diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 6267a3e..f4cb723 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,30 @@
+# Checkpoint — auto-naming hardened (2026-09-25 eve)
+
+## What changed since the label-step checkpoint
+- UI: pairing label step REMOVED (user friction: prefilled 'Amber' needed
+  letter-by-letter deletion). One click 'Sign in with a signer app (Amber)'
+  → QR. Seed label 'Amber'; real name comes from kind-0. (fc2fe93)
+- Backend: auto-name enrichment now retries 4x/20s apart with 75s budget
+  and per-attempt pairing_trace lines (bc736ff), after live proof that
+  nos.lol — the ONLY relay holding this account's kind-0 ('web5osint') —
+  intermittently 502s EVERY client (any UA; nostr-sdk and raw websockets
+  alike; worked 16:29, dead 16:40+). Single-shot fetch + flaky relay =
+  permanently generic label; retries fix that.
+
+## Verified
+- fetch_profile_metadata bisected per relay: only nos.lol has the kind-0;
+  all others return None (account metadata was only ever published there).
+- 216 unit + 5 e2e green; clippy 0; fmt clean; release rebuilt bc736ff.
+- frontend 125 tests green at fc2fe93.
+
+## Open
+- Profile will auto-rename to 'web5osint' on the next successful restore
+  once nos.lol recovers (retry loop logs 'auto-name: kind-0 fetched').
+- Consider publishing the account's kind-0 to primal/damus too so naming
+  doesn't depend on one relay (needs one Amber signature; user action).
+- Stray untracked files from another session left alone: COSMIC_THEME.md,
+  KeynectrAppIconPossibility02.jpeg, deferred/SignerConnectionPanel.tsx.wip/
+
 # Checkpoint — restore secret-echo fix LIVE-VERIFIED (2026-09-25 late PM)
 
 ## Where things are