• Read debian/ in full: control, rules, changelog, copyright, clean, gbp.conf, source/format, nodejs/build, nodejs/files, patches/series and the patch, tests/pkg-js/{test,files}, upstream/metadata.
• Tree inventory outside debian/ and .pc/ (about 30 files): three Reflect*.ts entry points, globals.d.ts, index.d.ts, no-conflict.d.ts, standalone.d.ts, gulpfile.js, two tsconfig files, package.json, README.md, AUTHORS.md, CopyrightNotice.txt, LICENSE, spec.html, spec/metadata.md, test/*.ts, .github/, .vscode/, .gitignore, .npmignore, .npmrc, docs/.
• LICENSE is the complete Apache-2.0 text; CopyrightNotice.txt and every .ts/.d.ts file carry Copyright (C) Microsoft. All rights reserved. plus the Apache-2.0 header. debian/copyright names Microsoft Corporation and Ron Buckton, which matches.
• AUTHORS.md (upstream file, identical in the orig tarball) lists Cy Brown, Oleh Dokuka, Ron Buckton and William Buchwalter as authors; it asserts no copyright and the source files carry only the Microsoft notice, so no separate holder entry is required beyond Ron Buckton.
• Whole-tree grep for Copyright/(C)/©/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/public domain/All rights reserved/MIT/BSD/CC0/non-commercial/No Evil: the only wording outside the Apache-2.0 headers is the MIT block in docs/ecmarkup.js and docs/index.html (reported as an issue).
• docs/index.html is ecmarkup output generated from spec.html, which is present and complete; docs/ecmarkup.{js,css} and docs/spec.biblio.json are the ecmarkup tool's own assets shipped by upstream for the GitHub Pages docs. They are not part of the installed package and nothing in the build depends on regenerating them.
• No built binaries, bytecode, minified code or PDFs in the tree: Reflect.js/ReflectLite.js/ReflectNoConflict.js and test/*.js are produced by gulp build/gulp test and removed by debian/clean; debian/nodejs/files installs only package.json, the three generated .js and the two .d.ts named in package.json's exports.
• The orig tarball contains the same files as the unpacked tree apart from the applied quilt patch (gulpfile.js, tsconfig*.json, globals.d.ts, test/tsconfig.json, Reflect*.ts, test/vm.ts).
• Packaging checks: compat 13 + dh-sequence-nodejs (provided by dh-nodejs 0.17.14) with %: dh $@; ${misc:Depends} present, which suffices at compat 13; Standards-Version 4.7.4 vs Policy 4.7.4.1; changelog distribution unstable, initial release closing the ITP; Rules-Requires-Root: no; Multi-Arch: foreign and Architecture: all appropriate for a pure-JS module.
• Patch checks: one quilt patch with DEP-3 headers (Description, Author, Forwarded: not-needed, Last-Update), Debian-specific (gulp 4 / TypeScript 6 / @types paths under /usr/share/nodejs), no unrelated hunks.
• Autopkgtest: Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test running gulp test:installed after symlinking the installed Reflect*.js, and debian/tests/pkg-js/files copying the gulpfile, tsconfigs and test sources; test-only Build-Depends carry <!nocheck>.
• All Build-Depends resolve in unstable: gulp 4.0.2, node-gulp-tsb 4.0.5, node-typescript 6.0.3, node-del 7.1.0, node-gulp-mocha 8.0.0, chai, mocha, dh-nodejs 0.17.14; no unconditional circular or missing dependency found.
• uscan found the packaged version as the newest upstream release (upstream 0.2.2~git20260824.acdeee4, packaged 0.2.2~git20260824.acdeee4).
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• Version string 0.2.2git20260824.acdeee4-1 sorts below 0.2.2 although package.json in this 2026-08-24 snapshot already says 0.2.2. If upstream released 0.2.2 before that commit (I could not check upstream's releases), the snapshot should be based on the next version (e.g. 0.2.3git...) so that a later 0.2.2 upload is not treated as newer; if 0.2.2 is still unreleased, the current name is correct.
• The licence of the non-fuzzysearch part of docs/ecmarkup.js and of docs/ecmarkup.css (the ecmarkup tool bundle) could not be determined from the package: those files carry no licence notice and ecmarkup is not packaged in Debian, so the Apache-2.0 claim of Files: * for them rests on the upstream project's word.
• The test compile path was not executed; whether gulp-tsb 4.0.5 parses tsconfig.json/tsconfig-release.json eagerly at load (they list Reflect.ts files not copied into the autopkgtest directory by debian/tests/pkg-js/files) could not be checked, as gulp-tsb is not installed on this system.
• debian/watch looks at github.com/microsoft/reflect-metadata, but the Source field of debian/copyright names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.
• debian/watch looks at github.com/microsoft/reflect-metadata, but Repository in debian/upstream/metadata names github.com/rbuckton/reflect-metadata. Whether these are the same upstream was not checked.

None.