diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 676c534..c423f51 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,54 @@
+# Checkpoint — remote-profile rename; live pairing aftermath (2026-09-23 PM)
+
+## Where things are
+- Project: `/home/avi/Projects/Keynctr`
+- Branch: `master` @ **`6ebc364`** ("fix(profiles): label-only rename for
+  secretless remote-signer profiles"). Previous: `ca62111` (live-pairing
+  checkpoint), `a8d112b` (state polling).
+- Working tree: clean for tracked files. Untracked intentionally NOT
+  committed: `COSMIC_THEME.md`, `KeynectrAppIconPossibility02.jpeg`,
+  `deferred/` (stays deferred).
+- Release binary: **rebuilt at `6ebc364`** (Rust changed). Renderer rebuilt
+  via `npm run build`. Restart Electron before retesting.
+
+## What was completed this session
+1. **Explained the generic "Remote Signer" label**: the paired identity
+   (`npub1f3tura…`) has NO kind-0 metadata on damus/primal/nos.lol (direct
+   REQ check — all EOSE), so the background enrichment correctly found
+   nothing to upgrade the pairing label with.
+2. **Label-only rename for remote profiles (`6ebc364`)**: `rename_profile`
+   used to resolve the local secret first, so renaming a paired profile
+   errored. Secretless `Nip46Client` rows now rename vault-side with an
+   empty publish report (kind-0 signing still awaits the P2 external-signer
+   reroute). Rename modal reports "saved on this device" for the empty
+   report instead of a misleading "published to 0 relays". New regression
+   test `rename_profile_updates_label_for_secretless_remote_profiles`.
+- Verification (all green at `6ebc364`): `cargo test` **212 unit + 4 e2e
+  passed / 0 failed**, `cargo clippy --all-targets` 0 warnings,
+  `cargo fmt --check` clean, `cargo build --release` green; frontend
+  `npm test` **119 passed**, `typecheck`, `lint`, `format:check`,
+  `electron:build`, `build` clean.
+
+## Commits added (newest first)
+- `6ebc364` fix(profiles): label-only rename for secretless remote-signer
+  profiles
+
+## How to resume / reproduce
+- Restart Electron, Profiles → rename `Remote Signer` to any display name
+  (e.g. your Nostr name) — saves instantly, no error.
+- To show your real Nostr name everywhere instead: publish a kind-0 profile
+  (name/picture) from Amber or another client; a future enrichment pass can
+  pick it up (no re-fetch path yet).
+
+## Outstanding / next steps
+1. **Live sign/publish through paired Amber** (never exercised live).
+2. Prune the 11 stale profileless `nip46_connections` rows (cosmetic).
+3. Remote picture/nip05 edits (same local-key limitation as rename had),
+   `publish_profile_metadata` kind-0 via `Signing` (P2), KDF upgrade
+   (Step 5), rename pass (Step 7) — unchanged.
+
+---
+
 # Checkpoint — FIRST LIVE END-TO-END AMBER PAIRING SUCCEEDED (2026-09-23 PM)
 
 ## Where things are