I'm structuring this as a legal memo with specific facts and analysis. The key issue is that 41,000 devices shipped with modified OpenTrellis firmware over 19 months—that's physical distribution of a derivative work without source code or license text, which violates the license conditions. The cloud backend is different though, since network access doesn't constitute distribution under copyright law, so there's no obligation to release that codebase even if it's been modified internally. Now I need to work through what counts as a "work based on" the library to determine the full scope of what's affected.

For the firmware specifically, I'm distinguishing between code that's merely interoperating through a stable API versus code that's tightly integrated with OpenTrellis. The sensor-fusion modifications are ambiguous—if they're just calling OpenTrellis through a defined interface, that's not derivative, but if they're deeply intertwined, the whole firmware becomes a derivative work. The license doesn't explicitly carve out mere aggregation, though the applicable rule provides that test. The cloud backend links against unmodified OpenTrellis but since there's no distribution, that's moot anyway.

On damages, the registration timing is critical: the work was first published four years ago but registered only 14 months after the first device shipped, which means registration came well after infringement began and outside the three-month window from first publication. That eliminates statutory damages and attorney fees—they're limited to actual damages and attributable profits only. I need to check whether post-registration infringement changes the analysis.

For actual damages, Meadowlark's status as a foundation giving software away free makes a lost license fee argument weak unless they offer a commercial dual license, which the facts don't indicate. The damages would likely be nominal. On the infringer's profits side, with 41,000 devices and roughly $44.3M in revenue over 19 months, a 34% margin yields about $15.1M in profit, but I need to apportion that down to just the OpenTrellis component—realistically 1-5%, putting attributable profits in the $150K to $750K range. Meadowlark has to prove gross revenue while Kestrel bears the burden of showing apportionment and deductible expenses.

For the DMCA §1202 angle, there are 63 files with headers and attributions stripped intentionally, which shows clear intent to conceal. Statutory damages run $2,500 to $25,000 per violation, but the counting mechanism matters enormously—per file gives $157,500 to $1.575M, but if courts count per distributed copy across 41,000 devices, the numbers explode unrealistically. Courts typically count per work or per act rather than per copy, so the per-file approach is more credible.

Kestrel will argue this is a single act of removal via script (one violation), while Meadowlark will push for per-file counting (63 violations) or even per CMI element removed (126 if counting headers and attributions separately). The distribution of 41,000 copies knowing CMI was removed adds another layer, though that's also typically counted per act. Attorney fees might be available under §505, though there's some uncertainty on whether this particular rule framework includes them.

On the contract side, Meadowlark has a separate claim for breach of the source code provision promise—this isn't preempted since it adds an extra element beyond copyright. The real leverage here is specific performance: forcing Kestrel to provide source code to all 41,000 recipients, which is a concrete remedy risk beyond just damages. The "strip the headers" message also cuts against Kestrel by showing intent to conceal and willfulness, which strengthens Meadowlark's position on damages calculations. Kestrel's counterarguments focus on the non-monetary harm to license reciprocity norms (which some courts recognize as irreparable), but they'll push back on injunction scope—arguing delay doesn't constitute laches, that money damages are adequate since profits are measurable, that halting sales harms third-party customers and public interest, and that any relief should be prospective firmware compliance rather than a mandatory release of proprietary code or cessation of already-shipped devices, especially if Meadowlark can escrow and provide modified source.

On the audit front, Kestrel wants to resist Meadowlark's choice of examiner and broad repository access, instead proposing a neutral third-party under NDA with scope limited to firmware build trees and code-scanned fingerprints, reporting only yes/no presence and file lists without source disclosure to Meadowlark, counsel-supervised, cost-shared, time-boxed, and sealed under protective order—and they'd prefer to conduct a privileged self-audit first before agreeing to anything.

For remediation, the options break down as: releasing the modified component source with license and attribution restoration to purchasers (low cost, minimal value leak, cures future risk but not past damages); a six-week replacement at $180K with a firmware pause (useful leverage but unnecessary if option one works); a paid commercial license only if Meadowlark dual licenses; or a negotiated settlement with retroactive licensing.

The critical constraint is refusing full-firmware release—the contract and copyright scope don't extend to sensor fusion if it's interfaced through a stable API, and that's the core asset. But if the sensor-fusion code is actually woven into the modified library internals, it becomes derivative and must either be released or refactored. I need to map the technical coupling immediately; if they're intertwined, the path forward is a clean refactor to separate the interface, which is where the $180K replacement cost comes in.

On the acquisition side, I'm weighing the IP and open-source compliance reps, undisclosed litigation risk, and the fact that a third-party diligence scan already flagged the header-stripping issue—so the acquirer likely already knows. Disclosure is urgent; concealment creates fraud exposure. The deal terms could shift with escrow, holdback, or indemnity adjustments, and R&W insurance may exclude known issues. Timing the settlement before signing is critical.

Now I'm building out the exposure scenarios: copyright infringement runs $150K–$1.5M in apportioned profits plus $0–$250K in actual damages; the §1202 statutory damages claim on 63 files could hit $157.5K–$1.575M with tail risk doubling to $3.15M, though realistic range is $250K–$900K; contract claims would be nominal damages and compliance costs; and remediation itself costs $25K–$60K for component release and purchaser notices.

Litigation defense through trial runs $1.5M–$3M, or $300K–$600K to settle early, putting the realistic settlement zone at $400K–$1.2M cash plus compliance work, with total economic exposure around $600K–$1.6M including all fees and remediation—worst case litigated scenario hits $3M–$5M plus injunction risk and deal damage, so Meadowlark's $2M ask sits above midpoint but within the tail range and is worth anchoring down from.

The statute of limitations is three years with 19 months elapsed, so everything's still within window. Their demand for the cloud codebase has no legal support under the contract language—that's a strong leverage point to undermine their credibility and shift negotiating position.

On the infringement side, devices are still shipping with non-compliant firmware, meaning each unit sold is technically a new violation, so I need to either immediately start including written source offers and license text with shipments to achieve forward compliance without halting sales, or pause briefly to get compliant. The deliverable under the license is the complete corresponding source of the modified library plus anything derived from it. There's also a theoretical class-action risk from the 41,000 existing purchasers as third-party beneficiaries, though practically the damages exposure there is minimal.

For defenses and counterclaims, I should examine whether Meadowlark actually owns the copyright across all 63 files—checking contributor assignments and CLAs is critical for standing, and the registration deposit might cover a different version than what Kestrel actually copied, which could be a useful registration defense. The firmware deletion also triggers §1202 concerns around removal of copyright management information. I'm going to structure this as a memo with headings and a 30-day action plan.

On damages, let me work through the economics more precisely: 19 months at $28M annual revenue gives roughly $44M in total revenue, with a 34% margin yielding about $15M in gross profit tied to the devices. That's roughly $1,081 per device in revenue and $368 per device in profit across the 41,000 units. For apportionment, if the library adds $5 to $15 per device in value, I'm looking at a range from $205K to $615K in attributable damages—a useful frame for settlement positioning.