diff --git a/docs/spec/cutover.md b/docs/spec/cutover.md
index 6236f1d..4489b7e 100644
--- a/docs/spec/cutover.md
+++ b/docs/spec/cutover.md
@@ -272,6 +272,20 @@ Write down which of the two each difference is. Do it after mail is
 flowing, not as a gate: it informs the contract, it doesn't block the
 cutover.
 
+## Source, and AGPL section 13
+
+The fork is a modified AGPL program, so everyone who interacts with it over
+a network has to be offered its Corresponding Source. That obligation starts
+when the fork begins serving, which is the cutover, not the announcement.
+
+Settled (John, 2026-09-19): the source is released after the cutover and the
+links go live then. In between, the only people the server serves are the
+operator's household, so the set of users owed an offer and the set of
+people holding the repository are the same set. A migration by anyone else
+inherits the obligation on their own first day, which is worth saying in the
+migration tool's output rather than leaving them to find it
+(`migration.md`).
+
 ## The first week
 
 - **Certificate renewal.** The one thing that fails quietly and late. Watch
diff --git a/docs/spec/migration.md b/docs/spec/migration.md
index 337fb2a..d77baf6 100644
--- a/docs/spec/migration.md
+++ b/docs/spec/migration.md
@@ -192,6 +192,14 @@ the verification, reports the timings, and removes the copy. It answers "how
 long will this take, and will it work" without touching the running server,
 and it is what the operator should run first.
 
+## What the operator inherits
+
+INBUXA is AGPL, and a migrated server is one its users reach over a network,
+so from its first day its operator owes those users an offer of the
+Corresponding Source (AGPL section 13). The tool should say so once, at the
+end of a successful migration, rather than leaving an obligation to be
+discovered. It is satisfied by a link, and INBUXA's own is published.
+
 ## Open
 
 - Where it lives: a command in ihasmail-oneshot, a sibling to