[DrunkOnJava]

Summary

CLEANROOM.md and the reconnaissance report's legal context (§6.4) stated more than the process or the evidence supports. They now say the clean-room approach reduces legal risk without eliminating it, describe 17 U.S.C. § 1201(f) as a limited provision with statutory conditions, source the one lawsuit they mention, and drop claims that could not be verified. Every rule, forbidden source and the contributor declaration in CLEANROOM.md are unchanged.

Changes

CLEANROOM.md:

• "Every byte-level finding in the repo is derived from public sources" → "must be derived from public sources and state the sources it rests on".
• The commercial-use bullet no longer says the licence and provenance mean "no viral-license risk + no IP-contamination risk". It says they are meant to keep that risk low, that no process can rule it out, and that users with specific constraints take their own advice (the legal posture section).

docs/rvt-moat-break-reconnaissance.md §6.4:

• Autodesk and the Open Design Alliance: the 2006 suit (over the TrustedDWG watermark) and the trademark proceedings after it concerned DWG, not RVT. Their 2010-04-09 settlement is linked to Autodesk's announcement. The old line said Autodesk "lost the ability to use trademark to stop RVT reimplementations".
• ODA BimRv SDK: a commercial SDK licensed to ODA members; rvt-rs uses none of it. The unverified price range is removed.
• Encryption: scoped to the files read for this work. Their streams are structured data read without any key (§3.3's inflation ratios); encrypted or password-protected files are listed as unsupported in compatibility.md.
• Legal risk: "The project's clean-room approach is intended to reduce, not eliminate, legal risk. In the United States, 17 U.S.C. § 1201(f) contains a limited interoperability provision subject to statutory conditions. This is not legal advice; the implications depend on the circumstances." This replaces "has no legal risk", the DMCA line and the description of § 1201(f) as a copyright exception.
• Autodesk Platform Services (formerly Forge): rvt-rs does not use it or its terms. The unverified claim about what Forge's terms restrict is removed.

Testing

• N/A: docs only. tools/ci/api-doc-ids.py and the PII guard run in CI.

Audit-honesty checklist

• README / docs reflect the current state after this PR
• N/A: changelog fragment (no user-visible behaviour)
• Commit messages describe what changed and why
• No emojis in code, docs, or commit messages
• No private paths, personal email addresses, or internal jargon in committed files

Legal and contribution hygiene

• Apache-2.0
• No Autodesk proprietary content

Breaking changes

None.

The maintainer reviews the final wording before this merges.