diff --git a/CREDITS.md b/CREDITS.md
index a8fe168..b6d92f4 100644
--- a/CREDITS.md
+++ b/CREDITS.md
@@ -18,7 +18,23 @@ versioning.  The original source code is preserved in `original/UC2_source/`.
 **Jan Bobrowski** wrote a clean-room portable decompressor (2020--2021) that
 forms the foundation of this project's decompression engine.  The library
 (`libunuc2`) is licensed under LGPL-3.0; the CLI tool (`unuc2`) is licensed
-under GPL-3.0.
+under GPL-3.0-or-later.
+
+The following files in this repository derive directly from Bobrowski's
+work and retain his licence (see `docs/license-audit.md` for the full
+provenance table):
+
+- `lib/src/decompress.c` (LGPL-3.0-only)  --  derived from `libunuc2.c`
+- `lib/src/list.h` (LGPL-3.0-only)  --  byte-identical to upstream
+- `lib/include/uc2/libuc2.h` (LGPL-3.0-only)  --  derived from `libunuc2.h`
+- `cli/src/main.c` (GPL-3.0-or-later)  --  derived from `unuc2.c`,
+  with substantial additions for archive creation, OTS, and benchmarking
+- `cli/src/compat/compat_win32.c` (LGPL-3.0-only)
+- `cli/src/compat/compat_dos.c` (LGPL-3.0-only, DOS adaptation by Valetov)
+
+The SuperMaster dictionary (`lib/src/super.bin`) is bit-identical to the
+copy shipped in `original/unuc2-0.6/` and to the data extracted from
+de Vries's 1992 binaries.
 
 - Website: <http://torinak.com/~jb/unuc2/>
 - Original source preserved in `original/unuc2-0.6/`
@@ -44,8 +60,14 @@ under GPL-3.0.
 - Content-aware preprocessing (BCJ, BWT, delta filter)
 - LZ4 ultra-fast compression
 - BLAKE3 cryptographic hashing
+- SHA-256 (FIPS 180-4) implementation
+- OpenTimestamps integration (proof parser, walker, archive trailer)
 - Dictionary metadata for cross-archive sharing
 - Backward compatibility with original UC2 Pro (verified via DOSBox-X)
-- Automated test infrastructure (16 unit tests, DOSBox-X cross-tool testing)
+- Automated test infrastructure (19 unit tests, DOSBox-X cross-tool testing)
+
+All files under "UC2 v3.0.0 Revival" are licensed GPL-3.0-or-later by
+Eremey Valetov (2026).  See `docs/license-audit.md` for the per-file
+provenance table and the LGPL-3.0 / GPL-3.0 chain rationale.
 
 - GitHub: <https://github.com/evvaletov/uc2>
diff --git a/cli/src/compat/compat_dos.c b/cli/src/compat/compat_dos.c
index 18c39c5..9f32c53 100644
--- a/cli/src/compat/compat_dos.c
+++ b/cli/src/compat/compat_dos.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 /* DOS/DJGPP compatibility layer for UC2.
    Provides BSD err.h functions and fnmatch for DJGPP,
    which lacks these POSIX/BSD extensions.
diff --git a/cli/src/compat/compat_win32.c b/cli/src/compat/compat_win32.c
index d5b923c..932bc77 100644
--- a/cli/src/compat/compat_win32.c
+++ b/cli/src/compat/compat_win32.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 /* Win32 compatibility layer for UC2 CLI.
    Provides POSIX/BSD functions missing from MSVC and MinGW.
    All file operations use wide-char Windows APIs for UTF-8 support.
diff --git a/cli/src/compat/getopt.c b/cli/src/compat/getopt.c
index 5395843..c5bf96c 100644
--- a/cli/src/compat/getopt.c
+++ b/cli/src/compat/getopt.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Minimal POSIX getopt() for MSVC.
    Supports short options with optional arguments (e.g., "d:"). */
 
diff --git a/cli/src/compat/include/err.h b/cli/src/compat/include/err.h
index 749e49d..ae3da53 100644
--- a/cli/src/compat/include/err.h
+++ b/cli/src/compat/include/err.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 #ifndef _ERR_H
 #define _ERR_H
 #ifdef __GNUC__
diff --git a/cli/src/compat/include/fnmatch.h b/cli/src/compat/include/fnmatch.h
index 6905693..4c07a9d 100644
--- a/cli/src/compat/include/fnmatch.h
+++ b/cli/src/compat/include/fnmatch.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 #ifndef _FNMATCH_H
 #define _FNMATCH_H
 
diff --git a/cli/src/compat/include/msvc/getopt.h b/cli/src/compat/include/msvc/getopt.h
index 9766ed8..3166a10 100644
--- a/cli/src/compat/include/msvc/getopt.h
+++ b/cli/src/compat/include/msvc/getopt.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Minimal POSIX getopt for MSVC */
 #ifndef _COMPAT_GETOPT_H
 #define _COMPAT_GETOPT_H
diff --git a/cli/src/compat/include/msvc/unistd.h b/cli/src/compat/include/msvc/unistd.h
index bd3fad4..6a8f8ee 100644
--- a/cli/src/compat/include/msvc/unistd.h
+++ b/cli/src/compat/include/msvc/unistd.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Minimal POSIX unistd.h for MSVC */
 #ifndef _COMPAT_UNISTD_H
 #define _COMPAT_UNISTD_H
diff --git a/cli/src/compat/include/msvc/utime.h b/cli/src/compat/include/msvc/utime.h
index c5f5e91..6003b7f 100644
--- a/cli/src/compat/include/msvc/utime.h
+++ b/cli/src/compat/include/msvc/utime.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* POSIX utime.h for MSVC (which only provides sys/utime.h) */
 #ifndef _COMPAT_UTIME_H
 #define _COMPAT_UTIME_H
diff --git a/cli/src/main.c b/cli/src/main.c
index 786b282..8806cde 100644
--- a/cli/src/main.c
+++ b/cli/src/main.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* UltraCompressor II extraction tool.
    Copyright © Jan Bobrowski 2020, 2021
    torinak.com/~jb/unuc2/
diff --git a/docs/license-audit.md b/docs/license-audit.md
new file mode 100644
index 0000000..32ce7a5
--- /dev/null
+++ b/docs/license-audit.md
@@ -0,0 +1,156 @@
+# UC2 License Audit
+
+Status: 2026-05-03. Maintained by Eremey Valetov.
+
+UC2 v3 builds on three layers of prior work, each released under its
+own free-software licence.  This document records per-file provenance,
+the LGPL-3.0 -> GPL-3.0 transition rationale, and the SPDX identifiers
+applied across the source tree.
+
+## Layer 1: Nico de Vries (1992-1996), released 2015
+
+Nico de Vries authored UltraCompressor II as proprietary DOS software
+between 1992 and 1996.  Danny Bezemer obtained permission to release
+the source code publicly and did so in 2015 under the GNU Lesser
+General Public License v3 (LGPL-3.0).
+
+The 2015 release is preserved in this repository under
+`original/UC2_source/` byte-for-byte unchanged, including its license
+header (`GNU LESSER GENERAL PUBLIC LICENSE V3.txt`) and the original
+binaries (`uc2pro.exe`, `uc237b.exe`, `ue.exe`).  No file in `lib/` or
+`cli/` is a verbatim copy of any file in that release.  The 2015 source
+serves as the format specification: it is read for documentation
+purposes (the on-disk archive layout, the SuperMaster dictionary
+contents, the Huffman tree encoding) but its C code is not linked in.
+
+Relicensing impact: none.  Layer 1 is preserved under its original
+LGPL-3.0 licence; nothing is moved upward to GPL-3.0.
+
+## Layer 2: Jan Bobrowski (2020-2021), libunuc2 / unuc2
+
+Jan Bobrowski wrote a clean-room portable decompressor for UC2 v3
+archives between 2020 and 2021.  He released two products:
+
+- `libunuc2` (decompression library) under LGPL-3.0
+- `unuc2` (CLI tool) under GPL-3.0-or-later
+
+The upstream source is preserved in `original/unuc2-0.6/`.  The
+following files in this repository derive from Bobrowski's work and
+retain his original licence:
+
+| Current file                          | Upstream origin                          | Licence       |
+|---------------------------------------|------------------------------------------|---------------|
+| `lib/src/decompress.c`                | `original/unuc2-0.6/libunuc2.c`          | LGPL-3.0-only |
+| `lib/src/list.h`                      | `original/unuc2-0.6/list.h` (identical)  | LGPL-3.0-only |
+| `lib/src/super.bin`                   | `original/unuc2-0.6/super.bin` (identical) | data (de Vries) |
+| `lib/include/uc2/libuc2.h`            | `original/unuc2-0.6/libunuc2.h`          | LGPL-3.0-only |
+| `cli/src/main.c`                      | `original/unuc2-0.6/unuc2.c`             | GPL-3.0-or-later |
+| `cli/src/compat/compat_win32.c`       | `original/unuc2-0.6/compat/compat.c` (Win32 portions) | LGPL-3.0-only |
+| `cli/src/compat/compat_dos.c`         | derived from `compat/compat.c` (DOS adaptation by Valetov) | LGPL-3.0-only |
+
+Modifications by Valetov in 2026 are released under the same licence
+as the file's upstream origin (LGPL-3.0 stays LGPL-3.0; GPL-3.0 stays
+GPL-3.0).  No unilateral upgrade from LGPL to GPL has been applied to
+Bobrowski's work.
+
+`lib/src/super.bin` is the SuperMaster dictionary block from the 1992
+distribution.  It is data, not code: a fixed binary table used as a
+compression-context priming dictionary.  It is bit-identical to the
+file in Bobrowski's release and to the data extracted from de Vries's
+1992 binaries.
+
+## Layer 3: Eremey Valetov (2026), UC2 v3 revival
+
+The following files are new work by Valetov, originally authored for
+the UC2 v3 revival project, released under GPL-3.0-or-later:
+
+| File                                  | Function                                           |
+|---------------------------------------|----------------------------------------------------|
+| `lib/src/compress.c`                  | LZ77+Huffman compressor (inverse of decompress.c)  |
+| `lib/src/uc2_tables.c`                | Huffman delta-coding lookup tables                 |
+| `lib/src/uc2_internal.h`              | Shared compressor/decompressor types and constants |
+| `lib/src/uc2_cdc.c` + `.h`            | Content-defined chunking (Gear hash)               |
+| `lib/src/uc2_merkle.c` + `.h`         | Merkle DAG of deduplicated blocks                  |
+| `lib/src/uc2_blockstore.c` + `.h`     | Cross-archive content-addressable block store     |
+| `lib/src/uc2_simhash.c` + `.h`        | SimHash near-duplicate detection                   |
+| `lib/src/uc2_delta.c` + `.h`          | Binary delta compression                           |
+| `lib/src/uc2_rans.c` + `.h`           | rANS entropy coder (method 10)                     |
+| `lib/src/uc2_dict.c` + `.h`           | Dictionary metadata for cross-archive sharing      |
+| `lib/src/uc2_preprocess.c` + `.h`     | BCJ / BWT / delta-filter preprocessing             |
+| `lib/src/uc2_lz4.c` + `.h`            | LZ4 ultra-fast compression                         |
+| `lib/src/uc2_blake3.c` + `.h`         | BLAKE3 cryptographic hashing                       |
+| `lib/src/uc2_sha256.c` + `.h`         | SHA-256 (FIPS 180-4)                               |
+| `lib/src/uc2_ots.c` + `.h`            | OpenTimestamps proof parser, walker, trailer      |
+| `cli/src/compat/getopt.c`             | Minimal POSIX getopt for MSVC                      |
+| `cli/src/main.c` (post-`9525a81` additions) | OTS attach/extract/info, archive creation, scanning, benchmark | GPL-3.0-or-later (matches upstream `unuc2.c`) |
+
+The Phase 3-7 modules are independent implementations.  They reference
+the UC2 v3 archive format (which is a bitstream layout, not a
+copyrighted work) and use BLAKE3, SHA-256, LZ4, rANS, etc. from
+public-domain or self-authored reference implementations.  None of
+these modules link to or derive from Bobrowski's code beyond using
+shared header types declared in `uc2_internal.h`.
+
+## Relicensing rationale
+
+The composite project links Bobrowski's LGPL-3.0 library (`lib/`) into
+a GPL-3.0-or-later executable (`cli/`).  This combination is permitted
+by LGPL-3.0 sec. 4 (Combined Works): the LGPL library may be used in
+GPL-licensed work without requiring the library itself to be relicensed.
+
+No code has been moved from LGPL-3.0 to GPL-3.0 in this project.
+LGPL §3 permits a one-way upgrade from LGPL to GPL but exercising it
+is unnecessary here: the LGPL files remain LGPL, the GPL files remain
+GPL, and the combined work is distributable under GPL-3.0-or-later (as
+recorded in the project root `LICENSE` file).
+
+If a downstream user wishes to redistribute `lib/` standalone under
+LGPL-3.0, the LGPL-3.0 files are individually identifiable via their
+SPDX-License-Identifier headers.
+
+## SPDX policy
+
+All source files in `lib/` and `cli/` carry one of two SPDX
+identifiers near the top:
+
+- `SPDX-License-Identifier: LGPL-3.0-only` for files derived from
+  Bobrowski's libunuc2 / compat code.
+- `SPDX-License-Identifier: GPL-3.0-or-later` for `cli/src/main.c`
+  (matches Bobrowski's original GPL-3.0-or-later choice for the CLI
+  tool) and for all Valetov-authored Phase 2 through Phase 7 work.
+
+Original copyright lines authored by Bobrowski are preserved verbatim
+where present.  Where Valetov has added substantial new content to a
+Bobrowski-originated file (notably `cli/src/main.c` and
+`compat_dos.c`), an additional Valetov copyright line has been added
+without removing the original.
+
+The 2015 LGPL-3.0 release in `original/UC2_source/` and the 2020-2021
+release in `original/unuc2-0.6/` are preserved unchanged and are not
+subject to this policy: they retain whatever licence headers their
+authors shipped them with.
+
+## Audit checklist
+
+- [x] LGPL-3.0 release by Bezemer/de Vries preserved unchanged in
+      `original/UC2_source/`
+- [x] LGPL-3.0 / GPL-3.0 release by Bobrowski preserved unchanged in
+      `original/unuc2-0.6/`
+- [x] Per-file provenance table above
+- [x] SPDX-License-Identifier on every source file in `lib/` and `cli/`
+- [x] CREDITS.md attributes Bobrowski specifically for libunuc2-derived
+      files, not as generic "inspiration"
+- [x] LICENSE-HISTORY summary published as this file
+      (`docs/license-audit.md`)
+- [x] No silent LGPL-to-GPL upgrade: every Bobrowski-origin file
+      retains LGPL-3.0-only
+
+## References
+
+- LGPL-3.0 text: <https://www.gnu.org/licenses/lgpl-3.0.html>
+- GPL-3.0 text: see `LICENSE` in repository root
+- Bobrowski upstream: <http://torinak.com/~jb/unuc2/>
+- Bezemer 2015 release notes: `original/UC2_source/Read Me First.txt`
+- LGPL-3.0 sec. 3 (allowing one-way upgrade to GPL):
+  <https://www.gnu.org/licenses/lgpl-3.0.html#section3>
+- LGPL-3.0 sec. 4 (Combined Works): same document, sec. 4
diff --git a/lib/include/uc2/libuc2.h b/lib/include/uc2/libuc2.h
index 6d9a8a5..74c7562 100644
--- a/lib/include/uc2/libuc2.h
+++ b/lib/include/uc2/libuc2.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 #ifndef LIBUC2_H
 #define LIBUC2_H
 
diff --git a/lib/include/uc2/uc2_blake3.h b/lib/include/uc2/uc2_blake3.h
index b4461fa..46ebbb8 100644
--- a/lib/include/uc2/uc2_blake3.h
+++ b/lib/include/uc2/uc2_blake3.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* BLAKE3 cryptographic hashing for archive integrity.
  *
  * BLAKE3 is a fast cryptographic hash based on the Bao tree hashing
diff --git a/lib/include/uc2/uc2_blockstore.h b/lib/include/uc2/uc2_blockstore.h
index c9edd78..f4fd118 100644
--- a/lib/include/uc2/uc2_blockstore.h
+++ b/lib/include/uc2/uc2_blockstore.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Cross-archive block store for content-addressable deduplication.
  *
  * Stores unique CDC chunks indexed by 64-bit content hash.  Multiple
diff --git a/lib/include/uc2/uc2_cdc.h b/lib/include/uc2/uc2_cdc.h
index 6161ade..b19b5c1 100644
--- a/lib/include/uc2/uc2_cdc.h
+++ b/lib/include/uc2/uc2_cdc.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-defined chunking (CDC) for UC2 deduplication.
  *
  * Uses the Gear rolling hash for fast, content-aware chunk boundary
diff --git a/lib/include/uc2/uc2_delta.h b/lib/include/uc2/uc2_delta.h
index fa1c8b1..717e03a 100644
--- a/lib/include/uc2/uc2_delta.h
+++ b/lib/include/uc2/uc2_delta.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Delta compression for file versioning.
  *
  * Computes a compact binary delta between a source (old) and target
diff --git a/lib/include/uc2/uc2_dict.h b/lib/include/uc2/uc2_dict.h
index 88ae8fe..8cae565 100644
--- a/lib/include/uc2/uc2_dict.h
+++ b/lib/include/uc2/uc2_dict.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Dictionary management for zstd-inspired dictionary compression.
  *
  * Formalizes UC2's master blocks as proper dictionaries with content
diff --git a/lib/include/uc2/uc2_lz4.h b/lib/include/uc2/uc2_lz4.h
index d9d39e0..cae482f 100644
--- a/lib/include/uc2/uc2_lz4.h
+++ b/lib/include/uc2/uc2_lz4.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* LZ4-compatible ultra-fast compression.
  *
  * Minimal LZ4-like compressor optimized for speed over ratio.
diff --git a/lib/include/uc2/uc2_merkle.h b/lib/include/uc2/uc2_merkle.h
index f69c476..d9de318 100644
--- a/lib/include/uc2/uc2_merkle.h
+++ b/lib/include/uc2/uc2_merkle.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Merkle DAG for content-addressable deduplication.
  *
  * Builds a Merkle tree from CDC chunks: each file is represented as a
diff --git a/lib/include/uc2/uc2_ots.h b/lib/include/uc2/uc2_ots.h
index af646ab..11ac367 100644
--- a/lib/include/uc2/uc2_ots.h
+++ b/lib/include/uc2/uc2_ots.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* OpenTimestamps integration.
  *
  * UC2 stores an OpenTimestamps proof in a magic-bracketed sidecar
diff --git a/lib/include/uc2/uc2_preprocess.h b/lib/include/uc2/uc2_preprocess.h
index 4a28657..34490c5 100644
--- a/lib/include/uc2/uc2_preprocess.h
+++ b/lib/include/uc2/uc2_preprocess.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-aware preprocessing filters for improved compression.
  *
  * These transforms are applied BEFORE compression to expose redundancy
diff --git a/lib/include/uc2/uc2_rans.h b/lib/include/uc2/uc2_rans.h
index 9530d30..2a4c65e 100644
--- a/lib/include/uc2/uc2_rans.h
+++ b/lib/include/uc2/uc2_rans.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* rANS (range Asymmetric Numeral Systems) entropy coder.
  *
  * Drop-in replacement for Huffman coding with ~5-15% better compression
diff --git a/lib/include/uc2/uc2_sha256.h b/lib/include/uc2/uc2_sha256.h
index 11decc7..aff2651 100644
--- a/lib/include/uc2/uc2_sha256.h
+++ b/lib/include/uc2/uc2_sha256.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* SHA-256 (FIPS 180-4) -- pure C implementation.
  *
  * Used by the OpenTimestamps integration; calendars accept SHA-256
diff --git a/lib/include/uc2/uc2_simhash.h b/lib/include/uc2/uc2_simhash.h
index eaabad6..7b968c5 100644
--- a/lib/include/uc2/uc2_simhash.h
+++ b/lib/include/uc2/uc2_simhash.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Near-duplicate detection via SimHash.
  *
  * SimHash produces a fixed-size fingerprint where similar documents
diff --git a/lib/src/compress.c b/lib/src/compress.c
index 2325645..978d518 100644
--- a/lib/src/compress.c
+++ b/lib/src/compress.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* UC2 LZ77+Huffman compressor.
    Produces bitstreams compatible with Bobrowski's decompressor (decompress.c).
 
diff --git a/lib/src/decompress.c b/lib/src/decompress.c
index 150fa68..7d6105c 100644
--- a/lib/src/decompress.c
+++ b/lib/src/decompress.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 /* UltraCompressor II decompression library.
    Copyright © Jan Bobrowski 2020, 2021
    torinak.com/~jb/unuc2/
diff --git a/lib/src/list.h b/lib/src/list.h
index 7b796cb..3ed37a4 100644
--- a/lib/src/list.h
+++ b/lib/src/list.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 /* list.h by Jan Bobrowski. Inspired by list.h from Linux */
 
 #ifndef LIST_H
diff --git a/lib/src/uc2_blake3.c b/lib/src/uc2_blake3.c
index 0615da6..ae73e54 100644
--- a/lib/src/uc2_blake3.c
+++ b/lib/src/uc2_blake3.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* BLAKE3 cryptographic hashing — simplified single-threaded implementation.
  *
  * Based on the BLAKE3 specification (github.com/BLAKE3-team/BLAKE3).
diff --git a/lib/src/uc2_blockstore.c b/lib/src/uc2_blockstore.c
index 4b50272..fa76ac4 100644
--- a/lib/src/uc2_blockstore.c
+++ b/lib/src/uc2_blockstore.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Cross-archive block store for content-addressable deduplication.
  *
  * Chunks are stored as individual files named by their 64-bit hash
diff --git a/lib/src/uc2_cdc.c b/lib/src/uc2_cdc.c
index 43fdc84..23b6f82 100644
--- a/lib/src/uc2_cdc.c
+++ b/lib/src/uc2_cdc.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-defined chunking (CDC) for UC2 deduplication.
  *
  * Gear hash: each byte updates the hash by shifting left and XORing
diff --git a/lib/src/uc2_delta.c b/lib/src/uc2_delta.c
index 7f5989b..f34dd9e 100644
--- a/lib/src/uc2_delta.c
+++ b/lib/src/uc2_delta.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Delta compression for file versioning.
  *
  * Uses a hash-based matching approach: hash all 4-byte windows in the
diff --git a/lib/src/uc2_dict.c b/lib/src/uc2_dict.c
index 648e08f..b33c4d5 100644
--- a/lib/src/uc2_dict.c
+++ b/lib/src/uc2_dict.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Dictionary management for zstd-inspired dictionary compression. */
 
 #include "uc2/uc2_dict.h"
diff --git a/lib/src/uc2_internal.h b/lib/src/uc2_internal.h
index 0ee2993..fd05375 100644
--- a/lib/src/uc2_internal.h
+++ b/lib/src/uc2_internal.h
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* UC2 format constants and shared types.
    Used by both the compressor and decompressor. */
 
diff --git a/lib/src/uc2_lz4.c b/lib/src/uc2_lz4.c
index 8fe5ac6..439e7d9 100644
--- a/lib/src/uc2_lz4.c
+++ b/lib/src/uc2_lz4.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* LZ4-compatible ultra-fast compression.
  *
  * Single-probe hash table with 4-byte match minimum.  No hash chains —
diff --git a/lib/src/uc2_merkle.c b/lib/src/uc2_merkle.c
index 658ca09..5424e3d 100644
--- a/lib/src/uc2_merkle.c
+++ b/lib/src/uc2_merkle.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Merkle DAG for content-addressable deduplication.
  *
  * Each file is split into CDC chunks (Gear hash), each chunk hashed
diff --git a/lib/src/uc2_ots.c b/lib/src/uc2_ots.c
index 105ebfa..ce04ffb 100644
--- a/lib/src/uc2_ots.c
+++ b/lib/src/uc2_ots.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* OpenTimestamps proof parser, serializer, walker, and UC2 trailer.
  *
  * The walker supports the calendar-path subset of opcodes (APPEND,
diff --git a/lib/src/uc2_preprocess.c b/lib/src/uc2_preprocess.c
index 523c603..8e4f7be 100644
--- a/lib/src/uc2_preprocess.c
+++ b/lib/src/uc2_preprocess.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-aware preprocessing filters. */
 
 #include "uc2/uc2_preprocess.h"
diff --git a/lib/src/uc2_rans.c b/lib/src/uc2_rans.c
index 19d8c27..474081c 100644
--- a/lib/src/uc2_rans.c
+++ b/lib/src/uc2_rans.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* rANS (range Asymmetric Numeral Systems) entropy coder.
  *
  * Table-based rANS with 32-bit state.  The state represents a position
diff --git a/lib/src/uc2_sha256.c b/lib/src/uc2_sha256.c
index 1964682..c168307 100644
--- a/lib/src/uc2_sha256.c
+++ b/lib/src/uc2_sha256.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* SHA-256 (FIPS 180-4). Reference textbook implementation. */
 
 #include "uc2/uc2_sha256.h"
diff --git a/lib/src/uc2_simhash.c b/lib/src/uc2_simhash.c
index 52d870a..4dc6abc 100644
--- a/lib/src/uc2_simhash.c
+++ b/lib/src/uc2_simhash.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Near-duplicate detection via SimHash.
  *
  * Algorithm: extract overlapping 4-byte shingles from the input,
diff --git a/lib/src/uc2_tables.c b/lib/src/uc2_tables.c
index 6690dc7..37b8fcb 100644
--- a/lib/src/uc2_tables.c
+++ b/lib/src/uc2_tables.c
@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* UC2 shared tables: Huffman delta coding and default tree lengths. */
 
 #include "uc2_internal.h"