Merge main into the desktop redesign branch

Four conflicts. Three were two people adding to the same spot, and one was a
real collision: main gave the connect bar a REMEMBER tick in the same pass that
this branch took the connect bar off the hosts screen.

REMEMBER is now in the drawer, beside the password box it qualifies. Nothing
about the feature changed — RemembersConnectPassword, its refusal to fire until
the remote has accepted the password, and the six tests over it are main's
untouched — only where it is drawn. The move improves it slightly and it is
worth saying why rather than claiming a merge was neutral: the bar had one row
and had to fit the box, the tick, the authentication note and CONNECT along it,
which is why the tick was a bare "REMEMBER" in tracked capitals. A column has
room to put it under the box as a sentence, where it reads as a property of the
password rather than as a fourth control in a row.

MainWindowViewModel: both sides added members after ShowTerminal — the desktop's
three fixed tabs here, the phone's connect menu on main. They do not interact,
so both are kept, each under its own heading.

TeamsScreen: main added the team's own RENAME, HAND OVER and ARCHIVE, a member's
LastActive, the role a new member arrives as, and the KEY HOLDERS list. This
branch had only bumped the file's font sizes a point. Resolved by taking main's
file whole and re-running the bump over it, so the new controls join the scale
rather than sitting a point below everything around them.

README: both sides described a different head's third pass in the same
paragraph. Both kept.

Two things checked rather than assumed, because this branch moved the furniture
the merged commits sit on. The chrome heights main's terminal work touched are
the phone's, not the desktop's — 44, 42 and 24 are unchanged, so the layout
harness's budget still describes the window. And main's keychain DELETE did not
reach VaultScreen.axaml, whose header this branch rearranged, so the five
buttons that overflowed at the larger type are still five.

2415 tests pass, up from 2369 by the 46 main brought.

src/DodoSSH.Client.App/Assets/dodossh-icon.ps1

@@ -0,0 +1,119 @@
+# Regenerates dodossh.ico from the same geometry the Android launcher icon draws.
+#
+# The phone's mark is a vector — Resources/drawable/ic_launcher_foreground.xml — and the whole
+# reason it is a vector is that there is then one geometry to change and no set of PNG densities
+# to forget one of. Windows will not take a vector: <ApplicationIcon> wants an .ico and nothing
+# else, and Window.Icon wants a bitmap. So the raster exists, and this script is how it stays
+# honest: the numbers below are the ones in that XML, and regenerating is the whole edit.
+#
+#     pwsh -File src/DodoSSH.Client.App/Assets/dodossh-icon.ps1
+#
+# Coordinates are the launcher's 108-unit viewport, mapped so the middle 72 fills the canvas.
+# That 72 is not an arbitrary crop: it is the part of an adaptive icon a launcher actually shows,
+# the outer 18 on each edge being what it eats for masking and parallax. Rendering the whole 108
+# here would draw the glyph at half the size it is meant to be — correct arithmetic, and a stamp
+# lost in a field of accent. Matching what the phone displays means matching the 72.
+#
+# The one thing this draws that the phone's vector does not is the tile. On Android the tile is
+# the background layer and the launcher's mask rounds it; Windows has no mask, so the rounding
+# happens here.
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Drawing
+
+$accent = [System.Drawing.ColorTranslator]::FromHtml('#5B8CFF')  # dodo_accent / AccentColor
+$ink = [System.Drawing.ColorTranslator]::FromHtml('#0E1220')     # AccentInk
+
+# Every size Windows asks for: 16 in a titlebar and a tree, 32 on the desktop, 48 in a large-icon
+# view, 256 for the preview pane. Shipping fewer means Windows downsamples one of these to fill
+# the gap, and its downsampler is not kind to a hairline.
+$sizes = @(16, 20, 24, 32, 40, 48, 64, 128, 256)
+
+function New-MarkPng([int]$size)
+{
+    $bitmap = New-Object System.Drawing.Bitmap($size, $size, [System.Drawing.Imaging.PixelFormat]::Format32bppArgb)
+    $g = [System.Drawing.Graphics]::FromImage($bitmap)
+    $g.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::AntiAlias
+    $g.PixelOffsetMode = [System.Drawing.Drawing2D.PixelOffsetMode]::HighQuality
+
+    # The accent tile, rounded as a launcher mask rounds it. A square-cornered tile would be the
+    # one icon on the taskbar with corners, which reads as unfinished rather than as deliberate.
+    $radius = [double]$size * 0.22
+    $d = $radius * 2.0
+    $path = New-Object System.Drawing.Drawing2D.GraphicsPath
+    $path.AddArc(0.0, 0.0, $d, $d, 180, 90)
+    $path.AddArc($size - $d, 0.0, $d, $d, 270, 90)
+    $path.AddArc($size - $d, $size - $d, $d, $d, 0, 90)
+    $path.AddArc(0.0, $size - $d, $d, $d, 90, 90)
+    $path.CloseFigure()
+    $brush = New-Object System.Drawing.SolidBrush($accent)
+    $g.FillPath($brush, $path)
+
+    # 108-viewport units to pixels, with the outer 18 dropped on each edge.
+    $scale = [double]$size / 72.0
+    function P([double]$x, [double]$y) { New-Object System.Drawing.PointF((($x - 18.0) * $scale), (($y - 18.0) * $scale)) }
+
+    # A stroke thinner than a pixel renders as a grey suggestion of itself, which at 16px is the
+    # difference between a mark and a smudge. The phone's file already bumps this width for the
+    # same reason at 48dp; the floor is that argument carried down to the sizes Windows asks for.
+    $pen = New-Object System.Drawing.Pen($ink, [float][Math]::Max(5.4 * $scale, 1.0))
+    $pen.StartCap = [System.Drawing.Drawing2D.LineCap]::Round
+    $pen.EndCap = [System.Drawing.Drawing2D.LineCap]::Round
+    $pen.LineJoin = [System.Drawing.Drawing2D.LineJoin]::Round
+
+    # The chevron of >_ and the underscore on the baseline it bottoms out at.
+    $g.DrawLines($pen, @((P 36.06 43.33), (P 49.91 53.57), (P 36.06 63.8)))
+    $g.DrawLine($pen, (P 54 64.68), (P 71.94 64.68))
+
+    $stream = New-Object System.IO.MemoryStream
+    $bitmap.Save($stream, [System.Drawing.Imaging.ImageFormat]::Png)
+
+    $pen.Dispose(); $brush.Dispose(); $path.Dispose(); $g.Dispose(); $bitmap.Dispose()
+    return $stream.ToArray()
+}
+
+# ICO is a six-byte header, a sixteen-byte directory entry per image, then the images. The entries
+# carry PNG payloads rather than the older BMP-with-AND-mask form, which every Windows since Vista
+# reads and which is what keeps a 256px entry from costing 256KB.
+#
+# The cast on each frame is load-bearing. A byte[] returned through PowerShell's output collector
+# comes back as Object[] of boxed bytes, which BinaryWriter has no overload for — it binds to one
+# of the scalar Write()s instead and puts a single byte on the stream. The first run of this
+# script produced a 159-byte .ico that way, header and directory intact and nine one-byte images.
+$frames = New-Object 'System.Collections.Generic.List[byte[]]'
+foreach ($size in $sizes)
+{
+    [byte[]]$png = New-MarkPng $size
+    $frames.Add($png)
+}
+
+$out = New-Object System.IO.MemoryStream
+$w = New-Object System.IO.BinaryWriter($out)
+$w.Write([uint16]0)             # reserved
+$w.Write([uint16]1)             # type: icon
+$w.Write([uint16]$sizes.Count)
+
+$offset = 6 + (16 * $sizes.Count)
+for ($i = 0; $i -lt $sizes.Count; $i++)
+{
+    $size = $sizes[$i]
+    $w.Write([byte]($(if ($size -ge 256) { 0 } else { $size })))  # 0 means 256
+    $w.Write([byte]($(if ($size -ge 256) { 0 } else { $size })))
+    $w.Write([byte]0)           # palette entries: none, this is truecolour
+    $w.Write([byte]0)           # reserved
+    $w.Write([uint16]1)         # colour planes
+    $w.Write([uint16]32)        # bits per pixel
+    $w.Write([uint32]$frames[$i].Length)
+    $w.Write([uint32]$offset)
+    $offset += $frames[$i].Length
+}
+
+foreach ($frame in $frames) { $w.Write($frame) }
+$w.Flush()
+
+$target = Join-Path $PSScriptRoot 'dodossh.ico'
+[System.IO.File]::WriteAllBytes($target, $out.ToArray())
+$w.Dispose(); $out.Dispose()
+
+Write-Output "Wrote $target ($($sizes.Count) sizes, $((Get-Item $target).Length) bytes)"

src/DodoSSH.Client.App/DodoSSH.Client.App.csproj

@@ -5,6 +5,14 @@
     <ApplicationManifest>app.manifest</ApplicationManifest>
     <AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
 
+    <!--
+      The icon on the executable itself — what Explorer, the Start menu and a pinned taskbar button
+      draw, all of which read it from the PE resource and never start the process. Window.Icon in
+      MainWindow.axaml is a separate thing that only exists once the application is running; both are
+      needed, and both point at this file.
+    -->
+    <ApplicationIcon>Assets/dodossh.ico</ApplicationIcon>
+
     <!--
       False here, unlike every server project. The root Directory.Build.props sets it true because
       the API is container-hosted, UTC-only and has no business formatting anything for a human.
@@ -15,6 +23,14 @@
     <InvariantGlobalization>false</InvariantGlobalization>
   </PropertyGroup>
 
+  <ItemGroup>
+    <!--
+      Named rather than globbed as Assets/**, because the folder also holds the script that draws the
+      icon and a build has no reason to carry a copy of it around inside the binary.
+    -->
+    <AvaloniaResource Include="Assets/dodossh.ico" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="Avalonia" />
     <PackageReference Include="Avalonia.Desktop" />

src/DodoSSH.Client.App/Views/HostDrawer.axaml

@@ -106,12 +106,24 @@
 
             It is here rather than in a bar across the top of the screen, which is where it used to be: the
             password belongs to the host, and a box at the top of a grid of forty machines is one whose
-            subject you have to work out.
+            subject you have to work out. That move is also what this arrangement is for — the bar had one
+            row and had to fit the box, the tick, the note and CONNECT along it; a column has room to put
+            the tick under the box it qualifies, which is where it reads as a property of the password
+            rather than as a fourth control in a row.
+
+            REMEMBER travels with the box and hides with it. It is the two-step chore the box's tooltip used
+            to describe — add a password under Keychain, then bind the host to it — done from the one place
+            that already has the password, and it takes effect only once the remote has accepted it.
           -->
-          <TextBox Text="{Binding ConnectPassword}" PlaceholderText="password (not stored)"
+          <TextBox Text="{Binding ConnectPassword}" PlaceholderText="password"
                    PasswordChar="•" HorizontalAlignment="Stretch"
                    IsVisible="{Binding SelectedHostAsksForAPassword}"
-                   ToolTip.Tip="Typed each time and never stored. To stop typing it, add a password under Keychain and bind this host to it in the host's own editor." />
+                   ToolTip.Tip="Typed each time unless REMEMBER is ticked, in which case it is saved to your keychain and bound to this host once the connection succeeds." />
+          <CheckBox IsChecked="{Binding RemembersConnectPassword}"
+                    IsVisible="{Binding SelectedHostAsksForAPassword}"
+                    ToolTip.Tip="Saves this password to your keychain, bound to this host, so it is not asked for again. It syncs to your other machines, and only happens if the connection works.">
+            <TextBlock Text="Remember this password" Classes="hint" FontSize="12" />
+          </CheckBox>
 
           <StackPanel Orientation="Horizontal" Spacing="6" IsVisible="{Binding ShowsHostActions}">
             <Button Classes="accent" Content="CONNECT" Command="{Binding ConnectCommand}"

src/DodoSSH.Client.App/Views/HostsScreen.axaml

@@ -49,6 +49,9 @@
 
         Ctrl+K is named on it because the palette is the other way to reach a host by typing, and somebody
         who has found this box should know about the one that also connects on Enter.
+
+        The connect bar that used to be this row — password box, REMEMBER, the note, CONNECT — is in the
+        drawer now, beside the host it is about. See HostDrawer.
       -->
       <Border Grid.Row="0" Padding="16,12" Background="{StaticResource Panel}"
               BorderBrush="{StaticResource BorderSubtle}" BorderThickness="0,0,0,1">

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -6,6 +6,7 @@
         x:Class="DodoSSH.Client.App.Views.MainWindow"
         x:DataType="vm:MainWindowViewModel"
         Title="DodoSSH"
+        Icon="/Assets/dodossh.ico"
         Width="1180"
         Height="760"
         MinWidth="1016"

src/DodoSSH.Client.App/Views/TeamsScreen.axaml

@@ -1,6 +1,7 @@
 <UserControl xmlns="https://github.com/avaloniaui"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:contracts="using:DodoSSH.Contracts"
              x:Class="DodoSSH.Client.App.Views.TeamsScreen"
              x:DataType="vm:TeamsViewModel">
 
@@ -13,9 +14,12 @@
     and the vaults table are side by side, an addition says out loud that it granted nothing readable yet,
     and SHARE KEY is its own button rather than a checkbox on the member row.
 
-    What the design asked for and is still not here: pending invitations (there is no outbound mail path and
-    no invitation token), two-factor state and last-active (the server records neither), and avatars (no
-    picture is stored anywhere). None of them is drawn with invented data.
+    What the design asked for and is still not here: two-factor state (no such concept exists anywhere in
+    this product) and avatars (no picture is stored anywhere). Invitations and last-active are here, and
+    both are narrower than the design drew. Nothing is sent — there is no outbound mail path and no token,
+    so an invitation is a standing instruction that the next account signing in with that address joins the
+    team, and there is consequently nothing to resend. Last-active is recorded at most once per account per
+    hour, so it is drawn coarsely rather than to the minute. None of it is drawn with invented data.
   -->
 
   <Grid ColumnDefinitions="268,*">
@@ -82,13 +86,71 @@
     <Grid Grid.Column="1" RowDefinitions="44,*,Auto">
 
       <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
-        <TextBlock Classes="mono" Text="{Binding SelectedTeam.Name}" FontSize="12" FontWeight="SemiBold"
-                   LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center" />
+        <Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
+          <TextBlock Grid.Column="0" Classes="mono" Text="{Binding SelectedTeam.Name}" FontSize="12"
+                     FontWeight="SemiBold" LetterSpacing="1" Foreground="{StaticResource Text}"
+                     VerticalAlignment="Center" />
+
+          <!--
+            The team's own operations. RENAME is an admin's; the other two are the owner's alone, and
+            that is the line the server draws as well — an admin the owner promoted must not be able
+            to archive the team or take it from them.
+          -->
+          <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6"
+                      IsVisible="{Binding ShowsTeamActions}">
+            <Button Classes="ghost" Content="RENAME" Command="{Binding RenameTeamCommand}"
+                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}" />
+            <Button Classes="ghost" Content="HAND OVER" Command="{Binding TransferOwnershipCommand}"
+                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding OwnsSelected}"
+                    ToolTip.Tip="Hands this team to the selected member. They become the owner and you become an admin; only the new owner can hand it on again." />
+            <Button Classes="danger" Content="ARCHIVE" Command="{Binding ArchiveTeamCommand}"
+                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding OwnsSelected}"
+                    ToolTip.Tip="Takes the team out of every member's list. Refused while it still owns any vault, and only somebody with database access can bring it back." />
+          </StackPanel>
+        </Grid>
       </Border>
 
       <ScrollViewer Grid.Row="1" IsVisible="{Binding HasSelection}">
         <StackPanel Margin="14,14" Spacing="18">
 
+          <!-- The rename form, in place, exactly as the create form on the left is. -->
+          <Border Padding="12" CornerRadius="4" BorderThickness="1"
+                  BorderBrush="{StaticResource Border}" IsVisible="{Binding IsEditingTeam}">
+            <StackPanel Spacing="8">
+              <TextBlock Classes="label" Text="RENAME TEAM" />
+              <TextBox PlaceholderText="Name" Text="{Binding EditTeamName}" />
+              <TextBox PlaceholderText="What this team is for (optional)"
+                       Text="{Binding EditTeamDescription}" />
+              <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                         Text="The slug does not change. It is what URLs and the server's own records use, and it is unique only among live teams — so a rename that moved it could take one an archived team is still holding." />
+              <StackPanel Orientation="Horizontal" Spacing="6">
+                <Button Classes="accent" Content="SAVE" Command="{Binding SaveTeamCommand}"
+                        IsEnabled="{Binding !IsBusy}" />
+                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelRenameTeamCommand}" />
+              </StackPanel>
+            </StackPanel>
+          </Border>
+
+          <!--
+            The armed confirmation, drawn where the buttons that armed it were. The vault screen's
+            idiom, and for the same reason: there is no modal anywhere in this window.
+          -->
+          <Border Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
+                  BorderThickness="1" CornerRadius="4" Padding="12"
+                  IsVisible="{Binding IsConfirming}">
+            <StackPanel Spacing="8">
+              <TextBlock Text="{Binding PendingAction.Question}" FontSize="13" FontWeight="Medium"
+                         Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+              <TextBlock Classes="hint" FontSize="11.5" TextWrapping="Wrap"
+                         Text="{Binding PendingAction.Consequence}" />
+              <StackPanel Orientation="Horizontal" Spacing="6">
+                <Button Classes="danger" Content="CONFIRM" Command="{Binding ConfirmActionCommand}"
+                        IsEnabled="{Binding !IsBusy}" />
+                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelActionCommand}" />
+              </StackPanel>
+            </StackPanel>
+          </Border>
+
           <!-- Members -->
 
           <StackPanel Spacing="8">
@@ -98,14 +160,17 @@
                      Background="Transparent" BorderThickness="0" MaxHeight="240">
               <ListBox.ItemTemplate>
                 <DataTemplate x:DataType="vm:TeamMemberRowViewModel">
-                  <Grid ColumnDefinitions="*,150,Auto" Margin="0,3">
+                  <Grid ColumnDefinitions="*,168,Auto" Margin="0,3">
                     <StackPanel Grid.Column="0" Spacing="2">
                       <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
                                  Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
                       <TextBlock Classes="hint" FontSize="11" Text="{Binding Email}" />
                     </StackPanel>
-                    <TextBlock Grid.Column="1" Classes="hint" FontSize="11" VerticalAlignment="Center"
-                               Text="{Binding KeyState}" TextWrapping="Wrap" />
+                    <StackPanel Grid.Column="1" Spacing="2" VerticalAlignment="Center">
+                      <TextBlock Classes="hint" FontSize="11" Text="{Binding KeyState}"
+                                 TextWrapping="Wrap" />
+                      <TextBlock Classes="hint" FontSize="10.5" Text="{Binding LastActive}" />
+                    </StackPanel>
                     <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Role}" FontSize="10"
                                Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
                                Margin="10,0,0,0" />
@@ -114,21 +179,96 @@
               </ListBox.ItemTemplate>
             </ListBox>
 
+            <!--
+              Buttons and a command rather than a selector bound to the role, which is the choice the
+              key editor and the category rail already make and for the reason they record: a selector
+              moves its own highlight before anything can refuse, so it can end up showing a role
+              nobody was given. OWNER is absent because it is not a role that can be assigned —
+              handing the team over is its own act, with its own confirmation.
+            -->
+            <StackPanel Spacing="6" IsVisible="{Binding CanAdministerSelected}">
+              <TextBlock Classes="label" Text="SET THE SELECTED MEMBER'S ROLE" />
+              <StackPanel Orientation="Horizontal" Spacing="6">
+                <Button Classes="flat choice" Content="VIEWER" Command="{Binding ChangeRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}"
+                        IsEnabled="{Binding !IsBusy}"
+                        ToolTip.Tip="May pull this team's vaults and may not push. It does not withdraw a vault key they already hold." />
+                <Button Classes="flat choice" Content="MEMBER" Command="{Binding ChangeRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Member}"
+                        IsEnabled="{Binding !IsBusy}"
+                        ToolTip.Tip="May read and change this team's vaults." />
+                <Button Classes="flat choice" Content="ADMIN" Command="{Binding ChangeRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Admin}"
+                        IsEnabled="{Binding !IsBusy}"
+                        ToolTip.Tip="May also manage members, create vaults and share vault keys." />
+              </StackPanel>
+            </StackPanel>
+
             <Grid ColumnDefinitions="*,Auto,Auto" IsVisible="{Binding CanAdministerSelected}">
               <TextBox Grid.Column="0" PlaceholderText="colleague@example.com" Text="{Binding InviteEmail}"
                        Margin="0,0,6,0" />
               <Button Grid.Column="1" Classes="accent" Content="ADD MEMBER"
-                      Command="{Binding AddMemberCommand}" IsEnabled="{Binding !IsBusy}" />
+                      Command="{Binding AddMemberCommand}" IsEnabled="{Binding !IsBusy}"
+                      ToolTip.Tip="Adds the account with this address, or invites the address if there is no account here yet. Nothing is sent either way — tell them yourself." />
               <Button Grid.Column="2" Classes="danger" Content="REMOVE" Margin="6,0,0,0"
                       Command="{Binding RemoveMemberCommand}" IsEnabled="{Binding !IsBusy}"
                       ToolTip.Tip="Removes the selected member and withdraws every vault key they hold from this team. It blocks future reads only — anything already on their machine stays there, so rotate the credentials that matter." />
             </Grid>
 
+            <StackPanel Spacing="4" IsVisible="{Binding CanAdministerSelected}">
+              <TextBlock Classes="label" Text="THEY ARRIVE AS" />
+              <StackPanel Orientation="Horizontal" Spacing="6">
+                <Button Classes="flat choice" Content="VIEWER" Classes.active="{Binding AddsAsViewer}"
+                        Command="{Binding ChooseNewMemberRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}" />
+                <Button Classes="flat choice" Content="MEMBER" Classes.active="{Binding AddsAsMember}"
+                        Command="{Binding ChooseNewMemberRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Member}" />
+                <Button Classes="flat choice" Content="ADMIN" Classes.active="{Binding AddsAsAdmin}"
+                        Command="{Binding ChooseNewMemberRoleCommand}"
+                        CommandParameter="{x:Static contracts:TeamMemberRole.Admin}" />
+              </StackPanel>
+            </StackPanel>
+
             <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
                        IsVisible="{Binding CanAdministerSelected}"
                        Text="Adding somebody lets the server serve them this team's vaults. It does not let them read one: a vault key can only be wrapped by a machine that already holds it, which is what SHARE KEY below does." />
           </StackPanel>
 
+          <!--
+            Invitations, drawn only when there are any. An empty INVITED heading on every team would be
+            a permanent reminder of a feature most teams never use.
+          -->
+          <StackPanel Spacing="8" IsVisible="{Binding HasInvitations}">
+            <Border Height="1" Background="{StaticResource BorderSubtle}" />
+
+            <TextBlock Classes="label" Text="INVITED" />
+
+            <ListBox ItemsSource="{Binding Invitations}" SelectedItem="{Binding SelectedInvitation}"
+                     Background="Transparent" BorderThickness="0" MaxHeight="160">
+              <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:TeamInvitationRowViewModel">
+                  <Grid ColumnDefinitions="*,Auto" Margin="0,3">
+                    <StackPanel Grid.Column="0" Spacing="2">
+                      <TextBlock Text="{Binding Email}" FontSize="13" FontWeight="Medium"
+                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                      <TextBlock Classes="hint" FontSize="11" Text="{Binding State}"
+                                 TextWrapping="Wrap" />
+                    </StackPanel>
+                    <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Role}" FontSize="10"
+                               Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
+                               Margin="10,0,0,0" />
+                  </Grid>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+
+            <Button Classes="danger" Content="WITHDRAW INVITATION" HorizontalAlignment="Left"
+                    Command="{Binding RevokeInvitationCommand}" IsEnabled="{Binding !IsBusy}"
+                    IsVisible="{Binding CanAdministerSelected}"
+                    ToolTip.Tip="Signing in with that address will no longer put them in this team. An invitation already taken up is a membership — remove the member instead." />
+          </StackPanel>
+
           <Border Height="1" Background="{StaticResource BorderSubtle}" />
 
           <!-- Vaults -->
@@ -167,6 +307,34 @@
                       ToolTip.Tip="Withdraws the selected member's key to the selected vault. Blocks future reads only." />
             </StackPanel>
 
+            <!--
+              Who can open the selected vault — the design's "shared with" avatars, as names and a
+              state. Under the vault rather than beside the member, because a grant is per vault: a
+              count on a member row would imply per-item sharing, which is M5 and does not exist.
+              Withdrawn and stale grants stay listed and say which they are, because a list that
+              quietly dropped them would show a departed colleague as merely absent rather than as
+              somebody whose key was taken away. The dot is Live and means exactly what it says: this
+              person can open this vault right now.
+            -->
+            <TextBlock Classes="label" Text="KEY HOLDERS" />
+
+            <ListBox ItemsSource="{Binding Grants}" Background="Transparent" BorderThickness="0"
+                     MaxHeight="150">
+              <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:TeamGrantRowViewModel">
+                  <Grid ColumnDefinitions="10,*" Margin="0,3">
+                    <Ellipse Grid.Column="0" Width="6" Height="6" VerticalAlignment="Center"
+                             IsVisible="{Binding IsLive}" Fill="{StaticResource Live}" />
+                    <StackPanel Grid.Column="1" Spacing="2" Margin="6,0,0,0">
+                      <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
+                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                      <TextBlock Classes="hint" FontSize="11" Text="{Binding State}" />
+                    </StackPanel>
+                  </Grid>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+
             <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
                        Text="Sharing verifies the recipient's key against the key log, which proves this server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
           </StackPanel>