So if Debian provides, say, a web frontend to Ghostscript, then with
AGPL Ghostscript running that web frontend as a service for others only
require an interface serving its sources if the _webmaster_ changes the
code for that frontend?
Not if Debian makes changes to both the frontend and AGPL Ghostscript?
That seems like a loophole to me: If Google wants an advantage by
running better-than-ghostscript.google.com PDF convertor, they can
simply let another company/organisation/person be the "Debian" in their
chain and not need to reveal their patches to their users.