Keep host key trust in the vault, and make it withdrawable

A fingerprint approved once is now approved on every machine and survives a
restart, because host key trust is a vault item type rather than a dictionary
that dies with the process. InMemoryKnownHostStore was what shipped, so the user
was asked to verify a fingerprint on every single connection — which is the gap
most likely to train somebody to click through the one warning that actually
matters. A warning that appears when nothing is wrong teaches that nothing is
ever wrong.

The fourth item type, and like the third it cost no sync logic: a row, an EF
configuration, a migration, a server kind; a secret, a codec, a merge, a cipher,
a repository facade and a session property. One row in the client registry. The
reconciler, the mirror, the repository, the outbox and the pull filter were not
touched. SyncEntityType.KnownHostKey and AadResourceType.KnownHostKey were
already reserved, so neither the contract nor docs/crypto.md changed.

One item per (host, port, algorithm), because a server legitimately offers
several host keys and which one gets negotiated is not ours to predict. Pinning
per endpoint would make an algorithm change indistinguishable from an attack.

The label is derived rather than stored, which is the one place this type
departs from the other three. A user never names a pin — there is nothing to
name it after but the three fields it already has — and a stored label is a
second copy of data that can disagree with the first after a merge. Relabel
returns the secret unchanged, and says why.

The store answers the handshake without touching the disk. SshNetConnectionFactory
calls FindAsync from inside SSH.NET's synchronous HostKeyReceived event, over
.GetAwaiter().GetResult(), which cannot be avoided; doing SQLite I/O plus an AEAD
open per lookup there would put the handshake behind the cache. So decryption
happens in OpenAsync and RefreshAsync — on unlock and after each sync pass,
exactly where the host and key lists already reload — and FindAsync is a
dictionary read under a lock with no await inside it.

That snapshot is where the one real bug in this change lived. Install originally
merged the live pins over the freshly loaded snapshot, to protect a TrustAsync
that had landed while the read was in flight. It would also have resurrected
every pin the user had just forgotten, and stopped a withdrawal made on another
machine from ever taking effect — the store would have healed the deletion back
into existence on every refresh. Replacing wholesale and discarding the read
instead is correct because writes are the rare case: every write bumps a
generation counter, and a refresh whose stamp is stale throws itself away rather
than winning. Nothing found this but reading the method again; it is the kind of
mistake that passes every test written before it, because the test that catches
it is the one the bug tells you to write.

Forgetting is new, and persistence is what made it mandatory rather than
convenient. A mismatch is a hard refusal with no way to continue — deliberately,
and that stays — so pinning a key permanently is also a way to make a
legitimately rebuilt server permanently unreachable. Before this change the pin
died at exit and the problem solved itself; now it does not.

ForgetAsync drops every algorithm for an endpoint, and it is reachable from the
host editor rather than from the warning. Putting it on the mismatch banner would
have made it two clicks from "this may be an attack" to "connect anyway", which
is the affordance the hard refusal exists to deny. The banner already promised
the key could be removed in the host's settings; that promise is now true and
points at the button.

Trust recorded on another machine becomes visible at the next sync pass, not
immediately, and that is a decision rather than an oversight. The failure it
produces is a first-contact prompt for a host a colleague approved a minute ago:
answerable, and self-correcting on the next pass. The opposite trade — polling
the vault on the handshake thread to close a one-minute window — buys nothing
and costs the property above. The dangerous direction is not reachable at all: a
pin recorded here enters the snapshot as part of recording it, so a refresh can
never discard a local trust decision.

The server learns nothing, and this is the item type where the temptation was
real. A plaintext host column would let a known-hosts screen sort and page
without decrypting anything, and it would hand the operator the map of every
user's estate — assembled, as these things are, out of facts that are each
individually harmless. A host row concedes an address only when relay is
switched on and the database refuses to store one otherwise (ADR 0004); there is
no equivalent excuse here. The table has no column to put one in, and the EF
configuration says so where somebody adding it would be standing.

Two things about the migration in this commit are worth knowing, because both
came out of getting it wrong.

It was hand-written first, including its .Designer.cs, and that version is not
what is here. Verifying it turned up something that had been quietly assumed:
Migration_AppliedCleanly_WithNoPendingModelChanges does not check the model
snapshot. It asserts that migrations applied and that none are pending, which a
wrong snapshot satisfies perfectly — the snapshot only matters as the diff base
for the *next* migrations add, so an incorrect one passes the whole suite and
corrupts the following migration instead. The real check is to generate a
throwaway migration and confirm its Up and Down come out empty. They did, and
the generated designer was byte-identical to the transcribed one across all 1255
lines, so the hand-written work was in fact correct.

Then dotnet ef migrations remove --no-build deleted the wrong migration. With
--no-build the tool reads the previously compiled assembly rather than the files
on disk, and the probe had just changed which migration was last, so it removed
AddKnownHostKeyItem and reverted the snapshot. That turned out to leave exactly
the right diff base, so the migration here is EF's own output rather than a
transcription — a better outcome than the one that was interrupted, arrived at
by accident. Never pass --no-build to migrations remove.

Mutation tested, all three sabotages detected: dropping the algorithm from
KnownHostIdentity.For, merging instead of replacing in Install, and pointing
KnownHostKeyCipher at PortForward — which is what a cast from the wire enum's 10
would silently produce. Each is caught both by an assertion about the mechanism
and by a behavioural test that never mentions it; the resource-type sabotage is
caught by the table from d10a38d and nothing else, which is what that table is
for.

The end-to-end slice now approves the real sshd's host key through the vault,
pushes it, and reads it back on the second simulated machine — including a check
that the server learned no address, and that the second machine answers null for
an algorithm never offered.

845 tests green. Zero warnings, dotnet format clean.

Three things are deliberately not fixed. A tombstone queued over a create that
was never pushed is refused by the server as Invalid and parked; that is
pre-existing for all four item types, and the fix belongs in
VaultItemRepository.DeleteAsync rather than here. Deleting a host, or changing
its address, orphans its pins — both are correct as trust decisions, since a pin
describes an endpoint and not a bookmark, but nothing surfaces the leftovers.
And there is no interface listing pins at all: trust is created at the connect
prompt and withdrawn in the host editor. A known-hosts list is where the orphans
would become visible, and it wants the vault column rework first, for the same
reason the credential editor does.

src/DodoSSH.Api/Features/Sync/ItemKinds.cs

@@ -68,8 +68,10 @@ internal interface IItemKind
 internal static class ItemKinds
 {
     private static readonly Dictionary<SyncEntityType, IItemKind> Supported =
-        new[] { (IItemKind)new HostKind(), new SshKeyKind(), new CredentialKind() }
-            .ToDictionary(kind => kind.WireType);
+        new[]
+        {
+            (IItemKind)new HostKind(), new SshKeyKind(), new CredentialKind(), new KnownHostKeyKind(),
+        }.ToDictionary(kind => kind.WireType);
 
     /// <summary>The kind for a wire type, or null when this server does not synchronise it yet.</summary>
     /// <remarks>
@@ -295,9 +297,9 @@ internal sealed class SshKeyKind : IItemKind
 
 /// <summary>Credentials: an envelope and nothing else.</summary>
 /// <remarks>
-/// The strictest of the three kinds about plaintext, and the reason is not symmetry. A key at least has a
-/// fingerprint that is public by nature; a password has no part that is safe to expose, so this kind accepts
-/// no plaintext fields at all and hydrates none.
+/// As strict as a kind gets about plaintext — <see cref="KnownHostKeyKind"/> is the other one — and the
+/// reason is not symmetry. A key at least has a fingerprint that is public by nature; a password has no part
+/// that is safe to expose, so this kind accepts no plaintext fields at all and hydrates none.
 /// </remarks>
 internal sealed class CredentialKind : IItemKind
 {
@@ -387,3 +389,101 @@ internal sealed class CredentialKind : IItemKind
     /// <inheritdoc />
     public SyncPlaintextFields? Hydrate(IVaultItem item) => null;
 }
+
+/// <summary>Known host keys: an envelope and nothing else.</summary>
+/// <remarks>
+/// As strict as <see cref="CredentialKind"/> about plaintext, for a reason that is about aggregation rather
+/// than secrecy. A fingerprint is published so it can be compared and an address may already sit in a
+/// relay-enabled host's columns — but the set of endpoints one user has approved is a map of their estate,
+/// and this server has nothing to do with it.
+/// </remarks>
+internal sealed class KnownHostKeyKind : IItemKind
+{
+    /// <inheritdoc />
+    public SyncEntityType WireType => SyncEntityType.KnownHostKey;
+
+    /// <inheritdoc />
+    public ChangeEntityType ChangeType => ChangeEntityType.KnownHostKey;
+
+    /// <inheritdoc />
+    public async Task<IVaultItem?> FindAsync(
+        DodoDbContext database,
+        Guid id,
+        CancellationToken cancellationToken) =>
+        await database.KnownHostKeys.SingleOrDefaultAsync(k => k.Id == id, cancellationToken)
+            .ConfigureAwait(false);
+
+    /// <inheritdoc />
+    public async Task<Dictionary<Guid, IVaultItem>> LoadAsync(
+        DodoDbContext database,
+        Guid vaultId,
+        Guid[] ids,
+        CancellationToken cancellationToken)
+    {
+        var rows = await database.KnownHostKeys
+            .Where(k => k.VaultId == vaultId && ids.Contains(k.Id))
+            .ToListAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        return rows.ToDictionary(row => row.Id, row => (IVaultItem)row);
+    }
+
+    /// <inheritdoc />
+    public IVaultItem Add(DodoDbContext database, Guid id, Guid vaultId)
+    {
+        var knownHost = new VaultKnownHostKey { Id = id, VaultId = vaultId };
+
+        database.KnownHostKeys.Add(knownHost);
+
+        return knownHost;
+    }
+
+    /// <summary>
+    /// Refuses every plaintext field there is.
+    /// </summary>
+    /// <remarks>
+    /// The relay fields are refused although this type is the one that <em>does</em> hold an address, and
+    /// that is the point: the address belongs in the ciphertext. A client sending it here is either confused
+    /// or trying to get the server to keep a list it has no business keeping, and either way it should be
+    /// told rather than have the value quietly dropped.
+    /// </remarks>
+    /// <inheritdoc />
+    public bool ValidateFields(SyncPlaintextFields fields, out string error)
+    {
+        ArgumentNullException.ThrowIfNull(fields);
+
+        error = string.Empty;
+
+        if (fields.RelayEnabled || fields.Hostname is not null || fields.Port is not null)
+        {
+            error = "A known host key is not something the server dials; its address stays encrypted.";
+            return false;
+        }
+
+        if (fields.PublicKeyFingerprint is not null)
+        {
+            error = "A known host key's fingerprint stays inside its payload.";
+            return false;
+        }
+
+        return true;
+    }
+
+    /// <remarks>Nothing to copy: this type has no plaintext columns to copy anything into.</remarks>
+    /// <inheritdoc />
+    public void ApplyFields(IVaultItem item, SyncPlaintextFields fields)
+    {
+    }
+
+    /// <inheritdoc />
+    public void ClearFieldsOnDelete(IVaultItem item)
+    {
+    }
+
+    /// <remarks>
+    /// Always null, as for a credential: this type has no plaintext columns, so there is nothing a pull could
+    /// hydrate even in principle.
+    /// </remarks>
+    /// <inheritdoc />
+    public SyncPlaintextFields? Hydrate(IVaultItem item) => null;
+}

src/DodoSSH.Client.App/App.axaml.cs

@@ -52,10 +52,11 @@ internal sealed partial class DodoSshApp : Application
         var paths = ClientPaths.Default;
         var caches = ClientCacheFactory.ForFile(paths.CacheFile);
 
-        // Known hosts are still in memory. The plan puts them in the vault as a synced entity so trust
-        // follows the user to every device, and SyncEntityType.KnownHostKey is reserved for it — but that
-        // entity type is not synced yet, so trust currently lasts one session.
-        var knownHosts = new InMemoryKnownHostStore();
+        // Known hosts live in the vault, so trust survives a restart and follows the user to every device.
+        // Composed here, once, because the connection factory below needs it now and outlives every unlock;
+        // the vault behind it is attached and detached as one is opened and locked. See VaultKnownHostStore
+        // for why the handshake is answered from a snapshot rather than by reading the vault per lookup.
+        var knownHosts = new VaultKnownHostStore();
 
         var workspace = new TerminalWorkspace(
             new AvaloniaTerminalAssetProvider(),

src/DodoSSH.Client.App/ViewModels/MainWindowViewModel.cs

@@ -3,7 +3,6 @@ using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using DodoSSH.Client.Auth;
 using DodoSSH.Client.Session;
-using DodoSSH.Client.Ssh;
 using DodoSSH.Client.Storage;
 using DodoSSH.Client.Terminal;
 using DodoSSH.Crypto;
@@ -60,7 +59,15 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     private readonly ClientPaths paths;
     private readonly ClientCacheFactory caches;
     private readonly TerminalWorkspace workspace;
-    private readonly IKnownHostStore knownHosts;
+
+    /// <remarks>
+    /// The concrete store rather than <c>IKnownHostStore</c>, because this is where its lifecycle belongs:
+    /// the interface is what the handshake asks, and opening a vault behind it, refreshing it and forgetting
+    /// it are this state machine's business. The same instance was handed to the connection factory when the
+    /// application was composed.
+    /// </remarks>
+    private readonly VaultKnownHostStore knownHosts;
+
     private readonly SignInHandler signIn;
     private readonly TimeProvider clock;
     private readonly Argon2Profile? passphraseProfile;
@@ -83,7 +90,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         ClientPaths paths,
         ClientCacheFactory caches,
         TerminalWorkspace workspace,
-        IKnownHostStore knownHosts,
+        VaultKnownHostStore knownHosts,
         SignInHandler signIn,
         TimeProvider clock,
         Argon2Profile? passphraseProfile = null)
@@ -355,6 +362,22 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
                 Passphrase = string.Empty;
 
+                // Before the vault view model, so the first connection after an unlock already knows which
+                // host keys this user has approved. Reading them is one listing; doing it here rather than
+                // lazily is what keeps it off the SSH handshake thread.
+                try
+                {
+                    await knownHosts.OpenAsync(outcome.Session!, cancellationToken).ConfigureAwait(true);
+                }
+                catch
+                {
+                    // Nothing owns the session yet, so nothing else would ever dispose it — and an
+                    // undisposed session is vault keys left in memory for the life of the process, which is
+                    // precisely what unlocking must be able to undo.
+                    await outcome.Session!.DisposeAsync().ConfigureAwait(true);
+                    throw;
+                }
+
                 Vault = new VaultViewModel(outcome.Session!, workspace, knownHosts, () => connection);
                 State = ShellState.Unlocked;
 
@@ -398,6 +421,11 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     [RelayCommand]
     private async Task LockAsync()
     {
+        // First, and before the session it read from goes: a synchronisation pass may be in flight, and it
+        // ends by refreshing this store. Detaching now makes that refresh a no-op instead of a set of pins
+        // reappearing behind a lock screen.
+        knownHosts.Close();
+
         if (Vault is { } open)
         {
             Vault = null;
@@ -420,6 +448,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
         disposed = true;
 
+        knownHosts.Close();
+
         if (Vault is { } open)
         {
             await open.DisposeAsync().ConfigureAwait(false);

src/DodoSSH.Client.App/ViewModels/VaultViewModel.cs

@@ -173,10 +173,12 @@ internal sealed class ConflictRowViewModel(ConflictNotice notice)
 /// A background pass is deliberately quieter than the button: see <see cref="AutoSyncAsync" />.
 /// </para>
 /// <para>
-/// <b>Keys are in the vault; passwords are not.</b> An SSH key is a synced item, so it is stored once and
-/// available on every machine. <c>SyncEntityType.Credential</c> exists in the contract and is still not
-/// synced, so password authentication asks for the password each time. That is a real M1 limitation rather
-/// than a design choice, and the interface says so rather than implying the vault holds more than it does.
+/// <b>Keys and host key trust are in the vault; passwords are not yet.</b> An SSH key is a synced item, so
+/// it is stored once and available on every machine, and so is a known host key — approving a fingerprint
+/// here approves it on every device and survives a restart. Credentials are synced as well, but nothing in
+/// this interface can create one, so password authentication still asks each time. That is a real M1
+/// limitation rather than a design choice, and the interface says so rather than implying the vault holds
+/// more than it does.
 /// </para>
 /// <para>
 /// <b>A key belongs to a host.</b> Each host names the key it authenticates with, or none, and that choice
@@ -188,7 +190,7 @@ internal sealed class ConflictRowViewModel(ConflictNotice notice)
 internal sealed partial class VaultViewModel(
     VaultSession session,
     TerminalWorkspace workspace,
-    IKnownHostStore knownHosts,
+    VaultKnownHostStore knownHosts,
     Func<IVaultServer?> connection) : ObservableObject, IAsyncDisposable
 {
     /// <remarks>
@@ -276,6 +278,17 @@ internal sealed partial class VaultViewModel(
     /// <summary>The item being edited, or null when creating.</summary>
     private Guid? editingEntityId;
 
+    /// <summary>
+    /// Whether the editor is showing a host that could have a pinned key to forget.
+    /// </summary>
+    /// <remarks>
+    /// Read by the editor to hide the button while a host is being created, where there is nothing to
+    /// withdraw yet. It does not claim a pin exists — answering that would mean a second question to the
+    /// known-host store for a button's visibility, and the command already says plainly when there was
+    /// nothing to forget.
+    /// </remarks>
+    internal bool CanForgetHostKey => IsEditing && editingEntityId is not null;
+
     // ---- The key editor ----
     // A second set of editor state rather than a shared one. The two editors hold unrelated fields, and
     // sharing them would mean a half-typed host reappearing inside a key editor.
@@ -310,7 +323,8 @@ internal sealed partial class VaultViewModel(
     // ---- Connecting ----
 
     /// <remarks>
-    /// Typed per connection because credentials are not a synced entity type yet. Never persisted.
+    /// Typed per connection because nothing in this interface can create a vault credential yet — not because
+    /// the vault cannot hold one. Never persisted.
     /// </remarks>
     [ObservableProperty]
     private string connectPassword = string.Empty;
@@ -531,6 +545,11 @@ internal sealed partial class VaultViewModel(
 
             await ReloadAsync(cancellationToken).ConfigureAwait(true);
 
+            // Host key trust arrives with the rest of the vault, and the store the SSH handshake asks holds a
+            // snapshot rather than reading per lookup — so a pass that pulled a pin has to hand it over here,
+            // or a host a colleague approved stays a first-contact prompt until the next unlock.
+            await knownHosts.RefreshAsync(cancellationToken).ConfigureAwait(true);
+
             return report;
         }
         finally
@@ -854,7 +873,15 @@ internal sealed partial class VaultViewModel(
             () => OpenSessionAsync(row, credential, cancellationToken)).ConfigureAwait(true);
     }
 
-    /// <summary>Pins the offered host key and retries.</summary>
+    /// <summary>
+    /// Pins the offered host key and retries.
+    /// </summary>
+    /// <remarks>
+    /// The pin goes into the vault, so this writes to the local cache and queues a change for every other
+    /// machine — which is why the write is guarded and the connection is only retried once it has landed.
+    /// It used to be a dictionary insert that could not fail; reporting a failed write as a failed
+    /// connection would send the user looking at the host.
+    /// </remarks>
     [RelayCommand]
     private async Task TrustHostKeyAsync(CancellationToken cancellationToken)
     {
@@ -863,11 +890,28 @@ internal sealed partial class VaultViewModel(
             return;
         }
 
-        await knownHosts.TrustAsync(presentation, cancellationToken).ConfigureAwait(true);
+        try
+        {
+            await knownHosts.TrustAsync(presentation, cancellationToken).ConfigureAwait(true);
+        }
+        catch (OperationCanceledException)
+        {
+            Status = "Cancelled.";
+            return;
+        }
+        catch (Exception exception)
+        {
+            Status = $"The host key could not be stored, so nothing was connected: {exception.Message}";
+            return;
+        }
 
         PendingHostKey = null;
 
         await ConnectAsync(cancellationToken).ConfigureAwait(true);
+
+        // After connecting, not before. A pin is worth pushing straight away — the same host on another
+        // machine should not ask again — but not at the cost of delaying the connection the user asked for.
+        await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
     }
 
     /// <summary>Dismisses the trust prompt without pinning anything.</summary>
@@ -878,6 +922,65 @@ internal sealed partial class VaultViewModel(
         Status = "The host key was not trusted, so nothing was connected.";
     }
 
+    /// <summary>
+    /// Withdraws trust from every key pinned for the host being edited.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The counterpart to trust that now outlives the process, and the reason it exists at all: a mismatch is
+    /// a hard refusal with no way past it, so a server that is legitimately rebuilt would be unreachable for
+    /// ever without this. It is deliberately <em>here</em> — in the host's editor, reached by choosing to edit
+    /// a host — and not on the refusal itself. A "forget this key" button next to the warning is the same
+    /// button as "continue anyway" with two clicks instead of one.
+    /// </para>
+    /// <para>
+    /// Applies to the host's <em>saved</em> address rather than whatever the editor's boxes currently hold.
+    /// The pin belongs to the endpoint that was actually dialled, and someone halfway through retyping a
+    /// hostname has not moved it yet.
+    /// </para>
+    /// </remarks>
+    [RelayCommand]
+    private async Task ForgetHostKeyAsync(CancellationToken cancellationToken)
+    {
+        if (editingEntityId is not { } entityId
+            || Hosts.FirstOrDefault(row => row.EntityId == entityId) is not { } row)
+        {
+            return;
+        }
+
+        var address = row.Host.Hostname;
+        var port = row.Host.Port;
+
+        await RunAsync(
+            $"Forgetting the pinned host key for {address}…",
+            async () =>
+            {
+                var forgotten = await knownHosts
+                    .ForgetAsync(address, port, cancellationToken)
+                    .ConfigureAwait(true);
+
+                // The refusal that sent the user here is about a pin that no longer exists.
+                HostKeyMismatch = null;
+
+                PendingChanges = await session
+                    .PendingChangeCountAsync(cancellationToken)
+                    .ConfigureAwait(true);
+
+                if (forgotten == 0)
+                {
+                    Status = $"Nothing was pinned for {address}:{port}.";
+                    return;
+                }
+
+                Status = $"Forgot the pinned host key for {address}:{port}. The next connection will "
+                    + "ask you to check its fingerprint again.";
+            }).ConfigureAwait(true);
+
+        // Pushed straight away, as a save or a deletion is: a withdrawal that stayed on this machine would
+        // leave the other ones refusing to connect to a server that has been rebuilt.
+        await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
+    }
+
     /// <summary>
     /// Marks every shown conflict as seen.
     /// </summary>
@@ -1219,6 +1322,14 @@ internal sealed partial class VaultViewModel(
     partial void OnSelectedHostChanged(HostRowViewModel? value) =>
         OnPropertyChanged(nameof(SelectedHostUsesAKey));
 
+    /// <remarks>
+    /// The editing id is set before this flips in every path that opens the editor, and cleared after it
+    /// flips back in every path that closes one, so this notification always observes the pair in a
+    /// consistent state.
+    /// </remarks>
+    partial void OnIsEditingChanged(bool value) =>
+        OnPropertyChanged(nameof(CanForgetHostKey));
+
     partial void OnPendingHostKeyChanged(HostKeyPresentation? value) =>
         OnPropertyChanged(nameof(HasPendingHostKey));
 

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -163,6 +163,19 @@
             <StackPanel Orientation="Horizontal" Spacing="8">
               <Button Content="Save" Command="{Binding Vault.SaveHostCommand}" />
               <Button Content="Cancel" Command="{Binding Vault.CancelEditCommand}" />
+              <!--
+                Withdrawing host key trust lives here, in the host's own settings, because a changed host key
+                is refused outright with no way to continue past it — so a legitimately rebuilt server needs
+                somewhere deliberate to be re-approved from, and that somewhere must not be the warning
+                itself. It takes effect when clicked rather than on Save, and the status line says so; it is
+                not a field of the host.
+
+                Added to this row rather than as a row of its own on purpose: this column's editors already
+                only just fit at the window's minimum height, which is why only one may be open at a time.
+              -->
+              <Button Content="Forget host key" Command="{Binding Vault.ForgetHostKeyCommand}"
+                      IsVisible="{Binding Vault.CanForgetHostKey}"
+                      ToolTip.Tip="Removes the pinned key for this host's address, so the next connection asks you to check its fingerprint again." />
             </StackPanel>
           </StackPanel>
         </Border>
@@ -253,10 +266,10 @@
         <Border Grid.Row="0" Padding="10,8" Background="#171b24" IsVisible="{Binding IsUnlocked}">
           <StackPanel Orientation="Horizontal" Spacing="8">
             <!--
-              Typed per connection. SyncEntityType.Credential exists in the contract but is not synced
-              yet, so the vault genuinely does not hold this — saying so beats a password box that looks
-              like it should have been remembered. Disabled rather than hidden when a key is being used, so
-              it stays visible that a password is what the other choice means.
+              Typed per connection. Credentials do sync, but nothing in this interface can create one, so
+              the vault genuinely does not hold this — saying so beats a password box that looks like it
+              should have been remembered. Disabled rather than hidden when a key is being used, so it
+              stays visible that a password is what the other choice means.
             -->
             <TextBox Text="{Binding Vault.ConnectPassword}" PlaceholderText="password (not stored yet)"
                      PasswordChar="•" Width="220" VerticalAlignment="Center"
@@ -305,7 +318,7 @@
                          Foreground="#f3c9cd" FontWeight="SemiBold" />
               <SelectableTextBlock Text="{Binding Vault.HostKeyMismatch}"
                                    Foreground="#f3c9cd" TextWrapping="Wrap" />
-              <TextBlock Text="If the server was legitimately rebuilt, remove its pinned key in the host's settings first. There is deliberately no way to continue from here."
+              <TextBlock Text="If the server was legitimately rebuilt, edit the host and choose &quot;Forget host key&quot; first. There is deliberately no way to continue from here."
                          Foreground="#d59aa1" TextWrapping="Wrap" />
             </StackPanel>
           </Border>

src/DodoSSH.Client.App/packages.lock.json

@@ -355,6 +355,7 @@
           "DodoSSH.Client.Api": "[1.0.0, )",
           "DodoSSH.Client.Auth": "[1.0.0, )",
           "DodoSSH.Client.Domain": "[1.0.0, )",
+          "DodoSSH.Client.Ssh": "[1.0.0, )",
           "DodoSSH.Client.Storage": "[1.0.0, )",
           "DodoSSH.Client.Sync": "[1.0.0, )"
         }

src/DodoSSH.Client.Domain/KnownHostSecret.cs

@@ -0,0 +1,106 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Globalization;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>
+/// One host key the user has decided to trust, decrypted.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Nothing in here is a secret — a public key fingerprint is published by operators on purpose — and it is
+/// still a vault item rather than a local file, for two reasons that have nothing to do with confidentiality.
+/// Trust follows the user to every device, so approving a host once means approving it once. And the server
+/// cannot tamper with it: a server able to drop a pin could silently downgrade every connection to
+/// first-use, which is the only interesting attack on a trust-on-first-use scheme. The <em>set</em> of hosts
+/// a person reaches is worth keeping to themselves as well, and encrypting the item does that for free.
+/// </para>
+/// <para>
+/// <b>One item per host, port and algorithm.</b> A server legitimately offers several host keys and which one
+/// gets negotiated can change between connections, so a pin has to name the algorithm it is about — pinning
+/// one and refusing the others would make an ordinary server look hostile. Three scalars and a fingerprint
+/// also means the merge is four independent fields with no collection in sight, which is why adding this type
+/// needed no new reconciliation logic.
+/// </para>
+/// <para>
+/// <b>Keyed on the address as dialled, not on the host item.</b> The SSH layer knows only what it connected
+/// to, and <c>IKnownHostStore</c> is asked in those terms. It also means changing a host's address makes its
+/// old pin stop applying and the new address a first contact, which is correct rather than unfortunate: as
+/// far as trust goes that is a different machine until somebody says otherwise.
+/// </para>
+/// </remarks>
+public sealed record KnownHostSecret : IVaultSecret
+{
+    /// <summary>The host as it was dialled — a name or an address.</summary>
+    /// <remarks>
+    /// Stored verbatim, and compared case-insensitively by the store that reads it rather than normalised
+    /// here. DNS is case-insensitive so the comparison has to be, but lower-casing what gets stored would
+    /// mean rewriting a value this type does not fully understand — an internationalised name, an IPv6
+    /// literal with a zone id — which is the same argument <see cref="SshKeySecret.PrivateKeyPem"/> makes for
+    /// keeping key armour untouched.
+    /// </remarks>
+    public required string Host { get; init; }
+
+    /// <summary>The port as it was dialled.</summary>
+    /// <remarks>
+    /// Required, with no default, unlike <see cref="HostSecret.Port"/>. A pin is a statement about one
+    /// endpoint, and a defaulted 22 would quietly pin the wrong one for a host reached anywhere else.
+    /// </remarks>
+    public required int Port { get; init; }
+
+    /// <summary>The host key algorithm, e.g. <c>ssh-ed25519</c>.</summary>
+    public required string Algorithm { get; init; }
+
+    /// <summary>The fingerprint that was approved, as <c>SHA256:base64</c>.</summary>
+    public required string Fingerprint { get; init; }
+
+    /// <summary>
+    /// What this pin is called, derived from what it pins.
+    /// </summary>
+    /// <remarks>
+    /// Computed rather than stored, which is the one place this type departs from the other three. A user
+    /// never names a pin — they approve a fingerprint for a host — so a stored label would be a field that
+    /// can disagree with the three fields it describes, and a merge taking the label from one side and the
+    /// address from the other would produce exactly that. Being get-only also keeps it out of the record's
+    /// equality, so two pins are equal when what they pin is equal.
+    /// </remarks>
+    public string Label =>
+        string.Create(CultureInfo.InvariantCulture, $"{Host}:{Port} ({Algorithm})");
+
+    /// <summary>Whether this is storable, and why not if it is not.</summary>
+    /// <remarks>
+    /// The whitespace checks are not pedantry. Neither of these values is typed by a person — the store
+    /// builds them from what the handshake presented — but a payload written by another client is untrusted
+    /// input, and a fingerprint carrying a stray space or a trailing comment would compare unequal to the
+    /// same key for ever, which reads to the user as a permanently changed host key.
+    /// </remarks>
+    public bool TryValidate([NotNullWhen(false)] out string? reason)
+    {
+        if (string.IsNullOrWhiteSpace(Host))
+        {
+            reason = "A known host key needs the host it belongs to.";
+            return false;
+        }
+
+        if (Port is < 1 or > 65535)
+        {
+            reason = $"Port must be between 1 and 65535, not {Port}.";
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(Algorithm) || Algorithm.Any(char.IsWhiteSpace))
+        {
+            reason = "A known host key needs the key algorithm it was negotiated with.";
+            return false;
+        }
+
+        if (string.IsNullOrWhiteSpace(Fingerprint) || Fingerprint.Any(char.IsWhiteSpace))
+        {
+            reason = "A known host key needs a fingerprint, with no spaces in it.";
+            return false;
+        }
+
+        reason = null;
+        return true;
+    }
+}

src/DodoSSH.Client.Domain/KnownHostSecretCodec.cs

@@ -0,0 +1,121 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>A decoded known-host payload, together with the schema version it was written at.</summary>
+/// <param name="KnownHost">The pin.</param>
+/// <param name="SchemaVersion">The version the writing client used.</param>
+public sealed record KnownHostSecretDocument(KnownHostSecret KnownHost, int SchemaVersion)
+{
+    /// <inheritdoc cref="HostSecretDocument.IsReadOnly" />
+    public bool IsReadOnly => SchemaVersion > KnownHostSecretCodec.CurrentSchemaVersion;
+}
+
+/// <summary>
+/// Encodes and decodes the plaintext inside a known-host item's encrypted payload.
+/// </summary>
+/// <remarks>
+/// Mirrors <see cref="CredentialSecretCodec"/>, for the same reasons and with the same guarantees: JSON so a
+/// field can be added without a migration, deterministic property order so an unchanged pin does not look
+/// like a change to the sync engine, and a separate mutable document type so a decode failure cannot produce
+/// a half-built pin that looks valid downstream.
+/// <para>
+/// The label is not in here, and that is not an omission — <see cref="KnownHostSecret.Label"/> is derived
+/// from the three fields that are. Writing it would put a value on the wire that a reader could disagree
+/// with.
+/// </para>
+/// </remarks>
+public static class KnownHostSecretCodec
+{
+    /// <summary>The schema version this build writes.</summary>
+    public const int CurrentSchemaVersion = 1;
+
+    /// <summary>Serialises a pin to the bytes that get sealed.</summary>
+    /// <exception cref="ArgumentException">The pin is not valid for storage.</exception>
+    public static byte[] Encode(KnownHostSecret knownHost)
+    {
+        ArgumentNullException.ThrowIfNull(knownHost);
+
+        if (!knownHost.TryValidate(out var reason))
+        {
+            throw new ArgumentException(reason, nameof(knownHost));
+        }
+
+        var document = new KnownHostPayloadDocument
+        {
+            SchemaVersion = CurrentSchemaVersion,
+            Host = knownHost.Host,
+            Port = knownHost.Port,
+            Algorithm = knownHost.Algorithm,
+            Fingerprint = knownHost.Fingerprint,
+        };
+
+        return JsonSerializer.SerializeToUtf8Bytes(
+            document, KnownHostPayloadJsonContext.Default.KnownHostPayloadDocument);
+    }
+
+    /// <summary>Parses a decrypted payload.</summary>
+    /// <inheritdoc cref="HostSecretCodec.TryDecode" path="/remarks" />
+    public static bool TryDecode(
+        ReadOnlySpan<byte> payload,
+        [NotNullWhen(true)] out KnownHostSecretDocument? document)
+    {
+        document = null;
+
+        KnownHostPayloadDocument? parsed;
+        try
+        {
+            parsed = JsonSerializer.Deserialize(
+                payload, KnownHostPayloadJsonContext.Default.KnownHostPayloadDocument);
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+
+        if (parsed is null || parsed.SchemaVersion < 1)
+        {
+            return false;
+        }
+
+        var candidate = new KnownHostSecret
+        {
+            Host = parsed.Host ?? string.Empty,
+            Port = parsed.Port,
+            Algorithm = parsed.Algorithm ?? string.Empty,
+            Fingerprint = parsed.Fingerprint ?? string.Empty,
+        };
+
+        if (!candidate.TryValidate(out _))
+        {
+            return false;
+        }
+
+        document = new KnownHostSecretDocument(candidate, parsed.SchemaVersion);
+        return true;
+    }
+}
+
+/// <summary>The serialised shape. Mutable and nullable because it models untrusted input.</summary>
+/// <inheritdoc cref="HostPayloadDocument" path="/remarks" />
+internal sealed class KnownHostPayloadDocument
+{
+    public int SchemaVersion { get; set; }
+
+    public string? Host { get; set; }
+
+    public int Port { get; set; }
+
+    public string? Algorithm { get; set; }
+
+    public string? Fingerprint { get; set; }
+}
+
+[JsonSourceGenerationOptions(
+    PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase,
+    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
+[JsonSerializable(typeof(KnownHostPayloadDocument))]
+internal sealed partial class KnownHostPayloadJsonContext : JsonSerializerContext;

src/DodoSSH.Client.Domain/KnownHostSecretMerge.cs

@@ -0,0 +1,121 @@
+using System.Globalization;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>The merged pin, and everything that had to be overridden to produce it.</summary>
+/// <param name="Merged">The pin to store and push.</param>
+/// <param name="Conflicts">Empty when the two sides were reconcilable field by field.</param>
+public sealed record KnownHostMergeResult(
+    KnownHostSecret Merged,
+    IReadOnlyList<HostFieldConflict> Conflicts)
+{
+    /// <summary>Whether anything had to be overridden.</summary>
+    public bool HasConflicts => Conflicts.Count > 0;
+}
+
+/// <summary>
+/// Merges two divergent versions of a known host key against the version they both started from.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Four scalars, so this is the same shape as <see cref="CredentialSecretMerge"/> and reuses
+/// <see cref="HostFieldConflict"/> for the same reason: the conflict log, the storage behind it and the
+/// interface that shows it are shared.
+/// </para>
+/// <para>
+/// <b>Nothing here is redacted, and the fingerprint least of all.</b> The other two item types hide the
+/// value that lost, because a discarded password or a discarded private key is still live somewhere. A
+/// fingerprint is published by operators precisely so that it can be compared, and which of two fingerprints
+/// the merge dropped is the entire content of the notice — a user told only that "the fingerprint differed"
+/// has been told nothing they can check.
+/// </para>
+/// <para>
+/// In practice only <see cref="KnownHostSecret.Fingerprint"/> can genuinely clash, and it is worth saying why
+/// the other three are merged rather than asserted: they are what the pin is <em>about</em>, so two sides
+/// holding different values for them are not two versions of one pin at all. Nothing in the client can
+/// produce that — the store rewrites a fingerprint or creates a new item, never re-addresses an existing one
+/// — but a payload arriving from elsewhere is untrusted input, and merging it field by field keeps the
+/// outcome a recorded conflict rather than a silent adoption.
+/// </para>
+/// </remarks>
+public static class KnownHostSecretMerge
+{
+    /// <summary>Produces the merged pin.</summary>
+    /// <param name="ancestor">The version both sides branched from.</param>
+    /// <param name="local">The pending local version.</param>
+    /// <param name="remote">The server's current version.</param>
+    public static KnownHostMergeResult Merge(
+        KnownHostSecret ancestor,
+        KnownHostSecret local,
+        KnownHostSecret remote)
+    {
+        ArgumentNullException.ThrowIfNull(ancestor);
+        ArgumentNullException.ThrowIfNull(local);
+        ArgumentNullException.ThrowIfNull(remote);
+
+        var conflicts = new List<HostFieldConflict>();
+
+        var merged = new KnownHostSecret
+        {
+            Host = Field(
+                nameof(KnownHostSecret.Host),
+                ancestor.Host,
+                local.Host,
+                remote.Host,
+                conflicts,
+                static host => host,
+                StringComparer.Ordinal),
+            Port = Field(
+                nameof(KnownHostSecret.Port),
+                ancestor.Port,
+                local.Port,
+                remote.Port,
+                conflicts,
+                static port => port.ToString(CultureInfo.InvariantCulture)),
+            Algorithm = Field(
+                nameof(KnownHostSecret.Algorithm),
+                ancestor.Algorithm,
+                local.Algorithm,
+                remote.Algorithm,
+                conflicts,
+                static algorithm => algorithm,
+                StringComparer.Ordinal),
+            Fingerprint = Field(
+                nameof(KnownHostSecret.Fingerprint),
+                ancestor.Fingerprint,
+                local.Fingerprint,
+                remote.Fingerprint,
+                conflicts,
+                static fingerprint => fingerprint,
+                StringComparer.Ordinal),
+        };
+
+        return new KnownHostMergeResult(merged, conflicts);
+    }
+
+    private static T Field<T>(
+        string name,
+        T ancestor,
+        T local,
+        T remote,
+        List<HostFieldConflict> conflicts,
+        Func<T, string?> format,
+        IEqualityComparer<T>? comparer = null)
+    {
+        var merge = ThreeWayMerge.Scalar(ancestor, local, remote, comparer);
+
+        if (merge.IsConflicted)
+        {
+            // The local side always loses a scalar clash — see ThreeWayMerge — so the discarded side is
+            // fixed here rather than derived from the outcome.
+            conflicts.Add(new HostFieldConflict(
+                name,
+                MergeSide.Local,
+                format(merge.Value),
+                format(merge.Discarded!),
+                DiscardedWasRemoval: false));
+        }
+
+        return merge.Value;
+    }
+}

src/DodoSSH.Client.Session/DodoSSH.Client.Session.csproj

@@ -14,6 +14,14 @@
     <ProjectReference Include="../DodoSSH.Client.Api/DodoSSH.Client.Api.csproj" />
     <ProjectReference Include="../DodoSSH.Client.Auth/DodoSSH.Client.Auth.csproj" />
     <ProjectReference Include="../DodoSSH.Client.Domain/DodoSSH.Client.Domain.csproj" />
+    <!--
+      The SSH layer, for one type: VaultKnownHostStore, which is the IKnownHostStore the application
+      actually composes. It has to live on this side of the seam, because it is the only thing that needs
+      both the interface the handshake asks and the vault the answer comes from — and it must not live in
+      Client.Ssh, which has no project references at all so that connections, authentication and PTY
+      handling stay testable with no cache, no keyring and no server.
+    -->
+    <ProjectReference Include="../DodoSSH.Client.Ssh/DodoSSH.Client.Ssh.csproj" />
     <ProjectReference Include="../DodoSSH.Client.Storage/DodoSSH.Client.Storage.csproj" />
     <ProjectReference Include="../DodoSSH.Client.Sync/DodoSSH.Client.Sync.csproj" />
   </ItemGroup>

src/DodoSSH.Client.Session/VaultKnownHostStore.cs

@@ -0,0 +1,364 @@
+using DodoSSH.Client.Domain;
+using DodoSSH.Client.Ssh;
+using DodoSSH.Client.Sync;
+
+namespace DodoSSH.Client.Session;
+
+/// <summary>
+/// Host key trust kept in the vault, answered from memory.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>Why a snapshot and not a lookup.</b> <see cref="FindAsync"/> is called from inside SSH.NET's
+/// synchronous host key event, which the connection factory has no choice but to block on — see
+/// <c>SshNetConnectionFactory</c>, where the comment explains why that cannot be avoided. A store that read
+/// SQLite and ran an AEAD open per lookup would put a disk round trip and a decryption on the thread
+/// completing the key exchange, once per host key offered, on every connection. So the vault is read when it
+/// unlocks and after each synchronisation pass, and the handshake gets a dictionary lookup.
+/// </para>
+/// <para>
+/// <b>What that costs, stated rather than hidden.</b> Trust recorded on another machine is not visible until
+/// the next pass brings it down, which is within the minute the shell already syncs on. The failure that
+/// causes is a first-contact prompt for a host somebody else approved seconds ago — a prompt the user can
+/// answer correctly, since the fingerprint is on screen — and it resolves itself. The reverse mistake would
+/// be the serious one, and it cannot happen here: a pin recorded on this machine goes into the snapshot as
+/// part of recording it, and invalidates any read that was already in flight.
+/// </para>
+/// <para>
+/// <b>Process-lifetime object, session-scoped contents.</b> The connection factory is composed once, at
+/// startup, and outlives every unlock; the vault behind this store does not. So the lifecycle is explicit:
+/// <see cref="OpenAsync"/> when a vault unlocks, <see cref="RefreshAsync"/> after a pass,
+/// <see cref="Close"/> when it locks. While closed every lookup answers "not pinned", which refuses
+/// connections rather than allowing them — the safe direction for the one case that can reach it, a vault
+/// locked while a handshake was in flight.
+/// </para>
+/// </remarks>
+public sealed class VaultKnownHostStore : IKnownHostStore
+{
+    private readonly Lock gate = new();
+
+    private Dictionary<string, PinnedHostKey> pins = new(KnownHostIdentity.Comparer);
+    private Binding? binding;
+
+    /// <summary>
+    /// Bumped whenever the snapshot changes underneath a read, so a read in flight cannot install a stale
+    /// answer over a newer one.
+    /// </summary>
+    /// <remarks>
+    /// The races are ordinary rather than theoretical. A background pass ends with a refresh, and between
+    /// that refresh's listing and its assignment the user may lock the vault, approve a new host key, or
+    /// withdraw trust from one — and every one of those would otherwise be undone a moment later by the
+    /// arriving snapshot.
+    /// </remarks>
+    private int generation;
+
+    /// <summary>Whether a vault is open behind this store.</summary>
+    public bool IsOpen
+    {
+        get
+        {
+            lock (gate)
+            {
+                return binding is not null;
+            }
+        }
+    }
+
+    /// <summary>Reads an unlocked vault's pins, and starts writing new ones to it.</summary>
+    /// <param name="session">The unlocked session. Its active vault is the one used.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <remarks>
+    /// The previous session's pins are dropped before the new vault is read, not after. Between the two
+    /// every host looks unvisited, which is one listing long and errs towards asking; keeping them would
+    /// mean one account's trust decisions briefly answering for another's.
+    /// </remarks>
+    public async Task OpenAsync(VaultSession session, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(session);
+
+        var opened = new Binding(session.KnownHosts, session.ActiveVaultId);
+        int stamp;
+
+        lock (gate)
+        {
+            binding = opened;
+            pins = new Dictionary<string, PinnedHostKey>(KnownHostIdentity.Comparer);
+            stamp = ++generation;
+        }
+
+        var snapshot = await ReadAsync(opened, cancellationToken).ConfigureAwait(false);
+
+        Install(stamp, snapshot);
+    }
+
+    /// <summary>
+    /// Re-reads the vault, picking up trust recorded on another machine.
+    /// </summary>
+    /// <remarks>
+    /// Does nothing while closed, so a synchronisation pass that finishes after the vault was locked cannot
+    /// bring its contents back.
+    /// </remarks>
+    public async Task RefreshAsync(CancellationToken cancellationToken)
+    {
+        Binding? current;
+        int stamp;
+
+        lock (gate)
+        {
+            current = binding;
+            stamp = generation;
+        }
+
+        if (current is null)
+        {
+            return;
+        }
+
+        var snapshot = await ReadAsync(current, cancellationToken).ConfigureAwait(false);
+
+        Install(stamp, snapshot);
+    }
+
+    /// <summary>Forgets the vault and everything read from it. What locking means here.</summary>
+    public void Close()
+    {
+        lock (gate)
+        {
+            binding = null;
+            pins = new Dictionary<string, PinnedHostKey>(KnownHostIdentity.Comparer);
+            generation++;
+        }
+    }
+
+    /// <inheritdoc />
+    public ValueTask<string?> FindAsync(
+        string host,
+        int port,
+        string algorithm,
+        CancellationToken cancellationToken)
+    {
+        lock (gate)
+        {
+            var identity = KnownHostIdentity.For(host, port, algorithm);
+
+            return ValueTask.FromResult(pins.GetValueOrDefault(identity)?.Secret.Fingerprint);
+        }
+    }
+
+    /// <inheritdoc />
+    /// <exception cref="InvalidOperationException">
+    /// The vault is not open, so there is nowhere to record trust.
+    /// </exception>
+    public async ValueTask TrustAsync(
+        HostKeyPresentation presentation,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(presentation);
+
+        var bound = Require();
+
+        var identity = KnownHostIdentity.For(
+            presentation.Host, presentation.Port, presentation.Algorithm);
+
+        var existing = Pinned(identity);
+
+        if (existing is not null
+            && SshHostKeyFingerprint.Equal(existing.Secret.Fingerprint, presentation.Fingerprint))
+        {
+            // Already trusted, to the byte. Writing it again would queue an outbox operation that changes
+            // nothing and push it to every other machine as a modification.
+            return;
+        }
+
+        var pin = new KnownHostSecret
+        {
+            Host = presentation.Host,
+            Port = presentation.Port,
+            Algorithm = presentation.Algorithm,
+            Fingerprint = presentation.Fingerprint,
+        };
+
+        var entityId = await StoreAsync(bound, existing, pin, cancellationToken).ConfigureAwait(false);
+
+        lock (gate)
+        {
+            if (!ReferenceEquals(binding, bound))
+            {
+                // The vault was locked, or another one was opened, while this was being written. The item is
+                // in that vault's outbox and will be there when it is next opened; it must not answer for
+                // whatever is open now.
+                return;
+            }
+
+            pins[identity] = new PinnedHostKey(entityId, pin);
+            generation++;
+        }
+    }
+
+    /// <inheritdoc />
+    /// <exception cref="InvalidOperationException">
+    /// The vault is not open, so there is nothing to forget.
+    /// </exception>
+    public async ValueTask<int> ForgetAsync(
+        string host,
+        int port,
+        CancellationToken cancellationToken)
+    {
+        var bound = Require();
+
+        // Read from the vault rather than from the snapshot, and this is the one operation that must:
+        // withdrawing trust has to reach every pin for the endpoint, including a duplicate the snapshot
+        // shadowed. A pin left behind is a host that keeps refusing to connect for a reason the user
+        // believes they have already dealt with.
+        var listing = await bound.KnownHosts
+            .ListAsync(bound.VaultId, cancellationToken)
+            .ConfigureAwait(false);
+
+        var doomed = listing.Items
+            .Where(item =>
+                KnownHostIdentity.Comparer.Equals(item.Secret.Host, host) && item.Secret.Port == port)
+            .ToArray();
+
+        foreach (var item in doomed)
+        {
+            await bound.KnownHosts
+                .DeleteAsync(bound.VaultId, item.EntityId, cancellationToken)
+                .ConfigureAwait(false);
+        }
+
+        Invalidate();
+
+        // Re-read rather than patched. The next listing is what these deletions mean, and reproducing that
+        // arithmetic against the snapshot is how the two would come to disagree.
+        await RefreshAsync(cancellationToken).ConfigureAwait(false);
+
+        return doomed.Length;
+    }
+
+    /// <summary>The vault this store writes to, and which vault inside it.</summary>
+    private sealed record Binding(KnownHostRepository KnownHosts, Guid VaultId);
+
+    /// <summary>A pin, and the vault item it came from, so re-trusting updates rather than duplicates.</summary>
+    /// <param name="EntityId">The item holding this pin.</param>
+    /// <param name="Secret">The pin.</param>
+    private sealed record PinnedHostKey(Guid EntityId, KnownHostSecret Secret)
+    {
+        /// <summary>Whether this build may re-encode the item, or a newer one wrote it.</summary>
+        internal bool IsWritable { get; init; } = true;
+    }
+
+    /// <summary>
+    /// Records a pin, updating the item that already held one for this endpoint where there is one.
+    /// </summary>
+    /// <remarks>
+    /// An item a newer client wrote is left alone and a fresh one is created beside it. Re-encoding it would
+    /// drop fields this build has no concept of, which is the rule the whole client follows for read-only
+    /// items — and refusing outright, as the editors do, would leave the user unable to connect to a rebuilt
+    /// server at all. The new item wins the lookup by the tie-break in <see cref="ReadAsync"/>, and a client
+    /// that understands both can reconcile them.
+    /// </remarks>
+    private static async Task<Guid> StoreAsync(
+        Binding bound,
+        PinnedHostKey? existing,
+        KnownHostSecret pin,
+        CancellationToken cancellationToken)
+    {
+        if (existing is { IsWritable: true } writable)
+        {
+            await bound.KnownHosts
+                .UpdateAsync(bound.VaultId, writable.EntityId, pin, cancellationToken)
+                .ConfigureAwait(false);
+
+            return writable.EntityId;
+        }
+
+        return await bound.KnownHosts
+            .CreateAsync(bound.VaultId, pin, cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// Reads every readable pin in the vault into a lookup.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Two items can name the same endpoint and algorithm: two machines that first met a host while unable
+    /// to reach each other each minted one. Where they agree — the ordinary case, since they saw the same
+    /// server — the duplicate is invisible. Where they do not, the later item wins, ordered by an id that is
+    /// a UUIDv7 and therefore by when the trust was recorded. Any total order would do for correctness; what
+    /// matters is that every machine picks the same one, and that the wrong choice is recoverable rather than
+    /// permanent, which <see cref="ForgetAsync"/> makes it.
+    /// </para>
+    /// <para>
+    /// A pin that will not decrypt is skipped, and its endpoint then looks unvisited. That is the safe
+    /// reading: an unreadable pin cannot be compared against anything, so the only honest answers are "ask
+    /// the user" and "refuse", and asking is the one that leaves them a way forward. The count is not lost —
+    /// the vault view reports undecryptable items of every kind.
+    /// </para>
+    /// </remarks>
+    private static async Task<Dictionary<string, PinnedHostKey>> ReadAsync(
+        Binding bound,
+        CancellationToken cancellationToken)
+    {
+        var listing = await bound.KnownHosts
+            .ListAsync(bound.VaultId, cancellationToken)
+            .ConfigureAwait(false);
+
+        var snapshot = new Dictionary<string, PinnedHostKey>(KnownHostIdentity.Comparer);
+
+        foreach (var item in listing.Items.OrderBy(item => item.EntityId))
+        {
+            var identity = KnownHostIdentity.For(
+                item.Secret.Host, item.Secret.Port, item.Secret.Algorithm);
+
+            snapshot[identity] = new PinnedHostKey(item.EntityId, item.Secret)
+            {
+                IsWritable = !item.IsReadOnly,
+            };
+        }
+
+        return snapshot;
+    }
+
+    /// <remarks>
+    /// Replaces the snapshot wholesale rather than merging into it, which is what makes a pin withdrawn on
+    /// another machine actually disappear here. Anything recorded on this machine while the read was in
+    /// flight has already bumped the generation, so it is this snapshot that gets dropped and not that pin.
+    /// </remarks>
+    private void Install(int stamp, Dictionary<string, PinnedHostKey> snapshot)
+    {
+        lock (gate)
+        {
+            if (stamp == generation)
+            {
+                pins = snapshot;
+            }
+        }
+    }
+
+    private void Invalidate()
+    {
+        lock (gate)
+        {
+            generation++;
+        }
+    }
+
+    private PinnedHostKey? Pinned(string identity)
+    {
+        lock (gate)
+        {
+            return pins.GetValueOrDefault(identity);
+        }
+    }
+
+    private Binding Require()
+    {
+        lock (gate)
+        {
+            return binding
+                ?? throw new InvalidOperationException(
+                    "The vault is locked, so host key trust cannot be changed.");
+        }
+    }
+}

src/DodoSSH.Client.Session/VaultSession.cs

@@ -77,6 +77,7 @@ public sealed class VaultSession : IAsyncDisposable
         Hosts = new HostRepository(Items, Outbox, keyring);
         SshKeys = new SshKeyRepository(Items, Outbox, keyring);
         Credentials = new CredentialRepository(Items, Outbox, keyring);
+        KnownHosts = new KnownHostRepository(Items, Outbox, keyring);
     }
 
     /// <summary>Who this session belongs to, and the material that unlocked it.</summary>
@@ -101,6 +102,14 @@ public sealed class VaultSession : IAsyncDisposable
     /// <summary>Usernames and passwords, decrypted, with unpushed local changes laid over them.</summary>
     public CredentialRepository Credentials { get; }
 
+    /// <summary>The host keys this vault trusts, decrypted, with unpushed local changes laid over them.</summary>
+    /// <remarks>
+    /// Read through <see cref="VaultKnownHostStore"/> rather than directly by anything that connects. The
+    /// handshake asks about host key trust from inside a synchronous SSH.NET event, and listing decrypts every
+    /// pin in the vault — see that type for why the two must not meet.
+    /// </remarks>
+    public KnownHostRepository KnownHosts { get; }
+
     /// <summary>Vaults whose grant could not be opened, so their items cannot be read.</summary>
     public IReadOnlyList<Guid> UnreadableVaults => keyring.Unopened;
 

src/DodoSSH.Client.Session/packages.lock.json

@@ -138,6 +138,12 @@
       "dodossh.client.domain": {
         "type": "Project"
       },
+      "dodossh.client.ssh": {
+        "type": "Project",
+        "dependencies": {
+          "SSH.NET": "[2025.1.0, )"
+        }
+      },
       "dodossh.client.storage": {
         "type": "Project",
         "dependencies": {
@@ -166,6 +172,12 @@
           "NSec.Cryptography": "[26.4.0, )"
         }
       },
+      "BouncyCastle.Cryptography": {
+        "type": "CentralTransitive",
+        "requested": "[2.6.2, )",
+        "resolved": "2.6.2",
+        "contentHash": "7oWOcvnntmMKNzDLsdxAYqApt+AjpRpP2CShjMfIa3umZ42UQMvH0tl1qAliYPNYO6vTdcGMqnRrCPmsfzTI1w=="
+      },
       "EFCore.NamingConventions": {
         "type": "CentralTransitive",
         "requested": "[10.0.1, )",
@@ -261,6 +273,16 @@
         "dependencies": {
           "SQLitePCLRaw.core": "2.1.12"
         }
+      },
+      "SSH.NET": {
+        "type": "CentralTransitive",
+        "requested": "[2025.1.0, )",
+        "resolved": "2025.1.0",
+        "contentHash": "jrnbtf0ItVaXAe6jE8X/kSLa6uC+0C+7W1vepcnRQB/rD88qy4IxG7Lf1FIbWmkoc4iVXv0pKrz+Wc6J4ngmHw==",
+        "dependencies": {
+          "BouncyCastle.Cryptography": "2.6.2",
+          "Microsoft.Extensions.Logging.Abstractions": "8.0.3"
+        }
       }
     }
   }

src/DodoSSH.Client.Ssh/HostKeyTrust.cs

@@ -1,3 +1,5 @@
+using System.Globalization;
+
 namespace DodoSSH.Client.Ssh;
 
 /// <summary>A host key as the server presented it during the handshake.</summary>
@@ -7,6 +9,35 @@ namespace DodoSSH.Client.Ssh;
 /// <param name="Fingerprint">OpenSSH-style fingerprint, from <see cref="SshHostKeyFingerprint"/>.</param>
 public sealed record HostKeyPresentation(string Host, int Port, string Algorithm, string Fingerprint);
 
+/// <summary>
+/// What makes two pins the same pin.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Shared by every <see cref="IKnownHostStore"/> rather than written per implementation, because the two that
+/// exist have to agree: one is what ships and the other is what this project's own SSH tests run against, and
+/// an identity rule that differed between them would mean the tested behaviour was not the shipped behaviour.
+/// </para>
+/// <para>
+/// <b>Case-insensitive, and the host is stored verbatim anyway.</b> DNS names are case-insensitive, so
+/// <c>DB.internal</c> and <c>db.internal</c> are one machine and must be one pin — a store that treated them
+/// as two would ask the user to approve the same server twice. Comparing case-insensitively rather than
+/// lower-casing what gets stored keeps the stored value the one that was actually dialled, which matters for
+/// an internationalised name or an IPv6 literal with a zone id: rewriting those means rewriting a value this
+/// layer does not fully understand. Algorithm names are compared the same way for the same reason, one step
+/// weaker — they are ASCII tokens, and no server has been seen to vary their case.
+/// </para>
+/// </remarks>
+public static class KnownHostIdentity
+{
+    /// <summary>The comparer an identity must be compared with.</summary>
+    public static StringComparer Comparer => StringComparer.OrdinalIgnoreCase;
+
+    /// <summary>The identity of one pin, as a single comparable value.</summary>
+    public static string For(string host, int port, string algorithm) =>
+        string.Create(CultureInfo.InvariantCulture, $"{host}:{port}/{algorithm}");
+}
+
 /// <summary>
 /// The trusted host keys a user has accumulated.
 /// </summary>
@@ -19,14 +50,34 @@ public interface IKnownHostStore
 {
     /// <summary>Returns the pinned fingerprint for a host and key algorithm, if there is one.</summary>
     /// <remarks>
+    /// <para>
     /// Keyed on algorithm as well as host, because a server legitimately offers several host keys and
     /// which one is negotiated can change between connections. Pinning only one and rejecting the
     /// others would make a normal server look hostile.
+    /// </para>
+    /// <para>
+    /// <b>Implementations must answer this without I/O.</b> It is called from inside SSH.NET's synchronous
+    /// host key event — see <c>SshNetConnectionFactory</c> — so the caller has no choice but to block the
+    /// thread completing the key exchange on it. Asynchronous in signature because a store may need to be
+    /// asynchronous to <em>fill</em> itself; not because this call may go and look something up.
+    /// </para>
     /// </remarks>
     ValueTask<string?> FindAsync(string host, int port, string algorithm, CancellationToken cancellationToken);
 
     /// <summary>Records a host key as trusted.</summary>
     ValueTask TrustAsync(HostKeyPresentation presentation, CancellationToken cancellationToken);
+
+    /// <summary>
+    /// Withdraws trust from every key pinned for one endpoint, whatever the algorithm.
+    /// </summary>
+    /// <remarks>
+    /// The counterpart to a pin that now outlives the process, and not an optional extra: a server that is
+    /// legitimately rebuilt gets a new host key, <see cref="SshHostKeyMismatchException"/> is a hard refusal
+    /// with no way past it, and without this the host would be unreachable for ever. Every algorithm goes at
+    /// once because the user's decision is about the machine, not about one of the keys it happens to offer.
+    /// </remarks>
+    /// <returns>How many pins were removed, so a caller can say whether there was anything to forget.</returns>
+    ValueTask<int> ForgetAsync(string host, int port, CancellationToken cancellationToken);
 }
 
 /// <summary>
@@ -53,9 +104,9 @@ public sealed class SshHostKeyUnknownException(HostKeyPresentation presentation)
 /// <remarks>
 /// This must stay a hard block with no "continue anyway" in the connect path. A dialog offering to
 /// proceed is how users are trained to click through the one warning that actually indicates an
-/// interception. A legitimate key change — a rebuilt server — is handled by explicitly removing the
+/// interception. A legitimate key change — a rebuilt server — is handled by explicitly forgetting the
 /// pin in the host's settings, which is a deliberate act performed away from the moment of
-/// connecting.
+/// connecting. See <see cref="IKnownHostStore.ForgetAsync"/>.
 /// </remarks>
 public sealed class SshHostKeyMismatchException(HostKeyPresentation presentation, string pinnedFingerprint)
     : Exception(
@@ -73,13 +124,21 @@ public sealed class SshHostKeyMismatchException(HostKeyPresentation presentation
 /// A known-host store held in memory.
 /// </summary>
 /// <remarks>
-/// Stands in until the encrypted local cache lands. Trust is lost when the process exits, so a user
-/// is asked about every host on every launch — noisy, but the noise is the correct failure mode for a
-/// placeholder: it cannot be mistaken for working persistence.
+/// <para>
+/// <b>Not the one that ships.</b> <c>VaultKnownHostStore</c> is: it keeps trust in the vault, so a
+/// fingerprint approved once is approved on every device and survives a restart. This is what a store looks
+/// like with nothing behind it, and it exists because this project deliberately has no project references at
+/// all — that is the seam which keeps connections, authentication and PTY handling testable without a cache,
+/// a keyring or a server, and those tests still need somewhere to put a pin.
+/// </para>
+/// <para>
+/// Trust is lost when the process exits, so a user of this store would be asked about every host on every
+/// launch. Nothing in the application composes it.
+/// </para>
 /// </remarks>
 public sealed class InMemoryKnownHostStore : IKnownHostStore
 {
-    private readonly Dictionary<string, string> pins = new(StringComparer.Ordinal);
+    private readonly Dictionary<string, HostKeyPresentation> pins = new(KnownHostIdentity.Comparer);
     private readonly Lock gate = new();
 
     /// <inheritdoc />
@@ -91,7 +150,9 @@ public sealed class InMemoryKnownHostStore : IKnownHostStore
     {
         lock (gate)
         {
-            return ValueTask.FromResult(pins.GetValueOrDefault(Key(host, port, algorithm)));
+            var key = KnownHostIdentity.For(host, port, algorithm);
+
+            return ValueTask.FromResult(pins.GetValueOrDefault(key)?.Fingerprint);
         }
     }
 
@@ -102,13 +163,35 @@ public sealed class InMemoryKnownHostStore : IKnownHostStore
 
         lock (gate)
         {
-            pins[Key(presentation.Host, presentation.Port, presentation.Algorithm)] =
-                presentation.Fingerprint;
+            var key = KnownHostIdentity.For(
+                presentation.Host, presentation.Port, presentation.Algorithm);
+
+            pins[key] = presentation;
         }
 
         return ValueTask.CompletedTask;
     }
 
-    private static string Key(string host, int port, string algorithm) =>
-        $"{host}:{port}/{algorithm}";
+    /// <inheritdoc />
+    public ValueTask<int> ForgetAsync(string host, int port, CancellationToken cancellationToken)
+    {
+        lock (gate)
+        {
+            // Matched on the stored values rather than by picking apart the composite key. The key exists to
+            // be looked up whole; taking it back apart to find an endpoint would be one parser too many, and
+            // a host that is an IPv6 literal is full of colons.
+            var doomed = pins
+                .Where(pin =>
+                    KnownHostIdentity.Comparer.Equals(pin.Value.Host, host) && pin.Value.Port == port)
+                .Select(pin => pin.Key)
+                .ToArray();
+
+            foreach (var key in doomed)
+            {
+                pins.Remove(key);
+            }
+
+            return ValueTask.FromResult(doomed.Length);
+        }
+    }
 }

src/DodoSSH.Client.Sync/ItemKinds.cs

@@ -27,7 +27,8 @@ internal sealed record MergedItem<TSecret>(
 /// <remarks>
 /// <para>
 /// The reconciler holds the six answers a collision can have — merge, adopt, resurrect, abandon, park,
-/// refuse — and every one of them is identical for a host, an SSH key and a credential. Only the encoding,
+/// refuse — and every one of them is identical for a host, an SSH key, a credential and a pinned host key.
+/// Only the encoding,
 /// the merge and the plaintext columns differ, and those arrive through here. A second copy of the
 /// reconciler per item type is the alternative, and it is not a real one: the file's whole premise is
 /// that the pull and push paths must answer the same situation the same way, and two copies would drift
@@ -116,6 +117,9 @@ internal static class ItemKinds
 
         (SyncEntityType.Credential, static (outbox, conflicts, keyring) =>
             new ItemReconciler<CredentialSecret>(CredentialKind.Instance, outbox, conflicts, keyring)),
+
+        (SyncEntityType.KnownHostKey, static (outbox, conflicts, keyring) =>
+            new ItemReconciler<KnownHostSecret>(KnownHostKeyKind.Instance, outbox, conflicts, keyring)),
     ];
 
     /// <summary>The types to ask the server for, in a fixed order.</summary>
@@ -316,3 +320,88 @@ internal sealed class CredentialKind : IItemKind<CredentialSecret>
         return secret with { Label = label };
     }
 }
+
+/// <summary>Known host keys.</summary>
+internal sealed class KnownHostKeyKind : IItemKind<KnownHostSecret>
+{
+    internal static KnownHostKeyKind Instance { get; } = new();
+
+    /// <inheritdoc />
+    public SyncEntityType EntityType => SyncEntityType.KnownHostKey;
+
+    /// <summary>
+    /// What to call one of these to a person.
+    /// </summary>
+    /// <remarks>
+    /// "Known host key" rather than "host key", because a user who reads "this host key could not be
+    /// decrypted" would go looking at the host they are connecting to. The item is the record of a decision
+    /// they made about that host, and the noun has to say so.
+    /// </remarks>
+    /// <inheritdoc />
+    public string Noun => "known host key";
+
+    /// <inheritdoc />
+    public OpenedItem<KnownHostSecret>? TryOpen(
+        EncryptedPayload payload,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        int itemVersion)
+    {
+        var document = KnownHostKeyCipher.TryOpen(payload, vaultKey, entityId, itemVersion);
+
+        return document is null
+            ? null
+            : new OpenedItem<KnownHostSecret>(document.KnownHost, document.IsReadOnly);
+    }
+
+    /// <inheritdoc />
+    public EncryptedPayload Seal(
+        KnownHostSecret secret,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        uint keyGeneration,
+        int itemVersion) =>
+        KnownHostKeyCipher.Seal(secret, vaultKey, entityId, keyGeneration, itemVersion);
+
+    /// <summary>
+    /// Nothing, and here the temptation is the strongest of the four.
+    /// </summary>
+    /// <remarks>
+    /// This item holds an address and a fingerprint, and neither is confidential in itself: the operator
+    /// published the fingerprint and the address is one the server may already hold for a relay-enabled host.
+    /// Handing them over anyway would tell the operator which machines each user actually connects to and
+    /// when they first did — a map of the estate assembled out of individually harmless facts, for columns
+    /// that do not exist and nothing that would read them. See ADR 0004.
+    /// </remarks>
+    /// <inheritdoc />
+    public SyncPlaintextFields? Fields(KnownHostSecret secret) => null;
+
+    /// <inheritdoc />
+    public MergedItem<KnownHostSecret> Merge(
+        KnownHostSecret ancestor,
+        KnownHostSecret local,
+        KnownHostSecret remote)
+    {
+        var merged = KnownHostSecretMerge.Merge(ancestor, local, remote);
+
+        return new MergedItem<KnownHostSecret>(merged.Merged, merged.Conflicts);
+    }
+
+    /// <summary>
+    /// The pin unchanged, because a pin has no name of its own to change.
+    /// </summary>
+    /// <remarks>
+    /// The only caller is the reconciler's resurrection path, which renames rescued content so a user can see
+    /// what happened to it. <see cref="KnownHostSecret.Label"/> is derived from the host, port and algorithm
+    /// the pin is about, so there is nothing here that a rename could move: renaming it would mean claiming
+    /// the pin is about a different host. The resurrected item still gets its own id and still produces a
+    /// conflict notice, so the event is visible — the notice simply names the pin the same way twice.
+    /// </remarks>
+    /// <inheritdoc />
+    public KnownHostSecret Relabel(KnownHostSecret secret, string label)
+    {
+        ArgumentNullException.ThrowIfNull(secret);
+
+        return secret;
+    }
+}

src/DodoSSH.Client.Sync/KnownHostKeyCipher.cs

@@ -0,0 +1,131 @@
+using System.Security.Cryptography;
+using DodoSSH.Client.Domain;
+using DodoSSH.Contracts;
+using DodoSSH.Crypto;
+
+namespace DodoSSH.Client.Sync;
+
+/// <summary>
+/// Turns a known host key into an item payload and back.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Mirrors <see cref="HostCipher"/> exactly, including the rule that a payload is sealed at the version the
+/// server <em>will</em> assign rather than the one it replaces — see <see cref="SyncVersions"/>.
+/// </para>
+/// <para>
+/// <b>The resource type is the one thing not to copy.</b> As with <see cref="CredentialCipher"/>, the AAD
+/// binds it and the two enums that name item types do not agree: <c>SyncEntityType.KnownHostKey</c> is 10
+/// while <c>CryptoSpec.AadResourceType.KnownHostKey</c> is 11, because the crypto enum carries None, User,
+/// Device and Vault ahead of the item types. Casting one to the other would seal a pin under the resource
+/// type for a <em>port forward</em> — which encrypts perfectly, decrypts perfectly on the machine that wrote
+/// it, and is a specification violation nothing would notice until an interoperating client refused the item.
+/// </para>
+/// </remarks>
+public static class KnownHostKeyCipher
+{
+    private const CryptoSpec.AadResourceType Resource = CryptoSpec.AadResourceType.KnownHostKey;
+
+    /// <summary>Encrypts a pin.</summary>
+    /// <param name="knownHost">The pin. Must be valid for storage.</param>
+    /// <param name="vaultKey">The vault key, which the data key is wrapped under.</param>
+    /// <param name="entityId">The item id, which the AAD binds.</param>
+    /// <param name="keyGeneration">The vault's current key generation.</param>
+    /// <param name="itemVersion">The version this payload will hold once the server accepts it.</param>
+    public static EncryptedPayload Seal(
+        KnownHostSecret knownHost,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        uint keyGeneration,
+        int itemVersion)
+    {
+        ArgumentNullException.ThrowIfNull(knownHost);
+        ArgumentOutOfRangeException.ThrowIfLessThan(itemVersion, 1);
+
+        var plaintext = KnownHostSecretCodec.Encode(knownHost);
+        var dataKey = ItemKeys.CreateDataKey();
+
+        try
+        {
+            var dataKeyId = Guid.CreateVersion7();
+
+            var wrappedDataKey = ItemKeys.WrapDataKey(
+                dataKey, vaultKey, Resource, entityId, keyGeneration, (uint)itemVersion);
+
+            var envelope = ItemKeys.SealPayload(
+                dataKey, plaintext, Resource, entityId, dataKeyId, keyGeneration, (uint)itemVersion);
+
+            return new EncryptedPayload(
+                envelope, wrappedDataKey, dataKeyId, keyGeneration, CryptoSpec.CurrentAadVersion);
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(dataKey);
+
+            // Wiped like every other payload in this folder, and for a smaller reason than the others: a
+            // fingerprint is published on purpose, so nothing in here is a secret in the sense a password is.
+            // What the buffer does hold is the address of a machine this user reaches, and leaving that in a
+            // pooled buffer for nothing would be a gratuitous difference from the neighbouring ciphers.
+            CryptographicOperations.ZeroMemory(plaintext);
+        }
+    }
+
+    /// <summary>Decrypts a pin.</summary>
+    /// <inheritdoc cref="HostCipher.TryOpen" path="/returns" />
+    public static KnownHostSecretDocument? TryOpen(
+        EncryptedPayload payload,
+        ReadOnlySpan<byte> vaultKey,
+        Guid entityId,
+        int itemVersion)
+    {
+        ArgumentNullException.ThrowIfNull(payload);
+
+        if (itemVersion < 1 || payload.WrappedDataKey.Length == 0)
+        {
+            return null;
+        }
+
+        var dataKey = ItemKeys.TryUnwrapDataKey(
+            vaultKey,
+            payload.WrappedDataKey,
+            Resource,
+            entityId,
+            payload.KeyGeneration,
+            (uint)itemVersion);
+
+        if (dataKey is null)
+        {
+            return null;
+        }
+
+        try
+        {
+            var plaintext = ItemKeys.TryOpenPayload(
+                dataKey,
+                payload.Envelope,
+                Resource,
+                entityId,
+                payload.DataKeyId,
+                payload.KeyGeneration,
+                (uint)itemVersion);
+
+            if (plaintext is null)
+            {
+                return null;
+            }
+
+            try
+            {
+                return KnownHostSecretCodec.TryDecode(plaintext, out var document) ? document : null;
+            }
+            finally
+            {
+                CryptographicOperations.ZeroMemory(plaintext);
+            }
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(dataKey);
+        }
+    }
+}

src/DodoSSH.Client.Sync/KnownHostRepository.cs

@@ -0,0 +1,51 @@
+using DodoSSH.Client.Domain;
+using DodoSSH.Client.Storage;
+
+namespace DodoSSH.Client.Sync;
+
+/// <summary>
+/// The host keys this vault trusts, decrypted, with unpushed local changes laid over them.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The fourth facade over the same generic repository, and it needed no new sync logic at all — which was the
+/// point of the item-kind seam.
+/// </para>
+/// <para>
+/// <b>Nothing here is on the SSH handshake path.</b> Listing decrypts every pin in the vault, and the
+/// handshake asks about host key trust from inside a synchronous SSH.NET event where a decryption per lookup
+/// would be I/O and AEAD work on the thread completing the key exchange. <c>VaultKnownHostStore</c> exists to
+/// keep those apart: it reads through here when a vault opens and after each synchronisation pass, and answers
+/// the handshake from an in-memory snapshot.
+/// </para>
+/// </remarks>
+public sealed class KnownHostRepository(ItemStore items, OutboxStore outbox, VaultKeyring keyring)
+{
+    private readonly VaultItemRepository<KnownHostSecret> knownHosts =
+        new(KnownHostKeyKind.Instance, items, outbox, keyring);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.ListAsync" />
+    public Task<ItemListing<KnownHostSecret>> ListAsync(
+        Guid vaultId,
+        CancellationToken cancellationToken) =>
+        knownHosts.ListAsync(vaultId, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.CreateAsync" />
+    public Task<Guid> CreateAsync(
+        Guid vaultId,
+        KnownHostSecret knownHost,
+        CancellationToken cancellationToken) =>
+        knownHosts.CreateAsync(vaultId, knownHost, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.UpdateAsync" />
+    public Task UpdateAsync(
+        Guid vaultId,
+        Guid entityId,
+        KnownHostSecret knownHost,
+        CancellationToken cancellationToken) =>
+        knownHosts.UpdateAsync(vaultId, entityId, knownHost, cancellationToken);
+
+    /// <inheritdoc cref="VaultItemRepository{TSecret}.DeleteAsync" />
+    public Task DeleteAsync(Guid vaultId, Guid entityId, CancellationToken cancellationToken) =>
+        knownHosts.DeleteAsync(vaultId, entityId, cancellationToken);
+}

src/DodoSSH.Domain/Hosts.cs

@@ -233,3 +233,85 @@ public sealed class VaultCredential : IVaultItem
     /// <summary>Who last modified it.</summary>
     public Guid UpdatedByUserId { get; set; }
 }
+
+/// <summary>
+/// One SSH host key a user has decided to trust, as ciphertext.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The host, the port, the key algorithm and the fingerprint are all inside <see cref="Payload"/>, and this
+/// is the item type where that is least obvious and most deliberate. None of those four values is
+/// confidential on its own — an operator publishes the fingerprint so it can be checked, and a
+/// relay-enabled host's address is already in a plaintext column next door. Together and across a user's
+/// whole vault they are something else: which machines that person reaches, and when they first reached
+/// them. The server has no use for any of it, so it gets none of it, and there is no column here to put it
+/// in even by mistake.
+/// </para>
+/// <para>
+/// <b>Why the server holds these at all, given it cannot read them.</b> Trust-on-first-use is only as good
+/// as its memory. Kept locally, a pin dies with the machine and the user is asked to approve the same host
+/// on every device — training them to approve without looking, which is the one habit that makes the
+/// warning worthless. Kept here, trust follows the user, and because the payload is sealed the server
+/// cannot drop a pin to force a fresh first-use decision without the client noticing the item is gone.
+/// </para>
+/// <para>
+/// Otherwise this is <see cref="VaultCredential"/>'s shape exactly: an opaque envelope and the bookkeeping
+/// the write path needs to order changes. Its own table for the same reason — the columns a host needs are
+/// columns this must never have.
+/// </para>
+/// </remarks>
+public sealed class VaultKnownHostKey : IVaultItem
+{
+    /// <summary>Primary key. UUIDv7, generated by the client so a pin can be recorded offline.</summary>
+    public Guid Id { get; set; }
+
+    /// <summary>Owning vault.</summary>
+    public Guid VaultId { get; set; }
+
+    /// <summary>Owning vault.</summary>
+    public Vault? Vault { get; set; }
+
+    /// <summary>The encrypted pin: a DSH1 envelope. Opaque to the server.</summary>
+    public byte[] Payload { get; set; } = [];
+
+    /// <summary>The item's data key, wrapped under the vault key. Opaque.</summary>
+    public byte[]? DataKeyWrap { get; set; }
+
+    /// <summary>Reserved for per-item content keys wrapped to individual users; see docs/crypto.md §3.</summary>
+    public Guid? ContentKeyId { get; set; }
+
+    /// <summary>Vault key generation this payload was encrypted under.</summary>
+    public int KeyGeneration { get; set; }
+
+    /// <summary>AAD rule version, enabling a lazy re-encrypt-on-write migration later.</summary>
+    public short PayloadAadVersion { get; set; }
+
+    /// <summary>Client-visible, monotonic item version, used for <c>expectedVersion</c> checks.</summary>
+    public int Version { get; set; }
+
+    /// <summary>Latest change-log sequence touching this row, so a delta pull can join directly.</summary>
+    public long ChangeSequence { get; set; }
+
+    /// <summary>Creation timestamp.</summary>
+    public DateTimeOffset CreatedAtUtc { get; set; }
+
+    /// <summary>Last modification timestamp.</summary>
+    public DateTimeOffset UpdatedAtUtc { get; set; }
+
+    /// <summary>
+    /// Soft-delete marker; a tombstone, so an offline client learns the pin was withdrawn.
+    /// </summary>
+    /// <remarks>
+    /// A tombstone matters more here than for the other types. Withdrawing trust is the deliberate act a
+    /// user performs when a server has legitimately been rebuilt, and a pin that simply vanished from one
+    /// machine's view would come back on the next pull — leaving the rebuilt host permanently unreachable
+    /// from the machine that had the old key.
+    /// </remarks>
+    public DateTimeOffset? DeletedAtUtc { get; set; }
+
+    /// <summary>Who created it.</summary>
+    public Guid CreatedByUserId { get; set; }
+
+    /// <summary>Who last modified it.</summary>
+    public Guid UpdatedByUserId { get; set; }
+}

src/DodoSSH.Infrastructure/Configurations/HostAndSyncConfigurations.cs

@@ -90,9 +90,10 @@ public sealed class SshKeyConfiguration : IEntityTypeConfiguration<VaultSshKey>
 /// Maps <see cref="VaultCredential"/>.
 /// </summary>
 /// <remarks>
-/// The narrowest of the three item tables, and deliberately so: no relay CHECK, and unlike
-/// <see cref="SshKeyConfiguration"/> not even a fingerprint column. There is nothing about a password that
-/// is safe to hold in the clear, so there is nothing here but the envelope and its bookkeeping.
+/// The narrowest shape any item table takes — shared now with <see cref="KnownHostKeyConfiguration"/> — and
+/// deliberately so: no relay CHECK, and unlike <see cref="SshKeyConfiguration"/> not even a fingerprint
+/// column. There is nothing about a password that is safe to hold in the clear, so there is nothing here but
+/// the envelope and its bookkeeping.
 /// </remarks>
 public sealed class CredentialConfiguration : IEntityTypeConfiguration<VaultCredential>
 {
@@ -122,6 +123,43 @@ public sealed class CredentialConfiguration : IEntityTypeConfiguration<VaultCred
     }
 }
 
+/// <summary>
+/// Maps <see cref="VaultKnownHostKey"/>.
+/// </summary>
+/// <remarks>
+/// Identical to <see cref="CredentialConfiguration"/>, and the sameness is the statement: a pin has no
+/// plaintext column either. It would have been easy to add a <c>host</c> column here for a "known hosts"
+/// screen to list without decrypting, and that column would have handed the operator the map of every user's
+/// estate. The client decrypts its own vault; it does not need the server's help to sort a list.
+/// </remarks>
+public sealed class KnownHostKeyConfiguration : IEntityTypeConfiguration<VaultKnownHostKey>
+{
+    /// <inheritdoc />
+    public void Configure(EntityTypeBuilder<VaultKnownHostKey> builder)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+
+        builder.ToTable("known_host_key");
+        builder.HasKey(k => k.Id);
+
+        // Client-generated UUIDv7: a pin must be recordable offline, with its id.
+        builder.Property(k => k.Id).ValueGeneratedNever();
+        builder.UseXminConcurrencyToken();
+
+        builder.Property(k => k.Payload).IsRequired();
+
+        builder.HasIndex(k => new { k.VaultId, k.ChangeSequence });
+
+        builder.HasIndex(k => k.VaultId)
+            .HasFilter("deleted_at_utc IS NULL")
+            .HasDatabaseName("ix_known_host_key_vault_live");
+
+        builder.ToTable(t => t.HasCheckConstraint(
+            "ck_known_host_key_version",
+            "version >= 1"));
+    }
+}
+
 /// <summary>Maps <see cref="VaultChange"/>.</summary>
 public sealed class SyncChangeConfiguration : IEntityTypeConfiguration<VaultChange>
 {

src/DodoSSH.Infrastructure/DodoDbContext.cs

@@ -60,6 +60,9 @@ public class DodoDbContext(DbContextOptions<DodoDbContext> options) : DbContext(
     /// <summary>Usernames and passwords, held as ciphertext.</summary>
     public DbSet<VaultCredential> Credentials => Set<VaultCredential>();
 
+    /// <summary>Trusted SSH host keys, held as ciphertext.</summary>
+    public DbSet<VaultKnownHostKey> KnownHostKeys => Set<VaultKnownHostKey>();
+
     /// <summary>The per-vault change log that delta sync reads.</summary>
     public DbSet<VaultChange> VaultChanges => Set<VaultChange>();
 

src/DodoSSH.Infrastructure/Migrations/20260730075732_AddKnownHostKeyItem.cs

@@ -0,0 +1,70 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace DodoSSH.Infrastructure.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddKnownHostKeyItem : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "known_host_key",
+                schema: "dodo",
+                columns: table => new
+                {
+                    id = table.Column<Guid>(type: "uuid", nullable: false),
+                    vault_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    payload = table.Column<byte[]>(type: "bytea", nullable: false),
+                    data_key_wrap = table.Column<byte[]>(type: "bytea", nullable: true),
+                    content_key_id = table.Column<Guid>(type: "uuid", nullable: true),
+                    key_generation = table.Column<int>(type: "integer", nullable: false),
+                    payload_aad_version = table.Column<short>(type: "smallint", nullable: false),
+                    version = table.Column<int>(type: "integer", nullable: false),
+                    change_sequence = table.Column<long>(type: "bigint", nullable: false),
+                    created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
+                    updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
+                    deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
+                    created_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    updated_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
+                    xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("pk_known_host_key", x => x.id);
+                    table.CheckConstraint("ck_known_host_key_version", "version >= 1");
+                    table.ForeignKey(
+                        name: "fk_known_host_key_vaults_vault_id",
+                        column: x => x.vault_id,
+                        principalSchema: "dodo",
+                        principalTable: "vault",
+                        principalColumn: "id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_known_host_key_vault_id_change_sequence",
+                schema: "dodo",
+                table: "known_host_key",
+                columns: new[] { "vault_id", "change_sequence" });
+
+            migrationBuilder.CreateIndex(
+                name: "ix_known_host_key_vault_live",
+                schema: "dodo",
+                table: "known_host_key",
+                column: "vault_id",
+                filter: "deleted_at_utc IS NULL");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "known_host_key",
+                schema: "dodo");
+        }
+    }
+}

src/DodoSSH.Infrastructure/Migrations/DodoDbContextModelSnapshot.cs

@@ -907,6 +907,87 @@ namespace DodoSSH.Infrastructure.Migrations
                         });
                 });
 
+            modelBuilder.Entity("DodoSSH.Domain.VaultKnownHostKey", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .HasColumnType("uuid")
+                        .HasColumnName("id");
+
+                    b.Property<long>("ChangeSequence")
+                        .HasColumnType("bigint")
+                        .HasColumnName("change_sequence");
+
+                    b.Property<Guid?>("ContentKeyId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("content_key_id");
+
+                    b.Property<DateTimeOffset>("CreatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("created_at_utc");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("created_by_user_id");
+
+                    b.Property<byte[]>("DataKeyWrap")
+                        .HasColumnType("bytea")
+                        .HasColumnName("data_key_wrap");
+
+                    b.Property<DateTimeOffset?>("DeletedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("deleted_at_utc");
+
+                    b.Property<int>("KeyGeneration")
+                        .HasColumnType("integer")
+                        .HasColumnName("key_generation");
+
+                    b.Property<byte[]>("Payload")
+                        .IsRequired()
+                        .HasColumnType("bytea")
+                        .HasColumnName("payload");
+
+                    b.Property<short>("PayloadAadVersion")
+                        .HasColumnType("smallint")
+                        .HasColumnName("payload_aad_version");
+
+                    b.Property<DateTimeOffset>("UpdatedAtUtc")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<Guid>("UpdatedByUserId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("updated_by_user_id");
+
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("uuid")
+                        .HasColumnName("vault_id");
+
+                    b.Property<int>("Version")
+                        .HasColumnType("integer")
+                        .HasColumnName("version");
+
+                    b.Property<uint>("xmin")
+                        .IsConcurrencyToken()
+                        .ValueGeneratedOnAddOrUpdate()
+                        .HasColumnType("xid")
+                        .HasColumnName("xmin");
+
+                    b.HasKey("Id")
+                        .HasName("pk_known_host_key");
+
+                    b.HasIndex("VaultId")
+                        .HasDatabaseName("ix_known_host_key_vault_live")
+                        .HasFilter("deleted_at_utc IS NULL");
+
+                    b.HasIndex("VaultId", "ChangeSequence")
+                        .HasDatabaseName("ix_known_host_key_vault_id_change_sequence");
+
+                    b.ToTable("known_host_key", "dodo", t =>
+                        {
+                            t.HasCheckConstraint("ck_known_host_key_version", "version >= 1");
+                        });
+                });
+
             modelBuilder.Entity("DodoSSH.Domain.VaultSshKey", b =>
                 {
                     b.Property<Guid>("Id")
@@ -1121,6 +1202,18 @@ namespace DodoSSH.Infrastructure.Migrations
                     b.Navigation("Vault");
                 });
 
+            modelBuilder.Entity("DodoSSH.Domain.VaultKnownHostKey", b =>
+                {
+                    b.HasOne("DodoSSH.Domain.Vault", "Vault")
+                        .WithMany()
+                        .HasForeignKey("VaultId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired()
+                        .HasConstraintName("fk_known_host_key_vaults_vault_id");
+
+                    b.Navigation("Vault");
+                });
+
             modelBuilder.Entity("DodoSSH.Domain.VaultSshKey", b =>
                 {
                     b.HasOne("DodoSSH.Domain.Vault", "Vault")