Build the three things the phone's + needs, before the + exists

Steps 1 to 3 of docs/adding-hosts-on-the-phone.md: the domain half. Nothing
on either head has changed, which is deliberate — the plan orders these first
because everything the editors will bind to has to exist and be merge-safe
before a screen can offer it.

HostGroupSecret gains a parent and four defaults, and the codec gains the
version rule it never had. It stamped CurrentSchemaVersion unconditionally,
which was harmless with one field and one version and stops being harmless
here: upgrading one machine and renaming any group would have made that group
uneditable on every machine still on the old build. It now emits the lowest
version that loses nothing, so a flat group with no defaults still encodes at
version 1, byte for byte, pinned against a literal.

Tags become a real item over the reserved slot. Secret, codec, merge, cipher,
repository, both registries, the EF entity and a generated AddTagItem
migration. TagCipher names AadResourceType.Tag as a constant rather than
casting the wire type, because Tag is 5 on the wire and 8 in the crypto enum
and 5 there is Credential — a cast would seal every tag under the resource
type for a password, encrypt and decrypt perfectly on the machine that wrote
it, and only fail when another implementation refused the item, by which time
the AAD is frozen into stored ciphertext. HostTag stays reserved and unused:
the one thing the join buys over a set on the host is bought instead by
merging TagIds per id.

HostSecret grows TagIds and Port goes nullable, which is the change with the
widest blast radius and the only one that loses an item rather than locking
one. A host with no port of its own omits the property, an older build reads
int Port as 0, and TryValidate refuses it — unreadable rather than read-only.
That cost is confined to hosts which actually inherit, because the version is
a maximum over the fields present; the alternative, writing 22 into every
host, is the lie inheritance exists to stop telling.

One decision the plan did not specify. "Three states where there were two" is
four — key, credential, typed password, or the group's answer — and two
nullable ids carry three. Naming neither id now means inherit, so
AsksForPassword says "a typed password even under a group that lends a key"
out loud. Only true is ever written and a decoded false folds back to null, so
a host that never touched it encodes as it always did. Nothing already stored
changed meaning: no group could lend a binding before this build, so every
existing host resolves exactly as it did.

HostInheritance is the resolver, and its visited set is load-bearing rather
than defensive. Two clients can each re-parent A under B and B under A while
offline; the merge sees one item against one item and the server sees
ciphertext, so nothing upstream can refuse the pair. With inheritance the
chain is walked at connect time, so an unguarded cycle is not an undrawable
sidebar — it is a shell that never opens. Stopping at the first repeat
degrades it to a group that reads as a root, and clearing the parent is the
repair.

A tag set turns out to be the one field on a host that can never ask the user
anything. TagSet.ToIdMap keys by the value, so no key can hold two values, so
the both-sides-moved-differently branch of the keyed merge is unreachable —
asserted over the whole eight-row matrix. The conflict loop is kept anyway,
because that proof is one edit from ceasing to hold and what it would cause is
a discarded tag nothing records.

Three guard tests failed by design and were fixed rather than relaxed: the
ordered pull filter, the AAD pinning table, and the server's refusal of a
plaintext parent — that last one survives with its reason rewritten, because
the refusal now means "the parent is not the server's to hold" rather than
"there is no such thing as a parent". The prose that said groups are flat is
rewritten in all four places it appeared, not deleted.

The five view-model sites that read Port directly now go through the resolver,
which is a down payment on step 4 rather than the whole of it. HostFields.From
still emits the stored port, and that is the one remaining place where an
unresolved read would be a wrong wire rather than a wrong label.

Verified by the whole suite: 1382 tests over nineteen projects, none failing.
Both heads build. Nothing seen on a display, because nothing on a display has
changed yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/adding-hosts-on-the-phone.md

@@ -4,7 +4,24 @@ The phone can read a keychain and connect through it. It cannot put anything in
 plan for the change that fixes that, and it is written to be picked up cold — the decisions, the reasons, the
 ordered work, and the traps that are already known.
 
-> **Status: planned, not started.** Nothing below is built. The only thing in the tree is this file.
+> **Status: steps 1–3 built, 4–6 not started.** The domain is done and the phone has not been touched. Each
+> built step compiles with the whole suite green, which is the rule the ordering below sets.
+>
+> | Step | State | Notes |
+> | --- | --- | --- |
+> | 1. `HostGroupSecret` grows | **Done** | Five fields, a version rule the codec did not have, a byte pin, and the "groups are flat" prose rewritten in all four places it appeared. |
+> | 2. The `Tag` item kind | **Done** | Secret, codec, merge, cipher, repository, both registries, EF entity and the generated `AddTagItem` migration. |
+> | 3. `HostSecret` grows, `Port` goes nullable | **Done** | `TagSet`, `TagIds`, `Port` as `int?`, `AsksForPassword`, both schema versions, and `HostInheritance` — the resolver. |
+> | 4. The shared view model | Not started | The five port call sites already route through the resolver; the rest of the list below does not. |
+> | 5. The phone | Not started | |
+> | 6. Tests and false prose | Partly done as it went | The guards steps 1–3 tripped are fixed. `docs/design-import-gaps.md` and the three phone files are untouched. |
+>
+> **One decision was taken that this plan did not specify.** "Three states where there were two" is four, not
+> three: a host can bind a key, bind a credential, be pinned to a typed password, or take its group's answer,
+> and two nullable ids express three of those. Naming neither id now means *inherit*, so
+> `HostSecret.AsksForPassword` was added to say "a typed password, even under a group that lends a key" out
+> loud. Nothing stored changed meaning — no group could lend a binding before this build, so every existing
+> host resolves exactly as it did.
 
 ## What was asked for
 
@@ -69,18 +86,19 @@ false prose and must be rewritten to say what replaced the argument, not deleted
 ## What the payload becomes
 
 ```
-HostSecret                          HostGroupSecret
-  Label                               Label
-  Hostname                            ParentId            ← new, optional
-  Port          int? — null inherits  DefaultPort         ← new
-  Username      null inherits         DefaultUsername     ← new
-  Notes                               DefaultSshKeyId     ← new
-  JumpHostIds                         DefaultCredentialId ← new
+HostSecret                            HostGroupSecret
+  Label                                 Label
+  Hostname                              ParentId            ← new, optional
+  Port            int? — null inherits  DefaultPort         ← new
+  Username        null inherits, "" none DefaultUsername    ← new
+  Notes                                 DefaultSshKeyId     ← new
+  JumpHostIds                           DefaultCredentialId ← new
   Options
-  SshKeyId      null inherits       TagSecret
-  CredentialId  null inherits         Label
-  GroupId       null = ungrouped
-  TagIds        ← new
+  SshKeyId        null inherits       TagSecret
+  CredentialId    null inherits         Label
+  AsksForPassword ← new, true only
+  GroupId         null = ungrouped
+  TagIds          ← new
   RelayEnabled
 ```
 
@@ -92,10 +110,18 @@ after the chain runs out.
 
 `SshKeyId` and `CredentialId` both null currently *means* "ask for a password each time" — a decision, not an
 absence. `AuthenticationChoice`'s own remark argues at length that the two must never be conflated.
-Inheritance adds a third state, so the picker needs an explicit **"Inherit from group"** entry beside
-**"Password (ask each time)"**, and `Bound(...)` needs to distinguish them. `Username` has the same problem:
-null means "no username" today and is refused at connect; it has to come to mean "inherit", with "no username"
-still reachable and still refused.
+Inheritance adds a state, so the picker needs an explicit **"Inherit from group"** entry beside **"Password
+(ask each time)"**, and `Bound(...)` needs to distinguish them. `Username` has the same problem: null means
+"no username" today and is refused at connect; it has to come to mean "inherit", with "no username" still
+reachable and still refused.
+
+**Built as four states, not three, because two nullable ids only carry three.** Key, credential, typed
+password, inherit — and naming neither id was the third and is now the fourth. `HostSecret.AsksForPassword`
+carries the difference: null is "not stated", which walks the chain and lands on a typed password if the
+chain lends nothing, and `true` is "a typed password, even under a group that lends a key". Only `true` is
+ever written, and a decoded `false` folds back to null, so a host that never touched the field encodes
+exactly as it did before it existed. `Username` needed no field — an empty string is "no username" and null
+is "inherit". `Port` needed none either: there is no "explicitly no port", only 22 at the end of the chain.
 
 Mutual exclusion moves with it. `HostSecret.TryValidate` enforces "a key or a credential, never both" per
 record; a host naming a credential under a group naming a key is two individually valid records that resolve to