diff --git a/Cargo.toml b/Cargo.toml
index cca3b40..2c8ed83 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,10 +13,17 @@ publish = ["kellnr"]
 readme = "README.md"
 keywords = ["trueskill", "rating", "bayesian", "elo", "skill"]
 categories = ["algorithms", "science", "game-development"]
-# TODO: pick a licence before publishing. `cargo publish` rejects a crate
-# without `license` (or `license-file`), and without one the source carries no
-# stated terms. The Rust convention is `license = "MIT OR Apache-2.0"` plus the
-# matching LICENSE-MIT / LICENSE-APACHE files.
+# Deliberately unlicensed for now — not an oversight.
+#
+# Correcting what this note used to claim: `cargo publish` does NOT reject a
+# crate without `license`/`license-file` when the target is an alternative
+# registry. Only crates.io enforces it. Verified by `cargo publish --dry-run`
+# against kellnr, which packages and verifies cleanly as-is.
+#
+# The consequence is legal, not mechanical: with no stated terms the source is
+# all-rights-reserved by default. The Rust convention when one is wanted is
+# `license = "MIT OR Apache-2.0"` plus matching LICENSE-MIT / LICENSE-APACHE
+# files.
 # `examples/atp.csv` is a 48 MB tennis dataset — 99% of the packaged crate,
 # for a library whose source is 312 KB. `examples/atp.rs` opens it by
 # relative path at runtime, so excluding the data still compiles; the