chore: make the internal changelog ours and clarify what the licence covers

[donislawdev]

Two commits, plus one question answered by measurement that produced no change.

1. CHANGELOG-INTERNAL.md leaves the repository

It records ADRs, rejected variants, measured dead ends and every added test. That belongs next to the notes it argues with, not in a public checkout. Older revisions stay in git history and that is accepted.

The interesting part is what had to move with it, because a git rm --cached alone would have broken three things quietly:

• tests/test_version_and_release.py read it in three places. A test that reads a file absent from every checkout reddens CI for a reason no CI can fix, so the changelog checks now cover only the shipped CHANGELOG.md, and the dated-section test lost the word "both" from its name because it stopped being true.
• release.yml checked both files at tag time and now checks one.
• The PR template told outside contributors to edit a file they cannot see.
• Two comments in engine.py and test_inject_batch.py pointed readers at it; they now say what happened instead of where to read about it.
• The repository scanners skip it, so they keep measuring the same set here and in CI.

The structural guards did not disappear, they moved into the maintainer's Stop hook, which runs where the file exists: BREAKING-comes-first, and a dated section for whatever version VERSION.txt names. Both mutation-checked after the move.

Two things worth stating plainly rather than leaving to be discovered:

• Cost: at the moment of tagging, nothing in CI can see this file any more. Only the local hook can.
• The duplicate-heading check was deliberately not ported. Headings in that file carry content (### ADR 2026-07-29: Nuitka ...), so two ### Fixed blocks in one version are normal - and 0.4.0 already has them. Ported blindly, the check fired on the existing file within a minute of being written. The right answer was to drop the check, not to reshape a published section to satisfy it.

2. Both READMEs say that what you make with the tool is yours

A reader can reasonably wonder whether writing a scenario file with a GPLv3 program puts that scenario under the GPL. It does not. Scenarios you write, saved profiles and config files, reproduction reports, CSV exports, logs and screenshots are your own work, and using the tool obliges you to publish nothing.

The distinction it would be misleading to omit: the example scenarios shipped in scenarios/ are part of the project and stay GPLv3. One you wrote yourself is not, even if you started from one of them and changed the numbers.

3. Is the CI build a release build? Yes, and the one remaining lever was measured and rejected

PyInstaller has no debug/release split. What exists is already set: debug=False, upx=False (packed binaries get flagged by scanners) and strip=False. The only untouched lever is Analysis(optimize=), which defaults to -1 meaning "inherit the building process", so today's builds are level 0.

Two real builds, startup paired and interleaved over 14 pairs:

	optimize=0	optimize=2
release	22.80 MB / 266 files	22.18 MB / 266 files
startup (--version), median	365.9 ms	365.6 ms
spread of the reference variant	34.0 ms	46.2 ms

The difference of medians is +0.3 ms against a 34 ms spread, so there is no difference. The gain is 0.62 MB, or 2.7%.

Rejected even so. -OO strips docstrings and asserts from the whole bundle including dependencies - beantester/ has none and never reads __doc__, pydivert's production code has none either (its 466 asserts are in its tests), but psutil ships 18 in _common.py. The stronger reason: it creates a source-versus-frozen divergence no test can see, because the suite runs from source where docstrings exist. That is the same class the Nuitka ADR already listed among its three defects. 2.7% of size is not worth silent differences in the shipped artefact that nothing guards.

No code change from this section. The measurement is written down so nobody re-opens it from a hunch.

Testing

python -m pytest tests: 918 passed, exit 0. python smoke_gui.py: OK. Both built exes were smoke-tested (--version, --license, --simulate with NDJSON output) before the comparison.

🤖 Generated with Claude Code