• Read debian/copyright, control, rules, changelog, gbp.conf, source/format, upstream/metadata, lrc.config, salsa-ci.yml and gitlab-ci.yml in full, and all 34 upstream files of the tree (debian/ excepted as instructed, .pc/ ignored).
• The four UCD files the scan listed - textseg/internal/charprops/ucd/DerivedCoreProperties.txt, ucd/auxiliary/GraphemeBreakProperty.txt, ucd/auxiliary/GraphemeBreakTest.txt, ucd/emoji/emoji-data.txt - each begin # © 2025 Unicode®, Inc. with # Unicode and the Unicode Logo are registered trademarks of Unicode, Inc. in the U.S. and other countries. and a pointer to the Unicode terms; they are matched by the Unicode-3.0 stanza, whose text is verbatim the Unicode License V3 of textseg/internal/charprops/ucd/license.txt. The 2025 header year against 1991-2026 in the copyright file is year drift only.
• Unicode License V3 is a free licence (permission to use, copy, modify, merge, publish, distribute and sell, subject to notice retention), so the UCD data is DFSG-compliant; the lrc.config line only teaches licensecheck the short name Unicode-3.0 and is not a licence statement.
• The top-level LICENSE is the Expat text reproduced under License: Expat in debian/copyright, with Copyright (c) 2017 Martin Atkins matching Copyright: 2017 Martin Atkins. No other file in the tree carries a copyright or licence notice (grep for Copyright/(C)/©/SPDX/Licensed under/public domain/All rights reserved over all files).
• Textseg/internal/machine/state.go says it is a Go port of a Rust implementation in the "grapheme_machine" package on crates.io; debian/copyright's Comment records this, and it is the same author's MIT crate, so no extra holder or licence is needed.
• textseg/internal/charprops/property_table_raw.go is the only generated file in the tree (// Generated by generate.go. DO NOT EDIT!); its generator (charprops/generate.go, //go:generate go run ./generate.go) and its inputs (gentable/, ucdparse/ and the ucd/*.txt files) are all present, so it is shipped with its preferred form for modification. No binaries, bytecode, minified files, archives or PDFs are in the tree.
• autoversion/ is a separate Go module whose go.mod requires github.com/apparentlymart/go-textseg/v15; DH_GOLANG_EXCLUDES := ^(github.com/apparentlymart/go-textseg/v17/)?autoversion(/|$)$$ matches both the full import path and the relative directory, and with compat 14 DH_GOLANG_EXCLUDES_ALL defaults to true, so the module is neither built nor installed and its v15 dependency needs no Build-Depends (autoversion/textseg/version_agnostic.go imports v15).
• The tests open the UCD data by relative path - property_table_test.go os.Open("ucd/auxiliary/GraphemeBreakProperty.txt"), textseg/grapheme_clusters_test.go internal/charprops/ucd/auxiliary/GraphemeBreakTest.txt - and DH_GOLANG_INSTALL_EXTRA := textseg/internal/charprops/ucd is what puts those files into the build workspace: the installed Debian::Debhelper::Buildsystem::golang runs a second File::Find over the extras and copies them to $builddir/src/$DH_GOPKG/, which is where those relative paths resolve. The same files are then installed into /usr/share/gocode, so the generated autopkgtest-pkg-go test can use them too.
• --builddirectory=debian/_build is safe: golang.pm's source-copy File::Find preprocess skips the top-level debian directory (and .pc, .git and the builddir), so the build directory under debian/ cannot be copied into itself, and golang.pm's clean stage removes it. GO111MODULE=off/GOPROXY=off are the buildsystem's defaults, so the empty root go.sum is fine.
• Build-Depends all resolve in unstable: debhelper-compat (= 14); dh-go 1.69, which provides the golang addon and buildsystem and Conflicts with dh-golang, so --with=golang is right; golang-any; and dpkg-build-api (= 1), provided by dpkg-dev 1.23.11.
• Per dpkg-build-api(7), level 1 makes Rules-Requires-Root default to no, so leaving the field out is correct; Depends: ${misc:Depends} at compat 14 is harmless and dh_gencontrol fills the relationship substvars itself.
• Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components match, so it is current.
• Multi-Arch: foreign on the Architecture: all -dev package is the Debian Go team convention (golang-github-spf13-cobra-dev is the same), and the package installs no binaries, so no sharing question arises.
• No debian/patches/series, no patches, no maintainer scripts, no *.maintscript, no debian/tests directory (the Testsuite: autopkgtest-pkg-go metarunner plus dh_golang_autopkgtest covers testing); changelog is an initial release to unstable closing #1153351, matching Source/version 17.0.1-1 in the .dsc and the .dsc's Go-Import-Path.
• uscan found the packaged version as the newest upstream release (upstream 17.0.1, packaged 17.0.1).

• Not built or tested here, so the build workspace layout the tests depend on is reasoned from the dh-golang buildsystem source, not observed; no build failure is suspected.
• The exact author of textseg/internal/charprops/ucd/README is inferred from its text (it describes the upstream project's vendoring of the UCD) - it is certainly not a Unicode, Inc. document, which is what the reported issue rests on.

None.