diff --git a/documentation/runbooks/target-selection.md b/documentation/runbooks/target-selection.md
index 45d7991..77147d1 100644
--- a/documentation/runbooks/target-selection.md
+++ b/documentation/runbooks/target-selection.md
@@ -84,7 +84,29 @@ produced a false "unreachable" verdict (standing rule 2).
 
 Create and destroy freely **on a Tier 0 host**. Two exceptions: **`drill-r50`** is a fixture, not
 scratch; and scratch **customers** outlive their VMs in the hub — delete those too, or they accumulate
-(`sess-c` and `sess-d` are both still there).
+(`sess-c` and `sess-d` were both left behind before anyone noticed).
+
+#### A fixture may prove a mechanism. Only a fresh box may prove a path.
+
+Rebuilding from scratch every time is waste; reusing a box is legitimate — but not for every claim.
+
+- **Reusable fixture** — a snapshot-reset VM on a Tier 0 host. Use it for **mechanism** work: payload
+  capture, fix cycles, anything whose claim is about *code behaviour*. Reset to `virgin` between runs.
+  Fast, repeatable, and the right default for iteration.
+- **Fresh day-0 from the ISO** — required for any claim about the **install path, the golden image,
+  agent publish/vouch, or first-boot state**. Slow, and the only thing that catches the drift family:
+  **R-111** (the golden's agent 17 releases behind), **R-115** (an agent built and deployed but never
+  published), **R-120** (the golden a controller release behind).
+
+**A fixture must record its provenance** — which golden, agent and controller it was built from, and
+when — alongside the VM. A fixture whose versions drift silently is R-120's mechanism turned into a
+permanent installation, and it is *worse* than no fixture, because it produces confident wrong results
+quickly.
+
+**Worked example.** R-116's closing run deliberately did a real day-0 from the v1.25.0 ISO on demo-hp
+instead of reusing the standing fixture. **That is how R-120 surfaced** — the fresh box installed the
+golden's controller, which is a release behind, and showed the customer the wrong absent-target message.
+The fixture would have shown a controller nobody installs.
 
 ## Not established — unknown, not guessed