reach objects, the shared library and the programs); dh_auto_build passes MY_CXX=g++ INC_DIR=/usr/include LIB_DIR=/usr/lib; execute_after_dh_install creates the .so symlinks then runs d-shlibmove --commit --multiarch --devunversioned --exclude-la --override 's/libsdsl4-dev/libsdsl-dev/' --movedev include/gcsa usr/include lib/libgcsa2.so; Makefile has no install target so dh_auto_install is a no-op and dh_install(1) finds bin/* in the source root (compat-14 fallback), as gcsa2.install expects.
• SONAME libgcsa2.so.1 (build_shared_library patch) matches package libgcsa2-1; binaries statically link libgcsa2.a and need only libsdsl/libstdc++/libgomp at runtime via dh_shlibdeps.
• debian/source/format 3.0 (quilt); debian/upstream/metadata present; debian/tests/control Tests: compile-link with Depends (libgcsa2-1, libgcsa2-dev, build-essential, libsdsl-dev), matching the dsc's Testsuite-Triggers; smoke.cpp compiles and runs against both the shared (-lgcsa2) and static (/usr/lib/$MULTIARCH/libgcsa2.a) library.
• debian/changelog: 1.4+dfsg-1 unstable; initial release (Closes: #1151599) with valid date/author. Standards-Version 4.7.4 is current (Policy reads 4.7.4.1). Vcs-Git/Vcs-Browser point at salsa.debian.org/med-team/gcsa2; Homepage correct. Substvars are named explicitly in control, harmless at compat 14.
• uscan found the packaged version as the newest upstream release (upstream 1.4, packaged 1.4+dfsg).

• The build and d-shlibmove were not run: the shared library's placement in the Multi-Arch path and the exact generated dependencies (including the libsdsl3 runtime dependency) are inferred from the tooling and package layout, not observed.
• d-shlibmove(1) is not installed on the reviewing system, so --movedev/--override semantics were not verified first-hand.

None.