Strictly speaking this is correct, and probably there's no one who would miss the gotcha on the list, but for the sake of completeness:

You can release the source only to people who you have provided the program, but *they* have the ability to redistribute it under the terms of the GPL.  As discussed elsewhere, this seems to be a difference between the LGPL and GPL, when dealing with Haskell libraries.  When using the LGPL, you must allow people to update the library, so must (in the absence of dynamic linking) provide the source, but you *may* prohibit redistribution of that source.  (IANAL...)