Merge branch 'main'

Two of main's changes land in files this branch rewrote, and both needed carrying
across by hand rather than by the merge.

The phone's nav staying up on Connections with nothing running is a fourth input
to RefreshChrome, which this branch had already given two more — whether hosts are
ticked and whether the host editor is filling the screen. They compose: the rail
and the bottom bar now ask (pages || connectPage) && !editing, so a page-shaped
terminal surface keeps its way off the screen and the editor still takes the whole
display.

The key question under the host's move panel is the harder one, because this
branch deleted the panel it was added to. The connect card is gone and the phone's
only route to a move is the action bar, so leaving the merge to take this side
would have removed a capability main had just shipped — silently, since nothing
would fail to build. It is asked in the action bar's own picker instead, in two
shapes fewer than the desktop's: one host, because which key to carry is a fact
about one machine and a selection of six has six answers, and a move rather than a
copy, because taking the key out from under an original that is staying put would
leave that original unable to connect. BindingOfTheMovingHost splits into
MovableBindingOf so both heads answer it the same way from different panels.

Main also fixed a real trap in the same commit — a host that only inherited its
key from its group arrived in the destination naming nothing at all, because the
group stays behind — and the batch move had the same bug for the same reason. It
goes through Detached now, which is where that fix lives.

The carried host is written as the carry left it rather than being detached again,
which is the one thing worth measuring: the key takes a new id over there, so a
run that rebuilt the payload from the row would send the machine across naming a
tombstone. Both directions are pinned, along with the rule about which shapes the
question is asked in at all.

src/DodoSSH.Client.Android/Views/HostsScreen.axaml

@@ -158,6 +158,28 @@
 
           <TextBlock Classes="body" Text="{Binding ChosenHostVaultPanelNote}" />
 
+          <!--
+            ◆ THE KEY. A binding resolves across vaults, so the host goes on working here whichever way this
+            is answered — but the vault it has just joined holds one key, and a host whose own key stayed
+            behind is one its new colleagues cannot connect with.
+
+            Drawn only for a move of exactly one host, which is the only shape the question has an answer in:
+            which key to carry is a fact about one machine, and a copy that took the key away would leave the
+            original unable to connect. See VaultViewModel.BringsTheChosenBindingAlong.
+
+            Unticked, because moving a key into a team's vault hands it to everybody who holds that vault's
+            key: a disclosure is chosen, never defaulted into. The line under it is the count of what else
+            uses that key, which is the difference between an obvious yes and an obvious no.
+          -->
+          <CheckBox IsChecked="{Binding BringsTheChosenBindingAlong}" MinHeight="44"
+                    IsVisible="{Binding HasAChosenBindingToBring}">
+            <TextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
+                       Text="{Binding ChosenBindingToBringQuestion}" />
+          </CheckBox>
+          <TextBlock Classes="body" TextWrapping="Wrap"
+                     IsVisible="{Binding HasAChosenBindingToBring}"
+                     Text="{Binding ChosenBindingToBringNote}" />
+
           <Grid ColumnDefinitions="*,8,*">
             <Button Grid.Column="0" Classes="primary" Height="44"
                     Content="{Binding ChosenHostVaultPanelVerb}"

src/DodoSSH.Client.Android/Views/KeychainScreen.axaml

@@ -149,8 +149,19 @@
           </StackPanel>
         </StackPanel>
 
-        <Button Grid.Column="2" Classes="danger" Height="44" Width="104" Content="DELETE"
-                Command="{Binding DeleteSelectedItemCommand}" />
+        <!--
+          MOVE beside it, and only where there is somewhere to move to — the rule the host's MOVE follows on
+          this head, for the reason a phone has: there is no room to draw a button that answers with a
+          refusal. It is the ghost of the pair rather than the danger one, because a move is undone by
+          moving it back.
+        -->
+        <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="8">
+          <Button Classes="secondary" Height="44" Width="86" Content="MOVE"
+                  IsVisible="{Binding CanMoveSelectedItem}"
+                  Command="{Binding MoveSelectedItemCommand}" />
+          <Button Classes="danger" Height="44" Width="104" Content="DELETE"
+                  Command="{Binding DeleteSelectedItemCommand}" />
+        </StackPanel>
       </Grid>
     </Border>
 
@@ -180,6 +191,47 @@
       </StackPanel>
     </Border>
 
+    <!-- ============ ◆ moving it to another vault ============ -->
+    <!--
+      The desktop's panel, in the place the deletion question uses and never at the same time as it: MOVE
+      disarms a pending deletion on the way in, and the buttons that ask either question are hidden while
+      one is up.
+
+      Both sentences are here rather than only in the status line afterwards, which on a phone is one line at
+      the bottom of a screen somebody has already navigated away from. The second one is the count of what
+      points at this key — every one of them is re-aimed at the vault it moves to, and that is the part
+      nobody can see from a keychain row.
+    -->
+    <Border Grid.Row="3" IsVisible="{Binding IsMovingItem}" Margin="12,4"
+            Background="{StaticResource Panel}" BorderBrush="{StaticResource BorderMid}"
+            BorderThickness="1" CornerRadius="12" Padding="14,12">
+      <StackPanel Spacing="8">
+        <TextBlock Classes="label" Text="MOVE TO VAULT" />
+        <TextBlock Classes="mono" FontSize="12" TextWrapping="Wrap"
+                   Text="{Binding MovingItemLabel}" />
+        <ComboBox HorizontalAlignment="Stretch" MinHeight="44"
+                  ItemsSource="{Binding MoveItemVaultChoices}"
+                  SelectedItem="{Binding SelectedMoveItemVault}">
+          <ComboBox.ItemTemplate>
+            <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+              <TextBlock Classes="mono" FontSize="12" Text="{Binding Display}" />
+            </DataTemplate>
+          </ComboBox.ItemTemplate>
+        </ComboBox>
+        <TextBlock Classes="body" TextWrapping="Wrap"
+                   Text="It is re-encrypted with the other vault's key, so everybody who holds that key can read it and nobody in the vault it leaves can." />
+        <TextBlock Classes="body" TextWrapping="Wrap"
+                   IsVisible="{Binding HasMovingItemUsage}"
+                   Text="{Binding MovingItemUsage}" />
+        <Grid ColumnDefinitions="*,8,*" Margin="0,4,0,0">
+          <Button Grid.Column="0" Classes="primary" Height="44" Content="MOVE"
+                  Command="{Binding ConfirmMoveItemCommand}" IsEnabled="{Binding !IsBusy}" />
+          <Button Grid.Column="2" Classes="secondary" Height="44" Content="CANCEL"
+                  Command="{Binding CancelMoveItemCommand}" />
+        </Grid>
+      </StackPanel>
+    </Border>
+
     <!-- ============ the items ============ -->
     <Panel Grid.Row="4">
 

src/DodoSSH.Client.Android/Views/PhoneRail.axaml

@@ -134,15 +134,17 @@
 
           <!--
             The terminal is a surface rather than a page, so it goes through its own command — the same
-            reason the bottom bar's middle entry does. It is never lit, and deliberately: this rail is
-            collapsed while a shell is showing, so IsCurrent could only ever read false. What marks that
-            destination as current is the surface filling the screen.
+            reason the bottom bar's middle entry does. It lights on IsTerminalSurface, which on this control
+            can only mean one thing: the rail stands down for a shell, so the one moment it is drawn beside
+            this surface is Connections with nothing running. That screen is a page in everything but which
+            enum it is in, and a rail sitting beside it with no entry lit would be pointing nowhere.
 
             No count, unlike the two above it. The shells strip sits above the bottom of every page on this
             surface and is that count, drawn as the sessions themselves — a number beside this word would be
             the same fact said twice, three inches apart.
           -->
-          <Button Classes="railentry" Command="{Binding ShowTerminalCommand}">
+          <Button Classes="railentry" Classes.active="{Binding IsTerminalSurface}"
+                  Command="{Binding ShowTerminalCommand}">
             <Grid ColumnDefinitions="Auto,*,Auto">
               <TextBlock Grid.Column="0" Classes="railglyph" Text="⌗" />
               <TextBlock Grid.Column="1" Classes="raillabel" Text="Connections" />

src/DodoSSH.Client.Android/Views/PhoneShell.axaml

@@ -25,8 +25,9 @@
 
     ── a terminal gets the screen ─────────────────────────────────────────────────────────────────────────
     Three of the four rows below stand down while a shell is showing: the header, the shells strip and the
-    bottom bar itself. All three are bound on IsShowingPages, which is the same question asked once — the
-    surface is either a page or a terminal, and these are the chrome a page has.
+    bottom bar itself. The strip asks IsShowingPages directly; the other two go through flags the control
+    computes, and the bar's is the one that differs — it stays up on Connections with nothing running, which
+    is the terminal surface drawing a page rather than a shell. See PhoneShell.RefreshChrome.
 
     The arithmetic is why. Header 56, strip 46, bar 64, and the terminal's own two rows on top of that: at
     360dp the shell was framed by about a third of the display, all of it about somewhere the user was not.
@@ -316,10 +317,15 @@
 
       <!-- ============ navigation ============ -->
       <!--
-        Gone while a terminal is showing, which is the whole of that surface's arrangement: the bar's three
+        Gone while a shell is showing, which is the whole of that surface's arrangement: the bar's three
         destinations are replaced by a back arrow and a + that leads to all of them, both in the terminal's
         own bar. See TerminalScreen.axaml.
 
+        ◆ A shell rather than the surface, which are not the same question — Connections with nothing running
+        is that surface drawing a page, and the bar stays under it. The screen it stands down for is the one
+        that pays for the room; a box asking which machine to connect to does not, and taking the nav away
+        from somebody who has just closed their last tab left them with only the back gesture.
+
         ◆ It is no longer a single question — a wide surface takes the rail instead — so it reads one flag
         the control computes rather than a condition here. See PhoneShell.ShowsBottomBar.
 
@@ -348,12 +354,15 @@
             rather than the door. The enum member stays ShellSurface.Terminal, for the reason the keychain's
             tab is not called Vault: the surface is a terminal, and the word a user reads is the product's.
 
-            The only entry here that never lights, and deliberately no longer tries: this bar is collapsed
-            while the terminal is showing, so IsCurrent could only ever be read as false. Binding it anyway
-            would be a rule about a state this control cannot be in. What marks it as current is the surface
-            filling the screen.
+            ◆ It lights again, and IsTerminalSurface is the right question rather than a near miss. This bar
+            is drawn in exactly two situations — a page, and Connections with nothing running — and that flag
+            separates them: false for every page, true for the one screen where this is where you are. With a
+            shell up the bar is gone and nothing here is read at all. It was left unbound while the bar was
+            collapsed for the whole of the terminal surface, which made a lit state unreachable; a screen the
+            bar can now sit under and not point at is the entry looking broken instead.
           -->
           <views:NavButton Grid.Column="1" Label="Connections" Glyph="⌗"
+                           IsCurrent="{Binding IsTerminalSurface}"
                            Command="{Binding ShowTerminalCommand}" />
 
           <!--

src/DodoSSH.Client.Android/Views/PhoneShell.axaml.cs

@@ -146,10 +146,19 @@ internal sealed partial class PhoneShell : UserControl
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(IsWide));
 
     /// <summary>Whether the rail down the left edge is drawn.</summary>
+    /// <remarks>
+    /// The wide surface's answer to <see cref="ShowsBottomBarProperty"/> and asks the same question about
+    /// which screen is up, so the two move together — including over Connections with nothing running. See
+    /// <see cref="RefreshChrome"/>.
+    /// </remarks>
     public static readonly StyledProperty<bool> ShowsRailProperty =
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(ShowsRail));
 
     /// <summary>Whether the three-entry bar across the bottom is drawn.</summary>
+    /// <remarks>
+    /// Not simply the pages: it also stays up on Connections with nothing running, which is the terminal
+    /// surface drawing a page. See <see cref="RefreshChrome"/>.
+    /// </remarks>
     public static readonly StyledProperty<bool> ShowsBottomBarProperty =
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(ShowsBottomBar));
 
@@ -212,12 +221,21 @@ internal sealed partial class PhoneShell : UserControl
     /// </summary>
     /// <remarks>
     /// <para>
-    /// ◆ <b>Three flags computed here rather than three conditions in the markup, because Avalonia's
+    /// ◆ <b>Five flags computed here rather than five conditions in the markup, because Avalonia's
     /// bindings have no "and" and none of these is a single question any more.</b> Everywhere else on this
     /// head that costs a wrapper element; here it would cost two nested ones per row and the header's would
     /// have to be an "or", which a wrapper cannot express at all.
     /// </para>
     /// <para>
+    /// ◆ <b>The nav stands down for a shell rather than for the terminal surface, and those parted company
+    /// when that surface gained a page.</b> Connections with nothing running is a box, a CONNECT button and
+    /// the machines connected to before — see TerminalScreen.axaml — and none of that is worth the screen a
+    /// shell is worth it for. It is also the one screen somebody can arrive at by closing their last tab,
+    /// which made the collapsed bar a way to end up with no route to Hosts or Settings but the system back
+    /// gesture. The header is deliberately not part of this: the surface draws its own bar with the back
+    /// arrow and the +, and the vault header above that is the second row this head exists to avoid.
+    /// </para>
+    /// <para>
     /// <b>The header is the one worth reading twice.</b> Narrow, it stands down behind SETTINGS, because the
     /// screens under that hub draw their own header with a back arrow and two rows of chrome is what this
     /// surface exists to avoid. Wide, there is no hub to be behind and no back arrow to duplicate — the rail
@@ -245,6 +263,14 @@ internal sealed partial class PhoneShell : UserControl
         var wide = body.Bounds.Width >= WideAt;
         var pages = shell?.IsShowingPages == true;
 
+        // ◆ Connections with nothing running, which is the terminal surface drawing a page: a box, a CONNECT
+        // button and the machines connected to before. The nav stands down for a shell — the whole of the
+        // arrangement below — and there is no shell here to stand down for, so it stays. Taking it away on
+        // this one screen was worst where it was least affordable: somebody who has just closed their last
+        // tab, or who pressed Connections to see what was open and found nothing, was left on a screen whose
+        // only way to Hosts or Settings was the system back gesture.
+        var connectPage = shell is { IsTerminalSurface: true, HasTabs: false };
+
         // The editor is a page of its own now, so nothing else is drawn around it — not the vault header,
         // not the shells strip, and not the way off the screen. Its own header carries the back arrow, which
         // is the one control it needs and the one the system gesture already maps to.
@@ -266,8 +292,8 @@ internal sealed partial class PhoneShell : UserControl
         }
 
         IsWide = wide;
-        ShowsRail = wide && pages && !editing;
-        ShowsBottomBar = !wide && pages && !editing;
+        ShowsRail = wide && (pages || connectPage) && !editing;
+        ShowsBottomBar = !wide && (pages || connectPage) && !editing;
         ShowsShellStrip = pages && !editing;
         ShowsHostSelectionBar = pages && choosing && !editing;
         ShowsVaultHeader = pages && !editing && !choosing && (wide || shell?.IsMoreSurface != true);

src/DodoSSH.Client.Android/Views/SnippetsScreen.axaml

@@ -64,6 +64,26 @@
 
           <TextBox Classes="field" Text="{Binding EditorLabel}" PlaceholderText="name" />
 
+          <!--
+            ◆ Which vault a *new* snippet is filed into. Hidden for an existing one — its vault is not a
+            field of this form, and changing it is MOVE below — and hidden entirely where there is only one
+            vault to choose between, which is where most people stay.
+          -->
+          <StackPanel Spacing="6" IsVisible="{Binding ShowsEditorVaultChoice}">
+            <TextBlock Classes="label" Text="VAULT" />
+            <ComboBox HorizontalAlignment="Stretch" MinHeight="44"
+                      ItemsSource="{Binding EditorVaultChoices}"
+                      SelectedItem="{Binding EditorSelectedVault}">
+              <ComboBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                  <TextBlock Classes="mono" FontSize="12" Text="{Binding Display}" />
+                </DataTemplate>
+              </ComboBox.ItemTemplate>
+            </ComboBox>
+            <TextBlock Classes="body"
+                       Text="A shared vault means everybody holding its key can read this command and insert it into their own terminals." />
+          </StackPanel>
+
           <TextBox Classes="field" Text="{Binding EditorCommand}" PlaceholderText="command"
                    Height="120" AcceptsReturn="True" TextWrapping="Wrap"
                    VerticalContentAlignment="Top" Padding="14,10" />
@@ -125,6 +145,15 @@
                           IsVisible="{Binding Badge, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">
                     <TextBlock Text="{Binding Badge}" />
                   </Border>
+
+                  <!--
+                    ◆ Which vault this one is in, drawn only where there is more than one to be in. A shared
+                    snippet is a command the rest of a team can read and insert into their own terminals,
+                    and this card is the only place that fact appears before somebody taps EDIT.
+                  -->
+                  <Border Classes="tag outline" IsVisible="{Binding HasVaultBadge}">
+                    <TextBlock Text="{Binding VaultBadge}" />
+                  </Border>
                 </StackPanel>
 
                 <!-- The command, on the surface every block of monospace in this design is drawn on. -->
@@ -151,20 +180,66 @@
             IsEnabled="{Binding !IsEditing}">
       <StackPanel Spacing="9">
 
-        <Button Classes="primary" Content="{Binding InsertLabel}" Command="{Binding InsertCommand}"
-                IsEnabled="{Binding CanInsert}" />
+        <StackPanel Spacing="9" IsVisible="{Binding ShowsSelectionActions}">
+          <Button Classes="primary" Content="{Binding InsertLabel}" Command="{Binding InsertCommand}"
+                  IsEnabled="{Binding CanInsert}" />
 
-        <!-- Only for a snippet marked as running. For every other one there is nothing this could mean. -->
-        <Button Classes="secondary" Height="44" Content="{Binding RunLabel}"
-                Command="{Binding RunCommand}" IsVisible="{Binding SelectionRuns}"
-                IsEnabled="{Binding CanInsert}" />
+          <!-- Only for a snippet marked as running. For every other one there is nothing this could mean. -->
+          <Button Classes="secondary" Height="44" Content="{Binding RunLabel}"
+                  Command="{Binding RunCommand}" IsVisible="{Binding SelectionRuns}"
+                  IsEnabled="{Binding CanInsert}" />
 
-        <Grid ColumnDefinitions="*,8,*">
-          <Button Grid.Column="0" Classes="secondary" Height="44" Content="EDIT"
-                  Command="{Binding EditCommand}" />
-          <Button Grid.Column="2" Classes="danger" Height="44" Content="DELETE"
-                  Command="{Binding DeleteCommand}" />
-        </Grid>
+          <Grid ColumnDefinitions="*,8,*">
+            <Button Grid.Column="0" Classes="secondary" Height="44" Content="EDIT"
+                    Command="{Binding EditCommand}" />
+            <!--
+              ◆ Sharing the snippet. Beside EDIT rather than inside it, which is the line the hosts screen
+              draws too: the two vaults are encrypted under different keys, so this is a re-seal into one and
+              a tombstone in the other — nothing a SAVE could do. It shows only where there is somewhere to
+              move to; see SnippetsViewModel.CanMove.
+            -->
+            <Button Grid.Column="2" Classes="secondary" Height="44" Content="MOVE"
+                    IsVisible="{Binding CanMove}" Command="{Binding MoveCommand}" />
+          </Grid>
+
+          <!--
+            ◆ A row of its own, under the pair rather than beside them, as the hosts screen puts it. A phone
+            has no hover and no tooltip, so the only thing separating a destructive button from an ordinary
+            one is where a thumb lands.
+          -->
+          <Button Classes="danger" Height="44" Content="DELETE" Command="{Binding DeleteCommand}" />
+        </StackPanel>
+
+        <!--
+          ◆ MOVING THE SNIPPET TO ANOTHER VAULT, in the place the insert controls were. A picker and two
+          buttons rather than a question with a yes: what is being asked is which vault, and a move is undone
+          by moving it back.
+
+          The sentence is not decoration. Unlike a host, a snippet crosses whole — there is no group and no
+          tag to leave behind — so what there is to say is who can read it afterwards; and on a phone, where
+          the status line is one line at the bottom of a screen somebody has already navigated away from,
+          before the tap is the only place that reliably gets read.
+        -->
+        <StackPanel Spacing="10" IsVisible="{Binding IsMoving}">
+          <TextBlock Classes="label" Text="MOVE TO VAULT" />
+          <ComboBox HorizontalAlignment="Stretch" MinHeight="44"
+                    ItemsSource="{Binding MoveVaultChoices}"
+                    SelectedItem="{Binding SelectedMoveVault}">
+            <ComboBox.ItemTemplate>
+              <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                <TextBlock Classes="mono" FontSize="12" Text="{Binding Display}" />
+              </DataTemplate>
+            </ComboBox.ItemTemplate>
+          </ComboBox>
+          <TextBlock Classes="body"
+                     Text="The snippet is re-encrypted with the other vault's key, so everybody who holds that key can read this command and insert it — and nobody else can. Nothing else about it changes." />
+          <Grid ColumnDefinitions="*,8,*">
+            <Button Grid.Column="0" Classes="primary" Height="44" Content="MOVE"
+                    Command="{Binding ConfirmMoveCommand}" />
+            <Button Grid.Column="2" Classes="secondary" Height="44" Content="CANCEL"
+                    Command="{Binding CancelMoveCommand}" />
+          </Grid>
+        </StackPanel>
       </StackPanel>
     </Border>
 

src/DodoSSH.Client.Android/Views/TerminalScreen.axaml

@@ -19,9 +19,13 @@
 
     ── the screen a shell gets ───────────────────────────────────────────────────────────────────────────
     A connected phone shows one bar and then the terminal. The vault header, the shells strip and the
-    four-entry bottom bar are all collapsed by PhoneShell while this surface is up, and what replaces them
+    three-entry bottom bar are all collapsed by PhoneShell while a shell is showing, and what replaces them
     is the row below: back, the sessions, and the way to open another one.
 
+    With nothing running it is only the header and the strip. This surface is then the connect page below —
+    a box and the machines connected to before — which is not what the screen was being cleared for, and is
+    the one screen reachable by closing your last tab, so the nav stays. See PhoneShell.RefreshChrome.
+
     That is a trade, and the thing bought is the only one a terminal really wants. At 360dp the chrome this
     screen used to sit inside came to 254 pixels of a roughly 780-pixel display — a third of it — and every
     one of those rows was about somewhere the user was not. What is given up is the bottom bar's one-tap
@@ -389,9 +393,10 @@
       of them.
 
       It lives here rather than in PhoneShell for the reason the add sheet lives in its own screen: nothing
-      but this surface raises it. The scrim reaching only the screen area is not a compromise here the way
-      it was there — the bottom bar is collapsed while a terminal is showing, so the screen area is the
-      display.
+      but this surface raises it. The scrim reaching only the screen area is the full display while a shell
+      is showing, because the bottom bar is collapsed for it. Raised from the connect page it is not, and
+      that lands on the add sheet's own answer: the three destinations under the scrim stay tappable, and for
+      a menu of places to connect from, navigating away is a perfectly good way to decide not to.
 
       Every row navigates away from the terminal. That is not a side effect of the menu, it is the menu:
       each of the three destinations is a picker, and the shell they open lands back on this surface as a