[nedtwigg]

Hosted's account page listed every computer as "Computer abcd1234". The remote enrollment poll now carries the computer's name, by default its hostname (the existing BurrowNameField prefill). Hosted stores it and shows it on the computer row and in the passkey "from …" line. A computer enrolled before this keeps showing its short id.

• One reduction: the Burrow and Hosted share reduceBurrowLabel (remote-lib-common), which strips control, format and separator characters and caps the name at 64 code points. The CHECK on migration 012's column refuses anything that reduction would strip, and an older Burrow that sends no name still enrolls.
• Scope: the self-host Relay still learns no name, and no Pocket route returns Hosted's. relay.md and remote-security-model.md → "Residual metadata" name this one exception.
• Privacy: the page now lists the name among what Hosted stores. The policy date moves to 2026-10-28, which matches TERMS_VERSION.
• No rename: the desktop has no rename, since the name changes only by enrolling again, so it is sent only at enrollment.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	732001e
Status:	✅  Deploy successful!
Preview URL:	https://fabcb2f3.mouseterm.pages.dev
Branch Preview URL:	https://hosted-computer-names.mouseterm.pages.dev

View logs

[dormouse-bot]

The nightly audit prompt still says the opposite of what this PR ships. .github/audit/remote.md, under Is the relay actually opaque?, tells the auditor: "The Relay must be unable to read a pairing decision, a Burrow label, a remote-api message, …". After this change, Hosted's Relay receives the label in plaintext on POST /api/burrow/enroll/poll and stores it in dormouse_relay_burrows.label. An auditor following that line will report a finding, and per docs/specs/security.md a failed audit holds the release. The specs were updated (remote-security-model.md → "Residual metadata", relay.md), but the prompt was not. The bullet could scope the label clause to the encrypted channel, for example "a Burrow label (other than the one Hosted's remote enrollment poll carries for its account page)". That way the auditor still checks every other path.

[nedtwigg]

Fixed in 732001e: .github/audit/remote.md → "Is the relay actually opaque?" now excepts the label Hosted's remote enrollment poll carries, pointing at remote-security-model.md → "Residual metadata". I swept the other audit prompts and security specs; none claimed the Relay keeps no label.

[dormouse-bot]

Thanks, the scoped bullet in 732001e resolves my review finding. The auditor still checks every other path a label could take, and Hosted's enrollment poll is the one exception it now allows.