diff --git a/website/EVENTS_PLAN.md b/website/EVENTS_PLAN.md
index 4a077de..4deda0b 100644
--- a/website/EVENTS_PLAN.md
+++ b/website/EVENTS_PLAN.md
@@ -1971,12 +1971,51 @@ core, docs, then the kit's re-pin and `runicgateway.com`.
 > public calendar. It is meant to. The entry carries its own `status`, and the page renders a past
 > cancelled run as **"Did not happen"** — the honest label, not a silent omission.
 >
-> **The one leg still owed is the module's own install.** `Module-uo#34` cuts the module release, and
-> until that release exists there is no bundle for core's installer to fetch — the whole point of the
-> leg is that the module arrives over https from a Gitea release rather than being copied into
-> `MODULES_DIR` by hand. Everything above stands without it: the shard half is entirely released
-> artefacts, and core is released `main`. Run it as `POST /admin/modules/install` against the
-> published module tarball once step 3 lands, on the rig described here.
+> **The module's own install was walked too**, once step 3 cut `Module-uo` **v1.2.1**. The module
+> arrived the way an operator's would: `POST /admin/modules` naming the release's **manifest** (not
+> its tarball — core answers a tarball with *"the install manifest is larger than 262144 bytes"*,
+> which is the size guard doing its job), core fetched the artifact over https from the allowlisted
+> host, verified its `sha256`, and mounted it on the next boot with 12 event actions and 27 triggers.
+> Then `PUT /admin/uo-link/config` with the four values the installer printed answered
+> **`status: connected`, `pluginConnected: true`, `protocol: 7`** — released core, released module,
+> released sidecar, released overlay, all four talking.
+>
+> On that rig the two Phase 16a fixes were confirmed in the shipped artefacts rather than in a working
+> tree: the atlas **imported off a stock tree** (309 decor types, 6,455 points, 800 creatures, 558
+> landmarks, 387 regions, 25 champions — the import that used to die at 313), and a world verb ran and
+> **tore down for real** — three orcs spawned, ledger `reverted` ×3, `cleanup: complete`, and the shard
+> itself answering `world.owned → owned: [], pruned: 0`. That last check is the one 16a's no-op
+> teardown hid behind. The enablement gate and the cap behaved as specified on the way past: the dry
+> run refused the action before it was enabled, then priced it `uo.creatures 3 of 10`.
+>
+> **And the leg found two more defects, both in the released bundle and neither visible to any test**
+> (`Module-uo#35`).
+>
+> **The aggregator discarded the `UniqueId`, so no Phase 12b property lease was authorable at all.**
+> All 6,455 spawn points imported with `unique_id` NULL; `listSpawners` filters
+> `unique_id IS NOT NULL`, so `uo.options.spawners` — the only source those leases have — was an empty
+> dropdown with nothing to explain itself. Every part of the path was right except one line: the files
+> carry `<UniqueId>`, `parsePoints` returns it, the column exists, the insert passes it. `buildAtlas`
+> rebuilds each point from an explicit field list and the field was not on it. **`PARSER_VERSION = 4`'s
+> own note says a point keeps its `UniqueId` and names Phase 12b as the reason** — that bump exists to
+> re-read trees for this field, and the field was dropped one function later. The intent shipped as a
+> comment. Fixing it needs `PARSER_VERSION` 5 as well, because the tree's hashes have not changed —
+> only what is kept from them — so nothing would re-read an existing install.
+>
+> **A landmark option value named 23 places at once.** 558 landmarks, 320 distinct `facet/name`:
+> `Trammel/Entrance` is Blighted Grove, Covetous, Deceit, Despise, Destard and 18 more, and
+> `landmarkPoint` resolves with `.find()`. So 22 of the 23 were unreachable and an author who picked
+> "Entrance — Destard" got Blighted Grove, with a successful run and no warning. **The group was
+> already the disambiguator** — shown in the dropdown, left out of the value. Now `facet/group/name`,
+> distinct across all 558, with the two-part read kept as a fallback because a published version is
+> immutable and those stored values are the authored record. A three-part value whose group is gone
+> refuses rather than falling back: it asked for one place.
+>
+> Both are the same failure shape as 16a's blocking defect and worth naming as a class: **an option
+> source that answers empty, or answers with a value that does not identify one thing, disables a
+> feature silently.** Nothing errors, the form simply cannot express the thing — and a test that
+> checks the parser, or the query, or the column in isolation passes throughout. The atlas fixture had
+> no `<UniqueId>` in it at all until this phase, which is why a green suite said nothing for two.
 
 **Two documents that are cutover-window work by construction.**
 - **`runicgateway.com`** — `checkFacts` reads `main`, so any claim about events is unverifiable until