Five of six current model cards do not say what the model was trained on. Every obligation you actually carry is in a different document.

THE OPERATOR'S MAP · Chapter: Sovereign Stack · Episode 2 · 28 August 2026. The five chapters advance together each week — agent controls (Ship AI), the open-source stack (Sovereign Stack), governance (The AI Boardroom), evaluation (Beyond the Benchmark), physical AI (Twin & Machine). This chapter's Episode 1, and every other chapter's Episode 2, are linked at the foot of the piece.

The Operator's Map is a weekly series for the people who have to run AI rather than admire it — five chapters, one per domain, all advancing together each week. This chapter teaches the open-source AI stack: what it means to run models you download rather than rent, and what that obliges you to check. On Tuesday: why the name of a model no longer tells you what it will do, and why provenance became a control. Today: how to read a model card like a contract — which is to say, how to notice that the card is not the contract. Every technical idea gets restated in plain terms as we go.

Why this reaches your desk. Somebody in your company has already downloaded an open-weight model on the strength of its description page, and that page is not the agreement. The agreement is a separate file, sometimes a separate website, sometimes five documents on one page with no marker saying which of them is yours — and it can contain a user-count threshold, a restriction keyed to what your company sells, a public attribution requirement that reaches your product name, and a positive obligation to warn your own customers about the model's dangers. None of those appear on the description page. All of them bind the person who clicked download.

Terms that matter this episode

• Model card — the description page a publisher writes for a model. Written by the publisher, verified by nobody, and not a contract.
• License — the document that grants you the right to use the weights at all and sets the conditions on that right. This is the contract.
• Acceptable-use policy — a separate list of prohibited uses, usually pulled into the license and hosted at a URL the publisher can change without republishing anything.
• Incorporation by reference — a clause that makes a document you never received part of the agreement you did.
• Field-of-use restriction — a license term that changes your rights according to what your company sells, rather than according to what you do with the model.
• Copyleft — a license family that forces its own terms onto anything derived from the work. Apache 2.0 and MIT do not do this. GPL-3.0 does.

A card is read as a warranty and written as a README

Watch what happens when a model is chosen. An engineer opens the description page. The page has benchmark tables, a two-line architecture summary, a code block that loads the weights, and a license badge in the corner. The engineer reads the benchmarks, copies the code block, notes the badge, and moves on. Somewhere downstream, that badge becomes a sentence in a risk register: we use an Apache-licensed open model. Nobody in the chain opened the license.

The reason this holds up for so long is that it usually works. Most of the time the badge is accurate, the terms behind it are the terms everyone assumes, and no obligation surfaces. The habit survives because its failures are silent and delayed.

So the useful exercise is not to read one card carefully. It is to read several at once, against the same questions, and watch where the answers stop appearing. A single card read alone teaches nothing, because there is no baseline for what a card could have said. Six cards read against one question set produce that baseline as a by-product.

This is the same move every chapter of the map is making this week. Read the artifact in front of you. Ship AI is reading an agent permission model as published. The AI Boardroom is reading an examination list. Beyond the Benchmark is reading what a benchmark actually measures. Twin & Machine is reading a certification scope. Five documents, one discipline: take the thing as it is actually written, not as the summary of it that everyone repeats.

The six cards, and the first question

I read six model cards in full on 28 August 2026, as the raw README.md at each repository rather than as a rendered page, so that the front matter and the section headings are exactly what the publisher wrote. The set was chosen to be genuinely current — most of it comes off the platform's own trending index this week — and then extended deliberately until the United States, the Gulf, India and China-origin weights were each represented by a publisher's own card.

The six: Qwen3.8-27B, published 5 August 2026 under Apache 2.0. Qwen3.8-Flash-Next, published 24 August 2026 by the same account under a license called Qwen Community License 1.0. GLM-5.3-Flash, published 25 August 2026 under MIT. Falcon-H1-7B-Instruct from the Technology Innovation Institute in Abu Dhabi, under a license the card names falcon-llm-license. sarvam-30b from Sarvam AI, under Apache 2.0, declaring twenty-three Indian language codes. And gemma-4-31B-it, under Apache 2.0.

The first question to put to a card is the plainest one a buyer of anything asks: what is this made of?

On five of the six, the card does not say. Training data or corpus: absent from the Qwen3.8-27B card, absent from the Qwen3.8-Flash-Next card, absent from the GLM-5.3-Flash card, absent from the Falcon-H1 card, absent from the sarvam-30b card. Not vague. Not summarized. There is no section.

The Falcon-H1 card is the instructive one, because it has a heading that looks like an answer. Its seven sections run: TL;DR, Model Details, Training Details, Usage, Evaluation, Useful links, Citation. A reader scanning that list would stop at Training Details and assume the question is covered. It is not. That section describes training procedure. The corpus is not there.

The sixth card answers. Gemma 4 has a section called Model Data, a subsection called Training Dataset, and this sentence: "Our pre-training dataset is a large-scale, diverse collection of data encompassing a wide range of domains and modalities, which includes web documents, code, images, audio, with a cutoff date of January 2025." Categories, and a date. Not a manifest, and not everything a regulator might eventually want, but an answer where five others have no section at all.

The second and third questions, and the pattern that will not shift

Ask a card what the model is for. Then ask it what the model is known to be bad at.

Intended use: absent on four of the six. Sarvam-30b has one partial — the card says the model is "designed primarily for practical deployment" and "designed to run reliably in resource-constrained environments and can handle multilingual voice calls." Gemma 4 has a section headed Intended Usage.

Limitations: absent on five of the six. Risks: absent on five. Bias: absent on five. Safety or alignment evaluation: absent on five.

Take the newest card in the set to see how little this is about haste. GLM-5.3-Flash was published on 25 August 2026. Its entire card has five headings: Introduction, Serve GLM-5.3-Flash Locally, Note, Footnotes, Citation. The "Note" section is runtime-parameter guidance about a thinking-budget parameter and a chat-template default. It is a competent, useful document for the thing it is trying to do, which is to get the model running on your machine in the next ten minutes. It is not attempting to be a disclosure document, and it does not pretend to be one.

That is the honest reading of every one of these cards, and it matters that we state it that way. None of these documents claims to be a contract or a safety disclosure. They are engineering READMEs. The defect is not in the writing. The defect is in the reading — in an industry-wide habit of treating a README as though it were a datasheet with warranties attached, because it sits where a datasheet would sit and has the shape of one.

The control case: the least demanding license carries the fullest card

Here is where the comparative reading pays for itself, because a single card could never show this.

Rank the six by how much the contract asks of you. At the permissive end sit Apache 2.0 and MIT — use it, modify it, sell it, no field-of-use restriction, no attribution beyond the notice, no threshold. At the demanding end sit the bespoke licenses: conditions, thresholds, attribution sentences, acceptable-use policies pulled in by reference.

Now rank the same six by how much the card tells you. If disclosure were driven by the license — if publishers wrote fuller cards because their contracts demanded it — those two rankings would line up.

They invert.

Gemma 4 has seventeen sections, including Model Data, Training Dataset, Data Preprocessing, Ethics and Safety, Evaluation Approach, Evaluation Results, Usage and Limitations, Intended Usage, Limitations, and Ethical Considerations and Risks. It reports safety testing in its own words: "For all areas of safety testing, we saw major improvements in all categories of content safety relative to previous Gemma models." It names a data cutoff. It opens its risks section by saying that the development of vision-language models "raises several ethical concerns."

And its license, followed to the publisher's own page at ai.google.dev/gemma/docs/gemma_4_license, is the unmodified Apache License 2.0. Version 2.0, January 2004. No additional restriction. No use-policy reference. No reserved right to restrict use remotely. No reserved right to change the terms. The only extra text on the page is the site-wide notice that page content is under a Creative Commons license and code samples under Apache 2.0.

Meanwhile Falcon-H1 carries the most complicated contract in the set — I will come to how complicated — and has no limitations section, no intended-use section, and no safety evaluation.

License strictness and card disclosure are independent variables. A permissive license does not buy you disclosure, and a demanding one does not guarantee it. Which means a reader cannot infer either from the other, and the two documents have to be read separately, against separate question sets. That is the single most useful thing in this episode, and it is only visible by comparison.

The license is a property of the model, not of the publisher — and it moves

Now the fourth question. What am I allowed to do with this?

The instinct here is to answer at the level of the publisher. They ship Apache. Their models are MIT. That instinct is wrong, and one account demonstrated it inside three weeks this month.

On 5 August 2026, Qwen3.8-27B was published with front matter reading license: apache-2.0. Plain, standard, no conditions beyond the notice.

On 24 August 2026, nineteen days later, the same account published Qwen3.8-Flash-Next with front matter reading license: other, license_name: qwen-community-1.0, license_link: LICENSE. The card itself is structurally the same document as its sibling: sixteen headings, benchmarks, quickstart, serving instructions, and the same absences — no training data, no intended use, no limitations, no safety evaluation.

The license file in that repository is not the same document at all. It is titled "Qwen Community License 1.0" and it carries two conditions that Apache 2.0 does not have.

Condition 1 is a scale trigger. The model name must be prominently displayed where the software "is Used for any of the licensee's commercial products or services that have more than 100,000,000 monthly active users or US$ 20,000,000…monthly revenue." A hundred million users, or twenty million dollars a month, and a display obligation switches on.

Condition 2 is a field-of-use restriction, and it is the one that will surprise people. A licensee conducting a "Model as a Service or AI Work Assistant business" must "obtain a separate license from Qwen before Using the Software…for any commercial purpose." The license defines both terms. "Model as a Service" involves "giving a third party access to language model inference or fine-tuning…in a manner that allows such third parties to exercise meaningful control." "AI Work Assistant" means "an independent AI-powered product primarily designed for AI-assisted coding or office productivity."

Read that carefully against your own company. It is not a restriction on what you do with the model. It is a restriction keyed to what your company is. Two companies can run the identical weights, in the identical way, on the identical hardware, and one of them needs a separate agreement because of the business it is in. The card says none of this. The card is the same card.

The same split shows up on a different continent, in a different form. On the Sarvam AI account, sarvam-30b and sarvam-105b both carry apache-2.0, while sarvam-translate carries gpl-3.0. That is not a smaller or larger version of the same deal. Copyleft propagates: it pushes its own terms onto works derived from it, in a way Apache 2.0 explicitly does not. One account, two license regimes with opposite behavior on derivation. Anyone who learned "this publisher ships Apache" from one repository and reached for the other by name has crossed a line nobody drew for them.

So the operating rule is narrow and it is not negotiable: the license attaches to the model, not to the account. Re-read it on every model, and re-read it on every version of every model.

The obligation you will never find by reading the card

Some terms are not in the license either. They are in a document the license points at.

The Llama 4 Community License Agreement, effective April 5, 2025, is the clearest published example of a contract that reaches well past the weights. Its section 1.b requires that you "prominently display 'Built with Llama' on a related website, user interface, blogpost, about page, or product documentation" — an obligation that lands on a marketing page, owned by a team that has never heard of the model. The same section requires that you include "Llama" at the beginning of any AI model name derived from the materials, which reaches your product naming. Section 1.b.i extends that naming obligation to the act of using outputs to "create, train, fine tune, or otherwise improve an AI model, which is distributed or made available" — meaning distillation is a licensed act, not merely a technical one. Section 2 sets a threshold: if your products have "greater than 700 million monthly active users in the preceding calendar month," you must request a license from Meta.

Then section 1.b.iv does the thing worth teaching. It requires compliance with the Acceptable Use Policy, "incorporated by reference." The policy lives at its own URL, opens with "If you access or use Llama 4, you agree to this Acceptable Use Policy," and organizes its prohibitions into five categories. Three of them are what anyone would predict: do not violate the law or others' rights; do not assist activities presenting a risk of death or bodily harm; do not intentionally deceive or mislead others. A fifth covers interacting with third-party tools built to generate unlawful content.

The fourth is different in kind. It prohibits you from doing this:

"Fail to appropriately disclose to end users any known dangers of your AI system"

Read what that is. It is a positive disclosure obligation placed on you, about your own product, owed to your own customers — sitting in an acceptable-use policy, incorporated by reference into a license, hosted at a URL the publisher controls and can update without ever shipping a new model. It is not on the card. It is not even in the license, except as a pointer. And it is exactly the kind of term a compliance function would want to know about, because it converts a vendor's policy into a duty that runs to your users.

The Technology Innovation Institute's license family does the same thing from the other direction. Section 5 of the Falcon 2 11B TII License reads: "Your use of the Work or any Derivative Work must comply with the Acceptable Use Policy at all times… You may not use the Work or any Derivative Work or any output from the Work or Derivative Work to create other works for purposes conflicting with the Acceptable Use Policy." That clause reaches outputs, and it reaches works built from outputs. The list it points at is hosted separately.

Which produces the second operating rule: an acceptable-use policy is a moving document, and the version you agreed to is the version that was live when you agreed. Diff it on a schedule, the same way you would diff any dependency you did not write.

When the license link resolves to five documents

There is one more failure mode, and it is not about what a document says. It is about whether you can tell which document is yours.

The Falcon-H1-7B-Instruct card declares license: other, license_name: falcon-llm-license, and license_link: https://falconllm.tii.ae/falcon-terms-and-conditions.html. That is the correct, well-formed way to point at a license that is not on the standard list. Follow the link.

Read on 28 August 2026, that page carries five distinct instruments:

1. Falcon 2 11B TII License Version 1.0 (May 2024)
2. Falcon 180B TII License Version 1.0 (September 2023)
3. Falcon Mamba 7B TII License Version 1.0 (Aug 2024)
4. TII Falcon License (December 2024)
5. Falcon Mobile Application Terms of Use (Effective 03 November 2025)

None of the five is named for Falcon-H1. Three are named for other, earlier models. The fourth is a general instrument that applies to designated models, and whether this one is designated under it is not stated on the card. The fifth is a consumer mobile application agreement, which governs an app rather than downloaded weights.

Each of those five documents is internally clear about what it governs. The problem is not in any of them. The problem is the resolution path: a reader who follows the card's own pointer arrives at a page and has to decide, unaided, which of five contracts they are under. That decision is being made by the reader, which means it is not really being made at all.

And the page contains a live trap for anyone who skims it. The Mobile Application Terms of Use say: "All rights to the outputs of the App belong to and shall vest with us." That is an outputs-ownership clause, and it is on the page the model card links to — but it governs the mobile app, not the weights you downloaded. A skim produces a materially wrong answer to the question "what may I do with the outputs of this model." The full prohibition list on that page sits in the same app document, at its section 2(f). Anyone quoting either of those as a term of the weights license would be quoting the wrong contract.

I want to be exact about what is and is not being said here, because this is the point in a comparative reading where it is easiest to slide from describing a document into grading an organization. Every instrument on that page is a real, competently drafted license. The TII Falcon License grants a "perpetual, worldwide, non-exclusive, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute" — that is a strong grant, stronger than several in this set. It asks for one clean attribution sentence: "[Derivative Work name] is built using artificial intelligence technology from the Technology Innovation Institute." And it is the only instrument in this entire pass that answers a question the others leave open, which I will come to in a moment.

The finding is about a link, and it is checkable in one click by anyone who wants to disagree with it.

What every one of them agrees on

Across six cards, four license families and two acceptable-use policies, exactly one term appears in every single instrument without exception.

No warranty. Provided "AS IS." Liability excluded.

Apache 2.0 says it. MIT says it. The Qwen Community License says the software is provided "AS IS, WITHOUT WARRANTY OF ANY KIND." The TII license says "as is" and "as available" without warranties of any kind, express or implied. The Llama 4 license says the materials are provided "AS IS" and the user assumes responsibility and associated risks, then excludes liability for lost profits and for indirect, consequential, incidental, exemplary and punitive damages.

The publishers disagree about almost everything else — thresholds, attribution, fields of use, whether outputs are constrained, whether the grant can be terminated. They agree unanimously that the risk was transferred to you at download. It did not move there when something went wrong. It was never anywhere else.

Which is the whole argument for treating the card as an untrusted input rather than a certificate, and it is worth saying plainly: this is what open weights are. It is not a defect and it is not a trick. Free, modifiable, redistributable capability comes with the risk attached, because the alternative — a publisher warranting the behavior of a system you may fine-tune, quantize, prompt and chain however you like — is not a thing anyone could offer.

Four regions, four different contract cultures

The sovereign lane is global by construction, and the contract layer is where the regional differences are sharpest — sharper than in the weights, which are increasingly interchangeable.

The United States. Two publishers, two opposite strategies, both current. Gemma 4 ships the fullest card in the set under the least demanding license in the set. Llama 4 ships a bespoke community license with a 700-million-user threshold, a naming term that reaches your product name, and an acceptable-use policy incorporated by reference. Anyone who says "the American approach to open weights" is describing one of those two and has not looked at the other. On the supervisory side, the current interagency model risk guidance — OCC Bulletin 2026-13, "Model Risk Management: Revised Guidance," 17 April 2026, with the parallel Federal Reserve designation SR 26-2 — places generative and agentic AI expressly outside its scope. Read that as a deferral rather than an exemption: no supervisor is currently going to tell you which of these questions to ask, so whatever you build now is what the eventual specification gets drafted against.

The Gulf. The TII Falcon license family is the only instrument in this entire pass that names a governing law and a forum: United Arab Emirates law, UAE courts. Apache 2.0 is silent on both. MIT is silent on both. For a Gulf buyer running a sovereign deployment, that is a feature rather than a footnote — jurisdiction is precisely the thing a sovereign build most wants pinned, and it is the one question the permissive licenses decline to answer. Silence on forum is not neutrality. It means the question gets litigated before the merits do.

India. Sarvam-30b's front matter declares twenty-three language codes: English, Hindi, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada, Malayalam, Punjabi, Odia, Assamese, Urdu, Sanskrit, Nepali, Sindhi, Konkani, Maithili, Dogri, Manipuri, Santali, Kashmiri and Tibetan. That is the most specific commitment any card in this set makes about anything — a checkable, enumerated coverage claim. And the card carries no limitations section, no safety evaluation, and no statement of how the model performs across those languages. A deployer reading that list in a regulated Indian workflow would be entitled to think coverage had been assessed across all twenty-three. The card does not say that, either way. Specificity in the front matter is not disclosure in the card, and the gap between those two is exactly where an operator's own testing has to live.

China-origin weights, as a market fact. The trending index this week is dominated by Qwen-lineage and GLM-lineage repositories, and the two most consequential contract facts in this whole pass come from that side of the catalog: a bespoke community license appearing on a flagship preview, and a three-day-old model shipping under MIT with a five-heading card. That is the record, cited, with nothing said about any publisher. It is also the reason the control has to be reading rather than origin-exclusion. You do not build a serious open stack in 2026 by refusing a region's weights. You build one by reading whatever contract came with them. (The EU's transparency regime speaks to some of this in detail; the buyers this lane serves are elsewhere.)

Three days of catalog

To show that none of this is a historical pattern that has since been fixed, here is a bounded sweep of what the catalog gained in the seventy-two hours before this was written.

On 24 August, Qwen3.8-Flash-Next arrived carrying a license name that did not exist on the same account's flagship nineteen days earlier. Its quantized sibling arrived the same day with the same tag. On 25 August, GLM-5.3-Flash arrived under MIT with five headings. On 26 August, a third-party conversion of it appeared on the trending index, carrying the license tag forward, inside twenty-four hours of the original.

Not one of those cards says what the model was trained on.

And a countable fact about the shape of the catalog, from the platform's own index, read the same day. Of the forty most-trending model repositories: eighteen carry apache-2.0, seven carry mit, thirteen carry the tag other, and two carry no license tag at all.

Those numbers deserve to be read precisely, because the sloppy reading of them is wrong. other is not a missing license. It is a pointer to a document you have to go and open — which, on the evidence of the Falcon link, is where the interesting problems live. And the two with no tag are not proof of no license; they are proof of no license declared in the platform's index. Whether a LICENSE file sits inside those repositories is a separate question I did not open them to answer. What I can say is that a reader relying on the index badge — which is what almost everyone does — gets nothing from those two rows.

The worked artifact: the model-card-as-contract clause map

This is the object to take to work. Sixteen questions, in four groups. Put every one of them to any model you are about to deploy — answer from the card, then from the license, then from the acceptable-use policy. Every question you cannot answer from any of the three is a control you now own.

The method transfers to a card nobody has written yet, which is the point of building it as questions rather than as a checklist of known publishers.

Group A — Identity: which artifact is this contract even about?

Group B — Provenance and fitness: what is this, and what is it for?

Group C — Permission: what am I allowed to do?

Group D — Obligation and consequence: what do I owe, and who pays?

The move

The habit this episode is trying to break is small and specific. It is reading the badge instead of the document.

The replacement habit is equally small. Before any open-weight model reaches production, someone answers the sixteen questions in writing, from the three documents, and the answers go in the same place the model bill of materials from Episode 1 lives. That is an hour of work per model. It is an hour that gets harder to find, not easier, as the number of models rises — which is the same asymmetry as every control worth having, and the same reason to build it while the stack is small.

What makes this urgent rather than merely tidy is that the contract layer is moving faster than the model layer. A model's weights are fixed at release. A model's acceptable-use policy is not. A publisher's license can change between two releases nineteen days apart, and did. The document you read at download is not necessarily the document you are under next quarter.

The scarce thing is not the model. Episode 1 said the scarce thing was the record of what the model was. Episode 2 says the other half: the record of what you agreed to when you took it.

What would make me wrong

Six is a sample, not a census. I read six cards in full. If a wider read of fifty found that limitations sections are the norm and this set was unrepresentative, the "five of six" framing weakens considerably. Notice what survives it: the clause map does not depend on the ratio. It depends on the questions existing and the answers living in different documents, which is true at any ratio.

The cards may be improving faster than I have measured. Gemma 4 shows what a full card looks like, and it is current. If the trend across the catalog is toward that shape, this episode is describing a receding problem rather than a growing one. I would take that outcome happily, and I have no time series to say which way it is moving.

I did not read the Llama 4 card. I read its license and its acceptable-use policy, which is where the argument needs them, but that means I make no claim about what that card does or does not contain. Somebody who read it could sharpen or blunt the "obligations live outside the card" point with evidence I do not have.

The Falcon link finding is about navigation, not about drafting. If TII publishes an H1-specific license, or splits that page, the finding evaporates — and it should. It is a claim about a resolution path on a specific date, and it is checkable in one click, which is the only reason it is worth publishing at all.

The trending index is volatile by construction. The license-tag counts are a snapshot of one day and will differ on any other day. The counts are shown so that anyone can re-run them and disagree; the argument does not rest on the integers.

What to ask your team

1. For every open-weight model we run in production, who has read its license — not its card — and where is that reading written down?
2. Does any model we run carry a scale threshold or a line-of-business condition that we would cross before anyone noticed?
3. Which of our models' license links resolve to more than one document — and which one did we decide governs us?
4. For every model whose card has no limitations section, where is our own limitations register, and who wrote it?
5. When did we last check the acceptable-use policy of a model we deploy against the version we agreed to?

The series

This is Episode 2 of The Operator's Map — a weekly series in five chapters, advancing together: Ship AI teaches agent controls, Sovereign Stack the open-source stack, The AI Boardroom governance, Beyond the Benchmark evaluation, Twin & Machine physical AI. All five of this week's episodes are the same act — reading a document as it is actually written rather than as everyone summarizes it. Next week, this chapter reads the layer underneath the model: the serving runtime's own license and its release notes, because the weights you pinned run inside software you did not pin. Subscribe to follow the map as it fills in.

Cut in verification, and why

• Any claim that Google's licensing changed between Gemma 3 and Gemma 4. Gemma 4 is verified as unmodified Apache 2.0 at Google's own page. Gemma 3's license was not fetched in this pass, so no claim about a change over time is made. Cut. The argument about licenses moving rests instead on one publisher's two models nineteen days apart, both read directly.
• A Canadian model card. Intended as a fifth region and not fetched inside the research budget, so not claimed. The regional frame runs the United States, the Gulf, India and China-origin weights only. Cut.
• What the Llama 4 model card contains. Its license and acceptable-use policy were read; the card was not. Cut — no claim is made about that card's sections.
• "Falcon-H1 is governed by the TII Falcon License (December 2024)." Not resolvable from the card, because the linked page carries five instruments and none is named for H1. Cut, and replaced by the accurate and sharper claim that the card does not name which instrument governs it.
• "All rights to the outputs vest with TII" as a term of a weights license. It is a term of the Falcon Mobile Application Terms of Use, which governs an app rather than downloaded weights. Cut as a license claim, and kept only as what it is: a hazard on the resolution path, attributed to the document it lives in.
• "Twelve of forty trending repositories have no license." False as stated. Two of forty carry no license tag in the platform's index; thirteen carry the tag other, which is a pointer rather than an absence. The distinction is the finding, so it is preserved exactly. Absence of an index tag is also not proof of an absent LICENSE file — those repositories were not opened. Narrowed, not cut.
• Any percentage or census claim about how common the missing-limitations pattern is. Six cards were read in full. Six is a sample. The text says "five of the six cards read in full," never "most cards."
• Any reading of download counts as evidence of quality, adoption or preference. Bounded to establishing that a repository is genuinely in front of readers.
• Secondary commentary on the current open-weight landscape. Consulted to orient the selection of cards, cited nowhere. Every claim above rests on a card, a license, an acceptable-use policy or the platform's own index.