docs(browser): bound commercial license scope

LICENSE

@@ -1,12 +1,18 @@
 Copyright (c) 2024-present Manaflow, Inc.
 
-This software is dual-licensed:
+Other contributors and third parties retain copyright in their material.
 
-1. Open source: GNU General Public License v3.0 or later (GPL-3.0-or-later).
-   See the full text below.
+Except where a file or accompanying notice states otherwise, material
+contributed under the cmux project license is licensed under the GNU General
+Public License v3.0 or later (GPL-3.0-or-later). See the full text below.
 
-2. Commercial: For organizations that cannot comply with GPL, a commercial license
-   is available. Contact [email protected] for details.
+Manaflow may separately offer commercial terms only for material for which it
+controls the necessary rights. Those terms do not relicense third-party
+material or outside contributions for which Manaflow lacks a separate grant.
+A product that combines cmux material with third-party material remains subject
+to every applicable third-party license and notice. See
+THIRD_PARTY_LICENSES.md and file-level notices. Contact [email protected]
+for details about the eligible scope.
 
 --------------------------------------------------------------------------------
 

README.md

@@ -440,4 +440,8 @@ cmux is free, open source, and always will be. If you'd like to support developm
 
 cmux is open source under [GPL-3.0-or-later](LICENSE).
 
-If your organization cannot comply with GPL, a commercial license is available. Contact [[email protected]](mailto:[email protected]) for details.
+If your organization cannot comply with GPL, commercial terms may be available
+for portions for which Manaflow controls the necessary rights. They do not
+relicense third-party material or outside contributions for which Manaflow
+lacks a separate grant. See [LICENSE](LICENSE) for the exact scope and contact
+[[email protected]](mailto:[email protected]) for details.

cmux-browser/IMPORT_PROVENANCE.md

@@ -61,6 +61,11 @@ AGPL's additional source requirement is material when a modified program is
 offered for remote interaction over a network. If cmux later ships a hosted
 service for which that distinction matters, license it as a separately
 reviewed component rather than changing the desktop product incidentally.
+AGPL obligations attach to the AGPL-covered network-interactive program; they
+do not automatically relicense independent neighboring services. If an
+AGPLv3-covered component is combined with GPLv3-covered code, the GPLv3/AGPLv3
+section 13 compatibility rule and the AGPL network-source requirement for the
+combination must be reviewed as part of that service's architecture.
 
 Manaflow can release later versions of rights-controlled code under different
 terms, but an already published GPL or AGPL grant remains available for that
@@ -88,9 +93,17 @@ composition gates.
 - **Chromium:** pin a full source commit and DEPS state. Generate the shipped
   target's license/credits output with Chromium's license tooling.
 - **Ghostty:** use the root gitlink, retain its MIT notice, and include licenses
-  for linked libraries, fonts, themes, and shell-integration resources. Do not
-  infer that every converted theme is MIT from the theme collection's license;
-  ship only themes with verified per-theme redistribution provenance.
+  for linked libraries, fonts, themes, and shell-integration resources. The
+  current Darwin link includes static GNU gettext/libintl 0.24 under
+  LGPL-2.1-or-later even when Ghostty is built with `-Di18n=false`; that option
+  disables catalogs but does not remove the unconditional Darwin link. Inspect
+  the produced archive rather than treating a build flag as license evidence.
+  The embedded font closure includes JetBrains Mono 2.304 under OFL-1.1 and
+  Nerd Fonts Symbols Only 3.4.0 under MIT; preserve their exact notices, and
+  review OFL Reserved Font Name conditions before modifying or rebuilding the
+  OFL font. Do not infer that every converted theme is MIT from the theme
+  collection's license; ship only themes with verified per-theme
+  redistribution provenance.
 - **cmux TUI:** build the sibling workspace and record the exact helper receipt.
 - **Helium:** retain exact patch provenance and GPL-3.0-only terms. A future
   proprietary Browser requires independently reimplementing or separately
@@ -99,8 +112,10 @@ composition gates.
   split-layout and animation behavior, even though cmux already ships Bonsplit
   elsewhere in the monorepo.
 - **uBlock Origin:** pin the extension payload digest and upstream source tag,
-  preserve GPL-3.0-only notices, and distribute the corresponding source or a valid
-  source offer with the binary.
+  preserve GPL-3.0-only notices, and distribute the corresponding source or a
+  valid source offer with the binary. Preserve and inventory the extension's
+  own embedded third-party licenses and assets as well; the uBlock GPL notice
+  is not a substitute for those notices.
 
 ## Required gates
 

cmux-browser/README.md

@@ -56,4 +56,6 @@ published GPL version, and it does not extend to third-party code or outside
 contributions without the necessary relicensing rights.
 
 See [`IMPORT_PROVENANCE.md`](IMPORT_PROVENANCE.md) for the import boundary and
-the repository's `THIRD_PARTY_LICENSES.md` for shipped notices.
+the repository's `THIRD_PARTY_LICENSES.md` for the current cmux dependency
+inventory. That root inventory is not a complete Browser binary notice bundle;
+target-specific Browser notices remain a release gate.