Record v5 in the design-import log, and let the working notes go

docs/design-import-gaps.md

@@ -165,6 +165,84 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > | **Show more ⌄** | Not drawn as a disclosure. What it would hide — notes, the relay switch, forgetting the host key — is in the editor, one press away, and a second fold inside a pane that already scrolls is a second place for a field to be missing from. |
 > | **Port Forwarding** in the sidebar | Nothing, for the third time in this document. |
 > | The host grid's toolbar avatar, share and tag-filter controls | Omitted, as in v3 and for the same reasons. |
+>
+> ## The desktop's v5 — hosts, restyled, and two reversals
+>
+> A fifth pass, and the first that undoes as much of its own predecessors as it adds: a re-theme both heads
+> share, pinned folders as a full feature, a last-connected time read off the connection log, and two pieces
+> of earlier passes put back on the user's own instruction rather than kept.
+>
+> **The palette went purple, and three fonts are embedded that were only ever named before.** The shared
+> scheme moves from v3's near-black-and-blue to a purple accent (`#5D42DE`, with a gradient and a glow of its
+> own) over the same near-black canvas, and both heads recolour together — `Palette.axaml` is shared, and a
+> colour is not allowed to mean something different on the two of them. What changed on the desktop alone is
+> the type: Montserrat, JetBrains Mono and Material Icons are embedded as `AvaloniaResource` in the Shell
+> project rather than requested by name and left to whatever the machine happens to have, the way `WithInterFont`
+> alone used to leave Inter registered but unused. Montserrat is the default sans now, with Inter kept as its
+> fallback rather than the whole answer; `MonoFont` gains JetBrains Mono at the front of its own list, ahead of
+> the system-mono stack that is still behind it for a glyph JetBrains Mono does not cover. Android recolours
+> with the shared palette and keeps its own default sans — fonts are per-head by decision, only colour is
+> shared.
+>
+> **Flat sections replace the grid of group cards and the breadcrumb trail — reversing v3, on the user's own
+> approval rather than a defect found in it.** v3's grid held one level of the group tree at a time, opened by
+> a double-click, with a trail above it saying where you were; that model is retired outright rather than
+> folded into anything; every group is now a heading on one flat board, in label order, exactly the flattening
+> the phone's `SidebarRows` has always drawn — a headerless board for a groupless keychain, "No group" first
+> where there is one, a chevron per heading and one Collapse All. Nothing here was found broken; the grid did
+> what v3 asked for. The user asked for the phone's shape on the desktop too, and decision 2 in
+> `hosts-v5-design-spec.md` is that request recorded.
+>
+> **Tag chips and a mono address line are back on the card — reversing v4, also by approval and not by
+> defect.** v4 had replaced both with a two-line `ssh, root, pci, eu-west-1` subtitle and moved the address to
+> the tooltip alone, on the reasoning that a card read while scanning forty machines wants the kind of machine
+> more than its address. v5's own mock draws chips and an address on every card, and the user chose the mock's
+> arrangement over v4's when the two were put side by side — so the card now carries both: the full address is
+> still on the tooltip, as v4 left it, and a truncated mono copy sits under the name as well.
+>
+> **Pinned folders are a full feature, not a field with nowhere to be edited.** `HostSecret.PinnedPaths` is an
+> ordered, deduplicated list merged per path the way `TagIds` is merged per tag, so two machines pinning
+> different folders on one host both keep theirs. The drawer's QUICK ACCESS section edits it — a row per pin
+> with a close box, an add field and button, staged on `VaultViewModel.EditorPinnedPaths` the way the tag
+> picker stages `editorTagIds` — the card shows a pin-count badge once there is at least one, and the detail
+> pane repeats the list read-only in its own fieldrow idiom. Clicking a pin above a connected terminal opens
+> the SFTP tab with the remote pane navigated straight to that path, through the same connect path "Browse
+> files" already used — a second authenticated connection, exactly as every SFTP session here is.
+>
+> **Last connected is read off the synced connection log, and it is deliberately narrow about when.**
+> `max(StartedAt)` per `HostId` is computed on the hosts screen's own activation and again when a session ends,
+> then restrung into words on a one-minute tick for as long as the screen stays visible — never on the sync
+> loop, which is the same rule `LogsViewModel` states for the log itself: nobody is watching their own
+> connection from an hour ago update on a screen they are not looking at. A connected host prints nothing here;
+> the green dot already answers "right now", and printing an age beside it would be answering a question about
+> a session that is not the one still running. **It is scoped to the active vault alone**, the same limitation
+> `LogsViewModel` and `MainWindowViewModel.RecentConnections` already carry — a host filed in a second vault
+> this session can read gets no ago-text until something on this screen reads more than one vault's connection
+> history, which nothing does yet. And a session ending can, briefly, still show the previous entry: the
+> recorder's own write is queued onto a background task rather than made inline, so a re-read landing before
+> that write drains reads the log as it stood before the session it is reporting on closed. It self-heals on
+> the next activation or the next session end, and closing the gap outright was judged not worth blocking a
+> screen transition on the recorder's queue.
+>
+> **Quick connect grew to match, and quietly answers a different question than the mock's own row does.** The
+> card widened from 520 to 640, gained the mock's `>_` prompt styling and a live dot per row the way the hosts
+> board's own two-state dot works. What it does not draw is the mock's SSH/SFTP kind column — every palette
+> connection here is SSH, so a constant printed as though it varied would be exactly the kind of decoration
+> this document has refused before (the terminal's session footer, the snippet's kind badge); the auth word
+> (credential/key/password) answers a question that is actually different per row instead.
+>
+> | v5 element | What ships instead |
+> | --- | --- |
+> | The status dot's third, amber state | ◆ **Still two states, on the same reasoning v3 and v4 both gave and v5 was asked to reconsider.** Green means a terminal is open on that host, grey means one is not; nothing here pings a machine, so the amber "reachable but not connected" state has no fact behind it to draw. |
+> | The relay checkbox's mock copy | The pre-existing sentence, unchanged, "(not wired up yet)" included — restyled into the mock's own nested-card shape (radius 12, a title beside the box rather than under it) but not reworded. The mock's own copy implies a relay this client can dial; it cannot, for the reason `HostDrawer.axaml`'s own remarks give. |
+> | The host card as a link straight to a terminal | Click still selects, double-click still connects, and the pencil still opens the pane — the mock's card-as-link is not adopted, because multi-select (Ctrl, Shift, the marquee band) depends on a plain click meaning "choose this one" rather than "go". |
+> | Quick connect's SSH/SFTP kind column | The auth word — credential, key, or password — see above. |
+> | A collapsed section staying collapsed after a restart | In memory only, for the running session. `settings.json` holds two scalars by decision — the terminal's text size and whether this machine checks for updates on its own — and collapse state is not judged worth a third. |
+> | QUICK ACCESS's editor, on the phone | **Deferred; the data is not.** `HostSecret.PinnedPaths` is shared, synced and merged on both heads, so a pin made on the desktop reaches the phone and back — Android just has nowhere yet to add or remove one itself. |
+> | Collapse All beside every section's own collapse chevron | Bound on every heading's view model and shown on only the first — `SidebarGroupHeader.IsFirstBoardSection` is what a virtualised list of sections uses in place of a control of the board's own that would otherwise have to sit above all of them. |
+> | The QUICK ACCESS hint's claim that pins live in a sidebar | "Pinned folders appear above the terminal for this host." — no sidebar exists on this screen for the sentence to point at, so the shipped hint says where they actually draw. |
+> | The mock's "Saving to **DodoTech ▾** vault" subtitle, with a picker's chevron inside a sentence | The pre-existing `DrawerSubtitle` wording — the vault's name alone, unchanged by this pass. A chevron inside running text implies the text itself is the control, which it is not: the vault picker is its own element, shown only while creating and only above one writable vault, as it always has been. |
+> | The design's two deeper text steps, `#6D6F84` and `#5D5F74` | Not added as `Palette.axaml` keys. `TextGhost`, already repicked to `#7C7F98` for v3, is reused everywhere the design reaches for either — a resource nothing yet distinguishes from `TextGhost` is not free to carry, on the same reasoning the border ramp's own remarks give. |
 
 Most of it landed. This file is the rest: every element of that design with nothing behind it, which
 project each piece would have to land in, and **what the shipped interface does instead**. That last
@@ -301,7 +379,7 @@ field cannot be removed and stays as a permanently refused member; `SyncEndpoint
 | Status bar port forwards | client-ssh | Port forwarding. See below. | Omitted. |
 | Status bar `sftp · 2 transfers` | client-app | Nothing now — file transfer is built. What is missing is the count reaching the status bar, which is a screen away from where the queue lives. | Omitted from the status bar. The queue itself is on the FILES screen, with a row per transfer. |
 | Status bar `locks in 09:41` | client-app | An idle auto-lock. See preferences below. | Omitted. |
-| IBM Plex Mono / IBM Plex Sans | ui | Shipping the font files as `AvaloniaResource` and registering them. The design loads them from Google Fonts, which a desktop app cannot. | Inter (already embedded) for prose, and the system monospace stack the terminal already names. Named once in `App.axaml` as `MonoFont`, so the substitution is reversible in one place. |
+| IBM Plex Mono / IBM Plex Sans | ui | Shipping the font files as `AvaloniaResource` and registering them. The design loads them from Google Fonts, which a desktop app cannot. | **Shipped, since v5, and not IBM Plex.** The v5 design asked for Montserrat, JetBrains Mono and Material Icons instead, and all three are embedded as `AvaloniaResource` in the Shell project rather than requested by name and left to whatever the machine happens to have. Montserrat is the default sans, with Inter — the earlier substitution — kept only as its fallback; `MonoFont` puts JetBrains Mono first, ahead of the system-monospace stack the terminal still falls back to. Named once each in `Program.cs` and `Palette.axaml`, so a later design's fonts are still a one-line swap. |
 | `⌘K`, `⌥↵` | ui | Nothing; the design is Mac-flavoured. | `CTRL K`. Development is Windows-only today (`docs/platform-flags.md`). |
 
 **Also worth knowing:** custom chrome went in as `SystemDecorations="BorderOnly"`, not by extending the