diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 8387dfb..81923f2 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,4 +1,87 @@
-# Checkpoint — DRY modal save lifecycle / R3 complete (2026-08-25)
+# Checkpoint — nostr stack 0.45 security migration (2026-08-25)
+
+A stopping point you can return to if this session is closed. Everything below was
+verified green at the moment this file was written.
+
+## Where things are
+
+- Project: `/home/avi/Projects/Nostr_Keynctr`
+- Git repo: `master` @ `fa5ba08` ("Security: upgrade nostr stack 0.40->0.45
+  clearing 11 RustSec advisories"). Before it: `bf10ae3` (Checkpoint: clarify
+  NIP-42 status), `e210f17` (Checkpoint: DRY modal save lifecycle / R3),
+  `7098e75` (refactor: share modal save lifecycle), `e6a1efc` (R4),
+  `6d5063d` (R2), `1c428a9` (R1).
+- Working tree: only the long-standing user changes remain — `concept3.svg`
+  deleted, `KeynectrAppIconPossibility02.jpeg` untracked.
+
+## What was completed
+
+1. **Security migration of the Nostr stack (`fa5ba08`).** `cargo audit` was
+   installed on this machine (`cargo install cargo-audit`, v0.22.2) and its
+   first scan found **11 RustSec vulnerabilities** in nostr 0.40 /
+   relay-pool 0.40.1 — including forged-event signature-bypass (0224),
+   NIP-46 credential Debug leak (0225), and auth-challenge memory
+   exhaustion (0231). Upgraded to `nostr 0.45.3` + `nostr-sdk 0.45.2`
+   (secp256k1 0.30), clearing every vulnerability and all 4 warnings.
+   Code adaptations: `Client::builder().authenticator(SignerAuthenticator)`
+   replaces implicit signer (NIP-42 auto-auth stays working); signing moved
+   from `EventBuilder::sign` to `finalize_async`; nip44 encrypt now takes an
+   explicit random nonce (getrandom); feed + signer receive loops moved to
+   `stream_events` (signer's notification stream still opens BEFORE the
+   announce, preserving the ordering fix); contact p-tags parsed via
+   `single_letter_tag()`; `relay()` returns Option; `try_connect().timeout()`.
+   Dropped unused `nip46` feature (signer is hand-rolled). Dry-run first:
+   bump-only build proved zero dependency-crate failures / no MSRV issues;
+   all 24 errors were exactly the planned API edits.
+2. **New regression tests (+2, suite now 115).** Malformed NIP-44 payloads
+   (not-base64, empty, truncated, bad version byte) reject cleanly with no
+   panic; error strings never contain secret-key material (0225 class).
+3. Earlier today: R3 modal-save dedup (`7098e75`) completing the DRY audit,
+   NIP-42 clarification docs (`bf10ae3`).
+
+## Commits added most recently
+
+- `fa5ba08` Security: upgrade nostr stack 0.40->0.45 clearing 11 RustSec advisories
+
+## Verification commands run (all green)
+
+Rust (repo root): cargo fmt --check clean; cargo clippy --all-targets only
+the two pre-existing profiles.rs warnings; cargo test 115 passed (release
+mode re-run too); cargo build --release success.
+Frontend (`frontend/`, untouched): typecheck clean; format:check clean;
+npm test 15 files / 99 tests; vite build success; electron:build success.
+Live: probe built on 0.45 stack published kind-1 notes accepted by
+wss://soloco.nl and wss://relay.primal.net within the 6 s watchdog.
+Pre-commit audit per user protocol: staged diff = Cargo.toml/Cargo.lock/src
+only; git diff --check clean.
+
+## How to use / reproduce
+
+No user-facing change. Rebuild + restart to pick up the new backend:
+
+```bash
+cd ~/Projects/Nostr_Keynctr && cargo build --release
+cd frontend && npm run build && npm start
+```
+
+Re-check Updates card: Rust advisory section should now list no
+vulnerabilities (cargo-audit is installed machine-wide).
+
+## Notes & next steps
+
+- wss://nostr.l484.com had a DNS-resolution blip at the very end of the
+  session (gaierror for ~a minute); it worked earlier today including a
+  stored test event. If it stays down, check the relay host — not app code.
+- Probe harnesses live in /tmp/opencode (nip42-probe on 0.45; python raw
+  readers). Copy into scripts/ if they should survive reboots.
+- Pre-existing clippy warnings in src/profiles.rs remain untouched by request.
+- Relay health today: nos.lol 502 intermittent, nostr.wine 403,
+  l484.com transient DNS failure at session end, nostr.band unreachable;
+  primal/mom/soloco healthy.
+
+---
+
+# Older checkpoint — DRY modal save lifecycle / R3 complete (2026-08-25)
 
 A stopping point you can return to if this session is closed. Everything below was
 verified green at the moment this file was written.