docs: close out lz4/zlib licensing check in bundling-chez.md

ober

afe6cade22d103f63de442e72bd7d1458d2793ee

diff --git a/docs/bundling-chez.md b/docs/bundling-chez.md
index 8c19ed7..52b0b23 100644
--- a/docs/bundling-chez.md
+++ b/docs/bundling-chez.md
@@ -20,7 +20,7 @@ part of the normal build. This doc records how that works and what's left.
 | Docker | **Done** — image builds the same `vendor/ChezScheme` (glibc + a `--static` musl variant) |
 | `--static` musl | **Done** — `support/musl-chez-build*.sh`, Docker musl stage |
 | `--static` everywhere | **Partial** — a hermetic-build knob beyond musl/Linux isn't generalized |
-| Licensing / attribution | **Partial** — `LICENSE-CHEZ`, README credit, and `--version` line done; lz4/zlib redistribution check TODO |
+| Licensing / attribution | **Done** — `LICENSE-CHEZ` + README + `--version`; all bundled deps permissive (lz4's unused GPL CLI/test code aside) |
 | Distribution story | **Open** — release-engineering decision |
 
 ## How it works today
@@ -100,13 +100,16 @@ dirs; supports multiple independent instances.
 
 ## Remaining work
 
-1. **Licensing / attribution (nearly done).** Root `LICENSE-CHEZ` (the Chez
-   NOTICE + Apache 2.0 text) is in place, the README's License section credits
-   Chez, and both `jerboa-bin` and the multicall `jerboa --version` print a Chez
-   attribution line. Still TODO:
-   confirm lz4/zlib (vendored under
-   `vendor/ChezScheme/`) are cleared for redistribution. Compliance, not
-   theory — settle it before any tagged release.
+1. **Licensing / attribution (done).** Root `LICENSE-CHEZ` (the Chez NOTICE +
+   Apache 2.0 text) is in place, the README's License section credits Chez, and
+   both `jerboa-bin` and the multicall `jerboa --version` print a Chez
+   attribution line. All bundled Chez deps are permissive and cleared for
+   redistribution: Chez + zuo (Apache 2.0), zlib (zlib License), lz4's `lib/`
+   (BSD 2-Clause), and nanopass + stex (MIT). The binary embeds only that
+   permissive set — lz4's GPL-2.0+ `programs/`/`tests/`/`examples/` are vendored
+   but never built or linked (`c/build.zuo` compiles only `lz4/lib/*.c`).
+   Optional cleanup: strip those unused lz4 GPL dirs from the snapshot to ship
+   zero copyleft source.
 
 2. **Generalize `--static` (partial).** Static, hermetic Chez is wired for
    musl/Linux (`musl-chez-build*.sh`, the Docker musl stage). A single