• Read all 13 upstream files: Cargo.toml, Cargo.toml.orig, Cargo.lock, .cargo_vcs_info.json, build.rs, src/lib.rs, src/node.rs, src/node_ext.rs, src/string_query.rs, src/parse_result/{mod,comments,diagnostics}.rs and vendor/prism-2.1.0/config.json. None carries its own copyright or licence header; the crate declares license = "MIT" and the only licence evidence is Expat, matching debian/copyright's License: Expat stanza and its complete permission/no-warranty text.
• vendor/prism-2.1.0/config.json is the JSON node/flag/error-code configuration that build.rs opens (vendor/prism-<CARGO_PKG_VERSION>/config.json, build.rs:104-107) to generate bindings.rs at build time; it is upstream source data, not a built artifact, and the code generator that consumes it is in the package.
• The prescan's author check found no holder in the tree that debian/copyright omits; the inaccuracy is the opposite one, the holder it names (see issue).
• Only Expat is involved, so the licences in the binary are compatible; debian/* is under Expat too, and the full licence text is included, so no pointer to /usr/share/common-licenses is required (its current form is correct either way).
• Packaging files read in full: control, rules, changelog, debcargo.toml, copyright.debcargo.hint, source/format (3.0 quilt), patches/series and patches/auto/auto-remove-features.patch, tests/control, upstream/metadata. The single patch is debcargo's autogenerated feature removal (default vendored dropped plus the matching unexpected_cfgs check-cfg) and the unpacked Cargo.toml shows it applied.
• Build-Depends-Arch mirrors the crate's [build-dependencies] (serde, serde-json) and [dependencies] (ruby-prism-sys); the binary Depends mirrors [dependencies] plus the build-dependencies consumers need to run build.rs, and carries ${misc:Depends}.
• librust-ruby-prism-sys-dev is absent from the archive but built by rust-ruby-prism-sys 2.1.0+ds-1, waiting in NEW; the versioned dependency is satisfiable. dh-cargo 34 provides dh-sequence-cargo, so the tests' dh-cargo (>= 33~) is met.
• rules overrides dh_auto_test with dh_auto_test -- test --all; the crate has no dev-dependencies, so no test-only Build-Depends is missing. The override is skipped under nocheck at compat 13, matching the <!nocheck> markers.
• Standards-Version 4.7.4 against Policy 4.7.4.1: current. Changelog 2.1.0-1, unstable, urgency medium, closes nothing; .dsc is PGP-signed and its checksums cover the orig and debian tarballs.
• The orig tarball contains exactly the reviewed tree (crate include list: src/, build.rs, Cargo.toml, Cargo.lock, vendor); no file was pruned by repacking, and no Files-Excluded is needed.
• uscan found the packaged version as the newest upstream release (upstream 2.1.0, packaged 2.1.0).

• The crate tarball ships no LICENSE file, so upstream's own copyright notice was not read; the holder is taken from /usr/share/doc/ruby-prism/copyright, Debian's package of the same upstream repository, rather than from the upstream file itself.

None.