Rewrite checks 7.6/7.6a for the picker that replaced the drag

The drag onto a group card went with v5's flat sections; filing a set
is the chosen-hosts menu's "Change group..." picker on both heads now.
The two checks walk that route instead and say honestly what
ShellFlowTests and ScreenLayoutTests already cover, what only a real
popup can show, and that nothing automated raises the mixed-keychain
refusal. The numbering preamble's example swaps to citations that
still exist.

docs/manual-checks.md

@@ -17,7 +17,7 @@ Three constraints put things on this list, and they are worth knowing before add
 Each item says what to do, what a pass looks like, and what a failure would mean.
 
 **On the numbering.** A check keeps its number for life, because code comments and other documents cite them
-— `HostGridTests` sends a reader to 7.6, `platform-flags.md` to 3.6–3.8. A check inserted later therefore
+— `platform-flags.md` sends a reader to 3.6–3.8, ADR 0013 to 16.4. A check inserted later therefore
 takes a letter rather than pushing its neighbours along: 3.2a and 3.2b sit between 3.2 and 3.3 and always
 will. Add in the same way, and keep each one next to the check it belongs beside; a gap in the numbers means
 a phase had nothing left for a person to do, which is the good outcome rather than an omission.
@@ -930,52 +930,64 @@ Start 7.1's slow connection and press GIVE UP (or the tab's cross) while it is s
 opened — it is a real shell, and one running with nothing naming it would be worse than one that comes
 back.
 
-### 7.6 Dragging a host onto a group card · **least covered, like all drag and drop**
+### 7.6 Filing a ticked host through "Change group…" · **the drag's replacement**
 
-Make two groups and file a host into one. Drag a host card up onto the other group's card.
+The gesture this number used to describe — a host card dragged onto a group card — went with the group cards
+themselves in v5's flat-sections rework: every group is a heading now, there is nothing on the board to drop
+onto, and no gesture replaced the drag. Filing from the board is the chosen-hosts menu's **Change group…**,
+the phone's route become both heads' — see `VaultViewModel.ConfirmRegroupChosenHostsAsync`'s own remarks.
+(A single host can also still be filed through its own editor's GROUP picker; 3.2 walks that route.)
 
-**Pass:** the group card under the pointer takes a two-pixel accent border while the pointer is over it, the
-cursor shows a move rather than a refusal, and the drop files the host — **the card leaves the grid**, going
-inside the group it was dropped on, the host counts under both group cards change, and the status line says
-where it went. That sentence is the only thing left saying so, which is why it is worth reading: the card
-itself is on the level below now, and nothing is selected once it has gone.
+Make two groups and file a host into one. Ctrl-click that host so it takes its ✓, right-click it, and choose
+**Change group…**.
 
-**Also check three refusals**, each of which must show the "no" cursor and mark nothing: over the card of the
-group the host is *already* in — type its name into the find box first, which is what brings a filed card
-back to this level; over another **host** card, which is deliberately not a target now that there are no
-headings to say which group it would mean; and over the empty space around the cards.
+**Pass:** the entry is on the menu only while something is ticked — right-click an unticked card first and
+the menu is the ordinary four (Connect, Details…, Edit…, Delete…) with no filing entry among them. Choosing
+it opens the CHANGE GROUP panel **above the board, not over it** — the ticked card stays in view, "1 chosen"
+sits beside the panel's heading — and the ComboBox reads **"No group"**, not the group the host is already
+in; drop it down and every group in this keychain is listed after it.
 
-**The targets are the cards on screen, which are one level** — see 3.2a. Filing into a group nested under
-another means opening the outer one first, exactly as moving a file into a subfolder does.
+**Then pick the other group and press FILE.** **Pass:** the panel folds, the card is drawn under the other
+heading and the headings' counts follow, the tick is off, and the status line says where it went — `Filed 1
+host(s) under …`.
 
-**And getting a host back out** is the host's own editor — pick "No group" in its picker. There is no
-UNGROUPED target on the desktop any more, because there is no UNGROUPED heading for it to be.
+**Then take it back out:** tick it again, open **Change group…**, and press FILE with the ComboBox untouched.
+**Pass:** the host is unfiled, back under the "No group" heading. The picker opening on "No group" is a
+decision rather than an oversight — unfiling a run of machines is exactly as common as filing them, and the
+box says what FILE will do before it is pressed — but it is also why the box has to be *read*: FILE never
+means "keep things as they are". CANCEL, tried once, folds the panel and keeps the ticks.
 
-**And a drag held near the top or bottom edge of the grid scrolls it**, which is what makes this usable at
-all with forty machines: the group cards are the first thing in the scroller, and a drag cannot use the
-wheel. The pointer has to keep moving inside the band — a stationary pointer gets no drag events.
+**Failure means:** the write and its guards are all covered headlessly — the filing by
+`ShellFlowTests.ChangingTheGroupOfTheChosenHosts_FilesThemAllAtOnce`, the refusal under an open editor by
+`RegroupingTheChosenHosts_IsRefusedWhileTheEditorIsOpen`, the panels' one-at-a-time rule by
+`TheActionBarsPanels_TakeEachOthersPlaceRatherThanStacking`, and the panel's fit by
+`ScreenLayoutTests.TheHostsScreenFitsWithTheChosenHostsGroupPanelOpen`. What none of them can see is a real
+popup: the menu entry and the ComboBox's dropdown both live in popups, reaching the vault through the same
+`#Board` indirection 7.9 explains. A menu missing the entry, or a FILE that files nothing, is that wiring —
+7.9's class of failure, on the one entry that opens a panel rather than acting at once.
 
-**Failure means:** headless Avalonia cannot synthesise a platform drag, so the picking up, the cursor and
-the drop are covered by nothing. What *is* automated is the decision each drag event takes —
-`HostGridTests.TheGroupCardsAreWhatAcceptsADroppedHost` raises a real `DragOver` over both kinds of card —
-and the write at the end, `ShellFlowTests.MovingAHostToAGroup_FilesItAndTakesItOffTheLevelItCameFrom`.
+### 7.6a Filing a whole set at once, and the one refusal · **the refusal needs a second vault**
 
-### 7.6a Dragging a whole set onto a group card · **also uncovered, and the same reason**
+Tick three hosts (7.7a is how), right-click one of the three, choose **Change group…**, pick a group, and
+press FILE.
 
-Tick three hosts (7.7a is how), then pick one of the three up and drag it onto a group card.
+**Pass:** the same panel, its heading now saying "3 chosen", and the write moves **all three** — every card
+under the picked heading, the status line counting them, and the ticks gone once it is done. A host that was
+never ticked stays exactly where it was.
 
-**Pass:** the card marks itself exactly as it does for one host, and the drop files **all three** — the
-status line says how many, and all three leave the level. Ticking nothing and dragging a single card still
-files that one card, which is what this gesture has always done.
+**Then, with a second vault:** tick one host from each keychain and choose **Change group…** again.
 
-**And a card that is not in the set** drags alone: press one of the unticked cards and the ticks come off
-before the drag starts, so what lands is the one machine that was under the pointer.
+**Pass:** no panel opens, and the status line says the hosts are in more than one keychain and a group
+belongs to one. The refusal is whole and it is early — raised when the picker is asked for, over the whole
+set, rather than after a group was picked from a list that could only ever have been one keychain's. Filing
+across that line would leave everyone else in the shared vault seeing a machine filed under nothing.
 
-**Failure means:** a drag that filed one of three is the payload having been built from the card rather than
-from the set — the thing this gesture must never do quietly, since the other two stay behind looking filed.
-The write is `ShellFlowTests.DroppingTheChosenHostsOnAGroupCard_FilesEveryOneOfThem` and the drag event's
-answer is `HostGridTests.AGroupCardTakesAWholeSetOfDraggedHosts`; the platform's half of it is covered by
-nothing, as 7.6 explains.
+**Failure means:** the set's write is `ChangingTheGroupOfTheChosenHosts_FilesThemAllAtOnce` again — one
+command reads the whole set, so "filed one of three" has no half-gesture to hide in the way the old drag's
+payload did. The refusal, though, is asserted by **nothing automated at all**: `VaultViewModel.RegroupChosenHosts`
+counts the distinct vaults and no test raises it, so this check is the only thing between that sentence and
+silence. A panel that does open over a mixed set is the worse half — it would offer one keychain's groups
+for another keychain's machines, which is the half-filed set the refusal exists to prevent.
 
 ### 7.7 A click still selects, and a double click still connects