diff --git a/docs/LICENSE-COMPLIANCE-AUDIT.md b/docs/LICENSE-COMPLIANCE-AUDIT.md
index 63c022d2..0e31e476 100644
--- a/docs/LICENSE-COMPLIANCE-AUDIT.md
+++ b/docs/LICENSE-COMPLIANCE-AUDIT.md
@@ -2,7 +2,10 @@
 
 Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/*, Android companion, image-recipe ISO, docker/, app-catalog, reticulum-daemon, demo/) plus the external FIPS source and registry-mirrored images.
 
-**Verdict:** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo is not releasable as-is: it has **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity.
+**Verdict (as of the 2026-07-22 audit):** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo was not releasable as-is: it had **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity.
+
+> **The licence blocker is closed** — root `LICENSE` (MIT) and `NOTICE` are in the
+> tree. **Two blockers are still open**, see the corrected status below.
 
 ---
 
@@ -10,7 +13,29 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/
 
 **DONE:**
 - MIT adopted. Root `LICENSE` + `NOTICE` added; `license = "MIT"` in all 5 workspace crates (archy-fips-core already had it); `"license": "MIT"` (+ `"private": true`) in all 4 package.json files.
-- Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`).
+- ~~Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`).~~
+  **⚠️ NOT DONE — corrected 2026-08-08.** All seven are still tracked at HEAD and
+  present on disk. Only the `web/dist` copies were removed; the sources never were:
+
+  ```
+  neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf   # Font Bureau, commercial
+  neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf      # Monotype, proprietary
+  neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf   # Monotype, proprietary
+  neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf
+  neode-ui/public/packages/atob.s9pk                                # 23 MB
+  neode-ui/public/packages/wireguard.apk                            # 17 MB
+  neode-ui/test-install.sh
+  ```
+
+  Verify with `git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'`.
+
+  **This is still a release blocker**: shipping proprietary Monotype and Font
+  Bureau typefaces in an MIT-licensed public repo is exactly what §3 says must
+  not happen. Deleting them is safe — nothing references the font *files* (the
+  three `Courier New` hits are CSS `font-family` fallbacks naming the system
+  font, not `@font-face` sources), and `wireguard.apk` / `atob.s9pk` have zero
+  references anywhere in the tree. Removing the two packages also takes 40 MB
+  off the frontend OTA tarball.
 - Media provenance resolved: all demo music/photos/posters, UI sfx, backgrounds, and intro video are the author's original work — recorded in `demo/content/README.md` and `NOTICE`.
 - Meshtastic device artwork attributed (`mesh-devices/ATTRIBUTION.md` + NOTICE); icon attribution added (`assets/icon/ATTRIBUTION.md`: game-icons.net CC BY 3.0, pixelarticons MIT).
 - Reticulum decision: include + disclose (NOTICE states the Reticulum License restrictions and that it applies only to the optional daemon).
@@ -23,7 +48,12 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/
 3. Delete dead StartOS-derived crates `core/{js-engine,container-init,models,helpers}` — §4.
 4. Attribution build integration: cargo-about in CI → ship full license texts in ISO; vite/rollup license plugin (or UI licenses page) for the web bundle; Android OSS-licenses screen — §5.
 5. Release-checklist items: per-release Debian source pointer (snapshot.debian.org), catalog `license`/`sourceUrl` fields, restrict ISO image bundling to the audited list — §6.
-6. Before repo goes public: purge deleted fonts/APKs from git history (`git filter-repo`), and verify game-icons author credit.
+6. ~~Before repo goes public: purge deleted fonts/APKs from git history (`git filter-repo`)~~ — **superseded**: the launch plan is a fresh-history publish, so there is no history to rewrite. What still applies is verifying the game-icons author credit, and actually deleting the files (see the correction above — they were never removed).
+
+**Re-verified 2026-08-08:**
+- `zbase32 0.1.2` (LGPL-3.0+) is **still a direct dependency** (`core/archipelago/Cargo.toml:113`), still used at `network/did_dht.rs:40,49`. Item 1 remains open and is the only hard copyleft blocker.
+- `LICENSE` (MIT) and `NOTICE` are present ✅. `core/THIRD-PARTY-LICENSES.md` and `neode-ui/THIRD-PARTY-LICENSES.md` are present ✅.
+- The four StartOS-derived crates in item 3 (`core/{js-engine,container-init,models,helpers}`) **still exist** — note KEY-05 legitimately cites `core/models`, so that one needs a look before deletion rather than a blind `rm`.
 
 ---