diff --git a/03-DESIGN/01-to-be/00-work-breakdown.md b/03-DESIGN/01-to-be/00-work-breakdown.md
index 6d77bd1..b2b2ba0 100644
--- a/03-DESIGN/01-to-be/00-work-breakdown.md
+++ b/03-DESIGN/01-to-be/00-work-breakdown.md
@@ -151,10 +151,14 @@ and proven — a credential moving at both ends with the old one ceasing to work
 the sort of thing to do deliberately on a quiet afternoon rather than as a side effect of moving a
 service between systems.
 
-**So there is a step before any of this: read the current environment out of the old system while
-it can still be read.** Once a value is accepted, the mesh cannot show it back — *a mesh that can
-reveal a secret is a mesh that holds it* — and once the old system is gone, neither can that. A
-password nobody wrote down is a service nobody can adopt.
+**So there is a step before any of this: read the current environment out of the old system**, because
+adoption means supplying those values and they live in its files today.
+
+*Corrected 2026-08-31 — an earlier version of this paragraph made that sound more dangerous than it
+is.* A sealed secret is not unreadable; it is sealed **to the node**, which holds the private half
+and writes the plaintext into the module's own file. The value is there, on the machine, as an
+ordinary file. What does not exist is a way to ask *the mesh* what a secret is, and there is no
+reveal command, because a mesh that can reveal a secret is a mesh that holds one.
 
 ## Where it starts, and what that costs