@@ -65,7 +65,7 @@ To add a starter stack (one pick per need for a kind of game), follow [`stacks/R
 - `url`: an `https://` address (`http://` only where the source has no https). Other schemes are rejected.
 - `added`: ISO date (`YYYY-MM-DD`) the entry joined the catalog. `npm run new-entry` fills it in; it never changes afterwards (V26: a real date, not in the future). The "new sources" feed and the home page's "New in the last 30 days" line key on it, so a re-verification sweep does not look like a wave of new entries. Moving an entry to another category keeps its date: `npm run check-added` (run in CI) fails when `added` is later than the file's first commit, following renames.
 - `verified`: ISO date (`YYYY-MM-DD`) of your last license check. It must be a real date, no later than tomorrow in UTC, and no newer than the newest date in `## Evidence` (V8): a new `verified` date needs a new dated Evidence line from the same check. Dates inside URLs do not count as Evidence dates.
-- `status`: `active` | `needs-review` | `deprecated`. A `deprecated` entry needs a `- Deprecated:` line in its body giving the reason (V9), and `npm run counts` afterwards, since deprecated entries leave the counts (V6). `active` means the licence, the commercial stance and the credit requirement are all settled: an `unknown` in `license`, `commercial` or `attribution_required` keeps an entry at `needs-review`. The validator enforces this (V14), and rejects `formats`, `subcategories` or `tags` values that differ only by case, punctuation or a trailing "s" from one already in use (V13).
+- `status`: `active` | `needs-review` | `deprecated`. A `needs-review` entry needs a `- Review:` line in its Notes saying what is still unresolved, in one sentence (V39); it shows on the entry page and in the monthly re-verify issue, and goes once the entry is settled. A `deprecated` entry needs a `- Deprecated:` line in its body giving the reason (V9), and `npm run counts` afterwards, since deprecated entries leave the counts (V6). `active` means the licence, the commercial stance and the credit requirement are all settled: an `unknown` in `license`, `commercial` or `attribution_required` keeps an entry at `needs-review`. The validator enforces this (V14), and rejects `formats`, `subcategories` or `tags` values that differ only by case, punctuation or a trailing "s" from one already in use (V13).
 - No other keys. An unknown key is rejected with the nearest allowed one (V33): `id`, `name`, `url`, `publisher`, `category`, `subcategories`, `license`, `license_spdx`, `commercial`, `attribution_required`, `attribution_string`, `formats`, `tags`, `added`, `verified`, `status`, `engine_lock`, `ue_versions`, `camera_perspective`, `grid_dimensions`, `maintenance`, `hardware_tags`, `preview` and `limits`. A typo such as `engine-lock` would otherwise drop the fact silently. Block-list items are indented under their key (`  - item`), and every key needs a space after its colon.
 
 ## What CI runs
 
@@ -31,6 +31,7 @@ Thousands of 32x32 top-down tiles covering monsters, items, dungeon features, an
 - Do not treat the game repository's GPL-2.0 as covering the art; the code license and the art license are separate questions here, and the art is the one that is unresolved
 - If a specific tile matters to your project, resolve it individually against `ARTISTS.md` rather than adopting the set wholesale
 - Still open (re-checked 2026-10-04): the `crawl/tiles` README says the export is meant to hold only CC0 tiles, but hedges ("every care possible has been taken"), describes the grant as "a license similar to \"public domain\"", and the export dates from 2015 with no push since 2020. No file states one unconditional licence for the packaged set, so `license` stays `varies` and `commercial` / `attribution_required` stay `unknown`. Settling it needs a statement from the maintainer, or a per-tile check against `ARTISTS.md`
+- Review: confirm whether the packaged tile set has one unconditional licence, or settle each tile against ARTISTS.md and the unknown-license list.
 
 ## Evidence
 
 
@@ -24,6 +24,7 @@ Curated pixel palettes and tools. **No site-wide commercial grant** — most pal
 - [privacy-policy](https://lospec.com/privacy-policy) / [about](https://lospec.com/about) have no palette license grant
 - Hardware palettes are often usable as color lists; artist palettes need author terms
 - Prefer [paleto-vol01](paleto-vol01.md) when you need a verified commercial-ok starter set
+- Review: settle each palette's own terms, since the site has no licence grant and most palette pages show none.
 
 ## Evidence
 
 
@@ -25,6 +25,7 @@ Community hub for game art under many licenses (CC0, CC-BY, CC-BY-SA, GPL, OGA-B
 - Filter CC0 / CC-BY before packaging
 - `commercial: true` follows the FAQ's plain site-wide statement (re-read 2026-10-04, unchanged). Still open: credit is per upload (CC0 none; CC-BY needs it; the FAQ says to assume GPL uploads need it), and the schema has no per-file value for `attribution_required`, so the entry stays `needs-review`
 - Apple App Store: the FAQ says GPL, LGPL, CC-BY-SA and CC-BY terms conflict with Apple's, so ask the artist first
+- Review: decide how to record attribution when credit is set per upload (CC0 none, CC-BY required), which attribution_required cannot express.
 
 ## Evidence
 
 
@@ -27,6 +27,7 @@ Fab, Epic's asset marketplace, has two kinds of free content. Permanently free l
 - Many free listings are Unreal-only by format even when the licence is not, because they ship as Unreal projects or asset packs
 - Epic's own free packs are catalogued separately: [megascans-starter-content](megascans-starter-content.md), [electric-dreams-environment](../environment/electric-dreams-environment.md), [paragon-characters](../characters/paragon-characters.md)
 - The entry `url` is a Fab search with the free filter on, because Fab has no stable "free listings" page. If Fab changes its search parameters the link breaks; open fab.com and filter by price "Free" instead
+- Review: decide how to record credit when each listing carries its own licence (Standard License none, CC-BY required).
 
 ## Evidence
 
 
@@ -28,6 +28,7 @@ The permanently free slice of Quixel Megascans on Fab. Free claiming of the whol
 - No redistribution: the Fab EULA summary says you may not "Resell or redistribute the asset for free on a standalone basis or allow others to do the same". Do not commit Megascans source files to a public repository
 - Prefer [poly-haven](../environment/poly-haven.md) or [ambientcg](ambientcg.md) when you need CC0 scans you can redistribute
 - The entry `url` is the Quixel Megascans seller page with Fab's free-price filter in the query string. If Fab changes its filter parameters the link falls back to the full seller page (`fab.com/sellers/Quixel Megascans`, checked 2026-10-22); filter by price "Free" there
+- Review: confirm the starter content stays under the Fab Standard License, not the Megascans Addendum clause limiting free assets to internal evaluation.
 
 ## Evidence
 
 
@@ -26,6 +26,7 @@ Low-poly model aggregator (10k+). **Per-model `Licence` field**: live samples in
 - Attribution required when the model is CC-BY (not when CC0)
 - **Do not infer a licence from the creator.** Checked 2026-09-23: of eight models on the Quaternius profile, seven read `CC0 1.0` and one, "Animated Base Character", reads `CC-BY 3.0`, while Quaternius releases its packs as CC0 on its own site. A Quaternius model downloaded here can owe attribution that the same author's pack does not. If you want the CC0 grant, take the file from [quaternius](quaternius.md) directly
 - Read the model page's `Licence` field, not the first licence string on the page: related-model cards on the same page carry their own labels
+- Review: confirm which Creative Commons licences uploaders may pick, so non-commercial or no-derivatives models can be ruled in or out.
 
 ## Evidence
 
 
@@ -26,6 +26,7 @@ MyMiniFactory's collection of 3D-scanned cultural artefacts, made for **physical
 - Still open (2026-10-04): no per-object licence could be read; the Scan The World user page and a scoped search return no object links or licence fields in a plain fetch. The platform terms moved to `/pages/terms-and-conditions` (the old `/terms-and-conditions` URL 404s) with the non-commercial clause unchanged. A per-object licence from the scan's owner is what would settle `license`
 - STL/OBJ from a print pipeline are rarely game-ready: wrong scale, solid meshes, no PBR materials
 - No `attribution_string`: none could be quoted, and a guessed credit line would be a liability
+- Review: find a per-object licence from the scan's owner that would override MyMiniFactory's non-commercial download terms.
 
 ## Evidence
 
 
@@ -26,6 +26,7 @@ Epic-owned 3D viewer and store. Free downloads are not a site-wide CC0 library.
 - Checklist: license is per-model (not a site badge), commercial varies per model, attribution unknown at catalog level, marketplace EULA yes, Epic/Sketchfab named, not blocklisted, catalog claims no rights
 - `commercial: varies` (set 2026-10-04) follows Sketchfab's own licence list: CC0, CC BY, CC BY-SA, CC BY-ND, Free Standard and Standard allow commercial use; CC BY-NC, BY-NC-SA, BY-NC-ND and Editorial do not
 - Still open (2026-10-04): credit is per model (CC0 "Credit is not mandatory"; every CC BY variant "Author must be credited"; the Standard licences' credit terms were not read), and the schema has no per-file value for `attribution_required`, so the entry stays `needs-review`
+- Review: decide how to record credit when it is set per model, and read the Standard licences' credit terms.
 
 ## Evidence
 
 
@@ -27,6 +27,7 @@ Epic's free third-person puzzle platformer sample, rebuilt from the ground up fo
 - Licence: Fab Standard License, free on both tiers. The current description has no "UE-Only Content" line, so `engine_lock` is omitted. Open question: Epic marks Lyra and Cropout UE-only but not this listing; confirm on the listing before exporting the robot or props to another engine. Kept at needs-review for that reason
 - Redistribution: this is Epic content and may not be redistributed in source form or committed to a public repository. Epic's content licence says you "may not Distribute Licensed Content in source format to third parties except to employees, affiliates, and contractors who are utilizing the Licensed Content in good faith to develop a Project on your behalf"
 - Gotchas: the pre-5.6 and 5.6+ versions are different projects, so tutorials written for the original Stack O Bot will not match the rebuild
+- Review: confirm on the Fab listing whether Stack O Bot is UE-only like Lyra and Cropout before exporting its robot or props to another engine.
 
 ## Evidence