• Inventoried the whole tree (336 files): root files, build/, docs/, scripts/, src/ (basic-languages with 91 directories, fillers/, language/), test/{unit,smoke} and debian/. .pc/ was not read.
• Grepped every source file for Copyright / (C) / © / Licensed under / SPDX-License-Identifier / Permission is hereby granted / GNU / Apache / Mozilla / public domain / All rights reserved: all headers are Microsoft's MIT notice ( * Copyright (c) Microsoft Corporation. All rights reserved. + * Licensed under the MIT License.), except src/basic-languages/swift/swift.ts (David Owens II, owensd.io), src/basic-languages/postiats/{postiats.ts,postiats.test.ts} (Artyom Shalkhakov) and src/basic-languages/wgsl/{wgsl.ts,wgsl.test.ts} (Microsoft Corporation, Google LLC) - all MIT and all covered by a debian/copyright stanza, with the two holder-scoping errors reported above.
• LICENSE.txt ("The MIT License (MIT)", "Copyright (c) 2016 - present Microsoft Corporation") is the Expat text debian/copyright inlines; README.md:122 points at it. Only one LICENSE/NOTICE-style file exists in the tree, the root LICENSE.txt.
• ThirdPartyNotices.txt is upstream's MIT-licensed NOTICE file (Microsoft's Files: *) reproducing the licence texts of components Microsoft ships in its npm bundle. The five holders the prescan found in it - Einar Lielmanis/Liam Newman (js-beautify 1.6.2, MIT), The Khronos Group (WebGL, MIT-like), Unicode, Inc (Unicode data files), W3C® (MIT, ERCIM, Keio, Beihang) (HTML 5.1), WHATWG (Apple, Google, Mozilla, Microsoft) (DOM, CC-BY-4.0) - are the holders of those components, not of this file, and none of them has code anywhere in the source package: greps for beautif/Lielmanis/drifty/Khronos/WD-html51/'Unicode, Inc'/owensd over the whole tree match that file alone. The one component named there that is in the tree, vscode-swift (David Owens II), is src/basic-languages/swift/swift.ts and has its own stanza. No stanza for them is needed.
• That notice file also names 'Ionic documentation' (Drifty Co.) and a W3C Community Final Specification Agreement text; both belong to upstream's dropped samples/ and manual-test material, which the repack removes (see debian/README.source and the DROP list in debian/get-orig-source), so nothing in the tree is under those terms.
• src/basic-languages/freemarker2/freemarker2.ts says it is 'adapted from the official JavaCC grammar for FreeMarker' (a comment, with a URL); the file's own header is Microsoft's MIT notice, assigned to Microsoft with the attribution kept, which is upstream's licensing decision, not a missing stanza.
• No minified JS, .map, .jar, .class, .so, .dll, .exe, .pyc, .ttf/.otf/.woff, .pdf, .zip, .gz or .wasm in the tree (glob for all of those: no matches). package-lock.json is npm's lock data, not a built artefact. docs/{code-structure.dio.svg,out-folders.dio.svg,debugging-core.gif,debugging-languages.gif,"launch config.png"} are upstream's documentation images, carried by Files: *; the two .dio.svg are the editable diagram sources, so the media have a preferred form for modification.
• No non-free wording anywhere (searched non-commercial/noncommercial/not for commercial/research only/no derivative/field of use/CC BY-NC/Attribution-NoDerivs/Good, not Evil: no matches outside the licence texts quoted in ThirdPartyNotices.txt, none of which applies to a file in the tree).
• debian/copyright is DEP-5 (Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/), has Upstream-Name/Source, Files: , the three upstream stanzas, a debian/ stanza (Emfox Zhou, 2026, consistent with the changelog) and a stand-alone License: Expat paragraph whose text matches LICENSE.txt. No Files-Excluded field.
• debian/control and the .dsc agree; Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool) is current; Distribution unstable, version 0.47.0+ds-1, source format 3.0 (quilt), orig monaco-editor_0.47.0+ds.orig.tar.gz consistent with the +ds repack documented in README.source.
• Build-Depends all resolve in the archive: esbuild 0.28.2-1 (which Provides node-esbuild and node-esbuild-linux-x64, so $SHARE/esbuild exists), fonts-codicons 0.0.46-42-1, node-glob 13.0.6, node-jsonc-parser 3.3.1, node-typescript 6.0.3 (>= 6.0.0 satisfied), node-vscode-{css,html,json}-languageservice, node-vscode-l10n, node-vscode-languageserver-{types,textdocument}, node-vscode-uri. node-monaco-editor-core is in no list - it is the companion engine package of the same upload, not in the package lists yet, so not a fault. @types/node comes from nodejs (node-types-node virtual), which node-typescript pulls in, so the tsc --typeRoots in debian/build.sh is satisfiable.
• debian/patches: all six carry DEP-3 headers (Description, Origin: vendor, Forwarded: not-needed) and each is explained in debian/README.source; they adapt the sources to TypeScript 6, take the commit from the environment, skip the AMD tree, read TypeScript from the package, drop the prettier pass and raise the stack.
• debian/clean lists node_modules/, out/ and the six build/*.js the tsc call emits plus the five files build/importTypescript.ts and package-json.cjs generate, which is everything debian/build.sh writes into the tree (importLibs writes only lib.ts and lib.index.ts); no unnamed generated file is left behind.
• dh_auto_test does nothing here: the man page says the make target is only run 'if there's a Makefile and it contains a test or check target' and there is no Makefile, so dh $@ without an override_dh_auto_test cannot fail the build.
• The installed tree duplicates the engine files that node-monaco-editor-core installs (debian/rules copies out/monaco-editor wholesale), which is upstream's own layout - the npm monaco-editor package embeds monaco-editor-core's ESM tree - and what makes the tree usable by a bundler, so not a fault.
• debian/tests/pkg-js/{SKIP,test} exist alongside Testsuite: autopkgtest-pkg-nodejs; the test checks the installed tree's entry points, metadata, one language bundle and the four workers, and greps the installed esm tree for build-path leakage.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.57.0, packaged 0.47.0+ds), which is not a fault of the package.

• fonts-codicons' file list could not be read directly (apt-cache shows only control fields, and the package is not installed on this system): a build, or the package's .deb contents, would settle whether the font is only at /usr/share/fonts-codicons/codicon.ttf, as its Description says, or whether /usr/share/fonts/truetype/codicons/codicon.ttf also exists. The issue above rests on that description.
• The script mode of debian/tests/pkg-js/test, debian/get-orig-source and debian/build.sh, and whether the pkg-js autopkgtest runner honours the SKIP file (its README and runner are not installed on this system), could not be checked.
• The contents of the binary media (docs/.gif, docs/.png) were not read, as instructed, and package-lock.json (425 KB of npm lock data) was not read in full; both are upstream's and are covered by Files: *.

None.