chore: make the internal changelog ours and clarify what the licence covers

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,6 +7,6 @@
 - [ ] `python -m pytest tests` passes locally.
 - [ ] New behaviour has tests (see `tests/` for the style).
 - [ ] UI text goes through i18n keys, with **both** `lang/en.json` and `lang/pl.json` updated.
-- [ ] User-facing changes noted in `CHANGELOG.md`; technical ones and new tests in `CHANGELOG-INTERNAL.md`, under `[Unreleased]`.
+- [ ] User-facing changes noted in `CHANGELOG.md`, under `[Unreleased]`.
 - [ ] Commits follow Conventional Commits (`type(scope): summary`).
 - [ ] No version bump - the owner closes a version via `VERSION.txt`.

.github/workflows/release.yml

@@ -64,7 +64,9 @@ jobs:
           version="$(cat VERSION.txt)"
           escaped="${version//./\\.}"
           fail=0
-          for f in CHANGELOG.md CHANGELOG-INTERNAL.md; do
+          # CHANGELOG-INTERNAL.md is not in the repository, so this job cannot
+          # see it. Its structure is guarded locally by .claude/hooks/check_notes.py.
+          for f in CHANGELOG.md; do
             grep -qE "^## \[${escaped}\] +- +[0-9]{4}-[0-9]{2}-[0-9]{2}" "$f" \
               || { echo "$f: no dated '## [$version] - YYYY-MM-DD' section"; fail=1; }
             open="$(awk '/^## \[Unreleased\]/{u=1;next} /^## \[/{u=0} u && /^- /{n++} END{print n+0}' "$f")"

.gitignore

@@ -31,6 +31,10 @@ BeanNetworkTester-*.zip
 CLAUDE.md
 PROJECT_NOTES.md
 HISTORY_NOTES.md
+# The technical changelog is ours: it records ADRs, rejected variants and
+# every added test. It stays next to the notes it argues with, not in the
+# release. Its structure is guarded by .claude/hooks/check_notes.py.
+CHANGELOG-INTERNAL.md
 
 # Internal scripts kept between sessions: measurement rigs, probes, diagnostics.
 # Never shipped, never a CI dependency, backed up by the owner separately.

CHANGELOG.md

@@ -5,6 +5,14 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); versions fol
 
 ## [Unreleased]
 
+### Docs
+
+- Both READMEs now say in the licence section that **what you make with the tool is yours**.
+  Scenarios you write, saved profiles and config files, reproduction reports, CSV exports, logs
+  and screenshots are your own work: the GPL covers the program, not its output, and using the
+  tool does not oblige you to publish anything. The example scenarios shipped in `scenarios/`
+  are part of the project and stay GPLv3.
+
 ### Fixed
 
 - In the Settings window, "Capture only the targeted traffic" stayed clickable after you pressed

README.md

@@ -1350,6 +1350,17 @@ change it, and to redistribute copies - including modified ones - provided you p
 under the same GPLv3 terms and make the corresponding source available. The program is provided
 "AS IS", with no warranty and no liability on the author's part. The author is **DonislawDev**.
 
+### What you make with it is yours
+
+**The GPL covers the program, not your output.** Scenario files you write, saved profiles and
+configuration files, reproduction reports, exported CSVs, log files and screenshots are your own
+work. Using Bean Network Tester does not put them under the GPL and does not oblige you to publish
+anything. Keep them private, ship them with a closed-source product, sell them - your call.
+
+The one thing to keep apart: the example scenarios that come **with** the program, in the
+`scenarios/` directory, are part of the project and are GPLv3 like the rest of it. A scenario you
+write yourself is not, even if you started from one of them and changed the numbers.
+
 ## Third-party components
 
 The program uses libraries by other authors, under their own licenses - among them

README.pl.md

@@ -1209,6 +1209,18 @@ pod warunkiem przekazywania programu dalej na tych samych warunkach GPLv3 i
 udostępnienia odpowiadającego kodu źródłowego. Program dostarczany jest „AS IS”,
 bez gwarancji i bez odpowiedzialności autora. Autorem jest **DonislawDev**.
 
+### To, co nim zrobisz, należy do Ciebie
+
+**GPL obejmuje program, a nie to, co nim wyprodukujesz.** Napisane przez Ciebie scenariusze,
+zapisane profile i pliki konfiguracji, raporty reprodukcji, wyeksportowane pliki CSV, logi
+i zrzuty ekranu są Twoją własną pracą. Użycie Bean Network Testera nie obejmuje ich licencją GPL
+i nie zobowiązuje Cię do publikowania czegokolwiek. Możesz je trzymać u siebie, dołączyć do
+zamkniętego produktu albo sprzedać - to Twoja decyzja.
+
+Jedna rzecz, którą trzeba oddzielić: przykładowe scenariusze dostarczane **razem** z programem,
+w katalogu `scenarios/`, są częścią projektu i podlegają GPLv3 tak samo jak reszta. Scenariusz
+napisany przez Ciebie już nie, nawet jeśli zacząłeś od jednego z nich i zmieniłeś liczby.
+
 ## Komponenty firm trzecich
 
 Program korzysta z bibliotek innych autorów, na ich własnych licencjach - m.in.

beantester/engine.py

@@ -1825,7 +1825,7 @@ def _inject_loop(self):
                     # will never see it either - without this it just left the
                     # seen/delivered/dropped balance, silently, which is the one
                     # thing keeping these numbers honest. Found while measuring the
-                    # batched injector (rejected, see CHANGELOG-INTERNAL): the hole
+                    # batched injector (built, measured and rejected): the hole
                     # was one packet wide already, and batching would have made it
                     # a whole batch wide.
                     self._bump("drop_shutdown")

tests/test_inject_batch.py

@@ -1,7 +1,7 @@
 """A packet taken off the release heap must never leave the books.
 
-Found while measuring the batched injector (measured and REJECTED - see
-CHANGELOG-INTERNAL). The hole is older than that work and survives it: the inject
+Found while measuring the batched injector, which was built, measured and then
+rejected. The hole is older than that work and survives it: the inject
 loop pops a packet, then finds ``_divert`` gone because STOP cleared it in
 between. The packet is no longer in ``_heap``, so ``stop()``'s stranded sweep
 cannot see it either, and it used to vanish with no counter at all.

tests/test_repo_conventions.py

@@ -22,7 +22,8 @@
 # exactly where they exist.
 SKIP_DIRS = {".git", "__pycache__", ".pytest_cache", "licenses", "build", "dist",
              ".hypothesis", "internal_tools", ".claude", "crashes"}
-SKIP_FILES = {"PROJECT_NOTES.md", "HISTORY_NOTES.md", "CLAUDE.md"}
+SKIP_FILES = {"PROJECT_NOTES.md", "HISTORY_NOTES.md", "CLAUDE.md",
+              "CHANGELOG-INTERNAL.md"}
 
 
 def repo_text_files(exts):
@@ -289,7 +290,8 @@ def test_the_repository_scanners_stay_out_of_what_is_not_in_the_repository():
     """
     scanned = {os.path.relpath(p, ROOT).replace(os.sep, "/")
                for p in repo_text_files((".py", ".md", ".json", ".txt"))}
-    for stray in ("PROJECT_NOTES.md", "CLAUDE.md", "HISTORY_NOTES.md"):
+    for stray in ("PROJECT_NOTES.md", "CLAUDE.md", "HISTORY_NOTES.md",
+                  "CHANGELOG-INTERNAL.md"):
         check(f"{stray} is not scanned (it is not in the repository)",
               stray not in scanned, f"({stray})")
     for prefix in ("internal_tools/", ".claude/", "crashes/"):

tests/test_version_and_release.py

@@ -114,7 +114,10 @@ def test_breaking_sections_come_first():
     in both changelogs and nothing noticed - the em/en-dash guard reads changelog
     TEXT, never its structure.
     """
-    for name in ("CHANGELOG.md", "CHANGELOG-INTERNAL.md"):
+    # CHANGELOG-INTERNAL.md is not in the repository (it is a maintainer file, kept
+    # in the private notes repo), so no test here can read it. Its structure is
+    # guarded by `.claude/hooks/check_notes.py`, which runs where the file exists.
+    for name in ("CHANGELOG.md",):
         lines = open(os.path.join(ROOT, name), encoding="utf-8").read().splitlines()
         version, sections = None, []
         problems = []
@@ -145,7 +148,9 @@ def close(version, sections):
 # already been broken in practice. Prose is not a guard.
 
 
-CHANGELOG_FILES = ("CHANGELOG.md", "CHANGELOG-INTERNAL.md")
+# Only the shipped changelog. The internal one is a maintainer file kept out
+# of the repository, so its guards live in `.claude/hooks/check_notes.py`.
+CHANGELOG_FILES = ("CHANGELOG.md",)
 DATED_VERSION_RE = re.compile(r"^## \[(\d+\.\d+\.\d+)\]\s+-\s+\d{4}-\d{2}-\d{2}\b")
 
 
@@ -164,8 +169,8 @@ def _versions_in(name):
     return blocks
 
 
-def test_version_txt_has_a_dated_section_in_both_changelogs():
-    """VERSION.txt must name a released, DATED section in both changelogs.
+def test_version_txt_has_a_dated_section_in_the_changelog():
+    """VERSION.txt must name a released, DATED section in the changelog.
 
     The failure this closes is silent by construction: `release.yml` checks the
     tag against VERSION.txt and nothing else, so a version bumped without its