diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 2145c39..c015e1f 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -6,10 +6,12 @@ verified green at the moment this file was written.
 ## Where things are
 
 - Project: `/home/avi/Projects/skills/nost-feed-manager`
-- Git repo: `master` @ `d677125` ("Show preview images and link cards in Compose"), on top of
+- Git repo: `master` @ `9ec01c9` ("Add AGENTS.md checkpoint workflow rule"), on top of
+  `a052851` (checkpoint refresh), `d677125` ("Show preview images and link cards in Compose"),
   `03f6877` (NIP-98 upload auth), `3e3467b` (compose preview + attachments), `17e8ace` (Profiles
   subtitle copy), and `8eb6685` (reveal-secret-key).
 - The working tree is **clean** — everything from this session is committed.
+- `AGENTS.md` now records the standing rule: every addition must end with an up-to-date checkpoint.
 - `/home/avi/Projects/nostr_backend/nostr_backendmanager.md` (old-CLI docs) has been updated
   to match reality; it lives outside this repo so it is not part of any commit.
 - `/home/avi/Projects/nostr_backend/vlog-website/` (separate, untouched).
@@ -33,6 +35,9 @@ will appear (profile avatar + npub, the text, and any images), without publishin
 
 ## Commits this session (newest first)
 
+- `9ec01c9` "Add AGENTS.md checkpoint workflow rule" — new `AGENTS.md` records that every addition
+  must end with an up-to-date checkpoint.
+- `a052851` "Refresh checkpoint with preview image/link fixes"
 - `d677125` "Show preview images and link cards in Compose" — two fixes from GUI testing:
   1. Remote images never rendered because the CSP was `img-src 'self' data:` — added `https:`
      (`frontend/index.html`). Attached images and pasted image URLs now appear in the preview.