Merge branch 'main' into claude/m3-implementation-57f9d7

Three files conflicted, and two of the resolutions are more than a choice of
side.

QuickConnectTests had both branches fixing the same build break — main's M2
merge left the shell's constructor with an ISftpSessionFactory nobody passed.
Main's version wins because it carries a comment saying why the palette never
needs a session.

VaultSession's conflict is adjacent edits: main added the remembered sign-in
members and this branch changed SyncAsync's summary from "the active vault" to
"one vault". Both kept.

VaultViewModel is the one that matters. Main taught the background pass to
report a sync that had to start over, on the grounds that a machine which
silently re-read a whole vault has had something happen to it; this branch
turned a pass into one report per readable vault. Taking either side alone
would have lost the other, so ResyncedFromStart is now one of the conditions
IsWorthReporting checks, per vault.

Merging also broke something neither branch could have caught alone, and the
build would not have said a word. SyncOnceAsync cleared LastSyncFailed
unconditionally, which was right while a pass was one vault and a failure was
an exception that never reached that line. A failure is now a report — one
unreachable team vault must not stop the others syncing — so the flag was being
cleared over a vault that had just failed, lighting the titlebar SYNCED. It is
computed from the report instead, in the one place both callers go through, so
the manual command gets it as well as the loop. The background pass still
swallows the message and keeps the fact, which is what
AnAutomaticPassThatFails_LeavesTheStatusAlone is there to hold it to.

Two comments the auto-merge left describing a world with one vault in it: the
SCOPES rail's, which said team vaults are refused by the access service, and
the host sidebar's "One heading, for one vault".

src/DodoSSH.Client.App/Views/ConfirmDeleteCard.axaml

@@ -0,0 +1,52 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.ConfirmDeleteCard"
+             x:DataType="vm:VaultViewModel">
+
+  <!--
+    The question in front of deleting something in the vault.
+
+    One control used in two places — the host sidebar, where it takes the place of the row of buttons that
+    opened it, and the vault screen's detail pane, where it takes the place of EDIT and DELETE. The two
+    moments are different and what has to be said is not, which is why this is a shared control rather than
+    two blocks that would drift apart. The sign-out confirmation is the same arrangement, for the same
+    reason; see SignOutCard.
+
+    A bare StackPanel and not a card, because the two hosts frame it themselves: the sidebar puts it in the
+    strip along its bottom edge, and the vault screen in a column that scrolls.
+
+    Everything it says is something the view model can answer. The question names the item, the consequence
+    knows whether this machine can push a tombstone yet, and the line in the box is a count of the hosts
+    that actually authenticate with the thing about to go — see VaultViewModel.HostsBoundTo. A confirmation
+    that only asked "are you sure?" would be a click to train people out of.
+  -->
+
+  <StackPanel Spacing="8">
+
+    <TextBlock Classes="heading" FontSize="13" TextWrapping="Wrap"
+               Text="{Binding PendingDeletion.Question}" />
+
+    <TextBlock Foreground="{StaticResource WarnText}" FontSize="11" TextWrapping="Wrap"
+               Text="{Binding PendingDeletion.Consequence}" />
+
+    <!--
+      What else in this vault leans on it. In a box of its own because it is the line that changes the
+      answer: everything above is true of every deletion, and this is about the one being made.
+    -->
+    <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
+            BorderThickness="1" CornerRadius="4" Padding="8,6"
+            IsVisible="{Binding PendingDeletion.HasUsage, FallbackValue=False}">
+      <TextBlock Foreground="{StaticResource Info}" FontSize="11" TextWrapping="Wrap"
+                 Text="{Binding PendingDeletion.Usage}" />
+    </Border>
+
+    <StackPanel Orientation="Horizontal" Spacing="6">
+      <Button Classes="danger" Content="DELETE" Command="{Binding ConfirmDeleteCommand}"
+              IsEnabled="{Binding !IsBusy}" />
+      <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelDeleteCommand}" />
+    </StackPanel>
+
+  </StackPanel>
+
+</UserControl>

src/DodoSSH.Client.App/Views/ConfirmDeleteCard.axaml.cs

@@ -0,0 +1,15 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>
+/// The question in front of deleting a host, a key or a password.
+/// </summary>
+/// <remarks>
+/// Its data context is the <c>VaultViewModel</c>, in both of the places it is shown, so every binding in the
+/// markup is a property of the vault. See <see cref="HostSidebar"/> and <see cref="VaultScreen"/>.
+/// </remarks>
+internal sealed partial class ConfirmDeleteCard : UserControl
+{
+    public ConfirmDeleteCard() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/HostSidebar.axaml

@@ -1,6 +1,7 @@
 <UserControl xmlns="https://github.com/avaloniaui"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
              x:Class="DodoSSH.Client.App.Views.HostSidebar"
              x:DataType="vm:VaultViewModel">
 
@@ -35,8 +36,10 @@
     </Border>
 
     <!--
-      One heading, for one vault. The chevron folds the list away; the count is the collection's own, so it
-      follows the filter without a second number to keep in step.
+      One heading, which names the vault while there is one and says ALL VAULTS once a team's is readable
+      too — a heading that went on naming the personal vault over a list containing a team's hosts would be
+      a quiet lie, so the rows carry the vault name instead. The chevron folds the list away; the count is
+      the collection's own, so it follows the filter without a second number to keep in step.
     -->
     <Button Grid.Row="1" Classes="flat grouphead" Command="{Binding ToggleHostsCommand}"
             HorizontalAlignment="Stretch" HorizontalContentAlignment="Stretch">
@@ -183,7 +186,7 @@
     </Border>
 
     <Border Grid.Row="4" Padding="10,8" BorderBrush="{StaticResource BorderSubtle}" BorderThickness="0,1,0,0"
-            IsVisible="{Binding !IsEditing}">
+            IsVisible="{Binding ShowsHostActions}">
       <StackPanel Orientation="Horizontal" Spacing="6">
         <Button Classes="ghost" Content="+ NEW HOST" Command="{Binding NewHostCommand}" />
         <Button Classes="ghost" Content="EDIT" Command="{Binding EditSelectedHostCommand}" />
@@ -191,6 +194,19 @@
       </StackPanel>
     </Border>
 
+    <!--
+      The question DELETE asks, in the place the buttons were rather than under them. This strip is at the
+      bottom edge of a column whose middle is a list that has already taken every spare pixel, so a second
+      block below the first would push its own buttons off the window — the same reasoning that swaps the
+      unlock card for the sign-out card rather than stacking them. Swapping also means DELETE cannot be
+      pressed again while its own question is up; see VaultViewModel.ShowsHostActions.
+    -->
+    <Border Grid.Row="4" Padding="10,8" Background="{StaticResource DangerWash}"
+            BorderBrush="{StaticResource BorderSubtle}" BorderThickness="0,1,0,0"
+            IsVisible="{Binding IsConfirmingDeletion}">
+      <views:ConfirmDeleteCard />
+    </Border>
+
   </Grid>
 
 </UserControl>

src/DodoSSH.Client.App/Views/HostSidebar.axaml.cs

@@ -1,4 +1,6 @@
 using Avalonia.Controls;
+using Avalonia.Input;
+using DodoSSH.Client.App.ViewModels;
 
 namespace DodoSSH.Client.App.Views;
 
@@ -11,7 +13,29 @@ namespace DodoSSH.Client.App.Views;
 /// </remarks>
 internal sealed partial class HostSidebar : UserControl
 {
-    public HostSidebar() => InitializeComponent();
+    public HostSidebar()
+    {
+        InitializeComponent();
+
+        // Wired here rather than in the markup because it is a gesture rather than a binding, which is how
+        // the transfers screen opens a directory too. Double-clicking a machine to get a shell on it is what
+        // every other client of this kind does, and the CONNECT button stays: it is the one that has the
+        // password box beside it, and a host that asks for a password still needs it typed first.
+        HostList.DoubleTapped += OnHostActivated;
+    }
+
+    /// <remarks>
+    /// Fire-and-forget, as the transfers screen's is: the command reports its own failures onto the status
+    /// line — an unknown host key, a refused password — and awaiting it here would mean an event handler
+    /// returning a task nothing observes.
+    /// </remarks>
+    private void OnHostActivated(object? sender, TappedEventArgs e)
+    {
+        if (DataContext is VaultViewModel vault)
+        {
+            _ = vault.ConnectCommand.ExecuteAsync(null);
+        }
+    }
 
     /// <summary>
     /// Where the keyboard should land when the terminal hands it back.

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -240,7 +240,13 @@
               <TextBlock Classes="heading" Text="Connect to your server" />
               <TextBlock Classes="hint"
                          Text="One address is all this needs. The identity provider, the client id and the scopes all come from the server itself." />
-              <TextBox Text="{Binding ServerUrl}" PlaceholderText="https://dodossh.example" />
+              <!--
+                Named because signing out lands here with the keyboard needing somewhere to go: the vault's
+                controls have just been collapsed, and Focus() on a collapsed control is a no-op that is
+                not replayed. See MainWindow.axaml.cs.
+              -->
+              <TextBox x:Name="ServerUrlBox" Text="{Binding ServerUrl}"
+                       PlaceholderText="https://dodossh.example" />
               <Button Classes="accent" Content="SIGN IN WITH YOUR BROWSER" Command="{Binding SignInCommand}"
                       IsEnabled="{Binding !IsBusy}" HorizontalAlignment="Left" />
               <TextBlock Classes="hint" Text="{Binding StatusMessage}" />
@@ -284,54 +290,22 @@
             </StackPanel>
           </Border>
 
-          <Border Classes="card" IsVisible="{Binding IsLocked}">
-            <StackPanel Spacing="12">
-              <TextBlock Classes="heading" Text="Unlock your vault" />
-              <TextBlock Text="{Binding AccountName}" Foreground="{StaticResource Info}" />
-              <!--
-                Named because locking has to put the keyboard here explicitly. The terminal's native
-                child window keeps Win32 focus when it is collapsed, so without that this box would
-                show a caret and silently swallow the passphrase — see NativeKeyboardFocus.
-              -->
-              <TextBox x:Name="UnlockPassphrase" Text="{Binding Passphrase}"
-                       PlaceholderText="vault passphrase" PasswordChar="•" />
-              <StackPanel Orientation="Horizontal" Spacing="8">
-                <Button Classes="accent" Content="UNLOCK" Command="{Binding UnlockCommand}"
-                        IsEnabled="{Binding !IsBusy}" />
-                <!--
-                  Shown only when this machine has both a registered wrap and a keystore still willing to
-                  release the key. Absent rather than disabled, because a greyed-out "Use Windows Hello" on a
-                  machine that never had it invites the reading that something is broken — and the passphrase
-                  box beside it is not a fallback, it is the ordinary way in.
-                -->
-                <Button Classes="ghost" Content="USE WINDOWS HELLO"
-                        Command="{Binding UnlockWithDeviceCommand}"
-                        IsEnabled="{Binding !IsBusy}"
-                        IsVisible="{Binding CanUnlockWithDevice}"
-                        ToolTip.Tip="Opens the vault with this machine's device key. Windows will ask you to confirm." />
-              </StackPanel>
-              <TextBlock Classes="hint" Text="{Binding StatusMessage}" />
-              <TextBlock Classes="hint" FontSize="11"
-                         Text="This works with no network: the salt and the wrapped key are already on this machine." />
+          <!--
+            The unlock card, and the sign-out confirmation that replaces it. Both live in their own files:
+            nothing inside this window can be laid out by a test — WebView2's adapter refuses the headless
+            session's thread — so markup that stays here is markup nobody can measure. See UnlockCard.axaml.
+          -->
+          <Border Classes="card" IsVisible="{Binding IsAskingForThePassphrase}">
+            <views:UnlockCard x:Name="UnlockPane" />
+          </Border>
 
-              <!--
-                Stated here because the lock screen is what hides it. The terminal's WebView is collapsed
-                while locked, so a shell left running is invisible as well as unstopped — and a screen
-                saying "Unlock your vault" over a machine that still holds authenticated SSH channels is
-                exactly the kind of half-truth this project writes down instead of implying. Visible only
-                when there is something to disclose, so an ordinary launch stays quiet.
-              -->
-              <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
-                      BorderThickness="1" CornerRadius="4" Padding="10,8"
-                      IsVisible="{Binding HasLiveSessions, FallbackValue=False}">
-                <StackPanel Spacing="4">
-                  <TextBlock Text="{Binding LiveSessionSummary}" Foreground="{StaticResource Info}"
-                             FontWeight="SemiBold" TextWrapping="Wrap" />
-                  <TextBlock Classes="hint" FontSize="11"
-                             Text="Locking closes the vault, not your terminals: a job you started keeps running, and its output is waiting behind this screen. It also means this machine still holds an open, authenticated channel to those hosts — locked describes the vault, not the connections. Quit DodoSSH to end them." />
-                </StackPanel>
-              </Border>
-            </StackPanel>
+          <!--
+            The confirmation, in place of the unlock card rather than under it: the card is already close
+            to the height the window guarantees at its minimum, and a screen a user cannot read all of is
+            worse than one that shows one question at a time.
+          -->
+          <Border Classes="card" IsVisible="{Binding IsConfirmingSignOut}">
+            <views:SignOutCard />
           </Border>
 
         </Panel>

src/DodoSSH.Client.App/Views/MainWindow.axaml.cs

@@ -74,6 +74,23 @@ internal sealed partial class MainWindow : Window
         _ => this,
     };
 
+    /// <summary>
+    /// Where the keyboard belongs once the vault is no longer open.
+    /// </summary>
+    /// <remarks>
+    /// Two ways out of an unlocked vault, and they land on different screens: locking shows the passphrase
+    /// box, and signing out empties this machine and goes back to asking for a server. Both collapse the
+    /// controls the keyboard was on, and <c>Focus()</c> on a collapsed control is a no-op that is not
+    /// replayed when it is revealed — so a fixed target would leave whoever signed out with a window that
+    /// swallows every keystroke until they click something.
+    /// </remarks>
+    private IInputElement ClosedVaultKeyboardHome => shell?.State switch
+    {
+        ShellState.Locked => UnlockPane.PassphraseBox,
+        ShellState.NeedsServer => ServerUrlBox,
+        _ => this,
+    };
+
     /// <summary>
     /// The shortcuts the window owns.
     /// </summary>
@@ -166,7 +183,7 @@ internal sealed partial class MainWindow : Window
             // change, and reacting to all of them would move focus during setup and sign-in.
             if (wasUnlocked && !unlocked)
             {
-                ReleaseKeyboardTo(UnlockPassphrase);
+                ReleaseKeyboardTo(ClosedVaultKeyboardHome);
             }
 
             wasUnlocked = unlocked;

src/DodoSSH.Client.App/Views/PreferencesScreen.axaml

@@ -1,6 +1,7 @@
 <UserControl xmlns="https://github.com/avaloniaui"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
              x:Class="DodoSSH.Client.App.Views.PreferencesScreen"
              x:DataType="vm:MainWindowViewModel">
 
@@ -76,18 +77,49 @@
           <TextBlock Text="Synchronise" Foreground="{StaticResource Text}" FontSize="12"
                      FontWeight="Medium" />
           <TextBlock Classes="hint" FontSize="10"
-                     Text="Runs a pass now. One runs on its own when the vault opens, straight after any change, and every minute while it stays open, so nothing depends on this being pressed." />
+                     Text="Runs a pass now. One runs on its own when the vault opens, straight after any change, and every minute while it stays open — and a pass that finds this machine offline signs it back in from the session it remembered, so nothing here depends on being pressed." />
         </StackPanel>
         <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6">
           <Button Classes="ghost" Content="SIGN IN" Command="{Binding SignInCommand}"
                   IsVisible="{Binding !IsOnline}"
-                  ToolTip.Tip="Opens your browser. Syncing needs a connection; everything else works without one." />
+                  ToolTip.Tip="Opens your browser. Only needed when there is no remembered session to resume — after signing out, or once your identity provider stops accepting the one this machine held." />
           <Button Classes="ghost" Content="SYNC NOW" Command="{Binding Vault.SyncCommand}" />
         </StackPanel>
       </Grid>
 
       <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
 
+      <TextBlock Classes="mono" Text="ACCOUNT" FontSize="13" FontWeight="SemiBold"
+                 LetterSpacing="1" Foreground="{StaticResource Text}" />
+
+      <TextBlock Classes="mono" Text="{Binding AccountName}" FontSize="11" Margin="0,8,0,0"
+                 Foreground="{StaticResource Info}" TextTrimming="CharacterEllipsis" />
+
+      <Grid ColumnDefinitions="*,Auto" Margin="0,12,0,0">
+        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
+          <TextBlock Text="Sign out of this machine" Foreground="{StaticResource Text}" FontSize="12"
+                     FontWeight="Medium" />
+          <TextBlock Classes="hint" FontSize="10"
+                     Text="Deletes this machine's copy of the vault and withdraws its device key, so it goes back to knowing nothing. The vault stays on the server; signing in again brings it back. Use this to hand a machine on, or to enrol a different account." />
+        </StackPanel>
+        <!--
+          Hidden rather than disabled while the confirmation is up, because the card below carries the
+          button that actually does it and two sign-out buttons on one screen is one too many.
+        -->
+        <Button Grid.Column="1" Classes="danger" Content="SIGN OUT"
+                Command="{Binding SignOutCommand}"
+                IsEnabled="{Binding !IsBusy}"
+                IsVisible="{Binding !IsConfirmingSignOut}" />
+      </Grid>
+
+      <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
+              BorderThickness="1" CornerRadius="6" Padding="14" Margin="0,14,0,0"
+              IsVisible="{Binding IsConfirmingSignOut}">
+        <views:SignOutCard />
+      </Border>
+
+      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
+
       <TextBlock Classes="mono" Text="NOT BUILT YET" FontSize="13" FontWeight="SemiBold"
                  LetterSpacing="1" Foreground="{StaticResource TextDim}" />
       <TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"

src/DodoSSH.Client.App/Views/SignOutCard.axaml

@@ -0,0 +1,64 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SignOutCard"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    The sign-out confirmation.
+
+    One control used in two places — the preferences screen, where somebody is leaving a machine on
+    purpose, and the unlock screen, where somebody has forgotten their passphrase and this is the only way
+    forward. The two moments are different and the warning is not, which is why this is a shared control
+    rather than two blocks that would drift apart.
+
+    It is a bare StackPanel and not a card: the two hosts frame it differently, because a card that centres
+    itself is right over a lock screen and wrong halfway down a scrolling column of preferences.
+
+    Everything it says is something the state machine can actually answer. The count comes from the outbox,
+    the shell count from the workspace, and the sentence about the identity provider is there because
+    nothing here can end that session — see MainWindowViewModel.ConfirmSignOutAsync.
+  -->
+
+  <StackPanel Spacing="10">
+
+    <TextBlock Classes="heading" FontSize="15" Text="Sign out of this machine?" />
+
+    <TextBlock Text="{Binding SignOutWarning}" Foreground="{StaticResource WarnText}"
+               TextWrapping="Wrap" />
+
+    <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+               Text="This deletes this machine's copy of the vault — the profile, the cached hosts, keys and passwords, and this machine's device key. Your vault is on the server and is not touched: signing in again brings it all back." />
+
+    <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
+            BorderThickness="1" CornerRadius="4" Padding="10,8"
+            IsVisible="{Binding HasLiveSessions, FallbackValue=False}">
+      <StackPanel Spacing="4">
+        <TextBlock Text="{Binding LiveSessionSummary}" Foreground="{StaticResource Info}"
+                   FontWeight="SemiBold" TextWrapping="Wrap" />
+        <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                   Text="Signing out does not close them, exactly as locking does not. Quit DodoSSH to end them." />
+      </StackPanel>
+    </Border>
+
+    <!--
+      The other thing that outlives signing out, on the same reasoning and worth its own line because it is
+      a connection this machine holds rather than a window it shows: a transfer in flight authenticated
+      before any of this and keeps writing into its part file afterwards.
+    -->
+    <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+               IsVisible="{Binding Transfers.IsConnected, FallbackValue=False}"
+               Text="A file-transfer session is open on this machine. Signing out does not close it either — it goes when DodoSSH does." />
+
+    <StackPanel Orientation="Horizontal" Spacing="8">
+      <Button Classes="danger" Content="SIGN OUT AND DELETE"
+              Command="{Binding ConfirmSignOutCommand}" IsEnabled="{Binding !IsBusy}" />
+      <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelSignOutCommand}" />
+    </StackPanel>
+
+    <TextBlock Classes="hint" FontSize="10" TextWrapping="Wrap"
+               Text="Your session at the identity provider is not ended by this — DodoSSH has no way to end it — so on a machine that is not yours, sign out there too." />
+
+  </StackPanel>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SignOutCard.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>The sign-out confirmation, shown on the preferences screen and on the unlock screen.</summary>
+internal sealed partial class SignOutCard : UserControl
+{
+    public SignOutCard() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/TransfersScreen.axaml

@@ -23,6 +23,16 @@
       A directory is marked by colour rather than by an icon: this application ships no icon set, and the
       palette already reserves blue for "a directory, a distinct scope" — see App.axaml, where it is
       described as deliberately rare. This is the one place it is spent.
+
+      Two further colours come from the mode, and they are split across the two columns on purpose: NAME says
+      what a row is, PERMS says what is notable about how it is set. So an executable is green in NAME —
+      "live, yours, something that runs" — while a file anyone may write to is amber in PERMS, over the
+      characters that actually say so. The two never compete for one TextBlock, which is what lets a
+      world-writable executable show both facts instead of one winning an argument.
+
+      Both are files only; see SftpEntry, which will not read a mode off a symbolic link or a directory.
+      Rendering `-rwxrwxrwx` in two colours at once is not something this list can do, so amber over the whole
+      string is the compromise: the eye lands on the column, and the string itself is the detail.
     -->
     <Style Selector="TextBlock.entry">
       <Setter Property="Foreground" Value="{StaticResource Text}" />
@@ -30,6 +40,25 @@
     <Style Selector="TextBlock.entry.dir">
       <Setter Property="Foreground" Value="{StaticResource Info}" />
     </Style>
+    <Style Selector="TextBlock.entry.exec">
+      <Setter Property="Foreground" Value="{StaticResource Accent}" />
+    </Style>
+
+    <!--
+      Faint by default, as this column has always been: a mode is there so its absence would be noticed. It
+      steps up to amber only when it has something to say, which is the whole reason the default is quiet.
+    -->
+    <Style Selector="TextBlock.perms">
+      <Setter Property="Foreground" Value="{StaticResource TextFaint}" />
+    </Style>
+    <!--
+      Warn rather than WarnText, which is the muted amber a warning card writes its sentences in. At 9.5px
+      against TextFaint that one is a shade, not a signal, and a marker nobody notices is the same as no
+      marker at all.
+    -->
+    <Style Selector="TextBlock.perms.loose">
+      <Setter Property="Foreground" Value="{StaticResource Warn}" />
+    </Style>
   </UserControl.Styles>
 
   <Grid RowDefinitions="44,*,Auto">
@@ -197,7 +226,7 @@
       </Border>
 
       <!-- ==== The host ==== -->
-      <Grid Grid.Column="2" RowDefinitions="Auto,Auto,Auto,*">
+      <Grid Grid.Column="2" RowDefinitions="Auto,Auto,Auto,Auto,*">
 
         <Border Grid.Row="0" Padding="12,7" BorderBrush="{StaticResource BorderSubtle}"
                 BorderThickness="0,0,0,1">
@@ -209,12 +238,40 @@
               <Button Classes="ghost" Content="REFRESH" Command="{Binding RefreshRemoteCommand}"
                       IsEnabled="{Binding IsConnected}" />
               <Button Classes="danger" Content="DELETE" Command="{Binding DeleteRemoteCommand}"
-                      IsEnabled="{Binding IsConnected}" />
+                      IsEnabled="{Binding CanDeleteRemote}" />
             </StackPanel>
           </Grid>
         </Border>
 
-        <Grid Grid.Row="1" ColumnDefinitions="*,Auto" Margin="12,6,12,4">
+        <!--
+          The question DELETE asks. Under the button rather than over the pane, so the row it is about is
+          still on screen and still selected while it is being answered — and it names the full path rather
+          than the file, because a name is the half that does not identify anything.
+
+          This is the strongest warning on any of these screens, and deliberately: everything else this
+          application deletes is a tombstone against a copy the server still has, and a file on somebody's
+          host is bytes with nothing behind them.
+        -->
+        <Border Grid.Row="1" Padding="12,10" Background="{StaticResource DangerWash}"
+                BorderBrush="{StaticResource DangerSoft}" BorderThickness="0,0,0,1"
+                IsVisible="{Binding IsConfirmingRemoteDeletion}">
+          <StackPanel Spacing="7">
+            <TextBlock Classes="heading" FontSize="13" TextWrapping="Wrap"
+                       Text="{Binding PendingRemoteDeletion.Question}" />
+            <SelectableTextBlock Classes="mono" FontSize="10.5" TextWrapping="Wrap"
+                                 Foreground="{StaticResource Danger}"
+                                 Text="{Binding PendingRemoteDeletion.FullPath}" />
+            <TextBlock Foreground="{StaticResource WarnText}" FontSize="11" TextWrapping="Wrap"
+                       Text="{Binding PendingRemoteDeletion.Consequence}" />
+            <StackPanel Orientation="Horizontal" Spacing="8">
+              <Button Classes="danger" Content="DELETE ON THE HOST"
+                      Command="{Binding ConfirmDeleteRemoteCommand}" IsEnabled="{Binding !IsBusy}" />
+              <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelDeleteRemoteCommand}" />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <Grid Grid.Row="2" ColumnDefinitions="*,Auto" Margin="12,6,12,4">
           <ItemsControl Grid.Column="0" ItemsSource="{Binding RemoteTrail}" VerticalAlignment="Center">
             <ItemsControl.ItemsPanel>
               <ItemsPanelTemplate>
@@ -249,34 +306,35 @@
           </StackPanel>
         </Grid>
 
-        <Grid Grid.Row="2" ColumnDefinitions="2,*,84,110,92" Margin="0,2,12,4">
+        <Grid Grid.Row="3" ColumnDefinitions="2,*,84,110,92" Margin="0,2,12,4">
           <TextBlock Grid.Column="1" Classes="label" Text="NAME" FontSize="8.5" Margin="12,0,8,0" />
           <TextBlock Grid.Column="2" Classes="label" Text="SIZE" FontSize="8.5" />
           <TextBlock Grid.Column="3" Classes="label" Text="MODIFIED" FontSize="8.5" />
           <TextBlock Grid.Column="4" Classes="label" Text="PERMS" FontSize="8.5" />
         </Grid>
 
-        <ListBox Grid.Row="3" x:Name="RemoteList" ItemsSource="{Binding RemoteEntries}"
+        <ListBox Grid.Row="4" x:Name="RemoteList" ItemsSource="{Binding RemoteEntries}"
                  SelectedItem="{Binding SelectedRemoteEntry}">
           <ListBox.ItemTemplate>
             <DataTemplate x:DataType="vm:RemoteEntryRowViewModel">
               <Grid ColumnDefinitions="2,*,84,110,92" Margin="0,5,12,5">
                 <Border Grid.Column="0" Classes="rowmark" />
                 <TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
+                           Classes.exec="{Binding IsExecutable}"
                            Text="{Binding Name}" FontSize="11"
                            Margin="12,0,8,0" TextTrimming="CharacterEllipsis" />
                 <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Size}" FontSize="9.5"
                            Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
                 <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Modified}" FontSize="9.5"
                            Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
-                <TextBlock Grid.Column="4" Classes="mono" Text="{Binding Permissions}" FontSize="9.5"
-                           Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+                <TextBlock Grid.Column="4" Classes="mono perms" Classes.loose="{Binding IsWorldWritable}"
+                           Text="{Binding Permissions}" FontSize="9.5" VerticalAlignment="Center" />
               </Grid>
             </DataTemplate>
           </ListBox.ItemTemplate>
         </ListBox>
 
-        <StackPanel Grid.Row="3" Spacing="10" Margin="24" MaxWidth="300"
+        <StackPanel Grid.Row="4" Spacing="10" Margin="24" MaxWidth="300"
                     HorizontalAlignment="Center" VerticalAlignment="Center"
                     IsVisible="{Binding !HasRemoteEntries}">
           <TextBlock Classes="hint" FontSize="11" TextAlignment="Center"

src/DodoSSH.Client.App/Views/UnlockCard.axaml

@@ -0,0 +1,98 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.UnlockCard"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    The unlock screen's contents.
+
+    Extracted from MainWindow.axaml so that it can be laid out and looked at: MainWindow cannot be shown in
+    the headless session at all — WebView2's adapter refuses its thread, which LayoutHarnessTests pins — so
+    markup that stays inside that file is markup no test can measure. This card is the one on the screen
+    with the least room to spare and the most conditional content: a disclosure about shells left running,
+    and a way out for a forgotten passphrase, both of which appear underneath a form that already fills most
+    of the height the window guarantees.
+
+    A bare StackPanel rather than a card, because the card is the frame MainWindow puts around it.
+  -->
+
+  <StackPanel Spacing="12">
+
+    <TextBlock Classes="heading" Text="Unlock your vault" />
+    <TextBlock Text="{Binding AccountName}" Foreground="{StaticResource Info}" />
+
+    <!--
+      Named because locking has to put the keyboard here explicitly, and reached from the window through
+      PassphraseBox. The terminal's native child window keeps Win32 focus when it is collapsed, so without
+      that this box would show a caret and silently swallow the passphrase — see NativeKeyboardFocus.
+
+      Enter unlocks. A KeyBinding on the box rather than a handler on the window, because this is a property
+      of the control the passphrase is typed into and not of the shell's state: the keyboard is put here on
+      every lock, so the one gesture everybody makes after typing a password reaches the command this box
+      exists for. A single-line TextBox does not handle Enter itself, so nothing is being fought over.
+    -->
+    <TextBox x:Name="UnlockPassphrase" Text="{Binding Passphrase}"
+             PlaceholderText="vault passphrase" PasswordChar="•">
+      <TextBox.KeyBindings>
+        <KeyBinding Gesture="Enter" Command="{Binding UnlockCommand}" />
+      </TextBox.KeyBindings>
+    </TextBox>
+
+    <StackPanel Orientation="Horizontal" Spacing="8">
+      <Button Classes="accent" Content="UNLOCK" Command="{Binding UnlockCommand}"
+              IsEnabled="{Binding !IsBusy}" />
+      <!--
+        Shown only when this machine has both a registered wrap and a keystore still willing to release the
+        key. Absent rather than disabled, because a greyed-out "Use Windows Hello" on a machine that never
+        had it invites the reading that something is broken — and the passphrase box beside it is not a
+        fallback, it is the ordinary way in.
+      -->
+      <Button Classes="ghost" Content="USE WINDOWS HELLO"
+              Command="{Binding UnlockWithDeviceCommand}"
+              IsEnabled="{Binding !IsBusy}"
+              IsVisible="{Binding CanUnlockWithDevice}"
+              ToolTip.Tip="Opens the vault with this machine's device key. Windows will ask you to confirm." />
+    </StackPanel>
+
+    <TextBlock Classes="hint" Text="{Binding StatusMessage}" TextWrapping="Wrap" />
+    <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+               Text="This works with no network: the salt and the wrapped key are already on this machine." />
+
+    <!--
+      Stated here because the lock screen is what hides it. The terminal's WebView is collapsed while
+      locked, so a shell left running is invisible as well as unstopped — and a screen saying "Unlock your
+      vault" over a machine that still holds authenticated SSH channels is exactly the kind of half-truth
+      this project writes down instead of implying. Visible only when there is something to disclose, so an
+      ordinary launch stays quiet.
+    -->
+    <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
+            BorderThickness="1" CornerRadius="4" Padding="10,8"
+            IsVisible="{Binding HasLiveSessions, FallbackValue=False}">
+      <StackPanel Spacing="4">
+        <TextBlock Text="{Binding LiveSessionSummary}" Foreground="{StaticResource Info}"
+                   FontWeight="SemiBold" TextWrapping="Wrap" />
+        <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                   Text="Locking closes the vault, not your terminals: a job you started keeps running, and its output is waiting behind this screen. It also means this machine still holds an open, authenticated channel to those hosts — locked describes the vault, not the connections. Quit DodoSSH to end them." />
+      </StackPanel>
+    </Border>
+
+    <!--
+      The way out of a forgotten passphrase, and the only one there is. Nothing can recover a passphrase —
+      there is no server-side reset by design — so the honest offer is to reset this machine and sign in
+      again, which costs whatever this machine had not yet pushed and nothing else. Stated here rather than
+      left to be discovered, because somebody stuck on this screen has no other route and quitting the
+      application does not help.
+    -->
+    <Border Height="1" Background="{StaticResource BorderSubtle}" />
+
+    <StackPanel Spacing="6">
+      <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                 Text="Forgotten your passphrase? Nothing can recover it — not even whoever runs the server. What you can do is reset this machine and sign in again; the vault is on the server and comes back." />
+      <Button Classes="ghost" Content="RESET THIS MACHINE"
+              Command="{Binding SignOutCommand}" HorizontalAlignment="Left" />
+    </StackPanel>
+
+  </StackPanel>
+
+</UserControl>

src/DodoSSH.Client.App/Views/UnlockCard.axaml.cs

@@ -0,0 +1,19 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>The unlock screen's contents.</summary>
+internal sealed partial class UnlockCard : UserControl
+{
+    public UnlockCard() => InitializeComponent();
+
+    /// <summary>
+    /// Where the keyboard goes when the vault is locked.
+    /// </summary>
+    /// <remarks>
+    /// Exposed the way <see cref="HostSidebar.KeyboardTarget"/> is, and for the same reason: the window
+    /// owns the focus policy — it has to take the keyboard off the terminal's native child window first —
+    /// and the control it hands it to belongs to whichever screen is showing.
+    /// </remarks>
+    internal TextBox PassphraseBox => UnlockPassphrase;
+}

src/DodoSSH.Client.App/Views/VaultScreen.axaml

@@ -1,6 +1,7 @@
 <UserControl xmlns="https://github.com/avaloniaui"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.App.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
              x:Class="DodoSSH.Client.App.Views.VaultScreen"
              x:DataType="vm:VaultViewModel">
 
@@ -17,9 +18,10 @@
     two headings that could never have anything under them. HOST KEYS is the other way round: a real,
     fully-backed category the design has no slot for. Both are recorded in docs/design-import-gaps.md.
 
-    The SCOPES rail below the categories is the vault list, which is real and today has one entry in it. The
-    design shows three, two of them teams; team vaults exist as tables on the server and are refused by its
-    access service, so a rail with three entries would be showing two vaults nothing can open.
+    The SCOPES rail below the categories is the vault list. Since M3 it genuinely has more than one entry
+    when somebody is in a team — but it is still not a selector, because every table on this screen already
+    spans every vault this session holds a key for and each row names its own. What it carries instead is
+    the one vault question with an answer: where a new item is filed.
   -->
 
   <Grid ColumnDefinitions="176,*,244">
@@ -237,11 +239,23 @@
                        Text="Vault items record no author, no timestamps and no sharing yet, so there is nothing more to show here." />
 
             <StackPanel Orientation="Horizontal" Spacing="6" Margin="0,14,0,0"
-                        IsVisible="{Binding SelectedItemIsEditable}">
+                        IsVisible="{Binding ShowsItemActions}">
               <Button Classes="ghost" Content="EDIT" Command="{Binding EditSelectedItemCommand}" />
               <Button Classes="danger" Content="DELETE" Command="{Binding DeleteSelectedItemCommand}" />
             </StackPanel>
 
+            <!--
+              The question DELETE asks, in the place those two buttons were. Here rather than over the
+              screen, because this pane is where the item being deleted is described: the name, the kind and
+              what is stored are all still on screen above it, which is most of what somebody checks before
+              answering. See ConfirmDeleteCard.
+            -->
+            <Border Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
+                    BorderThickness="1" CornerRadius="4" Padding="10" Margin="0,14,0,0"
+                    IsVisible="{Binding IsConfirmingDeletion}">
+              <views:ConfirmDeleteCard />
+            </Border>
+
             <!--
               A pin has no editor and no Add, which is the one asymmetry on this screen and is deliberate:
               a pin appears because somebody approved a fingerprint at the moment of connecting, which is