diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 2271d5c..d5dd9fd 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,64 @@
+# Checkpoint — stdin EAGAIN fix, accent theme, identity backfill (2026-09-28 evening)
+
+## Where things are
+- Project: `/home/avi/Projects/Keynctr`, branch `master` @ **`5b60ae3`**
+  ("feat(profiles): persistent identity backfill for generic pairing labels").
+  Previous: `a6182e3` (iOS blue accent for Workshop Dark + custom accent
+  setting), `9770f46` (stdin blocking-thread reader — EAGAIN crash fix),
+  `6bff188` (docs), `dcc701f` (no-restart self-update).
+- Working tree: clean for tracked files. Untracked intentionally NOT
+  committed: `COSMIC_THEME.md`, `KeynectrAppIconPossibility02.jpeg`,
+  `deferred/SignerConnectionPanel.tsx.wip/`.
+- Release binary rebuilt 2026-09-28 12:02 (from the 5b60ae3 tree).
+- origin/master is at `a6182e3`; local is 1 commit ahead — push still blocked
+  (no Forgejo token stored for this session; HTTPS asks for credentials).
+
+## Pairing problem status — RESOLVED (live evidence)
+- `~/.local/share/keynectr/profiles_vault.json` now carries **3 persisted
+  `nip46_connections`** rows with matching `signer_mode: nip46_client` profile
+  rows (created Sep 25, Sep 27, and **Sep 28 10:23**). The Sep 28 pairing
+  happened on the current build: Amber's connect event parses, the handshake
+  completes, and the profile row persists — the original
+  "Amber says connected but no row appears" failure no longer reproduces.
+- The Sep 28 row is the **active profile**. Its label is still the generic
+  "Amber" because the paired account has not published kind-0 yet; `5b60ae3`
+  backfill re-checks every ~2-5 min while the backend runs and will rename it
+  when metadata appears. No further parse-side work outstanding.
+
+## What was completed (this checkpoint's commits)
+1. **`9770f46` stdin EAGAIN crash fix** — `keynectr serve` treated a transient
+   EAGAIN on the Electron pipe as fatal ("Rust backend exited unexpectedly
+   code 1"). Dedicated blocking-thread reader + mpsc; verified live with a
+   200-line request stream.
+2. **`a6182e3` custom accent color** — iOS blue accent for Workshop Dark plus
+   a user-settable accent color.
+3. **`5b60ae3` persistent identity backfill** — slow-cadence loop in `serve()`
+   re-fetches kind-0 for Nip46Client rows still wearing generic
+   "Amber"/"Remote Signer" placeholders; user renames never overwritten;
+   locked vaults skipped; network off-lock, 90 s budget per identity.
+
+## Verification (2026-09-28 evening cron pass)
+- `cargo test` → 221 unit + 6 e2e passed, 0 failed.
+- `cargo clippy --all-targets` → 0 warnings. `cargo fmt --check` → clean.
+- `frontend`: `npm test` → 139 passed (19 files); `typecheck`, `lint`,
+  `format:check` all clean.
+
+## How to resume
+- GUI: `cd ~/Projects/Keynctr/frontend && npx vite --port 5173` then
+  `NOSTR_GUI_DEV_URL=http://localhost:5173 KEYNCTR_ENABLE_GPU=1 npx electron .`
+- CLI backend: `target/release/keynectr serve` (spawned by Electron).
+- Push pending commit when credentials are available: `git push origin master`.
+
+## Outstanding / next steps
+- Live confirmation of the backfill rename: pair/keep a fresh Amber account
+  with no kind-0, publish kind-0 from Amber, confirm the Keynctr row renames
+  itself within ~5 min without restarting the app.
+- Step 4 permissions UI follow-ups, Step 5 KDF, Step 7 rename/hygiene
+  (unchanged from previous checkpoint).
+- `package.json` `homepage` still points at github.com/avi/Keynctr (Step 7).
+
+---
+
 # Checkpoint — permissions UI + updater fix + Workshop theme (2026-09-27 night)
 
 ## Where things are