diff --git a/docs/TRAMPLER.md b/docs/TRAMPLER.md
index 8f9221d..f6b4e96 100644
--- a/docs/TRAMPLER.md
+++ b/docs/TRAMPLER.md
@@ -135,3 +135,12 @@ with ±90° firing wedges, rams, cargo numbered **C1–C8** in JSON order. Outpu
 - `reverse/{capture_hosts,ws_scrape,playfab_scrape,noise_filter,resolve_decomp}.py`.
 - Ghidra: `analyzeHeadless … -postScript decomp_targets.py|disasm_targets.py` (offset bug fixed:
   rva = il2cppdumper `Address` directly, **no −0x1000**).
+
+## Open questions
+- **Server-side upsert validation — UNTESTED.** We've only confirmed the *client* tolerates wiped/blank
+  hashes (loads, opens, edits, and regenerates all 5 on save). Whether the **master server** validates
+  the hashes (esp. the server-sourced `DefinitionsHash` / per-part `DefinitionHash`) when a blueprint is
+  `UpsertTrampler`'d — i.e. whether it recomputes, rejects, or stores blanks — is not yet known. It was
+  blocked this playtest by the master server throwing `System.NullReferenceException` and closing the
+  socket on `/connect` (no successful login). Re-test once `/connect` is healthy: upsert a walker with
+  Definition hashes blank, then `GetTrampler` it back and diff. See [MASTER_SERVER.md](MASTER_SERVER.md).