Let a closed terminal take its own status line with it

The strip along the bottom is one line for the whole window, and connecting
writes to it, so "Connected to prod-db." outlived the tab it was about: close
prod-db, look at the terminal beside it, and the bar was still reporting on a
session that is no longer there.

A connection's own lines are now owned by the attempt that wrote them, and
closing a tab clears the line only when that is what the bar is holding.
Ownership rather than a blanket clear on close, because the alternative loses
the sentences this bar exists for — a failed save or a refused sync is what the
design deleted the bar's other four fields to make room for, and closing a
terminal is no answer to one.

.github/workflows/ci.yml

@@ -291,6 +291,7 @@ jobs:
       # so it is not done either. What reaches users is built, installed and walked through Phase 16
       # of docs/manual-checks.md by a person first.
       - name: package the windows desktop client
+        id: winpack
         if: github.event_name != 'pull_request'
         run: |
           set -euo pipefail
@@ -374,6 +375,93 @@ jobs:
           ls -la "$releases"
           echo "Packaged DodoSSH $packVersion for win-x64, from a build MinVer calls $version."
 
+          # Handed to the macOS step below rather than worked out again there. The floor logic above
+          # is thirty lines of reasoning about MinVer's pre-first-tag answer, and a second copy of it
+          # is a second thing to keep in step — while two desktop packages built from one commit
+          # carrying different version numbers is precisely the confusion this file spends that
+          # reasoning to avoid.
+          echo "packVersion=$packVersion" >> "$GITHUB_OUTPUT"
+
+      # ◆ AND THE macOS BUNDLE IS BUILT HERE, ON LINUX, AND IS ALSO THROWN AWAY.
+      #
+      # Same argument as the Windows step above, one platform along: the failures a release is most
+      # exposed to are the ones only the packager finds, and the person who would otherwise find them
+      # is the one midway through a release on the one Mac that can cut one.
+      #
+      # What this catches that the Windows step cannot: the osx-arm64 restore graph. A native package
+      # that resolves for win-x64 and has no osx-arm64 asset — libsodium and SkiaSharp both ship per
+      # RID — fails here, on every main build, rather than at the first `dotnet publish` of a release
+      # nobody can retry without a Mac.
+      #
+      # ◆ bundle, NOT pack, AND THE DIFFERENCE IS NOT A CHOICE.
+      #
+      # `vpk [osx]` cross-compiling from a non-Mac offers exactly one packaging verb: bundle, which
+      # builds the .app. There is no `[osx] pack` off a Mac, and that is correct rather than a gap —
+      # pack signs with codesign, submits to Apple with notarytool and staples the ticket, all of
+      # which is Apple tooling that exists on no other platform. So this proves the bundle and stops
+      # where the platform does.
+      #
+      # No --plist and no --icon either, deliberately. Both are proved by scripts/release-macos.sh on
+      # the machine that can also check the result; passing a rendered plist here would mean copying
+      # the substitution out of that script to no end, since nothing looks at what this produces.
+      #
+      # ◆ NOTHING IS UPLOADED, FOR THE REASON THE WINDOWS STEP GIVES.
+      #
+      # RUNNER_TEMP, dying with the job. ADR 0013 rule 3 puts the capability to ship somebody a build
+      # on a machine which is not a runner, and an unsigned .app is additionally something no Mac
+      # would open — so publishing it would be handing out a file whose only possible use is confusion.
+      - name: publish and bundle the macos desktop client
+        if: github.event_name != 'pull_request'
+        run: |
+          set -euo pipefail
+
+          # RestoreLockedMode=false for the RID, exactly as the win-x64 publish above does — see the
+          # long note there for why the committed lock files are deliberately RID-free. This runner's
+          # checkout is thrown away, so the lock files it rewrites go nowhere.
+          dotnet publish src/DodoSSH.Client.App/DodoSSH.Client.App.csproj \
+            --configuration Release --runtime osx-arm64 --self-contained true \
+            -p:RestoreLockedMode=false \
+            --output "$RUNNER_TEMP/osx-arm64"
+
+          # The apphost has no extension on macOS, so this is `DodoSSH` and not `DodoSSH.exe`. Named
+          # rather than globbed, because a publish that produced no apphost at all would otherwise
+          # bundle happily and produce an .app that launches nothing.
+          if [ ! -s "$RUNNER_TEMP/osx-arm64/DodoSSH" ]; then
+            echo "The osx-arm64 publish produced no apphost." >&2
+            ls -la "$RUNNER_TEMP/osx-arm64" >&2 || true
+            exit 1
+          fi
+
+          bundles="$RUNNER_TEMP/osx-bundle"
+
+          # The quotes around [osx] are load-bearing, exactly as they are on '[win]' above: unquoted,
+          # the shell reads it as a glob matching any one of o, s and x.
+          dotnet vpk '[osx]' bundle \
+            --skip-updates \
+            --packId DodoSSH.Desktop \
+            --packVersion '${{ steps.winpack.outputs.packVersion }}' \
+            --packDir "$RUNNER_TEMP/osx-arm64" \
+            --packTitle DodoSSH \
+            --packAuthors DodoTech \
+            --mainExe DodoSSH \
+            --bundleId dev.dodotech.dodossh \
+            --runtime osx-arm64 \
+            --channel osx \
+            --outputDir "$bundles"
+
+          # Asked for rather than inferred from an exit code, for the reason the Windows step gives.
+          # The Info.plist is the specific thing worth naming: a bundle missing it is a directory
+          # macOS will not treat as an application at all, and it is the one part of the .app that
+          # vpk composes rather than copies.
+          app="$bundles/DodoSSH.Desktop.app"
+          if [ ! -s "$app/Contents/Info.plist" ]; then
+            echo "vpk reported success and there is no Info.plist at $app/Contents/Info.plist." >&2
+            find "$bundles" -maxdepth 3 >&2 || true
+            exit 1
+          fi
+
+          echo "Bundled DodoSSH ${{ steps.winpack.outputs.packVersion }} for osx-arm64."
+
       # This includes the end-to-end suite, which starts PostgreSQL, Keycloak and an OpenSSH
       # server through Testcontainers and runs the API as a child process — so it needs a
       # Docker daemon and gets one here. That is why the tests run on ubuntu rather than

README.md

@@ -80,6 +80,8 @@ docs/platform-flags.md     what differs off Windows, and the gotchas that have c
 docs/manual-checks.md      what no test can reach, and what to look for when checking by hand
 docs/android-port.md       the Android head: what was decided, what is built, what is left
 scripts/                   release-windows.ps1 — builds, packs and publishes the Windows client
+                           release-macos.sh   — the same, signed and notarized, on a Mac
+build/macos/               the entitlements and Info.plist template the macOS bundle is built from
 ```
 
 Everything under `src/DodoSSH.Client.*` except the two heads and `Shell` is deliberately free of Avalonia.
@@ -152,8 +154,32 @@ reinstalling asks for your passphrase rather than starting over. Use **Sign out*
 you want the machine to genuinely forget everything — an uninstall is not a sign-out, and does not withdraw
 this machine's device key from your account.
 
-Cutting a release is `scripts/release-windows.ps1`, run by a person on a Windows machine. Deliberately not a
-CI job; ADR 0013 decision 3 explains why, and it is not only that the runners are Linux.
+## Installing on macOS
+
+A `.pkg` on the same release page, for Apple Silicon. Everything above about where a client may come from,
+about the update check and about uninstalling applies unchanged; what differs is worth three short
+paragraphs.
+
+**It is signed and notarized, so there is no warning to click past.** That is not generosity — macOS refuses
+to open an un-notarized download outright rather than warning about it, so unlike the Windows build there
+was never an unsigned option. If you *do* see "cannot be opened because Apple cannot check it for malicious
+software", the file did not come from the project's release page, and that is worth taking literally.
+
+**Apple Silicon only for now.** An Intel package is a small amount of work and no one here has an Intel Mac
+to check it on, and this project does not ship desktop builds nobody has run — see
+[docs/manual-checks.md](docs/manual-checks.md). Under Rosetta the arm64 build will not run; there is no
+graceful version of that, and the honest answer is that the platform is not covered yet.
+
+**Touch ID can stand in for your passphrase**, on a Mac with a Secure Enclave. The key that unwraps your
+device key is generated inside the enclave and never leaves it, and the enclave — not DodoSSH — is what
+requires your fingerprint or login password before it will use it. Cancel the prompt and you get the
+passphrase screen, always. The application lives at `/Applications/DodoSSH.Desktop.app` and your vault cache
+at `~/Library/Application Support/DodoSSH`, which are deliberately two different places so that removing the
+first never touches the second.
+
+Cutting a release is `scripts/release-windows.ps1`, run by a person on a Windows machine, and
+`scripts/release-macos.sh` on a Mac. Deliberately not a CI job; ADR 0013 decision 3 explains why, and it is
+not only that the runners are Linux.
 
 ### The nightly desktop build
 
@@ -886,8 +912,18 @@ keychain plus a terminal — and the spike that gates all of it.
   [ADR 0013](docs/adr/0013-desktop-distribution-and-updates.md), and
   [Installing on Windows](#installing-on-windows) for what a user sees.
 
-  Still to do here: signing (the first release is unsigned, and the trigger for buying a certificate is the
-  first release aimed at strangers), and macOS and Linux packaging.
+  **The macOS half is built on the same machinery**, and signed from the start because Gatekeeper leaves no
+  choice: `scripts/release-macos.sh` publishes, signs every native library, notarizes with Apple and staples
+  the ticket before it will hand anything over, and refuses to upload until a person has installed it. The
+  device key is held in the Secure Enclave behind Touch ID. CI publishes `osx-arm64` and builds the `.app`
+  on every main build to prove it still packages, and uploads nothing. See
+  [ADR 0013](docs/adr/0013-desktop-distribution-and-updates.md) decision 10 and
+  [Installing on macOS](#installing-on-macos).
+
+  Still to do here: Windows signing (the first Windows release is unsigned, and the trigger for buying a
+  certificate is the first release aimed at strangers), macOS on Intel, Linux packaging, and Phase 18 of the
+  manual checks — the macOS build has never actually run, because there is no macOS runner in CI and
+  everything above is verified only as far as the bundle.
 - **M5 — multi-provider OIDC**, identity key rotation, per-item content keys.
 
 ## Licence

build/macos/DodoSSH.entitlements

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  What the hardened runtime has to be asked to relax before a .NET application will run under it.
+
+  The hardened runtime is not optional: notarization refuses a Developer ID submission without it,
+  and Gatekeeper refuses an un-notarized download. So every entitlement below is the price of being
+  distributable at all, and each one is a hole in a wall that is otherwise worth having. They are
+  listed one at a time, with what breaks without each, because the temptation when notarization
+  fails at eleven at night is to paste in a longer list from somewhere and stop thinking.
+
+  ◆ WHAT IS DELIBERATELY NOT HERE.
+
+  com.apple.security.app-sandbox. Developer ID distribution outside the App Store does not require
+  the sandbox, and turning it on would break the product outright: the terminal's data plane is a
+  loopback WebSocket (see DodoSSH.Client.Terminal/TerminalDataPlane.cs), and a sandboxed process
+  needs com.apple.security.network.server to listen at all, plus network.client to reach any host
+  the user asks for. This is the same shape of decision as ruling out MSIX on Windows, which was
+  ruled out for the same loopback reason — docs/platform-flags.md.
+
+  com.apple.security.cs.debugger. Would let this process attach to others. Nothing here debugs
+  anything, and it is the entitlement most worth not having.
+-->
+<plist version="1.0">
+<dict>
+  <!--
+    CoreCLR compiles IL to machine code at runtime and then executes the pages it just wrote. The
+    hardened runtime's default is that no page is both writable and executable, so without this the
+    process does not start — it dies during runtime initialisation, before any of this application's
+    code runs, which means before anything exists that could report it.
+  -->
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+
+  <!--
+    The broader form of the same permission, and it is needed as well as allow-jit rather than
+    instead of it. allow-jit covers pages mapped through the MAP_JIT convention; CoreCLR also
+    allocates executable memory outside that path — stubs, precode, and the write-xor-execute
+    fallback it uses when MAP_JIT is unavailable. With only the first, startup gets further and
+    still fails.
+  -->
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+
+  <!--
+    Library validation requires every loaded dylib to be signed by the same team as the main
+    binary. This bundle carries native libraries built by other people — libsodium, libSkiaSharp,
+    libHarfBuzzSharp, libe_sqlite3, libAvaloniaNative — and the release script signs each of them
+    with this Developer ID, which would in principle satisfy validation.
+
+    It is disabled anyway, and the reason is the updater. Velopack replaces the bundle in place and
+    relaunches it, and the process doing the replacing is not always signed by the same team as the
+    process being replaced during the changeover. Leaving validation on makes the failure mode of a
+    bad update "the application will not start", with no way to recover except a reinstall the user
+    would have to be told about through some other channel.
+  -->
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+
+  <!--
+    The runtime reads DYLD_ variables while resolving its own native dependencies, and Velopack's
+    update path sets them. Without this the hardened runtime strips them silently and the failure
+    surfaces later as a library that cannot be found, naming a file that is plainly present.
+  -->
+  <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+  <true/>
+</dict>
+</plist>

build/macos/Info.plist.template

@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  The Info.plist for the macOS bundle, with the version left as a placeholder.
+
+  ◆ A TEMPLATE RATHER THAN A FILE, BECAUSE vpk COPIES A CUSTOM PLIST VERBATIM.
+
+  Measured, not assumed: `vpk [osx] bundle --plist` performs no substitution of any kind. It logs
+  "Bundle using provided Info.plist" and copies the bytes. That is also why it refuses --plist and
+  --bundleId together — with a plist supplied, every key is the caller's problem.
+
+  So a committed Info.plist would carry whatever version it was written with into every release
+  afterwards, and the failure is quiet in the worst way: Velopack's own release index would carry the
+  right version, the updater would compare correctly and update correctly, and only the About window,
+  Finder's Get Info panel and any crash report would claim the build was something else. Nobody
+  reads those on the day of a release. scripts/release-macos.sh substitutes @VERSION@ into a copy
+  and passes that.
+
+  ◆ WHY A CUSTOM PLIST AT ALL, WHEN vpk WRITES A PERFECTLY GOOD ONE.
+
+  Three keys it does not write, each of which is a real defect without it:
+
+    CFBundleDisplayName    The bundle on disk is DodoSSH.Desktop.app, because the pack id must not
+                           be DodoSSH — see scripts/release-macos.sh for the directory collision
+                           that rule prevents. On Windows the pack id is invisible; on macOS it
+                           names the thing in /Applications and in the Dock. This key is what puts
+                           "DodoSSH" back in front of a person while the bundle keeps the id.
+
+    LSMinimumSystemVersion Without it macOS will happily launch this on a release the runtime was
+                           never built for, and the user gets a dyld crash rather than a sentence.
+
+    NSHumanReadableCopyright  Shown in the About panel. Absent, the panel shows a blank line.
+-->
+<plist version="1.0">
+<dict>
+  <!--
+    CFBundleName is what the menu bar shows and is capped at 15 characters by convention;
+    CFBundleDisplayName is what Finder and the Dock show. Both say DodoSSH, and the bundle
+    directory does not. See the note above.
+  -->
+  <key>CFBundleName</key>
+  <string>DodoSSH</string>
+
+  <key>CFBundleDisplayName</key>
+  <string>DodoSSH</string>
+
+  <!--
+    Reverse-DNS under the domain this project actually controls. It is the identity Gatekeeper,
+    the notary service and the keychain all key off, so it is as irreversible as the Windows pack
+    id: changing it makes an update a different application, and it orphans anything the previous
+    identifier stored — including the Secure Enclave key MacDeviceKeyStore holds, which is scoped
+    to this identifier and cannot be migrated because its whole point is that it never leaves the
+    enclave.
+  -->
+  <key>CFBundleIdentifier</key>
+  <string>dev.dodotech.dodossh</string>
+
+  <!--
+    The apphost the publish produced, named for the product by <AssemblyName> in the csproj rather
+    than for the project. Must match --mainExe or the bundle launches nothing.
+  -->
+  <key>CFBundleExecutable</key>
+  <string>DodoSSH</string>
+
+  <!--
+    Both version keys take the numeric core only — 1.2.3 and never 1.2.3-rc.1 — because Apple
+    defines them as one to three dot-separated integers and notarization rejects what it cannot
+    parse. The full version, prerelease suffix and all, is in Velopack's release index, and that
+    is the one the updater compares. These two are for Finder and for Gatekeeper.
+
+    They are the same value rather than the usual marketing/build split, because there is no build
+    counter here that a release does not already bump.
+  -->
+  <key>CFBundleShortVersionString</key>
+  <string>@VERSION@</string>
+
+  <key>CFBundleVersion</key>
+  <string>@VERSION@</string>
+
+  <!--
+    The file name inside Contents/Resources, which is where --icon puts it. With a custom plist
+    nothing rewrites this key, so a rename of the asset that forgets this line produces a bundle
+    showing the generic application icon and no error anywhere.
+  -->
+  <key>CFBundleIconFile</key>
+  <string>dodossh.icns</string>
+
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+
+  <!--
+    12.0, and it is read off the binaries rather than off a support matrix. The apphost and
+    libcoreclr.dylib in a net10.0 osx-arm64 publish both carry LC_BUILD_VERSION with minos 12.0.0,
+    so 12.0 is the oldest release these bytes are built to load on.
+
+    Microsoft's *support* statement for .NET 10 is higher than this, and that difference is
+    deliberate rather than overlooked: this key decides whether macOS refuses to launch the app at
+    all, and refusing on a release where it would in fact have run is the worse of the two errors.
+    A user on an unsupported-but-working macOS gets the application; the support matrix governs
+    what gets fixed if it misbehaves there, which is a different question.
+  -->
+  <key>LSMinimumSystemVersion</key>
+  <string>12.0</string>
+
+  <!--
+    Without this the window is drawn at 1x and scaled up, which on a Retina display turns the
+    terminal — the one surface in this application that is nothing but small text — into a blur.
+  -->
+  <key>NSHighResolutionCapable</key>
+  <true/>
+
+  <key>NSPrincipalClass</key>
+  <string>NSApplication</string>
+
+  <!--
+    False, and stated rather than left out. An agent application has no Dock icon and no menu bar;
+    this one is an ordinary windowed application and the default is already false, but the key
+    being absent is indistinguishable from somebody having removed it.
+  -->
+  <key>LSUIElement</key>
+  <false/>
+
+  <key>NSHumanReadableCopyright</key>
+  <string>© DodoTech. MIT licensed.</string>
+</dict>
+</plist>

docs/adr/0007-device-key-protection.md

@@ -1,4 +1,4 @@
-# ADR 0007 — What protects the device key on Windows
+# ADR 0007 — What protects the device key on the desktop
 
 **Status:** accepted, 2026-07-30
 **Supersedes nothing. Constrains** the device-unlock work described in the client roadmap.
@@ -141,6 +141,14 @@ would have become false under DPAPI alone. A gesture is still something the atta
 - **A TPM is not always there.** A machine without one gets a store that reports itself unavailable, so
   unlock keeps asking for the passphrase and neither affordance appears in the interface. The passphrase path
   is therefore required, not a nicety.
+- **macOS reaches the same decision through different hardware, and the argument transfers intact.**
+  `MacDeviceKeyStore` puts the wrapping key in the Secure Enclave under an access control requiring user
+  presence, so Touch ID or the login password is a condition of *using* it and the enforcement is the
+  platform's rather than the process's — which is the entire point of the 2026-07-30 amendment above, and
+  the thing a self-drawn prompt over a protected file would fail to be. The mechanical differences are
+  incidental: P-256 with ECIES because the enclave holds no other kind of key, and no prompt when sealing
+  because the public half needs no consent. See docs/platform-flags.md for the three ordinary Macs where the
+  probe answers no, one of which is every unsigned development build.
 - **The stored key must be treated as losable at any time** — a reset PIN, a cleared TPM, a replaced key.
   Every loss degrades to a passphrase prompt and never to a locked-out vault, which is why every failure in
   the store returns null rather than throwing and why the three unlock statuses all end in the same advice.

docs/adr/0013-desktop-distribution-and-updates.md

@@ -228,6 +228,44 @@ changes.
 token, and it puts a compellable third party in the signing path — which is ADR 0011 rule 3's shape one
 layer down, declined there for reasons that do not stop applying because the vendor changed.
 
+**This rule is Windows-only, and macOS gets the opposite one.** See decision 10: there is no "unsigned for
+now" available on that platform at any price, because Gatekeeper refuses rather than warns.
+
+### 10. macOS is a second desktop platform on the same machinery, signed from the start
+
+The macOS head is the same application, the same Velopack, and the same two-phase person-run release. Four
+things differ, and each is forced rather than chosen.
+
+**Signing is a precondition, not an improvement.** Decision 8's whole argument — one dialog per user per
+lifetime, buy a certificate when a stranger is invited to install — has no macOS equivalent. An
+un-notarized download is refused outright, so the Developer ID certificate and the notarization round trip
+are the price of the package existing. `scripts/release-macos.sh` therefore refuses to run without the
+signing identities, where the Windows script refuses nothing.
+
+**The channels are `osx` and `osx-nightly`, and they are separate for decision 9's reason.** Four channels
+now publish to one repository, and the only thing keeping a Mac from being offered a Windows package is
+that it never reads that index. The macOS nightly channel is named and has no publisher: CI builds and
+bundles the macOS head to prove it still builds, and uploads nothing, exactly as it does for the Windows
+release channel.
+
+**The pack id is shared with Windows, and on macOS it is visible.** vpk names the bundle after the pack id,
+so `/Applications` holds `DodoSSH.Desktop.app`. Decision 2's reasoning applies with more force here rather
+than less: a pack id of `DodoSSH` would put Velopack's install root on `~/Library/Application
+Support/DodoSSH`, which is `ClientPaths.DataDirectory`, and an uninstall would take the user's un-synced
+outbox with it. `CFBundleDisplayName` puts the product name back in front of a person; the directory keeps
+the id.
+
+**arm64 only, because the check is the scarce thing.** Velopack keys a channel to one architecture, and an
+Intel package would be the only artefact in this repository reaching users without somebody having walked
+Phase 18 against it. The engineering for a second channel is small and is described in the release script;
+what is missing is an Intel Mac to verify on, and shipping blind is the thing this project's manual-check
+discipline exists to refuse.
+
+**And one thing that does not differ, which is worth saying because it is the expensive half.** The
+capability to publish still lives on a person's machine and never in CI. Notarization does not change that:
+Apple's ticket says this build came from this developer account, and says nothing about whether the build
+should have been made. Velopack clients still apply what their feed serves. Rule 3 is untouched.
+
 ### 9. There is a second desktop channel, published by CI, and it is a second application
 
 [ADR 0014](0014-android-updates.md) gave the phone a nightly channel and rule 3 above gives the desktop

docs/android-port.md

@@ -30,7 +30,10 @@ verified is that it compiles, links, packages, and carries the right natives.
 transfers protected by a **foreground service**. File transfer is not in the first scope; when it arrives it
 is **one remote pane** with Android's document picker for moving files in and out. *It has since arrived,
 both ways:* the pane, the queue, `ACTION_OPEN_DOCUMENT` going in and `ACTION_CREATE_DOCUMENT` coming out,
-with the foreground service now counting transfers as well as shells.
+with the foreground service now counting transfers as well as shells — and, since, an idle-but-connected
+Files session as well, which a transfer count alone was blind to. *Corrected the same round:* the service's
+other half — a shell's own opening — had never been wired to anything at all, so a shell survived only for
+as long as the app stayed foreground; see [Sessions survive backgrounding](#sessions-survive-backgrounding-via-a-foreground-service).
 
 **What was actually checked**, so the rest can be read with the right amount of trust:
 
@@ -235,6 +238,37 @@ The parts that are definitely different are the on-screen keyboard, and the fact
 needs Ctrl, Esc, Tab and arrows that the software keyboard does not offer — every Android SSH client ships an
 accessory key row for this. That is UI work, not porting.
 
+> **⚠️ Corrected by the build. The data plane assumed a renderer that attaches once and lives forever, and
+> that assumption is WebView2's truth, not Android's.** Desktop's WebView2 process starts with the window and
+> dies with it; `TerminalDataPlane` was written to that reality — one socket, attached once,
+> `Interlocked.Exchange`-guarded against a second attach ever happening at all. On a phone the WebView's own
+> renderer process is a separate thing from the app process the foreground service above is keeping alive,
+> and Android kills *that* independently — under memory pressure, or simply for being backgrounded — with no
+> foreground service able to save it. The page then reloads with a fresh socket, and three things broke on
+> that reload before this was found: the second attach was refused outright (`409 Conflict`), because a
+> second valid upgrade could only mean a bug or a hostile second process, never our own page coming back; a
+> send into the dead first socket threw, and that exception unwound `TerminalSessionPump`'s flush loop,
+> freezing the still-live shell behind it — `LiveSessionCount` kept counting a session nothing would ever
+> drain again; and every byte sent while no page was attached had already spent flow-control credit that no
+> acknowledgement could ever return, so a session outliving 256 KiB of output into a dead page stalled for
+> good regardless of the other two. Waiting for the old socket to notice it was dead and close on its own
+> was never going to be enough either — a killed renderer sends no TCP FIN, so the old receive loop could sit
+> unaware for the whole 30-second keepalive.
+>
+> Fixed as a takeover rather than a guard: a second valid upgrade — origin, token and subprotocol all
+> checked exactly as before — now displaces whatever socket was attached instead of being refused, since
+> only this app's own page ever knows the token, so a second valid attach *is* that page, back again.
+> `TerminalDataPlane.SendAsync` no longer lets a dead-socket send escape as a fault; it reads as "nobody
+> listening," same as no socket being attached at all. `TerminalWorkspace` resets each live session's credit
+> window on every attach and resends its `SessionOpened` frame, flagged as a replay, so the fresh page
+> rebuilds the pane and the pump stops waiting on an acknowledgement that was never coming. And
+> `terminal.js`'s socket now retries itself, forever, with backoff, instead of reporting the connection
+> failed and stopping — the page dies with the app anyway, so there is no case where retrying is the wrong
+> call. What is **not** recovered, and says so rather than pretending otherwise: scrollback across a page
+> reload. It lived in the page's own DOM, and a reloaded page is a new DOM. The replay banner — *"the view
+> reconnected; earlier output stayed on the host"* — is that honesty put where the person looking at the
+> terminal will actually read it, not buried in a log.
+
 ---
 
 ## Decisions taken
@@ -280,13 +314,50 @@ What is desktop-only is the *left* pane — `LocalDirectory`, the drive list, th
 
 ### Sessions survive backgrounding, via a foreground service
 
-A persistent notification for as long as a shell or a transfer is live.
+A persistent notification for as long as a shell, a transfer, or an idle-but-connected Files session is
+live.
 
 It costs the user a notification and some battery. It buys the behaviour the desktop client already promises
 and documents — that a shell outlives a vault lock, and that a transfer finishes — and the alternative was
 to make `TerminalWorkspace`'s guarantee desktop-only, which is a worse thing to have to write down than a
 notification is to look at.
 
+**Three corrections found after the first cut shipped, all in the wiring rather than the design:**
+
+- **A shell opening never started the service.** `SessionKeepAlive` heard `TerminalWorkspace.SessionEnded`
+  and refreshed on that, but nothing announced the opposite event — so a user who opened a shell and
+  backgrounded the app immediately had no foreground service at all, and Android was free to kill the
+  process holding it. `MainWindowViewModel.TerminalSessionOpened` is now wired the same way in
+  `App.axaml.cs`'s `ComposeKeepAlive`.
+- **A connected-but-idle Files session counted as nothing.** A host open on the Files screen with no
+  transfer moving is a live SFTP connection a dying process would sever, and the old two-argument
+  `Reconcile(liveSessions, activeTransfers)` had no way to hear about it. `TransfersViewModel.HasLiveFileSession`
+  — `IsConnected` with a real `ConnectedCipher`, which a bucket never has — is the third fact `Reconcile` now
+  takes.
+- **Refreshing the notification restarted the service, which throws when backgrounded.** `Reconcile` called
+  `StartForegroundService` on every refresh, including the common case of a service that was already
+  running. On API 31+ that throws `ForegroundServiceStartNotAllowedException` the instant the app is
+  backgrounded — a transfer finishing in the pocket, one of two shells dying — which crashed the process and
+  took every session with it. `SessionForegroundService` now tracks whether it is already running and, when
+  it is, posts the updated notification through `NotificationManager.Notify` instead of asking Android to
+  start anything.
+
+**The notification permission is requested, not just declared.** API 33+ requires `POST_NOTIFICATIONS` at
+runtime or the receipt is silently invisible — the service still runs, but nothing on screen says so.
+`SessionForegroundService.Reconcile` asks for it the first time in this process there is actually something
+to show, at most once, with no result read back: a refusal costs the notification and nothing else, which is
+what the manifest's own comment on the permission says.
+
+**And a fourth correction, found by the notification refusing to come down.** "1 shell connected" outlived
+the shell, both ways a shell can close. A shell exiting on its own announced `SessionEnded` from inside its
+run's own finally block — where the run task is by definition not yet complete, so the
+`LiveSessionCount` the keep-alive reads from that event still counted the session that had just ended, and
+nothing fired afterwards to correct it. A tab closed by hand announced nothing at all, by a recorded
+decision that assumed every subscriber was the closer. Both reversed in `TerminalWorkspace`: the end is now
+announced from a continuation after the run has actually completed, and `CloseSessionAsync` announces too,
+after its own drain — the event's remark carries the reversal, and `SessionEnded`'s subscribers were all
+already "reconcile to reality" handlers for which a second announcement is harmless.
+
 ### Phone first
 
 About 360dp wide. The tablet route was cheaper — a landscape tablet is close to the existing 880×560 minimum
@@ -523,7 +594,12 @@ go at 360dp:
    stopping it from a count rather than a lifecycle. `TerminalWorkspace.LiveSessionCount` is the source of
    truth deliberately: it already knows that a session whose shell exited is not live, which a counter
    incremented on open would not, and a phone showing "1 shell connected" over nothing would be exactly the
-   dishonesty the unlock screen's count exists to prevent.
+   dishonesty the unlock screen's count exists to prevent. *Corrected since:* the opened half of a shell's
+   lifecycle was never wired in, so the service could never come up for a shell at all; an idle-but-connected
+   Files session now counts as a third live fact rather than nothing; a refresh while backgrounded updates
+   the notification in place instead of restarting the service, which the API throws on; and
+   `POST_NOTIFICATIONS` is now actually requested rather than merely declared. See
+   [Sessions survive backgrounding](#sessions-survive-backgrounding-via-a-foreground-service) for all four.
 7. ~~**The interface**, phone-first.~~ **Done for the decided scope** — all seven screens of the design,
    plus the two states the design does not draw because it starts at an enrolled phone (naming a server, and
    choosing a passphrase).

docs/design-import-gaps.md

@@ -188,9 +188,21 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > project rather than requested by name and left to whatever the machine happens to have, the way `WithInterFont`
 > alone used to leave Inter registered but unused. Montserrat is the default sans now, with Inter kept as its
 > fallback rather than the whole answer; `MonoFont` gains JetBrains Mono at the front of its own list, ahead of
-> the system-mono stack that is still behind it for a glyph JetBrains Mono does not cover. Android recolours
-> with the shared palette and keeps its own default sans — fonts are per-head by decision, only colour is
-> shared.
+> the system-mono stack that is still behind it for a glyph JetBrains Mono does not cover. **Android recoloured
+> with the shared palette and kept its own default sans when this paragraph was first written; it does not any
+> more** — see "the phone catches up", directly below.
+>
+> **The phone catches up.** A later reversal than the one above, on the same reasoning: a face is not a
+> colour, and the user decided the phone should share both rather than only the second. `WithInterFont` gains
+> the same `FontManagerOptions` block `Program.cs` sets, off the same embedded Montserrat, no new asset
+> required. `Theme/Phone.axaml`'s six-rung v2 ladder — 4/9/10/11/12/14 — collapses to the desktop's three:
+> chip or tag 6, button or field 10, card or output 12; `Button.fab`'s 28 and every sheet's 22 survive
+> unchanged, being geometry rather than ladder rungs. `Button.primary` and `Button.fab` take `AccentGradient`
+> and `AccentGlow` in place of a flat fill, the same swap `Button.accent` made on the desktop, `BoxShadow`
+> cleared the same way on disabled. And the phone's own chrome — the vault header, the bottom bar, the shells
+> strip, `HostActionBar`, the editor headers, the terminal's collapsed bar and every screen's raised selection
+> bar — moves from `Chrome`/`Sidebar` to `DeepChrome`, joining the desktop's own v5b titlebar-and-rail move;
+> `PhoneRail`'s hover takes `Track`, which `Palette.axaml` already names for that row. Borders stay keyed.
 >
 > **Flat sections replace the grid of group cards and the breadcrumb trail — reversing v3, on the user's own
 > approval rather than a defect found in it.** v3's grid held one level of the group tree at a time, opened by
@@ -246,7 +258,7 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > | The host card as a link straight to a terminal | Click still selects, double-click still connects, and the pencil still opens the pane — the mock's card-as-link is not adopted, because multi-select (Ctrl, Shift, the marquee band) depends on a plain click meaning "choose this one" rather than "go". |
 > | Quick connect's SSH/SFTP kind column | The auth word — credential, key, or password — see above. |
 > | A collapsed section staying collapsed after a restart | In memory only, for the running session. `settings.json` holds two scalars by decision — the terminal's text size and whether this machine checks for updates on its own — and collapse state is not judged worth a third. |
-> | QUICK ACCESS's editor, on the phone | **Deferred; the data is not.** `HostSecret.PinnedPaths` is shared, synced and merged on both heads, so a pin made on the desktop reaches the phone and back — Android just has nowhere yet to add or remove one itself. |
+> | QUICK ACCESS's editor, on the phone | ◆ **Shipped, over the same shared data the deferral above described.** The phone's host editor draws its own QUICK ACCESS section on the same staged `VaultViewModel.EditorPinnedPaths` the desktop's drawer binds — a row per pin, an add field and button, and a remove target sized to this head's 44dp touch floor rather than the desktop's 22-pixel close box. `AddEditorPinCommand`'s refusals surface through a `Status` line the editor page draws for itself, since that page covers the whole screen and the list behind it draws its own `Status` off-screen for as long as it is open. The pins themselves reach a second surface this head has that the desktop does not need: `TransfersViewModel.ConnectedPinnedPaths` carries them as chips on the Files screen while connected, and tapping one runs `GoRemoteCommand` — the same command the breadcrumb trail already used to navigate. Two deviations from the desktop, both named where they land: the chip row is a snapshot taken at connect rather than a live follow of the vault, so a pin edited mid-session shows up on the next connect rather than this one; and the editor's own hint sentence says the pins appear on the Files screen, not above a terminal — this head has no terminal strip for them to sit above, the same honesty the row below already states for the desktop's own hint. |
 > | Collapse All beside every section's own collapse chevron | Bound on every heading's view model and shown on only the first — `SidebarGroupHeader.IsFirstBoardSection` is what a virtualised list of sections uses in place of a control of the board's own that would otherwise have to sit above all of them. |
 > | The QUICK ACCESS hint's claim that pins live in a sidebar | "Pinned folders appear above the terminal for this host." — no sidebar exists on this screen for the sentence to point at, so the shipped hint says where they actually draw. |
 > | The mock's "Saving to **DodoTech ▾** vault" subtitle, with a picker's chevron inside a sentence | The pre-existing `DrawerSubtitle` wording — the vault's name alone, unchanged by this pass. A chevron inside running text implies the text itself is the control, which it is not: the vault picker is its own element, shown only while creating and only above one writable vault, as it always has been. |
@@ -285,11 +297,11 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > | The host header's OS label (`Ubuntu 24.04 LTS`) and latency reading (`12 ms`) | Neither. The client does not know the remote's OS and nothing measures round-trip time — the same two absences the terminal pane header already recorded before this pass, carried into the new header rather than reopened. |
 > | A **Port forward** button on the host header | Omitted. The feature does not exist; see the FORWARDING rows earlier in this document. |
 > | The tab and status dots' third, amber state | ◆ **Still two states**, for the reason the hosts screen's own dot has stayed two states since v3: green means a shell is open (or a session is connected), grey means it is not, and nothing here pings a host to justify a third colour meaning "reachable but not connected". |
-> | The status bar's negotiated cipher, host-key algorithm and key/credential name | Omitted, and recorded rather than silently dropped. None of the three is reachable from this shell today: `SshNetConnection` holds the negotiated algorithms but nothing reads them off `ISshConnection`; `HostKeyPresentation` exists only for the trust questions a connection asks on the way in, not for a session already open; and a key's display name is never threaded past the connect call into anything the session keeps. What is real and bound is CONNECTED plus a dot, the session's own elapsed timer, and — terminal surface only — `UTF-8`, worded as a fact about this client's own renderer rather than a claim the remote agreed to. Candidates for future plumbing, not a defect closed here. |
+> | The status bar's negotiated cipher, host-key algorithm and key/credential name | ◆ **Shipped, on both surfaces, with three honest deviations.** `ISshConnection` and `ISftpSession` now both carry `Cipher` — the server-to-client algorithm off SSH.NET's own `ConnectionInfo.CurrentServerEncryption`, captured once at construction because a rekey is not an event SSH.NET raises — and `TerminalWorkspace.GetSessionFacts` hands the cipher and the host key's algorithm back to the shell the moment a session opens; `VaultViewModel.TryBuildAuthentication` now threads the authenticating key's or credential's own `Label` into `HostAuthentication.IdentityLabel`, all the way to `MainWindowViewModel`'s surface-aware `SessionCipher`, `SessionHostKeyAlgorithm` and `SessionIdentityLabel`, composed into one `SessionIdentityText` run for the status bar. Three deviations from the mock, not omissions: the algorithm prints exactly as negotiated (`ssh-ed25519`), not the design's shortened `ed25519`, because trimming it would be an edit to a string this client did not choose; the run is plain text rather than the design's clickable element, because there is no pin-details modal for a session that is already open, and drawing a click target for a screen that does not exist would itself be a fabrication; and a typed-password session — nothing filed in the keychain to name — shows the host-key algorithm alone, with no `·` after it, because there is no item behind the dot. |
 > | S3 dimmed in the design's own switcher | **Enabled.** The mock leaves S3 as future work; this application already has bucket browsing, so SSH, SFTP and S3 are a true three-way segment, wired to `IsSshShowing`, `IsTransfersShowing` and `IsBucketsShowing` exactly alike. |
-> | The S3/Buckets screen | **Did not get the session shell this pass.** `TransfersScreen` serves both SFTP and S3 today and only the SFTP usage in `MainWindow.axaml` sits inside the new tab row/header/status bar/sidebar; the S3 usage is unchanged. |
+> | The S3/Buckets screen | **Did not get the session shell in v5b.** `TransfersScreen` serves both SFTP and S3 today and only the SFTP usage in `MainWindow.axaml` sat inside the new tab row/header/status bar/sidebar; the S3 usage was unchanged at the time. **v5c gives it the shell's own look without the machinery** — a 26-pixel padded, bordered, radius-12 container and nothing past that, since a bucket has no tab to close, no host to head a card with and no pin for a sidebar to show; see the v5c section, below. |
 > | No pins destination in the design at all | **Kept anyway.** The rail still carries Pins — `KnownHostsScreen` — because the mock has no screen for approved host keys and this application's has to stay reachable. |
-> | The popover's Settings and Preferences rows, and the design's own Settings-* family of screens | Both land on the one screen this application actually has, `Preferences` — the design's own Settings area is future work, so this is two doors to one room rather than a door removed. |
+> | The popover's Settings and Preferences rows, and the design's own Settings-* family of screens | **Landed in v5c.** What was two doors to one room in v5b — Settings and Preferences both opening the same bare `Preferences` screen — is now two of three doors onto their own settings pages: Settings opens General, Preferences opens Preferences, and a third row, Vaults, opens Vaults. All three are real, distinct pages inside one settings mode; see the v5c section, below. |
 > | `· Org` after the user chip's name, and a `Primary` tag on a vault row in the popover | Neither. There is no organisation concept behind a vault — only the vault itself — and no vault is distinguished as primary; the popover's vault rows are the existing shown-vaults toggles, restyled. |
 > | The design's titlebar, which has nowhere for a sync indicator | `SYNCED` stays, on the titlebar's right side, ahead of the window's own minimise/maximise/close buttons — the one thing this titlebar keeps that the design's own does not draw at all. |
 > | Per-tab SFTP sessions, implied by a tab row shared between the terminal and the SFTP surface | **Not built, and not what shipped instead.** A click on the SFTP tab row runs `MainWindowViewModel.SelectFilesHostAsync`, which opens (or reuses) a second, SFTP-specific connection through the same "Browse files" plumbing a pin click already used — an honest second login, not a channel multiplexed onto the terminal's. `SelectedTab` moves with the click, which is also what keeps the sidebar's QUICK ACCESS in step — that list is keyed to `SelectedTab` on both surfaces, so selecting a different terminal tab afterwards can leave QUICK ACCESS naming a host that is not the one the remote pane is actually browsing. |
@@ -307,6 +319,63 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > | The design's shorter captions — "Type into terminal", the rationale-only sentence for "runs on insert" | The screen's own longer, more actionable wording kept instead: the insert button still names the destination tab (`TYPE INTO {tab}` / `NO TERMINAL OPEN`), and the "runs on insert" caption still states the operational consequence rather than only the reason the setting exists. Both of the design's sentences are true; the ones already here say more. |
 > | A delete confirmation for a snippet | **Built, matching the mock.** `SnippetsViewModel.RequestDelete`/`ConfirmDelete`/`CancelDelete` say the same vault-wide-reach, tombstone, no-undo sentence `VaultViewModel.HowFarADeletionGoes` already says for every other item kind — additive beside the existing uncounted `DeleteCommand`, which the phone's own DELETE row still calls. |
 > | The Logs screen's own footer sentence about encryption | Adopted verbatim — verified against this screen's own header remark and ADR 0001 before shipping it, both true, so it is drawn as literal text rather than reworded. |
+>
+> ## The desktop's v5c — a settings area, at last
+>
+> An eighth pass, and the first to give the design's own Settings area a home of its own rather than folding
+> its two real screens into the rail's popover. Settings is a full-window **mode** now, swapped in wholesale
+> rather than laid over anything: its own 53px titlebar reading "Back to application", a 340px `SettingsNav`
+> rail — SETTINGS (General, Vaults, Account) above CUSTOMIZE (Security, Preferences, Groups, Tags), Logout
+> pinned below both — and a content column capped at the design's own 1100 pixels, which is 741 beside the
+> rail at the window's own minimum rather than the full 1100 (`LayoutHarness.SettingsContentWidth`). Seven
+> pages, not the design's eight: the ORGANISATION section and its one page are refused outright, below. Two
+> of the seven are wholly new — Account and Security did not exist as screens before this pass — and the
+> other five are the old `PreferencesScreen.axaml` and `VaultsScreen.axaml` split apart and restyled into the
+> design's own card idiom; both files are deleted, and every command either one offered is reachable here
+> exactly once. The popover's own Settings, Vaults and Preferences rows, and everywhere else in the codebase
+> that used to navigate to the bare `Preferences` or `Vaults` screen, now land in this mode instead —
+> `MainWindowViewModel.ShowScreen` redirects at that one point rather than at every caller that used to reach
+> either screen directly.
+>
+> The importer moved inside this same chrome rather than staying a screen of its own: it draws over the
+> Preferences page as a boolean overlay — `SettingsNav` stays lit on Preferences the whole time it is open,
+> and the titlebar's own back button reads "Back to preferences" instead of "Back to application" — restyled
+> to the design's own table (ALIAS/HOSTNAME/USER/PORT/WHAT THIS MEANS, one header tick-all button in place of
+> the old TICK ALL/TICK NONE pair). Known Hosts was restyled the same pass but kept its own place: it stays a
+> main-chrome screen, reached from the rail's Keys entry and now also from Security's own "Approved host
+> keys" row, because the design draws no page for it at all. And the S3/Buckets surface — which got none of
+> v5b's session shell — picked up that shell's *look* this time without its machinery: a 26-pixel padded,
+> bordered, radius-12 container and nothing else, since a bucket has no tab row, no host to head a card with,
+> no status-bar fact to print and no pin for a sidebar to show.
+>
+> | v5c element | What ships instead |
+> | --- | --- |
+> | The Settings-Organisation page, and the rail's own ORGANISATION section | Refused outright. No organisation entity exists anywhere in this product — a team is the membership list behind a shared vault, and there is exactly one tenant per deployment — so the rail simply has no third section; see `SettingsNav.axaml`'s own remark. |
+> | General: the update-channel switcher, Launch at login, Reopen tabs, the theme control and the language picker | Refused, and carried on the page's own NOT BUILT YET card rather than left silently missing: which channel a copy follows is fixed when it is built, nothing registers this application with Windows' own startup list or remembers a tab list across a launch, only the one dark theme exists, and there is no i18n anywhere in this client. |
+> | Vaults: the VAULT DEFAULTS card (auto-lock, require-password-on-unlock, relay) and the RECOVERY card (kit, export) | Both refused outright — none of the three settings exists, sync is always on, and there is no recovery kit and no export. |
+> | Vaults: "Manage devices", and the "3 devices" count on the sync line | Refused. There is no list-devices endpoint anywhere in this client. |
+> | Vaults: per-vault UNLOCKED/LOCKED chips, and the "Unlock ⟨vault⟩" modal | Refused. This application locks the keychain as a whole, not one vault at a time, so there is no per-vault state for a chip or a modal to act on; the keychain-level fact is the sync card's own dot instead. |
+> | Vaults: the magenta "Default" badge | Dropped rather than faked. The app does track a "new items go to" vault, but that lives on a different view model than the row being drawn here, and cross-referencing the two per card would be more machinery than the badge is worth. |
+> | Vaults: "Sorted by name ▾" | Decorative in the mock, and not drawn — `VaultsViewModel.Vaults` is already ordered personal-first-then-name, and there is no second order to switch to. |
+> | Vaults: member avatar stacks on every card | Refused on an unselected card — `VaultRowViewModel` carries a member *count*, not the members themselves, and only the selected vault's own member list is actually loaded. A count stands in on the card; avatars are real in the members panel, where the data is. |
+> | Account: Edit profile, Change passphrase, the DEVICES list, Sign out everywhere | All four refused — no endpoint exists for any of them, and the passphrase is a one-time enrollment choice with no change flow. What is new and real on this page instead: the SIGN-IN card's issuer sentence, `MainWindowViewModel.Issuer` off `MeResponse.Issuer`, cached the same turn the name and email are and surfaced here for the first time — "Signing in proves who you are — it never decrypts a vault." |
+> | Security: the strict-host-key toggle, the allowed-algorithms chips, the auto-lock link row | Refused — the app always asks on a changed key, there is no algorithm allow-list anywhere in the SSH stack, and there is no auto-lock setting for the link to point at. |
+> | Security: RECENT SECURITY EVENTS as a list of rows | Shipped as the link alone, "See all activity in Logs." A real list would mean a filtered read over `LogsViewModel`'s two logs, and which entries count as "security" is a judgement call the design does not resolve; the honest link is complete on its own. |
+> | Preferences: the device-name editor, Font/Cursor/Scrollback/Copy on select/Terminal bell, the clipboard-clear delay, confirm-run-on-insert | All refused, on the page's own carried-over NOT-BUILT idiom — none of the seven has anything behind it. Windows Hello's register/"Stop unlocking here" pair moved off this page to Security instead, one home rather than two. |
+> | Groups: drag-to-reorder, and the mock's "the order here is the order there" sentence | Refused. `HostGroupRowViewModel` orders by the vault new items go into, then by vault name, then by label — there is no manual order to drag into. The page prints the true sentence instead and draws no drag handles. |
+> | Tags: the LAST APPLIED column | Refused — no timestamp of when a tag was last put on a host exists anywhere in this client. |
+> | Tags: a per-tag vault chip | Refused — `TagRowViewModel` carries a label and a host count and nothing else; there is no vault id on the row for a chip to read. |
+> | Import: the "saving to ⟨vault⟩ ▾" picker | Refused as a control. Every import writes through the same `session.ActiveVaultId` every other bulk write does, so there is no per-import target to choose — the footer prints the vault's name as a fact, `ImportViewModel.SelectionSummary`, rather than as a `▾`. |
+> | Import: the old ADDRESS/AUTHENTICATION/STATE columns | Folded into the design's own column set — ALIAS/HOSTNAME/USER/PORT — with the authentication text moved onto the alias cell's own tooltip rather than kept as a column of its own. |
+> | Import: TICK ALL / TICK NONE | Replaced by the design's own header tick-all button, one press that ticks or unticks every row through `ImportRowViewModel.ToggleAllCommand`. |
+> | Import as a nav-rail destination | Refused. It is a boolean overlay over the Preferences settings page (`MainWindowViewModel.IsImportOpen`), not a page of its own — `SettingsNav` stays lit on Preferences throughout, exactly as `Import.dc.html` draws it. |
+> | The design's fixed 1100px content column | `MaxWidth="1100"` rather than a fixed width — the column is 741 pixels beside the 340px rail at the window's own minimum, where a fixed 1100 would not fit. |
+> | The status bar and the update banner, while in settings mode | Both hidden — `MainWindow.axaml`'s bottom two rows read `!IsSettingsMode`. The design's own settings titlebar has no room for either, and there is nowhere honest to draw them instead. |
+> | The design's sentence-case button copy | Not adopted. Every button on every settings page keeps this application's own ALL-CAPS mono convention — `CHECK NOW`, `SIGN OUT`, `OPEN IMPORTER` — over the mock's own "Check now". |
+> | The design's assumption that Settings is the only thing on screen | Not followed. The quick-connect palette and an unapproved host key's decision card both still draw over settings mode exactly as they interrupt every other screen — a connection question does not stop mattering because the window happens to be showing Settings; see `MainWindow.axaml`'s own remark on the ordering of its Panel. |
+> | The importer's own sentence, "This is the only control in DodoSSH that opens key material from a directory you did not point at file by file — nothing is read until Import is pressed." | Adopted verbatim — verified against `ImportViewModel.ScanAsync` and `ImportAsync`: scanning never calls `SshConfigLocator.ReadIdentity`, and `ImportAsync` is the only path that ever does. |
+> | The tags page's own sentence, "Renaming here is one write and every host follows." | Adopted verbatim — verified against `SaveTagAsync`: a host names a tag by id, never by label, so a rename touches nothing but the tag item itself. |
+> | The known-hosts screen's own intro, "Every pin is a decision recorded at the moment of connecting. Fingerprints are never trimmed — compare them character by character against what the operator published." | Adopted verbatim, matching the stance the rest of this application already takes on a pin. |
 
 Most of it landed. This file is the rest: every element of that design with nothing behind it, which
 project each piece would have to land in, and **what the shipped interface does instead**. That last
@@ -468,7 +537,7 @@ caption buttons and window title drawn on top of the application's own — two s
 | `SNIPPETS` panel, `↵` to run | client-domain | A snippet item type (`Snippet = 8`, reserved). | **Shipped**, as a screen rather than a panel. `↵` is per snippet and off by default: inserting types the command at the prompt and stops, because nothing here can tell whether the terminal is at a prompt at all. |
 | Broadcast to all panes (`⌥↵`) | client-ssh | Input is routed strictly by session id in `TerminalDataPlane.Dispatch`; there is no fan-out. Needs splits first. | Omitted. |
 | Pane header `24ms` | client-ssh | Round-trip measurement. SSH.NET offers no RTT API. | Omitted. |
-| Pane header `aes256-gcm` | client-ssh | **The closest miss on this list.** `SshNetConnection` holds the `SshClient`, so `ConnectionInfo.CurrentServerEncryption` is right there — it just is not on `ISshConnection` or surfaced by `TerminalWorkspace`. | Omitted; the session shell's own host header shows the account and endpoint actually dialled (v3–v4: the tab strip did; v5b moved the fact to `SessionHeader`, off `MainWindowViewModel.SessionAddress`, when the strip was retired). |
+| Pane header `aes256-gcm` | client-ssh | **No longer a miss — the plumbing this row used to lack now exists.** `ISshConnection.Cipher` and `TerminalWorkspace.GetSessionFacts` were built for the v5b session shell's status bar; see that row in the v5b section, above. | Still not on a pane header — this pre-v5b element does not exist as its own piece of chrome any more. The fact it wanted to show is drawn instead where v5b moved it: the status bar's `SessionCipher`, beside CONNECTED. The session shell's host header separately shows the account and endpoint actually dialled (v3–v4: the tab strip did; v5b moved that fact to `SessionHeader`, off `MainWindowViewModel.SessionAddress`, when the strip was retired). |
 | Pane header showing the running command and `following` | client-ssh | The host moves opaque bytes and never parses terminal output. Would need shell integration (OSC 133) on the remote. | Omitted. |
 | A `local · zsh` tab | client-ssh | Every session here is an SSH channel. Needs ConPTY and a second session kind. | Omitted. |
 | Tab strip `+` button | ui | Not missing so much as redundant: the real operation is *select a host, press Connect*, which the hosts grid already is. | **Shipped**, as the palette rather than a menu: it opens what Ctrl+K opens, so the strip and the shortcut are one way of doing one thing. A `MenuFlyout` offering "SSH" and "local shell" is the nicer answer and is not verifiably safe above the terminal's native child window — and there is no local shell to offer. |

docs/manual-checks.md

@@ -17,7 +17,7 @@ Three constraints put things on this list, and they are worth knowing before add
 Each item says what to do, what a pass looks like, and what a failure would mean.
 
 **On the numbering.** A check keeps its number for life, because code comments and other documents cite them
-— `HostGridTests` sends a reader to 7.6, `platform-flags.md` to 3.6–3.8. A check inserted later therefore
+— `platform-flags.md` sends a reader to 3.6–3.8, ADR 0013 to 16.4. A check inserted later therefore
 takes a letter rather than pushing its neighbours along: 3.2a and 3.2b sit between 3.2 and 3.3 and always
 will. Add in the same way, and keep each one next to the check it belongs beside; a gap in the numbers means
 a phase had nothing left for a person to do, which is the good outcome rather than an omission.
@@ -115,6 +115,61 @@ vault that authenticates with a key filed in the switched-off one still connects
 `VaultViewModel.IsVaultShown` for the list, and `VaultVisibilityTests` for the same assertions made against
 view models — this check is the version with a real connection on the end of it.
 
+### 1.8 Entering and leaving settings mode
+
+From HOSTS, press the user chip at the foot of the nav rail and choose **Settings**. Then repeat from a
+fresh open, choosing **Vaults**, and again choosing **Preferences**.
+
+**Pass:** each of the three swaps the whole window's chrome — the titlebar becomes the 53px "Back to
+application" bar, the ordinary nav rail is replaced by the 340px SettingsNav, and the status bar and the
+update banner (if either was showing) are both gone. **Settings** lands on General; **Vaults** and
+**Preferences** land on their own pages, each lit in SettingsNav's own list — General/Vaults/Account under
+SETTINGS, Security/Preferences/Groups/Tags under CUSTOMIZE, Logout pinned below both. Click every one of the
+seven rows in turn: each swaps the content column without leaving settings mode or touching the titlebar.
+
+Now open a terminal, leave it showing, and open Settings from the user chip again. Press **Back to
+application** — or, without touching anything else, press Esc.
+
+**Pass:** both return to exactly the screen that was showing before Settings was opened — the terminal,
+still running, rather than HOSTS or anywhere else. Switching between settings pages first (General → Vaults
+→ Preferences) does not change what "back" goes back to; only the screen open the moment Settings was
+**first** entered does.
+
+**Failure means:** a return to HOSTS regardless of where Settings was opened from is
+`MainWindowViewModel.settingsReturnScreen` being recaptured on every `EnterSettings` call rather than only on
+the way in from outside settings mode — see that field's own remark. A status bar or update banner still
+visible in settings mode is `MainWindow.axaml`'s two bottom rows no longer reading `!IsSettingsMode`. Esc
+doing nothing is `MainWindow.axaml.cs`'s `OnKeyDown` no longer checking `IsSettingsMode` after the palette's
+own branch.
+
+### 1.9 The importer's own home, and what still reaches through settings mode
+
+From Settings → Preferences, press **OPEN IMPORTER**.
+
+**Pass:** the titlebar's back button relabels itself "Back to preferences" — not "Back to application" — and
+SettingsNav stays lit on **Preferences** the whole time; the importer is drawn over the Preferences page
+rather than being a destination of its own. Press SCAN AGAIN and let it read your `~/.ssh/config`.
+
+Press **Back to preferences** (or Esc). **Pass:** the Preferences page is back, still inside settings mode,
+and the titlebar's label reverts. Press Esc a second time (or **Back to application**): now settings mode
+itself closes, back to whatever screen was open before Settings was entered — the same two-deep
+"closest thing first" order the titlebar's own two buttons and `MainWindowViewModel.OpenImport`/`CloseImport`
+follow.
+
+**Then, with the importer open, press Ctrl+K** and connect to a host from the palette.
+
+**Pass:** it works exactly as it does anywhere else in the application — the palette opens over the
+importer, and connecting leaves settings mode outright for the new terminal, the same way choosing any
+ordinary nav rail destination does through `MainWindowViewModel.ShowScreen`. An unapproved host's key card
+comes up over settings mode the same way it would over any other screen.
+
+**Failure means:** a back button that never changes label is `SettingsTitleBar.axaml`'s two buttons both
+bound to the same side of `IsImportOpen`. SettingsNav lighting a different row while the importer is up is
+`MainWindowViewModel.IsSettingsPreferencesPage` reading `IsImportOpen` when it must not —
+`Import.dc.html` draws the rail unmoved on purpose; see the remark on `IsImportOpen`. Ctrl+K doing nothing
+over the importer would be a guard added to `OnKeyDown` for `IsSettingsMode` that the design never asked for
+and this application's own quick-connect card was built to reach past.
+
 ---
 
 ## Phase 2 — Known Hosts as its own page
@@ -200,7 +255,7 @@ The parser has 22 cases over the shapes a real file contains, and the end-to-end
 
 ### 2.7 Scan your own `~/.ssh/config` and read the preview against the file
 
-Preferences → IMPORT HOSTS → SCAN. Do not press import yet.
+Settings → Preferences → OPEN IMPORTER, then SCAN AGAIN. Do not press Import N hosts yet.
 
 **Pass:** every entry you would expect is listed, with the address and port you expect, and the warnings
 above the table account for anything missing.
@@ -364,61 +419,81 @@ card, nothing saying the hosts are unfiled.
 **Failure means:** the "invisible until used" property is gone, and every existing user gets a section they
 did not ask for. `HasGroups` is what hides the row of group cards; `HostRowViewModel.HasGroup` hides the chip.
 
-### 3.2 Filing hosts, and the grid being one level at a time
+### 3.2 Filing hosts, and the board drawing every group at once
 
-Make two groups and file some hosts into each through the host editor, leaving at least one host unfiled.
+Make two groups — the Group ▾ flyout's "New group…" — and file some hosts into each, once through a host's
+own editor and its GROUP picker, and once by ticking several hosts and choosing **Change group…** from the
+right-click menu. Leave at least one host unfiled.
 
-**Pass:** the filed hosts **leave the grid** as they are filed — a group is a place, not a label, and the
-grid holds one level of it the way a directory pane holds one directory. What is left is the unfiled hosts.
-**There is no heading and no fold on the desktop** — the headings, their chevrons and UNGROUPED are the
-phone's, whose list has no room for a row of group cards and draws the whole tree flat instead. With every
-host filed, the grid says so in a sentence rather than sitting empty.
+**Pass:** every group is a heading on the board **at once** — in label order, "No group" first where it is
+occupied — with its own hosts underneath. There is no double-click, no card to open a group into and no
+breadcrumb trail: v3's one-level-at-a-time grid is gone outright, and every section is on screen from the
+moment the board is. A host filed under `production` is drawn once, under that heading, and nowhere else on
+the board.
 
-**Then press a group card once.** It is marked as chosen and **nothing else happens** — the grid is still the
-level it was, and no buttons appear beside the GROUPS heading: editing and deleting a group are on the card's
-own right-click menu, which is 7.9. **Then double-press it.** The group opens: its hosts
-are the grid, the trail above the cards reads `ALL HOSTS › <name> ›`, each card carrying the group's name as
-an accent chip, and the card grid shows what is *inside* that group rather than every group in the keychain.
-Pressing ALL HOSTS goes back to the outermost level.
+**Then press the chevron beside one heading.** It folds — the heading stays, with its live count, and its
+cards go — and pressing it again brings the cards back. **Then press "Collapse all"**, drawn on the first
+heading only. It folds every section at once and its own label swaps to "Expand all"; opening any one heading
+by hand swaps the label back to "Collapse all".
 
-**Then type a filed host's name into the find box at the top.** It is found from the outermost level,
-wherever it was filed and however deep, with the chip on its card saying which group it came out of. Clearing
-the box puts it away again. Inside a group the same box reaches that group and everything under it, and the
-empty-grid sentence there offers ALL HOSTS as the way to widen it.
+**Then type a filed host's name into the find box at the top, with its heading folded.** **Pass:** the
+heading's own count narrows to match — the count is read off the set the find box has already narrowed,
+before the fold is looked at — but the cards themselves stay hidden until that heading is reopened; open it
+and the narrowed set is there. Clear the box and every count returns.
 
-**Failure means:** if one press still narrows the grid, the card `ListBox` is bound to the wrong property —
-`SelectedItem` is `SelectedGroup`, and only `OpenGroupCommand` writes `GroupFilter`. Filed hosts still on the
-outermost level is `Matches` no longer comparing the host's group to the open one. A search that cannot find
-a filed host is worse than either: it is the box answering "no host matches that" about a machine the
-keychain has got. A full-width bar with a chevron between the cards is the old grouping coming back through
-`SidebarRows`; the desktop grid binds `VisibleHosts`. See `HostsScreen.axaml`.
+**Failure means:** a host drawn under a heading that is not its own, or under two at once, is
+`VaultViewModel.AddFlatSection`'s membership test reading the wrong field for that section —
+`host.Host.GroupId == group.EntityId` for a named heading, everything else for "No group". A chevron that
+folds every section rather than the one it sits beside is `ToggleGroupCommand` being handed the board rather
+than the single `SidebarGroupHeader` it was pressed on. A count that does not move with the find box is
+`MatchesHostBoardFilters` not running before `HostSections` is rebuilt — see
+`VaultViewModel.RebuildHostSections` and `OnHostFilterChanged`.
 
-### 3.2a A group inside a group, and the way back out
+### 3.2a A group nested under another, and what a host filed under it inherits
 
-Make two groups and file one under the other with the parent picker in the group editor.
+Make an outer group with a default port and no default username, then make a second group whose editor's
+PARENT picker points at the outer one, and give this inner group no default port of its own. File a host
+under the inner group with nothing set on the host itself.
 
-**Pass:** only the outer group has a card to start with. Double-press it and the inner one is the only card
-shown, with the trail reading `ALL HOSTS › <outer> ›`. Double-press that, and the cards disappear entirely —
-it has nothing inside it — while the trail stays. Pressing the **middle** crumb goes back one level rather
-than all the way out, which is also how a group with nothing inside it is renamed: back out to the level
-where it has a card, and right-click that.
+**Pass:** both groups are their own headings on the board, side by side — nesting is never drawn on the board
+itself, only carried in the group editor's own PARENT field. The inner heading's count is only the hosts
+filed directly under it, and the outer's is only the hosts filed directly under the outer one; the host filed
+under the inner group is not counted on the outer heading. Connect the host anyway: it dials the **outer**
+group's port. `HostInheritance.Chain` walks past the inner group's own silence on that field rather than
+stopping at the nearest group regardless of whether it answered. Give the inner group its own default port
+and reconnect: the host now dials that one instead, because the nearer group's answer wins once there is one.
 
-**Failure means:** cards for groups that are not at this level is `VisibleGroups` having been bound past —
-the flat `Groups` is the phone's and the lookups'. A group that cannot be reached at all is worse and is the
-case `EffectiveParents` promotes: see 3.4a.
+**Then open the inner group's own editor and look at its PARENT picker.** The outer group is offered. **Then
+open the outer group's own editor and look at its PARENT picker.** The inner group is **not** offered — a
+group found by walking down from the outer one is refused as its own parent, which is what keeps this one
+machine, acting alone, from building a cycle. (Two machines can still build one offline between them; that is
+3.4a, below.)
 
-### 3.2b Making something while standing inside a group
+**Failure means:** a host that dials 22 with the outer group's port set is the chain stopping at the first
+group above the host rather than reading each field independently from the nearest group that states it — see
+`HostInheritance.Resolve`'s own remarks. A parent picker offering a group's own descendant is
+`VaultViewModel.BuildGroupParentChoices` walking the wrong direction: each candidate has to be walked
+*upward*, through `HostInheritance.Chain`, to see whether it passes through the group being edited — a
+downward index of children is what the alternative would need, and this view model keeps none.
 
-Open a group, then press **+ NEW HOST**, and afterwards **+ NEW GROUP**.
+### 3.2b Making a host or a group inherits nothing from where the board is scrolled
 
-**Pass:** the host editor opens with that group already chosen in its group picker, and the saved host is on
-the screen it was made on rather than somewhere the trail is not. The group editor likewise opens with that
-group as its parent, so the new group is a card inside the one that is open.
+Scroll the board so one group's section fills the window, or fold every other section away, then press
+**+ New host**. Afterwards, open the Group ▾ flyout and press **New group…**.
 
-**Failure means:** anything created inside a group disappearing the moment it is saved. That is the papercut
-a level-at-a-time grid comes with, and `NewHost` / `NewGroup` are where it is answered. Note the deliberate
-difference between them: the host editor also takes a merely *selected* card as its group, the group editor
-takes only the group that is open.
+**Pass:** the host editor opens with its GROUP picker on **"No group"**, and the group editor opens with its
+PARENT on **"No group"** too — neither reads anything from which heading happens to be on screen or scrolled
+to. This is deliberate: the level-at-a-time grid these two commands used to inherit an "open group" from is
+gone, and nothing on the flat board replaced that context. Pick a group by hand in either picker and it
+stays picked — the host or the new group lands there once saved.
+
+**Failure means:** an editor that opens already filed under whichever section happened to be on screen is
+`VaultViewModel.GroupTarget` — the fallback both `NewHost` and `NewGroup` still read — having been wired to a
+live selection again. Read that property's own remarks before treating this as a regression: it is an alias
+for the single-select `GroupFilter`, which nothing in the current toolbar ever assigns any more — the Group ▾
+flyout ticks a set, `checkedGroupFilterIds`, a different field entirely — so today the fallback is dead code
+rather than a path either `+` button takes. Restoring it as live board context would make both commands
+context-sensitive in a way nothing on this board signals before the fact.
 
 ### 3.3 Deleting a group with hosts in it
 
@@ -855,52 +930,66 @@ Start 7.1's slow connection and press GIVE UP (or the tab's cross) while it is s
 opened — it is a real shell, and one running with nothing naming it would be worse than one that comes
 back.
 
-### 7.6 Dragging a host onto a group card · **least covered, like all drag and drop**
+### 7.6 Filing a ticked host through "Change group…" · **the drag's replacement**
 
-Make two groups and file a host into one. Drag a host card up onto the other group's card.
+The gesture this number used to describe — a host card dragged onto a group card — went with the group cards
+themselves in v5's flat-sections rework: every group is a heading now, there is nothing on the board to drop
+onto, and no gesture replaced the drag. Filing from the board is the chosen-hosts menu's **Change group…**,
+the phone's route become both heads' — see `VaultViewModel.ConfirmRegroupChosenHostsAsync`'s own remarks.
+(A single host can also still be filed through its own editor's GROUP picker; 3.2 walks that route.)
 
-**Pass:** the group card under the pointer takes a two-pixel accent border while the pointer is over it, the
-cursor shows a move rather than a refusal, and the drop files the host — **the card leaves the grid**, going
-inside the group it was dropped on, the host counts under both group cards change, and the status line says
-where it went. That sentence is the only thing left saying so, which is why it is worth reading: the card
-itself is on the level below now, and nothing is selected once it has gone.
+Make two groups and file a host into one. Ctrl-click that host so it takes its ✓, right-click it, and choose
+**Change group…**.
 
-**Also check three refusals**, each of which must show the "no" cursor and mark nothing: over the card of the
-group the host is *already* in — type its name into the find box first, which is what brings a filed card
-back to this level; over another **host** card, which is deliberately not a target now that there are no
-headings to say which group it would mean; and over the empty space around the cards.
+**Pass:** the entry is on the menu only while something is ticked — right-click an unticked card first and
+the menu is the ordinary four (Connect, Details…, Edit…, Delete…) with no filing entry among them. Choosing
+it opens the CHANGE GROUP panel **above the board, not over it** — the ticked card stays in view, "1 chosen"
+sits beside the panel's heading — and the ComboBox reads **"No group"**, not the group the host is already
+in; drop it down and every group in this keychain is listed after it.
 
-**The targets are the cards on screen, which are one level** — see 3.2a. Filing into a group nested under
-another means opening the outer one first, exactly as moving a file into a subfolder does.
+**Then pick the other group and press FILE.** **Pass:** the panel folds, the card is drawn under the other
+heading and the headings' counts follow, the tick is off, and the status line says where it went — `Filed 1
+host(s) under …`.
 
-**And getting a host back out** is the host's own editor — pick "No group" in its picker. There is no
-UNGROUPED target on the desktop any more, because there is no UNGROUPED heading for it to be.
+**Then take it back out:** tick it again, open **Change group…**, and press FILE with the ComboBox untouched.
+**Pass:** the host is unfiled, back under the "No group" heading. The picker opening on "No group" is a
+decision rather than an oversight — unfiling a run of machines is exactly as common as filing them, and the
+box says what FILE will do before it is pressed — but it is also why the box has to be *read*: FILE never
+means "keep things as they are". CANCEL, tried once, folds the panel and keeps the ticks.
 
-**And a drag held near the top or bottom edge of the grid scrolls it**, which is what makes this usable at
-all with forty machines: the group cards are the first thing in the scroller, and a drag cannot use the
-wheel. The pointer has to keep moving inside the band — a stationary pointer gets no drag events.
+**Failure means:** the write and its guards are all covered headlessly — the filing by
+`ShellFlowTests.ChangingTheGroupOfTheChosenHosts_FilesThemAllAtOnce`, the refusal under an open editor by
+`RegroupingTheChosenHosts_IsRefusedWhileTheEditorIsOpen`, the panels' one-at-a-time rule by
+`TheActionBarsPanels_TakeEachOthersPlaceRatherThanStacking`, and the panel's fit by
+`ScreenLayoutTests.TheHostsScreenFitsWithTheChosenHostsGroupPanelOpen`. What none of them can see is a real
+popup: the menu entry and the ComboBox's dropdown both live in popups, reaching the vault through the same
+`#Board` indirection 7.9 explains. A menu missing the entry, or a FILE that files nothing, is that wiring —
+7.9's class of failure, on the one entry that opens a panel rather than acting at once.
 
-**Failure means:** headless Avalonia cannot synthesise a platform drag, so the picking up, the cursor and
-the drop are covered by nothing. What *is* automated is the decision each drag event takes —
-`HostGridTests.TheGroupCardsAreWhatAcceptsADroppedHost` raises a real `DragOver` over both kinds of card —
-and the write at the end, `ShellFlowTests.MovingAHostToAGroup_FilesItAndTakesItOffTheLevelItCameFrom`.
+### 7.6a Filing a whole set at once, and the one refusal · **the refusal needs a second vault**
 
-### 7.6a Dragging a whole set onto a group card · **also uncovered, and the same reason**
+Tick three hosts (7.7a is how), right-click one of the three, choose **Change group…**, pick a group, and
+press FILE.
 
-Tick three hosts (7.7a is how), then pick one of the three up and drag it onto a group card.
+**Pass:** the same panel, its heading now saying "3 chosen", and the write moves **all three** — every card
+under the picked heading, the status line counting them, and the ticks gone once it is done. A host that was
+never ticked stays exactly where it was.
 
-**Pass:** the card marks itself exactly as it does for one host, and the drop files **all three** — the
-status line says how many, and all three leave the level. Ticking nothing and dragging a single card still
-files that one card, which is what this gesture has always done.
+**Then, with a second vault:** tick one host from each keychain and choose **Change group…** again.
 
-**And a card that is not in the set** drags alone: press one of the unticked cards and the ticks come off
-before the drag starts, so what lands is the one machine that was under the pointer.
+**Pass:** no panel opens, and the status line says the hosts are in more than one keychain and a group
+belongs to one. The refusal is whole and it is early — raised when the picker is asked for, over the whole
+set, rather than after a group was picked from a list that could only ever have been one keychain's. Filing
+across that line would leave everyone else in the shared vault seeing a machine filed under nothing.
 
-**Failure means:** a drag that filed one of three is the payload having been built from the card rather than
-from the set — the thing this gesture must never do quietly, since the other two stay behind looking filed.
-The write is `ShellFlowTests.DroppingTheChosenHostsOnAGroupCard_FilesEveryOneOfThem` and the drag event's
-answer is `HostGridTests.AGroupCardTakesAWholeSetOfDraggedHosts`; the platform's half of it is covered by
-nothing, as 7.6 explains.
+**Failure means:** the set's write is `ChangingTheGroupOfTheChosenHosts_FilesThemAllAtOnce` again — one
+command reads the whole set, so "filed one of three" has no half-gesture to hide in the way the old drag's
+payload did. The refusal is covered headlessly too:
+`RegroupingHostsChosenAcrossTwoKeychains_IsRefusedBeforeThePickerOpens` ticks a host in each of two
+keychains and asserts no picker opens and the sentence is on the status line. What is left for the eye is
+7.9's wiring, as in 7.6 — and a panel that does open over a mixed set is the worse half: it would offer one
+keychain's groups for another keychain's machines, which is the half-filed set the refusal exists to
+prevent.
 
 ### 7.7 A click still selects, and a double click still connects
 
@@ -1012,7 +1101,7 @@ time)" — is the worse failure of the two: it rebinds a host as a side effect o
 
 ## Phase 8 — Adding and removing on the phone's host list
 
-Thirteen checks, and the reason there are thirteen rather than none is worth stating: **the layout suite
+Twenty-one checks, and the reason there are twenty-one rather than none is worth stating: **the layout suite
 cannot see any of this and structurally never will.** `DodoSSH.Client.App.Layout.Tests` targets `net10.0` and
 `DodoSSH.Client.Android` targets `net10.0-android`, so a project reference is impossible; Avalonia's
 application, dispatcher and platform are one-shot process globals, so a second head cannot share the
@@ -1329,6 +1418,60 @@ destinations, so switching under a live one would show a screen titled S3 listin
 the row — that screen keeps its own copy of the host list, so it has to be re-found there by entity id
 rather than handed the vault's object.
 
+### 8.18 QUICK ACCESS in the phone's host editor
+
+Open a host's editor and scroll to QUICK ACCESS.
+
+**Pass:** an empty list, an add field and an ADD button. Type `/var/www/app` and press ADD.
+
+**Pass:** a row appears carrying that path and a ✕ at least 44dp on a side. Type the same path again and
+press ADD.
+
+**Pass:** nothing is added, and a sentence appears on the page saying the path is already pinned — this page
+covers the whole screen while it is open, so that sentence is this page's own `Status` line rather than the
+one the host list draws above HOSTS, which is off-screen right now. Clear the box and press ADD with nothing
+typed.
+
+**Pass:** a sentence saying a pinned path cannot be blank, in the same place.
+
+Press the ✕ on the pinned row, then SAVE.
+
+**Pass:** back on HOSTS with the pin gone. Open the editor on that host again.
+
+**Pass:** QUICK ACCESS is empty — the removal was saved, not merely staged. Re-pin `/var/www/app`, SAVE, and
+check the same host on the desktop.
+
+**Pass:** the pin is there. `HostSecret.PinnedPaths` is shared and merged like every other field on a host,
+so nothing about this page keeps its own copy.
+
+**Failure means:** a refusal that changes nothing on screen is `AddEditorPinCommand` writing to `Status`
+with nothing on this page bound to it — the honesty rule broken silently, since the command still behaves
+correctly and only the telling of it is missing. A pin gone after SAVE-then-reopen but present on the
+desktop is `BuildHost` not reading `EditorPinnedPaths`, or `EditSelectedHost` not loading it back in.
+
+### 8.19 Pin chips on the Files screen
+
+Pin a folder on a host, then connect to it on the files screen (SFTP), either directly or via **Connect via
+SFTP**.
+
+**Pass:** once connected, a row of chips appears between the breadcrumb and the listing, one per pin, each
+at least 44dp tall. Tap one.
+
+**Pass:** the listing navigates straight to that directory, the same as tapping a breadcrumb crumb does.
+Disconnect, then connect to a host with nothing pinned.
+
+**Pass:** no chip row at all — not an empty one. Connect to a bucket instead.
+
+**Pass:** still no chip row, on any bucket. A bucket has no `HostSecret` underneath it and so nothing to
+pin.
+
+**Failure means:** chips that do not move the listing are the row's `GoRemoteCommand` binding pointed at the
+wrong `DataContext` — see the `$parent[views:FilesScreen]` escape every other command in this file uses. A
+chip row surviving a disconnect, or appearing under a bucket, is `TransfersViewModel.ConnectedPinnedPaths`
+not being cleared in `CloseSessionAsync` or `OpenBucketAsync`. A chip row missing a pin added *after* this
+connect is not a bug — see `ConnectedPinnedPaths`'s own remark on why this is a snapshot rather than a live
+follow, and try disconnecting and reconnecting instead.
+
 ---
 
 ## Phase 9 — Tag chips and the picker
@@ -1602,6 +1745,57 @@ is a terminal that answers the buttons and ignores the keyboard: it reads as the
 Worth doing on the software keyboard too, where the same fault shows as the keyboard closing on the first
 tap of an arrow key.
 
+### 11.10a The accessory keys do not cost the terminal its *software* keyboard either
+
+With a shell open and the software keyboard up, tap **esc**, **tab** or an arrow on the accessory row, then
+keep typing on the software keyboard.
+
+**Pass:** the keyboard settles back unchanged — same layout, same suggestion strip, same height — and
+everything typed after the tap still reaches the terminal. The accessory row stays visible above the
+keyboard throughout. A blink during the press itself is tolerable: the platform takes the focus on both
+halves of every touch and the return is posted right behind each theft, so the connection can visibly flap
+for the press's own duration — what it must never do is *stay* swapped after the finger lifts.
+
+**Failure means:** Android's own view focus stayed on Avalonia's input view after the tap instead of being
+handed back. This is the half `Focusable = false` cannot reach — the platform requests focus for its own
+view after dispatching every handled touch — and the symptom chain is the keyboard swapping to its no-input
+layout and the inset churn parking it over the very row that was tapped. The first fix for this failed by
+timing alone: it handed focus back from inside the very dispatch the platform re-steals it after. See
+`TerminalFocus` in the Android head's Platform folder for both the mechanism and the fix's shape.
+
+### 11.11 Closing a connection and opening a new one both take you somewhere real
+
+Open a shell, close its tab, then open a different one from HOSTS.
+
+**Pass:** the new terminal renders and takes input straight away — no stuck "Connecting…" status, no blank
+pane that never receives the prompt.
+
+**Failure means:** `TerminalDataPlane` refused the page's reattach. The renderer's `WebSocket` does not
+survive a tab going from one to zero and back to one on every device, and a host that answers a second valid
+upgrade with `409 Conflict` instead of taking the socket over leaves every terminal after the first
+permanently unreachable — see the correction in `docs/android-port.md`'s terminal section.
+
+### 11.12 A backgrounded shell survives its renderer being killed · **needs several minutes, or developer tooling**
+
+With a shell open and something worth reading in its scrollback, background the app (home button, not back)
+for several minutes — long enough for Android to consider reclaiming it — then return. If the device exposes
+it, forcing a stop of the WebView renderer process from Developer Options while backgrounded is the more
+reliable way to trigger the same thing on demand rather than waiting on the OS's own judgement. Either way,
+type something once you are back.
+
+**Pass:** one of two honest outcomes, both good. Either the pane is exactly as it was — the renderer process
+survived, so nothing needed to happen — or the pane is empty but for a dim line reading `── the view
+reconnected; earlier output stayed on the host ──`, meaning the page reloaded and reattached. In both cases
+what is typed now reaches the shell, and the shell is still the same one — not a new tab, not a reconnect
+sheet, no "Connecting…" status stuck on screen.
+
+**Failure means:** if the status stays stuck or nothing typed arrives, the renderer's socket did not retry
+itself — see `terminal.js`'s `connect()` and its backoff. If the pane came back empty with **no** banner, a
+session that survived a reload is being shown as though its scrollback had too, which is not true and is
+worse than saying nothing: the banner exists so this is never silently wrong. If typing does nothing but the
+banner is there, the session's credit window was not reset on reattach and the shell is frozen behind it —
+see `TerminalWorkspace.ReplayAfterAttachAsync`.
+
 ---
 
 ## Phase 12 — Shared vaults: the operations that span two accounts
@@ -1618,7 +1812,7 @@ newcomer **must not have signed in to this deployment before** — 12.1 is about
 
 ### 12.1 An address with no account is refused, and joins nothing when it later signs in · **the one worth the most care**
 
-1. Sign in as `alice`, make a vault on the VAULTS screen, and select it.
+1. Sign in as `alice`, go to Settings → Vaults, make a vault there, and select it.
 2. Add `bob@example.com` as a Member, with Bob having never signed in here.
 3. **Pass:** it is refused. The status line names the address and says to ask them to sign in to this
    server once and then add them. **Nothing on the screen should suggest anything is pending** — no
@@ -1716,7 +1910,7 @@ vault is now flagged for rekey, the transfer is removing the outgoing owner rath
 
 Look for a way to remove a vault, on both heads.
 
-**Pass:** there is none, and the VAULTS screen says why in a sentence: nothing in this product removes a
+**Pass:** there is none, and Settings → Vaults says why in a sentence: nothing in this product removes a
 vault, and the server refuses to archive the membership list behind one while it exists. Archiving that
 list is still reachable over the API, and the endpoint suite drives both its refusal and its success — what
 is being checked here is that no button offers it.
@@ -1727,7 +1921,7 @@ button that always refuses is the milder failure and is still worth removing.
 
 ### 12.8 Renaming a vault reaches every place its name is drawn · **needs two accounts**
 
-Rename a shared vault from the VAULTS screen.
+Rename a shared vault from Settings → Vaults.
 
 **Pass:** the new name is on the vault list, on the badge of every host card in that vault, in the keychain
 screen's "new items file to" picker, in the host editor's vault picker, and in the nav rail's user-chip
@@ -1932,9 +2126,63 @@ Queue several files in each direction, put the phone to sleep with the screen of
 notification goes away when the last one does — with no shell open. With a shell open it stays, because that
 is what it was already for.
 
+Now, separately: open a shell to the host, press the home button (backgrounding rather than sleeping — the
+distinction matters, because backgrounded is the state in which Android is free to kill a process no
+foreground service is protecting), wait thirty seconds with the shell doing nothing, and return.
+
+**Pass:** the notification stayed up the whole time, and the shell is exactly where it was — same scrollback,
+same prompt — with typing reaching the host immediately. Exit the shell.
+
+**Pass:** the notification goes with it, once nothing else is open. Open another shell and close it from the
+shells strip's ✕ instead of exiting — the notification comes down for that route too, which is the route
+that used to leave it up: a deliberate close announced nothing to the keep-alive at all, and a shell exiting
+on its own was announced while the count still included it.
+
 **Failure means:** an upload that stalls with the screen off is the count not reaching
 `SessionForegroundService`, and Android has stopped the process mid-transfer. A notification left up
-afterwards is `ActivityChanged` not being subscribed — the other end of the same wire.
+afterwards is `ActivityChanged` not being subscribed — the other end of the same wire. A shell that has
+disconnected on return is `MainWindowViewModel.TerminalSessionOpened` never reaching `SessionKeepAlive` — the
+service only ever heard about a shell *ending*, so it never came up for one in the first place. A
+notification still saying "1 shell connected" after the shell is gone — by either route — is
+`TerminalWorkspace.SessionEnded` firing before the run completed, or a close not announcing; see
+`AnnounceEndedAsync` and the event's own remark.
+
+### 14.6a A Files connection with nothing moving still survives backgrounding
+
+Connect to a host on the Files screen with no transfer queued — just browse to somewhere and stop. Note the
+directory shown, then background the app, wait thirty seconds, and return.
+
+**Pass:** the notification stayed up the whole time (check the shade if the return is too quick to see it
+directly), and the pane is exactly where it was — the same listing, the same breadcrumb — with no reconnect
+needed.
+
+**Failure means:** `TransfersViewModel.HasLiveFileSession` not reaching `SessionKeepAlive`, so an idle but
+still-open SFTP connection read as nothing running at all and the process was free to die under it.
+
+### 14.6b The notification permission is asked for once, at the first thing worth showing · **needs Android 13+**
+
+On a device running Android 13 or later, on a fresh install that has never connected to anything, open a
+shell or the Files screen for the first time.
+
+**Pass:** a system dialogue asking to allow notifications appears at that moment — not at launch, and not
+before this first connect. Answer it either way; the connection completes regardless, and background the app
+afterwards to confirm nothing else changed about it.
+
+**Failure means:** the dialogue appearing at launch is asking before there is anything on screen to justify
+it. Never appearing at all on API 33+ is the harder failure to notice, because nothing else surfaces it —
+the service still starts and still holds the process open, only the receipt is invisible. See
+`SessionForegroundService.RequestNotificationPermission`.
+
+### 14.6c Refusing the permission costs the notification and nothing else
+
+Continuing from 14.6b: choose **Don't allow** on the system dialogue. Queue a transfer, or open a shell, and
+background the app.
+
+**Pass:** no notification appears anywhere, but the transfer still finishes, or the shell is still there on
+return, exactly as in 14.1–14.6a.
+
+**Failure means:** anything disconnecting or failing here is the permission refusal being read as though it
+had refused the service itself, rather than only the notification Android draws for it.
 
 ### 14.7 SAVE FILE writes where you pointed it, and the file opens
 
@@ -2149,10 +2397,11 @@ fifteen seconds comes from.
 
 ### 16.5 The version on screen is the version that was built
 
-Right-click `DodoSSH.exe` → Properties → Details, and open PREFERENCES → UPDATES.
+Right-click `DodoSSH.exe` → Properties → Details, and open Settings → General.
 
 **Pass:** File version reads the tag (`0.1.0.0`), product **DodoSSH**, company **DodoTech**, and the
-preferences screen prints the same number.
+General page's UPDATES card prints the same number — the block moved there from Preferences in v5c, and
+Preferences itself carries no version line any more.
 
 **Failure means:** `0.0.0.0` is MinVer never seeing a tag — a shallow clone, or `fetch-depth` having been
 dropped from a checkout. `1.0.0.0` is somebody having wired the app manifest's inert `assemblyIdentity`
@@ -2174,7 +2423,7 @@ script warns rather than failing when that is legitimate, which is the first rel
 ### 16.7 The update arrives, and the restart lands in it · **the whole point of the work**
 
 With v0.1.0 installed and running, a vault unlocked, a host change made, and **a terminal open**, publish
-v0.1.1 (`-Upload`). Then press CHECK NOW on PREFERENCES rather than waiting six hours.
+v0.1.1 (`-Upload`). Then press CHECK NOW on Settings → General rather than waiting six hours.
 
 **Pass:** the progress bar moves, the banner appears above the status bar, and — the part to actually watch
 — the terminal **reflows cleanly rather than being sliced**, with the remote seeing the smaller row count.
@@ -2228,7 +2477,7 @@ there is one install directory, the pack ids collide and the nightly has replace
 outright — which is the thing ADR 0013 decision 9 is constructed to make impossible, so it means one of the
 four separations has been undone.
 
-**And the direction that matters most:** on the release build, PREFERENCES → UPDATES → CHECK NOW must not
+**And the direction that matters most:** on the release build, Settings → General → CHECK NOW must not
 offer a nightly, ever, however many have been published since. It reads a different index and refuses
 prereleases; if a nightly version is ever offered there, stop and treat it as a release-channel incident
 rather than as a bug in the nightly.
@@ -2347,3 +2596,120 @@ package manager will not offer to.
 
 **Failure means:** the channels are not separate, and a public key is signing the application people keep
 their credentials in.
+
+## Phase 18 — Installing the macOS client, and being updated by it
+
+The macOS counterpart of phase 16, and it needs a Mac with a Secure Enclave — an Apple Silicon machine or
+an Intel one with a T2. Every check here is structurally unreachable by a test for the reasons phase 16
+gives, plus one this platform adds: **CI has no macOS runner at all**, so this phase is the only place the
+suite and the application ever run on macOS. Anything `docs/platform-flags.md` marks as unverified on macOS
+is verified here or nowhere.
+
+Run `bash scripts/release-macos.sh` first. It stops after packing and notarizing, on purpose, so that
+everything below happens before anything reaches a user. Phase 16.0 — the feed being readable without
+credentials — applies unchanged and is not repeated.
+
+### 18.1 Gatekeeper accepts it on a machine that did not build it · **do this one first**
+
+The Mac that signed a package trusts it locally whatever happened, so the build machine cannot answer this
+question about itself. Copy the `.pkg` to a second Mac — or at minimum download it through a browser, which
+is what applies the quarantine attribute — and open it.
+
+**Pass:** it installs with no warning beyond the ordinary installer prompts.
+
+**Failure means:** "cannot be opened because Apple cannot check it for malicious software" is notarization
+that did not happen or a ticket that did not staple. The script's `spctl --assess` and `xcrun stapler
+validate` should have caught it before this point, so reaching here means one of those two checks was
+removed or skipped. Do not distribute the package.
+
+### 18.2 The Dock shows the product and not the pack id
+
+Look at the installed application in `/Applications`, in the Dock, and in the menu bar while it runs.
+
+**Pass:** the menu bar says **DodoSSH**. Finder shows **DodoSSH**. The bundle on disk is
+`DodoSSH.Desktop.app` and that is expected — see the pack id note in `scripts/release-macos.sh`.
+
+**Failure means:** "DodoSSH.Desktop" in the menu bar is `CFBundleName` not reaching the bundle, which means
+the rendered `Info.plist` did not get used. Since vpk copies a custom plist verbatim and substitutes
+nothing, check the same bundle's `CFBundleShortVersionString` — if it reads `@VERSION@`, the template was
+passed through unrendered.
+
+### 18.3 The icon is the mark, at every size
+
+Look at it in the Dock, in Finder's icon view at a large size, and in `⌘I` Get Info.
+
+**Pass:** the accent tile and the `>_` mark, crisp at 1024, with the same air around it that Finder and
+Safari have.
+
+**Failure means:** a generic application icon is `CFBundleIconFile` naming a file that is not in
+`Contents/Resources`. An icon that fills its square edge to edge, larger than its neighbours, is
+`New-MarkPng` having been called with the Windows tile fraction — see `dodossh-icon.ps1`.
+
+### 18.4 Touch ID guards the device key, and the enclave enforces it
+
+Register a device key from the security settings page, then lock the vault and unlock it again.
+
+**Pass:** registering shows **no** prompt at all — sealing uses only the public half — and unlocking raises
+the system Touch ID sheet saying DodoSSH is trying to *unlock your DodoSSH vault*. The vault opens on a
+successful touch.
+
+**Failure means:** a prompt at registration is not a failure of correctness but says the key was not created
+in the enclave; check that `kSecAttrTokenID` reached the attributes. **No prompt at unlock, with the vault
+opening anyway, is the serious one** — it means the key is a software key and the access control did nothing,
+which is precisely the "a gate inside the process is not a gate" mistake `WindowsDeviceKeyStore` documents.
+
+### 18.5 Declining the fingerprint falls back to the passphrase
+
+Repeat 18.4 and cancel the Touch ID sheet.
+
+**Pass:** the unlock screen asks for the passphrase, and it works.
+
+**Failure means:** an error dialog, or a stuck screen, is `TryLoadAsync` throwing rather than answering
+null. Every failure it can meet — cancelled, timed out, key invalidated by a password reset — is meant to
+be indistinguishable and to land on the passphrase.
+
+### 18.6 A development build offers no device key at all
+
+Run the application with `dotnet run` rather than from the installed bundle, and open the security settings
+page.
+
+**Pass:** registering a device key is not offered.
+
+**Failure means:** being offered it is `IsSupported` having inferred availability from the OS rather than
+probing. An unsigned build cannot create an enclave key, so accepting the offer would put a wrap on the
+server that nothing can ever open and list a capability this machine does not have.
+
+### 18.7 The terminal works, which is the WKWebView question
+
+Connect to a host and use the shell: type, run something that scrolls, resize the window.
+
+**Pass:** the terminal attaches within a second or two and behaves as it does on Windows.
+
+**Failure means:** a blank pane that reports a renderer timeout after fifteen seconds is the loopback
+WebSocket not reaching WKWebView. This is the check that most needs walking, because the data plane has
+never run against this backend — see `TerminalDataPlane`. If it fails, the App Sandbox is the first thing to
+rule out: the entitlements deliberately do not enable it, and a sandboxed process cannot listen on loopback
+without `com.apple.security.network.server`.
+
+### 18.8 An update is offered, downloaded and applied
+
+With the release installed, cut a second release with a higher version and publish it, then leave the first
+running.
+
+**Pass:** the banner appears, downloads, and on applying the application closes and reopens on the new
+version. The vault's contents and the known hosts survive.
+
+**Failure means:** an update that never arrives is usually the channel — `osx` here and `osx` in
+`VelopackUpdateChannel.MacReleaseChannel`, with no error anywhere when they disagree. An update that
+downloads and fails to apply, leaving the application unable to restart, is library validation: check that
+`com.apple.security.cs.disable-library-validation` survived into the entitlements.
+
+### 18.9 Uninstalling does not take the vault with it
+
+Register a device, sync something, then remove the application.
+
+**Pass:** `~/Library/Application Support/DodoSSH` still holds the cache and the outbox afterwards.
+
+**Failure means:** an empty directory is the pack id having been changed to `DodoSSH`, which puts Velopack's
+install root on top of `ClientPaths.DataDirectory` and makes an uninstall delete a user's un-synced work.
+This is the single reason the bundle is named `DodoSSH.Desktop.app`.

docs/platform-flags.md

@@ -3,8 +3,18 @@
 Things known or suspected to behave differently outside Windows, plus deployment gotchas that
 have already cost time once. Development is Windows-first, but **the full test suite now runs on
 Linux in CI on every change**, so a Linux claim here is usually a measurement now rather than a
-suspicion. **macOS is still untested**, and anything marked *unverified* has not run on the platform
-in question and must not be assumed to work.
+suspicion. Anything marked *unverified* has not run on the platform in question and must not be
+assumed to work.
+
+**macOS now builds and packages, and has still never run.** The distinction matters more here than
+anywhere else on this page, because the two halves are verified in completely different places. The
+build is measured on every main and tag build: CI publishes `osx-arm64` and runs `vpk [osx] bundle`
+on a Linux runner, which is enough to catch a restore graph with no macOS native asset and an `.app`
+that will not compose. Everything past that — whether the window draws, whether the terminal's
+loopback WebSocket reaches WKWebView, whether the Secure Enclave holds a device key — is verified
+only by a person walking Phase 18 of [manual-checks.md](manual-checks.md) on a Mac, because **there
+is no macOS runner in CI**. Treat every macOS runtime claim below as unverified unless it says
+otherwise.
 
 Each entry says what the risk is, why it matters, and what to do about it. Delete an entry when it
 has been verified or made moot — not when it merely stops being convenient.
@@ -17,6 +27,19 @@ docs/crypto.md §1. *Already mitigated* — but if a BCL AEAD path is ever added
 **must** gate on `IsSupported` rather than assuming availability, or the client will fail to open
 any vault on macOS.
 
+**The Secure Enclave holds P-256 keys and nothing else**, which is why `MacDeviceKeyStore` wraps the
+device key with ECIES rather than with the RSA-OAEP the Windows store uses. It will not hold an RSA
+key at any size, so this is not a preference. The useful consequence is that the macOS shape is
+*better* than the Windows one: `SecKeyCopyPublicKey` works on an enclave key without prompting, so
+registering a device is silent and only unlock asks — where Windows raises a dialog at key creation
+too. *Unverified:* no enclave call in this repository has ever run.
+
+**Three ordinary Macs have no usable enclave**, and `IsSupported` probes rather than infers for that
+reason: an Intel machine without a T2, a machine with no login password set, and — the one that
+surprises people — **any build that is not code signed**, because enclave key creation needs a
+signing identity. So `dotnet run` correctly offers no device key at all. Do not "fix" this by
+checking the OS instead; the offer would then put a wrap on the server that nothing can ever open.
+
 **Argon2id timings are measured on one Windows machine only.** 256 MiB with t=4 took 323 ms here.
 The floor and ceiling in `EnrollmentLimits` were chosen against that number. *Unverified
 elsewhere:* recalibrate on the slowest target platform before recommending a default profile,
@@ -26,7 +49,11 @@ and the parameters are stored per user at enrollment, so a bad default is a per-
 **libsodium ships native binaries per RID.** This complicates single-file and AOT publishing, and
 on macOS every native library (`libsodium`, `libSkiaSharp`, `libHarfBuzzSharp`, `libe_sqlite3`)
 must be signed **individually** with `--options runtime --timestamp` before the bundle is signed,
-or notarization fails with an error that does not name the offending file.
+or notarization fails with an error that does not name the offending file. *Mitigated* in
+`scripts/release-macos.sh`, which signs every `.dylib` and `createdump` in a loop before vpk touches
+anything — vpk's own pass uses `codesign --deep`, which is the shape Apple documents as wrong for
+nested code and is the likeliest source of that unnamed rejection. The loop looks redundant next to
+`--deep` and is not; do not delete it because a release once succeeded without it.
 
 ## Desktop client
 
@@ -366,6 +393,37 @@ AppContainer where loopback connections are blocked without a `CheckNetIsolation
 terminal data plane *is* a loopback WebSocket, so MSIX would break the product outright. Velopack
 for Windows/macOS/AppImage; Flatpak and deb/rpm defer updates to the package manager.
 
+**The App Sandbox is ruled out on macOS for the same reason, and the entitlements say so.** A
+sandboxed process cannot listen on loopback without `com.apple.security.network.server`, and the
+terminal is that listener. Developer ID distribution outside the App Store does not require the
+sandbox, so this costs nothing today — but it does mean the Mac App Store is closed to this
+application without solving the data plane differently first. See
+`build/macos/DodoSSH.entitlements`.
+
+**The hardened runtime is not optional and .NET needs four holes punched in it.** Notarization
+refuses a Developer ID submission without it, and CoreCLR will not start under it without
+`allow-jit` and `allow-unsigned-executable-memory` — both, not either, because the runtime allocates
+executable memory outside the `MAP_JIT` path as well. `disable-library-validation` and
+`allow-dyld-environment-variables` are needed for Velopack's updater rather than for the runtime.
+Each is argued individually in the entitlements file; the failure mode for a missing one is a
+process that dies during runtime initialisation, before anything exists that could report it.
+
+**`vpk` cross-compiles to macOS only as far as the bundle.** `vpk [osx] bundle` runs anywhere and
+produces a real `.app`; there is no `[osx] pack` off a Mac, because pack drives `codesign`,
+`notarytool` and `stapler`. So CI can prove the bundle builds and only a Mac can produce something
+installable. Note this is the *opposite* of the Windows story, where `vpk [win] pack` builds the
+whole installer on Linux — the asymmetry is Apple tooling, not a Velopack limitation.
+
+**A custom `Info.plist` is copied verbatim by vpk, with no substitution whatsoever.** That is why
+`--plist` and `--bundleId` are mutually exclusive, and why `build/macos/Info.plist.template` is a
+template the release script renders rather than a committed file. A committed plist would carry one
+version into every release afterwards, and the symptom is silent: Velopack's index would still be
+right, the updater would still work, and only Get Info and any crash report would disagree.
+
+**macOS app icons live on an 824-in-1024 grid.** An icon that bleeds to the edge of its canvas is
+not bolder, it is the one icon in the Dock that is too big. `dodossh-icon.ps1` draws the `.icns` at
+that fraction and the `.ico` at full bleed, from one geometry.
+
 *Checked rather than assumed, now that Velopack is actually wired up:* its Windows path does not
 reintroduce the thing MSIX was ruled out for. `Setup.exe` is an ordinary Win32 executable that unpacks a
 directory under `%LOCALAPPDATA%` and creates shortcuts — there is no `AppxManifest`, no package identity,

scripts/release-macos.sh

@@ -0,0 +1,404 @@
+#!/usr/bin/env bash
+#
+# Builds, packages and publishes the macOS desktop client.
+#
+# The counterpart of scripts/release-windows.ps1, and deliberately the same shape: run by a person, on a
+# Mac that is not a CI runner, in two phases with the upload withheld until somebody has installed what
+# phase one built and walked the manual checks. docs/adr/0011-android-distribution.md rule 1 puts the
+# capability to ship somebody a build on a machine which is not a runner, and
+# docs/adr/0013-desktop-distribution-and-updates.md explains why the token that writes a Gitea release is
+# that capability: Velopack clients trust their feed and do not verify a package signature when they apply
+# it, so whoever can write a release can ship an update every install runs.
+#
+#   1. Without --upload: builds, signs, notarizes, packs, and stops. Nothing has left this machine
+#      except the notarization submission, which Apple sees and users do not.
+#   2. With --upload: asks for the forge token and publishes what phase one produced. It does not
+#      rebuild, so the bytes that reach users are the bytes that were installed and checked.
+#
+# ◆ WHAT IS DIFFERENT FROM THE WINDOWS SCRIPT, AND WHY.
+#
+# Signing is not optional here. On Windows an unsigned installer costs a SmartScreen dialog once per
+# user, which is why that script has no --signParams and says so. On macOS an un-notarized download is
+# refused outright by Gatekeeper — not warned about, refused — so the Developer ID certificate and the
+# notarization round trip are the price of the package being installable at all, not an improvement to
+# be bought later.
+#
+# ◆ CREDENTIALS COME FROM THE KEYCHAIN AND THE ENVIRONMENT, NOT FROM THIS FILE.
+#
+# Three values are read from the environment, and none of them is itself a secret — they name things the
+# keychain holds, and the keychain is what guards the private key and the App Store Connect credentials:
+#
+#   DODOSSH_SIGN_APP_IDENTITY      e.g. "Developer ID Application: DodoTech (TEAMID)"
+#   DODOSSH_SIGN_INSTALL_IDENTITY  e.g. "Developer ID Installer: DodoTech (TEAMID)"
+#   DODOSSH_NOTARY_PROFILE         the profile name given to `xcrun notarytool store-credentials`
+#
+# `security find-identity -v -p codesigning` lists the first two exactly as codesign wants them. The
+# third is created once per machine:
+#
+#   xcrun notarytool store-credentials DodoSSH \
+#     --apple-id you@example.com --team-id TEAMID --password <app-specific-password>
+#
+# The forge token is the one real secret, and it is prompted for rather than read from a file or the
+# environment, and only in the phase that needs it — for the reason the Windows script gives: the fewer
+# minutes a credential that can publish an update spends in a shell's memory the better.
+#
+# Usage:
+#   bash scripts/release-macos.sh
+#   bash scripts/release-macos.sh --upload
+#   bash scripts/release-macos.sh --skip-tests
+
+set -euo pipefail
+
+UPLOAD=0
+SKIP_TESTS=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --upload)     UPLOAD=1 ;;
+        --skip-tests) SKIP_TESTS=1 ;;
+        *)
+            echo "Unknown argument: $arg" >&2
+            echo "Usage: bash scripts/release-macos.sh [--upload] [--skip-tests]" >&2
+            exit 1
+            ;;
+    esac
+done
+
+# ---- The contract with every installed client ---------------------------------------------------------
+
+# Velopack's identity for this application, and it is effectively irreversible for the reasons the Windows
+# script states — it is what an installed client matches an update against.
+#
+# ◆ THE SAME PACK ID AS WINDOWS, AND ON THIS PLATFORM IT IS VISIBLE.
+#
+# vpk names the bundle after the pack id, so this produces DodoSSH.Desktop.app rather than DodoSSH.app,
+# and that is what somebody sees in /Applications. It is kept anyway, because the alternative is worse:
+# a pack id of DodoSSH would put Velopack's install and its uninstall on ~/Library/Application Support/
+# DodoSSH, which is exactly where ClientPaths keeps the encrypted cache, the outbox of changes not yet
+# pushed and the device key. Sharing that directory would mean an uninstall silently taking a user's
+# un-synced work with it. The same reasoning, and the same conclusion, as the Windows script.
+#
+# What a person actually reads is CFBundleDisplayName, which build/macos/Info.plist.template sets to
+# DodoSSH. So the bundle keeps the id and the Dock shows the product.
+PACK_ID='DodoSSH.Desktop'
+PACK_TITLE='DodoSSH'
+PACK_AUTHORS='DodoTech'
+
+# The project's own forge. Never a DodoSSH deployment — ADR 0011 rule 2. The same URL is a constant in
+# VelopackUpdateChannel, and the two have to agree or the client polls somewhere nothing is published.
+# The owner is part of it: Gitea left a 301 at the old organisation's path, which a GET follows and an
+# upload does not.
+REPO_URL='https://git.dodotech.cloud/DodoTech-Public/DodoSSH'
+
+# A contract with VelopackUpdateChannel.MacReleaseChannel. Velopack's macOS default is also "osx", so
+# leaving it unsaid on both sides would work — but unsaid here and stated there is how a feed goes quiet
+# with no error at all: the client checks, finds nothing, and reports itself up to date forever.
+CHANNEL='osx'
+
+# ◆ ARM64 ONLY, AND THAT IS A DECISION RATHER THAN AN OVERSIGHT.
+#
+# Velopack keys a channel to one architecture, so shipping Intel too means a second channel, a second
+# publish, a second set of deltas and a second thing to keep in step with the client's channel picker.
+# That is all affordable. What is not currently affordable is testing it: nobody here has an Intel Mac,
+# and docs/manual-checks.md exists because this project does not ship desktop builds no one has run.
+# An x64 package built blind and published beside a checked arm64 one would be the only artefact in this
+# repository that reached users unverified.
+#
+# Adding it later is this constant, a second channel name in VelopackUpdateChannel, and a picker keyed on
+# RuntimeInformation.ProcessArchitecture — which reports X64 for a build running under Rosetta, so an
+# Intel build correctly stays on the Intel feed. The work is small; the check is the part that is missing.
+RUNTIME='osx-arm64'
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PROJECT="$REPO_ROOT/src/DodoSSH.Client.App/DodoSSH.Client.App.csproj"
+SOLUTION="$REPO_ROOT/DodoSSH.slnx"
+PUBLISH_DIR="$REPO_ROOT/publish/$RUNTIME"
+RELEASES_DIR="$REPO_ROOT/Releases"
+ICON="$REPO_ROOT/src/DodoSSH.Client.App/Assets/dodossh.icns"
+ENTITLEMENTS="$REPO_ROOT/build/macos/DodoSSH.entitlements"
+PLIST_TEMPLATE="$REPO_ROOT/build/macos/Info.plist.template"
+
+write_step() { printf '\n\033[36m==> %s\033[0m\n' "$1"; }
+stop_with()  { printf '\n\033[31m%s\033[0m\n' "$1" >&2; exit 1; }
+
+# ---- Is this machine able to do the job at all? -------------------------------------------------------
+
+if [ "$(uname -s)" != 'Darwin' ]; then
+    # codesign, notarytool and stapler are Apple tooling and exist nowhere else. The build and even the
+    # .app bundle cross-compile fine from Windows or Linux — `vpk [osx] bundle` does exactly that, and
+    # ci.yml uses it to prove the bundle still builds — but a signed, notarized, installable package
+    # cannot be produced anywhere but here.
+    stop_with 'This builds a signed macOS package and has to run on macOS.'
+fi
+
+for tool in dotnet git xcrun codesign; do
+    command -v "$tool" >/dev/null 2>&1 || stop_with "$tool is not on PATH."
+done
+
+# Checked before anything is built rather than at the step that uses them. Notarization is the last thing
+# this script does and the slowest, and discovering there that a profile name was never exported means
+# throwing away a full build and test run.
+for required in DODOSSH_SIGN_APP_IDENTITY DODOSSH_SIGN_INSTALL_IDENTITY DODOSSH_NOTARY_PROFILE; do
+    if [ -z "${!required-}" ]; then
+        stop_with "$required is not set. See the header of this script for what the three are and how to make them."
+    fi
+done
+
+cd "$REPO_ROOT"
+
+# ---- What is being released ---------------------------------------------------------------------------
+
+# Restored before the version is read, and both halves are load-bearing — the same two traps the Windows
+# script documents. -t:MinVer, because -getProperty alone evaluates the project and runs no targets, while
+# MinVer sets Version from inside one, so the read would answer the SDK's default 1.0.0 regardless of the
+# tag. And a restore first, because naming a target that arrives with a package fails MSB4057 on a clean
+# clone where obj/ has no MinVer targets to import yet.
+write_step 'Restoring the desktop head, so the version can be read'
+dotnet restore "$PROJECT" --locked-mode || stop_with 'Restore failed.'
+
+VERSION="$(dotnet msbuild "$PROJECT" -getProperty:Version -t:MinVer -nologo | tr -d '[:space:]')"
+[ -n "$VERSION" ] || stop_with 'Could not read the version from MSBuild.'
+
+TAG="v$VERSION"
+
+# Apple's two version keys take one to three dot-separated integers and nothing else, so a prerelease
+# version has to have its suffix removed before it reaches the plist. 1.2.3-rc.1 becomes 1.2.3.
+#
+# The full version, suffix and all, is what vpk packs and what the release index carries, so the updater
+# still tells an rc from the release it precedes. These two keys are for Finder and Gatekeeper, which
+# care that the string parses and not what it says. See build/macos/Info.plist.template.
+PLIST_VERSION="${VERSION%%-*}"
+PLIST_VERSION="${PLIST_VERSION%%+*}"
+
+write_step "DodoSSH $VERSION  ($PACK_ID, channel $CHANNEL, $RUNTIME)"
+
+# ---- Phase 2: publish what phase 1 built --------------------------------------------------------------
+
+if [ "$UPLOAD" -eq 1 ]; then
+    # The installer package is the artefact a person downloads, so its absence is the honest test of
+    # whether phase one ever ran. A directory holding only a .nupkg is a pack that failed part way.
+    if ! ls "$RELEASES_DIR"/*.pkg >/dev/null 2>&1; then
+        stop_with "Nothing to upload: $RELEASES_DIR has no .pkg. Run this without --upload first."
+    fi
+
+    echo "About to publish the contents of $RELEASES_DIR to $REPO_URL as $TAG."
+    echo 'Only do this once you have installed it and walked Phase 18 of docs/manual-checks.md.'
+
+    # -s so the token is never echoed and never lands in the shell's history.
+    printf 'Gitea token (write:repository): '
+    read -r -s TOKEN
+    echo
+
+    [ -n "$TOKEN" ] || stop_with 'No token given.'
+
+    # --merge because Gitea already has a release entry for the pushed tag — and on this platform it may
+    # also already hold the Windows package for the same tag, which is the case --merge is really doing
+    # the work for: without it the second platform to publish a given version fails on a release that
+    # exists, and with it the two sit side by side under one tag. --channel keeps the indexes apart.
+    UPLOAD_ARGS=(
+        upload gitea
+        --repoUrl "$REPO_URL"
+        --token "$TOKEN"
+        --outputDir "$RELEASES_DIR"
+        --channel "$CHANNEL"
+        --releaseName "$TAG"
+        --tag "$TAG"
+        --merge
+        --publish
+    )
+
+    # Mirrors the rule the docker image job and the Windows script already apply to the same tag, so a
+    # release candidate is a prerelease in every channel or in none.
+    case "$VERSION" in
+        *-*) UPLOAD_ARGS+=(--pre) ;;
+    esac
+
+    write_step 'Uploading'
+    dotnet vpk "${UPLOAD_ARGS[@]}" || stop_with 'vpk upload failed.'
+
+    write_step "Published $TAG."
+    exit 0
+fi
+
+# ---- Phase 1: build, sign, notarize, pack -------------------------------------------------------------
+
+[ -z "$(git status --porcelain)" ] || stop_with 'The working tree is not clean. A release is cut from a commit, not from a desk.'
+
+HEAD_TAG="$(git describe --exact-match --tags HEAD 2>/dev/null || true)"
+[ -n "$HEAD_TAG" ] || stop_with "HEAD is not tagged. Tag it $TAG first, or change the version and tag that."
+
+# Cannot happen while MinVer is deriving the version from this very tag, and checked anyway: the day
+# somebody pins a version by hand this is the guard that notices.
+[ "$HEAD_TAG" = "$TAG" ] || stop_with "HEAD is tagged $HEAD_TAG but the computed version is $VERSION."
+
+write_step 'Restoring tools'
+dotnet tool restore || stop_with 'dotnet tool restore failed.'
+
+write_step 'Restoring packages (locked, exactly as CI does)'
+dotnet restore "$SOLUTION" --locked-mode || stop_with 'Restore failed. A lock file that only works on Linux fails here.'
+
+write_step 'Building'
+dotnet build "$SOLUTION" --no-restore --configuration Release || stop_with 'Build failed.'
+
+if [ "$SKIP_TESTS" -eq 0 ]; then
+    # The end-to-end suite starts containers and takes minutes. It is run here anyway rather than taken
+    # on trust from CI, because a tag is the one build nobody is watching — and on this platform there is
+    # a second reason: CI has no macOS runner, so this is the only place the suite ever runs on a Mac at
+    # all. Everything docs/platform-flags.md lists as unverified on macOS is verified here or nowhere.
+    write_step 'Testing'
+    dotnet test "$SOLUTION" --no-build --configuration Release || stop_with 'Tests failed.'
+fi
+
+write_step "Publishing $RUNTIME"
+rm -rf "$PUBLISH_DIR"
+
+# Self-contained, and not single-file, for the reasons the Windows script gives: the native libraries ship
+# per RID and a self-extracting bundle breaks delta updates.
+#
+# RestoreLockedMode=false, and the lock files put back straight afterwards. A RID-specific publish resolves
+# a graph the committed lock files do not describe, because they are deliberately kept RID-free —
+# declaring a RID on the head writes a net10.0/<rid> target into every project it references transitively,
+# including DodoSSH.Contracts and DodoSSH.Crypto, and the API's Dockerfile then restores those with no RID
+# under locked mode and fails NU1004. Packaging the desktop client would have broken the server's image
+# build. The gate that matters is the locked solution restore above, which is untouched.
+dotnet publish "$PROJECT" \
+    --configuration Release \
+    --runtime "$RUNTIME" \
+    --self-contained true \
+    --output "$PUBLISH_DIR" \
+    -p:RestoreLockedMode=false \
+    || stop_with 'Publish failed.'
+
+# An unlocked restore rewrites the lock files it walked. Left there, the next commit would carry exactly
+# the change that breaks the image build. Safe to do bluntly because this script refuses to run on a dirty
+# tree, so anything modified here is its own.
+git checkout -- '*packages.lock.json' || stop_with 'Could not restore the lock files after publishing.'
+
+# Checked rather than assumed. A publish directory without Velopack.dll would pack into an installer for an
+# application that never checks for updates — which looks completely normal until the next release goes out
+# and nobody receives it.
+for required in DodoSSH Velopack.dll; do
+    [ -e "$PUBLISH_DIR/$required" ] || stop_with "$required is missing from $PUBLISH_DIR."
+done
+
+echo "  $(du -sh "$PUBLISH_DIR" | cut -f1) in $(find "$PUBLISH_DIR" -type f | wc -l | tr -d ' ') files"
+
+# ---- Signing the native libraries, before vpk signs anything ------------------------------------------
+
+# ◆ THIS LOOP IS WHY NOTARIZATION SUCCEEDS, AND IT LOOKS REDUNDANT.
+#
+# vpk signs the finished bundle itself, with `codesign -f -v --timestamp --options runtime --entitlements
+# <file> --deep`, and --deep is documented by Apple as the wrong way to sign nested code. Apple's guidance
+# is inside-out: sign each nested binary first, then the bundle around it. --deep does the reverse in one
+# pass and applies the outer entitlements to everything it touches.
+#
+# In practice --deep alone is where the failure recorded in docs/platform-flags.md comes from — a
+# notarization rejection that does not name the offending file, on a submission that took its time getting
+# there. Signing each dylib properly first means vpk's pass has nothing left to get wrong, and re-signing
+# an already correctly signed binary with -f is a no-op in effect.
+#
+# No --entitlements here, and that is the difference that matters. Entitlements belong on the main
+# executable; a dylib carrying allow-jit is at best meaningless and at worst a rejection.
+write_step 'Signing native libraries'
+
+# createdump is a Mach-O executable the runtime ships and it is signed like the libraries: a nested
+# executable that is not signed fails notarization exactly as an unsigned dylib does, and it is the one
+# people forget because it has no extension to grep for.
+NATIVE_COUNT=0
+while IFS= read -r -d '' binary; do
+    codesign --force --verbose=0 --timestamp --options runtime \
+        --sign "$DODOSSH_SIGN_APP_IDENTITY" "$binary" \
+        || stop_with "codesign failed on $binary"
+    NATIVE_COUNT=$((NATIVE_COUNT + 1))
+done < <(find "$PUBLISH_DIR" \( -name '*.dylib' -o -name 'createdump' \) -type f -print0)
+
+[ "$NATIVE_COUNT" -gt 0 ] || stop_with "No native binaries found under $PUBLISH_DIR, which cannot be right for a self-contained publish."
+echo "  signed $NATIVE_COUNT native binaries"
+
+# ---- The bundle's Info.plist --------------------------------------------------------------------------
+
+# Rendered rather than committed, because vpk copies a custom plist verbatim and substitutes nothing —
+# so a committed one would carry whatever version it was written with into every release afterwards.
+# See the header of build/macos/Info.plist.template.
+write_step "Rendering Info.plist for $PLIST_VERSION"
+RENDERED_PLIST="$(mktemp -t dodossh-plist)"
+trap 'rm -f "$RENDERED_PLIST"' EXIT
+
+sed "s/@VERSION@/$PLIST_VERSION/g" "$PLIST_TEMPLATE" > "$RENDERED_PLIST"
+
+# The placeholder is the whole mechanism, so its absence is checked rather than hoped for. A template
+# somebody edited into a literal version would otherwise sail through and pin every future release to it.
+grep -q '@VERSION@' "$PLIST_TEMPLATE" || stop_with "$PLIST_TEMPLATE has no @VERSION@ placeholder left in it."
+! grep -q '@VERSION@' "$RENDERED_PLIST" || stop_with 'Substitution into the rendered Info.plist did not take.'
+
+mkdir -p "$RELEASES_DIR"
+
+# The previous release, so a delta can be built against it. Tolerated when it finds nothing: the first
+# macOS release has no predecessor, and a hard failure here would make cutting it impossible.
+write_step 'Fetching the previous release, for deltas'
+if ! dotnet vpk download gitea --repoUrl "$REPO_URL" --outputDir "$RELEASES_DIR" --channel "$CHANNEL"; then
+    echo '  Nothing came down. This package will be full-only, which is right for a first release.'
+fi
+
+# ---- Pack, sign, notarize, staple ---------------------------------------------------------------------
+
+# One command does the rest, and it is worth knowing what it is doing on your behalf, because the slow
+# part is not local: it builds the .app from the published files, signs it with the Developer ID
+# certificate and the entitlements below, submits it to Apple with `xcrun notarytool submit --wait`,
+# staples the resulting ticket to the package, and then builds the .pkg installer and the release index.
+#
+# The notarization wait is the reason this step can take a quarter of an hour and occasionally much
+# longer — it is a queue at Apple, not a computation here, and vpk's own message says so.
+#
+# --signInstallIdentity is a different certificate from --signAppIdentity, and the pair is not
+# interchangeable: "Developer ID Application" signs the bundle, "Developer ID Installer" signs the .pkg.
+# Passing one where the other belongs fails with a message about an identity that cannot be found, which
+# reads like a keychain problem rather than like the wrong certificate.
+write_step 'Packing, signing and notarizing (the notarization wait is Apple queueing, not this machine)'
+
+dotnet vpk pack \
+    --packId "$PACK_ID" \
+    --packVersion "$VERSION" \
+    --packDir "$PUBLISH_DIR" \
+    --packTitle "$PACK_TITLE" \
+    --packAuthors "$PACK_AUTHORS" \
+    --mainExe 'DodoSSH' \
+    --icon "$ICON" \
+    --plist "$RENDERED_PLIST" \
+    --entitlements "$ENTITLEMENTS" \
+    --signAppIdentity "$DODOSSH_SIGN_APP_IDENTITY" \
+    --signInstallIdentity "$DODOSSH_SIGN_INSTALL_IDENTITY" \
+    --notaryProfile "$DODOSSH_NOTARY_PROFILE" \
+    --runtime "$RUNTIME" \
+    --channel "$CHANNEL" \
+    --outputDir "$RELEASES_DIR" \
+    || stop_with 'vpk pack failed.'
+
+# ---- Did the notarization actually take? --------------------------------------------------------------
+
+# Asked rather than assumed, and this is the check worth having above all the others. A package whose
+# ticket did not staple is indistinguishable from a good one on the machine that built it — the Mac that
+# signed something trusts it locally — and reveals itself only on somebody else's machine, as a refusal
+# to open at all. spctl assesses it the way Gatekeeper will on a machine that has never seen this
+# certificate.
+write_step 'Verifying the notarization the way another Mac will'
+
+PKG="$(ls -t "$RELEASES_DIR"/*.pkg 2>/dev/null | head -n 1)"
+[ -n "$PKG" ] || stop_with 'vpk pack reported success but produced no .pkg.'
+
+if ! spctl --assess --type install --verbose=4 "$PKG"; then
+    stop_with "Gatekeeper rejects $PKG. It is signed but the notarization ticket is missing or stale; do not upload it."
+fi
+
+xcrun stapler validate "$PKG" || stop_with "The notarization ticket is not stapled to $PKG."
+
+write_step 'Built, notarized, and deliberately not uploaded'
+
+ls -lh "$RELEASES_DIR" | tail -n +2
+
+cat <<EOF
+
+Next:
+  1. Install the .pkg above and walk Phase 18 of docs/manual-checks.md.
+  2. Then: bash scripts/release-macos.sh --upload
+EOF

src/DodoSSH.Client.Android/App.axaml.cs

@@ -90,32 +90,61 @@ public sealed partial class DodoSshApp : Avalonia.Application
 
         shell.DataContext = viewModel;
 
-        // Difference 2: the foreground service, which is what makes TerminalWorkspace's promise — that a
-        // shell outlives a vault lock — true on a platform that stops backgrounded processes.
-        //
-        // The transfer count is real now that the document picker gives this head a way to start one, and
-        // it is the half that matters most here: a shell survives backgrounding because somebody is looking
-        // at it, and an upload has to survive precisely when nobody is — the screen is off and the phone is
-        // in a pocket. Queued counts as active, so putting five files in the queue and locking the phone
-        // moves five files.
-        //
-        // A local rather than a field, matching the desktop head: an Avalonia Application has no disposal
-        // hook, so a field holding a disposable would have nowhere honest to release it. It stays alive
-        // because it is subscribed to the workspace, which lives as long as the process.
-        var keepAlive = new SessionKeepAlive(
-            workspace,
-            activeTransfers: () => viewModel.Transfers.ActiveTransfers);
-
-        // The other end of the same wire: the workspace announces its own sessions ending, and the queue
-        // announces transfers appearing and finishing. Without this the notification would come up when an
-        // upload started and stay up after it finished, which is the failure this class exists to prevent.
-        viewModel.Transfers.ActivityChanged += (_, _) => keepAlive.Refresh();
-
-        keepAlive.Refresh();
+        // Difference 2, wired up in its own method purely for length — see ComposeKeepAlive for what it
+        // does and why.
+        ComposeKeepAlive(workspace, viewModel);
 
         return shell;
     }
 
+    /// <summary>
+    /// Wires up the foreground service that makes <c>TerminalWorkspace</c>'s promise — that a shell outlives
+    /// a vault lock — true on a platform that stops backgrounded processes.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Split out of <see cref="Compose"/> for length rather than for reuse; there is exactly one caller.
+    /// </para>
+    /// <para>
+    /// The transfer count is real now that the document picker gives this head a way to start one, and it
+    /// matters exactly when nobody is looking: a shell survives backgrounding because somebody opened it,
+    /// and an upload has to survive precisely when nobody is — the screen is off and the phone is in a
+    /// pocket. Queued counts as active, so putting five files in the queue and locking the phone moves five
+    /// files. <c>holdsFileSession</c> covers the third case a count alone cannot: a host connected on the
+    /// Files screen with no transfer moving is still a live SFTP session that backgrounding would sever, and
+    /// <c>TransfersViewModel.HasLiveFileSession</c> is the existing fact — <c>IsConnected</c> with a real
+    /// cipher, which a bucket never has — that answers whether one is open.
+    /// </para>
+    /// <para>
+    /// <c>keepAlive</c> is a local rather than a field, matching the desktop head: an Avalonia Application
+    /// has no disposal hook, so a field holding a disposable would have nowhere honest to release it. It
+    /// stays alive because it is subscribed to the workspace, which lives as long as the process.
+    /// </para>
+    /// </remarks>
+    private static void ComposeKeepAlive(TerminalWorkspace workspace, MainWindowViewModel viewModel)
+    {
+        var keepAlive = new SessionKeepAlive(
+            workspace,
+            activeTransfers: () => viewModel.Transfers.ActiveTransfers,
+            holdsFileSession: () => viewModel.Transfers.HasLiveFileSession);
+
+        // The other end of the same wire: the workspace announces its own sessions ending, and the queue
+        // announces transfers appearing and finishing, and a Files session connecting or disconnecting.
+        // Without this the notification would come up when an upload started and stay up after it
+        // finished, which is the failure this class exists to prevent.
+        viewModel.Transfers.ActivityChanged += (_, _) => keepAlive.Refresh();
+
+        // The half that was missing until now: a shell opening. SessionKeepAlive already heard the
+        // workspace announce a session ending, but nothing announced the opposite — a user who opened a
+        // shell and backgrounded the app had no foreground service at all, because the only wire in was the
+        // one for taking it down. TerminalSessionOpened is that other half, forwarded from
+        // VaultViewModel.SessionOpened, and without this line the service could never come up for a shell
+        // in the first place, which was precisely the promise this whole arrangement exists to keep.
+        viewModel.TerminalSessionOpened += (_, _) => keepAlive.Refresh();
+
+        keepAlive.Refresh();
+    }
+
     /// <summary>
     /// Writing to this phone's clipboard.
     /// </summary>

src/DodoSSH.Client.Android/DodoSshAndroidApplication.cs

@@ -1,6 +1,7 @@
 // See the note at the top of MainActivity for why the platform namespaces are reached through `global::`.
 using Avalonia;
 using Avalonia.Android;
+using Avalonia.Media;
 using DodoSSH.Client.Android.Platform;
 using global::Android.App;
 using global::Android.Runtime;
@@ -46,6 +47,30 @@ public sealed class DodoSshAndroidApplication : AvaloniaAndroidApplication<DodoS
     }
 
     /// <inheritdoc />
+    /// <remarks>
+    /// This used to be the one place the two heads disagreed on purpose: the recorded v2 decision was
+    /// "Android recolours with the shared palette and keeps its own default sans", on the reasoning that a
+    /// phone's system font is a phone's own business. The user has reversed that, this pass — the phone now
+    /// takes the desktop's face as well as its colours, and <c>docs/design-import-gaps.md</c> is corrected
+    /// to say so rather than left asserting a decision that no longer holds.
+    ///
+    /// <c>WithInterFont</c> still registers Inter, for the same reason <c>Program.cs</c> keeps it on the
+    /// desktop: it is what the layout suite pins and what a glyph Montserrat does not cover falls back to.
+    /// What changes is which face answers first. Montserrat ships embedded in
+    /// <c>DodoSSH.Client.Shell/Assets/Fonts</c> already — this project references that assembly for
+    /// <c>Theme/Phone.axaml</c>'s own <c>MonoFont</c>, so no csproj or asset work was needed to reach it
+    /// from here, only the same <see cref="FontManagerOptions"/> block the desktop's
+    /// <c>Program.BuildAvaloniaApp</c> sets.
+    /// </remarks>
     protected override AppBuilder CustomizeAppBuilder(AppBuilder builder) =>
-        base.CustomizeAppBuilder(builder).WithInterFont();
+        base.CustomizeAppBuilder(builder)
+            .WithInterFont()
+            .With(new FontManagerOptions
+            {
+                DefaultFamilyName = "avares://DodoSSH.Client.Shell/Assets/Fonts#Montserrat",
+                FontFallbacks =
+                [
+                    new FontFallback { FontFamily = new FontFamily("avares://Avalonia.Fonts.Inter/Assets#Inter") },
+                ],
+            });
 }

src/DodoSSH.Client.Android/Platform/SessionForegroundService.cs

@@ -6,7 +6,7 @@ using global::Android.OS;
 namespace DodoSSH.Client.Android.Platform;
 
 /// <summary>
-/// Keeps the process alive for as long as a shell or a transfer is live.
+/// Keeps the process alive for as long as a shell, a transfer, or a connected Files session is live.
 /// </summary>
 /// <remarks>
 /// <para>
@@ -41,6 +41,26 @@ internal sealed class SessionForegroundService : Service
     private const string ChannelId = "dodossh.sessions";
     private const int NotificationId = 1;
 
+    // API 33+ requires the request to name a code the RequestPermissionsResult callback would be handed
+    // back — 1 is fine because this head never implements that callback at all, see
+    // RequestNotificationPermission's own remark for why a result is not worth listening for.
+    private const int NotificationPermissionRequestCode = 1;
+
+    /// <summary>
+    /// Whether <see cref="OnStartCommand"/> has run for this process without a matching
+    /// <see cref="OnDestroy"/> since — i.e. whether Android currently considers this service foregrounded.
+    /// </summary>
+    /// <remarks>
+    /// Volatile because <see cref="Reconcile"/> can run on whatever thread called
+    /// <see cref="SessionKeepAlive.Refresh"/>, while this is set from the binder thread Android delivers
+    /// service lifecycle callbacks on — two threads with no other synchronisation between them, and a stale
+    /// read here is the difference between updating a notification in place and calling
+    /// <c>StartForegroundService</c> on a service that is already running, which is what defect 3 was.
+    /// </remarks>
+    private static volatile bool running;
+
+    private static bool notificationPermissionRequested;
+
     /// <remarks>
     /// A bound service would tie the sessions' lifetime to a binding, which is the opposite of what is
     /// wanted here: the point is that they outlive whatever the user does with the interface.
@@ -49,7 +69,9 @@ internal sealed class SessionForegroundService : Service
 
     public override StartCommandResult OnStartCommand(Intent? intent, StartCommandFlags flags, int startId)
     {
-        StartForeground(NotificationId, BuildNotification(intent?.GetStringExtra("summary") ?? "Working"));
+        running = true;
+
+        StartForeground(NotificationId, BuildNotification(this, intent?.GetStringExtra("summary") ?? "Working"));
 
         // NotSticky: if Android does kill this process, the SSH connections died with it and there is
         // nothing to resume. Restarting the service would produce a notification claiming sessions that no
@@ -58,14 +80,36 @@ internal sealed class SessionForegroundService : Service
         return StartCommandResult.NotSticky;
     }
 
+    /// <inheritdoc />
     /// <remarks>
+    /// The other half of <see cref="running"/>. Android calls this whether the service stopped itself or
+    /// was stopped from outside — <see cref="Reconcile"/>'s down case calls <c>StopService</c> rather than
+    /// clearing the flag directly, so this override is the one place that actually knows the service has
+    /// gone, matching how <see cref="OnStartCommand"/> is the one place that knows it has come up.
+    /// </remarks>
+    public override void OnDestroy()
+    {
+        running = false;
+
+        base.OnDestroy();
+    }
+
+    /// <remarks>
+    /// <para>
     /// Low importance on purpose. This notification is a receipt, not an alert — it exists because Android
     /// requires one, and because the user is entitled to know the app is holding connections open. Making
     /// it buzz would be a notification about nothing having happened.
+    /// </para>
+    /// <para>
+    /// Static, taking the <see cref="Context"/> it needs rather than reading <c>this</c>: the instance path
+    /// through <see cref="OnStartCommand"/> passes the service itself, and the in-place update path through
+    /// <see cref="Reconcile"/> has no service instance at all — only <see cref="PhoneEnvironment.Require"/>
+    /// — because posting to an already-running notification never touches the service's own lifecycle.
+    /// </para>
     /// </remarks>
-    private Notification BuildNotification(string summary)
+    private static Notification BuildNotification(Context context, string summary)
     {
-        var manager = (NotificationManager)GetSystemService(NotificationService)!;
+        var manager = (NotificationManager)context.GetSystemService(Context.NotificationService)!;
 
         if (OperatingSystem.IsAndroidVersionAtLeast(26))
         {
@@ -79,12 +123,12 @@ internal sealed class SessionForegroundService : Service
         }
 
         var reopen = PendingIntent.GetActivity(
-            this,
+            context,
             0,
-            new Intent(this, typeof(MainActivity)).SetFlags(ActivityFlags.SingleTop),
+            new Intent(context, typeof(MainActivity)).SetFlags(ActivityFlags.SingleTop),
             PendingIntentFlags.Immutable | PendingIntentFlags.UpdateCurrent);
 
-        return new Notification.Builder(this, ChannelId)
+        return new Notification.Builder(context, ChannelId)
             .SetContentTitle("DodoSSH")
             .SetContentText(summary)
             .SetSmallIcon(global::Android.Resource.Drawable.IcDialogInfo)
@@ -93,37 +137,138 @@ internal sealed class SessionForegroundService : Service
             .Build();
     }
 
-    /// <summary>Starts or stops the service to match what is actually running.</summary>
+    /// <summary>Starts, stops, or refreshes the service's notification to match what is actually running.</summary>
     /// <param name="liveSessions">Shells with a live channel behind them.</param>
     /// <param name="activeTransfers">Transfers still moving bytes.</param>
-    public static void Reconcile(int liveSessions, int activeTransfers)
+    /// <param name="holdsFileSession">Whether the Files screen holds a live, idle SFTP connection.</param>
+    /// <remarks>
+    /// Three outcomes, not the two a plain start-or-stop would have. Nothing live stops the service, as
+    /// always. Something live and the service not yet running starts it. Something live and the service
+    /// already running is the case that used to call <c>StartForegroundService</c> a second time, which on
+    /// API 31+ throws <c>ForegroundServiceStartNotAllowedException</c> the instant the app is backgrounded
+    /// — a transfer finishing in the pocket, one of two shells dying — crashing the process and taking the
+    /// remaining connections with it. That case — running, and the app backgrounded — now only posts a
+    /// fresh notification through the <see cref="NotificationManager"/> already holding the channel open,
+    /// which needs no foreground-start permission at all. A foregrounded refresh still prefers a real
+    /// start even over a service that looks like it is running; the inline remark below is why.
+    /// </remarks>
+    public static void Reconcile(int liveSessions, int activeTransfers, bool holdsFileSession)
     {
         var context = PhoneEnvironment.Require();
-        var intent = new Intent(context, typeof(SessionForegroundService));
 
-        if (liveSessions == 0 && activeTransfers == 0)
+        if (liveSessions == 0 && activeTransfers == 0 && !holdsFileSession)
         {
-            context.StopService(intent);
+            context.StopService(new Intent(context, typeof(SessionForegroundService)));
 
             return;
         }
 
         // The summary says what is actually held, counted rather than generic — the same principle the
         // delete confirmations follow. "DodoSSH is running" would tell the user nothing they could act on.
-        intent.PutExtra("summary", Summarise(liveSessions, activeTransfers));
+        var summary = Summarise(liveSessions, activeTransfers, holdsFileSession);
 
-        context.StartForegroundService(intent);
+        // In-place only while backgrounded, where it is the only legal move. Foregrounded, a real start is
+        // always allowed and is preferred even when `running` says the service is up: a disconnect followed
+        // by a quick reconnect can land here while the StopService just issued is still in flight, and
+        // posting to that dying service's notification would leave an orphan receipt over an unprotected
+        // process — restarting instead makes the flag's small lag harmless. A start on a service that
+        // really is running only re-delivers OnStartCommand, whose StartForeground updates the same
+        // notification anyway. CurrentActivity is the foreground signal: set on resume, cleared on pause.
+        if (running && PhoneEnvironment.CurrentActivity is null)
+        {
+            var manager = (NotificationManager)context.GetSystemService(Context.NotificationService)!;
+            manager.Notify(NotificationId, BuildNotification(context, summary));
+
+            return;
+        }
+
+        RequestNotificationPermission(context);
+        Start(context, summary);
     }
 
-    private static string Summarise(int liveSessions, int activeTransfers)
+    /// <remarks>
+    /// Split out of <see cref="Reconcile"/> for the try/catch alone, which needs its own remark and would
+    /// otherwise crowd the three-way branch above it.
+    /// </remarks>
+    private static void Start(Context context, string summary)
     {
-        var parts = new List<string>(2);
+        var intent = new Intent(context, typeof(SessionForegroundService));
+        intent.PutExtra("summary", summary);
+
+        try
+        {
+            context.StartForegroundService(intent);
+        }
+        catch (Java.Lang.IllegalStateException)
+        {
+            // ForegroundServiceStartNotAllowedException (API 31+) derives from this, and reaching it here
+            // means a start-worthy transition — a shell opening, a Files connection completing, the first
+            // transfer landing in an empty queue — happened while the app was backgrounded, which is
+            // precisely when Android refuses a new foreground start. There is no retry that helps: by the
+            // time this catch runs, the moment such a start would have been allowed has already passed.
+            // Swallowing it is the honest choice and not just the available one — letting the exception
+            // propagate would crash the process and drop the very shells and transfers this service exists
+            // to keep alive. A process that keeps running unprotected outlives one that does not run at all.
+        }
+    }
+
+    /// <summary>
+    /// Asks for the receipt notification's own permission, the first time this process actually has
+    /// something to show rather than at launch.
+    /// </summary>
+    /// <remarks>
+    /// At most once per process, via <see cref="notificationPermissionRequested"/> — not to work around a
+    /// platform limit, since Android already refuses to show the dialogue twice, but because a second call
+    /// to <c>RequestPermissions</c> after the first is still pending is its own kind of noise. No result is
+    /// read back: there is nothing this class would do differently for a grant versus a refusal, so a
+    /// callback would exist only to be empty. What refusal costs is stated rather than hidden — the
+    /// notification stays invisible — and what it does not cost is the point: the service still starts,
+    /// still holds the process in the foreground, and the shells and transfers it protects are exactly as
+    /// safe as if the user had said yes. See the manifest's own comment on this permission.
+    /// </remarks>
+    private static void RequestNotificationPermission(Context context)
+    {
+        // Isolated as its own guard clause rather than folded into the compound condition below: the
+        // platform-compatibility analyzer only recognises a version check as guarding what follows when it
+        // is the sole condition of its own early return, and PostNotifications is annotated API 33+.
+        if (!OperatingSystem.IsAndroidVersionAtLeast(33))
+        {
+            return;
+        }
+
+        // Read into a local rather than referenced again inside the lambda below: the guard clause above
+        // covers a direct call in this method's own body, but the platform-compatibility analyzer treats a
+        // lambda as reachable from anywhere and will not extend the guard across that boundary. Capturing
+        // the already-validated string sidesteps the false positive without weakening the actual check.
+        var postNotifications = global::Android.Manifest.Permission.PostNotifications;
+
+        if (notificationPermissionRequested
+            || PhoneEnvironment.CurrentActivity is not { } activity
+            || context.CheckSelfPermission(postNotifications) == Permission.Granted)
+        {
+            return;
+        }
+
+        notificationPermissionRequested = true;
+
+        activity.RunOnUiThread(() =>
+            activity.RequestPermissions([postNotifications], NotificationPermissionRequestCode));
+    }
+
+    private static string Summarise(int liveSessions, int activeTransfers, bool holdsFileSession)
+    {
+        var parts = new List<string>(3);
 
         if (liveSessions > 0)
         {
             parts.Add(liveSessions == 1 ? "1 shell connected" : $"{liveSessions} shells connected");
         }
 
+        if (holdsFileSession)
+        {
+            parts.Add("Files connected");
+        }
+
         if (activeTransfers > 0)
         {
             parts.Add(activeTransfers == 1 ? "1 transfer running" : $"{activeTransfers} transfers running");

src/DodoSSH.Client.Android/Platform/SessionKeepAlive.cs

@@ -17,37 +17,53 @@ namespace DodoSSH.Client.Android.Platform;
 /// tally kept here. It already knows that a session whose shell exited half an hour ago is not live, which
 /// a counter incremented on open and decremented on close would not.
 /// </para>
+/// <para>
+/// Three facts feed <see cref="SessionForegroundService.Reconcile"/>, not one: live shells, moving
+/// transfers, and an idle-but-connected Files session. The last of those used to be missing entirely —
+/// a shell survives backgrounding because somebody opened it, but a Files connection with nothing moving
+/// looked, to this class, exactly like nothing being open at all. <c>holdsFileSession</c> below is that
+/// gap closed, read the same way the other two facts are: asked, not cached.
+/// </para>
 /// </remarks>
 internal sealed class SessionKeepAlive : IDisposable
 {
     private readonly TerminalWorkspace workspace;
     private readonly Func<int> activeTransfers;
+    private readonly Func<bool> holdsFileSession;
 
     /// <param name="workspace">The live shells.</param>
     /// <param name="activeTransfers">
-    /// How many transfers are moving bytes. A delegate rather than a queue, because file transfer is out
-    /// of this head's first scope — see the decision in docs/android-port.md — and this is the seam it
-    /// will arrive through rather than a dependency taken before there is anything to depend on.
+    /// How many transfers are moving bytes. A delegate rather than a queue, because ownership of the
+    /// transfer queue stays with <c>TransfersViewModel</c> — this class only ever asks it a question.
     /// </param>
-    public SessionKeepAlive(TerminalWorkspace workspace, Func<int> activeTransfers)
+    /// <param name="holdsFileSession">
+    /// Whether the Files screen holds a live SFTP connection with nothing moving on it — the idle-but-
+    /// connected case a transfer count alone would miss. See <c>TransfersViewModel.HasLiveFileSession</c>.
+    /// </param>
+    public SessionKeepAlive(TerminalWorkspace workspace, Func<int> activeTransfers, Func<bool> holdsFileSession)
     {
         this.workspace = workspace;
         this.activeTransfers = activeTransfers;
+        this.holdsFileSession = holdsFileSession;
 
-        // Raised on whatever thread the pump unwound on, which is fine: starting and stopping a service is
-        // a binder call and needs no particular thread. Nothing here touches the interface.
+        // Raised on whatever thread the workspace announced from — a continuation of the ended run, or the
+        // closer's own — which is fine: starting and stopping a service is a binder call and needs no
+        // particular thread. Nothing here touches the interface. That the announcement waits for the run to
+        // actually complete, and comes for deliberate closes too, is what makes reading LiveSessionCount
+        // from it honest — the event's own remark carries the stuck notification that taught us both.
         workspace.SessionEnded += OnSessionEnded;
     }
 
     /// <summary>Re-reads the counts and starts or stops the service to match.</summary>
     /// <remarks>
-    /// Called after anything that could change either count — opening a shell, closing a tab, a transfer
-    /// finishing. Calling it when nothing changed is free: reconciling to the state it is already in is
-    /// either a redundant <c>startForegroundService</c> on a running service or a <c>stopService</c> on a
-    /// stopped one, and Android treats both as no-ops.
+    /// Called after anything that could change any of the three facts — opening a shell, closing a tab, a
+    /// transfer finishing, a Files connection opening or closing. Calling it when nothing changed is free:
+    /// reconciling to the state it is already in is either a redundant <c>startForegroundService</c> — or,
+    /// now, a redundant notification post — on a running service, or a <c>stopService</c> on a stopped one,
+    /// and Android treats all of those as no-ops.
     /// </remarks>
     public void Refresh() =>
-        SessionForegroundService.Reconcile(workspace.LiveSessionCount, activeTransfers());
+        SessionForegroundService.Reconcile(workspace.LiveSessionCount, activeTransfers(), holdsFileSession());
 
     /// <inheritdoc />
     public void Dispose()
@@ -56,7 +72,7 @@ internal sealed class SessionKeepAlive : IDisposable
 
         // The notification goes with the composition root. Leaving it up over a process that is shutting
         // down is how an SSH client acquires a reputation for a notification you cannot get rid of.
-        SessionForegroundService.Reconcile(0, 0);
+        SessionForegroundService.Reconcile(0, 0, false);
     }
 
     private void OnSessionEnded(object? sender, TerminalSessionEndedEventArgs e) => Refresh();

src/DodoSSH.Client.Android/Platform/TerminalFocus.cs

@@ -0,0 +1,79 @@
+using global::Android.Views;
+
+namespace DodoSSH.Client.Android.Platform;
+
+/// <summary>
+/// Hands native focus back to the terminal's WebView after Avalonia chrome took it.
+/// </summary>
+/// <remarks>
+/// <para>
+/// <b>The sibling of <see cref="SoftKeyboard"/>, and it exists for the same reason that one does:</b> the
+/// keyboard over a terminal belongs to the WebView's own native view, which Avalonia's focus manager does
+/// not own. The accessory row's keys are already <c>Focusable=false</c> — see TerminalScreen — so Avalonia's
+/// idea of focus never leaves the terminal when one is tapped. What still moves is <em>Android's</em>:
+/// <c>AvaloniaView.DispatchTouchEvent</c> (decompiled from Avalonia.Android 12.1.1) ends every handled
+/// touch — DOWN and UP alike — with a <c>RequestFocus()</c> for Avalonia's own view. The WebView's input
+/// connection dies with its focus, the keyboard swaps to the layout it shows an editor that takes no text,
+/// and the inset churn that follows can leave it sitting on top of the very row that was tapped.
+/// </para>
+/// <para>
+/// <b>Posted, not called — the posting is the fix's second attempt, and the first one's failure is why.</b>
+/// The first version called <c>RequestFocus()</c> from the keys' own Click handlers, which fire
+/// <em>inside</em> the UP event's dispatch — and the platform's own request runs <em>after</em> dispatch
+/// returns, so it undid ours a few microseconds later and the terminal stayed unfocused. A posted runnable
+/// runs on the next main-looper message, after the platform has taken its turn, so ours is the request that
+/// sticks. The focus check lives inside the posted runnable for the same reason: the answer at call time is
+/// about to be made stale by the very mechanism this exists to counter.
+/// </para>
+/// <para>
+/// The page inside the WebView never noticed any of this — its own DOM focus never moved — so regaining
+/// native focus re-establishes the same input connection and the keyboard settles back to what it was.
+/// </para>
+/// <para>
+/// Found by walking the decor view rather than asked of the <c>NativeWebView</c> control, because the
+/// control does not expose its platform child and this application only ever has the one WebView — the
+/// walk's first match is necessarily the terminal. Every step is allowed to be absent, exactly as
+/// <see cref="SoftKeyboard.Hide"/>'s are: no activity while backgrounded, no WebView while the terminal
+/// surface has never been shown, and nothing to do in either case.
+/// </para>
+/// </remarks>
+internal static class TerminalFocus
+{
+    public static void Return()
+    {
+        if (PhoneEnvironment.CurrentActivity?.Window?.DecorView is not ViewGroup decor)
+        {
+            return;
+        }
+
+        if (FindWebView(decor) is not { } webView)
+        {
+            return;
+        }
+
+        webView.Post(() =>
+        {
+            if (!webView.IsFocused)
+            {
+                webView.RequestFocus();
+            }
+        });
+    }
+
+    private static View? FindWebView(ViewGroup parent)
+    {
+        for (var i = 0; i < parent.ChildCount; i++)
+        {
+            switch (parent.GetChildAt(i))
+            {
+                case global::Android.Webkit.WebView webView:
+                    return webView;
+
+                case ViewGroup child when FindWebView(child) is { } found:
+                    return found;
+            }
+        }
+
+        return null;
+    }
+}

src/DodoSSH.Client.Android/Properties/AndroidManifest.xml

@@ -12,7 +12,12 @@
   <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
   <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
 
-  <!-- The service's persistent notification. Runtime-requested on API 33+, and refusal is survivable. -->
+  <!--
+    The service's persistent notification. Requested on API 33+ from SessionForegroundService.Reconcile,
+    the first time in this process there is actually something to show — not at launch, where the ask
+    would justify nothing on screen yet. Refusal is survivable: the service still starts and still holds
+    the process in the foreground either way, so a "no" costs the notification and nothing else.
+  -->
   <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
 
   <!-- Releases the device key. See AndroidDeviceKeyStore. -->

src/DodoSSH.Client.Android/Theme/Phone.axaml

@@ -12,10 +12,28 @@
     the alternative, and the red one is the one that costs something.
 
     ── v2 ──────────────────────────────────────────────────────────────────────────────────────────────
-    The second design rounds everything. The corner radii below are the design's own — 4 for a tag, 9 for a
-    button or a pill, 10 for a list row, 11 for the search well, 12 for a card, 14 for a block of
-    monospaced output — and they are a ladder rather than a set of preferences: the radius says how big the
-    thing is, so a 12 on a chip or a 4 on a card reads as the wrong size before it reads as the wrong shape.
+    The second design rounded everything on its own ladder — 4 for a tag, 9 for a button or a pill, 10 for
+    a list row, 11 for the search well, 12 for a card, 14 for a block of monospaced output — and the numbers
+    below carried it for three passes: the radius said how big the thing was, so a 12 on a chip or a 4 on a
+    card read as the wrong size before it read as the wrong shape. Left as a record of that reasoning rather
+    than deleted, because the reasoning still holds; only the numbers it was reasoning about have moved.
+
+    ── v5 ──────────────────────────────────────────────────────────────────────────────────────────────
+    This pass takes the desktop's v5 ladder instead of v2's own, on the same reversal recorded for the
+    fonts: the phone now matches the desktop's shape as well as its face. Three rungs rather than six —
+    cards and sections stay 12, a button or a field is 10, a chip or a tag is 6 — collapsing v2's 9/10/11
+    into the one value the desktop's buttons and fields already use, and moving its 4 up to 6 and its 14
+    down to 12 to land on the desktop's own chip and card numbers. The ladder still says how big a thing
+    is before it says what shape it is; it is just a shorter ladder now, because the desktop it is copying
+    never drew v2's 11-radius search well or a card any rounder than a chip's neighbour a step away, and the
+    same case that closed the gap between 9, 10 and 11 closes the one between 12 and 14.
+
+    Not every radius on this head belongs to this ladder. The floating action button is 28 — half its own
+    56, which is a circle rather than a ladder rung — and the sheets stay at 22 on their top corners only,
+    which is a phone idiom this codebase's own bottom sheets have used since v2 and the desktop draws
+    nothing like. Both are documented where they are set rather than here, for the reason FAB and sheet
+    radii are always documented locally: a reader who only ever meets one of them should not have to find
+    this paragraph to learn it was deliberate.
   -->
 
   <Style Selector="Button.primary">
@@ -23,15 +41,32 @@
     <Setter Property="HorizontalAlignment" Value="Stretch" />
     <Setter Property="HorizontalContentAlignment" Value="Center" />
     <Setter Property="VerticalContentAlignment" Value="Center" />
-    <Setter Property="Background" Value="{StaticResource Accent}" />
     <Setter Property="Foreground" Value="{StaticResource AccentInk}" />
-    <Setter Property="CornerRadius" Value="9" />
+    <Setter Property="CornerRadius" Value="10" />
     <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
     <Setter Property="FontSize" Value="12" />
     <Setter Property="FontWeight" Value="SemiBold" />
   </Style>
+
+  <!--
+    ◆ Gradient and glow, replacing a flat Accent fill — the same swap App.axaml's Button.accent made on the
+    desktop, and for the same reason: this design draws every primary button top-to-bottom from a lighter
+    violet into the accent proper, lifted off the surface with a soft violet glow rather than a border. Both
+    live in Palette.axaml as AccentGradient and AccentGlow, already resolvable here because the palette is
+    shared — this is a resource-key swap, not new colour.
+
+    Background and BoxShadow are set here rather than as plain Setters above, because Fluent's default
+    button template only lets a style reach the fill and the glow through the ContentPresenter it draws
+    itself around — the same reason the desktop's rule targets /template/ ContentPresenter rather than the
+    Button. Height, radius and the rest stay ordinary Setters on Button.primary itself; only the two the
+    template intercepts move down here.
+  -->
+  <Style Selector="Button.primary /template/ ContentPresenter">
+    <Setter Property="Background" Value="{StaticResource AccentGradient}" />
+    <Setter Property="BoxShadow" Value="{StaticResource AccentGlow}" />
+  </Style>
   <Style Selector="Button.primary:pressed /template/ ContentPresenter">
-    <Setter Property="Background" Value="{StaticResource Accent}" />
+    <Setter Property="Background" Value="{StaticResource AccentGradient}" />
     <Setter Property="Opacity" Value="0.82" />
   </Style>
 
@@ -39,9 +74,15 @@
     Disabled is drawn as flat and unlit rather than merely dimmed. The design's CONTINUE button on the
     recovery screen is disabled until the checkbox is ticked, and a user who cannot tell it is disabled
     reads the screen as broken rather than as waiting for them.
+
+    BoxShadow has to be cleared here too, as "none" rather than left unset — see the remark on
+    Button.accent:disabled in the desktop's App.axaml for why the literal string is required and an empty
+    BoxShadows is not: the base rule's glow Setter is still in effect wherever a more specific one does not
+    override it, and a disabled primary button lit with a glow would read as wanting to be pressed.
   -->
   <Style Selector="Button.primary:disabled /template/ ContentPresenter">
     <Setter Property="Background" Value="{StaticResource Raised}" />
+    <Setter Property="BoxShadow" Value="none" />
     <Setter Property="TextElement.Foreground" Value="{StaticResource TextFaint}" />
   </Style>
 
@@ -54,7 +95,7 @@
     <Setter Property="BorderBrush" Value="{StaticResource BorderMid}" />
     <Setter Property="BorderThickness" Value="1" />
     <Setter Property="Foreground" Value="{StaticResource Text}" />
-    <Setter Property="CornerRadius" Value="9" />
+    <Setter Property="CornerRadius" Value="10" />
     <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
     <Setter Property="FontSize" Value="11.5" />
     <Setter Property="FontWeight" Value="SemiBold" />
@@ -69,17 +110,33 @@
     <Setter Property="BorderBrush" Value="{StaticResource DangerSoft}" />
     <Setter Property="BorderThickness" Value="1" />
     <Setter Property="Foreground" Value="{StaticResource Danger}" />
-    <Setter Property="CornerRadius" Value="9" />
+    <Setter Property="CornerRadius" Value="10" />
     <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
     <Setter Property="FontSize" Value="10.5" />
     <Setter Property="FontWeight" Value="SemiBold" />
   </Style>
 
-  <!-- A row in a list: the whole row is the target, and it is 54 tall because a thumb is not a mouse. -->
+  <!--
+    A row in a list: the whole row is the target, and it is 54 tall because a thumb is not a mouse.
+
+    ◆ VerticalContentAlignment, because that height is the whole point of this class and Avalonia's default
+    for content alignment is Stretch — so the content presenter stretched the caption to the full row and a
+    TextBlock draws its line at the TOP of what it is given. Most rows here never showed it, having a
+    StackPanel or a Grid of already-centred children in them, which is what made the four that did look
+    like four unrelated mistakes: the breadcrumb chips and the up-one-directory button on FilesScreen, and
+    TerminalScreen's CLOSE THIS TAB, each a bare TextBlock in a row 36 or 44 tall with no vertical padding.
+    Measured at those numbers, the caption sat flush against the top edge with 21 to 33 pixels below it.
+
+    The desktop head's App.axaml carries the same setter on its own shapes for the same reason, and excludes
+    two of them — see the remark on Button.ghost there. Nothing is excluded here: no row's content depends
+    on being stretched, there being no full-height strip inside any of the thirty-three, and the Grids that
+    stop filling hold only children that already centre themselves, so they land where they always did.
+  -->
   <Style Selector="Button.row">
     <Setter Property="MinHeight" Value="54" />
     <Setter Property="HorizontalAlignment" Value="Stretch" />
     <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+    <Setter Property="VerticalContentAlignment" Value="Center" />
     <Setter Property="Background" Value="Transparent" />
     <Setter Property="BorderThickness" Value="0" />
     <Setter Property="CornerRadius" Value="10" />
@@ -126,7 +183,17 @@
 
     Accent-filled, which it shares with Button.primary and with nothing else — and it means the same thing
     in both places: the one action on the surface that is not a choice between peers. Circular by radius
-    rather than by a Path, so the pressed state the template draws is the same shape as the button.
+    rather than by a Path, so the pressed state the template draws is the same shape as the button — 28,
+    exactly half its own 56, which is a geometric constraint rather than a ladder rung and does not move
+    with the rest of this file's radii.
+
+    ◆ Gradient and glow since v5, matching Button.primary rather than staying a flat fill once that one
+    moved. The two are the only accent-filled controls on this head and are read as one idea — "the thing
+    this surface wants you to do" — so a flat FAB beside a gradient primary button would be the seam this
+    codebase's palette file keeps warning about, one screenshot over from the button it echoes. The glow
+    reads as well on a floating circle as it does on a bar-anchored rectangle: if anything a control that
+    already floats over content earns a lift more than one sitting in a row of chrome does, so it is kept
+    rather than dropped for the FAB's own shape.
 
     Still only on HOSTS. The design puts a second one on S3 and that editor genuinely does not exist yet, so
     the style being here is not permission to draw one there.
@@ -135,7 +202,6 @@
     <Setter Property="Width" Value="56" />
     <Setter Property="Height" Value="56" />
     <Setter Property="Padding" Value="0" />
-    <Setter Property="Background" Value="{StaticResource Accent}" />
     <Setter Property="BorderThickness" Value="0" />
     <Setter Property="CornerRadius" Value="28" />
     <Setter Property="HorizontalContentAlignment" Value="Center" />
@@ -145,8 +211,14 @@
     <Setter Property="FontSize" Value="24" />
     <Setter Property="FontWeight" Value="SemiBold" />
   </Style>
+  <!-- See the remark above Button.primary's own /template/ ContentPresenter rule: BoxShadow has no home on
+       a Button itself, so the fill moves down here alongside it rather than staying a plain Setter. -->
+  <Style Selector="Button.fab /template/ ContentPresenter">
+    <Setter Property="Background" Value="{StaticResource AccentGradient}" />
+    <Setter Property="BoxShadow" Value="{StaticResource AccentGlow}" />
+  </Style>
   <Style Selector="Button.fab:pressed /template/ ContentPresenter">
-    <Setter Property="Background" Value="{StaticResource Accent}" />
+    <Setter Property="Background" Value="{StaticResource AccentGradient}" />
     <Setter Property="Opacity" Value="0.82" />
   </Style>
 
@@ -194,7 +266,7 @@
   -->
   <Style Selector="Border.output">
     <Setter Property="Background" Value="{StaticResource TerminalSurface}" />
-    <Setter Property="CornerRadius" Value="14" />
+    <Setter Property="CornerRadius" Value="12" />
     <Setter Property="Padding" Value="12" />
   </Style>
 
@@ -205,7 +277,7 @@
   -->
   <Style Selector="Border.tag">
     <Setter Property="Background" Value="{StaticResource Chip}" />
-    <Setter Property="CornerRadius" Value="4" />
+    <Setter Property="CornerRadius" Value="6" />
     <Setter Property="Padding" Value="7,2" />
     <Setter Property="VerticalAlignment" Value="Center" />
   </Style>
@@ -231,7 +303,7 @@
     <Setter Property="Background" Value="Transparent" />
     <Setter Property="BorderBrush" Value="{StaticResource BorderMid}" />
     <Setter Property="BorderThickness" Value="1" />
-    <Setter Property="CornerRadius" Value="4" />
+    <Setter Property="CornerRadius" Value="6" />
     <Setter Property="Padding" Value="11,0" />
     <Setter Property="Foreground" Value="{StaticResource TextDim}" />
     <Setter Property="VerticalContentAlignment" Value="Center" />
@@ -267,11 +339,17 @@
     Checked is a filled surface with accent *text*, not an accent fill. v2 makes that distinction
     everywhere — see the remark on AccentText in Palette.axaml — and a chip is where it matters most: a row
     of four solid blue lozenges is a row of four things that all look like the primary action.
+
+    ◆ Its own radius rather than Border.tag's or Button.chiptoggle's, despite the name. v2 drew this control
+    on the ladder's button-or-pill rung rather than its tag rung — 9, not 4 — and the v5 pass carries the
+    same rung forward to 10 rather than to Border.tag's 6: it is a much larger control at 34 tall against a
+    tag's line-height, and a radius picked for a 34-pixel chip is not the one a 20-pixel tag needs, whatever
+    the class is called. See the remark on Phone.axaml's own ladder, above.
   -->
   <Style Selector="RadioButton.chip">
     <Setter Property="MinHeight" Value="34" />
     <Setter Property="Padding" Value="13,6" />
-    <Setter Property="CornerRadius" Value="9" />
+    <Setter Property="CornerRadius" Value="10" />
     <Setter Property="Background" Value="Transparent" />
     <Setter Property="BorderBrush" Value="{StaticResource BorderMid}" />
     <Setter Property="BorderThickness" Value="1" />
@@ -314,7 +392,7 @@
     <Setter Property="Background" Value="{StaticResource Field}" />
     <Setter Property="BorderBrush" Value="{StaticResource BorderMid}" />
     <Setter Property="BorderThickness" Value="1" />
-    <Setter Property="CornerRadius" Value="11" />
+    <Setter Property="CornerRadius" Value="10" />
     <Setter Property="Foreground" Value="{StaticResource Text}" />
     <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
     <Setter Property="FontSize" Value="12" />

src/DodoSSH.Client.Android/Views/FilesScreen.axaml

@@ -48,7 +48,7 @@
     the refusal has no continue button here either.
   -->
 
-  <Grid RowDefinitions="Auto,Auto,Auto,Auto,*,Auto">
+  <Grid RowDefinitions="Auto,Auto,Auto,Auto,Auto,*,Auto">
 
     <!-- ============ header ============ -->
     <Grid Grid.Row="0" ColumnDefinitions="Auto,Auto,*,Auto" Height="56" Margin="8,0">
@@ -178,7 +178,7 @@
     <ScrollViewer Grid.Row="3" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled"
                   IsVisible="{Binding IsConnected}" Margin="0,0,0,4">
       <StackPanel Orientation="Horizontal" Spacing="4" Margin="14,0" VerticalAlignment="Center">
-        <Button Classes="row" MinHeight="36" Padding="9,0" CornerRadius="9"
+        <Button Classes="row" MinHeight="36" Padding="9,0" CornerRadius="10"
                 Command="{Binding RemoteUpCommand}">
           <TextBlock Classes="mono" FontSize="12" Text="↑" Foreground="{StaticResource AccentText}" />
         </Button>
@@ -188,7 +188,7 @@
           </ItemsControl.ItemsPanel>
           <ItemsControl.ItemTemplate>
             <DataTemplate x:DataType="vm:CrumbViewModel">
-              <Button Classes="row" MinHeight="36" Padding="7,0" CornerRadius="9"
+              <Button Classes="row" MinHeight="36" Padding="7,0" CornerRadius="10"
                       Command="{Binding $parent[views:FilesScreen].((vm:TransfersViewModel)DataContext).GoRemoteCommand}"
                       CommandParameter="{Binding Path}">
                 <TextBlock Classes="detail" FontSize="11" Text="{Binding Name}" />
@@ -199,8 +199,48 @@
       </StackPanel>
     </ScrollViewer>
 
+    <!-- ============ pins ============ -->
+    <!--
+      ◆ The phone's answer to the desktop's QUICK ACCESS sidebar — the same PinnedPathList this host was
+      connected with, drawn where this head actually browses files rather than beside a terminal it has no
+      strip for. See TransfersViewModel.ConnectedPinnedPaths for why this is a snapshot taken at connect
+      rather than a live follow of the host row: a pin added or removed mid-session shows up here on the
+      next connect, not while this one is still open.
+
+      Its own row rather than folded into the breadcrumb above: the two scroll independently and mean
+      different things — the breadcrumb is where this pane is, the chips are places it can jump to — and a
+      shared row would make ↑ look like one more pin among several.
+
+      Gone rather than empty when nothing is pinned or nothing is connected, which HasConnectedPins already
+      answers: an empty scrolling strip under the breadcrumb would read as a loading row rather than as
+      "this host has nothing pinned".
+    -->
+    <ScrollViewer Grid.Row="4" HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled"
+                  IsVisible="{Binding HasConnectedPins}" Margin="0,0,0,4">
+      <ItemsControl ItemsSource="{Binding ConnectedPinnedPaths}">
+        <ItemsControl.ItemsPanel>
+          <ItemsPanelTemplate><StackPanel Orientation="Horizontal" Spacing="6" Margin="14,0" /></ItemsPanelTemplate>
+        </ItemsControl.ItemsPanel>
+        <ItemsControl.ItemTemplate>
+          <DataTemplate x:DataType="x:String">
+            <!--
+              Classes="row" at its default 44dp MinHeight rather than the breadcrumb's own 36 — these chips
+              are the destination, not the trail behind it, and a target worth a deliberate tap gets the
+              full touch floor this head holds everything else to. Not trimmed: a chip scrolls sideways with
+              the row rather than being squeezed to fit it, so the full path is always what a tap commits to.
+            -->
+            <Button Classes="row" MinHeight="44" Padding="11,0" CornerRadius="10"
+                    Command="{Binding $parent[views:FilesScreen].((vm:TransfersViewModel)DataContext).GoRemoteCommand}"
+                    CommandParameter="{Binding}">
+              <TextBlock Classes="mono" FontSize="12" Text="{Binding}" />
+            </Button>
+          </DataTemplate>
+        </ItemsControl.ItemTemplate>
+      </ItemsControl>
+    </ScrollViewer>
+
     <!-- ============ the listing ============ -->
-    <Panel Grid.Row="4">
+    <Panel Grid.Row="5">
 
       <TextBlock Classes="body" IsVisible="{Binding !IsConnected}" Margin="24,12"
                  VerticalAlignment="Top" Text="{Binding Status}" />
@@ -265,7 +305,8 @@
     </Panel>
 
     <!-- ============ what to do with the chosen entry ============ -->
-    <Border Grid.Row="5" IsVisible="{Binding IsConnected}" Background="{StaticResource Chrome}"
+    <!-- DeepChrome rather than Chrome, since v5 — see the remark on PhoneShell's vault header. -->
+    <Border Grid.Row="6" IsVisible="{Binding IsConnected}" Background="{StaticResource DeepChrome}"
             BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0" Padding="12,10">
       <StackPanel Spacing="9">
 

src/DodoSSH.Client.Android/Views/HostActionBar.axaml

@@ -29,7 +29,9 @@
     of "edit these six". The three that stay are the ones a count makes better rather than worse.
   -->
 
-  <Border Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+  <!-- DeepChrome rather than Chrome, since v5: this bar takes the vault header's own place, so it takes
+       the vault header's own surface too — see the remark on that header in PhoneShell.axaml. -->
+  <Border Background="{StaticResource DeepChrome}" BorderBrush="{StaticResource Border}"
           BorderThickness="0,0,0,1" Padding="6,0" Height="56">
     <Grid ColumnDefinitions="Auto,*,Auto,Auto">
 

src/DodoSSH.Client.Android/Views/HostsScreen.axaml

@@ -68,7 +68,7 @@
       of a selection and ticking it is a thing this screen supports rather than merely survives.
     -->
     <Border Grid.Row="0" Margin="14,10,14,4" Background="{StaticResource Field}"
-            BorderBrush="{StaticResource BorderMid}" BorderThickness="1" CornerRadius="11" Height="44">
+            BorderBrush="{StaticResource BorderMid}" BorderThickness="1" CornerRadius="10" Height="44">
       <Grid ColumnDefinitions="Auto,*">
         <TextBlock Grid.Column="0" Text="⌕" Foreground="{StaticResource TextFaint}" FontSize="13"
                    Margin="13,0,0,0" VerticalAlignment="Center" />
@@ -974,7 +974,10 @@
     <Grid IsVisible="{Binding IsEditing}" RowDefinitions="Auto,*"
           Background="{StaticResource Canvas}">
 
-      <Border Grid.Row="0" Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+      <!-- DeepChrome rather than Chrome, since v5: "its header carries what the surrounding chrome no longer
+           can" below is still true, and now the header itself carries the darker chrome the rest of this
+           head's frame does — see the remark on PhoneShell's vault header. -->
+      <Border Grid.Row="0" Background="{StaticResource DeepChrome}" BorderBrush="{StaticResource Border}"
               BorderThickness="0,0,0,1" Padding="6,0" Height="56">
         <Grid ColumnDefinitions="Auto,*,Auto">
           <Button Grid.Column="0" Classes="icon" Content="←" Command="{Binding CancelEditCommand}"
@@ -1095,6 +1098,60 @@
                     Command="{Binding AddEditorTagCommand}" />
           </Grid>
 
+          <!--
+            ◆ QUICK ACCESS. Staged on the shared VaultViewModel.EditorPinnedPaths the way EditorTagChoices
+            stages tags above — populated when the editor opens, read back by BuildHost on SAVE, left alone
+            by CANCEL. Nothing here is phone-only: a pin added on this page is the same PinnedPathList entry
+            the desktop's drawer stages under the same field, so it syncs to every other client the moment
+            this vault does, exactly as a tag would.
+
+            No folder glyph in the row, unlike the desktop's — this head carries MonoFont and a heading font
+            (see Theme/Phone.axaml) and no icon font, so the desktop's &#xE2C7; would draw as a tofu box
+            rather than a folder here. The path text carries the row on its own, trimmed in a Grid's star
+            column rather than a StackPanel's — a StackPanel measures its children at infinity, so
+            TextTrimming never actually engages inside one; this is the same fix TransfersScreen's pane
+            headers needed for the same reason.
+
+            The remove button is Classes="icon" at its default 44x44, not the desktop's 22x22 close box —
+            see this file's touch-floor rule at the top of the class: a target sized for a mouse pointer is
+            not one a thumb can reliably land on.
+
+            See surface B, the Files screen's pin chips, for where these pins actually get used on this
+            head — the hint sentence below names it rather than the desktop's terminal strip, which does
+            not exist here.
+          -->
+          <TextBlock Classes="label" Text="QUICK ACCESS" Margin="0,4,0,0" />
+
+          <ItemsControl ItemsSource="{Binding EditorPinnedPaths}">
+            <ItemsControl.ItemsPanel>
+              <ItemsPanelTemplate><StackPanel Spacing="6" /></ItemsPanelTemplate>
+            </ItemsControl.ItemsPanel>
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="x:String">
+                <Border MinHeight="44" CornerRadius="10" Background="{StaticResource Field}"
+                        BorderBrush="{StaticResource BorderMid}" BorderThickness="1" Padding="12,0">
+                  <Grid ColumnDefinitions="*,Auto">
+                    <TextBlock Grid.Column="0" Classes="mono" FontSize="12.5" Text="{Binding}"
+                               VerticalAlignment="Center" TextTrimming="CharacterEllipsis" />
+                    <Button Grid.Column="1" Classes="icon" Content="✕"
+                            Command="{Binding $parent[ItemsControl].((vm:VaultViewModel)DataContext).RemoveEditorPinCommand}"
+                            CommandParameter="{Binding}" ToolTip.Tip="Unpins this path" />
+                  </Grid>
+                </Border>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+
+          <Grid ColumnDefinitions="*,8,Auto">
+            <TextBox Grid.Column="0" Classes="field" Text="{Binding EditorNewPin}"
+                     PlaceholderText="/path/to/folder" />
+            <Button Grid.Column="2" Classes="secondary" Height="44" Width="72" Content="ADD"
+                    Command="{Binding AddEditorPinCommand}" />
+          </Grid>
+
+          <TextBlock Classes="body"
+                     Text="Pins show up as chips on the Files screen while you are connected to this host — tap one to jump straight there." />
+
           <!--
             ◆ The one control here that publishes something. Turning it on copies this host's address and
             port into plaintext columns the server can read, which is the single deliberate concession in
@@ -1114,6 +1171,18 @@
           <TextBlock Classes="body"
                      Text="Not built yet: this app always dials the host itself, so ticking this stores the address on the server and changes nothing about how the host is reached. When it works, the relay will dial on your behalf — which is why the address and port have to be stored in the clear. Everything else about the host stays encrypted either way, and a relayed host needs a port of its own rather than its group's." />
 
+          <!--
+            This page covers the whole screen while it is open, which is why it needs a Status line of its
+            own rather than relying on the one the list behind it draws at the top of HOSTS (see this file's
+            other Classes="detail" Text="{Binding Status}") — that TextBlock is off-screen for as long as
+            IsEditing is true. AddEditorTagCommand and AddEditorPinCommand both refuse silently into Status
+            rather than throwing, so without a line to draw it here the honesty rule would be broken: a
+            refusal that writes a message nothing on screen shows is the same, to whoever pressed ADD, as no
+            refusal at all.
+          -->
+          <TextBlock Classes="detail" Text="{Binding Status}" TextWrapping="Wrap"
+                     IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+
           <Grid ColumnDefinitions="*,8,*" Margin="0,6,0,0">
             <Button Grid.Column="0" Classes="primary" Height="44" Content="SAVE"
                     Command="{Binding SaveHostCommand}" />

src/DodoSSH.Client.Android/Views/LockedScreen.axaml

@@ -91,8 +91,8 @@
 
           Not Border.card, and neither are its two counterparts on HOSTS and FILES: that class is a panel,
           and this is a warning, so the background and the border are the warn pair rather than the chrome
-          one. What it does take is the radius the v2 ladder gives anything card-sized, which is what the
-          other two already draw.
+          one. What it does take is the radius the ladder gives anything card-sized — 12, unchanged from v2
+          to v5 — which is what the other two already draw.
         -->
         <Border IsVisible="{Binding HasLiveSessions}" Margin="0,22,0,0"
                 Background="{StaticResource WarnWash}" BorderBrush="{StaticResource WarnSoft}"

src/DodoSSH.Client.Android/Views/PhoneRail.axaml

@@ -36,6 +36,18 @@
     The .railentry styles live in this file because they are this control's own shape and nothing else wears
     them; every colour in them is resolved from Theme/Palette.axaml by key, which is the rule that matters —
     a rail that named its own blues is how a fifth surface colour ends up in the application.
+
+    ── DEEP CHROME, SINCE v5 ───────────────────────────────────────────────────────────────────────────────
+    This rail's own surface moves from Sidebar to DeepChrome in this pass, matching the desktop's NavRail —
+    which is exactly what this control is standing in for on a wide phone, and which took the same v5b move
+    itself: Palette.axaml's own remark on DeepChrome names "the rail down the side" as one of the five things
+    that colour is for. Sidebar stays what a card sits on; this is the frame the cards sit inside, the same
+    distinction PhoneShell's header, strip and bottom bar are drawing at the same time.
+
+    The hover fill moves too, from Panel to Track — and Track rather than Hover, because Palette.axaml's own
+    remark on Track names "the rail row a pointer sits over" as one of the three things that colour is for,
+    literally. Panel was never named for this; it read close enough that nobody had gone looking for the
+    seam, which is exactly the kind of gap Track exists to close.
   -->
 
   <UserControl.Styles>
@@ -54,7 +66,7 @@
     </Style>
 
     <Style Selector="Button.railentry:pointerover /template/ ContentPresenter">
-      <Setter Property="Background" Value="{StaticResource Panel}" />
+      <Setter Property="Background" Value="{StaticResource Track}" />
     </Style>
 
     <Style Selector="Button.railentry.active /template/ ContentPresenter">
@@ -96,7 +108,7 @@
     </Style>
   </UserControl.Styles>
 
-  <Border Width="188" Background="{StaticResource Sidebar}"
+  <Border Width="188" Background="{StaticResource DeepChrome}"
           BorderBrush="{StaticResource Border}" BorderThickness="0,0,1,0">
 
     <!--

src/DodoSSH.Client.Android/Views/PhoneShell.axaml

@@ -97,7 +97,16 @@
         the surface. See PhoneShell.ShowsVaultHeader.
       -->
       <Panel Grid.Row="0" IsVisible="{Binding $parent[views:PhoneShell].ShowsVaultHeader}">
-        <Border Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+        <!--
+          ◆ DeepChrome rather than Chrome, since v5. The desktop's own titlebar and nav rail made the same
+          move in v5b — one step darker than Chrome, #0B0B14 against #10111E, so the frame reads as what
+          holds the glass rather than as another pane of it — and this header is the phone's equivalent
+          furniture: it is what the desktop's titlebar is, on the surface that has no window to carry one.
+          HostActionBar, which takes this header's own place while hosts are selected, and the editor's
+          header in HostsScreen, which the header stands down for, both move with it for the same reason;
+          see the remark on each.
+        -->
+        <Border Background="{StaticResource DeepChrome}" BorderBrush="{StaticResource Border}"
                 BorderThickness="0,0,0,1" Padding="14,0" Height="56">
           <Grid ColumnDefinitions="Auto,*,Auto,Auto">
 
@@ -288,7 +297,10 @@
         PhoneShell.ShowsShellStrip, which is where that "and" is made, Avalonia's bindings having none.
       -->
       <Panel Grid.Row="2" IsVisible="{Binding $parent[views:PhoneShell].ShowsShellStrip}">
-        <Border IsVisible="{Binding HasTabs}" Background="{StaticResource Sidebar}"
+        <!-- DeepChrome rather than Sidebar, since v5, joining the header and the bar above and below it:
+             the strip is chrome the same way they are — a frame around the screen rather than a pane of
+             it — and Sidebar is what a card sits on, which this row is not. -->
+        <Border IsVisible="{Binding HasTabs}" Background="{StaticResource DeepChrome}"
                 BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0" Height="46">
           <ScrollViewer HorizontalScrollBarVisibility="Auto" VerticalScrollBarVisibility="Disabled">
             <ItemsControl ItemsSource="{Binding Tabs}" Margin="12,0" VerticalAlignment="Center">
@@ -297,7 +309,7 @@
               </ItemsControl.ItemsPanel>
               <ItemsControl.ItemTemplate>
                 <DataTemplate x:DataType="vm:TerminalTabViewModel">
-                  <Button Classes="row" MinHeight="34" Padding="13,0" CornerRadius="9"
+                  <Button Classes="row" MinHeight="34" Padding="13,0" CornerRadius="10"
                           Background="{StaticResource Panel}" BorderBrush="{StaticResource BorderMid}"
                           BorderThickness="1"
                           Command="{Binding $parent[views:PhoneShell].((vm:MainWindowViewModel)DataContext).SelectTabCommand}"
@@ -341,8 +353,10 @@
         shape of everything else already behind the hub. What is left is the two halves of using this
         application, and the drawer holding the rest.
       -->
+      <!-- DeepChrome rather than Chrome, since v5 — see the remark on the vault header, above, which this
+           bar is the foot of the same frame the header is the top of. -->
       <Border Grid.Row="3" IsVisible="{Binding $parent[views:PhoneShell].ShowsBottomBar}"
-              Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+              Background="{StaticResource DeepChrome}" BorderBrush="{StaticResource Border}"
               BorderThickness="0,1,0,0" Height="64">
         <Grid ColumnDefinitions="*,*,*">
 

src/DodoSSH.Client.Android/Views/RecoveryCodeScreen.axaml

@@ -36,8 +36,16 @@
         good way to read a code and a bad way to copy one: a user who cannot select it will photograph the
         screen, and that is a worse home for it than their clipboard.
       -->
+      <!--
+        ◆ CornerRadius 12, not 6. Its padding, 14,13, is Border.card's own — this box was already drawn to a
+        card's proportions, in every dimension but the corner — so under v2's ladder 6 was an outlier this
+        file never explained. It is worse than unexplained now: v5's ladder gives 6 to a chip, and a
+        full-width box holding the one secret this whole screen exists to show is not a chip wearing a
+        card's padding by coincidence. 12 is what a card-shaped box gets on this ladder, and this one always
+        was one.
+      -->
       <Border Margin="0,20,0,0" Background="{StaticResource Field}" BorderBrush="{StaticResource BorderMid}"
-              BorderThickness="1" CornerRadius="6" Padding="14,13">
+              BorderThickness="1" CornerRadius="12" Padding="14,13">
         <SelectableTextBlock Text="{Binding RecoveryCode}"
                              FontFamily="{StaticResource MonoFont}" FontSize="14"
                              Foreground="{StaticResource Accent}"

src/DodoSSH.Client.Android/Views/ServerScreen.axaml

@@ -20,9 +20,17 @@
       <StackPanel Spacing="10" HorizontalAlignment="Center" Margin="0,48,0,36">
         <!--
           Filled rather than outlined since v2, the same mark the header, the desktop titlebar and the
-          launcher icon carry. The radius is not picked: the mark runs 6 at 20 and 8 at 26, which is a
-          third of a unit per unit of tile and lands on 14 at 44 — and 14 is a rung of Phone.axaml's
-          ladder, the one for a block of monospaced output, which is what this is.
+          launcher icon carry. The radius is not picked: the mark runs 6 at 20 and 8 at 26, a third of a
+          unit per unit of tile, and lands on 14 at 44.
+
+          ◆ That used to be a rung of Phone.axaml's own ladder too — 14, the one for a block of monospaced
+          output, which this glyph reads as — and the coincidence was worth a sentence: one fewer number
+          the ladder had to introduce. It is a coincidence no longer. v5's ladder moves output to 12 and
+          never reaches 14 at all, so the mark's own 6/8/14 progression stands on its own now rather than
+          borrowing a card- or output-shaped justification — a self-contained proportion for a badge that
+          answers to nothing but its own three sizes. Left at 14 rather than moved to 12 with everything
+          else: the ladder governs content surfaces, and this is a mark, sized off its own tile rather than
+          off what it holds.
         -->
         <Border Width="44" Height="44" CornerRadius="14" Background="{StaticResource Accent}"
                 HorizontalAlignment="Center">

src/DodoSSH.Client.Android/Views/SnippetsScreen.axaml

@@ -156,8 +156,12 @@
                   </Border>
                 </StackPanel>
 
-                <!-- The command, on the surface every block of monospace in this design is drawn on. -->
-                <Border Classes="output" CornerRadius="9" Padding="11,9">
+                <!-- The command, on the surface every block of monospace in this design is drawn on.
+                     No radius override any more: it diverged from Border.output's own 14 under v2 for a
+                     smaller card-nested block, and now that the style's own value has moved to 12 there is
+                     no gap left worth a second number for — it takes the class's, like every other output
+                     block on this head. -->
+                <Border Classes="output" Padding="11,9">
                   <TextBlock Classes="mono" FontSize="11" Text="{Binding Preview}"
                              Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
                 </Border>
@@ -174,8 +178,12 @@
       second column to put it in. Both buttons name the terminal — "TYPE INTO pg-primary" — because on a
       phone the tab strip may be scrolled away and "whatever is in the terminal receives this" is not a
       sentence anybody should have to guess the subject of.
+
+      DeepChrome rather than Chrome, since v5: this bar is chrome furniture in the same sense the bottom
+      nav bar it sits above is — a raised strip of frame rather than a pane of content — and joins the same
+      DeepChrome decision PhoneShell's header, strip and bar made. See the remark there.
     -->
-    <Border Grid.Row="4" IsVisible="{Binding HasSelection}" Background="{StaticResource Chrome}"
+    <Border Grid.Row="4" IsVisible="{Binding HasSelection}" Background="{StaticResource DeepChrome}"
             BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0" Padding="14,12"
             IsEnabled="{Binding !IsEditing}">
       <StackPanel Spacing="9">

src/DodoSSH.Client.Android/Views/TerminalScreen.axaml

@@ -49,7 +49,10 @@
       to 34, the pills to 30 — because a bar that shrank around controls that did not would only have moved
       the clipping somewhere harder to see.
     -->
-    <Border Grid.Row="0" Height="35" Background="{StaticResource Chrome}"
+    <!-- DeepChrome rather than Chrome, since v5: this bar is what the vault header, the strip and the
+         bottom bar collapse into while a shell is showing, so it takes their surface along with their
+         job — see the remark on the header in PhoneShell.axaml. -->
+    <Border Grid.Row="0" Height="35" Background="{StaticResource DeepChrome}"
             BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
       <Grid ColumnDefinitions="Auto,*,Auto">
 
@@ -87,9 +90,9 @@
                   row where nothing sits above or below it to be hit by mistake.
                 -->
                 <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource BorderMid}"
-                        BorderThickness="1" CornerRadius="9" Height="30">
+                        BorderThickness="1" CornerRadius="10" Height="30">
                   <StackPanel Orientation="Horizontal">
-                    <Button Classes="row" MinHeight="28" Padding="11,0" CornerRadius="9"
+                    <Button Classes="row" MinHeight="28" Padding="11,0" CornerRadius="10"
                             VerticalContentAlignment="Center"
                             Command="{Binding $parent[views:TerminalScreen].((vm:MainWindowViewModel)DataContext).SelectTabCommand}"
                             CommandParameter="{Binding}">
@@ -116,7 +119,7 @@
                       It reads as a misprint, which for the control that ends a session is the wrong thing
                       to look like.
                     -->
-                    <Button Classes="row" MinHeight="28" Width="44" Padding="0" CornerRadius="0,9,9,0"
+                    <Button Classes="row" MinHeight="28" Width="44" Padding="0" CornerRadius="0,10,10,0"
                             HorizontalContentAlignment="Center" VerticalContentAlignment="Center"
                             BorderBrush="{StaticResource BorderMid}" BorderThickness="1,0,0,0"
                             Command="{Binding $parent[views:TerminalScreen].((vm:MainWindowViewModel)DataContext).CloseTabCommand}"
@@ -362,7 +365,7 @@
           <Border Width="1" Height="18" Background="{StaticResource Border}" Margin="0,0,3,0"
                   VerticalAlignment="Center" />
 
-          <Button Classes="row" MinHeight="30" Height="30" MinWidth="40" Padding="0" CornerRadius="9"
+          <Button Classes="row" MinHeight="30" Height="30" MinWidth="40" Padding="0" CornerRadius="10"
                   HorizontalContentAlignment="Center" VerticalContentAlignment="Center"
                   Background="{StaticResource Panel}" BorderBrush="{StaticResource BorderMid}"
                   BorderThickness="1" Focusable="False"
@@ -371,7 +374,7 @@
             <TextBlock Classes="mono" FontSize="13" Text="A−" />
           </Button>
 
-          <Button Classes="row" MinHeight="30" Height="30" MinWidth="40" Padding="0" CornerRadius="9"
+          <Button Classes="row" MinHeight="30" Height="30" MinWidth="40" Padding="0" CornerRadius="10"
                   HorizontalContentAlignment="Center" VerticalContentAlignment="Center"
                   Background="{StaticResource Panel}" BorderBrush="{StaticResource BorderMid}"
                   BorderThickness="1" Focusable="False"

src/DodoSSH.Client.Android/Views/TerminalScreen.axaml.cs

@@ -139,48 +139,18 @@ internal sealed partial class TerminalScreen : UserControl
     {
         var row = this.FindControl<StackPanel>("AccessoryKeys")!;
 
+        // Both halves of a press steal Android's own focus — the platform requests it for Avalonia's view
+        // after dispatching every handled touch, DOWN and UP alike; TerminalFocus carries the decompiled
+        // citation. Countered at the row rather than inside each key's Click, and for two reasons: Click
+        // only exists for the UP half, so a keyboard detached at DOWN would stay detached for the whole
+        // length of the press; and the Return is posted past the current dispatch, so its ordering against
+        // the key's own handler does not matter — which is what lets one pair of handlers cover ten keys.
+        row.AddHandler(PointerPressedEvent, (_, _) => TerminalFocus.Return(), RoutingStrategies.Tunnel);
+        row.AddHandler(PointerReleasedEvent, (_, _) => TerminalFocus.Return(), RoutingStrategies.Tunnel);
+
         foreach (var (label, bytes, latches) in Keys)
         {
-            var key = new Button
-            {
-                Content = new TextBlock
-                {
-                    Text = label,
-                    FontFamily = (FontFamily)Application.Current!.FindResource("MonoFont")!,
-                    FontSize = 11,
-                    HorizontalAlignment = HorizontalAlignment.Center,
-                    VerticalAlignment = VerticalAlignment.Center,
-                },
-
-                // 44 wide, and that is the number that matters: the design draws these flexed across the
-                // width, which at 360dp with ten keys is 32 pixels each — under every thumb-target
-                // guideline there is. The height came down with the row it sits in, from 38 to 30, and it
-                // costs nothing a width does: the keys are a single row with the terminal above and the
-                // system's gesture bar below, so there is no neighbour a short press can land on instead.
-                MinWidth = 44,
-                Height = 30,
-                Padding = new Thickness(10, 0),
-                CornerRadius = new CornerRadius(9),
-                Background = Palette("Panel"),
-                BorderBrush = Palette("BorderMid"),
-                BorderThickness = new Thickness(1),
-                Foreground = Palette("TextDim"),
-                HorizontalContentAlignment = HorizontalAlignment.Center,
-
-                // ◆ NOT FOCUSABLE, AND THAT IS THE WHOLE CONTROL RATHER THAN A DETAIL.
-                //
-                // These keys are an extension of the keyboard, not a place the keyboard should go. As
-                // ordinary buttons they took Avalonia's focus on tap, which takes it off the NativeWebView
-                // — and the package's own OnLostFocus then calls the adapter's ResignFocus(). So pressing
-                // Tab or an arrow handed the terminal one byte and took the keyboard away from it: the next
-                // thing typed on a hardware keyboard went nowhere, and the row went on working because its
-                // buttons are pressed rather than typed into, which is what makes it look like the terminal
-                // had died instead.
-                //
-                // Focusable=false is what a toolbar button is, and it means the focused element never
-                // changes: the WebView is still it, so nothing resigns and nothing has to be handed back.
-                Focusable = false,
-            };
+            var key = CreateKey(label);
 
             if (latches)
             {
@@ -196,6 +166,57 @@ internal sealed partial class TerminalScreen : UserControl
         }
     }
 
+    /// <summary>One key of the accessory row, before its click is wired.</summary>
+    /// <remarks>Split from <see cref="BuildAccessoryRow"/> for length rather than for reuse.</remarks>
+    private static Button CreateKey(string label) =>
+        new()
+        {
+            Content = new TextBlock
+            {
+                Text = label,
+                FontFamily = (FontFamily)Application.Current!.FindResource("MonoFont")!,
+                FontSize = 11,
+                HorizontalAlignment = HorizontalAlignment.Center,
+                VerticalAlignment = VerticalAlignment.Center,
+            },
+
+            // 44 wide, and that is the number that matters: the design draws these flexed across the
+            // width, which at 360dp with ten keys is 32 pixels each — under every thumb-target
+            // guideline there is. The height came down with the row it sits in, from 38 to 30, and it
+            // costs nothing a width does: the keys are a single row with the terminal above and the
+            // system's gesture bar below, so there is no neighbour a short press can land on instead.
+            MinWidth = 44,
+            Height = 30,
+            Padding = new Thickness(10, 0),
+            CornerRadius = new CornerRadius(9),
+            Background = Palette("Panel"),
+            BorderBrush = Palette("BorderMid"),
+            BorderThickness = new Thickness(1),
+            Foreground = Palette("TextDim"),
+            HorizontalContentAlignment = HorizontalAlignment.Center,
+
+            // ◆ NOT FOCUSABLE, AND THAT IS THE WHOLE CONTROL RATHER THAN A DETAIL.
+            //
+            // These keys are an extension of the keyboard, not a place the keyboard should go. As
+            // ordinary buttons they took Avalonia's focus on tap, which takes it off the NativeWebView
+            // — and the package's own OnLostFocus then calls the adapter's ResignFocus(). So pressing
+            // Tab or an arrow handed the terminal one byte and took the keyboard away from it: the next
+            // thing typed on a hardware keyboard went nowhere, and the row went on working because its
+            // buttons are pressed rather than typed into, which is what makes it look like the terminal
+            // had died instead.
+            //
+            // Focusable=false is what a toolbar button is, and it means the focused element never
+            // changes: the WebView is still it, so nothing resigns and nothing has to be handed back.
+            //
+            // At the Avalonia layer, that is. Android keeps a focus of its own, and the touch that
+            // presses one of these keys hands it to Avalonia's input view regardless of what Avalonia
+            // decides about its element — taking the keyboard's input connection off the terminal and
+            // swapping its layout mid-typing. The row's own pointer handlers in BuildAccessoryRow hand
+            // that half back; see TerminalFocus for the whole story, including why the handing back has
+            // to be posted rather than done inline.
+            Focusable = false,
+        };
+
     private void ToggleControl()
     {
         controlLatched = !controlLatched;

src/DodoSSH.Client.Android/Views/VaultsScreen.axaml

@@ -336,9 +336,11 @@
       the thing the whole screen is about — a member can only be selected under one, so choosing who is the
       only half left to make.
     -->
+    <!-- DeepChrome rather than Chrome, since v5 — the same raised-bar decision SnippetsScreen and
+         FilesScreen make for their own selection bars; see the remark on PhoneShell's vault header. -->
     <Border Grid.Row="4"
             IsVisible="{Binding SelectedMember, Converter={x:Static ObjectConverters.IsNotNull}}"
-            Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+            Background="{StaticResource DeepChrome}" BorderBrush="{StaticResource Border}"
             BorderThickness="0,1,0,0" Padding="14,12">
       <StackPanel Spacing="9">
 

src/DodoSSH.Client.App/App.axaml

@@ -153,6 +153,7 @@
       <Setter Property="CornerRadius" Value="6" />
       <Setter Property="Padding" Value="6,2" />
       <Setter Property="MinHeight" Value="0" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
       <Setter Property="Foreground" Value="{StaticResource TextDim}" />
       <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
       <Setter Property="FontWeight" Value="Medium" />
@@ -268,7 +269,26 @@
       <Setter Property="Foreground" Value="{StaticResource TextFaint}" />
     </Style>
 
-    <!-- Every button in this window is small, mono and tracked out; only the colours differ. -->
+    <!--
+      Every button in this window is small, mono and tracked out; only the colours differ.
+
+      ◆ VerticalContentAlignment IS NOT VerticalAlignment, and this style used to set only the second. The
+      first places the caption inside the button; the second places the button inside its parent. Avalonia's
+      default for content alignment is Stretch, so on any of these given a fixed Height — the hosts toolbar's
+      three at 40, and every dialog's row of them — the ContentPresenter stretched the caption's TextBlock to
+      the full content box and a TextBlock draws its line at the TOP of its bounds. Measured on the hosts
+      toolbar: a 40-pixel button with 9 pixels above the ink and 20 below it. Nothing was the wrong height,
+      which is why this read as one — the box was right and the label sat in the top third of it.
+
+      Center rather than a hand-tuned Padding, because the gap is the difference between the line box and the
+      content box and so moves with the font size: these carry 11.5 by default and the primary action
+      overrides it to 13.5. Every other button class here already sets it — navseg, sesstab, headerghost,
+      sidebarrow, fieldrow, paneicon — so this is the three shapes that were missed rather than a new idiom.
+
+      HorizontalContentAlignment is deliberately left alone. It is Stretch too, and it is invisible on a
+      button sized to its own caption; the ones that are stretched wide state their own (the flyouts' rows
+      ask for Left), and centring those from here would move text nobody complained about.
+    -->
     <Style Selector="Button.ghost, Button.accent, Button.danger">
       <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
       <Setter Property="FontSize" Value="11.5" />
@@ -277,6 +297,7 @@
       <Setter Property="Padding" Value="10,5" />
       <Setter Property="MinHeight" Value="0" />
       <Setter Property="VerticalAlignment" Value="Center" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
     </Style>
 
     <!--
@@ -443,6 +464,7 @@
       <Setter Property="Padding" Value="13,7" />
       <Setter Property="HorizontalAlignment" Value="Stretch" />
       <Setter Property="HorizontalContentAlignment" Value="Left" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
       <Setter Property="CornerRadius" Value="12" />
     </Style>
     <Style Selector="Button.navuser /template/ ContentPresenter#PART_ContentPresenter">
@@ -462,6 +484,7 @@
     <Style Selector="Button.poprow">
       <Setter Property="HorizontalAlignment" Value="Stretch" />
       <Setter Property="HorizontalContentAlignment" Value="Stretch" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
       <Setter Property="Padding" Value="11,4" />
       <Setter Property="CornerRadius" Value="8" />
       <Setter Property="MinHeight" Value="20" />
@@ -651,6 +674,7 @@
     -->
     <Style Selector="Button.choice">
       <Setter Property="Padding" Value="10,5" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
       <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
       <Setter Property="FontSize" Value="10.5" />
       <Setter Property="LetterSpacing" Value="0.5" />
@@ -1100,6 +1124,7 @@
     <Style Selector="Button.panechip">
       <Setter Property="Padding" Value="8,4" />
       <Setter Property="MinHeight" Value="0" />
+      <Setter Property="VerticalContentAlignment" Value="Center" />
       <Setter Property="FontFamily" Value="{StaticResource MonoFont}" />
       <Setter Property="FontSize" Value="11" />
       <Setter Property="FontWeight" Value="Medium" />
@@ -1261,6 +1286,57 @@
       <Setter Property="Foreground" Value="{StaticResource Text}" />
     </Style>
 
+    <!--
+      ── v5c ──────────────────────────────────────────────────────────────────────────────────────────────
+      Settings mode's own furniture: a page title, a tracked section label, a card group and the rows inside
+      it. Named apart from Border.section and TextBlock.sectionlabel above rather than reusing them — those
+      are the hosts drawer's 320-pixel column, at that column's own padding and heading size, and the
+      settings pages are a 1100-pixel one at the numbers Settings-General.dc.html and its three siblings all
+      state identically: 12-radius cards on Raised with a 1px Border inset, 20/24 row padding, a 1px
+      BorderSubtle divider between rows and none under the last one.
+    -->
+    <Style Selector="TextBlock.settingstitle">
+      <Setter Property="FontSize" Value="33" />
+      <Setter Property="FontWeight" Value="Bold" />
+      <Setter Property="LetterSpacing" Value="-0.5" />
+      <Setter Property="Foreground" Value="{StaticResource Text}" />
+    </Style>
+    <Style Selector="TextBlock.settingssection">
+      <Setter Property="FontSize" Value="10.5" />
+      <Setter Property="FontWeight" Value="SemiBold" />
+      <Setter Property="LetterSpacing" Value="1.2" />
+      <Setter Property="Foreground" Value="{StaticResource TextGhost}" />
+      <Setter Property="Margin" Value="0,32,0,12" />
+    </Style>
+    <Style Selector="Border.settingscard">
+      <Setter Property="Background" Value="{StaticResource Raised}" />
+      <Setter Property="BorderBrush" Value="{StaticResource Border}" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="CornerRadius" Value="12" />
+    </Style>
+    <Style Selector="Border.settingsrow">
+      <Setter Property="BorderBrush" Value="{StaticResource BorderSubtle}" />
+      <Setter Property="BorderThickness" Value="0,0,0,1" />
+      <Setter Property="Padding" Value="24,20" />
+    </Style>
+    <Style Selector="Border.settingsrow.last">
+      <Setter Property="BorderThickness" Value="0" />
+    </Style>
+    <Style Selector="TextBlock.settingsrowtitle">
+      <Setter Property="FontSize" Value="14.5" />
+      <Setter Property="FontWeight" Value="Bold" />
+      <Setter Property="LetterSpacing" Value="-0.2" />
+      <Setter Property="Foreground" Value="{StaticResource Text}" />
+    </Style>
+    <Style Selector="TextBlock.settingsrowcaption">
+      <Setter Property="FontSize" Value="12.5" />
+      <Setter Property="Foreground" Value="{StaticResource TextFaint}" />
+      <Setter Property="TextWrapping" Value="Wrap" />
+      <Setter Property="LineHeight" Value="19.4" />
+      <Setter Property="MaxWidth" Value="640" />
+      <Setter Property="HorizontalAlignment" Value="Left" />
+    </Style>
+
   </Application.Styles>
 
 </Application>

src/DodoSSH.Client.App/Assets/dodossh-icon.ps1

@@ -1,13 +1,18 @@
-# Regenerates dodossh.ico from the same geometry the Android launcher icon draws.
+# Regenerates dodossh.ico and dodossh.icns from the same geometry the Android launcher icon draws.
 #
 # The phone's mark is a vector — Resources/drawable/ic_launcher_foreground.xml — and the whole
 # reason it is a vector is that there is then one geometry to change and no set of PNG densities
-# to forget one of. Windows will not take a vector: <ApplicationIcon> wants an .ico and nothing
-# else, and Window.Icon wants a bitmap. So the raster exists, and this script is how it stays
-# honest: the numbers below are the ones in that XML, and regenerating is the whole edit.
+# to forget one of. Neither desktop platform will take a vector: <ApplicationIcon> wants an .ico
+# and nothing else, Window.Icon wants a bitmap, and vpk wants an .icns for the macOS bundle. So
+# the rasters exist, and this script is how they stay honest: the numbers below are the ones in
+# that XML, and regenerating is the whole edit.
 #
 #     pwsh -File src/DodoSSH.Client.App/Assets/dodossh-icon.ps1
 #
+# Both outputs are written every run, deliberately. Two scripts, or one script with a switch,
+# is how the two files come to be drawn from different geometry — which nobody would notice,
+# because no one person looks at a Windows taskbar and a macOS Dock on the same afternoon.
+#
 # Coordinates are the launcher's 108-unit viewport, mapped so the middle 72 fills the canvas.
 # That 72 is not an arbitrary crop: it is the part of an adaptive icon a launcher actually shows,
 # the outer 18 on each edge being what it eats for masking and parallax. Rendering the whole 108
@@ -30,29 +35,49 @@ $ink = [System.Drawing.ColorTranslator]::FromHtml('#FFFFFF')     # AccentInk
 # the gap, and its downsampler is not kind to a hairline.
 $sizes = @(16, 20, 24, 32, 40, 48, 64, 128, 256)
 
-function New-MarkPng([int]$size)
+# $tileFraction is how much of the canvas the accent tile fills, and it is the one number that
+# differs between the two platforms.
+#
+# Windows passes 1.0: the tile bleeds to the edge, because Windows draws application icons at
+# whatever size they come in and every other icon on the taskbar does the same.
+#
+# macOS passes 0.8047, and that is not taste. Apple's icon grid puts a rounded-rect app icon in
+# an 824-pixel square inside a 1024-pixel canvas — 824/1024 — with the remaining hundred pixels a
+# side left as air for the Dock's shadow and its magnification. An icon that ignores the grid and
+# bleeds to the edge does not read as bold; it reads as the one icon in the Dock that is too big,
+# because it sits beside Finder and Safari which do not.
+function New-MarkPng([int]$size, [double]$tileFraction = 1.0)
 {
     $bitmap = New-Object System.Drawing.Bitmap($size, $size, [System.Drawing.Imaging.PixelFormat]::Format32bppArgb)
     $g = [System.Drawing.Graphics]::FromImage($bitmap)
     $g.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::AntiAlias
     $g.PixelOffsetMode = [System.Drawing.Drawing2D.PixelOffsetMode]::HighQuality
 
+    # The tile, and the inset that centres it when it does not fill the canvas.
+    $tile = [double]$size * $tileFraction
+    $inset = ([double]$size - $tile) / 2.0
+
     # The accent tile, rounded as a launcher mask rounds it. A square-cornered tile would be the
     # one icon on the taskbar with corners, which reads as unfinished rather than as deliberate.
-    $radius = [double]$size * 0.22
+    #
+    # 0.22 of the tile rather than of the canvas, so the corner keeps its proportion to the shape
+    # it is rounding instead of growing as the air around it does. It is also within a whisker of
+    # the 185/824 Apple's own grid specifies, which is why one radius serves both files.
+    $radius = $tile * 0.22
     $d = $radius * 2.0
     $path = New-Object System.Drawing.Drawing2D.GraphicsPath
-    $path.AddArc(0.0, 0.0, $d, $d, 180, 90)
-    $path.AddArc($size - $d, 0.0, $d, $d, 270, 90)
-    $path.AddArc($size - $d, $size - $d, $d, $d, 0, 90)
-    $path.AddArc(0.0, $size - $d, $d, $d, 90, 90)
+    $path.AddArc($inset, $inset, $d, $d, 180, 90)
+    $path.AddArc($inset + $tile - $d, $inset, $d, $d, 270, 90)
+    $path.AddArc($inset + $tile - $d, $inset + $tile - $d, $d, $d, 0, 90)
+    $path.AddArc($inset, $inset + $tile - $d, $d, $d, 90, 90)
     $path.CloseFigure()
     $brush = New-Object System.Drawing.SolidBrush($accent)
     $g.FillPath($brush, $path)
 
-    # 108-viewport units to pixels, with the outer 18 dropped on each edge.
-    $scale = [double]$size / 72.0
-    function P([double]$x, [double]$y) { New-Object System.Drawing.PointF((($x - 18.0) * $scale), (($y - 18.0) * $scale)) }
+    # 108-viewport units to pixels, with the outer 18 dropped on each edge. Scaled to the tile and
+    # offset by the inset, so the glyph keeps its place within the tile at either fraction.
+    $scale = $tile / 72.0
+    function P([double]$x, [double]$y) { New-Object System.Drawing.PointF((($x - 18.0) * $scale + $inset), (($y - 18.0) * $scale + $inset)) }
 
     # A stroke thinner than a pixel renders as a grey suggestion of itself, which at 16px is the
     # difference between a mark and a smudge. The phone's file already bumps this width for the
@@ -117,3 +142,86 @@ $target = Join-Path $PSScriptRoot 'dodossh.ico'
 $w.Dispose(); $out.Dispose()
 
 Write-Output "Wrote $target ($($sizes.Count) sizes, $((Get-Item $target).Length) bytes)"
+
+# ---- dodossh.icns, for the macOS bundle ----------------------------------------------------------
+#
+# Written here rather than by `iconutil` on a Mac, and that is the point of doing it the long way.
+# iconutil is the documented tool and it exists only on macOS, so an icon that needed it could not
+# be regenerated on the machine this project is developed on — the geometry above would change and
+# the .icns would quietly keep the old mark until somebody next opened a Mac. The container format
+# is a magic word, a length and a run of typed PNG chunks, which is little enough to own.
+#
+# ◆ EVERY LENGTH IN THIS FILE IS BIG-ENDIAN, AND BinaryWriter IS NOT.
+#
+# The one thing that will catch anybody editing this. A .icns written little-endian is not rejected
+# with an error — Finder and vpk both just show the placeholder icon, because the first chunk claims
+# a length of about two billion and the parser walks off the end and gives up. Hence Write-BE32.
+#
+# Type codes are Apple's, and the pairs are not redundant. ic08 and ic13 are both 256 pixels because
+# one is "256 at 1x" and the other is "128 at 2x", and a Retina display asked for the second will not
+# accept the first. Same for ic09/ic14 at 512. iconutil emits both from an .iconset for this reason,
+# so this does too.
+$icnsTypes = @(
+    @{ Type = 'ic11'; Size = 32 }    # 16@2x
+    @{ Type = 'ic12'; Size = 64 }    # 32@2x
+    @{ Type = 'ic07'; Size = 128 }   # 128@1x
+    @{ Type = 'ic13'; Size = 256 }   # 128@2x
+    @{ Type = 'ic08'; Size = 256 }   # 256@1x
+    @{ Type = 'ic14'; Size = 512 }   # 256@2x
+    @{ Type = 'ic09'; Size = 512 }   # 512@1x
+    @{ Type = 'ic10'; Size = 1024 }  # 512@2x
+)
+
+# Apple's icon grid: an 824-pixel shape centred in a 1024-pixel canvas. See New-MarkPng.
+$macTileFraction = 824.0 / 1024.0
+
+# Rendered once per distinct pixel size rather than once per type code, so the two 256s and the two
+# 512s are byte-identical and the file does not carry the same image twice over at different
+# compression. It also halves the drawing, which at 1024 is not nothing.
+$rendered = @{}
+foreach ($size in ($icnsTypes.Size | Sort-Object -Unique))
+{
+    [byte[]]$png = New-MarkPng $size $macTileFraction
+    $rendered[$size] = $png
+}
+
+$icns = New-Object System.IO.MemoryStream
+
+function Write-BE32([System.IO.Stream]$stream, [uint32]$value)
+{
+    $bytes = [System.BitConverter]::GetBytes($value)
+    if ([System.BitConverter]::IsLittleEndian) { [array]::Reverse($bytes) }
+    $stream.Write($bytes, 0, 4)
+}
+
+function Write-Ascii([System.IO.Stream]$stream, [string]$text)
+{
+    $bytes = [System.Text.Encoding]::ASCII.GetBytes($text)
+    $stream.Write($bytes, 0, $bytes.Length)
+}
+
+# The header's length field covers the whole file including the header, so it is written last —
+# eight bytes of nothing now, seeked back to and filled in once the total is known.
+Write-Ascii $icns 'icns'
+Write-BE32 $icns 0
+
+foreach ($entry in $icnsTypes)
+{
+    $payload = $rendered[$entry.Size]
+    Write-Ascii $icns $entry.Type
+
+    # Length includes this chunk's own eight-byte header, which is the off-by-eight everybody
+    # writes once.
+    Write-BE32 $icns ([uint32]($payload.Length + 8))
+    $icns.Write($payload, 0, $payload.Length)
+}
+
+$total = [uint32]$icns.Length
+$icns.Position = 4
+Write-BE32 $icns $total
+
+$icnsTarget = Join-Path $PSScriptRoot 'dodossh.icns'
+[System.IO.File]::WriteAllBytes($icnsTarget, $icns.ToArray())
+$icns.Dispose()
+
+Write-Output "Wrote $icnsTarget ($($icnsTypes.Count) entries, $((Get-Item $icnsTarget).Length) bytes)"

src/DodoSSH.Client.App/DodoSSH.Client.App.csproj

@@ -66,6 +66,21 @@
     -->
     <DodoChannel Condition="'$(DodoChannel)' == ''">release</DodoChannel>
 
+    <!--
+      For the macOS keychain interop in Platform/, and for nothing else.
+
+      Set on this project rather than in Directory.Build.props deliberately. The frameworks that hold a
+      Secure Enclave key take CFDictionaries of raw pointers, so building one means pinning arrays and
+      taking their addresses — see MacDeviceKeyStore. Every other project here is managed code with no
+      business doing that, and a solution-wide flag would quietly permit it everywhere, including in the
+      crypto project where a stray pointer is the last thing anybody wants to have been allowed.
+
+      The alternative — GCHandle.Alloc with GCHandleType.Pinned — needs no flag and was considered. It
+      would replace each `fixed` with an allocate/free pair that has to be balanced by hand across the
+      early returns those methods are full of, which trades a compiler-checked scope for a manual one.
+    -->
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+
     <!--
       False here, unlike every server project. The root Directory.Build.props sets it true because
       the API is container-hosted, UTC-only and has no business formatting anything for a human.

src/DodoSSH.Client.App/Platform/MacDeviceKeyStore.cs

@@ -0,0 +1,598 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using System.Text;
+using DodoSSH.Client.Session;
+using static DodoSSH.Client.App.Platform.MacSecurity;
+
+namespace DodoSSH.Client.App.Platform;
+
+/// <summary>
+/// Keeps the device key encrypted to a Secure Enclave key whose use requires the user's presence.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The macOS counterpart of <see cref="WindowsDeviceKeyStore"/>, and the same argument holds it up:
+/// <b>the consent is enforced by the platform, not by this class</b>. The unwrapping key is generated
+/// inside the Secure Enclave and never leaves it — there is no code path, privileged or otherwise, that
+/// turns it into bytes — and it is created under an access control requiring
+/// <see cref="AccessControlFlags.UserPresence"/>, so Touch ID or the login password is a condition of
+/// <em>using</em> it. Malware running as the user can ask for a decryption; it cannot answer the prompt,
+/// and the attempt is visible.
+/// </para>
+/// <para>
+/// A store that showed its own prompt and then read a protected file would be trivially bypassed, which
+/// is the mistake ADR 0007 originally described and the Windows store's comment corrects. The correction
+/// applies here unchanged.
+/// </para>
+/// <para>
+/// <b>P-256 and ECIES, where Windows uses RSA-OAEP, and the difference is not a preference.</b> The
+/// Secure Enclave holds exactly one kind of key: a 256-bit key on the NIST P-256 curve. It will not hold
+/// an RSA key at any size. So the wrap is <c>eciesEncryptionCofactorX963SHA256AESGCM</c> — an ephemeral
+/// agreement against the enclave's public half, X9.63-KDF to an AES-GCM key, and the ephemeral public
+/// key carried in the output. The framework does all of that; what matters here is that the input is 32
+/// bytes and there is no size limit worth worrying about.
+/// </para>
+/// <para>
+/// <b>Sealing is silent and unsealing prompts, which is better than the Windows shape rather than merely
+/// different.</b> On Windows, <c>CngKey.Create</c> with <c>ProtectKey</c> raises a dialog at creation as
+/// well, because the policy means "protect this key with a PIN" and Windows sets that up there and then.
+/// Here <see cref="SecKeyCopyPublicKey"/> works on an enclave key without any prompt, so registering a
+/// device shows nothing and only unlock asks. <see cref="SaveAsync"/> is therefore not user-facing on
+/// this platform — but it is still called from where the Windows one has to be, and relying on that
+/// difference would make the shared caller platform-specific for no gain.
+/// </para>
+/// <para>
+/// <b>What this cannot be tested against, and what follows from that.</b> Every method except
+/// <see cref="IsAvailableAsync"/> and the empty case of <see cref="TryLoadAsync"/> needs an interactive
+/// login session and real enclave hardware, so none can be exercised by an automated test — the same
+/// line the Windows store draws. It also means <see cref="IsSupported"/> must probe rather than infer:
+/// see its remarks for the three ordinary machines that have no usable enclave and must degrade to the
+/// passphrase rather than fail at unlock.
+/// </para>
+/// </remarks>
+[SupportedOSPlatform("macos")]
+public sealed partial class MacDeviceKeyStore : IDeviceKeyStore
+{
+    /// <summary>
+    /// The keychain tag this application's enclave key is filed under.
+    /// </summary>
+    /// <remarks>
+    /// Versioned for the reason the Windows key name is: a future change of curve or wrap algorithm can
+    /// create a new key beside the old one rather than failing to open blobs written by a previous
+    /// build. A device that cannot be opened falls back to the passphrase, which is survivable — but
+    /// silently, and a user would only notice their fingerprint had stopped working.
+    ///
+    /// Prefixed with the bundle identifier because the keychain is shared across every application the
+    /// user runs, unlike a CNG key name, which is scoped to the user's key store already.
+    /// </remarks>
+    private const string KeyTag = "dev.dodotech.dodossh.devicekey.v1";
+
+    /// <summary>
+    /// Shown in the Touch ID prompt, so it has to read as a sentence to a person.
+    /// </summary>
+    /// <remarks>
+    /// macOS composes it into "DodoSSH is trying to ...", so this is a verb phrase and not a sentence of
+    /// its own. The same words the Windows consent dialog uses.
+    /// </remarks>
+    private const string ConsentPrompt = "unlock your DodoSSH vault";
+
+    private readonly ClientPaths paths;
+
+    /// <summary>Creates the store.</summary>
+    public MacDeviceKeyStore(ClientPaths paths)
+    {
+        ArgumentNullException.ThrowIfNull(paths);
+        this.paths = paths;
+    }
+
+    /// <summary>
+    /// Whether this Mac has a Secure Enclave that will hold a key for this build.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Probed by creating a throwaway key and deleting it, rather than by asking whether the hardware
+    /// exists. Three ordinary situations answer "no" here and would otherwise only be discovered at the
+    /// moment somebody tried to unlock:
+    /// </para>
+    /// <para>
+    /// <b>An Intel Mac with no T2.</b> Apple Silicon and T2 machines have an enclave; earlier Intel
+    /// models do not, and there is no single attribute that says so.
+    /// </para>
+    /// <para>
+    /// <b>A build that is not code signed.</b> Enclave key creation requires a signing identity, so
+    /// every <c>dotnet run</c> and every build from an IDE fails here with a missing-entitlement error.
+    /// That is the correct answer rather than a nuisance: a development build should keep asking for the
+    /// passphrase, and this is what makes it do so without a platform check somewhere else.
+    /// </para>
+    /// <para>
+    /// <b>A machine with no login password set.</b> <see cref="AccessControlFlags.UserPresence"/> has
+    /// nothing to demand, and the framework refuses the access control object rather than silently
+    /// creating a key anybody could use.
+    /// </para>
+    /// <para>
+    /// The probe uses its own tag and no UI policy, so nothing prompts and nothing collides with the
+    /// real key. It is deleted immediately; a probe key left behind would accumulate one per launch.
+    /// </para>
+    /// </remarks>
+    internal static bool IsSupported()
+    {
+        try
+        {
+            var probe = $"{KeyTag}.probe.{Guid.CreateVersion7():N}";
+
+            using var scope = new CoreFoundationScope();
+
+            var symbols = MacSymbols.Resolve();
+
+            if (!symbols.Complete)
+            {
+                return false;
+            }
+
+            var key = CreateEnclaveKey(scope, symbols, probe);
+
+            if (key == IntPtr.Zero)
+            {
+                return false;
+            }
+
+            // Discarded deliberately. The question this method answers is whether the enclave will make a
+            // key, and it demonstrably just did; a failure to clean the probe up afterwards leaves one
+            // stray keychain item and does not make the answer no.
+            _ = DeleteKey(symbols, probe);
+
+            return true;
+        }
+        catch (Exception exception) when (exception is DllNotFoundException
+                                              or EntryPointNotFoundException
+                                              or BadImageFormatException)
+        {
+            // A macOS without these frameworks is not a thing that exists, so this is really the guard
+            // for the case that does: a future release renaming or removing one of them. The answer is
+            // the same as for hardware that is absent — no device key, ask for the passphrase.
+            return false;
+        }
+    }
+
+    /// <inheritdoc />
+    public ValueTask<bool> IsAvailableAsync(CancellationToken cancellationToken) =>
+        ValueTask.FromResult(IsSupported());
+
+    /// <inheritdoc />
+    public async ValueTask SaveAsync(
+        ReadOnlyMemory<byte> devicePrivateKey,
+        CancellationToken cancellationToken)
+    {
+        var sealedKey = Seal(devicePrivateKey.Span)
+            ?? throw new InvalidOperationException(
+                "The Secure Enclave would not seal the device key. Check IsAvailableAsync before offering to register one.");
+
+        paths.EnsureCreated();
+
+        await File.WriteAllBytesAsync(paths.DeviceKeyFile, sealedKey, cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    /// <inheritdoc />
+    public async ValueTask<byte[]?> TryLoadAsync(CancellationToken cancellationToken)
+    {
+        if (!File.Exists(paths.DeviceKeyFile))
+        {
+            return null;
+        }
+
+        var sealedKey = await File.ReadAllBytesAsync(paths.DeviceKeyFile, cancellationToken)
+            .ConfigureAwait(false);
+
+        return Unseal(sealedKey);
+    }
+
+    /// <inheritdoc />
+    public ValueTask ForgetAsync(CancellationToken cancellationToken)
+    {
+        if (File.Exists(paths.DeviceKeyFile))
+        {
+            File.Delete(paths.DeviceKeyFile);
+        }
+
+        var symbols = MacSymbols.Resolve();
+
+        if (symbols.Complete)
+        {
+            // Discarded, and that is deliberate: there is nothing a caller could do about a failure here,
+            // and the file deleted above is the half that decides whether unlock will try at all. A key
+            // left in the enclave with no ciphertext to open is inert.
+            _ = DeleteKey(symbols, KeyTag);
+        }
+
+        return ValueTask.CompletedTask;
+    }
+
+    /// <remarks>
+    /// Silent: it uses only the public half. Null on every failure, and the caller's answer to all of
+    /// them is the same — do not offer a device unlock.
+    /// </remarks>
+    private static byte[]? Seal(ReadOnlySpan<byte> devicePrivateKey)
+    {
+        try
+        {
+            using var scope = new CoreFoundationScope();
+
+            var symbols = MacSymbols.Resolve();
+
+            if (!symbols.Complete)
+            {
+                return null;
+            }
+
+            // Created on first use rather than at registration, so that a device key re-registered after
+            // a ForgetAsync gets a key again without anything having to notice that it had gone.
+            var privateKey = FindKey(scope, symbols, KeyTag, prompt: null);
+
+            if (privateKey == IntPtr.Zero)
+            {
+                privateKey = CreateEnclaveKey(scope, symbols, KeyTag);
+            }
+
+            if (privateKey == IntPtr.Zero)
+            {
+                return null;
+            }
+
+            var publicKey = scope.Keep(SecKeyCopyPublicKey(privateKey));
+
+            if (publicKey == IntPtr.Zero)
+            {
+                return null;
+            }
+
+            var plaintext = Data(scope, devicePrivateKey);
+
+            if (plaintext == IntPtr.Zero)
+            {
+                return null;
+            }
+
+            var ciphertext = scope.Keep(
+                SecKeyCreateEncryptedData(publicKey, symbols.EciesAlgorithm, plaintext, out var error));
+
+            scope.Keep(error);
+
+            return ciphertext == IntPtr.Zero ? null : ToArray(ciphertext);
+        }
+        catch (Exception exception) when (exception is DllNotFoundException
+                                              or EntryPointNotFoundException
+                                              or BadImageFormatException)
+        {
+            return null;
+        }
+    }
+
+    /// <remarks>
+    /// <para>
+    /// This is the call that prompts. Every failure becomes null, and the set is wider than it looks:
+    /// the key may be gone, the user may have cancelled or let the prompt time out, the enclave may have
+    /// invalidated it after the login password was reset, or the blob may predate a key that has since
+    /// been replaced. None of them are distinguishable to a user and all have the same remedy, so none
+    /// are worth telling apart here — see <c>UnlockStatus.DeviceKeyUnavailable</c>.
+    /// </para>
+    /// <para>
+    /// Blocking, and it blocks on a person. The prompt is modal to the application, so this must not run
+    /// on a thread that is also expected to draw the window behind it.
+    /// </para>
+    /// </remarks>
+    private static byte[]? Unseal(byte[] sealedKey)
+    {
+        try
+        {
+            using var scope = new CoreFoundationScope();
+
+            var symbols = MacSymbols.Resolve();
+
+            if (!symbols.Complete)
+            {
+                return null;
+            }
+
+            var privateKey = FindKey(scope, symbols, KeyTag, ConsentPrompt);
+
+            if (privateKey == IntPtr.Zero)
+            {
+                return null;
+            }
+
+            var ciphertext = Data(scope, sealedKey);
+
+            if (ciphertext == IntPtr.Zero)
+            {
+                return null;
+            }
+
+            var plaintext = scope.Keep(
+                SecKeyCreateDecryptedData(privateKey, symbols.EciesAlgorithm, ciphertext, out var error));
+
+            scope.Keep(error);
+
+            return plaintext == IntPtr.Zero ? null : ToArray(plaintext);
+        }
+        catch (Exception exception) when (exception is DllNotFoundException
+                                              or EntryPointNotFoundException
+                                              or BadImageFormatException)
+        {
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// Generates a key inside the Secure Enclave, filed under <paramref name="tag"/>. Owned by the scope.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The attribute dictionary is the whole security decision, so it is worth reading rather than
+    /// pattern-matching. <c>TokenID = SecureEnclave</c> is what puts the private half in hardware;
+    /// without it this silently generates an ordinary software key that behaves identically in every
+    /// visible way and protects nothing.
+    /// </para>
+    /// <para>
+    /// <c>AccessibleWhenUnlockedThisDeviceOnly</c> rather than any of the migratable classes, because a
+    /// device key that could be restored onto another machine from a backup would no longer mean "this
+    /// machine". The enclave already makes that impossible; saying it as well means the intent survives
+    /// a future change of storage.
+    /// </para>
+    /// <para>
+    /// <c>UseDataProtectionKeychain</c> is the macOS-specific one and the easiest to omit. Without it,
+    /// macOS routes this to the older file-based keychain, which does not understand access control
+    /// objects or the enclave, and the call fails with a parameter error that says nothing about the
+    /// missing key.
+    /// </para>
+    /// </remarks>
+    private static IntPtr CreateEnclaveKey(CoreFoundationScope scope, MacSymbols symbols, string tag)
+    {
+        var access = scope.Keep(SecAccessControlCreateWithFlags(
+            IntPtr.Zero,
+            symbols.AccessibleWhenUnlockedThisDeviceOnly,
+            AccessControlFlags.PrivateKeyUsage | AccessControlFlags.UserPresence,
+            out var accessError));
+
+        scope.Keep(accessError);
+
+        if (access == IntPtr.Zero)
+        {
+            return IntPtr.Zero;
+        }
+
+        var privateAttrs = Dictionary(
+            scope,
+            [symbols.AttrIsPermanent, symbols.AttrApplicationTag, symbols.AttrAccessControl],
+            [symbols.True, TagData(scope, tag), access]);
+
+        if (privateAttrs == IntPtr.Zero)
+        {
+            return IntPtr.Zero;
+        }
+
+        var keySize = Number(scope, 256);
+
+        var parameters = Dictionary(
+            scope,
+            [
+                symbols.AttrKeyType,
+                symbols.AttrKeySizeInBits,
+                symbols.AttrTokenId,
+                symbols.UseDataProtectionKeychain,
+                symbols.PrivateKeyAttrs,
+            ],
+            [
+                symbols.KeyTypeEcSecPrimeRandom,
+                keySize,
+                symbols.TokenIdSecureEnclave,
+                symbols.True,
+                privateAttrs,
+            ]);
+
+        if (parameters == IntPtr.Zero)
+        {
+            return IntPtr.Zero;
+        }
+
+        var key = scope.Keep(SecKeyCreateRandomKey(parameters, out var error));
+
+        scope.Keep(error);
+
+        return key;
+    }
+
+    /// <summary>
+    /// Looks the enclave key up by tag. Owned by the scope; zero when there is none.
+    /// </summary>
+    /// <remarks>
+    /// <paramref name="prompt"/> is attached here and consumed later: the lookup itself does not raise
+    /// anything, because a handle to an enclave key is not a use of it. The words reach the user at the
+    /// decrypt, which is the operation the access control actually guards.
+    ///
+    /// <c>UseOperationPrompt</c> is deprecated in favour of an <c>LAContext</c>, and is used anyway. An
+    /// LAContext would mean binding LocalAuthentication as well for one string, and the deprecated key
+    /// still works; the day it stops, this call fails and the store degrades to the passphrase, which is
+    /// the failure this whole class is built to degrade into.
+    /// </remarks>
+    private static IntPtr FindKey(CoreFoundationScope scope, MacSymbols symbols, string tag, string? prompt)
+    {
+        List<IntPtr> keys =
+        [
+            symbols.Class,
+            symbols.AttrApplicationTag,
+            symbols.AttrKeyType,
+            symbols.UseDataProtectionKeychain,
+            symbols.ReturnRef,
+        ];
+
+        List<IntPtr> values =
+        [
+            symbols.ClassKey,
+            TagData(scope, tag),
+            symbols.KeyTypeEcSecPrimeRandom,
+            symbols.True,
+            symbols.True,
+        ];
+
+        if (prompt is not null)
+        {
+            keys.Add(symbols.UseOperationPrompt);
+            values.Add(scope.Keep(CFString(prompt)));
+        }
+
+        var query = Dictionary(scope, [.. keys], [.. values]);
+
+        if (query == IntPtr.Zero)
+        {
+            return IntPtr.Zero;
+        }
+
+        var status = SecItemCopyMatching(query, out var result);
+
+        // errSecItemNotFound is the ordinary answer on a machine that has never registered a device, and
+        // it is not distinguished from any other failure for the reason the class remarks give.
+        return status == Success ? scope.Keep(result) : IntPtr.Zero;
+    }
+
+    /// <summary>Removes the key with this tag from the keychain.</summary>
+    /// <returns>Whether the keychain now has no key under this tag.</returns>
+    /// <remarks>
+    /// <c>ItemNotFound</c> counts as success, and that is the common case rather than an edge: it is
+    /// what a machine that never registered a device answers, and what the second of two
+    /// <see cref="ForgetAsync"/> calls answers. Treating it as a failure would make forgetting a device
+    /// twice report a problem that does not exist.
+    /// </remarks>
+    private static bool DeleteKey(MacSymbols symbols, string tag)
+    {
+        using var scope = new CoreFoundationScope();
+
+        var query = Dictionary(
+            scope,
+            [symbols.Class, symbols.AttrApplicationTag, symbols.UseDataProtectionKeychain],
+            [symbols.ClassKey, TagData(scope, tag), symbols.True]);
+
+        if (query == IntPtr.Zero)
+        {
+            return false;
+        }
+
+        var status = SecItemDelete(query);
+
+        return status is Success or ItemNotFound;
+    }
+
+    // ---- Small CoreFoundation conveniences ---------------------------------------------------------
+
+    /// <remarks>
+    /// The arrays are pinned for the duration of the call and not beyond it, which is correct because
+    /// <c>CFDictionaryCreate</c> copies them: the dictionary retains each key and value, and never reads
+    /// the arrays again.
+    /// </remarks>
+    private static IntPtr Dictionary(CoreFoundationScope scope, IntPtr[] keys, IntPtr[] values)
+    {
+        // A zero anywhere means one of the constants did not resolve or an earlier allocation failed.
+        // Passing it on produces a dictionary with a null key, which CFDictionaryCreate does not reject
+        // — it crashes inside the callback table instead.
+        if (Array.IndexOf(keys, IntPtr.Zero) >= 0 || Array.IndexOf(values, IntPtr.Zero) >= 0)
+        {
+            return IntPtr.Zero;
+        }
+
+        var symbols = MacSymbols.Resolve();
+
+        unsafe
+        {
+            fixed (IntPtr* keyPtr = keys)
+            fixed (IntPtr* valuePtr = values)
+            {
+                return scope.Keep(CFDictionaryCreate(
+                    IntPtr.Zero,
+                    (IntPtr)keyPtr,
+                    (IntPtr)valuePtr,
+                    keys.Length,
+                    symbols.TypeDictionaryKeyCallBacks,
+                    symbols.TypeDictionaryValueCallBacks));
+            }
+        }
+    }
+
+    /// <summary>Copies bytes into a CFData. Owned by the scope.</summary>
+    /// <remarks>
+    /// The pin lasts only as long as the call, which is correct: <c>CFDataCreate</c> copies, so the
+    /// CFData does not reference this memory afterwards. <c>CFDataCreateWithBytesNoCopy</c> would not,
+    /// and is not used for exactly that reason — it would hand the framework a pointer into the managed
+    /// heap and rely on the object staying where the collector first put it.
+    /// </remarks>
+    private static IntPtr Data(CoreFoundationScope scope, ReadOnlySpan<byte> bytes)
+    {
+        unsafe
+        {
+            fixed (byte* pointer = bytes)
+            {
+                return scope.Keep(CFDataCreate(IntPtr.Zero, (IntPtr)pointer, bytes.Length));
+            }
+        }
+    }
+
+    /// <remarks>
+    /// UTF-8 rather than any other encoding, and it only has to be consistent with itself: the tag is an
+    /// opaque blob the keychain matches byte for byte, so what matters is that a lookup encodes it the
+    /// same way the creation did. It is written once, here, for exactly that reason.
+    /// </remarks>
+    private static IntPtr TagData(CoreFoundationScope scope, string tag) =>
+        Data(scope, Encoding.UTF8.GetBytes(tag));
+
+    private static IntPtr Number(CoreFoundationScope scope, int value)
+    {
+        unsafe
+        {
+            return scope.Keep(CFNumberCreate(IntPtr.Zero, (nint)CFNumberIntType, (IntPtr)(&value)));
+        }
+    }
+
+    /// <summary>Builds a CFString from a managed string. Owned, so the caller tracks it.</summary>
+    /// <remarks>
+    /// Built explicitly rather than left to the marshaller, because these calls take a
+    /// <c>CFStringRef</c> and not a C string — the runtime's default marshalling would hand over a
+    /// <c>char*</c>, which CoreFoundation reads as an object pointer and follows into nothing.
+    /// </remarks>
+    private static IntPtr CFString(string value)
+    {
+        var bytes = Encoding.UTF8.GetBytes(value);
+
+        unsafe
+        {
+            fixed (byte* pointer = bytes)
+            {
+                // kCFStringEncodingUTF8 is 0x08000100, spelled out rather than named because it is the
+                // only encoding constant this file uses.
+                return CFStringCreateWithBytes(IntPtr.Zero, (IntPtr)pointer, bytes.Length, 0x08000100, false);
+            }
+        }
+    }
+
+    [LibraryImport(CoreFoundation)]
+    private static partial IntPtr CFStringCreateWithBytes(
+        IntPtr allocator,
+        IntPtr bytes,
+        nint numBytes,
+        uint encoding,
+        [MarshalAs(UnmanagedType.U1)] bool isExternalRepresentation);
+
+    private static byte[] ToArray(IntPtr data)
+    {
+        var length = (int)CFDataGetLength(data);
+        var pointer = CFDataGetBytePtr(data);
+
+        if (length <= 0 || pointer == IntPtr.Zero)
+        {
+            return [];
+        }
+
+        var result = new byte[length];
+        Marshal.Copy(pointer, result, 0, length);
+
+        return result;
+    }
+}

src/DodoSSH.Client.App/Platform/MacSecurity.cs

@@ -0,0 +1,254 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+
+namespace DodoSSH.Client.App.Platform;
+
+/// <summary>
+/// The pieces of CoreFoundation and Security.framework <see cref="MacDeviceKeyStore"/> needs.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Separated from the store itself because it is a different kind of code with a different kind of
+/// review: nothing here makes a decision, and everything here is a translation of a C declaration that
+/// is either right or wrong. Mixing the two would mean the security argument in
+/// <see cref="MacDeviceKeyStore"/> had to be read past two hundred lines of marshalling to find.
+/// </para>
+/// <para>
+/// <b>Every Create or Copy returns an object this process owns.</b> That is CoreFoundation's Create
+/// Rule, and it is the thing here that goes wrong silently: the enclave key handle is small, so a leak
+/// shows up as nothing at all until a long-running process has done a few thousand unlocks.
+/// <see cref="CoreFoundationScope"/> exists so ownership is tracked by construction rather than by
+/// remembering, and every function below that returns a handle says whether it is owned.
+/// </para>
+/// <para>
+/// <b>The integer widths are the part worth checking against the headers rather than skimming.</b>
+/// <c>CFIndex</c>, <c>CFOptionFlags</c> and <c>CFNumberType</c> are all pointer-width on a 64-bit Mac,
+/// not 32-bit, and getting one wrong does not fail cleanly — it shifts every argument after it, so the
+/// call receives plausible rubbish and returns a parameter error that names nothing.
+/// </para>
+/// </remarks>
+[SupportedOSPlatform("macos")]
+internal static partial class MacSecurity
+{
+    internal const string SecurityFramework =
+        "/System/Library/Frameworks/Security.framework/Security";
+
+    internal const string CoreFoundation =
+        "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation";
+
+    /// <summary>
+    /// The access control flags <c>SecAccessControlCreateWithFlags</c> takes.
+    /// </summary>
+    /// <remarks>
+    /// <c>ulong</c> because the parameter is a <c>CFOptionFlags</c>, which is an <c>unsigned long</c>.
+    /// Only the two flags that are used are listed; the full set is large, and copying it in would
+    /// invite somebody to reach for one without reading what it does to the prompt — <c>Biometry</c>
+    /// alone, for instance, leaves a Mac with no Touch ID unable to unlock at all rather than falling
+    /// back to the login password.
+    /// </remarks>
+    [Flags]
+    internal enum AccessControlFlags : ulong
+    {
+        /// <summary>
+        /// Touch ID if the machine has it, the login password if not.
+        /// </summary>
+        /// <remarks>
+        /// The forgiving one, deliberately. <c>BiometryCurrentSet</c> would additionally invalidate the
+        /// key whenever a fingerprint is added or removed, which sounds stricter and here buys nothing:
+        /// this key wraps a device key whose loss already means "ask for the passphrase", so the only
+        /// effect would be users being sent back to their passphrase by an unrelated Settings change
+        /// they would never connect to it.
+        /// </remarks>
+        UserPresence = 1ul << 0,
+
+        /// <summary>Required for any key that lives in the Secure Enclave.</summary>
+        PrivateKeyUsage = 1ul << 30,
+    }
+
+    /// <summary>The CFNumberType code for a 32-bit int, from CFNumber.h.</summary>
+    internal const long CFNumberIntType = 9;
+
+    /// <summary>errSecSuccess.</summary>
+    internal const int Success = 0;
+
+    /// <summary>errSecItemNotFound, which is an answer rather than a failure.</summary>
+    internal const int ItemNotFound = -25300;
+
+    // ---- CoreFoundation ------------------------------------------------------------------------------
+
+    /// <summary>Releases an owned handle.</summary>
+    [LibraryImport(CoreFoundation)]
+    internal static partial void CFRelease(IntPtr handle);
+
+    /// <summary>Copies bytes into a new CFData. Owned.</summary>
+    [LibraryImport(CoreFoundation)]
+    internal static partial IntPtr CFDataCreate(IntPtr allocator, IntPtr bytes, nint length);
+
+    [LibraryImport(CoreFoundation)]
+    internal static partial IntPtr CFDataGetBytePtr(IntPtr data);
+
+    [LibraryImport(CoreFoundation)]
+    internal static partial nint CFDataGetLength(IntPtr data);
+
+    /// <summary>Boxes a value as a CFNumber. Owned.</summary>
+    [LibraryImport(CoreFoundation)]
+    internal static partial IntPtr CFNumberCreate(IntPtr allocator, nint theType, IntPtr valuePtr);
+
+    /// <summary>Builds an immutable dictionary. Owned.</summary>
+    /// <remarks>
+    /// <para>
+    /// The key and value arrays are passed as raw pointers to memory the caller pins, rather than as
+    /// managed arrays. Source-generated interop wants an explicit element count for a marshalled array,
+    /// and supplying one here would mean stating the length twice — once for the marshaller and once as
+    /// <paramref name="numValues"/> — which is exactly the pair that drifts.
+    /// </para>
+    /// <para>
+    /// The two callback tables are what make the dictionary retain its keys and values, which is why
+    /// they are passed rather than left null: with null callbacks the dictionary stores raw pointers and
+    /// keeps nothing alive, and the resulting use-after-free is intermittent by nature.
+    /// </para>
+    /// </remarks>
+    [LibraryImport(CoreFoundation)]
+    internal static partial IntPtr CFDictionaryCreate(
+        IntPtr allocator,
+        IntPtr keys,
+        IntPtr values,
+        nint numValues,
+        IntPtr keyCallBacks,
+        IntPtr valueCallBacks);
+
+    // ---- Security.framework --------------------------------------------------------------------------
+
+    /// <summary>Builds the access policy a Secure Enclave key is created under. Owned.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial IntPtr SecAccessControlCreateWithFlags(
+        IntPtr allocator,
+        IntPtr protection,
+        AccessControlFlags flags,
+        out IntPtr error);
+
+    /// <summary>Creates a key pair from an attribute dictionary. Owned.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial IntPtr SecKeyCreateRandomKey(IntPtr parameters, out IntPtr error);
+
+    /// <summary>The public half of a key. Owned.</summary>
+    /// <remarks>
+    /// Available even for an enclave key, and that asymmetry is the whole reason this design works: the
+    /// public half is an ordinary key this process can hold and use, while the private half is a handle
+    /// to something inside the enclave that never becomes bytes. So sealing is silent and unsealing is
+    /// the thing the user is asked about.
+    /// </remarks>
+    [LibraryImport(SecurityFramework)]
+    internal static partial IntPtr SecKeyCopyPublicKey(IntPtr key);
+
+    /// <summary>Encrypts with a public key. Owned.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial IntPtr SecKeyCreateEncryptedData(
+        IntPtr key,
+        IntPtr algorithm,
+        IntPtr plaintext,
+        out IntPtr error);
+
+    /// <summary>Decrypts with a private key, prompting for whatever guards it. Owned.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial IntPtr SecKeyCreateDecryptedData(
+        IntPtr key,
+        IntPtr algorithm,
+        IntPtr ciphertext,
+        out IntPtr error);
+
+    /// <summary>Finds a keychain item. The out handle is owned when the result is <see cref="Success"/>.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial int SecItemCopyMatching(IntPtr query, out IntPtr result);
+
+    /// <summary>Deletes every keychain item matching the query.</summary>
+    [LibraryImport(SecurityFramework)]
+    internal static partial int SecItemDelete(IntPtr query);
+
+    // ---- The framework constants ---------------------------------------------------------------------
+
+    /// <summary>
+    /// Reads one of a framework's global CFString constants, or zero if it is not exported.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The keys these dictionaries take are not strings this code may spell for itself. They are
+    /// pointer-comparable constants exported by the framework, and a CFString built here with the same
+    /// characters is a different object — the lookups would miss and the call would fail with a
+    /// parameter error naming nothing.
+    /// </para>
+    /// <para>
+    /// <b>Dereferenced once, because the exported symbol is the variable rather than its value.</b>
+    /// <c>TryGetExport</c> answers the address of the global; the CFStringRef is what that address
+    /// holds. Missing the indirection produces a pointer that is stable, plausible and wrong, which is
+    /// the worst of the three available outcomes.
+    /// </para>
+    /// <para>
+    /// Zero on a missing symbol rather than an exception, because the caller's answer to every failure
+    /// is the same one — report the store unavailable and let unlock ask for the passphrase — and a
+    /// constant that has been renamed by a future macOS should reach that answer rather than a crash.
+    /// </para>
+    /// </remarks>
+    internal static IntPtr Constant(IntPtr library, string symbol) =>
+        NativeLibrary.TryGetExport(library, symbol, out var address)
+            ? Marshal.ReadIntPtr(address)
+            : IntPtr.Zero;
+}
+
+/// <summary>
+/// Releases every CoreFoundation handle put into it, in reverse order, exactly once.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The alternative is a try/finally per handle, and the operations here need six or seven at a time — a
+/// dictionary holding a nested dictionary holding an access control object holding a CFData tag. Finallys
+/// nested that deep stop being read, and a handle released twice is a crash rather than a leak.
+/// </para>
+/// <para>
+/// <see cref="Keep"/> returns what it was given, so a handle can be tracked in the same expression that
+/// produces it and the call sites read as ordinary code.
+/// </para>
+/// </remarks>
+[SupportedOSPlatform("macos")]
+internal sealed class CoreFoundationScope : IDisposable
+{
+    private readonly List<IntPtr> owned = [];
+
+    private bool disposed;
+
+    /// <summary>Takes ownership of a handle and hands it straight back.</summary>
+    /// <remarks>
+    /// Zero is ignored rather than rejected. Every CoreFoundation call here answers zero on failure, so
+    /// accepting it lets a caller track the result in the expression that produces it and check it on
+    /// the next line, instead of writing the check twice.
+    /// </remarks>
+    internal IntPtr Keep(IntPtr handle)
+    {
+        if (handle != IntPtr.Zero)
+        {
+            owned.Add(handle);
+        }
+
+        return handle;
+    }
+
+    public void Dispose()
+    {
+        if (disposed)
+        {
+            return;
+        }
+
+        disposed = true;
+
+        // Reverse order, so a container is released before the things it retains. CoreFoundation does not
+        // require it — retain counts make the order irrelevant — but it keeps the lifetimes readable in a
+        // debugger, where a released container that still lists its contents is a confusing thing to meet.
+        for (var i = owned.Count - 1; i >= 0; i--)
+        {
+            MacSecurity.CFRelease(owned[i]);
+        }
+
+        owned.Clear();
+    }
+}

src/DodoSSH.Client.App/Platform/MacSymbols.cs

@@ -0,0 +1,185 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+
+namespace DodoSSH.Client.App.Platform;
+
+/// <summary>
+/// The framework constants <see cref="MacDeviceKeyStore"/> passes to CoreFoundation and Security.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Every field here is a pointer read out of a loaded framework rather than a value this code could
+/// write down. The dictionaries these go into are matched by pointer identity, so a CFString built with
+/// the same characters is a different key and the lookup misses — see <see cref="MacSecurity.Constant"/>
+/// for the indirection that trips people.
+/// </para>
+/// <para>
+/// <b>Resolved once and cached, and the caching is what makes the failure survivable.</b> Two frameworks
+/// and nineteen symbols is a lot of things to be wrong about, and the useful property is that being
+/// wrong about any one of them shows up here — as <see cref="Complete"/> being false — rather than
+/// three calls later as a parameter error. A store that reports itself unavailable sends the user back
+/// to their passphrase; a store that half works corrupts the moment somebody registers a device.
+/// </para>
+/// <para>
+/// <see cref="Lazy{T}"/> rather than a static constructor, because a type initialiser that throws
+/// poisons the type for the life of the process and turns a missing symbol into a
+/// <c>TypeInitializationException</c> at every later call site. The load is done inside a try instead,
+/// and its failure is a value.
+/// </para>
+/// </remarks>
+[SupportedOSPlatform("macos")]
+internal sealed class MacSymbols
+{
+    private static readonly Lazy<MacSymbols> Cached = new(Load, LazyThreadSafetyMode.ExecutionAndPublication);
+
+    private MacSymbols()
+    {
+    }
+
+    /// <summary>Whether every symbol resolved.</summary>
+    /// <remarks>
+    /// Checked by every caller before any of the pointers are used. It is one check rather than
+    /// nineteen, which is the only reason the call sites in <see cref="MacDeviceKeyStore"/> are
+    /// readable.
+    ///
+    /// Computed rather than stored, so that the instance returned when a framework will not load at all
+    /// — every field left at zero — answers false without that having to be set anywhere. One rule,
+    /// applied to the only state there is.
+    /// </remarks>
+    internal bool Complete => AllResolved();
+
+    // CoreFoundation.
+    internal IntPtr True { get; private init; }
+
+    internal IntPtr TypeDictionaryKeyCallBacks { get; private init; }
+
+    internal IntPtr TypeDictionaryValueCallBacks { get; private init; }
+
+    // Security: item classes and query keys.
+    internal IntPtr Class { get; private init; }
+
+    internal IntPtr ClassKey { get; private init; }
+
+    internal IntPtr ReturnRef { get; private init; }
+
+    internal IntPtr UseDataProtectionKeychain { get; private init; }
+
+    internal IntPtr UseOperationPrompt { get; private init; }
+
+    // Security: key attributes.
+    internal IntPtr AttrKeyType { get; private init; }
+
+    internal IntPtr AttrKeySizeInBits { get; private init; }
+
+    internal IntPtr AttrTokenId { get; private init; }
+
+    internal IntPtr AttrIsPermanent { get; private init; }
+
+    internal IntPtr AttrApplicationTag { get; private init; }
+
+    internal IntPtr AttrAccessControl { get; private init; }
+
+    internal IntPtr PrivateKeyAttrs { get; private init; }
+
+    // Security: attribute values.
+    internal IntPtr KeyTypeEcSecPrimeRandom { get; private init; }
+
+    internal IntPtr TokenIdSecureEnclave { get; private init; }
+
+    internal IntPtr AccessibleWhenUnlockedThisDeviceOnly { get; private init; }
+
+    /// <summary>
+    /// <c>kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM</c>.
+    /// </summary>
+    /// <remarks>
+    /// The one algorithm the Secure Enclave's P-256 keys support for encryption, and the reason this
+    /// store wraps rather than signs. The long name spells out the whole construction: an ephemeral
+    /// key agreed against the enclave's public half with cofactor ECDH, run through the X9.63 KDF with
+    /// SHA-256, used as an AES-GCM key. The ephemeral public key travels in the output, which is why the
+    /// ciphertext is larger than the 32 bytes going in and why nothing else has to be stored beside it.
+    /// </remarks>
+    internal IntPtr EciesAlgorithm { get; private init; }
+
+    /// <summary>The resolved symbols, loaded once.</summary>
+    internal static MacSymbols Resolve() => Cached.Value;
+
+    private static MacSymbols Load()
+    {
+        try
+        {
+            if (!NativeLibrary.TryLoad(MacSecurity.CoreFoundation, out var cf)
+                || !NativeLibrary.TryLoad(MacSecurity.SecurityFramework, out var sec))
+            {
+                // Every pointer left at zero, which AllResolved reads as incomplete.
+                return new MacSymbols();
+            }
+
+            // The two callback tables are structs rather than object pointers, so what is wanted is the
+            // address of the export itself and not what it holds. Every other symbol here is a CFTypeRef
+            // global and needs the dereference; these two do not, and mixing them up produces a
+            // dictionary that does not retain its contents.
+            var keyCallBacks = NativeLibrary.TryGetExport(cf, "kCFTypeDictionaryKeyCallBacks", out var k)
+                ? k
+                : IntPtr.Zero;
+
+            var valueCallBacks = NativeLibrary.TryGetExport(cf, "kCFTypeDictionaryValueCallBacks", out var v)
+                ? v
+                : IntPtr.Zero;
+
+            return new MacSymbols
+            {
+                True = MacSecurity.Constant(cf, "kCFBooleanTrue"),
+                TypeDictionaryKeyCallBacks = keyCallBacks,
+                TypeDictionaryValueCallBacks = valueCallBacks,
+
+                Class = MacSecurity.Constant(sec, "kSecClass"),
+                ClassKey = MacSecurity.Constant(sec, "kSecClassKey"),
+                ReturnRef = MacSecurity.Constant(sec, "kSecReturnRef"),
+                UseDataProtectionKeychain = MacSecurity.Constant(sec, "kSecUseDataProtectionKeychain"),
+                UseOperationPrompt = MacSecurity.Constant(sec, "kSecUseOperationPrompt"),
+
+                AttrKeyType = MacSecurity.Constant(sec, "kSecAttrKeyType"),
+                AttrKeySizeInBits = MacSecurity.Constant(sec, "kSecAttrKeySizeInBits"),
+                AttrTokenId = MacSecurity.Constant(sec, "kSecAttrTokenID"),
+                AttrIsPermanent = MacSecurity.Constant(sec, "kSecAttrIsPermanent"),
+                AttrApplicationTag = MacSecurity.Constant(sec, "kSecAttrApplicationTag"),
+                AttrAccessControl = MacSecurity.Constant(sec, "kSecAttrAccessControl"),
+                PrivateKeyAttrs = MacSecurity.Constant(sec, "kSecPrivateKeyAttrs"),
+
+                KeyTypeEcSecPrimeRandom = MacSecurity.Constant(sec, "kSecAttrKeyTypeECSECPrimeRandom"),
+                TokenIdSecureEnclave = MacSecurity.Constant(sec, "kSecAttrTokenIDSecureEnclave"),
+                AccessibleWhenUnlockedThisDeviceOnly =
+                    MacSecurity.Constant(sec, "kSecAttrAccessibleWhenUnlockedThisDeviceOnly"),
+
+                EciesAlgorithm = MacSecurity.Constant(
+                    sec,
+                    "kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM"),
+            };
+        }
+        catch (Exception exception) when (exception is DllNotFoundException or BadImageFormatException)
+        {
+            return new MacSymbols();
+        }
+    }
+
+    private bool AllResolved() =>
+        True != IntPtr.Zero
+        && TypeDictionaryKeyCallBacks != IntPtr.Zero
+        && TypeDictionaryValueCallBacks != IntPtr.Zero
+        && Class != IntPtr.Zero
+        && ClassKey != IntPtr.Zero
+        && ReturnRef != IntPtr.Zero
+        && UseDataProtectionKeychain != IntPtr.Zero
+        && UseOperationPrompt != IntPtr.Zero
+        && AttrKeyType != IntPtr.Zero
+        && AttrKeySizeInBits != IntPtr.Zero
+        && AttrTokenId != IntPtr.Zero
+        && AttrIsPermanent != IntPtr.Zero
+        && AttrApplicationTag != IntPtr.Zero
+        && AttrAccessControl != IntPtr.Zero
+        && PrivateKeyAttrs != IntPtr.Zero
+        && KeyTypeEcSecPrimeRandom != IntPtr.Zero
+        && TokenIdSecureEnclave != IntPtr.Zero
+        && AccessibleWhenUnlockedThisDeviceOnly != IntPtr.Zero
+        && EciesAlgorithm != IntPtr.Zero;
+}

src/DodoSSH.Client.App/Platform/VelopackUpdateChannel.cs

@@ -31,7 +31,12 @@ internal static class UpdateChannels
     /// </remarks>
     internal static IUpdateChannel ForThisMachine()
     {
-        if (!OperatingSystem.IsWindows())
+        // Two platforms now, and the check is a list rather than a negation for a reason: Linux reaches
+        // this too. Velopack has a Linux path — AppImage — but this repository does not build one, so a
+        // Linux build is a checkout somebody ran, and handing it an UpdateManager would have it poll a
+        // feed carrying nothing it could apply. Naming the platforms that are packaged keeps a future
+        // AppImage an addition here rather than a thing that silently already half-happened.
+        if (!OperatingSystem.IsWindows() && !OperatingSystem.IsMacOS())
         {
             return new UnavailableUpdateChannel();
         }
@@ -55,14 +60,21 @@ internal static class UpdateChannels
 }
 
 /// <summary>
-/// The Windows update channel, backed by Velopack against the project's own forge.
+/// The desktop update channel, backed by Velopack against the project's own forge.
 /// </summary>
 /// <remarks>
 /// <para>
-/// The one file in the repository that names Velopack. It lives beside <c>WindowsDeviceKeyStore</c>
-/// rather than in a project of its own because it is the same kind of thing — a Windows-only
-/// implementation of an interface declared in <c>DodoSSH.Client.Session</c> — and because
-/// <c>DodoSSH.Client.Shell</c> is shared with the Android head, which must never acquire an updater.
+/// The one file in the repository that names Velopack. It lives beside the platform key stores rather
+/// than in a project of its own because it is the same kind of thing — a desktop-only implementation of
+/// an interface declared in <c>DodoSSH.Client.Session</c> — and because <c>DodoSSH.Client.Shell</c> is
+/// shared with the Android head, which must never acquire an updater.
+/// </para>
+/// <para>
+/// <b>One class for both desktop platforms, where the key stores are one class each.</b> The difference
+/// is where the platform knowledge sits. A key store is platform knowledge from top to bottom: different
+/// hardware, different API, different failure modes. Velopack's <c>UpdateManager</c> has already absorbed
+/// all of that, and what is left over — check, download, apply, restart — is identical on the two. The
+/// only thing that differs is which string names the feed, and that is <see cref="ChannelFor"/>.
 /// </para>
 /// <para>
 /// See <c>docs/adr/0013-desktop-distribution-and-updates.md</c>.
@@ -103,7 +115,7 @@ internal sealed class VelopackUpdateChannel : IUpdateChannel
     /// but unsaid on one side and stated on the other is how a feed goes quiet with no error anywhere:
     /// the check succeeds, finds nothing, and reports that the client is up to date forever.
     /// </remarks>
-    private const string ReleaseChannel = "win";
+    private const string WindowsReleaseChannel = "win";
 
     /// <summary>
     /// The nightly channel, which is a different name rather than the same one on a different tag.
@@ -122,7 +134,26 @@ internal sealed class VelopackUpdateChannel : IUpdateChannel
     /// a download somebody watched. A channel each means neither ever sees the other's releases at all.
     /// </para>
     /// </remarks>
-    private const string NightlyChannel = "win-nightly";
+    private const string WindowsNightlyChannel = "win-nightly";
+
+    /// <summary>The macOS release channel, and Velopack's own default there.</summary>
+    /// <remarks>
+    /// A contract with <c>scripts/release-macos.sh</c>, exactly as the Windows pair is one with the
+    /// PowerShell script. Stated for the same reason, which applies with more force here: the four
+    /// channels all publish to one repository, so the only thing keeping a Mac from being offered a
+    /// <c>win</c> package is that it never reads that index.
+    /// </remarks>
+    private const string MacReleaseChannel = "osx";
+
+    /// <summary>The macOS nightly channel.</summary>
+    /// <remarks>
+    /// Named here and not yet published by anything. The CI job for the macOS head builds and bundles
+    /// and deliberately uploads nothing — see the packaging step in <c>ci.yml</c> — so a nightly macOS
+    /// build checking this feed finds an empty channel and reports itself up to date, which is the
+    /// correct behaviour for a channel with no publisher. The name exists so that turning the publisher
+    /// on later is one job rather than a job plus a rename that has to reach every installed client.
+    /// </remarks>
+    private const string MacNightlyChannel = "osx-nightly";
 
     private readonly UpdateManager manager;
 
@@ -141,10 +172,13 @@ internal sealed class VelopackUpdateChannel : IUpdateChannel
     /// <inheritdoc />
     public bool IsSupported => true;
 
-    /// <summary>Always, on this head.</summary>
+    /// <summary>Always, on this head, on either platform.</summary>
     /// <remarks>
-    /// Velopack's apply runs <c>Update.exe</c> over this installation and restarts it, so the process is
-    /// gone by the time anything could have asked a question. The phone's is the other answer; see
+    /// Velopack's apply hands off to a separate updater process — <c>Update.exe</c> on Windows, the
+    /// <c>UpdateMac</c> helper inside the bundle on macOS — which replaces this installation and
+    /// relaunches it, so the process is gone by the time anything could have asked a question. The
+    /// mechanism differs and the answer does not, which is why this is a constant rather than another
+    /// thing <see cref="ChannelFor"/> would have to decide. The phone's is the other answer; see
     /// <see cref="IUpdateChannel.ApplyingEndsTheProcess"/> for what the caller does differently.
     /// </remarks>
     public bool ApplyingEndsTheProcess => true;
@@ -183,7 +217,36 @@ internal sealed class VelopackUpdateChannel : IUpdateChannel
 
         return new UpdateManager(
             new GiteaSource(RepositoryUrl, accessToken: null, prerelease: nightly),
-            new UpdateOptions { ExplicitChannel = nightly ? NightlyChannel : ReleaseChannel });
+            new UpdateOptions { ExplicitChannel = ChannelFor(nightly) });
+    }
+
+    /// <summary>
+    /// The one of the four channel names this build belongs to.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Two independent axes — which platform, and which of that platform's two channels — and they are
+    /// resolved in one place so that neither can be answered differently somewhere else. The platform
+    /// half is the running OS rather than anything recorded in the build, because a package can only
+    /// ever be applied on the platform it was built for; the channel half comes from assembly metadata,
+    /// because a release build and a nightly are the same bytes on the same OS and only the metadata
+    /// tells them apart.
+    /// </para>
+    /// <para>
+    /// Windows is the fallback rather than a third branch. Only Windows and macOS reach here at all —
+    /// <see cref="UpdateChannels.ForThisMachine"/> is the gate — so the alternative would be an
+    /// unreachable throw, and an unreachable throw in the middle of the updater is a thing somebody
+    /// later has to reason about to discover it cannot happen.
+    /// </para>
+    /// </remarks>
+    private static string ChannelFor(bool nightly)
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            return nightly ? MacNightlyChannel : MacReleaseChannel;
+        }
+
+        return nightly ? WindowsNightlyChannel : WindowsReleaseChannel;
     }
 
     /// <inheritdoc />

src/DodoSSH.Client.App/Platform/WindowsDeviceKeyStore.cs

@@ -9,9 +9,17 @@ namespace DodoSSH.Client.App.Platform;
 /// </summary>
 /// <remarks>
 /// <para>
-/// One place decides, so nothing above has to carry a platform guard. A machine with no TPM, or one that
-/// is not Windows, gets <see cref="UnavailableDeviceKeyStore"/> and therefore keeps asking for the
-/// passphrase — which is the honest answer rather than a degraded one.
+/// One place decides, so nothing above has to carry a platform guard. A machine with no secure hardware,
+/// or one that is neither Windows nor macOS, gets <see cref="UnavailableDeviceKeyStore"/> and therefore
+/// keeps asking for the passphrase — which is the honest answer rather than a degraded one.
+/// </para>
+/// <para>
+/// <b>Both real stores are asked whether they work rather than told that they do.</b> Each
+/// <c>IsSupported</c> probes by doing the thing — creating a throwaway key and deleting it — because on
+/// both platforms the provider is present and reports itself present on machines where creating a key
+/// fails: a Windows box with no usable TPM, a Mac with no Secure Enclave, and on macOS also every
+/// unsigned development build, since enclave keys need a signing identity. Inferring from the OS would
+/// mean each of those discovering the truth at the moment somebody tried to unlock.
 /// </para>
 /// <para>
 /// <b>"Desktop", because the choice belongs to a head rather than to the session layer.</b> This file used
@@ -29,9 +37,17 @@ public static class DesktopDeviceKeyStores
     {
         ArgumentNullException.ThrowIfNull(paths);
 
-        return OperatingSystem.IsWindows() && WindowsDeviceKeyStore.IsSupported()
-            ? new WindowsDeviceKeyStore(paths)
-            : new UnavailableDeviceKeyStore();
+        if (OperatingSystem.IsWindows() && WindowsDeviceKeyStore.IsSupported())
+        {
+            return new WindowsDeviceKeyStore(paths);
+        }
+
+        if (OperatingSystem.IsMacOS() && MacDeviceKeyStore.IsSupported())
+        {
+            return new MacDeviceKeyStore(paths);
+        }
+
+        return new UnavailableDeviceKeyStore();
     }
 }
 

src/DodoSSH.Client.App/Views/ImportScreen.axaml

@@ -12,9 +12,10 @@
     forty entries for machines that stopped existing years ago. So scanning writes nothing and the list
     says what each entry means; importing is a separate press on a set somebody has looked at.
 
-    Reachable from the preferences screen and not from the nav rail. It is a task rather than a
-    destination — done once, or once a year — and a seventh rail entry would cost every screen a slot for
-    something almost nobody is looking at.
+    v5c-3: restyled into Import.dc.html's own table over SettingsView's content column — SettingsNav stays
+    lit on Preferences while this is up, and the titlebar says "Back to preferences"; see
+    MainWindowViewModel.IsImportOpen. No longer reachable from the nav rail, exactly as before: it is a task
+    done once or once a year, reached from the Preferences page's own "OPEN IMPORTER" row.
 
     ── ◆ THE ONE TICK THAT READS PRIVATE KEYS ─────────────────────────────────────────────────────────────
     Below the list, off, and drawn only where the scan actually found an IdentityFile. It is the only control
@@ -26,144 +27,212 @@
     What comes back afterwards is the report under the list: one line per key file, saying which were stored,
     which are protected by a passphrase this cannot know, and which were not there at all. That is reported
     rather than previewed for the same reason — previewing would mean reading them.
+
+    ── ◆ WHAT THIS MEANS ──────────────────────────────────────────────────────────────────────────────────
+    One chip per row rather than the old separate AUTHENTICATION/STATE columns, mapped off the two facts a
+    row actually carries: ImportRowViewModel.AlreadyPresent and HasWarnings. A skipped Host pattern (a
+    wildcard block) never becomes a row at all — see SshConfigImport.SkippedPatterns — so there is no third,
+    "skipped" state to draw here; a warned row is the amber case instead, and it wins over "already here"
+    because the warning is the more actionable of the two facts. See ImportRowViewModel.Meaning.
   -->
 
-  <Grid RowDefinitions="Auto,Auto,Auto,*,Auto">
+  <UserControl.Styles>
+    <!-- The row's own hover fill, matching the design's per-row style-hover — Track, the same as every other table this application draws. -->
+    <Style Selector="Border.importrow:pointerover">
+      <Setter Property="Background" Value="{StaticResource Track}" />
+    </Style>
+    <Style Selector="Border.meaningchip.new">
+      <Setter Property="Background" Value="{StaticResource LiveWash}" />
+    </Style>
+    <Style Selector="Border.meaningchip.new > TextBlock">
+      <Setter Property="Foreground" Value="{StaticResource Live}" />
+    </Style>
+    <Style Selector="Border.meaningchip.exists">
+      <Setter Property="Background" Value="{StaticResource Chip}" />
+    </Style>
+    <Style Selector="Border.meaningchip.exists > TextBlock">
+      <Setter Property="Foreground" Value="{StaticResource TextFaint}" />
+    </Style>
+    <Style Selector="Border.meaningchip.warn">
+      <Setter Property="Background" Value="{StaticResource WarnWash}" />
+    </Style>
+    <Style Selector="Border.meaningchip.warn > TextBlock">
+      <Setter Property="Foreground" Value="{StaticResource WarnText}" />
+    </Style>
+  </UserControl.Styles>
 
-    <Border Grid.Row="0" Padding="14,0" Height="44"
-            BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
-      <Grid ColumnDefinitions="Auto,*,Auto" VerticalAlignment="Center">
-        <TextBlock Grid.Column="0" Classes="mono" Text="IMPORT SSH CONFIG" FontSize="12"
-                   FontWeight="SemiBold" LetterSpacing="1" Foreground="{StaticResource Text}"
-                   VerticalAlignment="Center" />
-        <TextBlock Grid.Column="1" Classes="mono" Text="{Binding ConfigPath}" FontSize="10.5"
-                   Foreground="{StaticResource TextFaint}" Margin="10,0" VerticalAlignment="Center"
-                   TextTrimming="CharacterEllipsis" />
-        <Button Grid.Column="2" Classes="ghost" Content="SCAN" Command="{Binding ScanCommand}"
-                IsEnabled="{Binding !IsBusy}"
-                ToolTip.Tip="Reads the file and shows what it found. Nothing is stored." />
-      </Grid>
-    </Border>
+  <Grid MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch" RowDefinitions="Auto,Auto,Auto,*,Auto">
 
-    <TextBlock Grid.Row="1" Classes="hint" Text="{Binding Status}" FontSize="12" Margin="14,12,14,0"
+    <!-- ============ HEADER ============ -->
+    <Grid Grid.Row="0" ColumnDefinitions="*,Auto">
+      <StackPanel Grid.Column="0" Spacing="10">
+        <TextBlock Classes="settingstitle" Text="Import SSH config" />
+        <TextBlock Classes="mono" Text="{Binding HeaderStatus}" FontSize="12"
+                   Foreground="{StaticResource TextFaint}" TextTrimming="CharacterEllipsis" />
+      </StackPanel>
+      <Button Grid.Column="1" Classes="ghost" Height="40" VerticalAlignment="Top" Content="SCAN AGAIN"
+              Command="{Binding ScanCommand}" IsEnabled="{Binding !IsBusy}"
+              ToolTip.Tip="Reads the file again and shows what it found. Nothing is stored." />
+    </Grid>
+
+    <TextBlock Grid.Row="1" Classes="hint" Text="{Binding Status}" FontSize="12" Margin="0,10,0,0"
                TextWrapping="Wrap" />
 
     <!--
-      What could not be honoured, above the list rather than beside it. Every one of these is a way the
-      import is quieter than the file — an ignored Match block, a dropped ProxyCommand — and a person
-      comparing the two needs to be told before they conclude the parser lost something.
+      What could not be honoured, at document level. Every one of these is a way the import is quieter than
+      the file — an ignored Match block, a dropped ProxyCommand — and a person comparing the two needs to be
+      told before they conclude the parser lost something.
     -->
-    <Border Grid.Row="2" Margin="14,12,14,0" Padding="10,8" CornerRadius="4"
+    <Border Grid.Row="2" Margin="0,14,0,0" Padding="14,10" CornerRadius="10"
             Background="{StaticResource WarnWash}" BorderBrush="{StaticResource WarnSoft}"
             BorderThickness="1" IsVisible="{Binding HasWarnings}">
       <ItemsControl ItemsSource="{Binding Warnings}">
         <ItemsControl.ItemTemplate>
           <DataTemplate x:DataType="x:String">
-            <TextBlock Text="{Binding}" Foreground="{StaticResource WarnText}" FontSize="11"
+            <TextBlock Text="{Binding}" Foreground="{StaticResource WarnText}" FontSize="11.5"
                        TextWrapping="Wrap" Margin="0,2" />
           </DataTemplate>
         </ItemsControl.ItemTemplate>
       </ItemsControl>
     </Border>
 
-    <Grid Grid.Row="3" RowDefinitions="Auto,*" Margin="0,12,0,0" IsVisible="{Binding HasRows}">
+    <!-- ============ THE TABLE ============ -->
+    <Border Grid.Row="3" Margin="0,18,0,0" CornerRadius="12" Background="{StaticResource Pane}"
+            BorderBrush="{StaticResource Border}" BorderThickness="1" ClipToBounds="True"
+            IsVisible="{Binding HasRows}">
+      <Grid RowDefinitions="Auto,*">
 
-      <Grid Grid.Row="0" ColumnDefinitions="34,1.1*,1.4*,1.6*,96" Margin="14,0,14,6">
-        <TextBlock Grid.Column="1" Classes="label" Text="NAME" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="2" Classes="label" Text="ADDRESS" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="3" Classes="label" Text="AUTHENTICATION" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="4" Classes="label" Text="STATE" FontSize="9.5" LetterSpacing="1" />
+        <Border Grid.Row="0" Padding="24,14,24,10" BorderBrush="{StaticResource Border}"
+                BorderThickness="0,0,0,1">
+          <Grid ColumnDefinitions="24,1*,1.4*,0.7*,0.5*,1.3*">
+            <!--
+              The header tick-all box. A plain Button rather than a CheckBox — ImportRowViewModel's own
+              ToggleAllCommand is "tick everything, or untick everything" in one press, which is a command
+              rather than a two-way bound bool, and a CheckBox has no Command of its own to hang that on.
+            -->
+            <Button Grid.Column="0" Classes="flat" Width="18" Height="18" Padding="0"
+                    VerticalAlignment="Center" Command="{Binding ToggleAllCommand}"
+                    ToolTip.Tip="Tick or untick every row">
+              <Panel Width="18" Height="18">
+                <Border CornerRadius="5" Background="{StaticResource Accent}" IsVisible="{Binding AllTicked}">
+                  <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5CA;" FontSize="13"
+                             Foreground="White" HorizontalAlignment="Center" VerticalAlignment="Center" />
+                </Border>
+                <Border CornerRadius="5" BorderBrush="{StaticResource BorderMid}" BorderThickness="1.5"
+                        IsVisible="{Binding !AllTicked}" />
+              </Panel>
+            </Button>
+            <TextBlock Grid.Column="1" Classes="label" Text="ALIAS" FontSize="9.5" LetterSpacing="1"
+                       Margin="14,0,0,0" />
+            <TextBlock Grid.Column="2" Classes="label" Text="HOSTNAME" FontSize="9.5" LetterSpacing="1" />
+            <TextBlock Grid.Column="3" Classes="label" Text="USER" FontSize="9.5" LetterSpacing="1" />
+            <TextBlock Grid.Column="4" Classes="label" Text="PORT" FontSize="9.5" LetterSpacing="1" />
+            <TextBlock Grid.Column="5" Classes="label" Text="WHAT THIS MEANS" FontSize="9.5" LetterSpacing="1" />
+          </Grid>
+        </Border>
+
+        <ScrollViewer Grid.Row="1">
+          <ItemsControl ItemsSource="{Binding Rows}" Margin="12,8">
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="vm:ImportRowViewModel">
+                <Border Classes="importrow" CornerRadius="8">
+                  <Grid ColumnDefinitions="24,1*,1.4*,0.7*,0.5*,1.3*" Margin="12" MinHeight="20">
+                    <CheckBox Grid.Column="0" IsChecked="{Binding IsSelected}" VerticalAlignment="Center" />
+                    <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Alias}" FontSize="12.5"
+                               FontWeight="Medium" Foreground="{StaticResource Text}" Margin="14,0,10,0"
+                               TextTrimming="CharacterEllipsis" VerticalAlignment="Center"
+                               ToolTip.Tip="{Binding Authentication}" />
+                    <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Hostname}" FontSize="11.5"
+                               Foreground="{StaticResource TextDim}" Margin="0,0,10,0"
+                               TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+                    <TextBlock Grid.Column="3" Classes="mono" Text="{Binding User}" FontSize="11.5"
+                               Foreground="{StaticResource TextDim}" Margin="0,0,10,0"
+                               TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+                    <TextBlock Grid.Column="4" Classes="mono" Text="{Binding Port}" FontSize="11.5"
+                               Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
+                    <Border Grid.Column="5" Classes="meaningchip" CornerRadius="5" Padding="8,3"
+                            HorizontalAlignment="Left" VerticalAlignment="Center"
+                            Classes.new="{Binding IsMeaningNew}" Classes.exists="{Binding IsMeaningExisting}"
+                            Classes.warn="{Binding IsMeaningWarned}" ToolTip.Tip="{Binding Meaning}">
+                      <TextBlock Text="{Binding Meaning}" FontSize="10" FontWeight="SemiBold"
+                                 MaxWidth="230" TextTrimming="CharacterEllipsis" />
+                    </Border>
+                  </Grid>
+                </Border>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+        </ScrollViewer>
+
+      </Grid>
+    </Border>
+
+    <!-- ============ FOOTER ============ -->
+    <StackPanel Grid.Row="4" Margin="0,16,0,0" Spacing="16" IsVisible="{Binding HasRows}">
+
+      <!--
+        Said before the button, not after. Whether the key material comes with the host is the difference
+        between a bookmark that connects and one that asks for a password, and somebody who is not told
+        will conclude the import was broken.
+      -->
+      <TextBlock Classes="hint" FontSize="11.5" TextWrapping="Wrap" IsVisible="{Binding !ImportsKeys}"
+                 Text="Key files are not read. Where ssh_config names an IdentityFile the path is recorded as a note, and the host asks for a password until you bind it to a key in your keychain." />
+
+      <!--
+        ◆ THE OPT-IN CARD. Hidden entirely where the scan found no IdentityFile anywhere — an offer to read
+        ~/.ssh on a screen where it would read nothing is a control that teaches people to ignore it.
+      -->
+      <Border CornerRadius="12" Background="{StaticResource Raised}" BorderBrush="{StaticResource WarnSoft}"
+              BorderThickness="1" Padding="18,16" IsVisible="{Binding HasKeyFiles}">
+        <StackPanel Orientation="Horizontal" Spacing="14">
+          <CheckBox VerticalAlignment="Top" Margin="0,3,0,0" IsChecked="{Binding ImportsKeys}" />
+          <StackPanel Spacing="6">
+            <TextBlock Text="Also store the private keys these entries point at" FontSize="13.5"
+                       FontWeight="SemiBold" Foreground="{StaticResource Text}" />
+            <TextBlock Classes="hint" FontSize="11.5" LineHeight="17.5" TextWrapping="Wrap"
+                       Text="{Binding KeyMaterialIntro}" />
+            <!--
+              The warning sentence appears only when the tick is on, and it is the one place this application
+              says out loud that it is about to open private keys.
+            -->
+            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap" IsVisible="{Binding ImportsKeys}"
+                       Foreground="{StaticResource WarnText}"
+                       Text="Pressing IMPORT will read each host's first IdentityFile out of ~/.ssh, store it in this vault encrypted, and bind the host to it. One key is stored per file however many hosts name it, and a file already in your keychain is bound to rather than stored twice. A key protected by a passphrase comes in without one — nothing on disk says what it is — and the report below will name it." />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+
+      <!--
+        ◆ What became of each key file, after the fact. Capped with a scroll viewer because a config with
+        thirty keyed hosts would otherwise push IMPORT off the window — the one control this screen must
+        never lose.
+      -->
+      <Border IsVisible="{Binding HasKeyReport}" Padding="12,10" CornerRadius="10"
+              Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}" BorderThickness="1">
+        <ScrollViewer MaxHeight="120">
+          <ItemsControl ItemsSource="{Binding KeyReport}">
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="x:String">
+                <TextBlock Text="{Binding}" Classes="hint" FontSize="10.5" TextWrapping="Wrap" Margin="0,2" />
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+        </ScrollViewer>
+      </Border>
+
+      <!-- "N of M entries selected · saving to {vault}", Cancel, Import N hosts. -->
+      <Grid ColumnDefinitions="*,Auto">
+        <TextBlock Grid.Column="0" Classes="hint" FontSize="12" VerticalAlignment="Center"
+                   Text="{Binding SelectionSummary}" />
+        <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="10">
+          <Button Classes="ghost" Height="44" Content="CANCEL" Command="{Binding CancelCommand}"
+                  ToolTip.Tip="Back to Preferences. Nothing is stored." />
+          <Button Classes="accent" Height="44" Content="{Binding ImportLabel}" Command="{Binding ImportCommand}"
+                  IsEnabled="{Binding !IsBusy}" />
+        </StackPanel>
       </Grid>
 
-      <ScrollViewer Grid.Row="1">
-        <ItemsControl ItemsSource="{Binding Rows}">
-          <ItemsControl.ItemTemplate>
-            <DataTemplate x:DataType="vm:ImportRowViewModel">
-              <StackPanel Margin="14,0">
-                <Grid ColumnDefinitions="34,1.1*,1.4*,1.6*,96" Margin="0,7">
-                  <CheckBox Grid.Column="0" IsChecked="{Binding IsSelected}" VerticalAlignment="Center" />
-                  <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Alias}" FontSize="12"
-                             FontWeight="Medium" Foreground="{StaticResource Text}" Margin="0,0,8,0"
-                             TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-                  <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Address}" FontSize="10.5"
-                             Foreground="{StaticResource TextDim}" Margin="0,0,8,0"
-                             TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-                  <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Authentication}" FontSize="10.5"
-                             Foreground="{StaticResource TextFaint}" Margin="0,0,8,0"
-                             TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-                  <Border Grid.Column="4" Classes="chip" HorizontalAlignment="Left"
-                          VerticalAlignment="Center" IsVisible="{Binding HasBadge}">
-                    <TextBlock Text="{Binding Badge}" FontSize="9.5" />
-                  </Border>
-                </Grid>
-                <TextBlock Classes="hint" Text="{Binding Warnings}" FontSize="10.5" Margin="34,0,0,8"
-                           TextWrapping="Wrap" Foreground="{StaticResource WarnText}"
-                           IsVisible="{Binding HasWarnings}" />
-              </StackPanel>
-            </DataTemplate>
-          </ItemsControl.ItemTemplate>
-        </ItemsControl>
-      </ScrollViewer>
-    </Grid>
-
-    <Border Grid.Row="4" Padding="14,10" Background="{StaticResource Panel}"
-            BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
-            IsVisible="{Binding HasRows}">
-      <StackPanel Spacing="8">
-        <!--
-          Said before the button, not after. Whether the key material comes with the host is the difference
-          between a bookmark that connects and one that asks for a password, and somebody who is not told
-          will conclude the import was broken.
-        -->
-        <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                   IsVisible="{Binding !ImportsKeys}"
-                   Text="Key files are not read. Where ssh_config names an IdentityFile the path is recorded as a note, and the host asks for a password until you bind it to a key in your keychain." />
-
-        <!--
-          ◆ THE TICK. Hidden entirely where the scan found no IdentityFile anywhere — an offer to read ~/.ssh
-          on a screen where it would read nothing is a control that teaches people to ignore it.
-
-          The warning sentence appears only when it is on, and it is the one place this application says out
-          loud that it is about to open private keys. It names the directory rather than saying "your keys",
-          because what somebody is agreeing to is a read of that directory.
-        -->
-        <StackPanel Spacing="6" IsVisible="{Binding HasKeyFiles}">
-          <CheckBox IsChecked="{Binding ImportsKeys}">
-            <TextBlock Classes="mono" FontSize="11.5" TextWrapping="Wrap"
-                       Text="Also import the private keys these hosts point at" />
-          </CheckBox>
-          <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                     IsVisible="{Binding ImportsKeys}" Foreground="{StaticResource WarnText}"
-                     Text="Pressing IMPORT will read each host's first IdentityFile out of ~/.ssh, store it in this vault encrypted, and bind the host to it. One key is stored per file however many hosts name it, and a file already in your keychain is bound to rather than stored twice. A key protected by a passphrase comes in without one — nothing on disk says what it is — and the report below will name it." />
-        </StackPanel>
-
-        <StackPanel Orientation="Horizontal" Spacing="8">
-          <Button Classes="accent" Content="{Binding ImportLabel}" Command="{Binding ImportCommand}"
-                  IsEnabled="{Binding !IsBusy}" />
-          <Button Classes="ghost" Content="TICK ALL / NONE" Command="{Binding ToggleAllCommand}" />
-        </StackPanel>
-
-        <!--
-          ◆ What became of each key file, after the fact. Below the button because it is the answer rather
-          than the offer, and capped with a scroll viewer because a config with thirty keyed hosts would
-          otherwise push IMPORT off the window — the one control this screen must never lose.
-        -->
-        <Border IsVisible="{Binding HasKeyReport}" Padding="10,8" CornerRadius="4"
-                Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
-                BorderThickness="1">
-          <ScrollViewer MaxHeight="120">
-            <ItemsControl ItemsSource="{Binding KeyReport}">
-              <ItemsControl.ItemTemplate>
-                <DataTemplate x:DataType="x:String">
-                  <TextBlock Text="{Binding}" Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                             Margin="0,2" />
-                </DataTemplate>
-              </ItemsControl.ItemTemplate>
-            </ItemsControl>
-          </ScrollViewer>
-        </Border>
-      </StackPanel>
-    </Border>
+    </StackPanel>
 
   </Grid>
 

src/DodoSSH.Client.App/Views/ImportScreen.axaml.cs

@@ -1,6 +1,5 @@
 using Avalonia.Controls;
 using Avalonia.Controls.Primitives;
-using Avalonia.Input;
 using Avalonia.Interactivity;
 using DodoSSH.Client.Shell.ViewModels;
 
@@ -10,7 +9,11 @@ namespace DodoSSH.Client.App.Views;
 /// Importing hosts from <c>~/.ssh/config</c>.
 /// </summary>
 /// <remarks>
-/// A task rather than a destination, which is why it is reached from preferences and not from the nav rail.
+/// A task rather than a destination, which is why it is reached from Preferences rather than from the nav
+/// rail. v5c-3 moved it inside settings mode as an overlay over the Preferences page — it no longer has a
+/// keyboard target of its own to hand back: <c>MainWindow.axaml.cs</c>'s <c>KeyboardHome</c> falls back to
+/// the window for settings mode as a whole, the same way it already does for the account and logs screens,
+/// so a <c>KeyboardTarget</c> property here would be dead code nothing reads.
 /// </remarks>
 internal sealed partial class ImportScreen : UserControl
 {
@@ -24,9 +27,6 @@ internal sealed partial class ImportScreen : UserControl
         AddHandler(ToggleButton.IsCheckedChangedEvent, OnTickChanged, RoutingStrategies.Bubble);
     }
 
-    /// <summary>Where the keyboard lands when this screen is the one showing.</summary>
-    internal IInputElement KeyboardTarget => this;
-
     private void OnTickChanged(object? sender, RoutedEventArgs e)
     {
         if (DataContext is ImportViewModel import)

src/DodoSSH.Client.App/Views/KnownHostsScreen.axaml

@@ -15,128 +15,210 @@
 
     The data layer did not move and did not change. Every pin is still a vault item, still end-to-end
     encrypted, still synced; see KnownHostSecret. What is here is a screen over VaultViewModel.KnownHostPins.
+
+    v5c-3: restyled against KnownHosts.dc.html — still a main-chrome screen (the rail's own Keys item stays
+    the way in), a 40px back arrow to Keychain rather than the old link inside it, a bordered radius-12
+    container in place of the plain list-and-sidebar split, and a Copy fingerprint button beside Withdraw
+    pin. Everything the screen could do before still can: Filter, Selected, ForgetSelectedCommand and the
+    provenance notes below are unchanged, just repainted.
   -->
 
-  <Grid ColumnDefinitions="*,244">
+  <UserControl.Styles>
+    <!--
+      A row, not a card: Track fill on hover, Track fill plus an accent ring on the selected one, matching
+      the design's own "selected = Track bg + accent ring, hover Track" — the same idiom SnippetsScreen's
+      own ListBox.snipcards uses, at this design's own 8px radius rather than that one's 10.
+    -->
+    <Style Selector="ListBox.pinrows > ListBoxItem /template/ ContentPresenter#PART_ContentPresenter">
+      <Setter Property="CornerRadius" Value="8" />
+      <Setter Property="BorderThickness" Value="1" />
+      <Setter Property="BorderBrush" Value="Transparent" />
+    </Style>
+    <Style Selector="ListBox.pinrows > ListBoxItem:pointerover /template/ ContentPresenter#PART_ContentPresenter">
+      <Setter Property="Background" Value="{StaticResource Track}" />
+    </Style>
+    <Style Selector="ListBox.pinrows > ListBoxItem:selected /template/ ContentPresenter#PART_ContentPresenter">
+      <Setter Property="Background" Value="{StaticResource Track}" />
+      <Setter Property="BorderBrush" Value="{StaticResource Accent}" />
+    </Style>
+    <Style Selector="ListBox.pinrows > ListBoxItem:selected:pointerover /template/ ContentPresenter#PART_ContentPresenter">
+      <Setter Property="Background" Value="{StaticResource Track}" />
+      <Setter Property="BorderBrush" Value="{StaticResource Accent}" />
+    </Style>
+  </UserControl.Styles>
 
-    <Grid Grid.Column="0" RowDefinitions="Auto,Auto,*">
+  <Grid RowDefinitions="Auto,Auto,*" Margin="26">
 
-      <Border Grid.Row="0" Padding="14,0" Height="44"
-              BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
-        <Grid ColumnDefinitions="Auto,*,Auto" VerticalAlignment="Center">
-          <TextBlock Grid.Column="0" Classes="mono" Text="HOST KEYS" FontSize="12"
-                     FontWeight="SemiBold" LetterSpacing="1" Foreground="{StaticResource Text}"
-                     VerticalAlignment="Center" />
-          <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Summary}" FontSize="10.5"
-                     Foreground="{StaticResource TextFaint}" Margin="10,0,0,0"
-                     TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-
-          <!--
-            Matches fingerprints as well as host names, which is the point of it. What somebody does with
-            this screen is check whether a published SHA256:… is the one they approved, and searching only
-            by name would answer a different question.
-          -->
-          <TextBox Grid.Column="2" x:Name="PinFilter" Text="{Binding Filter}" Width="240"
-                   PlaceholderText="filter by host or fingerprint" VerticalAlignment="Center" />
-        </Grid>
+    <!-- ============ HEADER ============ -->
+    <Grid Grid.Row="0" ColumnDefinitions="Auto,Auto,Auto,*,Auto">
+      <Button Grid.Column="0" Classes="ghost" Width="40" Height="40" Padding="0"
+              Command="{Binding BackCommand}" ToolTip.Tip="Back to Keychain">
+        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5C4;" FontSize="17"
+                   Foreground="{StaticResource TextFaint}" HorizontalAlignment="Center"
+                   VerticalAlignment="Center" />
+      </Button>
+      <TextBlock Grid.Column="1" Text="Host keys" FontSize="33" FontWeight="Bold" LetterSpacing="-0.5"
+                 Foreground="{StaticResource Text}" VerticalAlignment="Center" Margin="14,0,0,0" />
+      <Border Grid.Column="2" MinWidth="30" Height="26" CornerRadius="8" Padding="8,0" Margin="12,0,0,0"
+              Background="{StaticResource Chip}" VerticalAlignment="Center" IsVisible="{Binding HasPins}">
+        <TextBlock Classes="mono" Text="{Binding Count}" FontSize="12.5" FontWeight="SemiBold"
+                   Foreground="{StaticResource TextDim}" HorizontalAlignment="Center"
+                   VerticalAlignment="Center" />
       </Border>
-
-      <Grid Grid.Row="1" ColumnDefinitions="2,1.4*,58,104,*,96" Margin="0,6,14,6"
-            IsVisible="{Binding HasVisiblePins}">
-        <TextBlock Grid.Column="1" Classes="label" Text="HOST" FontSize="9.5" LetterSpacing="1"
-                   Margin="12,0,8,0" />
-        <TextBlock Grid.Column="2" Classes="label" Text="PORT" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="3" Classes="label" Text="ALGORITHM" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="4" Classes="label" Text="FINGERPRINT" FontSize="9.5" LetterSpacing="1" />
-        <TextBlock Grid.Column="5" Classes="label" Text="APPROVED" FontSize="9.5" LetterSpacing="1" />
-      </Grid>
-
-      <ListBox Grid.Row="2" x:Name="PinList" Focusable="True"
-               ItemsSource="{Binding VisiblePins}"
-               SelectedItem="{Binding Selected}">
-        <ListBox.ItemTemplate>
-          <DataTemplate x:DataType="vm:KnownHostRowViewModel">
-            <Grid ColumnDefinitions="2,1.4*,58,104,*,96" Margin="0,7,14,7">
-              <Border Grid.Column="0" Classes="rowmark" />
-              <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Host}" FontSize="12"
-                         FontWeight="Medium" Foreground="{StaticResource Text}" Margin="12,0,8,0"
-                         TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-              <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Port}" FontSize="10.5"
-                         Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
-              <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Algorithm}" FontSize="10"
-                         Foreground="{StaticResource TextDim}" Margin="0,0,8,0"
-                         TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-              <!--
-                Never trimmed, and this column is why the table is laid out the way it is. The only thing
-                anybody does with a fingerprint is compare it character by character against one an operator
-                published; an ellipsis in the middle turns that into a glance, which is the habit the whole
-                mechanism exists to replace.
-              -->
-              <TextBlock Grid.Column="4" Classes="mono" Text="{Binding Fingerprint}" FontSize="10.5"
-                         Foreground="{StaticResource TextFaint}" Margin="0,0,8,0"
-                         VerticalAlignment="Center" />
-              <TextBlock Grid.Column="5" Classes="mono" Text="{Binding Approved}" FontSize="10"
-                         Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
-            </Grid>
-          </DataTemplate>
-        </ListBox.ItemTemplate>
-      </ListBox>
-
-      <TextBlock Grid.Row="2" Classes="hint" Text="{Binding EmptyMessage}" FontSize="12"
-                 Margin="24" HorizontalAlignment="Center" VerticalAlignment="Center"
-                 TextAlignment="Center" MaxWidth="340"
-                 IsVisible="{Binding !HasVisiblePins}" />
-
+      <!--
+        Matches fingerprints as well as host names, which is the point of it. What somebody does with
+        this screen is check whether a published SHA256:… is the one they approved, and searching only
+        by name would answer a different question.
+      -->
+      <TextBox Grid.Column="4" x:Name="PinFilter" Text="{Binding Filter}" Width="320" Height="40"
+               PlaceholderText="filter by host or fingerprint" VerticalAlignment="Center" />
     </Grid>
 
-    <Border Grid.Column="1" Background="{StaticResource Sidebar}"
-            BorderBrush="{StaticResource Border}" BorderThickness="1,0,0,0">
-      <ScrollViewer>
-        <StackPanel Margin="14,16" Spacing="6">
+    <TextBlock Grid.Row="1" Classes="hint" FontSize="12" Margin="0,10,0,0" TextWrapping="Wrap"
+               Text="Every pin is a decision recorded at the moment of connecting. Fingerprints are never trimmed — compare them character by character against what the operator published." />
 
-          <TextBlock Classes="hint" FontSize="12"
-                     Text="Choose a pinned key to see it in full, and to withdraw it."
-                     IsVisible="{Binding !HasSelection}" />
+    <!-- ============ THE TABLE ============ -->
+    <Border Grid.Row="2" Margin="0,18,0,0" CornerRadius="12" BorderBrush="{StaticResource Border}"
+            BorderThickness="1" ClipToBounds="True">
+      <Grid ColumnDefinitions="*,320">
 
-          <StackPanel Spacing="6" IsVisible="{Binding HasSelection}">
-            <TextBlock Classes="mono" Text="{Binding Selected.Label}" FontSize="13"
-                       FontWeight="SemiBold" Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+        <Grid Grid.Column="0" Background="{StaticResource Pane}" RowDefinitions="Auto,*">
 
-            <Border Classes="chip warn" HorizontalAlignment="Left"
-                    IsVisible="{Binding !Selected.IsDialledByAHost}">
-              <TextBlock Text="no host uses this" />
-            </Border>
+          <Border Grid.Row="0" Padding="24,14,24,10" BorderBrush="{StaticResource Border}"
+                  BorderThickness="0,0,0,1" IsVisible="{Binding HasVisiblePins}">
+            <Grid ColumnDefinitions="2,1.4*,58,104,*,96">
+              <TextBlock Grid.Column="1" Classes="label" Text="HOST" FontSize="9.5" LetterSpacing="1"
+                         Margin="12,0,8,0" />
+              <TextBlock Grid.Column="2" Classes="label" Text="PORT" FontSize="9.5" LetterSpacing="1" />
+              <TextBlock Grid.Column="3" Classes="label" Text="ALGORITHM" FontSize="9.5" LetterSpacing="1" />
+              <TextBlock Grid.Column="4" Classes="label" Text="FINGERPRINT" FontSize="9.5" LetterSpacing="1" />
+              <TextBlock Grid.Column="5" Classes="label" Text="APPROVED" FontSize="9.5" LetterSpacing="1" />
+            </Grid>
+          </Border>
 
-            <TextBlock Classes="label" Text="FINGERPRINT" Margin="0,12,0,4" />
-            <Border Background="{StaticResource Raised}" BorderBrush="{StaticResource Border}"
-                    BorderThickness="1" CornerRadius="4" Padding="8">
-              <SelectableTextBlock Classes="mono" Text="{Binding Selected.Fingerprint}"
-                                   FontSize="10.5" Foreground="{StaticResource TextDim}"
-                                   TextWrapping="Wrap" />
-            </Border>
+          <ListBox Grid.Row="1" x:Name="PinList" Classes="pinrows" Focusable="True" Margin="12,8"
+                   ItemsSource="{Binding VisiblePins}" SelectedItem="{Binding Selected}">
+            <ListBox.ItemTemplate>
+              <DataTemplate x:DataType="vm:KnownHostRowViewModel">
+                <Grid ColumnDefinitions="2,1.4*,58,104,*,96" Margin="12">
+                  <Border Grid.Column="0" Classes="rowmark" />
+                  <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Host}" FontSize="12.5"
+                             FontWeight="Medium" Foreground="{StaticResource Text}" Margin="12,0,8,0"
+                             TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+                  <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Port}" FontSize="11"
+                             Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
+                  <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Algorithm}" FontSize="10.5"
+                             Foreground="{StaticResource TextDim}" Margin="0,0,8,0"
+                             TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+                  <!--
+                    Never trimmed, and this column is why the table is laid out the way it is. The only thing
+                    anybody does with a fingerprint is compare it character by character against one an
+                    operator published; an ellipsis in the middle turns that into a glance, which is the habit
+                    the whole mechanism exists to replace.
+                  -->
+                  <TextBlock Grid.Column="4" Classes="mono" Text="{Binding Fingerprint}" FontSize="10.5"
+                             Foreground="{StaticResource TextFaint}" Margin="0,0,8,0"
+                             VerticalAlignment="Center" />
+                  <TextBlock Grid.Column="5" Classes="mono" Text="{Binding Approved}" FontSize="10.5"
+                             Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+                </Grid>
+              </DataTemplate>
+            </ListBox.ItemTemplate>
+          </ListBox>
 
-            <TextBlock Classes="label" Text="APPROVED" Margin="0,12,0,4" />
-            <TextBlock Classes="mono" Text="{Binding Selected.Approved}" FontSize="11"
-                       Foreground="{StaticResource TextDim}" />
-            <!--
-              Said rather than implied. No vault item carries a timestamp, so this date is read back out of
-              the item's own version 7 id — which records when the pin was created and knows nothing about
-              it being re-approved since. Presenting that as "last used" would be inventing a fact.
-            -->
-            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                       Text="Taken from the item's identifier, so it is when this key was first approved — not when it was last checked. Nothing here records that." />
+          <TextBlock Grid.Row="1" Classes="hint" Text="{Binding EmptyMessage}" FontSize="12"
+                     Margin="24" HorizontalAlignment="Center" VerticalAlignment="Center"
+                     TextAlignment="Center" MaxWidth="340" IsVisible="{Binding !HasVisiblePins}" />
 
-            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap" Margin="0,12,0,0"
-                       Text="A pin outlives whatever it was approved for: deleting a host leaves it, and so does changing a host's address. That is deliberate — trust is about the endpoint, not the bookmark." />
+        </Grid>
 
-            <Button Classes="danger" Content="FORGET THIS HOST KEY" Margin="0,12,0,0"
-                    HorizontalAlignment="Left"
-                    Command="{Binding ForgetSelectedCommand}"
-                    ToolTip.Tip="Withdraws trust. The next connection to this endpoint asks you to check the fingerprint again, which is the safe direction to be wrong in — and it is the way back from a server that was legitimately rebuilt." />
-          </StackPanel>
+        <!-- ============ DETAIL SIDEBAR ============ -->
+        <Border Grid.Column="1" Background="{StaticResource Sidebar}"
+                BorderBrush="{StaticResource Border}" BorderThickness="1,0,0,0">
+          <ScrollViewer>
+            <StackPanel Margin="20,22" Spacing="14">
 
-        </StackPanel>
-      </ScrollViewer>
+              <TextBlock Classes="hint" FontSize="12"
+                         Text="Choose a pinned key to see it in full, and to withdraw it."
+                         IsVisible="{Binding !HasSelection}" />
+
+              <StackPanel Spacing="14" IsVisible="{Binding HasSelection}">
+
+                <StackPanel Orientation="Horizontal" Spacing="12">
+                  <Border Width="36" Height="36" CornerRadius="10" Background="{StaticResource AccentSoft}">
+                    <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE90D;" FontSize="17"
+                               Foreground="{StaticResource AccentText}" HorizontalAlignment="Center"
+                               VerticalAlignment="Center" />
+                  </Border>
+                  <StackPanel Spacing="4" VerticalAlignment="Center">
+                    <TextBlock Classes="mono" Text="{Binding Selected.Host}" FontSize="13.5" FontWeight="Bold"
+                               Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+                    <TextBlock Classes="mono" Text="{Binding Selected.Label}" FontSize="10.5"
+                               Foreground="{StaticResource TextDim}" TextWrapping="Wrap" />
+                  </StackPanel>
+                </StackPanel>
+
+                <Border Classes="chip warn" Background="{StaticResource WarnWash}" HorizontalAlignment="Left"
+                        IsVisible="{Binding !Selected.IsDialledByAHost}">
+                  <TextBlock Text="no host uses this" />
+                </Border>
+
+                <StackPanel Spacing="6">
+                  <TextBlock Classes="label" Text="FINGERPRINT" />
+                  <Border Background="{StaticResource Pane}" BorderBrush="{StaticResource Border}"
+                          BorderThickness="1" CornerRadius="10" Padding="12,10">
+                    <SelectableTextBlock Classes="mono" Text="{Binding Selected.Fingerprint}"
+                                         FontSize="10.5" Foreground="{StaticResource TextDim}"
+                                         TextWrapping="Wrap" LineHeight="16" />
+                  </Border>
+                </StackPanel>
+
+                <StackPanel Spacing="6">
+                  <TextBlock Classes="label" Text="APPROVED" />
+                  <TextBlock Classes="mono" Text="{Binding Selected.Approved}" FontSize="11.5"
+                             Foreground="{StaticResource TextDim}" TextWrapping="Wrap" />
+                  <!--
+                    Said rather than implied. No vault item carries a timestamp, so this date is read back out
+                    of the item's own version 7 id — which records when the pin was created and knows nothing
+                    about it being re-approved since. Presenting that as "last used" would be inventing a fact.
+                  -->
+                  <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                             Text="Taken from the item's identifier, so it is when this key was first approved — not when it was last checked. Nothing here records that." />
+                </StackPanel>
+
+                <!--
+                  ◆ VAULT. Real, not decorative — KnownHostRowViewModel.VaultName comes off the same
+                  VaultId/VaultName pair HostRowViewModel carries, so this chip never names a vault the pin
+                  is not actually stored in.
+                -->
+                <StackPanel Spacing="6">
+                  <TextBlock Classes="label" Text="VAULT" />
+                  <Border Classes="chip" HorizontalAlignment="Left">
+                    <TextBlock Text="{Binding Selected.VaultName}" />
+                  </Border>
+                </StackPanel>
+
+                <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap" Margin="0,4,0,0"
+                           Text="A pin outlives whatever it was approved for: deleting a host leaves it, and so does changing a host's address. That is deliberate — trust is about the endpoint, not the bookmark." />
+
+                <StackPanel Spacing="8" Margin="0,10,0,0">
+                  <Button Classes="ghost" Height="38" HorizontalAlignment="Stretch"
+                          Content="COPY FINGERPRINT" Command="{Binding CopyFingerprintCommand}"
+                          ToolTip.Tip="Fingerprints are public. Puts it on the clipboard in full." />
+                  <Button Classes="danger" Height="38" HorizontalAlignment="Stretch"
+                          Content="WITHDRAW PIN" Command="{Binding ForgetSelectedCommand}"
+                          ToolTip.Tip="Withdraws trust. The next connection to this endpoint asks you to check the fingerprint again, which is the safe direction to be wrong in — and it is the way back from a server that was legitimately rebuilt." />
+                  <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap" TextAlignment="Center"
+                             Text="The next connection will ask you to approve this host's key again." />
+                </StackPanel>
+
+              </StackPanel>
+
+            </StackPanel>
+          </ScrollViewer>
+        </Border>
+
+      </Grid>
     </Border>
 
   </Grid>

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -91,12 +91,13 @@
 
   <Grid RowDefinitions="Auto,*,Auto,Auto">
 
-    <views:TitleBar Grid.Row="0" />
+    <views:TitleBar Grid.Row="0" IsVisible="{Binding !IsSettingsMode}" />
 
     <Panel Grid.Row="1">
 
       <!-- The unlocked application. -->
-      <Grid ColumnDefinitions="Auto,*" IsVisible="{Binding IsUnlocked}">
+      <Grid ColumnDefinitions="Auto,*" IsVisible="{Binding IsUnlocked}"
+            IsEnabled="{Binding !IsSettingsMode}">
 
         <!--
           The window's own furniture, at 255 pixels — see NavRail.axaml's own v5b remark. It no longer sits
@@ -176,13 +177,19 @@
               by a toggle inside the screen — see ShowFiles, and the rail's own switcher segment that
               calls it now; see NavRail.axaml.
 
-              Deliberately not given the session shell above: a bucket is not a host, has no terminal tab
+              Deliberately not given the full session shell above: a bucket is not a host, has no terminal tab
               to be the other end of a cross-surface button, and pins nothing the sidebar's QUICK ACCESS
-              could show. Wave B's own scope is the terminal and SFTP surfaces; S3 stays the plain screen it
-              already was, and this is the recorded reason rather than an oversight.
+              could show — so no tab row, no host header, no status bar and no sidebar. Wave B's own scope
+              was the terminal and SFTP surfaces and left this plain; v5c-3 gives it the session shell's own
+              LOOK without its machinery — a 26px padded column and the same bordered, radius-12 container —
+              since design-notes/v5c-fidelity-notes.md calls for the fidelity pass here too, and there is
+              nothing this screen does that needs the parts still withheld.
             -->
             <Panel IsVisible="{Binding IsBucketsScreen}">
-              <views:TransfersScreen DataContext="{Binding Transfers}" />
+              <Border Margin="26" BorderBrush="{StaticResource Border}" BorderThickness="1" CornerRadius="12"
+                      ClipToBounds="True">
+                <views:TransfersScreen DataContext="{Binding Transfers}" />
+              </Border>
             </Panel>
 
             <!-- ============ KEYCHAIN ============ -->
@@ -217,30 +224,21 @@
               <views:LogsScreen x:Name="LogsPane" DataContext="{Binding LogsScreen}" />
             </Panel>
 
-            <!-- ============ VAULTS ============ -->
             <!--
-              Wrapped, for the reason the keychain and transfers screens are: the visibility is the shell's
-              business and the data context is the vaults view model, and both on one element would resolve
-              IsVaultsScreen against a type that does not have it.
+              v5c-2: the VAULTS panel that used to live here is gone. ShellScreen.Vaults now only ever shows
+              through settings mode's own SettingsVaultsPage — see MainWindowViewModel.ShowScreen, which
+              redirects it into EnterSettings before Screen is ever set — so IsVaultsScreen being true also
+              means IsSettingsMode is true, and this whole page-area Panel (bound to !IsSettingsMode, above)
+              is already hidden behind SettingsView by then. A Panel here would never have been drawn.
 
-              Bound to Vaults, which is the vaults themselves and the people in them — not to Vault, which
-              is one vault's contents and is what the keychain and hosts screens above draw.
+              v5c-3: IMPORT left this Panel the same way, and for the same reason. Import.dc.html draws the
+              importer inside the settings chrome — SettingsNav lit on Preferences, a "Back to preferences"
+              titlebar rather than the ordinary rail and titlebar this Panel belongs to — so ImportScreen now
+              lives in SettingsView.axaml behind MainWindowViewModel.IsImportOpen, beside the seven settings
+              pages rather than among the screens here. See ShowScreen's own translation of
+              ShellScreen.Import for what still reaches it: the Preferences page's own "OPEN IMPORTER" row,
+              and anything else that names the same destination.
             -->
-            <Panel IsVisible="{Binding IsVaultsScreen}">
-              <views:VaultsScreen DataContext="{Binding Vaults}" />
-            </Panel>
-
-            <!-- ============ PREFERENCES ============ -->
-            <views:PreferencesScreen IsVisible="{Binding IsPreferencesScreen}" />
-
-            <!-- ============ IMPORT ============ -->
-            <!--
-              Reached from preferences rather than from the rail; see ShellScreen.Import. Wrapped, like
-              the others whose data context is their own view model.
-            -->
-            <Panel IsVisible="{Binding IsImportScreen}">
-              <views:ImportScreen x:Name="ImportPane" DataContext="{Binding ImportScreen}" />
-            </Panel>
 
           </Panel>
 
@@ -319,6 +317,22 @@
         </Panel>
       </Grid>
 
+      <!--
+        v5c: the settings mode, which replaces the titlebar above and everything in this Panel below it with
+        its own — see SettingsView.axaml and TitleBar's own IsVisible next to it in this file. Later in the
+        Panel than the unlocked Grid, on the same reasoning the setup Border below gives for its own
+        position: Avalonia z-order draws a later sibling over an earlier one, and SettingsView's own
+        Background is opaque, so it covers the rail and the page area completely rather than needing them
+        hidden out from under it. The unlocked Grid keeps IsEnabled bound to the negation above so a Tab
+        press cannot walk keyboard focus into a control this mode has covered.
+
+        Earlier than the palette and the host-key decision, both further down this same Panel, so either can
+        still interrupt settings mode exactly as it already interrupts every other screen — a host key that
+        changes while the sync loop is running does not stop being worth answering because the window
+        happens to be showing Settings.
+      -->
+      <views:SettingsView IsVisible="{Binding IsSettingsMode}" />
+
       <!--
         Setup and unlock. Later in the Panel, so it is above the application content in Avalonia's z-order —
         which covers Avalonia-drawn content and nothing else. The terminal is collapsed rather than covered;
@@ -476,11 +490,18 @@
       no DataContext yields UnsetValue, IsVisible falls back to true, and the previewer would show a banner
       announcing an update that does not exist.
     -->
-    <views:UpdateBanner Grid.Row="2"
-                        DataContext="{Binding Updates}"
-                        IsVisible="{Binding IsBannerShowing, FallbackValue=False}" />
+    <!--
+      v5c: wrapped rather than given a third condition of its own — UpdateBanner sets its own DataContext to
+      UpdateViewModel on this same element, so a binding against IsSettingsMode has to live on an ancestor
+      whose context is still the shell. The design's settings titlebar has no room for this strip; hiding it
+      here rather than teaching the banner about a mode it otherwise has no reason to know about.
+    -->
+    <Panel Grid.Row="2" IsVisible="{Binding !IsSettingsMode}">
+      <views:UpdateBanner DataContext="{Binding Updates}"
+                          IsVisible="{Binding IsBannerShowing, FallbackValue=False}" />
+    </Panel>
 
-    <views:StatusBar Grid.Row="3" />
+    <views:StatusBar Grid.Row="3" IsVisible="{Binding !IsSettingsMode}" />
 
   </Grid>
 

src/DodoSSH.Client.App/Views/MainWindow.axaml.cs

@@ -111,11 +111,13 @@ internal sealed partial class MainWindow : Window
     /// </remarks>
     private IInputElement KeyboardHome => shell switch
     {
+        // v5c: settings mode has no keyboard-focused control of its own yet — its pages are read-only prose
+        // and buttons, the same shape the account and logs screens already fall back to the window for.
+        { IsSettingsMode: true } => this,
         { IsTerminalShowing: true } => Terminal,
         { Screen: ShellScreen.Keychain } => VaultPane.KeyboardTarget,
         { Screen: ShellScreen.Hosts } => HostsPane.KeyboardTarget,
         { Screen: ShellScreen.KnownHosts } => PinsPane.KeyboardTarget,
-        { Screen: ShellScreen.Import } => ImportPane.KeyboardTarget,
         { Screen: ShellScreen.Snippets } => SnippetsPane.KeyboardTarget,
         { Screen: ShellScreen.Logs } => LogsPane.KeyboardTarget,
         _ => this,
@@ -213,6 +215,25 @@ internal sealed partial class MainWindow : Window
         {
             Palette.HandleKey(e);
         }
+        // v5c: Escape leaves settings mode, the same full-window-state idiom the palette's own Escape
+        // already follows one branch up. Checked after the palette rather than before it: the two states
+        // are mutually exclusive in practice — opening the palette does not enter settings mode and entering
+        // settings does not open the palette — but an Escape while both were somehow true should close the
+        // thing drawn on top, which is the palette.
+        //
+        // v5c: with the importer up, Escape closes only that — the same "closest thing first" rule, and the
+        // same one the titlebar's own back button follows by showing "Back to preferences" rather than
+        // "Back to application" while IsImportOpen is true.
+        else if (e.Key == Key.Escape && viewModel.IsImportOpen)
+        {
+            viewModel.CloseImportCommand.Execute(null);
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Escape && viewModel.IsSettingsMode)
+        {
+            viewModel.LeaveSettingsCommand.Execute(null);
+            e.Handled = true;
+        }
 
         base.OnKeyDown(e);
     }

src/DodoSSH.Client.App/Views/NavRail.axaml

@@ -249,12 +249,15 @@
               <Border Height="1" Background="{StaticResource BorderMid}" />
 
               <!--
-                Settings and Preferences both land on the one screen this application actually has — the
-                mock's own Settings area is a family of screens that do not exist yet; see the decided
-                deviation in design-notes/v5b-fidelity-notes.md. Two doors to one room rather than one door
-                removed, so neither word on the mock goes unanswered.
+                v5c: Settings, Vaults and Preferences now each land on their own page of the settings mode —
+                see MainWindowViewModel.EnterSettings and SettingsView.axaml. Settings opens on General, the
+                mode's own default landing page; Vaults and Preferences open directly on the page they name,
+                which is also what anything that used to navigate to ShellScreen.Vaults or
+                ShellScreen.Preferences now does — see ShowScreen. Three handlers rather than the two rows
+                sharing one before this wave: the mock's Settings area was a family of screens that did not
+                exist yet, and now that it does, "Settings" and "Preferences" are no longer the same click.
               -->
-              <Button Classes="poprow" Click="OnPopoverPreferencesPressed">
+              <Button Classes="poprow" Click="OnPopoverSettingsPressed">
                 <StackPanel Orientation="Horizontal" Spacing="10">
                   <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE8B8;" FontSize="12"
                              Foreground="{StaticResource Text}" />
@@ -282,8 +285,8 @@
 
               <!--
                 The existing sign-out flow, with its own confirm card — see
-                MainWindowViewModel.SignOutFromPopover for why this goes through Preferences rather than
-                calling SignOutCommand directly from wherever the popover happened to be opened.
+                MainWindowViewModel.SignOutFromPopover for why this goes through the Account settings page
+                rather than calling SignOutCommand directly from wherever the popover happened to be opened.
               -->
               <Button Classes="poprow" Click="OnPopoverLogoutPressed">
                 <StackPanel Orientation="Horizontal" Spacing="10">

src/DodoSSH.Client.App/Views/NavRail.axaml.cs

@@ -48,30 +48,42 @@ internal sealed partial class NavRail : UserControl
         }
     }
 
-    /// <summary>Settings and Preferences both land here — see the remark in the markup.</summary>
+    /// <summary>Opens settings mode on its default landing page — see the remark in the markup.</summary>
+    private void OnPopoverSettingsPressed(object? sender, RoutedEventArgs e)
+    {
+        ClosePopover();
+
+        if (DataContext is MainWindowViewModel shell)
+        {
+            shell.EnterSettingsCommand.Execute(SettingsPage.General);
+        }
+    }
+
+    /// <summary>Opens settings mode on its Preferences page.</summary>
     private void OnPopoverPreferencesPressed(object? sender, RoutedEventArgs e)
     {
         ClosePopover();
 
         if (DataContext is MainWindowViewModel shell)
         {
-            shell.ShowScreenCommand.Execute(ShellScreen.Preferences);
+            shell.EnterSettingsCommand.Execute(SettingsPage.Preferences);
         }
     }
 
+    /// <summary>Opens settings mode on its Vaults page.</summary>
     private void OnPopoverVaultsPressed(object? sender, RoutedEventArgs e)
     {
         ClosePopover();
 
         if (DataContext is MainWindowViewModel shell)
         {
-            shell.ShowScreenCommand.Execute(ShellScreen.Vaults);
+            shell.EnterSettingsCommand.Execute(SettingsPage.Vaults);
         }
     }
 
     /// <summary>
-    /// Starts a sign-out, through Preferences so the confirmation card has somewhere to be seen — see
-    /// <see cref="MainWindowViewModel.SignOutFromPopover"/>.
+    /// Starts a sign-out, through the Account settings page so the confirmation card has somewhere to be
+    /// seen — see <see cref="MainWindowViewModel.SignOutFromPopover"/>.
     /// </summary>
     private void OnPopoverLogoutPressed(object? sender, RoutedEventArgs e)
     {

src/DodoSSH.Client.App/Views/PreferencesScreen.axaml

@@ -1,275 +0,0 @@
-<UserControl xmlns="https://github.com/avaloniaui"
-             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
-             xmlns:views="using:DodoSSH.Client.App.Views"
-             x:Class="DodoSSH.Client.App.Views.PreferencesScreen"
-             x:DataType="vm:MainWindowViewModel">
-
-  <!--
-    Preferences.
-
-    The design's rail has six sections and its TERMINAL panel has six settings. One of those six is now
-    real: text size. It needed all three of the things this comment used to record as missing — somewhere
-    to keep a preference (settings.json beside the cache, outside it deliberately, so it can be read on a
-    launch that never unlocks anything), a frame carrying a terminal option (TerminalServerOpcode.FontSize),
-    and a way for the page's own chords to reach the host that owns the value
-    (TerminalClientOpcode.FontSizeStep). The rule that kept it off this screen until then still stands and
-    is why the storage came first: a stepper that reset on every launch is worse than no stepper.
-
-    So this screen ships what is real, which is not nothing: this machine's device key is a genuine
-    preference with a genuine effect, and it is the one thing on the design's SECURITY panel that exists.
-    The two commands behind it were already in the shell; they were merely homeless, wedged into the old
-    account bar because there was nowhere else to put them.
-
-    Everything else is listed as absent rather than omitted, because a preferences screen that is silent
-    about the settings it has not got reads as a product with six preferences.
-  -->
-
-  <ScrollViewer>
-    <StackPanel MaxWidth="620" Margin="28,26" HorizontalAlignment="Left">
-
-      <TextBlock Classes="mono" Text="THIS MACHINE" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource Text}" />
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,12,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Unlock with Windows Hello" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Registers this machine so a later launch can open the keychain with a Windows confirmation instead of your passphrase. Your passphrase keeps working." />
-        </StackPanel>
-        <Button Grid.Column="1" Classes="accent" Content="REGISTER"
-                Command="{Binding RegisterDeviceCommand}"
-                IsEnabled="{Binding !IsBusy}"
-                IsVisible="{Binding CanRegisterDevice}" />
-        <!--
-          The withdrawal, in the place the offer was. Its own flag rather than the negation of that one: a
-          machine with no TPM and a machine that is already registered are both "cannot register", and only
-          the second has anything to take back.
-        -->
-        <Button Grid.Column="1" Classes="danger" Content="STOP UNLOCKING HERE"
-                Command="{Binding ForgetDeviceCommand}"
-                IsEnabled="{Binding !IsBusy}"
-                IsVisible="{Binding CanForgetDevice}"
-                ToolTip.Tip="Withdraws this machine's device key, here and from your account, so it goes back to asking for your passphrase. Do this to a machine you have lost." />
-      </Grid>
-
-      <!-- Neither flag is set on a machine that cannot keep a key at all, and that is worth saying. -->
-      <TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"
-                 Text="This machine has nowhere to keep a device key, so the keychain will keep asking for your passphrase. That needs a TPM and a Windows keystore willing to release the key."
-                 IsVisible="{Binding HasNoDeviceKeyOption}" />
-
-      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
-
-      <TextBlock Classes="mono" Text="UPDATES" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource Text}" />
-
-      <!--
-        Not on the design at all, unlike everything else here. It arrived with packaging: an installed
-        client can replace itself, and the moment that is true the question of where a replacement comes
-        from stops being theoretical. The answer is the security content of this section rather than a
-        footnote to it, which is why it is printed under the version instead of hidden in a tooltip.
-      -->
-      <TextBlock Classes="mono" Text="{Binding Updates.CurrentVersion}" FontSize="12" Margin="0,8,0,0"
-                 Foreground="{StaticResource Info}" TextTrimming="CharacterEllipsis" />
-      <TextBlock Classes="hint" FontSize="11" Margin="0,4,0,0"
-                 Text="Builds come from the project's own release page, and never from the server you sign in to. That is deliberate: whoever hands you the client can hand you a client that copies your passphrase, and the operator of a DodoSSH deployment is the party the trust model is about. A deployment may tell you where to get it. It is not where it comes from." />
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Check for updates" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Asks the release page whether there is a newer build, and downloads it if there is. Nothing is ever installed while you are using it — a downloaded update waits for a restart you ask for, or for the next time you start DodoSSH." />
-        </StackPanel>
-        <Button x:Name="CheckNowButton" Grid.Column="1" Classes="ghost" Content="CHECK NOW"
-                Command="{Binding Updates.CheckNowCommand}"
-                IsEnabled="{Binding Updates.CanCheckNow}" />
-      </Grid>
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Check on its own" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Every six hours while DodoSSH is running, starting a couple of minutes after launch. It keeps checking while the keychain is locked, because where builds come from has nothing to do with your vault." />
-        </StackPanel>
-        <CheckBox x:Name="AutomaticUpdatesToggle" Grid.Column="1" VerticalAlignment="Top"
-                  IsChecked="{Binding Updates.IsAutomatic}"
-                  IsEnabled="{Binding Updates.IsSupported}" />
-      </Grid>
-
-      <!-- The only other ProgressBar in the application is the transfers one; same height, same brushes. -->
-      <ProgressBar Height="4" Minimum="0" Maximum="100" Margin="0,12,0,0"
-                   Value="{Binding Updates.DownloadPercent}"
-                   Foreground="{StaticResource Accent}" Background="{StaticResource Raised}"
-                   IsVisible="{Binding Updates.IsDownloading}" />
-
-      <!--
-        The restart, with the sentence the banner only has room for in a tooltip. This screen scrolls, so
-        this is where the warning can be as long as it needs to be — and it needs to be, because this
-        application has spent a lot of words teaching that locking keeps shells running.
-      -->
-      <Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0" IsVisible="{Binding Updates.IsReady}">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="{Binding Updates.ReadyHeadline}" Foreground="{StaticResource Text}"
-                     FontSize="13" FontWeight="Medium" TextWrapping="Wrap" />
-          <TextBlock Classes="hint" FontSize="11" Text="{Binding Updates.RestartWarning}" />
-        </StackPanel>
-        <Button Grid.Column="1" Classes="accent" Content="RESTART NOW"
-                Command="{Binding Updates.RestartNowCommand}" />
-      </Grid>
-
-      <TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"
-                 Text="{Binding Updates.Status}"
-                 IsVisible="{Binding Updates.Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-
-      <!--
-        The HasNoDeviceKeyOption precedent, one section up: a machine that gets none of the above is told
-        why rather than shown three controls that cannot do anything.
-      -->
-      <TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"
-                 Text="This copy of DodoSSH cannot replace itself, so none of the above does anything. That is what a build run from a source checkout looks like, and also what a copy somebody unzipped by hand looks like — it is the installer that registers the update path."
-                 IsVisible="{Binding Updates.IsUnsupported}" />
-
-      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
-
-      <TextBlock Classes="mono" Text="TERMINAL" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource Text}" />
-
-      <!--
-        Here as well as on the chord, and not because the chord is in doubt. Ctrl+plus can only be heard
-        while a terminal has focus, since that is where the keyboard is being read — so somebody who has
-        not opened one yet, or who has just made the text too small to find anything in, has nowhere else
-        to look. This is that place, and it names the chord so the screen teaches it rather than replacing
-        it.
-      -->
-      <Grid ColumnDefinitions="*,Auto" Margin="0,12,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Text size" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="How large a terminal draws, in pixels. Ctrl+plus and Ctrl+minus do the same while a terminal has focus, and Ctrl+0 puts it back. It resizes the grid rather than magnifying it, so the remote is told how many columns it now has — which is also why it stops before the columns run out." />
-        </StackPanel>
-        <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6" VerticalAlignment="Top">
-          <Button Classes="ghost" Content="A−" Command="{Binding ShrinkTerminalFontCommand}"
-                  IsEnabled="{Binding CanShrinkTerminalFont}"
-                  ToolTip.Tip="Smaller  ·  Ctrl+minus" />
-          <TextBlock Classes="mono" FontSize="13" MinWidth="26" VerticalAlignment="Center"
-                     TextAlignment="Center" Foreground="{StaticResource Text}"
-                     Text="{Binding TerminalFontSize}" />
-          <Button Classes="ghost" Content="A+" Command="{Binding EnlargeTerminalFontCommand}"
-                  IsEnabled="{Binding CanEnlargeTerminalFont}"
-                  ToolTip.Tip="Larger  ·  Ctrl+plus" />
-          <Button Classes="ghost" Content="RESET" Command="{Binding ResetTerminalFontCommand}"
-                  ToolTip.Tip="Back to the size it ships at  ·  Ctrl+0" />
-        </StackPanel>
-      </Grid>
-
-      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
-
-      <TextBlock Classes="mono" Text="KEYCHAIN" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource Text}" />
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,12,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Lock the keychain" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Closes the keychain and forgets every key it held. Shells you have open keep running and reappear when you unlock — locked describes the keychain, not this machine's access to your hosts." />
-        </StackPanel>
-        <Button Grid.Column="1" Classes="ghost" Content="LOCK NOW" Command="{Binding LockCommand}" />
-      </Grid>
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Synchronise" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Runs a pass now. One runs on its own when the keychain opens, straight after any change, and every minute while it stays open — and a pass that finds this machine offline signs it back in from the session it remembered, so nothing here depends on being pressed." />
-        </StackPanel>
-        <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6">
-          <Button Classes="ghost" Content="SIGN IN" Command="{Binding SignInCommand}"
-                  IsVisible="{Binding !IsOnline}"
-                  ToolTip.Tip="Opens your browser. Only needed when there is no remembered session to resume — after signing out, or once your identity provider stops accepting the one this machine held." />
-          <Button Classes="ghost" Content="SYNC NOW" Command="{Binding Vault.SyncCommand}" />
-        </StackPanel>
-      </Grid>
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Import from ~/.ssh/config" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Reads this machine's OpenSSH configuration and offers what it finds. It shows you the list first and stores nothing until you say so, and it does not read any private key — where a key file is named, the path is recorded as a note." />
-        </StackPanel>
-        <Button Grid.Column="1" Classes="ghost" Content="IMPORT HOSTS"
-                Command="{Binding ShowScreenCommand}"
-                CommandParameter="{x:Static vm:ShellScreen.Import}" />
-      </Grid>
-
-      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
-
-      <TextBlock Classes="mono" Text="ACCOUNT" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource Text}" />
-
-      <TextBlock Classes="mono" Text="{Binding AccountName}" FontSize="12" Margin="0,8,0,0"
-                 Foreground="{StaticResource Info}" TextTrimming="CharacterEllipsis" />
-
-      <Grid ColumnDefinitions="*,Auto" Margin="0,12,0,0">
-        <StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
-          <TextBlock Text="Sign out of this machine" Foreground="{StaticResource Text}" FontSize="13"
-                     FontWeight="Medium" />
-          <TextBlock Classes="hint" FontSize="11"
-                     Text="Deletes this machine's copy of the keychain and withdraws its device key, so it goes back to knowing nothing. The keychain stays on the server; signing in again brings it back. Use this to hand a machine on, or to enrol a different account." />
-        </StackPanel>
-        <!--
-          Hidden rather than disabled while the confirmation is up, because the card below carries the
-          button that actually does it and two sign-out buttons on one screen is one too many.
-        -->
-        <Button Grid.Column="1" Classes="danger" Content="SIGN OUT"
-                Command="{Binding SignOutCommand}"
-                IsEnabled="{Binding !IsBusy}"
-                IsVisible="{Binding !IsConfirmingSignOut}" />
-      </Grid>
-
-      <Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
-              BorderThickness="1" CornerRadius="6" Padding="14" Margin="0,14,0,0"
-              IsVisible="{Binding IsConfirmingSignOut}">
-        <views:SignOutCard />
-      </Border>
-
-      <Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
-
-      <TextBlock Classes="mono" Text="NOT BUILT YET" FontSize="14" FontWeight="SemiBold"
-                 LetterSpacing="1" Foreground="{StaticResource TextDim}" />
-      <TextBlock Classes="hint" FontSize="12" Margin="0,8,0,0"
-                 Text="These are on the design and have nothing behind them. They are listed rather than left out, so that what this screen does not do is as legible as what it does. The full list, and what each would take, is in docs/design-import-gaps.md." />
-
-      <ItemsControl Margin="0,12,0,0">
-        <ItemsControl.Styles>
-          <Style Selector="TextBlock.gap">
-            <Setter Property="Foreground" Value="{StaticResource TextFaint}" />
-            <Setter Property="FontSize" Value="11" />
-            <Setter Property="TextWrapping" Value="Wrap" />
-            <Setter Property="Margin" Value="0,0,0,7" />
-          </Style>
-        </ItemsControl.Styles>
-        <TextBlock Classes="gap"
-                   Text="Terminal font, cursor and scrollback — the renderer hard-codes those three. The text size above is the one that is not, and it is the path the others would follow if they were worth a row here." />
-        <TextBlock Classes="gap"
-                   Text="Changing channel from in here — there is a nightly as well as a release, but which one a copy follows is fixed when it is built, so moving between them means installing the other one." />
-        <TextBlock Classes="gap"
-                   Text="Auto-lock after idle — nothing tracks idleness, and the lock policy would have to decide what to do about a shell mid-job." />
-        <TextBlock Classes="gap"
-                   Text="Per-use approval before a key signs — keys are handed to the SSH stack whole at connect time, so there is no per-signature moment to interrupt." />
-        <TextBlock Classes="gap"
-                   Text="SSO and organisation policy — the server has endpoints for membership and none for policy, so there is nothing for this screen to show." />
-        <TextBlock Classes="gap"
-                   Text="Keyboard shortcuts — the window binds one chord, and the terminal keeps the rest for the remote." />
-      </ItemsControl>
-
-    </StackPanel>
-  </ScrollViewer>
-
-</UserControl>

src/DodoSSH.Client.App/Views/PreferencesScreen.axaml.cs

@@ -1,9 +0,0 @@
-using Avalonia.Controls;
-
-namespace DodoSSH.Client.App.Views;
-
-/// <summary>Preferences: what this build can actually change, and a list of what it cannot.</summary>
-internal sealed partial class PreferencesScreen : UserControl
-{
-    public PreferencesScreen() => InitializeComponent();
-}

src/DodoSSH.Client.App/Views/SessionStatusBar.axaml

@@ -8,36 +8,56 @@
   <!--
     ── v5b's session shell status bar ───────────────────────────────────────────────────────────────────────
     37px, DeepChrome, a 1px top border — the foot of the bordered container both the terminal and the SFTP
-    surface share. The design's own row also carries a negotiated cipher, a host-key algorithm and a
-    key/credential name; none of the three is reachable from this shell today — see the wave B report this
-    control's history carries, and design-notes/v5b-fidelity-notes.md's own decided deviation — so none of
-    them is drawn, omitted rather than faked, per this project's honesty rule.
+    surface share. The design's own row also carries a negotiated cipher and a host-key-plus-identity run
+    (`ed25519 · acme-deploy-key`, clickable to a pin-details modal); both are now real and bound, plumbed all
+    the way from SSH.NET through TerminalWorkspace.GetSessionFacts and TransfersViewModel to
+    MainWindowViewModel's own surface-aware properties — see SessionCipher, SessionHostKeyAlgorithm,
+    SessionIdentityLabel and the composed SessionIdentityText.
+
+    Three honest deviations from the mock. The algorithm prints exactly as negotiated — "ssh-ed25519", not
+    the design's shortened "ed25519" — because trimming it would be a cosmetic edit to a string this client
+    did not choose. The run is plain text, not a button: this application has no pin-details modal for a
+    session that is already open, and drawing a click target for a screen that does not exist would be the
+    fabrication this project's honesty rule forbids, not an honest omission of one. And a typed-password
+    session — nothing filed in the keychain to name — shows the algorithm alone, with no " · " after it,
+    because there is no item behind the dot.
 
     What is real and bound: the CONNECTED word and dot, off IsSessionConnected, shown only while there is a
     session/host context to report on at all — SessionAddress null means nothing here has anything to say,
-    the same state the header answers with its own empty-state sentence; the elapsed timer, off
-    SessionElapsedText, which is null and therefore absent whenever there is nothing timed; and, only on the
-    terminal surface — see <see cref="ShowsEncoding"/> — "UTF-8", which is a true fact about this client's own
-    renderer and write path (see TerminalWorkspace's terminal.js and SshShellSessionExtensions.WriteTextAsync)
-    rather than a negotiated session parameter, and is worded plainly rather than as a claim the remote agreed
-    to it.
+    the same state the header answers with its own empty-state sentence; the cipher and the host-key/identity
+    run, each collapsed rather than shown empty or fabricated when the fact behind it is not there — a bucket
+    connection has neither, and a session whose facts could not be read back at the instant they were asked
+    for has neither either; the elapsed timer, off SessionElapsedText, which is null and therefore absent
+    whenever there is nothing timed; and, only on the terminal surface — see <see cref="ShowsEncoding"/> —
+    "UTF-8", which is a true fact about this client's own renderer and write path (see TerminalWorkspace's
+    terminal.js and SshShellSessionExtensions.WriteTextAsync) rather than a negotiated session parameter, and
+    is worded plainly rather than as a claim the remote agreed to it.
   -->
 
   <Border Height="37" Background="{StaticResource DeepChrome}"
           BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0">
     <Grid ColumnDefinitions="*,Auto" Margin="24,0">
 
-      <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="7" VerticalAlignment="Center"
-                  IsVisible="{Binding SessionAddress, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">
-        <Ellipse Classes="dot" Width="7" Height="7" Classes.live="{Binding IsSessionConnected}"
-                 VerticalAlignment="Center" />
+      <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="18" VerticalAlignment="Center">
+        <StackPanel Orientation="Horizontal" Spacing="7" VerticalAlignment="Center"
+                    IsVisible="{Binding SessionAddress, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">
+          <Ellipse Classes="dot" Width="7" Height="7" Classes.live="{Binding IsSessionConnected}"
+                   VerticalAlignment="Center" />
 
-        <TextBlock FontFamily="Montserrat" FontWeight="SemiBold" FontSize="9.5" LetterSpacing="1.2"
-                   VerticalAlignment="Center" Text="CONNECTED" Foreground="{StaticResource Live}"
-                   IsVisible="{Binding IsSessionConnected}" />
-        <TextBlock FontFamily="Montserrat" FontWeight="SemiBold" FontSize="9.5" LetterSpacing="1.2"
-                   VerticalAlignment="Center" Text="NOT CONNECTED" Foreground="{StaticResource TextFaint}"
-                   IsVisible="{Binding !IsSessionConnected}" />
+          <TextBlock FontFamily="Montserrat" FontWeight="SemiBold" FontSize="9.5" LetterSpacing="1.2"
+                     VerticalAlignment="Center" Text="CONNECTED" Foreground="{StaticResource Live}"
+                     IsVisible="{Binding IsSessionConnected}" />
+          <TextBlock FontFamily="Montserrat" FontWeight="SemiBold" FontSize="9.5" LetterSpacing="1.2"
+                     VerticalAlignment="Center" Text="NOT CONNECTED" Foreground="{StaticResource TextFaint}"
+                     IsVisible="{Binding !IsSessionConnected}" />
+        </StackPanel>
+
+        <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextGhost}"
+                   VerticalAlignment="Center" Text="{Binding SessionCipher}"
+                   IsVisible="{Binding SessionCipher, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+        <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextGhost}"
+                   VerticalAlignment="Center" Text="{Binding SessionIdentityText}"
+                   IsVisible="{Binding SessionIdentityText, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
       </StackPanel>
 
       <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="18" VerticalAlignment="Center">

src/DodoSSH.Client.App/Views/SessionStatusBar.axaml.cs

@@ -4,8 +4,9 @@ using Avalonia.Controls;
 namespace DodoSSH.Client.App.Views;
 
 /// <summary>
-/// The v5b session shell's status bar: CONNECTED and its dot, the elapsed timer, and — only where it is true
-/// — UTF-8. See the remark at the top of SessionStatusBar.axaml.
+/// The v5b session shell's status bar: CONNECTED and its dot, the negotiated cipher, the host key's algorithm
+/// and — where one authenticated — the identity that did, the elapsed timer, and — only where it is true —
+/// UTF-8. See the remark at the top of SessionStatusBar.axaml.
 /// </summary>
 internal sealed partial class SessionStatusBar : UserControl
 {

src/DodoSSH.Client.App/Views/SettingsAccountPage.axaml

@@ -0,0 +1,94 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
+             x:Class="DodoSSH.Client.App.Views.SettingsAccountPage"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: Account, against Settings-Account.dc.html.
+
+    The profile card is read-only, unlike the design's own — there is no "Edit profile" row here because
+    there is no endpoint to send an edit to. Name, email and avatar all come from MeResponse and nothing in
+    this client can change any of the three.
+
+    The SIGN-IN card keeps one row rather than the design's two. The issuer sentence is real:
+    MainWindowViewModel.Issuer is MeResponse.Issuer, cached the same turn AccountName and Email are and
+    surfaced here for the first time — see the remark on that property. "Master passphrase" and its "Change
+    passphrase" button are refused outright: there is no change-passphrase flow, only the one enrollment-time
+    choice, and a button that opened nothing would be worse than no button.
+
+    DEVICES and "Sign out everywhere" are both refused. There is no list-devices endpoint and no
+    sign-out-everywhere endpoint; the one honest device fact this client has — this machine's own Windows
+    Hello registration — is drawn on the Security page, not duplicated here as a one-row list.
+
+    SignOutCard is the same control the old PreferencesScreen used, restyled into this page's card idiom
+    rather than rewritten — see that control's own remark on why it is a bare StackPanel and not a card of
+    its own, and why one control serves both this screen and the unlock screen's copy of it.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <TextBlock Classes="settingstitle" Text="Account" />
+
+      <Border Classes="settingscard" Margin="0,26,0,0" Padding="24,22">
+        <StackPanel Orientation="Horizontal" Spacing="18">
+          <Border Width="64" Height="64" CornerRadius="60" Background="{StaticResource AvatarGradient}">
+            <TextBlock Text="{Binding AvatarInitials}" FontWeight="Bold" FontSize="20" LetterSpacing="0.5"
+                       Foreground="White" HorizontalAlignment="Center" VerticalAlignment="Center" />
+          </Border>
+          <StackPanel Spacing="7" VerticalAlignment="Center">
+            <TextBlock Text="{Binding AccountName}" FontSize="20" FontWeight="Bold" LetterSpacing="-0.25"
+                       Foreground="{StaticResource Text}" />
+            <TextBlock Classes="mono" FontSize="12.5" Foreground="{StaticResource TextFaint}"
+                       Text="{Binding Email}"
+                       IsVisible="{Binding Email, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="SIGN-IN" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+          <Border Classes="settingsrow last">
+            <StackPanel Spacing="6" MaxWidth="640">
+              <TextBlock Classes="settingsrowtitle" Text="Single sign-on" />
+              <TextBlock Classes="settingsrowcaption"
+                         Text="Signing in proves who you are — it never decrypts a vault." />
+              <TextBlock Classes="mono" FontSize="12" Margin="0,4,0,0" Foreground="{StaticResource Live}"
+                         Text="{Binding Issuer, StringFormat='You sign in through {0}.'}"
+                         IsVisible="{Binding Issuer, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+            </StackPanel>
+          </Border>
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="THIS MACHINE" />
+
+      <Border Classes="settingscard" Margin="0,12,0,40">
+        <Panel>
+          <Border Classes="settingsrow last" IsVisible="{Binding !IsConfirmingSignOut}">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Sign out of this machine" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Deletes this machine's copy of the keychain and withdraws its device key, so it goes back to knowing nothing. The keychain stays on the server; signing in again brings it back. Use this to hand a machine on, or to enrol a different account." />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="danger" Height="38" Content="SIGN OUT"
+                      Command="{Binding SignOutCommand}"
+                      IsEnabled="{Binding !IsBusy}" />
+            </Grid>
+          </Border>
+
+          <Border Padding="24,20" IsVisible="{Binding IsConfirmingSignOut}">
+            <views:SignOutCard />
+          </Border>
+        </Panel>
+      </Border>
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsAccountPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's Account page: the read-only profile, the sign-in fact, and signing out.</summary>
+internal sealed partial class SettingsAccountPage : UserControl
+{
+    public SettingsAccountPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsGeneralPage.axaml

@@ -0,0 +1,114 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SettingsGeneralPage"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: General, against Settings-General.dc.html.
+
+    The design's page has three cards — STARTUP, APPEARANCE, UPDATES — and this one has one. STARTUP
+    (launch at login, reopen tabs) and APPEARANCE (theme, language) are refused outright: nothing tracks
+    whether Windows starts this application, nothing remembers a tab list across a launch, only the one dark
+    theme exists, and there is no i18n anywhere in the client. Building either card would be two rows of
+    controls that toggle a field nothing reads. See design-notes/v5c-fidelity-notes.md.
+
+    UPDATES is the whole page's real content, moved here from the old PreferencesScreen.axaml verbatim —
+    same UpdateViewModel, same states, same warnings, restyled into this page's row idiom. Its own
+    update-channel switcher is refused the same way STARTUP and APPEARANCE are: which channel a copy follows
+    is fixed when it is built, so this screen cannot offer to switch it.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <TextBlock Classes="settingstitle" Text="General" />
+
+      <TextBlock Classes="settingssection" Text="UPDATES" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+
+          <Border Classes="settingsrow">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Version" />
+                <TextBlock Classes="mono" FontSize="12" Foreground="{StaticResource TextFaint}"
+                           TextTrimming="CharacterEllipsis" Text="{Binding Updates.CurrentVersion}" />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="ghost" Height="38" Content="CHECK NOW"
+                      Command="{Binding Updates.CheckNowCommand}"
+                      IsEnabled="{Binding Updates.CanCheckNow}" />
+            </Grid>
+          </Border>
+
+          <Border Classes="settingsrow">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Check on its own" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Every six hours while DodoSSH is running, starting a couple of minutes after launch. It keeps checking while the keychain is locked, because where builds come from has nothing to do with your vault." />
+              </StackPanel>
+              <CheckBox Grid.Column="1" VerticalAlignment="Top"
+                        IsChecked="{Binding Updates.IsAutomatic}"
+                        IsEnabled="{Binding Updates.IsSupported}" />
+            </Grid>
+          </Border>
+
+          <Border Classes="settingsrow" IsVisible="{Binding Updates.IsDownloading}">
+            <StackPanel Spacing="8">
+              <TextBlock Classes="settingsrowtitle" Text="Downloading…" />
+              <ProgressBar Height="4" Minimum="0" Maximum="100"
+                           Value="{Binding Updates.DownloadPercent}"
+                           Foreground="{StaticResource Accent}" Background="{StaticResource Chip}" />
+            </StackPanel>
+          </Border>
+
+          <Border Classes="settingsrow" IsVisible="{Binding Updates.IsReady}">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="{Binding Updates.ReadyHeadline}" TextWrapping="Wrap" />
+                <TextBlock Classes="settingsrowcaption" Text="{Binding Updates.RestartWarning}" />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="accent" Height="38" Content="RESTART NOW"
+                      Command="{Binding Updates.RestartNowCommand}" />
+            </Grid>
+          </Border>
+
+          <Border Classes="settingsrow last">
+            <StackPanel Spacing="8">
+              <TextBlock Classes="settingsrowcaption"
+                         Text="Builds come from the project's own release page, and never from the server you sign in to. Whoever hands you the client can hand you a client that copies your passphrase, and the operator of a DodoSSH deployment is the party the trust model is about. A deployment may tell you where to get it. It is not where it comes from." />
+              <TextBlock Classes="settingsrowcaption" Foreground="{StaticResource TextFaint}"
+                         Text="{Binding Updates.Status}"
+                         IsVisible="{Binding Updates.Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+              <TextBlock Classes="settingsrowcaption"
+                         Text="This copy of DodoSSH cannot replace itself, so nothing above does anything. That is what a build run from a source checkout looks like, and also what a copy somebody unzipped by hand looks like — it is the installer that registers the update path."
+                         IsVisible="{Binding Updates.IsUnsupported}" />
+            </StackPanel>
+          </Border>
+
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="NOT BUILT YET" />
+
+      <Border Classes="settingscard">
+        <StackPanel Margin="24,20" Spacing="10">
+          <TextBlock Classes="settingsrowcaption"
+                     Text="These are on the design and have nothing behind them here. They are listed rather than left out, so what this page does not do is as legible as what it does. The full list, and what each would take, is in docs/design-import-gaps.md." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Update channel — there is a nightly as well as a release, but which one a copy follows is fixed when it is built, so moving between them means installing the other one." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Launch at login — nothing registers this application with Windows' own startup list." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Reopen tabs from last session — nothing remembers which tabs were open across a launch, and every connection would need to authenticate again regardless." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Theme and language — only the one dark theme exists, and there is no translation anywhere in this client." />
+        </StackPanel>
+      </Border>
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsGeneralPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's General page: the Updates card, and the refused items as an essay.</summary>
+internal sealed partial class SettingsGeneralPage : UserControl
+{
+    public SettingsGeneralPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsGroupsPage.axaml

@@ -0,0 +1,194 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
+             x:Class="DodoSSH.Client.App.Views.SettingsGroupsPage"
+             x:DataType="vm:MainWindowViewModel"
+             x:Name="Root">
+
+  <!--
+    v5c-2: Groups, against Settings-Groups.dc.html — a real management page over VaultViewModel's own group
+    commands (Groups, NewGroup, EditGroup, DeleteGroup), given its own row here rather than only living inside
+    the hosts board's sidebar. DataContext.Vault (VaultViewModel) is nullable — locked, or the settings mode
+    reached before an unlock — so every binding below is {Binding Vault.*}, and the empty-vault caption covers
+    the null case the same way the vaults page's own does.
+
+    ── THE INTRO SENTENCE IS NOT THE MOCK'S ────────────────────────────────────────────────────────────────
+    The design says "the order here is the order there" and draws drag handles to back it up. Neither is true:
+    HostGroupRowViewModel — see VaultViewModel.RebuildGroups — orders groups by the vault new items go into
+    first, then by vault name, then by label; there is no manual order to drag into and nothing this page
+    could do would make one real. The sentence below says what is actually true instead, and there are no
+    drag handles.
+
+    ── EDIT AND DELETE ──────────────────────────────────────────────────────────────────────────────────────
+    EditGroupCommand and DeleteGroupCommand already take the row as their argument — see
+    VaultViewModel.EditGroup and VaultViewModel.EditGroupFromHeading's own remark on why — so this card's
+    buttons bind straight to them with CommandParameter="{Binding}"; no wrapper commands were needed the way
+    the tags page needs one. Editing opens the same drawer form the hosts board's own GROUPS section does
+    (HostDrawer.axaml's IsEditingGroup panel); it is not reproduced here as a second form, on the reasoning
+    the vaults page gives for reusing VaultsViewModel's commands rather than rebuilding them: one set of
+    fields, one place they can drift from what SaveGroupCommand actually writes.
+
+    ── THE "NO GROUP" FOOTER ────────────────────────────────────────────────────────────────────────────────
+    Real, all three facts: VaultViewModel.UngroupedHostCount counts hosts whose group has gone or was never
+    set, "always listed first" is true of both FlattenIntoSections call sites (RebuildSidebarRows passes
+    ungroupedFirst: false — it is drawn last there — but the desktop's own board, RebuildHostSections, passes
+    true), and it genuinely cannot be renamed or deleted: there is no HostGroupSecret behind it for either
+    command to act on.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <Grid ColumnDefinitions="*,Auto">
+        <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="14" VerticalAlignment="Center">
+          <TextBlock Classes="settingstitle" Text="Groups" />
+          <Border Background="{StaticResource Chip}" CornerRadius="9" MinWidth="34" Height="30"
+                  IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
+            <TextBlock Text="{Binding Vault.Groups.Count}" FontSize="13.5" FontWeight="SemiBold"
+                       Foreground="{StaticResource TextFaint}" Margin="8,0"
+                       HorizontalAlignment="Center" VerticalAlignment="Center" />
+          </Border>
+        </StackPanel>
+        <Button Grid.Column="1" Classes="accent" Height="40" Content="+ NEW GROUP"
+                Command="{Binding Vault.NewGroupCommand}"
+                IsEnabled="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}" />
+      </Grid>
+
+      <TextBlock Classes="settingsrowcaption" Margin="0,12,0,0" TextWrapping="Wrap"
+                 Text="Groups order by which vault new items go into, then by vault, then by label — there is no manual order to set." />
+
+      <!-- The group editor, in place: HostDrawer's own IsEditingGroup form, restyled into this page's card
+           idiom rather than duplicated. Opened by + NEW GROUP above or an EDIT icon below. -->
+      <Border Classes="settingscard" Margin="0,20,0,0" Padding="20"
+              IsVisible="{Binding Vault.IsEditingGroup}">
+        <StackPanel Spacing="10">
+          <TextBlock Classes="settingsrowtitle" Text="{Binding Vault.DrawerTitle}" />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="A heading for the hosts board, and the defaults every host under it inherits when it says nothing itself." />
+          <TextBox PlaceholderText="group name" Text="{Binding Vault.GroupEditorLabel}" />
+          <StackPanel Spacing="4" IsVisible="{Binding Vault.ShowsGroupEditorVaultChoice}">
+            <ComboBox HorizontalAlignment="Stretch" ItemsSource="{Binding Vault.GroupEditorVaultChoices}"
+                      SelectedItem="{Binding Vault.GroupEditorSelectedVault}">
+              <ComboBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                  <TextBlock Text="{Binding Display}" FontSize="12" />
+                </DataTemplate>
+              </ComboBox.ItemTemplate>
+            </ComboBox>
+          </StackPanel>
+          <ComboBox HorizontalAlignment="Stretch" ItemsSource="{Binding Vault.GroupEditorParentChoices}"
+                    SelectedItem="{Binding Vault.GroupEditorSelectedParent}">
+            <ComboBox.ItemTemplate>
+              <DataTemplate x:DataType="vm:GroupChoice">
+                <TextBlock Text="{Binding Label}" />
+              </DataTemplate>
+            </ComboBox.ItemTemplate>
+          </ComboBox>
+          <Grid ColumnDefinitions="*,8,*">
+            <NumericUpDown Grid.Column="0" Value="{Binding Vault.GroupEditorDefaultPort}" Minimum="1"
+                           Maximum="65535" FormatString="0" ShowButtonSpinner="False"
+                           PlaceholderText="default port" />
+            <TextBox Grid.Column="2" Text="{Binding Vault.GroupEditorDefaultUsername}"
+                     PlaceholderText="default username" />
+          </Grid>
+          <ComboBox HorizontalAlignment="Stretch" ItemsSource="{Binding Vault.GroupEditorAuthenticationChoices}"
+                    SelectedItem="{Binding Vault.GroupEditorSelectedAuthentication}">
+            <ComboBox.ItemTemplate>
+              <DataTemplate x:DataType="vm:AuthenticationChoice">
+                <TextBlock Text="{Binding Label}" />
+              </DataTemplate>
+            </ComboBox.ItemTemplate>
+          </ComboBox>
+          <StackPanel Orientation="Horizontal" Spacing="8">
+            <Button Classes="accent" Height="36" Content="{Binding Vault.GroupSaveLabel}"
+                    Command="{Binding Vault.SaveGroupCommand}" />
+            <Button Classes="ghost" Height="36" Content="CANCEL"
+                    Command="{Binding Vault.CancelGroupEditCommand}" />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+
+      <!-- The delete confirmation, in place. The same control the hosts board's GROUPS section and the
+           vaults page both reuse. -->
+      <Border Margin="0,20,0,0" Padding="20" CornerRadius="12"
+              Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
+              BorderThickness="1"
+              IsVisible="{Binding Vault.PendingDeletion, Converter={x:Static ObjectConverters.IsNotNull}}">
+        <views:ConfirmDeleteCard DataContext="{Binding Vault}" />
+      </Border>
+
+      <StackPanel Margin="0,24,0,40" Spacing="10">
+        <ItemsControl ItemsSource="{Binding Vault.Groups}">
+          <ItemsControl.ItemsPanel>
+            <ItemsPanelTemplate>
+              <StackPanel Spacing="10" />
+            </ItemsPanelTemplate>
+          </ItemsControl.ItemsPanel>
+          <ItemsControl.ItemTemplate>
+            <DataTemplate x:DataType="vm:HostGroupRowViewModel">
+              <Border Classes="settingscard" Padding="20,16">
+                <Grid ColumnDefinitions="Auto,*,Auto,Auto">
+
+                  <Border Grid.Column="0" Width="38" Height="38" CornerRadius="10"
+                          Background="{StaticResource AvatarGradient}">
+                    <TextBlock Text="{Binding Initial}" FontWeight="Bold" FontSize="14"
+                               Foreground="White" HorizontalAlignment="Center" VerticalAlignment="Center" />
+                  </Border>
+
+                  <StackPanel Grid.Column="1" Spacing="5" Margin="14,0" VerticalAlignment="Center">
+                    <TextBlock Text="{Binding Label}" FontSize="15" FontWeight="Bold" LetterSpacing="-0.2"
+                               Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                    <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextFaint}"
+                               Text="{Binding Description}" />
+                  </StackPanel>
+
+                  <Border Grid.Column="2" Classes="chip" Margin="0,0,14,0" VerticalAlignment="Center"
+                          IsVisible="{Binding HasVaultBadge}">
+                    <TextBlock Text="{Binding VaultBadge}" />
+                  </Border>
+
+                  <StackPanel Grid.Column="3" Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+                    <Button Classes="paneicon" Width="34" Height="34" FontSize="15"
+                            Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.EditGroupCommand}"
+                            CommandParameter="{Binding}" ToolTip.Tip="Rename this group or change what its hosts inherit.">
+                      <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE3C9;" />
+                    </Button>
+                    <Button Classes="paneicon danger" Width="34" Height="34" FontSize="15"
+                            Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.DeleteGroupCommand}"
+                            CommandParameter="{Binding}" ToolTip.Tip="Delete this group. The hosts filed under it are asked about separately.">
+                      <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE872;" />
+                    </Button>
+                  </StackPanel>
+
+                </Grid>
+              </Border>
+            </DataTemplate>
+          </ItemsControl.ItemTemplate>
+        </ItemsControl>
+
+        <!-- The "No group" footer row. Always drawn, even with zero groups, because it is true whether or
+             not any group exists — it is just as often the only row on this page. -->
+        <Border Classes="settingscard" Padding="20,16" Opacity="0.7"
+                IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
+          <StackPanel Orientation="Horizontal" Spacing="14">
+            <TextBlock FontFamily="{StaticResource IconFont}" FontSize="17" Text="&#xE14B;"
+                       Foreground="{StaticResource TextGhost}" VerticalAlignment="Center" />
+            <StackPanel Spacing="5">
+              <TextBlock Text="No group" FontSize="14" FontWeight="SemiBold" LetterSpacing="-0.2"
+                         Foreground="{StaticResource TextFaint}" />
+              <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextGhost}"
+                         Text="{Binding Vault.UngroupedHostCount, StringFormat='{}{0} hosts · always listed first · cannot be renamed or deleted'}" />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                   IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNull}}"
+                   Text="Unlock your keychain to see and manage your groups." />
+      </StackPanel>
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsGroupsPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Groups: every group, and the hosts filed under each — see the remark at the top of the markup.</summary>
+internal sealed partial class SettingsGroupsPage : UserControl
+{
+    public SettingsGroupsPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsNav.axaml

@@ -0,0 +1,116 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SettingsNav"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: settings mode's own 340px rail — SettingsNav.dc.html. Two sections rather than the design's three:
+    the design's ORGANISATION section and its one row (Organisation settings) are refused outright — no
+    organisation entity exists anywhere in this product; a Team is the membership list behind a shared vault,
+    and there is exactly one tenant per deployment. See design-notes/v5c-fidelity-notes.md.
+
+    v5c-2: Groups and Tags joined CUSTOMIZE, after Preferences — the design's own order (Security,
+    Preferences, Groups, Tags). Each opens a real management page over the existing group and tag commands;
+    see SettingsGroupsPage.axaml and SettingsTagsPage.axaml.
+
+    Button.nav and its two TextBlock helpers are the exact rows NavRail.axaml already draws at 255px — height
+    35, radius 8, a 19px glyph and a 10.5 semibold label, accent fill with white text when active. Reused
+    rather than restyled: this design states the same three numbers for this rail's own rows, and a second
+    copy of one style is how the two rails drift apart the day only one of them is touched again.
+  -->
+
+  <Border Width="340" Background="{StaticResource DeepChrome}"
+          BorderBrush="{StaticResource Border}" BorderThickness="0,0,1,0">
+    <DockPanel LastChildFill="False" Margin="18,24">
+
+      <StackPanel DockPanel.Dock="Top" Spacing="8">
+
+        <TextBlock Text="SETTINGS" Margin="11,0,0,6" FontSize="10" FontWeight="SemiBold"
+                   LetterSpacing="1.5" Foreground="{StaticResource TextGhost}" />
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsGeneralPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.General}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE8B8;" />
+            <TextBlock Classes="navlabel" Text="General" />
+          </StackPanel>
+        </Button>
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsVaultsPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Vaults}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE84F;" />
+            <TextBlock Classes="navlabel" Text="Vaults" />
+          </StackPanel>
+        </Button>
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsAccountPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Account}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE7FD;" />
+            <TextBlock Classes="navlabel" Text="Account" />
+          </StackPanel>
+        </Button>
+
+        <TextBlock Text="CUSTOMIZE" Margin="11,14,0,6" FontSize="10" FontWeight="SemiBold"
+                   LetterSpacing="1.5" Foreground="{StaticResource TextGhost}" />
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsSecurityPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Security}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE9E0;" />
+            <TextBlock Classes="navlabel" Text="Security" />
+          </StackPanel>
+        </Button>
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsPreferencesPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Preferences}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE429;" />
+            <TextBlock Classes="navlabel" Text="Preferences" />
+          </StackPanel>
+        </Button>
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsGroupsPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Groups}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE7EF;" />
+            <TextBlock Classes="navlabel" Text="Groups" />
+          </StackPanel>
+        </Button>
+
+        <Button Classes="flat nav" Classes.active="{Binding IsSettingsTagsPage}"
+                Command="{Binding EnterSettingsCommand}"
+                CommandParameter="{x:Static vm:SettingsPage.Tags}">
+          <StackPanel Orientation="Horizontal" Spacing="10">
+            <TextBlock Classes="navicon" Text="&#xE54E;" />
+            <TextBlock Classes="navlabel" Text="Tags" />
+          </StackPanel>
+        </Button>
+
+      </StackPanel>
+
+      <!--
+        Wired to the same command the rail's own user popover Logout row calls — see
+        MainWindowViewModel.SignOutFromPopover, which now lands on the Account page rather than on the old
+        bare Preferences screen, so there is exactly one place the confirmation card is drawn.
+      -->
+      <Button DockPanel.Dock="Bottom" Classes="flat nav"
+              Command="{Binding SignOutFromPopoverCommand}">
+        <StackPanel Orientation="Horizontal" Spacing="10">
+          <TextBlock Classes="navicon" FontSize="17" Text="&#xE9BA;" />
+          <TextBlock Classes="navlabel" Text="Logout" />
+        </StackPanel>
+      </Button>
+
+    </DockPanel>
+  </Border>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsNav.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's own 340px rail — General/Vaults/Account, Security/Preferences, and Logout.</summary>
+internal sealed partial class SettingsNav : UserControl
+{
+    public SettingsNav() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml

@@ -0,0 +1,134 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SettingsPreferencesPage"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: Preferences, against Settings-Preferences.dc.html — the old PreferencesScreen.axaml's real content,
+    restyled into the settings page idiom and split across two pages rather than one.
+
+    THIS MACHINE moved to the Security page whole: Windows Hello's register/"stop unlocking here" pair and
+    the no-TPM explanation are Security's UNLOCKING card now, one home rather than two — see the cross-
+    reference row at the foot of this page. Device name is not one of the rows that moved; it never existed
+    here at all, because there is no device-name setting to move. Logs record the machine name on their own.
+
+    TERMINAL keeps its one real setting, text size, and drops the design's other five — font, cursor,
+    scrollback, copy on select, terminal bell — which the renderer hard-codes. KEYCHAIN keeps Lock now,
+    Sync now/Sign in, and the importer row exactly as the old screen had them; the design's own SECURITY
+    card (clipboard-clear delay, confirm-run-on-insert) has nothing behind either row and is not drawn here.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <TextBlock Classes="settingstitle" Text="Preferences" />
+
+      <TextBlock Classes="settingssection" Text="TERMINAL" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+
+          <Border Classes="settingsrow last">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Text size" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="How large a terminal draws, in pixels. Ctrl+plus and Ctrl+minus do the same while a terminal has focus, and Ctrl+0 puts it back. It resizes the grid rather than magnifying it, so the remote is told how many columns it now has — which is also why it stops before the columns run out." />
+              </StackPanel>
+              <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="10" VerticalAlignment="Top">
+                <Button Width="36" Height="36" Classes="ghost" Padding="0"
+                        Command="{Binding ShrinkTerminalFontCommand}"
+                        IsEnabled="{Binding CanShrinkTerminalFont}"
+                        ToolTip.Tip="Smaller · Ctrl+minus">
+                  <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE15B;" FontSize="15" />
+                </Button>
+                <TextBlock Classes="mono" FontSize="13.5" MinWidth="46" VerticalAlignment="Center"
+                           TextAlignment="Center" Foreground="{StaticResource Text}"
+                           Text="{Binding TerminalFontSize, StringFormat={}{0} px}" />
+                <Button Width="36" Height="36" Classes="ghost" Padding="0"
+                        Command="{Binding EnlargeTerminalFontCommand}"
+                        IsEnabled="{Binding CanEnlargeTerminalFont}"
+                        ToolTip.Tip="Larger · Ctrl+plus">
+                  <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE145;" FontSize="15" />
+                </Button>
+                <Button Classes="ghost" Height="36" Content="RESET"
+                        Command="{Binding ResetTerminalFontCommand}"
+                        ToolTip.Tip="Back to the size it ships at · Ctrl+0" />
+              </StackPanel>
+            </Grid>
+          </Border>
+
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="KEYCHAIN" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+
+          <Border Classes="settingsrow">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Lock the keychain" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Closes the keychain and forgets every key it held. Shells you have open keep running and reappear when you unlock — locked describes the keychain, not this machine's access to your hosts." />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="ghost" Height="38" Content="LOCK NOW"
+                      Command="{Binding LockCommand}" />
+            </Grid>
+          </Border>
+
+          <Border Classes="settingsrow">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Synchronise" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Runs a pass now. One runs on its own when the keychain opens, straight after any change, and every minute while it stays open." />
+              </StackPanel>
+              <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="8">
+                <Button Classes="ghost" Height="38" Content="SIGN IN" Command="{Binding SignInCommand}"
+                        IsVisible="{Binding !IsOnline}"
+                        ToolTip.Tip="Opens your browser. Only needed when there is no remembered session to resume." />
+                <Button Classes="ghost" Height="38" Content="SYNC NOW" Command="{Binding Vault.SyncCommand}" />
+              </StackPanel>
+            </Grid>
+          </Border>
+
+          <Border Classes="settingsrow last">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0">
+                <TextBlock Classes="settingsrowtitle" Text="Import SSH config" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Reads this machine's ~/.ssh/config, shows what it found, and imports only what you approve. Nothing is stored during the scan, and no private key is read — where a key file is named, the path is recorded as a note." />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="ghost" Height="38" Content="OPEN IMPORTER"
+                      Command="{Binding ShowScreenCommand}"
+                      CommandParameter="{x:Static vm:ShellScreen.Import}" />
+            </Grid>
+          </Border>
+
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="NOT BUILT YET" />
+
+      <Border Classes="settingscard">
+        <StackPanel Margin="24,20" Spacing="10">
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Unlocking with Windows Hello moved to Security — it registers this machine rather than a preference of this screen's, and Security is where the rest of this machine's trust facts live." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Terminal font, cursor and scrollback — the renderer hard-codes those three. Text size above is the one that is not." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Copy on select and the terminal bell — neither is wired to anything the renderer does." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Clearing the clipboard after copying a secret, and confirming a snippet that runs on insert — neither exists; a copied secret stays on the clipboard until something else replaces it." />
+          <TextBlock Classes="settingsrowcaption"
+                     Text="A device name — there is no such setting. Logs record this machine's own name on their own." />
+        </StackPanel>
+      </Border>
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsPreferencesPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's Preferences page: the Terminal and Keychain cards.</summary>
+internal sealed partial class SettingsPreferencesPage : UserControl
+{
+    public SettingsPreferencesPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsSecurityPage.axaml

@@ -0,0 +1,126 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SettingsSecurityPage"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: Security, against Settings-Security.dc.html.
+
+    The end-to-end card's sentence is ADR 0001's own claim in the design's words: "The server stores
+    ciphertext and never holds a key" and "the relay operator ... see ciphertext only" — see docs/adr/0001-e2ee-trust-model.md.
+
+    UNLOCKING is Windows Hello's register/"Stop unlocking here" pair, moved here whole from the old
+    PreferencesScreen.axaml — same RegisterDeviceCommand, ForgetDeviceCommand and the no-TPM explanation
+    (HasNoDeviceKeyOption). One home for this fact rather than two; see the cross-reference on the
+    Preferences page. The design's own auto-lock link row is refused: there is nothing to link to, since
+    auto-lock and per-vault unlock rules do not exist anywhere in this client.
+
+    CONNECTING keeps exactly one row, Approved host keys. Strict host-key checking and the allowed-algorithm
+    chips are both refused — the app always asks on a changed key, and there is no algorithm allow-list
+    anywhere in the SSH stack. The count and the "N that no host dials" clause both come straight off
+    KnownHostsViewModel.Summary, the same sentence the known-hosts screen's own header prints, so this row
+    can never say a different number than the screen it sends you to. "Open host keys" leaves settings mode
+    on purpose — known-hosts is a MAIN-chrome screen, and there is no honest way to show it without leaving;
+    ShowScreenCommand already does that for any target that is not Preferences or Vaults.
+
+    RECENT SECURITY EVENTS is the link row alone, not the design's own list of rows. A real list would mean
+    building a filtered read over LogsViewModel's activity and connection logs — which entries count as
+    "security" is itself a judgement call the design does not resolve — and the honest link is complete on
+    its own: Logs already holds the whole story, and this row says so rather than half-repeating it.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <TextBlock Classes="settingstitle" Text="Security" />
+
+      <Border Classes="settingscard" Margin="0,26,0,0" Padding="20,20">
+        <StackPanel Orientation="Horizontal" Spacing="16">
+          <Border Width="44" Height="44" CornerRadius="12" Background="#103A2F">
+            <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE897;" FontSize="20"
+                       Foreground="{StaticResource Live}"
+                       HorizontalAlignment="Center" VerticalAlignment="Center" />
+          </Border>
+          <StackPanel Spacing="6" VerticalAlignment="Center">
+            <TextBlock Text="End-to-end encrypted" FontSize="15" FontWeight="Bold" LetterSpacing="-0.2"
+                       Foreground="{StaticResource Text}" />
+            <TextBlock Classes="settingsrowcaption"
+                       Text="Every vault item is sealed on your devices. The server and the relay both store ciphertext and timestamps only — neither can read a single field." />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="UNLOCKING" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+          <Border Classes="settingsrow last">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0" MaxWidth="640">
+                <TextBlock Classes="settingsrowtitle" Text="Windows Hello on this machine" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Registers this machine so a later launch can open the keychain with a Windows confirmation instead of your passphrase. Your passphrase keeps working."
+                           IsVisible="{Binding CanRegisterDevice}" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="Registered · the TPM holds a device key that can open the keychain with a Windows confirmation."
+                           IsVisible="{Binding CanForgetDevice}" />
+                <TextBlock Classes="settingsrowcaption"
+                           Text="This machine has nowhere to keep a device key, so the keychain will keep asking for your passphrase. That needs a TPM and a Windows keystore willing to release the key."
+                           IsVisible="{Binding HasNoDeviceKeyOption}" />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="accent" Height="38" Content="REGISTER"
+                      Command="{Binding RegisterDeviceCommand}"
+                      IsEnabled="{Binding !IsBusy}"
+                      IsVisible="{Binding CanRegisterDevice}" />
+              <Button Grid.Column="1" Classes="danger" Height="38" Content="STOP UNLOCKING HERE"
+                      Command="{Binding ForgetDeviceCommand}"
+                      IsEnabled="{Binding !IsBusy}"
+                      IsVisible="{Binding CanForgetDevice}"
+                      ToolTip.Tip="Withdraws this machine's device key, here and from your account, so it goes back to asking for your passphrase. Do this to a machine you have lost." />
+            </Grid>
+          </Border>
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="CONNECTING" />
+
+      <Border Classes="settingscard">
+        <StackPanel>
+          <Border Classes="settingsrow last">
+            <Grid ColumnDefinitions="*,Auto">
+              <StackPanel Grid.Column="0" Spacing="6" Margin="0,0,16,0" MaxWidth="640">
+                <TextBlock Classes="settingsrowtitle" Text="Approved host keys" />
+                <TextBlock Classes="settingsrowcaption" Text="{Binding KnownHostsScreen.Summary}" />
+              </StackPanel>
+              <Button Grid.Column="1" Classes="ghost" Height="38" Content="OPEN HOST KEYS"
+                      Command="{Binding ShowScreenCommand}"
+                      CommandParameter="{x:Static vm:ShellScreen.KnownHosts}" />
+            </Grid>
+          </Border>
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingssection" Text="RECENT SECURITY EVENTS" />
+
+      <Border Classes="settingscard" Margin="0,12,0,40">
+        <StackPanel>
+          <Border Classes="settingsrow last">
+            <Button Classes="flat" Padding="0" HorizontalAlignment="Left"
+                    Command="{Binding ShowScreenCommand}"
+                    CommandParameter="{x:Static vm:ShellScreen.Logs}">
+              <StackPanel Orientation="Horizontal" Spacing="8">
+                <TextBlock Text="See all activity in Logs" FontSize="12" FontWeight="SemiBold"
+                           Foreground="{StaticResource AccentText}" />
+                <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5C8;" FontSize="14"
+                           Foreground="{StaticResource AccentText}" />
+              </StackPanel>
+            </Button>
+          </Border>
+        </StackPanel>
+      </Border>
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsSecurityPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's Security page: the E2E explainer, Windows Hello, and approved host keys.</summary>
+internal sealed partial class SettingsSecurityPage : UserControl
+{
+    public SettingsSecurityPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsTagsPage.axaml

@@ -0,0 +1,150 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
+             x:Class="DodoSSH.Client.App.Views.SettingsTagsPage"
+             x:DataType="vm:MainWindowViewModel"
+             x:Name="Root">
+
+  <!--
+    v5c-2: Tags, against Settings-Tags.dc.html — a real management page over VaultViewModel's own tag
+    commands (Tags, NewTag, EditTagRow, DeleteTagRow), which used to be reachable only from the keychain
+    screen's TAGS category. Both doors stay open — the keychain screen's own panel is untouched — because
+    they lead to the same commands and the same rows; nothing here is a second implementation.
+
+    ── THE INTRO SENTENCE IS TRUE, AND IT IS THE DESIGN'S OWN ─────────────────────────────────────────────
+    "Renaming here is one write and every host follows" — verified against SaveTagAsync and TagRowViewModel's
+    own remark: a host names a tag's id in its TagSet, never its label, so renaming touches nothing but the
+    tag item itself. Kept rather than rewritten.
+
+    ── EDIT AND DELETE ARE WRAPPER COMMANDS, UNLIKE THE GROUPS PAGE'S ──────────────────────────────────────
+    EditTagCommand and DeleteTagCommand read VaultViewModel.SelectedTag rather than taking a row argument —
+    they were built for the keychain screen's own ListBox selection, which this page has no equivalent of.
+    VaultViewModel.EditTagRow/DeleteTagRow (v5c-2, additive) select the row and then call the real command, so
+    every guard and every sentence either one already has is still the one that runs.
+
+    ── WHAT THE DESIGN DREW AND THIS PAGE DOES NOT ─────────────────────────────────────────────────────────
+    The LAST APPLIED column: no timestamp of when a tag was last put on a host exists anywhere in this
+    client, and a column of "just now" / "2 min ago" would be inventing one.
+  -->
+
+  <ScrollViewer>
+    <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+      <Grid ColumnDefinitions="*,Auto">
+        <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="14" VerticalAlignment="Center">
+          <TextBlock Classes="settingstitle" Text="Tags" />
+          <Border Background="{StaticResource Chip}" CornerRadius="9" MinWidth="34" Height="30"
+                  IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
+            <TextBlock Text="{Binding Vault.Tags.Count}" FontSize="13.5" FontWeight="SemiBold"
+                       Foreground="{StaticResource TextFaint}" Margin="8,0"
+                       HorizontalAlignment="Center" VerticalAlignment="Center" />
+          </Border>
+        </StackPanel>
+        <Button Grid.Column="1" Classes="accent" Height="40" Content="+ NEW TAG"
+                Command="{Binding Vault.NewTagCommand}"
+                IsEnabled="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}" />
+      </Grid>
+
+      <TextBlock Classes="settingsrowcaption" Margin="0,12,0,0" TextWrapping="Wrap"
+                 Text="A tag is a name shared by every host that carries it. Renaming here is one write — every host, filter and snippet rule follows." />
+
+      <!-- The tag editor, in place — the same one-box form the keychain screen's own panel draws, restyled
+           into this page's card idiom. -->
+      <Border Classes="settingscard" Margin="0,20,0,0" Padding="20"
+              IsVisible="{Binding Vault.IsEditingTag}">
+        <StackPanel Spacing="8">
+          <TextBlock Classes="settingsrowtitle" Text="Tag" />
+          <TextBox PlaceholderText="name" Text="{Binding Vault.TagEditorLabel}">
+            <TextBox.KeyBindings>
+              <KeyBinding Gesture="Enter" Command="{Binding Vault.SaveTagCommand}" />
+            </TextBox.KeyBindings>
+          </TextBox>
+          <TextBlock Classes="settingsrowcaption"
+                     Text="Renaming a tag changes it everywhere at once. No host is rewritten — each one names this tag rather than repeating its name." />
+          <StackPanel Orientation="Horizontal" Spacing="8">
+            <Button Classes="accent" Height="36" Content="SAVE" Command="{Binding Vault.SaveTagCommand}" />
+            <Button Classes="ghost" Height="36" Content="CANCEL" Command="{Binding Vault.CancelTagEditCommand}" />
+          </StackPanel>
+        </StackPanel>
+      </Border>
+
+      <!-- The delete confirmation, in place — the same shared control the groups and vaults pages reuse. -->
+      <Border Margin="0,20,0,0" Padding="20" CornerRadius="12"
+              Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
+              BorderThickness="1"
+              IsVisible="{Binding Vault.PendingDeletion, Converter={x:Static ObjectConverters.IsNotNull}}">
+        <views:ConfirmDeleteCard DataContext="{Binding Vault}" />
+      </Border>
+
+      <Border Classes="settingscard" Margin="0,24,0,40" Padding="0"
+              IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
+        <StackPanel>
+
+          <Grid ColumnDefinitions="1.4*,*,*,Auto" Margin="20,14,20,10">
+            <TextBlock Grid.Column="0" Classes="label" Text="TAG" />
+            <TextBlock Grid.Column="1" Classes="label" Text="USED BY" />
+            <TextBlock Grid.Column="2" Classes="label" Text="VAULT" />
+            <TextBlock Grid.Column="3" Classes="label" Text=" " />
+          </Grid>
+
+          <ItemsControl ItemsSource="{Binding Vault.Tags}">
+            <ItemsControl.ItemsPanel>
+              <ItemsPanelTemplate>
+                <StackPanel />
+              </ItemsPanelTemplate>
+            </ItemsControl.ItemsPanel>
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="vm:TagRowViewModel">
+                <Border Classes="settingsrow last" Padding="20,10">
+                  <Grid ColumnDefinitions="1.4*,*,*,Auto">
+
+                    <Border Grid.Column="0" Classes="chip" HorizontalAlignment="Left" VerticalAlignment="Center">
+                      <TextBlock Text="{Binding Label}" />
+                    </Border>
+
+                    <TextBlock Grid.Column="1" Classes="mono" FontSize="11.5"
+                               Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
+                               Text="{Binding Description}" />
+
+                    <!--
+                      No vault chip here — unlike a group, TagRowViewModel does not carry which vault it lives
+                      in (tags are read from the active vault alone; see VaultViewModel.NewTag's own remark),
+                      so there is no second vault this column could honestly name.
+                    -->
+                    <TextBlock Grid.Column="2" />
+
+                    <StackPanel Grid.Column="3" Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+                      <Button Classes="paneicon" Width="30" Height="30" FontSize="13"
+                              Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.EditTagRowCommand}"
+                              CommandParameter="{Binding}" ToolTip.Tip="Rename this tag.">
+                        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE3C9;" />
+                      </Button>
+                      <Button Classes="paneicon danger" Width="30" Height="30" FontSize="13"
+                              Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.DeleteTagRowCommand}"
+                              CommandParameter="{Binding}" ToolTip.Tip="Delete this tag. Hosts wearing it simply stop showing the chip.">
+                        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE872;" />
+                      </Button>
+                    </StackPanel>
+
+                  </Grid>
+                </Border>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+
+          <TextBlock Classes="settingsrowcaption" Margin="20,14,20,18" TextWrapping="Wrap"
+                     IsVisible="{Binding !Vault.HasTagItems}"
+                     Text="No tags yet. Add one from here, or from a host's own editor." />
+
+        </StackPanel>
+      </Border>
+
+      <TextBlock Classes="settingsrowcaption" Margin="0,20,0,40" TextWrapping="Wrap"
+                 IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNull}}"
+                 Text="Unlock your keychain to see and manage your tags." />
+
+    </StackPanel>
+  </ScrollViewer>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsTagsPage.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Tags: every tag, and how many hosts wear each — see the remark at the top of the markup.</summary>
+internal sealed partial class SettingsTagsPage : UserControl
+{
+    public SettingsTagsPage() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml

@@ -0,0 +1,79 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             x:Class="DodoSSH.Client.App.Views.SettingsTitleBar"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: settings mode's own titlebar — SettingsNav.dc.html and the four Settings-*.dc.html sources all draw
+    the same 53px bar: "Back to application" on the left, in place of the wordmark and the search box, and
+    the same three window-control glyphs on the right TitleBar.axaml already draws.
+
+    A separate control rather than a variant of TitleBar itself, on the same reasoning SessionHeader and
+    SessionStatusBar are their own files: nothing here can be measured by a test that hosts the real window,
+    and a control that is either "the wordmark bar" or "the settings bar" depending on a bound flag would be
+    two controls wearing one name. The dragging, maximising and closing logic is duplicated from TitleBar's
+    own code-behind rather than shared through a base class — four short handlers, and the day one of the two
+    bars needs its own window behaviour a shared base would have to be pulled apart first.
+
+    v5c-3: two back buttons rather than one whose text and command a converter swaps, toggled by
+    MainWindowViewModel.IsImportOpen — Import.dc.html draws the same 53px bar with "Back to preferences" in
+    place of "Back to application" while the importer is up, and CloseImportCommand closes it without leaving
+    settings mode, unlike LeaveSettingsCommand.
+  -->
+
+  <Border Height="53" Background="{StaticResource DeepChrome}"
+          PointerPressed="OnDrag" DoubleTapped="OnToggleMaximised">
+
+    <Grid ColumnDefinitions="*,Auto" Margin="26,0,20,0">
+
+      <Button Grid.Column="0" Classes="flat" HorizontalAlignment="Left"
+              IsVisible="{Binding !IsImportOpen}"
+              Command="{Binding LeaveSettingsCommand}"
+              ToolTip.Tip="Back to the screen you were on before opening Settings">
+        <StackPanel Orientation="Horizontal" Spacing="12" VerticalAlignment="Center">
+          <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5C4;" FontSize="17"
+                     Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+          <TextBlock Text="Back to application" FontSize="13" FontWeight="SemiBold"
+                     Foreground="{StaticResource Text}" VerticalAlignment="Center" />
+        </StackPanel>
+      </Button>
+
+      <Button Grid.Column="0" Classes="flat" HorizontalAlignment="Left"
+              IsVisible="{Binding IsImportOpen}"
+              Command="{Binding CloseImportCommand}"
+              ToolTip.Tip="Back to preferences, without leaving Settings">
+        <StackPanel Orientation="Horizontal" Spacing="12" VerticalAlignment="Center">
+          <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5C4;" FontSize="17"
+                     Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+          <TextBlock Text="Back to preferences" FontSize="13" FontWeight="SemiBold"
+                     Foreground="{StaticResource Text}" VerticalAlignment="Center" />
+        </StackPanel>
+      </Button>
+
+      <!-- The window controls, identical to TitleBar's own — see the remark above on why they are repeated. -->
+      <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="2">
+        <Button Classes="flat" Width="26" Height="24" Click="OnMinimise"
+                ToolTip.Tip="Minimise">
+          <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE15B;" FontSize="14"
+                     Foreground="{StaticResource TextFaint}"
+                     HorizontalAlignment="Center" VerticalAlignment="Center" />
+        </Button>
+        <Button Classes="flat" Width="26" Height="24" Click="OnToggleMaximised"
+                ToolTip.Tip="Maximise">
+          <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE3C6;" FontSize="13"
+                     Foreground="{StaticResource TextFaint}"
+                     HorizontalAlignment="Center" VerticalAlignment="Center" />
+        </Button>
+        <Button Classes="flat close" Width="26" Height="24" Click="OnClose"
+                ToolTip.Tip="Close DodoSSH. This ends every shell it has open.">
+          <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5CD;" FontSize="14"
+                     HorizontalAlignment="Center" VerticalAlignment="Center" />
+        </Button>
+      </StackPanel>
+
+    </Grid>
+
+  </Border>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsTitleBar.axaml.cs

@@ -0,0 +1,47 @@
+using Avalonia.Controls;
+using Avalonia.Input;
+using Avalonia.Interactivity;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Settings mode's own titlebar — see the remark in the markup for why it is not TitleBar itself.</summary>
+internal sealed partial class SettingsTitleBar : UserControl
+{
+    public SettingsTitleBar() => InitializeComponent();
+
+    private Window? Host => TopLevel.GetTopLevel(this) as Window;
+
+    /// <summary>Left button only, and only on a press nothing inside the bar has already handled.</summary>
+    private void OnDrag(object? sender, PointerPressedEventArgs e)
+    {
+        if (e.Handled || !e.GetCurrentPoint(this).Properties.IsLeftButtonPressed)
+        {
+            return;
+        }
+
+        Host?.BeginMoveDrag(e);
+    }
+
+    private void OnMinimise(object? sender, RoutedEventArgs e)
+    {
+        if (Host is { } window)
+        {
+            window.WindowState = WindowState.Minimized;
+        }
+    }
+
+    /// <summary>Both the button and a double-click on the bar arrive here, as Windows convention expects.</summary>
+    private void OnToggleMaximised(object? sender, RoutedEventArgs e)
+    {
+        if (Host is not { } window)
+        {
+            return;
+        }
+
+        window.WindowState = window.WindowState == WindowState.Maximized
+            ? WindowState.Normal
+            : WindowState.Maximized;
+    }
+
+    private void OnClose(object? sender, RoutedEventArgs e) => Host?.Close();
+}

src/DodoSSH.Client.App/Views/SettingsVaultsPage.axaml

@@ -0,0 +1,407 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:contracts="using:DodoSSH.Contracts"
+             x:Class="DodoSSH.Client.App.Views.SettingsVaultsPage"
+             x:DataType="vm:MainWindowViewModel"
+             x:Name="Root">
+
+  <!--
+    v5c-2: Vaults, against Settings-Vaults.dc.html. Replaces the old full-bleed VaultsScreen, which this
+    settings page now covers completely — every command it had is reachable here exactly once, and
+    VaultsScreen.axaml is gone. Its data is DataContext.Vaults (VaultsViewModel), reached as {Binding Vaults.*}
+    throughout because this page's own DataContext is the shell, the same choice every other settings page
+    makes.
+
+    ── WHAT THE DESIGN DREW AND THIS PAGE DOES NOT ─────────────────────────────────────────────────────────
+    "Manage devices" and "3 devices" in the sync line — no list-devices endpoint exists. The whole VAULT
+    DEFAULTS card (auto-lock, require-password-on-unlock, relay toggle) and the whole RECOVERY card (kit,
+    export) — none of the three exists; sync is always on. The magenta "Default" badge — the app does track a
+    "new items go to" vault (VaultViewModel.TargetVaultId), but that lives on a different view model than the
+    row being drawn here and cross-referencing the two per card would be more machinery than the badge is
+    worth; dropped rather than faked. Per-vault UNLOCKED/LOCKED chips — this app locks the keychain as a
+    whole, not one vault at a time, so there is no per-vault state for a chip to draw; the keychain-level fact
+    lives in the sync card's dot instead. The "Unlock Rocateq" modal — same reason, there is nothing per-vault
+    to unlock. Member avatar stacks on the card list — VaultRowViewModel carries a member *count*, not the
+    members themselves; only the selected vault's Members collection is actually loaded, which is why avatars
+    are drawn in the members panel below and nowhere else. The "Sorted by name ▾" control — decorative in the
+    mock; Vaults.Vaults is already ordered personal-first-then-name and there is no second order to switch to.
+
+    ── THE MEMBERS PANEL ────────────────────────────────────────────────────────────────────────────────────
+    The design draws an 860px modal. This app's only overlay idiom below a whole-window mode is the scrim a
+    Border with a translucent Background and a PointerPressed handler draws — see QuickConnect.axaml, the
+    other place a click-away-to-close panel exists — so that is what this is, capped at MaxWidth 860 rather
+    than fixed to it: the settings content column is narrower than 860 at the window's minimum, and a modal
+    that insisted on the full width would arrange its own rows past the edge of what this page is given.
+
+    Inside it is the old screen's own right-hand column, restyled rather than reinvented: a selectable list of
+    members, the SET ROLE buttons, the ADD row, REMOVE, HAND OVER, SHARE KEY/WITHDRAW KEY and the KEY HOLDERS
+    list, on the same VaultsViewModel.SelectedMember selection the old screen used. Deleting a vault stays a
+    card-level action (the danger icon below), not a members-panel one, so PendingAction is drawn in only one
+    of the two places at a time — see the two IsVisible guards below, which key off IsMembersPanelOpen because
+    HAND OVER can only ever be armed with the panel open (it needs a selected member) and DELETE only with it
+    closed (the card's own icon is what arms it).
+
+    The sentence that must survive from the old screen: a vault cannot be deleted through the membership list
+    behind it — there is no such call anywhere in the server, and archiving a team while its vault still
+    exists is refused. That is not the same fact as "a vault cannot be deleted" — the DELETE icon below does
+    delete the vault itself — and both sentences are kept, each where it is true.
+  -->
+
+  <Panel>
+
+    <ScrollViewer>
+      <StackPanel MaxWidth="1100" Margin="40" HorizontalAlignment="Stretch">
+
+        <Grid ColumnDefinitions="*,Auto">
+          <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="14" VerticalAlignment="Center">
+            <TextBlock Classes="settingstitle" Text="Vaults" />
+            <Border Background="{StaticResource Chip}" CornerRadius="9" MinWidth="34" Height="30">
+              <TextBlock Text="{Binding Vaults.Vaults.Count}" FontSize="13.5" FontWeight="SemiBold"
+                         Foreground="{StaticResource TextFaint}" Margin="8,0"
+                         HorizontalAlignment="Center" VerticalAlignment="Center" />
+            </Border>
+          </StackPanel>
+          <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="12" VerticalAlignment="Center">
+            <Button Classes="ghost" Height="40" Content="SYNC NOW" Command="{Binding Vault.SyncCommand}" />
+            <Button Classes="accent" Height="40" Content="+ NEW VAULT"
+                    Command="{Binding Vaults.NewVaultCommand}"
+                    IsEnabled="{Binding !Vaults.IsBusy}" />
+          </StackPanel>
+        </Grid>
+
+        <!-- The name-a-vault and rename-a-vault forms, in place — this window has no modal idiom for a bare
+             text field, and the members panel below is a different kind of overlay: over one vault's people,
+             not over a form. -->
+        <Border Classes="settingscard" Margin="0,20,0,0" Padding="20"
+                IsVisible="{Binding Vaults.IsCreatingVault}">
+          <StackPanel Spacing="8">
+            <TextBlock Classes="settingsrowtitle" Text="New vault" />
+            <TextBox PlaceholderText="Name" Text="{Binding Vaults.NewVaultName}" />
+            <TextBlock Classes="settingsrowcaption"
+                       Text="Its key is made on this machine and nobody else has it. Add people to it once it exists, then press SHARE KEY." />
+            <StackPanel Orientation="Horizontal" Spacing="8">
+              <Button Classes="accent" Height="36" Content="CREATE"
+                      Command="{Binding Vaults.CreateVaultCommand}" IsEnabled="{Binding !Vaults.IsBusy}" />
+              <Button Classes="ghost" Height="36" Content="CANCEL"
+                      Command="{Binding Vaults.CancelNewVaultCommand}" />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <Border Classes="settingscard" Margin="0,20,0,0" Padding="20"
+                IsVisible="{Binding Vaults.IsRenamingVault}">
+          <StackPanel Spacing="8">
+            <TextBlock Classes="settingsrowtitle" Text="Rename vault" />
+            <TextBox PlaceholderText="Name" Text="{Binding Vaults.EditVaultName}" />
+            <TextBlock Classes="settingsrowcaption"
+                       Text="Everybody who shares this vault sees the new name. Nothing is re-encrypted and no key changes — the name has always been stored in plain text, because a person has to be able to pick a vault before anything is decrypted." />
+            <StackPanel Orientation="Horizontal" Spacing="8">
+              <Button Classes="accent" Height="36" Content="SAVE"
+                      Command="{Binding Vaults.SaveVaultNameCommand}" IsEnabled="{Binding !Vaults.IsBusy}" />
+              <Button Classes="ghost" Height="36" Content="CANCEL"
+                      Command="{Binding Vaults.CancelRenameVaultCommand}" />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <!-- A vault's own destructive confirmation. Only while the members panel is shut — see the remark
+             above for why the two never compete for this one PendingAction. Both conditions on the same
+             Border, not one nested inside the other: a Border visible with its content hidden would still
+             draw an empty danger-tinted card while the members panel's own copy of this confirmation is
+             showing. -->
+        <Border Classes="settingscard" Margin="0,20,0,0" Padding="20"
+                Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}">
+          <Border.IsVisible>
+            <MultiBinding Converter="{x:Static BoolConverters.And}">
+              <Binding Path="Vaults.IsConfirming" />
+              <Binding Path="!Vaults.IsMembersPanelOpen" />
+            </MultiBinding>
+          </Border.IsVisible>
+          <StackPanel Spacing="8">
+            <TextBlock Text="{Binding Vaults.PendingAction.Question}" FontSize="14.5" FontWeight="Bold"
+                       Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+            <TextBlock Text="{Binding Vaults.PendingAction.Consequence}" FontSize="12.5"
+                       Foreground="{StaticResource WarnText}" TextWrapping="Wrap" />
+            <StackPanel Orientation="Horizontal" Spacing="8">
+              <Button Classes="danger" Height="36" Content="CONFIRM"
+                      Command="{Binding Vaults.ConfirmActionCommand}" IsEnabled="{Binding !Vaults.IsBusy}" />
+              <Button Classes="ghost" Height="36" Content="CANCEL"
+                      Command="{Binding Vaults.CancelActionCommand}" />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <!-- Sync status: only what is real — no device count, no "ran N minutes ago" (this session tracks no
+             such timestamp). The dot and the word are MainWindowViewModel.IsFullySynced/SyncLabel, the exact
+             fact the titlebar's own dot already tells the truth with. -->
+        <Border Classes="settingscard" Margin="0,20,0,0" Padding="20,18">
+          <StackPanel Orientation="Horizontal" Spacing="14">
+            <Ellipse Classes="dot" Classes.live="{Binding IsFullySynced}" Width="9" Height="9"
+                     Margin="0,7,0,0" VerticalAlignment="Top" />
+            <StackPanel Spacing="6">
+              <TextBlock Classes="mono" Text="{Binding SyncLabel}" FontSize="13" FontWeight="Bold"
+                         LetterSpacing="0.5" Foreground="{StaticResource Text}" />
+              <TextBlock Classes="settingsrowcaption" Text="End-to-end encrypted." />
+            </StackPanel>
+          </StackPanel>
+        </Border>
+
+        <TextBlock Classes="settingssection" Text="YOUR VAULTS" Margin="0,32,0,12" />
+
+        <StackPanel Spacing="10" Margin="0,0,0,40" IsVisible="{Binding Vaults.HasVaults}">
+          <ItemsControl ItemsSource="{Binding Vaults.Vaults}">
+            <ItemsControl.ItemsPanel>
+              <ItemsPanelTemplate>
+                <StackPanel Spacing="10" />
+              </ItemsPanelTemplate>
+            </ItemsControl.ItemsPanel>
+            <ItemsControl.ItemTemplate>
+              <DataTemplate x:DataType="vm:VaultRowViewModel">
+                <Border Classes="settingscard" Padding="22,18">
+                  <Grid ColumnDefinitions="Auto,*,Auto">
+
+                    <Border Grid.Column="0" Width="52" Height="52" CornerRadius="12"
+                            Background="{StaticResource AvatarGradient}">
+                      <TextBlock Text="{Binding Initial}" FontWeight="Bold" FontSize="20"
+                                 Foreground="White" HorizontalAlignment="Center" VerticalAlignment="Center" />
+                    </Border>
+
+                    <StackPanel Grid.Column="1" Spacing="7" Margin="16,0" VerticalAlignment="Center">
+                      <StackPanel Orientation="Horizontal" Spacing="8">
+                        <TextBlock Text="{Binding Name}" FontSize="17" FontWeight="Bold"
+                                   LetterSpacing="-0.25" Foreground="{StaticResource Text}"
+                                   TextTrimming="CharacterEllipsis" />
+                        <Border Classes="chip">
+                          <TextBlock Text="{Binding RoleLabel}" />
+                        </Border>
+                      </StackPanel>
+                      <TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextFaint}"
+                                 Text="{Binding Detail}" TextWrapping="Wrap" />
+                      <TextBlock Classes="mono" FontSize="10.5" Foreground="{StaticResource WarnText}"
+                                 Text="{Binding State}" IsVisible="{Binding HasState}" TextWrapping="Wrap" />
+                    </StackPanel>
+
+                    <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+                      <Button Classes="paneicon" Width="34" Height="34" FontSize="15"
+                              Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vaults.OpenMembersPanelCommand}"
+                              CommandParameter="{Binding}" IsVisible="{Binding IsShared}"
+                              ToolTip.Tip="See and manage who is in this vault.">
+                        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE7EF;" />
+                      </Button>
+                      <Button Classes="paneicon" Width="34" Height="34" FontSize="15"
+                              Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vaults.RenameVaultRowCommand}"
+                              CommandParameter="{Binding}" IsVisible="{Binding CanAdminister}"
+                              ToolTip.Tip="Changes what this vault is called. The name is plaintext on the server, as it always was; nothing inside is re-encrypted.">
+                        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE3C9;" />
+                      </Button>
+                      <Button Classes="paneicon danger" Width="34" Height="34" FontSize="15"
+                              Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vaults.DeleteVaultRowCommand}"
+                              CommandParameter="{Binding}"
+                              IsVisible="{Binding !IsPersonal}"
+                              ToolTip.Tip="Deletes this vault and withdraws everybody's key to it. It cannot reach a machine that has already synced it.">
+                        <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE872;" />
+                      </Button>
+                    </StackPanel>
+
+                  </Grid>
+                </Border>
+              </DataTemplate>
+            </ItemsControl.ItemTemplate>
+          </ItemsControl>
+        </StackPanel>
+
+        <TextBlock Classes="settingsrowcaption" Margin="0,20,0,40" TextWrapping="Wrap"
+                   IsVisible="{Binding !Vaults.HasVaults}"
+                   Text="No vaults yet. Unlock your keychain to see the personal one, or make a vault to share hosts and credentials with colleagues." />
+
+        <TextBlock Margin="0,0,0,40" FontSize="11.5" TextWrapping="Wrap"
+                   Foreground="{StaticResource TextFaint}"
+                   IsVisible="{Binding Vaults.Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}"
+                   Text="{Binding Vaults.Status}" />
+
+      </StackPanel>
+    </ScrollViewer>
+
+    <!-- ============ THE MEMBERS PANEL ============ -->
+    <Border x:Name="MembersBackdrop" Background="#9905050A"
+            IsVisible="{Binding Vaults.IsMembersPanelOpen}" PointerPressed="OnBackdropPressed">
+      <Border MaxWidth="860" MaxHeight="620" Margin="30"
+              HorizontalAlignment="Center" VerticalAlignment="Center"
+              Background="{StaticResource Chrome}" BorderBrush="{StaticResource BorderMid}"
+              BorderThickness="1" CornerRadius="14">
+        <Grid RowDefinitions="Auto,*" Margin="26,22">
+
+          <Grid Grid.Row="0" ColumnDefinitions="*,Auto" Margin="0,0,0,14">
+            <TextBlock Grid.Column="0" Text="{Binding Vaults.SelectedVault.Name, StringFormat='{}{0} · Members'}"
+                       FontSize="18" FontWeight="Bold" LetterSpacing="-0.25"
+                       Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+            <Button Grid.Column="1" Classes="paneicon" Width="26" Height="26"
+                    Command="{Binding Vaults.CloseMembersPanelCommand}" ToolTip.Tip="Close">
+              <TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE5CD;" FontSize="15" />
+            </Button>
+          </Grid>
+
+          <ScrollViewer Grid.Row="1">
+            <StackPanel Spacing="16">
+
+              <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                         IsVisible="{Binding Vaults.HasSharedMembershipWarning}"
+                         Text="{Binding Vaults.SharedMembershipWarning}" />
+
+              <StackPanel Spacing="8" IsVisible="{Binding !Vaults.SelectedIsPersonal}">
+
+                <TextBlock Classes="settingssection" Text="MEMBERS" Margin="0" />
+
+                <ListBox ItemsSource="{Binding Vaults.Members}" SelectedItem="{Binding Vaults.SelectedMember}"
+                         Background="Transparent" BorderThickness="0" MaxHeight="220">
+                  <ListBox.ItemTemplate>
+                    <DataTemplate x:DataType="vm:VaultMemberRowViewModel">
+                      <Grid ColumnDefinitions="Auto,*,150,Auto" Margin="0,4">
+                        <Border Grid.Column="0" Width="30" Height="30" CornerRadius="15"
+                                Background="{StaticResource AvatarGradient}">
+                          <TextBlock Text="{Binding Initials}" FontWeight="Bold" FontSize="10"
+                                     Foreground="White" HorizontalAlignment="Center"
+                                     VerticalAlignment="Center" />
+                        </Border>
+                        <StackPanel Grid.Column="1" Spacing="2" Margin="10,0" VerticalAlignment="Center">
+                          <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
+                                     Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                          <TextBlock Classes="settingsrowcaption" FontSize="11" Text="{Binding Email}" />
+                        </StackPanel>
+                        <StackPanel Grid.Column="2" Spacing="2" VerticalAlignment="Center">
+                          <TextBlock Classes="settingsrowcaption" FontSize="10.5" Text="{Binding KeyState}"
+                                     TextWrapping="Wrap" />
+                          <TextBlock Classes="settingsrowcaption" FontSize="10" Text="{Binding LastActive}" />
+                        </StackPanel>
+                        <TextBlock Grid.Column="3" Classes="mono" Text="{Binding Role}" FontSize="10.5"
+                                   Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
+                                   Margin="10,0,0,0" />
+                      </Grid>
+                    </DataTemplate>
+                  </ListBox.ItemTemplate>
+                </ListBox>
+
+                <!-- The hand-over confirmation, only while this panel is the one that armed it. -->
+                <Border Padding="14" CornerRadius="10" Background="{StaticResource DangerWash}"
+                        BorderBrush="{StaticResource DangerSoft}" BorderThickness="1"
+                        IsVisible="{Binding Vaults.IsConfirming}">
+                  <StackPanel Spacing="8">
+                    <TextBlock Text="{Binding Vaults.PendingAction.Question}" FontSize="13.5" FontWeight="Bold"
+                               Foreground="{StaticResource Text}" TextWrapping="Wrap" />
+                    <TextBlock Text="{Binding Vaults.PendingAction.Consequence}" FontSize="11.5"
+                               Foreground="{StaticResource WarnText}" TextWrapping="Wrap" />
+                    <StackPanel Orientation="Horizontal" Spacing="8">
+                      <Button Classes="danger" Content="CONFIRM" Command="{Binding Vaults.ConfirmActionCommand}"
+                              IsEnabled="{Binding !Vaults.IsBusy}" />
+                      <Button Classes="ghost" Content="CANCEL" Command="{Binding Vaults.CancelActionCommand}" />
+                    </StackPanel>
+                  </StackPanel>
+                </Border>
+
+                <StackPanel Spacing="8" IsVisible="{Binding Vaults.CanAdministerSelected}">
+                  <TextBlock Classes="label" Text="SET THE SELECTED MEMBER'S ROLE" />
+                  <StackPanel Orientation="Horizontal" Spacing="6">
+                    <Button Classes="flat choice" Content="VIEWER" Command="{Binding Vaults.ChangeRoleCommand}"
+                            CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}"
+                            IsEnabled="{Binding !Vaults.IsBusy}" />
+                    <Button Classes="flat choice" Content="MEMBER" Command="{Binding Vaults.ChangeRoleCommand}"
+                            CommandParameter="{x:Static contracts:TeamMemberRole.Member}"
+                            IsEnabled="{Binding !Vaults.IsBusy}" />
+                    <Button Classes="flat choice" Content="ADMIN" Command="{Binding Vaults.ChangeRoleCommand}"
+                            CommandParameter="{x:Static contracts:TeamMemberRole.Admin}"
+                            IsEnabled="{Binding !Vaults.IsBusy}" />
+                  </StackPanel>
+                  <StackPanel Orientation="Horizontal" Spacing="8">
+                    <Button Classes="ghost" Content="HAND OVER" Command="{Binding Vaults.HandOverCommand}"
+                            IsEnabled="{Binding !Vaults.IsBusy}" IsVisible="{Binding Vaults.OwnsSelected}"
+                            ToolTip.Tip="Hands this vault to the selected member. They become its owner and you become an admin; only the new owner can hand it on again." />
+                    <Button Classes="danger" Content="REMOVE" Command="{Binding Vaults.RemoveMemberCommand}"
+                            IsEnabled="{Binding !Vaults.IsBusy}"
+                            ToolTip.Tip="Removes the selected member and withdraws every key they hold to this vault. It blocks future reads only." />
+                  </StackPanel>
+                </StackPanel>
+
+                <StackPanel Spacing="8" IsVisible="{Binding Vaults.CanAdministerSelected}">
+                  <TextBlock Classes="settingssection" Text="INVITE" Margin="0" />
+                  <Grid ColumnDefinitions="*,140,44">
+                    <TextBox Grid.Column="0" PlaceholderText="colleague@example.com"
+                             Text="{Binding Vaults.NewMemberEmail}" Margin="0,0,8,0" />
+                    <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="4">
+                      <Button Classes="flat choice" Content="VIEWER"
+                              Classes.active="{Binding Vaults.AddsAsViewer}"
+                              Command="{Binding Vaults.ChooseNewMemberRoleCommand}"
+                              CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}" />
+                      <Button Classes="flat choice" Content="MEMBER"
+                              Classes.active="{Binding Vaults.AddsAsMember}"
+                              Command="{Binding Vaults.ChooseNewMemberRoleCommand}"
+                              CommandParameter="{x:Static contracts:TeamMemberRole.Member}" />
+                    </StackPanel>
+                    <Button Grid.Column="2" Classes="accent" Width="44" Content="+"
+                            Command="{Binding Vaults.AddMemberCommand}" IsEnabled="{Binding !Vaults.IsBusy}"
+                            Margin="8,0,0,0"
+                            ToolTip.Tip="Adds the account that signs in with this address. An address with no account here is refused and says so." />
+                  </Grid>
+                  <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                             Text="Adding somebody lets the server serve them this vault. It does not let them read it — that needs a vault key, which SHARE KEY below wraps for them." />
+                </StackPanel>
+
+              </StackPanel>
+
+              <StackPanel Spacing="8" IsVisible="{Binding Vaults.SelectedIsPersonal}">
+                <TextBlock Classes="settingssection" Text="YOURS ALONE" Margin="0" />
+                <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                           Text="Nobody can be added to your personal vault, and the server refuses a key grant on one outright. Make a vault for the things you want to share, and put them in it." />
+              </StackPanel>
+
+              <Border Height="1" Background="{StaticResource BorderSubtle}" />
+
+              <StackPanel Spacing="8">
+                <StackPanel Orientation="Horizontal" Spacing="8" IsVisible="{Binding Vaults.SelectedIsShared}">
+                  <Button Classes="accent" Content="SHARE KEY" Command="{Binding Vaults.ShareVaultCommand}"
+                          IsEnabled="{Binding !Vaults.IsBusy}"
+                          ToolTip.Tip="Wraps this vault's key to the selected member. Their published key is checked against the server's append-only key log first." />
+                  <Button Classes="danger" Content="WITHDRAW KEY" Command="{Binding Vaults.RevokeVaultCommand}"
+                          IsEnabled="{Binding !Vaults.IsBusy}"
+                          ToolTip.Tip="Withdraws the selected member's key to this vault. Blocks future reads only." />
+                </StackPanel>
+
+                <TextBlock Classes="settingssection" Text="KEY HOLDERS" Margin="0" />
+
+                <ListBox ItemsSource="{Binding Vaults.Grants}" Background="Transparent" BorderThickness="0"
+                         MaxHeight="120">
+                  <ListBox.ItemTemplate>
+                    <DataTemplate x:DataType="vm:VaultGrantRowViewModel">
+                      <Grid ColumnDefinitions="10,*" Margin="0,3">
+                        <Ellipse Grid.Column="0" Width="6" Height="6" VerticalAlignment="Center"
+                                 IsVisible="{Binding IsLive}" Fill="{StaticResource Live}" />
+                        <StackPanel Grid.Column="1" Spacing="2" Margin="6,0,0,0">
+                          <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
+                                     Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
+                          <TextBlock Classes="settingsrowcaption" FontSize="11" Text="{Binding State}" />
+                        </StackPanel>
+                      </Grid>
+                    </DataTemplate>
+                  </ListBox.ItemTemplate>
+                </ListBox>
+
+                <!--
+                  Load-bearing, from the old screen: there is no DELETE here for a reason, and the reason is
+                  not "not built yet". The membership list behind a shared vault cannot be archived while the
+                  vault exists — that is a different fact from the vault itself, which the card's own DELETE
+                  icon does remove.
+                -->
+                <TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
+                           Text="A vault's membership list cannot be deleted on its own — the server refuses to archive it while the vault it carries still exists. Deleting the vault itself is the card's own icon, outside this panel." />
+              </StackPanel>
+
+            </StackPanel>
+          </ScrollViewer>
+
+        </Grid>
+      </Border>
+    </Border>
+
+  </Panel>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsVaultsPage.axaml.cs

@@ -0,0 +1,29 @@
+using Avalonia.Controls;
+using Avalonia.Input;
+using DodoSSH.Client.Shell.ViewModels;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Vaults, restyled into the settings page idiom — see the remark at the top of the markup.</summary>
+internal sealed partial class SettingsVaultsPage : UserControl
+{
+    public SettingsVaultsPage() => InitializeComponent();
+
+    private MainWindowViewModel? Shell => DataContext as MainWindowViewModel;
+
+    /// <remarks>
+    /// Only a press on the wash itself, the same test <c>QuickConnect.OnBackdropPressed</c> makes: a press
+    /// inside the card bubbles through here too, with its source the control that was actually hit rather
+    /// than the backdrop, so closing on those would make the panel impossible to click into.
+    /// </remarks>
+    private void OnBackdropPressed(object? sender, PointerPressedEventArgs e)
+    {
+        if (!ReferenceEquals(e.Source, MembersBackdrop) || Shell is not { } shell)
+        {
+            return;
+        }
+
+        shell.Vaults.CloseMembersPanelCommand.Execute(null);
+        e.Handled = true;
+    }
+}

src/DodoSSH.Client.App/Views/SettingsView.axaml

@@ -0,0 +1,68 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.App.Views"
+             x:Class="DodoSSH.Client.App.Views.SettingsView"
+             x:DataType="vm:MainWindowViewModel">
+
+  <!--
+    v5c: the settings MODE — the full-window chrome swap the design calls Settings, built as one control so
+    MainWindow.axaml can show or hide the whole thing behind MainWindowViewModel.IsSettingsMode with a single
+    IsVisible, the same way it already does for the unlocked application and the setup half of the window.
+
+    Titlebar, then a row of the 340px SettingsNav beside whichever page ActiveSettingsPage names. Seven pages
+    now, all of the design's — v5c-2 added Groups and Tags and retired the old VaultsScreen; see
+    SettingsNav.axaml and design-notes/v5c-fidelity-notes.md.
+
+    Every page including Vaults is wrapped in the 1100px centred column now. SettingsVaultsPage replaces the
+    old VaultsScreen's own 268px-list-beside-a-full-bleed-pane layout with the design's card idiom — see that
+    page's own remark for what changed and why.
+
+    v5c-3: ImportScreen joined the Panel, drawn over SettingsPreferencesPage rather than beside it — see
+    MainWindowViewModel.IsImportOpen. SettingsNav stays lit on Preferences the whole time, per Import.dc.html,
+    because ActiveSettingsPage never actually leaves SettingsPage.Preferences; only IsImportOpen and the pair
+    of IsVisible bindings below move. Its data context is ImportScreen rather than this control's own, the
+    same split MainWindow.axaml drew before the importer moved in here.
+  -->
+
+  <Grid RowDefinitions="Auto,*" Background="{StaticResource Canvas}">
+
+    <views:SettingsTitleBar Grid.Row="0" />
+
+    <Grid Grid.Row="1" ColumnDefinitions="Auto,*">
+
+      <views:SettingsNav Grid.Column="0" />
+
+      <Panel Grid.Column="1">
+
+        <views:SettingsGeneralPage IsVisible="{Binding IsSettingsGeneralPage}" />
+
+        <views:SettingsVaultsPage IsVisible="{Binding IsSettingsVaultsPage}" />
+
+        <views:SettingsAccountPage IsVisible="{Binding IsSettingsAccountPage}" />
+
+        <views:SettingsSecurityPage IsVisible="{Binding IsSettingsSecurityPage}" />
+
+        <views:SettingsPreferencesPage IsVisible="{Binding IsSettingsPreferencesContentShowing}" />
+
+        <views:SettingsGroupsPage IsVisible="{Binding IsSettingsGroupsPage}" />
+
+        <views:SettingsTagsPage IsVisible="{Binding IsSettingsTagsPage}" />
+
+        <!--
+          Wrapped, like MainWindow.axaml wraps every screen whose data context is its own rather than this
+          control's: IsVisible has to resolve against the ambient MainWindowViewModel, and putting it on the
+          same element as the DataContext override below would have it resolve against ImportViewModel
+          instead, where IsImportOpen does not exist.
+        -->
+        <Panel IsVisible="{Binding IsImportOpen}">
+          <views:ImportScreen DataContext="{Binding ImportScreen}" />
+        </Panel>
+
+      </Panel>
+
+    </Grid>
+
+  </Grid>
+
+</UserControl>

src/DodoSSH.Client.App/Views/SettingsView.axaml.cs

@@ -0,0 +1,12 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>
+/// The settings mode's whole chrome: its own titlebar, its own 340px rail, and whichever of its five pages
+/// <see cref="DodoSSH.Client.Shell.ViewModels.MainWindowViewModel.ActiveSettingsPage"/> names.
+/// </summary>
+internal sealed partial class SettingsView : UserControl
+{
+    public SettingsView() => InitializeComponent();
+}

src/DodoSSH.Client.App/Views/StatusBar.axaml

@@ -25,6 +25,14 @@
     channel this application has for saying that a save failed, that a sync was refused, that a merge picked
     a winner. The design is a mock-up of a working afternoon and has nowhere for a sentence like that to go;
     dropping the bar would have meant dropping the sentence, or repeating it on six screens.
+
+    ── One line, several terminals ────────────────────────────────────────────────────────────────────────
+    One bar for a window that now holds any number of tabs, and connecting writes to it — so "Connected to
+    prod-db." outlived the tab it was about, and closing prod-db left that sentence sitting under whichever
+    terminal the user looked at next. A connection's own lines are now owned by the attempt that wrote them
+    and are cleared when its tab is closed; everything else the vault says stays, because closing a terminal
+    is not an answer to a failed save. See VaultViewModel.ForgetConnectionStatus and
+    MainWindowViewModel.CloseTabAsync.
   -->
 
   <Border Height="24" Background="{StaticResource Chrome}"

src/DodoSSH.Client.App/Views/TransfersScreen.axaml

@@ -177,16 +177,27 @@
           thing (go to the parent directory), and the pair reading differently is the design's own choice
           faithfully carried over rather than a functional difference invented to justify it.
         -->
+        <!--
+          ◆ THE PATH SITS IN THE STAR COLUMN, ALONE, AND THAT PLACEMENT IS LOAD-BEARING.
+
+          TextTrimming only acts when measure hands the block a finite width, and a horizontal StackPanel
+          never does — it measures every child at infinity, takes the full answer, and an Auto grid column
+          passes that on. With the path in a StackPanel beside the label, a directory deep enough — the
+          remote pane meets one on any real host, this pane on any machine whose profile path is long —
+          made the header wider than the pane and pushed the icon buttons past the window's own edge. The
+          layout suite caught it at the 472-pixel session budget, on the one machine whose home directory
+          was long enough to arm it. Star column: bounded width, working ellipsis, buttons that stay.
+        -->
         <Border Grid.Row="0" Padding="0,0,0,10" BorderThickness="0">
           <Grid ColumnDefinitions="Auto,*,Auto">
-            <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="12" VerticalAlignment="Center">
-              <TextBlock Classes="label" FontSize="10" Text="LOCAL" VerticalAlignment="Center" />
-              <TextBlock Classes="mono" FontSize="13.5" FontWeight="Medium"
-                         Foreground="{StaticResource TextDim}" VerticalAlignment="Center"
-                         Text="{Binding LocalPath}" TextTrimming="CharacterEllipsis"
-                         ToolTip.Tip="{Binding LocalPath}" />
-            </StackPanel>
-            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="4">
+            <TextBlock Grid.Column="0" Classes="label" FontSize="10" Text="LOCAL"
+                       VerticalAlignment="Center" Margin="0,0,12,0" />
+            <TextBlock Grid.Column="1" Classes="mono" FontSize="13.5" FontWeight="Medium"
+                       Foreground="{StaticResource TextDim}" VerticalAlignment="Center"
+                       HorizontalAlignment="Left"
+                       Text="{Binding LocalPath}" TextTrimming="CharacterEllipsis"
+                       ToolTip.Tip="{Binding LocalPath}" />
+            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="4" Margin="12,0,0,0">
               <!--
                 The drives, because the breadcrumb cannot reach them: above C:\ is a list rather than a
                 directory. Without this the pane is stuck on whichever drive the user profile is on. Chips
@@ -332,19 +343,26 @@
           UP is arrow_downward here, matching arrow_upward on the local pane above per the design's own two
           distinct glyphs; see that pane's own remark on why the pair differs without the actions differing.
         -->
+        <!--
+          The path is alone in the star column for the reason the local pane's header remark spells out:
+          TextTrimming needs the finite width only a star column gives it, and this is the pane where the
+          long path is not even unusual — it is any host with a deep directory tree.
+        -->
         <Border Grid.Row="0" Padding="0,0,0,10" BorderThickness="0">
           <Grid ColumnDefinitions="Auto,*,Auto">
-            <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="12" VerticalAlignment="Center">
+            <StackPanel Grid.Column="0" Orientation="Horizontal" Spacing="12" VerticalAlignment="Center"
+                        Margin="0,0,12,0">
               <TextBlock Classes="label" FontSize="10" Text="HOST" VerticalAlignment="Center"
                          IsVisible="{Binding ShowsHostPicker}" />
               <TextBlock Classes="label" FontSize="10" Text="BUCKET" VerticalAlignment="Center"
                          IsVisible="{Binding ShowsBucketPicker}" />
-              <TextBlock Classes="mono" FontSize="13.5" FontWeight="Medium"
-                         Foreground="{StaticResource TextDim}" VerticalAlignment="Center"
-                         Text="{Binding RemotePath}" TextTrimming="CharacterEllipsis"
-                         ToolTip.Tip="{Binding RemotePath}" />
             </StackPanel>
-            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="4">
+            <TextBlock Grid.Column="1" Classes="mono" FontSize="13.5" FontWeight="Medium"
+                       Foreground="{StaticResource TextDim}" VerticalAlignment="Center"
+                       HorizontalAlignment="Left"
+                       Text="{Binding RemotePath}" TextTrimming="CharacterEllipsis"
+                       ToolTip.Tip="{Binding RemotePath}" />
+            <StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="4" Margin="12,0,0,0">
               <Button Classes="paneicon" Command="{Binding RemoteUpCommand}"
                       IsEnabled="{Binding IsConnected}" ToolTip.Tip="Up one directory">
                 <TextBlock FontFamily="{StaticResource IconFont}" FontSize="16" Text="&#xE5DB;" />

src/DodoSSH.Client.App/Views/VaultsScreen.axaml

@@ -1,362 +0,0 @@
-<UserControl xmlns="https://github.com/avaloniaui"
-             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
-             xmlns:contracts="using:DodoSSH.Contracts"
-             x:Class="DodoSSH.Client.App.Views.VaultsScreen"
-             x:DataType="vm:VaultsViewModel">
-
-  <!--
-    Vaults, and the people in each of them.
-
-    ── THIS WAS THE TEAMS SCREEN, AND THE TEAM IS NOW BEHIND THE VAULT. ─────────────────────────────────
-    The left column used to list teams; a team owned vaults, and sharing meant creating a team, then a
-    vault in it, then wrapping a key. Two of those three steps were about a concept nobody came here for.
-    So the rows are vaults now: naming one makes the membership list that carries it, and everything on
-    the right — members, key holders — is that vault's. The server still authorises against
-    a team, because that is what VaultAccessService resolves; what went is the requirement that a person
-    know it exists. The one case where it is still visible is a membership list carrying several vaults,
-    which this screen cannot make and will not hide: see SharedMembershipWarning.
-
-    ── THE ONE FACT THE WHOLE SCREEN IS BUILT AROUND ────────────────────────────────────────────────────
-    Adding somebody to a vault and giving them its key are two different acts, and only the first is
-    something a server can do. The second needs a machine that holds the key, because this server never
-    does. So the members list and the key-holders list are both here and are not the same list, an
-    addition says out loud that it granted nothing readable yet, and SHARE KEY is its own button rather
-    than a checkbox on the member row.
-
-    What the design asked for and is still not here: two-factor state (no such concept exists anywhere in
-    this product) and avatars (no picture is stored anywhere). There is no INVITED list either, and that
-    one is a decision rather than a gap — an address is not a way into a vault, so only an account that
-    already exists can be added and there is nothing pending to draw. See the ADD box below, which says
-    what to do about somebody who has not signed in here yet. Last-active is recorded at most once per
-    account per hour, so it is drawn coarsely. Nor is there a way to delete a vault: the server has no
-    such call, and the screen says so rather than offering a button that refuses.
-  -->
-
-  <Grid ColumnDefinitions="268,*">
-
-    <!-- ============ The vault list ============ -->
-    <Border Grid.Column="0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,1,0">
-      <Grid RowDefinitions="44,*,Auto">
-
-        <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
-          <Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
-            <TextBlock Grid.Column="0" Classes="mono" Text="VAULTS" FontSize="12" FontWeight="SemiBold"
-                       LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center" />
-            <Button Grid.Column="1" Classes="ghost" Content="NEW"
-                    Command="{Binding NewVaultCommand}" IsEnabled="{Binding !IsBusy}"
-                    ToolTip.Tip="Makes a vault you can share. Its key is generated on this machine, and nobody else has it until you hand it out." />
-          </Grid>
-        </Border>
-
-        <ScrollViewer Grid.Row="1">
-          <StackPanel>
-            <!--
-              Read from this machine's own vault list rather than from the server, so the column is right
-              with no connection. What is missing offline is who is in each one, which is why a row can
-              say its membership is unknown rather than saying nothing at all.
-            -->
-            <ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
-                     Background="Transparent" BorderThickness="0">
-              <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:VaultRowViewModel">
-                  <StackPanel Spacing="2" Margin="0,3">
-                    <Grid ColumnDefinitions="*,Auto">
-                      <TextBlock Grid.Column="0" Text="{Binding Name}" FontSize="13" FontWeight="Medium"
-                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
-                      <TextBlock Grid.Column="1" Classes="mono" Text="{Binding RoleLabel}" FontSize="10"
-                                 Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
-                                 Margin="8,0,0,0" />
-                    </Grid>
-                    <TextBlock Classes="hint" FontSize="11" Text="{Binding Detail}" />
-                    <!--
-                      Only when there is something to say. A vault waiting for a key and one owing a rekey
-                      are both temporary and both need somebody to act; a permanent "fine" beside them
-                      would teach people to stop reading the line.
-                    -->
-                    <TextBlock Classes="hint" FontSize="10.5" Text="{Binding State}"
-                               TextWrapping="Wrap" IsVisible="{Binding HasState}" />
-                  </StackPanel>
-                </DataTemplate>
-              </ListBox.ItemTemplate>
-            </ListBox>
-
-            <TextBlock Classes="hint" FontSize="11" Margin="14,12" TextWrapping="Wrap"
-                       IsVisible="{Binding !HasVaults}"
-                       Text="No vaults yet. Unlock your keychain to see the personal one, or make a vault to share hosts and credentials with colleagues." />
-          </StackPanel>
-        </ScrollViewer>
-
-        <!--
-          The name-a-vault form, in place rather than in a modal: this window has no idiom for one. It is
-          in this column rather than beside the pane on the right for one reason — that pane is bound to
-          HasSelection, so with no vaults at all it is not on screen, and "no vaults at all" is exactly
-          the state somebody arrives in from the tab strip's New vault entry.
-
-          One field. The membership list behind it is made with it and named after it, and its slug is
-          derived — see VaultsViewModel.CreateVaultAsync. Asking for a URL handle would be asking for one
-          from somebody who has not been told they are making anything but a vault.
-        -->
-        <Border Grid.Row="2" Padding="14,12" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
-                IsVisible="{Binding IsCreatingVault}">
-          <StackPanel Spacing="8">
-            <TextBlock Classes="label" Text="NEW VAULT" />
-            <TextBox PlaceholderText="Name" Text="{Binding NewVaultName}" />
-            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                       Text="Its key is made on this machine and nobody else has it. Add people to it once it exists, then press SHARE KEY." />
-            <StackPanel Orientation="Horizontal" Spacing="6">
-              <Button Classes="accent" Content="CREATE" Command="{Binding CreateVaultCommand}"
-                      IsEnabled="{Binding !IsBusy}" />
-              <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelNewVaultCommand}" />
-            </StackPanel>
-          </StackPanel>
-        </Border>
-
-      </Grid>
-    </Border>
-
-    <!-- ============ The selected vault: who is in it, and who can open it ============ -->
-    <Grid Grid.Column="1" RowDefinitions="44,*,Auto">
-
-      <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
-        <Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
-          <TextBlock Grid.Column="0" Classes="mono" Text="{Binding SelectedVault.Name}" FontSize="12"
-                     FontWeight="SemiBold" LetterSpacing="1" Foreground="{StaticResource Text}"
-                     VerticalAlignment="Center" />
-
-          <!--
-            The vault's own operations. RENAME is an admin's; handing it on is the owner's alone, and
-            that is the line the server draws as well — an admin the owner promoted must not be able to
-            take the vault from them.
-
-            DELETE is an admin's too, and it is last and red because it is the only one of the three that
-            cannot be undone. It is absent on the personal vault rather than disabled: there is no version
-            of this window in which that vault can go, so a greyed button would be an offer that never
-            becomes real. Its question is the card below, as every destructive answer on this screen is.
-          -->
-          <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6"
-                      IsVisible="{Binding ShowsVaultActions}">
-            <Button Classes="ghost" Content="RENAME" Command="{Binding RenameVaultCommand}"
-                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}"
-                    ToolTip.Tip="Changes what this vault is called. The name is plaintext on the server, as it always was; nothing inside is re-encrypted." />
-            <Button Classes="ghost" Content="HAND OVER" Command="{Binding HandOverCommand}"
-                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding OwnsSelected}"
-                    ToolTip.Tip="Hands this vault to the selected member. They become its owner and you become an admin; only the new owner can hand it on again." />
-            <Button Classes="danger" Content="DELETE" Command="{Binding DeleteVaultCommand}"
-                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanDeleteSelected}"
-                    ToolTip.Tip="Deletes this vault and withdraws everybody's key to it. It cannot reach a machine that has already synced it." />
-          </StackPanel>
-        </Grid>
-      </Border>
-
-      <ScrollViewer Grid.Row="1" IsVisible="{Binding HasSelection}">
-        <StackPanel Margin="14,14" Spacing="18">
-
-          <!-- The rename form, in place, exactly as the create form on the left is. -->
-          <Border Padding="12" CornerRadius="4" BorderThickness="1"
-                  BorderBrush="{StaticResource Border}" IsVisible="{Binding IsRenamingVault}">
-            <StackPanel Spacing="8">
-              <TextBlock Classes="label" Text="RENAME VAULT" />
-              <TextBox PlaceholderText="Name" Text="{Binding EditVaultName}" />
-              <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                         Text="Everybody who shares this vault sees the new name. Nothing is re-encrypted and no key changes; the name has always been stored in plain text, because a person has to be able to pick a vault before anything is decrypted." />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="accent" Content="SAVE" Command="{Binding SaveVaultNameCommand}"
-                        IsEnabled="{Binding !IsBusy}" />
-                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelRenameVaultCommand}" />
-              </StackPanel>
-            </StackPanel>
-          </Border>
-
-          <!--
-            The armed confirmation, drawn where the buttons that armed it were. The keychain screen's
-            idiom, and for the same reason: there is no modal anywhere in this window.
-          -->
-          <Border Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
-                  BorderThickness="1" CornerRadius="4" Padding="12"
-                  IsVisible="{Binding IsConfirming}">
-            <StackPanel Spacing="8">
-              <TextBlock Text="{Binding PendingAction.Question}" FontSize="13" FontWeight="Medium"
-                         Foreground="{StaticResource Text}" TextWrapping="Wrap" />
-              <TextBlock Classes="hint" FontSize="11.5" TextWrapping="Wrap"
-                         Text="{Binding PendingAction.Consequence}" />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="danger" Content="CONFIRM" Command="{Binding ConfirmActionCommand}"
-                        IsEnabled="{Binding !IsBusy}" />
-                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelActionCommand}" />
-              </StackPanel>
-            </StackPanel>
-          </Border>
-
-          <!--
-            The personal vault, which is the one vault sharing cannot reach. Said here rather than by
-            drawing the members section empty: an empty MEMBERS heading over a vault that can never have
-            any reads as a feature that has not loaded.
-          -->
-          <StackPanel Spacing="8" IsVisible="{Binding SelectedIsPersonal}">
-            <TextBlock Classes="label" Text="YOURS ALONE" />
-            <TextBlock Classes="hint" FontSize="11.5" TextWrapping="Wrap"
-                       Text="Nobody can be added to your personal vault, and the server refuses a key grant on one outright — a key wrapped to somebody it will go on refusing to serve would look like sharing and would not be. Make a vault above for the things you want to share, and put them in it." />
-          </StackPanel>
-
-          <!-- Members -->
-
-          <StackPanel Spacing="8" IsVisible="{Binding SelectedIsShared}">
-            <TextBlock Classes="label" Text="MEMBERS" />
-
-            <!--
-              Only ever non-empty for a membership list this screen did not make. Adding somebody to one
-              vault and silently adding them to three others is precisely the fact a vault-shaped screen
-              is in a position to hide, so it says it instead.
-            -->
-            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                       IsVisible="{Binding HasSharedMembershipWarning}"
-                       Text="{Binding SharedMembershipWarning}" />
-
-            <ListBox ItemsSource="{Binding Members}" SelectedItem="{Binding SelectedMember}"
-                     Background="Transparent" BorderThickness="0" MaxHeight="240">
-              <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:VaultMemberRowViewModel">
-                  <Grid ColumnDefinitions="*,168,Auto" Margin="0,3">
-                    <StackPanel Grid.Column="0" Spacing="2">
-                      <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
-                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
-                      <TextBlock Classes="hint" FontSize="11" Text="{Binding Email}" />
-                    </StackPanel>
-                    <StackPanel Grid.Column="1" Spacing="2" VerticalAlignment="Center">
-                      <TextBlock Classes="hint" FontSize="11" Text="{Binding KeyState}"
-                                 TextWrapping="Wrap" />
-                      <TextBlock Classes="hint" FontSize="10.5" Text="{Binding LastActive}" />
-                    </StackPanel>
-                    <TextBlock Grid.Column="2" Classes="mono" Text="{Binding Role}" FontSize="10"
-                               Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
-                               Margin="10,0,0,0" />
-                  </Grid>
-                </DataTemplate>
-              </ListBox.ItemTemplate>
-            </ListBox>
-
-            <!--
-              Buttons and a command rather than a selector bound to the role, which is the choice the
-              key editor and the category rail already make and for the reason they record: a selector
-              moves its own highlight before anything can refuse, so it can end up showing a role
-              nobody was given. OWNER is absent because it is not a role that can be assigned —
-              handing the vault over is its own act, with its own confirmation.
-            -->
-            <StackPanel Spacing="6" IsVisible="{Binding CanAdministerSelected}">
-              <TextBlock Classes="label" Text="SET THE SELECTED MEMBER'S ROLE" />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="flat choice" Content="VIEWER" Command="{Binding ChangeRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}"
-                        IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May pull this vault and may not push. It does not withdraw a key they already hold." />
-                <Button Classes="flat choice" Content="MEMBER" Command="{Binding ChangeRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Member}"
-                        IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May read and change what is in this vault." />
-                <Button Classes="flat choice" Content="ADMIN" Command="{Binding ChangeRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Admin}"
-                        IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May also add and remove people, rename the vault, and share its key." />
-              </StackPanel>
-            </StackPanel>
-
-            <Grid ColumnDefinitions="*,Auto,Auto" IsVisible="{Binding CanAdministerSelected}">
-              <TextBox Grid.Column="0" PlaceholderText="colleague@example.com"
-                       Text="{Binding NewMemberEmail}" Margin="0,0,6,0" />
-              <Button Grid.Column="1" Classes="accent" Content="ADD"
-                      Command="{Binding AddMemberCommand}" IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Adds the account that signs in with this address. An address with no account here is refused and says so — ask them to sign in to this server once, which is what creates the account, and then add them." />
-              <Button Grid.Column="2" Classes="danger" Content="REMOVE" Margin="6,0,0,0"
-                      Command="{Binding RemoveMemberCommand}" IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Removes the selected member and withdraws every key they hold to this vault. It blocks future reads only — anything already on their machine stays there, so rotate the credentials that matter." />
-            </Grid>
-
-            <StackPanel Spacing="4" IsVisible="{Binding CanAdministerSelected}">
-              <TextBlock Classes="label" Text="THEY ARRIVE AS" />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="flat choice" Content="VIEWER" Classes.active="{Binding AddsAsViewer}"
-                        Command="{Binding ChooseNewMemberRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}" />
-                <Button Classes="flat choice" Content="MEMBER" Classes.active="{Binding AddsAsMember}"
-                        Command="{Binding ChooseNewMemberRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Member}" />
-                <Button Classes="flat choice" Content="ADMIN" Classes.active="{Binding AddsAsAdmin}"
-                        Command="{Binding ChooseNewMemberRoleCommand}"
-                        CommandParameter="{x:Static contracts:TeamMemberRole.Admin}" />
-              </StackPanel>
-            </StackPanel>
-
-            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                       IsVisible="{Binding CanAdministerSelected}"
-                       Text="Adding somebody lets the server serve them this vault. It does not let them read it: a vault key can only be wrapped by a machine that already holds it, which is what SHARE KEY below does." />
-          </StackPanel>
-
-          <Border Height="1" Background="{StaticResource BorderSubtle}" />
-
-          <!-- Who holds the key -->
-
-          <StackPanel Spacing="8">
-            <StackPanel Orientation="Horizontal" Spacing="6" IsVisible="{Binding SelectedIsShared}">
-              <Button Classes="accent" Content="SHARE KEY" Command="{Binding ShareVaultCommand}"
-                      IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Wraps this vault's key to the selected member. Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged." />
-              <Button Classes="danger" Content="WITHDRAW KEY" Command="{Binding RevokeVaultCommand}"
-                      IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Withdraws the selected member's key to this vault. Blocks future reads only." />
-            </StackPanel>
-
-            <!--
-              Who can open this vault — the design's "shared with" avatars, as names and a state.
-              Withdrawn and stale grants stay listed and say which they are, because a list that quietly
-              dropped them would show a departed colleague as merely absent rather than as somebody whose
-              key was taken away. The dot is Live and means exactly what it says: this person can open
-              this vault right now.
-            -->
-            <TextBlock Classes="label" Text="KEY HOLDERS" />
-
-            <ListBox ItemsSource="{Binding Grants}" Background="Transparent" BorderThickness="0"
-                     MaxHeight="150">
-              <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:VaultGrantRowViewModel">
-                  <Grid ColumnDefinitions="10,*" Margin="0,3">
-                    <Ellipse Grid.Column="0" Width="6" Height="6" VerticalAlignment="Center"
-                             IsVisible="{Binding IsLive}" Fill="{StaticResource Live}" />
-                    <StackPanel Grid.Column="1" Spacing="2" Margin="6,0,0,0">
-                      <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
-                                 Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
-                      <TextBlock Classes="hint" FontSize="11" Text="{Binding State}" />
-                    </StackPanel>
-                  </Grid>
-                </DataTemplate>
-              </ListBox.ItemTemplate>
-            </ListBox>
-
-            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                       IsVisible="{Binding SelectedIsShared}"
-                       Text="Sharing verifies the recipient's key against the key log, which proves this server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
-
-            <!--
-              Said once, where somebody would otherwise go looking for a DELETE button. There is no call
-              for it anywhere in the server, and archiving the membership list behind a vault is refused
-              while the vault exists — so a button here would be one that always refuses.
-            -->
-            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                       Text="A vault cannot be deleted. Nothing in this product removes one, and the server refuses to archive the membership list behind it while it still exists." />
-          </StackPanel>
-
-        </StackPanel>
-      </ScrollViewer>
-
-      <TextBlock Grid.Row="1" Classes="hint" FontSize="12" Margin="20" TextWrapping="Wrap"
-                 VerticalAlignment="Top" IsVisible="{Binding !HasSelection}"
-                 Text="Make a vault on the left, or wait for somebody to add you to one. A vault holds hosts and credentials that a group of people share; its key is what makes those readable, and that key is handed out by people rather than by the server." />
-
-      <Border Grid.Row="2" Padding="14,10" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
-              IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">
-        <TextBlock Classes="hint" FontSize="11.5" Text="{Binding Status}" TextWrapping="Wrap" />
-      </Border>
-
-    </Grid>
-  </Grid>
-</UserControl>

src/DodoSSH.Client.App/Views/VaultsScreen.axaml.cs

@@ -1,9 +0,0 @@
-using Avalonia.Controls;
-
-namespace DodoSSH.Client.App.Views;
-
-/// <summary>Vaults: which there are, who is in each, and who holds a key to it.</summary>
-internal sealed partial class VaultsScreen : UserControl
-{
-    public VaultsScreen() => InitializeComponent();
-}

src/DodoSSH.Client.Shell/ViewModels/ImportViewModel.cs

@@ -1,4 +1,5 @@
 using System.Collections.ObjectModel;
+using System.Globalization;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using DodoSSH.Client.Domain;
@@ -54,6 +55,16 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 
     internal string Address => host.Address;
 
+    /// <summary>What <c>HostName</c> said, on its own — the v5c table's own column, beside <see cref="User"/>
+    /// and <see cref="Port"/> rather than folded into <see cref="Address"/>.</summary>
+    internal string Hostname => host.Hostname;
+
+    /// <summary>What <c>User</c> said, or an em dash where the entry named none.</summary>
+    internal string User => host.Username is { Length: > 0 } user ? user : "—";
+
+    /// <summary>What <c>Port</c> said, defaulting to 22 the same way <see cref="ImportedHost"/> does.</summary>
+    internal string Port => host.Port.ToString(CultureInfo.InvariantCulture);
+
     /// <summary>Whether a host with this address is already in the keychain.</summary>
     internal bool AlreadyPresent { get; }
 
@@ -61,6 +72,23 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 
     internal bool HasBadge => AlreadyPresent;
 
+    /// <summary>
+    /// What the v5c table's WHAT THIS MEANS chip says, mapped honestly off the two facts this row actually
+    /// carries — nothing this screen cannot back up. Skipped patterns (a wildcard <c>Host</c> block) never
+    /// become a row at all, so there is no third, "skipped" state to draw here; a row's own per-host
+    /// warnings, from <see cref="HasWarnings"/>, are the amber case instead — a flattened <c>ProxyJump</c> or
+    /// a dropped directive is exactly the kind of thing "quieter than the file" that <c>ImportScreen.axaml</c>'s
+    /// own remark says has to be told before it looks like data loss.
+    /// </summary>
+    internal string Meaning => HasWarnings ? Warnings : AlreadyPresent ? "already here" : "new host";
+
+    /// <summary>The warned case wins over "already here" — a warning is the more actionable of the two facts.</summary>
+    internal bool IsMeaningWarned => HasWarnings;
+
+    internal bool IsMeaningExisting => !HasWarnings && AlreadyPresent;
+
+    internal bool IsMeaningNew => !HasWarnings && !AlreadyPresent;
+
     /// <summary>Whether this row's <c>ssh_config</c> entry named a key at all.</summary>
     /// <remarks>
     /// Most do not, and the tick above the list is about the ones that do. Kept as a property rather than
@@ -138,7 +166,10 @@ internal sealed partial class ImportRowViewModel : ObservableObject
 /// <see cref="KeyReport"/>.
 /// </para>
 /// </remarks>
-internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLocator locator) : ObservableObject
+internal sealed partial class ImportViewModel(
+    VaultViewModel vault,
+    SshConfigLocator locator,
+    Action? onCancel = null) : ObservableObject
 {
     internal ObservableCollection<ImportRowViewModel> Rows { get; } = [];
 
@@ -202,6 +233,66 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
 
     internal string ImportLabel => SelectedCount == 1 ? "IMPORT 1 HOST" : $"IMPORT {SelectedCount} HOSTS";
 
+    /// <summary>Whether every row is ticked — what the v5c table's header tick-all box shows.</summary>
+    internal bool AllTicked => Rows.Count > 0 && SelectedCount == Rows.Count;
+
+    /// <summary>
+    /// The v5c header's own mono status line: the file this reads, and whether it has been read yet.
+    /// </summary>
+    /// <remarks>
+    /// Two real facts and nothing invented — <see cref="ConfigPath"/> and <see cref="HasScanned"/>. The
+    /// fuller narrative belongs to <see cref="Status"/>, which this does not replace: what happened on a scan
+    /// or an import is a sentence, not a fact this header line has room to state honestly in a handful of
+    /// words.
+    /// </remarks>
+    internal string HeaderStatus => HasScanned ? $"{ConfigPath} · scanned" : $"{ConfigPath} · not scanned yet";
+
+    /// <summary>
+    /// The key-material card's own always-visible sentence, ahead of the tick.
+    /// </summary>
+    /// <remarks>
+    /// The count is hosts naming a key file, not raw <c>IdentityFile</c> lines — a fact <see cref="Rows"/>
+    /// actually carries, where a literal line count would not survive a host that names more than one and is
+    /// only ever bound to the first. The rest of the sentence is <c>ImportViewModel</c>'s own long-standing
+    /// claim, restated in the design's words after checking it against <c>SshConfigLocator</c>: this type is
+    /// the only place in the application that reads a private key out of a directory nobody pointed at file
+    /// by file, and <see cref="ImportAsync"/> is the only place that ever calls
+    /// <see cref="SshConfigLocator.ReadIdentity"/> — never <see cref="ScanAsync"/> — so nothing is read until
+    /// IMPORT is pressed.
+    /// </remarks>
+    internal string KeyMaterialIntro
+    {
+        get
+        {
+            var count = Rows.Count(row => row.HasKeyFile);
+            var directory = Path.GetDirectoryName(ConfigPath) ?? ConfigPath;
+            var noun = count == 1 ? "host names" : "hosts name";
+
+            return $"The scan found {count} {noun} a key file in {directory}. This is the only control in "
+                + "DodoSSH that opens key material from a directory you did not point at file by file — "
+                + "nothing is read until Import is pressed.";
+        }
+    }
+
+    /// <summary>The vault every import lands in — see <see cref="VaultViewModel.ImportHostsAsync"/>.</summary>
+    /// <remarks>
+    /// Fixed rather than offered as a picker: the import goes through the same
+    /// <c>session.ActiveVaultId</c> every other bulk write does, and there is no per-import target choice to
+    /// bind — see design-notes/v5c-fidelity-notes.md. Printed as a fact instead of drawn as a dropdown.
+    /// </remarks>
+    internal string VaultName => vault.VaultName;
+
+    /// <summary>The v5c footer's own sentence: how many are ticked, out of how many, and where they land.</summary>
+    internal string SelectionSummary
+    {
+        get
+        {
+            var noun = Rows.Count == 1 ? "entry" : "entries";
+
+            return $"{SelectedCount} of {Rows.Count} {noun} selected · saving to {VaultName}";
+        }
+    }
+
     /// <summary>Reads the file and shows what it found. Writes nothing.</summary>
     [RelayCommand]
     private async Task ScanAsync(CancellationToken cancellationToken)
@@ -389,6 +480,16 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
 
     internal void NoteSelectionChanged() => RaiseListState();
 
+    /// <summary>The footer's own Cancel button: back to the Preferences page, nothing stored.</summary>
+    /// <remarks>
+    /// A delegate rather than a reference up to <c>MainWindowViewModel</c>, on the same reasoning
+    /// <c>VaultViewModel</c>'s own <c>copyToClipboard</c> is one: this type has no business knowing settings
+    /// mode exists, and a null delegate — nothing wired, as in a layout test that builds this directly — makes
+    /// the button a no-op rather than a crash.
+    /// </remarks>
+    [RelayCommand]
+    private void Cancel() => onCancel?.Invoke();
+
     /// <remarks>
     /// The rows carry the answer as well as the view model, because each one says what it will authenticate
     /// with and that sentence changes with the tick. Pushed rather than bound per row: a row cannot see a
@@ -441,5 +542,11 @@ internal sealed partial class ImportViewModel(VaultViewModel vault, SshConfigLoc
         OnPropertyChanged(nameof(HasKeyReport));
         OnPropertyChanged(nameof(SelectedCount));
         OnPropertyChanged(nameof(ImportLabel));
+        OnPropertyChanged(nameof(AllTicked));
+        OnPropertyChanged(nameof(KeyMaterialIntro));
+        OnPropertyChanged(nameof(SelectionSummary));
     }
+
+    /// <remarks>The header's own status line is a function of <see cref="HasScanned"/> alone.</remarks>
+    partial void OnHasScannedChanged(bool value) => OnPropertyChanged(nameof(HeaderStatus));
 }

src/DodoSSH.Client.Shell/ViewModels/KnownHostsViewModel.cs

@@ -106,10 +106,19 @@ internal sealed class KnownHostRowViewModel(
 internal sealed partial class KnownHostsViewModel : ObservableObject
 {
     private readonly VaultViewModel vault;
+    private readonly Action? onBack;
 
-    internal KnownHostsViewModel(VaultViewModel vault)
+    /// <param name="vault">Where the pins, the reload and the withdrawal all actually live.</param>
+    /// <param name="onBack">
+    /// What the v5c header's own back arrow does — a delegate rather than a reference up to
+    /// <c>MainWindowViewModel</c>, on the same reasoning <c>ImportViewModel</c>'s own <c>onCancel</c> is one:
+    /// this type has no business knowing <c>ShellScreen</c> exists. Null in a layout test that builds this
+    /// directly makes the button a no-op rather than a crash.
+    /// </param>
+    internal KnownHostsViewModel(VaultViewModel vault, Action? onBack = null)
     {
         this.vault = vault;
+        this.onBack = onBack;
 
         // The vault rebuilds this list on every reload and every sync pass, and a screen showing a stale
         // copy of a trust decision is the one kind of staleness that matters here.
@@ -155,6 +164,14 @@ internal sealed partial class KnownHostsViewModel : ObservableObject
 
     internal bool HasPins => Shown.Any();
 
+    /// <summary>
+    /// How many approved host keys this machine can see, before the filter box narrows the table — the v5c
+    /// header's own count chip. Unfiltered, on the same reasoning <see cref="Summary"/> reads off
+    /// <see cref="Shown"/> rather than <see cref="VisiblePins"/>: it is a fact about the list, not about
+    /// whatever somebody last typed into the filter.
+    /// </summary>
+    internal int Count => Shown.Count();
+
     internal bool HasVisiblePins => VisiblePins.Count > 0;
 
     internal bool HasSelection => Selected is not null;
@@ -218,6 +235,22 @@ internal sealed partial class KnownHostsViewModel : ObservableObject
         await vault.ForgetPinCommand.ExecuteAsync(null).ConfigureAwait(true);
     }
 
+    /// <summary>Puts the selected pin's fingerprint on the clipboard. Forwarded, like <see cref="ForgetSelectedAsync"/>.</summary>
+    [RelayCommand]
+    private async Task CopyFingerprintAsync()
+    {
+        if (Selected is null)
+        {
+            return;
+        }
+
+        await vault.CopyPinFingerprintCommand.ExecuteAsync(null).ConfigureAwait(true);
+    }
+
+    /// <summary>The header's own back arrow: to the Keychain screen this list was pulled out of.</summary>
+    [RelayCommand]
+    private void Back() => onBack?.Invoke();
+
     internal void Detach() => vault.KnownHostPins.CollectionChanged -= OnPinsChanged;
 
     partial void OnFilterChanged(string value) => Rebuild();
@@ -247,6 +280,7 @@ internal sealed partial class KnownHostsViewModel : ObservableObject
         Selected = VisiblePins.FirstOrDefault(pin => pin.EntityId == selectedId);
 
         OnPropertyChanged(nameof(HasPins));
+        OnPropertyChanged(nameof(Count));
         OnPropertyChanged(nameof(HasVisiblePins));
         OnPropertyChanged(nameof(Summary));
         OnPropertyChanged(nameof(EmptyMessage));

src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs

@@ -206,6 +206,54 @@ internal enum ShellSurface
     Terminal = 1,
 }
 
+/// <summary>
+/// Which page the settings mode is showing, while <see cref="MainWindowViewModel.ActiveSettingsPage"/> is
+/// not null.
+/// </summary>
+/// <remarks>
+/// <para>
+/// v5c: the design's Settings area is a full-window mode that replaces the titlebar, the rail and the page
+/// area with its own — see <c>SettingsView.axaml</c> and the settings-mode remark on
+/// <see cref="MainWindowViewModel.ActiveSettingsPage"/>. This is a second, orthogonal notion of "where am I"
+/// from <see cref="ShellScreen"/>, not a replacement for it: <see cref="Preferences"/> and <see cref="Vaults"/>
+/// still set <see cref="MainWindowViewModel.Screen"/> to the matching <see cref="ShellScreen"/> member, so
+/// every existing binding and test that asks "is the screen Preferences" keeps its answer. <see cref="General"/>,
+/// <see cref="Account"/> and <see cref="Security"/> have no <see cref="ShellScreen"/> counterpart — nothing
+/// outside settings mode ever asked "which one of these three am I on" before this wave existed.
+/// </para>
+/// <para>
+/// <b>v5c-2: Groups and Tags joined.</b> The design's rail lists them beside Security and Preferences; v5c-1
+/// omitted both from <c>SettingsView.axaml</c> rather than building a placeholder for either, and this wave
+/// is the page each was waiting on — see design-notes/v5c-fidelity-notes.md. Neither has a
+/// <see cref="ShellScreen"/> counterpart: managing groups and tags has never been its own screen before this,
+/// only a panel inside the hosts board and the keychain screen respectively, so there is no existing binding
+/// for either to keep in step with.
+/// </para>
+/// </remarks>
+internal enum SettingsPage
+{
+    /// <summary>Updates, and the refused items from the design's General page, as an essay.</summary>
+    General = 0,
+
+    /// <summary>The vaults themselves and the people in them — the existing <see cref="ShellScreen.Vaults"/> screen.</summary>
+    Vaults = 1,
+
+    /// <summary>The signed-in profile, the sign-in fact, and signing out of this machine.</summary>
+    Account = 2,
+
+    /// <summary>The end-to-end explainer, Windows Hello, and approved host keys.</summary>
+    Security = 3,
+
+    /// <summary>This machine's terminal and keychain settings — the existing <see cref="ShellScreen.Preferences"/> screen.</summary>
+    Preferences = 4,
+
+    /// <summary>Every group, and the hosts filed under each — the existing group commands, given their own page.</summary>
+    Groups = 5,
+
+    /// <summary>Every tag, and how many hosts wear each — the existing tag commands, given their own page.</summary>
+    Tags = 6,
+}
+
 /// <summary>
 /// The shell: get to an unlocked vault, then hand over to <see cref="VaultViewModel"/>.
 /// </summary>
@@ -368,6 +416,20 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
     private bool disposed;
 
+    /// <summary>
+    /// Where <see cref="LeaveSettings"/> goes back to — captured once, on the turn settings mode is
+    /// entered, and not touched again until it is left.
+    /// </summary>
+    /// <remarks>
+    /// Not re-captured on every <see cref="EnterSettings"/> call, which is what makes switching pages inside
+    /// settings mode (Preferences, then Security, then Account) still come back to the one screen the user
+    /// was actually on beforehand rather than to whichever settings page they last visited.
+    /// </remarks>
+    private ShellScreen settingsReturnScreen;
+
+    /// <inheritdoc cref="settingsReturnScreen" />
+    private ShellSurface settingsReturnSurface;
+
     /// <summary>
     /// Establishes a connection to a server.
     /// </summary>
@@ -463,6 +525,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // list. Detached in DisposeAsync, which is the only point either of them ends.
         this.workspace.SessionEnded += OnWorkspaceSessionEnded;
         this.workspace.FontSizeStepRequested += OnFontSizeStepRequested;
+        this.workspace.RendererReattached += OnRendererReattached;
 
         settings = new ClientSettingsStore(paths);
 
@@ -573,6 +636,31 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     private void OnFontSizeStepRequested(object? sender, TerminalFontSizeStepEventArgs e) =>
         Dispatcher.UIThread.Post(() => StepTerminalFontSize(e.Step));
 
+    /// <remarks>
+    /// <para>
+    /// Marshalled for the same reason as <see cref="OnFontSizeStepRequested"/>: this arrives on the data
+    /// plane's socket-accept thread, and both properties it reads here — <see cref="TerminalFontSize"/> and
+    /// <see cref="SelectedTab"/> — are bound to by the interface.
+    /// </para>
+    /// <para>
+    /// <see cref="TerminalWorkspace.RendererReattached"/> fires once the workspace has replayed what it
+    /// owns — the live sessions. Font size and the choice of active tab are not the workspace's to know;
+    /// they live here, so this is the other half of putting a reattached page back the way it was. The size
+    /// is sent exactly as <see cref="TellRendererTheFontSizeAsync"/> sends it at startup, because nothing
+    /// has changed — the page has merely forgotten, and this is only a reminder.
+    /// </para>
+    /// </remarks>
+    private void OnRendererReattached(object? sender, EventArgs e) =>
+        Dispatcher.UIThread.Post(() =>
+        {
+            _ = workspace.SetFontSizeAsync(TerminalFontSize, CancellationToken.None).AsTask();
+
+            if (SelectedTab is { } tab)
+            {
+                _ = workspace.ActivateSessionAsync(tab.SessionId, CancellationToken.None).AsTask();
+            }
+        });
+
     [ObservableProperty]
     private ShellState state = ShellState.Starting;
 
@@ -660,6 +748,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     [ObservableProperty]
     private string? email;
 
+    /// <summary>
+    /// The OIDC issuer this account signs in through, when this machine has one cached — for the Account
+    /// settings page's SIGN-IN row.
+    /// </summary>
+    /// <remarks>
+    /// v5c: <c>MeResponse.Issuer</c> was already being cached into <c>StoredUnlockMaterial.Issuer</c> by
+    /// <see cref="AccountProvisioner"/>, for no reader — nothing before this wave surfaced it. Set from the
+    /// same two places <see cref="AccountName"/> and <see cref="Email"/> are, in <see cref="AdoptIdentity"/>,
+    /// so the three can never drift out of step with which account is actually signed in.
+    /// </remarks>
+    [ObservableProperty]
+    private string? issuer;
+
     /// <summary>Two letters for the rail's avatar circle, read off the signed-in display name.</summary>
     /// <remarks>
     /// The first letter of the first two words in <see cref="AccountName"/> — which is already
@@ -700,10 +801,11 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// kept them from drifting apart the day one of the two calls gained <see cref="Email"/> and the other
     /// did not.
     /// </remarks>
-    private void AdoptIdentity(string? displayName, string? emailAddress, string subject)
+    private void AdoptIdentity(string? displayName, string? emailAddress, string subject, string? issuer = null)
     {
         AccountName = displayName ?? emailAddress ?? subject;
         Email = emailAddress;
+        Issuer = issuer;
     }
 
     [ObservableProperty]
@@ -980,9 +1082,6 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// <inheritdoc cref="IsHostsScreen" />
     internal bool IsKnownHostsScreen => Screen is ShellScreen.KnownHosts;
 
-    /// <inheritdoc cref="IsHostsScreen" />
-    internal bool IsImportScreen => Screen is ShellScreen.Import;
-
     /// <inheritdoc cref="IsHostsScreen" />
     internal bool IsSnippetsScreen => Screen is ShellScreen.Snippets;
 
@@ -1186,10 +1285,175 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     [RelayCommand]
     private void ShowScreen(ShellScreen target)
     {
+        // v5c: Preferences and Vaults are settings pages now, and everywhere that used to navigate to either
+        // of them — the rail's own popover, the phone's hub, a test calling this command by hand — is meant
+        // to land in settings mode rather than on the bare screen the design retired. Redirecting here,
+        // rather than at every caller, is what makes that true without hunting down every existing call.
+        if (target is ShellScreen.Preferences)
+        {
+            EnterSettings(SettingsPage.Preferences);
+            return;
+        }
+
+        if (target is ShellScreen.Vaults)
+        {
+            EnterSettings(SettingsPage.Vaults);
+            return;
+        }
+
+        // v5c: Import sits inside the settings chrome too, per Import.dc.html — SettingsNav stays lit on
+        // Preferences, and what changes underneath it is the content column and the titlebar's own back
+        // label, both driven by IsImportOpen rather than by a SettingsPage of its own. See OpenImport.
+        if (target is ShellScreen.Import)
+        {
+            OpenImport();
+            return;
+        }
+
+        // Any other screen leaves settings mode outright rather than restoring whatever was remembered on
+        // the way in — the caller named a destination, and that destination wins over "go back".
+        ActiveSettingsPage = null;
         Screen = target;
         Surface = ShellSurface.Page;
     }
 
+    /// <summary>
+    /// The full-window settings mode: its own titlebar, its own 340px rail, and a centred content column —
+    /// see <c>SettingsView.axaml</c>. Not null exactly while that chrome, rather than the ordinary titlebar
+    /// and nav rail, is what <c>MainWindow.axaml</c> draws.
+    /// </summary>
+    /// <remarks>
+    /// A second notion of "where am I" from <see cref="Screen"/> rather than a replacement for it — see the
+    /// remark on <see cref="SettingsPage"/>. Two of its five members, <see cref="SettingsPage.Preferences"/>
+    /// and <see cref="SettingsPage.Vaults"/>, keep <see cref="Screen"/> in step with the matching
+    /// <see cref="ShellScreen"/> member so every binding and test written against that screen before this
+    /// mode existed keeps working; the other three have nothing to keep in step with.
+    /// </remarks>
+    [ObservableProperty]
+    private SettingsPage? activeSettingsPage;
+
+    /// <summary>Whether the settings chrome, rather than the ordinary one, is what the window is drawing.</summary>
+    internal bool IsSettingsMode => ActiveSettingsPage is not null;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsGeneralPage => ActiveSettingsPage is SettingsPage.General;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsVaultsPage => ActiveSettingsPage is SettingsPage.Vaults;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsAccountPage => ActiveSettingsPage is SettingsPage.Account;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsSecurityPage => ActiveSettingsPage is SettingsPage.Security;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsPreferencesPage => ActiveSettingsPage is SettingsPage.Preferences;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsGroupsPage => ActiveSettingsPage is SettingsPage.Groups;
+
+    /// <inheritdoc cref="IsSettingsMode" />
+    internal bool IsSettingsTagsPage => ActiveSettingsPage is SettingsPage.Tags;
+
+    /// <summary>
+    /// Whether the importer is showing over the Preferences page, inside settings mode.
+    /// </summary>
+    /// <remarks>
+    /// A flag layered on top of <see cref="ActiveSettingsPage"/> rather than a <see cref="SettingsPage"/>
+    /// member of its own — Import.dc.html draws <c>SettingsNav</c> lit on Preferences the whole time the
+    /// importer is up, which this makes true for free: <see cref="ActiveSettingsPage"/> never leaves
+    /// <see cref="SettingsPage.Preferences"/>, so <see cref="IsSettingsPreferencesPage"/> and the nav row it
+    /// drives stay exactly as they were. What moves is only the content column, via
+    /// <see cref="IsSettingsPreferencesContentShowing"/>, and the titlebar's own back label — see
+    /// <c>SettingsTitleBar.axaml</c>.
+    /// </remarks>
+    [ObservableProperty]
+    private bool isImportOpen;
+
+    /// <summary>
+    /// Whether the Preferences page itself, rather than the importer drawn over it, is what settings mode's
+    /// content column shows.
+    /// </summary>
+    internal bool IsSettingsPreferencesContentShowing => IsSettingsPreferencesPage && !IsImportOpen;
+
+    partial void OnActiveSettingsPageChanged(SettingsPage? value)
+    {
+        OnPropertyChanged(nameof(IsSettingsMode));
+        OnPropertyChanged(nameof(IsSettingsGeneralPage));
+        OnPropertyChanged(nameof(IsSettingsVaultsPage));
+        OnPropertyChanged(nameof(IsSettingsAccountPage));
+        OnPropertyChanged(nameof(IsSettingsSecurityPage));
+        OnPropertyChanged(nameof(IsSettingsPreferencesPage));
+        OnPropertyChanged(nameof(IsSettingsGroupsPage));
+        OnPropertyChanged(nameof(IsSettingsTagsPage));
+        OnPropertyChanged(nameof(IsSettingsPreferencesContentShowing));
+    }
+
+    partial void OnIsImportOpenChanged(bool value) =>
+        OnPropertyChanged(nameof(IsSettingsPreferencesContentShowing));
+
+    /// <summary>Enters settings mode on a page, remembering where "Back to application" returns to.</summary>
+    /// <remarks>
+    /// The return screen is captured only on the way in from outside settings mode — see
+    /// <see cref="settingsReturnScreen"/> — so switching between settings pages, which calls this
+    /// repeatedly, cannot overwrite it with another settings page.
+    /// <para>
+    /// v5c: also closes the importer, on the same reasoning. Naming a page — including Preferences again — is
+    /// a request for that page, not for whatever was drawn over it the last time settings mode was up.
+    /// </para>
+    /// </remarks>
+    [RelayCommand]
+    private void EnterSettings(SettingsPage page)
+    {
+        if (ActiveSettingsPage is null)
+        {
+            settingsReturnScreen = Screen;
+            settingsReturnSurface = Surface;
+        }
+
+        ActiveSettingsPage = page;
+        IsImportOpen = false;
+
+        Screen = page switch
+        {
+            SettingsPage.Preferences => ShellScreen.Preferences,
+            SettingsPage.Vaults => ShellScreen.Vaults,
+            _ => Screen,
+        };
+
+        Surface = ShellSurface.Page;
+    }
+
+    /// <summary>
+    /// Opens the importer over the Preferences page — the Preferences row's own "OPEN IMPORTER" button, and
+    /// <see cref="ShowScreen"/>'s translation of <see cref="ShellScreen.Import"/> for every other caller.
+    /// </summary>
+    private void OpenImport()
+    {
+        EnterSettings(SettingsPage.Preferences);
+        IsImportOpen = true;
+    }
+
+    /// <summary>"Back to preferences": closes the importer without leaving settings mode.</summary>
+    [RelayCommand]
+    private void CloseImport() => IsImportOpen = false;
+
+    /// <summary>"Back to application": leaves settings mode for wherever it was entered from.</summary>
+    [RelayCommand]
+    private void LeaveSettings()
+    {
+        if (ActiveSettingsPage is null)
+        {
+            return;
+        }
+
+        ActiveSettingsPage = null;
+        IsImportOpen = false;
+        Screen = settingsReturnScreen;
+        Surface = settingsReturnSurface;
+    }
+
     /// <summary>Switches to the terminal surface.</summary>
     /// <remarks>
     /// <para>
@@ -1660,9 +1924,18 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// Closes one terminal, ending its shell.
     /// </summary>
     /// <remarks>
+    /// <para>
     /// This is the one thing in the application that deliberately ends a session, which is why it is a tab's
     /// close button and not a menu item: closing the window somebody's job is running in should take exactly
     /// as much intent as it looks like it does. Locking does not do this, and neither does anything else.
+    /// </para>
+    /// <para>
+    /// <b>It takes the status line with it, when that line is this tab's.</b> The strip along the bottom is
+    /// one line for the whole window — see <c>StatusBar.axaml</c> — and connecting writes to it, so closing
+    /// prod-db used to leave "Connected to prod-db." reporting on a session that is gone, over whichever
+    /// terminal the user looked at next. Only the sentence this attempt wrote goes; anything the vault has
+    /// said since stays, because a failed save is not something closing a terminal answers.
+    /// </para>
     /// </remarks>
     [RelayCommand]
     private async Task CloseTabAsync(TerminalTabViewModel tab)
@@ -1672,9 +1945,9 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
             return;
         }
 
-        // Removed first, so the workspace's SessionEnded — which fires as the pump unwinds — finds no tab to
-        // mark dead and does nothing. The alternative ordering leaves a window in which a tab that is on its
-        // way out is repainted as disconnected.
+        // Removed first, so the workspace's SessionEnded — announced once the close below has fully drained
+        // — finds no tab to mark dead and does nothing here. The alternative ordering leaves a window in
+        // which a tab that is on its way out is repainted as disconnected.
         var index = Tabs.IndexOf(tab);
         Tabs.Remove(tab);
 
@@ -1696,6 +1969,9 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
         RaiseTabState();
 
+        // Only this tab's own sentence, and only if that is what the bar currently holds — see the remark.
+        Vault?.ForgetConnectionStatus(tab.AttemptId);
+
         // Explicitly, and not left to the selection having moved. Closing a tab that was not the selected one
         // changes nothing about the selection, so OnSelectedTabChanged does not run — and the host whose
         // terminal just went would keep a lit dot until something else happened to move the selection.
@@ -1911,7 +2187,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
                 return;
             }
 
-            AdoptIdentity(profile.DisplayName, profile.Email, profile.Subject);
+            AdoptIdentity(profile.DisplayName, profile.Email, profile.Subject, profile.Issuer);
             ServerUrl = profile.ServerUrl;
             State = ShellState.Locked;
             StatusMessage = $"Enrolled against {profile.ServerUrl}.";
@@ -1972,7 +2248,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
                     .RefreshAsync(ServerUrl, cancellationToken)
                     .ConfigureAwait(true);
 
-                AdoptIdentity(outcome.Me.DisplayName, outcome.Me.Email, outcome.Me.Subject);
+                AdoptIdentity(outcome.Me.DisplayName, outcome.Me.Email, outcome.Me.Subject, outcome.Me.Issuer);
                 StatusMessage = outcome.Message;
 
                 if (outcome.Status == ProvisionStatus.EnrollmentRequired)
@@ -2659,21 +2935,30 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     [RelayCommand]
     private void CancelSignOut() => IsConfirmingSignOut = false;
 
-    /// <summary>Starts a sign-out from the rail's user popover, from wherever the window is showing.</summary>
+    /// <summary>
+    /// Starts a sign-out from the rail's user popover, or from settings mode's own Logout row, from wherever
+    /// the window is showing.
+    /// </summary>
     /// <remarks>
     /// <see cref="SignOut"/> only arms <see cref="IsConfirmingSignOut"/>; the confirmation itself is drawn
-    /// inline on the Preferences screen while the vault is unlocked — see <c>PreferencesScreen.axaml</c> —
-    /// and nowhere else, because <c>MainWindow.axaml</c>'s own copy of <c>SignOutCard</c> is inside the
+    /// inline on the Account settings page while the vault is unlocked — see <c>SettingsAccountPage.axaml</c>
+    /// — and nowhere else, because <c>MainWindow.axaml</c>'s own copy of <c>SignOutCard</c> is inside the
     /// setup half of the window, which is hidden the whole time this one is reachable. Calling
     /// <see cref="SignOut"/> straight from the popover on, say, the hosts screen would arm the flag with
-    /// nothing on screen to show it — a card raised nobody can see. Going to Preferences first is what the
-    /// popover's own "New vault" and "New bucket" rows already do for the same reason; see
+    /// nothing on screen to show it — a card raised nobody can see. Entering settings on Account first is
+    /// what the popover's own "New vault" and "New bucket" rows already do for the same reason; see
     /// <see cref="ShowNewVault"/>.
+    /// <para>
+    /// v5c: went to <c>ShellScreen.Preferences</c> before this wave, because that bare screen was the only
+    /// place the confirmation card could be seen. It moved to the Account settings page with the card — see
+    /// design-notes/v5c-fidelity-notes.md — and this is the one command both the rail's popover Logout row
+    /// and settings mode's own bottom Logout row are wired to, so the confirmation has exactly one home.
+    /// </para>
     /// </remarks>
     [RelayCommand]
     private void SignOutFromPopover()
     {
-        ShowScreen(ShellScreen.Preferences);
+        EnterSettings(SettingsPage.Account);
         SignOut();
     }
 
@@ -2744,6 +3029,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
                 AccountName = null;
                 Email = null;
+                Issuer = null;
                 Passphrase = string.Empty;
                 ConfirmPassphrase = string.Empty;
                 RecoveryCode = null;
@@ -2803,6 +3089,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
 
         workspace.SessionEnded -= OnWorkspaceSessionEnded;
         workspace.FontSizeStepRequested -= OnFontSizeStepRequested;
+        workspace.RendererReattached -= OnRendererReattached;
         transfers.PropertyChanged -= OnTransfersPropertyChanged;
 
         // Stopped here rather than left to the process exiting with it: the loop holds no vault key and
@@ -3017,8 +3304,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // vault is opened or closed. It holds a subscription to the vault's pin list, so leaving one behind
         // would keep a disposed vault alive and repaint a screen nobody can reach.
         KnownHostsScreen?.Detach();
-        KnownHostsScreen = newValue is null ? null : new KnownHostsViewModel(newValue);
-        ImportScreen = newValue is null ? null : new ImportViewModel(newValue, new SshConfigLocator());
+
+        // v5c-3: the back arrow's own destination, on the same reasoning as ImportViewModel's onCancel below
+        // — KnownHostsViewModel has no business knowing ShellScreen exists.
+        KnownHostsScreen = newValue is null
+            ? null
+            : new KnownHostsViewModel(newValue, () => ShowScreen(ShellScreen.Keychain));
+
+        // v5c-3: CloseImport, so the importer's own Cancel button can back out to the Preferences page
+        // beneath it without ImportViewModel knowing anything about settings mode — the same reasoning
+        // VaultViewModel's copyToClipboard delegate is built on.
+        ImportScreen = newValue is null
+            ? null
+            : new ImportViewModel(newValue, new SshConfigLocator(), CloseImport);
 
         SnippetsScreen?.Detach();
         SnippetsScreen = newValue is null
@@ -3114,7 +3412,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// </remarks>
     private void OnVaultConnectionStarting(object? sender, ConnectionAttemptEventArgs e)
     {
-        var tab = new TerminalTabViewModel(e.Label, e.Address);
+        var tab = new TerminalTabViewModel(e.Label, e.Address) { AttemptId = e.AttemptId };
         attempts[e.AttemptId] = tab;
 
         AdoptTab(tab);
@@ -3141,7 +3439,14 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
             // No tab was opened for this attempt, which means the user closed the connecting tab while the
             // handshake was still running. The session is real and has to be adopted rather than dropped:
             // dropping it would leave a shell running with nothing in the window naming it.
-            var adopted = new TerminalTabViewModel(e.SessionId, e.Label, e.Address) { StartedAt = clock.GetUtcNow() };
+            var adopted = new TerminalTabViewModel(e.SessionId, e.Label, e.Address)
+            {
+                AttemptId = e.AttemptId,
+                StartedAt = clock.GetUtcNow(),
+                Cipher = NullIfEmpty(e.Cipher),
+                HostKeyAlgorithm = NullIfEmpty(e.HostKeyAlgorithm),
+                IdentityLabel = e.IdentityLabel,
+            };
             AdoptTab(adopted);
             RefreshConnectedHosts();
             return;
@@ -3152,6 +3457,9 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // From this moment, not from when the tab first appeared — connecting is not open, and the session
         // shell's elapsed timer is about a shell that is actually running.
         tab.StartedAt = clock.GetUtcNow();
+        tab.Cipher = NullIfEmpty(e.Cipher);
+        tab.HostKeyAlgorithm = NullIfEmpty(e.HostKeyAlgorithm);
+        tab.IdentityLabel = e.IdentityLabel;
 
         // The pane exists from this moment, so what the rectangle should hold has changed — the card goes and
         // the WebView comes back. Only for the tab being looked at, which is what these flags already ask.
@@ -3655,6 +3963,69 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         _ => null,
     };
 
+    /// <summary>
+    /// The negotiated server-to-client cipher the status bar shows beside CONNECTED, or null when neither
+    /// surface has a session — or when the one it has has nothing to report.
+    /// </summary>
+    /// <remarks>
+    /// One property reading whichever surface is showing, for the same reason <see cref="SessionAddress"/>
+    /// is: <c>SessionStatusBar.axaml</c> is the same markup on both surfaces. The terminal's is
+    /// <see cref="TerminalTabViewModel.Cipher"/>; SFTP's is <see cref="TransfersViewModel.ConnectedCipher"/>.
+    /// </remarks>
+    internal string? SessionCipher => Surface switch
+    {
+        ShellSurface.Terminal => NullIfEmpty(SelectedTab?.Cipher),
+        _ when IsTransfersShowing => NullIfEmpty(Transfers.ConnectedCipher),
+        _ => null,
+    };
+
+    /// <summary>The accepted host key's algorithm, e.g. <c>ssh-ed25519</c> — printed as negotiated, not shortened.</summary>
+    /// <remarks>See <see cref="SessionCipher"/>; resolved the same way, off <see cref="TerminalTabViewModel.HostKeyAlgorithm"/> or <see cref="TransfersViewModel.ConnectedHostKeyAlgorithm"/>.</remarks>
+    internal string? SessionHostKeyAlgorithm => Surface switch
+    {
+        ShellSurface.Terminal => NullIfEmpty(SelectedTab?.HostKeyAlgorithm),
+        _ when IsTransfersShowing => NullIfEmpty(Transfers.ConnectedHostKeyAlgorithm),
+        _ => null,
+    };
+
+    /// <summary>
+    /// The display name of the key or credential that authenticated, or null when a typed password did or
+    /// nothing is connected.
+    /// </summary>
+    /// <remarks>See <see cref="SessionCipher"/>; resolved the same way, off <see cref="TerminalTabViewModel.IdentityLabel"/> or <see cref="TransfersViewModel.ConnectedIdentityLabel"/>.</remarks>
+    internal string? SessionIdentityLabel => Surface switch
+    {
+        ShellSurface.Terminal => SelectedTab?.IdentityLabel,
+        _ when IsTransfersShowing => Transfers.ConnectedIdentityLabel,
+        _ => null,
+    };
+
+    /// <summary>
+    /// The status bar's one run of text for the host key and the identity that authenticated — the design's
+    /// <c>ed25519 · acme-deploy-key</c> — or null while <see cref="SessionHostKeyAlgorithm"/> is.
+    /// </summary>
+    /// <remarks>
+    /// Composed here rather than in the view, so <c>SessionStatusBar.axaml</c> binds one <c>TextBlock</c> to
+    /// one string instead of assembling a separator between two bindings that can each be absent on their own.
+    /// The algorithm prints exactly as negotiated — <c>ssh-ed25519</c>, not the design's shortened
+    /// <c>ed25519</c> — because trimming it would be a cosmetic claim about a string this shell has no
+    /// business editing. A typed-password session has no item to name, so it shows the algorithm alone with
+    /// no <c>·</c> — there being nothing after the dot would be a punctuation mark standing in for the fact
+    /// that was never real.
+    /// </remarks>
+    internal string? SessionIdentityText => SessionHostKeyAlgorithm is { } algorithm
+        ? SessionIdentityLabel is { } label ? $"{algorithm} · {label}" : algorithm
+        : null;
+
+    /// <summary>Null for an empty string, unchanged otherwise.</summary>
+    /// <remarks>
+    /// <see cref="ISshConnection.Cipher"/> and <see cref="HostKeyPresentation.Algorithm"/> are non-nullable
+    /// strings that this shell nonetheless treats as absent when empty — a session whose facts genuinely
+    /// could not be read back (see <c>TerminalWorkspace.GetSessionFacts</c>) hands over <see cref="string.Empty"/>
+    /// rather than null, and the status bar's collapse bindings only know how to ask about null.
+    /// </remarks>
+    private static string? NullIfEmpty(string? value) => string.IsNullOrEmpty(value) ? null : value;
+
     /// <summary>Whether the session the header and status bar are describing is actually open.</summary>
     /// <remarks>
     /// Not the same question as <see cref="SessionAddress"/> being non-null on the terminal surface: a tab
@@ -3722,6 +4093,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(SessionAddress));
         OnPropertyChanged(nameof(IsSessionConnected));
         OnPropertyChanged(nameof(SessionElapsedText));
+        OnPropertyChanged(nameof(SessionCipher));
+        OnPropertyChanged(nameof(SessionHostKeyAlgorithm));
+        OnPropertyChanged(nameof(SessionIdentityLabel));
+        OnPropertyChanged(nameof(SessionIdentityText));
         OnPropertyChanged(nameof(ShowsQuickAccessSidebar));
     }
 
@@ -3737,7 +4112,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         if (e.PropertyName is nameof(TransfersViewModel.SelectedHost)
             or nameof(TransfersViewModel.IsConnected)
             or nameof(TransfersViewModel.Remote)
-            or nameof(TransfersViewModel.ConnectedTo))
+            or nameof(TransfersViewModel.ConnectedTo)
+            or nameof(TransfersViewModel.ConnectedCipher)
+            or nameof(TransfersViewModel.ConnectedHostKeyAlgorithm)
+            or nameof(TransfersViewModel.ConnectedIdentityLabel))
         {
             RaiseSessionState();
         }
@@ -4086,7 +4464,6 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(IsVaultsScreen));
         OnPropertyChanged(nameof(IsPreferencesScreen));
         OnPropertyChanged(nameof(IsKnownHostsScreen));
-        OnPropertyChanged(nameof(IsImportScreen));
         OnPropertyChanged(nameof(IsSnippetsScreen));
         OnPropertyChanged(nameof(IsLogsScreen));
         OnPropertyChanged(nameof(IsMoreScreen));

src/DodoSSH.Client.Shell/ViewModels/TerminalTabViewModel.cs

@@ -28,10 +28,11 @@ internal enum TerminalTabState
 /// </summary>
 /// <remarks>
 /// <para>
-/// A tab is a session id and two strings. It holds no terminal and owns nothing: the pane, its scrollback
-/// and the shell behind it all live in the renderer and in <c>TerminalWorkspace</c>, and selecting a tab is
-/// one frame telling the page which pane to show. That is what makes tabs cheap here — the expensive object
-/// is the WebView, and there is one of those however many tabs are open.
+/// A tab is a session id and a handful of strings — the address, and now the three connection facts the
+/// status bar draws beside CONNECTED. It holds no terminal and owns nothing: the pane, its scrollback and the
+/// shell behind it all live in the renderer and in <c>TerminalWorkspace</c>, and selecting a tab is one frame
+/// telling the page which pane to show. That is what makes tabs cheap here — the expensive object is the
+/// WebView, and there is one of those however many tabs are open.
 /// </para>
 /// <para>
 /// <b>A tab starts before its session does.</b> Connecting is a network round trip that can take as long as
@@ -83,6 +84,18 @@ internal sealed partial class TerminalTabViewModel : ObservableObject
     /// </remarks>
     internal uint SessionId { get; private set; }
 
+    /// <summary>
+    /// The connection attempt this tab was opened for, or <see cref="Guid.Empty"/> for a tab nothing dialled.
+    /// </summary>
+    /// <remarks>
+    /// Carried only so that closing this tab can take the vault's status line with it when the line is about
+    /// this connection — see <c>VaultViewModel.ForgetConnectionStatus</c>. It is the attempt id and not the
+    /// session id because the message can be written before a session exists ("Connecting to prod-db…") and
+    /// after one has stopped existing, and because the two failure sentences a tab can end on never have a
+    /// session id at all.
+    /// </remarks>
+    internal Guid AttemptId { get; init; }
+
     internal string Label { get; }
 
     /// <summary>The account and endpoint, for the pane header and the status bar.</summary>
@@ -102,6 +115,31 @@ internal sealed partial class TerminalTabViewModel : ObservableObject
     /// </remarks>
     internal DateTimeOffset? StartedAt { get; set; }
 
+    /// <summary>
+    /// The negotiated server-to-client cipher, for the status bar — or null while there is no session.
+    /// </summary>
+    /// <remarks>
+    /// Set alongside <see cref="StartedAt"/>, from the same event, and kept for the same reason: a dead tab's
+    /// pane still holds the scrollback of a session that really did negotiate this cipher, and clearing the
+    /// fact when the shell ends would not make it less true of what is on screen.
+    /// </remarks>
+    internal string? Cipher { get; set; }
+
+    /// <summary>The accepted host key's algorithm, e.g. <c>ssh-ed25519</c> — or null while there is no session.</summary>
+    /// <remarks>See <see cref="Cipher"/>; set and kept the same way, for the same reason.</remarks>
+    internal string? HostKeyAlgorithm { get; set; }
+
+    /// <summary>
+    /// The display name of the key or credential that authenticated, or null when a typed password did, or
+    /// null while there is no session.
+    /// </summary>
+    /// <remarks>
+    /// Three different reasons collapse to the same null, and that is deliberate: nothing downstream needs to
+    /// tell a session with no identity to name apart from a tab that has not opened one yet — both mean the
+    /// status bar shows the host-key algorithm alone, with no ` · name` after it.
+    /// </remarks>
+    internal string? IdentityLabel { get; set; }
+
     /// <inheritdoc cref="TerminalTabState" />
     [ObservableProperty]
     private TerminalTabState state;

src/DodoSSH.Client.Shell/ViewModels/TransfersViewModel.cs

@@ -606,6 +606,75 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
     [ObservableProperty]
     private string? connectedTo;
 
+    /// <summary>
+    /// The negotiated server-to-client cipher for the open SFTP session, for the v5b status bar — or null
+    /// while nothing is connected, or while what is connected is a bucket rather than a host.
+    /// </summary>
+    /// <remarks>
+    /// A bucket is <c>IRemoteFileStore</c> with no SSH underneath it at all, so it has no cipher, no host key
+    /// and no identity to name — <see cref="OpenBucketAsync"/> leaves all three null rather than each reading
+    /// as "not yet known", which is the meaning null already carries for a host that has not connected yet.
+    /// Read off the concrete <c>ISftpSession</c> at connect time, the same moment <see cref="ConnectedTo"/> is
+    /// set, because <see cref="session"/> itself is typed as <c>IRemoteFileStore</c> and does not carry it.
+    /// </remarks>
+    [ObservableProperty]
+    private string? connectedCipher;
+
+    /// <summary>
+    /// Whether there is a live SFTP connection this session would lose by dying — the phone's foreground-
+    /// service question, not the desktop's.
+    /// </summary>
+    /// <remarks>
+    /// <see cref="ConnectedCipher"/> is already the fact that tells a host apart from a bucket, because only
+    /// a host set it — a bucket is HTTP, per-request, and closes nothing a dying process would have kept
+    /// open, so it answers false here even while <see cref="IsConnected"/> is true. Android reads this to
+    /// decide whether an idle Files screen with no transfer moving still needs the process kept alive; the
+    /// desktop has no such question because nothing stops its process for having gone quiet.
+    /// </remarks>
+    internal bool HasLiveFileSession => IsConnected && ConnectedCipher is not null;
+
+    /// <summary>The accepted host key's algorithm, e.g. <c>ssh-ed25519</c>. See <see cref="ConnectedCipher"/>.</summary>
+    [ObservableProperty]
+    private string? connectedHostKeyAlgorithm;
+
+    /// <summary>
+    /// The display name of the key or credential that authenticated, or null when a typed password did, or
+    /// null while nothing is connected.
+    /// </summary>
+    /// <remarks>
+    /// Threaded from <see cref="VaultViewModel.TryBuildConnectionRequest"/>'s own out parameter rather than
+    /// re-resolved here: the label names a keychain item this screen has no authentication ladder of its own
+    /// to climb, and a second lookup would be a second place for a stale binding to answer differently than
+    /// the one that actually authenticated.
+    /// </remarks>
+    [ObservableProperty]
+    private string? connectedIdentityLabel;
+
+    /// <summary>
+    /// The paths pinned on the connected host, for the phone's Files-screen chip row — the desktop draws
+    /// the same list in its QUICK ACCESS sidebar, over the terminal surface rather than this one. See
+    /// <see cref="VaultViewModel.EditorPinnedPaths"/> for where a pin is actually added or removed; this is
+    /// a read of what was already saved there.
+    /// </summary>
+    /// <remarks>
+    /// Captured at connect, the same moment <see cref="ConnectedTo"/> is, rather than followed live off the
+    /// host row's own <c>PinnedPaths</c>. A pin edited while this session stays open shows up on the next
+    /// connect rather than mid-session — the same lag <see cref="ConnectedTo"/> itself already carries for
+    /// a relabel — because this screen reads the vault once, at the moment it dials, rather than staying
+    /// wired to a collection it otherwise never has a reason to watch. A bucket has no pins at all:
+    /// <see cref="OpenBucketAsync"/> leaves this empty rather than reading as "not yet known", which is what
+    /// empty already means for a host that connected with none pinned.
+    /// </remarks>
+    internal ObservableCollection<string> ConnectedPinnedPaths { get; } = [];
+
+    /// <summary>Whether the connected host or bucket has any pins to draw as chips.</summary>
+    /// <remarks>
+    /// A read of <see cref="ConnectedPinnedPaths"/> rather than an <c>[ObservableProperty]</c> of its own,
+    /// so it is raised by hand at each of the three places that collection is repopulated or cleared —
+    /// <see cref="MarkHostConnected"/>, <see cref="OpenBucketAsync"/> and <see cref="CloseSessionAsync"/>.
+    /// </remarks>
+    internal bool HasConnectedPins => ConnectedPinnedPaths.Count > 0;
+
     [ObservableProperty]
     private HostKeyPresentation? pendingHostKey;
 
@@ -689,13 +758,18 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
 
     internal ObservableCollection<TransferRowViewModel> Transfers { get; } = [];
 
-    /// <summary>Raised on the UI thread whenever a transfer appears or changes state.</summary>
+    /// <summary>
+    /// Raised on the UI thread whenever a transfer appears or changes state, or a host or bucket connects or
+    /// disconnects.
+    /// </summary>
     /// <remarks>
     /// For a head that has to tell the operating system what this process is doing — Android's foreground
-    /// service, which must be up for as long as bytes are moving and down afterwards. An event rather than
-    /// letting that head watch <see cref="Transfers"/> itself: the collection announces rows arriving and
-    /// leaving, and the transition that matters most is neither of those but a row going from RUNNING to
-    /// DONE without moving.
+    /// service, which must be up for as long as bytes are moving, or a host session sits open, and down
+    /// afterwards. An event rather than letting that head watch <see cref="Transfers"/> itself: the
+    /// collection announces rows arriving and leaving, and the transition that matters most is neither of
+    /// those but a row going from RUNNING to DONE without moving. Connecting and disconnecting are the other
+    /// two transitions the service cares about — see <see cref="HasLiveFileSession"/> — and neither touches
+    /// <see cref="Transfers"/> at all, so they need this same announcement made by hand.
     /// </remarks>
     internal event EventHandler? ActivityChanged;
 
@@ -763,12 +837,48 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
 
         foreach (var root in LocalDirectory.Roots())
         {
-            LocalRoots.Add(new CrumbViewModel(root.TrimEnd(Path.DirectorySeparatorChar), root));
+            LocalRoots.Add(new CrumbViewModel(RootChipName(root), root));
         }
 
         RefreshLocalCommand.Execute(null);
     }
 
+    /// <summary>What a root's chip in the pane header says: <c>C:</c>, <c>/</c>, <c>~</c>, or a mount's name.</summary>
+    /// <remarks>
+    /// <para>
+    /// A name, never a path — the full path is the chip's <see cref="CrumbViewModel.Path"/> and its command
+    /// parameter, and it stays there. This used to be <c>root.TrimEnd(separator)</c>, which is a name only
+    /// for a Windows drive: on Unix it made the <c>/</c> chip an empty pill and the home chip the entire
+    /// home path, drawn at full width in a header column nothing bounds. A machine whose home directory sat
+    /// deep enough — CI's per-job HOME is forty-six characters — had that one chip push the header's own
+    /// buttons past the window's edge at the session shell's 472-pixel budget.
+    /// </para>
+    /// <para>
+    /// <c>~</c> for home is the one substitution rather than a shortening: every shell a user of this
+    /// application has ever typed into already means "my home directory" by it, which is exactly what the
+    /// chip does when pressed.
+    /// </para>
+    /// </remarks>
+    internal static string RootChipName(string root)
+    {
+        if (string.Equals(root, LocalDirectory.Home, StringComparison.Ordinal))
+        {
+            return "~";
+        }
+
+        var trimmed = root.TrimEnd(Path.DirectorySeparatorChar);
+        if (trimmed.Length == 0)
+        {
+            // Unix's "/": trimming eats the whole string, and the root's name is the root itself.
+            return "/";
+        }
+
+        // A mount under /media or /run/media names itself by its last segment; a Windows drive ("C:") has
+        // no file-name segment at all, and the trimmed root is already the two-character name it always had.
+        var name = Path.GetFileName(trimmed);
+        return name.Length == 0 ? trimmed : name;
+    }
+
     /// <summary>
     /// Gives up the vault, keeping the connection and anything in flight.
     /// </summary>
@@ -874,6 +984,16 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
                 ConnectedTo = string.Create(
                     CultureInfo.InvariantCulture, $"s3://{row.Store.Bucket}");
 
+                // No SSH underneath a bucket, so none of the three has an honest value — see
+                // ConnectedCipher's own remark.
+                ConnectedCipher = null;
+                ConnectedHostKeyAlgorithm = null;
+                ConnectedIdentityLabel = null;
+
+                // And no pins either — see ConnectedPinnedPaths's own remark.
+                ConnectedPinnedPaths.Clear();
+                OnPropertyChanged(nameof(HasConnectedPins));
+
                 connected = (ConnectedTo, row.Label, row.EntityId, TimeProvider.System.GetUtcNow());
 
                 await ListRemoteAsync(session.HomeDirectory, cancellationToken).ConfigureAwait(true);
@@ -891,7 +1011,8 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             return;
         }
 
-        if (!open.TryBuildConnectionRequest(row.Host, TypedPassword, out var request, out var refusal))
+        if (!open.TryBuildConnectionRequest(
+            row.Host, TypedPassword, out var request, out var identityLabel, out var refusal))
         {
             Status = refusal;
             return;
@@ -906,9 +1027,11 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             {
                 await CloseSessionAsync().ConfigureAwait(true);
 
+                ISftpSession opened;
+
                 try
                 {
-                    session = await sftp.OpenSftpAsync(request, cancellationToken).ConfigureAwait(true);
+                    opened = await sftp.OpenSftpAsync(request, cancellationToken).ConfigureAwait(true);
                 }
                 catch (SshHostKeyUnknownException exception)
                 {
@@ -926,17 +1049,9 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
                     return;
                 }
 
+                session = opened;
                 TypedPassword = string.Empty;
-                IsConnected = true;
-                ConnectedTo = string.Create(
-                    CultureInfo.InvariantCulture,
-                    $"{request.Username}@{request.Host}:{request.Port}");
-
-                // Recorded, and not hidden because it is "only" the file browser. Opening this is a second
-                // login as far as the remote's own auth.log is concerned, so a log of ours that omitted it
-                // would disagree with the host's — and anybody comparing the two would be right to believe
-                // the host.
-                connected = (ConnectedTo, row.Label, row.EntityId, TimeProvider.System.GetUtcNow());
+                MarkHostConnected(opened, request, row, identityLabel);
 
                 await ListRemoteAsync(session.HomeDirectory, cancellationToken).ConfigureAwait(true);
 
@@ -944,6 +1059,49 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
             }).ConfigureAwait(true);
     }
 
+    /// <summary>
+    /// Records that a host connection just succeeded: the address, the negotiated facts, and the ticket the
+    /// disconnect log closes out later.
+    /// </summary>
+    /// <remarks>
+    /// Split out of <see cref="ConnectToHostAsync"/> for length rather than for reuse — <see cref="OpenBucketAsync"/>
+    /// sets the same four properties its own way, with no SSH underneath to read the last three off. Reads
+    /// the cipher and host key off <paramref name="opened"/> rather than <see cref="session"/>, which is typed
+    /// as <c>IRemoteFileStore</c> and does not carry either.
+    /// </remarks>
+    private void MarkHostConnected(
+        ISftpSession opened, SshConnectionRequest request, HostRowViewModel row, string? identityLabel)
+    {
+        IsConnected = true;
+        ConnectedTo = string.Create(
+            CultureInfo.InvariantCulture,
+            $"{request.Username}@{request.Host}:{request.Port}");
+        ConnectedCipher = opened.Cipher;
+        ConnectedHostKeyAlgorithm = opened.HostKey.Algorithm;
+        ConnectedIdentityLabel = identityLabel;
+
+        // See ConnectedPinnedPaths's own remark for why this is a snapshot rather than a live follow.
+        ConnectedPinnedPaths.Clear();
+        foreach (var path in row.Host.PinnedPaths)
+        {
+            ConnectedPinnedPaths.Add(path);
+        }
+
+        OnPropertyChanged(nameof(HasConnectedPins));
+
+        // Recorded, and not hidden because it is "only" the file browser. Opening this is a second login as
+        // far as the remote's own auth.log is concerned, so a log of ours that omitted it would disagree with
+        // the host's — and anybody comparing the two would be right to believe the host.
+        connected = (ConnectedTo, row.Label, row.EntityId, TimeProvider.System.GetUtcNow());
+
+        // Raised here rather than from OnIsConnectedChanged, on purpose: IsConnected is set first, above,
+        // and ConnectedCipher second — a partial method firing off the first assignment would read
+        // HasLiveFileSession against a ConnectedCipher still holding whatever the previous session left
+        // there. Only at the end of this method are both facts actually true together.
+        OnPropertyChanged(nameof(HasLiveFileSession));
+        ActivityChanged?.Invoke(this, EventArgs.Empty);
+    }
+
     /// <summary>
     /// Closes the file-transfer session.
     /// </summary>
@@ -1713,11 +1871,21 @@ internal sealed partial class TransfersViewModel : ObservableObject, IAsyncDispo
 
         IsConnected = false;
         ConnectedTo = null;
+        ConnectedCipher = null;
+        ConnectedHostKeyAlgorithm = null;
+        ConnectedIdentityLabel = null;
+        ConnectedPinnedPaths.Clear();
+        OnPropertyChanged(nameof(HasConnectedPins));
         RemotePath = string.Empty;
         RemoteEntries.Clear();
         RemoteTrail.Clear();
         SelectedRemoteEntry = null;
 
+        // Same ordering reason as the raise at the end of MarkHostConnected: both properties this reads are
+        // already null above, so the raise belongs after them rather than in OnIsConnectedChanged. This also
+        // covers OpenBucketAsync, which calls this method first and never itself turns HasLiveFileSession on.
+        OnPropertyChanged(nameof(HasLiveFileSession));
+        ActivityChanged?.Invoke(this, EventArgs.Empty);
     }
 
     /// <remarks>

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -123,6 +123,9 @@ internal sealed class HostGroupRowViewModel(VaultGroupItem group, int hostCount)
 
     /// <summary>What the row says under the name.</summary>
     internal string Description => hostCount == 1 ? "1 host" : $"{hostCount} hosts";
+
+    /// <summary>The single letter the settings page's card draws on this group's tile.</summary>
+    internal string Initial => Label.Length > 0 ? Label[..1].ToUpperInvariant() : "?";
 }
 
 /// <summary>An entry in the host editor's group picker.</summary>
@@ -885,11 +888,19 @@ internal static class ItemBadge
 /// <param name="sessionId">Identifies the session to the renderer and to the workspace.</param>
 /// <param name="label">The host's name, as the vault has it.</param>
 /// <param name="address">The account and endpoint actually dialled.</param>
+/// <param name="cipher">The negotiated server-to-client cipher; see <see cref="ISshConnection.Cipher"/>.</param>
+/// <param name="hostKeyAlgorithm">The accepted host key's algorithm, e.g. <c>ssh-ed25519</c>.</param>
+/// <param name="identityLabel">
+/// The display name of the key or credential that authenticated, or null when a typed password did.
+/// </param>
 internal sealed class TerminalSessionEventArgs(
     Guid attemptId,
     uint sessionId,
     string label,
-    string address) : EventArgs
+    string address,
+    string cipher,
+    string hostKeyAlgorithm,
+    string? identityLabel) : EventArgs
 {
     /// <summary>Which attempt this session came out of.</summary>
     /// <inheritdoc cref="ConnectionAttemptEventArgs.AttemptId" path="/remarks" />
@@ -900,6 +911,12 @@ internal sealed class TerminalSessionEventArgs(
     internal string Label { get; } = label;
 
     internal string Address { get; } = address;
+
+    internal string Cipher { get; } = cipher;
+
+    internal string HostKeyAlgorithm { get; } = hostKeyAlgorithm;
+
+    internal string? IdentityLabel { get; } = identityLabel;
 }
 
 /// <summary>A connection that has been asked for, and has not answered yet.</summary>
@@ -2113,6 +2130,60 @@ internal sealed partial class VaultViewModel(
     [ObservableProperty]
     private string status = string.Empty;
 
+    /// <summary>
+    /// The connection <see cref="Status"/> is currently about, or <see cref="Guid.Empty"/> when it is about
+    /// something else — a save, a sync, a refusal that has nothing to do with a terminal.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The status line is one line for the whole window, and most of what goes through it is about the vault,
+    /// which is one thing however many terminals are open. A connection is not: "Connected to prod-db." is
+    /// about one tab, and it used to outlive that tab — close prod-db, look at the terminal beside it, and the
+    /// strip along the bottom was still reporting on a session that is no longer there.
+    /// </para>
+    /// <para>
+    /// Ownership rather than a blanket clear on every close, because the alternative loses the sentences this
+    /// bar exists for: a failed save or a refused sync is what the design deleted the bar's other four fields
+    /// to make room for, and closing a terminal is no reason to take one away.
+    /// </para>
+    /// <para>
+    /// Reset by <see cref="OnStatusChanged"/> on every write, so the only messages that carry an owner are the
+    /// ones <see cref="SayAbout"/> writes. Anything assigning <see cref="Status"/> in the ordinary way says,
+    /// by doing so, that its message belongs to no tab.
+    /// </para>
+    /// </remarks>
+    private Guid statusAttemptId;
+
+    partial void OnStatusChanged(string value) => statusAttemptId = Guid.Empty;
+
+    /// <summary>Writes a status line that belongs to one connection attempt.</summary>
+    /// <remarks>
+    /// After the assignment, not before: <see cref="OnStatusChanged"/> clears the owner on every write, which
+    /// is what makes "belongs to nobody" the default rather than something each of the other status writes
+    /// would have to remember to say.
+    /// </remarks>
+    private void SayAbout(ConnectionAttemptEventArgs attempt, string message)
+    {
+        Status = message;
+        statusAttemptId = attempt.AttemptId;
+    }
+
+    /// <summary>
+    /// Clears the status line if what it is saying is about this connection, and leaves it alone otherwise.
+    /// </summary>
+    /// <remarks>
+    /// Called by the shell when a tab is closed — see <c>MainWindowViewModel.CloseTabAsync</c>. Cleared to
+    /// empty rather than replaced with "Closed prod-db.": the tab going is the report, it is the report the
+    /// user just made happen, and a bar that answers every close with a sentence is a bar people stop reading.
+    /// </remarks>
+    internal void ForgetConnectionStatus(Guid attemptId)
+    {
+        if (attemptId != Guid.Empty && statusAttemptId == attemptId)
+        {
+            Status = string.Empty;
+        }
+    }
+
     [ObservableProperty]
     private int pendingChanges;
 
@@ -4667,8 +4738,20 @@ internal sealed partial class VaultViewModel(
         }
 
         SelectedTag = Tags.FirstOrDefault(row => row.EntityId == selectedId);
+
+        OnPropertyChanged(nameof(HasTagItems));
     }
 
+    /// <summary>
+    /// Whether there is at least one tag to manage.
+    /// </summary>
+    /// <remarks>
+    /// v5c-2: the settings Tags page's empty state. Named apart from <c>HostRowViewModel.HasTags</c>, which
+    /// answers a different question — whether one host wears any — rather than reusing that name at this
+    /// level and relying on which <c>x:DataType</c> a binding happens to be inside to tell the two apart.
+    /// </remarks>
+    internal bool HasTagItems => Tags.Count > 0;
+
     /// <summary>
     /// A host with its group chain applied: the port to dial, the user to log in as, and how to
     /// authenticate.
@@ -4763,6 +4846,28 @@ internal sealed partial class VaultViewModel(
         GroupFilter = Groups.FirstOrDefault(row => row.EntityId == filteredId);
 
         OnPropertyChanged(nameof(HasGroups));
+        OnPropertyChanged(nameof(UngroupedHostCount));
+    }
+
+    /// <summary>
+    /// How many hosts, across every shown vault, carry no group that still exists.
+    /// </summary>
+    /// <remarks>
+    /// v5c: the settings Groups page's "No group" footer row. The same dangling-reference reading
+    /// <see cref="FlattenIntoSections"/> gives the sidebar's own UNGROUPED heading — a host naming a group
+    /// this vault no longer has counts as ungrouped rather than vanishing — but counted over every shown
+    /// vault's hosts rather than over a find-box-filtered subset, because a settings page has no find box
+    /// and a count that shrank while somebody typed in one would be answering the wrong question.
+    /// </remarks>
+    internal int UngroupedHostCount
+    {
+        get
+        {
+            var known = Groups.Select(group => group.EntityId).ToHashSet();
+
+            return Hosts.Count(row =>
+                IsVaultShown(row.VaultId) && (row.Host.GroupId is not { } id || !known.Contains(id)));
+        }
     }
 
     /// <summary>
@@ -9881,6 +9986,35 @@ internal sealed partial class VaultViewModel(
         Status = $"Renaming {row.Label}.";
     }
 
+    /// <summary>
+    /// Opens the tag editor for a specific row, from the settings page's per-row edit icon.
+    /// </summary>
+    /// <remarks>
+    /// A thin wrapper around <see cref="EditTag"/> rather than a second implementation of what it does. The
+    /// keychain screen's own table drives <see cref="EditTag"/> off a <c>ListBox</c> selection; the settings
+    /// page draws one card per tag with no such selection to lean on, so this puts the row on
+    /// <see cref="SelectedTag"/> first and then asks the command that already knows how to open it — the
+    /// same trick <see cref="EditGroupFromHeading"/> plays for a group, except that command took the row as
+    /// an argument from the start and this one did not, because nothing needed it to until now.
+    /// </remarks>
+    /// <param name="row">The tag to edit.</param>
+    [RelayCommand]
+    private void EditTagRow(TagRowViewModel? row)
+    {
+        SelectedTag = row;
+        EditTagCommand.Execute(null);
+    }
+
+    /// <summary>Arms the delete confirmation for a specific row, from the settings page's per-row delete icon.</summary>
+    /// <inheritdoc cref="EditTagRow" path="/remarks" />
+    /// <param name="row">The tag to ask about deleting.</param>
+    [RelayCommand]
+    private void DeleteTagRow(TagRowViewModel? row)
+    {
+        SelectedTag = row;
+        DeleteTagCommand.Execute(null);
+    }
+
     /// <summary>Abandons the tag editor.</summary>
     [RelayCommand]
     private void CancelTagEdit()
@@ -10341,6 +10475,35 @@ internal sealed partial class VaultViewModel(
         await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
     }
 
+    /// <summary>
+    /// Puts the selected pin's fingerprint on the clipboard.
+    /// </summary>
+    /// <remarks>
+    /// The twin of <see cref="CopyPublicKeyAsync"/> and the opposite call about secrecy: a host key
+    /// fingerprint is not one. Operators publish theirs on purpose, and the whole workflow this screen exists
+    /// for is comparing a pinned one against what was published — which is a copy-and-paste somebody should
+    /// not have to retype by hand out of a box that refuses to trim it.
+    /// </remarks>
+    [RelayCommand]
+    private async Task CopyPinFingerprintAsync()
+    {
+        if (SelectedKnownHost is not { } row)
+        {
+            Status = "Choose a pinned key first.";
+            return;
+        }
+
+        if (copyToClipboard is null)
+        {
+            Status = "This machine has no clipboard.";
+            return;
+        }
+
+        await copyToClipboard(row.Fingerprint).ConfigureAwait(true);
+
+        Status = $"Copied the fingerprint for {row.Host}.";
+    }
+
     /// <summary>
     /// Opens a terminal on the selected host.
     /// </summary>
@@ -10658,7 +10821,7 @@ internal sealed partial class VaultViewModel(
             Dialled(target, authentication));
 
         ConnectionStarting?.Invoke(this, attempt);
-        Status = $"Connecting to {target.Label}…";
+        SayAbout(attempt, $"Connecting to {target.Label}…");
 
         await OpenSessionAsync(attempt, target, authentication, cancellationToken).ConfigureAwait(true);
     }
@@ -10933,7 +11096,9 @@ internal sealed partial class VaultViewModel(
     /// </remarks>
     private void Abandon(ConnectionAttemptEventArgs attempt, string reason)
     {
-        Status = reason;
+        // Owned by the attempt, unlike Answer's own line below: this is the case where the tab stays, carrying
+        // the same reason, so closing that tab is exactly the moment the line stops being about anything.
+        SayAbout(attempt, reason);
 
         ConnectionFailed?.Invoke(
             this,
@@ -10988,7 +11153,14 @@ internal sealed partial class VaultViewModel(
         // only record that machine was reached at all.
         connectionLog?.Identify(sessionId, target.Label, target.HostId);
 
-        Status = $"Connected to {target.Label}.";
+        SayAbout(attempt, $"Connected to {target.Label}.");
+
+        // The session the workspace just opened is the only place the negotiated cipher and host-key
+        // algorithm live — an SshConnectionRequest asks for neither and gets no say in either — so they are
+        // read back here rather than carried forward from somewhere upstream that never had them. Absent only
+        // for a session that has already ended in the instant between opening it and asking, which the empty
+        // string collapses to on the status bar exactly as a session with nothing to report would.
+        var facts = workspace.GetSessionFacts(sessionId);
 
         // Only now, and only on success. The page's own term.focus() focuses the textarea inside the
         // document, which does nothing while the window's keyboard focus is still on the Connect button — so
@@ -10999,7 +11171,10 @@ internal sealed partial class VaultViewModel(
                 attempt.AttemptId,
                 sessionId,
                 target.Label,
-                Dialled(target, authentication)));
+                Dialled(target, authentication),
+                facts?.Cipher ?? string.Empty,
+                facts?.HostKeyAlgorithm ?? string.Empty,
+                authentication.IdentityLabel));
 
         // Last, and after the tab exists: keeping the password is a favour, and the session the user asked
         // for must not wait on a vault write to appear.
@@ -11009,7 +11184,8 @@ internal sealed partial class VaultViewModel(
         // screen it is typed on says so.
         if (target.Row is { } row)
         {
-            await RememberTypedPasswordAsync(row, authentication, cancellationToken).ConfigureAwait(true);
+            await RememberTypedPasswordAsync(attempt, row, authentication, cancellationToken)
+                .ConfigureAwait(true);
         }
     }
 
@@ -11041,6 +11217,7 @@ internal sealed partial class VaultViewModel(
     /// </para>
     /// </remarks>
     private async Task RememberTypedPasswordAsync(
+        ConnectionAttemptEventArgs attempt,
         HostRowViewModel row,
         HostAuthentication authentication,
         CancellationToken cancellationToken)
@@ -11056,8 +11233,10 @@ internal sealed partial class VaultViewModel(
 
         if (row.IsReadOnly)
         {
-            Status = $"Connected to {row.Label}. Its password was not saved: this host was written by a "
-                + "newer version of DodoSSH, and binding a credential would re-encode it.";
+            SayAbout(
+                attempt,
+                $"Connected to {row.Label}. Its password was not saved: this host was written by a newer "
+                + "version of DodoSSH, and binding a credential would re-encode it.");
             return;
         }
 
@@ -11081,7 +11260,9 @@ internal sealed partial class VaultViewModel(
         }
         catch (Exception exception)
         {
-            Status = $"Connected to {row.Label}, but its password could not be saved: {exception.Message}";
+            SayAbout(
+                attempt,
+                $"Connected to {row.Label}, but its password could not be saved: {exception.Message}");
             return;
         }
 
@@ -11092,8 +11273,10 @@ internal sealed partial class VaultViewModel(
 
         await ReloadAsync(cancellationToken).ConfigureAwait(true);
 
-        Status = $"Connected to {row.Label}. Its password is saved in your keychain as '{row.Label}', so it "
-            + "will not be asked for again.";
+        SayAbout(
+            attempt,
+            $"Connected to {row.Label}. Its password is saved in your keychain as '{row.Label}', so it will "
+            + "not be asked for again.");
 
         await AutoSyncAsync(cancellationToken).ConfigureAwait(true);
     }
@@ -11184,13 +11367,19 @@ internal sealed partial class VaultViewModel(
     /// </summary>
     /// <param name="Username">The account to log in as, after any credential has had its say.</param>
     /// <param name="Credential">What proves it.</param>
+    /// <param name="IdentityLabel">
+    /// The display name of the keychain item that authenticates — a key's or a credential's own
+    /// <c>Label</c> — or null when the password was typed rather than filed. Carried alongside the credential
+    /// so the session shell's status bar can name what actually authenticated without a second lookup back
+    /// into <see cref="Keys"/> or <see cref="Credentials"/> once the connection has moved on.
+    /// </param>
     /// <remarks>
     /// The two travel together because a credential can change both. Returning only the secret and reading the
     /// username off the host separately is what the connect path used to do, and it would have sent a stored
     /// credential's password under the host's username — which is the one combination that is wrong in a way
     /// the server reports as "authentication failed".
     /// </remarks>
-    private sealed record HostAuthentication(string Username, SshCredential Credential);
+    private sealed record HostAuthentication(string Username, SshCredential Credential, string? IdentityLabel = null);
 
     /// <summary>
     /// The machine a connection is being made to, however it was named.
@@ -11264,6 +11453,7 @@ internal sealed partial class VaultViewModel(
         HostSecret host,
         string typedPassword,
         [NotNullWhen(true)] out SshConnectionRequest? request,
+        out string? identityLabel,
         [NotNullWhen(false)] out string? reason)
     {
         ArgumentNullException.ThrowIfNull(host);
@@ -11273,6 +11463,7 @@ internal sealed partial class VaultViewModel(
         if (!TryBuildAuthentication(host, resolved, typedPassword, out var authentication, out reason))
         {
             request = null;
+            identityLabel = null;
             return false;
         }
 
@@ -11282,6 +11473,8 @@ internal sealed partial class VaultViewModel(
             authentication.Username,
             authentication.Credential);
 
+        identityLabel = authentication.IdentityLabel;
+
         return true;
     }
 
@@ -11333,6 +11526,7 @@ internal sealed partial class VaultViewModel(
             return Complete(
                 credential.Credential.Username ?? resolved.Username.Value,
                 new SshPasswordCredential(credential.Credential.Password),
+                credential.Label,
                 out authentication,
                 out reason);
         }
@@ -11351,13 +11545,18 @@ internal sealed partial class VaultViewModel(
                 resolved.Username.Value,
                 new SshPrivateKeyCredential(
                     Encoding.UTF8.GetBytes(key.Key.PrivateKeyPem), key.Key.Passphrase),
+                key.Label,
                 out authentication,
                 out reason);
         }
 
+        // No item to name: a typed password has nothing filed in the keychain, and IdentityLabel stays null —
+        // the default Complete's own signature gives it — rather than the placeholder text a display-only
+        // fallback would tempt someone to invent.
         return Complete(
             resolved.Username.Value,
             new SshPasswordCredential(typedPassword),
+            identityLabel: null,
             out authentication,
             out reason);
     }
@@ -11381,6 +11580,7 @@ internal sealed partial class VaultViewModel(
     private static bool Complete(
         string? username,
         SshCredential credential,
+        string? identityLabel,
         out HostAuthentication? authentication,
         [NotNullWhen(false)] out string? reason)
     {
@@ -11392,7 +11592,7 @@ internal sealed partial class VaultViewModel(
                 out reason);
         }
 
-        authentication = new HostAuthentication(username, credential);
+        authentication = new HostAuthentication(username, credential, identityLabel);
         reason = null;
         return true;
     }

src/DodoSSH.Client.Shell/ViewModels/VaultsViewModel.cs

@@ -107,6 +107,9 @@ internal sealed record VaultRowViewModel(
     };
 
     internal bool HasState => State.Length > 0;
+
+    /// <summary>The single letter the settings page's card draws on this vault's tile.</summary>
+    internal string Initial => Name.Length > 0 ? Name[..1].ToUpperInvariant() : "?";
 }
 
 /// <summary>One member of a vault, as a row in the members table.</summary>
@@ -153,6 +156,32 @@ internal sealed record VaultMemberRowViewModel(TeamMemberSummary Member, bool Is
 
     internal bool CanBeRemoved => Member.Role != TeamMemberRole.Owner;
 
+    /// <summary>
+    /// The two letters the members panel draws on this row's avatar.
+    /// </summary>
+    /// <remarks>
+    /// The same rule <c>HostRowViewModel.Monogram</c> draws a card's monogram by — the first letters of the
+    /// first two words in the name, or the first two characters where it is one word — except uppercase,
+    /// which is how the design draws a person's initials rather than a host's.
+    /// </remarks>
+    internal string Initials
+    {
+        get
+        {
+            var words = Name.Split(
+                InitialsWordSeparators,
+                StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+            var letters = words.Length >= 2
+                ? string.Concat(words[0][0], words[1][0])
+                : Name.Length >= 2 ? Name[..2] : Name;
+
+            return letters.ToUpperInvariant();
+        }
+    }
+
+    private static readonly char[] InitialsWordSeparators = [' ', '-', '_', '.'];
+
     /// <summary>Whether this member's role can be changed at all.</summary>
     /// <remarks>
     /// The owner's cannot, and not for want of an endpoint: ownership is sole, so demoting them is
@@ -312,6 +341,33 @@ internal sealed partial class VaultsViewModel(
     [ObservableProperty]
     private bool isBusy;
 
+    /// <summary>
+    /// Whether the members panel — v5c's settings-page overlay over the selected vault's people — is open.
+    /// </summary>
+    /// <remarks>
+    /// Desktop-only presentation state, not a fact about any vault: it says which rectangle is on screen and
+    /// nothing else. Selecting a vault is what actually reads its members, in
+    /// <see cref="OnSelectedVaultChanged"/>; opening this panel over one already selected re-reads nothing.
+    /// </remarks>
+    [ObservableProperty]
+    private bool isMembersPanelOpen;
+
+    /// <summary>Opens the members panel, selecting the vault it is about first if it is not selected already.</summary>
+    [RelayCommand]
+    private void OpenMembersPanel(VaultRowViewModel? vault)
+    {
+        if (vault is not null && !ReferenceEquals(vault, SelectedVault))
+        {
+            SelectedVault = vault;
+        }
+
+        IsMembersPanelOpen = true;
+    }
+
+    /// <summary>Closes the members panel.</summary>
+    [RelayCommand]
+    private void CloseMembersPanel() => IsMembersPanelOpen = false;
+
     // ---- Creating a vault ----
 
     [ObservableProperty]
@@ -824,6 +880,38 @@ internal sealed partial class VaultsViewModel(
         Status = string.Empty;
     }
 
+    /// <summary>Opens the rename form for a specific vault, from the settings page's per-card edit icon.</summary>
+    /// <remarks>
+    /// A thin wrapper around <see cref="RenameVault"/> rather than a second implementation: the settings
+    /// page draws one card per vault with no list selection to lean on the way this screen used to have, so
+    /// this selects the row first and then asks the command that already knows how to open the form.
+    /// </remarks>
+    /// <param name="vault">The vault to rename.</param>
+    [RelayCommand]
+    private void RenameVaultRow(VaultRowViewModel? vault)
+    {
+        if (vault is not null)
+        {
+            SelectedVault = vault;
+        }
+
+        RenameVaultCommand.Execute(null);
+    }
+
+    /// <summary>Arms the delete confirmation for a specific vault, from the settings page's per-card delete icon.</summary>
+    /// <inheritdoc cref="RenameVaultRow" path="/remarks" />
+    /// <param name="vault">The vault to ask about deleting.</param>
+    [RelayCommand]
+    private void DeleteVaultRow(VaultRowViewModel? vault)
+    {
+        if (vault is not null)
+        {
+            SelectedVault = vault;
+        }
+
+        DeleteVaultCommand.Execute(null);
+    }
+
     /// <summary>
     /// Saves the renamed vault.
     /// </summary>
@@ -1538,6 +1626,13 @@ internal sealed partial class VaultsViewModel(
         PendingAction = null;
         IsRenamingVault = false;
 
+        // The members panel is drawn over one vault's people; a selection that clears altogether — the
+        // vault it was showing got deleted, or the list emptied — leaves nothing for it to be about.
+        if (value is null)
+        {
+            IsMembersPanelOpen = false;
+        }
+
         if (isReselecting)
         {
             return;

src/DodoSSH.Client.Shell/WebAssets/terminal.js

@@ -3,7 +3,7 @@
 /*
   The renderer half of the terminal data plane.
 
-  Two things here are load-bearing and easy to get wrong:
+  Three things here are load-bearing and easy to get wrong:
 
   1. Output is acknowledged from term.write's completion callback, never on receipt. The
      acknowledgement returns flow-control credit to the host, so acknowledging early would tell
@@ -15,6 +15,14 @@
      partial sequences across writes. Decoding here would corrupt any multi-byte character that
      happened to straddle a frame boundary, which shows up as occasional mojibake in exactly the
      conditions that are hardest to reproduce.
+
+  3. The socket reconnects itself, forever, with backoff. This page's WebView is routinely killed
+     and reloaded by Android under memory pressure or simply for being backgrounded, so "the
+     socket closed" is an ordinary event here, not the end of the terminal's life — see connect().
+     A reloaded page starts with an empty session map, so createSession is idempotent (a session
+     that already has a pane is left alone) and a SESSION_OPENED frame carries a flag telling this
+     page whether it is a replay: nothing to do for a pane that is still here, and a short banner
+     for one that is not, because that pane's scrollback genuinely did not survive.
 */
 
 const SERVER_OUTPUT = 1;
@@ -33,6 +41,25 @@ const CLIENT_FONT_SIZE_STEP = 4;
 const HEADER_LENGTH = 5;
 const SCROLLBACK_LINES = 5000;
 
+/*
+  How long to wait before trying the socket again, and how that wait grows. Starting quick matters
+  because the ordinary case is a page that just finished loading after its WebView came back — the
+  host's listener has been sitting there the whole time — and capping it matters because there is no
+  point spacing attempts further apart than a person notices. Forever rather than giving up, because
+  giving up would need a way to try again and there is none better than the one already here: the page
+  dies with the app.
+*/
+const RECONNECT_INITIAL_DELAY_MS = 1000;
+const RECONNECT_MAX_DELAY_MS = 5000;
+
+/*
+  Styled like the SESSION_CLOSED banner (matching \x1b[38;5;244, the same dim grey), but written by
+  createSession's caller rather than by createSession itself: only a *replay* landing on a pane that
+  does not exist yet means the page reloaded and lost it, and createSession has no way to know which
+  of its callers that is.
+*/
+const REPLAY_BANNER = '\x1b[38;5;244m── the view reconnected; earlier output stayed on the host ──\x1b[0m\r\n';
+
 /*
   The size panes are created at, until the host says otherwise — which it does as soon as it has read
   the stored preference, usually before the first session exists. Kept here as well so a pane opened
@@ -192,7 +219,19 @@ function handleKey(event) {
   return true;
 }
 
+/**
+ * Builds a pane for a session, or returns the one already there.
+ *
+ * Idempotent because a replay can land on a page that never lost its pane — the socket dropped and
+ * came back, but this page's own process survived — and asking for a session that already has a pane
+ * must not build a second one on top of it, orphaning the first one's WebGL context and scrollback.
+ */
 function createSession(sessionId) {
+  const existing = sessions.get(sessionId);
+  if (existing) {
+    return existing;
+  }
+
   const pane = document.createElement('div');
   pane.className = 'pane';
   pane.dataset.sessionId = String(sessionId);
@@ -290,10 +329,23 @@ function handleFrame(buffer) {
   const payload = new Uint8Array(buffer, HEADER_LENGTH);
 
   switch (opcode) {
-    case SERVER_SESSION_OPENED:
-      createSession(sessionId);
+    case SERVER_SESSION_OPENED: {
+      // Checked before createSession, which would otherwise erase the answer by creating the pane
+      // this check is asking about.
+      const hadPaneAlready = sessions.has(sessionId);
+      const session = createSession(sessionId);
+
+      // Byte 1 means the host is replaying a session that existed before this socket attached — see
+      // TerminalWorkspace.ReplayAfterAttachAsync. A replay landing on a pane that is still here has
+      // nothing left to do beyond the idempotent create above; one landing on a pane that is not means
+      // this page reloaded and that pane's scrollback went with it, which is worth a line saying so.
+      if (payload.length > 0 && payload[0] === 1 && !hadPaneAlready) {
+        session.term.write(REPLAY_BANNER);
+      }
+
       setStatus('');
       break;
+    }
 
     case SERVER_OUTPUT: {
       const session = sessions.get(sessionId) ?? createSession(sessionId);
@@ -414,6 +466,31 @@ function handleFrame(buffer) {
   }
 }
 
+/** @type {number | null} */
+let reconnectTimer = null;
+let reconnectDelay = RECONNECT_INITIAL_DELAY_MS;
+
+/**
+ * Tries the socket again after a wait, unless a try is already pending.
+ *
+ * The guard is what keeps 'close' and 'error' from stacking two timers for one failure — a socket
+ * that fails to open typically fires both, and each would otherwise schedule its own reconnect.
+ */
+function scheduleReconnect() {
+  if (reconnectTimer !== null) {
+    return;
+  }
+
+  setStatus('Reconnecting the terminal view…');
+
+  reconnectTimer = setTimeout(() => {
+    reconnectTimer = null;
+    connect();
+  }, reconnectDelay);
+
+  reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_DELAY_MS);
+}
+
 function connect() {
   const token = root.dataset.token;
   const url = root.dataset.socket;
@@ -423,16 +500,22 @@ function connect() {
   socket = new WebSocket(url, ['dodossh.terminal.v1', `token.${token}`]);
   socket.binaryType = 'arraybuffer';
 
-  socket.addEventListener('open', () => setStatus(''));
+  socket.addEventListener('open', () => {
+    setStatus('');
+
+    // Back to the quick attempt for whatever the next failure turns out to be. Kept slow between
+    // attempts within one outage, reset once the outage is actually over.
+    reconnectDelay = RECONNECT_INITIAL_DELAY_MS;
+  });
+
   socket.addEventListener('message', (event) => handleFrame(event.data));
 
-  socket.addEventListener('close', () => {
-    setStatus('Disconnected from DodoSSH.');
-  });
-
-  socket.addEventListener('error', () => {
-    setStatus('The terminal connection failed.');
-  });
+  // Both close and error retry. They are not the same event on every failure — a socket that never
+  // opens can fire only 'error', one that opens and later drops fires only 'close' — and the host
+  // side of this same problem (TerminalDataPlane.UpgradeAsync's takeover) is exactly why retrying is
+  // safe: whichever attempt eventually reaches the host, a fresh valid upgrade always wins the socket.
+  socket.addEventListener('close', scheduleReconnect);
+  socket.addEventListener('error', scheduleReconnect);
 }
 
 // One observer for the whole root rather than one per pane: resizes arrive in bursts while a

src/DodoSSH.Client.Ssh/SftpSession.cs

@@ -265,6 +265,17 @@ public interface ISftpSession : IRemoteFileStore
 {
     /// <summary>The host key that was accepted for this session.</summary>
     HostKeyPresentation HostKey { get; }
+
+    /// <summary>
+    /// The negotiated server-to-client encryption algorithm, e.g. <c>aes256-gcm@openssh.com</c>.
+    /// </summary>
+    /// <remarks>
+    /// The same fact <see cref="ISshConnection.Cipher"/> is, read the same way — off SSH.NET's
+    /// <c>ConnectionInfo.CurrentServerEncryption</c> once the handshake this session's own connect performed
+    /// has finished — and for the same reason: <c>SftpClient</c> derives from <c>BaseClient</c> exactly as
+    /// <c>SshClient</c> does, and rekeys are no more visible here than they are there. See that member's remark.
+    /// </remarks>
+    string Cipher { get; }
 }
 
 /// <summary>

src/DodoSSH.Client.Ssh/SshConnection.cs

@@ -98,6 +98,25 @@ public interface ISshConnection : IAsyncDisposable
     /// <summary>The host key that was accepted for this connection.</summary>
     HostKeyPresentation HostKey { get; }
 
+    /// <summary>
+    /// The negotiated server-to-client encryption algorithm, e.g. <c>aes256-gcm@openssh.com</c>.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Read once, immediately after the handshake, off SSH.NET's own <c>ConnectionInfo.CurrentServerEncryption</c>.
+    /// The only event that could make this stale is a rekey, and SSH.NET raises no event for one and exposes no
+    /// way to ask again — there is nothing behind this property to go and re-read. A captured value is therefore
+    /// not a snapshot that might drift; it is the only value there has ever been a moment to observe.
+    /// </para>
+    /// <para>
+    /// <b>Server-to-client, not client-to-server.</b> SSH negotiates the two directions independently and a
+    /// server is free to choose differently for each, so the two can in principle disagree. This is the
+    /// direction the bytes drawn on a terminal pane travelled in, which is the fact a status bar showing what
+    /// the screen is made of should be naming.
+    /// </para>
+    /// </remarks>
+    string Cipher { get; }
+
     /// <summary>Opens an interactive shell with a pseudo-terminal.</summary>
     Task<ISshShellSession> OpenShellAsync(TerminalSize size, CancellationToken cancellationToken);
 }

src/DodoSSH.Client.Ssh/SshNetConnectionFactory.cs

@@ -274,6 +274,16 @@ internal sealed class SshNetConnection(SshClient client, HostKeyPresentation hos
     /// <inheritdoc />
     public HostKeyPresentation HostKey { get; } = hostKey;
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// Read at construction rather than lazily: by the time an <see cref="SshNetConnection"/> exists,
+    /// <see cref="SshNetConnectionFactory.ConnectAsync"/> has already awaited <c>client.ConnectAsync</c>, so
+    /// <c>ConnectionInfo</c> is already populated and there is no earlier moment reading it would race. SSH.NET
+    /// types the property as a non-nullable <c>string</c>, so this reads straight through rather than coalescing
+    /// a null that the library's own contract says cannot occur.
+    /// </remarks>
+    public string Cipher { get; } = client.ConnectionInfo.CurrentServerEncryption;
+
     /// <inheritdoc />
     public Task<ISshShellSession> OpenShellAsync(TerminalSize size, CancellationToken cancellationToken)
     {

src/DodoSSH.Client.Ssh/SshNetSftpSession.cs

@@ -20,6 +20,14 @@ internal sealed class SshNetSftpSession(SftpClient client, HostKeyPresentation h
     /// <inheritdoc />
     public HostKeyPresentation HostKey { get; } = hostKey;
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// Read at construction, the same way and for the same reason as <c>SshNetConnection.Cipher</c>: this type
+    /// is only ever built after <c>SshNetConnectionFactory.OpenSftpAsync</c> has awaited <c>client.ConnectAsync</c>,
+    /// so <c>ConnectionInfo</c> is already populated by the time there is a session to read it from.
+    /// </remarks>
+    public string Cipher { get; } = client.ConnectionInfo.CurrentServerEncryption;
+
     /// <inheritdoc />
     public string HomeDirectory { get; } = homeDirectory;
 

src/DodoSSH.Client.Terminal/TerminalDataPlane.cs

@@ -66,7 +66,6 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
         new(TaskCreationOptions.RunContinuationsAsynchronously);
 
     private WebSocket? socket;
-    private int accepted;
     private int disposed;
 
     /// <param name="assets">Where the renderer's files come from.</param>
@@ -106,6 +105,26 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
     /// </remarks>
     public event EventHandler<TerminalFontSizeStepEventArgs>? FontSizeStepRequested;
 
+    /// <summary>
+    /// Raised after a socket attaches — the first one, and every later takeover.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Raised after <see cref="socket"/> has been swapped in but before <see cref="ReceiveLoopAsync"/> starts
+    /// consuming it, on the socket-accept thread — the same thread that is in the middle of
+    /// <see cref="UpgradeAsync"/> for this connection. <see cref="TerminalWorkspace"/> is this event's one
+    /// subscriber, and it uses the ordering to replay session state before anything the fresh page sends
+    /// (a resize, an early acknowledgement) can be dispatched; see its remark for why the two racing is
+    /// harmless regardless.
+    /// </para>
+    /// <para>
+    /// Unlike <see cref="RendererAttached"/>, which resolves once and answers "has a renderer ever attached"
+    /// for <see cref="TerminalWorkspace.WaitForRendererAsync"/>, this fires every time — because a takeover
+    /// is exactly the case <see cref="RendererAttached"/> was never meant to describe again.
+    /// </para>
+    /// </remarks>
+    public event EventHandler? SocketAttached;
+
     /// <summary>Registers a session so inbound frames can be routed to it.</summary>
     public void Register(uint sessionId, TerminalSessionPump pump)
     {
@@ -148,8 +167,9 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
             // Each connection on its own task, and deliberately not awaited. An upgraded WebSocket
             // lives for the whole session, so handling connections in sequence would leave the accept
             // loop parked inside the receive loop and every later request unanswered — the page's
-            // script and stylesheet among them. Concurrency needs no coordination here because the
-            // single-attach guard is an interlocked exchange.
+            // script and stylesheet among them. Two upgrades racing each other need no coordination
+            // here either, because the takeover in UpgradeAsync swaps the shared socket field with an
+            // interlocked exchange rather than assuming it is the only writer.
             _ = HandleConnectionAsync(client, linked.Token);
         }
     }
@@ -192,6 +212,29 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
                 .SendAsync(frame, WebSocketMessageType.Binary, endOfMessage: true, cancellationToken)
                 .ConfigureAwait(false);
         }
+        catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
+        {
+            // Not a cancellation despite the type: .NET's ManagedWebSocket wraps a send that fails because
+            // the underlying connection is already gone — which is exactly what a killed renderer's socket
+            // looks like — in an OperationCanceledException of its own manufacture, regardless of whether
+            // anyone actually cancelled anything. The filter is what tells the two apart: if the caller's
+            // own token were the cause, IsCancellationRequested would be true here and this catch does not
+            // apply, so a real cancellation still propagates. Everything below about why this must not
+            // fault the caller applies here exactly as it does to the exception types in the next catch.
+        }
+        catch (Exception exception)
+            when (exception is WebSocketException or ObjectDisposedException
+                or InvalidOperationException or IOException)
+        {
+            // The state check above is not atomic with the send, and a WebView renderer process killed by
+            // Android leaves its socket reporting Open long after nobody is reading from the other end. This
+            // has to read as "nobody listening" — the same as the no-socket case above — and never as a
+            // fault: SendAsync is called from TerminalSessionPump.SendOutputAsync inside the flush loop, and
+            // letting this exception escape would fault that loop. A faulted flush loop stops draining the
+            // credit window, the reader blocks once it fills, and the SSH session behind it freezes for good
+            // while LiveSessionCount still counts it as running. A dropped frame is recoverable — a frozen
+            // session is not.
+        }
         finally
         {
             sendGate.Release();
@@ -267,6 +310,25 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
             .ConfigureAwait(false);
     }
 
+    /// <remarks>
+    /// <para>
+    /// <b>Takeover, not rejection.</b> A valid upgrade always wins the socket, even when one is already
+    /// attached — the old socket is aborted and the newcomer takes its place. Refusing a second attach used
+    /// to be the rule, on the theory that one renderer lives for the whole process. That is WebView2's
+    /// truth and not Android's: the platform kills the WebView's renderer process under memory pressure or
+    /// simply for being backgrounded, the page reloads, and the reload's socket is a second valid upgrade —
+    /// refusing it left the terminal permanently unreachable with no way back short of restarting the app.
+    /// </para>
+    /// <para>
+    /// Refusing protects nothing here anyway: only our own page knows the token (see the type-level remark
+    /// on what the token defends against), so a second valid upgrade <em>is</em> our page, reattaching.
+    /// Waiting for the old socket to notice it is dead and close on its own is not a safer alternative
+    /// either — a killed renderer process sends no TCP FIN, so the old receive loop can sit unaware for the
+    /// whole 30-second keepalive interval, and every reload landing in that window would still find the
+    /// door held shut by a socket nobody is on the other end of. Taking over immediately is what makes a
+    /// reload actually reattach.
+    /// </para>
+    /// </remarks>
     private async Task UpgradeAsync(
         Stream stream,
         HttpRequestLine request,
@@ -280,16 +342,6 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
             return;
         }
 
-        if (Interlocked.Exchange(ref accepted, 1) == 1)
-        {
-            // One renderer, one socket. A second attach would be either a bug or something else on the
-            // machine having found the port.
-            await WriteResponseAsync(
-                    stream, "409 Conflict", "text/plain", "Already attached"u8.ToArray(), cancellationToken)
-                .ConfigureAwait(false);
-            return;
-        }
-
         var key = request.Headers.GetValueOrDefault("sec-websocket-key")!;
         var accept = ComputeHandshakeAccept(key);
 
@@ -314,10 +366,28 @@ public sealed class TerminalDataPlane : ITerminalTransport, IAsyncDisposable
                 KeepAliveInterval = TimeSpan.FromSeconds(30),
             });
 
-        socket = webSocket;
-        rendererAttached.TrySetResult();
+        // Whatever was attached before is displaced, not merely overwritten: Exchange hands back the old
+        // reference so it can be aborted rather than left to linger as a socket nothing reads from again.
+        // Abort rather than a graceful close — a close frame would wait on a peer that, per the remark
+        // above, may never notice it should reply, and the newcomer already proved it is our page.
+        var previous = Interlocked.Exchange(ref socket, webSocket);
+        previous?.Abort();
 
-        await ReceiveLoopAsync(webSocket, cancellationToken).ConfigureAwait(false);
+        rendererAttached.TrySetResult();
+        SocketAttached?.Invoke(this, EventArgs.Empty);
+
+        try
+        {
+            await ReceiveLoopAsync(webSocket, cancellationToken).ConfigureAwait(false);
+        }
+        finally
+        {
+            // Cleared only if the field still holds this connection's own socket. A takeover has already
+            // swapped in a newer one by the time an aborted receive loop unwinds to here, and clearing the
+            // field regardless would race the newcomer: whichever of the two finished last would win, and
+            // it must always be the newcomer, never this one going away.
+            Interlocked.CompareExchange(ref socket, null, webSocket);
+        }
     }
 
     /// <remarks>

src/DodoSSH.Client.Terminal/TerminalWorkspace.cs

@@ -37,6 +37,18 @@ public sealed class TerminalSessionEndedEventArgs(uint sessionId) : EventArgs
     public uint SessionId { get; } = sessionId;
 }
 
+/// <summary>
+/// The negotiated cipher and host-key algorithm for one live session.
+/// </summary>
+/// <param name="Cipher">The server-to-client encryption algorithm; see <see cref="ISshConnection.Cipher"/>.</param>
+/// <param name="HostKeyAlgorithm">The host key's algorithm, e.g. <c>ssh-ed25519</c>.</param>
+/// <remarks>
+/// Two facts rather than the whole <see cref="ISshConnection"/>, because that is all a caller outside this
+/// assembly has any business reading off a session it does not own — everything else on the connection
+/// (disposal, the shell) belongs to the workspace alone. See <see cref="TerminalWorkspace.GetSessionFacts"/>.
+/// </remarks>
+public sealed record SessionFacts(string Cipher, string HostKeyAlgorithm);
+
 /// <summary>The renderer asking for a different font size.</summary>
 /// <param name="step">
 /// How far to move, in points of font size, or zero to go back to the default. It is a step rather than a
@@ -89,6 +101,13 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     private readonly Lock sessionGate = new();
     private readonly CancellationTokenSource lifetime = new();
 
+    /// <summary>
+    /// The payload that marks a <see cref="TerminalServerOpcode.SessionOpened"/> frame as a replay rather
+    /// than a fresh open. A one-byte non-empty payload, so terminal.js's existing length check (empty
+    /// payload for a real open) tells the two apart without a second opcode.
+    /// </summary>
+    private static readonly byte[] ReplayMarker = [1];
+
     private uint nextSessionId = 1;
     private Task? server;
     private int disposed;
@@ -113,6 +132,12 @@ public sealed class TerminalWorkspace : IAsyncDisposable
         // came from. Nothing here decides anything about the size: the shell owns it, because the shell is
         // what remembers it between launches.
         dataPlane.FontSizeStepRequested += (_, e) => FontSizeStepRequested?.Invoke(this, e);
+
+        // Fire-and-forget: this fires on the socket-accept thread, in the middle of the data plane's own
+        // handshake handling, and has no business making that wait on however long a replay takes. See
+        // ReplayAfterAttachAsync for what "replay" means and why racing the fresh page's own first frames
+        // is harmless.
+        dataPlane.SocketAttached += (_, _) => _ = ReplayAfterAttachAsync();
     }
 
     /// <summary>
@@ -181,7 +206,59 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     }
 
     /// <summary>
-    /// Raised with the session id when a shell ends on its own.
+    /// The negotiated cipher and host-key algorithm for one live session, or null when the id names no
+    /// session this workspace still has open.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Additive, and deliberately narrow: the caller this exists for — the shell's own connect path, which
+    /// wants these two facts for its status bar — has no other business with a session it does not own, and a
+    /// method that handed back the <see cref="ISshConnection"/> itself would have handed over the shell,
+    /// disposal and all, to code that already goes through <see cref="CloseSessionAsync"/> for that.
+    /// </para>
+    /// <para>
+    /// "No session this workspace still has open" covers two different absences the same way
+    /// <see cref="IsSessionLive"/> already does: an id this workspace never issued, and one whose shell has
+    /// already ended but whose entry has not been removed yet. Both are "nothing to report" to a caller
+    /// asking what a session's transport looks like right now.
+    /// </para>
+    /// </remarks>
+    public SessionFacts? GetSessionFacts(uint sessionId)
+    {
+        lock (sessionGate)
+        {
+            if (!sessions.TryGetValue(sessionId, out var session) || session.Run.IsCompleted)
+            {
+                return null;
+            }
+
+            return new SessionFacts(session.Connection.Cipher, session.Connection.HostKey.Algorithm);
+        }
+    }
+
+    /// <summary>
+    /// A live session's flow-control window, or null when the id names no session this workspace still has
+    /// open.
+    /// </summary>
+    /// <remarks>
+    /// A test seam rather than something the shell has ever needed: nothing outside this assembly has a
+    /// reason to see a pump's credit window rather than what the transport does with it, but
+    /// <see cref="ReplayAfterAttachAsync"/>'s reset of that window on reattach is exactly the kind of thing
+    /// that is easy to get backwards, and worth asserting directly rather than only through its side
+    /// effects. Internal rather than public, reachable from the test assembly through the
+    /// <c>InternalsVisibleTo</c> this project already declares for it.
+    /// </remarks>
+    internal CreditWindow? CreditsFor(uint sessionId)
+    {
+        lock (sessionGate)
+        {
+            return sessions.TryGetValue(sessionId, out var session) ? session.Pump.Credits : null;
+        }
+    }
+
+    /// <summary>
+    /// Raised with the session id once a session is over — its shell having ended on its own, or a
+    /// deliberate close having fully drained.
     /// </summary>
     /// <remarks>
     /// <para>
@@ -192,13 +269,23 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     /// the half of the interface Avalonia draws.
     /// </para>
     /// <para>
-    /// <b>Raised on whatever thread the pump finished on</b>, which is a thread-pool thread. A handler that
-    /// touches an observable collection has to marshal; this type has no toolkit to do it with, which is
-    /// exactly why it does not try.
+    /// <b>Raised only after the session's run task has completed, and that ordering is load-bearing.</b>
+    /// It used to fire from inside the run's own finally block, where the task is by definition not yet
+    /// complete — so a handler reading <see cref="LiveSessionCount"/> still counted the session that had
+    /// just ended, which is how the phone's foreground notification went on saying "1 shell connected"
+    /// over nothing. See <see cref="AnnounceEndedAsync"/>. Raised on a thread-pool continuation, or on the
+    /// closer's own thread; a handler that touches an observable collection has to marshal either way.
     /// </para>
     /// <para>
-    /// Not raised by <see cref="CloseSessionAsync"/>. That path already has a caller who knows the session is
-    /// going, and telling it what it just asked for is how a tab close turns into a second tab close.
+    /// <b>Raised by <see cref="CloseSessionAsync"/> too, which reverses a recorded decision.</b> The old
+    /// reasoning — the caller asked, so telling it is an echo — assumed every subscriber was the caller.
+    /// The phone's keep-alive is not: it hears this event to reconcile a notification with reality, and a
+    /// close that announced nothing left that notification claiming a shell that was gone. Every subscriber
+    /// treats the event as "reconcile" rather than "act" — a tab is marked dead if it is still there and
+    /// skipped if it is not — so a second announcement for a session that already announced its own end
+    /// (closing the tab of a shell that exited earlier) is deliberate and harmless. Shutdown is the one
+    /// close that stays silent: <see cref="DisposeAsync"/> is tearing the subscribers down with the
+    /// sessions, and news nobody is left to hear is not news.
     /// </para>
     /// </remarks>
     public event EventHandler<TerminalSessionEndedEventArgs>? SessionEnded;
@@ -211,6 +298,24 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     /// </remarks>
     public event EventHandler<TerminalFontSizeStepEventArgs>? FontSizeStepRequested;
 
+    /// <summary>
+    /// Raised once a (re)attached renderer has been sent everything this workspace owns for it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The workspace's own share of "put the page back the way it was" is the sessions — each live one gets
+    /// its <c>SessionOpened</c> frame again, done by the time this fires. What is left is what the workspace
+    /// has no business owning: the font size and which tab is selected are both remembered by the shell, not
+    /// by a terminal, so this is the seam the shell uses to re-push them. See
+    /// <c>MainWindowViewModel</c>'s subscription for the other half.
+    /// </para>
+    /// <para>
+    /// Raised on the socket-accept thread, same as <see cref="TerminalDataPlane.SocketAttached"/> that
+    /// triggers it — a handler that touches a view model has to marshal.
+    /// </para>
+    /// </remarks>
+    public event EventHandler? RendererReattached;
+
     /// <summary>Starts the loopback listener.</summary>
     public void Start() => server = dataPlane.RunAsync(lifetime.Token);
 
@@ -309,6 +414,10 @@ public sealed class TerminalWorkspace : IAsyncDisposable
             sessions[sessionId] = new LiveSession(connection, pump, run);
         }
 
+        // The announcement's own continuation — see AnnounceEndedAsync. Started after the entry is stored,
+        // so the containment check inside it can never run against a dictionary the session had not reached.
+        _ = AnnounceEndedAsync(sessionId, run);
+
         return sessionId;
     }
 
@@ -480,6 +589,14 @@ public sealed class TerminalWorkspace : IAsyncDisposable
         {
             // Expected on the ordinary path: disposing the pump cancels its run.
         }
+
+        // After the drain, so a handler reading LiveSessionCount sees this session already gone — the
+        // event's own remark carries why a deliberate close is announced at all, and why shutdown is not:
+        // DisposeAsync sets the flag before its closing loop, and is dismantling every subscriber anyway.
+        if (Volatile.Read(ref disposed) == 0)
+        {
+            SessionEnded?.Invoke(this, new TerminalSessionEndedEventArgs(sessionId));
+        }
     }
 
     /// <inheritdoc />
@@ -520,6 +637,71 @@ public sealed class TerminalWorkspace : IAsyncDisposable
         lifetime.Dispose();
     }
 
+    /// <summary>
+    /// Rebuilds a freshly (re)attached page's idea of what is running, then tells the shell to rebuild its
+    /// own.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Runs on the socket-accept thread that raised <see cref="TerminalDataPlane.SocketAttached"/> — the
+    /// constructor wires it up fire-and-forget for exactly that reason, so this method owns its own error
+    /// handling rather than leaving an unobserved exception for nobody to see.
+    /// </para>
+    /// <para>
+    /// Every live session — one whose <c>Run</c> has not completed — gets two things. Its credit window is
+    /// reset, because whatever was outstanding was reserved against bytes sent to a page that is now gone;
+    /// the acknowledgement that would return that credit died with it, and without this reset the session
+    /// would stall the moment 256 KiB of history had accumulated. And it gets its <c>SessionOpened</c> frame
+    /// again, marked with <see cref="ReplayMarker"/> so the page can tell a reattach from a session that is
+    /// genuinely new — the same frame a page that survived the socket drop already has a pane for, and one a
+    /// reloaded page does not.
+    /// </para>
+    /// <para>
+    /// A session whose shell has already ended gets nothing here. Its scrollback lived only in the page that
+    /// is gone, and sending a frame that implied otherwise would be exactly the kind of dishonesty this
+    /// fix is supposed to remove, not add. The tab strip still shows that session ended; nothing about this
+    /// method changes what <see cref="LiveSessionCount"/> or <see cref="IsSessionLive"/> report.
+    /// </para>
+    /// <para>
+    /// This can race the fresh page's own first frames — an early resize, an acknowledgement for output it
+    /// already had. That is harmless: every frame in both directions names its session, delivery order
+    /// within a session is preserved by both xterm and the socket, and a frame for a pane the page has not
+    /// created yet is simply dropped, the same as any frame for a session it does not know — see
+    /// <c>terminal.js</c>'s <c>handleFrame</c>.
+    /// </para>
+    /// </remarks>
+    private async Task ReplayAfterAttachAsync()
+    {
+        KeyValuePair<uint, LiveSession>[] live;
+
+        lock (sessionGate)
+        {
+            live = [.. sessions.Where(entry => !entry.Value.Run.IsCompleted)];
+        }
+
+        try
+        {
+            foreach (var (sessionId, session) in live)
+            {
+                session.Pump.Credits.Reset();
+
+                await dataPlane
+                    .SendAsync(
+                        TerminalFrame.Create((byte)TerminalServerOpcode.SessionOpened, sessionId, ReplayMarker),
+                        CancellationToken.None)
+                    .ConfigureAwait(false);
+            }
+
+            RendererReattached?.Invoke(this, EventArgs.Empty);
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException)
+        {
+            // Best-effort, same as every other fire-and-forget path here: a page that dies again mid-replay
+            // leaves nothing worse than the problem this method exists to fix, and there is no caller on
+            // this thread left to hand a failure to.
+        }
+    }
+
     private async Task RunSessionAsync(uint sessionId, TerminalSessionPump pump)
     {
         try
@@ -535,21 +717,51 @@ public sealed class TerminalWorkspace : IAsyncDisposable
             // the pump unwinding, which is why CloseSessionAsync needs no call of its own — and why this
             // must not do any work: it is running on a thread-pool thread inside DisposeAsync's loop when
             // the application is closing.
+            //
+            // SessionEnded is deliberately NOT raised from here, and it used to be — see
+            // AnnounceEndedAsync for what was wrong with that.
             ConnectionLog?.Closed(sessionId, clock.GetUtcNow());
+        }
+    }
 
-            // Only when the session is still one this workspace knows about. CloseSessionAsync removes the
-            // entry before it disposes the pump, so a tab the user closed does not come back as news.
-            bool announce;
+    /// <summary>Announces a session's end once its run task has actually completed.</summary>
+    /// <remarks>
+    /// <para>
+    /// A continuation rather than a line in <see cref="RunSessionAsync"/>'s finally, and the difference is
+    /// what a handler sees. Inside that finally the run task is not yet complete — a finally is part of the
+    /// task — so <see cref="LiveSessionCount"/>, which counts incomplete runs, still included the session
+    /// that had just ended. The phone's keep-alive answers this event by reading exactly that count, and
+    /// reconciled its foreground notification to "1 shell connected" over a shell that was gone, with
+    /// nothing left to fire afterwards and correct it. By the time an await on the run resumes, the task is
+    /// complete and the count is honest.
+    /// </para>
+    /// <para>
+    /// The containment check keeps the deliberate paths out of this route: <see cref="CloseSessionAsync"/>
+    /// removes the entry before it disposes the pump, and makes its own announcement after its own drain.
+    /// </para>
+    /// </remarks>
+    private async Task AnnounceEndedAsync(uint sessionId, Task run)
+    {
+        try
+        {
+            await run.ConfigureAwait(false);
+        }
+        catch (Exception exception) when (exception is not OutOfMemoryException)
+        {
+            // The run's faults belong to whoever drains it — CloseSessionAsync, on the deliberate path.
+            // This continuation cares only that the run is over, however it got there.
+        }
 
-            lock (sessionGate)
-            {
-                announce = sessions.ContainsKey(sessionId);
-            }
+        bool announce;
 
-            if (announce)
-            {
-                SessionEnded?.Invoke(this, new TerminalSessionEndedEventArgs(sessionId));
-            }
+        lock (sessionGate)
+        {
+            announce = sessions.ContainsKey(sessionId);
+        }
+
+        if (announce)
+        {
+            SessionEnded?.Invoke(this, new TerminalSessionEndedEventArgs(sessionId));
         }
     }
 

tests/DodoSSH.Client.App.Layout.Tests/ButtonCaptionTests.cs

@@ -0,0 +1,219 @@
+using System.Globalization;
+using Avalonia;
+using Avalonia.Controls;
+using Avalonia.Controls.Presenters;
+using Avalonia.Layout;
+using Avalonia.VisualTree;
+
+namespace DodoSSH.Client.App.Layout.Tests;
+
+/// <summary>
+/// The button shapes that centre their caption do, and the two that deliberately do not still fill.
+/// </summary>
+/// <remarks>
+/// <para>
+/// ◆ THE DEFECT THIS EXISTS FOR was read as a height problem and was not one. <c>App.axaml</c>'s
+/// <c>Button.ghost, Button.accent, Button.danger</c> rule set <c>VerticalAlignment</c> — where the button
+/// sits in its parent — and never <c>VerticalContentAlignment</c>, where the caption sits in the button.
+/// Avalonia's default for the second is <c>Stretch</c>, so on any of these given a fixed <c>Height</c> the
+/// content presenter stretched the caption's <see cref="TextBlock"/> to the whole content box, and a
+/// <see cref="TextBlock"/> draws its line at the TOP of its bounds. The hosts toolbar's three 40-pixel
+/// buttons measured 9 pixels above the ink and 20 below it. Every box was the height it declared, which is
+/// exactly why it read as one being wrong: nothing was mis-sized, the labels sat in the top third.
+/// </para>
+/// <para>
+/// A bare <see cref="Button"/> rather than a screen, because <c>Application.Styles</c> is global — the same
+/// property <see cref="LayoutHarnessTests"/> leans on — so this measures the style rule itself rather than
+/// one of the hundred-odd places it lands. A screen-level test would pin one toolbar and leave the dialogs,
+/// the drawer's Save/Cancel pair and the import screen's buttons uncovered by the thing that fixed them all.
+/// </para>
+/// <para>
+/// ◆ THE LINE BOX IS MEASURED, NOT THE TextBlock's ARRANGED BOUNDS, and the difference is the whole test.
+/// A stretched caption's <see cref="Visual.Bounds"/> fill the content box, so they are symmetrical about
+/// the button's middle under the defect just as they are under the fix — the first draft of this suite
+/// asserted on them, passed on both, and was caught only by
+/// <see cref="AStretchedCaption_IsNotCentred_AndIsCaught"/>. What actually moves is where the line sits
+/// INSIDE those bounds: <see cref="TextBlock"/> draws at the top of whatever it is given, so the ink is
+/// centred only when the box it is drawn in is its own line box.
+/// </para>
+/// <para>
+/// The gaps are compared to each other rather than to a number. What the caption's own line box measures is
+/// a property of JetBrains Mono at whichever size the caller set — 11.5 by default and 13.5 on the primary
+/// action — so an absolute expectation would be a font metric written down in a test file, and it would move
+/// the day the face does. "Centred" survives both.
+/// </para>
+/// <para>
+/// The five shapes beyond the original three were swept in afterwards, and none of them was misbehaving
+/// when it was: every one is content-sized everywhere it is used today, so <c>Stretch</c> and <c>Center</c>
+/// agreed and the change moved nothing — 113 buttons across 29 screens measured byte-identical before and
+/// after. What the sweep buys is that the day any of them is given a height, it is already right. That is
+/// also why <see cref="AStretchingShapeStillFillsItsButton"/> matters more than it looks: the same
+/// reasoning applied to <c>flat</c> or <c>cat</c> would break a pill and a strip that are currently
+/// correct.
+/// </para>
+/// </remarks>
+public sealed class ButtonCaptionTests
+{
+    /// <summary>Taller than any caption these carry, which is the condition that exposes the defect.</summary>
+    /// <remarks>
+    /// The hosts and keychain toolbars' own number. A button left to size itself cannot show this at all:
+    /// its content box is its caption's line box exactly, so <c>Stretch</c> and <c>Center</c> agree and a
+    /// test written against one would pass under either.
+    /// </remarks>
+    private const double FixedHeight = 40;
+
+    /// <remarks>One pixel, for a content box whose odd leftover cannot be halved evenly.</remarks>
+    private const double Tolerance = 1;
+
+    private static CancellationToken Token => TestContext.Current.CancellationToken;
+
+    [Theory]
+    [InlineData("ghost")]
+    [InlineData("accent")]
+    [InlineData("danger")]
+    [InlineData("navuser")]
+    [InlineData("poprow")]
+    [InlineData("panechip")]
+    [InlineData("chiptoggle")]
+    [InlineData("choice")]
+    public async Task ACaptionIsCentredInAButtonTallerThanItself(string shape)
+    {
+        await MeasureAsync(
+            shape,
+            alignment: null,
+            (above, below) =>
+                Math.Abs(above - below).ShouldBeLessThanOrEqualTo(
+                    Tolerance,
+                    string.Create(
+                        CultureInfo.InvariantCulture,
+                        $"Button.{shape} left {above:0.#} above the caption and {below:0.#} below it.")));
+    }
+
+    /// <summary>
+    /// The instrument's own calibration: the check fails on the arrangement the fix replaced.
+    /// </summary>
+    /// <remarks>
+    /// The same practice <see cref="LayoutHarnessTests"/> states for the clipping harness, and it earns its
+    /// place here for the same reason. Everything above passes if <c>VerticalContentAlignment</c> is Center
+    /// AND it passes if the caption happens to fill its box, so without this a rule quietly reverted to
+    /// Stretch would have to be caught by eye again. Stretch is set inline here rather than by editing the
+    /// style sheet, because <c>Application.Styles</c> is global and a test that mutated it would be changing
+    /// every other test in the assembly out from under itself.
+    /// </remarks>
+    [Fact]
+    public async Task AStretchedCaption_IsNotCentred_AndIsCaught()
+    {
+        await MeasureAsync(
+            "ghost",
+            VerticalAlignment.Stretch,
+            (above, below) => (below - above).ShouldBeGreaterThan(
+                Tolerance,
+                "the caption should sit high, which is the defect this suite was written for"));
+    }
+
+    /// <summary>
+    /// <c>flat</c> and <c>cat</c> are excluded from the rule above, and must stay excluded.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Both stretch their content on purpose, and both would be silently broken by a later pass that
+    /// "finished" the sweep the rest of these classes belong to — which is exactly why this is a test and
+    /// not a comment.
+    /// </para>
+    /// <para>
+    /// <c>flat</c> carries the titlebar's search pill, a <c>Border.searchpill</c> with no height of its own
+    /// that is meant to fill all 35 pixels of the button; the usage states
+    /// <c>HorizontalContentAlignment="Stretch"</c> and relies on the vertical default matching it. Centring
+    /// from the style would shrink that pill to its caption's line box inside a button twice as tall.
+    /// <c>cat</c> carries the keychain rail's accent strip, a <c>Border.rowmark</c> whose style sets
+    /// <c>Width="2"</c> and no height at all — "at full row height", says the rule's own remark — so its
+    /// height is the stretch and nothing else.
+    /// </para>
+    /// <para>
+    /// Asserted as "the content fills the button", not as "the caption is off-centre": what these two need
+    /// is the fill, and a test phrased the other way would still pass if the fill broke in some new way.
+    /// </para>
+    /// </remarks>
+    [Theory]
+    [InlineData("flat")]
+    [InlineData("cat")]
+    public async Task AStretchingShapeStillFillsItsButton(string shape)
+    {
+        await LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                // A bare Border is what both of them actually hold: no height, sized only by its parent.
+                var fill = new Border();
+                var button = new Button { Content = fill, Height = FixedHeight };
+                button.Classes.Add(shape);
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    button, LayoutHarness.MinimumWidth, LayoutHarness.MinimumHeight);
+
+                try
+                {
+                    // The slot read off the presenter rather than recomputed from the button's Padding:
+                    // these shapes differ in whether their presenter also draws a border, and a hand-rolled
+                    // sum was two pixels out on Button.cat for exactly that reason.
+                    var presenter = button.GetVisualDescendants()
+                        .OfType<ContentPresenter>()
+                        .Single(p => string.Equals(p.Name, "PART_ContentPresenter", StringComparison.Ordinal));
+
+                    var slot = presenter.Bounds.Height
+                        - presenter.Padding.Top - presenter.Padding.Bottom
+                        - presenter.BorderThickness.Top - presenter.BorderThickness.Bottom;
+
+                    fill.Bounds.Height.ShouldBe(
+                        slot,
+                        Tolerance,
+                        $"Button.{shape} must stretch its content — the search pill and the rail's accent "
+                        + "strip have no height of their own");
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+    }
+
+    private static Task MeasureAsync(
+        string shape, VerticalAlignment? alignment, Action<double, double> assert) =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var button = new Button { Content = "Group ▾", Height = FixedHeight };
+                button.Classes.Add(shape);
+
+                if (alignment is { } forced)
+                {
+                    button.VerticalContentAlignment = forced;
+                }
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    button, LayoutHarness.MinimumWidth, LayoutHarness.MinimumHeight);
+
+                try
+                {
+                    var caption = button.GetVisualDescendants().OfType<TextBlock>().Single();
+                    var origin = caption.TranslatePoint(default, button);
+
+                    origin.ShouldNotBeNull("the caption is not in the button's visual tree");
+
+                    // The laid-out line rather than caption.Bounds.Height, which under Stretch is the
+                    // content box and so is symmetrical whether or not the ink in it is — see the remark on
+                    // the class.
+                    var line = caption.TextLayout.Height;
+
+                    var above = origin.Value.Y;
+                    var below = button.Bounds.Height - above - line;
+
+                    assert(above, below);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+}

tests/DodoSSH.Client.App.Layout.Tests/LayoutHarness.cs

@@ -55,6 +55,33 @@ internal static class LayoutHarness
     /// <remarks>v5b: 190 became 255, the design's own number rather than this bar's old approximation.</remarks>
     internal const double NavRailWidth = 255;
 
+    /// <summary>Settings mode's own rail, from <c>SettingsNav.axaml</c> — wider than <see cref="NavRailWidth"/>.</summary>
+    internal const double SettingsNavWidth = 340;
+
+    /// <summary>
+    /// The width settings mode's own content column asks for, from the design's <c>width:1100px</c>.
+    /// </summary>
+    /// <remarks>
+    /// A <c>MaxWidth</c> on the page, not a <c>Width</c> — see the same trade <c>TitleBar.axaml</c>'s own
+    /// search box makes with its own <c>MaxWidth="514"</c>, and for the identical reason:
+    /// <see cref="SettingsContentWidth"/> below is smaller than this at the window's minimum, and a page
+    /// that insisted on the full 1100 would arrange its own rows past the edge of the rectangle settings
+    /// mode actually gives them.
+    /// </remarks>
+    internal const double SettingsDesignContentWidth = 1100;
+
+    /// <summary>The width a settings page's content column actually gets at the window's minimum.</summary>
+    internal static double SettingsContentWidth => MinimumWidth - SettingsNavWidth;
+
+    /// <summary>What settings mode leaves a page between its own titlebar and the window's bottom edge.</summary>
+    /// <remarks>
+    /// Settings mode has no status bar and no update banner of its own — see <c>MainWindow.axaml</c>'s own
+    /// remark on why both are hidden while <c>IsSettingsMode</c> is true — so this is
+    /// <see cref="MinimumHeight"/> less only <see cref="TitleBarHeight"/>, not <see cref="ContentHeight"/>'s
+    /// own subtraction of <see cref="StatusBarHeight"/> too.
+    /// </remarks>
+    internal static double SettingsContentHeight => MinimumHeight - TitleBarHeight;
+
     /// <summary>
     /// What the titlebar and the status bar take off the window before any screen gets a pixel.
     /// </summary>
@@ -193,6 +220,18 @@ internal static class LayoutHarness
     /// <summary>The width a full-width screen gets, once the nav rail has taken its column.</summary>
     internal static double ScreenWidth => MinimumWidth - NavRailWidth;
 
+    /// <summary>
+    /// v5c-3: what the S3 usage of <c>TransfersScreen</c> gets, now that <c>MainWindow.axaml</c> gives it the
+    /// session shell's own 26px-padded, 1px-bordered LOOK with none of its machinery — no tab row, header,
+    /// status bar or sidebar to take further space off it.
+    /// </summary>
+    internal static double BucketsScreenWidth =>
+        ScreenWidth - (2 * SessionShellPadding) - (2 * SessionShellBorderThickness);
+
+    /// <inheritdoc cref="BucketsScreenWidth" />
+    internal static double BucketsScreenHeight =>
+        ScreenHeight - (2 * SessionShellPadding) - (2 * SessionShellBorderThickness);
+
     private static readonly HeadlessUnitTestSession Session =
         HeadlessUnitTestSession.GetOrStartForAssembly(typeof(LayoutHarness).Assembly);
 

tests/DodoSSH.Client.App.Layout.Tests/NavRailTests.cs

@@ -207,24 +207,35 @@ public sealed class NavRailTests : IAsyncLifetime
         });
     }
 
-    /// <summary>Settings, Vaults and Preferences each land on the screen they promise, and shut the popover.</summary>
+    /// <summary>
+    /// Settings, Vaults and Preferences each enter settings mode on the page they promise, and shut the
+    /// popover behind them.
+    /// </summary>
     /// <remarks>
-    /// Three <see cref="Fact"/>s over one private body rather than a <see cref="Theory"/>: <c>ShellScreen</c>
+    /// <para>
+    /// v5c: these three used to land on a bare <c>ShellScreen</c> — Settings and Preferences on the very
+    /// same one, since the mock's own Settings area did not exist yet. Now that it does, each opens the
+    /// settings mode on its own page — see <see cref="MainWindowViewModel.EnterSettings"/> — and "Settings"
+    /// and "Preferences" are no longer the same click.
+    /// </para>
+    /// <para>
+    /// Three <see cref="Fact"/>s over one private body rather than a <see cref="Theory"/>: <c>SettingsPage</c>
     /// is <c>internal</c>, and a public theory method may not carry an internal type in its signature.
+    /// </para>
     /// </remarks>
     [Fact]
-    public Task ThePopoversSettingsRow_LandsOnPreferencesAndClosesThePopover() =>
-        APopoverRowLandsOnAsync("Settings", ShellScreen.Preferences);
+    public Task ThePopoversSettingsRow_EntersSettingsOnGeneralAndClosesThePopover() =>
+        APopoverRowLandsOnAsync("Settings", SettingsPage.General);
 
     [Fact]
-    public Task ThePopoversVaultsRow_LandsOnVaultsAndClosesThePopover() =>
-        APopoverRowLandsOnAsync("Vaults", ShellScreen.Vaults);
+    public Task ThePopoversVaultsRow_EntersSettingsOnVaultsAndClosesThePopover() =>
+        APopoverRowLandsOnAsync("Vaults", SettingsPage.Vaults);
 
     [Fact]
-    public Task ThePopoversPreferencesRow_LandsOnPreferencesAndClosesThePopover() =>
-        APopoverRowLandsOnAsync("Preferences", ShellScreen.Preferences);
+    public Task ThePopoversPreferencesRow_EntersSettingsOnPreferencesAndClosesThePopover() =>
+        APopoverRowLandsOnAsync("Preferences", SettingsPage.Preferences);
 
-    private Task APopoverRowLandsOnAsync(string label, ShellScreen target) =>
+    private Task APopoverRowLandsOnAsync(string label, SettingsPage target) =>
         OnTheRailAsync((rail, window) =>
         {
             var chip = UserChip(rail);
@@ -232,19 +243,20 @@ public sealed class NavRailTests : IAsyncLifetime
 
             Click(PopoverRow(window, label), window);
 
-            shell.Screen.ShouldBe(target);
+            shell.IsSettingsMode.ShouldBeTrue();
+            shell.ActiveSettingsPage.ShouldBe(target);
             shell.IsShowingPages.ShouldBeTrue();
             FlyoutBase.GetAttachedFlyout(chip)!.IsOpen.ShouldBeFalse("a navigation row shuts the popover behind it");
         });
 
     /// <remarks>
-    /// Through Preferences rather than a direct <c>SignOutCommand</c> — see
-    /// <see cref="MainWindowViewModel.SignOutFromPopover"/> for why: the confirmation card the mock has no
-    /// room for at all is drawn inline on that one screen while the vault is unlocked, and arming it from
-    /// anywhere else would be a card raised nobody could see.
+    /// Through the Account settings page rather than a direct <c>SignOutCommand</c> — see
+    /// <see cref="MainWindowViewModel.SignOutFromPopover"/> for why: the confirmation card is drawn inline on
+    /// that one page while the vault is unlocked, and arming it from anywhere else would be a card raised
+    /// nobody could see.
     /// </remarks>
     [Fact]
-    public async Task ThePopoversLogoutRow_GoesToPreferencesAndArmsTheSignOutConfirmation()
+    public async Task ThePopoversLogoutRow_EntersSettingsOnAccountAndArmsTheSignOutConfirmation()
     {
         await OnTheRailAsync((rail, window) =>
         {
@@ -253,7 +265,8 @@ public sealed class NavRailTests : IAsyncLifetime
 
             Click(PopoverRow(window, "Logout"), window);
 
-            shell.Screen.ShouldBe(ShellScreen.Preferences);
+            shell.IsSettingsMode.ShouldBeTrue();
+            shell.ActiveSettingsPage.ShouldBe(SettingsPage.Account);
             shell.IsConfirmingSignOut.ShouldBeTrue();
             FlyoutBase.GetAttachedFlyout(chip)!.IsOpen.ShouldBeFalse();
         });

tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs

@@ -6,7 +6,6 @@ using Avalonia.Threading;
 using Avalonia.VisualTree;
 using DodoSSH.Client.App.Views;
 using DodoSSH.Client.Domain;
-using DodoSSH.Client.Import;
 using DodoSSH.Client.Session;
 using DodoSSH.Client.Session.Tests;
 using DodoSSH.Client.Shell.ViewModels;
@@ -825,9 +824,10 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
 
         transfers.ShowsNoBuckets.ShouldBeTrue("this vault has no buckets in it");
 
-        // The plain-screen budget, not the session shell's: MainWindow.axaml gives S3 the same TransfersScreen
-        // control with no tab row, no header and no sidebar around it — see its own remark on why the S3
-        // usage is "deliberately not given the session shell above."
+        // The buckets budget, not the full session shell's: MainWindow.axaml gives S3 the same TransfersScreen
+        // control inside a padded, bordered container but with no tab row, no header, no status bar and no
+        // sidebar around it — see its own remark on why the S3 usage is "deliberately not given the full
+        // session shell above."
         await MeasureBucketsAsync(faults => faults.ShouldBeEmpty("with nothing to open yet"));
     }
 
@@ -847,27 +847,9 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
         await MeasureTransfersAsync(faults => faults.ShouldBeEmpty("with a drop in progress"));
     }
 
-    // ---- The import screen ----
-
-    [Fact]
-    public async Task TheImportScreenFitsBeforeAnythingHasBeenScanned()
-    {
-        await MeasureImportAsync(faults => faults.ShouldBeEmpty("the state it opens in"));
-    }
-
-    /// <remarks>
-    /// The shape with something to decide about: a table of candidate hosts with tickboxes, a warning
-    /// block above it, and a footer carrying the sentence that says key files are not read. That sentence
-    /// is the one that must not be pushed off the bottom — it is the difference between an import somebody
-    /// understands and one they think is broken.
-    /// </remarks>
-    [Fact]
-    public async Task TheImportScreenFitsWithHostsToChooseFromAndWarnings()
-    {
-        await MeasureImportAsync(
-            faults => faults.ShouldBeEmpty("with a scanned list"),
-            await ScannedImportAsync());
-    }
+    // v5c-3: the import screen's own layout coverage moved to SettingsPagesLayoutTests — it is a settings
+    // page now, drawn inside settings mode over the Preferences page rather than beside the ordinary nav
+    // rail; see MainWindowViewModel.IsImportOpen and design-notes/v5c-fidelity-notes.md.
 
     // ---- The host keys screen ----
 
@@ -1499,17 +1481,29 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
     }
 
     /// <remarks>
+    /// <para>
     /// The narrowest real shape wave C's restyle has to survive at once: connected, so QUICK ACCESS's own
     /// sidebar takes its 300 pixels — see <see cref="LayoutHarness.SessionScreenWidth"/> — a populated remote
     /// listing carrying every colour state a row can show (a directory, an executable, a world-writable
     /// file), and a full transfer queue underneath, all inside the 204-pixel-a-side budget that leaves either
     /// pane.
+    /// </para>
+    /// <para>
+    /// Both pane headers carry a deep path on purpose, and the paths are set here rather than left to the
+    /// fixture's real filesystem. The header's ellipsis only works because the path sits alone in a star
+    /// column — see the pane header remark in <c>TransfersScreen.axaml</c> — and the regression it guards
+    /// against armed itself only on a machine whose home directory happened to be long: CI's per-job HOME
+    /// found it, every developer machine's short profile path missed it. A pinned sixty-character path asks
+    /// the question on every machine alike.
+    /// </para>
     /// </remarks>
     [Fact]
     public async Task TheRestyledPanesFitTheSessionShellsNarrowestBudget()
     {
         transfers.IsConnected = true;
         transfers.ConnectedTo = "deployment-service@releases.eu-west.internal.example:2222";
+        transfers.LocalPath = "/home/deployment-service/.cache/build/workspaces/site/artefacts";
+        transfers.RemotePath = "/srv/releases/site/shared/uploads/production/2026/08/nightly";
 
         transfers.RemoteEntries.Add(new RemoteEntryRowViewModel(new SftpEntry(
             "docker-compose.yml", "/srv/releases/site/docker-compose.yml", SftpEntryKind.File,
@@ -1898,87 +1892,6 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             },
             Token);
 
-    /// <summary>Lays the import screen out at the size it gets beside the nav rail.</summary>
-    private Task MeasureImportAsync(
-        Action<IReadOnlyList<string>> assert,
-        ImportViewModel? import = null) =>
-        LayoutHarness.OnTheUiThreadAsync(
-            () =>
-            {
-                var screen = new ImportScreen
-                {
-                    DataContext = import ?? new ImportViewModel(vault, new SshConfigLocator()),
-                };
-
-                var window = LayoutHarness.HostAtMinimumSize(
-                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);
-
-                try
-                {
-                    assert(LayoutHarness.Unreachable(window));
-                }
-                finally
-                {
-                    window.Close();
-                }
-            },
-            Token);
-
-    /// <summary>
-    /// An import view model that has scanned a real file, so the table has rows in it.
-    /// </summary>
-    /// <remarks>
-    /// Through a temporary directory rather than by populating the rows directly, because the shape being
-    /// measured is what the parser produces — an entry with two warnings under it is taller than one
-    /// without, and inventing the rows would measure a layout nothing generates.
-    /// </remarks>
-    private async Task<ImportViewModel> ScannedImportAsync()
-    {
-        var directory = Path.Combine(Path.GetTempPath(), $"dodossh-import-{Guid.CreateVersion7():N}");
-        Directory.CreateDirectory(directory);
-
-        try
-        {
-            await File.WriteAllTextAsync(
-                Path.Combine(directory, "config"),
-                """
-                Host *
-                  ServerAliveInterval 30
-
-                Host prod-db
-                  HostName database.production.internal
-                  User deploy
-                  Port 2222
-                  IdentityFile ~/.ssh/id_ed25519
-
-                Host bastion-eu-west-1
-                  HostName bastion.eu-west-1.example.com
-                  User ops
-                  ProxyCommand nc %h %p
-                  Compression yes
-                  compression no
-
-                Match host anything
-                  User root
-                """);
-
-            var import = new ImportViewModel(vault, new SshConfigLocator(directory));
-
-            // Awaited, not fired. ScanCommand reads a file, so executing without awaiting measures an empty
-            // table — which is the other test.
-            await import.ScanCommand.ExecuteAsync(null);
-
-            import.HasRows.ShouldBeTrue("the fixture has hosts in it");
-            import.HasWarnings.ShouldBeTrue("the fixture has a Match block and a wildcard block");
-
-            return import;
-        }
-        finally
-        {
-            Directory.Delete(directory, recursive: true);
-        }
-    }
-
     /// <summary>Lays the host keys screen out at the size it gets beside the nav rail.</summary>
     private Task MeasurePinsAsync(
         Action<IReadOnlyList<string>> assert,
@@ -2142,12 +2055,14 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             },
             Token);
 
-    /// <summary>Lays the S3 usage of <c>TransfersScreen</c> out at the plain-screen budget it actually gets.</summary>
+    /// <summary>Lays the S3 usage of <c>TransfersScreen</c> out at the budget it actually gets.</summary>
     /// <remarks>
-    /// The same control as <see cref="MeasureTransfersAsync"/> measures, at a different width and height: S3
-    /// is "deliberately not given the session shell" — see <c>MainWindow.axaml</c>'s own remark on why — so it
-    /// is measured at <see cref="LayoutHarness.ScreenWidth"/>/<see cref="LayoutHarness.ScreenHeight"/> instead,
-    /// the same budget every other full-bleed page gets.
+    /// The same control as <see cref="MeasureTransfersAsync"/> measures, at a different width and height. v5c-3
+    /// gives S3 the session shell's own 26px-padded, 1px-bordered LOOK with none of its machinery — see
+    /// <c>MainWindow.axaml</c>'s own remark on why — so it is measured at
+    /// <see cref="LayoutHarness.BucketsScreenWidth"/>/<see cref="LayoutHarness.BucketsScreenHeight"/>, which
+    /// take that padding and border off the full-bleed budget every other page gets and stop there: no tab
+    /// row, header, status bar or sidebar to subtract, unlike <see cref="LayoutHarness.SessionScreenWidth"/>.
     /// </remarks>
     private Task MeasureBucketsAsync(Action<IReadOnlyList<string>> assert) =>
         LayoutHarness.OnTheUiThreadAsync(
@@ -2156,7 +2071,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
                 var screen = new TransfersScreen { DataContext = transfers };
 
                 var window = LayoutHarness.HostAtMinimumSize(
-                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);
+                    screen, LayoutHarness.BucketsScreenWidth, LayoutHarness.BucketsScreenHeight);
 
                 try
                 {
@@ -2190,123 +2105,12 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
             bytesPerSecond,
             failure)));
 
-    /// <summary>Lays the vaults screen out at the width it gets once the nav rail has taken its column.</summary>
     /// <remarks>
-    /// <para>
-    /// Its right-hand column is the narrowest measured here: the window's minimum is 1081, the nav rail
-    /// takes 255 and the vault list 268, leaving 558 for everything above — the same 558 as before v5b
-    /// widened the rail, because the minimum grew by exactly what the rail did.
-    /// </para>
-    /// <para>
-    /// Every list is seeded, and seeded with the long rows rather than the convenient ones — see
-    /// <see cref="StubTeamServer"/>. The two states that hide half the screen, the rename form and the
-    /// confirmation, are measured in their own tests below rather than here, because a control that is
-    /// collapsed when the window is laid out is a control this suite has not checked.
-    /// </para>
+    /// v5c-2: the old VaultsScreen this suite used to measure here is gone — Vaults is a settings page now,
+    /// and its own layout coverage (populated lists, the rename and new-vault forms, the hand-over
+    /// confirmation, the members panel) lives in <c>SettingsPagesLayoutTests</c> beside every other settings
+    /// page's, measured against the settings content budget rather than this suite's full-chrome one.
     /// </remarks>
-    [Fact]
-    public Task TheVaultsScreen_FitsWithEveryListPopulated() =>
-        OnTheVaultsScreenAsync(
-            vaults => { },
-            window => LayoutHarness.Unreachable(window)
-                .ShouldBeEmpty("the vaults screen with members and key holders"));
-
-    /// <remarks>
-    /// The rename form is drawn in place, above the members list, and pushes everything below it down.
-    /// </remarks>
-    [Fact]
-    public Task TheVaultsScreen_FitsWhileRenamingAVault() =>
-        OnTheVaultsScreenAsync(
-            vaults => vaults.RenameVaultCommand.Execute(null),
-            window => LayoutHarness.Unreachable(window)
-                .ShouldBeEmpty("the vaults screen with the rename form open"));
-
-    /// <remarks>
-    /// The name-a-vault form is in the left column under the vault list. Worth its own case because the
-    /// column is 268 wide and the sentence under the field wraps.
-    /// </remarks>
-    [Fact]
-    public Task TheVaultsScreen_FitsWithTheNewVaultFormOpen() =>
-        OnTheVaultsScreenAsync(
-            vaults => vaults.NewVaultCommand.Execute(null),
-            window => LayoutHarness.Unreachable(window)
-                .ShouldBeEmpty("the vaults screen with the new-vault form open"));
-
-    /// <remarks>
-    /// The armed confirmation carries two sentences of prose and replaces the header's buttons. It is the
-    /// tallest thing that can appear above the members list, so it is the case most likely to push the
-    /// key-holders list off the bottom.
-    /// </remarks>
-    [Fact]
-    public Task TheVaultsScreen_FitsWhileConfirmingAHandOver() =>
-        OnTheVaultsScreenAsync(
-            vaults =>
-            {
-                vaults.SelectedMember = vaults.Members.First(member => !member.IsSelf);
-                vaults.HandOverCommand.Execute(null);
-            },
-            window => LayoutHarness.Unreachable(window)
-                .ShouldBeEmpty("the vaults screen with the hand-over confirmation armed"));
-
-    /// <remarks>
-    /// <para>
-    /// A real <c>VaultsViewModel</c> over this suite's own unlocked session and a stub server. Both halves
-    /// are needed and they answer different questions: the vault list is the session's, and who is in each
-    /// vault is the server's.
-    /// </para>
-    /// <para>
-    /// A shared vault is created into the session first, because a session that has only ever been unlocked
-    /// offline holds one personal vault — and the personal vault draws none of what this screen is for. It
-    /// is created through the real <c>CreateTeamVaultAsync</c> rather than poked into the cache, so the row
-    /// being measured is one the application could actually produce.
-    /// </para>
-    /// <para>
-    /// Selected before the second load rather than after it, so the members read is the awaited one: a
-    /// selection assignment starts a read nothing can wait for, and measuring a window while it was still
-    /// in flight would certify a screen with empty lists.
-    /// </para>
-    /// </remarks>
-    private async Task OnTheVaultsScreenAsync(
-        Action<VaultsViewModel> arrange,
-        Action<Window> assert)
-    {
-        using var teamServer = new StubTeamServer();
-
-        await session.CreateTeamVaultAsync(
-            teamServer.Teams, StubTeamServer.SharedTeamId, "Platform secrets", Token);
-
-        var vaults = new VaultsViewModel(() => teamServer, () => session);
-
-        await vaults.LoadAsync(Token);
-
-        vaults.SelectedVault = vaults.Vaults.First(row => row.IsShared);
-
-        await vaults.LoadAsync(Token);
-
-        vaults.Members.ShouldNotBeEmpty("there is nothing to measure otherwise");
-
-        await LayoutHarness.OnTheUiThreadAsync(
-            () =>
-            {
-                arrange(vaults);
-
-                var screen = new VaultsScreen { DataContext = vaults };
-
-                var window = LayoutHarness.HostAtMinimumSize(
-                    screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);
-
-                try
-                {
-                    assert(window);
-                }
-                finally
-                {
-                    window.Close();
-                }
-            },
-            Token);
-    }
-
     private Task MeasureVaultAsync(Action<IReadOnlyList<string>> assert) =>
         OnTheVaultAsync((_, window) => assert(LayoutHarness.Unreachable(window)));
 

tests/DodoSSH.Client.App.Layout.Tests/SettingsPagesLayoutTests.cs

@@ -0,0 +1,541 @@
+using Avalonia;
+using Avalonia.Controls;
+using Avalonia.VisualTree;
+using DodoSSH.Client.App.Views;
+using DodoSSH.Client.Import;
+using DodoSSH.Client.Session;
+using DodoSSH.Client.Session.Tests;
+using DodoSSH.Client.Shell.ViewModels;
+using DodoSSH.Client.Ssh;
+using DodoSSH.Client.Storage;
+using DodoSSH.Client.Terminal;
+using DodoSSH.Crypto;
+using NSubstitute;
+
+namespace DodoSSH.Client.App.Layout.Tests;
+
+/// <summary>
+/// v5c: whether each of settings mode's four pages fits the rectangle it is actually given, and whether the
+/// rows a fidelity pass could quietly unwire — Updates on General, Windows Hello on Security — are still
+/// wired to the real commands.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The budget is <see cref="LayoutHarness.SettingsContentWidth"/> by <see cref="LayoutHarness.SettingsContentHeight"/>
+/// — the space beside <c>SettingsNav</c>'s own 340 pixels, under settings mode's own titlebar and with no
+/// status bar or update banner beneath it, at the window's minimum. Not the design's own 1100-wide column,
+/// which is wider than that budget: see the <c>MaxWidth</c> remark on <see cref="LayoutHarness.SettingsDesignContentWidth"/>
+/// for why the pages ask for 1100 at most rather than exactly.
+/// </para>
+/// <para>
+/// A real unlocked vault, on the same reasoning <see cref="ScreenLayoutTests"/> gives: the Security page
+/// binds <c>KnownHostsScreen.Summary</c>, which is null until a vault is open, and a stand-in vault would
+/// still have to be the real <see cref="VaultViewModel"/> type for the compiled bindings to resolve at all.
+/// </para>
+/// </remarks>
+public sealed class SettingsPagesLayoutTests : IAsyncLifetime
+{
+    private const string Passphrase = "a sufficiently long passphrase";
+    private const string ServerUrl = "https://dodossh.example";
+
+    private static readonly Argon2Profile CheapProfile =
+        Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);
+
+    private readonly FakeAccountServer server = new();
+    private readonly StubKeyBinding keyBinding = new();
+    private readonly VaultKnownHostStore knownHosts = new();
+
+    private ClientCacheFactory caches = null!;
+    private TerminalWorkspace workspace = null!;
+    private VaultSession session = null!;
+    private VaultViewModel vault = null!;
+    private MainWindowViewModel shell = null!;
+
+    private static CancellationToken Token => TestContext.Current.CancellationToken;
+
+    /// <inheritdoc />
+    public async ValueTask InitializeAsync()
+    {
+        caches = ClientCacheFactory.ForMemory($"settings-layout-{Guid.CreateVersion7():N}");
+        await caches.MigrateAsync(Token);
+
+        await new AccountProvisioner(server, keyBinding, caches, TimeProvider.System, CheapProfile)
+            .EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
+
+        var outcome = await new SessionOpener(caches, TimeProvider.System).UnlockAsync(Passphrase, Token);
+        outcome.IsUnlocked.ShouldBeTrue(outcome.Message);
+        session = outcome.Session!;
+
+        workspace = new TerminalWorkspace(
+            new InMemoryTerminalAssetProvider(new Dictionary<string, TerminalAsset>(StringComparer.Ordinal)),
+            Substitute.For<ISshConnectionFactory>(),
+            TimeProvider.System);
+
+        await knownHosts.OpenAsync(session, Token);
+
+        vault = new VaultViewModel(session, workspace, knownHosts, static () => null);
+
+        shell = new MainWindowViewModel(
+            new ClientPaths(Path.Combine(Path.GetTempPath(), $"dodossh-settings-layout-{Guid.CreateVersion7():N}")),
+            caches,
+            workspace,
+            knownHosts,
+            new UnavailableDeviceKeyStore(),
+            static (_, _) => throw new InvalidOperationException("A layout test has no network."),
+            TimeProvider.System,
+            Substitute.For<ISftpSessionFactory>(),
+            CheapProfile)
+        {
+            State = ShellState.Unlocked,
+            Vault = vault,
+            AccountName = "Ripley Vega",
+            Email = "ripley@example.test",
+            Issuer = "https://sso.example.test/realms/dodotech",
+        };
+    }
+
+    /// <inheritdoc />
+    public async ValueTask DisposeAsync()
+    {
+        await shell.DisposeAsync();
+        await vault.DisposeAsync();
+        knownHosts.Close();
+        await workspace.DisposeAsync();
+        await session.DisposeAsync();
+        caches.Dispose();
+    }
+
+    [Fact]
+    public Task TheGeneralPageFitsAtTheWindowsMinimum() =>
+        MeasureAsync(() => new SettingsGeneralPage(), faults => faults.ShouldBeEmpty());
+
+    [Fact]
+    public Task ThePreferencesPageFitsAtTheWindowsMinimum() =>
+        MeasureAsync(() => new SettingsPreferencesPage(), faults => faults.ShouldBeEmpty());
+
+    [Fact]
+    public Task TheAccountPageFitsAtTheWindowsMinimum() =>
+        MeasureAsync(() => new SettingsAccountPage(), faults => faults.ShouldBeEmpty("the ordinary shape"));
+
+    /// <remarks>The other shape the Account page takes — the sign-out confirmation card in place of the row.</remarks>
+    [Fact]
+    public async Task TheAccountPageFitsWithTheSignOutConfirmationUp()
+    {
+        shell.SignOutCommand.Execute(null);
+        shell.IsConfirmingSignOut.ShouldBeTrue();
+
+        await MeasureAsync(() => new SettingsAccountPage(), faults => faults.ShouldBeEmpty("with the confirm card up"));
+    }
+
+    [Fact]
+    public Task TheSecurityPageFitsWhileThisMachineCanRegisterADeviceKey()
+    {
+        shell.CanRegisterDevice = true;
+        shell.CanForgetDevice = false;
+
+        return MeasureAsync(() => new SettingsSecurityPage(), faults => faults.ShouldBeEmpty("offering to register"));
+    }
+
+    [Fact]
+    public Task TheSecurityPageFitsWhileThisMachineIsAlreadyRegistered()
+    {
+        shell.CanRegisterDevice = false;
+        shell.CanForgetDevice = true;
+
+        return MeasureAsync(() => new SettingsSecurityPage(), faults => faults.ShouldBeEmpty("offering to withdraw"));
+    }
+
+    [Fact]
+    public Task TheSecurityPageFitsOnAMachineWithNowhereToKeepADeviceKey()
+    {
+        shell.CanRegisterDevice = false;
+        shell.CanForgetDevice = false;
+        shell.HasNoDeviceKeyOption.ShouldBeTrue();
+
+        return MeasureAsync(() => new SettingsSecurityPage(), faults => faults.ShouldBeEmpty("the no-TPM explanation"));
+    }
+
+    /// <summary>
+    /// Checking for updates on the General page is still the real <c>UpdateViewModel</c> command, not a
+    /// row a fidelity pass silently detached while restyling it into the card idiom.
+    /// </summary>
+    [Fact]
+    public Task TheGeneralPagesCheckNowButton_IsWiredToTheRealUpdatesCommand() =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var page = new SettingsGeneralPage { DataContext = shell };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    page, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    ButtonNamed(window, "CHECK NOW").Command.ShouldBeSameAs(shell.Updates.CheckNowCommand);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+    /// <summary>
+    /// Windows Hello's two commands — moved here whole from the old Preferences screen — are reachable from
+    /// the Security page in both of the states they can be in.
+    /// </summary>
+    [Fact]
+    public async Task TheSecurityPagesHelloButtons_AreWiredToTheRealDeviceCommands()
+    {
+        shell.CanRegisterDevice = true;
+        shell.CanForgetDevice = false;
+
+        await LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var page = new SettingsSecurityPage { DataContext = shell };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    page, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    ButtonNamed(window, "REGISTER").Command.ShouldBeSameAs(shell.RegisterDeviceCommand);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+        shell.CanRegisterDevice = false;
+        shell.CanForgetDevice = true;
+
+        await LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var page = new SettingsSecurityPage { DataContext = shell };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    page, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    ButtonNamed(window, "STOP UNLOCKING HERE").Command.ShouldBeSameAs(shell.ForgetDeviceCommand);
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+    }
+
+    // ---- v5c-2: Vaults, Groups, Tags ----
+    //
+    // Vaults replaces the old full-bleed VaultsScreen, which ScreenLayoutTests used to measure at
+    // LayoutHarness.ScreenWidth/ScreenHeight (the space beside the ordinary nav rail); it is a settings page
+    // now, so its own layout coverage belongs here, against the narrower settings budget, beside every other
+    // settings page's. Groups and Tags are new pages with nothing to migrate.
+
+    /// <remarks>
+    /// A shared vault added straight into the fixture's own session — the same technique the retired
+    /// VaultsScreen layout tests used — so the card list draws both the personal vault and a shared one
+    /// without a live server: <c>VaultRowViewModel.IsShared</c> only asks whether the vault carries a team
+    /// id, which this sets without needing <see cref="MainWindowViewModel"/>'s own (offline) connection.
+    /// </remarks>
+    private async Task AddSharedVaultAsync()
+    {
+        using var teamServer = new StubTeamServer();
+
+        await session.CreateTeamVaultAsync(
+            teamServer.Teams, StubTeamServer.SharedTeamId, "Platform secrets", Token);
+    }
+
+    [Fact]
+    public async Task TheVaultsPageFitsWithTheVaultListPopulated()
+    {
+        await AddSharedVaultAsync();
+        await shell.Vaults.LoadAsync(Token);
+
+        await MeasureAsync(
+            () => new SettingsVaultsPage(),
+            faults => faults.ShouldBeEmpty("a personal vault and a shared one"));
+    }
+
+    [Fact]
+    public async Task TheVaultsPageFitsWithTheNewVaultFormOpen()
+    {
+        await shell.Vaults.LoadAsync(Token);
+        shell.Vaults.NewVaultCommand.Execute(null);
+
+        await MeasureAsync(
+            () => new SettingsVaultsPage(),
+            faults => faults.ShouldBeEmpty("the new-vault form open"));
+    }
+
+    [Fact]
+    public async Task TheVaultsPageFitsWithTheRenameFormOpen()
+    {
+        await AddSharedVaultAsync();
+        await shell.Vaults.LoadAsync(Token);
+
+        shell.Vaults.RenameVaultRowCommand.Execute(shell.Vaults.Vaults.First(row => row.IsShared));
+
+        await MeasureAsync(
+            () => new SettingsVaultsPage(),
+            faults => faults.ShouldBeEmpty("the rename form open"));
+    }
+
+    /// <remarks>
+    /// The panel's own geometry — the ListBoxes, the SHARE KEY/WITHDRAW KEY row, the KEY HOLDERS list —
+    /// with nothing in Members or Grants, since the fixture's connection is offline and both are read from
+    /// the server on selection. An empty ListBox is zero pixels tall and exempt from this harness's own
+    /// "no size" rule, so this is still a real check of everything around it.
+    /// </remarks>
+    [Fact]
+    public async Task TheVaultsPageFitsWithTheMembersPanelOpen()
+    {
+        await AddSharedVaultAsync();
+        await shell.Vaults.LoadAsync(Token);
+
+        shell.Vaults.OpenMembersPanelCommand.Execute(shell.Vaults.Vaults.First(row => row.IsShared));
+
+        await MeasureAsync(
+            () => new SettingsVaultsPage(),
+            faults => faults.ShouldBeEmpty("the members panel open"));
+    }
+
+    [Fact]
+    public async Task TheGroupsPageFitsWithGroupsPopulated()
+    {
+        await AddGroupAsync("production");
+        await AddGroupAsync("staging");
+
+        await MeasureAsync(
+            () => new SettingsGroupsPage(),
+            faults => faults.ShouldBeEmpty("two groups and the No group footer"));
+    }
+
+    [Fact]
+    public async Task TheGroupsPageFitsWithTheEditorOpen()
+    {
+        vault.NewGroupCommand.Execute(null);
+
+        await MeasureAsync(
+            () => new SettingsGroupsPage(),
+            faults => faults.ShouldBeEmpty("the group editor open"));
+    }
+
+    [Fact]
+    public async Task TheGroupsPageFitsWithTheDeleteConfirmationArmed()
+    {
+        await AddGroupAsync("production");
+
+        vault.DeleteGroupCommand.Execute(vault.Groups.Single());
+
+        await MeasureAsync(
+            () => new SettingsGroupsPage(),
+            faults => faults.ShouldBeEmpty("the delete confirmation armed"));
+    }
+
+    [Fact]
+    public async Task TheTagsPageFitsWithTagsPopulated()
+    {
+        await AddTagAsync("production");
+        await AddTagAsync("staging");
+
+        await MeasureAsync(
+            () => new SettingsTagsPage(),
+            faults => faults.ShouldBeEmpty("two tags"));
+    }
+
+    [Fact]
+    public async Task TheTagsPageFitsWithTheEditorOpen()
+    {
+        vault.NewTagCommand.Execute(null);
+
+        await MeasureAsync(
+            () => new SettingsTagsPage(),
+            faults => faults.ShouldBeEmpty("the tag editor open"));
+    }
+
+    [Fact]
+    public async Task TheTagsPageFitsWithTheDeleteConfirmationArmed()
+    {
+        await AddTagAsync("production");
+
+        vault.DeleteTagRowCommand.Execute(vault.Tags.Single());
+
+        await MeasureAsync(
+            () => new SettingsTagsPage(),
+            faults => faults.ShouldBeEmpty("the delete confirmation armed"));
+    }
+
+    private async Task AddGroupAsync(string label)
+    {
+        vault.NewGroupCommand.Execute(null);
+        vault.GroupEditorLabel = label;
+
+        await vault.SaveGroupCommand.ExecuteAsync(null);
+    }
+
+    private async Task AddTagAsync(string label)
+    {
+        vault.NewTagCommand.Execute(null);
+        vault.TagEditorLabel = label;
+
+        await vault.SaveTagCommand.ExecuteAsync(null);
+    }
+
+    // ---- v5c-3: Import ----
+    //
+    // The importer moved into settings mode's own chrome — see MainWindowViewModel.IsImportOpen and
+    // design-notes/v5c-fidelity-notes.md — so its layout coverage moved here from ScreenLayoutTests, against
+    // the same SettingsContentWidth/SettingsContentHeight budget every other settings page is measured
+    // against, rather than the plain full-bleed one it used to get beside the ordinary nav rail.
+
+    [Fact]
+    public async Task TheImportScreenFitsBeforeAnythingHasBeenScanned()
+    {
+        await MeasureImportAsync(faults => faults.ShouldBeEmpty("the state it opens in"));
+    }
+
+    /// <remarks>
+    /// The shape with something to decide about: a table of candidate hosts with tickboxes, a warning
+    /// block above it, and a footer carrying the sentence that says key files are not read. That sentence
+    /// is the one that must not be pushed off the bottom — it is the difference between an import somebody
+    /// understands and one they think is broken.
+    /// </remarks>
+    [Fact]
+    public async Task TheImportScreenFitsWithHostsToChooseFromAndWarnings()
+    {
+        await MeasureImportAsync(
+            faults => faults.ShouldBeEmpty("with a scanned list"),
+            await ScannedImportAsync());
+    }
+
+    // ---- Helpers ----
+
+    /// <remarks>
+    /// The page is built by the factory rather than handed in already constructed: an Avalonia control is
+    /// owned by whichever thread creates it, and every caller of this helper must build its page on the
+    /// dispatcher thread <see cref="LayoutHarness.OnTheUiThreadAsync"/> switches onto, not on the test
+    /// runner's own thread the factory is captured from.
+    /// </remarks>
+    private Task MeasureAsync(Func<UserControl> page, Action<IReadOnlyList<string>> assert) =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var control = page();
+                control.DataContext = shell;
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    control, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    assert(LayoutHarness.Unreachable(window));
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+    private static Button ButtonNamed(Visual root, string label) =>
+        root.GetVisualDescendants()
+            .OfType<Button>()
+            .First(button => string.Equals(button.Content as string, label, StringComparison.Ordinal));
+
+    /// <summary>
+    /// Lays the importer out at the budget settings mode's own content column actually gets.
+    /// </summary>
+    /// <remarks>
+    /// Not built through <see cref="MeasureAsync"/>: every other settings page is typed to
+    /// <see cref="MainWindowViewModel"/> and takes <see cref="shell"/> as its data context, where
+    /// <c>ImportScreen</c> is typed to <c>ImportViewModel</c> — the same split <c>SettingsView.axaml</c>
+    /// draws by handing it <c>{Binding ImportScreen}</c> rather than the shell itself.
+    /// </remarks>
+    private Task MeasureImportAsync(
+        Action<IReadOnlyList<string>> assert,
+        ImportViewModel? import = null) =>
+        LayoutHarness.OnTheUiThreadAsync(
+            () =>
+            {
+                var screen = new ImportScreen
+                {
+                    DataContext = import ?? new ImportViewModel(vault, new SshConfigLocator()),
+                };
+
+                var window = LayoutHarness.HostAtMinimumSize(
+                    screen, LayoutHarness.SettingsContentWidth, LayoutHarness.SettingsContentHeight);
+
+                try
+                {
+                    assert(LayoutHarness.Unreachable(window));
+                }
+                finally
+                {
+                    window.Close();
+                }
+            },
+            Token);
+
+    /// <summary>
+    /// An import view model that has scanned a real file, so the table has rows in it.
+    /// </summary>
+    /// <remarks>
+    /// Through a temporary directory rather than by populating the rows directly, because the shape being
+    /// measured is what the parser produces — an entry with two warnings under it is taller than one
+    /// without, and inventing the rows would measure a layout nothing generates.
+    /// </remarks>
+    private async Task<ImportViewModel> ScannedImportAsync()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"dodossh-settings-import-{Guid.CreateVersion7():N}");
+        Directory.CreateDirectory(directory);
+
+        try
+        {
+            await File.WriteAllTextAsync(
+                Path.Combine(directory, "config"),
+                """
+                Host *
+                  ServerAliveInterval 30
+
+                Host prod-db
+                  HostName database.production.internal
+                  User deploy
+                  Port 2222
+                  IdentityFile ~/.ssh/id_ed25519
+
+                Host bastion-eu-west-1
+                  HostName bastion.eu-west-1.example.com
+                  User ops
+                  ProxyCommand nc %h %p
+                  Compression yes
+                  compression no
+
+                Match host anything
+                  User root
+                """);
+
+            var import = new ImportViewModel(vault, new SshConfigLocator(directory));
+
+            // Awaited, not fired. ScanCommand reads a file, so executing without awaiting measures an empty
+            // table — which is the other test.
+            await import.ScanCommand.ExecuteAsync(null);
+
+            import.HasRows.ShouldBeTrue("the fixture has hosts in it");
+            import.HasWarnings.ShouldBeTrue("the fixture has a Match block and a wildcard block");
+
+            return import;
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+}

tests/DodoSSH.Client.App.Tests/FakeSsh.cs

@@ -83,6 +83,9 @@ internal sealed class FakeSftpSession(SshConnectionRequest request) : ISftpSessi
     public HostKeyPresentation HostKey { get; } =
         new(request.Host, request.Port, "ssh-ed25519", "SHA256:fake");
 
+    /// <inheritdoc />
+    public string Cipher { get; } = "aes256-gcm@openssh.com";
+
     /// <inheritdoc />
     public string HomeDirectory => $"/home/{request.Username}";
 
@@ -139,6 +142,9 @@ internal sealed class FakeSshConnection(SshConnectionRequest request) : ISshConn
     public HostKeyPresentation HostKey { get; } =
         new(request.Host, request.Port, "ssh-ed25519", "SHA256:fake");
 
+    /// <inheritdoc />
+    public string Cipher { get; } = "aes256-gcm@openssh.com";
+
     /// <inheritdoc />
     public Task<ISshShellSession> OpenShellAsync(
         TerminalSize size,

tests/DodoSSH.Client.App.Tests/RootChipNameTests.cs

@@ -0,0 +1,47 @@
+using DodoSSH.Client.Shell.ViewModels;
+using DodoSSH.Client.Transfer;
+
+namespace DodoSSH.Client.App.Tests;
+
+/// <summary>What the local pane's root chips are called.</summary>
+/// <remarks>
+/// A chip carries a name and never a path — the path is the chip's command parameter, where its length costs
+/// nothing. The derivation used to be <c>TrimEnd(separator)</c>, which is a name only for a Windows drive:
+/// on Unix it made the <c>/</c> chip an empty pill and the home chip the whole home path, and a home
+/// directory deep enough pushed the pane header's own buttons out of the window — CI's per-job HOME is what
+/// finally said so. These pin the derivation with fixed strings, so the question no longer depends on how
+/// long a path any particular machine keeps its profile under.
+/// </remarks>
+public sealed class RootChipNameTests
+{
+    [Fact]
+    public void TheUnixRootIsASlash_NotAnEmptyPill() =>
+        TransfersViewModel.RootChipName("/").ShouldBe("/");
+
+    /// <remarks>
+    /// The one substitution rather than a shortening: every shell already means "my home directory" by
+    /// <c>~</c>, and the machine's real home path — however deep — stays on the chip's command alone.
+    /// </remarks>
+    [Fact]
+    public void TheHomeChipIsATilde_HoweverDeepHomeSits() =>
+        TransfersViewModel.RootChipName(LocalDirectory.Home).ShouldBe("~");
+
+    [Fact]
+    public void AMountNamesItselfByItsLastSegment() =>
+        TransfersViewModel.RootChipName("/media/usb0").ShouldBe("usb0");
+
+    /// <remarks>
+    /// Windows only, because the input only exists there — <c>LocalDirectory.Roots()</c> produces drive
+    /// roots on no other platform, and <c>Path.GetFileName</c> reads <c>C:\</c> differently on Unix.
+    /// </remarks>
+    [Fact]
+    public void AWindowsDriveKeepsItsTwoCharacterName()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return;
+        }
+
+        TransfersViewModel.RootChipName(@"C:\").ShouldBe("C:");
+    }
+}

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -2,6 +2,7 @@ using System.Globalization;
 using DodoSSH.Client.Auth;
 using DodoSSH.Client.Domain;
 using DodoSSH.Client.Import;
+using DodoSSH.Client.ObjectStore;
 using DodoSSH.Client.Session;
 // FakeDeviceKeyStore is compiled into this assembly from a source link and keeps its original namespace;
 // see the csproj for why it is shared rather than reimplemented.
@@ -1253,6 +1254,68 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.IsTerminalShowing.ShouldBeTrue();
     }
 
+    /// <remarks>
+    /// The status line is one line for the whole window, so a sentence about a session that has been closed is
+    /// a sentence the user reads over some other terminal.
+    /// </remarks>
+    [Fact]
+    public async Task ClosingATab_TakesItsOwnStatusLineWithIt()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        await vault.ConnectCommand.ExecuteAsync(null);
+        vault.Status.ShouldContain("Connected", Case.Insensitive);
+
+        await shell.CloseTabCommand.ExecuteAsync(shell.Tabs[0]);
+
+        vault.Status.ShouldBeEmpty();
+    }
+
+    /// <remarks>
+    /// The other half, and the reason closing does not simply blank the bar: everything this application has
+    /// to say about a save, a sync or a refusal goes through the same line — see <c>StatusBar.axaml</c> — and
+    /// closing a terminal answers none of it.
+    /// </remarks>
+    [Fact]
+    public async Task ClosingATab_LeavesAStatusLineThatIsAboutSomethingElse()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        await vault.ConnectCommand.ExecuteAsync(null);
+        vault.Status = "The keychain could not be saved.";
+
+        await shell.CloseTabCommand.ExecuteAsync(shell.Tabs[0]);
+
+        vault.Status.ShouldBe("The keychain could not be saved.");
+    }
+
+    /// <remarks>
+    /// Two sessions to the same host, which is the case a label could not tell apart: the line belongs to the
+    /// attempt that wrote it, so closing the other one leaves it alone.
+    /// </remarks>
+    [Fact]
+    public async Task ClosingATab_LeavesTheLineAnotherTabWrote()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        await vault.ConnectCommand.ExecuteAsync(null);
+        var first = shell.Tabs[0];
+
+        // The second connection's own line is what the bar holds now.
+        await vault.ConnectCommand.ExecuteAsync(null);
+        var reported = vault.Status;
+
+        await shell.CloseTabCommand.ExecuteAsync(first);
+
+        vault.Status.ShouldBe(reported);
+    }
+
     // ---- Connecting, while it is still happening ----
     //
     // A handshake is a network round trip and no longer holds the vault while it runs, so there is a stretch
@@ -3815,6 +3878,66 @@ public sealed class ShellFlowTests : IAsyncLifetime
         vault.KnownHostPins.ShouldHaveSingleItem();
     }
 
+    /// <remarks>
+    /// v5c-3: fingerprints are public — operators publish theirs on purpose — so this is the one clipboard
+    /// copy on this screen that needs no confirmation and no refusal, unlike a private key's own
+    /// <c>CopyPublicKeyCommand</c>. In full, because a shortened fingerprint cannot be compared against what
+    /// was published.
+    /// </remarks>
+    [Fact]
+    public async Task CopyingAPinsFingerprint_PutsTheFullFingerprintOnTheClipboard()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await knownHosts.TrustAsync(
+            new HostKeyPresentation("db.internal", 22, "ssh-ed25519", "SHA256:the-key"), Token);
+
+        await vault.LoadAsync(Token);
+        vault.SelectedKnownHost = vault.KnownHostPins.ShouldHaveSingleItem();
+
+        await vault.CopyPinFingerprintCommand.ExecuteAsync(null);
+
+        clipboard.ShouldHaveSingleItem().ShouldBe("SHA256:the-key");
+    }
+
+    /// <remarks>The v5c screen's own restyle over <see cref="KnownHostsViewModel"/> forwards the same command.</remarks>
+    [Fact]
+    public async Task CopyingAPinsFingerprintThroughTheKnownHostsScreen_ReachesTheVault()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await knownHosts.TrustAsync(
+            new HostKeyPresentation("db.internal", 22, "ssh-ed25519", "SHA256:the-key"), Token);
+        await vault.LoadAsync(Token);
+
+        var pins = shell.KnownHostsScreen.ShouldNotBeNull();
+        pins.Selected = pins.VisiblePins.ShouldHaveSingleItem();
+
+        await pins.CopyFingerprintCommand.ExecuteAsync(null);
+
+        clipboard.ShouldHaveSingleItem().ShouldBe("SHA256:the-key");
+    }
+
+    /// <remarks>
+    /// The v5c header's own back arrow, reached through the same onBack delegate ImportViewModel's Cancel
+    /// button uses — see MainWindowViewModel.OnVaultChanged. Its destination is the Keychain screen this list
+    /// was pulled out of.
+    /// </remarks>
+    [Fact]
+    public async Task TheKnownHostsScreensBackArrow_ReturnsToKeychain()
+    {
+        await UnlockedAsync();
+
+        shell.ShowScreenCommand.Execute(ShellScreen.KnownHosts);
+        shell.IsKnownHostsScreen.ShouldBeTrue();
+
+        var pins = shell.KnownHostsScreen.ShouldNotBeNull();
+        pins.BackCommand.Execute(null);
+
+        shell.IsKeychainScreen.ShouldBeTrue();
+    }
+
     /// <remarks>
     /// Pins used to be a category on the keychain screen. They are a destination of their own now, and this
     /// is the seam that could silently come apart: the screen's view model is built from the vault in
@@ -4332,6 +4455,150 @@ public sealed class ShellFlowTests : IAsyncLifetime
         import.Status.ShouldContain("no", Case.Insensitive);
     }
 
+    // ---- v5c-3: the WHAT THIS MEANS chip, tick-all, and the footer's own facts ----
+
+    /// <remarks>
+    /// The three real states a row can be in, and nothing else: a skipped <c>Host</c> pattern never becomes a
+    /// row at all (see <c>SshConfigImport.SkippedPatterns</c>), so there is no fourth, invented "skipped" chip
+    /// to test for. A warned row wins over "already here" — see <c>ImportRowViewModel.Meaning</c>.
+    /// </remarks>
+    [Fact]
+    public async Task TheImportersMeaningChipsMapTheRealRowStatesHonestly()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await AddHostAsync(vault, "prod-db");
+
+        var sshDirectory = Path.Combine(directory, $"ssh-meaning-{Guid.CreateVersion7():N}");
+        Directory.CreateDirectory(sshDirectory);
+
+        await File.WriteAllTextAsync(
+            Path.Combine(sshDirectory, "config"),
+            """
+            Host already-here
+              HostName db.internal
+              User deploy
+
+            Host bastion
+              HostName bastion.internal
+              User ops
+              ProxyCommand nc %h %p
+
+            Host fresh
+              HostName fresh.internal
+              User deploy
+            """,
+            Token);
+
+        var import = new ImportViewModel(vault, new SshConfigLocator(sshDirectory));
+
+        await import.ScanCommand.ExecuteAsync(null);
+
+        import.Rows.Count.ShouldBe(3);
+
+        var known = import.Rows.Single(row => string.Equals(row.Alias, "already-here", StringComparison.Ordinal));
+        known.IsMeaningExisting.ShouldBeTrue();
+        known.IsMeaningNew.ShouldBeFalse();
+        known.IsMeaningWarned.ShouldBeFalse();
+        known.Meaning.ShouldBe("already here");
+
+        var warned = import.Rows.Single(row => string.Equals(row.Alias, "bastion", StringComparison.Ordinal));
+        warned.IsMeaningWarned.ShouldBeTrue();
+        warned.IsMeaningNew.ShouldBeFalse();
+        warned.IsMeaningExisting.ShouldBeFalse();
+        // The warned chip carries the row's own real reason.
+        warned.Meaning.ShouldContain("ProxyCommand");
+
+        var fresh = import.Rows.Single(row => string.Equals(row.Alias, "fresh", StringComparison.Ordinal));
+        fresh.IsMeaningNew.ShouldBeTrue();
+        fresh.IsMeaningExisting.ShouldBeFalse();
+        fresh.IsMeaningWarned.ShouldBeFalse();
+        fresh.Meaning.ShouldBe("new host");
+    }
+
+    /// <remarks>The header's own tick-all box, over <see cref="ImportViewModel.ToggleAllCommand"/>.</remarks>
+    [Fact]
+    public async Task TickingAllTogglesEveryRowAndTheHeaderTickReflectsIt()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        var sshDirectory = Path.Combine(directory, $"ssh-tickall-{Guid.CreateVersion7():N}");
+        Directory.CreateDirectory(sshDirectory);
+
+        await File.WriteAllTextAsync(
+            Path.Combine(sshDirectory, "config"),
+            """
+            Host a
+              HostName a.internal
+
+            Host b
+              HostName b.internal
+            """,
+            Token);
+
+        var import = new ImportViewModel(vault, new SshConfigLocator(sshDirectory));
+        await import.ScanCommand.ExecuteAsync(null);
+
+        import.AllTicked.ShouldBeTrue("both are new hosts, which start ticked");
+
+        import.Rows[0].IsSelected = false;
+        import.NoteSelectionChanged();
+
+        import.AllTicked.ShouldBeFalse();
+
+        import.ToggleAllCommand.Execute(null);
+
+        import.AllTicked.ShouldBeTrue("fewer than all ticked toggles everything on");
+        import.Rows.ShouldAllBe(row => row.IsSelected);
+
+        import.ToggleAllCommand.Execute(null);
+
+        import.AllTicked.ShouldBeFalse();
+        import.Rows.ShouldAllBe(row => !row.IsSelected);
+    }
+
+    /// <remarks>
+    /// The key-material opt-in card's own always-visible sentence: a real count of hosts naming a key file,
+    /// the real directory, and the same "nothing is read until Import is pressed" claim verified against
+    /// <see cref="SshConfigLocator.ReadIdentity"/> only ever being called from <c>ImportAsync</c>.
+    /// </remarks>
+    [Fact]
+    public async Task TheKeyMaterialCardsIntroSentence_NamesTheRealCountAndDirectory()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        var sshDirectory = KeyedConfigDirectory();
+        var import = new ImportViewModel(vault, new SshConfigLocator(sshDirectory));
+
+        await import.ScanCommand.ExecuteAsync(null);
+
+        import.KeyMaterialIntro.ShouldContain("1 host names");
+        import.KeyMaterialIntro.ShouldContain(sshDirectory);
+        import.KeyMaterialIntro.ShouldContain(
+            "nothing is read until Import is pressed", Case.Insensitive);
+    }
+
+    [Fact]
+    public async Task TheFooterSummary_NamesTheRealSelectionCountAndVault()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        var sshDirectory = Path.Combine(directory, $"ssh-summary-{Guid.CreateVersion7():N}");
+        Directory.CreateDirectory(sshDirectory);
+
+        await File.WriteAllTextAsync(
+            Path.Combine(sshDirectory, "config"), "Host a\n  HostName a.internal\n", Token);
+
+        var import = new ImportViewModel(vault, new SshConfigLocator(sshDirectory));
+        await import.ScanCommand.ExecuteAsync(null);
+
+        import.SelectionSummary.ShouldBe($"1 of 1 entry selected · saving to {vault.VaultName}");
+    }
+
     // ---- Filtering the host sidebar ----
 
     /// <remarks>
@@ -4435,6 +4702,38 @@ public sealed class ShellFlowTests : IAsyncLifetime
         rows[3].ShouldBeOfType<HostRowViewModel>().Label.ShouldBe("stage-web");
     }
 
+    /// <remarks>
+    /// v5c-2: the settings Groups page's "No group" footer row. Counts a host whose group has never been set
+    /// and one whose group id dangles (deleted from under it) the same way — both are "ungrouped" to a person
+    /// looking at the list, per the reading <c>FlattenIntoSections</c> already gives the sidebar's own
+    /// heading, and <c>UngroupedHostCount</c> has to agree with it rather than invent a second definition.
+    /// </remarks>
+    [Fact]
+    public async Task UngroupedHostCount_CountsHostsWithNoGroupAndHostsWhoseGroupHasGone()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await AddHostAsync(vault, "prod-db");
+        await AddHostAsync(vault, "stage-web");
+        await AddHostAsync(vault, "bastion");
+        await AddGroupAsync(vault, "production");
+
+        vault.UngroupedHostCount.ShouldBe(3, "no host has been filed under the new group yet");
+
+        await FileAsync(vault, "prod-db", "production");
+
+        vault.UngroupedHostCount.ShouldBe(2, "one host now belongs to a real group");
+
+        var group = vault.Groups.Single();
+        vault.DeleteGroupCommand.Execute(group);
+        vault.PendingDeletion.ShouldNotBeNull();
+        await vault.ConfirmDeleteCommand.ExecuteAsync(null);
+
+        vault.UngroupedHostCount.ShouldBe(
+            3, "a host whose group was deleted falls back to ungrouped rather than vanishing from the count");
+    }
+
     /// <remarks>
     /// An empty group keeps its heading; a group emptied by the filter does not. The first is a folder
     /// somebody made and can put things in, the second is an absence of search results — and a heading with
@@ -5609,6 +5908,60 @@ public sealed class ShellFlowTests : IAsyncLifetime
         Host(vault, "staging").Host.GroupId.ShouldBeNull("it was never ticked");
     }
 
+    /// <remarks>
+    /// The other refusal at the same door, and the one that needs two keychains to raise: a group is an
+    /// item of one vault, so filing a mixed set under it would leave everyone else in the shared vault
+    /// seeing a machine filed under nothing. Checked when the picker is asked for and over the whole set —
+    /// see <see cref="VaultViewModel.RegroupChosenHosts"/> — rather than once per host mid-write, which is
+    /// why no panel opens at all and the status line's sentence has to carry the whole explanation.
+    /// </remarks>
+    [Fact]
+    public async Task RegroupingHostsChosenAcrossTwoKeychains_IsRefusedBeforeThePickerOpens()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+
+        await vaults.LoadAsync(Token);
+
+        vaults.NewVaultCommand.Execute(null);
+        vaults.NewVaultName = "Platform secrets";
+
+        await vaults.CreateVaultCommand.ExecuteAsync(null);
+
+        var vault = shell.Vault!;
+        var sharedVaultId = vaults.SelectedVault!.VaultId;
+
+        await vault.LoadAsync(Token);
+
+        await AddHostAsync(vault, "prod-db");
+
+        vault.NewHostCommand.Execute(null);
+        vault.EditorSelectedVault =
+            vault.EditorVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
+        vault.EditorLabel = "prod-web";
+        vault.EditorHostname = "web.internal";
+
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.ChooseHostCommand.Execute(Host(vault, "prod-db"));
+        vault.ToggleHostChoiceCommand.Execute(Host(vault, "prod-web"));
+
+        vault.RegroupChosenHostsCommand.Execute(null);
+
+        vault.IsRegroupingChosenHosts.ShouldBeFalse("a group belongs to one keychain");
+        vault.Status.ShouldStartWith("These hosts are in more than one keychain");
+        vault.IsChoosingHosts.ShouldBeTrue("the set was refused, not dissolved");
+
+        // Unticking the visitor is all it takes: the refusal is about the set, not a latch the screen has
+        // to be talked out of.
+        vault.ToggleHostChoiceCommand.Execute(Host(vault, "prod-web"));
+
+        vault.RegroupChosenHostsCommand.Execute(null);
+
+        vault.IsRegroupingChosenHosts.ShouldBeTrue(vault.Status);
+    }
+
     /// <remarks>
     /// Duplicating keeps the group and the tags, which is the whole difference between it and a copy into
     /// another vault: the copy stays in the same keychain, so everything it points at is still there.
@@ -5985,7 +6338,9 @@ public sealed class ShellFlowTests : IAsyncLifetime
     /// <remarks>
     /// The status bar's facts, read off the selected terminal tab. <see cref="MainWindowViewModel.SessionElapsedText"/>
     /// is real, not fabricated: <c>StartedAt</c> is set from the shell's own clock at the moment the session
-    /// opens, and this reads it back through the same clock.
+    /// opens, and this reads it back through the same clock. The cipher and host-key algorithm are the
+    /// fake's own, and the identity text is the bound key's label — <c>ConnectedHostWithAPinAsync</c> binds
+    /// "deploy" — composed with the real (unshortened) algorithm string.
     /// </remarks>
     [Fact]
     public async Task SessionFacts_ReflectTheSelectedTerminalTab()
@@ -5995,6 +6350,9 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.IsSessionConnected.ShouldBeTrue();
         shell.SessionAddress.ShouldBe(shell.Tabs[0].Address);
         shell.SessionElapsedText.ShouldNotBeNull().ShouldStartWith("session ");
+        shell.SessionCipher.ShouldBe("aes256-gcm@openssh.com");
+        shell.SessionHostKeyAlgorithm.ShouldBe("ssh-ed25519");
+        shell.SessionIdentityText.ShouldBe("ssh-ed25519 · deploy");
     }
 
     /// <remarks>
@@ -6009,6 +6367,55 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.IsSessionConnected.ShouldBeFalse();
         shell.SessionAddress.ShouldBeNull();
         shell.SessionElapsedText.ShouldBeNull();
+        shell.SessionCipher.ShouldBeNull();
+        shell.SessionHostKeyAlgorithm.ShouldBeNull();
+        shell.SessionIdentityText.ShouldBeNull();
+    }
+
+    /// <remarks>
+    /// A typed password has nothing filed in the keychain to name, so the status bar's identity run is the
+    /// host-key algorithm alone — no " · " and nothing after it, which is what
+    /// <see cref="MainWindowViewModel.SessionIdentityText"/>'s own remark promises rather than a placeholder
+    /// standing in for the item that was never there.
+    /// </remarks>
+    [Fact]
+    public async Task SessionFacts_ATypedPasswordSession_ShowsTheHostKeyAlgorithmAloneWithNoIdentity()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        vault.ManualTarget = "deploy@build.internal:2222";
+        vault.ManualPassword = "hunter2";
+
+        await vault.ConnectManuallyCommand.ExecuteAsync(null);
+
+        shell.IsSessionConnected.ShouldBeTrue();
+        shell.SessionHostKeyAlgorithm.ShouldBe("ssh-ed25519");
+        shell.SessionIdentityText.ShouldBe("ssh-ed25519", "a typed password names no keychain item");
+    }
+
+    /// <remarks>
+    /// The same facts on the other surface, and one asymmetry worth pinning: the SFTP session is its own
+    /// login through the same resolution ladder, so the status bar names that session's cipher, host key and
+    /// identity — and stops naming them on disconnect, where a terminal tab keeps its facts for the
+    /// scrollback still on screen (see <c>TerminalTabViewModel.Cipher</c>'s remark).
+    /// </remarks>
+    [Fact]
+    public async Task SessionFacts_FollowTheSftpSurfacesOwnSession()
+    {
+        await ConnectedHostWithAPinAsync();
+
+        await shell.OpenPinnedPathCommand.ExecuteAsync("/var/www/app");
+
+        shell.IsTransfersShowing.ShouldBeTrue();
+        shell.SessionCipher.ShouldBe("aes256-gcm@openssh.com");
+        shell.SessionIdentityText.ShouldBe("ssh-ed25519 · deploy");
+
+        await shell.Transfers.DisconnectCommand.ExecuteAsync(null);
+
+        shell.SessionCipher.ShouldBeNull("the SFTP surface has no scrollback for a dead session's facts to describe");
+        shell.SessionIdentityText.ShouldBeNull();
     }
 
     [Fact]
@@ -6282,6 +6689,46 @@ public sealed class ShellFlowTests : IAsyncLifetime
         Host(vault, "prod-db").Host.TagIds.ShouldBe(wornBefore);
     }
 
+    /// <remarks>
+    /// v5c-2: the settings Tags page has no list selection to lean on the way the keychain screen's own
+    /// table does, so <c>EditTagRow</c>/<c>DeleteTagRow</c> select the row and then hand off to the real
+    /// commands above — this proves the hand-off reaches the same place, with the same guard sentences.
+    /// </remarks>
+    [Fact]
+    public async Task EditTagRow_SelectsTheRowThenOpensTheSameEditorEditTagDoes()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await AddTagAsync(vault, "pci");
+        var row = vault.Tags.Single();
+
+        vault.EditTagRowCommand.Execute(row);
+
+        vault.SelectedTag.ShouldBe(row);
+        vault.IsEditingTag.ShouldBeTrue();
+        vault.TagEditorLabel.ShouldBe("pci");
+    }
+
+    [Fact]
+    public async Task DeleteTagRow_SelectsTheRowThenArmsTheSameConfirmationDeleteTagDoes()
+    {
+        await UnlockedAsync();
+        var vault = shell.Vault!;
+
+        await AddHostAsync(vault, "prod-db");
+        await AddTagAsync(vault, "pci");
+        await TagAsync(vault, "prod-db", "pci");
+
+        var row = vault.Tags.Single();
+
+        vault.DeleteTagRowCommand.Execute(row);
+
+        vault.SelectedTag.ShouldBe(row);
+        vault.PendingDeletion.ShouldNotBeNull().Usage
+            .ShouldContain("1 host", Case.Insensitive, "the same guard sentence DeleteTag would have armed");
+    }
+
     [Fact]
     public async Task ATagCreatedFromTheHostEditor_IsPutOnTheHostBeingEdited()
     {
@@ -7675,6 +8122,221 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.Transfers.RemoteEntries.Select(entry => entry.Name).ShouldBe(["notes.txt"]);
     }
 
+    /// <remarks>
+    /// The phone's Files-screen chip row, proven at the view model rather than through Avalonia: a pin
+    /// saved on the host before this screen ever connects to it is read straight off the row's own
+    /// <c>HostSecret.PinnedPaths</c> at the moment <c>MarkHostConnected</c> runs, which is what
+    /// <see cref="TransfersViewModel.ConnectedPinnedPaths"/>'s own remark promises rather than a live follow
+    /// of the vault.
+    /// </remarks>
+    [Fact]
+    public async Task ConnectingATransfersHostWithPins_PopulatesConnectedPinnedPaths()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorNewPin = "/var/www/app";
+        vault.AddEditorPinCommand.Execute(null);
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.ConnectedPinnedPaths.ShouldBe(["/var/www/app"]);
+        shell.Transfers.HasConnectedPins.ShouldBeTrue();
+    }
+
+    /// <remarks>
+    /// The other half of <see cref="ConnectingATransfersHostWithPins_PopulatesConnectedPinnedPaths"/>: the
+    /// chip row has to go with the connection it belongs to, or a later connect to a host with no pins would
+    /// show the previous host's.
+    /// </remarks>
+    [Fact]
+    public async Task DisconnectingTheTransfersScreen_ClearsConnectedPinnedPaths()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        vault.EditSelectedHostCommand.Execute(null);
+        vault.EditorNewPin = "/var/www/app";
+        vault.AddEditorPinCommand.Execute(null);
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+        shell.Transfers.HasConnectedPins.ShouldBeTrue();
+
+        await shell.Transfers.DisconnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.ConnectedPinnedPaths.ShouldBeEmpty();
+        shell.Transfers.HasConnectedPins.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// The phone's foreground-service question, proven at the view model rather than through Android: a
+    /// connect that opens an SFTP session is exactly the transition <c>SessionKeepAlive</c> needs to hear
+    /// about even when no transfer ever moves — see <see cref="TransfersViewModel.ActivityChanged"/>'s own
+    /// remark for why the queue's own raise, in <c>OnTransferChanged</c>, cannot cover a connect that never
+    /// touches <c>Transfers</c> at all.
+    /// </remarks>
+    [Fact]
+    public async Task ConnectingATransfersHost_RaisesActivityChangedAndTurnsOnHasLiveFileSession()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        var raised = 0;
+        shell.Transfers.ActivityChanged += (_, _) => raised++;
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.HasLiveFileSession.ShouldBeTrue();
+        raised.ShouldBeGreaterThan(0);
+    }
+
+    /// <remarks>
+    /// The other half: a disconnect is as much a transition the service must hear about as a connect is,
+    /// because it is the moment the connection <see cref="TransfersViewModel.HasLiveFileSession"/> promised
+    /// was open stops being true — and the foreground service would otherwise keep the process alive over a
+    /// session that has already closed.
+    /// </remarks>
+    [Fact]
+    public async Task DisconnectingTheTransfersScreen_RaisesActivityChangedAndTurnsOffHasLiveFileSession()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.Transfers.SelectedHost = shell.Transfers.Hosts[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+        shell.Transfers.HasLiveFileSession.ShouldBeTrue();
+
+        var raised = 0;
+        shell.Transfers.ActivityChanged += (_, _) => raised++;
+
+        await shell.Transfers.DisconnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.HasLiveFileSession.ShouldBeFalse();
+        raised.ShouldBeGreaterThan(0);
+    }
+
+    /// <remarks>
+    /// A bucket is an <c>IRemoteFileStore</c> with no <c>HostSecret</c> underneath it, so there is no
+    /// <c>PinnedPaths</c> to read at all — see <see cref="TransfersViewModel.OpenBucketAsync"/>'s own remark.
+    /// The bucket here is created through the same keychain route
+    /// <see cref="TheS3ScreenWithNoBuckets_SaysWhereOneIsMadeAndGoesThere"/> exercises, and
+    /// <see cref="FakeObjectStoreFactory"/> stands in for the network the way <see cref="FakeSshConnectionFactory"/>
+    /// already does for SFTP.
+    /// </remarks>
+    [Fact]
+    public async Task ConnectingABucket_LeavesConnectedPinnedPathsEmpty()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts, buckets: new FakeObjectStoreFactory());
+
+        vault.NewObjectStoreCommand.Execute(null);
+        vault.BucketEditorLabel = "Backups";
+        vault.BucketEditorBucket = "backups";
+        vault.BucketEditorAccessKeyId = "AKIAEXAMPLE";
+        vault.BucketEditorSecretAccessKey = "a-secret-access-key";
+        vault.BucketEditorRegion = "eu-west-1";
+        await vault.SaveObjectStoreCommand.ExecuteAsync(null);
+
+        // Remote is what ConnectAsync branches on, and Attach's RefreshHosts has already auto-selected the
+        // host ReadyToConnectAsync left in the picker — without this line the command below dialled that
+        // host, and every assertion here passed only because that host happens to have no pins either. The
+        // ConnectedTo check is the proof the bucket path was actually taken.
+        shell.Transfers.Remote = RemoteKind.Bucket;
+        shell.Transfers.SelectedBucket = shell.Transfers.Buckets[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.ConnectedTo.ShouldBe("s3://backups");
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.ConnectedPinnedPaths.ShouldBeEmpty();
+        shell.Transfers.HasConnectedPins.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// A bucket is HTTP, per-request, with nothing open that a dying process would lose — see
+    /// <see cref="TransfersViewModel.HasLiveFileSession"/>'s own remark. <c>IsConnected</c> alone would have
+    /// answered this wrongly, which is exactly why the flag reads <c>ConnectedCipher</c> as well: nothing
+    /// underneath a bucket ever sets it.
+    /// </remarks>
+    [Fact]
+    public async Task ConnectingABucket_LeavesHasLiveFileSessionOff()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts, buckets: new FakeObjectStoreFactory());
+
+        vault.NewObjectStoreCommand.Execute(null);
+        vault.BucketEditorLabel = "Backups";
+        vault.BucketEditorBucket = "backups";
+        vault.BucketEditorAccessKeyId = "AKIAEXAMPLE";
+        vault.BucketEditorSecretAccessKey = "a-secret-access-key";
+        vault.BucketEditorRegion = "eu-west-1";
+        await vault.SaveObjectStoreCommand.ExecuteAsync(null);
+
+        // ReadyToConnectAsync already left a host in the picker, and Attach's own RefreshHosts auto-selects
+        // it — so without this the CONNECT command below would dial that host rather than open the bucket,
+        // and a host with no pins would make ConnectedPinnedPathsEmpty-style assertions pass for the wrong
+        // reason. Remote is what ConnectAsync actually branches on.
+        shell.Transfers.Remote = RemoteKind.Bucket;
+        shell.Transfers.SelectedBucket = shell.Transfers.Buckets[0];
+
+        await shell.Transfers.ConnectCommand.ExecuteAsync(null);
+
+        shell.Transfers.ConnectedTo.ShouldBe("s3://backups", "proof this opened the bucket rather than the host");
+        shell.Transfers.IsConnected.ShouldBeTrue(shell.Transfers.Status);
+        shell.Transfers.HasLiveFileSession.ShouldBeFalse();
+    }
+
+    /// <summary>A bucket that opens and lists as empty, so a bucket connect can be proven with no network.</summary>
+    private sealed class FakeObjectStoreFactory : IObjectStoreFactory
+    {
+        public IRemoteFileStore Open(ObjectStoreSecret store) => new FakeBucketStore();
+    }
+
+    /// <summary>The minimum <see cref="IRemoteFileStore"/> a bucket connect touches: home, then a listing.</summary>
+    private sealed class FakeBucketStore : IRemoteFileStore
+    {
+        public bool IsConnected => true;
+
+        public string HomeDirectory => "/";
+
+        public Task<IReadOnlyList<SftpEntry>> ListAsync(string path, CancellationToken cancellationToken) =>
+            Task.FromResult<IReadOnlyList<SftpEntry>>([]);
+
+        public Task<SftpEntry?> StatAsync(string path, CancellationToken cancellationToken) =>
+            Task.FromResult<SftpEntry?>(null);
+
+        public Task<Stream> OpenReadAsync(string path, long offset, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
+
+        public Task<Stream> OpenWriteAsync(string path, long offset, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
+
+        public Task CreateDirectoryAsync(string path, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
+
+        public Task DeleteAsync(string path, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
+
+        public Task RenameAsync(string fromPath, string toPath, CancellationToken cancellationToken) =>
+            throw new NotSupportedException("Not exercised by proving a bucket connect leaves no pins.");
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
     /// <remarks>
     /// <para>
     /// The picker that replaced the desktop's connect bar, and the four things that put it away again. It
@@ -7915,6 +8577,249 @@ public sealed class ShellFlowTests : IAsyncLifetime
         ssh.Requests.ShouldNotBeEmpty("the password is only kept once a handshake has succeeded");
     }
 
+    // ---- v5c: settings mode ----
+    //
+    // The window-level mode that swaps the titlebar, the rail and the page area for settings mode's own —
+    // see MainWindowViewModel.EnterSettings and design-notes/v5c-fidelity-notes.md. What is worth proving at
+    // this level, with no Avalonia involved, is the state machine itself: entering and leaving preserves
+    // wherever the user actually was, switching between settings pages does not forget it, and the two
+    // pages that mirror an existing ShellScreen keep every binding written against that screen before this
+    // mode existed.
+
+    /// <remarks>
+    /// The core promise of "Back to application": whatever screen a user was on survives a trip through
+    /// settings mode untouched, however many pages they visit while they are there.
+    /// </remarks>
+    [Fact]
+    public async Task EnteringAndLeavingSettingsMode_PreservesTheScreenItWasEnteredFrom()
+    {
+        await ReadyToConnectAsync();
+        shell.ShowScreenCommand.Execute(ShellScreen.Keychain);
+
+        shell.EnterSettingsCommand.Execute(SettingsPage.General);
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.General);
+
+        // Switching pages inside settings mode must not overwrite the remembered return screen with a
+        // settings page of its own — see the remark on MainWindowViewModel.settingsReturnScreen.
+        shell.EnterSettingsCommand.Execute(SettingsPage.Security);
+        shell.EnterSettingsCommand.Execute(SettingsPage.Preferences);
+
+        shell.LeaveSettingsCommand.Execute(null);
+
+        shell.IsSettingsMode.ShouldBeFalse();
+        shell.ActiveSettingsPage.ShouldBeNull();
+        shell.Screen.ShouldBe(ShellScreen.Keychain);
+    }
+
+    /// <remarks>
+    /// Settings mode collapses the terminal the same way any other page does — <see cref="ShellSurface.Page"/>
+    /// and <see cref="ShellSurface.Terminal"/> are exclusive by construction — and "Back to application" has
+    /// to bring it back rather than leaving the user on a page they never asked for.
+    /// </remarks>
+    [Fact]
+    public async Task EnteringSettingsModeFromATerminal_CollapsesItAndLeavingRestoresIt()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        shell.IsTerminalSurface.ShouldBeTrue();
+
+        shell.EnterSettingsCommand.Execute(SettingsPage.Security);
+
+        shell.IsTerminalSurface.ShouldBeFalse("settings mode occupies the same rectangle a page does");
+        shell.IsSettingsMode.ShouldBeTrue();
+
+        shell.LeaveSettingsCommand.Execute(null);
+
+        shell.IsTerminalSurface.ShouldBeTrue();
+        shell.IsSettingsMode.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// v5c: <see cref="ShellScreen.Preferences"/> and <see cref="ShellScreen.Vaults"/> are settings pages
+    /// now, so anything that still navigates to either — a test written before this wave, the phone's own
+    /// hub — is redirected into settings mode on the matching page rather than landing on a screen the
+    /// design retired. <see cref="MainWindowViewModel.Screen"/> is kept in step with the two so every
+    /// existing binding written against either screen keeps its answer.
+    /// <para>
+    /// Two <see cref="Fact"/>s over one private body rather than a <see cref="Theory"/>: <c>ShellScreen</c>
+    /// and <c>SettingsPage</c> are both <c>internal</c>, and a public theory method may not carry an
+    /// internal type in its signature.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public void ShowingPreferences_EntersSettingsModeOnThePreferencesPage() =>
+        ShowingAScreenEntersSettingsModeOn(ShellScreen.Preferences, SettingsPage.Preferences);
+
+    [Fact]
+    public void ShowingVaults_EntersSettingsModeOnTheVaultsPage() =>
+        ShowingAScreenEntersSettingsModeOn(ShellScreen.Vaults, SettingsPage.Vaults);
+
+    /// <remarks>
+    /// v5c-2: Groups and Tags joined settings mode with no <see cref="ShellScreen"/> counterpart — managing
+    /// either has never been its own screen before this wave — so there is no redirect to prove, only that
+    /// <see cref="MainWindowViewModel.EnterSettingsCommand"/> reaches each directly.
+    /// </remarks>
+    [Fact]
+    public void EnteringSettingsOnGroups_ShowsTheGroupsPage()
+    {
+        shell.EnterSettingsCommand.Execute(SettingsPage.Groups);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.Groups);
+        shell.IsSettingsGroupsPage.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void EnteringSettingsOnTags_ShowsTheTagsPage()
+    {
+        shell.EnterSettingsCommand.Execute(SettingsPage.Tags);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.Tags);
+        shell.IsSettingsTagsPage.ShouldBeTrue();
+    }
+
+    private void ShowingAScreenEntersSettingsModeOn(ShellScreen screen, SettingsPage page)
+    {
+        shell.ShowScreenCommand.Execute(screen);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(page);
+        shell.Screen.ShouldBe(screen);
+        shell.IsShowingPages.ShouldBeTrue();
+    }
+
+    /// <remarks>
+    /// A caller that names an ordinary screen while settings mode is up is not asking to go back to
+    /// wherever settings was entered from — it is asking for that screen, which wins over "Back to
+    /// application" restoring anything.
+    /// </remarks>
+    [Fact]
+    public void NavigatingToAnOrdinaryScreenWhileInSettingsMode_LeavesSettingsModeOutright()
+    {
+        shell.ShowScreenCommand.Execute(ShellScreen.Keychain);
+        shell.EnterSettingsCommand.Execute(SettingsPage.Security);
+
+        shell.ShowScreenCommand.Execute(ShellScreen.Hosts);
+
+        shell.IsSettingsMode.ShouldBeFalse();
+        shell.Screen.ShouldBe(ShellScreen.Hosts);
+    }
+
+    /// <remarks>
+    /// The confirmation card moved from the old bare Preferences screen to the Account settings page — see
+    /// <see cref="MainWindowViewModel.SignOutFromPopover"/> — and this is the one command both the rail's
+    /// popover Logout row and settings mode's own bottom Logout row call, so there is exactly one place the
+    /// card is armed from.
+    /// </remarks>
+    [Fact]
+    public async Task SignOutFromPopover_EntersSettingsOnAccountAndArmsTheConfirmation()
+    {
+        await ReadyToConnectAsync();
+
+        shell.SignOutFromPopoverCommand.Execute(null);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.Account);
+        shell.IsConfirmingSignOut.ShouldBeTrue();
+    }
+
+    // ---- v5c-3: the importer, inside settings mode ----
+    //
+    // Import.dc.html draws the importer over the Preferences page, with SettingsNav still lit on
+    // Preferences — so ActiveSettingsPage never actually leaves SettingsPage.Preferences; only
+    // MainWindowViewModel.IsImportOpen and IsSettingsPreferencesContentShowing move. See ShowScreen's own
+    // translation of ShellScreen.Import, which is the Preferences page's "OPEN IMPORTER" row and every other
+    // caller that used to land on the old bare screen.
+
+    [Fact]
+    public void ShowingImport_OpensTheImporterOverThePreferencesPage()
+    {
+        shell.ShowScreenCommand.Execute(ShellScreen.Import);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.Preferences, "SettingsNav stays lit on Preferences");
+        shell.IsSettingsPreferencesPage.ShouldBeTrue();
+        shell.IsImportOpen.ShouldBeTrue();
+        shell.IsSettingsPreferencesContentShowing.ShouldBeFalse("the importer is drawn over it, not beside it");
+    }
+
+    /// <remarks>The titlebar's own "Back to preferences": closes the importer without leaving settings mode.</remarks>
+    [Fact]
+    public void CloseImport_ReturnsToPreferencesWithoutLeavingSettingsMode()
+    {
+        shell.ShowScreenCommand.Execute(ShellScreen.Import);
+
+        shell.CloseImportCommand.Execute(null);
+
+        shell.IsSettingsMode.ShouldBeTrue();
+        shell.ActiveSettingsPage.ShouldBe(SettingsPage.Preferences);
+        shell.IsImportOpen.ShouldBeFalse();
+        shell.IsSettingsPreferencesContentShowing.ShouldBeTrue();
+    }
+
+    /// <remarks>The importer's own footer Cancel button, wired through ImportViewModel's onCancel delegate.</remarks>
+    [Fact]
+    public async Task TheImporterScreensCancelButton_ClosesItTheSameWayTheTitlebarDoes()
+    {
+        await UnlockedAsync();
+
+        shell.ShowScreenCommand.Execute(ShellScreen.Import);
+        shell.IsImportOpen.ShouldBeTrue();
+
+        shell.ImportScreen!.CancelCommand.Execute(null);
+
+        shell.IsSettingsMode.ShouldBeTrue("Cancel backs out to Preferences, not out of Settings altogether");
+        shell.IsImportOpen.ShouldBeFalse();
+    }
+
+    /// <remarks>
+    /// Naming a settings page — including Preferences again — while the importer is up is a request for that
+    /// page, not for whatever was drawn over it last time. Covers the nav rail's own Preferences row as well
+    /// as every other page.
+    /// </remarks>
+    [Fact]
+    public void EnteringAnySettingsPageWhileImportIsOpen_ClosesTheImporter()
+    {
+        shell.ShowScreenCommand.Execute(ShellScreen.Import);
+        shell.IsImportOpen.ShouldBeTrue();
+
+        shell.EnterSettingsCommand.Execute(SettingsPage.Preferences);
+
+        shell.IsImportOpen.ShouldBeFalse();
+        shell.IsSettingsPreferencesContentShowing.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void LeavingSettingsModeWhileImportIsOpen_ClosesTheImporterToo()
+    {
+        shell.ShowScreenCommand.Execute(ShellScreen.Keychain);
+        shell.ShowScreenCommand.Execute(ShellScreen.Import);
+
+        shell.LeaveSettingsCommand.Execute(null);
+
+        shell.IsSettingsMode.ShouldBeFalse();
+        shell.IsImportOpen.ShouldBeFalse("a stale flag here would reopen the importer the next time Settings is entered");
+    }
+
+    /// <remarks>
+    /// <see cref="MainWindowViewModel.Issuer"/> is new in v5c, for the Account settings page's SIGN-IN row —
+    /// see the property's own remark. <c>MeResponse.Issuer</c> was already being cached into
+    /// <c>StoredUnlockMaterial</c> for no reader before this wave; this is the first assertion that it also
+    /// reaches the shell.
+    /// </remarks>
+    [Fact]
+    public async Task UnlockingCarriesTheIssuerOntoTheShell_ForTheAccountPagesSignInRow()
+    {
+        await UnlockedAsync();
+
+        shell.Issuer.ShouldBe("https://idp.example/realms/dodossh");
+    }
+
     /// <summary>An unlocked vault with one selected host and a renderer attached.</summary>
     private async Task<VaultViewModel> ReadyToConnectAsync()
     {

tests/DodoSSH.Client.App.Tests/VaultSharingTests.cs

@@ -1910,6 +1910,85 @@ public sealed class VaultSharingTests : IAsyncLifetime
             .ShouldBe("Platform");
     }
 
+    /// <remarks>
+    /// v5c-2: the settings Vaults page draws one card per vault with no list selection to lean on, so
+    /// <c>RenameVaultRow</c>/<c>DeleteVaultRow</c> select the row first and then hand off to the commands
+    /// above — this proves the hand-off selects the right vault and reaches the same form.
+    /// </remarks>
+    [Fact]
+    public async Task RenameVaultRow_SelectsTheCardThenOpensTheSameFormRenameVaultDoes()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+
+        await CreateVaultAsync(vaults, "Platform secrets");
+        var shared = vaults.SelectedVault!;
+
+        // A different vault selected first, so the row argument is what actually decides which one the
+        // form is about rather than whatever was already selected.
+        vaults.SelectedVault = vaults.Vaults.First(row => row.IsPersonal);
+
+        vaults.RenameVaultRowCommand.Execute(shared);
+
+        vaults.SelectedVault.ShouldBe(shared);
+        vaults.IsRenamingVault.ShouldBeTrue();
+        vaults.EditVaultName.ShouldBe("Platform secrets");
+    }
+
+    [Fact]
+    public async Task DeleteVaultRow_SelectsTheCardThenArmsTheSameConfirmationDeleteVaultDoes()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+
+        await CreateVaultAsync(vaults, "Platform secrets");
+        var shared = vaults.SelectedVault!;
+
+        vaults.SelectedVault = vaults.Vaults.First(row => row.IsPersonal);
+
+        vaults.DeleteVaultRowCommand.Execute(shared);
+
+        vaults.SelectedVault.ShouldBe(shared);
+        vaults.IsConfirming.ShouldBeTrue();
+        vaults.PendingAction!.Question.ShouldContain("Platform secrets");
+    }
+
+    /// <remarks>
+    /// The settings page's members panel: pressing the card's members icon on a vault that is not already
+    /// selected has to select it first, or the panel would open over whichever vault the list last landed
+    /// on rather than the one that was actually clicked.
+    /// </remarks>
+    [Fact]
+    public async Task OpenMembersPanel_SelectsTheVaultItWasOpenedForAndReadsItsMembers()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+
+        await CreateVaultAsync(vaults, "Platform secrets");
+        var shared = vaults.SelectedVault!;
+
+        vaults.SelectedVault = vaults.Vaults.First(row => row.IsPersonal);
+        vaults.IsMembersPanelOpen.ShouldBeFalse();
+
+        vaults.OpenMembersPanelCommand.Execute(shared);
+
+        vaults.IsMembersPanelOpen.ShouldBeTrue();
+        vaults.SelectedVault.ShouldBe(shared);
+
+        // OpenMembersPanel's own selection assignment starts a read nothing here can await — see
+        // OnSelectedVaultChanged — so this reads it again through LoadAsync, which is awaited, rather than
+        // racing the fire-and-forget one.
+        await vaults.LoadAsync(Token);
+
+        vaults.Members.ShouldContain(member => member.IsSelf);
+
+        vaults.CloseMembersPanelCommand.Execute(null);
+        vaults.IsMembersPanelOpen.ShouldBeFalse();
+    }
+
     /// <remarks>
     /// <para>
     /// <b>An address with no account is a refusal, and the sentence has to say what to do about it.</b>

tests/DodoSSH.Client.Ssh.Tests/KeyAuthenticationTests.cs

@@ -36,6 +36,12 @@ public sealed class KeyAuthenticationTests(SshServerFixture fixture)
 
         connection.IsConnected.ShouldBeTrue();
 
+        // The one place this suite checks Cipher against a real handshake rather than a fake's fixed string.
+        // SSH.NET negotiates whatever the container's sshd offers first from its own preference list, so the
+        // exact algorithm is not pinned here — only that ConnectionInfo.CurrentServerEncryption came back as
+        // something rather than the empty string a stalled or pre-handshake read would produce.
+        connection.Cipher.ShouldNotBeNullOrEmpty();
+
         // Authenticated is not the same as usable: a channel has to open on the connection too.
         await using var shell = await connection.OpenShellAsync(TerminalSize.Default, Token);
 

tests/DodoSSH.Client.Terminal.Tests/FakeShellSession.cs

@@ -8,6 +8,8 @@ internal sealed class FakeShellSession : ISshShellSession
     private readonly List<byte> written = [];
     private readonly Lock gate = new();
 
+    private readonly bool blockReads;
+
     private long remaining;
     private byte pattern;
 
@@ -16,7 +18,19 @@ internal sealed class FakeShellSession : ISshShellSession
     /// endless producer, which is what a runaway remote process looks like — those sessions are ended
     /// by disposing the pump rather than by running out of data.
     /// </param>
-    internal FakeShellSession(long bytesToProduce = 0) => remaining = bytesToProduce;
+    /// <param name="blockReads">
+    /// True for a shell that is open and live but has nothing to say — an idle prompt, rather than either
+    /// end of the "produces bytes" and "hit end of stream" spectrum <paramref name="bytesToProduce"/>
+    /// covers. <see cref="ReadAsync"/> then blocks until cancelled, which is what a real idle SSH channel's
+    /// read does. Exists for tests that need a session whose <c>Run</c> stays live without a background
+    /// read loop racing the test for control of the pump's credit window — see the reattach tests in
+    /// <c>TerminalWorkspaceTests</c>.
+    /// </param>
+    internal FakeShellSession(long bytesToProduce = 0, bool blockReads = false)
+    {
+        remaining = bytesToProduce;
+        this.blockReads = blockReads;
+    }
 
     /// <inheritdoc />
     public bool IsOpen { get; private set; } = true;
@@ -52,6 +66,13 @@ internal sealed class FakeShellSession : ISshShellSession
     {
         ReadCount++;
 
+        if (blockReads)
+        {
+            // Never completes on its own. The only way out is the same way a real blocked read ends: the
+            // token being cancelled, which is what disposing the pump does.
+            await Task.Delay(Timeout.InfiniteTimeSpan, cancellationToken).ConfigureAwait(false);
+        }
+
         await Task.Yield();
         cancellationToken.ThrowIfCancellationRequested();
 
@@ -109,7 +130,8 @@ internal sealed class FakeShellSession : ISshShellSession
 /// workspace is the layer that decides when a session is over, and that decision is what needs a
 /// connection whose shell can be made to end on cue.
 /// </remarks>
-internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue) : ISshConnectionFactory
+internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue, bool blockShellReads = false)
+    : ISshConnectionFactory
 {
     /// <summary>Connections handed out, in order.</summary>
     internal List<FakeConnection> Connections { get; } = [];
@@ -119,7 +141,7 @@ internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue)
         SshConnectionRequest request,
         CancellationToken cancellationToken)
     {
-        var connection = new FakeConnection(request, bytesPerShell);
+        var connection = new FakeConnection(request, bytesPerShell, blockShellReads);
         Connections.Add(connection);
 
         return Task.FromResult<ISshConnection>(connection);
@@ -127,7 +149,8 @@ internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue)
 }
 
 /// <summary>A connection that opens fake shells and records its own disposal.</summary>
-internal sealed class FakeConnection(SshConnectionRequest request, long bytesPerShell) : ISshConnection
+internal sealed class FakeConnection(SshConnectionRequest request, long bytesPerShell, bool blockShellReads = false)
+    : ISshConnection
 {
     /// <inheritdoc />
     public bool IsConnected { get; private set; } = true;
@@ -136,6 +159,9 @@ internal sealed class FakeConnection(SshConnectionRequest request, long bytesPer
     public HostKeyPresentation HostKey { get; } =
         new(request.Host, request.Port, "ssh-ed25519", "SHA256:fake");
 
+    /// <inheritdoc />
+    public string Cipher { get; } = "aes256-gcm@openssh.com";
+
     /// <summary>The shell this connection opened, if it opened one.</summary>
     internal FakeShellSession? Shell { get; private set; }
 
@@ -145,7 +171,7 @@ internal sealed class FakeConnection(SshConnectionRequest request, long bytesPer
     /// <inheritdoc />
     public Task<ISshShellSession> OpenShellAsync(TerminalSize size, CancellationToken cancellationToken)
     {
-        Shell = new FakeShellSession(bytesPerShell);
+        Shell = new FakeShellSession(bytesPerShell, blockShellReads);
 
         return Task.FromResult<ISshShellSession>(Shell);
     }

tests/DodoSSH.Client.Terminal.Tests/TerminalDataPlaneTests.cs

@@ -142,15 +142,96 @@ public sealed class TerminalDataPlaneTests : IAsyncDisposable
             await ConnectAsync(origin: "https://evil.example"));
     }
 
+    /// <remarks>
+    /// The truth this replaced: a second valid attach used to be a 409, on the theory that one renderer
+    /// lives for the whole process. Android's WebView does not honour that theory — its renderer process is
+    /// routinely killed and the page reloads with a fresh socket — so a second valid attach is now a
+    /// takeover. This asserts both halves: the newcomer gets the connection, and the displaced socket
+    /// actually goes rather than lingering as a phantom nothing is reading from.
+    /// </remarks>
     [Fact]
-    public async Task ASecondRenderer_IsRejected()
+    public async Task ASecondRenderer_TakesOver_AndTheFirstSocketIsDropped()
     {
         Start();
 
         using var first = await ConnectAsync();
         first.State.ShouldBe(WebSocketState.Open);
 
-        await Should.ThrowAsync<WebSocketException>(async () => await ConnectAsync());
+        using var second = await ConnectAsync();
+        second.State.ShouldBe(WebSocketState.Open);
+
+        // The first socket was aborted rather than closed gracefully — Abort skips the close handshake
+        // entirely, so there is no Close frame for this side to see coming. What a receive on it sees
+        // instead is the connection simply gone, which the client surfaces as an exception rather than as
+        // a state that quietly flips on its own; nothing here reads from the socket otherwise, so the
+        // state alone would not move.
+        var firstBuffer = new byte[16];
+        await Should.ThrowAsync<Exception>(async () =>
+            await first.ReceiveAsync(firstBuffer.AsMemory(), TestContext.Current.CancellationToken));
+
+        await using var session = new FakeShellSession(bytesToProduce: 64);
+        await using var pump = CreatePump(session);
+        plane.Register(SessionId, pump);
+
+        var run = pump.RunAsync(TestContext.Current.CancellationToken);
+
+        var opened = await ReceiveAsync(second);
+        opened.Opcode.ShouldBe((byte)TerminalServerOpcode.SessionOpened);
+
+        var output = await ReceiveAsync(second);
+        output.Opcode.ShouldBe((byte)TerminalServerOpcode.Output);
+        output.Payload.Length.ShouldBe(64);
+
+        await SendAsync(
+            second,
+            (byte)TerminalClientOpcode.Acknowledge,
+            TerminalFrame.CreateAcknowledgementPayload((uint)output.Payload.Length));
+
+        await run;
+    }
+
+    /// <remarks>
+    /// <para>
+    /// The other half of the takeover: a renderer process that dies without a close handshake — which is
+    /// what a killed Android WebView actually does, no FIN, nothing — must not fault the send path. A
+    /// faulted send would propagate into <see cref="TerminalSessionPump"/>'s flush loop and freeze a live
+    /// session; see <see cref="TerminalDataPlane.SendAsync"/>'s remark for why. Disposing the client socket
+    /// abruptly, with no close handshake sent, is the closest this harness gets to that: the server-side
+    /// socket is left believing itself open until it actually tries to write to it.
+    /// </para>
+    /// <para>
+    /// Driven straight through <see cref="TerminalDataPlane.SendAsync"/> rather than through a pump, because
+    /// a pump adds nothing here — the point is entirely about the transport's own contract, and a session
+    /// layered on top would only leave it unclear whether a passing test proved the transport never threw or
+    /// merely that the frames never happened to need a live socket.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task SendAsync_DoesNotThrow_WhenTheAttachedRendererDiedWithoutClosing_AndAFreshAttachStillReceives()
+    {
+        Start();
+
+        var first = await ConnectAsync();
+        first.State.ShouldBe(WebSocketState.Open);
+        first.Dispose();
+
+        // Whether this particular send lands on the OS's send buffer before the peer's absence is noticed,
+        // or fails immediately, is not the point — either way it must not throw.
+        await Should.NotThrowAsync(async () =>
+            await plane.SendAsync(
+                TerminalFrame.Create((byte)TerminalServerOpcode.Output, SessionId, "before"u8.ToArray()),
+                TestContext.Current.CancellationToken));
+
+        using var second = await ConnectAsync();
+
+        await Should.NotThrowAsync(async () =>
+            await plane.SendAsync(
+                TerminalFrame.Create((byte)TerminalServerOpcode.Output, SessionId, "after"u8.ToArray()),
+                TestContext.Current.CancellationToken));
+
+        var output = await ReceiveAsync(second);
+        output.Opcode.ShouldBe((byte)TerminalServerOpcode.Output);
+        Encoding.UTF8.GetString(output.Payload).ShouldBe("after");
     }
 
     // ---- Frames ----