Android: the redesign — a Vaults tab with hosts, keychain and snippets, card lists, a keychain that can add, and files that act on what is chosen

The bottom bar is Vaults · Connections · Settings, drawn as Material 3 pills with icons from the embedded
Material font and a count of open sessions on Connections, which replaces the strip of shells above the
bar. Vaults is the open vault: its header carries the name as a switch to the vaults screen, the sync
light and a lock icon, and a Hosts · Keychain · Snippets segmented control sits under it. The keychain
and snippets move there from Settings (IsVaultSurface lights the tab; IsMoreSurface no longer lists
them), and back from either goes to the hosts. Settings becomes an account card and grouped sections:
security, vaults and history, files, this app.

Host rows are cards with a terminal tile and the live dot on its corner. The connect sheet names the
host and its address, labels its box, focuses it as it opens, reveals the password on request, and puts
CANCEL left and CONNECT right; every two-button row on the head now confirms on the right. While a
hosts-screen sheet is up the header and bar are dimmed too and a tap on them lowers it, and the bar
stands down while the software keyboard is up.

The keychain gains a floating + and a sheet of the desktop's five adds (generate a key, paste a key, a
password, a bucket, a tag) over the editors VaultViewModel already had, drawn as a full-screen page with
labels above the boxes; a chosen item gets EDIT and COPY PUBLIC KEY beside MOVE and DELETE. Snippets get
a floating + and cards that say RUNS or INSERTS. Files trade the seven-button block for a selection bar
(save, and a ⋮ sheet with rename, move, permissions and a red delete), folder and file tiles, an upload
button, and header actions for a terminal on the same host, refresh and close; a terminal's + sheet
opens SFTP on that terminal's own host.

The theme takes the audit's visual findings: Fluent's ClipToBounds is cleared on glowing buttons so the
glow is no longer cut to a square (the desktop's Button.accent too), prose is Montserrat with mono kept
for addresses and code, disabled secondary buttons are quieter than enabled ones, Fluent's dropdown,
checkbox, switch, focus and selection brushes come from the palette, touch no longer leaves hover fills
behind, and lists, nav entries and icon buttons carry names for TalkBack.

Builds clean; checked on the emulator end to end: unlock, the three vault views, adding and deleting a
password, connecting through the new sheet, files on the terminal's host with the selection bar and
its sheet. App tests 727 of 733 pass with 5 skipped; the one failure, TheCountsAPhoneShows_
FollowEveryForwardsState, passes three runs of three alone and is untouched here. Layout tests pass.

src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs

@@ -1465,17 +1465,28 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// screen missing here is one whose arrival darkens the tab that led to it and brings the shell's own
     /// header back over a screen that already has one.
     ///
-    /// <b>The keychain joined it too, and that is why the bar went from four entries to three.</b> Unlike
-    /// the two above, that one is a move rather than an addition: a phone's bottom bar is for the places a
-    /// session moves between, and the keychain is not one of those — hosts and connections are what
-    /// somebody opens the application to do, and keys, credentials and tags are what they go and manage
-    /// occasionally. The desktop keeps its rail entry, having room for nine, so this is the second thing
-    /// the two heads deliberately arrange differently, after the hub itself.
+    /// ◆ <b>The keychain and snippets left it again, for <see cref="IsVaultSurface"/>.</b> They had joined
+    /// it on the argument that a bottom bar is for the places a session moves between, and keys and saved
+    /// commands are managed occasionally. The 2026-10-04 redesign answers that differently: the first tab is
+    /// the open vault rather than its host list, and the vault's three kinds of content — hosts, keychain,
+    /// snippets — are a switch at the top of it. What stays here is what is about this phone and this
+    /// account rather than about a vault's contents: the hub, logs, files, preferences and the vaults list.
     /// </remarks>
     internal bool IsMoreSurface =>
-        IsShowingPages && Screen is ShellScreen.More or ShellScreen.Snippets or ShellScreen.Logs
+        IsShowingPages && Screen is ShellScreen.More or ShellScreen.Logs
             or ShellScreen.Transfers or ShellScreen.Buckets or ShellScreen.Preferences
-            or ShellScreen.Vaults or ShellScreen.Keychain;
+            or ShellScreen.Vaults;
+
+    /// <summary>
+    /// Whether the phone's VAULTS tab should light: one of the open vault's three kinds of content is up.
+    /// </summary>
+    /// <remarks>
+    /// The phone's counterpart of <see cref="IsMoreSurface"/>, and drawn by the Android head alone — the
+    /// desktop's rail has an entry for each of the three. It also decides which pages wear the vault's own
+    /// header and the HOSTS · KEYCHAIN · SNIPPETS switch under it; see PhoneShell.RefreshChrome.
+    /// </remarks>
+    internal bool IsVaultSurface =>
+        IsShowingPages && Screen is ShellScreen.Hosts or ShellScreen.Keychain or ShellScreen.Snippets;
 
     /// <summary>
     /// Whether the terminal's WebView may be on screen at this instant.
@@ -5554,6 +5565,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(IsMoreShowing));
         OnPropertyChanged(nameof(IsBucketsShowing));
         OnPropertyChanged(nameof(IsMoreSurface));
+        OnPropertyChanged(nameof(IsVaultSurface));
 
         // The rail's switcher and its mode-dependent first row read the same three flags above, so
         // whatever moved them has to repaint these too — see the remarks on each.