diff --git a/03-DESIGN/01-to-be/47-milestones/G-20-lead-answers.md b/03-DESIGN/01-to-be/47-milestones/G-20-lead-answers.md
index 57af4354..9a409873 100644
--- a/03-DESIGN/01-to-be/47-milestones/G-20-lead-answers.md
+++ b/03-DESIGN/01-to-be/47-milestones/G-20-lead-answers.md
@@ -568,3 +568,6 @@ names the principle that settles it, and is cited as "design 47 G A-n".
   group member's build, with a `binds` file as go-package-registry's (`at`, `serves.port`), and read the blob by the
   store's own path `<at>:<port>/v2/<module>/<artifact>/blobs/<digest>`; they never write into it, so ADR 0614 §2
   holds, and their manifest tests assert the read.
+- **A-152** (§472, §492; principles 3 and 7) The toolchain's `digest` is the sha256 of the toolchain program the build
+  module runs (the `go` or `node` it finds), computed at its start and again when the toolchain's version changes; no
+  field is added to the provision.