diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 72a0cdd..5c53946 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,53 @@
+# Checkpoint — placeholder kind-0 fix + grant editing UI (2026-10-01)
+
+## Where things are
+- Project: `/home/avi/Projects/Keynctr`, branch `master` @ **`83f5940`**
+  ("fix(profiles): never treat placeholder kind-0 as a real display name").
+- Working tree: clean for tracked files (always-untracked: COSMIC_THEME.md,
+  icon jpeg, deferred/).
+- **Unpushed: `e8d2abb` + `83f5940`** on top of remote HEAD `8070dfc`.
+
+## What was completed (user-facing)
+1. **Grant kind-editing UI** (`e8d2abb`): the Signer screen's "Always-allow
+   permissions" card now edits each grant's event-kind scope inline
+   (Edit → comma-separated kinds → Save/Revert). Backed by the
+   `signer_grant_update` RPC from `d7cf2a5`.
+2. **Profile-name fix** (`83f5940`): placeholder "My Profile" names no longer
+   stick. Verified live: npub1p437…'s kind-0 on purplepag.es/damus says
+   "My Profile" (ts 1789050653) — an early build auto-published the
+   empty-label default as new accounts' kind-0, and pairing enrichment +
+   backfill then copied that poisoned value over typed names forever. Now:
+   - shared `profiles::network_display_name()` rejects blank AND placeholder
+     names fetched FROM the network (unit-tested);
+   - create/import never auto-publish a generic placeholder as kind-0;
+   - import falls back to the shortened npub instead of "My Profile".
+
+## Commits this session (newest first)
+- `83f5940` fix(profiles): never treat placeholder kind-0 as a real display name
+- `e8d2abb` feat(signer): inline kind-scope editing for always-allow grants
+(checkpoint commits interleaved; earlier session: `d7cf2a5`, `ec8b515`, `aef47dd`)
+
+## Verification (all green, 2026-10-01)
+- `cargo test` → 227 unit + 6 e2e, 0 failed · `cargo clippy --all-targets` → 0 warnings
+- `cargo fmt --check` clean · `cargo build --release` rebuilt 10:48
+- frontend: `npm test` 142 passed; `typecheck`, `lint`, `format:check`,
+  `build`, `electron:build` green. (Full-suite failures seen earlier today
+  were load-induced 5s timeouts on a busy box — passed on quiet reruns.)
+
+## How to verify in the app
+1. Fully quit and relaunch Keynctr (new backend, 10:48).
+2. For npub1p437…: Profiles → rename → Publish name (pushes a clean kind-0
+   network-wide). The backfill will no longer overwrite it with "My Profile".
+3. Signer screen → Always-allow permissions → Edit a grant's kinds → Save.
+
+## Next steps
+- **PUSH BLOCKED**: token supplied 2026-10-01 rejected by Forgejo API
+  ("access token does not exist") — expired/wrong kind. Need a fresh token
+  with write scope to push `master`.
+- Optional: remove /tmp/kn-base worktree when done.
+
+---
+
 # Checkpoint — grant kind-editing backend (2026-09-30, session stopped mid-Step-4)
 
 ## Where things are