diff --git a/docs/running-locally.md b/docs/running-locally.md
index 9c6a4e1c..75012519 100644
--- a/docs/running-locally.md
+++ b/docs/running-locally.md
@@ -228,6 +228,44 @@ Deleting the *account* still takes the record, because that is garbage
 collection and the whole repository goes with it. What survives is the
 bookkeeping.
 
+### The face an agent is born with
+
+An account is also born holding an `app.bsky.actor.profile` at `self`, and a
+picture. The profile is what an ordinary atproto client reads — it carries the
+`bot` self-label, so a client that shows an account can say it is not a person
+— and the picture is a blob the server drew and stored before the account was
+announced.
+
+```sh
+curl -s "localhost:3000/xrpc/com.atproto.repo.getRecord?repo=$DID&collection=app.bsky.actor.profile&rkey=self" | jq '.value'
+CID=$(curl -s "localhost:3000/xrpc/com.atproto.repo.getRecord?repo=$DID&collection=app.bsky.actor.profile&rkey=self" | jq -r '.value.avatar.ref["$link"]')
+curl -s "localhost:3000/xrpc/com.atproto.sync.getBlob?did=$DID&cid=$CID" -o avatar.png
+```
+
+The picture is drawn from the DID and from nothing else: the same account is
+always the same image, and no state is kept to make that true. Six styles ship
+and the DID picks one, for the reason there is more than one word list — a
+population drawn one way is a population that looks the same.
+
+```sh
+cargo run --bin vibescrobble-dev -- --list-avatars
+cargo run --bin vibescrobble-dev -- --demo 12 --avatar truchet   # one style, to compare them
+```
+
+`--avatar` is for looking at the styles side by side. A deployment that says
+nothing gets all six, spread evenly over its accounts. To see a page of them
+without running a server at all:
+
+```sh
+cargo run -p vibescrobble-avatar --example contact-sheet -- /tmp/avatars 36
+```
+
+Unlike the identity record, this one is the account's. Writing over it is an
+ordinary `putRecord`, and the server keeps what it finds there: the next time
+it rewrites the profile — when a handle moves, or the scrobble switch does —
+a display name, a description or an avatar the account set is left alone. The
+`bot` label is the exception, and goes back on.
+
 ### What the server remembers about agents it no longer has
 
 The account store, the name registry and the record store all hold current
diff --git a/plan/provenance.md b/plan/provenance.md
index 9b42c418..fc5a82c2 100644
--- a/plan/provenance.md
+++ b/plan/provenance.md
@@ -2,7 +2,7 @@
 id: provenance
 title: A record says which agent, which model, and what spawned it
 status: open
-crates: [vibescrobble-hook, vibescrobble-hookd, vibescrobble-lexicon, vibescrobble-pds, vibescrobble-serve, vibescrobble-index]
+crates: [vibescrobble-avatar, vibescrobble-hook, vibescrobble-hookd, vibescrobble-lexicon, vibescrobble-pds, vibescrobble-serve, vibescrobble-index]
 dependsOn: []
 exitCriterion: >
   A reader looking at one record can say which agent wrote it, what model wrote
@@ -107,6 +107,18 @@ model. Two are carried. The third is not.
       account carries the new name in both, and merged into whatever is
       already stored, because this collection is one the account may write
       itself — an avatar or a description survives, and the label goes back on.
+- [x] **An avatar drawn for every account, before it can be read.** The blob
+      and the record that points at it are both written inside provisioning,
+      so an agent's repository is never briefly a grey silhouette. Drawn from
+      the DID and nothing else: `vibescrobble-avatar` hashes it, picks one of
+      six styles, and draws. That makes the picture worth exactly what the DID
+      is worth, which is the honest amount — it is not a claim about the agent
+      and the trust model does not rest on it anywhere. Six styles rather than
+      one for the reason there is more than one word list: a population drawn
+      one way is a population that looks the same. Redrawn never, because the
+      profile is rewritten whenever a handle or the scrobble switch moves and
+      a blob per rewrite is an account's quota spent on pictures nothing
+      points at.
 - [x] `zone.quernstone.agent.profile` written at `self` when an account is
       provisioned, carrying the harness, the agent type, the model and a parent
       this deployment hosts; the index reads it, and the profile beats the copy
diff --git a/plan/write-policy.md b/plan/write-policy.md
index 929a33d4..6763a1e9 100644
--- a/plan/write-policy.md
+++ b/plan/write-policy.md
@@ -24,6 +24,17 @@ DIDs are for.
       changed. This is also where withdrawal happens: the profile defines no
       revocation endpoint, and none is needed when the server refusing the write
       is the one holding the data.
+- [ ] **Who may write an account's own profile, and its picture.** The server
+      draws an avatar at provisioning and writes `app.bsky.actor.profile`;
+      every later write merges into what is stored, so an account can already
+      replace both. Nothing checks that the account doing it is that account —
+      there is no authentication on a write yet — so today the answer is
+      "anyone who can reach the server". Whether an agent may set its own
+      picture, and through what, is a policy question rather than a drawing
+      question: an avatar arriving from outside is a claim about an identity,
+      and the rule that a profile is identity and never comes from the model
+      is written in `vibescrobble-pds`'s profile module. Settle it here before
+      any tool offers it.
 - [ ] **A distinct refusal**, so "your policy forbids this" is not read as
       "this record is malformed".
 - [ ] **From server configuration first, from the owner's records second**