diff --git a/tasks.org b/tasks.org
index 27cc96d..29770bc 100644
--- a/tasks.org
+++ b/tasks.org
@@ -532,6 +532,27 @@ lifespan() in server/app/main.py now logs the token between === lines on every s
 - tests: manual — docker restart synq, docker logs synq | grep token
 - datetime: [2026-05-19 Mon]
 
+** DONE default device label to Build.MODEL
+*** acceptance
+- fresh install shows the actual device model name, not "android".
+*** notes
+SettingsRepository.kt: changed deviceLabel fallback from hardcoded "android" to Build.MODEL. No permissions needed. Existing users who have already saved a label are unaffected — DataStore only uses the fallback when no value is stored.
+*** evidence
+- commit: 628a28a
+- tests: manual — fresh install, open settings, verify device label shows model name
+- datetime: [2026-05-19 Mon]
+
+** DONE replace hex token with 3-word passphrase
+*** acceptance
+- generated token is human-readable and fits on one log line.
+- existing token.txt files are unaffected.
+*** notes
+secrets.token_hex(32) produced 64 chars — too long to read/verify visually. Replaced with _generate_passphrase() which picks 3 words from a 512-word embedded list using secrets.choice, hyphenated (e.g. "coral-drift-lamp"). ~27 bits entropy, sufficient for a LAN-only service. Existing token.txt files load unchanged — generation only runs when no token exists. To rotate: delete /data/token.txt and restart the container.
+*** evidence
+- commit: 628a28a
+- tests: manual — delete token.txt, restart container, docker logs synq shows short readable token
+- datetime: [2026-05-19 Mon]
+
 * implementation notes for coding agents
 - keep the server small and testable.
 - keep org formatting in one pure function.