diff --git a/03-DESIGN/01-to-be/00-work-breakdown.md b/03-DESIGN/01-to-be/00-work-breakdown.md
index a8e5e88..6db2583 100644
--- a/03-DESIGN/01-to-be/00-work-breakdown.md
+++ b/03-DESIGN/01-to-be/00-work-breakdown.md
@@ -303,6 +303,31 @@ running server produced.
 
 The forge (3.2) and the mail system (3.3) need no provisioner and are not blocked on this.
 
+### And they could not have run anyway — *2026-09-01*
+
+Every one of the five named a container image that does not exist: sixty-four zeros where a digest
+belongs, eighteen times over
+([`025`](../../04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md)).
+They parsed, resolved and composed into a declaration a host accepts, and every one would have
+stopped on the machine at the moment of fetching.
+
+Nothing caught it because nothing could. A host checks the *shape* of a reference and no more —
+verifying a digest exists means reaching a registry, which is the one thing a host must never have
+to do. The refusal now sits where a declaration is composed instead, which is the last moment
+before a machine sees one.
+
+Twelve are pinned to real images. Two further faults surfaced only by pinning for real: the mail
+system's seven images named repositories that **do not exist**, because it publishes to a
+different registry than assumed, and one of the seven had been renamed upstream.
+
+**The forge now runs**, on a database another module provides, with a password it did not choose
+and a connection string it could not have written. That is the first of these descriptions to be
+started rather than planned, and it exercises everything the credential work added.
+
+What is still missing is the mechanism: nothing turns a tag into a digest as part of the mesh's
+own work, so it was done by hand. Asking a registry takes about a second and pulls nothing, which
+removes the main argument for leaving it undone.
+
 ## The conversion is done by hand, and that is a decision
 
 *2026-08-31.* **Moving from the current system to this one is a person at a command line, working