The Name That Could Not Escape

A parent renames a screen. A kid renames a screen. The Firewalla app, AirPlay, and DHCP all happily show the new label. If curfew keyed on that label, bedtime would be a settings menu away. On 2026-07-23 we proved the opposite on the live haus, and closed the last soft edge where a rename could still feel like it had broken enforcement.

What happened

The living-room Apple TV (HomeKit hub, mode: services) was renamed to Den Room on the Gold Pro. Force Flow still held the curfew: same MAC, holiday schedule 23:00, streaming DNS blocks still active (Netflix, YouTube, Disney+, Apple TV+, …). The only thing that lagged was the label on surfaces that cached the old Firewalla name until the box redis rediscovered it.

What we changed

In sanctum-screen-time the engine now:

1. Treats MAC as identity for every enforce path (already true) and makes that explicit on rename.
2. Records aliases (device_aliases table + optional also_known_as in config) so columbo-style hostname matching still finds the device after a rename.
3. Soft-updates the in-memory display name so Holocron stays truthful without rewriting the gitignored haus devices.yaml mid-tick.

Unit coverage lives in tests/test_rename_identity.py. The doctrine page is Device Identity — section Display-name renames cannot drop curfew.

E2E that shipped

Check	Result
Force Flow /screen/status for the enrolled screen	curfew 23:00, blocked: true
Gold Pro host by MAC	new display name, still blocked
Streaming DNS policies scoped to that MAC	present (Netflix/YouTube/…)
Hostname match old label → same screen key	yes
Hostname match new label → same screen key	yes
Simulated further rename	MAC stays known; enforce set unchanged

Where the live registry lives

devices.yaml is haus config (gitignored in the public tree). Renames that should stick across reloads get an also_known_as entry on the Mini; the engine also learns aliases at runtime into usage.db.

What rename still does not fix

A new MAC with no pin, no OUI path, and no unknown-during-curfew hit is a different problem — the evasion ladder on the Device Identity page. Renaming alone never was enough. The work tonight was making sure the system never behaves as if the label were the key.