This is a tentative solution to #1311. When creating an always-on client, take its account name, append 16 bytes of zeroes (to prevent any collision with a CIDR that could be an input to the cloaking algorithm), then apply the cloaking algorithm truncate(SHA3(K || M), num_cloak_bits), then use that as the hostname.