diff --git a/03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md b/03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md
index bd0e147..84efcd5 100644
--- a/03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md
+++ b/03-DESIGN/01-to-be/27-a-module-requires-the-mesh-resolves.md
@@ -365,3 +365,29 @@ Each phase ends at a check that holds, so none of them leaves a mechanism half-r
 - The layout a node's default root uses beneath it, beyond one directory per assignment.
 - Whether a module provider's answer can change without the provider being asked, for example a
   provider moving. The rule so far is that it cannot, and moving is re-resolving.
+
+## The three gaps, answered (2026-09-26, operator)
+
+**Where the root comes from.** A node setting, fixed at installation; a node that states none
+gets the default under `/var/lib`. (The adopted-machine placement stays as proposed: a
+per-assignment placement for data that must sit where it already is — mssql is novox's live
+case.)
+
+**What sits beneath it — dissolved, not decided.** The question assumed the mesh's own
+writes (`/var/lib/mesh/<module>`: sealed credentials, composed bindings) need a
+module-visible reservation. They do not: a module *requires* a `host-path` and receives a
+location; what the mesh writes for the module is the mesh's plumbing, placed where the mesh
+chooses and mounted in — never part of the module's contract. One reservation per
+requirement, `<root>/<module>/<name>`.
+
+**Resolution happens in the controller, at declaration composition.** The node receives
+concrete paths exactly as today — the wire format and the host's apply do not change for
+this. What changes is that no *manifest* carries a path; the controller resolves
+requirement → location against the node's root setting. (The host still needs issue 126's
+fix — volumes in the spec comparison — or a resolved path change cannot reach a running
+container.)
+
+**Retirement order** stays per-module data migration with verification, smallest and
+empties first, the mail spool and the store last — the novox session's six-module window
+(mesh-catalog #97, hq 126) is the worked example, hazard included.
+