• Read debian/ in full except debian/watch (out of scope): changelog, clean, control, copyright, gbp.conf, nodejs/build, nodejs/files, patches/0001-gulp4-and-node-compat.patch, patches/series, rules, source/format, tests/pkg-js/files, tests/pkg-js/test, upstream/metadata.
• Inventoried and sampled all 40 files outside debian/ and .pc/; none is binary. The prescan's author check found no holder missing from debian/copyright and listed no files to explain.
• Every source file with a notice has the same Copyright (C) Microsoft. All rights reserved. / Licensed under the Apache License, Version 2.0 header (Reflect.ts, ReflectLite.ts, ReflectNoConflict.ts, globals.d.ts, index.d.ts, no-conflict.d.ts, standalone.d.ts, CopyrightNotice.txt); LICENSE is the Apache-2.0 text and package.json says "license": "Apache-2.0". Most files (gulpfile.js, tsconfig*.json, test/.ts, spec.html, README.md, docs/) have no header of their own and are covered by the repository licence through Files: *.
• grep for Copyright/(C)/(c)/SPDX/Licensed under/Permission is hereby granted/GNU/Apache/BSD/ISC/MPL/GPL/public domain/non-commercial/NoDerivatives found no other holder and no non-free wording anywhere in the tree.
• The only third-party notices are the MIT fuzzysearch block in docs/ecmarkup.js (lines 564-582) and in the same text embedded in docs/index.html (lines 575-593): Copyright (c) 2015 Nicolas Bevacqua, Copyright (c) 2016 Brian Terlson. debian/copyright has a stanza for docs/ecmarkup.js and docs/ecmarkup.css (MIT, both holders) and for docs/index.html (Apache-2.0 and MIT, both holders), and reproduces the full MIT text.
• docs/index.html is the ecmarkup build of spec.html and docs/spec.biblio.json the matching biblio; both sources are present, so the generated documents are not shipped without their preferred form. The generated file is not installed in the binary, and the tarball ships no compiled .js (debian/clean removes Reflect*.js, their maps and test/*.js that the build creates).
• Files: patterns behave correctly per copyright-format 6.9: Files: * matches everything at any depth, and the later docs/ stanzas (exact paths, no subdirectory reach) override it for the three files they name; debian/* has its own stanza, so the maintainer copyright is covered.
• AUTHORS.md names Cy Brown, Oleh Dokuka, Ron Buckton and William Buchwalter as authors, but only Ron Buckton appears in a copyright notice; the others are contributors, not holders with a notice, and debian/copyright names Buckton.
• The single patch has DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update) and only adapts the gulpfile, tsconfig files, globals.d.ts, Reflect*.ts type annotations and test/vm.ts to packaged gulp 4/TypeScript 6 and mainline Node.js APIs; it does not change runtime behaviour.
• Standards-Version 4.7.4 against Policy 4.7.4.1 from the policy tool: the first two components match, so it is current enough.
• Changelog: initial release, version 0.2.2~git20260824.acdeee4-1, distribution unstable, closes ITP #1152958; date 2026-11-05 is a Thursday, as written.
• Binary contents follow from the packaging: Reflect.js via package.json main (forced by dh-nodejs), ReflectLite.js/ReflectNoConflict.js/no-conflict.d.ts/index.d.ts via package.json types and exports, the debian/nodejs/files list, and README.md/AUTHORS.md via dh_nodejs_autodocs; docs/, spec.html and spec/ stay in the source only.
• Build-Depends resolve in the archive: dh-nodejs provides dh-sequence-nodejs (0.17.14), gulp 4.0.2, node-del 7.1.0, node-gulp-mocha 8.0.0, node-gulp-tsb 4.0.5, node-typescript 6.0.3; @types/chai and @types/mocha are provided by chai and mocha (Provides node-types-chai/node-types-mocha) and @types/node by the nodejs package (Provides node-types-node), which dh-nodejs pulls in at build time.
• uscan found the packaged version as the newest upstream release (upstream 0.2.2~git20260824.acdeee4, packaged 0.2.2~git20260824.acdeee4).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• autopkgtest dependencies: debian/tests/pkg-js/test runs gulp test:installed, which needs gulp, node-gulp-tsb, node-typescript, mocha and chai (and the @types files), but there is no debian/tests/control. pkg-js-tools is not installed on the reviewing system, so I could not read the generated 'nodejs' test definition to see whether pkg-js-autopkgtest installs those or only the package itself; an autopkgtest run would show. If it installs only the package, the test needs a debian/tests/control declaring them (and nodejs).
• Version scheme: 0.2.2~git20260824.acdeee4 sorts below a 0.2.2 release although package.json already says 0.2.2 and the snapshot is from 2026-08-24. If upstream has published 0.2.2, 0.2.2+git20260824.acdeee4 would be the correct sort order so that a later 0.2.2-1 is not treated as an upgrade over this snapshot; I could not check upstream tags without network access.
• The licence of the ecmarkup runtime and stylesheet in docs/ecmarkup.js and docs/ecmarkup.css is stated only by debian/copyright (MIT); the files themselves carry only the embedded MIT fuzzysearch notice, and upstream ecmarkup could not be consulted (node-ecmarkup is not in the archive lists).
• I could not build the package or run its tests.
• debian/watch looks at github.com/microsoft/reflect-metadata, but the Source field of debian/copyright names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.
• debian/watch looks at github.com/microsoft/reflect-metadata, but Repository in debian/upstream/metadata names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.

None.