diff --git a/02-DECISIONS/0006-the-substrate-and-the-control-plane.md b/02-DECISIONS/0006-the-substrate-and-the-control-plane.md
index 2401471..f5044fb 100644
--- a/02-DECISIONS/0006-the-substrate-and-the-control-plane.md
+++ b/02-DECISIONS/0006-the-substrate-and-the-control-plane.md
@@ -113,7 +113,14 @@ apply time. A tag moves; a digest does not, and reproducibility comes from pinni
 a thing rather than carrying its bytes.
 
 The assumption that a machine might have no network came from the lab and was wrong: a machine
-being adopted has one, and the sealed case is the lab, which places images itself.
+being adopted has one, and the sealed case is the lab.
+
+**The lab places images by raising a registry inside the scenario**, which is what a real node
+pulls from anyway — so it tests the real path rather than a stand-in for it. The digests that
+registry serves are its own, and that satisfies this rule: what is required is a reference that
+is **exact and cannot move**, and one it assigned is both. Assuming an upstream digest had to be
+preserved is what made this look impossible for a while
+([04-ISSUES/009](../04-ISSUES/009-a-digest-pinned-image-cannot-be-placed-in-the-lab/00-report.md)).
 
 **Its contents are per operating system** even though its mechanism is not — package names, unit
 names and service names all differ, so an Arch host embeds an Arch bundle.