Which identity and restoration stacks are actually usable commercially once face models, base models and checkpoints are all counted?

InstantID's README says its checkpoints are research-only and insightface models are non-commercial, while its Hugging Face card lists Apache-2.0; PuLID states no weights license and builds on FLUX.1-dev for the FLUX path; SUPIR carries a non-commercial declaration. For each, what is the effective commercial status of an end-to-end pipeline, and can owners clarify conflicting statements? Why this is still open: Primary sources conflict (GitHub vs Hugging Face) or are silent, and code licenses do not settle weights or dependency rights.