diff --git a/internal/apply/hold.go b/internal/apply/hold.go
index 935ec69..3776c41 100644
--- a/internal/apply/hold.go
+++ b/internal/apply/hold.go
@@ -234,7 +234,9 @@ func mountSource(mapping string) string {
 }
 
 // runsIn is the container a resource runs inside, if any: an action's `in`, or a run-once step
-// sharing a container's namespace.
+// sharing a container's namespace. An action with no `in` runs on the machine itself and is not
+// held for a container: it reaches nothing a predecessor holds by running there, and holding every
+// action of an untaken module would stop a module preparing itself before its cutover.
 func runsIn(r declaration.Resource) string {
 	switch res := r.(type) {
 	case *declaration.Action:
diff --git a/internal/bootstrap/phase_packages.go b/internal/bootstrap/phase_packages.go
index cd82e6e..bb8414b 100644
--- a/internal/bootstrap/phase_packages.go
+++ b/internal/bootstrap/phase_packages.go
@@ -148,9 +148,9 @@ func seedGiteaDatabase(ctx context.Context, run Runner, timeout time.Duration, p
 	return nil
 }
 
-// raiseGiteaServer starts the gitea server container against the foundation store. It joins the
-// store's network namespace so `127.0.0.1:5432` reaches postgres, and publishes its own port on the
-// machine so the builder and this installer can reach it. Started if absent, left alone if present.
+// raiseGiteaServer starts the gitea server container against the foundation store. It runs on the
+// machine's own network, so `127.0.0.1` reaches the store where it publishes its port, and it binds
+// its own port there for the builder and this installer. Started if absent, left alone if present.
 func raiseGiteaServer(ctx context.Context, run Runner, timeout time.Duration, dbPassword string,
 	ports FoundationPorts, say func(string)) error {
 	asking, cancel := context.WithTimeout(ctx, timeout)