- On macOS, the path from _NSGetExecutablePath is cut at its first NUL
  found inside the buffer, in place of strlen, which reads until a NUL
  wherever it is.
- The table test measures its C strings with std::string_view.
- The Bazel reporter test reads the JUnit report and rejects a document
  type before parsing it, so no entity, external or internal, is ever
  expanded.

Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

Every Progmasoft-authored file moves from MPL-2.0 WITH
AdditionRef-Progmasoft-Exception-2.0 to LGPL-3.0-or-later, from 0.5.0
on. Catch2-originated files keep BSL-1.0, and the vendored yyjson and
pugixml keep MIT.

- LICENSES/ holds the LGPL-3.0 text and the GPL-3.0 text it builds on,
  both as published by the FSF; the MPL-2.0 and Progmasoft Exception
  texts go, since no file uses them any more.
- Five files that came from Catch2 and were rewritten by Progmasoft
  (.clang-format, the issue and pull request templates, SECURITY.md)
  keep Catch2's notice next to Progmasoft's and say
  LGPL-3.0-or-later AND BSL-1.0.
- //tools:check expects the new header of Progmasoft files; the
  amalgamation notes say LGPL-3.0-or-later and the amalgamated files
  are regenerated; meson's project license is BSL-1.0 and
  LGPL-3.0-or-later.
- README gains a License section; LICENSES/README.md, contributing.md
  and progmasoft-catch3.md describe the new split and that releases
  before 0.5.0 keep the license they were published under.

Every commit to Progmasoft's files since the fork is the maintainer's.

Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

A function-local static std::mutex has an exit-time destructor, which
the macOS build rejects with -Wexit-time-destructors. The lock is now
allocated once and never destroyed, which also keeps it usable by a
thread that starts a child while the process exits.

Reading the coverage profiles on several threads broke an assumption of
ChildProcess::Start on POSIX: it changes the working directory of the
whole process around posix_spawn. Two gcov runs started at once could
both run in one test's directory, so on the GCC job the map of
"Subtracts one" showed what "Adds one" reached.

- ChildProcess::Start holds a lock while a child starts, on POSIX and
  Windows, so the directory change and the handles a child inherits never
  overlap with another start.
- gcov gets the absolute path of the data file and no working directory,
  so no directory changes while profiles are read in parallel.

EnvironmentBlock replaced every non-ASCII character of an inherited name
with '?' before asking whether to withhold it, so --pass-env=MY_?_TOKEN
kept an unrelated MY_é_TOKEN. Names are now converted with Narrow, as
everything else the runner compares.

A block whose variables were all withheld, with no additions, ended in one
terminator; CreateProcessW needs two for an empty block.

The amalgamated sources are regenerated for the runner changes.

Workers and the other processes the runner starts copied its whole
environment, tokens and passwords included. ChildProcess::Start now
leaves out every variable whose name contains, in any case, TOKEN,
SECRET, PASSWORD, PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or
ACCESS_KEY (IsSecretVariable), unless ChildOptions::keptEnvironment
names it; names compare without case on Windows.

--pass-env=NAME, repeatable, and "pass-env" in catch3.json keep a
variable for the tests. The runner itself still starts with the whole
environment, so code that runs before the first worker sees it;
docs/progmasoft-runner.md says so.

A runner test starts the shell's environment listing with a secret and
a plain variable set, sees only the plain one, and sees the secret once
it is kept.

Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties
for the code the tools place in them, and left other cases unclear.
Version 2.0 adds a generated code permission, covers runtime and standard
libraries, compiler transformations, interfaces and examples, and settles
how a file is identified and how to tell recipients about source.

Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0.
The older texts stay, because released versions name them.

A lambda in the POSIX half of Process.cpp captured a structured binding,
which needs C++20 and which a Windows build never compiles. The files in
extras still held the C++20 sources, so they are generated again, and the
generator no longer says the runner needs C++20.

C++17 is still the widest common target, and a library built on it stays
usable from C++17 and every later standard, while C++20 would have left
out many users.

Concepts become enable_if on named traits in Detail/TypeTraits.hpp, which
also replaces std::remove_cvref_t and std::identity. std::span becomes
std::vector references, std::bit_cast becomes static_cast and memcpy,
template lambdas become helper templates, and std::erase_if, contains,
starts_with and ends_with have their C++17 forms. Random::Between no
longer uses a lambda over a constexpr local, which MSVC rejects outside
/permissive-, so the headers work under its default mode too.

Tests give up designated initializers, which MSVC refuses in C++17. CI
builds the matrix in C++17 and C++20, since the headers promise both.