• The prescan listed no file: its author check scanned 78 files and found every copyright holder already named in debian/copyright, so there is no file to account for individually.
• Full inventory of the upstream tree (78 files, .pc/ excluded): Makefile, install.sh, README.md, SERIALIZATION.md, LICENSE, .gitignore, an empty .gitmodules, 13 headers under include/gbwtgraph/, 20 .cpp under src/, 11 test programs plus shared.h, the GFA fixtures in tests/gfas/ and tests/gfas/set-pggname.py. All are text source or plain test data; there are no archives, object files, shared objects, bytecode, PDFs or minified JS/CSS.
• A tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, permission notices, GNU/Apache/MPL wording, public domain and All rights reserved returned matches only in LICENSE and debian/copyright. The root LICENSE (Expat, 'Jouni Siren and other authors') is the only upstream licensing statement; set-pggname.py and the GFA fixtures carry no separate terms and are covered by it.
• src/canonical_gfa.cpp is shipped but is not in LIBOBJS in the Makefile, so it is not compiled; the <handlegraph/algorithms/canonical_gfa.hpp> include removed from tests/test_gfa.cpp by the patch is not needed by anything that is built. gbwt_to_canonical_gfa() itself lives in src/gfa.cpp and uses no such header.
• Shared-library packaging: debian/rules builds libgbwtgraph.so.1.5 with SONAME libgbwtgraph.so.1 and uses d-shlibmove --multiarch --devunversioned to split it into libgbwtgraph1 (runtime) and libgbwtgraph-dev (headers under /usr/include/gbwtgraph plus the linker symlink), which matches the SONAME and Policy 8; gbwtgraph.install installs bin/*, and the Makefile builds seven tools.
• Dependencies that are visible in the sources: include/gbwtgraph/utils.h includes <openssl/evp.h>, so libssl-dev in Build-Depends and in the -dev Depends is justified; libgtest-dev is needed by tests/Makefile; pkgconf is needed by the Makefile's pkg-config probe; d-shlibs is needed by rules.
• debhelper compat 14: relationship substvars are added by dh_gencontrol itself, so the ${shlibs:Depends}/${misc:Depends} naming in control and their absence elsewhere is not an issue; dh_missing defaults to --fail-missing; dh skips override_dh_auto_test on DEB_BUILD_OPTIONS=nocheck, and the extra check in rules is harmless. Standards-Version 4.7.4 against Policy 4.7.4.1 matches in its first two components.
• Patch review: the four patches in debian/patches/series all have Description, Author and Last-Update; build_shared_library adds the shared object and -fPIC, add_ldflags_cppflags passes CPPFLAGS/CXXFLAGS/LDFLAGS into the test build, use_debian_sdsl removes the SDSL_DIR/Make.helper includes, drop_canonical_gfa_tool removes the canonical_gfa program and its test.
• The autopkgtest (debian/tests/control, debian/tests/smoke, smoke.cpp) builds a small program against libgbwtgraph and runs gfa2gbwt -c and gbz_stats -g: -c is the documented compress-GFA mode that writes .gbz, and gbz_stats -g prints the 'Nodes' line the grep looks for.
• debian/changelog is a well-formed 1.5-1 unstable entry closing #1152193; debian/source/format is 3.0 (quilt); Vcs-Git, Vcs-Browser, Homepage and debian/upstream/metadata are present and consistent.
• uscan found the packaged version as the newest upstream release (upstream 1.5, packaged 1.5).

• libgbwt-dev and libhandlegraph-dev appear nowhere in the archive lists used here (as of 2026-10-27) and are not in ftp-master's NEW list either, so their existence and versions could not be checked; if they are not yet accepted the build dependency cannot be resolved.
• libgbwtgraph-dev depends on libhandlegraph-dev (>= 20261019), while debian/patches/drop_canonical_gfa_tool states that the libhandlegraph packaged in Debian is a 2024-11-22 snapshot that lacks canonical_gfa.hpp. If that is still the packaged version the -dev package is uninstallable; if a newer snapshot exists, the patch has become obsolete. Neither state could be verified.
• The tree uses sdsl::simple_sds and debian/tests/smoke.cpp includes <sdsl/simple_sds.hpp>; the archive's libsdsl-dev is built from simongog/sdsl-lite 2.1.1, which may predate simple-sds entirely. libsdsl-dev is not installed on this system, so its contents could not be inspected; a build would show whether the header and namespace exist.
• d-shlibmove is not installed here, so it could not be checked whether its arguments lib/libgbwtgraph.so and include/gbwtgraph are resolved against the build tree: nothing stages files into debian/tmp (the upstream Makefile has no install target and debian/rules has no override_dh_auto_install), so a build would show whether execute_after_dh_install finds them.

None.