diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ff78cff..83303f9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,6 +31,10 @@ jobs:
           else
             echo "code=true" >> "$GITHUB_OUTPUT"
           fi
+          echo "base=$base" >> "$GITHUB_OUTPUT"
+      - name: CHANGELOG entry for data changes
+        run: |
+          base='${{ steps.changes.outputs.base }}'
           if ! git diff --quiet "$base"...HEAD -- data testdata/shipped_shape.txt && git diff --quiet "$base"...HEAD -- CHANGELOG.md; then
             echo "::error::the shipped data changed without a CHANGELOG.md entry (see the README's Versioning)"
             exit 1
diff --git a/AGENTS.md b/AGENTS.md
index 031f02b..5bab122 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,8 +1,8 @@
 # Rules
 
-- Go runs only through `docker compose run --rm <test|vet|fmt|build>`; the merge gate is `docker build .`.
+- Go runs only through `docker compose run --rm <test|vet|fmt|build>`; the merge gate is `docker build .` plus CI's changelog check.
 - Tests first, in their own commit; the implementation follows in the next. A re-pin of seeded output or of `testdata/shipped_shape.txt` is its own commit.
-- A change under `data/` or to the shape pin adds its `CHANGELOG.md` entry under `Unreleased` in the same PR; what is major is the README's Versioning table.
+- A change under `data/` or to the shape pin adds its `CHANGELOG.md` entry under `Unreleased` in the same PR, and so does a change to a flag, an exit code, an exported name, a fence, a builtin or the lowest Go; what is major is the README's Versioning table.
 - One-line commit messages: no ticket prefix, no repo name, no authorship trailers.
 - Hard tabs. No comment by default; delete a restatement, a rationale, history, or a file preamble.
 - One spelling per result: reject the other at `New`, and let the error name the spelling to use.
diff --git a/README.md b/README.md
index 2e8c390..e0443cc 100644
--- a/README.md
+++ b/README.md
@@ -538,11 +538,14 @@ a minor only adds, and a major is the only release that changes what exists.
 
 | Surface | Major | Minor |
 |---------|-------|-------|
-| Shipped data | remove or rename a path; change a category's format; remove a value, or change a weight or a repeat; add a reference from one shipped category into another | a path, a locale, a value in a list |
+| Shipped data | remove or rename a path; change a category's format; remove a value, or change a weight or a repeat; add a reference from one shipped category into another | a path outside a record's columns, a locale, a value in a list |
 | Records | remove, rename, retype or add a column; let a column be null | a record, as a new category |
-| Data format | a fence: a spelling `New` rejects that it accepted; an option, since it reserves a field name | a builtin |
-| CLI | remove or rename a flag, or change its default; change what an exit code means; change the bytes a `--format` writes, the `--list` layout, or what an error names | a flag, a format |
-| Library | change or remove an exported name; raise the lowest supported Go | an exported name, an option |
+| Data format | a fence: a spelling `New` rejects that it accepted; a template option, since it reserves a field name | a builtin |
+| CLI | remove or rename a flag, or change its default; change what an exit code means; change the framing a `--format` writes (header, quoting, statement shape), the `--list` layout, or what an error names | a flag, a format |
+| Library | change or remove an exported name; raise the lowest supported Go | an exported name, a `With…` option |
+
+A patch changes no row of this table: performance, docs, or a fix inside a promised
+behaviour that changes no value, path, format or spelling.
 
 Seeded output is a promise within one version: same seed, same version, same
 data, same output. Any release may shift a stream, since a value added to a list
@@ -817,8 +820,9 @@ docker compose run --rm --user "$(id -u):$(id -g)" tidy  # go mod tidy
 Every pull request runs `docker build .` against both the latest and the lowest
 supported Go, and must pass before it can be merged — unless it changes none of
 the files the build and its tests read, nor the workflow itself, in which case
-it's skipped (see [Decisions](#decisions)). That build is the whole gate — vet,
-complexity, format check and tests — so run it locally before pushing:
+it's skipped (see [Decisions](#decisions)). That build is the whole gate but the
+changelog check, which CI runs against the PR base — vet, complexity, format check
+and tests — so run it locally before pushing:
 
 ```sh
 docker build .                                  # latest
diff --git a/todo.md b/todo.md
index 253bd54..fbc3d8c 100644
--- a/todo.md
+++ b/todo.md
@@ -15,7 +15,7 @@
 
 - CLI without Go — investigate prebuilt binaries: GoReleaser attaching them to
   the Gitea release the tag workflow publishes, a container image, Homebrew and
-  Scoop. A `--version` flag lands with them.
+  Scoop. A checkout build prints `devel` for `--version`; the binaries carry the stamped tag.
 - Homepage — a simple page for fejkdata with an in-browser generator: the library
   compiled to WebAssembly, so visitors generate as much data as they like in their
   own browser.