Say plainly where the raised package registry runs, and why an action outside a container still runs

internal/apply/hold.go

@@ -234,7 +234,9 @@ func mountSource(mapping string) string {
 }
 
 // runsIn is the container a resource runs inside, if any: an action's `in`, or a run-once step
-// sharing a container's namespace.
+// sharing a container's namespace. An action with no `in` runs on the machine itself and is not
+// held for a container: it reaches nothing a predecessor holds by running there, and holding every
+// action of an untaken module would stop a module preparing itself before its cutover.
 func runsIn(r declaration.Resource) string {
 	switch res := r.(type) {
 	case *declaration.Action:

internal/bootstrap/phase_packages.go

@@ -148,9 +148,9 @@ func seedGiteaDatabase(ctx context.Context, run Runner, timeout time.Duration, p
 	return nil
 }
 
-// raiseGiteaServer starts the gitea server container against the foundation store. It joins the
-// store's network namespace so `127.0.0.1:5432` reaches postgres, and publishes its own port on the
-// machine so the builder and this installer can reach it. Started if absent, left alone if present.
+// raiseGiteaServer starts the gitea server container against the foundation store. It runs on the
+// machine's own network, so `127.0.0.1` reaches the store where it publishes its port, and it binds
+// its own port there for the builder and this installer. Started if absent, left alone if present.
 func raiseGiteaServer(ctx context.Context, run Runner, timeout time.Duration, dbPassword string,
 	ports FoundationPorts, say func(string)) error {
 	asking, cancel := context.WithTimeout(ctx, timeout)