A manifest digest is assigned by a registry on push, so insisting on one meant a registry had to exist before the thing that lets a mesh have a registry could start — a dependency the pinning rule created by accident, not a pin. The mesh's own control plane is built from source and lives in no public registry. A bare sha256:... names an image the machine already holds, by the digest of its own configuration: immutable and unforgeable in exactly the way the rule asks for. Absent, it says so plainly rather than failing at a pull nothing serves. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF