## Board memorandum: Meadowlark / OpenTrellis claim and 30-day course

**Bottom line**

1. **Kestrel likely violated a license condition** by shipping 41,000 devices containing modified OpenTrellis without providing source code and the license. Because the source-code terms are **conditions**, the failure supports **copyright infringement**, not merely breach of contract.

2. The **cloud backend is likely not distribution** under the supplied license text. Providing functionality over a network without transferring a copy is expressly not distribution. The cloud codebase should **not** be treated as requiring release.

3. The “work based on” source obligation **at minimum reaches the modified OpenTrellis component**. It may reach the **full firmware** only if Kestrel’s proprietary sensor-fusion code is more than a separate program interposing through a stable interface. The **cloud codebase should not be released** on the facts.

4. Because Meadowlark’s registration was too late, **no statutory copyright damages or copyright attorney fees** are available. The main cash exposure is **actual damages / attributable profits** plus a separate **CMI claim** for header removal. A defensible exposure range is roughly **$0.3M–$2.6M**, with a practical settlement target in the **$0.75M–$1.5M** range and a litigation reserve toward the **$2.0M–$2.5M** tail.

5. The “strip the headers” message is a serious adverse document. It likely supports the **CMI intent element**, supports a high-end CMI award, and weakens Kestrel’s equitable position.

6. Meadowlark may seek an injunction, but it cannot presume irreparable harm. Kestrel’s strongest position is that **money damages are adequate**, that **source release and compliance can cure prospective harm**, and that an injunction would impose severe, disproportionate hardship.

7. Kestrel should **resist an audit of all repositories by Meadowlark’s chosen examiner**, but should **accept a narrowly tailored, neutral, confidentiality-protected audit** of OpenTrellis-derived code, firmware build/release records, and the 63-file header history.

8. The best remediation path is a combination: **immediately release the modified OpenTrellis component source** (if technical/legal review confirms that is the correct scope), **negotiate a targeted settlement/audit**, and use replacement or a paid commercial license only if the full-firmware issue cannot be resolved or if Kestrel strategically wants to exit the reciprocal license.

9. The pending acquisition makes **prompt disclosure to the acquirer essential**. The demand, the header message, the exposure range, and the remediation plan are material.

10. Recommended immediate action: **litigation hold, outside counsel, technical triage, pause noncompliant shipments if source is not yet released, release the modified component source, respond to Meadowlark with a targeted settlement/audit proposal, and disclose to the acquirer.**

---

# 1. Did shipping the modified library in device firmware violate a license condition?

Yes, on the facts Kestrel likely violated a condition of the reciprocal license.

The license states:

> “You may distribute this software or works based on it only if you provide recipients the complete corresponding source code and this license. Conveying a work to third parties on a physical product is distribution. Providing access to the software’s functionality over a network, without transferring a copy, is not distribution. These scope terms are conditions.”

Kestrel:

- copied and modified OpenTrellis;
- shipped the modified OpenTrellis library in device firmware;
- conveyed the devices to third parties;
- did not provide purchasers with source code;
- did not provide the license text.

Under the supplied law:

- Copyright infringement requires copying of protectable expression.
- A license is an affirmative defense.
- If a license term is a **condition**, use outside the condition supports an infringement claim.
- If a license term is a **covenant**, breach supports only contract remedies.
- The prompt expressly says the scope terms are **conditions**.

Therefore, Kestrel’s distribution of the modified OpenTrellis work without providing source code and the license was outside the scope of the license. The license defense fails for the firmware distributions. The consequence is that Meadowlark can frame the issue as **copyright infringement**, not merely contract breach.

The condition/covenant distinction is critical here:

- If the source-code requirement were merely a **covenant**, Meadowlark’s remedy would likely be limited to contract damages.
- Because it is a **condition**, each unlicensed distribution can support copyright infringement.
- A contract claim may also survive preemption if it requires proof of something beyond unauthorized copying, such as a promise to provide source code, but the principal exposure here is the copyright condition breach.
- The CMI claim is separate and does not depend on the condition/covenant distinction.

Internal use and modification without distribution do not violate the license. Thus, Kestrel’s initial integration and modification were not themselves violations. The violation arose when Kestrel **distributed** the modified library in sold devices.

---

# 2. Is the cloud backend’s network use distribution under the license?

Almost certainly **no**.

The cloud backend:

- links against **unmodified** OpenTrellis;
- is used in a cloud analytics service;
- is accessed by customers through a web dashboard;
- does not transfer a copy of the backend to customers.

The license explicitly states:

> “Providing access to the software’s functionality over a network, without transferring a copy, is not distribution.”

Therefore, the cloud service is not distribution under the supplied license text.

Also, the supplied law states:

> “Internal use and modification without distribution do not violate the license.”

Even if the cloud backend were somehow a derivative work, the license as supplied does not trigger a distribution-based source obligation when no copy is conveyed. The cloud codebase should not be treated as subject to the reciprocal source-release obligation.

Meadowlark’s demand for release of the **entire cloud codebase** is therefore overbroad on the stated facts. Kestrel should resist it strongly.

There is a residual risk if Kestrel later distributes the backend module, provides downloadable backend copies, or provides copies to third parties in a way that transfers a copy. On the current facts, however, network access alone is not distribution.

---

# 3. How far does the “work based on it” source obligation reach?

The obligation reaches at least the **modified OpenTrellis component**. Whether it reaches the **full firmware** depends on the technical relationship between OpenTrellis and Kestrel’s proprietary sensor-fusion code. It should not reach the **cloud codebase** on the facts.

## A. Modified OpenTrellis library

Kestrel modified OpenTrellis and shipped the modified library. That is plainly a work based on OpenTrellis. The modified library incorporates, adapts, and is intimately intertwined with the original licensed code.

Kestrel must provide at minimum:

- complete corresponding source code for the modified OpenTrellis library;
- all Kestrel modifications to OpenTrellis;
- the license text;
- copyright and author information to the extent required by the license or CMI rules;
- build instructions or other material necessary to make the corresponding source usable, if that is what “complete corresponding source” requires under the license.

The fact that releasing the modified OpenTrellis component alone would reveal little competitive value makes this the most practical immediate remediation step.

## B. Full firmware

The harder issue is whether the **entire firmware** is a “work based on” OpenTrellis.

The supplied law says:

> The scope of a “work based on” the licensed software turns on whether the allegedly derivative code incorporates, adapts, or is intimately intertwined with the licensed code, not on mere interoperation through a stable interface.

Kestrel’s strongest position is that the proprietary sensor-fusion code is a separate work that merely interposes with the modified OpenTrellis library through stable interfaces. If that is true, the full firmware is not a derivative work, and Kestrel need not release the entire firmware.

However, if the sensor-fusion code:

- incorporates OpenTrellis code;
- adapts OpenTrellis structures or logic;
- is tightly coupled to the modified library;
- shares data structures, global state, or low-level abstractions;
- cannot be separated without substantial rework;
- was created by modifying or building directly on OpenTrellis code;

then the full firmware may be a work based on OpenTrellis, and the source obligation may extend to the full firmware.

This is a technical/legal boundary question. Kestrel should not assume the full firmware is protected. It must document:

- module boundaries;
- API boundaries;
- build system separation;
- which files contain OpenTrellis-derived code;
- which files are independent sensor-fusion code;
- how the firmware links or communicates with OpenTrellis;
- whether stable interfaces suffice.

If the analysis supports separability, Kestrel should release only the modified OpenTrellis component and any code that is truly derived from or intimately intertwined with OpenTrellis.

If the analysis is unfavorable and the full firmware is likely a derivative work, Kestrel should **not** voluntarily release the full firmware. That would expose its principal asset. In that scenario, Kestrel should pursue a paid license, settlement, or replacement to avoid a forced full-firmware source release.

## C. Cloud codebase

The cloud codebase should not be released.

Reasons:

1. The backend links against **unmodified** OpenTrellis.
2. No copy of the backend is transferred to customers.
3. Network access is expressly not distribution under the license.
4. Even if the backend were a work based on OpenTrellis, the license as supplied does not impose a source obligation in this network-only setting.
5. Releasing the cloud codebase would expose business logic unrelated to the firmware violation.

Kestrel should resist any demand for cloud codebase release. It can offer enough information to verify that the cloud service does not distribute copies, such as architecture diagrams, deployment model, build/dependency metadata, or a limited review of integration points, without releasing source code.

---

# 4. What damages can Meadowlark recover, and what is the exposure range?

## A. Registration timing eliminates statutory copyright damages and copyright fees

Statutory damages and attorney fees are available only if the work was registered:

- before the infringement began, or
- within three months of first publication.

Here:

- OpenTrellis was first published four years ago.
- Kestrel’s first device shipped more than 14 months before registration.
- Meadowlark registered 14 months after the first device shipped.
- Registration was therefore not before infringement began and not within three months of first publication.

Therefore, Meadowlark is limited to:

- actual damages, and
- Kestrel’s attributable profits.

It cannot recover statutory copyright damages or copyright attorney fees.

This is a major advantage for Kestrel. If statutory damages had been available, the exposure could have been dramatically higher because of the 41,000 devices.

## B. Copyright damages: actual damages and attributable profits

Meadowlark can recover actual damages or Kestrel’s attributable profits, but not both to the extent they would overlap. The key is apportionment: how much of the device’s value or profit is attributable to OpenTrellis?

### Assumptions for the board model

Use the stated revenue and margin as a planning baseline:

- Device revenue: $28 million per year.
- Margin: 34%.
- Devices shipped: 41,000 over 19 months.

If revenue was roughly uniform over the 19-month period:

- 19-month revenue ≈ $28M × 19/12 = **$44.3M**.
- 19-month gross profit ≈ $44.3M × 34% = **$15.1M**.
- Implied ASP ≈ $44.3M / 41,000 = **$1,081**.
- Implied device gross profit ≈ **$368 per device**.

These numbers are a starting point, not a fixed answer. If actual 19-month revenue differs, scale the model proportionally.

### Reasonable royalty approach

A reasonable royalty for a non-core open-source library might be low, but not zero. A defensible planning range is roughly:

- 0.5% of attributable revenue ≈ **$220,000**;
- 1.0% of attributable revenue ≈ **$440,000**;
- 1.5% of attributable revenue ≈ **$665,000**.

A higher royalty is possible if Meadowlark can show OpenTrellis was central to the device’s value, but the facts suggest Kestrel’s principal asset is the proprietary sensor-fusion code, not OpenTrellis.

### Attributable profits approach

Total device gross profit over 19 months is roughly **$15.1M**.

If OpenTrellis contributed:

- 1% of device value → **$150,000**;
- 3% of device value → **$450,000**;
- 5% of device value → **$750,000**;

then a reasonable copyright-damages planning range is:

- low: **$150,000**;
- base: **$400,000**;
- high: **$1.0M**.

This is a defensible single-measure range. Kestrel should argue that OpenTrellis is one component among many and that the principal value lies in Kestrel’s sensor-fusion code. Meadowlark may argue for a higher apportionment, especially if OpenTrellis was important to sensor support.

## C. CMI claim: header removal

The facts state:

- OpenTrellis license headers and author attributions were deleted from **63 source files** before the first release.
- A senior engineer wrote: “Strip the headers before we ship. Nobody diffs firmware.”
- Repository history confirms the deletion.

The supplied law provides a separate CMI claim with statutory damages of:

> $2,500 to $25,000 per violation, independent of registration timing.

The most defensible counting unit is the **63 files**, though a court could treat the deletions as one integrated violation or, less likely, as more numerous violations. For planning, use the 63-file count.

CMI exposure:

- Low: 63 × $2,500 = **$157,500**.
- Midpoint: 63 × $10,000 = **$630,000**.
- High: 63 × $25,000 = **$1,575,000**.

The “strip the headers” message strongly supports the elements:

- knowing removal or alteration of CMI;
- intent to conceal infringement.

This makes the CMI claim one of Meadowlark’s strongest sources of leverage despite the late copyright registration.

## D. Defensible total exposure range

| Component | Low | Base | High |
|---|---:|---:|---:|
| Copyright actual damages / attributable profits | $150,000 | $400,000 | $1,000,000 |
| CMI claim, 63 files | $157,500 | $630,000 | $1,575,000 |
| **Total cash exposure** | **$307,500** | **$1,030,000** | **$2,575,000** |

Additional cash items, not necessarily recoverable as liability:

- Targeted audit cost: **$100,000–$300,000** if Kestrel agrees to bear or share it.
- Optional six-week replacement: **$180,000**.
- Internal compliance and remediation costs: modest relative to the above.

A defensible board-level exposure range is therefore:

- **Floor:** approximately **$0.3M**.
- **Planning midpoint:** approximately **$1.0M**.
- **High tail:** approximately **$2.6M**.

Meadowlark’s **$2M demand** is not frivolous; it sits in the high end of the plausible range, driven largely by CMI. But Kestrel has strong arguments to push the number down:

- no statutory copyright damages;
- no copyright attorney fees;
- cloud not distribution;
- full firmware may not be a derivative work;
- OpenTrellis may be a small value contributor;
- CMI count may be less than 63 if the court consolidates violations.

Recommended settlement posture:

- Initial counter: **$350,000–$600,000**.
- Target settlement: **$750,000–$1,500,000**.
- Litigation reserve: **$2.0M–$2.5M** if Meadowlark presses the high CMI end and threatens injunction.

---

# 5. Evidentiary effect of the “strip the headers” message

The internal message is a significant adverse document.

Likely effects:

1. **Admissibility**
   - It is a statement by a party opponent.
   - It is likely not privileged because it appears to be a business communication, not attorney-client communication or work product prepared in anticipation of litigation.
   - It is likely discoverable and admissible.

2. **Supports the CMI claim**
   - It shows knowledge of the header removal.
   - It supports intent to conceal.
   - “Nobody diffs firmware” suggests an understanding that the removal would reduce detectability.
   - This directly supports the statutory CMI claim and pushes the award toward the high end.

3. **Undermines good-faith defenses**
   - Kestrel will have a harder time arguing the header removal was accidental.
   - It weakens Kestrel’s equitable arguments in any injunction fight.
   - It may make settlement at the low end less attractive to Meadowlark.

4. **Affects credibility**
   - Kestrel engineers and executives may be impeached if they downplay the issue.
   - The message may be used in settlement negotiations and, if litigated, at trial.

5. **Acquisition disclosure**
   - The acquirer will likely want to know about this message.
   - It is material to IP risk, litigation exposure, and remediation costs.

Recommended handling:

- Include the message in the litigation hold.
- Do not alter, delete, or “clean up” repository history.
- Do not encourage employees to discuss the message informally.
- Have counsel prepare witnesses under privilege.
- Use the message to calibrate settlement, not to provoke internal escalation.

---

# 6. Can Meadowlark obtain an injunction halting device sales?

Meadowlark may seek one, but Kestrel has strong arguments against it.

The supplied law says:

> Injunctive relief requires irreparable harm and inadequacy of legal remedies. Harm is not presumed from infringement.

Meadowlark must show:

1. likelihood of success on the merits;
2. irreparable harm to Meadowlark;
3. inadequacy of legal remedies;
4. balance of hardships favoring injunction;
5. public interest, if applicable.

Kestrel’s strongest arguments:

## A. Legal damages are adequate

The harm to Meadowlark is largely monetary:

- lost license value;
- attributable profits from Kestrel’s noncompliant distributions;
- CMI statutory damages.

Kestrel can pay those amounts. An injunction is not necessary to make Meadowlark whole.

## B. No market harm to Meadowlark is evident

Meadowlark is described as a software foundation concerning an open-source component. There is no stated fact that Meadowlark sells a competing device or cloud product. The absence of direct market competition weakens irreparable harm.

## C. Kestrel can stop prospective harm without an injunction

If Kestrel:

- releases the modified OpenTrellis component source;
- provides the license text;
- makes source available for affected firmware versions;
- implements compliance controls;
- pauses or conditions further shipments until source is available;

then the ongoing infringement risk is substantially reduced.

Meadowlark’s interest in source availability can be protected without halting all device sales.

## D. Balance of hardships strongly favors Kestrel

An injunction halting device sales would affect:

- $28M annual device revenue;
- 34% margin;
- customer relationships;
- manufacturing pipeline;
- the pending acquisition;
- Kestrel’s principal proprietary asset if full firmware release is threatened.

By contrast, Meadowlark’s monetary harm is quantifiable and compensable.

## E. Bad faith is a risk, but not fatal

The header-removal message hurts Kestrel’s equitable posture. It may make Meadowlark more aggressive and a court more skeptical of Kestrel’s assurances. But bad faith alone does not establish irreparable harm. Kestrel can mitigate this by acting quickly, releasing source, accepting a targeted audit, and offering a fair settlement.

## Practical injunction strategy

To minimize injunction risk:

1. Release the modified OpenTrellis component source as soon as technically feasible.
2. If the full-firmware scope is uncertain, pause new shipments of the affected firmware until source scope is resolved.
3. Offer a targeted audit.
4. Offer a settlement with compliance covenants.
5. Do not continue shipping noncompliant firmware while negotiating.

If Kestrel does these things, an injunction halting all device sales becomes much harder to justify.

---

# 7. Audit demand: what scope should Kestrel accept, resist, or counterpropose?

Meadowlark demands:

- an audit of **all Kestrel repositories**;
- by **Meadowlark’s chosen examiner**.

Kestrel should not accept that as written.

## A. Resist

Resist:

1. **Audit of all repositories**
   - Overbroad.
   - Includes unrelated code, products, trade secrets, and possibly acquirer-sensitive information.
   - Not tied to the alleged infringement.

2. **Release of entire cloud codebase**
   - Cloud is not distribution under the license.
   - No copy transferred.
   - No basis for source release on the facts.

3. **Unilateral examiner chosen by Meadowlark**
   - Adversarial examiner may not protect Kestrel trade secrets or privilege.
   - Creates risk of misuse of sensitive information.

4. **Open-ended scope and no cost cap**
   - Could become a fishing expedition.
   - Could increase cost and delay.

## B. Accept in limited form

Kestrel should accept a targeted audit focused on:

1. **OpenTrellis-derived code**
   - Modified OpenTrellis library.
   - Any Kestrel code determined to be derived from or intimately intertwined with OpenTrellis.

2. **Firmware build and release records**
   - Firmware versions shipped.
   - Device counts.
   - Release dates.
   - Build configurations.
   - Source packages released or to be released.

3. **63-file header history**
   - Repository history for the affected files.
   - Commit metadata.
   - Deletion timeline.
   - Restoration, if any.

4. **Cloud dependency verification**
   - Confirmation that the cloud backend links against unmodified OpenTrellis.
   - Confirmation that no backend copy is transferred to customers.
   - Architecture and deployment model.
   - Not full cloud source code.

## C. Counterproposal

Kestrel should propose:

1. **Neutral examiner**
   - Jointly selected, or court-supervised if disputed.
   - Bound by a strict confidentiality agreement.
   - No use of information outside the dispute.

2. **Phased protocol**
   - Phase 1: Kestrel provides source release, file manifests, build logs, and hash verification data.
   - Phase 2: Examiner reviews targeted repositories and build/release artifacts.
   - Phase 3: Limited interviews or written responses, subject to privilege.

3. **Privilege and trade-secret protections**
   - Kestrel counsel reviews potentially privileged material before production.
   - Proprietary sensor-fusion code is excluded unless necessary to determine derivative-work scope.
   - If necessary, use redactions, summaries, or third-party verification instead of full source disclosure.

4. **Cost allocation**
   - Given the likely violation, Kestrel may need to pay or share a reasonable portion of the audit cost.
   - But propose a cost cap and exclusivity of use.
   - Meadowlark should bear excess costs if it insists on overbroad scope.

5. **Timing**
   - 30–45 days for targeted audit.
   - No indefinite access.

This approach shows good faith while protecting Kestrel’s principal asset and cloud business.

---

# 8. Remediation paths compared

## Option A: Release the modified OpenTrellis component source

**What it does**

- Satisfies the source obligation for the modified library.
- Stops prospective infringement for future distributions, assuming the modified component is the correct scope.
- Preserves proprietary sensor-fusion code if separability is established.
- Shows good faith to Meadowlark and the acquirer.

**Cost/time**

- Low.
- Likely days to a couple of weeks, depending on technical packaging.

**Risks**

- Does not erase past infringement.
- Past distributions remain actionable.
- If the full firmware is a derivative work, releasing only the modified component may be insufficient.
- The modified component itself becomes subject to the reciprocal license going forward.

**Best use**

- Do this immediately if technical/legal review confirms the modified component is the correct corresponding source.
- It is the best first step to reduce injunction risk and settlement leverage.

## Option B: Six-week replacement with a commercial alternative

**What it does**

- Removes the OpenTrellis dependency from future firmware.
- Avoids future reciprocal-license obligations.
- Protects proprietary code if Kestrel does not want ongoing open-source constraints.

**Cost/time**

- $180,000.
- Six weeks.
- New firmware releases pause during transition.
- Manufacturing can continue, but release cadence is affected.

**Risks**

- Does not cure past infringement.
- Past devices already shipped remain infringing unless source is released or a license is obtained.
- Integration risk and delay.
- May not be necessary if source release of the modified component is acceptable.

**Best use**

- Use if:
  - the full firmware is likely a derivative work and Kestrel does not want to release it;
  - Kestrel strategically wants to avoid the reciprocal license;
  - the acquirer requires clean IP;
  - settlement is not available on acceptable terms.

## Option C: Paid commercial license from Meadowlark

**What it does**

- The copyright owner can grant a license that may waive or modify the reciprocal source condition.
- Can cover past and future use.
- May allow Kestrel to avoid releasing full firmware or cloud code.
- Can include a release of claims for past distributions.

**Cost/time**

- Unknown.
- Likely to be influenced by Meadowlark’s $2M demand.
- Could be a one-time payment, royalty, or combination.

**Risks**

- Meadowlark may not want money if its primary goal is source availability.
- Price may be high.
- A commercial license may still require source release or audit rights.
- Does not eliminate the CMI issue unless expressly released.

**Best use**

- Use if:
  - the full firmware is likely a derivative work;
  - releasing full firmware would destroy enterprise value;
  - Kestrel wants certainty;
  - Meadowlark is willing to sell a license.

## Option D: Negotiated settlement

**What it does**

- Resolves past and future claims.
- Tailors scope of source release.
- Controls audit process.
- Avoids litigation uncertainty.
- Provides deal certainty for the acquisition.

**Cost/time**

- Settlement payment plus audit/compliance costs.
- Likely weeks, not months, if both sides are motivated.

**Risks**

- May require payment and some disclosure.
- If settlement fails, litigation resumes.
- Meadowlark may demand more than Kestrel wants to pay.

**Recommended settlement terms**

Kestrel should propose:

1. Release of modified OpenTrellis component source under the reciprocal license.
2. License text provided for affected firmware versions.
3. Source made available to past purchasers, e.g., via documentation, website, QR code, or version-specific repository.
4. No release of full firmware unless technical/legal analysis requires it.
5. No release of cloud codebase.
6. Payment covering:
   - copyright actual damages/attributable profits;
   - CMI claim;
   - agreed audit costs.
7. Mutual release for the 41,000 devices and related past distributions.
8. No admission of liability.
9. Targeted neutral audit with confidentiality and cost cap.
10. Compliance covenants:
    - license header restoration;
    - CI/CD license scanning;
    - open-source inventory;
    - release checklist;
    - source-release verification.
11. No injunction, or injunction limited to narrow prospective compliance.
12. Confidentiality and no-disparagement provisions, if appropriate.
13. Timing coordinated with the acquisition.

## Comparison table

| Path | Cures past? | Cures future? | Preserves trade secrets? | Cost | Time | Best when |
|---|---:|---:|---:|---:|---:|---|
| Release modified component source | Partially, if accepted | Yes, if correct scope | Yes, if firmware separable | Low | Days/weeks | First step; separability confirmed |
| Six-week replacement | No | Yes | Yes | $180,000 | 6 weeks | Strategic exit from copyleft; full firmware release unacceptable |
| Paid commercial license | Yes, if granted | Yes, if granted | Often yes | Potentially high | Weeks/months | Full firmware likely derivative; want certainty |
| Negotiated settlement | Yes | Yes | Tailored | Moderate | Weeks | Preferred path |

---

# 9. Effect of the pending acquisition and disclosure obligations

The pending acquisition materially affects strategy.

## A. Disclosure is required in practical terms

Even if the LOI does not have a specific “litigation notice” clause, Kestrel should disclose to the acquirer:

- the Meadowlark demand;
- the basis of the claim;
- the header-removal message and repository history;
- the exposure range;
- the remediation plan;
- expected settlement cost and timing;
- any impact on representations, warranties, or closing conditions.

The acquirer’s diligence scan already detected OpenTrellis code. The acquirer is likely to discover the demand and the adverse internal message independently. Proactive disclosure is far better than surprise disclosure.

## B. Risks of nondisclosure

Failure to disclose could result in:

- breach of LOI or definitive agreement representations;
- rescission rights;
- price reduction;
- indemnity claims;
- escrow or holdback demands;
- loss of trust;
- fraud or misrepresentation risk;
- board fiduciary duty issues.

## C. Deal mechanics to consider

Kestrel should work with deal counsel to address:

- material adverse change clauses;
- IP representations and warranties;
- closing conditions;
- escrow or holdback for litigation exposure;
- special indemnity;
- price adjustment;
- who bears settlement costs pre- or post-close.

Ideally, Kestrel should settle or substantially resolve the matter before closing. If that is not possible, negotiate an escrow or indemnity reflecting the exposure range.

## D. Strategic effect

The acquisition increases the cost of delay:

- An injunction could threaten device sales.
- A full-firmware source release could threaten enterprise value.
- Litigation uncertainty could delay closing.
- The acquirer may view open-source noncompliance as a cultural or governance issue.

The acquisition also increases the value of a clean, documented remediation:

- source release;
- targeted settlement;
- compliance program;
- board oversight.

## E. Fiduciary duty

The board should not let the acquisition pressure it into an inadequate response. The board’s duty is to protect Kestrel’s value, including through proper legal remediation and disclosure. Quick, reasonable settlement and compliance are likely better than short-term concealment or aggressive litigation that could derail the deal.

---

# 10. Recommended 30-day course of action

## Days 0–1: Immediate containment

1. **Engage outside copyright/open-source counsel.**
   - Retain litigation counsel and, if needed, a forensic open-source auditor.

2. **Issue a litigation hold.**
   - Preserve:
     - firmware source code;
     - build artifacts;
     - release records;
     - repository history;
     - the 63 affected files;
     - the “strip the headers” message;
     - communications with Meadowlark;
     - acquisition diligence materials;
     - cloud backend architecture and deployment records.

3. **Pause noncompliant shipments if source is not yet released.**
   - Manufacturing may continue, but avoid new distributions of the affected firmware until corresponding source is available or a compliant alternative is in place.
   - This is a short-term pause, not necessarily a long-term device-sales halt.

4. **Do not make admissions.**
   - All external communications through counsel.

5. **Notify the acquirer if LOI or diligence process requires it.**
   - Initial notice can be brief:
     - demand received;
     - counsel engaged;
     - exposure being quantified;
     - remediation underway;
     - further update to follow.

## Days 1–5: Technical and legal triage

By the board meeting, Kestrel should have a preliminary picture.

Tasks:

1. **Identify all affected firmware versions.**
   - Dates.
   - Device counts.
   - Customers.
   - Shipping channels.

2. **Map OpenTrellis usage.**
   - Modified OpenTrellis library.
   - Files containing OpenTrellis-derived code.
   - Build system relationships.
   - API boundaries.
   - Whether sensor-fusion code is separable.

3. **Prepare modified OpenTrellis source package.**
   - Include modifications.
   - Restore headers/attributions to the extent possible.
   - Include license text.
   - Include build instructions.

4. **Confirm cloud facts.**
   - No backend copy transferred.
   - Unmodified OpenTrellis.
   - Network-only access.
   - Document architecture.

5. **Build damages model.**
   - Use $28M revenue, 34% margin, 41,000 devices, 19 months.
   - Calculate CMI range using 63 files.

6. **Prepare board memo.**
   - Likely infringement for firmware.
   - Cloud likely not distribution.
   - Exposure range.
   - Recommended immediate actions.
   - Settlement authority request.

## Days 5–10: Remediation and response to Meadowlark

1. **Release the modified OpenTrellis component source.**
   - If counsel and engineers confirm that the modified component is the correct corresponding source.
   - Make it available in a way that satisfies the license for affected firmware versions.
   - Provide license text.
   - Make source available to past purchasers through documentation, website, QR code, or version-specific repository.

2. **If full-firmware scope remains uncertain, continue pause on affected firmware shipments.**
   - Do not ship additional noncompliant firmware while scope is unresolved.

3. **Send a measured response to Meadowlark.**
   - Acknowledge the demand.
   - No admission of liability.
   - State that Kestrel has:
     - preserved records;
     - engaged counsel;
     - begun technical review;
     - made or is making the modified OpenTrellis component source available;
     - implemented compliance controls.
   - Propose:
     - targeted audit;
     - neutral examiner;
     - confidentiality protocol;
     - settlement discussions.
   - Reject overbroad demands:
     - full cloud codebase;
     - all repositories;
     - unilateral examiner.

4. **Begin internal compliance remediation.**
   - Restore headers in current builds.
   - Add license scanner to CI/CD.
   - Create open-source inventory.
   - Require source-release verification before firmware release.
   - Train engineering on license terms.

## Days 10–20: Negotiate audit and settlement

1. **Negotiate audit protocol.**
   - Scope:
     - modified OpenTrellis;
     - affected firmware;
     - 63-file history;
     - cloud dependency verification.
   - Examiner:
     - neutral, jointly selected.
   - Confidentiality:
     - strict NDA.
     - no use outside dispute.
   - Cost:
     - reasonable, capped.
   - Privilege:
     - Kestrel counsel controls privileged material.

2. **Negotiate settlement range.**
   - Target: **$750,000–$1,500,000**.
   - Include:
     - source release of modified component;
     - past-distribution release;
     - CMI release;
     - no admission;
     - targeted audit;
     - no injunction;
     - compliance covenants.

3. **Update the acquirer.**
   - Provide nonprivileged summary.
   - Explain remediation.
   - Discuss escrow/holdback or price adjustment if needed.

4. **Prepare litigation fallback.**
   - If settlement fails:
     - pleadings;
     - CMI defense;
     - damages defense;
     - injunction opposition;
     - motion to narrow audit if ordered.

## Days 20–30: Close or formalize next steps

1. **Execute settlement and audit agreement if possible.**
   - Make payment.
   - Complete source release.
   - Obtain mutual releases.
   - Confirm no injunction.

2. **If settlement is not complete:**
   - Continue targeted audit;
   - maintain source release;
   - maintain shipment pause if necessary;
   - prepare for filing or responsive pleading.

3. **Decide future architecture.**
   - If settlement includes a forward license, replacement may be optional.
   - If Kestrel wants to avoid reciprocal-license constraints, start the six-week replacement project.
   - If full firmware is likely derivative and settlement does not resolve it, prioritize a paid license or replacement to avoid forced full-firmware release.

4. **Report to the board.**
   - What was done.
   - Current exposure.
   - Settlement status.
   - Acquisition impact.
   - Remaining risks.
   - 30-day forward plan.

---

# 11. Recommended decision for the board

The board should approve the following package:

1. **Immediate litigation hold and outside counsel engagement.**

2. **Short pause on shipment of affected firmware** until the modified OpenTrellis component source is released or the scope issue is resolved.

3. **Release of the modified OpenTrellis component source** under the reciprocal license, with license text and appropriate headers, assuming technical review confirms it is the correct corresponding source.

4. **No release of the full firmware or cloud codebase** unless legal/technical analysis requires full-firmware source or a settlement/license structure requires it.

5. **Targeted neutral audit** of OpenTrellis-derived code, firmware release records, and the 63-file header history, with strict confidentiality and cost cap.

6. **Settlement posture:**
   - Initial counter: **$350,000–$600,000**.
   - Target: **$750,000–$1,500,000**.
   - Litigation reserve: **$2.0M–$2.5M** if Meadowlark presses the high CMI end and injunction risk.

7. **Disclosure to the acquirer** of the demand, the header message, the exposure range, and the remediation plan.

8. **Open-source compliance program** going forward:
   - license inventory;
   - CI/CD scanning;
   - release checklist;
   - source-release verification;
   - header preservation;
   - engineering training.

9. **Replacement or paid license only if needed** to avoid full-firmware source release or if Kestrel strategically wants to exit the reciprocal license.

This path minimizes legal exposure, protects the proprietary sensor-fusion asset, preserves the acquisition, and avoids the worst operational outcome: a forced full-firmware source release or a device-sales injunction.