Backfill qqTimer and scrambles legal evidence state

docs/HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.md

@@ -5,18 +5,18 @@ Scope: deduped local mirror custody across `C:\Workspaces\HyperTwist\mirrors\{pe
 Boundary:
 - this is the repo-local legal-evidence pass for mirrored HyperTwist custody, not a rewrite of the broader historical workbook universe
 - only standalone git roots count in the live audit
-- package-subpath rows, non-standalone mirror paths, and missing mirror paths stay visible as exclusions instead of being silently counted
+- package-subpath rows, non-standalone mirror paths, upstream-unavailable rows, and unresolved missing mirror paths stay visible as exclusions instead of being silently counted
 - when later repos are mirrored or their root-license evidence changes, rerun `C:\HyperTwist\scripts\Write-HyperTwistRepoLicenseEvidenceAudit.ps1` in the same pass that updates the legal tracker
 
 Counts:
-- total deduped repos scanned: 65
+- total deduped repos scanned: 66
 - clear repo-local license file or explicit mixed root-license declaration: 59
 - MIT with clear root license file: 33
 - MIT from README only, no root license file: 1
 - MIT from repo metadata only, no root license file: 1
-- no clear repo-local license signal: 4
-- no-clear bucket where current HyperTwist manifest already carries a legal call: 4
-- non-standalone or missing mirror paths excluded from the live count: 13
+- no clear repo-local license signal: 5
+- no-clear bucket where current HyperTwist manifest already carries a legal call: 5
+- non-standalone, upstream-unavailable, or missing mirror rows excluded from the live count: 12
 
 Artifacts:
 - audit CSV: `docs/generated/license_audit/HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.csv`
@@ -33,11 +33,11 @@ No clear repo-local license signal:
 - alinen/cube - current manifest call: `No explicit license found`
 - ambisinister/blindsolve - current manifest call: `No explicit license found`
 - AviKaufman/Rubix-cube-trainer - current manifest call: `All rights reserved`
+- cubing/qqTimer - current manifest call: `No explicit license found`
 - poliva/cubedex - current manifest call: `No explicit license found`
 
 Excluded from the live standalone-git-root count:
-- C:\Workspaces\HyperTwist\mirrors\permissive\cubing\qqTimer (`missing_local_path`)
-- C:\Workspaces\HyperTwist\mirrors\permissive\cubing\scrambles (`missing_local_path`)
+- C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\scrambles (`upstream_unavailable_or_not_publicly_resolvable`)
 - C:\Workspaces\HyperTwist\mirrors\permissive\google\model-viewer\packages\model-viewer-effects -> C:/Workspaces/HyperTwist/mirrors/permissive/google/model-viewer (`non_standalone_git_subpath`)
 - C:\Workspaces\HyperTwist\mirrors\permissive\google\model-viewer\packages\modelviewer.dev -> C:/Workspaces/HyperTwist/mirrors/permissive/google/model-viewer (`non_standalone_git_subpath`)
 - C:\Workspaces\HyperTwist\mirrors\permissive\google\model-viewer\packages\render-fidelity-tools -> C:/Workspaces/HyperTwist/mirrors/permissive/google/model-viewer (`non_standalone_git_subpath`)

docs/REPO_LICENSE_TRACKING.md

@@ -100,6 +100,10 @@ Required rule:
   deep-source pass materially refreshes a relied-on repo row, update:
   - `C:\HyperTwist\docs\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.md`
   - `C:\HyperTwist\docs\generated\license_audit\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.csv`
+- if a retained repo URL is not publicly resolvable and no local mirror exists,
+  record that as an explicit `upstream-unavailable` exclusion in the manifest,
+  generated audit bundle, and this root tracker instead of leaving it as an
+  accidental generic missing-path row
 - if a repo resolves to `MIT` from a repo-root license file, capture the exact
   repo-root `MIT` text under:
   - `C:\HyperTwist\docs\generated\license_audit\MIT_LICENSE_TEXTS_2026-05-27\`
@@ -635,6 +639,81 @@ Approved working posture:
 - preserve as a landed first-party permissive lane
 - widen only through ordinary owned enhancement work
 
+### `cubing/qqTimer`
+
+Decision date:
+
+- `2026-05-27`
+
+Current licensing judgment:
+
+- the repo is now mirrored locally
+- no explicit license is visible at the checked mirror root
+- the checked root surface currently lacks a standalone `LICENSE`, `COPYING`,
+  or `NOTICE` file
+- the checked `README.md` attributes the timer to `Michael Gottlieb` and this
+  repo variant to `Lucas Garron`, but does not grant a standalone permissive
+  code license
+- treat the row as restrictive custody and `license-missing`
+- not a live HyperTwist lane; retained supplemental timer reference only
+
+Source basis:
+
+- `C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer\README.md`
+- `C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer\Makefile`
+- `C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer\docs\index.htm`
+- `C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer\docs\scramble_333_edit.js`
+
+Practical obligations:
+
+- keep the mirror in restrictive custody
+- do not treat the row as a direct donor-use approval
+- Model B must not read this mirror
+- if a later source-backed license basis appears, reopen this row selectively
+  instead of silently flattening it back into permissive custody
+
+Approved working posture:
+
+- retain as a supplemental timer reference and clean-room candidate only
+- use it for source inspection, timer-behavior reference, or independently
+  owned reimplementation planning
+- do not widen from the mirror as a normal permissive donor lane
+
+### `cubing/scrambles`
+
+Decision date:
+
+- `2026-05-27`
+
+Current licensing judgment:
+
+- the retained repo URL is currently not publicly resolvable from this pass
+- no local mirror is present
+- no repo-root license signal could be checked in current local custody
+- direct donor use is not cleared
+- keep the row as an explicit upstream-unavailable supplemental exclusion
+  rather than a generic missing-path oversight
+
+Source basis:
+
+- `C:\Workspaces\HyperTwist\repos.manifest.json`
+- `C:\HyperTwist\docs\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.md`
+
+Practical obligations:
+
+- do not fabricate a local mirror or assume permissive terms from older intake
+  prose
+- keep the row outside the live standalone-git-root count until public source
+  is restorable and reviewed
+- if upstream becomes public again, clone and re-audit before donor
+  classification or source use
+
+Approved working posture:
+
+- retain as a historical or supplemental reference row only
+- do not treat it as mirror-ready today
+- do not treat it as a donor-use lane today
+
 ### `onionhoney/roux-trainers`
 
 Decision date:

docs/generated/license_audit/HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.csv

@@ -14,6 +14,7 @@
 "cs0x7f/cstimer","https://github.com/cs0x7f/cstimer.git","C:\Workspaces\HyperTwist\mirrors\restrictive\cs0x7f\cstimer","C:\Workspaces\HyperTwist\mirrors\restrictive\cs0x7f\cstimer","restrictive","GPL-3.0","strong-copyleft","1","LICENSE","","README.md","GPL-3.0-or-later","clear_repo_license_file","","LICENSE","","","","","Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>","d417cfcc5d7702b54ef8afcb843d87c5dfcfb69e","Manifest/tracker posture is narrower or more contextual than the root license signal."
 "cubing/alg.js","https://github.com/cubing/alg.js.git","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\alg.js","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\alg.js","restrictive","GPL-3.0-or-later","strong-copyleft","1","LICENSE.md","","README.md","GPL-3.0-or-later","clear_repo_license_file","","LICENSE.md","","","","","Copyright (C) 2007 Free Software Foundation, Inc.","1c2fd2bf2fb4204f5f2a195ee7bd2a04a9a7784c",""
 "cubing/cubing.js","https://github.com/cubing/cubing.js.git","C:\Workspaces\HyperTwist\mirrors\permissive\cubing\cubing.js","C:\Workspaces\HyperTwist\mirrors\permissive\cubing\cubing.js","permissive","MPL-2.0 OR GPL-3.0-or-later","dual-weak-copyleft-library-use-ok","2","LICENSE-GPL.md; LICENSE-MPL.md","","README.md","MPL-2.0 OR GPL-3.0-or-later","clear_repo_license_file","","LICENSE-GPL.md; LICENSE-MPL.md","","","","","Copyright (C) 2007 Free Software Foundation, Inc.","06faa3d74083646a93236e69e0f38cb23669ad34",""
+"cubing/qqTimer","https://github.com/cubing/qqTimer.git","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\qqTimer","restrictive","No explicit license found","license-missing","0","","","README.md","no_clear_repo_local_license_signal","","","","","","","","","64786743d9e2a4f2bdeb9d1cff1ff97874fbac63","Manifest/tracker carries the current legal call, but no standalone repo-local license signal was captured at the mirror root."
 "cubing/twisty.js","https://github.com/cubing/twisty.js.git","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\twisty.js","C:\Workspaces\HyperTwist\mirrors\restrictive\cubing\twisty.js","restrictive","GPL-3.0-or-later","strong-copyleft","1","LICENSE.md","","README.md","GPL-3.0-or-later","clear_repo_license_file","","LICENSE.md","","","","","Copyright (C) 2007 Free Software Foundation, Inc.","58ef9e07e253054ad1fd88f71823f0af76f2852f",""
 "cutelyaware/magiccube4d","https://github.com/cutelyaware/magiccube4d.git","C:\Workspaces\HyperTwist\mirrors\permissive\cutelyaware\magiccube4d","C:\Workspaces\HyperTwist\mirrors\permissive\cutelyaware\magiccube4d","permissive","Custom permissive attribution-request license","custom-permissive-attribution","1","LICENSE.md","","README.md","other_root_license_file","clear_repo_license_file","","LICENSE.md","","","","","Copyright (c) 2016 Melinda Green and Don Hatch","6761a9dff7fc23cd11c747f473d47e164c0d076f","Manifest/tracker posture is narrower or more contextual than the root license signal."
 "ecomfe/echarts-gl","https://github.com/ecomfe/echarts-gl.git","C:\Workspaces\HyperTwist\mirrors\permissive\ecomfe\echarts-gl","C:\Workspaces\HyperTwist\mirrors\permissive\ecomfe\echarts-gl","permissive","BSD-3-Clause","permissive","1","LICENSE","","README.md","BSD-family","clear_repo_license_file","","LICENSE","","","","","Copyright (c) 2017, Baidu Inc.","709273a186bed9d0271ac7efd49aafc275275626","Manifest/tracker posture is narrower or more contextual than the root license signal."

docs/ops/HYPERTWIST_DEEP_SOURCE_CLOSEOUT_AND_LEGAL_EVIDENCE_SEQUENCE_2026-05-26.md

@@ -67,6 +67,10 @@ For each resumed repo pass:
 8. when mirror custody or repo-root legal evidence changed, update:
    - `C:\HyperTwist\docs\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.md`
    - `C:\HyperTwist\docs\generated\license_audit\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.csv`
+8a. if a retained repo URL is not publicly resolvable and no local mirror can be
+    reviewed in the same pass, mark the row as an explicit
+    `upstream-unavailable` exclusion in the manifest, generated audit, and root
+    tracker instead of leaving it as a generic missing-path artifact
 9. if the repo resolves to `MIT`, also update:
    - `C:\HyperTwist\docs\generated\license_audit\MIT_LICENSE_TEXTS_2026-05-27\`
    - `C:\HyperTwist\docs\generated\license_audit\THIRD_PARTY_NOTICES_MIT_DRAFT_2026-05-27.txt`

docs/v6_5_deep_manual_pack/HyperTwist/LICENSETRACKING.md

@@ -73,6 +73,10 @@ Required rule:
   deep-source pass materially refreshes a relied-on repo row, update:
   - `C:\HyperTwist\docs\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.md`
   - `C:\HyperTwist\docs\generated\license_audit\HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_2026-05-27.csv`
+- if a retained repo URL is not publicly resolvable and no local mirror exists,
+  record that as an explicit `upstream-unavailable` exclusion in the manifest,
+  generated audit bundle, and root tracker instead of leaving it as a generic
+  missing-path row
 - if a repo resolves to `MIT` from a repo-root license file, capture the exact
   repo-root `MIT` text under:
   - `C:\HyperTwist\docs\generated\license_audit\MIT_LICENSE_TEXTS_2026-05-27\`
@@ -241,6 +245,7 @@ Current HyperTwist correction:
 - twenty-two permissive lanes are already live, including the landed analytics/reporting lane, the landed hypercubing knowledge and community-reference lane, the landed browser spatial owner trio, the landed bounded speech/voice permissive lanes, and the landed bounded hyper/simulation widening lanes
 - six boundary-sensitive lanes are already live: `cubing/cubing.js` through an explicit `MPL`-aware adapter posture, `cutelyaware/magiccube4d` through an explicit attribution/provenance boundary, `google/model-viewer/packages/shared-assets` through an explicit allowlist/provenance boundary, `PostHog/posthog` through an explicit root-`MIT`-core-versus-`ee/` subtree boundary, `screenpipe/screenpipe` through an explicit permissive-core-versus-`ee/` subtree boundary, and `remotion-dev/remotion` through an explicit package-split commercial boundary
 - six restrictive lanes are now live in custody terms, with `onionhoney/roux-trainers` preserved as the earlier clean-room precedent, the later retained restrictive rows landed through accepted clean-room routing, and `poliva/cubedex` corrected into restrictive custody while its existing first-party outputs remain preserved and donor widening is blocked
+- supplemental rows `cubing/qqTimer` and `cubing/scrambles` are not live lanes: `qqTimer` is now mirrored under restrictive custody with no clear root license signal, while `scrambles` remains an explicit upstream-unavailable exclusion until a public repo surface can be restored and reviewed
 - timer comparators such as `cstimer` still remain benchmark/reference rows until deep evaluation says otherwise
 
 ### Hyper ecosystems

scripts/Write-HyperTwistRepoLicenseEvidenceAudit.ps1

@@ -317,12 +317,17 @@ foreach ($entry in $entries) {
     $path = $entry.PrimaryPath
     $exists = Test-Path -LiteralPath $path
     if (-not $exists) {
+        $missingReason = if ($entry.CurrentManifestLicenseStatus -eq "upstream-unavailable") {
+            "upstream_unavailable_or_not_publicly_resolvable"
+        } else {
+            "missing_local_path"
+        }
         $excludedRows.Add([pscustomobject]@{
                 RepoId = $entry.RepoId
                 RepoUrl = $entry.RepoUrl
                 Path = $path
                 GitRoot = ""
-                Reason = "missing_local_path"
+                Reason = $missingReason
             })
         continue
     }
@@ -526,7 +531,7 @@ $markdown.Add("")
 $markdown.Add("Boundary:")
 $markdown.Add("- this is the repo-local legal-evidence pass for mirrored HyperTwist custody, not a rewrite of the broader historical workbook universe")
 $markdown.Add("- only standalone git roots count in the live audit")
-$markdown.Add("- package-subpath rows, non-standalone mirror paths, and missing mirror paths stay visible as exclusions instead of being silently counted")
+$markdown.Add("- package-subpath rows, non-standalone mirror paths, upstream-unavailable rows, and unresolved missing mirror paths stay visible as exclusions instead of being silently counted")
 $markdown.Add('- when later repos are mirrored or their root-license evidence changes, rerun `C:\HyperTwist\scripts\Write-HyperTwistRepoLicenseEvidenceAudit.ps1` in the same pass that updates the legal tracker')
 $markdown.Add("")
 $markdown.Add("Counts:")
@@ -537,7 +542,7 @@ $markdown.Add("- MIT from README only, no root license file: $mitReadmeCount")
 $markdown.Add("- MIT from repo metadata only, no root license file: $mitMetadataCount")
 $markdown.Add("- no clear repo-local license signal: $noClearCount")
 $markdown.Add("- no-clear bucket where current HyperTwist manifest already carries a legal call: $noClearWithCanonCount")
-$markdown.Add("- non-standalone or missing mirror paths excluded from the live count: $excludedCount")
+$markdown.Add("- non-standalone, upstream-unavailable, or missing mirror rows excluded from the live count: $excludedCount")
 $markdown.Add("")
 $markdown.Add("Artifacts:")
 $markdown.Add('- audit CSV: `docs/generated/license_audit/HYPERTWIST_REPO_LICENSE_EVIDENCE_AUDIT_' + $Stamp + '.csv`')