The five modules could not have run, and now the forge does

Recorded against phase 3, because the phase note said running them
needed images stocked and provisioners built — and missed that not one
of them named an image that exists. Sixty-four zeros where a digest
belongs, eighteen times, parsing and resolving perfectly.

The forge now runs: on a database another module provides, with a
password it did not choose and a connection string it could not have
written itself. First of these descriptions to be started rather than
planned, and it exercises the whole of the credential work.

What remains is the mechanism rather than the data. Nothing turns a tag
into a digest as part of the mesh's own work, so it was done by hand —
which is what the issue says a person should not be asked to do. Asking
a registry takes a second and pulls nothing, so the main argument for
leaving it undone is gone.

03-DESIGN/01-to-be/00-work-breakdown.md

@@ -303,6 +303,31 @@ running server produced.
 
 The forge (3.2) and the mail system (3.3) need no provisioner and are not blocked on this.
 
+### And they could not have run anyway — *2026-09-01*
+
+Every one of the five named a container image that does not exist: sixty-four zeros where a digest
+belongs, eighteen times over
+([`025`](../../04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md)).
+They parsed, resolved and composed into a declaration a host accepts, and every one would have
+stopped on the machine at the moment of fetching.
+
+Nothing caught it because nothing could. A host checks the *shape* of a reference and no more —
+verifying a digest exists means reaching a registry, which is the one thing a host must never have
+to do. The refusal now sits where a declaration is composed instead, which is the last moment
+before a machine sees one.
+
+Twelve are pinned to real images. Two further faults surfaced only by pinning for real: the mail
+system's seven images named repositories that **do not exist**, because it publishes to a
+different registry than assumed, and one of the seven had been renamed upstream.
+
+**The forge now runs**, on a database another module provides, with a password it did not choose
+and a connection string it could not have written. That is the first of these descriptions to be
+started rather than planned, and it exercises everything the credential work added.
+
+What is still missing is the mechanism: nothing turns a tag into a digest as part of the mesh's
+own work, so it was done by hand. Asking a registry takes about a second and pulls nothing, which
+removes the main argument for leaving it undone.
+
 ## The conversion is done by hand, and that is a decision
 
 *2026-08-31.* **Moving from the current system to this one is a person at a command line, working