# Design note — changing your name

**Dated 2026-08-05. Written before the code, per the provenance practice in
[ROADMAP.md](../../ROADMAP.md#proving-independence).**

---

## The job to be done

A username is chosen in the first thirty seconds of an account's life, by
somebody who has not yet seen the place, and then worn in public forever. People
outgrow them, get named after an old job, or picked something that identifies
them more than they meant it to.

Nothing in Convoro can change one.

## Decision 1 — this is cheap because people are addressed by id

Profile URLs are `/member/{id}`. Mentions are resolved when a post is written
and baked into its stored HTML as `<a href="/member/5">@oldname</a>`.

So a rename **breaks no link anywhere**, with no migration and no rewrite. That
is worth stating plainly because it is the reason this is a small feature here
and a frightening one elsewhere.

The rendered mention keeps showing the name that was written. That is correct:
a post is a record of what somebody said at the time, and silently rewriting
old posts to say something else is a worse outcome than a stale handle beside a
working link.

## Decision 2 — an old handle still finds the person

Somebody who has known you as `@bob` for two years will type `@bob`. If that
resolves to nothing, the mention silently does not notify you, and the person
who wrote it has no way to know.

So handle lookup consults **history as well as current names**. A name that was
yours still reaches you.

Current names win over historical ones, always. Otherwise a former name could
shadow somebody's actual name.

## Decision 3 — the old name is held, not released

The moment `@bob` becomes free, anybody can take it — and every old mention in
the archive now displays a name belonging to somebody else.

It is not a security hole, because those links carry the original id. It is an
impersonation problem, and a confusing one to explain.

So a released name is **held for ninety days**. Long enough that the archive
settles and anybody looking for the original person has found them; short
enough that a name is not locked away forever by somebody who used it once.

Administrators can release a held name early, because the alternative is a
support ticket nobody can action.

## Decision 4 — rate limited, and the limit is generous but real

**Once every thirty days.** Not because renaming is expensive, but because a
person whose name changes weekly cannot be recognised, followed, or held to
anything they said — and in a community that is the whole currency.

Administrators renaming somebody else are not limited: that is a moderation
action, usually about a name that should not have been allowed in the first
place.

## Decision 5 — history is for staff, not for everybody

Moderators sometimes need to know that this account used to be that one. That is
a legitimate need and the history table serves it.

Publishing it on the profile is not the same thing. Somebody who renamed to get
away from a name that identified them would find a permanent public record of
the old one worse than never being able to rename at all.

So: recorded always, visible to staff, never rendered on a public profile.

## Decision 6 — the same rules as registration, in one place

A name that could not be registered cannot be changed to. Length, character
set, uniqueness, and the reserved-name check are one implementation used by
both paths, because two implementations of "is this name allowed" is how a
forum ends up with an account called `admin`.

## What this does not do

- **No rewriting of old posts.** See decision 1.
- **No display names separate from usernames.** A second name to be known by is
  a different feature with its own moderation surface.
- **No name reservation queue.** "Tell me when `@bob` is free" is a nicety on a
  nicety.
