Make a vault the thing you create, and let a window set one aside

Everything a shared vault needs was already here and arranged the wrong way
round. A vault has to belong to a team, so creating one meant going to the teams
screen, founding an organisation, and only then adding a vault to it — which the
NEW VAULT button named after the team, so a team with three of them held three
vaults called the same thing and nothing told them apart. Somebody who wants to
share four servers with two colleagues is not asking to found anything.

So the form asks for a name and nothing else. The team is derived from it, slug
included, and created with this account as its owner; the vault goes inside; and
the members, roles, invitations and key holders that hang off a team are all on
screen the moment it exists. The tab strip's New vault entry lands there with the
new vault selected, which is where the next thing anybody wants to do already is.

That is two calls, and the first can succeed alone. When it does the team is
kept: the id is minted once into pendingVaultTeamId, so pressing CREATE again
resends the identical create — which the server treats as the same team — and
retries the vault, and the message says all of that rather than "creating the
vault failed". Archiving the orphan instead would be a client deleting something
on the user's behalf because a later step failed, which is the kind of tidying
that eventually archives a team somebody has just been added to. A slug taken by
somebody else is retried once with a disambiguated one and never in a loop; a
name with no a-z or 0-9 anywhere in it falls back to the team's own id rather
than to a refusal pointing at a field nobody was shown.

The other half is the caret beside Vaults. Being in four teams means four teams'
machines in front of you all day, and the answer is a switch per vault rather
than four sign-ins. Switching one off takes its hosts, groups, keys and pins off
the screens that list them and does nothing else: it still syncs, its key stays
in the keyring, it stays choosable as somewhere to file a new item, and a shown
host that authenticates with a key filed in it still connects. That last one is
what shaped the design. TryBuildAuthentication resolves a binding out of the
keychain's typed list and a cross-vault binding is legal, so filtering the reload
loops — the obvious implementation — would have turned a preference about reading
into an outage. Only the projections a person reads consult IsVaultShown; every
Reload*Async stays whole, including the dialled-endpoint set that decides which
pins are described as unused, because that is a hint which invites deleting
trust.

Snippets, logs and buckets needed no code and the comment says so out loud: all
three read ActiveVaultId alone, and the personal vault is drawn in the menu
ticked and cannot be switched off — it is the active vault, the group and tag
editors' target, and the save picker's fallback, so hiding it would empty half
the application rather than filter it.

The preference is a column on the cache's vault row, which is what makes it
survive both a relaunch and the /me refresh that runs every minute: Apply does
not touch it, deliberately, because the server has never been told which vaults
this machine is showing. It is in the encrypted cache rather than settings.json
because it is a list of vault ids and that file's own doc comment says what may
go in it. VaultSession cannot see the type at all — ReadableVaults is what the
sync loop walks, and a filter reaching it would be a vault that quietly stopped
syncing, found out weeks later from a host that was never there.

The strip's note refusing a MenuFlyout stands and is unchanged. This flyout
sidesteps the question rather than answering it: the handler selects the Vaults
tab first, which collapses the renderer, so nothing native is under the popup by
the time it opens — the move QuickConnect already makes. A headless test asserts
that ordering, which is as far as headless can go with no native window, and
manual check 1.6 is the other half.

The phone is out of scope on purpose: it has no tab strip and its teams screen's
vault section is read-only. The plumbing is in Client.Shell, so it can adopt this
later; until then nothing there is ever hidden, which is today's behaviour.

1514 tests pass. Fifteen are new in VaultVisibilityTests, and the ones worth
naming are the guards: a hidden vault still syncs, still holds keys that
authenticate hosts on screen, still appears in the save picker, and still counts
towards which pins nothing dials.

Not fixed, and noted here because it is next door: VaultGrantService's team-vault
create refuses a taken vault id rather than returning the existing vault, while
VaultSharing's own remark claims a create whose response was lost is safe to
resend. A lost 200 therefore leaves a vault whose key the client's catch already
zeroed, openable by nobody.

tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs

@@ -1633,6 +1633,34 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             window => LayoutHarness.Unreachable(window)
                 .ShouldBeEmpty("the teams screen with the rename form open"));
 
+    /// <remarks>
+    /// The name-a-vault form is in the left column under the team list, and it is the taller of the two
+    /// forms that can appear there — one field, but two sentences under it. Worth its own case because the
+    /// column is 268 wide and both sentences wrap.
+    /// </remarks>
+    [Fact]
+    public Task TheTeamsScreen_FitsWithTheNewVaultFormOpen() =>
+        OnTheTeamsScreenAsync(
+            teams => teams.NewVaultInItsOwnTeamCommand.Execute(null),
+            window => LayoutHarness.Unreachable(window)
+                .ShouldBeEmpty("the teams screen with the new-vault form open"));
+
+    /// <remarks>
+    /// Both forms at once, which is reachable: NEW at the top of the team list and New vault… in the tab
+    /// strip's menu arm different forms and neither closes the other. Together they are the most the left
+    /// column can be asked to hold.
+    /// </remarks>
+    [Fact]
+    public Task TheTeamsScreen_FitsWithBothCreateFormsOpen() =>
+        OnTheTeamsScreenAsync(
+            teams =>
+            {
+                teams.NewTeamCommand.Execute(null);
+                teams.NewVaultInItsOwnTeamCommand.Execute(null);
+            },
+            window => LayoutHarness.Unreachable(window)
+                .ShouldBeEmpty("the teams screen with both create forms open"));
+
     /// <remarks>
     /// The armed confirmation carries two sentences of prose and replaces the header's buttons. It is the
     /// tallest thing that can appear above the members list, so it is the case most likely to push the

tests/DodoSSH.Client.App.Layout.Tests/TerminalTabsTests.cs

@@ -1,6 +1,7 @@
 using Avalonia;
 using Avalonia.Controls;
 using Avalonia.Controls.Presenters;
+using Avalonia.Controls.Primitives;
 using Avalonia.Headless;
 using Avalonia.Input;
 using Avalonia.Media;
@@ -249,10 +250,68 @@ public sealed class TerminalTabsTests : IAsyncLifetime
         });
     }
 
+    /// <remarks>
+    /// The caret is the second half of the Vaults pill and the only control in this strip that opens a
+    /// popup. Asserted as behaviour rather than as markup, because what makes it correct is the order in
+    /// the handler rather than the flyout being attached — see the test below.
+    /// </remarks>
+    [Fact]
+    public async Task TheCaretBesideVaults_OpensTheVaultMenu()
+    {
+        await OnTheStripAsync((strip, window) =>
+        {
+            var caret = CaretButton(strip);
+
+            FlyoutBase.GetAttachedFlyout(caret)!.IsOpen.ShouldBeFalse("nothing has been pressed yet");
+
+            Click(caret, window);
+
+            FlyoutBase.GetAttachedFlyout(caret)!.IsOpen.ShouldBeTrue();
+        });
+    }
+
+    /// <summary>
+    /// Opening the vault menu selects the Vaults tab first, so the renderer is collapsed under it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>The occlusion guard, and the reason this strip may have a flyout at all.</b> The comment on the
+    /// <c>+</c> button refuses one because a popup dropping into the terminal's rectangle would have to
+    /// composite above a native child window, which this project does not claim without a screenshot. The
+    /// caret sidesteps the question rather than answering it: it goes to the Vaults tab before it opens,
+    /// and a page surface is one where the renderer is not drawn.
+    /// </para>
+    /// <para>
+    /// So the assertion is on <see cref="MainWindowViewModel.IsTerminalShowing"/> rather than on anything
+    /// about the popup. A change that opened the flyout without moving the surface first would still show a
+    /// menu in every screenshot anybody took on a machine where it happened to work.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task OpeningTheVaultMenu_SelectsTheVaultsTabSoTheTerminalIsNotUnderIt()
+    {
+        await OnTheStripAsync((strip, window) =>
+        {
+            shell.SelectTabCommand.Execute(shell.Tabs[0]);
+
+            shell.IsTerminalShowing.ShouldBeTrue("this test is meaningless without one in the way");
+
+            Click(CaretButton(strip), window);
+
+            shell.IsVaultsTab.ShouldBeTrue();
+            shell.IsTerminalShowing.ShouldBeFalse(
+                "the flyout must never have to composite over the renderer's native child window");
+        });
+    }
+
     /// <remarks>
     /// None of the three owns a shell, so none of them may offer to end one. The cross is what tells a
     /// destination from a machine in this strip, and a fixed tab that grew one would be offering to close
     /// SFTP.
+    /// <para>
+    /// The Vaults caret is a sibling of its tab rather than a child, which is what keeps this assertion
+    /// meaning what it says: a button inside a fixed tab would still be a close box.
+    /// </para>
     /// </remarks>
     [Fact]
     public async Task TheFixedTabsCarryNoCloseBox()
@@ -411,6 +470,11 @@ public sealed class TerminalTabsTests : IAsyncLifetime
             .OfType<Button>()
             .First(button => ReferenceEquals(button.DataContext, tab) && button.Classes.Contains("close"));
 
+    /// <summary>The half of the Vaults pill that opens the vault menu.</summary>
+    /// <inheritdoc cref="TabButton" path="/remarks" />
+    private static Button CaretButton(Visual strip) =>
+        strip.GetVisualDescendants().OfType<Button>().First(button => button.Classes.Contains("caret"));
+
     /// <inheritdoc cref="TabButton" />
     private static Button PlusButton(Visual strip) =>
         strip.GetVisualDescendants().OfType<Button>().First(button => button.Classes.Contains("plus"));

tests/DodoSSH.Client.App.Tests/FakeVaultServer.Teams.cs

@@ -52,6 +52,24 @@ internal sealed partial class FakeVaultServer : ITeamApi, IDirectoryApi, IVaultG
     /// </remarks>
     internal bool CorruptKeyLog { get; set; }
 
+    /// <summary>Slugs this fake refuses, as the real server refuses one already in use.</summary>
+    /// <remarks>
+    /// A vault's slug is derived from its name rather than typed, so a collision is something the client
+    /// has to get out of on its own — and a fake that accepted every slug could not tell whether it does.
+    /// </remarks>
+    internal HashSet<string> TakenSlugs { get; } = new(StringComparer.Ordinal);
+
+    /// <summary>How many vault creates to refuse before answering normally.</summary>
+    /// <remarks>
+    /// Creating a vault of its own is two calls, and the failure worth testing is the one between them:
+    /// the team is made and the vault is not. One refusal is enough to leave the client in that state and
+    /// let the test press CREATE again.
+    /// </remarks>
+    internal int VaultCreateFailures { get; set; }
+
+    /// <summary>How many team creates have been asked for, for a test to assert on.</summary>
+    internal int TeamCreates { get; private set; }
+
     /// <summary>Registers another account, as though they had signed in and enrolled here.</summary>
     /// <returns>Their user id.</returns>
     internal Guid AddAccount(string email, string displayName)
@@ -87,6 +105,24 @@ internal sealed partial class FakeVaultServer : ITeamApi, IDirectoryApi, IVaultG
         CreateTeamRequest request,
         CancellationToken cancellationToken)
     {
+        TeamCreates++;
+
+        // Idempotent on the client-chosen id, as the real one is. That is the whole of how a create whose
+        // second half failed is retried without leaving a second team behind, so a fake that made one
+        // anyway would let the bug through.
+        if (teams.Find(row => row.TeamId == request.TeamId) is { } existing)
+        {
+            return Task.FromResult(existing);
+        }
+
+        if (TakenSlugs.Contains(request.Slug))
+        {
+            throw new DodoSshApiException(
+                System.Net.HttpStatusCode.Conflict,
+                ProblemCodes.TeamSlugTaken,
+                $"The slug '{request.Slug}' is already in use.");
+        }
+
         var team = new TeamSummary(
             request.TeamId,
             request.Name,
@@ -388,6 +424,16 @@ internal sealed partial class FakeVaultServer : ITeamApi, IDirectoryApi, IVaultG
         CreateTeamVaultRequest request,
         CancellationToken cancellationToken)
     {
+        if (VaultCreateFailures > 0)
+        {
+            VaultCreateFailures--;
+
+            throw new DodoSshApiException(
+                System.Net.HttpStatusCode.ServiceUnavailable,
+                code: null,
+                "The server is not answering.");
+        }
+
         var vault = new VaultSummary(
             request.VaultId,
             request.Name,

tests/DodoSSH.Client.App.Tests/TeamSharingTests.cs

@@ -112,7 +112,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
 
         await CreateTeamAsync(teams, "Platform", "platform");
 
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
         teams.Vaults.Count.ShouldBe(1, teams.Status);
 
         teams.InviteEmail = "bob@example.com";
@@ -156,7 +156,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var colleague = server.AddAccount("mallory@example.com", "Mallory Example");
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         teams.InviteEmail = "mallory@example.com";
         await teams.AddMemberCommand.ExecuteAsync(null);
@@ -186,7 +186,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var teams = shell.Teams;
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         var vaultId = teams.Vaults[0].VaultId;
         var session = shell.Vault!.Session;
@@ -213,7 +213,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var teams = shell.Teams;
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         var vault = shell.Vault!;
         var teamVaultId = teams.Vaults[0].VaultId;
@@ -254,7 +254,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var teams = shell.Teams;
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         var teamVaultId = teams.Vaults[0].VaultId;
         var vault = shell.Vault!;
@@ -288,7 +288,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var colleague = server.AddAccount("bob@example.com", "Bob Example");
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         teams.InviteEmail = "bob@example.com";
         await teams.AddMemberCommand.ExecuteAsync(null);
@@ -414,7 +414,7 @@ public sealed class TeamSharingTests : IAsyncLifetime
         var teams = shell.Teams;
 
         await CreateTeamAsync(teams, "Platform", "platform");
-        await teams.CreateVaultCommand.ExecuteAsync(null);
+        await CreateVaultAsync(teams, "Platform secrets");
 
         teams.ArchiveTeamCommand.Execute(null);
         await teams.ConfirmActionCommand.ExecuteAsync(null);
@@ -571,6 +571,21 @@ public sealed class TeamSharingTests : IAsyncLifetime
         teams.Members.ShouldHaveSingleItem().Role.ShouldBe("OWNER");
     }
 
+    /// <remarks>
+    /// Through the form rather than straight at the command, because the name is what the form is for: a
+    /// vault used to be named after its team, which gave a team with three of them three vaults called the
+    /// same thing.
+    /// </remarks>
+    private async Task CreateVaultAsync(TeamsViewModel teams, string name)
+    {
+        teams.NewVaultCommand.Execute(null);
+        teams.NewVaultName = name;
+
+        await teams.CreateVaultCommand.ExecuteAsync(null);
+
+        teams.IsCreatingVault.ShouldBeFalse(teams.Status);
+    }
+
     private async Task CreateTeamAsync(TeamsViewModel teams, string name, string slug)
     {
         await teams.LoadAsync(Token);

tests/DodoSSH.Client.App.Tests/VaultVisibilityTests.cs

@@ -0,0 +1,574 @@
+using DodoSSH.Client.Session;
+// FakeDeviceKeyStore is compiled into this assembly from a source link and keeps its original namespace;
+// see the csproj for why it is shared rather than reimplemented.
+using DodoSSH.Client.Session.Tests;
+using DodoSSH.Client.Shell.ViewModels;
+using DodoSSH.Client.Ssh;
+using DodoSSH.Client.Storage;
+using DodoSSH.Client.Terminal;
+using DodoSSH.Crypto;
+
+namespace DodoSSH.Client.App.Tests;
+
+/// <summary>
+/// Making a vault by naming it, and switching one off without switching it out.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Two features that meet in the same place. <b>Creating</b> a vault takes a name and nothing else — the
+/// team that owns it is derived and made behind it — so the half worth testing is the failure between the
+/// two calls, where the team exists and the vault does not.
+/// </para>
+/// <para>
+/// <b>Hiding</b> one is a preference about what is drawn, and every test below that says "still" is
+/// guarding the line it must not cross. A hidden vault goes on syncing, its keys go on authenticating
+/// hosts that are still on screen, and it stays choosable as somewhere to file a new item. What changes is
+/// the lists a person reads, and nothing else.
+/// </para>
+/// </remarks>
+public sealed class VaultVisibilityTests : IAsyncLifetime
+{
+    private const string Passphrase = "a sufficiently long passphrase";
+
+    private static readonly Argon2Profile CheapProfile =
+        Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);
+
+    private readonly FakeVaultServer server = new();
+    private readonly FakeSshConnectionFactory ssh = new();
+
+    private string directory = null!;
+    private ClientPaths paths = null!;
+    private ClientCacheFactory caches = null!;
+    private TerminalWorkspace workspace = null!;
+    private VaultKnownHostStore knownHosts = null!;
+    private FakeDeviceKeyStore deviceKeys = null!;
+    private MainWindowViewModel shell = null!;
+
+    private static CancellationToken Token => TestContext.Current.CancellationToken;
+
+    /// <inheritdoc />
+    public ValueTask InitializeAsync()
+    {
+        directory = Path.Combine(Path.GetTempPath(), $"dodossh-visibility-{Guid.CreateVersion7():N}");
+        paths = new ClientPaths(directory);
+
+        caches = ClientCacheFactory.ForFile(paths.CacheFile);
+        knownHosts = new VaultKnownHostStore();
+        deviceKeys = new FakeDeviceKeyStore();
+
+        workspace = new TerminalWorkspace(
+            new InMemoryTerminalAssetProvider(
+                new Dictionary<string, TerminalAsset>(StringComparer.Ordinal)),
+            ssh,
+            TimeProvider.System);
+
+        shell = NewShell();
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public async ValueTask DisposeAsync()
+    {
+        await shell.DisposeAsync();
+        knownHosts.Close();
+        await workspace.DisposeAsync();
+        caches.Dispose();
+
+        try
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+        catch (IOException)
+        {
+            // A cache file the process has not finished releasing. The directory is under the temp path
+            // and named per run, so leaving it costs a few kilobytes and never collides.
+        }
+    }
+
+    // ---- Making one ----
+
+    /// <remarks>
+    /// The whole feature in one test. A name is all that is asked for, and what comes back is a vault this
+    /// machine can already write to inside a team this account owns — which is what makes the rest of the
+    /// screen, members and roles and key holders, apply to it.
+    /// </remarks>
+    [Fact]
+    public async Task CreatingAVaultByNameAlone_MakesATeamForItAndOwnsIt()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+        await CreateVaultAsync("Platform secrets");
+
+        var team = teams.Teams.ShouldHaveSingleItem();
+
+        team.Name.ShouldBe("Platform secrets");
+        team.Slug.ShouldBe("platform-secrets", "the slug is derived rather than asked for");
+        team.Role.ShouldBe("OWNER");
+
+        var vault = teams.Vaults.ShouldHaveSingleItem();
+
+        vault.Name.ShouldBe("Platform secrets");
+        shell.Vault!.Session.ReadableVaults
+            .Select(row => row.VaultId)
+            .ShouldContain(vault.VaultId, "a vault made here is usable here, without a relock");
+    }
+
+    /// <remarks>
+    /// Where the flow lands, and it is the point of routing the tab strip's entry through this screen: the
+    /// next thing anybody making a shared vault wants is the people, and the people are here.
+    /// </remarks>
+    [Fact]
+    public async Task CreatingAVaultByNameAlone_LeavesTheNewVaultSelectedOnTheTeamsScreen()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+        await CreateVaultAsync("Platform secrets");
+
+        teams.SelectedTeam.ShouldNotBeNull(teams.Status);
+        teams.SelectedTeam.Name.ShouldBe("Platform secrets");
+        teams.SelectedVault.ShouldNotBeNull(teams.Status);
+        teams.SelectedVault.Name.ShouldBe("Platform secrets");
+    }
+
+    /// <remarks>
+    /// The failure between the two calls. The team is real and stays — a client that archived it because a
+    /// later step failed is a client that will one day archive a team somebody has just been added to — so
+    /// the sentence has to carry the whole state rather than "creating the vault failed".
+    /// </remarks>
+    [Fact]
+    public async Task AVaultCreateThatFailsAfterTheTeam_KeepsTheTeamAndSaysSo()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+
+        server.VaultCreateFailures = 1;
+
+        teams.NewVaultInItsOwnTeamCommand.Execute(null);
+        teams.NewVaultName = "Platform secrets";
+
+        await teams.CreateVaultCommand.ExecuteAsync(null);
+
+        teams.Teams.ShouldHaveSingleItem().Name.ShouldBe("Platform secrets");
+        teams.Vaults.ShouldBeEmpty();
+
+        teams.IsCreatingVault.ShouldBeTrue("the form stays open so CREATE can be pressed again");
+        teams.NewVaultName.ShouldBe("Platform secrets", "and what was typed is still in it");
+
+        teams.Status.ShouldContain("was created, but its vault was not");
+        teams.Status.ShouldContain("Press CREATE again");
+    }
+
+    /// <remarks>
+    /// The retry, and the reason the team id is generated once and held rather than per attempt. A second
+    /// team would leave somebody with two identically named ones and no way to tell which is which.
+    /// </remarks>
+    [Fact]
+    public async Task RetryingAfterTheVaultCreateFailed_ReusesTheTeamRatherThanMakingASecond()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+
+        server.VaultCreateFailures = 1;
+
+        teams.NewVaultInItsOwnTeamCommand.Execute(null);
+        teams.NewVaultName = "Platform secrets";
+
+        await teams.CreateVaultCommand.ExecuteAsync(null);
+
+        var teamId = teams.Teams.ShouldHaveSingleItem().TeamId;
+
+        // Pressed again on the form that is still open, which is exactly what the message tells the user
+        // to do.
+        await teams.CreateVaultCommand.ExecuteAsync(null);
+
+        teams.Teams.ShouldHaveSingleItem().TeamId.ShouldBe(teamId);
+        teams.Vaults.ShouldHaveSingleItem().Name.ShouldBe("Platform secrets");
+        teams.IsCreatingVault.ShouldBeFalse(teams.Status);
+    }
+
+    /// <remarks>
+    /// A slug is derived, so a collision is something the user cannot see coming and cannot fix by editing
+    /// a field they were never shown. One retry with a disambiguated slug, and the name they typed is left
+    /// alone — the name is theirs, the slug is a handle.
+    /// </remarks>
+    [Fact]
+    public async Task ASlugAlreadyInUse_IsRetriedOnceWithADisambiguatedOne()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+
+        server.TakenSlugs.Add("platform-secrets");
+
+        await CreateVaultAsync("Platform secrets");
+
+        var team = teams.Teams.ShouldHaveSingleItem();
+
+        team.Name.ShouldBe("Platform secrets", "the name is what the user typed");
+        team.Slug.ShouldStartWith("platform-secrets-");
+        team.Slug.ShouldNotBe("platform-secrets");
+    }
+
+    /// <remarks>
+    /// A name written in a script with no a-z or 0-9 in it leaves nothing to slugify. It still has to be a
+    /// vault a person can make, so the fallback is the team's own id rather than a refusal pointing at a
+    /// field that does not exist.
+    /// </remarks>
+    [Fact]
+    public async Task AVaultNameWithNothingSluggableInIt_StillGetsAUsableSlug()
+    {
+        await UnlockedAsync();
+
+        var teams = shell.Teams;
+
+        await teams.LoadAsync(Token);
+        await CreateVaultAsync("διαχείριση");
+
+        var team = teams.Teams.ShouldHaveSingleItem();
+
+        team.Name.ShouldBe("διαχείριση");
+        team.Slug.ShouldStartWith("vault-");
+        team.Slug.Length.ShouldBeGreaterThan("vault-".Length);
+    }
+
+    // ---- Switching one off ----
+
+    /// <remarks>
+    /// What the switch is for. Somebody in four teams does not want four teams' machines in front of them
+    /// all day, and this is the list that gets shorter.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_TakesItsHostsOffTheHostsScreen()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAHostAsync("Platform secrets", "prod-db");
+        var vault = shell.Vault!;
+
+        vault.VisibleHosts.ShouldContain(row => row.VaultId == teamVaultId);
+
+        await HideAsync(teamVaultId);
+
+        vault.VisibleHosts.ShouldNotContain(row => row.VaultId == teamVaultId);
+        vault.Hosts.ShouldContain(
+            row => row.VaultId == teamVaultId,
+            "the unfiltered list stays whole — everything that resolves a binding reads it");
+
+        vault.HasVisibleHosts.ShouldBeFalse("the personal vault has nothing in it in this test");
+        vault.NoVisibleHostsMessage.ShouldContain("switched off");
+    }
+
+    /// <remarks>
+    /// The keychain is vault-scoped too, so the same switch has to reach it. The table is what is filtered
+    /// rather than the typed lists behind it — see the test below for why that distinction is load-bearing.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_TakesItsKeysOffTheKeychain()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAKeyAsync("Platform secrets", "deploy");
+        var vault = shell.Vault!;
+
+        vault.VaultItems.ShouldContain(row => string.Equals(row.Name, "deploy", StringComparison.Ordinal));
+
+        await HideAsync(teamVaultId);
+
+        vault.VaultItems.ShouldNotContain(
+            row => string.Equals(row.Name, "deploy", StringComparison.Ordinal));
+    }
+
+    /// <remarks>
+    /// <b>The regression this whole design is shaped around.</b> A host in one vault may authenticate with
+    /// a key filed in another, and the only authentication resolution in the product reads the keychain's
+    /// typed list. Filtering that list rather than the table would make switching a vault off break
+    /// connections to hosts still on screen — a preference about reading turning into an outage.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_LeavesAHostThatBindsItsKeyStillConnectable()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAKeyAsync("Platform secrets", "deploy");
+        var vault = shell.Vault!;
+
+        var key = vault.Keys.Single(row => string.Equals(row.Label, "deploy", StringComparison.Ordinal));
+
+        await HideAsync(teamVaultId);
+
+        vault.Keys.ShouldContain(
+            row => row.EntityId == key.EntityId,
+            "a hidden vault's keys still have to resolve for the hosts that name them");
+
+        vault.NewHostCommand.Execute(null);
+
+        vault.EditorAuthenticationChoices.ShouldContain(
+            choice => choice.EntityId == key.EntityId,
+            "and still have to be offerable, or the binding could never be repaired");
+    }
+
+    /// <remarks>
+    /// Hiding is about reading. A destination you cannot choose is a vault you cannot put anything in, so
+    /// switching a team's forty hosts out of the way must not quietly stop you filing into it.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_LeavesItInTheSaveTargetPicker()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAHostAsync("Platform secrets", "prod-db");
+
+        await HideAsync(teamVaultId);
+
+        shell.Vault!.TargetVaults.Select(choice => choice.VaultId).ShouldContain(teamVaultId);
+    }
+
+    /// <remarks>
+    /// The line the feature must not cross. A vault that stopped syncing because somebody tidied it off
+    /// their screen would be found out weeks later, by a host that was never there.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_DoesNotStopItSyncing()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAHostAsync("Platform secrets", "prod-db");
+        var vault = shell.Vault!;
+
+        await HideAsync(teamVaultId);
+
+        vault.Session.ReadableVaults.Select(row => row.VaultId).ShouldContain(teamVaultId);
+
+        // And it still accepts writes and still pushes them, which is the part a user would notice.
+        var before = server.LiveRowCount;
+
+        await AddHostAsync(vault, teamVaultId, "prod-cache", "cache.internal");
+
+        server.LiveRowCount.ShouldBe(before + 1, vault.Status);
+        vault.PendingChanges.ShouldBe(0, "saving pushes, hidden or not");
+    }
+
+    /// <remarks>
+    /// The pin list describes a pin nothing dials as unused, which is a hint that invites withdrawing
+    /// trust. That answer is taken over every host rather than the shown ones, so switching a vault off
+    /// cannot turn a pin somebody relies on into one they are being nudged to delete.
+    /// </remarks>
+    [Fact]
+    public async Task HidingATeamVault_StillCountsItsHostsWhenDecidingWhichPinsNothingDials()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAHostAsync("Platform secrets", "prod-db");
+        var vault = shell.Vault!;
+
+        // Trusted into the personal vault, which is where the handshake writes; the host it is for lives in
+        // the team's. That crossing is exactly the case the count has to survive.
+        await knownHosts.TrustAsync(
+            new HostKeyPresentation("db.internal", 22, "ssh-ed25519", "SHA256:the-key"), Token);
+
+        await vault.LoadAsync(Token);
+
+        vault.KnownHostPins.ShouldHaveSingleItem().IsDialledByAHost.ShouldBeTrue();
+
+        await HideAsync(teamVaultId);
+
+        vault.KnownHostPins.ShouldHaveSingleItem().IsDialledByAHost
+            .ShouldBeTrue("hiding a vault must not make a pin look abandoned");
+    }
+
+    /// <remarks>
+    /// It is a preference, so it belongs to the machine rather than to the session. Somebody who set a
+    /// vault aside yesterday has not asked to be shown it again this morning.
+    /// </remarks>
+    [Fact]
+    public async Task HidingAVault_SurvivesLockingAndUnlocking()
+    {
+        await UnlockedAsync();
+
+        var teamVaultId = await VaultWithAHostAsync("Platform secrets", "prod-db");
+
+        await HideAsync(teamVaultId);
+        await shell.LockCommand.ExecuteAsync(null);
+
+        shell.VaultToggles.ShouldBeEmpty("the switches belong to the session that was open");
+
+        shell.Passphrase = Passphrase;
+        await shell.UnlockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Unlocked, shell.StatusMessage);
+
+        shell.VaultToggles.Single(toggle => toggle.VaultId == teamVaultId).IsShown.ShouldBeFalse();
+        shell.Vault!.VisibleHosts.ShouldNotContain(row => row.VaultId == teamVaultId);
+    }
+
+    /// <remarks>
+    /// It is drawn in the menu and ticked, because a vault missing from a list of vaults reads as something
+    /// having gone wrong — and it cannot be switched off, because snippets, logs, buckets and the editable
+    /// group and tag lists are all read from it alone. Switching it off would empty half the application
+    /// rather than filter it, so the refusal says why instead of doing nothing.
+    /// </remarks>
+    [Fact]
+    public async Task ThePersonalVaultIsListedAndCannotBeHidden()
+    {
+        await UnlockedAsync();
+        await CreateVaultAsync("Platform secrets");
+
+        var personal = shell.VaultToggles.Single(toggle => toggle.IsPersonal);
+
+        personal.IsShown.ShouldBeTrue();
+        personal.CanHide.ShouldBeFalse();
+
+        await shell.ToggleVaultCommand.ExecuteAsync(personal);
+
+        shell.VaultToggles.Single(toggle => toggle.IsPersonal).IsShown.ShouldBeTrue();
+        shell.StatusMessage.ShouldContain("always shown");
+    }
+
+    /// <remarks>
+    /// The switches are the readable vaults, personal first. A vault whose grant awaits re-wrap has nothing
+    /// that would decrypt, so a switch for it would do nothing at all.
+    /// </remarks>
+    [Fact]
+    public async Task TheVaultMenu_ListsEveryReadableVaultWithThePersonalOneFirst()
+    {
+        await UnlockedAsync();
+
+        shell.HasVaultSwitches.ShouldBeFalse("one vault is a menu with nothing to choose between");
+
+        await CreateVaultAsync("Platform secrets");
+
+        shell.HasVaultSwitches.ShouldBeTrue();
+        shell.VaultToggles.Count.ShouldBe(2);
+        shell.VaultToggles[0].IsPersonal.ShouldBeTrue();
+        shell.VaultToggles[1].Display.ShouldBe("Platform secrets · TEAM");
+    }
+
+    // ---- Helpers ----
+
+    private MainWindowViewModel NewShell() =>
+        new(
+            paths,
+            caches,
+            workspace,
+            knownHosts,
+            deviceKeys,
+            (_, _) => Task.FromResult<IVaultServer>(server),
+            TimeProvider.System,
+            NSubstitute.Substitute.For<ISftpSessionFactory>(),
+            CheapProfile);
+
+    /// <summary>Names a vault, from the form the tab strip's menu opens.</summary>
+    private async Task<Guid> CreateVaultAsync(string name)
+    {
+        var teams = shell.Teams;
+
+        teams.NewVaultInItsOwnTeamCommand.Execute(null);
+        teams.NewVaultName = name;
+
+        await teams.CreateVaultCommand.ExecuteAsync(null);
+
+        teams.IsCreatingVault.ShouldBeFalse(teams.Status);
+
+        return teams.Vaults.Single(row => string.Equals(row.Name, name, StringComparison.Ordinal))
+            .VaultId;
+    }
+
+    private async Task<Guid> VaultWithAHostAsync(string vaultName, string hostLabel)
+    {
+        await shell.Teams.LoadAsync(Token);
+
+        var vaultId = await CreateVaultAsync(vaultName);
+
+        await AddHostAsync(shell.Vault!, vaultId, hostLabel, "db.internal");
+
+        return vaultId;
+    }
+
+    private async Task<Guid> VaultWithAKeyAsync(string vaultName, string keyLabel)
+    {
+        await shell.Teams.LoadAsync(Token);
+
+        var vaultId = await CreateVaultAsync(vaultName);
+        var vault = shell.Vault!;
+
+        await vault.LoadAsync(Token);
+
+        vault.SelectedTargetVault = vault.TargetVaults.Single(choice => choice.VaultId == vaultId);
+
+        vault.NewKeyCommand.Execute(null);
+        vault.KeyEditorLabel = keyLabel;
+        vault.KeyEditorPrivateKey =
+            "-----BEGIN OPENSSH PRIVATE KEY-----\nMATERIAL\n-----END OPENSSH PRIVATE KEY-----\n";
+
+        await vault.SaveKeyCommand.ExecuteAsync(null);
+
+        vault.IsEditingKey.ShouldBeFalse(vault.Status);
+
+        return vaultId;
+    }
+
+    private async Task AddHostAsync(
+        VaultViewModel vault,
+        Guid vaultId,
+        string label,
+        string hostname)
+    {
+        await vault.LoadAsync(Token);
+
+        vault.SelectedTargetVault = vault.TargetVaults.Single(choice => choice.VaultId == vaultId);
+
+        vault.NewHostCommand.Execute(null);
+        vault.EditorLabel = label;
+        vault.EditorHostname = hostname;
+        vault.EditorUsername = "deploy";
+
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.IsEditing.ShouldBeFalse(vault.Status);
+    }
+
+    /// <summary>Switches a vault off through the menu, as the tab strip does.</summary>
+    private async Task HideAsync(Guid vaultId)
+    {
+        var toggle = shell.VaultToggles.Single(row => row.VaultId == vaultId);
+
+        await shell.ToggleVaultCommand.ExecuteAsync(toggle);
+
+        shell.VaultToggles.Single(row => row.VaultId == vaultId).IsShown
+            .ShouldBeFalse(shell.StatusMessage);
+    }
+
+    /// <inheritdoc cref="TeamSharingTests.UnlockedAsync" />
+    private async Task UnlockedAsync()
+    {
+        await shell.StartAsync(Token);
+        await shell.SignInCommand.ExecuteAsync(null);
+
+        shell.Passphrase = Passphrase;
+        shell.ConfirmPassphrase = Passphrase;
+        await shell.EnrollCommand.ExecuteAsync(null);
+
+        shell.RecoveryCodeWrittenDown = true;
+        shell.ConfirmRecoveryCodeCommand.Execute(null);
+
+        shell.Passphrase = Passphrase;
+        await shell.UnlockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Unlocked, shell.StatusMessage);
+    }
+}

tests/DodoSSH.Client.Storage.Tests/CacheStoreTests.cs

@@ -205,6 +205,61 @@ public sealed class CacheStoreTests : IAsyncLifetime
         read!.WrappedVaultKey.ShouldBe(wrapped);
     }
 
+    [Fact]
+    public async Task HidingAVault_SurvivesTheNextVaultListFromTheServer()
+    {
+        // The whole reason the flag is a column here rather than a field on StoredVault. /me is fetched
+        // once a minute; a refresh that carried this preference along would un-hide every vault within
+        // the minute, and the user would never work out what kept switching them back on.
+        var vaultId = Guid.CreateVersion7();
+
+        await harness.Vaults.ReplaceAllAsync([Vault(vaultId, "Ops", 1)], Token);
+        await harness.Vaults.SetHiddenAsync(vaultId, hidden: true, Token);
+
+        await harness.Vaults.ReplaceAllAsync([Vault(vaultId, "Ops renamed", 2)], Token);
+
+        (await harness.Vaults.ListHiddenAsync(Token)).ShouldBe([vaultId]);
+    }
+
+    [Fact]
+    public async Task TheServersVaultList_NeverHidesAVaultByItself()
+    {
+        // The other direction, and worth its own test: the server knows nothing about which vaults this
+        // machine is showing, so no answer it gives may switch one off.
+        var vaultId = Guid.CreateVersion7();
+
+        await harness.Vaults.ReplaceAllAsync([Vault(vaultId, "Ops", 1)], Token);
+
+        (await harness.Vaults.ListHiddenAsync(Token)).ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task HidingAVaultThatIsNoLongerCached_DoesNothing()
+    {
+        // A grant withdrawn between the click and the write. There is nothing left to record a reading
+        // preference about, and the vault is already off every list the preference would have applied to.
+        await Should.NotThrowAsync(
+            () => harness.Vaults.SetHiddenAsync(Guid.CreateVersion7(), hidden: true, Token));
+
+        (await harness.Vaults.ListHiddenAsync(Token)).ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task AVaultThatLosesItsGrantAndGetsItBack_ComesBackShowing()
+    {
+        // Absence from the server's list means access was lost, and the row goes with it. Being re-granted
+        // is a new vault as far as this machine is concerned, and a new vault is shown.
+        var vaultId = Guid.CreateVersion7();
+
+        await harness.Vaults.ReplaceAllAsync([Vault(vaultId, "Ops", 1)], Token);
+        await harness.Vaults.SetHiddenAsync(vaultId, hidden: true, Token);
+
+        await harness.Vaults.ReplaceAllAsync([], Token);
+        await harness.Vaults.ReplaceAllAsync([Vault(vaultId, "Ops", 1)], Token);
+
+        (await harness.Vaults.ListHiddenAsync(Token)).ShouldBeEmpty();
+    }
+
     // ---- Unlock material ----
 
     [Fact]