# MEMORANDUM — PRIVILEGED & CONFIDENTIAL / ATTORNEY WORK PRODUCT

**To:** Board of Directors, Kestrel Devices
**From:** Outside Counsel
**Re:** Meadowlark Software Foundation audit demand and infringement claim — exposure, options, recommendation
**Date:** Day 0 (board meets Day 5)

---

## 0. Executive summary

1. **The firmware claim is real and largely indefensible on liability.** Shipping the modified OpenTrellis library on 41,000 physical devices is "distribution" under the license's own definition, and the source-plus-license requirement is a **condition**. Kestrel therefore acted outside the scope of its license and is an infringer, not merely a breaching promisor.
2. **The cloud claim fails on the license's face.** The license text expressly excludes network-delivered functionality without transfer of a copy. Meadowlark's demand for the cloud codebase is unsupported and should be rejected flatly — it is also our best lever for discrediting the demand letter as a whole.
3. **The full-firmware release demand is overreaching.** Under the governing "work based on it" test, mere interoperation through a stable interface does not sweep in the sensor-fusion code. The obligation reaches the **modified library** and any code actually intertwined with it. This is the one genuinely urgent factual question for engineering.
4. **Meadowlark's money claim is much weaker than $2M.** Registration came 14 months into the infringement and years after first publication, so **no statutory damages and no fee award on the copyright claim** — actual damages plus apportioned profits only. The real money risk is the **header-removal claim**, which carries statutory damages regardless of registration timing.
5. **Defensible exposure range: $450,000–$1.4M all-in on an early negotiated resolution; $2.5M–$5M plus defense costs in a litigated worst case.** Details in §4.
6. **The "strip the headers" message is the single most damaging fact in the file.** It converts a compliance oversight into an intent-to-conceal case, supplies the mental element of the statutory CMI claim, poisons our equitable position, and is an acquisition problem independent of Meadowlark.
7. **Recommendation:** immediate prospective compliance (publish the modified component's source, restore attributions, ship license text and a written source offer with every unit), a narrow counterproposed audit, and a fast confidential settlement in the **$400K–$800K** cash range with a full release, no full-firmware disclosure, and no Meadowlark-chosen examiner. Fund the $180K replacement project in parallel as leverage and as a clean-IP story for the acquirer. Disclose to the acquirer under NDA this week.

---

## 1. The firmware: condition breached, and why that matters

**The scope terms are conditions.** Governing law item 3 removes the usual battleground. The permission to distribute is granted *"only if"* recipients receive complete corresponding source and the license text. Kestrel distributed and provided neither. Distribution of the work on a physical product is expressly within the definition. There is no license defense for the 41,000 units.

**Consequences of condition rather than covenant:**

| | If condition (our facts) | If covenant only |
|---|---|---|
| Cause of action | Copyright infringement | Breach of contract only |
| Remedy set | Damages + profits; injunctive relief available in principle | Contract damages; specific performance in equity |
| Willfulness relevance | Yes (though statutory damages unavailable here) | Largely irrelevant |
| Preemption | N/A | Source-code promise survives preemption (item 7) |

Two practical points follow.

*First,* the condition framing is what gets Meadowlark into court asking for an injunction and profits. Under a pure covenant theory it would be limited to expectation damages on a promise to hand over source code — worth almost nothing in cash to a foundation that gives its software away. So the condition characterization is the source of essentially all of Meadowlark's leverage on the copyright side.

*Second,* Meadowlark will nonetheless plead the contract claim in parallel, and item 7 lets it. The contract claim's value to Meadowlark is not money — it is **specific performance**: an order that Kestrel actually deliver corresponding source and the license text to the 41,000 purchasers. That remedy is cheap for us to satisfy voluntarily (see §8), which is precisely why we should satisfy it before Meadowlark asks a court for it.

**Ongoing infringement.** Every unit shipped today is a fresh act. Sales need not stop to fix this: compliance is achieved by including the license text plus complete corresponding source (or a valid written offer for it) with each unit. That change should go into the shipping process this week, before the board meets. It stops the accrual clock, moots the strongest part of any injunction motion, and costs almost nothing.

**Diligence items that could improve our position:**
- **Chain of title / standing.** Does Meadowlark actually own or hold exclusive rights in all 63 files? Is there a contributor license agreement or assignment record? Community projects frequently cannot prove title to every contribution.
- **Registration scope.** Which version did Meadowlark deposit? If the registered deposit is a later version and the code we copied is materially different, the registration may not cover the copied expression at all — which affects the ability to sue on those files, not just remedies.
- **Statute of limitations.** All 19 months are inside a three-year window; no help there.

---

## 2. The cloud backend: not distribution

The license says, in terms: *"Providing access to the software's functionality over a network, without transferring a copy, is not distribution."* The backend links unmodified OpenTrellis; customers reach it through a web dashboard; no copy of the backend is transferred. Item 4 confirms internal use and modification without distribution do not violate the license.

**Conclusion: no violation, no source obligation, and no basis to demand the cloud codebase.** This is not a close call under the supplied text, and it is a licensor-drafted document, so any ambiguity argument runs against Meadowlark.

Guardrails engineering must observe so this stays true:
- No shipment of on-premises or appliance builds of the backend, no container images or binaries delivered to customers, no SDK or edge agent that embeds OpenTrellis.
- No "download a local copy for offline use" feature.
- Written confirmation from engineering that no backend build artifact has ever left Kestrel's infrastructure. If it has — even a single customer pilot appliance — the analysis changes for that instance and we need to know before we assert the defense.

**Use this in negotiation.** The cloud demand and the full-firmware demand are both unsupported. Saying so, with the license text quoted back, reframes the dispute from "Kestrel got caught" to "Meadowlark overreached," and justifies anchoring far below $2M.

---

## 3. Reach of "work based on it"

Item 9 supplies the test: incorporation, adaptation, or intimate intertwining — **not** mere interoperation through a stable interface. Three concentric rings:

**Ring 1 — the modified library. Clearly covered.** Kestrel adapted OpenTrellis to support its sensor. The modified library is a work based on OpenTrellis. Its complete corresponding source must be provided. Fortunately, engineering reports this reveals little of competitive value.

**Ring 2 — the rest of the firmware. Contested, and factually contingent.** If the sensor-fusion code sits behind a stable API boundary and simply calls the library, item 9 says that is not enough. If, however, Kestrel's engineers **inserted sensor-fusion logic into OpenTrellis source files**, or restructured library internals around proprietary algorithms, that inserted and intertwined code is derivative and falls inside the obligation.

The fact that Kestrel "modified OpenTrellis to support its sensor" is ambiguous on exactly this point and is the highest-value technical question in the matter. **Engineering must produce, within 72 hours, a file-level map showing:** which files are OpenTrellis-derived; which contain Kestrel-authored code; whether any proprietary algorithm resides inside a derived file; and what the call/link boundary looks like. Two outcomes:

- *Clean boundary:* we assert Ring 1 only and refuse anything more, with a credible technical declaration behind it.
- *Intertwined:* we do a **targeted refactor** — lift proprietary logic out of derived files into separately authored modules behind a documented interface — and then publish the cleaned Ring 1 component. This is where some portion of the $180K/six-week budget is well spent even if we keep OpenTrellis. Note that refactoring going forward does not cure the past 41,000 units; it bounds the *prospective* disclosure obligation and removes Meadowlark's best argument for the firmware-wide release.

**Ring 3 — the cloud codebase. Not reachable at all,** because scope questions only matter where there is distribution, and there is none. Even if the backend module were a work based on OpenTrellis, network access is carved out.

**Bottom line for the board:** the sensor-fusion code — the company's principal asset — should not be released, and we have a governing-law basis to refuse. Do not let a settlement drift into any commitment that could be read as covering "the firmware" as a whole. Any settlement source-release obligation must be defined by an enumerated file list.

---

## 4. Damages arithmetic and defensible exposure range

### 4.1 Copyright: no statutory damages, no fees

OpenTrellis was first published four years ago. Registration occurred 14 months after the first infringing shipment. Under item 5, statutory damages and fees require registration **before infringement began** or **within three months of first publication**. Neither is satisfied. The three-month window closed roughly 45 months ago, and the infringement began 14 months before registration. Continuing shipments of the same product line after registration do not reset the commencement date.

**Meadowlark is limited to actual damages plus Kestrel's attributable profits, with no fee shifting on this claim.** That is a large structural win and should be communicated early — it removes the asymmetric fee threat that drives most copyleft settlements.

**Actual damages.** Meadowlark distributes free software. Unless it operates a commercial dual-license program (verify immediately — check its website, price sheets, and any published exception policy), there is no lost license fee to measure. A hypothetical-negotiation theory is available but speculative and, without a comparable transaction, poorly supported. Realistic range: **$0–$250K**, with the high end only if a genuine commercial license price list exists.

**Attributable profits.** Gross figures:

- Revenue over 19 months: $28M/yr × 1.583 yr ≈ **$44.3M**
- Gross profit at 34%: ≈ **$15.1M**
- Per unit: ≈ $1,081 revenue, ≈ $368 profit across 41,000 units

$15.1M is the theoretical ceiling only, and only if apportionment fails entirely. Meadowlark bears the burden on gross revenue; **Kestrel bears the burden of proving deductible expenses and apportionment** to non-infringing contributions. Here the value drivers are the hardware, the proprietary sensor-fusion code (Kestrel's own principal asset), manufacturing, and the sales channel. OpenTrellis is one library performing a supporting function.

Framing apportionment per unit is the most persuasive approach: what is the incremental value of this library to the device? Comparable commercial alternatives exist — indeed, the replacement quote is $180K of engineering for a permanent substitute, which implies the library's economic value to Kestrel is on the order of a few dollars per unit, not hundreds.

| Apportionment | Profits award |
|---|---|
| $3/unit (≈0.8% of profit) | $123K |
| $5/unit | $205K |
| $10/unit | $410K |
| $15/unit (≈4% of profit) | $615K |
| 10% of gross profit (aggressive plaintiff) | $1.5M |

**Litigated copyright expectation: $200K–$700K; tail risk to $1.5M if apportionment proof is weak.** Note that a weak apportionment record is a *self-inflicted* risk — preserve costing data, bill of materials, engineering time records, and the commercial-alternative quote now, because they are the apportionment evidence.

### 4.2 The header-removal claim: where the real money is

Item 6 provides **$2,500–$25,000 per violation, independent of registration timing**, for knowing removal or alteration of copyright management information with intent to conceal. This claim is not subject to the registration defect, and Meadowlark will make it the centerpiece once it understands the registration problem.

Elements are essentially conceded: license headers and author attributions are CMI; repository history proves deletion from 63 files before first release; the engineer's message supplies knowledge and intent to conceal.

**The fight is over the multiplier.** Competing counts:

| Counting theory | Violations | Low ($2,500) | High ($25,000) |
|---|---|---|---|
| One work (OpenTrellis) | 1 | $2,500 | $25,000 |
| One act of removal (scripted deletion) | 1 | $2,500 | $25,000 |
| **Per file** | **63** | **$157,500** | **$1,575,000** |
| Per CMI element (header + attribution per file) | 126 | $315,000 | $3,150,000 |
| Per distributed copy | 41,000+ | not credible | not credible |

Our arguments for a low count: the statute protects works, not files; the deletion was a single coordinated act; per-copy and per-element stacking produces absurd results wildly disproportionate to the value of a freely licensed library, which courts resist. Meadowlark's argument for 63: each file bore distinct CMI, including distinct author attributions identifying different contributors, and each removal was a separate decision.

**Realistic litigated range on this claim: $200K–$900K**, with genuine tail exposure to $1.5M+ if a court adopts per-file counting at the upper end of the range. The intent-to-conceal message pushes any award toward the top of whatever range applies.

Assume for planning purposes that **fee exposure may attach to this claim** even though it does not attach to the copyright count. Confirm, because it materially affects settlement value; if fees are available on the CMI claim, Meadowlark's practical leverage roughly doubles.

### 4.3 Contract claim

Not preempted (item 7), because it requires proof of a promise to provide source code — an element beyond unauthorized copying. Monetary value near zero. Its significance is **specific performance** (deliver source and license to purchasers) and possibly third-party beneficiary claims by the 41,000 purchasers, which are theoretically available but practically worthless in damages. Voluntary compliance eliminates this claim's value.

### 4.4 Consolidated exposure

| Component | Early settlement | Litigated expected | Litigated worst case |
|---|---|---|---|
| Copyright (actual + profits) | included below | $200K–$700K | $1.5M |
| CMI / header removal | included below | $200K–$900K | $1.6M–$3.15M |
| Contract | $0 | nominal | nominal |
| **Cash to Meadowlark** | **$400K–$800K** | **$400K–$1.6M** | **$3.1M–$4.65M** |
| Compliance & remediation (Ring 1 release, attribution restoration, purchaser notice, targeted refactor) | $50K–$150K | same | same |
| Optional replacement project | $180K | $180K | $180K |
| Defense costs | $150K–$350K | $1.2M–$2.5M | $2.5M–$3.5M |
| **Total economic cost** | **$600K–$1.4M** | **$1.8M–$4.3M** | **$5.8M–$8.3M** |

Plus unquantified but potentially dominant costs in the litigated scenarios: deal risk on the pending acquisition, injunction risk, and reputational exposure with a foundation that will publicize.

**Meadowlark's $2M demand sits above the midpoint of the litigated range and far above the settlement zone.** It is an anchor, not a valuation. Our counter-anchor is the registration defect plus the failure of the cloud and full-firmware demands.

---

## 5. Evidentiary effect of "Strip the headers before we ship. Nobody diffs firmware."

This is the fact that changes the character of the case. Assume it will be read aloud at any hearing and quoted in any press release.

**Where it hurts:**
- **Supplies the CMI mental element.** "Knowingly" and "with intent to conceal" are the hard elements of the item 6 claim, and this message proves both, corroborated by repository history across 63 files. It converts a contestable claim into a near-certain one and drives the per-violation amount toward $25,000.
- **Willfulness and equities.** Even though statutory copyright damages are unavailable, willfulness colors everything discretionary: apportionment credibility, the size of the CMI award, any fee analysis, and a court's willingness to grant equitable relief.
- **Destroys innocence and mitigation narratives.** No "compliance oversight," no reliance on counsel, no good-faith misunderstanding of scope.
- **Undermines our own equitable defenses.** Laches, estoppel, and unclean-hands arguments against Meadowlark become unattractive to press.
- **Insurance.** Likely triggers intentional-acts exclusions. Tender to carriers now anyway; late notice forfeits coverage that might otherwise attach to the negligence-framed portions.
- **Acquisition.** Independently material. It is the kind of document that turns a price adjustment into a walk-away or a fraud allegation if concealed.

**Mitigation, honestly assessed:**
- It is one engineer's message, not an officer's directive. Determine whether any manager saw, approved, or ratified it. If not, we can argue no corporate policy of concealment — this affects tone and quantum, not liability.
- Determine whether the deletion was a scripted build-hygiene step applied to all third-party headers (supports "one act," and a less sinister motive) or a targeted OpenTrellis-only excision (much worse).
- Preserve the possibility that the author will testify he meant something narrower. Do not coach; do interview promptly with counsel present.

**Immediate obligations:**
1. **Litigation hold today**, covering the repository (including history and reflogs), issue trackers, chat archives, email, and build systems. Any deletion now is spoliation and would be catastrophically worse than the original conduct.
2. **Do not attempt to rewrite or garbage-collect repository history.** Assume Meadowlark already has the third-party scan report.
3. **Restore the headers and attributions in current source immediately.** This is cheap, is required regardless, and is the only available act of good faith that a court will credit.
4. Instruct all personnel: no independent contact with Meadowlark, the scanning vendor, or the acquirer's diligence team.

---

## 6. Injunction analysis

Item 8 is favorable: **irreparable harm is not presumed from infringement**, and Meadowlark must also show legal remedies are inadequate.

**Meadowlark's case:** its injury is to the integrity of the reciprocal license and the reciprocity norm that induces contributions — a non-monetary interest that cannot be compensated in damages. It will argue that permitting continued non-compliant sales lets Kestrel buy its way out of copyleft, and it will lean on the concealment evidence for equitable weight.

**Kestrel's strongest arguments against irreparable harm:**

1. **Meadowlark suffers no market injury.** It sells nothing, competes with nothing, and loses no sales, customers, or pricing power. There is no market to erode.
2. **Its own conduct shows the harm is compensable and non-urgent.** It let the work sit unregistered for four years, registered only 14 months into the infringement, and learned of the conduct only because a third party told it. The claimed harm to license integrity is real in the abstract but was not being actively policed.
3. **Voluntary compliance moots the prospective claim.** By the hearing we will have published the modified component's source, restored attributions, and included the license text plus a source offer with every shipped unit. An injunction cannot compel what is already done, and courts do not enjoin cured conduct.
4. **Damages are readily measurable.** Meadowlark itself asserts $2M, and profits are calculable from Kestrel's books — an admission that money is an adequate remedy.
5. **Balance of hardships is lopsided.** Halting sales costs roughly $2.33M in revenue per month (about $793K in gross profit per month) and jeopardizes an outstanding acquisition; Meadowlark loses nothing measurable during the same period.
6. **Public interest and third parties.** 41,000 warehouse operators depend on these devices and on continued firmware support, including security updates. An order halting sales or freezing releases harms non-parties who have no role in the dispute.
7. **The relief requested is grossly overbroad.** A mandatory injunction compelling release of the entire firmware and cloud codebase would (a) exceed the license's scope under item 9, (b) contradict the license's own network carve-out, and (c) destroy the value of Kestrel's principal asset — a remedy wildly disproportionate to the interest at stake. Even if some injunction issues, it should be limited to compliance with respect to the OpenTrellis-derived files.

**Realistic assessment:** Meadowlark is unlikely to obtain an order halting device sales, particularly against a defendant that has already come into prospective compliance. It has a moderate chance of obtaining a **narrow compliance injunction** — ship the license text and corresponding source for enumerated derived files with each unit — which is relief we intend to provide voluntarily and can therefore offer as a stipulation. The concealment evidence is the wild card; it is exactly the fact pattern that makes a court willing to enter *some* order to signal disapproval. We should give it a narrow order to enter.

**Tactical implication:** get to compliance before any motion is filed. Voluntary cure converts the injunction question from "should sales stop" to "what more is needed," and there is no good answer to that on the licensor's side.

---

## 7. The audit demand

Meadowlark demands an audit of **all Kestrel repositories** by **Meadowlark's chosen examiner**. Both features are unacceptable.

**Why we resist:** there is no contractual audit right in the quoted license. Meadowlark's leverage is litigation discovery, not an inspection clause. An unrestricted examination would expose the sensor-fusion code, the cloud backend (as to which there is no claim at all), unrelated products, and other third-party components whose compliance status we have not yet verified — creating new claims by non-parties. A licensor-selected examiner is an adverse agent, not a neutral, and any information it receives flows straight to a litigation adversary and potentially to the community.

**Sequence matters: self-audit first, under privilege.** Before agreeing to any external process, complete an internal, counsel-directed scan of the firmware and cloud repositories for all third-party open-source components, with results delivered to counsel. We must know what else is in there before we let anyone else look. Discovering a second compliance problem mid-audit would be far worse than discovering it ourselves this week.

**Counterproposal — accept, resist, counter:**

| Element | Position |
|---|---|
| Examiner identity | **Resist** Meadowlark's choice. Counter: a mutually agreed independent examiner from an agreed list of three, retained jointly, or a Kestrel-retained examiner delivering a certified report. |
| Scope of repositories | **Resist** "all repositories." Counter: the firmware build tree for shipped releases in the relevant 19-month window, plus any repository a fingerprint scan flags as containing OpenTrellis code. |
| Cloud backend | **Resist** entirely, subject to a narrow written certification that no backend build artifact has been transferred to any third party. No code access. |
| Output to Meadowlark | **Accept** a findings-only report: presence/absence, OpenTrellis version(s), file list, dates of first inclusion, unit counts, and CMI status. **Resist** delivery of any Kestrel source code, architecture documentation, or build scripts. |
| Confidentiality | **Insist:** NDA with the examiner running to Kestrel; no retention of copies beyond the engagement; no publication; no use in any other proceeding; sealing and a Rule 502(d)-style non-waiver order if litigation is filed. |
| Process controls | **Insist:** on-premises or in a Kestrel-controlled enclave, Kestrel counsel and engineering present, logged queries, no unsupervised crawling, no data exfiltration. |
| Timing and cost | **Accept** a time-boxed engagement (three weeks). Cost sharing or Meadowlark-paid; we should not fund an adversary's discovery. |
| Consideration | **Insist:** the audit is provided only as part of a settlement framework including a full release, not as a standalone concession. |

An audit conducted on these terms is genuinely useful to us: an independent report confirming that OpenTrellis appears only in enumerated files and that the sensor-fusion code sits behind a stable interface is the best possible evidence on the Ring 2 scope question and on apportionment.

---

## 8. Remediation paths compared

**Path A — Release the modified component's source (Ring 1 only).**
Cost: low — engineering time to prepare a publishable tree, restore headers and attributions, publish the license text, and provide a written source offer with each unit. Estimate $25K–$60K, plus a targeted refactor of $30K–$90K if engineering finds intertwining.
Effect: achieves prospective compliance; cures the contract claim's specific-performance value; substantially defeats the injunction; demonstrates good faith to a court and to the acquirer; reveals little of competitive value by engineering's own assessment.
Limits: does not extinguish past-conduct damages or the CMI claim.
**Assessment: do this regardless of everything else. It is the highest-return action available and should not wait for the board meeting or for Meadowlark's agreement.**

**Path B — Six-week replacement, $180K, firmware releases paused.**
Effect: eliminates all future OpenTrellis obligations; produces a clean-IP story for the acquirer; removes any ongoing hook for Meadowlark.
Costs: $180K plus the opportunity cost of a six-week release freeze (security patches, customer commitments, roadmap slip). Manufacturing continues, so revenue is not directly interrupted.
Limits: does nothing about the 41,000 units already shipped or the header claim. Path B alone, without Path A, leaves us non-compliant as to past units and looks like evasion.
**Assessment: fund it now as a parallel track and as negotiating leverage — it credibly caps our need for any relationship with Meadowlark and demonstrates that the library's value is $180K, not $2M. Whether to complete it depends on the settlement and on the acquirer's preference.**

**Path C — Paid commercial license / retroactive relicense.**
Viable only if Meadowlark offers a commercial exception; verify immediately. Even absent a standing program, this is functionally what a settlement should include: **a retroactive license plus a prospective permissive grant covering the 41,000 shipped units and the enumerated derived files.** That is the single most valuable term available to us because it converts an infringement history into a documented license — which is exactly what the acquirer's diligence needs to see.
**Assessment: make this the core of the settlement structure, not merely a cash payment.**

**Path D — Negotiated settlement (recommended container for A, and optionally B and C).**
Target terms:
- Cash: **$400K–$800K**, payable in installments if possible.
- Full release of all claims (copyright, contract, CMI) for Kestrel, its officers, employees, successors, and acquirers — **successor coverage is essential** for the deal.
- Retroactive and prospective license as in Path C.
- Source release limited to an **enumerated file list**; express written acknowledgment that the sensor-fusion code and the cloud backend are outside the obligation, and that network-delivered functionality is not distribution under the license.
- Attribution and header restoration, publicly.
- Narrow audit per §7, one time only, findings-only.
- No admission of liability; mutual non-disparagement; agreed neutral joint statement if Meadowlark insists on publicity (foundations usually do — negotiate the wording rather than fight the fact).
- Confidentiality subject to a carve-out permitting disclosure to the acquirer and its counsel under NDA.
- Optional sweetener with high value-to-cost ratio: a modest recurring sponsorship or contribution of the sensor-support patches upstream. Foundations weight these heavily and they cost us little given that the component reveals nothing of competitive value.

**Ranking:** A (now, unilaterally) → D (containing C, over 30 days) → B (funded in parallel, completed if the acquirer wants clean IP or if settlement fails).

---

## 9. The pending acquisition

**The acquisition is simultaneously the largest risk factor and the strongest reason to settle fast.**

**Disclosure.** Assume the acquirer will learn of this independently and soon — the claim surfaced from an acquisition diligence scan by a third party, which means a scanning vendor already has the finding in its files, and Meadowlark has every incentive to make the dispute public. Standard representations on IP ownership, open-source compliance, absence of infringement claims, and absence of threatened litigation cannot be given truthfully today. Non-disclosure creates fraud exposure that would dwarf the Meadowlark claim and would personally implicate signing officers.

**Recommendation: disclose to the acquirer within the week, under NDA, on our own terms and with a remediation plan attached.** A controlled disclosure paired with "here is the plan, here is the bounded exposure, here is the independent examiner's report" is a price-adjustment conversation. An uncontrolled discovery two weeks before signing is a walk-away or a re-trade.

**Predictable deal consequences to plan for:**
- Special indemnity or escrow/holdback sized to exposure — expect the acquirer to demand $1.5M–$3M initially; our objective is a holdback near the settlement amount plus a modest cushion, which is why a signed release before signing is worth real money.
- Representations & warranties insurance will exclude known matters; a signed, released, fully performed settlement is the only way to move this out of the "known issue" bucket.
- Confirmatory diligence will include a fresh code scan. The internal self-audit (§7) should precede it so we control the narrative on any additional findings.
- Expect questions about the "strip the headers" message that go to management integrity, not just IP. Be ready with: who wrote it, whether anyone approved it, what has changed in process, and who is accountable.

**Process discipline going forward:** appoint a single point of contact for the acquirer; funnel all Meadowlark communications through counsel; brief the acquirer's counsel on the registration defect and the failure of the cloud and full-firmware demands so they value the exposure correctly rather than assuming the $2M demand is the number.

**Leverage note:** the acquirer may prefer to fund or direct the settlement. That is generally good for us — it aligns incentives and can accelerate resolution — but it must not become a channel through which the acquirer learns our settlement floor before Meadowlark does.

---

## 10. Recommendation and 30-day sequence

**Recommendation to the board:** authorize immediate unilateral compliance for the OpenTrellis-derived component; reject the cloud and full-firmware demands on the license's face; counterpropose a narrow, neutral, findings-only audit; and settle confidentially in the **$400K–$800K** range with a full release including successors, a retroactive and prospective license, and an enumerated-file source obligation. Fund the $180K replacement project in parallel. Disclose to the acquirer this week under NDA. **Settlement authority requested: $900K, with authority to the CEO and counsel to close at or below that figure.**

### Days 0–5 (before the board meeting)

1. **Litigation hold** issued today; repository history and chat archives preserved; explicit no-deletion instruction.
2. **Acknowledgment letter to Meadowlark** — professional, non-admitting: confirms receipt, states Kestrel is investigating and takes compliance seriously, requests a 21-day standstill (no filing, no publication) to allow a substantive response, and requests Meadowlark's registration certificate, deposit copy, chain-of-title documentation, and any commercial licensing terms. Do not concede or argue yet.
3. **Engineering file-level map** of OpenTrellis-derived files and the Ring 2 coupling question (72-hour deadline).
4. **Restore headers and attributions** in current source; begin preparing the Ring 1 publishable tree.
5. **Ship-process change:** license text plus written source offer included with every unit from this week forward. Stops the accrual clock before any motion.
6. **Insurance tender** to all potentially applicable carriers.
7. **Board package:** this memo, the exposure table, the engineering map, and a single-page decision sheet with the authority request.

### Days 5–10

8. Board authorizes the plan and settlement authority; **fund the $180K replacement project** and start it.
9. **Publish the modified component's source** with license text and full attributions; post a compliance notice and source-offer instructions for existing purchasers on the support site.
10. **Disclose to the acquirer** under NDA, with the remediation plan, the registration analysis, and the bounded exposure range.
11. **Substantive response letter to Meadowlark:** (a) confirms completed prospective compliance for the derived component; (b) rejects the cloud demand quoting the license's network carve-out; (c) rejects the full-firmware demand under the "work based on it" test; (d) notes without belaboring that registration timing precludes statutory damages and fees on the copyright claim; (e) counterproposes the narrow audit; (f) proposes mediation or a direct principals' call within 14 days. Tone: cooperative on compliance, firm on scope, quiet confidence on remedies.
12. Verify whether Meadowlark operates a commercial licensing program; confirm chain of title and registration deposit scope.
13. Begin counsel-directed **internal open-source audit of all products** for other third-party components.

### Days 10–20

14. **Negotiate.** Open at $250K plus completed compliance, upstream contribution of the sensor-support patches, and modest sponsorship. Target landing zone $400K–$800K. Trade the narrow audit and the public joint statement for the release and the successor coverage — those are our must-haves.
15. **Engage the neutral examiner** if audit terms are agreed; scope and protective order signed before any access.
16. Interview the message's author and any recipients; document what process changes have been made. Prepare a short factual account for the acquirer and, if needed, for a court.
17. Preserve apportionment evidence: bill of materials, engineering time records, the $180K replacement quote, and the commercial-alternative pricing.

### Days 20–30

18. **Close the settlement** — cash, release running to Kestrel and successors, retroactive plus prospective license, enumerated-file source obligation, narrow one-time audit, agreed joint statement, confidentiality with an acquirer carve-out.
19. Deliver the executed settlement to the acquirer; negotiate the holdback down against the signed release; update disclosure schedules.
20. **Adopt a standing open-source compliance program:** mandatory scan gate in CI/CD, a policy prohibiting removal or alteration of third-party notices (with disciplinary consequences), an approved-license list, a maintained bill of materials per release, and a named compliance owner reporting to the General Counsel. Report completion to the board at the next meeting. This is both risk management and a diligence artifact.

**If Meadowlark refuses to engage or sues:** we are well positioned. Our prospective compliance will be complete, the injunction motion is weak on irreparable harm and grossly overbroad in the relief sought, the copyright claim carries no statutory damages or fee shifting, and the cloud and full-firmware theories fail on the license text. The CMI claim is the only one that genuinely hurts, and it is a bounded-dollar claim. Litigation would nonetheless cost $1.2M–$2.5M and endanger the acquisition — which is precisely why we should pay a premium over the litigated expected value to close quickly, and why the recommended settlement range sits above the low end of our damages estimate.

---

*This memorandum applies the governing-law framework supplied in the engagement materials and is prepared for the board's deliberation. Several conclusions — particularly the reach of the "work based on it" obligation and the per-violation count on the CMI claim — depend on facts still being developed by engineering and on confirmation of fee availability under item 6. I will supplement before the board meeting.*