Say plainly where the raised package registry runs, and why an action outside a container still runs

internal/apply/hold.go

@@ -234,7 +234,9 @@ func mountSource(mapping string) string {
 }
 
 // runsIn is the container a resource runs inside, if any: an action's `in`, or a run-once step
-// sharing a container's namespace.
+// sharing a container's namespace. An action with no `in` runs on the machine itself and is not
+// held for a container: it reaches nothing a predecessor holds by running there, and holding every
+// action of an untaken module would stop a module preparing itself before its cutover.
 func runsIn(r declaration.Resource) string {
 	switch res := r.(type) {
 	case *declaration.Action: