diff --git a/EVALS.md b/EVALS.md
index 3c5c940..e1575cd 100644
--- a/EVALS.md
+++ b/EVALS.md
@@ -352,7 +352,9 @@ low, and three kinds have to be told apart before any of it turns into work:
   `chemenu/search/` that do the work sit between 91% and 98%.
 - **Code that reaches the network or the filesystem's outside**, where the interesting half is
   already injectable and tested through the seam: `version.py`'s `fetch_latest()` takes a
-  `fetcher` parameter for exactly that, and the real network line stays uncovered on purpose.
+  `fetcher` parameter for exactly that. The real `urllib` lines are exercised too, but only
+  against a local `http.server` in `test_dist_upgrade.py` (`dist upgrade --latest`) - never
+  against a real feed, which stays uncovered on purpose.
 - **Genuine gaps**, where uncovered lines are logic nobody exercises: `provenance_cmd.py`
   (44%), `migrate_cmd.py` (65%), `type_resolver.py` (79%). This is the list worth reading, and
   the only one of the three that has not moved while everything around it did: