diff --git a/docs/plan/ldls.md b/docs/plan/ldls.md
index 70cd413..345fa49 100644
--- a/docs/plan/ldls.md
+++ b/docs/plan/ldls.md
@@ -345,6 +345,32 @@ The 22 are not failures of the loader; they are drivers that needed an
 allocation to come back non-null. The 29 without an entry point are mostly
 library modules that exist to be depended on.
 
+### And what it says about the work queue
+
+Counting *calls* is the wrong metric — one module walking an rbtree called
+`rb_first` sixty-four times and told us nothing. Counting **how many modules
+need a symbol** is the useful one, and over 110 modules it comes to this:
+
+| symbol | modules |
+|---|---|
+| `__kmem_cache_create_args` | 25 |
+| `crypto_register_template` | 11 |
+| `_printk` | 10 |
+| `crypto_register_alg` | 10 |
+| `__register_nls` | 9 |
+| `crypto_register_shash` | 4 |
+| `af_alg_register_type` | 4 |
+| `register_filesystem`, `misc_register`, … | 2 each |
+
+**Forty-four distinct symbols would carry every one of those 110 modules
+through `init_module`.** That is a small enough number to be a plan rather than
+an estimate, and it is not a number anybody could have guessed — the slab
+allocator at the top, and a long tail of registration calls that mostly want to
+record a pointer and return zero.
+
+It says nothing about `probe()`, which is where the real surface is and which
+the kernel, not the module, is supposed to call. Reaching that is L2.
+
 ---
 
 ## What it will not do