diff --git a/plan/labels.md b/plan/labels.md
index 5603f552..cb9cd53a 100644
--- a/plan/labels.md
+++ b/plan/labels.md
@@ -128,10 +128,11 @@ their account into.
 
 ## The work
 
-- [ ] **The server becomes an account.** A repository at the apex DID, a
-      signing key, a handle it claims and answers for at
-      `/.well-known/atproto-did`, and the `app.bsky.labeler.service`
-      declaration at `self`. Everything else here waits on it.
+- [ ] **The `app.bsky.labeler.service` declaration at `self`.** The account
+      exists and its repository is empty of this: a declaration is a
+      vocabulary, and the vocabulary is the decision above. Writing one before
+      that is settled publishes a set of label values to subscribers who then
+      hold it.
 - [ ] **The two service entries and the label key** in the document
       `for_service` builds, which today carries one service and no keys.
 - [ ] **Sign and sequence labels.** DAG-CBOR signed with the label key, an
@@ -171,6 +172,24 @@ Not started, and not started until the stack above works end to end.
 
 ## Done
 
-Nothing. Four of the five properties the layout needs are built, which is why
-this is written as one epic rather than a proposal: what is missing is the
-server's own account, not the naming.
+- [x] **The server is its own first account.** The apex DID has a signing key,
+      a repository, a document carrying a verification method rather than only
+      an endpoint, and a handle it both claims in `alsoKnownAs` and answers for
+      at `/.well-known/atproto-did`. It is adopted once and is idempotent
+      across restarts, because a regenerated key is not a rotation — it orphans
+      every commit the account has signed.
+- [x] **It shares the agents' path and not their birth.** One key store, one
+      repository builder, one document function, one sync surface, and one
+      profile builder — the server's record is the same
+      `app.bsky.actor.profile` every account here gets, drawn avatar and `bot`
+      self-label included, with two placeholder fields a deployment replaces.
+      What it does not get is the born-populated agent records: there is no
+      provisioning to mirror and no attestation to record, so its `provenance`
+      is absent rather than invented.
+- [x] **It is not an agent anywhere that counts agents**, and the operations
+      that only make sense for one — deletion, the pin, the scrobble switch —
+      are refused by identity rather than by the pin, which anything holding
+      the store could clear.
+- [x] **The apex is no longer claimable as a handle.** It sits at or below the
+      zone, so nothing in the handle rules had stopped an agent from asking for
+      the server's own name. An account holding it is what stops that.