Make the vault the thing you share, and ask a host which one it lives in

The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.

Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.

The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.

Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.

What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.

The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.

That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.

Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.

1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.

src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs

@@ -31,11 +31,11 @@ internal sealed record VaultToggleViewModel(Guid VaultId, string Name, bool IsPe
 {
     /// <summary>What the switch says.</summary>
     /// <remarks>
-    /// A team vault is marked as one, exactly as it is in the "file this into" picker, and for a weaker
+    /// A shared vault is marked as one, exactly as it is in the "file this into" picker, and for a weaker
     /// version of the same reason: two vaults may hold a host with the same label, and which vault a switch
     /// is about is the only thing that tells the two switches apart.
     /// </remarks>
-    internal string Display => IsPersonal ? Name : $"{Name} · TEAM";
+    internal string Display => IsPersonal ? Name : $"{Name} · SHARED";
 
     /// <summary>Whether this vault can be switched off.</summary>
     /// <remarks>
@@ -100,11 +100,22 @@ internal enum ShellScreen
     /// <summary>File transfer over SFTP: two directory panes and a queue.</summary>
     Transfers = 1,
 
-    /// <summary>Everything in the vault that is not a host.</summary>
-    Vault = 2,
+    /// <summary>Everything in the open vault that is not a host: keys, passwords, buckets, tags.</summary>
+    /// <remarks>
+    /// Named for what the rail calls it rather than for the vault it reads, which is what it was called
+    /// when <see cref="Vaults"/> arrived beside it. Two members a letter apart, one meaning "one vault's
+    /// contents" and the other "the vaults themselves", is a pair somebody eventually gets the wrong way
+    /// round.
+    /// </remarks>
+    Keychain = 2,
 
-    /// <summary>Shared vaults and the people in them. Both heads draw it.</summary>
-    Team = 3,
+    /// <summary>The vaults themselves and the people in them. Both heads draw it.</summary>
+    /// <remarks>
+    /// Was <c>Team</c>, and the value is unchanged with it: the screen is the same destination, and these
+    /// numbers are written into <c>NavRail.axaml</c> as <c>x:Static</c> literals. What changed is what the
+    /// screen is about — see <see cref="VaultsViewModel"/>.
+    /// </remarks>
+    Vaults = 3,
 
     /// <summary>Preferences.</summary>
     Preferences = 4,
@@ -275,7 +286,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// </remarks>
     private readonly ConnectionRecorder connectionLog;
 
-    private readonly TeamsViewModel teams;
+    private readonly VaultsViewModel vaults;
 
     /// <summary>
     /// The tab standing in for each connection that has been asked for and has not answered yet.
@@ -381,7 +392,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // The third argument is how a vault made over there reaches the lists and the menu over here: both
         // are built from the session's vault list, and neither would otherwise learn that it had grown until
         // something else happened to rebuild them.
-        teams = new TeamsViewModel(() => connection, () => Vault?.Session, OnVaultsChangedAsync);
+        vaults = new VaultsViewModel(() => connection, () => Vault?.Session, OnVaultsChangedAsync);
 
         // Subscribed for the life of the process, because the workspace lives that long and so does the tab
         // list. Detached in DisposeAsync, which is the only point either of them ends.
@@ -532,15 +543,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     private LogsViewModel? logsScreen;
 
     /// <summary>
-    /// The teams screen, which the window binds to whether or not a vault is open.
+    /// The vaults screen, which the window binds to whether or not a vault is open.
     /// </summary>
     /// <remarks>
-    /// Not nullable and never replaced, for the reason <see cref="Transfers"/> is not: the screen reads a
-    /// server rather than a vault, and both of its dependencies are fetched through a function at the
-    /// moment they are needed. That means a lock does not have to tear it down and an unlock does not have
-    /// to rebuild it, and the list it is showing survives both.
+    /// Not nullable and never replaced, for the reason <see cref="Transfers"/> is not: both of its
+    /// dependencies are fetched through a function at the moment they are needed. That means a lock does
+    /// not have to tear it down and an unlock does not have to rebuild it, and the list it is showing
+    /// survives both.
+    /// <para>
+    /// Distinct from <see cref="Vault"/>, which is one vault's <em>contents</em> — the hosts, keys and
+    /// passwords the rail's other screens draw. This one is the vaults themselves and the people in them.
+    /// </para>
     /// </remarks>
-    internal TeamsViewModel Teams => teams;
+    internal VaultsViewModel Vaults => vaults;
 
     /// <summary>The transfers screen, which the window binds to whether or not a vault is open.</summary>
     /// <remarks>
@@ -759,10 +774,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsTransfersScreen => Screen is ShellScreen.Transfers;
 
     /// <inheritdoc cref="IsHostsScreen" />
-    internal bool IsVaultScreen => Screen is ShellScreen.Vault;
+    internal bool IsKeychainScreen => Screen is ShellScreen.Keychain;
 
     /// <inheritdoc cref="IsHostsScreen" />
-    internal bool IsTeamScreen => Screen is ShellScreen.Team;
+    internal bool IsVaultsScreen => Screen is ShellScreen.Vaults;
 
     /// <inheritdoc cref="IsHostsScreen" />
     internal bool IsPreferencesScreen => Screen is ShellScreen.Preferences;
@@ -801,10 +816,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsTransfersShowing => IsShowingPages && IsTransfersScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
-    internal bool IsVaultShowing => IsShowingPages && IsVaultScreen;
+    internal bool IsKeychainShowing => IsShowingPages && IsKeychainScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
-    internal bool IsTeamShowing => IsShowingPages && IsTeamScreen;
+    internal bool IsVaultsShowing => IsShowingPages && IsVaultsScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
     internal bool IsPreferencesShowing => IsShowingPages && IsPreferencesScreen;
@@ -834,8 +849,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// tabs are each exactly one thing, and this one is seven.
     ///
     /// Preferences is in the list because the phone reaches it through the hub. The desktop reaches it from
-    /// the rail and never asks this. <see cref="ShellScreen.Team"/> is in it for the same reason and no
-    /// other: the desktop has a rail entry for teams and the phone reaches them through the hub, so a
+    /// the rail and never asks this. <see cref="ShellScreen.Vaults"/> is in it for the same reason and no
+    /// other: the desktop has a rail entry for it and the phone reaches it through the hub, so a
     /// screen missing here is one whose arrival darkens the tab that led to it and brings the shell's own
     /// header back over a screen that already has one.
     ///
@@ -849,7 +864,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsMoreSurface =>
         IsShowingPages && Screen is ShellScreen.More or ShellScreen.Snippets or ShellScreen.Logs
             or ShellScreen.Transfers or ShellScreen.Buckets or ShellScreen.Preferences
-            or ShellScreen.Team or ShellScreen.Vault;
+            or ShellScreen.Vaults or ShellScreen.Keychain;
 
     /// <summary>
     /// Whether the terminal's WebView may be on screen at this instant.
@@ -1107,6 +1122,11 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// and the two would have had to be kept in step. <see cref="IsTransfersShowing"/> and
     /// <see cref="IsBucketsShowing"/> are the other two tabs, unchanged and already used by both heads.
     /// </para>
+    /// <para>
+    /// <b>Not <see cref="IsVaultsShowing"/>, which is one of the nine screens underneath this tab.</b> The
+    /// two are true together whenever somebody is looking at the vaults screen and are otherwise unrelated:
+    /// this one is "the strip is on its first tab rather than on SFTP, S3 or a terminal".
+    /// </para>
     /// </remarks>
     internal bool IsVaultsTab => IsShowingPages && IsVaultsPage(Screen);
 
@@ -1265,19 +1285,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     }
 
     /// <summary>
-    /// Goes to the teams screen with the new-vault form open.
+    /// Goes to the vaults screen with the new-vault form open.
     /// </summary>
     /// <remarks>
-    /// A vault gets a team, so the place to make one is the screen that shows teams — where the people, the
-    /// roles and the key holders already are, which is the next thing anybody making a shared vault wants.
-    /// The form asks for a name and nothing else; see <c>TeamsViewModel.CreateVaultAsync</c> for what is
+    /// The screen a vault is made on is the one that shows vaults — where the people, the roles and the key
+    /// holders already are, which is the next thing anybody making a shared vault wants. The form asks for a
+    /// name and nothing else; see <c>VaultsViewModel.CreateVaultAsync</c> for the membership list that is
     /// made behind it.
     /// </remarks>
     [RelayCommand]
     private void ShowNewVault()
     {
-        ShowScreen(ShellScreen.Team);
-        teams.NewVaultInItsOwnTeamCommand.Execute(null);
+        ShowScreen(ShellScreen.Vaults);
+        vaults.NewVaultCommand.Execute(null);
     }
 
     // ---- The phone's connect menu ----
@@ -2964,13 +2984,14 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
             _ = logs.RefreshCommand.ExecuteAsync(null);
         }
 
-        // Teams are read from the server rather than from the vault, so there is nothing to show until
-        // somebody asks for it — and asking for it on every unlock would be a request per launch for a
-        // screen most people never open. Fire-and-forget because a property change cannot await, and
-        // because the view model turns every failure into its own status line rather than throwing.
-        if (value is ShellScreen.Team)
+        // Who is in each vault is read from the server rather than from the vault itself, so there is
+        // nothing to show until somebody asks for it — and asking for it on every unlock would be a request
+        // per launch for a screen most people never open. Fire-and-forget because a property change cannot
+        // await, and because the view model turns every failure into its own status line rather than
+        // throwing.
+        if (value is ShellScreen.Vaults)
         {
-            _ = teams.LoadAsync(CancellationToken.None);
+            _ = vaults.LoadAsync(CancellationToken.None);
         }
 
     }
@@ -3044,8 +3065,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     {
         OnPropertyChanged(nameof(IsHostsScreen));
         OnPropertyChanged(nameof(IsTransfersScreen));
-        OnPropertyChanged(nameof(IsVaultScreen));
-        OnPropertyChanged(nameof(IsTeamScreen));
+        OnPropertyChanged(nameof(IsKeychainScreen));
+        OnPropertyChanged(nameof(IsVaultsScreen));
         OnPropertyChanged(nameof(IsPreferencesScreen));
         OnPropertyChanged(nameof(IsKnownHostsScreen));
         OnPropertyChanged(nameof(IsImportScreen));
@@ -3058,8 +3079,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(IsVaultsTab));
         OnPropertyChanged(nameof(IsHostsShowing));
         OnPropertyChanged(nameof(IsTransfersShowing));
-        OnPropertyChanged(nameof(IsVaultShowing));
-        OnPropertyChanged(nameof(IsTeamShowing));
+        OnPropertyChanged(nameof(IsKeychainShowing));
+        OnPropertyChanged(nameof(IsVaultsShowing));
         OnPropertyChanged(nameof(IsPreferencesShowing));
         OnPropertyChanged(nameof(IsKnownHostsShowing));
         OnPropertyChanged(nameof(IsSnippetsShowing));

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -864,11 +864,12 @@ internal sealed record VaultChoiceViewModel(Guid VaultId, string Name, bool IsPe
     /// What the picker shows.
     /// </summary>
     /// <remarks>
-    /// A team vault is marked as one. The whole risk this picker introduces is putting a credential
+    /// A shared vault is marked as one. The whole risk this picker introduces is putting a credential
     /// somewhere more people can read it, so the option that does that must not look like the option
-    /// that does not.
+    /// that does not. It says SHARED rather than TEAM because a team is no longer something the person
+    /// choosing has been shown — see <c>VaultsViewModel</c>.
     /// </remarks>
-    internal string Display => IsPersonal ? Name : $"{Name} · TEAM";
+    internal string Display => IsPersonal ? Name : $"{Name} · SHARED";
 }
 
 internal sealed record VaultItemRowViewModel(
@@ -1064,6 +1065,18 @@ internal sealed partial class VaultViewModel(
     /// </remarks>
     private Dictionary<Guid, HostGroupSecret> groupsById = [];
 
+    /// <summary>
+    /// Every readable vault's groups, kept apart by the vault they live in.
+    /// </summary>
+    /// <remarks>
+    /// What the host editor's group picker is built from, and it has to be per vault rather than the one
+    /// list <see cref="Groups"/> holds. A group is an item like any other, so it lives in exactly one
+    /// vault; offering the personal vault's groups while a host is being filed into a shared one would
+    /// produce a host whose group id nobody else in that vault can resolve — a colleague would see it
+    /// filed under nothing, which is the quietest kind of wrong. See <see cref="BuildGroupChoices"/>.
+    /// </remarks>
+    private Dictionary<Guid, List<GroupChoice>> groupsByVault = [];
+
     /// <summary>
     /// The tags as they came out of the vault, before the host counts are attached.
     /// </summary>
@@ -1916,10 +1929,50 @@ internal sealed partial class VaultViewModel(
     [ObservableProperty]
     private AuthenticationChoice? editorSelectedAuthentication;
 
-    /// <summary>What the group picker offers: "no group", then every group.</summary>
+    /// <summary>What the group picker offers: "no group", then every group of the chosen vault.</summary>
     /// <inheritdoc cref="EditorAuthenticationChoices" path="/remarks" />
     internal ObservableCollection<GroupChoice> EditorGroupChoices { get; } = [];
 
+    /// <summary>
+    /// Which vault a host being created will be filed into.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The picker in the host editor itself, and it is a second one rather than the keychain screen's
+    /// <see cref="TargetVaults"/> reused: that one is a standing preference about where new items go and
+    /// this is a field of the host in front of you. Binding both to one selection would mean the box under
+    /// SSH KEYS moved every time somebody put a host somewhere, and — the other way round — that a host
+    /// half-typed on this screen could be moved by a click on that one, which is the bug
+    /// <see cref="editingHostVaultId"/> was introduced to prevent.
+    /// </para>
+    /// <para>
+    /// Filled from the same source, so what it offers is what the keychain screen offers: vaults this
+    /// session can both read and write.
+    /// </para>
+    /// </remarks>
+    internal ObservableCollection<VaultChoiceViewModel> EditorVaultChoices { get; } = [];
+
+    [ObservableProperty]
+    private VaultChoiceViewModel? editorSelectedVault;
+
+    /// <summary>
+    /// Whether the editor should be asking which vault this host goes into.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Only while creating, and only where there is more than one vault to choose between. An existing
+    /// host's vault is not editable and the picker is not shown disabled beside it: the two are encrypted
+    /// under different keys, so moving an item is a delete and a retype rather than a save — see the note
+    /// on the drawer's header, which says where the host is filed.
+    /// </para>
+    /// <para>
+    /// Hidden at one vault rather than shown with a single option, which is the rule
+    /// <see cref="HasVaultChoice"/> already applies for the same reason: a control offering one answer is
+    /// a question nobody was asked.
+    /// </para>
+    /// </remarks>
+    internal bool ShowsEditorVaultChoice => editingEntityId is null && EditorVaultChoices.Count > 1;
+
     [ObservableProperty]
     [NotifyPropertyChangedFor(nameof(EditorPortPlaceholder))]
     [NotifyPropertyChangedFor(nameof(EditorUsernamePlaceholder))]
@@ -2990,6 +3043,8 @@ internal sealed partial class VaultViewModel(
         // still this one's.
         groupItems = [];
 
+        var perVault = new Dictionary<Guid, List<GroupChoice>>();
+
         foreach (var vault in session.ReadableVaults)
         {
             var listing = await session.HostGroups
@@ -3003,6 +3058,13 @@ internal sealed partial class VaultViewModel(
                 resolvable[group.EntityId] = group.Secret;
             }
 
+            perVault[vault.VaultId] =
+            [
+                .. listing.Items
+                    .OrderBy(group => group.Secret.Label, StringComparer.CurrentCulture)
+                    .Select(group => new GroupChoice(group.EntityId, group.Secret.Label)),
+            ];
+
             if (vault.VaultId == session.ActiveVaultId)
             {
                 groupItems =
@@ -3011,6 +3073,7 @@ internal sealed partial class VaultViewModel(
         }
 
         groupsById = resolvable;
+        groupsByVault = perVault;
 
         return unreadable;
     }
@@ -4118,7 +4181,12 @@ internal sealed partial class VaultViewModel(
         }
 
         editingEntityId = null;
+
+        // The keychain screen's picker is the default rather than the answer: the editor has a picker of its
+        // own from here on, and moving that one is what decides where this host lands. See
+        // EditorVaultChoices.
         editingHostVaultId = TargetVaultId;
+
         EditorLabel = string.Empty;
         EditorHostname = string.Empty;
 
@@ -4132,13 +4200,18 @@ internal sealed partial class VaultViewModel(
         EditorNewTag = string.Empty;
         BuildTagChoices();
 
+        // Before the group picker, because a group belongs to one vault and the picker is that vault's.
+        BuildEditorVaultChoices(editingHostVaultId);
+
         // A new host opens in the group the screen is already about — the card that is selected, or failing
         // that the group whose contents are showing. Adding three machines to the group somebody has just
         // made is the ordinary case, and since the grid holds one level at a time the alternative is worse
         // than a default nobody chose: a host created inside a group and filed under none would vanish from
-        // the screen it was created on. Before the picker, because whether there is a group to inherit from
-        // decides whether the picker offers to.
-        BuildGroupChoices(GroupTarget?.EntityId);
+        // the screen it was created on. Only when that group is in the vault this host is going into,
+        // though — the grid draws the active vault's groups, and inheriting one into a shared vault would
+        // file the host under something nobody else in it can resolve. Before the authentication picker,
+        // because whether there is a group to inherit from decides whether that one offers to.
+        BuildGroupChoices(GroupInEditingVault(GroupTarget?.EntityId));
 
         BuildAuthenticationChoices(
             boundKeyId: null,
@@ -4167,7 +4240,13 @@ internal sealed partial class VaultViewModel(
         }
 
         editingEntityId = row.EntityId;
+
+        // The host's own vault, and it does not move: the two are encrypted under different keys, so
+        // saving anywhere else would fork it rather than move it. The picker is hidden for an existing
+        // host — see ShowsEditorVaultChoice — and is filled anyway so that it is not showing the last
+        // host's vault behind the panel.
         editingHostVaultId = row.VaultId;
+
         EditorLabel = row.Host.Label;
         EditorHostname = row.Host.Hostname;
 
@@ -4182,6 +4261,7 @@ internal sealed partial class VaultViewModel(
         EditorNewTag = string.Empty;
         BuildTagChoices();
 
+        BuildEditorVaultChoices(editingHostVaultId);
         BuildGroupChoices(row.Host.GroupId);
 
         BuildAuthenticationChoices(
@@ -6873,14 +6953,98 @@ internal sealed partial class VaultViewModel(
     /// somebody editing the host's port would unfile it by saving. It says the group is gone rather than
     /// naming it, because there is nothing left to read the name off.
     /// </remarks>
+    /// <summary>Refills the host editor's vault picker, landing on the vault the editor will write to.</summary>
+    /// <remarks>
+    /// Filled from <see cref="TargetVaults"/>, which is already the readable-and-writable set and is kept
+    /// in step with the session by <see cref="RebuildTargetVaults"/>. The options are shared objects rather
+    /// than copies, so the two pickers show the same names without either one being able to move the other:
+    /// what they do not share is the selection.
+    /// </remarks>
+    private void BuildEditorVaultChoices(Guid vaultId)
+    {
+        EditorVaultChoices.Clear();
+
+        foreach (var choice in TargetVaults)
+        {
+            EditorVaultChoices.Add(choice);
+        }
+
+        // Null where the host's vault is one this session cannot write — a team vault this account is a
+        // viewer of. The picker is hidden for an existing host anyway, and leaving the box empty is a
+        // better answer than adding an option that would move the host if it were touched.
+        EditorSelectedVault = EditorVaultChoices.FirstOrDefault(choice => choice.VaultId == vaultId);
+
+        OnPropertyChanged(nameof(ShowsEditorVaultChoice));
+    }
+
+    /// <summary>
+    /// Moves a half-typed host into the vault just chosen for it.
+    /// </summary>
+    /// <remarks>
+    /// Only while creating. An existing host's vault is fixed, and this guard is what makes that true
+    /// rather than the view merely not drawing the control: an item cannot be moved between vaults, so a
+    /// path that reassigned this on an edit would write the host into a second vault and leave the
+    /// original behind.
+    /// </remarks>
+    partial void OnEditorSelectedVaultChanged(VaultChoiceViewModel? value)
+    {
+        if (value is null || editingEntityId is not null || editingHostVaultId == value.VaultId)
+        {
+            return;
+        }
+
+        editingHostVaultId = value.VaultId;
+
+        var authentication = EditorSelectedAuthentication;
+
+        // The group picker is the vault's, so it has to be rebuilt — and whatever was chosen in it belongs
+        // to the vault just left, so it is kept only if the new one has it too. Which in practice means it
+        // is dropped, because a group is one item in one vault.
+        BuildGroupChoices(GroupInEditingVault(EditorSelectedGroup?.EntityId));
+
+        // Rebuilt after it, because "inherit from group" is offered only to a host that is in one — and
+        // whether this one still is has just been decided above. The key and credential entries are not
+        // filtered by vault, unlike the groups: the key list spans every readable vault by design, and a
+        // host authenticating with a key from another vault is a thing this application already supports.
+        BuildAuthenticationChoices(
+            authentication?.Kind == AuthenticationKind.SshKey ? authentication.EntityId : null,
+            authentication?.Kind == AuthenticationKind.Credential ? authentication.EntityId : null,
+            asksForPassword: authentication?.Kind == AuthenticationKind.Typed,
+            grouped: EditorSelectedGroup?.EntityId is not null);
+    }
+
+    /// <summary>The group, if the vault being written to actually has it; otherwise none.</summary>
+    private Guid? GroupInEditingVault(Guid? groupId) =>
+        groupId is { } id
+            && groupsByVault.TryGetValue(editingHostVaultId, out var groups)
+            && groups.Any(choice => choice.EntityId == id)
+                ? id
+                : null;
+
+    /// <summary>Refills the host editor's group picker for one vault.</summary>
+    /// <param name="groupId">The group to land on, or null for none.</param>
+    /// <remarks>
+    /// <para>
+    /// The vault's own groups and no others — see <see cref="groupsByVault"/>. A vault this session cannot
+    /// read has no entry there and gets an empty list rather than the active vault's, which is the right
+    /// answer for a picker: there is nothing in it that this host could be filed under.
+    /// </para>
+    /// <para>
+    /// A group the vault no longer has keeps a placeholder entry, so that editing a host's port cannot
+    /// quietly unfile it.
+    /// </para>
+    /// </remarks>
     private void BuildGroupChoices(Guid? groupId)
     {
         EditorGroupChoices.Clear();
         EditorGroupChoices.Add(GroupChoice.None);
 
-        foreach (var group in Groups)
+        if (groupsByVault.TryGetValue(editingHostVaultId, out var groups))
         {
-            EditorGroupChoices.Add(new GroupChoice(group.EntityId, group.Label));
+            foreach (var group in groups)
+            {
+                EditorGroupChoices.Add(group);
+            }
         }
 
         if (groupId is { } bound && !EditorGroupChoices.Any(choice => choice.EntityId == bound))