From 586ea2c831a3735e9488c382a9186f3112eb2731 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Wed, 21 Oct 2026 18:51:12 +0200
Subject: [PATCH 1/6] Teams: say when a team waits for two-step verification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A team that requires two-step verification hides its vaults from a
member without it, and the app said nothing: the vault just never
came. The sync round now notes it (Hold::Totp): from 403
totp_setup_required, or, for a member who never had the vaults, from
the team's policy and the account when none of its vaults is listed.
The sidebar, the phone's hosts screen and the team's page say so and
open the authenticator setup; turning it on or off starts a round.

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 apps/desktop/e2e/flows.mjs                  |  56 +++-
 apps/desktop/src-tauri/src/sync.rs          |  23 +-
 apps/desktop/src/App.tsx                    |   9 +-
 apps/desktop/src/Sidebar.tsx                |  11 +
 apps/desktop/src/SyncPanel.tsx              |  32 +-
 apps/desktop/src/TeamsPanel.tsx             |  37 ++-
 apps/desktop/src/api.ts                     |   9 +
 apps/desktop/src/mobile/MobileWorkspace.tsx |  14 +
 apps/desktop/src/styles.css                 |   6 +
 crates/mg-store/src/sharing.rs              |  24 +-
 crates/mg-store/src/sync.rs                 |   2 +
 crates/mg-store/src/sync_http.rs            |   3 +
 crates/mg-sync/src/client.rs                |   9 +
 crates/mg-sync/src/types.rs                 |   3 +-
 docs/features/account-and-devices.md        |  13 +-
 docs/features/teams.md                      |   2 +-
 docs/sync-crypto-spec.md                    |   5 +-
 server/tests/totp_policy.rs                 | 310 ++++++++++++++++++++
 spec/openapi.yaml                           |  10 +-
 19 files changed, 548 insertions(+), 30 deletions(-)
 create mode 100644 server/tests/totp_policy.rs

diff --git a/apps/desktop/e2e/flows.mjs b/apps/desktop/e2e/flows.mjs
index 50953d5..1fe3bb9 100644
--- a/apps/desktop/e2e/flows.mjs
+++ b/apps/desktop/e2e/flows.mjs
@@ -7,6 +7,7 @@
 // mails sign-up codes (Mailpit's web address), for servers that verify addresses.
 
 import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
 
 export const PASSWORD = "correct horse battery staple";
 
@@ -495,17 +496,64 @@ export async function rotateDueKeys(s, org) {
   }
 }
 
-/** J7 (an owner or admin, in the organization's page): requires approval of new devices. */
-export async function requireDeviceApproval(s) {
+/** An owner or admin, in the organization's page: turns on the policy whose label has `text`. */
+async function turnOnPolicy(s, text) {
   await s.wait(
-    () => s.exec(`return [...document.querySelectorAll(".page-aside label.check")].some((l) => l.innerText.includes("approve new devices")) || null`),
+    () => s.exec(`return [...document.querySelectorAll(".page-aside label.check")].some((l) => l.innerText.includes(arguments[0])) || null`, text),
     "the policies",
   );
-  await s.exec(`[...document.querySelectorAll(".page-aside label.check")].find((l) => l.innerText.includes("approve new devices")).querySelector("input").click(); return true`);
+  await s.exec(`[...document.querySelectorAll(".page-aside label.check")].find((l) => l.innerText.includes(arguments[0])).querySelector("input").click(); return true`, text);
   await s.clickButton("Save policies");
   await s.wait(() => s.exec(`return [...document.querySelectorAll(".page-aside button")].some((b) => b.innerText.includes("Save policies")) ? null : true`), "the policies to save");
 }
 
+/** J7 (an owner or admin, in the organization's page): requires approval of new devices. */
+export const requireDeviceApproval = (s) => turnOnPolicy(s, "approve new devices");
+
+/** T14 (an owner or admin, in the organization's page): requires two-step verification. */
+export const requireTwoStep = (s) => turnOnPolicy(s, "Require two-step verification");
+
+/** The sidebar's "Turn on two-step verification" (a team requires it), with its tooltip, or null. */
+export const twoStepDue = (s) => s.exec(`const b = document.querySelector("button.sidebar-foot.totp"); return b ? b.title : null`);
+
+/** The current code of an authenticator app holding `secret` (RFC 6238: SHA-1, 6 digits, 30 s). */
+export function totpCode(secret, at = Date.now()) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const bits = [...secret.replace(/[\s=]/g, "").toUpperCase()].map((c) => alphabet.indexOf(c).toString(2).padStart(5, "0")).join("");
+  const key = Buffer.from(bits.match(/.{8}/g).map((b) => parseInt(b, 2)));
+  const counter = Buffer.alloc(8);
+  counter.writeBigUInt64BE(BigInt(Math.floor(at / 30000)));
+  const mac = createHmac("sha1", key).update(counter).digest();
+  const at4 = mac[mac.length - 1] & 15;
+  return String((mac.readUInt32BE(at4) & 0x7fffffff) % 1e6).padStart(6, "0");
+}
+
+/** T14: turns on two-step verification with a made-up authenticator, from the sidebar's notice
+ *  when a team asks for it, else from Sync; returns its secret. */
+export async function turnOnTwoStep(s, password = PASSWORD) {
+  const press = (text) =>
+    s.exec(`const b = [...document.querySelectorAll(".panel button")].find((b) => b.innerText === arguments[0] && !b.disabled);
+      if (!b) throw new Error("no enabled button " + arguments[0]); b.click(); return true`, text);
+  if (await twoStepDue(s)) await s.click("button.sidebar-foot.totp");
+  else {
+    await s.click("button.sidebar-foot.sync");
+    await s.wait(() => s.exec(`return [...document.querySelectorAll(".panel button")].some((b) => b.innerText === "Turn on two-step verification") || null`), "the account");
+    await press("Turn on two-step verification");
+  }
+  await s.waitText("Confirm with your master password", ".panel");
+  await s.typeLabelled("Master password", password);
+  await press("Continue");
+  const secret = await s.wait(
+    () => s.exec(`const k = [...document.querySelectorAll(".panel .hint")].find((p) => p.innerText.includes("Enter this key instead")); return k ? k.querySelector(".mono").innerText : null`),
+    "the authenticator key",
+    30000,
+  );
+  await s.typeLabelled("Authenticator code", totpCode(secret));
+  await press("Turn on");
+  await s.waitText("Turn off two-step verification", ".panel", 30000);
+  return secret.replace(/\s/g, "");
+}
+
 /** The device-approval state on this device's sidebar ("Waiting for approval", "Denied"), or null. */
 export const approvalState = (s) => s.exec(`const b = document.querySelector("button.sidebar-foot.approval"); return b ? b.innerText : null`);
 
diff --git a/apps/desktop/src-tauri/src/sync.rs b/apps/desktop/src-tauri/src/sync.rs
index 3ef31b7..0b53920 100644
--- a/apps/desktop/src-tauri/src/sync.rs
+++ b/apps/desktop/src-tauri/src/sync.rs
@@ -121,6 +121,8 @@ pub struct SyncStatusView {
     syncing: bool,
     /// Sync is on but the server ended this device's session: sign in again.
     signed_out: bool,
+    /// Organizations whose vaults wait for this account to turn on two-step verification.
+    totp_required: Vec<SsoNeed>,
     /// Organizations whose vaults wait for this device to sign in at their identity provider.
     sso_required: Vec<SsoNeed>,
     /// Organizations whose vaults wait for this device to be approved (or that denied it).
@@ -323,6 +325,14 @@ fn status(vault: &VaultState, sync: &SyncState, syncing: bool) -> SyncStatusView
             .map_or_else(|| "Your organization".into(), |o| o.name.clone())
     };
     let held = sync.held.lock().map(|h| h.clone()).unwrap_or_default();
+    let totp_required = held
+        .iter()
+        .filter(|(_, why)| *why == Hold::Totp)
+        .map(|(id, _)| SsoNeed {
+            org_id: id.clone(),
+            org_name: name(id),
+        })
+        .collect();
     let sso_required = held
         .iter()
         .filter(|(_, why)| *why == Hold::Sso)
@@ -333,7 +343,7 @@ fn status(vault: &VaultState, sync: &SyncState, syncing: bool) -> SyncStatusView
         .collect();
     let approval_required = held
         .iter()
-        .filter(|(_, why)| *why != Hold::Sso)
+        .filter(|(_, why)| matches!(why, Hold::Approval | Hold::Denied))
         .map(|(id, why)| ApprovalNeed {
             org_id: id.clone(),
             org_name: name(id),
@@ -383,6 +393,7 @@ fn status(vault: &VaultState, sync: &SyncState, syncing: bool) -> SyncStatusView
         last_sync_at: info.as_ref().and_then(|i| i.last_sync_at),
         last_error: info.and_then(|i| i.last_error),
         syncing,
+        totp_required,
         sso_required,
         approval_required,
         approvals_waiting,
@@ -1271,7 +1282,10 @@ pub async fn sync_totp_enable(
     let client = signed_in(&state, &vault).await?;
     account::enable_totp(&vault.0, client, code)
         .await
-        .map_err(|e| e.to_string())
+        .map_err(|e| e.to_string())?;
+    // Teams that require it open their vaults: the next round brings them.
+    state.poke.notify_one();
+    Ok(())
 }
 
 /// Turns two-step verification off (master password and a current code).
@@ -1286,7 +1300,10 @@ pub async fn sync_totp_disable(
     let client = signed_in(&state, &vault).await?;
     account::disable_totp(&vault.0, client, Zeroizing::new(password), code)
         .await
-        .map_err(|e| e.to_string())
+        .map_err(|e| e.to_string())?;
+    // Teams that require it hold their vaults back from now on: the next round says so.
+    state.poke.notify_one();
+    Ok(())
 }
 
 /// Mails a code to the address the account should move to.
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index 12afc0f..2f84552 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -154,7 +154,8 @@ type View =
   | { kind: "key"; id?: string }
   | { kind: "snippet"; id?: string }
   | { kind: "forward"; id?: string }
-  | { kind: "sync" }
+  /** `totp`: straight to turning on two-step verification (teams wait for it). */
+  | { kind: "sync"; totp?: boolean }
   | { kind: "security" }
   | { kind: "about" }
   | { kind: "teams" }
@@ -834,12 +835,16 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           onChanged={refresh}
           onClose={close}
           onSso={(orgId, orgName) => setSsoFor({ orgId, orgName })}
+          totpRequired={syncStatus?.totpRequired.map((o) => o.orgId) ?? []}
+          onTotp={() => open({ kind: "sync", totp: true })}
           invite={linked?.invite}
           openOrg={linked?.org}
         />
       )}
       {view.kind === "sync" && syncStatus && (
         <SyncPanel
+          key={view.totp ? "totp" : "sync"}
+          startTotp={view.totp}
           status={syncStatus}
           orgs={orgList}
           onChanged={() => void syncApi.status().then(setSyncStatus).then(refresh)}
@@ -1069,6 +1074,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
             open(p === "quick" ? { kind: "connect" } : p === "forwards" ? { kind: "forward" } : p === "logs" ? { kind: "logs" } : { kind: p })
           }
           onLock={onLock}
+          onTotp={() => open({ kind: "sync", totp: true })}
           onSso={setSsoFor}
           onApproval={setApprovalFor}
           onSend={sendTo}
@@ -1107,6 +1113,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           onOpenSync={() => open({ kind: "sync" })}
           vaults={vaults}
           onOpenTeams={() => open({ kind: "teams" })}
+          onTotp={() => open({ kind: "sync", totp: true })}
           onSso={setSsoFor}
           onApproval={setApprovalFor}
           onOpenAppearance={() => open({ kind: "appearance" })}
diff --git a/apps/desktop/src/Sidebar.tsx b/apps/desktop/src/Sidebar.tsx
index 6e8e192..72f5b5c 100644
--- a/apps/desktop/src/Sidebar.tsx
+++ b/apps/desktop/src/Sidebar.tsx
@@ -1,6 +1,7 @@
 import { useState, type ReactNode } from "react";
 import {
   ago,
+  totpTitle,
   type ForwardView,
   type GroupView,
   type HostView,
@@ -56,6 +57,8 @@ interface Props {
   onLock: () => void;
   update: UpdateInfo | null;
   onOpenAbout: () => void;
+  /** Turn on two-step verification: organizations' vaults wait for it. */
+  onTotp: () => void;
   /** Sign in at an organization's identity provider. */
   onSso: (need: SsoNeed) => void;
   /** An organization's vaults wait for this device's approval. */
@@ -104,6 +107,7 @@ export function Sidebar({
   onLock,
   update,
   onOpenAbout,
+  onTotp,
   onSso,
   onApproval,
 }: Props) {
@@ -284,6 +288,13 @@ export function Sidebar({
             <span>Update to {update.version}</span>
           </button>
         )}
+        {!!syncStatus?.totpRequired.length && (
+          <button className="sidebar-foot due totp" onClick={onTotp} title={totpTitle(syncStatus.totpRequired)}>
+            <Icon name="teams" size={15} />
+            <span className="grow">Turn on two-step verification</span>
+            <i className="status-square connecting" aria-hidden="true" />
+          </button>
+        )}
         {syncStatus?.ssoRequired.map((n) => (
           <button
             key={n.orgId}
diff --git a/apps/desktop/src/SyncPanel.tsx b/apps/desktop/src/SyncPanel.tsx
index 398634c..2cc8464 100644
--- a/apps/desktop/src/SyncPanel.tsx
+++ b/apps/desktop/src/SyncPanel.tsx
@@ -8,7 +8,9 @@ import {
   openLink,
   ownsTeam,
   sync,
+  totpTitle,
   type OrgInfo,
+  type SsoNeed,
   type SyncAccount,
   type SyncDevice,
   type SyncPlan,
@@ -30,9 +32,11 @@ interface Props {
   onChanged: () => void;
   onClose: () => void;
   onOpenTeams: () => void;
+  /** Opened to turn on two-step verification (teams wait for it). */
+  startTotp?: boolean;
 }
 
-export function SyncPanel({ status, orgs, onChanged, onClose, onOpenTeams }: Props) {
+export function SyncPanel({ status, orgs, onChanged, onClose, onOpenTeams, startTotp }: Props) {
   // The address of the account just deleted from here.
   const [deleted, setDeleted] = useState("");
   // The account this device just joined: what that did to its master password is said once more.
@@ -50,6 +54,8 @@ export function SyncPanel({ status, orgs, onChanged, onClose, onOpenTeams }: Pro
           !status.signedOut && (
             <Account
               round={status.lastSyncAt}
+              totpRequired={status.totpRequired}
+              startTotp={startTotp}
               owned={orgs.filter((o) => o.role === "owner")}
               onChanged={onChanged}
               onDeleted={onDeleted}
@@ -610,12 +616,17 @@ function planText(p: SyncPlan): string {
  * again after each sync round (`round`): a plan bought or ended meanwhile shows. */
 function Account({
   round,
+  totpRequired,
+  startTotp,
   owned,
   onChanged,
   onDeleted,
   onOpenTeams,
 }: {
   round: number | null;
+  /** Teams whose vaults wait until the account has two-step verification. */
+  totpRequired: SsoNeed[];
+  startTotp?: boolean;
   owned: OrgInfo[];
   onChanged: () => void;
   onDeleted: (email: string) => void;
@@ -624,7 +635,7 @@ function Account({
   const [account, setAccount] = useState<SyncAccount | null>(null);
   const [error, setError] = useState("");
   const [saved, setSaved] = useState("");
-  const [mode, setMode] = useState<"" | "totp-on" | "totp-off" | "email" | "delete">("");
+  const [mode, setMode] = useState<"" | "totp-on" | "totp-off" | "email" | "delete">(startTotp ? "totp-on" : "");
   const exportData = () => {
     setError("");
     setSaved("");
@@ -644,6 +655,8 @@ function Account({
   const cancel = () => setMode("");
 
   if (!account) return error ? <p className="error">{error}</p> : null;
+  // Asked to turn it on, but it's on already (from another device, say).
+  const shown = mode === "totp-on" && account.totpEnabled ? "" : mode;
   const facts = account.plan || account.emailVerified === false || account.totp;
   return (
     <div className="stack">
@@ -671,19 +684,20 @@ function Account({
         </dl>
       )}
       {error && <p className="error">{error}</p>}
-      {account.termsToAccept && mode === "" && <TermsUpdate terms={account.termsToAccept} onDone={done} />}
+      {account.termsToAccept && shown === "" && <TermsUpdate terms={account.termsToAccept} onDone={done} />}
       {saved && (
         <p className="ok">
           Saved {saved}: what the server keeps about your account. Your hosts and keys aren't in it; the server can't read them.
         </p>
       )}
-      {mode === "totp-on" && <TotpOn onDone={done} onCancel={cancel} />}
-      {mode === "totp-off" && <TotpOff onDone={done} onCancel={cancel} />}
-      {mode === "email" && <EmailChange onDone={done} onCancel={cancel} />}
-      {mode === "delete" && (
+      {totpRequired.length > 0 && !account.totpEnabled && <p className="notice-box warn">{totpTitle(totpRequired)}.</p>}
+      {shown === "totp-on" && <TotpOn onDone={done} onCancel={cancel} />}
+      {shown === "totp-off" && <TotpOff onDone={done} onCancel={cancel} />}
+      {shown === "email" && <EmailChange onDone={done} onCancel={cancel} />}
+      {shown === "delete" && (
         <DeleteAccount email={account.email} owned={owned} onDone={() => onDeleted(account.email)} onCancel={cancel} onOpenTeams={onOpenTeams} />
       )}
-      {mode === "" && (
+      {shown === "" && (
         <div className="row wrap">
           {account.totp && (
             <button type="button" className="secondary" onClick={() => setMode(account.totpEnabled ? "totp-off" : "totp-on")}>
@@ -708,7 +722,7 @@ function Account({
           </button>
         </div>
       )}
-      {mode === "" && account.totp && !account.totpEnabled && (
+      {shown === "" && account.totp && !account.totpEnabled && (
         <p className="hint">With two-step verification, signing in on a new device also needs a code from an authenticator app.</p>
       )}
     </div>
diff --git a/apps/desktop/src/TeamsPanel.tsx b/apps/desktop/src/TeamsPanel.tsx
index 441b029..da0c5ef 100644
--- a/apps/desktop/src/TeamsPanel.tsx
+++ b/apps/desktop/src/TeamsPanel.tsx
@@ -44,6 +44,10 @@ interface Props {
   onClose: () => void;
   /** Sign in at an organization's identity provider. */
   onSso: (orgId: string, orgName: string) => void;
+  /** Organizations whose vaults wait until the account has two-step verification. */
+  totpRequired: string[];
+  /** Turn on two-step verification. */
+  onTotp: () => void;
   /** From a link: an invite to look up, or the team to open. */
   invite?: string;
   openOrg?: string;
@@ -51,7 +55,7 @@ interface Props {
 
 const ACCESS_LEVELS: Access[] = ["read", "write", "manage"];
 
-export function TeamsPanel({ vaults, orgs, keys, onChanged, onClose, onSso, invite, openOrg }: Props) {
+export function TeamsPanel({ vaults, orgs, keys, onChanged, onClose, onSso, totpRequired, onTotp, invite, openOrg }: Props) {
   const personal = vaults.find((v) => v.personal)?.id;
   const personalKeys = keys.filter((k) => k.vaultId === personal);
   const [status, setStatus] = useState<SharingStatus | null>(null);
@@ -77,6 +81,8 @@ export function TeamsPanel({ vaults, orgs, keys, onChanged, onClose, onSso, invi
         onChanged={onChanged}
         onGone={() => void onChanged().then(() => setOpen(null))}
         onSso={() => onSso(org.id, org.name)}
+        totpRequired={totpRequired.includes(org.id)}
+        onTotp={onTotp}
       />
     );
   }
@@ -296,9 +302,12 @@ interface OrgProps {
   onGone: () => void;
   /** Sign in at the organization's identity provider. */
   onSso: () => void;
+  /** Its vaults wait until the account has two-step verification. */
+  totpRequired: boolean;
+  onTotp: () => void;
 }
 
-function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose, onChanged, onGone, onSso }: OrgProps) {
+function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose, onChanged, onGone, onSso, totpRequired, onTotp }: OrgProps) {
   const [members, setMembers] = useState<MemberView[] | null>(null);
   const [memberKeys, setMemberKeys] = useState<MemberKeyView[]>([]);
   const shared = vaults.filter((v) => !v.directory);
@@ -414,6 +423,16 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
         </div>
       )}
       {error && <p className="error">{error}</p>}
+      {confirmed && totpRequired && (
+        <div className="notice-box warn stack">
+          <p>{org.name} requires two-step verification: its vaults open on your devices once your account has it.</p>
+          <div className="row">
+            <button type="button" className="primary" onClick={onTotp}>
+              Turn on two-step verification
+            </button>
+          </div>
+        </div>
+      )}
       {locked && (
         <p className="notice-box warn team-locked">
           {org.name} is locked until it has a plan: no new vaults, edits, invites, policies or published keys.
@@ -445,7 +464,14 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
 
       {confirmed && (
         <fieldset className="plain" disabled={locked}>
-          <MyKeys org={org} keys={personalKeys} published={memberKeys.filter((k) => k.mine)} ready={hasDirectory} onChanged={loadKeys} />
+          <MyKeys
+            org={org}
+            keys={personalKeys}
+            published={memberKeys.filter((k) => k.mine)}
+            ready={hasDirectory}
+            waiting={totpRequired}
+            onChanged={loadKeys}
+          />
         </fieldset>
       )}
       {confirmed && details && (
@@ -1411,12 +1437,15 @@ function MyKeys({
   keys,
   published,
   ready,
+  waiting,
   onChanged,
 }: {
   org: OrgInfo;
   keys: KeyView[];
   published: MemberKeyView[];
   ready: boolean;
+  /** The directory waits like the organization's vaults (two-step verification, said above). */
+  waiting: boolean;
   onChanged: () => void;
 }) {
   const [pick, setPick] = useState("");
@@ -1438,7 +1467,7 @@ function MyKeys({
         Publish the public keys you use on {org.name}'s servers. If you leave, admins can then find and remove your access
         from those servers. Only the public half is shared.
       </p>
-      {!ready && <p className="hint">The organization's member key directory arrives with the next sync.</p>}
+      {!ready && !waiting && <p className="hint">The organization's member key directory arrives with the next sync.</p>}
       {published.length > 0 && (
         <ul className="device-list">
           {published.map((k) => (
diff --git a/apps/desktop/src/api.ts b/apps/desktop/src/api.ts
index 8d79933..1b1fa05 100644
--- a/apps/desktop/src/api.ts
+++ b/apps/desktop/src/api.ts
@@ -525,6 +525,8 @@ export interface SyncStatus {
   syncing: boolean;
   /** Sync is on but the server ended this device's session: sign in again. */
   signedOut: boolean;
+  /** Organizations whose vaults wait for this account to turn on two-step verification. */
+  totpRequired: SsoNeed[];
   /** Organizations whose vaults wait for this device to sign in at their identity provider. */
   ssoRequired: SsoNeed[];
   /** Organizations whose vaults wait for this device to be approved, or that denied it. */
@@ -567,6 +569,13 @@ export interface SsoNeed {
   orgName: string;
 }
 
+/** Which teams wait for two-step verification, and what for. */
+export function totpTitle(orgs: SsoNeed[]): string {
+  const names = orgs.map((o) => o.orgName);
+  const list = names.length > 1 ? `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}` : names[0];
+  return `${list} ${names.length > 1 ? "require" : "requires"} two-step verification: ${names.length > 1 ? "their" : "its"} vaults open here once your account has it`;
+}
+
 /** An organization's identity provider and this device's session with it. */
 export interface SsoView {
   configured: boolean;
diff --git a/apps/desktop/src/mobile/MobileWorkspace.tsx b/apps/desktop/src/mobile/MobileWorkspace.tsx
index 780c460..df3e8ce 100644
--- a/apps/desktop/src/mobile/MobileWorkspace.tsx
+++ b/apps/desktop/src/mobile/MobileWorkspace.tsx
@@ -4,6 +4,7 @@ import {
   describeForward,
   hosts as hostsApi,
   keyType,
+  totpTitle,
   vpnKindName,
   type ConnectTarget,
   type ForwardView,
@@ -79,6 +80,8 @@ interface Props {
   onToggleForward: (f: ForwardView) => void;
   onOpenMore: (panel: MorePanel) => void;
   onLock: () => void;
+  /** Turn on two-step verification: organizations' vaults wait for it. */
+  onTotp: () => void;
   /** Sign in at an organization's identity provider. */
   onSso: (need: SsoNeed) => void;
   /** An organization's vaults wait for this device's approval. */
@@ -225,6 +228,17 @@ function Home(p: Props & { section: Section; onSection: (s: Section) => void; on
       <div className="m-scroll">
         {p.section === "hosts" && (
           <>
+            {!!p.syncStatus?.totpRequired.length && (
+              <button type="button" className="m-sso" onClick={p.onTotp}>
+                <span className="m-row-text">
+                  <span className="m-row-title">Turn on two-step verification</span>
+                  <span className="m-row-sub">{totpTitle(p.syncStatus.totpRequired)}.</span>
+                </span>
+                <span className="m-chevron">
+                  <Svg d={CHEVRON} size={18} />
+                </span>
+              </button>
+            )}
             {p.syncStatus?.ssoRequired.map((n) => (
               <button key={n.orgId} type="button" className="m-sso" onClick={() => p.onSso(n)}>
                 <span className="m-row-text">
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index cb39c75..40f8bf8 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -1772,6 +1772,12 @@ dialog.modal .actions {
   color: var(--ink);
 }
 
+.sidebar-foot .grow {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 /* First run: sync offered in a dialog, the same form as the Sync page. */
 dialog.sheet {
   width: min(520px, calc(100% - 32px));
diff --git a/crates/mg-store/src/sharing.rs b/crates/mg-store/src/sharing.rs
index bf16893..921207f 100644
--- a/crates/mg-store/src/sharing.rs
+++ b/crates/mg-store/src/sharing.rs
@@ -824,6 +824,7 @@ pub async fn refresh_with(
     let mut known = HashSet::new();
     let mut approving = Vec::new();
     let mut keys_required = Vec::new();
+    let mut totp_required = Vec::new();
     for m in &memberships {
         known.insert(m.id.clone());
         let mut snap = match last.remove(&m.id).filter(|s| m.rev == Some(s.rev)) {
@@ -849,6 +850,9 @@ pub async fn refresh_with(
         if m.status == MemberStatus::Confirmed && org.policies.require_member_keys == Some(true) {
             keys_required.push(m);
         }
+        if m.status == MemberStatus::Confirmed && org.policies.require_totp {
+            totp_required.push(m.id.clone());
+        }
         {
             let v = lock(vault)?;
             let root = match v.org_root(&m.id)? {
@@ -912,6 +916,24 @@ pub async fn refresh_with(
 
     let vaults = client.list_vaults().await?;
     report.heads = vaults.iter().map(|v| (v.id.clone(), v.head_rev)).collect();
+    // An organization that requires two-step verification leaves its vaults out of the list for
+    // an account without it, without saying why. When none of its vaults is listed (it may have
+    // none for this account yet), the account says whether that's the reason.
+    let totp_unlisted: Vec<String> = totp_required
+        .into_iter()
+        .filter(|org| !vaults.iter().any(|v| v.org_id.as_ref() == Some(org)))
+        .collect();
+    if !totp_unlisted.is_empty() {
+        match client.account().await {
+            Ok(account) if !account.totp_enabled => {
+                for org in totp_unlisted {
+                    note_held(&mut report.held, org, Hold::Totp);
+                }
+            }
+            Ok(_) => {}
+            Err(e) => report.errors.push(format!("two-step verification: {e}")),
+        }
+    }
     // Former members this device verified: their grants and vault names stay valid.
     let pins = lock(vault)?.pinned()?;
     let mut keep = HashSet::new();
@@ -962,7 +984,7 @@ pub async fn refresh_with(
                 note_held(&mut report.held, org, why);
                 keep.insert(id);
             }
-            // Listed late, held back by two-step verification, or unknown: keep it.
+            // Listed late, held back by a server that doesn't say why, or unknown: keep it.
             _ => {
                 keep.insert(id);
             }
diff --git a/crates/mg-store/src/sync.rs b/crates/mg-store/src/sync.rs
index ef2db27..327391f 100644
--- a/crates/mg-store/src/sync.rs
+++ b/crates/mg-store/src/sync.rs
@@ -143,6 +143,8 @@ pub enum RemoteError {
 /// and sync once it's settled.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub enum Hold {
+    /// Turn on two-step verification for the account: the organization requires it.
+    Totp,
     /// Sign in at the organization's identity provider.
     Sso,
     /// An owner or admin, or one of the member's approved devices, has to approve this device.
diff --git a/crates/mg-store/src/sync_http.rs b/crates/mg-store/src/sync_http.rs
index 97586b6..8b10da1 100644
--- a/crates/mg-store/src/sync_http.rs
+++ b/crates/mg-store/src/sync_http.rs
@@ -14,6 +14,9 @@ const PAGE: u32 = 500;
 /// The organization and why, when the server held its vaults back.
 pub(crate) fn held(e: &mg_sync::Error) -> Option<(String, Hold)> {
     match e {
+        mg_sync::Error::TotpSetupRequired { org_id } if !org_id.is_empty() => {
+            Some((org_id.clone(), Hold::Totp))
+        }
         mg_sync::Error::SsoRequired { org_id } => Some((org_id.clone(), Hold::Sso)),
         mg_sync::Error::DeviceApprovalRequired { org_id, denied } => Some((
             org_id.clone(),
diff --git a/crates/mg-sync/src/client.rs b/crates/mg-sync/src/client.rs
index c942d37..3b242b6 100644
--- a/crates/mg-sync/src/client.rs
+++ b/crates/mg-sync/src/client.rs
@@ -31,6 +31,10 @@ pub enum Error {
     /// `402`: the account's or organization's plan doesn't cover this.
     #[error("{}", payment_message(.0))]
     PaymentRequired(Box<Payment>),
+    /// `403 totp_setup_required`: the organization's vaults need two-step verification on the
+    /// account (`org_id` empty from servers that don't say which organization).
+    #[error("the organization requires two-step verification; turn it on first")]
+    TotpSetupRequired { org_id: String },
     /// `403 sso_required`: the organization's vaults need this device signed in at its
     /// identity provider (`sso_start`).
     #[error("the organization's vaults need single sign-on")]
@@ -932,6 +936,11 @@ async fn error(resp: reqwest::Response) -> Error {
                 .and_then(|v| v.as_u64())
                 .and_then(|n| u32::try_from(n).ok()),
         })),
+        StatusCode::FORBIDDEN if field("code").as_deref() == Some("totp_setup_required") => {
+            Error::TotpSetupRequired {
+                org_id: field("org_id").unwrap_or_default(),
+            }
+        }
         StatusCode::FORBIDDEN if field("code").as_deref() == Some("sso_required") => {
             Error::SsoRequired {
                 org_id: field("org_id").unwrap_or_default(),
diff --git a/crates/mg-sync/src/types.rs b/crates/mg-sync/src/types.rs
index f77863a..db8045e 100644
--- a/crates/mg-sync/src/types.rs
+++ b/crates/mg-sync/src/types.rs
@@ -49,7 +49,8 @@ impl<'de> Deserialize<'de> for B64 {
 pub struct ApiError {
     pub code: String,
     pub message: String,
-    /// With `403 sso_required` and `403 device_approval_required`: the organization.
+    /// With `403 totp_setup_required`, `403 sso_required` and `403 device_approval_required`:
+    /// the organization.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub org_id: Option<String>,
     /// With `403 device_approval_required`: the calling device.
diff --git a/docs/features/account-and-devices.md b/docs/features/account-and-devices.md
index 15aa86a..1964a9e 100644
--- a/docs/features/account-and-devices.md
+++ b/docs/features/account-and-devices.md
@@ -148,7 +148,17 @@ The account's other devices hear `401 account_deleted` on their next refresh (a
 
 ## When an organization holds this device
 
-An organization can keep its vaults from a device until something is settled. Its vaults that are already here stay, unsynced edits included, and sync once it is settled; the personal vault is never affected. The shared part of each round notes the hold (`Hold` in `crates/mg-store/src/sync.rs`) from a `403 sso_required` or `403 device_approval_required` on the organization's vaults, and, with device approval on, from this device's row in `GET /v1/orgs/{org}/devices`. `SyncStatusView` carries them as `ssoRequired` and `approvalRequired`. The team side (approving others, policies) is in [Teams](teams.md#device-approval-single-sign-on-and-activity).
+An organization can keep its vaults from a device until something is settled. Its vaults that are already here stay, unsynced edits included, and sync once it is settled; the personal vault is never affected. The shared part of each round notes the hold (`Hold` in `crates/mg-store/src/sync.rs`) from a `403 totp_setup_required`, `403 sso_required` or `403 device_approval_required` on the organization's vaults, and, with device approval on, from this device's row in `GET /v1/orgs/{org}/devices`. A server leaves such vaults out of `GET /v1/vaults` without saying why, so a member who never had them would see nothing: for an organization with `require_totp` none of whose vaults is listed, the round reads `GET /v1/account` and notes the hold when `totp_enabled` is off. `SyncStatusView` carries them as `totpRequired`, `ssoRequired` and `approvalRequired`. The team side (approving others, policies) is in [Teams](teams.md#device-approval-single-sign-on-and-activity).
+
+### Two-step verification required
+
+| Where | Shows |
+| --- | --- |
+| Sidebar foot | **Turn on two-step verification**; its tooltip names the teams: "{team} requires two-step verification: its vaults open here once your account has it" |
+| Phone, hosts screen | **Turn on two-step verification** with the same line |
+| Team page | "{team} requires two-step verification: its vaults open on your devices once your account has it." and **Turn on two-step verification** |
+
+Each opens Sync with the authenticator setup started (`{kind: "sync", totp: true}`), under the same line in a notice. `sync_totp_enable` and `sync_totp_disable` start a round when they're done, so the team's vaults come, or wait, at once.
 
 ### Waiting for approval
 
@@ -214,6 +224,7 @@ All of them hold the sync lock, and those that keep the session store a rotated
 | `server/tests/account.rs` | `signing_out_another_device` (the other device gets `DeviceRevoked`, signs in again), `a_device_updates_what_it_says_about_itself` (and can't rename another, nor to blank), `deleting_an_account_tells_its_other_devices` (`AccountDeleted`, and `DeviceRevoked` for one signed out before), `the_data_export_tells_what_the_server_keeps` |
 | `server/tests/account.rs`, `protocol.rs` | `password_change_reaches_every_device`, `recovery_on_a_synced_device_and_on_a_fresh_one`, `a_new_recovery_key_replaces_the_old_one_without_signing_anyone_out`, `password_rotation_signs_out_others_but_a_new_recovery_key_does_not`, `recovery_tokens_are_narrow_and_single_use` |
 | `server/tests/device_approval.rs` | `a_new_device_waits_for_approval` |
+| `server/tests/totp_policy.rs` | `a_team_that_requires_two_step_verification_says_so`: a proxy in front of the reference server plays the hosted service's check; a new member without it is told, gets the vault once it's on, and keeps it (told again) when it's off |
 | `crates/mg-store/src/sync.rs`, `vault.rs` | `token_and_config_roundtrip_and_disable` (what **Keep a copy here** leaves), `erase_leaves_a_first_run_device` |
 | `apps/desktop/e2e/teams.mjs` | Bob signs his second device out from his first: it erases itself, the first screen says why, and signing in brings his vault back; a new device waits for approval, is denied, then approved from Bob's first device; Alice signs in to her team's identity provider from **Sign in to {team}**; **Download your data**; **Delete account…** sends an owner to Teams, deletes Bob's account, and his second device says the account was deleted |
 
diff --git a/docs/features/teams.md b/docs/features/teams.md
index 6c31a2b..7dbe9bd 100644
--- a/docs/features/teams.md
+++ b/docs/features/teams.md
@@ -158,7 +158,7 @@ Owners and admins edit **Policies**; **Save policies** appears once something ch
 
 | Policy | Control | Notes |
 | --- | --- | --- |
-| `require_totp` | **Require two-step verification to open the organization's vaults** | Disabled without `features.totp` unless on ("(this server doesn't offer two-step verification)") |
+| `require_totp` | **Require two-step verification to open the organization's vaults** | Disabled without `features.totp` unless on ("(this server doesn't offer two-step verification)"). Members without it are told where they look for the vaults ([Two-step verification required](account-and-devices.md#two-step-verification-required)) |
 | `members_can_create_vaults` | **Members can create vaults (they manage the ones they create)** | |
 | `allowed_email_domains` | **Invite only addresses at these domains (empty: any)** | Split on commas and spaces, leading `@` dropped, lowercased; the invite form checks it too |
 | `require_device_approval` | **Owners and admins approve new devices before they open the organization's vaults (…)** | Disabled unless the plan lists `device_approval` (or the server has no plans) or it is on: "Needs the Business plan." |
diff --git a/docs/sync-crypto-spec.md b/docs/sync-crypto-spec.md
index e42eb8e..e5e3113 100644
--- a/docs/sync-crypto-spec.md
+++ b/docs/sync-crypto-spec.md
@@ -248,7 +248,10 @@ Login proves knowledge of `AuthKey` and returns short-lived tokens. The client n
 **Devices.** Each login registers a device (`name`, `platform`, public Ed25519 key). `GET /devices` lists them and `DELETE /devices/{id}` signs one out: its tokens stop working, and its next refresh gets `401 device_revoked` (servers keep answering that for the refresh token's lifetime), on which the app erases what it keeps (vaults, keys, settings, pinned host keys, its keychain entry) and returns to first run with a note saying why. Only that code erases. `401 account_deleted` (the account was deleted from another device or a website) turns sync off as *Disconnect → Keep a copy* does: the personal vault stays, now the only copy, and team vaults go. Every other 401 (an expired session, a reused refresh token, a password changed on another device) means "sign in again", and the data stays. A device that never connects again keeps what it has, encrypted under the master password, so the UI says signing out takes effect when the device next connects. A device's own *Disconnect* asks whether to erase it too or keep a copy that no longer syncs.
 
 **2FA.** TOTP on the account, checked at `/auth/login`; set up and turned off through
-`/account/totp…`, and turned off by recovery. WebAuthn isn't supported yet. Email-verified sign-up,
+`/account/totp…`, and turned off by recovery. An organization can require it
+(`policies.require_totp`): its vaults answer `403 totp_setup_required` (with `org_id`) to a member
+without it, and `GET /vaults` leaves them out, so the app checks the account when none of such an
+organization's vaults is listed. WebAuthn isn't supported yet. Email-verified sign-up,
 email changes and an account portal are optional features of the API spec
 ([`spec/openapi.yaml`](../spec/openapi.yaml)).
 
diff --git a/server/tests/totp_policy.rs b/server/tests/totp_policy.rs
new file mode 100644
index 0000000..c2d4ed9
--- /dev/null
+++ b/server/tests/totp_policy.rs
@@ -0,0 +1,310 @@
+//! A team that requires two-step verification (`require_totp`), as the hosted service enforces
+//! it: the reference server has no two-step verification, so a proxy in front of it plays that
+//! part for one member. Without it on the account, the team's vaults are left out of the list
+//! and refused (`403 totp_setup_required`); the round says why, and a vault already on the device
+//! stays there.
+
+use std::collections::HashSet;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use axum::body::Body;
+use axum::extract::{Request, State};
+use axum::http::{HeaderMap, StatusCode, header};
+use axum::response::Response;
+use mg_store::account::SharedVault;
+use mg_store::sharing;
+use mg_store::sync::{Hold, SyncConfig, sync_once};
+use mg_store::sync_http::{HttpRemote, create_vault_request, register_request};
+use mg_store::{Access, Host, HostAuth, ItemData, LocalVault};
+use mg_sync::{B64, DeviceInfo, Role, SyncClient};
+use mg_vault::KdfParams;
+use serde_json::{Value, json};
+
+mod common;
+
+const PW: &str = "correct horse battery";
+
+struct Device {
+    vault: SharedVault,
+    client: Arc<SyncClient>,
+    account: String,
+    email: String,
+}
+
+/// The hosted service's check, for whoever syncs through it: `totp` is whether their account
+/// has two-step verification on.
+#[derive(Clone)]
+struct Gate {
+    upstream: String,
+    http: reqwest::Client,
+    org: Arc<Mutex<String>>,
+    vaults: Arc<Mutex<HashSet<String>>>,
+    totp: Arc<AtomicBool>,
+}
+
+impl Gate {
+    async fn serve(upstream: &str) -> (String, Gate) {
+        let gate = Gate {
+            upstream: upstream.into(),
+            http: reqwest::Client::new(),
+            org: Arc::default(),
+            vaults: Arc::default(),
+            totp: Arc::default(),
+        };
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let url = format!("http://{}", listener.local_addr().unwrap());
+        let app = axum::Router::new()
+            .fallback(forward)
+            .with_state(gate.clone());
+        tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+        (url, gate)
+    }
+
+    fn on(&self) -> bool {
+        self.totp.load(Ordering::SeqCst)
+    }
+}
+
+/// Forwards to the reference server, then answers as the hosted service does for an
+/// organization that requires two-step verification.
+async fn forward(State(g): State<Gate>, req: Request) -> Response {
+    let method = req.method().clone();
+    let path = req.uri().path().to_owned();
+    let target = format!(
+        "{}{}",
+        g.upstream,
+        req.uri().path_and_query().map_or("", |p| p.as_str())
+    );
+    let mut headers = HeaderMap::new();
+    for name in [header::AUTHORIZATION, header::CONTENT_TYPE, header::ACCEPT] {
+        if let Some(v) = req.headers().get(&name) {
+            headers.insert(name, v.clone());
+        }
+    }
+    let body = axum::body::to_bytes(req.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let org = g.org.lock().unwrap().clone();
+    let vault = path
+        .strip_prefix("/v1/vaults/")
+        .and_then(|rest| rest.split('/').next());
+    if !g.on() && vault.is_some_and(|v| g.vaults.lock().unwrap().contains(v)) {
+        return json_response(
+            StatusCode::FORBIDDEN,
+            &json!({
+                "code": "totp_setup_required",
+                "message": "this organization requires two-step verification; turn it on first",
+                "org_id": org,
+            }),
+        );
+    }
+    let resp = g
+        .http
+        .request(method.clone(), target)
+        .headers(headers)
+        .body(body)
+        .send()
+        .await
+        .unwrap();
+    let status = resp.status();
+    let bytes = resp.bytes().await.unwrap();
+    if method != axum::http::Method::GET || !status.is_success() {
+        return Response::builder()
+            .status(status)
+            .header(header::CONTENT_TYPE, "application/json")
+            .body(Body::from(bytes))
+            .unwrap();
+    }
+    let mut value: Value = match serde_json::from_slice(&bytes) {
+        Ok(v) => v,
+        Err(_) => {
+            return Response::builder()
+                .status(status)
+                .body(Body::from(bytes))
+                .unwrap();
+        }
+    };
+    if path == "/v1/vaults" && !g.on() {
+        // Left out of the list, without a word.
+        if let Some(list) = value.as_array_mut() {
+            list.retain(|v| v["org_id"].as_str() != Some(&org));
+        }
+    } else if !org.is_empty() && path == format!("/v1/orgs/{org}") {
+        value["policies"]["require_totp"] = json!(true);
+    } else if path == "/v1/account" {
+        value["totp_enabled"] = json!(g.on());
+    }
+    json_response(status, &value)
+}
+
+fn json_response(status: StatusCode, value: &Value) -> Response {
+    Response::builder()
+        .status(status)
+        .header(header::CONTENT_TYPE, "application/json")
+        .body(Body::from(serde_json::to_vec(value).unwrap()))
+        .unwrap()
+}
+
+fn fast() -> LocalVault {
+    LocalVault::open_in_memory()
+        .unwrap()
+        .with_kdf_cost(KdfParams::MIN_M_KIB, KdfParams::MIN_T, 1)
+}
+
+fn host(label: &str) -> ItemData {
+    ItemData::Host(Host {
+        label: label.into(),
+        hostname: format!("{label}.internal"),
+        port: 22,
+        user: "deploy".into(),
+        auth: HostAuth::Password { password: None },
+        jump_ref: None,
+        vpn_ref: None,
+        theme_ref: None,
+        record_sessions: false,
+        tags: vec![],
+        notes: String::new(),
+        group_ref: None,
+        identity_ref: None,
+        keep_session: false,
+        forward_agent: false,
+        login_command: None,
+        jump_command: None,
+        proxy_command: None,
+        source: None,
+    })
+}
+
+/// Someone's first device: a new account with sync on, through `url`.
+async fn first(url: &str, name: &str) -> Device {
+    let mut v = fast();
+    v.create(PW).unwrap();
+    let (export, _) = v.export_for_registration(PW).unwrap();
+    let client = Arc::new(SyncClient::new(url).unwrap());
+    let email = common::email(name);
+    let device = DeviceInfo {
+        id: ulid::Ulid::generate().to_string(),
+        name: name.into(),
+        platform: "linux".into(),
+        client_version: None,
+        public_key: B64(vec![1; 32]),
+    };
+    let session = client
+        .register(&register_request(&export, &email, device.clone(), None))
+        .await
+        .unwrap();
+    client
+        .create_vault(&create_vault_request(&export.vault))
+        .await
+        .unwrap();
+    v.enable_sync(&SyncConfig {
+        server_url: url.into(),
+        email: email.clone(),
+        account_id: session.account_id.clone(),
+        device_id: device.id,
+        device_public_key: [1; 32],
+    })
+    .unwrap();
+    Device {
+        vault: Arc::new(Mutex::new(v)),
+        client,
+        account: session.account_id,
+        email,
+    }
+}
+
+/// One round: the shared part, then the vaults.
+async fn round(d: &Device) -> (sharing::RefreshReport, mg_store::sync::SyncReport) {
+    let refresh = sharing::refresh(&d.vault, &d.client).await.unwrap();
+    let report = sync_once(&d.vault, &HttpRemote(&d.client)).await.unwrap();
+    assert!(report.vault_errors.is_empty(), "{:?}", report.vault_errors);
+    (refresh, report)
+}
+
+fn labels(d: &Device, vault: &str) -> Vec<String> {
+    let mut out: Vec<String> = d
+        .vault
+        .lock()
+        .unwrap()
+        .items()
+        .unwrap()
+        .into_iter()
+        .filter(|i| i.vault_id == vault)
+        .map(|i| match i.data {
+            ItemData::Host(h) => h.label,
+            _ => String::new(),
+        })
+        .collect();
+    out.sort();
+    out
+}
+
+#[tokio::test]
+async fn a_team_that_requires_two_step_verification_says_so() {
+    let Some((url, _)) = common::reference_state().await else {
+        return;
+    };
+    let (gated, gate) = Gate::serve(&url).await;
+    let alice = first(&url, "alice").await;
+    let bob = first(&gated, "bob").await;
+    let org = sharing::create_org(&alice.vault, &alice.client, "Acme")
+        .await
+        .unwrap();
+    let prod = sharing::create_vault(&alice.vault, &alice.client, &org, "Production")
+        .await
+        .unwrap();
+    alice
+        .vault
+        .lock()
+        .unwrap()
+        .upsert_in(&prod, None, host("db1"))
+        .unwrap();
+    round(&alice).await;
+    *gate.org.lock().unwrap() = org.clone();
+    gate.vaults.lock().unwrap().insert(prod.clone());
+
+    // Bob joins with access to Production, without two-step verification: the vault list leaves
+    // it out and says nothing; the round finds out why.
+    let invite = sharing::invite(
+        &alice.client,
+        &org,
+        &bob.email,
+        Role::Member,
+        vec![(prod.clone(), Access::Read)],
+    )
+    .await
+    .unwrap();
+    let token = invite.token.unwrap();
+    let preview = sharing::preview_invite(&bob.client, &token).await.unwrap();
+    sharing::accept_invite(&bob.vault, &bob.client, &token, &preview.owner_fingerprint)
+        .await
+        .unwrap();
+    round(&bob).await;
+    let keys = bob.vault.lock().unwrap().public_keys().unwrap();
+    let bob_fp = mg_vault::sharing::fingerprint(&bob.account, &keys);
+    sharing::confirm_member(&alice.vault, &alice.client, &org, &bob.account, &bob_fp)
+        .await
+        .unwrap();
+    let (refresh, _) = round(&bob).await;
+    assert_eq!(refresh.held, [(org.clone(), Hold::Totp)]);
+    assert!(labels(&bob, &prod).is_empty());
+
+    // With it on, the vault comes.
+    gate.totp.store(true, Ordering::SeqCst);
+    let (refresh, report) = round(&bob).await;
+    assert!(refresh.held.is_empty(), "{:?}", refresh.held);
+    assert!(report.held.is_empty(), "{:?}", report.held);
+    assert_eq!(labels(&bob, &prod), ["db1"]);
+
+    // Turned off again: the vault stays on the device, and both parts of the round say why.
+    gate.totp.store(false, Ordering::SeqCst);
+    let (refresh, report) = round(&bob).await;
+    assert_eq!(refresh.held, [(org.clone(), Hold::Totp)]);
+    assert_eq!(report.held, [(org.clone(), Hold::Totp)]);
+    assert_eq!(labels(&bob, &prod), ["db1"]);
+
+    // Alice, whom the requirement doesn't hold back, sees nothing of it.
+    let (refresh, _) = round(&alice).await;
+    assert!(refresh.held.is_empty(), "{:?}", refresh.held);
+}
diff --git a/spec/openapi.yaml b/spec/openapi.yaml
index 2a67b7c..44bcf98 100644
--- a/spec/openapi.yaml
+++ b/spec/openapi.yaml
@@ -1417,7 +1417,8 @@ components:
         org_id:
           type: string
           description: >-
-            With 403 sso_required, the organization whose identity provider the device must sign
+            With 403 totp_setup_required, the organization that requires two-step verification;
+            with 403 sso_required, the organization whose identity provider the device must sign
             in at; with 403 device_approval_required, the organization that has to approve it.
         device_id:
           type: string
@@ -1842,9 +1843,10 @@ components:
         require_totp:
           type: boolean
           description: >-
-            Members without two-step verification get 403 totp_setup_required on the
-            organization's vaults (pull and push) until they turn it on. Their personal vault is
-            unaffected. Servers without TOTP refuse to set it (501 not_supported).
+            Members without two-step verification get 403 totp_setup_required (with org_id) on
+            the organization's vaults (pull and push), and GET /vaults leaves them out, until they
+            turn it on. Their personal vault is unaffected. Servers without TOTP refuse to set it
+            (501 not_supported).
         members_can_create_vaults:
           type: boolean
           description: Members (not only owners and admins) may create vaults, which they then manage.

From 73ab2f023226b37051d747e83bde93add15a218f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Wed, 21 Oct 2026 19:44:28 +0200
Subject: [PATCH 2/6] First screen: new account, invites, suggested passwords;
 Hosts as home
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 Cargo.lock                                    |    1 +
 apps/desktop/e2e/appimage.mjs                 |    3 +
 apps/desktop/e2e/flows.mjs                    |   63 +-
 apps/desktop/e2e/layout.mjs                   |    9 +-
 apps/desktop/e2e/mobile.mjs                   |    7 +
 apps/desktop/e2e/teams.mjs                    |    2 +-
 apps/desktop/scripts/licenses.mjs             |   18 +-
 apps/desktop/src-tauri/Cargo.toml             |    1 +
 apps/desktop/src-tauri/src/lib.rs             |    4 +
 apps/desktop/src-tauri/src/links.rs           |  109 +-
 apps/desktop/src-tauri/src/orgs.rs            |   10 +
 apps/desktop/src-tauri/src/password.rs        |   71 +
 apps/desktop/src-tauri/wordlist/README.md     |   11 +
 .../src-tauri/wordlist/eff_large_wordlist.txt | 7776 +++++++++++++++++
 apps/desktop/src/App.tsx                      |   35 +-
 apps/desktop/src/Licenses.tsx                 |    4 +-
 apps/desktop/src/Lists.tsx                    |    7 +
 apps/desktop/src/SyncPanel.tsx                |   28 +-
 apps/desktop/src/SyncServerField.tsx          |    9 +-
 apps/desktop/src/Terms.tsx                    |   27 +
 apps/desktop/src/VaultGate.tsx                |  411 +-
 apps/desktop/src/api.ts                       |    9 +
 apps/desktop/src/styles.css                   |    7 +
 docs/features/account-and-devices.md          |    6 +-
 docs/features/deep-links.md                   |    6 +-
 docs/features/hosts-groups-identities.md      |    4 +-
 docs/features/sync.md                         |    2 +-
 docs/features/teams.md                        |    2 +-
 docs/features/terminal-and-snippets.md        |    2 +-
 docs/features/vault-and-unlock.md             |   13 +-
 30 files changed, 8571 insertions(+), 86 deletions(-)
 create mode 100644 apps/desktop/src-tauri/wordlist/README.md
 create mode 100644 apps/desktop/src-tauri/wordlist/eff_large_wordlist.txt
 create mode 100644 apps/desktop/src/Terms.tsx

diff --git a/Cargo.lock b/Cargo.lock
index 8e19cec..f2ec5f1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3548,6 +3548,7 @@ dependencies = [
  "apple-native-keyring-store",
  "base64 0.23.1",
  "flate2",
+ "getrandom 0.4.3",
  "jni 0.22.4",
  "keyring",
  "libc",
diff --git a/apps/desktop/e2e/appimage.mjs b/apps/desktop/e2e/appimage.mjs
index aff9357..2a2684e 100644
--- a/apps/desktop/e2e/appimage.mjs
+++ b/apps/desktop/e2e/appimage.mjs
@@ -933,6 +933,9 @@ try {
   await s.type("input[autocomplete=current-password]", PASSWORD);
   await s.exec(`document.querySelector("form button[type=submit]").click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector("button.brand") ? true : null`), "the workspace", 60000);
+  // A vault with hosts opens on them (with none, on quick connect).
+  assert.ok(await s.exec(`return document.querySelectorAll(".sidebar .row-title").length > 0`), "the vault still has hosts");
+  await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page as home");
   assert.match(await openAbout(s), new RegExp(`Version ${next} · AppImage`));
   await checkNow(s);
   await s.waitText("up to date");
diff --git a/apps/desktop/e2e/flows.mjs b/apps/desktop/e2e/flows.mjs
index 1fe3bb9..b1cf137 100644
--- a/apps/desktop/e2e/flows.mjs
+++ b/apps/desktop/e2e/flows.mjs
@@ -98,10 +98,10 @@ export async function signUp(s, { server, email, mailpit, password = PASSWORD })
   await s.waitText("Last sync", ".panel", 60000);
 }
 
-/** J3: the first screen's "I have an account" (a fresh device). */
+/** J3: the first screen's "Sign in" (a fresh device). */
 export async function signInFresh(s, { server, email, password = PASSWORD }) {
   await s.wait(() => s.exec(`return document.querySelector(".gate-choice") ? true : null`), "the first screen");
-  await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "I have an account").click(); return true`);
+  await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "Sign in").click(); return true`);
   await chooseServer(s, server);
   await s.typeLabelled("Email", email);
   await s.typeLabelled("Master password", password);
@@ -184,10 +184,16 @@ export async function invite(s, email, { mailpit } = {}) {
 /** T2 (the invitee): joins after checking the owner's fingerprint. Returns the member's own. */
 export async function acceptInvite(s, token, ownerFp, team) {
   await openTeams(s);
-  const fp = await fingerprint(s);
   await s.type('input[aria-label="Invite code"]', token);
   await s.clickButton("Look up");
-  await s.waitText("Join only if", ".panel");
+  return joinLookedUp(s, ownerFp, team);
+}
+
+/** T2 (the invitee, in Teams with the invite looked up): compares the owner's fingerprint and
+ * joins. Returns the member's own. */
+export async function joinLookedUp(s, ownerFp, team) {
+  await s.waitText("Join only if", ".panel", 30000);
+  const fp = await fingerprint(s, ".page-aside .fingerprint");
   assert.equal(await fingerprint(s, ".notice-box .fingerprint"), ownerFp);
   await s.click(".notice-box label.check input");
   await s.clickButton(`Join ${team}`);
@@ -195,6 +201,55 @@ export async function acceptInvite(s, token, ownerFp, team) {
   return fp;
 }
 
+/**
+ * J2 and T2 on a fresh install: the invite pasted on the first screen ("Joining a team?"), a new
+ * account with the address it names and a suggested password, then Teams opens with the invite
+ * looked up. Returns the password.
+ */
+export async function newAccountFromInvite(s, { invite, team, email, mailpit, shots }) {
+  await s.wait(() => s.exec(`return document.querySelector(".gate-choice") ? true : null`), "the first screen");
+  await s.clickButton("Joining a team? Paste your invite");
+  await s.typeLabelled("Invite code or link", invite);
+  await s.clickButton("Use this invite");
+  await s.waitText(`to join ${team}`, ".gate-invite", 30000);
+  // An invite needs an account: offered first, with the invited address.
+  await s.waitText("Create your account", ".gate-card");
+  await s.wait(() => s.exec(`return document.querySelector(".gate-card input[type=email]")?.value === arguments[0] || null`, email), "the invited address");
+  await s.clickButton("Suggest a strong password");
+  const password = await s.wait(() => s.exec(`return document.querySelector(".suggested-password .mono")?.innerText || null`), "a suggested password");
+  if (shots) await s.screenshot(`${shots}/first-screen-invite.png`);
+  // The server's terms, once it was asked what it needs (none on a server without them).
+  await s.wait(() => s.exec(`return document.querySelector(".gate-card .terms-check") ? true : null`), "the terms", 10000).catch(() => {});
+  if (await s.exec(`return !!document.querySelector(".gate-card .terms-check input")`)) await s.click(".gate-card .terms-check input");
+  // The recovery key (the account is made), an error, or (`code`: the first step) the mailed code's field.
+  const step = (code, what, ms) =>
+    s.wait(
+      () =>
+        s.exec(
+          `const e = document.querySelector(".gate-card p.error"); if (e) return { error: e.innerText };
+          if (document.querySelector(".recovery-code")) return "done";
+          return arguments[0] && [...document.querySelectorAll(".gate-card label span")].some((l) => l.innerText.startsWith("Code sent to")) ? "code" : null`,
+          code,
+        ),
+      what,
+      ms,
+    );
+  const since = Date.now();
+  await s.click(".gate-card form button.primary");
+  let next = await step(true, "a mailed code, or the account", 60000);
+  if (next === "code") {
+    assert.ok(mailpit, "the server mails a code: pass where to read it (Mailpit)");
+    await s.typeLabelled("Code sent to", await mailedCode(mailpit, email, since));
+    await s.click(".gate-card form button.primary");
+    next = await step(false, "the account", 90000);
+  }
+  assert.equal(next, "done", JSON.stringify(next));
+  await s.click(".gate-card label.check input");
+  await s.exec(`[...document.querySelectorAll(".gate-card button.primary")].find((b) => !b.disabled).click(); return true`);
+  await s.wait(() => s.exec(`return document.querySelector("button.brand, .m-home") ? true : null`), "the workspace", 30000);
+  return password;
+}
+
 /** T2 (an owner or admin, in the organization's page): confirms `email` after checking its fingerprint. */
 export async function confirmMember(s, email, memberFp) {
   await s.waitText("Waiting for confirmation", ".panel", 30000);
diff --git a/apps/desktop/e2e/layout.mjs b/apps/desktop/e2e/layout.mjs
index c61aa4b..4d97c4c 100644
--- a/apps/desktop/e2e/layout.mjs
+++ b/apps/desktop/e2e/layout.mjs
@@ -62,9 +62,14 @@ async function page(s, label) {
 
 const s = await session(app);
 try {
-  // The first screen: a new vault, or the account used on other devices.
+  // The first screen: a new vault, a new account, or the account used on other devices.
   await s.wait(() => s.exec(`return document.querySelector(".gate-choice") ? true : null`), "the first screen");
-  await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "I have an account").click(); return true`);
+  await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "New account").click(); return true`);
+  await s.waitText("Create your account");
+  await s.clickButton("Suggest a strong password");
+  await s.wait(() => s.exec(`return document.querySelector(".suggested-password") ? true : null`), "a suggested password");
+  await shoot(s, "first-run-new-account", ".gate");
+  await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "Sign in").click(); return true`);
   await s.waitText("Sign in to sync");
   await shoot(s, "first-run-sign-in", ".gate");
   await s.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "New vault").click(); return true`);
diff --git a/apps/desktop/e2e/mobile.mjs b/apps/desktop/e2e/mobile.mjs
index 3334b57..228a08d 100644
--- a/apps/desktop/e2e/mobile.mjs
+++ b/apps/desktop/e2e/mobile.mjs
@@ -33,6 +33,13 @@ const tapText = (css, text) =>
 
 try {
   await s.resize(390, 844);
+  // The first screen's three choices fit a phone.
+  await s.wait(() => s.exec(`return document.querySelector(".gate-choice") ? true : null`), "the first screen", 60000);
+  assert.ok(
+    await s.exec(`return [...document.querySelectorAll(".gate-choice button")].every((b) => b.scrollWidth <= b.clientWidth && b.getBoundingClientRect().height < 40)`),
+    "the choices fit on one line",
+  );
+  await s.screenshot(`${shots}/first-screen.png`);
   await createVault(s, PASSWORD, shots);
   await s.wait(() => s.exec(`return document.querySelector(".m-home") ? true : null`), "the phone layout");
   ok("a phone-sized window gets the phone layout");
diff --git a/apps/desktop/e2e/teams.mjs b/apps/desktop/e2e/teams.mjs
index 60cc04f..60c3ed1 100644
--- a/apps/desktop/e2e/teams.mjs
+++ b/apps/desktop/e2e/teams.mjs
@@ -711,7 +711,7 @@ try {
   assert.match(notice, new RegExp(`signed out of ${bobEmail.replace(/[.+]/g, "\\$&")} from another device`));
   assert.ok(await carol.exec(`return !!document.querySelector(".gate-choice")`), "back at the first screen");
   await carol.screenshot(`${shots}/carol-signed-out.png`);
-  await carol.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "I have an account").click(); return true`);
+  await carol.exec(`[...document.querySelectorAll(".gate-choice button")].find((b) => b.innerText === "Sign in").click(); return true`);
   await useOwnServer(carol);
   await carol.typeLabelled("Email", bobEmail);
   await carol.typeLabelled("Master password", PASSWORD);
diff --git a/apps/desktop/scripts/licenses.mjs b/apps/desktop/scripts/licenses.mjs
index 5a0ab59..16c2c43 100644
--- a/apps/desktop/scripts/licenses.mjs
+++ b/apps/desktop/scripts/licenses.mjs
@@ -139,6 +139,22 @@ for (const [name, url] of [
   components.push({ name, license: "OFL-1.1", kind: "font", url, texts: [ofl] });
 }
 
+// Data: EFF's long wordlist, for suggested master passwords (src-tauri/wordlist/README.md).
+components.push({
+  name: "EFF's long wordlist",
+  license: "CC-BY-3.0-US",
+  kind: "data",
+  url: "https://www.eff.org/dice",
+  texts: [
+    textId(
+      "EFF's long wordlist for passphrases, by the Electronic Frontier Foundation (https://www.eff.org/dice), " +
+        "is licensed under the Creative Commons Attribution 3.0 United States License " +
+        "(https://creativecommons.org/licenses/by/3.0/us/). MorphGate uses its words as published, " +
+        "leaving out the four that contain a hyphen.\n",
+    ),
+  ],
+});
+
 // Android: the Java libraries the app, Tauri and its plugins name in their Gradle files.
 if (target.includes("android")) {
   const apache = textId(STANDARD["Apache-2.0"]());
@@ -167,7 +183,7 @@ writeFileSync(out, json);
 for (const w of warnings) console.warn(`licenses: ${w}`);
 const count = (k) => components.filter((c) => c.kind === k).length;
 console.log(
-  `licenses: ${count("crate")} crates, ${count("npm")} npm packages, ${count("font")} fonts` +
+  `licenses: ${count("crate")} crates, ${count("npm")} npm packages, ${count("font")} fonts, ${count("data")} word list` +
     (count("android") ? `, ${count("android")} Android libraries` : "") +
     ` for ${target}; ${texts.length} texts, ${Math.round(json.length / 1024)} KiB`,
 );
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index 2eceaa5..271a5a1 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -27,6 +27,7 @@ qrcode = { version = "0.14.1", default-features = false, features = ["svg"] }
 serde.workspace = true
 serde_json.workspace = true
 sha2 = "0.11.0"
+getrandom = "0.4.3"
 zxcvbn = "3.1.1"
 tauri = { version = "2", features = [] }
 tokio.workspace = true
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index a4a7f8a..51f6b49 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -214,6 +214,8 @@ pub fn run() {
             agents::agents_list,
             orgs::orgs_locked,
             links::links_take,
+            links::links_peek,
+            links::links_add_invite,
             host_import::import_preview,
             host_import::import_hosts,
             vault::snippets_list,
@@ -229,6 +231,7 @@ pub fn run() {
             sync::sync_status,
             sync::sync_presence,
             password::password_strength,
+            password::password_suggest,
             sync::sync_check,
             sync::sync_start_registration,
             sync::sync_enable,
@@ -266,6 +269,7 @@ pub fn run() {
             orgs::org_invites,
             orgs::org_invite_cancel,
             orgs::invite_preview,
+            orgs::invite_peek,
             orgs::invite_accept,
             orgs::member_confirm,
             orgs::member_role,
diff --git a/apps/desktop/src-tauri/src/links.rs b/apps/desktop/src-tauri/src/links.rs
index 9b44f8a..f9cdb40 100644
--- a/apps/desktop/src-tauri/src/links.rs
+++ b/apps/desktop/src-tauri/src/links.rs
@@ -7,7 +7,8 @@
 //! - `morphgate://connect?host=…&port=…&user=…&label=…`: quick connect
 //!
 //! Dev builds answer `morphgate-dev://` instead. Links that arrive while the vault is locked wait
-//! here until the workspace takes them.
+//! here until the workspace takes them; the first screen looks at a waiting invite (and can add
+//! one pasted there) without taking it.
 
 use std::sync::Mutex;
 
@@ -75,11 +76,7 @@ pub fn parse(url: &Url) -> Result<Link, String> {
             let token = query("token")
                 .or_else(|| path.first().map(|s| (*s).to_owned()))
                 .ok_or("the invite link has no code")?;
-            if !(16..=256).contains(&token.len())
-                || !token
-                    .bytes()
-                    .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
-            {
+            if !invite_code(&token) {
                 return Err("the invite code in the link isn't valid".into());
             }
             let server = query("server").map(|s| origin(&s)).transpose()?;
@@ -146,6 +143,46 @@ pub fn parse(url: &Url) -> Result<Link, String> {
     }
 }
 
+/// What an invite code looks like.
+fn invite_code(token: &str) -> bool {
+    (16..=256).contains(&token.len())
+        && token
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
+}
+
+/// An invite pasted on the first screen: the code, the website's invite page
+/// (`https://…/invite/<code>`), or a `morphgate://invite` link.
+pub fn pasted_invite(text: &str) -> Result<Link, String> {
+    let text = text.trim();
+    let not = || "that isn't an invite link or code".to_owned();
+    if invite_code(text) {
+        return Ok(Link::Invite {
+            token: text.into(),
+            server: None,
+        });
+    }
+    let url = Url::parse(text).map_err(|_| not())?;
+    if SCHEMES.contains(&url.scheme()) {
+        return match parse(&url)? {
+            link @ Link::Invite { .. } => Ok(link),
+            _ => Err(not()),
+        };
+    }
+    let token = match url
+        .path_segments()
+        .map(|p| p.collect::<Vec<_>>())
+        .as_deref()
+    {
+        Some(["invite", token]) if invite_code(token) => (*token).to_owned(),
+        _ => return Err(not()),
+    };
+    Ok(Link::Invite {
+        token,
+        server: Some(origin(url.as_str())?),
+    })
+}
+
 /// `https://host[:port]` (plain `http` only for this computer).
 fn origin(server: &str) -> Result<String, String> {
     let bad = || "the server in the link isn't a sync server address".to_owned();
@@ -208,6 +245,33 @@ pub fn links_take(links: State<'_, Links>) -> Vec<Received> {
         .unwrap_or_default()
 }
 
+/// The links waiting for the workspace, left waiting (the first screen shows an invite).
+#[tauri::command]
+pub fn links_peek(links: State<'_, Links>) -> Vec<Received> {
+    links.0.lock().map(|l| l.clone()).unwrap_or_default()
+}
+
+/// An invite pasted on the first screen: it waits with the other links, so the workspace opens
+/// Teams with it once there's an account.
+#[tauri::command]
+pub fn links_add_invite(
+    app: AppHandle,
+    links: State<'_, Links>,
+    text: String,
+) -> Result<(), String> {
+    let link = pasted_invite(&text)?;
+    let mut pending = links.0.lock().map_err(|_| "links lock poisoned")?;
+    // One invite at a time: the newest replaces any waiting.
+    pending.retain(|r| !matches!(r.link, Some(Link::Invite { .. })));
+    pending.push(Received {
+        link: Some(link),
+        error: None,
+    });
+    drop(pending);
+    let _ = app.emit("links-pending", ());
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -218,6 +282,39 @@ mod tests {
 
     const TOKEN: &str = "AbCdEfGhIjKlMnOpQrStUv_-0123456789";
 
+    #[test]
+    fn pasted_invites() {
+        let hosted = Link::Invite {
+            token: TOKEN.into(),
+            server: Some("https://morphgate.com".into()),
+        };
+        assert_eq!(
+            pasted_invite(&format!(" {TOKEN}\n")),
+            Ok(Link::Invite {
+                token: TOKEN.into(),
+                server: None
+            })
+        );
+        assert_eq!(
+            pasted_invite(&format!("https://morphgate.com/invite/{TOKEN}")),
+            Ok(hosted.clone())
+        );
+        assert_eq!(
+            pasted_invite(&format!(
+                "morphgate://invite?token={TOKEN}&server=https://morphgate.com"
+            )),
+            Ok(hosted)
+        );
+        for not in [
+            "hello",
+            "morphgate://sync",
+            "https://morphgate.com/account",
+            "http://evil.example/invite/AbCdEfGhIjKlMnOpQrStUv",
+        ] {
+            assert!(pasted_invite(not).is_err(), "{not}");
+        }
+    }
+
     #[test]
     fn invites() {
         let expected = Link::Invite {
diff --git a/apps/desktop/src-tauri/src/orgs.rs b/apps/desktop/src-tauri/src/orgs.rs
index 6823162..47fb4d2 100644
--- a/apps/desktop/src-tauri/src/orgs.rs
+++ b/apps/desktop/src-tauri/src/orgs.rs
@@ -305,6 +305,16 @@ pub async fn invite_preview(
     .await
 }
 
+/// What an invite is for, before there's an account (the first screen): `server` is the one the
+/// link names, or the one chosen there.
+#[tauri::command]
+pub async fn invite_peek(server: String, token: String) -> Result<InvitePreview, String> {
+    let client = SyncClient::new(&server).map_err(|e| e.to_string())?;
+    sharing::preview_invite(&client, &token)
+        .await
+        .map_err(|e| e.to_string())
+}
+
 #[tauri::command]
 pub async fn invite_accept(
     vault: State<'_, VaultState>,
diff --git a/apps/desktop/src-tauri/src/password.rs b/apps/desktop/src-tauri/src/password.rs
index 70f395c..45cd49f 100644
--- a/apps/desktop/src-tauri/src/password.rs
+++ b/apps/desktop/src-tauri/src/password.rs
@@ -67,6 +67,57 @@ pub fn password_strength(password: String) -> Strength {
     strength(&password)
 }
 
+/// EFF's long wordlist (`wordlist/README.md`): dice numbers, a tab, a word.
+const WORDLIST: &str = include_str!("../wordlist/eff_large_wordlist.txt");
+/// Words in a suggestion: about 64 bits from the 7772 used.
+const SUGGESTED_WORDS: usize = 5;
+
+/// The list's words, but for the four with a hyphen (the separator).
+fn words() -> Vec<&'static str> {
+    WORDLIST
+        .lines()
+        .filter_map(|l| l.split_once('\t').map(|(_, w)| w.trim()))
+        .filter(|w| !w.is_empty() && w.bytes().all(|b| b.is_ascii_lowercase()))
+        .collect()
+}
+
+/// A number below `n`, every one as likely (no modulo bias).
+fn below(n: u32) -> Result<u32, String> {
+    let zone = u32::MAX - u32::MAX % n;
+    loop {
+        let mut b = [0u8; 4];
+        getrandom::fill(&mut b).map_err(|e| format!("no randomness from the system: {e}"))?;
+        let x = u32::from_le_bytes(b);
+        if x < zone {
+            return Ok(x % n);
+        }
+    }
+}
+
+/// Five words at random, joined by hyphens: easy to write down and type, hard to guess. Ones the
+/// strength check would refuse (rarely: a run of very common words) are drawn again.
+pub(crate) fn suggest() -> Result<String, String> {
+    let list = words();
+    let n = u32::try_from(list.len()).map_err(|_| "the wordlist is too long")?;
+    for _ in 0..16 {
+        let mut picked = Vec::with_capacity(SUGGESTED_WORDS);
+        for _ in 0..SUGGESTED_WORDS {
+            picked.push(list[below(n)? as usize]);
+        }
+        let password = picked.join("-");
+        if strength(&password).ok {
+            return Ok(password);
+        }
+    }
+    Err("couldn't come up with a strong password; type one instead".into())
+}
+
+/// A master password to suggest.
+#[tauri::command]
+pub fn password_suggest() -> Result<String, String> {
+    suggest()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -92,4 +143,24 @@ mod tests {
         let s = strength("P@ssw0rd123");
         assert!(!s.ok && s.warning.is_some());
     }
+
+    #[test]
+    fn suggestions_are_five_listed_words_that_pass() {
+        let list = words();
+        assert_eq!(
+            list.len(),
+            7776 - 4,
+            "the list as published, but for the hyphenated four"
+        );
+        let mut seen = std::collections::HashSet::new();
+        for _ in 0..50 {
+            let p = suggest().unwrap();
+            let parts: Vec<&str> = p.split('-').collect();
+            assert_eq!(parts.len(), SUGGESTED_WORDS, "{p}");
+            assert!(parts.iter().all(|w| list.contains(w)), "{p}");
+            assert!(check(&p).is_ok(), "{p}");
+            seen.insert(p);
+        }
+        assert_eq!(seen.len(), 50, "suggestions repeat");
+    }
 }
diff --git a/apps/desktop/src-tauri/wordlist/README.md b/apps/desktop/src-tauri/wordlist/README.md
new file mode 100644
index 0000000..21f87bd
--- /dev/null
+++ b/apps/desktop/src-tauri/wordlist/README.md
@@ -0,0 +1,11 @@
+# EFF's long wordlist
+
+`eff_large_wordlist.txt` is the [Electronic Frontier Foundation](https://www.eff.org/dice)'s long
+wordlist for passphrases, as published at
+<https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt> (7776 words, sha256
+`addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e`), under the
+[Creative Commons Attribution 3.0 United States License](https://creativecommons.org/licenses/by/3.0/us/).
+
+"Suggest one" under a new master password (`password_suggest` in `src/password.rs`) picks five of
+its words at random. It leaves out the four with a hyphen, so that a hyphen always separates words.
+The app's open-source licenses list it (`scripts/licenses.mjs`).
diff --git a/apps/desktop/src-tauri/wordlist/eff_large_wordlist.txt b/apps/desktop/src-tauri/wordlist/eff_large_wordlist.txt
new file mode 100644
index 0000000..43f88a9
--- /dev/null
+++ b/apps/desktop/src-tauri/wordlist/eff_large_wordlist.txt
@@ -0,0 +1,7776 @@
+11111	abacus
+11112	abdomen
+11113	abdominal
+11114	abide
+11115	abiding
+11116	ability
+11121	ablaze
+11122	able
+11123	abnormal
+11124	abrasion
+11125	abrasive
+11126	abreast
+11131	abridge
+11132	abroad
+11133	abruptly
+11134	absence
+11135	absentee
+11136	absently
+11141	absinthe
+11142	absolute
+11143	absolve
+11144	abstain
+11145	abstract
+11146	absurd
+11151	accent
+11152	acclaim
+11153	acclimate
+11154	accompany
+11155	account
+11156	accuracy
+11161	accurate
+11162	accustom
+11163	acetone
+11164	achiness
+11165	aching
+11166	acid
+11211	acorn
+11212	acquaint
+11213	acquire
+11214	acre
+11215	acrobat
+11216	acronym
+11221	acting
+11222	action
+11223	activate
+11224	activator
+11225	active
+11226	activism
+11231	activist
+11232	activity
+11233	actress
+11234	acts
+11235	acutely
+11236	acuteness
+11241	aeration
+11242	aerobics
+11243	aerosol
+11244	aerospace
+11245	afar
+11246	affair
+11251	affected
+11252	affecting
+11253	affection
+11254	affidavit
+11255	affiliate
+11256	affirm
+11261	affix
+11262	afflicted
+11263	affluent
+11264	afford
+11265	affront
+11266	aflame
+11311	afloat
+11312	aflutter
+11313	afoot
+11314	afraid
+11315	afterglow
+11316	afterlife
+11321	aftermath
+11322	aftermost
+11323	afternoon
+11324	aged
+11325	ageless
+11326	agency
+11331	agenda
+11332	agent
+11333	aggregate
+11334	aghast
+11335	agile
+11336	agility
+11341	aging
+11342	agnostic
+11343	agonize
+11344	agonizing
+11345	agony
+11346	agreeable
+11351	agreeably
+11352	agreed
+11353	agreeing
+11354	agreement
+11355	aground
+11356	ahead
+11361	ahoy
+11362	aide
+11363	aids
+11364	aim
+11365	ajar
+11366	alabaster
+11411	alarm
+11412	albatross
+11413	album
+11414	alfalfa
+11415	algebra
+11416	algorithm
+11421	alias
+11422	alibi
+11423	alienable
+11424	alienate
+11425	aliens
+11426	alike
+11431	alive
+11432	alkaline
+11433	alkalize
+11434	almanac
+11435	almighty
+11436	almost
+11441	aloe
+11442	aloft
+11443	aloha
+11444	alone
+11445	alongside
+11446	aloof
+11451	alphabet
+11452	alright
+11453	although
+11454	altitude
+11455	alto
+11456	aluminum
+11461	alumni
+11462	always
+11463	amaretto
+11464	amaze
+11465	amazingly
+11466	amber
+11511	ambiance
+11512	ambiguity
+11513	ambiguous
+11514	ambition
+11515	ambitious
+11516	ambulance
+11521	ambush
+11522	amendable
+11523	amendment
+11524	amends
+11525	amenity
+11526	amiable
+11531	amicably
+11532	amid
+11533	amigo
+11534	amino
+11535	amiss
+11536	ammonia
+11541	ammonium
+11542	amnesty
+11543	amniotic
+11544	among
+11545	amount
+11546	amperage
+11551	ample
+11552	amplifier
+11553	amplify
+11554	amply
+11555	amuck
+11556	amulet
+11561	amusable
+11562	amused
+11563	amusement
+11564	amuser
+11565	amusing
+11566	anaconda
+11611	anaerobic
+11612	anagram
+11613	anatomist
+11614	anatomy
+11615	anchor
+11616	anchovy
+11621	ancient
+11622	android
+11623	anemia
+11624	anemic
+11625	aneurism
+11626	anew
+11631	angelfish
+11632	angelic
+11633	anger
+11634	angled
+11635	angler
+11636	angles
+11641	angling
+11642	angrily
+11643	angriness
+11644	anguished
+11645	angular
+11646	animal
+11651	animate
+11652	animating
+11653	animation
+11654	animator
+11655	anime
+11656	animosity
+11661	ankle
+11662	annex
+11663	annotate
+11664	announcer
+11665	annoying
+11666	annually
+12111	annuity
+12112	anointer
+12113	another
+12114	answering
+12115	antacid
+12116	antarctic
+12121	anteater
+12122	antelope
+12123	antennae
+12124	anthem
+12125	anthill
+12126	anthology
+12131	antibody
+12132	antics
+12133	antidote
+12134	antihero
+12135	antiquely
+12136	antiques
+12141	antiquity
+12142	antirust
+12143	antitoxic
+12144	antitrust
+12145	antiviral
+12146	antivirus
+12151	antler
+12152	antonym
+12153	antsy
+12154	anvil
+12155	anybody
+12156	anyhow
+12161	anymore
+12162	anyone
+12163	anyplace
+12164	anything
+12165	anytime
+12166	anyway
+12211	anywhere
+12212	aorta
+12213	apache
+12214	apostle
+12215	appealing
+12216	appear
+12221	appease
+12222	appeasing
+12223	appendage
+12224	appendix
+12225	appetite
+12226	appetizer
+12231	applaud
+12232	applause
+12233	apple
+12234	appliance
+12235	applicant
+12236	applied
+12241	apply
+12242	appointee
+12243	appraisal
+12244	appraiser
+12245	apprehend
+12246	approach
+12251	approval
+12252	approve
+12253	apricot
+12254	april
+12255	apron
+12256	aptitude
+12261	aptly
+12262	aqua
+12263	aqueduct
+12264	arbitrary
+12265	arbitrate
+12266	ardently
+12311	area
+12312	arena
+12313	arguable
+12314	arguably
+12315	argue
+12316	arise
+12321	armadillo
+12322	armband
+12323	armchair
+12324	armed
+12325	armful
+12326	armhole
+12331	arming
+12332	armless
+12333	armoire
+12334	armored
+12335	armory
+12336	armrest
+12341	army
+12342	aroma
+12343	arose
+12344	around
+12345	arousal
+12346	arrange
+12351	array
+12352	arrest
+12353	arrival
+12354	arrive
+12355	arrogance
+12356	arrogant
+12361	arson
+12362	art
+12363	ascend
+12364	ascension
+12365	ascent
+12366	ascertain
+12411	ashamed
+12412	ashen
+12413	ashes
+12414	ashy
+12415	aside
+12416	askew
+12421	asleep
+12422	asparagus
+12423	aspect
+12424	aspirate
+12425	aspire
+12426	aspirin
+12431	astonish
+12432	astound
+12433	astride
+12434	astrology
+12435	astronaut
+12436	astronomy
+12441	astute
+12442	atlantic
+12443	atlas
+12444	atom
+12445	atonable
+12446	atop
+12451	atrium
+12452	atrocious
+12453	atrophy
+12454	attach
+12455	attain
+12456	attempt
+12461	attendant
+12462	attendee
+12463	attention
+12464	attentive
+12465	attest
+12466	attic
+12511	attire
+12512	attitude
+12513	attractor
+12514	attribute
+12515	atypical
+12516	auction
+12521	audacious
+12522	audacity
+12523	audible
+12524	audibly
+12525	audience
+12526	audio
+12531	audition
+12532	augmented
+12533	august
+12534	authentic
+12535	author
+12536	autism
+12541	autistic
+12542	autograph
+12543	automaker
+12544	automated
+12545	automatic
+12546	autopilot
+12551	available
+12552	avalanche
+12553	avatar
+12554	avenge
+12555	avenging
+12556	avenue
+12561	average
+12562	aversion
+12563	avert
+12564	aviation
+12565	aviator
+12566	avid
+12611	avoid
+12612	await
+12613	awaken
+12614	award
+12615	aware
+12616	awhile
+12621	awkward
+12622	awning
+12623	awoke
+12624	awry
+12625	axis
+12626	babble
+12631	babbling
+12632	babied
+12633	baboon
+12634	backache
+12635	backboard
+12636	backboned
+12641	backdrop
+12642	backed
+12643	backer
+12644	backfield
+12645	backfire
+12646	backhand
+12651	backing
+12652	backlands
+12653	backlash
+12654	backless
+12655	backlight
+12656	backlit
+12661	backlog
+12662	backpack
+12663	backpedal
+12664	backrest
+12665	backroom
+12666	backshift
+13111	backside
+13112	backslid
+13113	backspace
+13114	backspin
+13115	backstab
+13116	backstage
+13121	backtalk
+13122	backtrack
+13123	backup
+13124	backward
+13125	backwash
+13126	backwater
+13131	backyard
+13132	bacon
+13133	bacteria
+13134	bacterium
+13135	badass
+13136	badge
+13141	badland
+13142	badly
+13143	badness
+13144	baffle
+13145	baffling
+13146	bagel
+13151	bagful
+13152	baggage
+13153	bagged
+13154	baggie
+13155	bagginess
+13156	bagging
+13161	baggy
+13162	bagpipe
+13163	baguette
+13164	baked
+13165	bakery
+13166	bakeshop
+13211	baking
+13212	balance
+13213	balancing
+13214	balcony
+13215	balmy
+13216	balsamic
+13221	bamboo
+13222	banana
+13223	banish
+13224	banister
+13225	banjo
+13226	bankable
+13231	bankbook
+13232	banked
+13233	banker
+13234	banking
+13235	banknote
+13236	bankroll
+13241	banner
+13242	bannister
+13243	banshee
+13244	banter
+13245	barbecue
+13246	barbed
+13251	barbell
+13252	barber
+13253	barcode
+13254	barge
+13255	bargraph
+13256	barista
+13261	baritone
+13262	barley
+13263	barmaid
+13264	barman
+13265	barn
+13266	barometer
+13311	barrack
+13312	barracuda
+13313	barrel
+13314	barrette
+13315	barricade
+13316	barrier
+13321	barstool
+13322	bartender
+13323	barterer
+13324	bash
+13325	basically
+13326	basics
+13331	basil
+13332	basin
+13333	basis
+13334	basket
+13335	batboy
+13336	batch
+13341	bath
+13342	baton
+13343	bats
+13344	battalion
+13345	battered
+13346	battering
+13351	battery
+13352	batting
+13353	battle
+13354	bauble
+13355	bazooka
+13356	blabber
+13361	bladder
+13362	blade
+13363	blah
+13364	blame
+13365	blaming
+13366	blanching
+13411	blandness
+13412	blank
+13413	blaspheme
+13414	blasphemy
+13415	blast
+13416	blatancy
+13421	blatantly
+13422	blazer
+13423	blazing
+13424	bleach
+13425	bleak
+13426	bleep
+13431	blemish
+13432	blend
+13433	bless
+13434	blighted
+13435	blimp
+13436	bling
+13441	blinked
+13442	blinker
+13443	blinking
+13444	blinks
+13445	blip
+13446	blissful
+13451	blitz
+13452	blizzard
+13453	bloated
+13454	bloating
+13455	blob
+13456	blog
+13461	bloomers
+13462	blooming
+13463	blooper
+13464	blot
+13465	blouse
+13466	blubber
+13511	bluff
+13512	bluish
+13513	blunderer
+13514	blunt
+13515	blurb
+13516	blurred
+13521	blurry
+13522	blurt
+13523	blush
+13524	blustery
+13525	boaster
+13526	boastful
+13531	boasting
+13532	boat
+13533	bobbed
+13534	bobbing
+13535	bobble
+13536	bobcat
+13541	bobsled
+13542	bobtail
+13543	bodacious
+13544	body
+13545	bogged
+13546	boggle
+13551	bogus
+13552	boil
+13553	bok
+13554	bolster
+13555	bolt
+13556	bonanza
+13561	bonded
+13562	bonding
+13563	bondless
+13564	boned
+13565	bonehead
+13566	boneless
+13611	bonelike
+13612	boney
+13613	bonfire
+13614	bonnet
+13615	bonsai
+13616	bonus
+13621	bony
+13622	boogeyman
+13623	boogieman
+13624	book
+13625	boondocks
+13626	booted
+13631	booth
+13632	bootie
+13633	booting
+13634	bootlace
+13635	bootleg
+13636	boots
+13641	boozy
+13642	borax
+13643	boring
+13644	borough
+13645	borrower
+13646	borrowing
+13651	boss
+13652	botanical
+13653	botanist
+13654	botany
+13655	botch
+13656	both
+13661	bottle
+13662	bottling
+13663	bottom
+13664	bounce
+13665	bouncing
+13666	bouncy
+14111	bounding
+14112	boundless
+14113	bountiful
+14114	bovine
+14115	boxcar
+14116	boxer
+14121	boxing
+14122	boxlike
+14123	boxy
+14124	breach
+14125	breath
+14126	breeches
+14131	breeching
+14132	breeder
+14133	breeding
+14134	breeze
+14135	breezy
+14136	brethren
+14141	brewery
+14142	brewing
+14143	briar
+14144	bribe
+14145	brick
+14146	bride
+14151	bridged
+14152	brigade
+14153	bright
+14154	brilliant
+14155	brim
+14156	bring
+14161	brink
+14162	brisket
+14163	briskly
+14164	briskness
+14165	bristle
+14166	brittle
+14211	broadband
+14212	broadcast
+14213	broaden
+14214	broadly
+14215	broadness
+14216	broadside
+14221	broadways
+14222	broiler
+14223	broiling
+14224	broken
+14225	broker
+14226	bronchial
+14231	bronco
+14232	bronze
+14233	bronzing
+14234	brook
+14235	broom
+14236	brought
+14241	browbeat
+14242	brownnose
+14243	browse
+14244	browsing
+14245	bruising
+14246	brunch
+14251	brunette
+14252	brunt
+14253	brush
+14254	brussels
+14255	brute
+14256	brutishly
+14261	bubble
+14262	bubbling
+14263	bubbly
+14264	buccaneer
+14265	bucked
+14266	bucket
+14311	buckle
+14312	buckshot
+14313	buckskin
+14314	bucktooth
+14315	buckwheat
+14316	buddhism
+14321	buddhist
+14322	budding
+14323	buddy
+14324	budget
+14325	buffalo
+14326	buffed
+14331	buffer
+14332	buffing
+14333	buffoon
+14334	buggy
+14335	bulb
+14336	bulge
+14341	bulginess
+14342	bulgur
+14343	bulk
+14344	bulldog
+14345	bulldozer
+14346	bullfight
+14351	bullfrog
+14352	bullhorn
+14353	bullion
+14354	bullish
+14355	bullpen
+14356	bullring
+14361	bullseye
+14362	bullwhip
+14363	bully
+14364	bunch
+14365	bundle
+14366	bungee
+14411	bunion
+14412	bunkbed
+14413	bunkhouse
+14414	bunkmate
+14415	bunny
+14416	bunt
+14421	busboy
+14422	bush
+14423	busily
+14424	busload
+14425	bust
+14426	busybody
+14431	buzz
+14432	cabana
+14433	cabbage
+14434	cabbie
+14435	cabdriver
+14436	cable
+14441	caboose
+14442	cache
+14443	cackle
+14444	cacti
+14445	cactus
+14446	caddie
+14451	caddy
+14452	cadet
+14453	cadillac
+14454	cadmium
+14455	cage
+14456	cahoots
+14461	cake
+14462	calamari
+14463	calamity
+14464	calcium
+14465	calculate
+14466	calculus
+14511	caliber
+14512	calibrate
+14513	calm
+14514	caloric
+14515	calorie
+14516	calzone
+14521	camcorder
+14522	cameo
+14523	camera
+14524	camisole
+14525	camper
+14526	campfire
+14531	camping
+14532	campsite
+14533	campus
+14534	canal
+14535	canary
+14536	cancel
+14541	candied
+14542	candle
+14543	candy
+14544	cane
+14545	canine
+14546	canister
+14551	cannabis
+14552	canned
+14553	canning
+14554	cannon
+14555	cannot
+14556	canola
+14561	canon
+14562	canopener
+14563	canopy
+14564	canteen
+14565	canyon
+14566	capable
+14611	capably
+14612	capacity
+14613	cape
+14614	capillary
+14615	capital
+14616	capitol
+14621	capped
+14622	capricorn
+14623	capsize
+14624	capsule
+14625	caption
+14626	captivate
+14631	captive
+14632	captivity
+14633	capture
+14634	caramel
+14635	carat
+14636	caravan
+14641	carbon
+14642	cardboard
+14643	carded
+14644	cardiac
+14645	cardigan
+14646	cardinal
+14651	cardstock
+14652	carefully
+14653	caregiver
+14654	careless
+14655	caress
+14656	caretaker
+14661	cargo
+14662	caring
+14663	carless
+14664	carload
+14665	carmaker
+14666	carnage
+15111	carnation
+15112	carnival
+15113	carnivore
+15114	carol
+15115	carpenter
+15116	carpentry
+15121	carpool
+15122	carport
+15123	carried
+15124	carrot
+15125	carrousel
+15126	carry
+15131	cartel
+15132	cartload
+15133	carton
+15134	cartoon
+15135	cartridge
+15136	cartwheel
+15141	carve
+15142	carving
+15143	carwash
+15144	cascade
+15145	case
+15146	cash
+15151	casing
+15152	casino
+15153	casket
+15154	cassette
+15155	casually
+15156	casualty
+15161	catacomb
+15162	catalog
+15163	catalyst
+15164	catalyze
+15165	catapult
+15166	cataract
+15211	catatonic
+15212	catcall
+15213	catchable
+15214	catcher
+15215	catching
+15216	catchy
+15221	caterer
+15222	catering
+15223	catfight
+15224	catfish
+15225	cathedral
+15226	cathouse
+15231	catlike
+15232	catnap
+15233	catnip
+15234	catsup
+15235	cattail
+15236	cattishly
+15241	cattle
+15242	catty
+15243	catwalk
+15244	caucasian
+15245	caucus
+15246	causal
+15251	causation
+15252	cause
+15253	causing
+15254	cauterize
+15255	caution
+15256	cautious
+15261	cavalier
+15262	cavalry
+15263	caviar
+15264	cavity
+15265	cedar
+15266	celery
+15311	celestial
+15312	celibacy
+15313	celibate
+15314	celtic
+15315	cement
+15316	census
+15321	ceramics
+15322	ceremony
+15323	certainly
+15324	certainty
+15325	certified
+15326	certify
+15331	cesarean
+15332	cesspool
+15333	chafe
+15334	chaffing
+15335	chain
+15336	chair
+15341	chalice
+15342	challenge
+15343	chamber
+15344	chamomile
+15345	champion
+15346	chance
+15351	change
+15352	channel
+15353	chant
+15354	chaos
+15355	chaperone
+15356	chaplain
+15361	chapped
+15362	chaps
+15363	chapter
+15364	character
+15365	charbroil
+15366	charcoal
+15411	charger
+15412	charging
+15413	chariot
+15414	charity
+15415	charm
+15416	charred
+15421	charter
+15422	charting
+15423	chase
+15424	chasing
+15425	chaste
+15426	chastise
+15431	chastity
+15432	chatroom
+15433	chatter
+15434	chatting
+15435	chatty
+15436	cheating
+15441	cheddar
+15442	cheek
+15443	cheer
+15444	cheese
+15445	cheesy
+15446	chef
+15451	chemicals
+15452	chemist
+15453	chemo
+15454	cherisher
+15455	cherub
+15456	chess
+15461	chest
+15462	chevron
+15463	chevy
+15464	chewable
+15465	chewer
+15466	chewing
+15511	chewy
+15512	chief
+15513	chihuahua
+15514	childcare
+15515	childhood
+15516	childish
+15521	childless
+15522	childlike
+15523	chili
+15524	chill
+15525	chimp
+15526	chip
+15531	chirping
+15532	chirpy
+15533	chitchat
+15534	chivalry
+15535	chive
+15536	chloride
+15541	chlorine
+15542	choice
+15543	chokehold
+15544	choking
+15545	chomp
+15546	chooser
+15551	choosing
+15552	choosy
+15553	chop
+15554	chosen
+15555	chowder
+15556	chowtime
+15561	chrome
+15562	chubby
+15563	chuck
+15564	chug
+15565	chummy
+15566	chump
+15611	chunk
+15612	churn
+15613	chute
+15614	cider
+15615	cilantro
+15616	cinch
+15621	cinema
+15622	cinnamon
+15623	circle
+15624	circling
+15625	circular
+15626	circulate
+15631	circus
+15632	citable
+15633	citadel
+15634	citation
+15635	citizen
+15636	citric
+15641	citrus
+15642	city
+15643	civic
+15644	civil
+15645	clad
+15646	claim
+15651	clambake
+15652	clammy
+15653	clamor
+15654	clamp
+15655	clamshell
+15656	clang
+15661	clanking
+15662	clapped
+15663	clapper
+15664	clapping
+15665	clarify
+15666	clarinet
+16111	clarity
+16112	clash
+16113	clasp
+16114	class
+16115	clatter
+16116	clause
+16121	clavicle
+16122	claw
+16123	clay
+16124	clean
+16125	clear
+16126	cleat
+16131	cleaver
+16132	cleft
+16133	clench
+16134	clergyman
+16135	clerical
+16136	clerk
+16141	clever
+16142	clicker
+16143	client
+16144	climate
+16145	climatic
+16146	cling
+16151	clinic
+16152	clinking
+16153	clip
+16154	clique
+16155	cloak
+16156	clobber
+16161	clock
+16162	clone
+16163	cloning
+16164	closable
+16165	closure
+16166	clothes
+16211	clothing
+16212	cloud
+16213	clover
+16214	clubbed
+16215	clubbing
+16216	clubhouse
+16221	clump
+16222	clumsily
+16223	clumsy
+16224	clunky
+16225	clustered
+16226	clutch
+16231	clutter
+16232	coach
+16233	coagulant
+16234	coastal
+16235	coaster
+16236	coasting
+16241	coastland
+16242	coastline
+16243	coat
+16244	coauthor
+16245	cobalt
+16246	cobbler
+16251	cobweb
+16252	cocoa
+16253	coconut
+16254	cod
+16255	coeditor
+16256	coerce
+16261	coexist
+16262	coffee
+16263	cofounder
+16264	cognition
+16265	cognitive
+16266	cogwheel
+16311	coherence
+16312	coherent
+16313	cohesive
+16314	coil
+16315	coke
+16316	cola
+16321	cold
+16322	coleslaw
+16323	coliseum
+16324	collage
+16325	collapse
+16326	collar
+16331	collected
+16332	collector
+16333	collide
+16334	collie
+16335	collision
+16336	colonial
+16341	colonist
+16342	colonize
+16343	colony
+16344	colossal
+16345	colt
+16346	coma
+16351	come
+16352	comfort
+16353	comfy
+16354	comic
+16355	coming
+16356	comma
+16361	commence
+16362	commend
+16363	comment
+16364	commerce
+16365	commode
+16366	commodity
+16411	commodore
+16412	common
+16413	commotion
+16414	commute
+16415	commuting
+16416	compacted
+16421	compacter
+16422	compactly
+16423	compactor
+16424	companion
+16425	company
+16426	compare
+16431	compel
+16432	compile
+16433	comply
+16434	component
+16435	composed
+16436	composer
+16441	composite
+16442	compost
+16443	composure
+16444	compound
+16445	compress
+16446	comprised
+16451	computer
+16452	computing
+16453	comrade
+16454	concave
+16455	conceal
+16456	conceded
+16461	concept
+16462	concerned
+16463	concert
+16464	conch
+16465	concierge
+16466	concise
+16511	conclude
+16512	concrete
+16513	concur
+16514	condense
+16515	condiment
+16516	condition
+16521	condone
+16522	conducive
+16523	conductor
+16524	conduit
+16525	cone
+16526	confess
+16531	confetti
+16532	confidant
+16533	confident
+16534	confider
+16535	confiding
+16536	configure
+16541	confined
+16542	confining
+16543	confirm
+16544	conflict
+16545	conform
+16546	confound
+16551	confront
+16552	confused
+16553	confusing
+16554	confusion
+16555	congenial
+16556	congested
+16561	congrats
+16562	congress
+16563	conical
+16564	conjoined
+16565	conjure
+16566	conjuror
+16611	connected
+16612	connector
+16613	consensus
+16614	consent
+16615	console
+16616	consoling
+16621	consonant
+16622	constable
+16623	constant
+16624	constrain
+16625	constrict
+16626	construct
+16631	consult
+16632	consumer
+16633	consuming
+16634	contact
+16635	container
+16636	contempt
+16641	contend
+16642	contented
+16643	contently
+16644	contents
+16645	contest
+16646	context
+16651	contort
+16652	contour
+16653	contrite
+16654	control
+16655	contusion
+16656	convene
+16661	convent
+16662	copartner
+16663	cope
+16664	copied
+16665	copier
+16666	copilot
+21111	coping
+21112	copious
+21113	copper
+21114	copy
+21115	coral
+21116	cork
+21121	cornball
+21122	cornbread
+21123	corncob
+21124	cornea
+21125	corned
+21126	corner
+21131	cornfield
+21132	cornflake
+21133	cornhusk
+21134	cornmeal
+21135	cornstalk
+21136	corny
+21141	coronary
+21142	coroner
+21143	corporal
+21144	corporate
+21145	corral
+21146	correct
+21151	corridor
+21152	corrode
+21153	corroding
+21154	corrosive
+21155	corsage
+21156	corset
+21161	cortex
+21162	cosigner
+21163	cosmetics
+21164	cosmic
+21165	cosmos
+21166	cosponsor
+21211	cost
+21212	cottage
+21213	cotton
+21214	couch
+21215	cough
+21216	could
+21221	countable
+21222	countdown
+21223	counting
+21224	countless
+21225	country
+21226	county
+21231	courier
+21232	covenant
+21233	cover
+21234	coveted
+21235	coveting
+21236	coyness
+21241	cozily
+21242	coziness
+21243	cozy
+21244	crabbing
+21245	crabgrass
+21246	crablike
+21251	crabmeat
+21252	cradle
+21253	cradling
+21254	crafter
+21255	craftily
+21256	craftsman
+21261	craftwork
+21262	crafty
+21263	cramp
+21264	cranberry
+21265	crane
+21266	cranial
+21311	cranium
+21312	crank
+21313	crate
+21314	crave
+21315	craving
+21316	crawfish
+21321	crawlers
+21322	crawling
+21323	crayfish
+21324	crayon
+21325	crazed
+21326	crazily
+21331	craziness
+21332	crazy
+21333	creamed
+21334	creamer
+21335	creamlike
+21336	crease
+21341	creasing
+21342	creatable
+21343	create
+21344	creation
+21345	creative
+21346	creature
+21351	credible
+21352	credibly
+21353	credit
+21354	creed
+21355	creme
+21356	creole
+21361	crepe
+21362	crept
+21363	crescent
+21364	crested
+21365	cresting
+21366	crestless
+21411	crevice
+21412	crewless
+21413	crewman
+21414	crewmate
+21415	crib
+21416	cricket
+21421	cried
+21422	crier
+21423	crimp
+21424	crimson
+21425	cringe
+21426	cringing
+21431	crinkle
+21432	crinkly
+21433	crisped
+21434	crisping
+21435	crisply
+21436	crispness
+21441	crispy
+21442	criteria
+21443	critter
+21444	croak
+21445	crock
+21446	crook
+21451	croon
+21452	crop
+21453	cross
+21454	crouch
+21455	crouton
+21456	crowbar
+21461	crowd
+21462	crown
+21463	crucial
+21464	crudely
+21465	crudeness
+21466	cruelly
+21511	cruelness
+21512	cruelty
+21513	crumb
+21514	crummiest
+21515	crummy
+21516	crumpet
+21521	crumpled
+21522	cruncher
+21523	crunching
+21524	crunchy
+21525	crusader
+21526	crushable
+21531	crushed
+21532	crusher
+21533	crushing
+21534	crust
+21535	crux
+21536	crying
+21541	cryptic
+21542	crystal
+21543	cubbyhole
+21544	cube
+21545	cubical
+21546	cubicle
+21551	cucumber
+21552	cuddle
+21553	cuddly
+21554	cufflink
+21555	culinary
+21556	culminate
+21561	culpable
+21562	culprit
+21563	cultivate
+21564	cultural
+21565	culture
+21566	cupbearer
+21611	cupcake
+21612	cupid
+21613	cupped
+21614	cupping
+21615	curable
+21616	curator
+21621	curdle
+21622	cure
+21623	curfew
+21624	curing
+21625	curled
+21626	curler
+21631	curliness
+21632	curling
+21633	curly
+21634	curry
+21635	curse
+21636	cursive
+21641	cursor
+21642	curtain
+21643	curtly
+21644	curtsy
+21645	curvature
+21646	curve
+21651	curvy
+21652	cushy
+21653	cusp
+21654	cussed
+21655	custard
+21656	custodian
+21661	custody
+21662	customary
+21663	customer
+21664	customize
+21665	customs
+21666	cut
+22111	cycle
+22112	cyclic
+22113	cycling
+22114	cyclist
+22115	cylinder
+22116	cymbal
+22121	cytoplasm
+22122	cytoplast
+22123	dab
+22124	dad
+22125	daffodil
+22126	dagger
+22131	daily
+22132	daintily
+22133	dainty
+22134	dairy
+22135	daisy
+22136	dallying
+22141	dance
+22142	dancing
+22143	dandelion
+22144	dander
+22145	dandruff
+22146	dandy
+22151	danger
+22152	dangle
+22153	dangling
+22154	daredevil
+22155	dares
+22156	daringly
+22161	darkened
+22162	darkening
+22163	darkish
+22164	darkness
+22165	darkroom
+22166	darling
+22211	darn
+22212	dart
+22213	darwinism
+22214	dash
+22215	dastardly
+22216	data
+22221	datebook
+22222	dating
+22223	daughter
+22224	daunting
+22225	dawdler
+22226	dawn
+22231	daybed
+22232	daybreak
+22233	daycare
+22234	daydream
+22235	daylight
+22236	daylong
+22241	dayroom
+22242	daytime
+22243	dazzler
+22244	dazzling
+22245	deacon
+22246	deafening
+22251	deafness
+22252	dealer
+22253	dealing
+22254	dealmaker
+22255	dealt
+22256	dean
+22261	debatable
+22262	debate
+22263	debating
+22264	debit
+22265	debrief
+22266	debtless
+22311	debtor
+22312	debug
+22313	debunk
+22314	decade
+22315	decaf
+22316	decal
+22321	decathlon
+22322	decay
+22323	deceased
+22324	deceit
+22325	deceiver
+22326	deceiving
+22331	december
+22332	decency
+22333	decent
+22334	deception
+22335	deceptive
+22336	decibel
+22341	decidable
+22342	decimal
+22343	decimeter
+22344	decipher
+22345	deck
+22346	declared
+22351	decline
+22352	decode
+22353	decompose
+22354	decorated
+22355	decorator
+22356	decoy
+22361	decrease
+22362	decree
+22363	dedicate
+22364	dedicator
+22365	deduce
+22366	deduct
+22411	deed
+22412	deem
+22413	deepen
+22414	deeply
+22415	deepness
+22416	deface
+22421	defacing
+22422	defame
+22423	default
+22424	defeat
+22425	defection
+22426	defective
+22431	defendant
+22432	defender
+22433	defense
+22434	defensive
+22435	deferral
+22436	deferred
+22441	defiance
+22442	defiant
+22443	defile
+22444	defiling
+22445	define
+22446	definite
+22451	deflate
+22452	deflation
+22453	deflator
+22454	deflected
+22455	deflector
+22456	defog
+22461	deforest
+22462	defraud
+22463	defrost
+22464	deftly
+22465	defuse
+22466	defy
+22511	degraded
+22512	degrading
+22513	degrease
+22514	degree
+22515	dehydrate
+22516	deity
+22521	dejected
+22522	delay
+22523	delegate
+22524	delegator
+22525	delete
+22526	deletion
+22531	delicacy
+22532	delicate
+22533	delicious
+22534	delighted
+22535	delirious
+22536	delirium
+22541	deliverer
+22542	delivery
+22543	delouse
+22544	delta
+22545	deluge
+22546	delusion
+22551	deluxe
+22552	demanding
+22553	demeaning
+22554	demeanor
+22555	demise
+22556	democracy
+22561	democrat
+22562	demote
+22563	demotion
+22564	demystify
+22565	denatured
+22566	deniable
+22611	denial
+22612	denim
+22613	denote
+22614	dense
+22615	density
+22616	dental
+22621	dentist
+22622	denture
+22623	deny
+22624	deodorant
+22625	deodorize
+22626	departed
+22631	departure
+22632	depict
+22633	deplete
+22634	depletion
+22635	deplored
+22636	deploy
+22641	deport
+22642	depose
+22643	depraved
+22644	depravity
+22645	deprecate
+22646	depress
+22651	deprive
+22652	depth
+22653	deputize
+22654	deputy
+22655	derail
+22656	deranged
+22661	derby
+22662	derived
+22663	desecrate
+22664	deserve
+22665	deserving
+22666	designate
+23111	designed
+23112	designer
+23113	designing
+23114	deskbound
+23115	desktop
+23116	deskwork
+23121	desolate
+23122	despair
+23123	despise
+23124	despite
+23125	destiny
+23126	destitute
+23131	destruct
+23132	detached
+23133	detail
+23134	detection
+23135	detective
+23136	detector
+23141	detention
+23142	detergent
+23143	detest
+23144	detonate
+23145	detonator
+23146	detoxify
+23151	detract
+23152	deuce
+23153	devalue
+23154	deviancy
+23155	deviant
+23156	deviate
+23161	deviation
+23162	deviator
+23163	device
+23164	devious
+23165	devotedly
+23166	devotee
+23211	devotion
+23212	devourer
+23213	devouring
+23214	devoutly
+23215	dexterity
+23216	dexterous
+23221	diabetes
+23222	diabetic
+23223	diabolic
+23224	diagnoses
+23225	diagnosis
+23226	diagram
+23231	dial
+23232	diameter
+23233	diaper
+23234	diaphragm
+23235	diary
+23236	dice
+23241	dicing
+23242	dictate
+23243	dictation
+23244	dictator
+23245	difficult
+23246	diffused
+23251	diffuser
+23252	diffusion
+23253	diffusive
+23254	dig
+23255	dilation
+23256	diligence
+23261	diligent
+23262	dill
+23263	dilute
+23264	dime
+23265	diminish
+23266	dimly
+23311	dimmed
+23312	dimmer
+23313	dimness
+23314	dimple
+23315	diner
+23316	dingbat
+23321	dinghy
+23322	dinginess
+23323	dingo
+23324	dingy
+23325	dining
+23326	dinner
+23331	diocese
+23332	dioxide
+23333	diploma
+23334	dipped
+23335	dipper
+23336	dipping
+23341	directed
+23342	direction
+23343	directive
+23344	directly
+23345	directory
+23346	direness
+23351	dirtiness
+23352	disabled
+23353	disagree
+23354	disallow
+23355	disarm
+23356	disarray
+23361	disaster
+23362	disband
+23363	disbelief
+23364	disburse
+23365	discard
+23366	discern
+23411	discharge
+23412	disclose
+23413	discolor
+23414	discount
+23415	discourse
+23416	discover
+23421	discuss
+23422	disdain
+23423	disengage
+23424	disfigure
+23425	disgrace
+23426	dish
+23431	disinfect
+23432	disjoin
+23433	disk
+23434	dislike
+23435	disliking
+23436	dislocate
+23441	dislodge
+23442	disloyal
+23443	dismantle
+23444	dismay
+23445	dismiss
+23446	dismount
+23451	disobey
+23452	disorder
+23453	disown
+23454	disparate
+23455	disparity
+23456	dispatch
+23461	dispense
+23462	dispersal
+23463	dispersed
+23464	disperser
+23465	displace
+23466	display
+23511	displease
+23512	disposal
+23513	dispose
+23514	disprove
+23515	dispute
+23516	disregard
+23521	disrupt
+23522	dissuade
+23523	distance
+23524	distant
+23525	distaste
+23526	distill
+23531	distinct
+23532	distort
+23533	distract
+23534	distress
+23535	district
+23536	distrust
+23541	ditch
+23542	ditto
+23543	ditzy
+23544	dividable
+23545	divided
+23546	dividend
+23551	dividers
+23552	dividing
+23553	divinely
+23554	diving
+23555	divinity
+23556	divisible
+23561	divisibly
+23562	division
+23563	divisive
+23564	divorcee
+23565	dizziness
+23566	dizzy
+23611	doable
+23612	docile
+23613	dock
+23614	doctrine
+23615	document
+23616	dodge
+23621	dodgy
+23622	doily
+23623	doing
+23624	dole
+23625	dollar
+23626	dollhouse
+23631	dollop
+23632	dolly
+23633	dolphin
+23634	domain
+23635	domelike
+23636	domestic
+23641	dominion
+23642	dominoes
+23643	donated
+23644	donation
+23645	donator
+23646	donor
+23651	donut
+23652	doodle
+23653	doorbell
+23654	doorframe
+23655	doorknob
+23656	doorman
+23661	doormat
+23662	doornail
+23663	doorpost
+23664	doorstep
+23665	doorstop
+23666	doorway
+24111	doozy
+24112	dork
+24113	dormitory
+24114	dorsal
+24115	dosage
+24116	dose
+24121	dotted
+24122	doubling
+24123	douche
+24124	dove
+24125	down
+24126	dowry
+24131	doze
+24132	drab
+24133	dragging
+24134	dragonfly
+24135	dragonish
+24136	dragster
+24141	drainable
+24142	drainage
+24143	drained
+24144	drainer
+24145	drainpipe
+24146	dramatic
+24151	dramatize
+24152	drank
+24153	drapery
+24154	drastic
+24155	draw
+24156	dreaded
+24161	dreadful
+24162	dreadlock
+24163	dreamboat
+24164	dreamily
+24165	dreamland
+24166	dreamless
+24211	dreamlike
+24212	dreamt
+24213	dreamy
+24214	drearily
+24215	dreary
+24216	drench
+24221	dress
+24222	drew
+24223	dribble
+24224	dried
+24225	drier
+24226	drift
+24231	driller
+24232	drilling
+24233	drinkable
+24234	drinking
+24235	dripping
+24236	drippy
+24241	drivable
+24242	driven
+24243	driver
+24244	driveway
+24245	driving
+24246	drizzle
+24251	drizzly
+24252	drone
+24253	drool
+24254	droop
+24255	drop-down
+24256	dropbox
+24261	dropkick
+24262	droplet
+24263	dropout
+24264	dropper
+24265	drove
+24266	drown
+24311	drowsily
+24312	drudge
+24313	drum
+24314	dry
+24315	dubbed
+24316	dubiously
+24321	duchess
+24322	duckbill
+24323	ducking
+24324	duckling
+24325	ducktail
+24326	ducky
+24331	duct
+24332	dude
+24333	duffel
+24334	dugout
+24335	duh
+24336	duke
+24341	duller
+24342	dullness
+24343	duly
+24344	dumping
+24345	dumpling
+24346	dumpster
+24351	duo
+24352	dupe
+24353	duplex
+24354	duplicate
+24355	duplicity
+24356	durable
+24361	durably
+24362	duration
+24363	duress
+24364	during
+24365	dusk
+24366	dust
+24411	dutiful
+24412	duty
+24413	duvet
+24414	dwarf
+24415	dweeb
+24416	dwelled
+24421	dweller
+24422	dwelling
+24423	dwindle
+24424	dwindling
+24425	dynamic
+24426	dynamite
+24431	dynasty
+24432	dyslexia
+24433	dyslexic
+24434	each
+24435	eagle
+24436	earache
+24441	eardrum
+24442	earflap
+24443	earful
+24444	earlobe
+24445	early
+24446	earmark
+24451	earmuff
+24452	earphone
+24453	earpiece
+24454	earplugs
+24455	earring
+24456	earshot
+24461	earthen
+24462	earthlike
+24463	earthling
+24464	earthly
+24465	earthworm
+24466	earthy
+24511	earwig
+24512	easeful
+24513	easel
+24514	easiest
+24515	easily
+24516	easiness
+24521	easing
+24522	eastbound
+24523	eastcoast
+24524	easter
+24525	eastward
+24526	eatable
+24531	eaten
+24532	eatery
+24533	eating
+24534	eats
+24535	ebay
+24536	ebony
+24541	ebook
+24542	ecard
+24543	eccentric
+24544	echo
+24545	eclair
+24546	eclipse
+24551	ecologist
+24552	ecology
+24553	economic
+24554	economist
+24555	economy
+24556	ecosphere
+24561	ecosystem
+24562	edge
+24563	edginess
+24564	edging
+24565	edgy
+24566	edition
+24611	editor
+24612	educated
+24613	education
+24614	educator
+24615	eel
+24616	effective
+24621	effects
+24622	efficient
+24623	effort
+24624	eggbeater
+24625	egging
+24626	eggnog
+24631	eggplant
+24632	eggshell
+24633	egomaniac
+24634	egotism
+24635	egotistic
+24636	either
+24641	eject
+24642	elaborate
+24643	elastic
+24644	elated
+24645	elbow
+24646	eldercare
+24651	elderly
+24652	eldest
+24653	electable
+24654	election
+24655	elective
+24656	elephant
+24661	elevate
+24662	elevating
+24663	elevation
+24664	elevator
+24665	eleven
+24666	elf
+25111	eligible
+25112	eligibly
+25113	eliminate
+25114	elite
+25115	elitism
+25116	elixir
+25121	elk
+25122	ellipse
+25123	elliptic
+25124	elm
+25125	elongated
+25126	elope
+25131	eloquence
+25132	eloquent
+25133	elsewhere
+25134	elude
+25135	elusive
+25136	elves
+25141	email
+25142	embargo
+25143	embark
+25144	embassy
+25145	embattled
+25146	embellish
+25151	ember
+25152	embezzle
+25153	emblaze
+25154	emblem
+25155	embody
+25156	embolism
+25161	emboss
+25162	embroider
+25163	emcee
+25164	emerald
+25165	emergency
+25166	emission
+25211	emit
+25212	emote
+25213	emoticon
+25214	emotion
+25215	empathic
+25216	empathy
+25221	emperor
+25222	emphases
+25223	emphasis
+25224	emphasize
+25225	emphatic
+25226	empirical
+25231	employed
+25232	employee
+25233	employer
+25234	emporium
+25235	empower
+25236	emptier
+25241	emptiness
+25242	empty
+25243	emu
+25244	enable
+25245	enactment
+25246	enamel
+25251	enchanted
+25252	enchilada
+25253	encircle
+25254	enclose
+25255	enclosure
+25256	encode
+25261	encore
+25262	encounter
+25263	encourage
+25264	encroach
+25265	encrust
+25266	encrypt
+25311	endanger
+25312	endeared
+25313	endearing
+25314	ended
+25315	ending
+25316	endless
+25321	endnote
+25322	endocrine
+25323	endorphin
+25324	endorse
+25325	endowment
+25326	endpoint
+25331	endurable
+25332	endurance
+25333	enduring
+25334	energetic
+25335	energize
+25336	energy
+25341	enforced
+25342	enforcer
+25343	engaged
+25344	engaging
+25345	engine
+25346	engorge
+25351	engraved
+25352	engraver
+25353	engraving
+25354	engross
+25355	engulf
+25356	enhance
+25361	enigmatic
+25362	enjoyable
+25363	enjoyably
+25364	enjoyer
+25365	enjoying
+25366	enjoyment
+25411	enlarged
+25412	enlarging
+25413	enlighten
+25414	enlisted
+25415	enquirer
+25416	enrage
+25421	enrich
+25422	enroll
+25423	enslave
+25424	ensnare
+25425	ensure
+25426	entail
+25431	entangled
+25432	entering
+25433	entertain
+25434	enticing
+25435	entire
+25436	entitle
+25441	entity
+25442	entomb
+25443	entourage
+25444	entrap
+25445	entree
+25446	entrench
+25451	entrust
+25452	entryway
+25453	entwine
+25454	enunciate
+25455	envelope
+25456	enviable
+25461	enviably
+25462	envious
+25463	envision
+25464	envoy
+25465	envy
+25466	enzyme
+25511	epic
+25512	epidemic
+25513	epidermal
+25514	epidermis
+25515	epidural
+25516	epilepsy
+25521	epileptic
+25522	epilogue
+25523	epiphany
+25524	episode
+25525	equal
+25526	equate
+25531	equation
+25532	equator
+25533	equinox
+25534	equipment
+25535	equity
+25536	equivocal
+25541	eradicate
+25542	erasable
+25543	erased
+25544	eraser
+25545	erasure
+25546	ergonomic
+25551	errand
+25552	errant
+25553	erratic
+25554	error
+25555	erupt
+25556	escalate
+25561	escalator
+25562	escapable
+25563	escapade
+25564	escapist
+25565	escargot
+25566	eskimo
+25611	esophagus
+25612	espionage
+25613	espresso
+25614	esquire
+25615	essay
+25616	essence
+25621	essential
+25622	establish
+25623	estate
+25624	esteemed
+25625	estimate
+25626	estimator
+25631	estranged
+25632	estrogen
+25633	etching
+25634	eternal
+25635	eternity
+25636	ethanol
+25641	ether
+25642	ethically
+25643	ethics
+25644	euphemism
+25645	evacuate
+25646	evacuee
+25651	evade
+25652	evaluate
+25653	evaluator
+25654	evaporate
+25655	evasion
+25656	evasive
+25661	even
+25662	everglade
+25663	evergreen
+25664	everybody
+25665	everyday
+25666	everyone
+26111	evict
+26112	evidence
+26113	evident
+26114	evil
+26115	evoke
+26116	evolution
+26121	evolve
+26122	exact
+26123	exalted
+26124	example
+26125	excavate
+26126	excavator
+26131	exceeding
+26132	exception
+26133	excess
+26134	exchange
+26135	excitable
+26136	exciting
+26141	exclaim
+26142	exclude
+26143	excluding
+26144	exclusion
+26145	exclusive
+26146	excretion
+26151	excretory
+26152	excursion
+26153	excusable
+26154	excusably
+26155	excuse
+26156	exemplary
+26161	exemplify
+26162	exemption
+26163	exerciser
+26164	exert
+26165	exes
+26166	exfoliate
+26211	exhale
+26212	exhaust
+26213	exhume
+26214	exile
+26215	existing
+26216	exit
+26221	exodus
+26222	exonerate
+26223	exorcism
+26224	exorcist
+26225	expand
+26226	expanse
+26231	expansion
+26232	expansive
+26233	expectant
+26234	expedited
+26235	expediter
+26236	expel
+26241	expend
+26242	expenses
+26243	expensive
+26244	expert
+26245	expire
+26246	expiring
+26251	explain
+26252	expletive
+26253	explicit
+26254	explode
+26255	exploit
+26256	explore
+26261	exploring
+26262	exponent
+26263	exporter
+26264	exposable
+26265	expose
+26266	exposure
+26311	express
+26312	expulsion
+26313	exquisite
+26314	extended
+26315	extending
+26316	extent
+26321	extenuate
+26322	exterior
+26323	external
+26324	extinct
+26325	extortion
+26326	extradite
+26331	extras
+26332	extrovert
+26333	extrude
+26334	extruding
+26335	exuberant
+26336	fable
+26341	fabric
+26342	fabulous
+26343	facebook
+26344	facecloth
+26345	facedown
+26346	faceless
+26351	facelift
+26352	faceplate
+26353	faceted
+26354	facial
+26355	facility
+26356	facing
+26361	facsimile
+26362	faction
+26363	factoid
+26364	factor
+26365	factsheet
+26366	factual
+26411	faculty
+26412	fade
+26413	fading
+26414	failing
+26415	falcon
+26416	fall
+26421	false
+26422	falsify
+26423	fame
+26424	familiar
+26425	family
+26426	famine
+26431	famished
+26432	fanatic
+26433	fancied
+26434	fanciness
+26435	fancy
+26436	fanfare
+26441	fang
+26442	fanning
+26443	fantasize
+26444	fantastic
+26445	fantasy
+26446	fascism
+26451	fastball
+26452	faster
+26453	fasting
+26454	fastness
+26455	faucet
+26456	favorable
+26461	favorably
+26462	favored
+26463	favoring
+26464	favorite
+26465	fax
+26466	feast
+26511	federal
+26512	fedora
+26513	feeble
+26514	feed
+26515	feel
+26516	feisty
+26521	feline
+26522	felt-tip
+26523	feminine
+26524	feminism
+26525	feminist
+26526	feminize
+26531	femur
+26532	fence
+26533	fencing
+26534	fender
+26535	ferment
+26536	fernlike
+26541	ferocious
+26542	ferocity
+26543	ferret
+26544	ferris
+26545	ferry
+26546	fervor
+26551	fester
+26552	festival
+26553	festive
+26554	festivity
+26555	fetal
+26556	fetch
+26561	fever
+26562	fiber
+26563	fiction
+26564	fiddle
+26565	fiddling
+26566	fidelity
+26611	fidgeting
+26612	fidgety
+26613	fifteen
+26614	fifth
+26615	fiftieth
+26616	fifty
+26621	figment
+26622	figure
+26623	figurine
+26624	filing
+26625	filled
+26626	filler
+26631	filling
+26632	film
+26633	filter
+26634	filth
+26635	filtrate
+26636	finale
+26641	finalist
+26642	finalize
+26643	finally
+26644	finance
+26645	financial
+26646	finch
+26651	fineness
+26652	finer
+26653	finicky
+26654	finished
+26655	finisher
+26656	finishing
+26661	finite
+26662	finless
+26663	finlike
+26664	fiscally
+26665	fit
+26666	five
+31111	flaccid
+31112	flagman
+31113	flagpole
+31114	flagship
+31115	flagstick
+31116	flagstone
+31121	flail
+31122	flakily
+31123	flaky
+31124	flame
+31125	flammable
+31126	flanked
+31131	flanking
+31132	flannels
+31133	flap
+31134	flaring
+31135	flashback
+31136	flashbulb
+31141	flashcard
+31142	flashily
+31143	flashing
+31144	flashy
+31145	flask
+31146	flatbed
+31151	flatfoot
+31152	flatly
+31153	flatness
+31154	flatten
+31155	flattered
+31156	flatterer
+31161	flattery
+31162	flattop
+31163	flatware
+31164	flatworm
+31165	flavored
+31166	flavorful
+31211	flavoring
+31212	flaxseed
+31213	fled
+31214	fleshed
+31215	fleshy
+31216	flick
+31221	flier
+31222	flight
+31223	flinch
+31224	fling
+31225	flint
+31226	flip
+31231	flirt
+31232	float
+31233	flock
+31234	flogging
+31235	flop
+31236	floral
+31241	florist
+31242	floss
+31243	flounder
+31244	flyable
+31245	flyaway
+31246	flyer
+31251	flying
+31252	flyover
+31253	flypaper
+31254	foam
+31255	foe
+31256	fog
+31261	foil
+31262	folic
+31263	folk
+31264	follicle
+31265	follow
+31266	fondling
+31311	fondly
+31312	fondness
+31313	fondue
+31314	font
+31315	food
+31316	fool
+31321	footage
+31322	football
+31323	footbath
+31324	footboard
+31325	footer
+31326	footgear
+31331	foothill
+31332	foothold
+31333	footing
+31334	footless
+31335	footman
+31336	footnote
+31341	footpad
+31342	footpath
+31343	footprint
+31344	footrest
+31345	footsie
+31346	footsore
+31351	footwear
+31352	footwork
+31353	fossil
+31354	foster
+31355	founder
+31356	founding
+31361	fountain
+31362	fox
+31363	foyer
+31364	fraction
+31365	fracture
+31366	fragile
+31411	fragility
+31412	fragment
+31413	fragrance
+31414	fragrant
+31415	frail
+31416	frame
+31421	framing
+31422	frantic
+31423	fraternal
+31424	frayed
+31425	fraying
+31426	frays
+31431	freckled
+31432	freckles
+31433	freebase
+31434	freebee
+31435	freebie
+31436	freedom
+31441	freefall
+31442	freehand
+31443	freeing
+31444	freeload
+31445	freely
+31446	freemason
+31451	freeness
+31452	freestyle
+31453	freeware
+31454	freeway
+31455	freewill
+31456	freezable
+31461	freezing
+31462	freight
+31463	french
+31464	frenzied
+31465	frenzy
+31466	frequency
+31511	frequent
+31512	fresh
+31513	fretful
+31514	fretted
+31515	friction
+31516	friday
+31521	fridge
+31522	fried
+31523	friend
+31524	frighten
+31525	frightful
+31526	frigidity
+31531	frigidly
+31532	frill
+31533	fringe
+31534	frisbee
+31535	frisk
+31536	fritter
+31541	frivolous
+31542	frolic
+31543	from
+31544	front
+31545	frostbite
+31546	frosted
+31551	frostily
+31552	frosting
+31553	frostlike
+31554	frosty
+31555	froth
+31556	frown
+31561	frozen
+31562	fructose
+31563	frugality
+31564	frugally
+31565	fruit
+31566	frustrate
+31611	frying
+31612	gab
+31613	gaffe
+31614	gag
+31615	gainfully
+31616	gaining
+31621	gains
+31622	gala
+31623	gallantly
+31624	galleria
+31625	gallery
+31626	galley
+31631	gallon
+31632	gallows
+31633	gallstone
+31634	galore
+31635	galvanize
+31636	gambling
+31641	game
+31642	gaming
+31643	gamma
+31644	gander
+31645	gangly
+31646	gangrene
+31651	gangway
+31652	gap
+31653	garage
+31654	garbage
+31655	garden
+31656	gargle
+31661	garland
+31662	garlic
+31663	garment
+31664	garnet
+31665	garnish
+31666	garter
+32111	gas
+32112	gatherer
+32113	gathering
+32114	gating
+32115	gauging
+32116	gauntlet
+32121	gauze
+32122	gave
+32123	gawk
+32124	gazing
+32125	gear
+32126	gecko
+32131	geek
+32132	geiger
+32133	gem
+32134	gender
+32135	generic
+32136	generous
+32141	genetics
+32142	genre
+32143	gentile
+32144	gentleman
+32145	gently
+32146	gents
+32151	geography
+32152	geologic
+32153	geologist
+32154	geology
+32155	geometric
+32156	geometry
+32161	geranium
+32162	gerbil
+32163	geriatric
+32164	germicide
+32165	germinate
+32166	germless
+32211	germproof
+32212	gestate
+32213	gestation
+32214	gesture
+32215	getaway
+32216	getting
+32221	getup
+32222	giant
+32223	gibberish
+32224	giblet
+32225	giddily
+32226	giddiness
+32231	giddy
+32232	gift
+32233	gigabyte
+32234	gigahertz
+32235	gigantic
+32236	giggle
+32241	giggling
+32242	giggly
+32243	gigolo
+32244	gilled
+32245	gills
+32246	gimmick
+32251	girdle
+32252	giveaway
+32253	given
+32254	giver
+32255	giving
+32256	gizmo
+32261	gizzard
+32262	glacial
+32263	glacier
+32264	glade
+32265	gladiator
+32266	gladly
+32311	glamorous
+32312	glamour
+32313	glance
+32314	glancing
+32315	glandular
+32316	glare
+32321	glaring
+32322	glass
+32323	glaucoma
+32324	glazing
+32325	gleaming
+32326	gleeful
+32331	glider
+32332	gliding
+32333	glimmer
+32334	glimpse
+32335	glisten
+32336	glitch
+32341	glitter
+32342	glitzy
+32343	gloater
+32344	gloating
+32345	gloomily
+32346	gloomy
+32351	glorified
+32352	glorifier
+32353	glorify
+32354	glorious
+32355	glory
+32356	gloss
+32361	glove
+32362	glowing
+32363	glowworm
+32364	glucose
+32365	glue
+32366	gluten
+32411	glutinous
+32412	glutton
+32413	gnarly
+32414	gnat
+32415	goal
+32416	goatskin
+32421	goes
+32422	goggles
+32423	going
+32424	goldfish
+32425	goldmine
+32426	goldsmith
+32431	golf
+32432	goliath
+32433	gonad
+32434	gondola
+32435	gone
+32436	gong
+32441	good
+32442	gooey
+32443	goofball
+32444	goofiness
+32445	goofy
+32446	google
+32451	goon
+32452	gopher
+32453	gore
+32454	gorged
+32455	gorgeous
+32456	gory
+32461	gosling
+32462	gossip
+32463	gothic
+32464	gotten
+32465	gout
+32466	gown
+32511	grab
+32512	graceful
+32513	graceless
+32514	gracious
+32515	gradation
+32516	graded
+32521	grader
+32522	gradient
+32523	grading
+32524	gradually
+32525	graduate
+32526	graffiti
+32531	grafted
+32532	grafting
+32533	grain
+32534	granddad
+32535	grandkid
+32536	grandly
+32541	grandma
+32542	grandpa
+32543	grandson
+32544	granite
+32545	granny
+32546	granola
+32551	grant
+32552	granular
+32553	grape
+32554	graph
+32555	grapple
+32556	grappling
+32561	grasp
+32562	grass
+32563	gratified
+32564	gratify
+32565	grating
+32566	gratitude
+32611	gratuity
+32612	gravel
+32613	graveness
+32614	graves
+32615	graveyard
+32616	gravitate
+32621	gravity
+32622	gravy
+32623	gray
+32624	grazing
+32625	greasily
+32626	greedily
+32631	greedless
+32632	greedy
+32633	green
+32634	greeter
+32635	greeting
+32636	grew
+32641	greyhound
+32642	grid
+32643	grief
+32644	grievance
+32645	grieving
+32646	grievous
+32651	grill
+32652	grimace
+32653	grimacing
+32654	grime
+32655	griminess
+32656	grimy
+32661	grinch
+32662	grinning
+32663	grip
+32664	gristle
+32665	grit
+32666	groggily
+33111	groggy
+33112	groin
+33113	groom
+33114	groove
+33115	grooving
+33116	groovy
+33121	grope
+33122	ground
+33123	grouped
+33124	grout
+33125	grove
+33126	grower
+33131	growing
+33132	growl
+33133	grub
+33134	grudge
+33135	grudging
+33136	grueling
+33141	gruffly
+33142	grumble
+33143	grumbling
+33144	grumbly
+33145	grumpily
+33146	grunge
+33151	grunt
+33152	guacamole
+33153	guidable
+33154	guidance
+33155	guide
+33156	guiding
+33161	guileless
+33162	guise
+33163	gulf
+33164	gullible
+33165	gully
+33166	gulp
+33211	gumball
+33212	gumdrop
+33213	gumminess
+33214	gumming
+33215	gummy
+33216	gurgle
+33221	gurgling
+33222	guru
+33223	gush
+33224	gusto
+33225	gusty
+33226	gutless
+33231	guts
+33232	gutter
+33233	guy
+33234	guzzler
+33235	gyration
+33236	habitable
+33241	habitant
+33242	habitat
+33243	habitual
+33244	hacked
+33245	hacker
+33246	hacking
+33251	hacksaw
+33252	had
+33253	haggler
+33254	haiku
+33255	half
+33256	halogen
+33261	halt
+33262	halved
+33263	halves
+33264	hamburger
+33265	hamlet
+33266	hammock
+33311	hamper
+33312	hamster
+33313	hamstring
+33314	handbag
+33315	handball
+33316	handbook
+33321	handbrake
+33322	handcart
+33323	handclap
+33324	handclasp
+33325	handcraft
+33326	handcuff
+33331	handed
+33332	handful
+33333	handgrip
+33334	handgun
+33335	handheld
+33336	handiness
+33341	handiwork
+33342	handlebar
+33343	handled
+33344	handler
+33345	handling
+33346	handmade
+33351	handoff
+33352	handpick
+33353	handprint
+33354	handrail
+33355	handsaw
+33356	handset
+33361	handsfree
+33362	handshake
+33363	handstand
+33364	handwash
+33365	handwork
+33366	handwoven
+33411	handwrite
+33412	handyman
+33413	hangnail
+33414	hangout
+33415	hangover
+33416	hangup
+33421	hankering
+33422	hankie
+33423	hanky
+33424	haphazard
+33425	happening
+33426	happier
+33431	happiest
+33432	happily
+33433	happiness
+33434	happy
+33435	harbor
+33436	hardcopy
+33441	hardcore
+33442	hardcover
+33443	harddisk
+33444	hardened
+33445	hardener
+33446	hardening
+33451	hardhat
+33452	hardhead
+33453	hardiness
+33454	hardly
+33455	hardness
+33456	hardship
+33461	hardware
+33462	hardwired
+33463	hardwood
+33464	hardy
+33465	harmful
+33466	harmless
+33511	harmonica
+33512	harmonics
+33513	harmonize
+33514	harmony
+33515	harness
+33516	harpist
+33521	harsh
+33522	harvest
+33523	hash
+33524	hassle
+33525	haste
+33526	hastily
+33531	hastiness
+33532	hasty
+33533	hatbox
+33534	hatchback
+33535	hatchery
+33536	hatchet
+33541	hatching
+33542	hatchling
+33543	hate
+33544	hatless
+33545	hatred
+33546	haunt
+33551	haven
+33552	hazard
+33553	hazelnut
+33554	hazily
+33555	haziness
+33556	hazing
+33561	hazy
+33562	headache
+33563	headband
+33564	headboard
+33565	headcount
+33566	headdress
+33611	headed
+33612	header
+33613	headfirst
+33614	headgear
+33615	heading
+33616	headlamp
+33621	headless
+33622	headlock
+33623	headphone
+33624	headpiece
+33625	headrest
+33626	headroom
+33631	headscarf
+33632	headset
+33633	headsman
+33634	headstand
+33635	headstone
+33636	headway
+33641	headwear
+33642	heap
+33643	heat
+33644	heave
+33645	heavily
+33646	heaviness
+33651	heaving
+33652	hedge
+33653	hedging
+33654	heftiness
+33655	hefty
+33656	helium
+33661	helmet
+33662	helper
+33663	helpful
+33664	helping
+33665	helpless
+33666	helpline
+34111	hemlock
+34112	hemstitch
+34113	hence
+34114	henchman
+34115	henna
+34116	herald
+34121	herbal
+34122	herbicide
+34123	herbs
+34124	heritage
+34125	hermit
+34126	heroics
+34131	heroism
+34132	herring
+34133	herself
+34134	hertz
+34135	hesitancy
+34136	hesitant
+34141	hesitate
+34142	hexagon
+34143	hexagram
+34144	hubcap
+34145	huddle
+34146	huddling
+34151	huff
+34152	hug
+34153	hula
+34154	hulk
+34155	hull
+34156	human
+34161	humble
+34162	humbling
+34163	humbly
+34164	humid
+34165	humiliate
+34166	humility
+34211	humming
+34212	hummus
+34213	humongous
+34214	humorist
+34215	humorless
+34216	humorous
+34221	humpback
+34222	humped
+34223	humvee
+34224	hunchback
+34225	hundredth
+34226	hunger
+34231	hungrily
+34232	hungry
+34233	hunk
+34234	hunter
+34235	hunting
+34236	huntress
+34241	huntsman
+34242	hurdle
+34243	hurled
+34244	hurler
+34245	hurling
+34246	hurray
+34251	hurricane
+34252	hurried
+34253	hurry
+34254	hurt
+34255	husband
+34256	hush
+34261	husked
+34262	huskiness
+34263	hut
+34264	hybrid
+34265	hydrant
+34266	hydrated
+34311	hydration
+34312	hydrogen
+34313	hydroxide
+34314	hyperlink
+34315	hypertext
+34316	hyphen
+34321	hypnoses
+34322	hypnosis
+34323	hypnotic
+34324	hypnotism
+34325	hypnotist
+34326	hypnotize
+34331	hypocrisy
+34332	hypocrite
+34333	ibuprofen
+34334	ice
+34335	iciness
+34336	icing
+34341	icky
+34342	icon
+34343	icy
+34344	idealism
+34345	idealist
+34346	idealize
+34351	ideally
+34352	idealness
+34353	identical
+34354	identify
+34355	identity
+34356	ideology
+34361	idiocy
+34362	idiom
+34363	idly
+34364	igloo
+34365	ignition
+34366	ignore
+34411	iguana
+34412	illicitly
+34413	illusion
+34414	illusive
+34415	image
+34416	imaginary
+34421	imagines
+34422	imaging
+34423	imbecile
+34424	imitate
+34425	imitation
+34426	immature
+34431	immerse
+34432	immersion
+34433	imminent
+34434	immobile
+34435	immodest
+34436	immorally
+34441	immortal
+34442	immovable
+34443	immovably
+34444	immunity
+34445	immunize
+34446	impaired
+34451	impale
+34452	impart
+34453	impatient
+34454	impeach
+34455	impeding
+34456	impending
+34461	imperfect
+34462	imperial
+34463	impish
+34464	implant
+34465	implement
+34466	implicate
+34511	implicit
+34512	implode
+34513	implosion
+34514	implosive
+34515	imply
+34516	impolite
+34521	important
+34522	importer
+34523	impose
+34524	imposing
+34525	impotence
+34526	impotency
+34531	impotent
+34532	impound
+34533	imprecise
+34534	imprint
+34535	imprison
+34536	impromptu
+34541	improper
+34542	improve
+34543	improving
+34544	improvise
+34545	imprudent
+34546	impulse
+34551	impulsive
+34552	impure
+34553	impurity
+34554	iodine
+34555	iodize
+34556	ion
+34561	ipad
+34562	iphone
+34563	ipod
+34564	irate
+34565	irk
+34566	iron
+34611	irregular
+34612	irrigate
+34613	irritable
+34614	irritably
+34615	irritant
+34616	irritate
+34621	islamic
+34622	islamist
+34623	isolated
+34624	isolating
+34625	isolation
+34626	isotope
+34631	issue
+34632	issuing
+34633	italicize
+34634	italics
+34635	item
+34636	itinerary
+34641	itunes
+34642	ivory
+34643	ivy
+34644	jab
+34645	jackal
+34646	jacket
+34651	jackknife
+34652	jackpot
+34653	jailbird
+34654	jailbreak
+34655	jailer
+34656	jailhouse
+34661	jalapeno
+34662	jam
+34663	janitor
+34664	january
+34665	jargon
+34666	jarring
+35111	jasmine
+35112	jaundice
+35113	jaunt
+35114	java
+35115	jawed
+35116	jawless
+35121	jawline
+35122	jaws
+35123	jaybird
+35124	jaywalker
+35125	jazz
+35126	jeep
+35131	jeeringly
+35132	jellied
+35133	jelly
+35134	jersey
+35135	jester
+35136	jet
+35141	jiffy
+35142	jigsaw
+35143	jimmy
+35144	jingle
+35145	jingling
+35146	jinx
+35151	jitters
+35152	jittery
+35153	job
+35154	jockey
+35155	jockstrap
+35156	jogger
+35161	jogging
+35162	john
+35163	joining
+35164	jokester
+35165	jokingly
+35166	jolliness
+35211	jolly
+35212	jolt
+35213	jot
+35214	jovial
+35215	joyfully
+35216	joylessly
+35221	joyous
+35222	joyride
+35223	joystick
+35224	jubilance
+35225	jubilant
+35226	judge
+35231	judgingly
+35232	judicial
+35233	judiciary
+35234	judo
+35235	juggle
+35236	juggling
+35241	jugular
+35242	juice
+35243	juiciness
+35244	juicy
+35245	jujitsu
+35246	jukebox
+35251	july
+35252	jumble
+35253	jumbo
+35254	jump
+35255	junction
+35256	juncture
+35261	june
+35262	junior
+35263	juniper
+35264	junkie
+35265	junkman
+35266	junkyard
+35311	jurist
+35312	juror
+35313	jury
+35314	justice
+35315	justifier
+35316	justify
+35321	justly
+35322	justness
+35323	juvenile
+35324	kabob
+35325	kangaroo
+35326	karaoke
+35331	karate
+35332	karma
+35333	kebab
+35334	keenly
+35335	keenness
+35336	keep
+35341	keg
+35342	kelp
+35343	kennel
+35344	kept
+35345	kerchief
+35346	kerosene
+35351	kettle
+35352	kick
+35353	kiln
+35354	kilobyte
+35355	kilogram
+35356	kilometer
+35361	kilowatt
+35362	kilt
+35363	kimono
+35364	kindle
+35365	kindling
+35366	kindly
+35411	kindness
+35412	kindred
+35413	kinetic
+35414	kinfolk
+35415	king
+35416	kinship
+35421	kinsman
+35422	kinswoman
+35423	kissable
+35424	kisser
+35425	kissing
+35426	kitchen
+35431	kite
+35432	kitten
+35433	kitty
+35434	kiwi
+35435	kleenex
+35436	knapsack
+35441	knee
+35442	knelt
+35443	knickers
+35444	knoll
+35445	koala
+35446	kooky
+35451	kosher
+35452	krypton
+35453	kudos
+35454	kung
+35455	labored
+35456	laborer
+35461	laboring
+35462	laborious
+35463	labrador
+35464	ladder
+35465	ladies
+35466	ladle
+35511	ladybug
+35512	ladylike
+35513	lagged
+35514	lagging
+35515	lagoon
+35516	lair
+35521	lake
+35522	lance
+35523	landed
+35524	landfall
+35525	landfill
+35526	landing
+35531	landlady
+35532	landless
+35533	landline
+35534	landlord
+35535	landmark
+35536	landmass
+35541	landmine
+35542	landowner
+35543	landscape
+35544	landside
+35545	landslide
+35546	language
+35551	lankiness
+35552	lanky
+35553	lantern
+35554	lapdog
+35555	lapel
+35556	lapped
+35561	lapping
+35562	laptop
+35563	lard
+35564	large
+35565	lark
+35566	lash
+35611	lasso
+35612	last
+35613	latch
+35614	late
+35615	lather
+35616	latitude
+35621	latrine
+35622	latter
+35623	latticed
+35624	launch
+35625	launder
+35626	laundry
+35631	laurel
+35632	lavender
+35633	lavish
+35634	laxative
+35635	lazily
+35636	laziness
+35641	lazy
+35642	lecturer
+35643	left
+35644	legacy
+35645	legal
+35646	legend
+35651	legged
+35652	leggings
+35653	legible
+35654	legibly
+35655	legislate
+35656	lego
+35661	legroom
+35662	legume
+35663	legwarmer
+35664	legwork
+35665	lemon
+35666	lend
+36111	length
+36112	lens
+36113	lent
+36114	leotard
+36115	lesser
+36116	letdown
+36121	lethargic
+36122	lethargy
+36123	letter
+36124	lettuce
+36125	level
+36126	leverage
+36131	levers
+36132	levitate
+36133	levitator
+36134	liability
+36135	liable
+36136	liberty
+36141	librarian
+36142	library
+36143	licking
+36144	licorice
+36145	lid
+36146	life
+36151	lifter
+36152	lifting
+36153	liftoff
+36154	ligament
+36155	likely
+36156	likeness
+36161	likewise
+36162	liking
+36163	lilac
+36164	lilly
+36165	lily
+36166	limb
+36211	limeade
+36212	limelight
+36213	limes
+36214	limit
+36215	limping
+36216	limpness
+36221	line
+36222	lingo
+36223	linguini
+36224	linguist
+36225	lining
+36226	linked
+36231	linoleum
+36232	linseed
+36233	lint
+36234	lion
+36235	lip
+36236	liquefy
+36241	liqueur
+36242	liquid
+36243	lisp
+36244	list
+36245	litigate
+36246	litigator
+36251	litmus
+36252	litter
+36253	little
+36254	livable
+36255	lived
+36256	lively
+36261	liver
+36262	livestock
+36263	lividly
+36264	living
+36265	lizard
+36266	lubricant
+36311	lubricate
+36312	lucid
+36313	luckily
+36314	luckiness
+36315	luckless
+36316	lucrative
+36321	ludicrous
+36322	lugged
+36323	lukewarm
+36324	lullaby
+36325	lumber
+36326	luminance
+36331	luminous
+36332	lumpiness
+36333	lumping
+36334	lumpish
+36335	lunacy
+36336	lunar
+36341	lunchbox
+36342	luncheon
+36343	lunchroom
+36344	lunchtime
+36345	lung
+36346	lurch
+36351	lure
+36352	luridness
+36353	lurk
+36354	lushly
+36355	lushness
+36356	luster
+36361	lustfully
+36362	lustily
+36363	lustiness
+36364	lustrous
+36365	lusty
+36366	luxurious
+36411	luxury
+36412	lying
+36413	lyrically
+36414	lyricism
+36415	lyricist
+36416	lyrics
+36421	macarena
+36422	macaroni
+36423	macaw
+36424	mace
+36425	machine
+36426	machinist
+36431	magazine
+36432	magenta
+36433	maggot
+36434	magical
+36435	magician
+36436	magma
+36441	magnesium
+36442	magnetic
+36443	magnetism
+36444	magnetize
+36445	magnifier
+36446	magnify
+36451	magnitude
+36452	magnolia
+36453	mahogany
+36454	maimed
+36455	majestic
+36456	majesty
+36461	majorette
+36462	majority
+36463	makeover
+36464	maker
+36465	makeshift
+36466	making
+36511	malformed
+36512	malt
+36513	mama
+36514	mammal
+36515	mammary
+36516	mammogram
+36521	manager
+36522	managing
+36523	manatee
+36524	mandarin
+36525	mandate
+36526	mandatory
+36531	mandolin
+36532	manger
+36533	mangle
+36534	mango
+36535	mangy
+36536	manhandle
+36541	manhole
+36542	manhood
+36543	manhunt
+36544	manicotti
+36545	manicure
+36546	manifesto
+36551	manila
+36552	mankind
+36553	manlike
+36554	manliness
+36555	manly
+36556	manmade
+36561	manned
+36562	mannish
+36563	manor
+36564	manpower
+36565	mantis
+36566	mantra
+36611	manual
+36612	many
+36613	map
+36614	marathon
+36615	marauding
+36616	marbled
+36621	marbles
+36622	marbling
+36623	march
+36624	mardi
+36625	margarine
+36626	margarita
+36631	margin
+36632	marigold
+36633	marina
+36634	marine
+36635	marital
+36636	maritime
+36641	marlin
+36642	marmalade
+36643	maroon
+36644	married
+36645	marrow
+36646	marry
+36651	marshland
+36652	marshy
+36653	marsupial
+36654	marvelous
+36655	marxism
+36656	mascot
+36661	masculine
+36662	mashed
+36663	mashing
+36664	massager
+36665	masses
+36666	massive
+41111	mastiff
+41112	matador
+41113	matchbook
+41114	matchbox
+41115	matcher
+41116	matching
+41121	matchless
+41122	material
+41123	maternal
+41124	maternity
+41125	math
+41126	mating
+41131	matriarch
+41132	matrimony
+41133	matrix
+41134	matron
+41135	matted
+41136	matter
+41141	maturely
+41142	maturing
+41143	maturity
+41144	mauve
+41145	maverick
+41146	maximize
+41151	maximum
+41152	maybe
+41153	mayday
+41154	mayflower
+41155	moaner
+41156	moaning
+41161	mobile
+41162	mobility
+41163	mobilize
+41164	mobster
+41165	mocha
+41166	mocker
+41211	mockup
+41212	modified
+41213	modify
+41214	modular
+41215	modulator
+41216	module
+41221	moisten
+41222	moistness
+41223	moisture
+41224	molar
+41225	molasses
+41226	mold
+41231	molecular
+41232	molecule
+41233	molehill
+41234	mollusk
+41235	mom
+41236	monastery
+41241	monday
+41242	monetary
+41243	monetize
+41244	moneybags
+41245	moneyless
+41246	moneywise
+41251	mongoose
+41252	mongrel
+41253	monitor
+41254	monkhood
+41255	monogamy
+41256	monogram
+41261	monologue
+41262	monopoly
+41263	monorail
+41264	monotone
+41265	monotype
+41266	monoxide
+41311	monsieur
+41312	monsoon
+41313	monstrous
+41314	monthly
+41315	monument
+41316	moocher
+41321	moodiness
+41322	moody
+41323	mooing
+41324	moonbeam
+41325	mooned
+41326	moonlight
+41331	moonlike
+41332	moonlit
+41333	moonrise
+41334	moonscape
+41335	moonshine
+41336	moonstone
+41341	moonwalk
+41342	mop
+41343	morale
+41344	morality
+41345	morally
+41346	morbidity
+41351	morbidly
+41352	morphine
+41353	morphing
+41354	morse
+41355	mortality
+41356	mortally
+41361	mortician
+41362	mortified
+41363	mortify
+41364	mortuary
+41365	mosaic
+41366	mossy
+41411	most
+41412	mothball
+41413	mothproof
+41414	motion
+41415	motivate
+41416	motivator
+41421	motive
+41422	motocross
+41423	motor
+41424	motto
+41425	mountable
+41426	mountain
+41431	mounted
+41432	mounting
+41433	mourner
+41434	mournful
+41435	mouse
+41436	mousiness
+41441	moustache
+41442	mousy
+41443	mouth
+41444	movable
+41445	move
+41446	movie
+41451	moving
+41452	mower
+41453	mowing
+41454	much
+41455	muck
+41456	mud
+41461	mug
+41462	mulberry
+41463	mulch
+41464	mule
+41465	mulled
+41466	mullets
+41511	multiple
+41512	multiply
+41513	multitask
+41514	multitude
+41515	mumble
+41516	mumbling
+41521	mumbo
+41522	mummified
+41523	mummify
+41524	mummy
+41525	mumps
+41526	munchkin
+41531	mundane
+41532	municipal
+41533	muppet
+41534	mural
+41535	murkiness
+41536	murky
+41541	murmuring
+41542	muscular
+41543	museum
+41544	mushily
+41545	mushiness
+41546	mushroom
+41551	mushy
+41552	music
+41553	musket
+41554	muskiness
+41555	musky
+41556	mustang
+41561	mustard
+41562	muster
+41563	mustiness
+41564	musty
+41565	mutable
+41566	mutate
+41611	mutation
+41612	mute
+41613	mutilated
+41614	mutilator
+41615	mutiny
+41616	mutt
+41621	mutual
+41622	muzzle
+41623	myself
+41624	myspace
+41625	mystified
+41626	mystify
+41631	myth
+41632	nacho
+41633	nag
+41634	nail
+41635	name
+41636	naming
+41641	nanny
+41642	nanometer
+41643	nape
+41644	napkin
+41645	napped
+41646	napping
+41651	nappy
+41652	narrow
+41653	nastily
+41654	nastiness
+41655	national
+41656	native
+41661	nativity
+41662	natural
+41663	nature
+41664	naturist
+41665	nautical
+41666	navigate
+42111	navigator
+42112	navy
+42113	nearby
+42114	nearest
+42115	nearly
+42116	nearness
+42121	neatly
+42122	neatness
+42123	nebula
+42124	nebulizer
+42125	nectar
+42126	negate
+42131	negation
+42132	negative
+42133	neglector
+42134	negligee
+42135	negligent
+42136	negotiate
+42141	nemeses
+42142	nemesis
+42143	neon
+42144	nephew
+42145	nerd
+42146	nervous
+42151	nervy
+42152	nest
+42153	net
+42154	neurology
+42155	neuron
+42156	neurosis
+42161	neurotic
+42162	neuter
+42163	neutron
+42164	never
+42165	next
+42166	nibble
+42211	nickname
+42212	nicotine
+42213	niece
+42214	nifty
+42215	nimble
+42216	nimbly
+42221	nineteen
+42222	ninetieth
+42223	ninja
+42224	nintendo
+42225	ninth
+42226	nuclear
+42231	nuclei
+42232	nucleus
+42233	nugget
+42234	nullify
+42235	number
+42236	numbing
+42241	numbly
+42242	numbness
+42243	numeral
+42244	numerate
+42245	numerator
+42246	numeric
+42251	numerous
+42252	nuptials
+42253	nursery
+42254	nursing
+42255	nurture
+42256	nutcase
+42261	nutlike
+42262	nutmeg
+42263	nutrient
+42264	nutshell
+42265	nuttiness
+42266	nutty
+42311	nuzzle
+42312	nylon
+42313	oaf
+42314	oak
+42315	oasis
+42316	oat
+42321	obedience
+42322	obedient
+42323	obituary
+42324	object
+42325	obligate
+42326	obliged
+42331	oblivion
+42332	oblivious
+42333	oblong
+42334	obnoxious
+42335	oboe
+42336	obscure
+42341	obscurity
+42342	observant
+42343	observer
+42344	observing
+42345	obsessed
+42346	obsession
+42351	obsessive
+42352	obsolete
+42353	obstacle
+42354	obstinate
+42355	obstruct
+42356	obtain
+42361	obtrusive
+42362	obtuse
+42363	obvious
+42364	occultist
+42365	occupancy
+42366	occupant
+42411	occupier
+42412	occupy
+42413	ocean
+42414	ocelot
+42415	octagon
+42416	octane
+42421	october
+42422	octopus
+42423	ogle
+42424	oil
+42425	oink
+42426	ointment
+42431	okay
+42432	old
+42433	olive
+42434	olympics
+42435	omega
+42436	omen
+42441	ominous
+42442	omission
+42443	omit
+42444	omnivore
+42445	onboard
+42446	oncoming
+42451	ongoing
+42452	onion
+42453	online
+42454	onlooker
+42455	only
+42456	onscreen
+42461	onset
+42462	onshore
+42463	onslaught
+42464	onstage
+42465	onto
+42466	onward
+42511	onyx
+42512	oops
+42513	ooze
+42514	oozy
+42515	opacity
+42516	opal
+42521	open
+42522	operable
+42523	operate
+42524	operating
+42525	operation
+42526	operative
+42531	operator
+42532	opium
+42533	opossum
+42534	opponent
+42535	oppose
+42536	opposing
+42541	opposite
+42542	oppressed
+42543	oppressor
+42544	opt
+42545	opulently
+42546	osmosis
+42551	other
+42552	otter
+42553	ouch
+42554	ought
+42555	ounce
+42556	outage
+42561	outback
+42562	outbid
+42563	outboard
+42564	outbound
+42565	outbreak
+42566	outburst
+42611	outcast
+42612	outclass
+42613	outcome
+42614	outdated
+42615	outdoors
+42616	outer
+42621	outfield
+42622	outfit
+42623	outflank
+42624	outgoing
+42625	outgrow
+42626	outhouse
+42631	outing
+42632	outlast
+42633	outlet
+42634	outline
+42635	outlook
+42636	outlying
+42641	outmatch
+42642	outmost
+42643	outnumber
+42644	outplayed
+42645	outpost
+42646	outpour
+42651	output
+42652	outrage
+42653	outrank
+42654	outreach
+42655	outright
+42656	outscore
+42661	outsell
+42662	outshine
+42663	outshoot
+42664	outsider
+42665	outskirts
+42666	outsmart
+43111	outsource
+43112	outspoken
+43113	outtakes
+43114	outthink
+43115	outward
+43116	outweigh
+43121	outwit
+43122	oval
+43123	ovary
+43124	oven
+43125	overact
+43126	overall
+43131	overarch
+43132	overbid
+43133	overbill
+43134	overbite
+43135	overblown
+43136	overboard
+43141	overbook
+43142	overbuilt
+43143	overcast
+43144	overcoat
+43145	overcome
+43146	overcook
+43151	overcrowd
+43152	overdraft
+43153	overdrawn
+43154	overdress
+43155	overdrive
+43156	overdue
+43161	overeager
+43162	overeater
+43163	overexert
+43164	overfed
+43165	overfeed
+43166	overfill
+43211	overflow
+43212	overfull
+43213	overgrown
+43214	overhand
+43215	overhang
+43216	overhaul
+43221	overhead
+43222	overhear
+43223	overheat
+43224	overhung
+43225	overjoyed
+43226	overkill
+43231	overlabor
+43232	overlaid
+43233	overlap
+43234	overlay
+43235	overload
+43236	overlook
+43241	overlord
+43242	overlying
+43243	overnight
+43244	overpass
+43245	overpay
+43246	overplant
+43251	overplay
+43252	overpower
+43253	overprice
+43254	overrate
+43255	overreach
+43256	overreact
+43261	override
+43262	overripe
+43263	overrule
+43264	overrun
+43265	overshoot
+43266	overshot
+43311	oversight
+43312	oversized
+43313	oversleep
+43314	oversold
+43315	overspend
+43316	overstate
+43321	overstay
+43322	overstep
+43323	overstock
+43324	overstuff
+43325	oversweet
+43326	overtake
+43331	overthrow
+43332	overtime
+43333	overtly
+43334	overtone
+43335	overture
+43336	overturn
+43341	overuse
+43342	overvalue
+43343	overview
+43344	overwrite
+43345	owl
+43346	oxford
+43351	oxidant
+43352	oxidation
+43353	oxidize
+43354	oxidizing
+43355	oxygen
+43356	oxymoron
+43361	oyster
+43362	ozone
+43363	paced
+43364	pacemaker
+43365	pacific
+43366	pacifier
+43411	pacifism
+43412	pacifist
+43413	pacify
+43414	padded
+43415	padding
+43416	paddle
+43421	paddling
+43422	padlock
+43423	pagan
+43424	pager
+43425	paging
+43426	pajamas
+43431	palace
+43432	palatable
+43433	palm
+43434	palpable
+43435	palpitate
+43436	paltry
+43441	pampered
+43442	pamperer
+43443	pampers
+43444	pamphlet
+43445	panama
+43446	pancake
+43451	pancreas
+43452	panda
+43453	pandemic
+43454	pang
+43455	panhandle
+43456	panic
+43461	panning
+43462	panorama
+43463	panoramic
+43464	panther
+43465	pantomime
+43466	pantry
+43511	pants
+43512	pantyhose
+43513	paparazzi
+43514	papaya
+43515	paper
+43516	paprika
+43521	papyrus
+43522	parabola
+43523	parachute
+43524	parade
+43525	paradox
+43526	paragraph
+43531	parakeet
+43532	paralegal
+43533	paralyses
+43534	paralysis
+43535	paralyze
+43536	paramedic
+43541	parameter
+43542	paramount
+43543	parasail
+43544	parasite
+43545	parasitic
+43546	parcel
+43551	parched
+43552	parchment
+43553	pardon
+43554	parish
+43555	parka
+43556	parking
+43561	parkway
+43562	parlor
+43563	parmesan
+43564	parole
+43565	parrot
+43566	parsley
+43611	parsnip
+43612	partake
+43613	parted
+43614	parting
+43615	partition
+43616	partly
+43621	partner
+43622	partridge
+43623	party
+43624	passable
+43625	passably
+43626	passage
+43631	passcode
+43632	passenger
+43633	passerby
+43634	passing
+43635	passion
+43636	passive
+43641	passivism
+43642	passover
+43643	passport
+43644	password
+43645	pasta
+43646	pasted
+43651	pastel
+43652	pastime
+43653	pastor
+43654	pastrami
+43655	pasture
+43656	pasty
+43661	patchwork
+43662	patchy
+43663	paternal
+43664	paternity
+43665	path
+43666	patience
+44111	patient
+44112	patio
+44113	patriarch
+44114	patriot
+44115	patrol
+44116	patronage
+44121	patronize
+44122	pauper
+44123	pavement
+44124	paver
+44125	pavestone
+44126	pavilion
+44131	paving
+44132	pawing
+44133	payable
+44134	payback
+44135	paycheck
+44136	payday
+44141	payee
+44142	payer
+44143	paying
+44144	payment
+44145	payphone
+44146	payroll
+44151	pebble
+44152	pebbly
+44153	pecan
+44154	pectin
+44155	peculiar
+44156	peddling
+44161	pediatric
+44162	pedicure
+44163	pedigree
+44164	pedometer
+44165	pegboard
+44166	pelican
+44211	pellet
+44212	pelt
+44213	pelvis
+44214	penalize
+44215	penalty
+44216	pencil
+44221	pendant
+44222	pending
+44223	penholder
+44224	penknife
+44225	pennant
+44226	penniless
+44231	penny
+44232	penpal
+44233	pension
+44234	pentagon
+44235	pentagram
+44236	pep
+44241	perceive
+44242	percent
+44243	perch
+44244	percolate
+44245	perennial
+44246	perfected
+44251	perfectly
+44252	perfume
+44253	periscope
+44254	perish
+44255	perjurer
+44256	perjury
+44261	perkiness
+44262	perky
+44263	perm
+44264	peroxide
+44265	perpetual
+44266	perplexed
+44311	persecute
+44312	persevere
+44313	persuaded
+44314	persuader
+44315	pesky
+44316	peso
+44321	pessimism
+44322	pessimist
+44323	pester
+44324	pesticide
+44325	petal
+44326	petite
+44331	petition
+44332	petri
+44333	petroleum
+44334	petted
+44335	petticoat
+44336	pettiness
+44341	petty
+44342	petunia
+44343	phantom
+44344	phobia
+44345	phoenix
+44346	phonebook
+44351	phoney
+44352	phonics
+44353	phoniness
+44354	phony
+44355	phosphate
+44356	photo
+44361	phrase
+44362	phrasing
+44363	placard
+44364	placate
+44365	placidly
+44366	plank
+44411	planner
+44412	plant
+44413	plasma
+44414	plaster
+44415	plastic
+44416	plated
+44421	platform
+44422	plating
+44423	platinum
+44424	platonic
+44425	platter
+44426	platypus
+44431	plausible
+44432	plausibly
+44433	playable
+44434	playback
+44435	player
+44436	playful
+44441	playgroup
+44442	playhouse
+44443	playing
+44444	playlist
+44445	playmaker
+44446	playmate
+44451	playoff
+44452	playpen
+44453	playroom
+44454	playset
+44455	plaything
+44456	playtime
+44461	plaza
+44462	pleading
+44463	pleat
+44464	pledge
+44465	plentiful
+44466	plenty
+44511	plethora
+44512	plexiglas
+44513	pliable
+44514	plod
+44515	plop
+44516	plot
+44521	plow
+44522	ploy
+44523	pluck
+44524	plug
+44525	plunder
+44526	plunging
+44531	plural
+44532	plus
+44533	plutonium
+44534	plywood
+44535	poach
+44536	pod
+44541	poem
+44542	poet
+44543	pogo
+44544	pointed
+44545	pointer
+44546	pointing
+44551	pointless
+44552	pointy
+44553	poise
+44554	poison
+44555	poker
+44556	poking
+44561	polar
+44562	police
+44563	policy
+44564	polio
+44565	polish
+44566	politely
+44611	polka
+44612	polo
+44613	polyester
+44614	polygon
+44615	polygraph
+44616	polymer
+44621	poncho
+44622	pond
+44623	pony
+44624	popcorn
+44625	pope
+44626	poplar
+44631	popper
+44632	poppy
+44633	popsicle
+44634	populace
+44635	popular
+44636	populate
+44641	porcupine
+44642	pork
+44643	porous
+44644	porridge
+44645	portable
+44646	portal
+44651	portfolio
+44652	porthole
+44653	portion
+44654	portly
+44655	portside
+44656	poser
+44661	posh
+44662	posing
+44663	possible
+44664	possibly
+44665	possum
+44666	postage
+45111	postal
+45112	postbox
+45113	postcard
+45114	posted
+45115	poster
+45116	posting
+45121	postnasal
+45122	posture
+45123	postwar
+45124	pouch
+45125	pounce
+45126	pouncing
+45131	pound
+45132	pouring
+45133	pout
+45134	powdered
+45135	powdering
+45136	powdery
+45141	power
+45142	powwow
+45143	pox
+45144	praising
+45145	prance
+45146	prancing
+45151	pranker
+45152	prankish
+45153	prankster
+45154	prayer
+45155	praying
+45156	preacher
+45161	preaching
+45162	preachy
+45163	preamble
+45164	precinct
+45165	precise
+45166	precision
+45211	precook
+45212	precut
+45213	predator
+45214	predefine
+45215	predict
+45216	preface
+45221	prefix
+45222	preflight
+45223	preformed
+45224	pregame
+45225	pregnancy
+45226	pregnant
+45231	preheated
+45232	prelaunch
+45233	prelaw
+45234	prelude
+45235	premiere
+45236	premises
+45241	premium
+45242	prenatal
+45243	preoccupy
+45244	preorder
+45245	prepaid
+45246	prepay
+45251	preplan
+45252	preppy
+45253	preschool
+45254	prescribe
+45255	preseason
+45256	preset
+45261	preshow
+45262	president
+45263	presoak
+45264	press
+45265	presume
+45266	presuming
+45311	preteen
+45312	pretended
+45313	pretender
+45314	pretense
+45315	pretext
+45316	pretty
+45321	pretzel
+45322	prevail
+45323	prevalent
+45324	prevent
+45325	preview
+45326	previous
+45331	prewar
+45332	prewashed
+45333	prideful
+45334	pried
+45335	primal
+45336	primarily
+45341	primary
+45342	primate
+45343	primer
+45344	primp
+45345	princess
+45346	print
+45351	prior
+45352	prism
+45353	prison
+45354	prissy
+45355	pristine
+45356	privacy
+45361	private
+45362	privatize
+45363	prize
+45364	proactive
+45365	probable
+45366	probably
+45411	probation
+45412	probe
+45413	probing
+45414	probiotic
+45415	problem
+45416	procedure
+45421	process
+45422	proclaim
+45423	procreate
+45424	procurer
+45425	prodigal
+45426	prodigy
+45431	produce
+45432	product
+45433	profane
+45434	profanity
+45435	professed
+45436	professor
+45441	profile
+45442	profound
+45443	profusely
+45444	progeny
+45445	prognosis
+45446	program
+45451	progress
+45452	projector
+45453	prologue
+45454	prolonged
+45455	promenade
+45456	prominent
+45461	promoter
+45462	promotion
+45463	prompter
+45464	promptly
+45465	prone
+45466	prong
+45511	pronounce
+45512	pronto
+45513	proofing
+45514	proofread
+45515	proofs
+45516	propeller
+45521	properly
+45522	property
+45523	proponent
+45524	proposal
+45525	propose
+45526	props
+45531	prorate
+45532	protector
+45533	protegee
+45534	proton
+45535	prototype
+45536	protozoan
+45541	protract
+45542	protrude
+45543	proud
+45544	provable
+45545	proved
+45546	proven
+45551	provided
+45552	provider
+45553	providing
+45554	province
+45555	proving
+45556	provoke
+45561	provoking
+45562	provolone
+45563	prowess
+45564	prowler
+45565	prowling
+45566	proximity
+45611	proxy
+45612	prozac
+45613	prude
+45614	prudishly
+45615	prune
+45616	pruning
+45621	pry
+45622	psychic
+45623	public
+45624	publisher
+45625	pucker
+45626	pueblo
+45631	pug
+45632	pull
+45633	pulmonary
+45634	pulp
+45635	pulsate
+45636	pulse
+45641	pulverize
+45642	puma
+45643	pumice
+45644	pummel
+45645	punch
+45646	punctual
+45651	punctuate
+45652	punctured
+45653	pungent
+45654	punisher
+45655	punk
+45656	pupil
+45661	puppet
+45662	puppy
+45663	purchase
+45664	pureblood
+45665	purebred
+45666	purely
+46111	pureness
+46112	purgatory
+46113	purge
+46114	purging
+46115	purifier
+46116	purify
+46121	purist
+46122	puritan
+46123	purity
+46124	purple
+46125	purplish
+46126	purposely
+46131	purr
+46132	purse
+46133	pursuable
+46134	pursuant
+46135	pursuit
+46136	purveyor
+46141	pushcart
+46142	pushchair
+46143	pusher
+46144	pushiness
+46145	pushing
+46146	pushover
+46151	pushpin
+46152	pushup
+46153	pushy
+46154	putdown
+46155	putt
+46156	puzzle
+46161	puzzling
+46162	pyramid
+46163	pyromania
+46164	python
+46165	quack
+46166	quadrant
+46211	quail
+46212	quaintly
+46213	quake
+46214	quaking
+46215	qualified
+46216	qualifier
+46221	qualify
+46222	quality
+46223	qualm
+46224	quantum
+46225	quarrel
+46226	quarry
+46231	quartered
+46232	quarterly
+46233	quarters
+46234	quartet
+46235	quench
+46236	query
+46241	quicken
+46242	quickly
+46243	quickness
+46244	quicksand
+46245	quickstep
+46246	quiet
+46251	quill
+46252	quilt
+46253	quintet
+46254	quintuple
+46255	quirk
+46256	quit
+46261	quiver
+46262	quizzical
+46263	quotable
+46264	quotation
+46265	quote
+46266	rabid
+46311	race
+46312	racing
+46313	racism
+46314	rack
+46315	racoon
+46316	radar
+46321	radial
+46322	radiance
+46323	radiantly
+46324	radiated
+46325	radiation
+46326	radiator
+46331	radio
+46332	radish
+46333	raffle
+46334	raft
+46335	rage
+46336	ragged
+46341	raging
+46342	ragweed
+46343	raider
+46344	railcar
+46345	railing
+46346	railroad
+46351	railway
+46352	raisin
+46353	rake
+46354	raking
+46355	rally
+46356	ramble
+46361	rambling
+46362	ramp
+46363	ramrod
+46364	ranch
+46365	rancidity
+46366	random
+46411	ranged
+46412	ranger
+46413	ranging
+46414	ranked
+46415	ranking
+46416	ransack
+46421	ranting
+46422	rants
+46423	rare
+46424	rarity
+46425	rascal
+46426	rash
+46431	rasping
+46432	ravage
+46433	raven
+46434	ravine
+46435	raving
+46436	ravioli
+46441	ravishing
+46442	reabsorb
+46443	reach
+46444	reacquire
+46445	reaction
+46446	reactive
+46451	reactor
+46452	reaffirm
+46453	ream
+46454	reanalyze
+46455	reappear
+46456	reapply
+46461	reappoint
+46462	reapprove
+46463	rearrange
+46464	rearview
+46465	reason
+46466	reassign
+46511	reassure
+46512	reattach
+46513	reawake
+46514	rebalance
+46515	rebate
+46516	rebel
+46521	rebirth
+46522	reboot
+46523	reborn
+46524	rebound
+46525	rebuff
+46526	rebuild
+46531	rebuilt
+46532	reburial
+46533	rebuttal
+46534	recall
+46535	recant
+46536	recapture
+46541	recast
+46542	recede
+46543	recent
+46544	recess
+46545	recharger
+46546	recipient
+46551	recital
+46552	recite
+46553	reckless
+46554	reclaim
+46555	recliner
+46556	reclining
+46561	recluse
+46562	reclusive
+46563	recognize
+46564	recoil
+46565	recollect
+46566	recolor
+46611	reconcile
+46612	reconfirm
+46613	reconvene
+46614	recopy
+46615	record
+46616	recount
+46621	recoup
+46622	recovery
+46623	recreate
+46624	rectal
+46625	rectangle
+46626	rectified
+46631	rectify
+46632	recycled
+46633	recycler
+46634	recycling
+46635	reemerge
+46636	reenact
+46641	reenter
+46642	reentry
+46643	reexamine
+46644	referable
+46645	referee
+46646	reference
+46651	refill
+46652	refinance
+46653	refined
+46654	refinery
+46655	refining
+46656	refinish
+46661	reflected
+46662	reflector
+46663	reflex
+46664	reflux
+46665	refocus
+46666	refold
+51111	reforest
+51112	reformat
+51113	reformed
+51114	reformer
+51115	reformist
+51116	refract
+51121	refrain
+51122	refreeze
+51123	refresh
+51124	refried
+51125	refueling
+51126	refund
+51131	refurbish
+51132	refurnish
+51133	refusal
+51134	refuse
+51135	refusing
+51136	refutable
+51141	refute
+51142	regain
+51143	regalia
+51144	regally
+51145	reggae
+51146	regime
+51151	region
+51152	register
+51153	registrar
+51154	registry
+51155	regress
+51156	regretful
+51161	regroup
+51162	regular
+51163	regulate
+51164	regulator
+51165	rehab
+51166	reheat
+51211	rehire
+51212	rehydrate
+51213	reimburse
+51214	reissue
+51215	reiterate
+51216	rejoice
+51221	rejoicing
+51222	rejoin
+51223	rekindle
+51224	relapse
+51225	relapsing
+51226	relatable
+51231	related
+51232	relation
+51233	relative
+51234	relax
+51235	relay
+51236	relearn
+51241	release
+51242	relenting
+51243	reliable
+51244	reliably
+51245	reliance
+51246	reliant
+51251	relic
+51252	relieve
+51253	relieving
+51254	relight
+51255	relish
+51256	relive
+51261	reload
+51262	relocate
+51263	relock
+51264	reluctant
+51265	rely
+51266	remake
+51311	remark
+51312	remarry
+51313	rematch
+51314	remedial
+51315	remedy
+51316	remember
+51321	reminder
+51322	remindful
+51323	remission
+51324	remix
+51325	remnant
+51326	remodeler
+51331	remold
+51332	remorse
+51333	remote
+51334	removable
+51335	removal
+51336	removed
+51341	remover
+51342	removing
+51343	rename
+51344	renderer
+51345	rendering
+51346	rendition
+51351	renegade
+51352	renewable
+51353	renewably
+51354	renewal
+51355	renewed
+51356	renounce
+51361	renovate
+51362	renovator
+51363	rentable
+51364	rental
+51365	rented
+51366	renter
+51411	reoccupy
+51412	reoccur
+51413	reopen
+51414	reorder
+51415	repackage
+51416	repacking
+51421	repaint
+51422	repair
+51423	repave
+51424	repaying
+51425	repayment
+51426	repeal
+51431	repeated
+51432	repeater
+51433	repent
+51434	rephrase
+51435	replace
+51436	replay
+51441	replica
+51442	reply
+51443	reporter
+51444	repose
+51445	repossess
+51446	repost
+51451	repressed
+51452	reprimand
+51453	reprint
+51454	reprise
+51455	reproach
+51456	reprocess
+51461	reproduce
+51462	reprogram
+51463	reps
+51464	reptile
+51465	reptilian
+51466	repugnant
+51511	repulsion
+51512	repulsive
+51513	repurpose
+51514	reputable
+51515	reputably
+51516	request
+51521	require
+51522	requisite
+51523	reroute
+51524	rerun
+51525	resale
+51526	resample
+51531	rescuer
+51532	reseal
+51533	research
+51534	reselect
+51535	reseller
+51536	resemble
+51541	resend
+51542	resent
+51543	reset
+51544	reshape
+51545	reshoot
+51546	reshuffle
+51551	residence
+51552	residency
+51553	resident
+51554	residual
+51555	residue
+51556	resigned
+51561	resilient
+51562	resistant
+51563	resisting
+51564	resize
+51565	resolute
+51566	resolved
+51611	resonant
+51612	resonate
+51613	resort
+51614	resource
+51615	respect
+51616	resubmit
+51621	result
+51622	resume
+51623	resupply
+51624	resurface
+51625	resurrect
+51626	retail
+51631	retainer
+51632	retaining
+51633	retake
+51634	retaliate
+51635	retention
+51636	rethink
+51641	retinal
+51642	retired
+51643	retiree
+51644	retiring
+51645	retold
+51646	retool
+51651	retorted
+51652	retouch
+51653	retrace
+51654	retract
+51655	retrain
+51656	retread
+51661	retreat
+51662	retrial
+51663	retrieval
+51664	retriever
+51665	retry
+51666	return
+52111	retying
+52112	retype
+52113	reunion
+52114	reunite
+52115	reusable
+52116	reuse
+52121	reveal
+52122	reveler
+52123	revenge
+52124	revenue
+52125	reverb
+52126	revered
+52131	reverence
+52132	reverend
+52133	reversal
+52134	reverse
+52135	reversing
+52136	reversion
+52141	revert
+52142	revisable
+52143	revise
+52144	revision
+52145	revisit
+52146	revivable
+52151	revival
+52152	reviver
+52153	reviving
+52154	revocable
+52155	revoke
+52156	revolt
+52161	revolver
+52162	revolving
+52163	reward
+52164	rewash
+52165	rewind
+52166	rewire
+52211	reword
+52212	rework
+52213	rewrap
+52214	rewrite
+52215	rhyme
+52216	ribbon
+52221	ribcage
+52222	rice
+52223	riches
+52224	richly
+52225	richness
+52226	rickety
+52231	ricotta
+52232	riddance
+52233	ridden
+52234	ride
+52235	riding
+52236	rifling
+52241	rift
+52242	rigging
+52243	rigid
+52244	rigor
+52245	rimless
+52246	rimmed
+52251	rind
+52252	rink
+52253	rinse
+52254	rinsing
+52255	riot
+52256	ripcord
+52261	ripeness
+52262	ripening
+52263	ripping
+52264	ripple
+52265	rippling
+52266	riptide
+52311	rise
+52312	rising
+52313	risk
+52314	risotto
+52315	ritalin
+52316	ritzy
+52321	rival
+52322	riverbank
+52323	riverbed
+52324	riverboat
+52325	riverside
+52326	riveter
+52331	riveting
+52332	roamer
+52333	roaming
+52334	roast
+52335	robbing
+52336	robe
+52341	robin
+52342	robotics
+52343	robust
+52344	rockband
+52345	rocker
+52346	rocket
+52351	rockfish
+52352	rockiness
+52353	rocking
+52354	rocklike
+52355	rockslide
+52356	rockstar
+52361	rocky
+52362	rogue
+52363	roman
+52364	romp
+52365	rope
+52366	roping
+52411	roster
+52412	rosy
+52413	rotten
+52414	rotting
+52415	rotunda
+52416	roulette
+52421	rounding
+52422	roundish
+52423	roundness
+52424	roundup
+52425	roundworm
+52426	routine
+52431	routing
+52432	rover
+52433	roving
+52434	royal
+52435	rubbed
+52436	rubber
+52441	rubbing
+52442	rubble
+52443	rubdown
+52444	ruby
+52445	ruckus
+52446	rudder
+52451	rug
+52452	ruined
+52453	rule
+52454	rumble
+52455	rumbling
+52456	rummage
+52461	rumor
+52462	runaround
+52463	rundown
+52464	runner
+52465	running
+52466	runny
+52511	runt
+52512	runway
+52513	rupture
+52514	rural
+52515	ruse
+52516	rush
+52521	rust
+52522	rut
+52523	sabbath
+52524	sabotage
+52525	sacrament
+52526	sacred
+52531	sacrifice
+52532	sadden
+52533	saddlebag
+52534	saddled
+52535	saddling
+52536	sadly
+52541	sadness
+52542	safari
+52543	safeguard
+52544	safehouse
+52545	safely
+52546	safeness
+52551	saffron
+52552	saga
+52553	sage
+52554	sagging
+52555	saggy
+52556	said
+52561	saint
+52562	sake
+52563	salad
+52564	salami
+52565	salaried
+52566	salary
+52611	saline
+52612	salon
+52613	saloon
+52614	salsa
+52615	salt
+52616	salutary
+52621	salute
+52622	salvage
+52623	salvaging
+52624	salvation
+52625	same
+52626	sample
+52631	sampling
+52632	sanction
+52633	sanctity
+52634	sanctuary
+52635	sandal
+52636	sandbag
+52641	sandbank
+52642	sandbar
+52643	sandblast
+52644	sandbox
+52645	sanded
+52646	sandfish
+52651	sanding
+52652	sandlot
+52653	sandpaper
+52654	sandpit
+52655	sandstone
+52656	sandstorm
+52661	sandworm
+52662	sandy
+52663	sanitary
+52664	sanitizer
+52665	sank
+52666	santa
+53111	sapling
+53112	sappiness
+53113	sappy
+53114	sarcasm
+53115	sarcastic
+53116	sardine
+53121	sash
+53122	sasquatch
+53123	sassy
+53124	satchel
+53125	satiable
+53126	satin
+53131	satirical
+53132	satisfied
+53133	satisfy
+53134	saturate
+53135	saturday
+53136	sauciness
+53141	saucy
+53142	sauna
+53143	savage
+53144	savanna
+53145	saved
+53146	savings
+53151	savior
+53152	savor
+53153	saxophone
+53154	say
+53155	scabbed
+53156	scabby
+53161	scalded
+53162	scalding
+53163	scale
+53164	scaling
+53165	scallion
+53166	scallop
+53211	scalping
+53212	scam
+53213	scandal
+53214	scanner
+53215	scanning
+53216	scant
+53221	scapegoat
+53222	scarce
+53223	scarcity
+53224	scarecrow
+53225	scared
+53226	scarf
+53231	scarily
+53232	scariness
+53233	scarring
+53234	scary
+53235	scavenger
+53236	scenic
+53241	schedule
+53242	schematic
+53243	scheme
+53244	scheming
+53245	schilling
+53246	schnapps
+53251	scholar
+53252	science
+53253	scientist
+53254	scion
+53255	scoff
+53256	scolding
+53261	scone
+53262	scoop
+53263	scooter
+53264	scope
+53265	scorch
+53266	scorebook
+53311	scorecard
+53312	scored
+53313	scoreless
+53314	scorer
+53315	scoring
+53316	scorn
+53321	scorpion
+53322	scotch
+53323	scoundrel
+53324	scoured
+53325	scouring
+53326	scouting
+53331	scouts
+53332	scowling
+53333	scrabble
+53334	scraggly
+53335	scrambled
+53336	scrambler
+53341	scrap
+53342	scratch
+53343	scrawny
+53344	screen
+53345	scribble
+53346	scribe
+53351	scribing
+53352	scrimmage
+53353	script
+53354	scroll
+53355	scrooge
+53356	scrounger
+53361	scrubbed
+53362	scrubber
+53363	scruffy
+53364	scrunch
+53365	scrutiny
+53366	scuba
+53411	scuff
+53412	sculptor
+53413	sculpture
+53414	scurvy
+53415	scuttle
+53416	secluded
+53421	secluding
+53422	seclusion
+53423	second
+53424	secrecy
+53425	secret
+53426	sectional
+53431	sector
+53432	secular
+53433	securely
+53434	security
+53435	sedan
+53436	sedate
+53441	sedation
+53442	sedative
+53443	sediment
+53444	seduce
+53445	seducing
+53446	segment
+53451	seismic
+53452	seizing
+53453	seldom
+53454	selected
+53455	selection
+53456	selective
+53461	selector
+53462	self
+53463	seltzer
+53464	semantic
+53465	semester
+53466	semicolon
+53511	semifinal
+53512	seminar
+53513	semisoft
+53514	semisweet
+53515	senate
+53516	senator
+53521	send
+53522	senior
+53523	senorita
+53524	sensation
+53525	sensitive
+53526	sensitize
+53531	sensually
+53532	sensuous
+53533	sepia
+53534	september
+53535	septic
+53536	septum
+53541	sequel
+53542	sequence
+53543	sequester
+53544	series
+53545	sermon
+53546	serotonin
+53551	serpent
+53552	serrated
+53553	serve
+53554	service
+53555	serving
+53556	sesame
+53561	sessions
+53562	setback
+53563	setting
+53564	settle
+53565	settling
+53566	setup
+53611	sevenfold
+53612	seventeen
+53613	seventh
+53614	seventy
+53615	severity
+53616	shabby
+53621	shack
+53622	shaded
+53623	shadily
+53624	shadiness
+53625	shading
+53626	shadow
+53631	shady
+53632	shaft
+53633	shakable
+53634	shakily
+53635	shakiness
+53636	shaking
+53641	shaky
+53642	shale
+53643	shallot
+53644	shallow
+53645	shame
+53646	shampoo
+53651	shamrock
+53652	shank
+53653	shanty
+53654	shape
+53655	shaping
+53656	share
+53661	sharpener
+53662	sharper
+53663	sharpie
+53664	sharply
+53665	sharpness
+53666	shawl
+54111	sheath
+54112	shed
+54113	sheep
+54114	sheet
+54115	shelf
+54116	shell
+54121	shelter
+54122	shelve
+54123	shelving
+54124	sherry
+54125	shield
+54126	shifter
+54131	shifting
+54132	shiftless
+54133	shifty
+54134	shimmer
+54135	shimmy
+54136	shindig
+54141	shine
+54142	shingle
+54143	shininess
+54144	shining
+54145	shiny
+54146	ship
+54151	shirt
+54152	shivering
+54153	shock
+54154	shone
+54155	shoplift
+54156	shopper
+54161	shopping
+54162	shoptalk
+54163	shore
+54164	shortage
+54165	shortcake
+54166	shortcut
+54211	shorten
+54212	shorter
+54213	shorthand
+54214	shortlist
+54215	shortly
+54216	shortness
+54221	shorts
+54222	shortwave
+54223	shorty
+54224	shout
+54225	shove
+54226	showbiz
+54231	showcase
+54232	showdown
+54233	shower
+54234	showgirl
+54235	showing
+54236	showman
+54241	shown
+54242	showoff
+54243	showpiece
+54244	showplace
+54245	showroom
+54246	showy
+54251	shrank
+54252	shrapnel
+54253	shredder
+54254	shredding
+54255	shrewdly
+54256	shriek
+54261	shrill
+54262	shrimp
+54263	shrine
+54264	shrink
+54265	shrivel
+54266	shrouded
+54311	shrubbery
+54312	shrubs
+54313	shrug
+54314	shrunk
+54315	shucking
+54316	shudder
+54321	shuffle
+54322	shuffling
+54323	shun
+54324	shush
+54325	shut
+54326	shy
+54331	siamese
+54332	siberian
+54333	sibling
+54334	siding
+54335	sierra
+54336	siesta
+54341	sift
+54342	sighing
+54343	silenced
+54344	silencer
+54345	silent
+54346	silica
+54351	silicon
+54352	silk
+54353	silliness
+54354	silly
+54355	silo
+54356	silt
+54361	silver
+54362	similarly
+54363	simile
+54364	simmering
+54365	simple
+54366	simplify
+54411	simply
+54412	sincere
+54413	sincerity
+54414	singer
+54415	singing
+54416	single
+54421	singular
+54422	sinister
+54423	sinless
+54424	sinner
+54425	sinuous
+54426	sip
+54431	siren
+54432	sister
+54433	sitcom
+54434	sitter
+54435	sitting
+54436	situated
+54441	situation
+54442	sixfold
+54443	sixteen
+54444	sixth
+54445	sixties
+54446	sixtieth
+54451	sixtyfold
+54452	sizable
+54453	sizably
+54454	size
+54455	sizing
+54456	sizzle
+54461	sizzling
+54462	skater
+54463	skating
+54464	skedaddle
+54465	skeletal
+54466	skeleton
+54511	skeptic
+54512	sketch
+54513	skewed
+54514	skewer
+54515	skid
+54516	skied
+54521	skier
+54522	skies
+54523	skiing
+54524	skilled
+54525	skillet
+54526	skillful
+54531	skimmed
+54532	skimmer
+54533	skimming
+54534	skimpily
+54535	skincare
+54536	skinhead
+54541	skinless
+54542	skinning
+54543	skinny
+54544	skintight
+54545	skipper
+54546	skipping
+54551	skirmish
+54552	skirt
+54553	skittle
+54554	skydiver
+54555	skylight
+54556	skyline
+54561	skype
+54562	skyrocket
+54563	skyward
+54564	slab
+54565	slacked
+54566	slacker
+54611	slacking
+54612	slackness
+54613	slacks
+54614	slain
+54615	slam
+54616	slander
+54621	slang
+54622	slapping
+54623	slapstick
+54624	slashed
+54625	slashing
+54626	slate
+54631	slather
+54632	slaw
+54633	sled
+54634	sleek
+54635	sleep
+54636	sleet
+54641	sleeve
+54642	slept
+54643	sliceable
+54644	sliced
+54645	slicer
+54646	slicing
+54651	slick
+54652	slider
+54653	slideshow
+54654	sliding
+54655	slighted
+54656	slighting
+54661	slightly
+54662	slimness
+54663	slimy
+54664	slinging
+54665	slingshot
+54666	slinky
+55111	slip
+55112	slit
+55113	sliver
+55114	slobbery
+55115	slogan
+55116	sloped
+55121	sloping
+55122	sloppily
+55123	sloppy
+55124	slot
+55125	slouching
+55126	slouchy
+55131	sludge
+55132	slug
+55133	slum
+55134	slurp
+55135	slush
+55136	sly
+55141	small
+55142	smartly
+55143	smartness
+55144	smasher
+55145	smashing
+55146	smashup
+55151	smell
+55152	smelting
+55153	smile
+55154	smilingly
+55155	smirk
+55156	smite
+55161	smith
+55162	smitten
+55163	smock
+55164	smog
+55165	smoked
+55166	smokeless
+55211	smokiness
+55212	smoking
+55213	smoky
+55214	smolder
+55215	smooth
+55216	smother
+55221	smudge
+55222	smudgy
+55223	smuggler
+55224	smuggling
+55225	smugly
+55226	smugness
+55231	snack
+55232	snagged
+55233	snaking
+55234	snap
+55235	snare
+55236	snarl
+55241	snazzy
+55242	sneak
+55243	sneer
+55244	sneeze
+55245	sneezing
+55246	snide
+55251	sniff
+55252	snippet
+55253	snipping
+55254	snitch
+55255	snooper
+55256	snooze
+55261	snore
+55262	snoring
+55263	snorkel
+55264	snort
+55265	snout
+55266	snowbird
+55311	snowboard
+55312	snowbound
+55313	snowcap
+55314	snowdrift
+55315	snowdrop
+55316	snowfall
+55321	snowfield
+55322	snowflake
+55323	snowiness
+55324	snowless
+55325	snowman
+55326	snowplow
+55331	snowshoe
+55332	snowstorm
+55333	snowsuit
+55334	snowy
+55335	snub
+55336	snuff
+55341	snuggle
+55342	snugly
+55343	snugness
+55344	speak
+55345	spearfish
+55346	spearhead
+55351	spearman
+55352	spearmint
+55353	species
+55354	specimen
+55355	specked
+55356	speckled
+55361	specks
+55362	spectacle
+55363	spectator
+55364	spectrum
+55365	speculate
+55366	speech
+55411	speed
+55412	spellbind
+55413	speller
+55414	spelling
+55415	spendable
+55416	spender
+55421	spending
+55422	spent
+55423	spew
+55424	sphere
+55425	spherical
+55426	sphinx
+55431	spider
+55432	spied
+55433	spiffy
+55434	spill
+55435	spilt
+55436	spinach
+55441	spinal
+55442	spindle
+55443	spinner
+55444	spinning
+55445	spinout
+55446	spinster
+55451	spiny
+55452	spiral
+55453	spirited
+55454	spiritism
+55455	spirits
+55456	spiritual
+55461	splashed
+55462	splashing
+55463	splashy
+55464	splatter
+55465	spleen
+55466	splendid
+55511	splendor
+55512	splice
+55513	splicing
+55514	splinter
+55515	splotchy
+55516	splurge
+55521	spoilage
+55522	spoiled
+55523	spoiler
+55524	spoiling
+55525	spoils
+55526	spoken
+55531	spokesman
+55532	sponge
+55533	spongy
+55534	sponsor
+55535	spoof
+55536	spookily
+55541	spooky
+55542	spool
+55543	spoon
+55544	spore
+55545	sporting
+55546	sports
+55551	sporty
+55552	spotless
+55553	spotlight
+55554	spotted
+55555	spotter
+55556	spotting
+55561	spotty
+55562	spousal
+55563	spouse
+55564	spout
+55565	sprain
+55566	sprang
+55611	sprawl
+55612	spray
+55613	spree
+55614	sprig
+55615	spring
+55616	sprinkled
+55621	sprinkler
+55622	sprint
+55623	sprite
+55624	sprout
+55625	spruce
+55626	sprung
+55631	spry
+55632	spud
+55633	spur
+55634	sputter
+55635	spyglass
+55636	squabble
+55641	squad
+55642	squall
+55643	squander
+55644	squash
+55645	squatted
+55646	squatter
+55651	squatting
+55652	squeak
+55653	squealer
+55654	squealing
+55655	squeamish
+55656	squeegee
+55661	squeeze
+55662	squeezing
+55663	squid
+55664	squiggle
+55665	squiggly
+55666	squint
+56111	squire
+56112	squirt
+56113	squishier
+56114	squishy
+56115	stability
+56116	stabilize
+56121	stable
+56122	stack
+56123	stadium
+56124	staff
+56125	stage
+56126	staging
+56131	stagnant
+56132	stagnate
+56133	stainable
+56134	stained
+56135	staining
+56136	stainless
+56141	stalemate
+56142	staleness
+56143	stalling
+56144	stallion
+56145	stamina
+56146	stammer
+56151	stamp
+56152	stand
+56153	stank
+56154	staple
+56155	stapling
+56156	starboard
+56161	starch
+56162	stardom
+56163	stardust
+56164	starfish
+56165	stargazer
+56166	staring
+56211	stark
+56212	starless
+56213	starlet
+56214	starlight
+56215	starlit
+56216	starring
+56221	starry
+56222	starship
+56223	starter
+56224	starting
+56225	startle
+56226	startling
+56231	startup
+56232	starved
+56233	starving
+56234	stash
+56235	state
+56236	static
+56241	statistic
+56242	statue
+56243	stature
+56244	status
+56245	statute
+56246	statutory
+56251	staunch
+56252	stays
+56253	steadfast
+56254	steadier
+56255	steadily
+56256	steadying
+56261	steam
+56262	steed
+56263	steep
+56264	steerable
+56265	steering
+56266	steersman
+56311	stegosaur
+56312	stellar
+56313	stem
+56314	stench
+56315	stencil
+56316	step
+56321	stereo
+56322	sterile
+56323	sterility
+56324	sterilize
+56325	sterling
+56326	sternness
+56331	sternum
+56332	stew
+56333	stick
+56334	stiffen
+56335	stiffly
+56336	stiffness
+56341	stifle
+56342	stifling
+56343	stillness
+56344	stilt
+56345	stimulant
+56346	stimulate
+56351	stimuli
+56352	stimulus
+56353	stinger
+56354	stingily
+56355	stinging
+56356	stingray
+56361	stingy
+56362	stinking
+56363	stinky
+56364	stipend
+56365	stipulate
+56366	stir
+56411	stitch
+56412	stock
+56413	stoic
+56414	stoke
+56415	stole
+56416	stomp
+56421	stonewall
+56422	stoneware
+56423	stonework
+56424	stoning
+56425	stony
+56426	stood
+56431	stooge
+56432	stool
+56433	stoop
+56434	stoplight
+56435	stoppable
+56436	stoppage
+56441	stopped
+56442	stopper
+56443	stopping
+56444	stopwatch
+56445	storable
+56446	storage
+56451	storeroom
+56452	storewide
+56453	storm
+56454	stout
+56455	stove
+56456	stowaway
+56461	stowing
+56462	straddle
+56463	straggler
+56464	strained
+56465	strainer
+56466	straining
+56511	strangely
+56512	stranger
+56513	strangle
+56514	strategic
+56515	strategy
+56516	stratus
+56521	straw
+56522	stray
+56523	streak
+56524	stream
+56525	street
+56526	strength
+56531	strenuous
+56532	strep
+56533	stress
+56534	stretch
+56535	strewn
+56536	stricken
+56541	strict
+56542	stride
+56543	strife
+56544	strike
+56545	striking
+56546	strive
+56551	striving
+56552	strobe
+56553	strode
+56554	stroller
+56555	strongbox
+56556	strongly
+56561	strongman
+56562	struck
+56563	structure
+56564	strudel
+56565	struggle
+56566	strum
+56611	strung
+56612	strut
+56613	stubbed
+56614	stubble
+56615	stubbly
+56616	stubborn
+56621	stucco
+56622	stuck
+56623	student
+56624	studied
+56625	studio
+56626	study
+56631	stuffed
+56632	stuffing
+56633	stuffy
+56634	stumble
+56635	stumbling
+56636	stump
+56641	stung
+56642	stunned
+56643	stunner
+56644	stunning
+56645	stunt
+56646	stupor
+56651	sturdily
+56652	sturdy
+56653	styling
+56654	stylishly
+56655	stylist
+56656	stylized
+56661	stylus
+56662	suave
+56663	subarctic
+56664	subatomic
+56665	subdivide
+56666	subdued
+61111	subduing
+61112	subfloor
+61113	subgroup
+61114	subheader
+61115	subject
+61116	sublease
+61121	sublet
+61122	sublevel
+61123	sublime
+61124	submarine
+61125	submerge
+61126	submersed
+61131	submitter
+61132	subpanel
+61133	subpar
+61134	subplot
+61135	subprime
+61136	subscribe
+61141	subscript
+61142	subsector
+61143	subside
+61144	subsiding
+61145	subsidize
+61146	subsidy
+61151	subsoil
+61152	subsonic
+61153	substance
+61154	subsystem
+61155	subtext
+61156	subtitle
+61161	subtly
+61162	subtotal
+61163	subtract
+61164	subtype
+61165	suburb
+61166	subway
+61211	subwoofer
+61212	subzero
+61213	succulent
+61214	such
+61215	suction
+61216	sudden
+61221	sudoku
+61222	suds
+61223	sufferer
+61224	suffering
+61225	suffice
+61226	suffix
+61231	suffocate
+61232	suffrage
+61233	sugar
+61234	suggest
+61235	suing
+61236	suitable
+61241	suitably
+61242	suitcase
+61243	suitor
+61244	sulfate
+61245	sulfide
+61246	sulfite
+61251	sulfur
+61252	sulk
+61253	sullen
+61254	sulphate
+61255	sulphuric
+61256	sultry
+61261	superbowl
+61262	superglue
+61263	superhero
+61264	superior
+61265	superjet
+61266	superman
+61311	supermom
+61312	supernova
+61313	supervise
+61314	supper
+61315	supplier
+61316	supply
+61321	support
+61322	supremacy
+61323	supreme
+61324	surcharge
+61325	surely
+61326	sureness
+61331	surface
+61332	surfacing
+61333	surfboard
+61334	surfer
+61335	surgery
+61336	surgical
+61341	surging
+61342	surname
+61343	surpass
+61344	surplus
+61345	surprise
+61346	surreal
+61351	surrender
+61352	surrogate
+61353	surround
+61354	survey
+61355	survival
+61356	survive
+61361	surviving
+61362	survivor
+61363	sushi
+61364	suspect
+61365	suspend
+61366	suspense
+61411	sustained
+61412	sustainer
+61413	swab
+61414	swaddling
+61415	swagger
+61416	swampland
+61421	swan
+61422	swapping
+61423	swarm
+61424	sway
+61425	swear
+61426	sweat
+61431	sweep
+61432	swell
+61433	swept
+61434	swerve
+61435	swifter
+61436	swiftly
+61441	swiftness
+61442	swimmable
+61443	swimmer
+61444	swimming
+61445	swimsuit
+61446	swimwear
+61451	swinger
+61452	swinging
+61453	swipe
+61454	swirl
+61455	switch
+61456	swivel
+61461	swizzle
+61462	swooned
+61463	swoop
+61464	swoosh
+61465	swore
+61466	sworn
+61511	swung
+61512	sycamore
+61513	sympathy
+61514	symphonic
+61515	symphony
+61516	symptom
+61521	synapse
+61522	syndrome
+61523	synergy
+61524	synopses
+61525	synopsis
+61526	synthesis
+61531	synthetic
+61532	syrup
+61533	system
+61534	t-shirt
+61535	tabasco
+61536	tabby
+61541	tableful
+61542	tables
+61543	tablet
+61544	tableware
+61545	tabloid
+61546	tackiness
+61551	tacking
+61552	tackle
+61553	tackling
+61554	tacky
+61555	taco
+61556	tactful
+61561	tactical
+61562	tactics
+61563	tactile
+61564	tactless
+61565	tadpole
+61566	taekwondo
+61611	tag
+61612	tainted
+61613	take
+61614	taking
+61615	talcum
+61616	talisman
+61621	tall
+61622	talon
+61623	tamale
+61624	tameness
+61625	tamer
+61626	tamper
+61631	tank
+61632	tanned
+61633	tannery
+61634	tanning
+61635	tantrum
+61636	tapeless
+61641	tapered
+61642	tapering
+61643	tapestry
+61644	tapioca
+61645	tapping
+61646	taps
+61651	tarantula
+61652	target
+61653	tarmac
+61654	tarnish
+61655	tarot
+61656	tartar
+61661	tartly
+61662	tartness
+61663	task
+61664	tassel
+61665	taste
+61666	tastiness
+62111	tasting
+62112	tasty
+62113	tattered
+62114	tattle
+62115	tattling
+62116	tattoo
+62121	taunt
+62122	tavern
+62123	thank
+62124	that
+62125	thaw
+62126	theater
+62131	theatrics
+62132	thee
+62133	theft
+62134	theme
+62135	theology
+62136	theorize
+62141	thermal
+62142	thermos
+62143	thesaurus
+62144	these
+62145	thesis
+62146	thespian
+62151	thicken
+62152	thicket
+62153	thickness
+62154	thieving
+62155	thievish
+62156	thigh
+62161	thimble
+62162	thing
+62163	think
+62164	thinly
+62165	thinner
+62166	thinness
+62211	thinning
+62212	thirstily
+62213	thirsting
+62214	thirsty
+62215	thirteen
+62216	thirty
+62221	thong
+62222	thorn
+62223	those
+62224	thousand
+62225	thrash
+62226	thread
+62231	threaten
+62232	threefold
+62233	thrift
+62234	thrill
+62235	thrive
+62236	thriving
+62241	throat
+62242	throbbing
+62243	throng
+62244	throttle
+62245	throwaway
+62246	throwback
+62251	thrower
+62252	throwing
+62253	thud
+62254	thumb
+62255	thumping
+62256	thursday
+62261	thus
+62262	thwarting
+62263	thyself
+62264	tiara
+62265	tibia
+62266	tidal
+62311	tidbit
+62312	tidiness
+62313	tidings
+62314	tidy
+62315	tiger
+62316	tighten
+62321	tightly
+62322	tightness
+62323	tightrope
+62324	tightwad
+62325	tigress
+62326	tile
+62331	tiling
+62332	till
+62333	tilt
+62334	timid
+62335	timing
+62336	timothy
+62341	tinderbox
+62342	tinfoil
+62343	tingle
+62344	tingling
+62345	tingly
+62346	tinker
+62351	tinkling
+62352	tinsel
+62353	tinsmith
+62354	tint
+62355	tinwork
+62356	tiny
+62361	tipoff
+62362	tipped
+62363	tipper
+62364	tipping
+62365	tiptoeing
+62366	tiptop
+62411	tiring
+62412	tissue
+62413	trace
+62414	tracing
+62415	track
+62416	traction
+62421	tractor
+62422	trade
+62423	trading
+62424	tradition
+62425	traffic
+62426	tragedy
+62431	trailing
+62432	trailside
+62433	train
+62434	traitor
+62435	trance
+62436	tranquil
+62441	transfer
+62442	transform
+62443	translate
+62444	transpire
+62445	transport
+62446	transpose
+62451	trapdoor
+62452	trapeze
+62453	trapezoid
+62454	trapped
+62455	trapper
+62456	trapping
+62461	traps
+62462	trash
+62463	travel
+62464	traverse
+62465	travesty
+62466	tray
+62511	treachery
+62512	treading
+62513	treadmill
+62514	treason
+62515	treat
+62516	treble
+62521	tree
+62522	trekker
+62523	tremble
+62524	trembling
+62525	tremor
+62526	trench
+62531	trend
+62532	trespass
+62533	triage
+62534	trial
+62535	triangle
+62536	tribesman
+62541	tribunal
+62542	tribune
+62543	tributary
+62544	tribute
+62545	triceps
+62546	trickery
+62551	trickily
+62552	tricking
+62553	trickle
+62554	trickster
+62555	tricky
+62556	tricolor
+62561	tricycle
+62562	trident
+62563	tried
+62564	trifle
+62565	trifocals
+62566	trillion
+62611	trilogy
+62612	trimester
+62613	trimmer
+62614	trimming
+62615	trimness
+62616	trinity
+62621	trio
+62622	tripod
+62623	tripping
+62624	triumph
+62625	trivial
+62626	trodden
+62631	trolling
+62632	trombone
+62633	trophy
+62634	tropical
+62635	tropics
+62636	trouble
+62641	troubling
+62642	trough
+62643	trousers
+62644	trout
+62645	trowel
+62646	truce
+62651	truck
+62652	truffle
+62653	trump
+62654	trunks
+62655	trustable
+62656	trustee
+62661	trustful
+62662	trusting
+62663	trustless
+62664	truth
+62665	try
+62666	tubby
+63111	tubeless
+63112	tubular
+63113	tucking
+63114	tuesday
+63115	tug
+63116	tuition
+63121	tulip
+63122	tumble
+63123	tumbling
+63124	tummy
+63125	turban
+63126	turbine
+63131	turbofan
+63132	turbojet
+63133	turbulent
+63134	turf
+63135	turkey
+63136	turmoil
+63141	turret
+63142	turtle
+63143	tusk
+63144	tutor
+63145	tutu
+63146	tux
+63151	tweak
+63152	tweed
+63153	tweet
+63154	tweezers
+63155	twelve
+63156	twentieth
+63161	twenty
+63162	twerp
+63163	twice
+63164	twiddle
+63165	twiddling
+63166	twig
+63211	twilight
+63212	twine
+63213	twins
+63214	twirl
+63215	twistable
+63216	twisted
+63221	twister
+63222	twisting
+63223	twisty
+63224	twitch
+63225	twitter
+63226	tycoon
+63231	tying
+63232	tyke
+63233	udder
+63234	ultimate
+63235	ultimatum
+63236	ultra
+63241	umbilical
+63242	umbrella
+63243	umpire
+63244	unabashed
+63245	unable
+63246	unadorned
+63251	unadvised
+63252	unafraid
+63253	unaired
+63254	unaligned
+63255	unaltered
+63256	unarmored
+63261	unashamed
+63262	unaudited
+63263	unawake
+63264	unaware
+63265	unbaked
+63266	unbalance
+63311	unbeaten
+63312	unbend
+63313	unbent
+63314	unbiased
+63315	unbitten
+63316	unblended
+63321	unblessed
+63322	unblock
+63323	unbolted
+63324	unbounded
+63325	unboxed
+63326	unbraided
+63331	unbridle
+63332	unbroken
+63333	unbuckled
+63334	unbundle
+63335	unburned
+63336	unbutton
+63341	uncanny
+63342	uncapped
+63343	uncaring
+63344	uncertain
+63345	unchain
+63346	unchanged
+63351	uncharted
+63352	uncheck
+63353	uncivil
+63354	unclad
+63355	unclaimed
+63356	unclamped
+63361	unclasp
+63362	uncle
+63363	unclip
+63364	uncloak
+63365	unclog
+63366	unclothed
+63411	uncoated
+63412	uncoiled
+63413	uncolored
+63414	uncombed
+63415	uncommon
+63416	uncooked
+63421	uncork
+63422	uncorrupt
+63423	uncounted
+63424	uncouple
+63425	uncouth
+63426	uncover
+63431	uncross
+63432	uncrown
+63433	uncrushed
+63434	uncured
+63435	uncurious
+63436	uncurled
+63441	uncut
+63442	undamaged
+63443	undated
+63444	undaunted
+63445	undead
+63446	undecided
+63451	undefined
+63452	underage
+63453	underarm
+63454	undercoat
+63455	undercook
+63456	undercut
+63461	underdog
+63462	underdone
+63463	underfed
+63464	underfeed
+63465	underfoot
+63466	undergo
+63511	undergrad
+63512	underhand
+63513	underline
+63514	underling
+63515	undermine
+63516	undermost
+63521	underpaid
+63522	underpass
+63523	underpay
+63524	underrate
+63525	undertake
+63526	undertone
+63531	undertook
+63532	undertow
+63533	underuse
+63534	underwear
+63535	underwent
+63536	underwire
+63541	undesired
+63542	undiluted
+63543	undivided
+63544	undocked
+63545	undoing
+63546	undone
+63551	undrafted
+63552	undress
+63553	undrilled
+63554	undusted
+63555	undying
+63556	unearned
+63561	unearth
+63562	unease
+63563	uneasily
+63564	uneasy
+63565	uneatable
+63566	uneaten
+63611	unedited
+63612	unelected
+63613	unending
+63614	unengaged
+63615	unenvied
+63616	unequal
+63621	unethical
+63622	uneven
+63623	unexpired
+63624	unexposed
+63625	unfailing
+63626	unfair
+63631	unfasten
+63632	unfazed
+63633	unfeeling
+63634	unfiled
+63635	unfilled
+63636	unfitted
+63641	unfitting
+63642	unfixable
+63643	unfixed
+63644	unflawed
+63645	unfocused
+63646	unfold
+63651	unfounded
+63652	unframed
+63653	unfreeze
+63654	unfrosted
+63655	unfrozen
+63656	unfunded
+63661	unglazed
+63662	ungloved
+63663	unglue
+63664	ungodly
+63665	ungraded
+63666	ungreased
+64111	unguarded
+64112	unguided
+64113	unhappily
+64114	unhappy
+64115	unharmed
+64116	unhealthy
+64121	unheard
+64122	unhearing
+64123	unheated
+64124	unhelpful
+64125	unhidden
+64126	unhinge
+64131	unhitched
+64132	unholy
+64133	unhook
+64134	unicorn
+64135	unicycle
+64136	unified
+64141	unifier
+64142	uniformed
+64143	uniformly
+64144	unify
+64145	unimpeded
+64146	uninjured
+64151	uninstall
+64152	uninsured
+64153	uninvited
+64154	union
+64155	uniquely
+64156	unisexual
+64161	unison
+64162	unissued
+64163	unit
+64164	universal
+64165	universe
+64166	unjustly
+64211	unkempt
+64212	unkind
+64213	unknotted
+64214	unknowing
+64215	unknown
+64216	unlaced
+64221	unlatch
+64222	unlawful
+64223	unleaded
+64224	unlearned
+64225	unleash
+64226	unless
+64231	unleveled
+64232	unlighted
+64233	unlikable
+64234	unlimited
+64235	unlined
+64236	unlinked
+64241	unlisted
+64242	unlit
+64243	unlivable
+64244	unloaded
+64245	unloader
+64246	unlocked
+64251	unlocking
+64252	unlovable
+64253	unloved
+64254	unlovely
+64255	unloving
+64256	unluckily
+64261	unlucky
+64262	unmade
+64263	unmanaged
+64264	unmanned
+64265	unmapped
+64266	unmarked
+64311	unmasked
+64312	unmasking
+64313	unmatched
+64314	unmindful
+64315	unmixable
+64316	unmixed
+64321	unmolded
+64322	unmoral
+64323	unmovable
+64324	unmoved
+64325	unmoving
+64326	unnamable
+64331	unnamed
+64332	unnatural
+64333	unneeded
+64334	unnerve
+64335	unnerving
+64336	unnoticed
+64341	unopened
+64342	unopposed
+64343	unpack
+64344	unpadded
+64345	unpaid
+64346	unpainted
+64351	unpaired
+64352	unpaved
+64353	unpeeled
+64354	unpicked
+64355	unpiloted
+64356	unpinned
+64361	unplanned
+64362	unplanted
+64363	unpleased
+64364	unpledged
+64365	unplowed
+64366	unplug
+64411	unpopular
+64412	unproven
+64413	unquote
+64414	unranked
+64415	unrated
+64416	unraveled
+64421	unreached
+64422	unread
+64423	unreal
+64424	unreeling
+64425	unrefined
+64426	unrelated
+64431	unrented
+64432	unrest
+64433	unretired
+64434	unrevised
+64435	unrigged
+64436	unripe
+64441	unrivaled
+64442	unroasted
+64443	unrobed
+64444	unroll
+64445	unruffled
+64446	unruly
+64451	unrushed
+64452	unsaddle
+64453	unsafe
+64454	unsaid
+64455	unsalted
+64456	unsaved
+64461	unsavory
+64462	unscathed
+64463	unscented
+64464	unscrew
+64465	unsealed
+64466	unseated
+64511	unsecured
+64512	unseeing
+64513	unseemly
+64514	unseen
+64515	unselect
+64516	unselfish
+64521	unsent
+64522	unsettled
+64523	unshackle
+64524	unshaken
+64525	unshaved
+64526	unshaven
+64531	unsheathe
+64532	unshipped
+64533	unsightly
+64534	unsigned
+64535	unskilled
+64536	unsliced
+64541	unsmooth
+64542	unsnap
+64543	unsocial
+64544	unsoiled
+64545	unsold
+64546	unsolved
+64551	unsorted
+64552	unspoiled
+64553	unspoken
+64554	unstable
+64555	unstaffed
+64556	unstamped
+64561	unsteady
+64562	unsterile
+64563	unstirred
+64564	unstitch
+64565	unstopped
+64566	unstuck
+64611	unstuffed
+64612	unstylish
+64613	unsubtle
+64614	unsubtly
+64615	unsuited
+64616	unsure
+64621	unsworn
+64622	untagged
+64623	untainted
+64624	untaken
+64625	untamed
+64626	untangled
+64631	untapped
+64632	untaxed
+64633	unthawed
+64634	unthread
+64635	untidy
+64636	untie
+64641	until
+64642	untimed
+64643	untimely
+64644	untitled
+64645	untoasted
+64646	untold
+64651	untouched
+64652	untracked
+64653	untrained
+64654	untreated
+64655	untried
+64656	untrimmed
+64661	untrue
+64662	untruth
+64663	unturned
+64664	untwist
+64665	untying
+64666	unusable
+65111	unused
+65112	unusual
+65113	unvalued
+65114	unvaried
+65115	unvarying
+65116	unveiled
+65121	unveiling
+65122	unvented
+65123	unviable
+65124	unvisited
+65125	unvocal
+65126	unwanted
+65131	unwarlike
+65132	unwary
+65133	unwashed
+65134	unwatched
+65135	unweave
+65136	unwed
+65141	unwelcome
+65142	unwell
+65143	unwieldy
+65144	unwilling
+65145	unwind
+65146	unwired
+65151	unwitting
+65152	unwomanly
+65153	unworldly
+65154	unworn
+65155	unworried
+65156	unworthy
+65161	unwound
+65162	unwoven
+65163	unwrapped
+65164	unwritten
+65165	unzip
+65166	upbeat
+65211	upchuck
+65212	upcoming
+65213	upcountry
+65214	update
+65215	upfront
+65216	upgrade
+65221	upheaval
+65222	upheld
+65223	uphill
+65224	uphold
+65225	uplifted
+65226	uplifting
+65231	upload
+65232	upon
+65233	upper
+65234	upright
+65235	uprising
+65236	upriver
+65241	uproar
+65242	uproot
+65243	upscale
+65244	upside
+65245	upstage
+65246	upstairs
+65251	upstart
+65252	upstate
+65253	upstream
+65254	upstroke
+65255	upswing
+65256	uptake
+65261	uptight
+65262	uptown
+65263	upturned
+65264	upward
+65265	upwind
+65266	uranium
+65311	urban
+65312	urchin
+65313	urethane
+65314	urgency
+65315	urgent
+65316	urging
+65321	urologist
+65322	urology
+65323	usable
+65324	usage
+65325	useable
+65326	used
+65331	uselessly
+65332	user
+65333	usher
+65334	usual
+65335	utensil
+65336	utility
+65341	utilize
+65342	utmost
+65343	utopia
+65344	utter
+65345	vacancy
+65346	vacant
+65351	vacate
+65352	vacation
+65353	vagabond
+65354	vagrancy
+65355	vagrantly
+65356	vaguely
+65361	vagueness
+65362	valiant
+65363	valid
+65364	valium
+65365	valley
+65366	valuables
+65411	value
+65412	vanilla
+65413	vanish
+65414	vanity
+65415	vanquish
+65416	vantage
+65421	vaporizer
+65422	variable
+65423	variably
+65424	varied
+65425	variety
+65426	various
+65431	varmint
+65432	varnish
+65433	varsity
+65434	varying
+65435	vascular
+65436	vaseline
+65441	vastly
+65442	vastness
+65443	veal
+65444	vegan
+65445	veggie
+65446	vehicular
+65451	velcro
+65452	velocity
+65453	velvet
+65454	vendetta
+65455	vending
+65456	vendor
+65461	veneering
+65462	vengeful
+65463	venomous
+65464	ventricle
+65465	venture
+65466	venue
+65511	venus
+65512	verbalize
+65513	verbally
+65514	verbose
+65515	verdict
+65516	verify
+65521	verse
+65522	version
+65523	versus
+65524	vertebrae
+65525	vertical
+65526	vertigo
+65531	very
+65532	vessel
+65533	vest
+65534	veteran
+65535	veto
+65536	vexingly
+65541	viability
+65542	viable
+65543	vibes
+65544	vice
+65545	vicinity
+65546	victory
+65551	video
+65552	viewable
+65553	viewer
+65554	viewing
+65555	viewless
+65556	viewpoint
+65561	vigorous
+65562	village
+65563	villain
+65564	vindicate
+65565	vineyard
+65566	vintage
+65611	violate
+65612	violation
+65613	violator
+65614	violet
+65615	violin
+65616	viper
+65621	viral
+65622	virtual
+65623	virtuous
+65624	virus
+65625	visa
+65626	viscosity
+65631	viscous
+65632	viselike
+65633	visible
+65634	visibly
+65635	vision
+65636	visiting
+65641	visitor
+65642	visor
+65643	vista
+65644	vitality
+65645	vitalize
+65646	vitally
+65651	vitamins
+65652	vivacious
+65653	vividly
+65654	vividness
+65655	vixen
+65656	vocalist
+65661	vocalize
+65662	vocally
+65663	vocation
+65664	voice
+65665	voicing
+65666	void
+66111	volatile
+66112	volley
+66113	voltage
+66114	volumes
+66115	voter
+66116	voting
+66121	voucher
+66122	vowed
+66123	vowel
+66124	voyage
+66125	wackiness
+66126	wad
+66131	wafer
+66132	waffle
+66133	waged
+66134	wager
+66135	wages
+66136	waggle
+66141	wagon
+66142	wake
+66143	waking
+66144	walk
+66145	walmart
+66146	walnut
+66151	walrus
+66152	waltz
+66153	wand
+66154	wannabe
+66155	wanted
+66156	wanting
+66161	wasabi
+66162	washable
+66163	washbasin
+66164	washboard
+66165	washbowl
+66166	washcloth
+66211	washday
+66212	washed
+66213	washer
+66214	washhouse
+66215	washing
+66216	washout
+66221	washroom
+66222	washstand
+66223	washtub
+66224	wasp
+66225	wasting
+66226	watch
+66231	water
+66232	waviness
+66233	waving
+66234	wavy
+66235	whacking
+66236	whacky
+66241	wham
+66242	wharf
+66243	wheat
+66244	whenever
+66245	whiff
+66246	whimsical
+66251	whinny
+66252	whiny
+66253	whisking
+66254	whoever
+66255	whole
+66256	whomever
+66261	whoopee
+66262	whooping
+66263	whoops
+66264	why
+66265	wick
+66266	widely
+66311	widen
+66312	widget
+66313	widow
+66314	width
+66315	wieldable
+66316	wielder
+66321	wife
+66322	wifi
+66323	wikipedia
+66324	wildcard
+66325	wildcat
+66326	wilder
+66331	wildfire
+66332	wildfowl
+66333	wildland
+66334	wildlife
+66335	wildly
+66336	wildness
+66341	willed
+66342	willfully
+66343	willing
+66344	willow
+66345	willpower
+66346	wilt
+66351	wimp
+66352	wince
+66353	wincing
+66354	wind
+66355	wing
+66356	winking
+66361	winner
+66362	winnings
+66363	winter
+66364	wipe
+66365	wired
+66366	wireless
+66411	wiring
+66412	wiry
+66413	wisdom
+66414	wise
+66415	wish
+66416	wisplike
+66421	wispy
+66422	wistful
+66423	wizard
+66424	wobble
+66425	wobbling
+66426	wobbly
+66431	wok
+66432	wolf
+66433	wolverine
+66434	womanhood
+66435	womankind
+66436	womanless
+66441	womanlike
+66442	womanly
+66443	womb
+66444	woof
+66445	wooing
+66446	wool
+66451	woozy
+66452	word
+66453	work
+66454	worried
+66455	worrier
+66456	worrisome
+66461	worry
+66462	worsening
+66463	worshiper
+66464	worst
+66465	wound
+66466	woven
+66511	wow
+66512	wrangle
+66513	wrath
+66514	wreath
+66515	wreckage
+66516	wrecker
+66521	wrecking
+66522	wrench
+66523	wriggle
+66524	wriggly
+66525	wrinkle
+66526	wrinkly
+66531	wrist
+66532	writing
+66533	written
+66534	wrongdoer
+66535	wronged
+66536	wrongful
+66541	wrongly
+66542	wrongness
+66543	wrought
+66544	xbox
+66545	xerox
+66546	yahoo
+66551	yam
+66552	yanking
+66553	yapping
+66554	yard
+66555	yarn
+66556	yeah
+66561	yearbook
+66562	yearling
+66563	yearly
+66564	yearning
+66565	yeast
+66566	yelling
+66611	yelp
+66612	yen
+66613	yesterday
+66614	yiddish
+66615	yield
+66616	yin
+66621	yippee
+66622	yo-yo
+66623	yodel
+66624	yoga
+66625	yogurt
+66626	yonder
+66631	yoyo
+66632	yummy
+66633	zap
+66634	zealous
+66635	zebra
+66636	zen
+66641	zeppelin
+66642	zero
+66643	zestfully
+66644	zesty
+66645	zigzagged
+66646	zipfile
+66651	zipping
+66652	zippy
+66653	zips
+66654	zit
+66655	zodiac
+66656	zombie
+66661	zone
+66662	zoning
+66663	zookeeper
+66664	zoologist
+66665	zoology
+66666	zoom
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index 2f84552..8f193c3 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -43,6 +43,7 @@ import {
   type TerminalSettings,
   type VaultTheme,
   type SecurityKeyTouch,
+  type Link,
   type ReceivedLink,
 } from "./api";
 import { AppearancePanel } from "./AppearancePanel";
@@ -286,8 +287,9 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
         return open({ kind: "teams" });
       case "invite":
         if (!syncStatus?.enabled || syncStatus.signedOut) {
+          setWaitingInvite(link);
           setNotice(
-            `This is an invite to a team${link.server ? ` on ${new URL(link.server).host}` : ""}. Turn on sync with the invited address first, then open the link again.`,
+            `This is an invite to a team${link.server ? ` on ${new URL(link.server).host}` : ""}. Turn on sync with the invited address: Teams opens with the invite once it's on.`,
           );
           return open({ kind: "sync" });
         }
@@ -301,13 +303,24 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
         return open({ kind: mobile ? "connect" : "quick" });
     }
   };
+  const [syncStatus, setSyncStatus] = useState<SyncStatus | null>(null);
+  // Links are taken once sync's state is known: an invite needs it.
+  const statusKnown = syncStatus !== null;
   useEffect(() => {
+    if (!statusKnown) return;
     const take = () => void linksApi.take().then((all) => all.forEach((r) => openLink.current(r)), () => {});
     take();
     const unlisten = listen("links-pending", take);
     return () => void unlisten.then((f) => f());
-  }, []);
-  const [syncStatus, setSyncStatus] = useState<SyncStatus | null>(null);
+  }, [statusKnown]);
+  // An invite that came while sync was off: Teams opens with it once sync is on.
+  const [waitingInvite, setWaitingInvite] = useState<Link | null>(null);
+  useEffect(() => {
+    if (!waitingInvite || !syncStatus?.enabled || syncStatus.signedOut) return;
+    setWaitingInvite(null);
+    setNotice("");
+    openLink.current({ link: waitingInvite, error: null });
+  }, [waitingInvite, syncStatus?.enabled, syncStatus?.signedOut]);
 
   useEffect(() => {
     if (orgList.length === 0) return setLockedOrgs(new Set());
@@ -332,6 +345,9 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
     if (tabs.length === 0) setMobile(onPhone || narrow);
   }, [narrow, tabs.length]);
   const [view, setView] = useState<View>({ kind: "quick" });
+  // Home, where the workspace opens and where closing the last page or tab lands: the hosts once
+  // there are any (on a phone, "quick" is the host list already), else quick connect.
+  const home = (): View => (!mobile && hostList.length > 0 ? { kind: "hosts" } : { kind: "quick" });
   // The way back: closing a view returns to the page, editor or session it was opened from.
   const [trail, setTrail] = useState<View[]>([]);
   const open = (v: View) => {
@@ -346,7 +362,8 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
   };
   const close = () => {
     const rest = [...trail];
-    let next: View = { kind: "quick" };
+    // Closing home itself goes to quick connect.
+    let next: View = view.kind === "hosts" ? { kind: "quick" } : home();
     while (rest.length) {
       const v = rest.pop()!;
       if (v.kind !== "tab" || tabs.some((t) => t.key === v.key)) {
@@ -422,9 +439,14 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
     [vaults, refresh],
   );
 
+  const [loaded, setLoaded] = useState(false);
   useEffect(() => {
-    void refresh();
+    void refresh().then(() => setLoaded(true));
   }, [refresh]);
+  // Opened (unlocked) with hosts: home is the hosts, unless a link filled in quick connect meanwhile.
+  useEffect(() => {
+    if (loaded && view.kind === "quick" && !linked?.connect) setView(home());
+  }, [loaded]);
 
   useEffect(() => {
     if (view.kind === "tab" && tabs.find((t) => t.key === view.key)?.kind === "terminal") setLastTerminal(view.key);
@@ -564,7 +586,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
       // The next pane of the same split, else the last tab.
       const sibling = splitOf(view.key) && panes(splitOf(view.key)!.layout).find((k) => !keys.includes(k));
       const next = sibling ?? rest.at(-1)?.key;
-      setView(next !== undefined ? { kind: "tab", key: next } : { kind: "quick" });
+      setView(next !== undefined ? { kind: "tab", key: next } : home());
     }
   };
   const closeTab = (key: number) => closeTabs([key]);
@@ -896,6 +918,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           onOpenGroup={(id) => open({ kind: "groupPage", id })}
           onImport={() => open({ kind: "importHosts" })}
           onCloud={() => open({ kind: "cloud" })}
+          onQuickConnect={mobile ? undefined : () => open({ kind: "quick" })}
           onClose={close}
         />
       )}
diff --git a/apps/desktop/src/Licenses.tsx b/apps/desktop/src/Licenses.tsx
index 040cb21..52bc214 100644
--- a/apps/desktop/src/Licenses.tsx
+++ b/apps/desktop/src/Licenses.tsx
@@ -5,7 +5,7 @@ interface Component {
   version?: string;
   /** SPDX expression, as the package declares it. */
   license: string;
-  kind: "crate" | "npm" | "font" | "android";
+  kind: "crate" | "npm" | "font" | "data" | "android";
   url?: string;
   /** Indexes into `texts`. */
   texts: number[];
@@ -21,7 +21,7 @@ interface Notices {
 // missing under `npm run dev`. Loaded when this opens: it's most of a megabyte.
 const generated = import.meta.glob<Notices>("./generated/licenses.json", { import: "default" });
 
-const KINDS: Record<Component["kind"], string> = { crate: "Rust crate", npm: "npm package", font: "font", android: "Android library" };
+const KINDS: Record<Component["kind"], string> = { crate: "Rust crate", npm: "npm package", font: "font", data: "word list", android: "Android library" };
 
 /** About → Open-source licenses: the third-party components in this build, with their notices. */
 export function Licenses({ onBack }: { onBack: () => void }) {
diff --git a/apps/desktop/src/Lists.tsx b/apps/desktop/src/Lists.tsx
index 5199ce9..f36dc17 100644
--- a/apps/desktop/src/Lists.tsx
+++ b/apps/desktop/src/Lists.tsx
@@ -247,6 +247,8 @@ interface HostsProps {
   /** Hosts from OpenSSH's configuration (desktop). */
   onImport: () => void;
   onCloud: () => void;
+  /** Quick connect, to a host not saved (desktop, where this page is home once there are hosts). */
+  onQuickConnect?: () => void;
   /** After a change made here (several deleted, moved to a group). */
   onChanged: () => void;
   onClose: () => void;
@@ -272,6 +274,11 @@ export function HostsPage(p: HostsProps) {
       onClose={p.onClose}
       actions={
         <>
+          {p.onQuickConnect && (
+            <button type="button" className="secondary" onClick={p.onQuickConnect}>
+              Quick connect
+            </button>
+          )}
           {!mobileOs && (
             <button type="button" className="secondary" onClick={p.onImport}>
               Import…
diff --git a/apps/desktop/src/SyncPanel.tsx b/apps/desktop/src/SyncPanel.tsx
index 2cc8464..f32fa4f 100644
--- a/apps/desktop/src/SyncPanel.tsx
+++ b/apps/desktop/src/SyncPanel.tsx
@@ -5,7 +5,6 @@ import {
   platformName,
   errorText,
   isTotpRequired,
-  openLink,
   ownsTeam,
   sync,
   totpTitle,
@@ -22,6 +21,7 @@ import {
 import { Page } from "./Page";
 import { HOSTED_SERVER, SyncServerField } from "./SyncServerField";
 import { isTotpCode, TotpCode } from "./TotpCode";
+import { TermsCheck, TermsLinks } from "./Terms";
 import { RecoveryCode } from "./VaultGate";
 import { mobileOs } from "./mobile/useMobile";
 
@@ -470,32 +470,6 @@ function Setup({ onChanged, onJoined }: { onChanged: () => void; onJoined: (emai
   );
 }
 
-/** The server's terms of use and privacy policy, each opening in the browser. */
-function TermsLinks({ terms }: { terms: SyncTerms }) {
-  return (
-    <>
-      <button type="button" className="link inline" onClick={() => void openLink(terms.termsUrl)}>
-        terms of use
-      </button>{" "}
-      and the{" "}
-      <button type="button" className="link inline" onClick={() => void openLink(terms.privacyUrl)}>
-        privacy policy
-      </button>
-    </>
-  );
-}
-
-function TermsCheck({ terms, accepted, onChange }: { terms: SyncTerms; accepted: boolean; onChange: (v: boolean) => void }) {
-  return (
-    <label className="check terms-check">
-      <input type="checkbox" checked={accepted} onChange={(e) => onChange(e.target.checked)} />
-      <span>
-        I accept the <TermsLinks terms={terms} />.
-      </span>
-    </label>
-  );
-}
-
 /** The server's terms changed since this account accepted them. */
 function TermsUpdate({ terms, onDone }: { terms: SyncTerms; onDone: () => void }) {
   const { busy, error, run } = useStep();
diff --git a/apps/desktop/src/SyncServerField.tsx b/apps/desktop/src/SyncServerField.tsx
index 92bb4f5..db4acf9 100644
--- a/apps/desktop/src/SyncServerField.tsx
+++ b/apps/desktop/src/SyncServerField.tsx
@@ -1,4 +1,4 @@
-import { useState, type ReactNode } from "react";
+import { useEffect, useState, type ReactNode } from "react";
 
 /** MorphGate's hosted sync service, the default choice. */
 export const HOSTED_SERVER = "https://morphgate.com";
@@ -28,6 +28,13 @@ export function SyncServerField({ value, onChange, action }: Props) {
     setOwn(mine);
     onChange(mine ? address : HOSTED_SERVER);
   };
+  // Set from outside (the server an invite names): shown as chosen.
+  useEffect(() => {
+    if (value === (own ? address : HOSTED_SERVER)) return;
+    const mine = value !== HOSTED_SERVER;
+    setOwn(mine);
+    if (mine) setAddress(value);
+  }, [value]);
   return (
     <div className="stack sync-server">
       <span className="field-label">Sync server</span>
diff --git a/apps/desktop/src/Terms.tsx b/apps/desktop/src/Terms.tsx
new file mode 100644
index 0000000..edf2601
--- /dev/null
+++ b/apps/desktop/src/Terms.tsx
@@ -0,0 +1,27 @@
+import { openLink, type SyncTerms } from "./api";
+
+/** The server's terms of use and privacy policy, each opening in the browser. */
+export function TermsLinks({ terms }: { terms: SyncTerms }) {
+  return (
+    <>
+      <button type="button" className="link inline" onClick={() => void openLink(terms.termsUrl)}>
+        terms of use
+      </button>{" "}
+      and the{" "}
+      <button type="button" className="link inline" onClick={() => void openLink(terms.privacyUrl)}>
+        privacy policy
+      </button>
+    </>
+  );
+}
+
+export function TermsCheck({ terms, accepted, onChange }: { terms: SyncTerms; accepted: boolean; onChange: (v: boolean) => void }) {
+  return (
+    <label className="check terms-check">
+      <input type="checkbox" checked={accepted} onChange={(e) => onChange(e.target.checked)} />
+      <span>
+        I accept the <TermsLinks terms={terms} />.
+      </span>
+    </label>
+  );
+}
diff --git a/apps/desktop/src/VaultGate.tsx b/apps/desktop/src/VaultGate.tsx
index 03b47ad..39d822e 100644
--- a/apps/desktop/src/VaultGate.tsx
+++ b/apps/desktop/src/VaultGate.tsx
@@ -1,6 +1,22 @@
-import { useEffect, useState, type FormEvent, type ReactNode } from "react";
-import { device, errorText, isCancelled, isTotpRequired, presenceName, sync, vault, type PasswordStrength, type PresenceKind } from "./api";
+import { listen } from "@tauri-apps/api/event";
+import { useEffect, useRef, useState, type FormEvent, type ReactNode } from "react";
+import {
+  device,
+  errorText,
+  isCancelled,
+  isTotpRequired,
+  links,
+  presenceName,
+  sync,
+  teams,
+  vault,
+  type InvitePreview,
+  type PasswordStrength,
+  type PresenceKind,
+  type SyncServer,
+} from "./api";
 import { HOSTED_SERVER, SyncServerField } from "./SyncServerField";
+import { TermsCheck } from "./Terms";
 import { isTotpCode, TotpCode } from "./TotpCode";
 import appIcon from "./assets/brand/app-icon.svg";
 import { MobileUnlock } from "./mobile/MobileUnlock";
@@ -8,27 +24,37 @@ import { onPhone, useMobile } from "./mobile/useMobile";
 
 const MIN_CHARS = 10;
 
-/** The app icon over a card; `footnote` explains the screen's circumstances under it. */
-/** First run: start a new vault, or sign in to the one already synced from another device. */
-function StartChoice({ signIn, onChange }: { signIn: boolean; onChange: (signIn: boolean) => void }) {
+/** How the first screen starts: a vault on this device only, a vault with an account that syncs
+ * it, or signing in to the account already used on another device. */
+type Start = "vault" | "account" | "signIn";
+
+const STARTS: [Start, string][] = [
+  ["vault", "New vault"],
+  ["account", "New account"],
+  ["signIn", "Sign in"],
+];
+
+function StartChoice({ value, onChange }: { value: Start; onChange: (s: Start) => void }) {
   return (
-    <div className="segmented two gate-choice" role="radiogroup" aria-label="How to start">
-      <button type="button" role="radio" aria-checked={!signIn} className={signIn ? "" : "on"} onClick={() => onChange(false)}>
-        New vault
-      </button>
-      <button type="button" role="radio" aria-checked={signIn} className={signIn ? "on" : ""} onClick={() => onChange(true)}>
-        I have an account
-      </button>
+    <div className="segmented gate-choice" role="radiogroup" aria-label="How to start">
+      {STARTS.map(([s, label]) => (
+        <button key={s} type="button" role="radio" aria-checked={value === s} className={value === s ? "on" : ""} onClick={() => onChange(s)}>
+          {label}
+        </button>
+      ))}
     </div>
   );
 }
 
+/** The app icon over a card; `footnote` explains the screen's circumstances under it. */
 function Card({
   title,
   lead,
   footnote,
   choice,
   notice,
+  invite,
+  after,
   children,
 }: {
   title: string;
@@ -37,6 +63,10 @@ function Card({
   choice?: ReactNode;
   /** Above everything: why the app is back at the start (the device was erased). */
   notice?: ReactNode;
+  /** An invite waiting for an account (`InviteNote`). */
+  invite?: ReactNode;
+  /** Under the form. */
+  after?: ReactNode;
   children: ReactNode;
 }) {
   return (
@@ -44,18 +74,112 @@ function Card({
       <img className="gate-icon" src={appIcon} alt="MorphGate" width={56} height={56} />
       <div className="gate-card">
         {notice && <p className="notice-box warn gate-notice">{notice}</p>}
+        {invite}
         {choice}
         <div className="gate-head">
           <h1>{title}</h1>
           <p className="lead">{lead}</p>
         </div>
         {children}
+        {after}
       </div>
       {footnote && <p className="gate-footnote">{footnote}</p>}
     </div>
   );
 }
 
+/** An invite to a team that waits for an account: from a link opened before there was a vault,
+ * or pasted on this screen. It stays waiting until the workspace opens Teams with it. */
+interface PendingInvite {
+  token: string;
+  /** The server the link names; none for a bare code (MorphGate's is asked). */
+  server: string | null;
+  preview: InvitePreview | null;
+  /** Why it couldn't be looked up (only said when the link named its server). */
+  error: string;
+}
+
+function usePendingInvite(): PendingInvite | null {
+  const [invite, setInvite] = useState<PendingInvite | null>(null);
+  useEffect(() => {
+    let live = true;
+    const look = () =>
+      void links.peek().then((all) => {
+        const found = [...all].reverse().find((r) => r.link?.kind === "invite")?.link;
+        if (!live || found?.kind !== "invite") return;
+        const { token, server } = found;
+        setInvite((cur) => (cur?.token === token ? cur : { token, server, preview: null, error: "" }));
+        const same = (cur: PendingInvite | null) => cur?.token === token;
+        teams.peek(server ?? HOSTED_SERVER, token).then(
+          (preview) => live && setInvite((cur) => (same(cur) ? { ...cur!, preview } : cur)),
+          (e) => live && server && setInvite((cur) => (same(cur) ? { ...cur!, error: errorText(e) } : cur)),
+        );
+      }, () => {});
+    look();
+    const unlisten = listen("links-pending", look);
+    return () => {
+      live = false;
+      void unlisten.then((f) => f());
+    };
+  }, []);
+  return invite;
+}
+
+function InviteNote({ invite }: { invite: PendingInvite }) {
+  const p = invite.preview;
+  if (invite.error) return <p className="notice-box warn gate-invite">This invite can't be opened: {invite.error}</p>;
+  return (
+    <p className="notice-box gate-invite">
+      {p ? (
+        <>
+          {p.inviterEmail || "An admin"} invited <strong>{p.email}</strong> to join <strong>{p.orgName}</strong> as {p.role === "admin" ? "an admin" : "a member"}.
+        </>
+      ) : (
+        "You have an invite to a team."
+      )}{" "}
+      Create your account{p ? " with that address" : ""}, or sign in if you have one: Teams then opens with the invite.
+    </p>
+  );
+}
+
+/** "Joining a team?": the invite's code, or its link, pasted in. */
+function PasteInvite() {
+  const [open, setOpen] = useState(false);
+  const [text, setText] = useState("");
+  const [error, setError] = useState("");
+  if (!open) {
+    return (
+      <button type="button" className="link align-start" onClick={() => setOpen(true)}>
+        Joining a team? Paste your invite
+      </button>
+    );
+  }
+  return (
+    <form
+      className="stack"
+      onSubmit={(e) => {
+        e.preventDefault();
+        setError("");
+        links.addInvite(text).catch((err) => setError(errorText(err)));
+      }}
+    >
+      <label>
+        <span>Invite code or link</span>
+        <input value={text} onChange={(e) => setText(e.target.value)} autoFocus spellCheck={false} autoComplete="off" />
+      </label>
+      {error && <p className="error">{error}</p>}
+      <div className="row">
+        <button type="button" className="secondary" onClick={() => (setOpen(false), setError(""))}>
+          Cancel
+        </button>
+        <button type="submit" className="primary grow" disabled={!text.trim()}>
+          Use this invite
+        </button>
+      </div>
+    </form>
+  );
+}
+
 const PresenceIcon = () => (
   <svg viewBox="0 0 24 24" width="20" height="20" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" aria-hidden="true">
     <path d="M5 11a7 7 0 0 1 14 0v2" />
@@ -107,11 +231,28 @@ export function NewPasswordFields({
   strength: PasswordStrength | null;
 }) {
   const s = meter(password, strength);
+  // A suggestion is shown, in the clear, while both fields still hold it.
+  const [suggested, setSuggested] = useState("");
+  const [error, setError] = useState("");
+  const suggest = () => {
+    setError("");
+    vault.suggest().then(
+      (p) => (setSuggested(p), setPassword(p), setConfirm(p)),
+      (e) => setError(errorText(e)),
+    );
+  };
+  const showing = suggested !== "" && password === suggested && confirm === suggested;
   return (
     <>
       <label>
         <span>{label}</span>
-        <input type="password" autoFocus={autoFocus} value={password} onChange={(e) => setPassword(e.target.value)} autoComplete="new-password" />
+        <input
+          type="password"
+          autoFocus={autoFocus}
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          autoComplete="new-password"
+        />
       </label>
       <div className={`meter l${s.level}`} aria-label={`Password strength: ${s.label}`}>
         <i />
@@ -119,6 +260,22 @@ export function NewPasswordFields({
         <i />
         <small>{password ? s.label : `At least ${MIN_CHARS} characters, not easy to guess: a few unrelated words make a strong one.`}</small>
       </div>
+      {showing ? (
+        <div className="notice-box stack suggested-password">
+          <span className="mono" aria-label="Suggested password">
+            {suggested}
+          </span>
+          <small className="hint">Five random words. Write them down, or save them in a password manager: you'll need them to unlock MorphGate.</small>
+          <button type="button" className="link align-start" onClick={suggest}>
+            Suggest another
+          </button>
+        </div>
+      ) : (
+        <button type="button" className="link align-start" onClick={suggest}>
+          Suggest a strong password
+        </button>
+      )}
+      {error && <p className="error">{error}</p>}
       <label>
         <span>Repeat password</span>
         <input type="password" value={confirm} onChange={(e) => setConfirm(e.target.value)} autoComplete="new-password" />
@@ -166,10 +323,31 @@ export function RecoveryCode({ code, action, onDone }: { code: string; action: s
   );
 }
 
-function SignIn({ onDone, onBack, notice }: { onDone: () => void; onBack: () => void; notice?: ReactNode }) {
+/** What the first screen's forms share: the choice, its notes, and what an invite fills in. */
+interface StartProps {
+  choice: ReactNode;
+  notice?: ReactNode;
+  invite: PendingInvite | null;
+  after?: ReactNode;
+}
+
+/** The server and address an invite names, once known (unless already typed in). */
+function useInviteFill(invite: PendingInvite | null, setServer: (s: string) => void, setEmail: (f: (e: string) => string) => void) {
+  const server = invite?.server;
+  const email = invite?.preview?.email;
+  useEffect(() => {
+    if (server) setServer(server);
+  }, [server]);
+  useEffect(() => {
+    if (email) setEmail((e) => e || email);
+  }, [email]);
+}
+
+function SignIn({ onDone, choice, notice, invite, after }: StartProps & { onDone: () => void }) {
   const [recover, setRecover] = useState(false);
-  const [server, setServer] = useState(HOSTED_SERVER);
-  const [email, setEmail] = useState("");
+  const [server, setServer] = useState(invite?.server ?? HOSTED_SERVER);
+  const [email, setEmail] = useState(invite?.preview?.email ?? "");
+  useInviteFill(invite, setServer, setEmail);
   const [password, setPassword] = useState("");
   const [code, setCode] = useState("");
   const [confirm, setConfirm] = useState("");
@@ -199,7 +377,9 @@ function SignIn({ onDone, onBack, notice }: { onDone: () => void; onBack: () =>
   return (
     <Card
       notice={notice}
-      choice={<StartChoice signIn onChange={(s) => s || onBack()} />}
+      invite={invite && <InviteNote invite={invite} />}
+      choice={choice}
+      after={after}
       title={recover ? "Reset password and sign in" : "Sign in to sync"}
       lead={
         recover
@@ -255,7 +435,6 @@ function SignIn({ onDone, onBack, notice }: { onDone: () => void; onBack: () =>
   );
 }
 
-/** `onDone(true)`: a new vault; `onDone(false)`: one joined through sync. */
 /** Why this device was erased (`device-erased`): it's back at the start. */
 export interface Erased {
   reason: "signedOut" | "disconnected";
@@ -265,17 +444,187 @@ export interface Erased {
 function erasedNotice(e: Erased): string {
   const account = e.email ?? "its sync account";
   return e.reason === "signedOut"
-    ? `This device was signed out of ${account} from another device, so MorphGate removed everything it kept here. To use the account again, sign in under “I have an account”.`
-    : `MorphGate removed everything it kept on this device. Your vaults are still in ${e.email ?? "your sync account"}: sign in under “I have an account” to get them back.`;
+    ? `This device was signed out of ${account} from another device, so MorphGate removed everything it kept here. To use the account again, choose “Sign in”.`
+    : `MorphGate removed everything it kept on this device. Your vaults are still in ${e.email ?? "your sync account"}: choose “Sign in” to get them back.`;
+}
+
+/** A new vault and the account that syncs it, in one go: the vault is created here, then the
+ * account with the same master password (after the emailed code, on servers that check). */
+function NewAccount({
+  onDone,
+  onSignIn,
+  choice,
+  notice,
+  invite,
+  after,
+}: StartProps & { onDone: (created: boolean) => void; onSignIn: () => void }) {
+  const [server, setServer] = useState(invite?.server ?? HOSTED_SERVER);
+  const [checked, setChecked] = useState<SyncServer | null>(null);
+  const [email, setEmail] = useState(invite?.preview?.email ?? "");
+  const [password, setPassword] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [accepted, setAccepted] = useState(false);
+  // Servers that verify addresses mail a code first; null until it was sent.
+  const [emailCode, setEmailCode] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  // The vault's recovery key once it's created (before the account, which may still fail).
+  const [created, setCreated] = useState<string | null>(null);
+  // Shown once everything is done (or the account is skipped).
+  const [recovery, setRecovery] = useState<{ code: string; account: boolean } | null>(null);
+  useInviteFill(invite, setServer, setEmail);
+  const strength = usePasswordStrength(password);
+  const terms = checked?.terms ?? null;
+
+  // What the server asks for (its terms, a mailed code) shows before anything is typed.
+  useEffect(() => {
+    let live = true;
+    setChecked(null);
+    const t = setTimeout(() => void sync.check(server).then((c) => live && setChecked(c), () => {}), server === HOSTED_SERVER ? 0 : 600);
+    return () => {
+      live = false;
+      clearTimeout(t);
+    };
+  }, [server]);
+
+  const ok =
+    server.trim() !== "" &&
+    email.includes("@") &&
+    (created !== null || (!!strength?.ok && password === confirm)) &&
+    (terms === null || accepted) &&
+    (emailCode === null || isTotpCode(emailCode));
+
+  const submit = async (e: FormEvent) => {
+    e.preventDefault();
+    if (!ok) return;
+    setBusy(true);
+    setError("");
+    try {
+      const caps = checked ?? (await sync.check(server));
+      setChecked(caps);
+      if (caps.terms && !accepted) return setError("Accept the terms of use and the privacy policy first.");
+      if (emailCode === null && caps.emailVerification) {
+        await sync.startRegistration(server, email);
+        setEmailCode("");
+        return;
+      }
+      const code = created ?? (await vault.create(password));
+      setCreated(code);
+      const r = await sync.enable(server, email, password, emailCode ?? undefined, caps.terms && accepted ? caps.terms.version : undefined);
+      setPassword("");
+      setConfirm("");
+      setRecovery({ code: r.recoveryCode ?? code, account: true });
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  if (recovery) {
+    return (
+      <Card
+        title="Save your recovery key"
+        lead={
+          recovery.account
+            ? "It is the only way back in if you forget your master password, here and for your account. MorphGate cannot reset it for you, and it will not be shown again."
+            : "It is the only way back in if you forget your master password. MorphGate cannot reset it for you, and it will not be shown again."
+        }
+        footnote="Hosts, keys and passwords are encrypted on this device with your master password. It never leaves this device."
+      >
+        <RecoveryCode code={recovery.code} action="Open my vault" onDone={() => onDone(!recovery.account)} />
+      </Card>
+    );
+  }
+
+  const asking = emailCode === null && !!checked?.emailVerification;
+  return (
+    <Card
+      notice={notice}
+      invite={invite && <InviteNote invite={invite} />}
+      choice={choice}
+      after={after}
+      title="Create your account"
+      lead="A vault encrypted on this device with your master password, kept on your other devices through sync. The server stores only ciphertext."
+    >
+      <form className="stack" onSubmit={(e) => void submit(e)}>
+        <SyncServerField value={server} onChange={(v) => (setServer(v), setEmailCode(null), setAccepted(false))} />
+        {checked && !checked.registrationOpen && <p className="warn">This server isn't accepting new accounts.</p>}
+        <label>
+          <span>Email</span>
+          <input
+            type="email"
+            value={email}
+            onChange={(e) => (setEmail(e.target.value), setEmailCode(null))}
+            autoComplete="username"
+            autoFocus={!onPhone && !invite}
+          />
+        </label>
+        {!created && (
+          <NewPasswordFields password={password} confirm={confirm} setPassword={setPassword} setConfirm={setConfirm} autoFocus={false} strength={strength} />
+        )}
+        <p className="hint">
+          {created
+            ? "Your vault is ready, with the master password you chose. The account gets the same one."
+            : "Your master password also signs you in to your account. It never leaves this device: only a key derived from it does."}
+        </p>
+        {confirm && password !== confirm && !created && <p className="error">Passwords don't match.</p>}
+        {emailCode !== null && (
+          <>
+            <TotpCode value={emailCode} onChange={setEmailCode} label={`Code sent to ${email}`} />
+            <p className="hint">
+              Didn't get it? Check spam, or{" "}
+              <button
+                type="button"
+                className="link inline"
+                onClick={() => sync.startRegistration(server, email).catch((err) => setError(errorText(err)))}
+              >
+                send a new code
+              </button>
+              . If this address already has an account, you got an email saying so instead
+              {created ? (
+                "."
+              ) : (
+                <>
+                  :{" "}
+                  <button type="button" className="link inline" onClick={onSignIn}>
+                    sign in to it
+                  </button>
+                  .
+                </>
+              )}
+            </p>
+          </>
+        )}
+        {terms && <TermsCheck terms={terms} accepted={accepted} onChange={setAccepted} />}
+        {error && <p className="error">{error}</p>}
+        <button className="primary large" type="submit" disabled={!ok || busy}>
+          {busy ? (asking ? "Sending code…" : created ? "Creating account…" : "Creating vault and account…") : asking ? "Continue" : "Create account"}
+        </button>
+        {created && (
+          <button type="button" className="link" onClick={() => setRecovery({ code: created, account: false })}>
+            Use the vault without an account for now
+          </button>
+        )}
+      </form>
+    </Card>
+  );
 }
 
+/** `onDone(true)`: a new vault without sync (sync is offered next); `onDone(false)`: sync is on. */
 export function SetupScreen({ onDone, erased }: { onDone: (created: boolean) => void; erased?: Erased | null }) {
   const [password, setPassword] = useState("");
   const [confirm, setConfirm] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
   const [code, setCode] = useState<string | null>(null);
-  const [signIn, setSignIn] = useState(false);
+  const invite = usePendingInvite();
+  const [start, setStart] = useState<Start>("vault");
+  // An invite needs an account: it's what the screen offers first, until something is chosen.
+  const chose = useRef(false);
+  useEffect(() => {
+    if (invite && !chose.current) setStart("account");
+  }, [invite?.token]);
 
   const strength = usePasswordStrength(password);
   const ok = !!strength?.ok && password === confirm;
@@ -297,7 +646,21 @@ export function SetupScreen({ onDone, erased }: { onDone: (created: boolean) =>
   };
 
   const notice = erased ? erasedNotice(erased) : undefined;
-  if (signIn) return <SignIn onDone={() => onDone(false)} onBack={() => setSignIn(false)} notice={notice} />;
+  const choice = <StartChoice value={start} onChange={(s) => ((chose.current = true), setStart(s))} />;
+  const after = invite ? undefined : <PasteInvite />;
+  if (start === "signIn") return <SignIn onDone={() => onDone(false)} choice={choice} notice={notice} invite={invite} after={after} />;
+  if (start === "account") {
+    return (
+      <NewAccount
+        onDone={onDone}
+        onSignIn={() => ((chose.current = true), setStart("signIn"))}
+        choice={choice}
+        notice={notice}
+        invite={invite}
+        after={after}
+      />
+    );
+  }
 
   if (code) {
     return (
@@ -314,7 +677,9 @@ export function SetupScreen({ onDone, erased }: { onDone: (created: boolean) =>
   return (
     <Card
       notice={notice}
-      choice={<StartChoice signIn={false} onChange={setSignIn} />}
+      invite={invite && <InviteNote invite={invite} />}
+      choice={choice}
+      after={after}
       title="Create your vault"
       lead="Hosts, keys and passwords are encrypted on this device with your master password. It never leaves this device."
     >
diff --git a/apps/desktop/src/api.ts b/apps/desktop/src/api.ts
index 1b1fa05..5eee015 100644
--- a/apps/desktop/src/api.ts
+++ b/apps/desktop/src/api.ts
@@ -117,6 +117,8 @@ export interface PasswordStrength {
 export const vault = {
   /** How strong a master password would be (desktop and phone check alike). */
   strength: (password: string) => invoke<PasswordStrength>("password_strength", { password }),
+  /** Five random words from EFF's long wordlist: a master password to suggest. */
+  suggest: () => invoke<string>("password_suggest"),
   status: () => invoke<VaultStatus>("vault_status"),
   /** Resolves to the recovery code, shown once. */
   create: (password: string) => invoke<string>("vault_create", { password }),
@@ -881,6 +883,8 @@ export const teams = {
   invites: (orgId: string) => invoke<InviteView[]>("org_invites", { orgId }),
   cancelInvite: (orgId: string, inviteId: string) => invoke<void>("org_invite_cancel", { orgId, inviteId }),
   preview: (token: string) => invoke<InvitePreview>("invite_preview", { token }),
+  /** What an invite is for, before there's an account (no sign-in needed). */
+  peek: (server: string, token: string) => invoke<InvitePreview>("invite_peek", { server, token }),
   /** `fingerprint`: the owner's, as compared; joining fails if it no longer matches. */
   accept: (token: string, fingerprint: string) => invoke<string>("invite_accept", { token, fingerprint }),
   confirm: (orgId: string, accountId: string, fingerprint: string) =>
@@ -928,6 +932,11 @@ export interface ReceivedLink {
 export const links = {
   /** The links received since the last call (waiting while the vault was locked). */
   take: () => invoke<ReceivedLink[]>("links_take"),
+  /** The same, left waiting (the first screen shows an invite before there's a vault). */
+  peek: () => invoke<ReceivedLink[]>("links_peek"),
+  /** An invite pasted on the first screen (its code, its web page, or a morphgate:// link): it
+   * waits with the other links, for Teams once there's an account. */
+  addInvite: (text: string) => invoke<void>("links_add_invite", { text }),
 };
 
 // ------------------------------------------------------------------ SSH agents
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index 40f8bf8..51135b4 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -481,6 +481,13 @@ button.with-icon {
   color: var(--ink-muted);
 }
 
+/* A suggested master password, in the clear while both fields hold it. */
+.suggested-password .mono {
+  font-size: 15px;
+  overflow-wrap: anywhere;
+  user-select: all;
+}
+
 .meter {
   display: grid;
   grid-template-columns: repeat(3, 1fr);
diff --git a/docs/features/account-and-devices.md b/docs/features/account-and-devices.md
index 1964a9e..8c52e08 100644
--- a/docs/features/account-and-devices.md
+++ b/docs/features/account-and-devices.md
@@ -57,7 +57,7 @@ A device signed out from elsewhere learns it on its next token refresh: `401 dev
 4. drops the sync session and what the last rounds learnt (`SyncState::forget`);
 5. emits `device-erased` with `{reason, email}`, and the window returns to the first screen with:
 
-> This device was signed out of {email} from another device, so MorphGate removed everything it kept here. To use the account again, sign in under “I have an account”.
+> This device was signed out of {email} from another device, so MorphGate removed everything it kept here. To use the account again, choose “Sign in”.
 
 The spec's reason: the account signed this device out, so the device forgets what it keeps from the account. Every other `401` on refresh only means "sign in again" and keeps the data; see [Sync](sync.md#tokens).
 
@@ -72,7 +72,7 @@ The spec's reason: the account signed this device out, so the device forgets wha
 
 Both first end the session with `POST /v1/auth/logout` when one is open, ignoring errors: offline, the session stays on the server until it expires or another device signs this one out.
 
-- **Remove everything** runs `erase_device(app, "disconnected")` as above, and the first screen says: "MorphGate removed everything it kept on this device. Your vaults are still in {email}: sign in under “I have an account” to get them back." Unsynced changes are lost.
+- **Remove everything** runs `erase_device(app, "disconnected")` as above, and the first screen says: "MorphGate removed everything it kept on this device. Your vaults are still in {email}: choose “Sign in” to get them back." Unsynced changes are lost.
 - **Keep a copy** runs `disable_sync()`: it deletes the sync settings and token, the team vaults and organizations (they belong to the team on the server) and tombstones, and marks every remaining item unsynced (`rev` 0, dirty) with every vault's `head_rev` back to 0. Unsynced changes stay. Turning sync on again, on any server, uploads the whole personal vault.
 
 Moving to another server: on one device **Keep a copy here**, then **Enable sync** with the new address. Other devices either remove everything and sign in on the first screen, or keep a copy and use **I have an account** in the Sync panel; their items join the account's vault with the same ids, so identical items merge and differing ones become "(conflict)" copies ([Sync](sync.md#conflicts)).
@@ -97,7 +97,7 @@ The master password and the recovery key are the account's, so with sync on the
 | Change the master password (Security) | `vault_change_password` | `account::change_password`: checks the current password here and prepares new KDF parameters, AuthKey and wrapped keys, sends `PUT /v1/account/keys {current_auth_key, new_kdf, new_auth_key, wrapped_private_keys}`, then applies them here. The server signs the other devices out; each shows **Sign in again** and, with the new password, re-wraps its own keys (`sign_in_again`, `adopt_credentials`) |
 | New recovery key (Security) | `vault_new_recovery_code` | `account::new_recovery_key`: the same request with the password unchanged and a new `recovery {wrapped_private_keys_rk, recovery_proof}`. Nobody is signed out; the old code stops working on the server too |
 | Forgot the password, on a synced device (unlock screen) | `vault_recover` | `account::recover`: `POST /v1/account/recover {email, recovery_proof}` returns the recovery-wrapped keys and a short-lived token that only allows `PUT /v1/account/keys`; the new credentials are made here from the recovery code and sent without a current AuthKey; then the device signs in again with the new password and its own device id, without a code (recovery turns two-step verification off), and only then stores them. Every other device is signed out |
-| Forgot the password, fresh device (**I have an account**, **Forgot the master password? Use your recovery key**) | `sync_recover_sign_in` | `account::recover_and_sign_in`: the same on the server, then an ordinary sign-in with the new password ([Sync](sync.md#signing-in)) |
+| Forgot the password, fresh device (**Sign in**, **Forgot the master password? Use your recovery key**) | `sync_recover_sign_in` | `account::recover_and_sign_in`: the same on the server, then an ordinary sign-in with the new password ([Sync](sync.md#signing-in)) |
 
 A recovery code the server doesn't accept is "the sync server doesn't accept this recovery code for that account". While signed out, account changes stop at "this device is signed out of sync; sign in again (Sync panel) before changing the account". Server side: `PUT /v1/account/keys` and `POST /v1/account/recover` in `spec/openapi.yaml`, and the single-use recovery token in the [spec](../sync-crypto-spec.md#auth--devices).
 
diff --git a/docs/features/deep-links.md b/docs/features/deep-links.md
index a11bad6..ae03f99 100644
--- a/docs/features/deep-links.md
+++ b/docs/features/deep-links.md
@@ -41,7 +41,7 @@ A refused link shows a banner: "MorphGate can't open this link: {reason}".
 | Another scheme (`https://…`) handed to the app | Dropped silently (`received()` keeps only its own schemes) | |
 | `connect` | Fills in host, port, user and label only. The person picks how to sign in, and the host key is checked as for any connection | Connecting is the person's decision; a link could point at a look-alike host |
 | Host or user with other characters (`a;rm -rf`, `root;id`) | Refused | Only names and addresses get through, never shell syntax or options |
-| `invite` while sync is off or signed out | Notice "This is an invite to a team on {server}. Turn on sync with the invited address first, then open the link again." and the Sync page opens | An invite is accepted by a signed-in account |
+| `invite` while sync is off or signed out | Notice "This is an invite to a team on {server}. Turn on sync with the invited address: Teams opens with the invite once it's on." and the Sync page opens; once sync is on, Teams opens with it | An invite is accepted by a signed-in account |
 | `invite` whose `server` is not the server this device syncs with | Notice "This invite is for a team on {server}, but this device syncs with {other}."; nothing opens | Invite codes are only valid on the server that made them |
 
 Joining still needs the fingerprint check and a click on **Join {team}**; quick connect still needs **Connect**. [Trust boundaries](../architecture.md#trust-boundaries) lists links among the app's inputs.
@@ -51,11 +51,13 @@ Joining still needs the fingerprint check and a click on **Join {team}**; quick
 1. The operating system hands the URL to `tauri-plugin-deep-link`: at launch (`get_current()` in setup) or while running (`on_open_url`).
 2. On Windows and Linux a link starts a second copy of the app. `tauri-plugin-single-instance` (with its `deep-link` feature) passes the URL to the copy already running for this user's vault and the second copy exits. On macOS and the phones the system delivers the URL to the running app.
 3. `links::received()` parses each URL into a `Received {link, error}`, appends it to the `Links` queue, brings the window forward on desktop (`show()`: unminimize, show, focus) and emits `links-pending`.
-4. The unlocked workspace calls `links_take` when it mounts and on every `links-pending`, and opens each link (`openLink` in `App.tsx`). While the vault is locked nothing takes them, so they wait in the queue until unlock.
+4. The unlocked workspace calls `links_take` once it knows whether sync is on, and on every `links-pending`, and opens each link (`openLink` in `App.tsx`). While the vault is locked nothing takes them, so they wait in the queue until unlock. Before there's a vault, the first screen shows a waiting invite without taking it ([First run](vault-and-unlock.md#first-run)).
 
 | Command or event | Does |
 | --- | --- |
 | `links_take` | Returns and empties the queue of received links |
+| `links_peek` | Returns the queue, leaving it as it is |
+| `links_add_invite` | An invite pasted on the first screen: its code, `https://…/invite/{code}`, or a `morphgate://invite` link (`pasted_invite`). Replaces an invite already waiting |
 | `links-pending` (event) | A link arrived; the workspace takes it |
 
 ## Registering the scheme
diff --git a/docs/features/hosts-groups-identities.md b/docs/features/hosts-groups-identities.md
index 4825d54..00e2f26 100644
--- a/docs/features/hosts-groups-identities.md
+++ b/docs/features/hosts-groups-identities.md
@@ -106,6 +106,8 @@ An `attachment` is `name` (as added, without a path), `host_ref`, `blob` (hex SH
 
 The sidebar (`Sidebar.tsx`) is for connecting; the pages (`Lists.tsx`) are for managing.
 
+On desktop, once the vault has hosts, the Hosts page is home: the workspace opens on it after unlocking, and closing the last tab or page returns to it (`home()` in `App.tsx`). With no hosts, home is quick connect. Closing the Hosts page itself goes to quick connect. On phones the start screen is the host list either way.
+
 | Sidebar part | What it does |
 | --- | --- |
 | Navigation | **Hosts**, **Groups**, **Keys** (keys and identities counted together), **Snippets**, **Tunnels** ("2 on"), **VPNs** ("1 up"), and **Session logs** once a host records |
@@ -115,7 +117,7 @@ The sidebar (`Sidebar.tsx`) is for connecting; the pages (`Lists.tsx`) are for m
 
 | Page | Content |
 | --- | --- |
-| Hosts | **Import…** and **Clouds…** (desktop), **Select**, **New group**, **New host**; "Not in a group", then a section per group with **Edit group** and what its hosts use; rows with **Connect**, **Files**, **Edit**, tags, and badges "gone from AWS" or the machine's state ("stopped") |
+| Hosts | **Quick connect**, **Import…** and **Clouds…** (desktop), **Select**, **New group**, **New host**; "Not in a group", then a section per group with **Edit group** and what its hosts use; rows with **Connect**, **Files**, **Edit**, tags, and badges "gone from AWS" or the machine's state ("stopped") |
 | Groups | Each group with its host count and defaults; **Open**, **Edit** |
 | A group | Its hosts, the tunnels through them, their files (**Save**), and "What its hosts use" (identities, keys, jump hosts, VPNs); **Move to…**, **Edit group** |
 | Keys | Keys, then **Identities** (**New identity**) and **Host CAs** |
diff --git a/docs/features/sync.md b/docs/features/sync.md
index 51ac8b0..f411c90 100644
--- a/docs/features/sync.md
+++ b/docs/features/sync.md
@@ -85,7 +85,7 @@ On a server with `email_verification`, the first **Enable sync** sends `POST /v1
 
 | Where | Command | What it does |
 | --- | --- | --- |
-| First screen, **I have an account**, titled **Sign in to sync** | `sync_sign_in` | For a device with no vault ("This device already has a vault." otherwise): takes the account's keys and vault key, unlocks; items arrive with the first round |
+| First screen, **Sign in**, titled **Sign in to sync** | `sync_sign_in` | For a device with no vault ("This device already has a vault." otherwise): takes the account's keys and vault key, unlocks; items arrive with the first round |
 | Sync panel, **I have an account** | `sync_join` | For a device with a vault of its own that never synced: its items, files included, move into the account's vault with the same ids, and it opens with the account's master password and recovery key from then on. Keychain unlock is set up again with the account's keys (Android's fingerprint unlock goes off). Refused with "this device syncs already" or "this device has team vaults: it synced before". A wrong password changes nothing |
 | Sync panel while signed out, **Sign in again** | `sync_sign_in_again` | Same device id; re-wraps this vault's keys under the account's current password (it may have changed on another device) |
 | First screen, **Forgot the master password? Use your recovery key** | `sync_recover_sign_in` | New password with the recovery key, then a sign-in; see [Account and devices](account-and-devices.md#password-changes-and-recovery) |
diff --git a/docs/features/teams.md b/docs/features/teams.md
index 7dbe9bd..296bc92 100644
--- a/docs/features/teams.md
+++ b/docs/features/teams.md
@@ -82,7 +82,7 @@ Owners and admins see **Invites** beside the team.
 | "This server doesn't email invites. Send this code to {email} (it works once, for that address, for 7 days):", **Copy code**, **Done** | When the server returned the token (`mails_invites: false`) |
 | "Invite emailed to {email}." | Otherwise |
 
-An invite page on the web opens `morphgate://invite?token=…&server=…` (or `morphgate://invite/{token}`). The app opens Teams with the code looked up, after checking that sync is on (otherwise it opens Sync: "Turn on sync with the invited address first, then open the link again") and that `server` is the server this device syncs with. A link never joins by itself. See [Deep links](deep-links.md).
+An invite page on the web opens `morphgate://invite?token=…&server=…` (or `morphgate://invite/{token}`). The app opens Teams with the code looked up, after checking that sync is on (otherwise it opens Sync, and Teams once sync is on) and that `server` is the server this device syncs with. Opened before the app has a vault, the first screen shows the invite and offers a new account with its address ([First run](vault-and-unlock.md#first-run)). A link never joins by itself. See [Deep links](deep-links.md).
 
 ## Joining
 
diff --git a/docs/features/terminal-and-snippets.md b/docs/features/terminal-and-snippets.md
index 064aeec..d59666c 100644
--- a/docs/features/terminal-and-snippets.md
+++ b/docs/features/terminal-and-snippets.md
@@ -76,7 +76,7 @@ A login command wins; the host editor disables the tmux checkbox while one is se
 | `+N` | A split with N more panes; the title says when typing goes to all of them |
 | Close (×) | "Close tab", or "Close the tab and its panes" for a split |
 
-Sessions open from the sidebar (click a host), the Hosts page (**Connect**), and **Quick connect** (the plus at the end of the tab bar). A host can have any number of tabs. Every `TerminalView` stays mounted whatever is shown, so hidden sessions keep running. Locking the vault unmounts the workspace, and each `TerminalView` disconnects as it goes; `vault_lock` itself stops tunnels, SFTP and VPNs. Tabs are kept in memory only: they are not restored after a restart or an unlock.
+Sessions open from the sidebar (click a host), the Hosts page (**Connect**), and **Quick connect** (the plus at the end of the tab bar, or the Hosts page's **Quick connect**). A host can have any number of tabs. Every `TerminalView` stays mounted whatever is shown, so hidden sessions keep running. Locking the vault unmounts the workspace, and each `TerminalView` disconnects as it goes; `vault_lock` itself stops tunnels, SFTP and VPNs. Tabs are kept in memory only: they are not restored after a restart or an unlock.
 
 ## Split panes
 
diff --git a/docs/features/vault-and-unlock.md b/docs/features/vault-and-unlock.md
index 05dd0b6..228774f 100644
--- a/docs/features/vault-and-unlock.md
+++ b/docs/features/vault-and-unlock.md
@@ -66,14 +66,19 @@ Deleting leaves a tombstone (`deleted` 1) holding the signed deletion (`{"type":
 
 ## First run
 
-`App.tsx` shows `SetupScreen` while the status is `uninitialized`. A segmented choice offers **New vault** and **I have an account** (signing in to an existing sync account; see [Account and devices](account-and-devices.md)).
+`App.tsx` shows `SetupScreen` while the status is `uninitialized`. A segmented choice offers **New vault** (on this device only; sync is offered next), **New account** (the vault and the sync account that keeps it on other devices, in one go) and **Sign in** (an existing sync account; see [Sync](sync.md#signing-in)). The same screen, on every platform.
 
 | Step | UI |
 | --- | --- |
-| **Create your vault** | **Master password**, the strength meter, **Repeat password** ("Passwords don't match."), **Create vault** (enabled once the password is strong and repeated; "Deriving keys…" while busy) |
+| **Create your vault** | **Master password**, the strength meter, **Suggest a strong password**, **Repeat password** ("Passwords don't match."), **Create vault** (enabled once the password is strong and repeated; "Deriving keys…" while busy) |
+| **Create your account** | **Sync server**, **Email**, the password fields as above, the server's terms where it has them, **Continue** (the server mails a code: **Code sent to {email}**) or **Create account**. It creates the vault (`vault_create`), then the account with the same password (`sync_enable`). If the account then fails (a wrong code, say), the vault stays and the form keeps the rest: another try needs no new vault, and **Use the vault without an account for now** goes on to the recovery key and the usual sync offer |
 | **Save your recovery key** | The code in groups, **Copy to clipboard** ("Copied", and "MorphGate clears the clipboard when you continue, so the key doesn't stay there."), the checkbox **I stored it somewhere safe, away from this device**, then **Open my vault** (enabled once ticked), which clears the clipboard if the key was copied; a minute on the screen clears it too, where the webview allows that without a click (`RecoveryCode` in `VaultGate.tsx`) |
 
-`vault_create` checks the password (`password::check`), then `LocalVault::create` runs in one transaction: new KDF parameters, the master key, random account keys, a random recovery key, a personal vault (ULID) and its key sealed to the account. It returns the recovery key; the command returns its code, which the UI shows once and never stores. A freshly created vault then gets a one-time offer to turn on sync. After a device was erased, the first screen says why above the form (see [Resetting](#resetting)).
+`vault_create` checks the password (`password::check`), then `LocalVault::create` runs in one transaction: new KDF parameters, the master key, random account keys, a random recovery key, a personal vault (ULID) and its key sealed to the account. It returns the recovery key; the command returns its code, which the UI shows once and never stores. A vault created without an account then gets a one-time offer to turn on sync. After a device was erased, the first screen says why above the form (see [Resetting](#resetting)).
+
+**Invited before there's a vault.** An invite link opened before the vault exists (the website's **Open in MorphGate**) waits in the link queue; the first screen reads it without taking it (`links_peek`) and looks it up on the server the link names, which needs no account (`invite_peek`, `GET /v1/invites/{token}`). Above the choice: "{inviter} invited {email} to join {team} as a member. Create your account with that address, or sign in if you have one: Teams then opens with the invite." The choice starts on **New account** with the server and address filled in. Without a link, **Joining a team? Paste your invite** takes the code, the invite page's address or a `morphgate://invite` link (`links_add_invite`) and does the same; a bare code is looked up on morphgate.com, quietly. Once there's an account, the workspace takes the invite and opens Teams with it looked up ([Deep links](deep-links.md)).
+
+**Suggested passwords.** **Suggest a strong password** (in `NewPasswordFields`, so also for recovery and password change) asks `password_suggest`: five words picked with the system's random generator from EFF's long wordlist (`src-tauri/wordlist/`, 7772 words without the four that contain a hyphen, about 64 bits), joined by hyphens, drawn again in the rare case the strength check would refuse them. Both fields get it, and it shows in the clear under the meter ("Five random words. Write them down, or save them in a password manager: you'll need them to unlock MorphGate.") with **Suggest another**, until either field changes. Never a fixed example: those end up in cracking wordlists.
 
 ## Master password rules
 
@@ -125,7 +130,7 @@ The timer is the webview's (`useIdleLock` in `App.tsx`): `keydown`, `mousedown`,
 
 The code is shown once, at creation and when a new one is made (`RecoveryCode`: copy, the "I stored it somewhere safe" checkbox, then the action button). Neither the key nor the code is stored.
 
-**Forgot the password, on this device.** **Forgot password? Use your recovery key** opens **Use your recovery key**: **Recovery key** (a text area), **Master password**, **Repeat password**, **Set new password** ("Re-encrypting…"), **Back to unlock**. The footnote says whether sync is on. `vault_recover` checks the new password, then without sync `LocalVault::recover`: parse the code, unwrap the account keys from the local `wrapped_private_keys_rk`, check they are this vault's ("that recovery key does not match this vault"), wrap them under the new password with fresh KDF parameters, and unlock. With sync the server goes first (`mg_store::account::recover`). On a fresh device, recovery goes through **I have an account**, **Forgot the master password? Use your recovery key** ("Reset password and sign in", **Reset and sign in**).
+**Forgot the password, on this device.** **Forgot password? Use your recovery key** opens **Use your recovery key**: **Recovery key** (a text area), **Master password**, **Repeat password**, **Set new password** ("Re-encrypting…"), **Back to unlock**. The footnote says whether sync is on. `vault_recover` checks the new password, then without sync `LocalVault::recover`: parse the code, unwrap the account keys from the local `wrapped_private_keys_rk`, check they are this vault's ("that recovery key does not match this vault"), wrap them under the new password with fresh KDF parameters, and unlock. With sync the server goes first (`mg_store::account::recover`). On a fresh device, recovery goes through **Sign in**, **Forgot the master password? Use your recovery key** ("Reset password and sign in", **Reset and sign in**).
 
 **A new recovery key.** Security, **Recovery key**: **Master password**, **Create a new recovery key** ("Creating…"). `vault_new_recovery_code` makes a new key and replaces `wrapped_private_keys_rk` and `recovery_proof`; the password wrapping stays. The old code stops working at once (on the server too, with sync on). Nobody is signed out.
 

From eae1d5617c70de62f7e9da52a71db4438e87df28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Wed, 21 Oct 2026 22:37:07 +0200
Subject: [PATCH 3/6] Lists and team pages redesigned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 CHANGELOG.md                             |   26 +
 apps/desktop/e2e/appimage.mjs            |   31 +-
 apps/desktop/e2e/flows.mjs               |   87 +-
 apps/desktop/e2e/layout.mjs              |   40 +-
 apps/desktop/e2e/teams.mjs               |  102 +-
 apps/desktop/e2e/webdriver.mjs           |   19 +
 apps/desktop/src/App.tsx                 |   26 +-
 apps/desktop/src/ListParts.tsx           |  221 +++
 apps/desktop/src/Lists.tsx               | 1263 +++++++------
 apps/desktop/src/Page.tsx                |    7 +-
 apps/desktop/src/Sidebar.tsx             |   42 +-
 apps/desktop/src/TeamsPanel.tsx          | 2167 +++++++++++++---------
 apps/desktop/src/styles.css              |  983 +++++++---
 docs/features/cloud-sources.md           |    2 +-
 docs/features/hosts-groups-identities.md |   16 +-
 docs/features/importing.md               |    2 +-
 docs/features/port-forwarding.md         |    2 +-
 docs/features/ssh-keys-and-agents.md     |    2 +-
 docs/features/teams.md                   |   59 +-
 docs/features/terminal-and-snippets.md   |    2 +-
 docs/features/vpn.md                     |    2 +-
 21 files changed, 3254 insertions(+), 1847 deletions(-)
 create mode 100644 apps/desktop/src/ListParts.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbfe200..6db1f7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,32 @@
 Each `## X.Y.Z` section becomes the notes of that release, on GitHub and in the app's update
 prompt. Write them for users.
 
+## 0.2.1
+
+- The first screen offers New vault, New account and Sign in. New account creates your vault and
+  your sync account in one go.
+- An invite to a team opened before you've set MorphGate up shows on its first screen, with your
+  address filled in, and once your account exists Teams opens with the invite. You can also paste
+  an invite there (Joining a team?). An invite opened while sync is off opens as soon as you turn
+  sync on: no need to open the link again.
+- MorphGate can suggest a strong master password: five random words, wherever you set one.
+- With saved hosts, MorphGate opens on your Hosts page, which has a quick connect bar: type
+  user@host:port and choose how to sign in.
+- Hosts, groups, keys, snippets, tunnels and VPNs are tables you can search and filter, each row's
+  actions shown as you point at it. Hosts show whether they're connected instead of a letter, each
+  group says what it gives its hosts, and the sidebar lists your open sessions first. Keys,
+  identities and host CAs are tabs of the Keys page.
+- A team's page starts with what needs you (a member to confirm, a device to approve, a key to
+  rotate), then has tabs for its members, vaults, your SSH keys, settings and activity. You can
+  invite several people at once, and Teams says per team what's waiting for you.
+- When a team requires two-step verification and your account doesn't have it, MorphGate says so
+  and takes you to turning it on, instead of the team's vaults silently not appearing.
+- Sync: every change now carries a version inside its signed envelope, and deletions are signed,
+  so a sync server can't give a device an older copy of an item than one it has seen. Older
+  versions of the app keep syncing alongside this one.
+- Install and restart waits for an update check that's still running, so it installs the update
+  that check found.
+
 ## 0.2.0
 
 First release.
diff --git a/apps/desktop/e2e/appimage.mjs b/apps/desktop/e2e/appimage.mjs
index 2a2684e..b4959b6 100644
--- a/apps/desktop/e2e/appimage.mjs
+++ b/apps/desktop/e2e/appimage.mjs
@@ -138,7 +138,7 @@ try {
   );
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Import…");
+  await s.addFrom("Import…");
   await s.wait(() => s.exec(`return document.querySelectorAll(".import-list li").length === 2 || null`), "the two hosts in ~/.ssh/config");
   const listed = await s.exec(`return document.querySelector(".import-hosts").innerText`);
   assert.match(listed, /Match blocks are skipped/);
@@ -191,7 +191,7 @@ try {
   writeFileSync(`${home}/.putty/sessions/router`, "HostName=10.0.0.1\nProtocol=telnet\n");
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Import…");
+  await s.addFrom("Import…");
   await s.clickButton("PuTTY");
   await s.wait(() => s.exec(`return document.querySelector(".import-list")?.innerText.includes("E2E PuTTY") || null`), "the PuTTY session");
   let page = await s.exec(`return document.querySelector(".import-hosts").innerText`);
@@ -375,6 +375,7 @@ try {
   // host key prompt, and the route bar says who vouched for it.
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Keys")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Keys" || null`), "the Keys page");
+  await s.pageTab("Host CAs");
   await s.clickButton("New host CA");
   await s.waitText("New host CA", ".panel");
   await s.typeLabelled("Name", "e2e host CA");
@@ -391,7 +392,7 @@ try {
       throw e;
     });
   assert.equal(saved, "ok", `saving the host CA: ${saved}`);
-  await s.wait(() => s.hasText(".panel strong", "e2e host CA"), "the host CA listed");
+  await s.wait(() => s.hasText(".panel .lname", "e2e host CA"), "the host CA listed");
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
   await s.clickButton("New host");
@@ -451,7 +452,7 @@ try {
   // the key goes on the account; a refresh changes nothing; no Files for its hosts (no SFTP).
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Clouds…");
+  await s.addFrom("Clouds…");
   // The page shows what to add once it has listed the sources.
   await s.waitText("Connect Vallic Cloud", ".cloud-page", 30000);
   await s.clickButton("Connect Vallic Cloud");
@@ -480,10 +481,10 @@ try {
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page again");
   const vallicRow = await s.exec(
-    `const li = [...document.querySelectorAll(".panel.page li")].find((l) => l.innerText.includes("E2E Shop · Production"));
-     return li ? [...li.querySelectorAll("button")].map((b) => b.innerText).join("|") : null`,
+    `const row = [...document.querySelectorAll(".panel.page [role=row]")].find((r) => r.innerText.includes("E2E Shop · Production"));
+     return row ? [...row.querySelectorAll("button")].map((b) => b.getAttribute("aria-label") || b.innerText).join("|") : null`,
   );
-  assert.ok(vallicRow && !vallicRow.split("|").includes("Files"), `no Files for a Vallic host: ${vallicRow}`);
+  assert.ok(vallicRow && !vallicRow.split("|").includes("Browse files (SFTP)"), `no Files for a Vallic host: ${vallicRow}`);
   // Its SSH forwards no ports: the tunnel editor doesn't offer it.
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Tunnels")).click(); return true`);
   await s.clickButton("New tunnel");
@@ -513,7 +514,7 @@ try {
   // the stopped one without an address waits.
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Clouds…");
+  await s.addFrom("Clouds…");
   // The page shows what to add once it has listed the sources.
   await s.waitText("Add AWS", ".cloud-page", 30000);
   await s.clickButton("Add AWS");
@@ -544,7 +545,7 @@ try {
   // connection goes through `aws ssm start-session` (the stand-in relays it to this sshd).
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Clouds…");
+  await s.addFrom("Clouds…");
   await s.waitText("123456789012", ".cloud-source", 30000);
   await s.exec(
     `const card = [...document.querySelectorAll(".cloud-source")].find((x) => x.innerText.includes("123456789012"));
@@ -585,7 +586,7 @@ try {
   // for the source; its droplet (this sshd) connects.
   await s.exec(`[...document.querySelectorAll(".sidebar-nav button")].find((b) => b.innerText.startsWith("Hosts")).click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page");
-  await s.clickButton("Clouds…");
+  await s.addFrom("Clouds…");
   await s.waitText("Add DigitalOcean", ".cloud-page", 30000);
   await s.clickButton("Add DigitalOcean");
   await s.waitText("is signed in as e2e@example.com (E2E)", ".cloud-adding", 30000);
@@ -628,8 +629,8 @@ try {
   await s.clickButton("Select");
   const pick = (label) =>
     s.exec(
-      `const li = [...document.querySelectorAll(".panel.page li.picking")].find((l) => l.querySelector("strong")?.innerText === arguments[0]);
-       if (!li) throw new Error("no row " + arguments[0]); li.click(); return true`,
+      `const row = [...document.querySelectorAll(".panel.page [role=row].picking")].find((r) => r.querySelector(".lname")?.innerText === arguments[0]);
+       if (!row) throw new Error("no row " + arguments[0]); row.click(); return true`,
       label,
     );
   await pick("e2e-csv");
@@ -640,8 +641,8 @@ try {
   await s.waitText("Moved 2 hosts.", ".select-bar-wrap", 30000);
   await s.wait(
     () =>
-      s.exec(`const section = [...document.querySelectorAll(".panel.page section")].find((x) => x.querySelector(".group-title")?.innerText.includes("E2E Lab"));
-              const names = section ? [...section.querySelectorAll("li strong")].map((x) => x.innerText) : [];
+      s.exec(`const section = [...document.querySelectorAll(".panel.page .lsection")].find((x) => x.querySelector(".lghead")?.innerText.includes("E2E Lab"));
+              const names = section ? [...section.querySelectorAll(".lname")].map((x) => x.innerText) : [];
               return names.includes("e2e-csv") && names.includes("e2e-royal") || null`),
     "both hosts in E2E Lab",
   );
@@ -934,7 +935,7 @@ try {
   await s.exec(`document.querySelector("form button[type=submit]").click(); return true`);
   await s.wait(() => s.exec(`return document.querySelector("button.brand") ? true : null`), "the workspace", 60000);
   // A vault with hosts opens on them (with none, on quick connect).
-  assert.ok(await s.exec(`return document.querySelectorAll(".sidebar .row-title").length > 0`), "the vault still has hosts");
+  await s.wait(() => s.exec(`return document.querySelectorAll(".sidebar .row-title").length > 0 || null`), "the vault's hosts", 30000);
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Hosts" || null`), "the Hosts page as home");
   assert.match(await openAbout(s), new RegExp(`Version ${next} · AppImage`));
   await checkNow(s);
diff --git a/apps/desktop/e2e/flows.mjs b/apps/desktop/e2e/flows.mjs
index b1cf137..02cf48c 100644
--- a/apps/desktop/e2e/flows.mjs
+++ b/apps/desktop/e2e/flows.mjs
@@ -113,7 +113,7 @@ export async function signInFresh(s, { server, email, password = PASSWORD }) {
 export async function openTeams(s) {
   await s.click("button.sidebar-foot.teams");
   await s.exec(
-    `const b = [...document.querySelectorAll(".panel button.link")].find((b) => b.innerText.includes("All organizations"));
+    `const b = [...document.querySelectorAll(".panel button.link")].find((b) => b.innerText.trim() === "← Teams");
      if (b) b.click(); return true`,
   );
   await s.waitText("Your fingerprint", ".panel");
@@ -121,8 +121,8 @@ export async function openTeams(s) {
 
 export async function openOrg(s, name) {
   await s.exec(
-    `const li = [...document.querySelectorAll(".panel .device-list li")].find((l) => l.querySelector("strong")?.innerText === arguments[0]);
-     li.querySelector("button").click(); return true`,
+    `const row = [...document.querySelectorAll(".panel [role=row]")].find((r) => r.querySelector(".lname")?.innerText === arguments[0]);
+     row.querySelector("button.lnamebtn").click(); return true`,
     name,
   );
   await s.waitText("Members", ".panel");
@@ -132,12 +132,15 @@ export async function openOrg(s, name) {
 export async function createTeam(s, name, vault) {
   await openTeams(s);
   const fp = await fingerprint(s);
-  await s.type('input[aria-label="Organization name"]', name);
-  await s.clickButton("Create");
+  await s.clickButton("New team");
+  await s.type('input[aria-label="Team name"]', name);
+  await s.clickButton("Create team");
+  await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === arguments[0] || null`, name), "the team's page");
+  await s.pageTab("Vaults");
   await s.waitText("No vaults yet", ".panel");
   await s.type('input[aria-label="New vault name"]', vault);
   await s.clickButton("New vault");
-  await s.wait(() => s.hasText(".panel .device-list strong", vault), "the new vault");
+  await s.wait(() => s.hasText(".panel .lname", vault), "the new vault");
   return fp;
 }
 
@@ -163,19 +166,22 @@ export async function mailedInvite(mailpit, to, since, ms = 30000) {
  * the mail (Mailpit) where the server mails it.
  */
 export async function invite(s, email, { mailpit } = {}) {
-  await s.type('input[aria-label="Email to invite"]', email);
+  await s.clickButton("Invite people");
+  await s.wait(() => s.exec(`return document.querySelector("dialog.invite-dialog[open]") ? true : null`), "the invite dialog");
+  await s.type('input[aria-label="Emails to invite"]', email);
   for (const box of await s.exec(`return document.querySelectorAll(".grants input[type=checkbox]").length`).then((n) => [...Array(n).keys()])) {
     await s.exec(`document.querySelectorAll(".grants input[type=checkbox]")[arguments[0]].click(); return true`, box);
   }
   const since = Date.now();
-  await s.clickButton("Invite");
+  await s.clickButton("Send invite");
   const shown = await s.wait(
     () =>
       s.exec(
-        `const c = document.querySelector(".invite-code"); return c ? { token: c.innerText.trim() } : document.querySelector(".panel").innerText.includes("Invite emailed to") ? { mailed: true } : null`,
+        `const c = document.querySelector(".invite-code"); return c ? { token: c.innerText.trim() } : document.querySelector("dialog.invite-dialog")?.innerText.includes("Invite emailed to") ? { mailed: true } : null`,
       ),
     "the invite code, or that it was mailed",
   );
+  await s.clickButton("Done");
   if (shown.token) return shown.token;
   assert.ok(mailpit, "the server mails invites: pass where to read them (Mailpit)");
   return mailedInvite(mailpit, email, since);
@@ -193,7 +199,7 @@ export async function acceptInvite(s, token, ownerFp, team) {
  * joins. Returns the member's own. */
 export async function joinLookedUp(s, ownerFp, team) {
   await s.waitText("Join only if", ".panel", 30000);
-  const fp = await fingerprint(s, ".page-aside .fingerprint");
+  const fp = await fingerprint(s, ".teams-foot > .stack > .fingerprint");
   assert.equal(await fingerprint(s, ".notice-box .fingerprint"), ownerFp);
   await s.click(".notice-box label.check input");
   await s.clickButton(`Join ${team}`);
@@ -252,20 +258,21 @@ export async function newAccountFromInvite(s, { invite, team, email, mailpit, sh
 
 /** T2 (an owner or admin, in the organization's page): confirms `email` after checking its fingerprint. */
 export async function confirmMember(s, email, memberFp) {
-  await s.waitText("Waiting for confirmation", ".panel", 30000);
+  await s.pageTab("Members");
+  await s.waitText("To confirm", ".panel", 30000);
   await s.clickButton("Confirm…");
-  assert.equal(await fingerprint(s, "li.nested .fingerprint"), memberFp);
-  await s.click("li.nested label.check input");
+  assert.equal(await fingerprint(s, ".lexpand .fingerprint"), memberFp);
+  await s.click(".lexpand label.check input");
   await s.clickButton(`Confirm ${email}`);
-  await s.wait(() => s.exec(`return document.querySelector(".panel").innerText.includes("Waiting for confirmation") ? null : true`), "the confirmation", 30000);
+  await s.wait(() => s.exec(`return document.querySelector(".panel").innerText.includes("To confirm") ? null : true`), "the confirmation", 30000);
 }
 
 /** T6 (an owner or admin, in the organization's page): removes `email` and rotates keys. */
 export async function removeMember(s, email) {
-  // The "Remove…" on `email`'s row (the smallest list item naming them that has one).
-  const row = `[...document.querySelectorAll(".panel li")]
-    .filter((l) => l.innerText.includes(arguments[0]) && [...l.querySelectorAll("button")].some((b) => b.innerText.includes("Remove…")))
-    .sort((a, b) => a.innerText.length - b.innerText.length)[0]`;
+  // The "Remove…" on `email`'s row in the member list.
+  await s.pageTab("Members");
+  const row = `[...document.querySelectorAll(".panel [role=row]")]
+    .find((r) => r.querySelector(".lname")?.innerText === arguments[0] && [...r.querySelectorAll("button")].some((b) => b.innerText.includes("Remove…")))`;
   await s.wait(() => s.exec(`return ${row} ? true : null`, email), `${email} in the member list`);
   await s.exec(`[...${row}.querySelectorAll("button")].find((b) => b.innerText.includes("Remove…")).click(); return true`, email);
   await s.waitText("1. What they can open", ".panel");
@@ -391,7 +398,8 @@ export async function signInAgain(s, password = PASSWORD) {
 
 /** T8 (the owner, in the organization's page): deletes it. */
 export async function deleteTeam(s, name, password = PASSWORD) {
-  await s.clickButton("Delete organization");
+  await s.pageTab("Settings");
+  await s.clickButton("Delete team…");
   await s.typeLabelled("Your master password", password);
   await clickWhenEnabled(s, `Delete ${name}`);
   await s.waitText("Your fingerprint", ".panel", 60000);
@@ -402,6 +410,8 @@ export async function deleteTeam(s, name, password = PASSWORD) {
  * confirmation reads "Really leave?"). `name` is unused, kept for callers that pass it.
  */
 export async function leaveTeam(s, name) {
+  // A confirmed member leaves from their row in Members; one still waiting, from the notice.
+  if (await s.exec(`return !!document.querySelector(".page-tabs")`)) await s.pageTab("Members");
   await s.clickButton("Leave");
   await s.clickButton("Really leave");
   await s.waitText("Your fingerprint", ".panel", 60000);
@@ -510,20 +520,21 @@ export async function recoverOnUnlock(s, key, password) {
 
 /** In the organization's page: the vault named `vault`, its access list open. */
 async function openAccess(s, vault) {
-  await s.wait(() => s.hasText(".panel .device-list strong", vault), `the vault ${vault}`);
+  await s.pageTab("Vaults");
+  await s.wait(() => s.hasText(".panel .lname", vault), `the vault ${vault}`);
   await s.exec(
-    `const li = [...document.querySelectorAll(".panel .device-list li")].find((l) => l.querySelector("strong")?.innerText === arguments[0]);
-     [...li.querySelectorAll("button")].find((b) => b.innerText.includes("Access")).click(); return true`,
+    `const row = [...document.querySelectorAll(".panel [role=row]")].find((r) => r.querySelector(".lname")?.innerText === arguments[0]);
+     [...row.querySelectorAll("button")].find((b) => b.innerText.includes("Access")).click(); return true`,
     vault,
   );
-  await s.wait(() => s.exec(`return document.querySelector("li.nested .access-row") ? true : null`), "the access list");
+  await s.wait(() => s.exec(`return document.querySelector(".lexpand .access-row") ? true : null`), "the access list");
 }
 
 /** T4 (an owner or admin, in the organization's page): takes `email`'s access to `vault` away. */
 export async function revokeAccess(s, vault, email) {
   await openAccess(s, vault);
   await s.exec(
-    `const row = [...document.querySelectorAll("li.nested .access-row")].find((r) => r.innerText.includes(arguments[0]));
+    `const row = [...document.querySelectorAll(".lexpand .access-row")].find((r) => r.innerText.includes(arguments[0]));
      row.querySelector("button.ghost-danger").click(); return true`,
     email,
   );
@@ -535,7 +546,7 @@ export async function grantAccess(s, vault, email) {
   await openAccess(s, vault);
   await s.choose('select[aria-label="Member to give access"]', email);
   await s.exec(`const sel = document.querySelector('select[aria-label="Member to give access"]'); [...sel.closest(".row").querySelectorAll("button")].find((b) => b.innerText === "Add").click(); return true`);
-  await s.wait(() => s.exec(`return [...document.querySelectorAll("li.nested .access-row")].some((r) => r.innerText.includes(arguments[0]) && r.querySelector("button.ghost-danger")) || null`, email), `${email}'s access`, 30000);
+  await s.wait(() => s.exec(`return [...document.querySelectorAll(".lexpand .access-row")].some((r) => r.innerText.includes(arguments[0]) && r.querySelector("button.ghost-danger")) || null`, email), `${email}'s access`, 30000);
 }
 
 /** After a removal or revocation: the rotation Teams asks for, done (every vault due). */
@@ -551,19 +562,18 @@ export async function rotateDueKeys(s, org) {
   }
 }
 
-/** An owner or admin, in the organization's page: turns on the policy whose label has `text`. */
+/** An owner or admin, on the team's page: turns on the setting whose name has `text`, and saves. */
 async function turnOnPolicy(s, text) {
-  await s.wait(
-    () => s.exec(`return [...document.querySelectorAll(".page-aside label.check")].some((l) => l.innerText.includes(arguments[0])) || null`, text),
-    "the policies",
-  );
-  await s.exec(`[...document.querySelectorAll(".page-aside label.check")].find((l) => l.innerText.includes(arguments[0])).querySelector("input").click(); return true`, text);
-  await s.clickButton("Save policies");
-  await s.wait(() => s.exec(`return [...document.querySelectorAll(".page-aside button")].some((b) => b.innerText.includes("Save policies")) ? null : true`), "the policies to save");
+  await s.pageTab("Settings");
+  const find = `[...document.querySelectorAll(".setting")].find((r) => r.querySelector(".setting-name")?.innerText.includes(arguments[0]))`;
+  await s.wait(() => s.exec(`return ${find} ? true : null`, text), "the settings");
+  await s.exec(`${find}.querySelector("button[role=switch]").click(); return true`, text);
+  await s.clickButton("Save settings");
+  await s.wait(() => s.exec(`return [...document.querySelectorAll("button")].some((b) => b.innerText.includes("Save settings")) ? null : true`), "the settings to save");
 }
 
 /** J7 (an owner or admin, in the organization's page): requires approval of new devices. */
-export const requireDeviceApproval = (s) => turnOnPolicy(s, "approve new devices");
+export const requireDeviceApproval = (s) => turnOnPolicy(s, "Approve new devices");
 
 /** T14 (an owner or admin, in the organization's page): requires two-step verification. */
 export const requireTwoStep = (s) => turnOnPolicy(s, "Require two-step verification");
@@ -612,11 +622,11 @@ export async function turnOnTwoStep(s, password = PASSWORD) {
 /** The device-approval state on this device's sidebar ("Waiting for approval", "Denied"), or null. */
 export const approvalState = (s) => s.exec(`const b = document.querySelector("button.sidebar-foot.approval"); return b ? b.innerText : null`);
 
-/** J7 (an owner, an admin or one of the member's approved devices, in the organization's page): approves the waiting device. */
+/** J7 (an owner, an admin or one of the member's approved devices, in the organization's page): approves the waiting device, from Needs you. */
 export async function approveDevice(s) {
-  await s.waitText("Waiting for approval", ".panel.page", 60000);
-  await s.exec(`[...document.querySelectorAll(".device-requests button")].find((b) => b.innerText === "Approve").click(); return true`);
-  await s.wait(() => s.exec(`return document.querySelector(".device-requests") ? null : true`), "the request to go", 30000);
+  await s.waitText("waits for approval", ".needs", 60000);
+  await s.exec(`[...document.querySelectorAll(".needs button")].find((b) => b.innerText === "Approve").click(); return true`);
+  await s.wait(() => s.exec(`return [...document.querySelectorAll(".needs button")].some((b) => b.innerText === "Approve") ? null : true`), "the request to go", 30000);
 }
 
 /** S9: Sync → Delete account, with the master password. */
@@ -633,6 +643,7 @@ export async function deleteAccount(s, password = PASSWORD) {
 export async function memberListed(s, org, email) {
   await openTeams(s);
   await openOrg(s, org);
+  await s.pageTab("Members");
   await s.wait(() => s.exec(`return document.querySelector(".panel").innerText.includes("Members") || null`), "the member list");
   await new Promise((r) => setTimeout(r, 1500));
   return s.exec(`return document.querySelector(".panel").innerText.includes(arguments[0])`, email);
diff --git a/apps/desktop/e2e/layout.mjs b/apps/desktop/e2e/layout.mjs
index 4d97c4c..1cf4674 100644
--- a/apps/desktop/e2e/layout.mjs
+++ b/apps/desktop/e2e/layout.mjs
@@ -131,14 +131,14 @@ try {
   await s.waitText("selected", ".select-bar");
   await shoot(s, "hosts-selecting");
   await s.clickButton("Done");
-  await s.clickButton("Clouds…");
+  await s.addFrom("Clouds…");
   await s.waitText("Connect Vallic Cloud", ".panel");
   await shoot(s, "vallic-cloud");
   await s.clickButton("Close");
 
   // Groups, a group's page with everything in it, and its editor full screen.
   const groupPage = async () => {
-    await s.exec(`[...document.querySelectorAll(".panel button.title-link")].find((b) => b.innerText === "Production").click(); return true`);
+    await s.exec(`[...document.querySelectorAll(".panel button.lnamebtn")].find((b) => b.querySelector(".lname")?.innerText === "Production").click(); return true`);
     await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Production" || null`), "the Production group's page");
   };
   await page(s, "Groups");
@@ -159,7 +159,7 @@ try {
   await s.click(".panel form button[type=submit]");
   await s.waitText("Save changes", ".panel");
   await s.clickButton("Close");
-  await s.wait(() => s.hasText(".panel strong", "Tail nginx errors"), "the snippet on its page");
+  await s.wait(() => s.hasText(".panel .lname", "Tail nginx errors"), "the snippet on its page");
   await shoot(s, "snippets");
 
   await page(s, "Tunnels");
@@ -173,7 +173,7 @@ try {
   await s.click(".panel form button[type=submit]");
   await s.waitText("Edit tunnel", ".panel");
   await s.clickButton("Cancel");
-  await s.wait(() => s.hasText(".panel strong", "Postgres on prod"), "the tunnel on its page");
+  await s.wait(() => s.hasText(".panel .lname", "Postgres on prod"), "the tunnel on its page");
   await shoot(s, "tunnels");
 
   await page(s, "VPNs");
@@ -185,26 +185,42 @@ try {
   await s.typeLabelled("Server", "vpn.client.example");
   await s.click(".panel form button[type=submit]");
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "VPNs" || null`), "the VPNs page again");
-  await s.wait(() => s.hasText(".panel strong", "Client office"), "the VPN on its page");
+  await s.wait(() => s.hasText(".panel .lname", "Client office"), "the VPN on its page");
   await shoot(s, "vpns");
   await page(s, "Keys");
   await shoot(s, "keys");
 
   // A team with a vault and an invite to a long address.
   await s.click("button.sidebar-foot.teams");
-  await s.wait(() => s.exec(`return document.querySelector('input[aria-label="Organization name"]') ? true : null`), "the teams page");
+  await s.wait(() => s.exec(`return [...document.querySelectorAll(".panel button")].some((b) => b.innerText === "New team") || null`), "the teams page");
   await shoot(s, "teams-list");
-  await s.type('input[aria-label="Organization name"]', "Acme Operations International");
-  await s.clickButton("Create");
+  await s.clickButton("New team");
+  await s.type('input[aria-label="Team name"]', "Acme Operations International");
+  await s.clickButton("Create team");
+  await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Acme Operations International" || null`), "the team's page");
+  await s.pageTab("Vaults");
   await s.waitText("No vaults yet", ".panel");
   await s.type('input[aria-label="New vault name"]', "Production databases");
   await s.clickButton("New vault");
-  await s.wait(() => s.hasText(".panel .device-list strong", "Production databases"), "the new vault");
-  await s.type('input[aria-label="Email to invite"]', "someone.with.a.long.address@example.com");
+  await s.wait(() => s.hasText(".panel .lname", "Production databases"), "the new vault");
+  await shoot(s, "org-vaults");
+  await s.clickButton("Invite people");
+  await s.type('input[aria-label="Emails to invite"]', "someone.with.a.long.address@example.com, another.person@example.com");
   await s.click(".grants input[type=checkbox]");
-  await s.clickButton("Invite");
-  await s.wait(() => s.exec(`return document.querySelector(".invite-code") ? true : null`), "the invite code");
+  await shoot(s, "invite", "dialog.invite-dialog");
+  await s.clickButton("Send 2 invites");
+  await s.wait(() => s.exec(`return document.querySelector(".invite-code") ? true : null`), "the invite codes");
+  await shoot(s, "invite-sent", "dialog.invite-dialog");
+  await s.clickButton("Done");
+  await s.pageTab("Members");
+  await s.wait(() => s.hasText(".panel .lname", "someone.with.a.long.address@example.com"), "the invites in Members");
   await shoot(s, "org");
+  await s.pageTab("Settings");
+  await s.waitText("Require two-step verification", ".panel");
+  await shoot(s, "org-settings");
+  await s.pageTab("Activity");
+  await s.waitText("invited someone.with.a.long.address@example.com", ".panel");
+  await shoot(s, "org-activity");
 
   // Moving the group into the team's vault: the plan, then cancel.
   await page(s, "Groups");
diff --git a/apps/desktop/e2e/teams.mjs b/apps/desktop/e2e/teams.mjs
index 60c3ed1..919f46f 100644
--- a/apps/desktop/e2e/teams.mjs
+++ b/apps/desktop/e2e/teams.mjs
@@ -110,7 +110,7 @@ async function openTeams(s) {
   await s.click("button.sidebar-foot.teams");
   // Already in an organization: back to the list.
   await s.exec(
-    `const b = [...document.querySelectorAll(".panel button.link")].find((b) => b.innerText.includes("All organizations"));
+    `const b = [...document.querySelectorAll(".panel button.link")].find((b) => b.innerText.trim() === "← Teams");
      if (b) b.click(); return true`,
   );
   await s.waitText("Your fingerprint", ".panel");
@@ -118,13 +118,27 @@ async function openTeams(s) {
 
 async function openOrg(s, name) {
   await s.exec(
-    `const li = [...document.querySelectorAll(".panel .device-list li")].find((l) => l.querySelector("strong")?.innerText === arguments[0]);
-     li.querySelector("button").click(); return true`,
+    `const row = [...document.querySelectorAll(".panel [role=row]")].find((r) => r.querySelector(".lname")?.innerText === arguments[0]);
+     row.querySelector("button.lnamebtn").click(); return true`,
     name,
   );
   await s.waitText("Members", ".panel");
 }
 
+/** On a team's page: turns on the setting whose name has `name`, and saves. */
+async function turnOn(s, name) {
+  await s.pageTab("Settings");
+  const find = `[...document.querySelectorAll(".setting")].find((r) => r.querySelector(".setting-name")?.innerText.includes(arguments[0]))`;
+  await s.wait(() => s.exec(`return ${find} ? true : null`, name), `the setting ${name}`);
+  await s.exec(`${find}.querySelector("button[role=switch]").click(); return true`, name);
+  await s.clickButton("Save settings");
+  await s.wait(() => s.exec(`return [...document.querySelectorAll("button")].some((b) => b.innerText.includes("Save settings")) ? null : true`), "the settings to save");
+}
+
+/** A team page's row naming `name`, as text, or null. */
+const rowText = (s, name) =>
+  s.exec(`const r = [...document.querySelectorAll(".panel [role=row]")].find((r) => r.querySelector(".lname")?.innerText === arguments[0]); return r ? r.innerText : null`, name);
+
 const alice = await session(app, process.env.WD_URL_ALICE);
 const bob = await session(app, process.env.WD_URL_BOB);
 // Bob's second device, for device approval.
@@ -138,20 +152,25 @@ try {
   // Alice: an organization, a vault, and an invite for Bob with write access to it.
   await openTeams(alice);
   const aliceFp = await fingerprint(alice);
-  await alice.type('input[aria-label="Organization name"]', "Acme Ops");
-  await alice.clickButton("Create");
+  await alice.clickButton("New team");
+  await alice.type('input[aria-label="Team name"]', "Acme Ops");
+  await alice.clickButton("Create team");
+  await alice.wait(() => alice.exec(`return document.querySelector(".panel.page h1")?.innerText === "Acme Ops" || null`), "the team's page");
+  await alice.pageTab("Vaults");
   await alice.waitText("No vaults yet", ".panel");
   await alice.type('input[aria-label="New vault name"]', "Production");
   await alice.clickButton("New vault");
-  await alice.wait(() => alice.hasText(".panel .device-list strong", "Production"), "the new vault");
-  await alice.type('input[aria-label="Email to invite"]', bobEmail);
+  await alice.wait(() => alice.hasText(".panel .lname", "Production"), "the new vault");
+  await alice.clickButton("Invite people");
+  await alice.type('input[aria-label="Emails to invite"]', bobEmail);
   await alice.click(".grants input[type=checkbox]");
-  await alice.clickButton("Invite");
+  await alice.clickButton("Send invite");
   const token = await alice.wait(
     () => alice.exec(`const c = document.querySelector(".invite-code"); return c ? c.innerText.trim() : null`),
     "the invite code",
   );
   await alice.screenshot(`${shots}/alice-invited.png`);
+  await alice.clickButton("Done");
   ok("Alice created Acme Ops / Production and invited Bob");
 
   // Bob: looks the invite up and joins only because the owner's fingerprint matches.
@@ -170,15 +189,16 @@ try {
   ok("Bob saw Alice's fingerprint and joined");
 
   // Alice: confirms Bob only because his fingerprint matches what he reads out.
-  await alice.clickButton("All organizations");
+  await openTeams(alice);
   await openOrg(alice, "Acme Ops");
-  await alice.waitText("Waiting for confirmation", ".panel");
+  await alice.waitText("To confirm", ".panel");
+  await alice.screenshot(`${shots}/alice-needs-you.png`);
   await alice.clickButton("Confirm…");
-  assert.equal(await fingerprint(alice, "li.nested .fingerprint"), bobFp);
-  await alice.click("li.nested label.check input");
+  assert.equal(await fingerprint(alice, ".lexpand .fingerprint"), bobFp);
+  await alice.click(".lexpand label.check input");
   await alice.clickButton(`Confirm ${bobEmail}`);
   await alice.wait(
-    () => alice.exec(`return document.querySelector(".panel").innerText.includes("Waiting for confirmation") ? null : true`),
+    () => alice.exec(`return document.querySelector(".panel").innerText.includes("To confirm") ? null : true`),
     "Bob's confirmation",
   );
   ok("Alice compared Bob's fingerprint and confirmed him");
@@ -251,7 +271,7 @@ try {
   await syncNow(alice);
   await syncUntil(bob, () => sidebarHas(bob, "lab1"), "lab1 on Bob's device");
   await openPage(bob, "Keys");
-  assert.ok(await bob.hasText(".panel strong", "lab key"), "the key came along");
+  assert.ok(await bob.hasText(".panel .lname", "lab key"), "the key came along");
   ok("Alice moved lab1 and the key it uses into Production; Bob has both");
   await alice.exec(`document.querySelector('.sidebar button[aria-label="Edit lab1"]').click(); return true`);
   await moveTo(alice, "Personal (only you)");
@@ -270,6 +290,7 @@ try {
   const bobKey = await bob.exec(`return document.querySelector(".panel textarea").value`);
   await openTeams(bob);
   await openOrg(bob, "Acme Ops");
+  await bob.pageTab("Your SSH keys");
   await bob.wait(() => bob.exec(`return document.querySelector('select[aria-label="Key to publish"]') ? true : null`), "the publish form");
   await bob.choose('select[aria-label="Key to publish"]', "bob laptop");
   await bob.clickButton("Publish");
@@ -280,7 +301,7 @@ try {
     await openTeams(alice);
     await openOrg(alice, "Acme Ops");
     try {
-      await alice.waitText("1 SSH key published", ".panel", 3000);
+      await alice.wait(async () => ((await rowText(alice, bobEmail)) ?? "").includes("1 published") || null, "Bob's published key", 3000);
       break;
     } catch (e) {
       if (i >= 15) throw e;
@@ -291,9 +312,10 @@ try {
   // Alice revokes Bob: the vault leaves his device, and Alice rotates its key.
   await openTeams(alice);
   await openOrg(alice, "Acme Ops");
+  await alice.pageTab("Vaults");
   await alice.clickButton("Access");
-  await alice.wait(() => alice.exec(`return document.querySelector("li.nested .access-row button.ghost-danger") ? true : null`), "the access list");
-  await alice.click("li.nested .access-row button.ghost-danger");
+  await alice.wait(() => alice.exec(`return document.querySelector(".lexpand .access-row button.ghost-danger") ? true : null`), "the access list");
+  await alice.click(".lexpand .access-row button.ghost-danger");
   await alice.waitText("Rotate the key", ".panel");
   await syncUntil(bob, () => bob.exec(`return document.querySelector(".sidebar .vault-tag") ? null : true`), "the vault to leave Bob's device");
   assert.ok(!(await sidebarHas(bob, "db1-primary")));
@@ -313,26 +335,18 @@ try {
   // Policies: members may create vaults, and Bob makes one he manages.
   await openTeams(alice);
   await openOrg(alice, "Acme Ops");
-  await alice.waitText("Policies", ".panel");
-  await alice.exec(
-    `[...document.querySelectorAll(".panel label.check")].find((l) => l.innerText.includes("Members can create vaults")).querySelector("input").click(); return true`,
-  );
-  await alice.clickButton("Save policies");
-  await alice.wait(
-    () => alice.exec(`return [...document.querySelectorAll("button")].some((b) => b.innerText.includes("Save policies")) ? null : true`),
-    "the saved policies",
-  );
+  await turnOn(alice, "Members can create vaults");
   await openTeams(bob);
   await openOrg(bob, "Acme Ops");
   await bob.wait(() => bob.exec(`return document.querySelector('input[aria-label="New vault name"]') ? true : null`), "Bob's new-vault form");
   await bob.type('input[aria-label="New vault name"]', "Bob's tools");
   await bob.clickButton("New vault");
-  await bob.wait(() => bob.hasText(".panel .device-list strong", "Bob's tools"), "Bob's vault");
-  assert.ok(await bob.hasText(".panel .device-list .kind-badge", "Can manage"));
+  await bob.wait(() => bob.hasText(".panel .lname", "Bob's tools"), "Bob's vault");
+  assert.ok(((await rowText(bob, "Bob's tools")) ?? "").includes("Can manage"));
   ok("Alice let members create vaults; Bob made one he manages");
 
   // The activity log tells the story.
-  await alice.clickButton("Show activity");
+  await alice.pageTab("Activity");
   const log = await alice.waitText("rotated the key of Production", ".panel");
   assert.ok(log.includes(`invited ${bobEmail}`), "the invite is in the log");
   assert.ok(log.includes(`removed ${bobEmail}'s access to Production`), "the revocation is in the log");
@@ -351,9 +365,7 @@ try {
   ok("Alice downloaded the activity log as CSV");
 
   // Acme Ops asks members to publish their SSH keys: Alice hasn't, so Teams reminds her.
-  await alice.exec(`[...document.querySelectorAll(".page-aside label.check")].find((l) => l.innerText.includes("publish the SSH keys")).querySelector("input").click(); return true`);
-  await alice.clickButton("Save policies");
-  await alice.wait(() => alice.exec(`return [...document.querySelectorAll(".page-aside button")].some((b) => b.innerText.includes("Save policies")) ? null : true`), "the saved policy");
+  await turnOn(alice, "Ask members to publish their SSH keys");
   await syncUntil(
     alice,
     () => alice.exec(`const b = document.querySelector("button.sidebar-foot.teams"); return b && b.innerText.includes("publish your keys") ? true : null`),
@@ -367,13 +379,7 @@ try {
   // Device approval: Alice requires it. Bob's current device stays approved; his new one
   // (Carol's app, signed in to Bob's account) waits, Alice denies it, and Bob approves it from
   // his first device.
-  await alice.wait(
-    () => alice.exec(`return [...document.querySelectorAll(".page-aside label.check")].some((l) => l.innerText.includes("approve new devices")) || null`),
-    "the policies",
-  );
-  await alice.exec(`[...document.querySelectorAll(".page-aside label.check")].find((l) => l.innerText.includes("approve new devices")).querySelector("input").click(); return true`);
-  await alice.clickButton("Save policies");
-  await alice.wait(() => alice.exec(`return [...document.querySelectorAll(".page-aside button")].some((b) => b.innerText.includes("Save policies")) ? null : true`), "the policies to save");
+  await turnOn(alice, "Approve new devices");
 
   // Bob's second device started out with a vault of its own, a host in it, and joins his account
   // from Sync ("I have an account"): the host goes into his account, and Acme Ops' vaults wait for
@@ -411,7 +417,7 @@ try {
 
   await openTeams(alice);
   await openOrg(alice, "Acme Ops");
-  await alice.waitText("Waiting for approval", ".panel.page");
+  await alice.waitText("waits for approval", ".needs");
   await alice.screenshot(`${shots}/alice-device-request.png`);
   await alice.exec(`[...document.querySelectorAll(".device-requests button")].find((b) => b.innerText === "Deny").click(); return true`);
   await alice.waitText("Denied", ".device-requests");
@@ -421,6 +427,7 @@ try {
 
   await openTeams(bob);
   await openOrg(bob, "Acme Ops");
+  await bob.pageTab("Members");
   await bob.waitText("Denied", ".device-requests");
   await bob.exec(`[...document.querySelectorAll(".device-requests button")].find((b) => b.innerText === "Approve").click(); return true`);
   await bob.wait(() => bob.exec(`return document.querySelector(".device-requests") ? null : true`), "the request to go");
@@ -428,7 +435,7 @@ try {
   await syncUntil(carol, () => carol.exec(`return document.querySelector("button.sidebar-foot.approval") ? null : true`), "the approval");
   await openTeams(carol);
   await openOrg(carol, "Acme Ops");
-  await carol.wait(() => carol.hasText(".panel .device-list strong", "Bob's tools"), "Bob's vault on his new device");
+  await carol.wait(() => carol.hasText(".panel .lname", "Bob's tools"), "Bob's vault on his new device");
   await carol.screenshot(`${shots}/carol-approved.png`);
   ok("Acme Ops required device approval: Bob's new device waited, Alice denied it, Bob approved it from his first device");
 
@@ -438,7 +445,8 @@ try {
     await syncNow(alice).catch(() => {});
     await openTeams(alice);
     await openOrg(alice, "Acme Ops");
-    if (await alice.hasText(".panel .device-list strong", "Bob's tools")) break;
+    await alice.pageTab("Vaults");
+    if (await alice.hasText(".panel .lname", "Bob's tools")) break;
     if (i >= 15) throw new Error("Bob's vault never reached Alice");
     await new Promise((r) => setTimeout(r, 1000));
   }
@@ -557,7 +565,7 @@ try {
 
   // The session: box's row is live in the sidebar; Files in the route bar opens SFTP on it.
   await alice.wait(
-    () => alice.exec(`return document.querySelector(".sidebar .list li.selected .avatar .live.connected") ? true : null`),
+    () => alice.exec(`return document.querySelector(".sidebar .list li.selected .sq.connected") ? true : null`),
     "box's live square",
   );
   await alice.wait(() => alice.exec(`return document.querySelector(".route-bar .pinned-key") ? true : null`), "the pinned key");
@@ -574,6 +582,7 @@ try {
   // Shared credentials and a group: box signs in as the group's "lab" identity and keeps its
   // session in tmux on the server; Reconnect picks that session back up.
   await openPage(alice, "Keys");
+  await alice.pageTab("Identities");
   await alice.clickButton("New identity");
   await alice.waitText("New identity", ".panel");
   await pickIn(alice, "Vault", "Bob's tools");
@@ -583,7 +592,8 @@ try {
   await alice.click(".panel form button[type=submit]");
   await alice.waitText("Edit identity", ".panel");
   await openPage(alice, "Keys");
-  await alice.wait(() => alice.hasText(".panel strong", "lab"), "the lab identity");
+  await alice.pageTab("Identities");
+  await alice.wait(() => alice.hasText(".panel .lname", "lab"), "the lab identity");
   await alice.click('button[aria-label="New group"]');
   await alice.waitText("New group", ".panel");
   await pickIn(alice, "Vault", "Bob's tools");
@@ -608,8 +618,8 @@ try {
   // The group's page lists it, with the identity its hosts use.
   await alice.exec(`document.querySelector('.sidebar button[aria-label="Open group Lab"]').click(); return true`);
   await alice.wait(() => alice.exec(`return document.querySelector(".panel.page h1")?.innerText === "Lab" || null`), "the Lab group's page");
-  assert.ok(await alice.hasText(".panel .page-main strong", "box"), "box is on the Lab page");
-  assert.ok(await alice.hasText(".panel .page-aside strong", "lab"), "so is the lab identity");
+  assert.ok(await alice.hasText(".panel .page-main .lname", "box"), "box is on the Lab page");
+  assert.ok(await alice.hasText(".panel .use-card .use-name", "lab"), "so is the lab identity");
   await alice.screenshot(`${shots}/alice-group-page.png`);
   await alice.exec(
     `[...document.querySelectorAll(".sidebar .host-group li")].find((l) => l.querySelector(".row-title")?.innerText === "box").querySelector(".row-main").click(); return true`,
diff --git a/apps/desktop/e2e/webdriver.mjs b/apps/desktop/e2e/webdriver.mjs
index a58f9a9..bcb0495 100644
--- a/apps/desktop/e2e/webdriver.mjs
+++ b/apps/desktop/e2e/webdriver.mjs
@@ -64,6 +64,25 @@ export async function session(application, base = BASE) {
         text,
       ),
 
+    /** "Add from…" on a list page, then one of its items ("Import…", "Clouds…"). */
+    addFrom: async (item) => {
+      await s.clickButton("Add from…");
+      await s.wait(() => s.exec(`return document.querySelector(".add-from .menu") ? true : null`), "the Add from menu");
+      await s.exec(
+        `const b = [...document.querySelectorAll(".add-from .menu button")].find((b) => b.innerText.startsWith(arguments[0]));
+         if (!b) throw new Error("no menu item " + arguments[0]); b.click(); return true`,
+        item,
+      );
+    },
+
+    /** One of a page's tabs ("Identities", "Host CAs"). */
+    pageTab: (label) =>
+      s.exec(
+        `const b = [...document.querySelectorAll(".page-tabs button")].find((b) => b.innerText.startsWith(arguments[0]));
+         if (!b) throw new Error("no tab " + arguments[0]); b.click(); return true`,
+        label,
+      ),
+
     /** Sets an input's value the way React notices. */
     type: (css, text) =>
       s.exec(
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index 8f193c3..dea7233 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -67,7 +67,7 @@ import { PasswordDialog } from "./PasswordDialog";
 import { CloudPage } from "./CloudPage";
 import { ImportHostsPage } from "./ImportHosts";
 import { ImportSnippetsPage } from "./ImportSnippets";
-import { GroupPage, GroupsPage, HostsPage, KeysPage, SnippetsPage, TunnelsPage, VpnsPage } from "./Lists";
+import { GroupPage, GroupsPage, HostsPage, KeysPage, SnippetsPage, TunnelsPage, VpnsPage, type KeysTab } from "./Lists";
 import { MoveContext } from "./Move";
 import { Sidebar, type LiveState, type PageKind } from "./Sidebar";
 import { SnippetPanel } from "./SnippetPanel";
@@ -173,7 +173,8 @@ type View =
   | { kind: "groups" }
   /** One group and everything in it. */
   | { kind: "groupPage"; id: string }
-  | { kind: "keys" }
+  /** `tab`: Keys (the default), Identities or Host CAs. */
+  | { kind: "keys"; tab?: KeysTab }
   | { kind: "snippets" }
   | { kind: "forwards" }
   | { kind: "vpns" };
@@ -532,6 +533,17 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
     }
     openTab({ kind: "saved", hostId: h.id, password, tmux }, h.label, kind, place);
   };
+  // A host's session: its latest tab (or a new one, if it closed meanwhile).
+  const showSession = (h: HostView) => {
+    const t = [...tabs].reverse().find((x) => x.target.kind === "saved" && x.target.hostId === h.id);
+    if (t) open({ kind: "tab", key: t.key });
+    else connectHost(h);
+  };
+  // Quick connect, filled in from the Hosts page's bar.
+  const quickConnect = (to?: ConnectPrefill) => {
+    if (to) setLinked({ n: (linked?.n ?? 0) + 1, connect: to });
+    open({ kind: "quick" });
+  };
 
   const busy = (id: string, on: boolean) =>
     setPending((p) => {
@@ -854,6 +866,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           vaults={vaults}
           orgs={orgList}
           keys={keyList}
+          syncStatus={syncStatus}
           onChanged={refresh}
           onClose={close}
           onSso={(orgId, orgName) => setSsoFor({ orgId, orgName })}
@@ -912,13 +925,14 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           vaults={vaults}
           live={live}
           onConnect={(h) => connectHost(h)}
+          onShowSession={showSession}
           onFiles={(h) => connectHost(h, undefined, "sftp")}
           onEdit={(id) => open({ kind: "host", id })}
           onEditGroup={(id) => open({ kind: "group", id })}
           onOpenGroup={(id) => open({ kind: "groupPage", id })}
           onImport={() => open({ kind: "importHosts" })}
           onCloud={() => open({ kind: "cloud" })}
-          onQuickConnect={mobile ? undefined : () => open({ kind: "quick" })}
+          onQuickConnect={mobile ? undefined : quickConnect}
           onClose={close}
         />
       )}
@@ -932,6 +946,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           keys={keyList}
           vpns={vpnList}
           vaults={vaults}
+          live={live}
           onOpen={(id) => open({ kind: "groupPage", id })}
           onEdit={(id) => open({ kind: "group", id })}
           onClose={close}
@@ -950,6 +965,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           live={live}
           pending={pending}
           onConnect={(h) => connectHost(h)}
+          onShowSession={showSession}
           onFiles={(h) => connectHost(h, undefined, "sftp")}
           onEditHost={(id) => open({ kind: "host", id })}
           onEditGroup={(id) => open({ kind: "group", id })}
@@ -973,6 +989,8 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           onOpenKey={(id) => open({ kind: "key", id })}
           onEditIdentity={(id) => open({ kind: "identity", id })}
           onEditHostCa={(id) => open({ kind: "hostCa", id })}
+          tab={view.tab ?? "keys"}
+          onTab={(tab) => setView({ kind: "keys", tab })}
           onClose={close}
         />
       )}
@@ -993,6 +1011,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           forwards={forwardList}
           hosts={hostList}
           vaults={vaults}
+          live={live}
           pending={pending}
           onToggle={toggleForward}
           onOpen={(id) => open({ kind: "forward", id })}
@@ -1128,6 +1147,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           activeHost={currentHost?.id ?? null}
           live={live}
           onConnect={(h) => connectHost(h)}
+          onShowSession={showSession}
           onOpenFiles={(h) => connectHost(h, undefined, "sftp")}
           onEditHost={(id) => open({ kind: "host", id })}
           onEditGroup={(id) => open({ kind: "group", id })}
diff --git a/apps/desktop/src/ListParts.tsx b/apps/desktop/src/ListParts.tsx
new file mode 100644
index 0000000..ad99de2
--- /dev/null
+++ b/apps/desktop/src/ListParts.tsx
@@ -0,0 +1,221 @@
+// The list pattern the pages share (Lists.tsx, TeamsPanel.tsx): a table with a row per item, its
+// name first (its main action), the columns people scan, then the row's other actions, shown on
+// hover or keyboard focus; a toolbar with search, filters and Select; states as squares and chips.
+
+import { useEffect, useRef, useState, type CSSProperties, type ReactNode } from "react";
+import { Icon, type IconName } from "./Icon";
+import type { pickOf, Selection } from "./Selection";
+import type { LiveState } from "./Sidebar";
+
+/** What a row needs while its list is selecting (see Selection.tsx). */
+export type Pick = ReturnType<typeof pickOf>;
+
+/** A list as a table. `cols`: the grid's columns, the actions' column last; `head`: their titles. */
+export function Table({ cols, label, head, children }: { cols: string; label: string; head: string[]; children: ReactNode }) {
+  return (
+    <div className="ltable" role="table" aria-label={label} style={{ "--cols": cols } as CSSProperties}>
+      <div className="lthead" role="row">
+        {head.map((h, i) => (
+          <span key={i} role="columnheader" className="section-title">
+            {h}
+          </span>
+        ))}
+        <span role="columnheader">
+          <span className="visually-hidden">Actions</span>
+        </span>
+      </div>
+      {children}
+    </div>
+  );
+}
+
+/** One row: its cells, then its actions. Picking: the whole row toggles it, and no actions. */
+export function TRow({ index, pick, className, children, actions }: { index: number; pick?: Pick; className?: string; children: ReactNode; actions?: ReactNode }) {
+  const classes = ["lrow", index % 2 === 1 && "band", pick && "picking", pick?.on && "picked", className].filter(Boolean).join(" ");
+  return (
+    <div role="row" className={classes} onClick={pick?.toggle}>
+      {children}
+      <span role="cell" className="rowact">
+        {!pick && actions}
+      </span>
+    </div>
+  );
+}
+
+/** A row's first cell: its name (a button for the row's main action) with what goes beside it,
+ * and a line under it. Picking: a checkbox in front, and the name is only text. */
+export function NameCell({
+  pick,
+  onOpen,
+  title,
+  lead,
+  name,
+  beside,
+  sub,
+  subMono,
+}: {
+  pick?: Pick;
+  onOpen?: () => void;
+  /** What the name's button does ("Connect to web-1"). */
+  title?: string;
+  /** Before the name: a status square or an icon. */
+  lead?: ReactNode;
+  name: string;
+  beside?: ReactNode;
+  sub?: ReactNode;
+  /** The line under it is machine text (an address). */
+  subMono?: boolean;
+}) {
+  const inner = (
+    <>
+      {lead}
+      <span className="lstack">
+        <span className="lname-row">
+          <span className="lname">{name}</span>
+          {beside}
+        </span>
+        {sub && <span className={`lsub ${subMono ? "mono" : ""}`}>{sub}</span>}
+      </span>
+    </>
+  );
+  return (
+    <span role="cell" className="lcell lfirst">
+      {pick && (
+        <input type="checkbox" className="pick" checked={pick.on} onChange={pick.toggle} onClick={(e) => e.stopPropagation()} aria-label={`Select ${pick.label}`} />
+      )}
+      {pick || !onOpen ? (
+        <span className="lnamebtn">{inner}</span>
+      ) : (
+        <button type="button" className="lnamebtn" onClick={onOpen} title={title}>
+          {inner}
+        </button>
+      )}
+    </span>
+  );
+}
+
+export const Cell = ({ children, className }: { children?: ReactNode; className?: string }) => (
+  <span role="cell" className={`lcell ${className ?? ""}`}>
+    {children}
+  </span>
+);
+
+/** A connection's state as a square, from the mark's cursor: shape and colour. */
+export function StatusSq({ state }: { state: LiveState | undefined }) {
+  return <span className={`sq ${state ?? "idle"}`} title={state === "connected" ? "Connected" : state === "connecting" ? "Connecting" : "Not connected"} />;
+}
+
+/** A state in a word, with its square. */
+export function Chip({ state, children }: { state: "connected" | "idle" | "attention" | "failed"; children: ReactNode }) {
+  return (
+    <span className={`chip ${state}`}>
+      <i aria-hidden="true" />
+      {children}
+    </span>
+  );
+}
+
+/** A row action as an icon. */
+export function IconAction({ icon, label, onClick }: { icon: IconName; label: string; onClick: () => void }) {
+  return (
+    <button type="button" className="icon small" onClick={onClick} title={label} aria-label={label}>
+      <Icon name={icon} size={14} />
+    </button>
+  );
+}
+
+/** A row action in words (Connect, Run). */
+export function TextAction({ children, onClick, warn }: { children: ReactNode; onClick: () => void; warn?: boolean }) {
+  return (
+    <button type="button" className={`text-action ${warn ? "warn" : ""}`} onClick={onClick}>
+      {children}
+    </button>
+  );
+}
+
+/** A list's toolbar: the search, filters, and Select (which the bar replaces while selecting). */
+export function Toolbar({
+  query,
+  setQuery,
+  placeholder,
+  label,
+  filters,
+  sel,
+  any,
+}: {
+  query: string;
+  setQuery: (q: string) => void;
+  placeholder: string;
+  label: string;
+  filters?: ReactNode;
+  sel: Selection;
+  any: boolean;
+}) {
+  return (
+    <div className="ltoolbar">
+      <label className="search page-search">
+        <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
+          <circle cx="11" cy="11" r="6" />
+          <path d="M20 20l-4.5-4.5" />
+        </svg>
+        <input placeholder={placeholder} aria-label={label} value={query} onChange={(e) => setQuery(e.target.value)} spellCheck={false} />
+      </label>
+      {filters}
+      <span className="spacer" />
+      {any && !sel.on && (
+        <button type="button" className="quiet small-button" onClick={sel.start}>
+          Select
+        </button>
+      )}
+    </div>
+  );
+}
+
+/** Filter buttons: one shown at a time ("all", or one of the others). */
+export function Filters({ value, onChange, options }: { value: string; onChange: (v: string) => void; options: { key: string; label: string; count?: number }[] }) {
+  return (
+    <div className="filters" role="group" aria-label="Show">
+      {options.map((o) => (
+        <button key={o.key} type="button" className={`filter ${value === o.key ? "on" : ""}`} aria-pressed={value === o.key} onClick={() => onChange(value === o.key ? "all" : o.key)}>
+          {o.label}
+          {o.count !== undefined && <b>{o.count}</b>}
+        </button>
+      ))}
+    </div>
+  );
+}
+
+/** "Add from…": the other ways to add, in a menu. */
+export function AddFrom({ items }: { items: { label: string; sub: string; onClick: () => void }[] }) {
+  const [open, setOpen] = useState(false);
+  const ref = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    if (!open) return;
+    const away = (e: MouseEvent) => {
+      if (!ref.current?.contains(e.target as Node)) setOpen(false);
+    };
+    const esc = (e: KeyboardEvent) => e.key === "Escape" && setOpen(false);
+    document.addEventListener("mousedown", away);
+    document.addEventListener("keydown", esc);
+    return () => (document.removeEventListener("mousedown", away), document.removeEventListener("keydown", esc));
+  }, [open]);
+  return (
+    <div className="add-from" ref={ref}>
+      <button type="button" className="secondary" aria-haspopup="menu" aria-expanded={open} onClick={() => setOpen(!open)}>
+        Add from…
+        <Icon name="chevron" size={12} />
+      </button>
+      {open && (
+        <div className="menu" role="menu">
+          {items.map((it) => (
+            <button key={it.label} type="button" role="menuitem" className="menu-item" onClick={() => (setOpen(false), it.onClick())}>
+              <span className="menu-title">{it.label}</span>
+              <span className="menu-sub">{it.sub}</span>
+            </button>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
diff --git a/apps/desktop/src/Lists.tsx b/apps/desktop/src/Lists.tsx
index f36dc17..bea3904 100644
--- a/apps/desktop/src/Lists.tsx
+++ b/apps/desktop/src/Lists.tsx
@@ -1,6 +1,10 @@
 // Pages that list one kind of item each: hosts (by group), groups, keys and identities, snippets,
 // tunnels and VPNs, and a group's page with everything in it. The sidebar keeps the host list for
 // connecting; everything is managed here.
+//
+// Every list is a table: a row per item, its name first (its main action: connect a host, open
+// anything else), then what people scan for, then the row's other actions, shown on hover or
+// keyboard focus. Every other row carries the greenbar band. One primary button per page.
 
 import { useEffect, useState, type ReactNode } from "react";
 import {
@@ -24,7 +28,9 @@ import {
   type VaultEntry,
   type VpnView,
 } from "./api";
-import { Icon } from "./Icon";
+import type { ConnectPrefill } from "./ConnectForm";
+import { Icon, type IconName } from "./Icon";
+import { AddFrom, Cell, Chip, Filters, IconAction, NameCell, StatusSq, Table, TextAction, Toolbar, TRow } from "./ListParts";
 import { MoveButton } from "./Move";
 import { Page } from "./Page";
 import type { LiveState } from "./Sidebar";
@@ -34,16 +40,6 @@ import { eachOf, outcome, pickOf, SelectBar, useSelection, type Selection } from
 
 const plural = (n: number, one: string, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
-/** "Select", for a list with something in it that isn't selecting yet. */
-function SelectButton({ sel, any }: { sel: Selection; any: boolean }) {
-  if (!any || sel.on) return null;
-  return (
-    <button type="button" className="secondary" onClick={sel.start}>
-      Select
-    </button>
-  );
-}
-
 /** The vault's name, for items in shared vaults. */
 function VaultTag({ vaults, id }: { vaults: VaultEntry[]; id: string | undefined }) {
   const v = vaults.find((x) => x.id === id);
@@ -66,51 +62,6 @@ function Empty({ text, action, onAction }: { text: string; action: string; onAct
   );
 }
 
-/** What a row needs while its list is selecting (see Selection.tsx). */
-type Pick = ReturnType<typeof pickOf>;
-
-/** One row: an avatar, a title line, detail lines, then buttons. Picking (`pick`): a checkbox
- * instead of the buttons, and the whole row toggles it. */
-function Row({
-  avatar,
-  title,
-  lines,
-  children,
-  on,
-  pick,
-}: {
-  avatar: ReactNode;
-  title: ReactNode;
-  lines: ReactNode[];
-  children?: ReactNode;
-  on?: boolean;
-  pick?: Pick;
-}) {
-  const classes = [on && "on", pick && "picking", pick?.on && "picked"].filter(Boolean).join(" ");
-  return (
-    <li className={classes || undefined} onClick={pick?.toggle}>
-      {pick && (
-        <input
-          type="checkbox"
-          className="pick"
-          checked={pick.on}
-          onChange={pick.toggle}
-          onClick={(e) => e.stopPropagation()}
-          aria-label={`Select ${pick.label}`}
-        />
-      )}
-      <span className="list-avatar">{avatar}</span>
-      <div>
-        {title}
-        {lines.filter(Boolean).map((l, i) => (
-          <small key={i}>{l}</small>
-        ))}
-      </div>
-      {children && !pick && <span className="list-buttons">{children}</span>}
-    </li>
-  );
-}
-
 // ------------------------------------------------------------------ hosts
 
 /** What hosts are described with. */
@@ -131,23 +82,66 @@ const nameOf = (id: string | null, list: { id?: string; label?: string; name?: s
   return it ? (it.label ?? it.name ?? "?") : "?";
 };
 
-/** How a host connects, in a line. */
-const hostHow = (h: HostView, t: Things) => {
-  const parts: string[] = [];
-  if (h.jumpId) parts.push(`via ${nameOf(h.jumpId, t.hosts)}`);
-  else if (h.source?.via) parts.push(`through ${REACH_NAMES[h.source.via]}`);
-  else if (h.proxyCommand) parts.push(h.proxyAllowed ? "through a proxy command" : "through a proxy command not allowed on this device");
-  else if (h.vpnId) parts.push(`VPN ${nameOf(h.vpnId, t.vpns)}`);
+/** How a host is reached: its jump host, cloud route or proxy command, and its VPN. */
+function HostRoute({ h, t }: { h: HostView; t: Things }) {
+  const vpn = h.vpnId ? t.vpns.find((v) => v.id === h.vpnId) : undefined;
+  const route = h.jumpId ? (
+    <>
+      <span className="muted">via</span> <span className="mono trunc">{nameOf(h.jumpId, t.hosts)}</span>
+    </>
+  ) : h.source?.via ? (
+    <span className="muted">through {REACH_NAMES[h.source.via]}</span>
+  ) : h.proxyCommand ? (
+    <span className={h.proxyAllowed ? "muted" : "error-text"}>{h.proxyAllowed ? "proxy command" : "proxy command not allowed here"}</span>
+  ) : (
+    <span className="muted">direct</span>
+  );
+  return (
+    <>
+      {route}
+      {vpn && (
+        <span className={`tag ${vpn.active ? "up" : ""}`} title={`VPN ${vpn.label}${vpn.active ? ": up" : ""}`}>
+          {vpn.label}
+        </span>
+      )}
+    </>
+  );
+}
+
+/** How a host signs in, and what it does beyond that. */
+function hostSignIn(h: HostView, t: Things): { how: ReactNode; more: string } {
   const identity = identityOf(h, t.groups);
-  if (identity) parts.push(`identity ${nameOf(identity, t.identities)}${h.identityId ? "" : " (the group's)"}`);
-  else if (h.auth.kind === "key") parts.push(`key ${nameOf(h.auth.keyId, t.keys)}`);
-  else parts.push(h.auth.kind === "agent" ? agentDescription(h.auth) : h.auth.saved ? "saved password" : "password each time");
-  if (h.keepSession) parts.push("keeps its session");
-  if (h.recordSessions) parts.push("recorded");
-  return parts.join(" · ");
+  const how = identity ? (
+    <>
+      identity <span className="mono">{nameOf(identity, t.identities)}</span>
+      {h.identityId ? "" : " (the group's)"}
+    </>
+  ) : h.auth.kind === "key" ? (
+    <>
+      key <span className="mono">{nameOf(h.auth.keyId, t.keys)}</span>
+    </>
+  ) : h.auth.kind === "agent" ? (
+    agentDescription(h.auth)
+  ) : h.auth.saved ? (
+    "saved password"
+  ) : (
+    "password each time"
+  );
+  const more = [h.keepSession && "keeps its session", h.recordSessions && "recorded"].filter(Boolean).join(" · ");
+  return { how, more };
+}
+
+/** What a group gives its hosts, in parts. */
+const groupParts = (g: GroupView, t: Things) => {
+  const parts: ReactNode[] = [];
+  if (g.identityId) parts.push(<span key="i">identity <span className="mono">{nameOf(g.identityId, t.identities)}</span></span>);
+  if (g.jumpId) parts.push(<span key="j">via <span className="mono">{nameOf(g.jumpId, t.hosts)}</span></span>);
+  if (g.vpnId) parts.push(<span key="v">VPN <span className="mono">{nameOf(g.vpnId, t.vpns)}</span></span>);
+  if (g.keepSession) parts.push(<span key="k">keeps sessions</span>);
+  return parts;
 };
 
-/** What a group gives its hosts, in a line. */
+/** The same in a line, for text. */
 const groupHow = (g: GroupView, t: Things) => {
   const parts: string[] = [];
   if (g.identityId) parts.push(`identity ${nameOf(g.identityId, t.identities)}`);
@@ -157,12 +151,17 @@ const groupHow = (g: GroupView, t: Things) => {
   return parts.join(" · ");
 };
 
+const HOST_COLS = "minmax(170px, 1.6fr) minmax(110px, 1fr) minmax(110px, 1fr) minmax(60px, 0.6fr) 116px";
+const HOST_HEAD = ["Host", "Route", "Signs in with", "Tags"];
+
 interface HostRowsProps {
   list: HostView[];
   things: Things;
   vaults: VaultEntry[];
   live: Map<string, LiveState>;
   onConnect: (h: HostView) => void;
+  /** A host with a session: its tab. */
+  onShowSession?: (h: HostView) => void;
   onFiles: (h: HostView) => void;
   onEdit: (id?: string) => void;
   sel?: Selection;
@@ -170,64 +169,100 @@ interface HostRowsProps {
 
 function HostRows({ list, things, ...p }: HostRowsProps) {
   return (
-    <ul className="device-list item-list">
-      {list.map((h) => {
+    <>
+      {list.map((h, i) => {
         const state = p.live.get(h.id);
+        const { how, more } = hostSignIn(h, things);
+        const toSession = state && p.onShowSession;
         return (
-          <Row
+          <TRow
             key={h.id}
-            on={!!state}
+            index={i}
             pick={p.sel && pickOf(p.sel, h.id, h.label)}
-            avatar={
-              <>
-                {(h.label[0] ?? "?").toUpperCase()}
-                {state && <i className={`live ${state}`} title={state === "connected" ? "Connected" : "Connecting"} />}
-              </>
-            }
-            title={
+            actions={
               <>
-                <strong>{h.label}</strong>
-                <VaultTag vaults={p.vaults} id={h.vaultId} />
-                {h.source?.gone && (
-                  <span className="kind-badge gone" title="Its cloud no longer lists it: it was kept, remove it if it's gone for good">
-                    gone from {PROVIDERS[h.source.provider || "vallic"]?.name ?? "its cloud"}
-                  </span>
-                )}
-                {h.source?.state && !h.source.gone && (
-                  <span className="kind-badge" title="Not running: it keeps its last address until it starts">
-                    {h.source.state.replace(/^VM /, "").toLowerCase()}
-                  </span>
-                )}
-                {h.tags.map((t) => (
-                  <span key={t} className="tag">
-                    {t}
-                  </span>
-                ))}
+                <TextAction onClick={() => p.onConnect(h)}>{state ? "New tab" : "Connect"}</TextAction>
+                {!h.source?.noSftp && <IconAction icon="files" label="Browse files (SFTP)" onClick={() => p.onFiles(h)} />}
+                <IconAction icon="edit" label={`Edit ${h.label}`} onClick={() => p.onEdit(h.id)} />
               </>
             }
-            lines={[
-              <span className="mono">
-                {h.user}@{h.hostname}
-                {h.port !== 22 ? `:${h.port}` : ""}
-              </span>,
-              hostHow(h, things),
-            ]}
           >
-            <button type="button" className="primary small-button" onClick={() => p.onConnect(h)}>
-              Connect
-            </button>
-            {!h.source?.noSftp && (
-              <button type="button" className="secondary small-button" onClick={() => p.onFiles(h)}>
-                Files
-              </button>
-            )}
-            <button type="button" className="secondary small-button" onClick={() => p.onEdit(h.id)} aria-label={`Edit ${h.label}`}>
-              Edit
-            </button>
-          </Row>
+            <NameCell
+              pick={p.sel && pickOf(p.sel, h.id, h.label)}
+              onOpen={() => (toSession ? p.onShowSession!(h) : p.onConnect(h))}
+              title={toSession ? `Go to ${h.label}'s session` : `Connect to ${h.user}@${h.hostname}:${h.port}`}
+              lead={<StatusSq state={state} />}
+              name={h.label}
+              beside={
+                <>
+                  <VaultTag vaults={p.vaults} id={h.vaultId} />
+                  {h.source?.gone && (
+                    <span className="kind-badge gone" title="Its cloud no longer lists it: it was kept, remove it if it's gone for good">
+                      gone from {PROVIDERS[h.source.provider || "vallic"]?.name ?? "its cloud"}
+                    </span>
+                  )}
+                  {h.source?.state && !h.source.gone && (
+                    <span className="kind-badge" title="Not running: it keeps its last address until it starts">
+                      {h.source.state.replace(/^VM /, "").toLowerCase()}
+                    </span>
+                  )}
+                </>
+              }
+              sub={`${h.user}@${h.hostname}:${h.port}`}
+              subMono
+            />
+            <Cell>
+              <HostRoute h={h} t={things} />
+            </Cell>
+            <Cell className="lstack">
+              <span className="trunc">{how}</span>
+              {more && <span className="lsub">{more}</span>}
+            </Cell>
+            <Cell className="ltags">
+              {h.tags.slice(0, 2).map((t) => (
+                <span key={t} className="tag">
+                  {t}
+                </span>
+              ))}
+              {h.tags.length > 2 && <span className="muted" title={h.tags.slice(2).join(", ")}>+{h.tags.length - 2}</span>}
+            </Cell>
+          </TRow>
         );
       })}
-    </ul>
+    </>
+  );
+}
+
+/** Quick connect, as a bar: what's typed fills in the quick connect form. */
+function QuickBar({ onQuickConnect }: { onQuickConnect: (to?: ConnectPrefill) => void }) {
+  const [text, setText] = useState("");
+  const m = text.trim().match(/^(?:([^@\s]+)@)?(\[[^\]\s]+\]|[^:@\s]+)(?::(\d{1,5}))?$/);
+  const port = m?.[3] ? Number(m[3]) : null;
+  const to: ConnectPrefill | null = m && (port === null || (port > 0 && port < 65536)) ? { user: m[1] ?? null, host: m[2].replace(/^\[|\]$/g, ""), port, label: null } : null;
+  return (
+    <form
+      className="quick-bar"
+      onSubmit={(e) => {
+        e.preventDefault();
+        onQuickConnect(to ?? undefined);
+      }}
+    >
+      <span className="section-title">Quick connect</span>
+      <input
+        className="mono grow"
+        placeholder="user@host:port"
+        aria-label="Quick connect to user@host:port"
+        value={text}
+        onChange={(e) => setText(e.target.value)}
+        spellCheck={false}
+        autoCapitalize="off"
+        autoComplete="off"
+      />
+      <button type="submit" className="secondary" disabled={text.trim() !== "" && !to}>
+        Connect…
+      </button>
+      <small className="hint quick-hint">Fills in quick connect, where you choose how to sign in. Nothing is saved.</small>
+    </form>
   );
 }
 
@@ -240,6 +275,7 @@ interface HostsProps {
   vaults: VaultEntry[];
   live: Map<string, LiveState>;
   onConnect: (h: HostView) => void;
+  onShowSession: (h: HostView) => void;
   onFiles: (h: HostView) => void;
   onEdit: (id?: string) => void;
   onEditGroup: (id?: string) => void;
@@ -247,8 +283,8 @@ interface HostsProps {
   /** Hosts from OpenSSH's configuration (desktop). */
   onImport: () => void;
   onCloud: () => void;
-  /** Quick connect, to a host not saved (desktop, where this page is home once there are hosts). */
-  onQuickConnect?: () => void;
+  /** Quick connect (desktop, where this page is home once there are hosts), filled in or not. */
+  onQuickConnect?: (to?: ConnectPrefill) => void;
   /** After a change made here (several deleted, moved to a group). */
   onChanged: () => void;
   onClose: () => void;
@@ -258,38 +294,39 @@ const matches = (h: HostView, q: string) => [h.label, h.hostname, h.user, ...h.t
 
 export function HostsPage(p: HostsProps) {
   const [query, setQuery] = useState("");
+  const [filter, setFilter] = useState("all");
   const sel = useSelection();
   const q = query.trim().toLowerCase();
-  const shown = q ? p.hosts.filter((h) => matches(h, q)) : p.hosts;
+  const connected = p.hosts.filter((h) => p.live.has(h.id)).length;
+  // The tags most hosts carry, as filters.
+  const tagCounts = new Map<string, number>();
+  p.hosts.forEach((h) => h.tags.forEach((t) => tagCounts.set(t, (tagCounts.get(t) ?? 0) + 1)));
+  const tags = [...tagCounts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 5);
+  const shown = p.hosts.filter(
+    (h) => (!q || matches(h, q)) && (filter === "all" || (filter === "connected" ? p.live.has(h.id) : h.tags.includes(filter.slice(4)))),
+  );
+  const narrowed = !!q || filter !== "all";
   const ungrouped = shown.filter((h) => !h.groupId || !p.groups.some((g) => g.id === h.groupId));
-  const rows = { things: p, vaults: p.vaults, live: p.live, onConnect: p.onConnect, onFiles: p.onFiles, onEdit: p.onEdit, sel };
+  const rows = { things: p, vaults: p.vaults, live: p.live, onConnect: p.onConnect, onShowSession: p.onShowSession, onFiles: p.onFiles, onEdit: p.onEdit, sel };
   return (
     <Page
       title="Hosts"
       lead={
         p.hosts.length
-          ? `${plural(p.hosts.length, "host")}${p.groups.length ? ` in ${plural(p.groups.length, "group")}` : ""}. A group's settings apply to its hosts unless a host sets its own.`
+          ? `${plural(p.hosts.length, "host")}${p.groups.length ? ` in ${plural(p.groups.length, "group")}` : ""}${connected ? `. ${connected} connected` : ""}.`
           : undefined
       }
       onClose={p.onClose}
       actions={
         <>
-          {p.onQuickConnect && (
-            <button type="button" className="secondary" onClick={p.onQuickConnect}>
-              Quick connect
-            </button>
-          )}
           {!mobileOs && (
-            <button type="button" className="secondary" onClick={p.onImport}>
-              Import…
-            </button>
-          )}
-          {!mobileOs && (
-            <button type="button" className="secondary" onClick={p.onCloud}>
-              Clouds…
-            </button>
+            <AddFrom
+              items={[
+                { label: "Import…", sub: "OpenSSH's config, PuTTY, a CSV file, Royal TS", onClick: p.onImport },
+                { label: "Clouds…", sub: "Machines from AWS, DigitalOcean, Vallic Cloud…", onClick: p.onCloud },
+              ]}
+            />
           )}
-          <SelectButton sel={sel} any={p.hosts.length > 0} />
           <button type="button" className="secondary" onClick={() => p.onEditGroup()}>
             New group
           </button>
@@ -299,90 +336,112 @@ export function HostsPage(p: HostsProps) {
         </>
       }
     >
-      <SelectBar
-        sel={sel}
-        shown={shown.map((h) => ({ id: h.id, vaultId: h.vaultId }))}
-        noun={["host", "hosts"]}
-        onDelete={bulk.remove}
-        onChanged={p.onChanged}
-        more={(ids, vaultId, report) =>
-          vaultId && (
-            <select
-              className="small-select"
-              aria-label="Move to group"
-              value=""
-              onChange={(e) => {
-                const group = e.target.value;
-                bulk.setGroup(ids, group === "none" ? null : group).then(
-                  (r) => (report(outcome(r, "Moved", ["host", "hosts"])), p.onChanged()),
-                  (err) => report({ ok: false, text: errorText(err) }),
-                );
-              }}
-            >
-              <option value="" disabled>
-                Move to group…
-              </option>
-              {p.groups
-                .filter((g) => g.vaultId === vaultId)
-                .map((g) => (
-                  <option key={g.id} value={g.id}>
-                    {g.name}
-                  </option>
-                ))}
-              <option value="none">No group</option>
-            </select>
-          )
-        }
-      />
+      {p.onQuickConnect && <QuickBar onQuickConnect={p.onQuickConnect} />}
       {p.hosts.length === 0 ? (
         <Empty text="No hosts yet." action="Add your first host" onAction={() => p.onEdit()} />
       ) : (
         <>
-          <label className="search page-search">
-            <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
-              <circle cx="11" cy="11" r="6" />
-              <path d="M20 20l-4.5-4.5" />
-            </svg>
-            <input placeholder="Search by name, address, user or tag" aria-label="Search hosts" value={query} onChange={(e) => setQuery(e.target.value)} spellCheck={false} />
-          </label>
-          {shown.length === 0 && <p className="hint">No hosts match “{query}”.</p>}
-          {ungrouped.length > 0 && (
-            <section className="stack">
-              {p.groups.length > 0 && <h2 className="section-title">Not in a group</h2>}
-              <HostRows list={ungrouped} {...rows} />
-            </section>
+          <Toolbar
+            query={query}
+            setQuery={setQuery}
+            placeholder="Search by name, address, user or tag"
+            label="Search hosts"
+            sel={sel}
+            any={p.hosts.length > 0}
+            filters={
+              (connected > 0 || tags.length > 0) && (
+                <Filters
+                  value={filter}
+                  onChange={setFilter}
+                  options={[
+                    ...(connected > 0 ? [{ key: "connected", label: "Connected", count: connected }] : []),
+                    ...tags.map(([t, n]) => ({ key: `tag:${t}`, label: t, count: n })),
+                  ]}
+                />
+              )
+            }
+          />
+          <SelectBar
+            sel={sel}
+            shown={shown.map((h) => ({ id: h.id, vaultId: h.vaultId }))}
+            noun={["host", "hosts"]}
+            onDelete={bulk.remove}
+            onChanged={p.onChanged}
+            more={(ids, vaultId, report) =>
+              vaultId && (
+                <select
+                  className="small-select"
+                  aria-label="Move to group"
+                  value=""
+                  onChange={(e) => {
+                    const group = e.target.value;
+                    bulk.setGroup(ids, group === "none" ? null : group).then(
+                      (r) => (report(outcome(r, "Moved", ["host", "hosts"])), p.onChanged()),
+                      (err) => report({ ok: false, text: errorText(err) }),
+                    );
+                  }}
+                >
+                  <option value="" disabled>
+                    Move to group…
+                  </option>
+                  {p.groups
+                    .filter((g) => g.vaultId === vaultId)
+                    .map((g) => (
+                      <option key={g.id} value={g.id}>
+                        {g.name}
+                      </option>
+                    ))}
+                  <option value="none">No group</option>
+                </select>
+              )
+            }
+          />
+          {shown.length === 0 ? (
+            <p className="hint page-pad">No hosts match{q ? ` “${query}”` : " this filter"}.</p>
+          ) : (
+            <Table cols={HOST_COLS} label="Hosts" head={HOST_HEAD}>
+              {ungrouped.length > 0 && (
+                <section className="lsection">
+                  {p.groups.length > 0 && (
+                    <div className="lghead">
+                      <span className="lgname">Not in a group</span>
+                      <span className="lgcount">{ungrouped.length}</span>
+                    </div>
+                  )}
+                  <HostRows list={ungrouped} {...rows} />
+                </section>
+              )}
+              {p.groups.map((g) => {
+                const members = shown.filter((h) => h.groupId === g.id);
+                if (narrowed && members.length === 0) return null;
+                const parts = groupParts(g, p);
+                return (
+                  <section key={g.id} className="lsection">
+                    <div className="lghead">
+                      <button type="button" className="lgname" onClick={() => p.onOpenGroup(g.id!)} title={`Open the group ${g.name}`}>
+                        <Icon name="group" size={14} />
+                        {g.name}
+                      </button>
+                      <span className="lgcount">{members.length}</span>
+                      <VaultTag vaults={p.vaults} id={g.vaultId} />
+                      {parts.length > 0 && <span className="defaults">{parts}</span>}
+                      <span className="spacer" />
+                      <button type="button" className="text-action" onClick={() => p.onEditGroup(g.id)} aria-label={`Edit group ${g.name}`}>
+                        Edit group
+                      </button>
+                    </div>
+                    {members.length ? (
+                      <HostRows list={members} {...rows} />
+                    ) : (
+                      <p className="hint lempty">No hosts in it yet. Pick the group in a host's editor.</p>
+                    )}
+                  </section>
+                );
+              })}
+            </Table>
           )}
         </>
       )}
-      {p.groups.map((g) => {
-        const members = shown.filter((h) => h.groupId === g.id);
-        if (q && members.length === 0) return null;
-        const summary = groupHow(g, p);
-        return (
-          <section key={g.id} className="stack">
-            <div className="group-title">
-              <Icon name="group" size={15} />
-              <h2>
-                <button type="button" className="title-link" onClick={() => p.onOpenGroup(g.id!)}>
-                  {g.name}
-                </button>
-              </h2>
-              <span className="group-count">{members.length}</span>
-              <VaultTag vaults={p.vaults} id={g.vaultId} />
-              <span className="spacer" />
-              <button type="button" className="secondary small-button" onClick={() => p.onEditGroup(g.id)} aria-label={`Edit group ${g.name}`}>
-                Edit group
-              </button>
-            </div>
-            {summary && <p className="hint">Hosts here use {summary}.</p>}
-            {members.length ? (
-              <HostRows list={members} {...rows} />
-            ) : (
-              <p className="hint">No hosts in it yet. Pick the group in a host's editor.</p>
-            )}
-          </section>
-        );
-      })}
     </Page>
   );
 }
@@ -391,6 +450,7 @@ export function HostsPage(p: HostsProps) {
 
 interface GroupsProps extends Things {
   vaults: VaultEntry[];
+  live: Map<string, LiveState>;
   onOpen: (id: string) => void;
   onEdit: (id?: string) => void;
   onChanged: () => void;
@@ -399,65 +459,59 @@ interface GroupsProps extends Things {
 
 export function GroupsPage(p: GroupsProps) {
   const sel = useSelection();
+  const [query, setQuery] = useState("");
+  const q = query.trim().toLowerCase();
+  const shown = q ? p.groups.filter((g) => g.name.toLowerCase().includes(q)) : p.groups;
   return (
     <Page
       title="Groups"
       lead="Hosts that belong together. A group's settings (who to sign in as, a jump host, a VPN, a terminal scheme) apply to its hosts unless a host sets its own."
       onClose={p.onClose}
       actions={
-        <>
-          <SelectButton sel={sel} any={p.groups.length > 0} />
-          <button type="button" className="primary" onClick={() => p.onEdit()}>
-            New group
-          </button>
-        </>
+        <button type="button" className="primary" onClick={() => p.onEdit()}>
+          New group
+        </button>
       }
     >
-      <SelectBar
-        sel={sel}
-        shown={p.groups.map((g) => ({ id: g.id!, vaultId: g.vaultId! }))}
-        noun={["group", "groups"]}
-        onDelete={bulk.remove}
-        onChanged={p.onChanged}
-      />
       {p.groups.length === 0 ? (
         <Empty text="No groups yet." action="Make a group" onAction={() => p.onEdit()} />
       ) : (
-        <ul className="device-list item-list">
-          {p.groups.map((g) => {
-            const count = p.hosts.filter((h) => h.groupId === g.id).length;
-            const summary = groupHow(g, p);
-            return (
-              <Row
-                key={g.id}
-                pick={pickOf(sel, g.id!, g.name)}
-                avatar={<Icon name="group" size={14} />}
-                title={
-                  <>
-                    <strong>
-                      {sel.on ? (
-                        g.name
-                      ) : (
-                        <button type="button" className="title-link" onClick={() => p.onOpen(g.id!)}>
-                          {g.name}
-                        </button>
-                      )}
-                    </strong>
-                    <VaultTag vaults={p.vaults} id={g.vaultId} />
-                  </>
-                }
-                lines={[plural(count, "host"), summary && `Its hosts use ${summary}`, sel.on && count > 0 && "Deleting it keeps its hosts"]}
-              >
-                <button type="button" className="secondary small-button" onClick={() => p.onOpen(g.id!)} aria-label={`Open ${g.name}`}>
-                  Open
-                </button>
-                <button type="button" className="secondary small-button" onClick={() => p.onEdit(g.id)} aria-label={`Edit group ${g.name}`}>
-                  Edit
-                </button>
-              </Row>
-            );
-          })}
-        </ul>
+        <>
+          <Toolbar query={query} setQuery={setQuery} placeholder="Search groups" label="Search groups" sel={sel} any />
+          <SelectBar sel={sel} shown={shown.map((g) => ({ id: g.id!, vaultId: g.vaultId! }))} noun={["group", "groups"]} onDelete={bulk.remove} onChanged={p.onChanged} />
+          <Table cols="minmax(170px, 1.2fr) 56px minmax(200px, 2fr) 80px 40px" label="Groups" head={["Group", "Hosts", "What its hosts get", "Connected"]}>
+            {shown.map((g, i) => {
+              const members = p.hosts.filter((h) => h.groupId === g.id);
+              const live = members.filter((h) => p.live.has(h.id)).length;
+              const parts = groupParts(g, p);
+              return (
+                <TRow key={g.id} index={i} pick={pickOf(sel, g.id!, g.name)} actions={<IconAction icon="edit" label={`Edit group ${g.name}`} onClick={() => p.onEdit(g.id)} />}>
+                  <NameCell
+                    pick={pickOf(sel, g.id!, g.name)}
+                    onOpen={() => p.onOpen(g.id!)}
+                    title={`Open ${g.name}`}
+                    lead={<Icon name="group" size={15} />}
+                    name={g.name}
+                    beside={<VaultTag vaults={p.vaults} id={g.vaultId} />}
+                    sub={sel.on && members.length > 0 ? "Deleting it keeps its hosts" : undefined}
+                  />
+                  <Cell className="num">{members.length}</Cell>
+                  <Cell>{parts.length ? <span className="defaults">{parts}</span> : <span className="muted">Nothing: each host its own</span>}</Cell>
+                  <Cell>
+                    {live > 0 ? (
+                      <>
+                        <StatusSq state="connected" />
+                        {live}
+                      </>
+                    ) : (
+                      <span className="muted">None</span>
+                    )}
+                  </Cell>
+                </TRow>
+              );
+            })}
+          </Table>
+        </>
       )}
     </Page>
   );
@@ -470,6 +524,7 @@ interface GroupProps extends Things {
   live: Map<string, LiveState>;
   pending: Set<string>;
   onConnect: (h: HostView) => void;
+  onShowSession: (h: HostView) => void;
   onFiles: (h: HostView) => void;
   onEditHost: (id?: string) => void;
   onEditGroup: (id: string) => void;
@@ -482,8 +537,10 @@ interface GroupProps extends Things {
   onClose: () => void;
 }
 
-/** One group and everything in it: its hosts, the tunnels through them, their files, and what they
- * use to connect. */
+const sizeText = (n: number) => (n < 1024 ? `${n} B` : n < 1048576 ? `${Math.round(n / 1024)} KB` : `${(n / 1048576).toFixed(1)} MB`);
+
+/** One group and everything in it: what its hosts use to connect, its hosts, the tunnels through
+ * them and their files. */
 export function GroupPage(p: GroupProps) {
   const g = p.group;
   const members = p.hosts.filter((h) => h.groupId === g.id);
@@ -512,53 +569,30 @@ export function GroupPage(p: GroupProps) {
   const jumps = p.hosts.filter((j) => !memberIds.has(j.id) && members.some((h) => h.jumpId === j.id));
   const summary = groupHow(g, p);
   const hostLabel = (id: string | null) => p.hosts.find((h) => h.id === id)?.label ?? "";
-
-  const uses = (
-    <div className="stack">
-      <h2 className="section-title">What its hosts use</h2>
-      {identities.length + keys.length + vpns.length + jumps.length === 0 ? (
-        <p className="hint">Nothing from the vault: they sign in with a password or the SSH agent, directly.</p>
-      ) : (
-        <ul className="device-list item-list">
-          {identities.map((i) => (
-            <Row key={i.id} avatar={<Icon name="identity" size={14} />} title={<strong>{i.label}</strong>} lines={[`Identity · ${i.user}`]}>
-              <button type="button" className="secondary small-button" onClick={() => p.onOpenIdentity(i.id)} aria-label={`Open ${i.label}`}>
-                Open
-              </button>
-            </Row>
-          ))}
-          {keys.map((k) => (
-            <Row key={k.id} avatar={<Icon name="key" size={14} />} title={<strong>{k.label}</strong>} lines={[`Key · ${k.algorithm.replace(/^ssh-/, "")}`]}>
-              <button type="button" className="secondary small-button" onClick={() => p.onOpenKey(k.id)} aria-label={`Open ${k.label}`}>
-                Open
-              </button>
-            </Row>
-          ))}
-          {jumps.map((j) => (
-            <Row key={j.id} avatar={<Icon name="host" size={14} />} title={<strong>{j.label}</strong>} lines={["Jump host"]}>
-              <button type="button" className="secondary small-button" onClick={() => p.onEditHost(j.id)} aria-label={`Edit ${j.label}`}>
-                Edit
-              </button>
-            </Row>
-          ))}
-          {vpns.map((v) => (
-            <Row key={v.id} on={v.active} avatar={<Icon name="vpn" size={14} />} title={<strong>{v.label}</strong>} lines={[`VPN · ${vpnKindName(v.kind)}`]}>
-              <button type="button" className="secondary small-button" onClick={() => p.onOpenVpn(v.id)} aria-label={`Open ${v.label}`}>
-                Open
-              </button>
-            </Row>
-          ))}
-        </ul>
-      )}
-    </div>
-  );
+  const uses: { kind: string; icon: IconName; label: string; sub: ReactNode; open: () => void }[] = [
+    ...identities.map((i) => ({ kind: "Identity", icon: "identity" as const, label: i.label, sub: <span className="mono">{i.user}</span>, open: () => p.onOpenIdentity(i.id) })),
+    ...keys.map((k) => ({ kind: "Key", icon: "key" as const, label: k.label, sub: k.algorithm.replace(/^ssh-/, ""), open: () => p.onOpenKey(k.id) })),
+    ...jumps.map((j) => ({ kind: "Jump host", icon: "host" as const, label: j.label, sub: <span className="mono">{j.hostname}</span>, open: () => p.onEditHost(j.id) })),
+    ...vpns.map((v) => ({
+      kind: "VPN",
+      icon: "vpn" as const,
+      label: v.label,
+      sub: (
+        <>
+          {vpnKindName(v.kind)}
+          {v.active && <span className="tag up">up</span>}
+        </>
+      ),
+      open: () => p.onOpenVpn(v.id),
+    })),
+  ];
 
   return (
     <Page
       back={{ label: "Groups", onClick: p.onBack }}
       title={g.name}
       badge={<VaultTag vaults={p.vaults} id={g.vaultId} />}
-      lead={summary ? `Its hosts use ${summary}, unless they set their own.` : "Its hosts each sign in and connect their own way."}
+      lead={`${plural(members.length, "host")}. ${summary ? "Its settings apply to them unless a host sets its own." : "Its hosts each sign in and connect their own way."}`}
       onClose={p.onClose}
       actions={
         <>
@@ -568,12 +602,32 @@ export function GroupPage(p: GroupProps) {
           </button>
         </>
       }
-      aside={uses}
     >
+      <section className="stack">
+        <h2 className="section-title">What its hosts use</h2>
+        {uses.length === 0 ? (
+          <p className="hint">Nothing from the vault: they sign in with a password or the SSH agent, directly.</p>
+        ) : (
+          <div className="use-cards">
+            {uses.map((u) => (
+              <button key={`${u.kind}:${u.label}`} type="button" className="use-card" onClick={u.open} title={`Open ${u.label}`}>
+                <span className="section-title">{u.kind}</span>
+                <span className="use-name">
+                  <Icon name={u.icon} size={14} />
+                  {u.label}
+                </span>
+                <span className="lsub">{u.sub}</span>
+              </button>
+            ))}
+          </div>
+        )}
+      </section>
       <section className="stack">
         <h2 className="section-title">Hosts</h2>
         {members.length ? (
-          <HostRows list={members} things={p} vaults={p.vaults} live={p.live} onConnect={p.onConnect} onFiles={p.onFiles} onEdit={p.onEditHost} />
+          <Table cols={HOST_COLS} label={`Hosts in ${g.name}`} head={HOST_HEAD}>
+            <HostRows list={members} things={p} vaults={p.vaults} live={p.live} onConnect={p.onConnect} onShowSession={p.onShowSession} onFiles={p.onFiles} onEdit={p.onEditHost} />
+          </Table>
         ) : (
           <p className="hint">None yet. Pick the group in a host's editor.</p>
         )}
@@ -581,30 +635,25 @@ export function GroupPage(p: GroupProps) {
       {tunnels.length > 0 && (
         <section className="stack">
           <h2 className="section-title">Tunnels</h2>
-          <TunnelRows forwards={tunnels} hosts={p.hosts} vaults={p.vaults} pending={p.pending} onToggle={p.onToggleForward} onOpen={p.onOpenForward} />
+          <TunnelTable forwards={tunnels} hosts={p.hosts} vaults={p.vaults} live={p.live} pending={p.pending} onToggle={p.onToggleForward} onOpen={p.onOpenForward} />
         </section>
       )}
       {(files?.length ?? 0) > 0 && (
         <section className="stack">
           <h2 className="section-title">Files</h2>
-          <ul className="device-list item-list">
-            {files!.map((f) => (
-              <Row
+          <Table cols="minmax(170px, 1.4fr) minmax(120px, 1fr) 70px 56px" label="Files" head={["File", "Host", "Size"]}>
+            {files!.map((f, i) => (
+              <TRow
                 key={f.id}
-                avatar={<Icon name="files" size={14} />}
-                title={<strong>{f.name}</strong>}
-                lines={[`${hostLabel(f.hostId)} · ${f.size < 1024 ? `${f.size} B` : f.size < 1048576 ? `${Math.round(f.size / 1024)} KB` : `${(f.size / 1048576).toFixed(1)} MB`}`]}
+                index={i}
+                actions={<TextAction onClick={() => attachmentsApi.save(f.id).then((path) => setSaved(`Saved ${path}`), (e) => setError(errorText(e)))}>Save</TextAction>}
               >
-                <button
-                  type="button"
-                  className="secondary small-button"
-                  onClick={() => attachmentsApi.save(f.id).then((path) => setSaved(`Saved ${path}`), (e) => setError(errorText(e)))}
-                >
-                  Save
-                </button>
-              </Row>
+                <NameCell lead={<Icon name="files" size={14} />} name={f.name} />
+                <Cell className="trunc">{hostLabel(f.hostId)}</Cell>
+                <Cell className="num muted">{sizeText(f.size)}</Cell>
+              </TRow>
             ))}
-          </ul>
+          </Table>
         </section>
       )}
       {saved && <p className="ok">{saved}</p>}
@@ -625,24 +674,44 @@ interface KeysProps {
   onEditIdentity: (id?: string) => void;
   hostCas: HostCaView[];
   onEditHostCa: (id?: string) => void;
+  /** The tab open; it's part of the view, so closing an editor returns to it. */
+  tab: KeysTab;
+  onTab: (tab: KeysTab) => void;
   onChanged: () => void;
   onClose: () => void;
 }
 
+export type KeysTab = "keys" | "identities" | "cas";
+
+/** A key's certificate, as a state: none, valid (for how long), soon over, over or unreadable. */
+function CertState({ k }: { k: KeyView }) {
+  if (k.certificateError) return <Chip state="failed">Can't be read</Chip>;
+  if (!k.certificate) return <span className="muted">None</span>;
+  const left = k.certificate.validBefore - Date.now() / 1000;
+  if (k.certificate.validBefore >= 2 ** 62) return <Chip state="connected">No expiry</Chip>;
+  if (left <= 0) return <Chip state="failed">Expired</Chip>;
+  const days = Math.floor(left / 86400);
+  const when = days >= 1 ? `${days} d` : `${Math.max(1, Math.floor(left / 3600))} h`;
+  return days < 7 ? <Chip state="attention">Expires in {when}</Chip> : <Chip state="connected">Valid {when}</Chip>;
+}
+
 export function KeysPage(p: KeysProps) {
-  // Keys and identities together: a key can go with the identity that uses it.
   const sel = useSelection();
+  const tab = p.tab;
+  const [query, setQuery] = useState("");
+  const q = query.trim().toLowerCase();
+  const pickTab = (t: KeysTab) => (sel.stop(), setQuery(""), p.onTab(t));
   const keyUse = (k: KeyView) => {
     const hosts = p.hosts.filter((h) => h.auth.kind === "key" && h.auth.keyId === k.id).length;
     const ids = p.identities.filter((i) => i.auth.kind === "key" && i.auth.keyId === k.id).length;
     const parts = [hosts && plural(hosts, "host"), ids && plural(ids, "identity", "identities")].filter(Boolean);
-    return parts.length ? `Used by ${parts.join(" and ")}` : "Not used yet";
+    return parts.length ? parts.join(", ") : "Not used yet";
   };
   const idUse = (it: IdentityView) => {
     const hosts = p.hosts.filter((h) => h.identityId === it.id).length;
     const groups = p.groups.filter((g) => g.identityId === it.id).length;
     const parts = [hosts && plural(hosts, "host"), groups && plural(groups, "group")].filter(Boolean);
-    return parts.length ? `Used by ${parts.join(" and ")}` : "Not used yet";
+    return parts.length ? parts.join(", ") : "Not used yet";
   };
   const authText = (it: IdentityView) =>
     it.auth.kind === "key"
@@ -650,115 +719,145 @@ export function KeysPage(p: KeysProps) {
       : it.auth.kind === "agent"
         ? agentDescription(it.auth)
         : "password";
+  const keys = q ? p.keys.filter((k) => `${k.label} ${k.fingerprint}`.toLowerCase().includes(q)) : p.keys;
+  const identities = q ? p.identities.filter((i) => `${i.label} ${i.user}`.toLowerCase().includes(q)) : p.identities;
+  const cas = q ? p.hostCas.filter((c) => `${c.label} ${c.hosts.join(" ")}`.toLowerCase().includes(q)) : p.hostCas;
+  const shown = tab === "keys" ? keys : tab === "identities" ? identities : cas;
+  const total = tab === "keys" ? p.keys.length : tab === "identities" ? p.identities.length : p.hostCas.length;
+  const tabs: [KeysTab, string, number][] = [
+    ["keys", "Keys", p.keys.length],
+    ["identities", "Identities", p.identities.length],
+    ["cas", "Host CAs", p.hostCas.length],
+  ];
+  const primary =
+    tab === "keys" ? (
+      <button type="button" className="primary" onClick={() => p.onOpenKey()}>
+        New key
+      </button>
+    ) : tab === "identities" ? (
+      <button type="button" className="primary" onClick={() => p.onEditIdentity()}>
+        New identity
+      </button>
+    ) : (
+      <button type="button" className="primary" onClick={() => p.onEditHostCa()}>
+        New host CA
+      </button>
+    );
 
   return (
     <Page
       title="Keys"
-      lead="SSH keys stay in the vault, encrypted, and are used from there: they are never written to disk."
+      lead={
+        tab === "keys"
+          ? "SSH keys stay in the vault, encrypted, and are used from there: they are never written to disk."
+          : tab === "identities"
+            ? "A user and a key (or password) that several hosts share. Change it once and they all follow."
+            : "Hosts whose keys a CA signed are trusted without pinning each one (@cert-authority)."
+      }
       onClose={p.onClose}
-      actions={
-        <>
-          <SelectButton sel={sel} any={p.keys.length + p.identities.length + p.hostCas.length > 0} />
-          <button type="button" className="primary" onClick={() => p.onOpenKey()}>
-            New key
+      actions={primary}
+    >
+      <div className="page-tabs" role="tablist" aria-label="Keys, identities and host CAs">
+        {tabs.map(([t, label, n]) => (
+          <button key={t} type="button" role="tab" aria-selected={tab === t} className={`page-tab ${tab === t ? "on" : ""}`} onClick={() => pickTab(t)}>
+            {label}
+            <b>{n}</b>
           </button>
-        </>
-      }
-      aside={
-        <div className="stack">
-          <div className="row align-center">
-            <h2 className="section-title grow">Identities</h2>
-            <button type="button" className="secondary small-button" onClick={() => p.onEditIdentity()}>
-              New identity
-            </button>
-          </div>
-          <p className="hint">A user and a key (or password) that several hosts share. Change it once and they all follow.</p>
-          {p.identities.length > 0 && (
-            <ul className="device-list item-list">
-              {p.identities.map((it) => (
-                <Row
-                  key={it.id}
-                  pick={pickOf(sel, it.id, it.label)}
-                  avatar={<Icon name="identity" size={14} />}
-                  title={
-                    <>
-                      <strong>{it.label}</strong>
-                      <VaultTag vaults={p.vaults} id={it.vaultId} />
-                    </>
-                  }
-                  lines={[`${it.user} · ${authText(it)}`, idUse(it)]}
-                >
-                  <button type="button" className="secondary small-button" onClick={() => p.onEditIdentity(it.id)} aria-label={`Edit ${it.label}`}>
-                    Edit
-                  </button>
-                </Row>
+        ))}
+      </div>
+      {total === 0 ? (
+        tab === "keys" ? (
+          <Empty text="No keys yet." action="Generate or import a key" onAction={() => p.onOpenKey()} />
+        ) : tab === "identities" ? (
+          <Empty text="No identities yet." action="Make an identity" onAction={() => p.onEditIdentity()} />
+        ) : (
+          <Empty text="No host CAs yet." action="Trust a host CA" onAction={() => p.onEditHostCa()} />
+        )
+      ) : (
+        <>
+          <Toolbar
+            query={query}
+            setQuery={setQuery}
+            placeholder={tab === "keys" ? "Search keys" : tab === "identities" ? "Search identities" : "Search host CAs"}
+            label="Search"
+            sel={sel}
+            any
+          />
+          <SelectBar
+            sel={sel}
+            shown={shown.map((x) => ({ id: x.id, vaultId: x.vaultId }))}
+            noun={tab === "keys" ? ["key", "keys"] : tab === "identities" ? ["identity", "identities"] : ["host CA", "host CAs"]}
+            onDelete={bulk.remove}
+            onChanged={p.onChanged}
+          />
+          {tab === "keys" && (
+            <Table cols="minmax(170px, 1.2fr) minmax(160px, 1.5fr) minmax(100px, 0.9fr) 120px 40px" label="Keys" head={["Key", "Fingerprint", "Used by", "Certificate"]}>
+              {keys.map((k, i) => (
+                <TRow key={k.id} index={i} pick={pickOf(sel, k.id, k.label)} actions={<IconAction icon="edit" label={`Open ${k.label}`} onClick={() => p.onOpenKey(k.id)} />}>
+                  <NameCell
+                    pick={pickOf(sel, k.id, k.label)}
+                    onOpen={() => p.onOpenKey(k.id)}
+                    title={`Open ${k.label}`}
+                    lead={<Icon name="key" size={15} />}
+                    name={k.label}
+                    beside={
+                      <>
+                        <span className="tag">{k.algorithm.replace(/^ssh-/, "")}</span>
+                        {k.encrypted && <span className="tag">passphrase</span>}
+                        <VaultTag vaults={p.vaults} id={k.vaultId} />
+                      </>
+                    }
+                  />
+                  <Cell className="mono lsub trunc">{k.fingerprint}</Cell>
+                  <Cell className="trunc">{keyUse(k)}</Cell>
+                  <Cell>
+                    <CertState k={k} />
+                  </Cell>
+                </TRow>
               ))}
-            </ul>
+            </Table>
           )}
-          <div className="row align-center">
-            <h2 className="section-title grow">Host CAs</h2>
-            <button type="button" className="secondary small-button" onClick={() => p.onEditHostCa()}>
-              New host CA
-            </button>
-          </div>
-          <p className="hint">Hosts whose keys a CA signed are trusted without pinning each one (@cert-authority).</p>
-          {p.hostCas.length > 0 && (
-            <ul className="device-list item-list">
-              {p.hostCas.map((ca) => (
-                <Row
-                  key={ca.id}
-                  pick={pickOf(sel, ca.id, ca.label)}
-                  avatar={<Icon name="key" size={14} />}
-                  title={
-                    <>
-                      <strong>{ca.label}</strong>
-                      <VaultTag vaults={p.vaults} id={ca.vaultId} />
-                    </>
-                  }
-                  lines={[<span className="mono">{ca.hosts.join(", ")}</span>, <span className="mono">{ca.fingerprint}</span>]}
-                >
-                  <button type="button" className="secondary small-button" onClick={() => p.onEditHostCa(ca.id)} aria-label={`Edit ${ca.label}`}>
-                    Edit
-                  </button>
-                </Row>
+          {tab === "identities" && (
+            <Table cols="minmax(170px, 1.2fr) minmax(170px, 1.4fr) minmax(110px, 0.9fr) 40px" label="Identities" head={["Identity", "Signs in as", "Used by"]}>
+              {identities.map((it, i) => (
+                <TRow key={it.id} index={i} pick={pickOf(sel, it.id, it.label)} actions={<IconAction icon="edit" label={`Edit ${it.label}`} onClick={() => p.onEditIdentity(it.id)} />}>
+                  <NameCell
+                    pick={pickOf(sel, it.id, it.label)}
+                    onOpen={() => p.onEditIdentity(it.id)}
+                    title={`Edit ${it.label}`}
+                    lead={<Icon name="identity" size={15} />}
+                    name={it.label}
+                    beside={<VaultTag vaults={p.vaults} id={it.vaultId} />}
+                  />
+                  <Cell className="trunc">
+                    <span className="mono">{it.user}</span>
+                    <span className="muted">· {authText(it)}</span>
+                  </Cell>
+                  <Cell className="trunc">{idUse(it)}</Cell>
+                </TRow>
               ))}
-            </ul>
+            </Table>
           )}
-        </div>
-      }
-    >
-      <SelectBar
-        sel={sel}
-        shown={[...p.keys, ...p.identities, ...p.hostCas].map((x) => ({ id: x.id, vaultId: x.vaultId }))}
-        noun={["item", "items"]}
-        onDelete={bulk.remove}
-        onChanged={p.onChanged}
-      />
-      {p.keys.length === 0 ? (
-        <Empty text="No keys yet." action="Generate or import a key" onAction={() => p.onOpenKey()} />
-      ) : (
-        <ul className="device-list item-list">
-          {p.keys.map((k) => (
-            <Row
-              key={k.id}
-              pick={pickOf(sel, k.id, k.label)}
-              avatar={<Icon name="key" size={14} />}
-              title={
-                <>
-                  <strong>{k.label}</strong>
-                  <span className="kind-badge">{k.algorithm.replace(/^ssh-/, "")}</span>
-                  {k.encrypted && <span className="kind-badge">passphrase</span>}
-                  <VaultTag vaults={p.vaults} id={k.vaultId} />
-                </>
-              }
-              lines={[<span className="mono">{k.fingerprint}</span>, keyUse(k)]}
-            >
-              <button type="button" className="secondary small-button" onClick={() => p.onOpenKey(k.id)} aria-label={`Open ${k.label}`}>
-                Open
-              </button>
-            </Row>
-          ))}
-        </ul>
+          {tab === "cas" && (
+            <Table cols="minmax(170px, 1.2fr) minmax(150px, 1.4fr) minmax(150px, 1.4fr) 40px" label="Host CAs" head={["Host CA", "Trusted for", "Fingerprint"]}>
+              {cas.map((ca, i) => (
+                <TRow key={ca.id} index={i} pick={pickOf(sel, ca.id, ca.label)} actions={<IconAction icon="edit" label={`Edit ${ca.label}`} onClick={() => p.onEditHostCa(ca.id)} />}>
+                  <NameCell
+                    pick={pickOf(sel, ca.id, ca.label)}
+                    onOpen={() => p.onEditHostCa(ca.id)}
+                    title={`Edit ${ca.label}`}
+                    lead={<Icon name="key" size={15} />}
+                    name={ca.label}
+                    beside={<VaultTag vaults={p.vaults} id={ca.vaultId} />}
+                  />
+                  <Cell className="mono trunc">{ca.hosts.join(", ")}</Cell>
+                  <Cell className="mono lsub trunc">{ca.fingerprint}</Cell>
+                </TRow>
+              ))}
+            </Table>
+          )}
+          {shown.length === 0 && <p className="hint page-pad">Nothing matches “{query}”.</p>}
+        </>
       )}
     </Page>
   );
@@ -781,6 +880,15 @@ interface SnippetsProps {
 
 export function SnippetsPage(p: SnippetsProps) {
   const sel = useSelection();
+  const [query, setQuery] = useState("");
+  const [filter, setFilter] = useState("all");
+  const q = query.trim().toLowerCase();
+  const tagCounts = new Map<string, number>();
+  p.snippets.forEach((s) => s.tags.forEach((t) => tagCounts.set(t, (tagCounts.get(t) ?? 0) + 1)));
+  const tags = [...tagCounts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 5);
+  const shown = p.snippets.filter(
+    (s) => (!q || [s.name, s.body, ...s.tags].some((x) => x.toLowerCase().includes(q))) && (filter === "all" || s.tags.includes(filter.slice(4))),
+  );
   return (
     <Page
       title="Snippets"
@@ -788,7 +896,6 @@ export function SnippetsPage(p: SnippetsProps) {
       onClose={p.onClose}
       actions={
         <>
-          <SelectButton sel={sel} any={p.snippets.length > 0} />
           <button type="button" className="secondary" onClick={p.onImport}>
             Import…
           </button>
@@ -798,54 +905,69 @@ export function SnippetsPage(p: SnippetsProps) {
         </>
       }
     >
-      <SelectBar
-        sel={sel}
-        shown={p.snippets.map((s) => ({ id: s.id, vaultId: s.vaultId }))}
-        noun={["snippet", "snippets"]}
-        onDelete={bulk.remove}
-        onChanged={p.onChanged}
-      />
       {p.snippets.length === 0 ? (
         <Empty text="No snippets yet." action="Save a command you run often" onAction={() => p.onOpen()} />
       ) : (
-        <ul className="device-list item-list">
-          {p.snippets.map((sn) => {
-            const lines = sn.body.split("\n");
-            return (
-              <Row
-                key={sn.id}
-                pick={pickOf(sel, sn.id, sn.name)}
-                avatar={<Icon name="snippet" size={14} />}
-                title={
-                  <>
-                    <strong>{sn.name}</strong>
-                    <VaultTag vaults={p.vaults} id={sn.vaultId} />
-                    {sn.tags.map((t) => (
-                      <span key={t} className="tag">
-                        {t}
-                      </span>
-                    ))}
-                  </>
-                }
-                lines={[<span className="mono">{lines[0]}</span>, lines.length > 1 && `${lines.length} lines`]}
-              >
-                {p.target && (
-                  <>
-                    <button type="button" className="secondary small-button" onClick={() => p.onSend(sn.body, false)}>
-                      Paste
-                    </button>
-                    <button type="button" className="primary small-button" onClick={() => p.onSend(sn.body, true)}>
-                      Run
-                    </button>
-                  </>
-                )}
-                <button type="button" className="secondary small-button" onClick={() => p.onOpen(sn.id)} aria-label={`Edit ${sn.name}`}>
-                  Edit
-                </button>
-              </Row>
-            );
-          })}
-        </ul>
+        <>
+          <Toolbar
+            query={query}
+            setQuery={setQuery}
+            placeholder="Search by name, command or tag"
+            label="Search snippets"
+            sel={sel}
+            any
+            filters={tags.length > 0 && <Filters value={filter} onChange={setFilter} options={tags.map(([t, n]) => ({ key: `tag:${t}`, label: t, count: n }))} />}
+          />
+          <SelectBar sel={sel} shown={shown.map((s) => ({ id: s.id, vaultId: s.vaultId }))} noun={["snippet", "snippets"]} onDelete={bulk.remove} onChanged={p.onChanged} />
+          {shown.length === 0 ? (
+            <p className="hint page-pad">No snippets match{q ? ` “${query}”` : " this filter"}.</p>
+          ) : (
+            <Table cols={`minmax(160px, 1fr) minmax(200px, 2.2fr) minmax(70px, 0.6fr) ${p.target ? "140px" : "40px"}`} label="Snippets" head={["Snippet", "Command", "Tags"]}>
+              {shown.map((sn, i) => {
+                const lines = sn.body.split("\n");
+                return (
+                  <TRow
+                    key={sn.id}
+                    index={i}
+                    pick={pickOf(sel, sn.id, sn.name)}
+                    actions={
+                      <>
+                        {p.target && (
+                          <>
+                            <TextAction onClick={() => p.onSend(sn.body, false)}>Paste</TextAction>
+                            <TextAction onClick={() => p.onSend(sn.body, true)}>Run</TextAction>
+                          </>
+                        )}
+                        <IconAction icon="edit" label={`Edit ${sn.name}`} onClick={() => p.onOpen(sn.id)} />
+                      </>
+                    }
+                  >
+                    <NameCell
+                      pick={pickOf(sel, sn.id, sn.name)}
+                      onOpen={() => p.onOpen(sn.id)}
+                      title={`Edit ${sn.name}`}
+                      lead={<Icon name="snippet" size={15} />}
+                      name={sn.name}
+                      beside={<VaultTag vaults={p.vaults} id={sn.vaultId} />}
+                    />
+                    <Cell className="lstack">
+                      <span className="mono trunc">{lines[0]}</span>
+                      {lines.length > 1 && <span className="lsub">{plural(lines.length, "line")}</span>}
+                    </Cell>
+                    <Cell className="ltags">
+                      {sn.tags.slice(0, 2).map((t) => (
+                        <span key={t} className="tag">
+                          {t}
+                        </span>
+                      ))}
+                      {sn.tags.length > 2 && <span className="muted">+{sn.tags.length - 2}</span>}
+                    </Cell>
+                  </TRow>
+                );
+              })}
+            </Table>
+          )}
+        </>
       )}
     </Page>
   );
@@ -857,6 +979,7 @@ interface TunnelsProps {
   forwards: ForwardView[];
   hosts: HostView[];
   vaults: VaultEntry[];
+  live: Map<string, LiveState>;
   pending: Set<string>;
   onToggle: (f: ForwardView) => void;
   onOpen: (id?: string) => void;
@@ -866,81 +989,95 @@ interface TunnelsProps {
 
 export function TunnelsPage(p: TunnelsProps) {
   const sel = useSelection();
+  const [query, setQuery] = useState("");
+  const [filter, setFilter] = useState("all");
+  const q = query.trim().toLowerCase();
   const running = p.forwards.filter((f) => f.running).length;
+  const shown = p.forwards.filter((f) => (!q || `${f.label} ${describeForward(f)}`.toLowerCase().includes(q)) && (filter === "all" || f.running));
   return (
     <Page
       title="Tunnels"
       lead={p.forwards.length ? `${running} of ${p.forwards.length} running. A tunnel forwards a port through a host's SSH connection.` : undefined}
       onClose={p.onClose}
       actions={
-        <>
-          <SelectButton sel={sel} any={p.forwards.length > 0} />
-          <button type="button" className="primary" onClick={() => p.onOpen()}>
-            New tunnel
-          </button>
-        </>
+        <button type="button" className="primary" onClick={() => p.onOpen()}>
+          New tunnel
+        </button>
       }
     >
-      <SelectBar
-        sel={sel}
-        shown={p.forwards.map((f) => ({ id: f.id, vaultId: f.vaultId }))}
-        noun={["tunnel", "tunnels"]}
-        onDelete={(ids) => eachOf(ids, forwardsApi.remove)}
-        onChanged={p.onChanged}
-      />
       {p.forwards.length === 0 ? (
         <Empty text="No tunnels yet." action="Forward a port through a host" onAction={() => p.onOpen()} />
       ) : (
-        <TunnelRows forwards={p.forwards} hosts={p.hosts} vaults={p.vaults} pending={p.pending} onToggle={p.onToggle} onOpen={p.onOpen} sel={sel} />
+        <>
+          <Toolbar
+            query={query}
+            setQuery={setQuery}
+            placeholder="Search tunnels"
+            label="Search tunnels"
+            sel={sel}
+            any
+            filters={running > 0 && <Filters value={filter} onChange={setFilter} options={[{ key: "running", label: "Running", count: running }]} />}
+          />
+          <SelectBar sel={sel} shown={shown.map((f) => ({ id: f.id, vaultId: f.vaultId }))} noun={["tunnel", "tunnels"]} onDelete={(ids) => eachOf(ids, forwardsApi.remove)} onChanged={p.onChanged} />
+          {shown.length === 0 ? (
+            <p className="hint page-pad">No tunnels match{q ? ` “${query}”` : " this filter"}.</p>
+          ) : (
+            <TunnelTable forwards={shown} hosts={p.hosts} vaults={p.vaults} live={p.live} pending={p.pending} onToggle={p.onToggle} onOpen={p.onOpen} sel={sel} />
+          )}
+        </>
       )}
     </Page>
   );
 }
 
-function TunnelRows(p: Omit<TunnelsProps, "onClose" | "onChanged"> & { sel?: Selection }) {
+/** Tunnels, their switch first: on or off is what people come here for. */
+function TunnelTable(p: Omit<TunnelsProps, "onClose" | "onChanged"> & { sel?: Selection }) {
   return (
-    <ul className="device-list item-list">
-      {p.forwards.map((f) => {
+    <Table cols="36px minmax(120px, 1fr) minmax(140px, 1.4fr) minmax(100px, 1fr) 120px 32px" label="Tunnels" head={["On", "Tunnel", "Forwards", "Through", "State"]}>
+      {p.forwards.map((f, i) => {
         const busy = p.pending.has(f.id);
+        const host = p.hosts.find((h) => h.id === f.hostId);
         return (
-          <Row
-            key={f.id}
-            on={f.running}
-            pick={p.sel && pickOf(p.sel, f.id, f.label)}
-            avatar={<Icon name="tunnel" size={14} />}
-            title={
-              <>
-                <strong>{f.label}</strong>
-                <VaultTag vaults={p.vaults} id={f.vaultId} />
-              </>
-            }
-            lines={[
-              <span className="mono">
-                {describeForward(f)}
-                {f.running && f.active > 0 ? ` · ${f.active} open` : ""}
-              </span>,
-              `Through ${p.hosts.find((h) => h.id === f.hostId)?.label ?? "a host that's gone"}`,
-            ]}
-          >
-            <button type="button" className="secondary small-button" onClick={() => p.onOpen(f.id)} aria-label={`Edit ${f.label}`}>
-              Edit
-            </button>
-            <button
-              type="button"
-              role="switch"
-              aria-checked={f.running}
-              aria-label={`${f.running ? "Stop" : "Start"} ${f.label}`}
-              title={f.running ? "Stop tunnel" : "Start tunnel"}
-              className={`switch ${f.running ? "on" : ""} ${busy ? "busy" : ""}`}
-              disabled={busy}
-              onClick={() => p.onToggle(f)}
-            >
-              <i />
-            </button>
-          </Row>
+          <TRow key={f.id} index={i} pick={p.sel && pickOf(p.sel, f.id, f.label)} actions={<IconAction icon="edit" label={`Edit ${f.label}`} onClick={() => p.onOpen(f.id)} />}>
+            <Cell>
+              <button
+                type="button"
+                role="switch"
+                aria-checked={f.running}
+                aria-label={`${f.running ? "Stop" : "Start"} ${f.label}`}
+                title={f.running ? "Stop tunnel" : "Start tunnel"}
+                className={`switch ${f.running ? "on" : ""} ${busy ? "busy" : ""}`}
+                disabled={busy || !!p.sel?.on}
+                onClick={(e) => (e.stopPropagation(), p.onToggle(f))}
+              >
+                <i />
+              </button>
+            </Cell>
+            <NameCell pick={p.sel && pickOf(p.sel, f.id, f.label)} onOpen={() => p.onOpen(f.id)} title={`Edit ${f.label}`} name={f.label} beside={<VaultTag vaults={p.vaults} id={f.vaultId} />} />
+            <Cell className="mono trunc">{describeForward(f)}</Cell>
+            <Cell className="trunc">
+              {host ? (
+                <>
+                  <StatusSq state={p.live.get(host.id)} />
+                  <span className="mono trunc">{host.label}</span>
+                </>
+              ) : (
+                <span className="error-text">a host that's gone</span>
+              )}
+            </Cell>
+            <Cell>
+              {busy ? (
+                <Chip state="attention">{f.running ? "Stopping…" : "Starting…"}</Chip>
+              ) : f.running ? (
+                <Chip state="connected">{f.active > 0 ? `Running · ${f.active} open` : "Running"}</Chip>
+              ) : (
+                <Chip state="idle">Stopped</Chip>
+              )}
+            </Cell>
+          </TRow>
         );
       })}
-    </ul>
+    </Table>
   );
 }
 
@@ -958,61 +1095,61 @@ interface VpnsProps {
 
 export function VpnsPage(p: VpnsProps) {
   const sel = useSelection();
+  const [query, setQuery] = useState("");
+  const q = query.trim().toLowerCase();
   const use = (v: VpnView) => {
     const hosts = p.hosts.filter((h) => h.vpnId === v.id).length;
     const groups = p.groups.filter((g) => g.vpnId === v.id).length;
     const parts = [hosts && plural(hosts, "host"), groups && plural(groups, "group")].filter(Boolean);
-    return parts.length ? `Used by ${parts.join(" and ")}` : "Not used by a host yet";
+    return parts.length ? parts.join(", ") : "No host yet";
   };
+  const shown = q ? p.vpns.filter((v) => `${v.label} ${v.server}`.toLowerCase().includes(q)) : p.vpns;
   return (
     <Page
       title="VPNs"
       lead="Hosts that use a VPN connect through it. It starts with the first session or tunnel that needs it and stops after the last, inside MorphGate: nothing changes on the system."
       onClose={p.onClose}
       actions={
-        <>
-          <SelectButton sel={sel} any={p.vpns.length > 0} />
-          <button type="button" className="primary" onClick={() => p.onOpen()}>
-            New VPN
-          </button>
-        </>
+        <button type="button" className="primary" onClick={() => p.onOpen()}>
+          New VPN
+        </button>
       }
     >
-      <SelectBar
-        sel={sel}
-        shown={p.vpns.map((v) => ({ id: v.id, vaultId: v.vaultId }))}
-        noun={["VPN", "VPNs"]}
-        onDelete={(ids) => eachOf(ids, vpnsApi.remove)}
-        onChanged={p.onChanged}
-      />
       {p.vpns.length === 0 ? (
         <Empty text="No VPNs yet." action="Add a client's VPN (WireGuard, OpenVPN, AnyConnect…)" onAction={() => p.onOpen()} />
       ) : (
-        <ul className="device-list item-list">
-          {p.vpns.map((v) => (
-            <Row
-              key={v.id}
-              on={v.active}
-              pick={pickOf(sel, v.id, v.label)}
-              avatar={<Icon name="vpn" size={14} />}
-              title={
-                <>
-                  <strong>{v.label}</strong>
-                  <span className="kind-badge">{vpnKindName(v.kind)}</span>
-                  <VaultTag vaults={p.vaults} id={v.vaultId} />
-                </>
-              }
-              lines={[
-                <span className="mono">{v.server}</span>,
-                v.problem ? <span className="error-text">{v.problem}</span> : v.active ? `Connected${v.address ? ` · ${v.address}` : ""}` : use(v),
-              ]}
-            >
-              <button type="button" className="secondary small-button" onClick={() => p.onOpen(v.id)} aria-label={`Open ${v.label}`}>
-                Open
-              </button>
-            </Row>
-          ))}
-        </ul>
+        <>
+          <Toolbar query={query} setQuery={setQuery} placeholder="Search VPNs" label="Search VPNs" sel={sel} any />
+          <SelectBar sel={sel} shown={shown.map((v) => ({ id: v.id, vaultId: v.vaultId }))} noun={["VPN", "VPNs"]} onDelete={(ids) => eachOf(ids, vpnsApi.remove)} onChanged={p.onChanged} />
+          <Table cols="minmax(170px, 1.2fr) minmax(140px, 1.2fr) minmax(100px, 0.9fr) 100px 40px" label="VPNs" head={["VPN", "Server", "Used by", "State"]}>
+            {shown.map((v, i) => (
+              <TRow key={v.id} index={i} pick={pickOf(sel, v.id, v.label)} actions={<IconAction icon="edit" label={`Open ${v.label}`} onClick={() => p.onOpen(v.id)} />}>
+                <NameCell
+                  pick={pickOf(sel, v.id, v.label)}
+                  onOpen={() => p.onOpen(v.id)}
+                  title={`Open ${v.label}`}
+                  lead={<Icon name="vpn" size={15} />}
+                  name={v.label}
+                  beside={<VaultTag vaults={p.vaults} id={v.vaultId} />}
+                  sub={
+                    v.problem ? (
+                      <span className="error-text">{v.problem}</span>
+                    ) : (
+                      <>
+                        {vpnKindName(v.kind)}
+                        {v.active && v.address && <span className="mono"> · {v.address}</span>}
+                      </>
+                    )
+                  }
+                />
+                <Cell className="mono trunc">{v.server}</Cell>
+                <Cell className="trunc">{use(v)}</Cell>
+                <Cell>{v.problem ? <Chip state="failed">Problem</Chip> : v.active ? <Chip state="connected">Up</Chip> : <Chip state="idle">Down</Chip>}</Cell>
+              </TRow>
+            ))}
+          </Table>
+          {shown.length === 0 && <p className="hint page-pad">No VPNs match “{query}”.</p>}
+        </>
       )}
     </Page>
   );
diff --git a/apps/desktop/src/Page.tsx b/apps/desktop/src/Page.tsx
index 3eef452..e378a21 100644
--- a/apps/desktop/src/Page.tsx
+++ b/apps/desktop/src/Page.tsx
@@ -34,8 +34,11 @@ export function Page({ title, badge, lead, back, actions, onClose, aside, childr
               <div className="page-actions">
                 {actions}
                 {onClose && (
-                  <button type="button" className="secondary page-close" onClick={onClose}>
-                    Close
+                  <button type="button" className="icon page-close" onClick={onClose} title="Close">
+                    <svg viewBox="0 0 24 24" width="16" height="16" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
+                      <path d="M6 6l12 12M18 6L6 18" />
+                    </svg>
+                    <span className="visually-hidden">Close</span>
                   </button>
                 )}
               </div>
diff --git a/apps/desktop/src/Sidebar.tsx b/apps/desktop/src/Sidebar.tsx
index 72f5b5c..1d0a3ae 100644
--- a/apps/desktop/src/Sidebar.tsx
+++ b/apps/desktop/src/Sidebar.tsx
@@ -46,6 +46,8 @@ interface Props {
   /** Hosts with an open session. */
   live: Map<string, LiveState>;
   onConnect: (host: HostView) => void;
+  /** A host with a session: its tab. */
+  onShowSession: (host: HostView) => void;
   onOpenFiles: (host: HostView) => void;
   onEditHost: (id?: string) => void;
   syncStatus: SyncStatus | null;
@@ -96,6 +98,7 @@ export function Sidebar({
   activeHost,
   live,
   onConnect,
+  onShowSession,
   onOpenFiles,
   onEditHost,
   syncStatus,
@@ -157,16 +160,21 @@ export function Sidebar({
     </button>
   );
 
-  const hostRow = (h: HostView, i: number) => {
+  // `session`: a row of the Open list, which goes to the host's tab.
+  const hostRow = (h: HostView, i: number, session = false) => {
     const on = selected === h.id || activeHost === h.id;
     const state = live.get(h.id);
     return (
       <li key={h.id} className={`${on ? "selected" : ""} ${band(i)} ${h.source?.gone ? "gone" : ""}`}>
-        <button className="row-main" onClick={() => onConnect(h)} title={`Connect to ${h.user}@${h.hostname}:${h.port}`}>
-          <span className={`avatar ${on ? "on" : ""}`}>
-            {(h.label[0] ?? "?").toUpperCase()}
-            {state && <i className={`live ${state}`} title={state === "connected" ? "Connected" : "Connecting"} />}
-          </span>
+        <button
+          className="row-main"
+          onClick={() => (session ? onShowSession(h) : onConnect(h))}
+          title={session ? `Go to ${h.label}'s session` : `Connect to ${h.user}@${h.hostname}:${h.port}`}
+        >
+          <span
+            className={`sq ${state ?? "idle"}`}
+            title={state === "connected" ? "Connected" : state === "connecting" ? "Connecting" : "Not connected"}
+          />
           <span className="row-text">
             <span className="row-title">{h.label}</span>
             <span className="row-sub mono">
@@ -196,6 +204,8 @@ export function Sidebar({
     );
   };
   const ungrouped = shown.filter((h) => !h.groupId || !groups.some((g) => g.id === h.groupId));
+  // Hosts with a session, first: where people go back to most.
+  const sessions = [...live.keys()].map((id) => hosts.find((h) => h.id === id)).filter((h): h is HostView => !!h && (!q || matches(h, q)));
 
   return (
     <aside className="sidebar">
@@ -238,6 +248,12 @@ export function Sidebar({
       </label>
 
       <div className="sidebar-scroll">
+        {sessions.length > 0 && (
+          <>
+            <Section title="Open" />
+            <ul className="list">{sessions.map((h, i) => hostRow(h, i, true))}</ul>
+          </>
+        )}
         <Section
           title="Hosts"
           onNew={() => onEditHost()}
@@ -350,16 +366,18 @@ export function Sidebar({
   );
 }
 
-function Section({ title, onNew, newLabel, extra }: { title: string; onNew: () => void; newLabel: string; extra?: ReactNode }) {
+function Section({ title, onNew, newLabel, extra }: { title: string; onNew?: () => void; newLabel?: string; extra?: ReactNode }) {
   return (
     <div className="section-head">
       <span className="grow">{title}</span>
       {extra}
-      <button className="icon small" onClick={onNew} title={newLabel} aria-label={newLabel}>
-        <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
-          <path d="M12 5v14M5 12h14" />
-        </svg>
-      </button>
+      {onNew && (
+        <button className="icon small" onClick={onNew} title={newLabel} aria-label={newLabel}>
+          <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round">
+            <path d="M12 5v14M5 12h14" />
+          </svg>
+        </button>
+      )}
     </div>
   );
 }
diff --git a/apps/desktop/src/TeamsPanel.tsx b/apps/desktop/src/TeamsPanel.tsx
index da0c5ef..9a3be3b 100644
--- a/apps/desktop/src/TeamsPanel.tsx
+++ b/apps/desktop/src/TeamsPanel.tsx
@@ -1,4 +1,11 @@
-import { Fragment, useCallback, useEffect, useState, type FormEvent } from "react";
+// Teams: the teams this account is in, each team's page, and joining one.
+//
+// A team's page puts what needs you first (a member to confirm, a device to approve, a key to
+// rotate), then tabs: Members, Vaults, your SSH keys, and for owners and admins Settings and
+// Activity. Lists are tables (ListParts.tsx), as on the other pages; inviting people is the
+// page's one primary action.
+
+import { Fragment, useCallback, useEffect, useRef, useState, type FormEvent, type ReactNode } from "react";
 import {
   ACCESS_NAMES,
   ROLE_NAMES,
@@ -28,9 +35,12 @@ import {
   type SharingStatus,
   type SsoView,
   type DeviceRequest,
+  type SyncStatus,
   type VaultAccess,
   type VaultEntry,
 } from "./api";
+import { Icon } from "./Icon";
+import { Cell, Chip, NameCell, Table, TextAction, TRow } from "./ListParts";
 import { Page } from "./Page";
 import { mobileOs } from "./mobile/useMobile";
 
@@ -39,6 +49,8 @@ interface Props {
   orgs: OrgInfo[];
   /** SSH keys in the vault (the personal ones can be published to an organization). */
   keys: KeyView[];
+  /** What sync knows each team waits on: sign-ins, approvals, keys to publish. */
+  syncStatus: SyncStatus | null;
   /** Reloads organizations, vaults and items. */
   onChanged: () => Promise<void>;
   onClose: () => void;
@@ -54,18 +66,20 @@ interface Props {
 }
 
 const ACCESS_LEVELS: Access[] = ["read", "write", "manage"];
+const plural = (n: number, one: string, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
-export function TeamsPanel({ vaults, orgs, keys, onChanged, onClose, onSso, totpRequired, onTotp, invite, openOrg }: Props) {
+export function TeamsPanel({ vaults, orgs, keys, syncStatus, onChanged, onClose, onSso, totpRequired, onTotp, invite, openOrg }: Props) {
   const personal = vaults.find((v) => v.personal)?.id;
   const personalKeys = keys.filter((k) => k.vaultId === personal);
   const [status, setStatus] = useState<SharingStatus | null>(null);
   const [error, setError] = useState("");
   const [open, setOpen] = useState<string | null>(openOrg ?? null);
+  const [creating, setCreating] = useState(false);
   useEffect(() => {
     teams.status().then(setStatus, (e) => setError(errorText(e)));
   }, []);
   const org = orgs.find((o) => o.id === open);
-  const opened = (id: string) => void onChanged().then(() => setOpen(id));
+  const opened = (id: string) => void onChanged().then(() => (setCreating(false), setOpen(id)));
 
   if (org) {
     return (
@@ -87,78 +101,88 @@ export function TeamsPanel({ vaults, orgs, keys, onChanged, onClose, onSso, totp
     );
   }
 
+  // What each team waits on from this account or device, from what's known here.
+  const needsOf = (o: OrgInfo): string[] => {
+    if (o.status === "accepted") return [];
+    const out: string[] = [];
+    if (totpRequired.includes(o.id)) out.push("Turn on two-step verification");
+    if (syncStatus?.ssoRequired.some((n) => n.orgId === o.id)) out.push("Sign in with single sign-on");
+    const held = syncStatus?.approvalRequired.find((n) => n.orgId === o.id);
+    if (held) out.push(held.denied ? "This device was denied" : "This device waits for approval");
+    const waiting = syncStatus?.approvalsWaiting.find((w) => w.orgId === o.id)?.count ?? 0;
+    if (waiting) out.push(`${plural(waiting, "device")} to approve`);
+    if (syncStatus?.memberKeysDue.some((d) => d.orgId === o.id)) out.push("Publish your SSH keys");
+    if (vaults.some((v) => v.orgId === o.id && v.access === "manage" && v.rotationDue)) out.push("Rotate a vault's key");
+    return out;
+  };
+
   return (
     <Page
       title="Teams"
-      lead="Share hosts, keys, tunnels and VPNs with your team through organization vaults. They stay end-to-end encrypted: the sync server can't read them either."
+      lead="Share hosts, keys, tunnels and VPNs through a team's vaults. They stay end-to-end encrypted: the sync server can't read them either."
       onClose={onClose}
-      aside={
-        status?.available ? (
-          <>
-            {status.fingerprint && (
-              <div className="stack">
-                <h2 className="section-title">Your fingerprint</h2>
-                <Fingerprint value={status.fingerprint} />
-                <p className="hint">
-                  Before an admin gives you access to a team's vaults, they compare this with you on a call or in person. It
-                  proves that the keys the server showed them are really yours.
-                </p>
-              </div>
-            )}
-            <JoinOrg onJoined={opened} invite={invite} />
-          </>
-        ) : undefined
+      actions={
+        status?.available && (
+          <button type="button" className="primary" onClick={() => setCreating(true)} disabled={creating}>
+            New team
+          </button>
+        )
       }
     >
       {error && <p className="error">{error}</p>}
       {!status && !error && <p className="hint">Loading…</p>}
       {status && !status.available && <p className="warn">{status.reason}</p>}
-      {(orgs.length > 0 || status?.available) && (
-        <div className="stack">
-          <h2 className="section-title">Organizations</h2>
-          {orgs.length === 0 && <p className="hint">None yet. Create one, or join with an invite someone sent you.</p>}
-          {orgs.length > 0 && (
-            <ul className="device-list">
-              {orgs.map((o) => {
-                const count = vaults.filter((v) => v.orgId === o.id && !v.directory).length;
+      {creating && <CreateOrg onCreated={opened} onCancel={() => setCreating(false)} />}
+      {orgs.length === 0
+        ? status?.available && !creating && <p className="hint">No teams yet. Make one, or join with an invite someone sent you.</p>
+        : (
+            <Table cols="minmax(160px, 1.3fr) 80px minmax(120px, 1fr) minmax(160px, 1.5fr) 56px" label="Your teams" head={["Team", "You are", "Vaults you open", "Needs you"]}>
+              {orgs.map((o, i) => {
+                const names = vaults.filter((v) => v.orgId === o.id && !v.directory).map((v) => v.name ?? "Shared vault");
+                const needs = needsOf(o);
                 return (
-                  <li key={o.id}>
-                    <div>
-                      <strong>{o.name}</strong>
-                      <span className="kind-badge">{ROLE_NAMES[o.role]}</span>
-                      <small>
-                        {o.status === "accepted"
-                          ? "Waiting for an admin to confirm you"
-                          : `${count} vault${count === 1 ? "" : "s"} you can open`}
-                      </small>
-                    </div>
-                    <button type="button" className="secondary small-button" onClick={() => setOpen(o.id)}>
-                      Open
-                    </button>
-                  </li>
+                  <TRow key={o.id} index={i} actions={<TextAction onClick={() => setOpen(o.id)}>Open</TextAction>}>
+                    <NameCell onOpen={() => setOpen(o.id)} title={`Open ${o.name}`} lead={<Icon name="teams" size={15} />} name={o.name} />
+                    <Cell>{o.status === "accepted" ? <span className="muted">Joined</span> : ROLE_NAMES[o.role]}</Cell>
+                    <Cell className="trunc">{names.length ? names.join(", ") : <span className="muted">None yet</span>}</Cell>
+                    <Cell className="ltags">
+                      {o.status === "accepted" ? (
+                        <span className="muted">An admin confirms you next</span>
+                      ) : needs.length ? (
+                        needs.map((n) => (
+                          <Chip key={n} state="attention">
+                            {n}
+                          </Chip>
+                        ))
+                      ) : (
+                        <span className="muted">Nothing</span>
+                      )}
+                    </Cell>
+                  </TRow>
                 );
               })}
-            </ul>
+            </Table>
+          )}
+      {status?.available && (
+        <div className="teams-foot">
+          <JoinOrg onJoined={opened} invite={invite} />
+          {status.fingerprint && (
+            <div className="stack">
+              <h2 className="section-title">Your fingerprint</h2>
+              <Fingerprint value={status.fingerprint} />
+              <p className="hint">
+                Before an admin gives you a team's vaults, they compare this with you on a call or in person. It proves that the keys
+                the server showed them are yours.
+              </p>
+            </div>
           )}
         </div>
       )}
-      {status?.available && <CreateOrg onCreated={opened} />}
     </Page>
   );
 }
 
-/** A fingerprint in groups of four, easy to read out loud. */
-function Fingerprint({ value }: { value: string }) {
-  return (
-    <div className="fingerprint" aria-label={`Fingerprint ${value}`}>
-      {value.split("-").map((g, i) => (
-        <span key={i}>{g}</span>
-      ))}
-    </div>
-  );
-}
-
-function CreateOrg({ onCreated }: { onCreated: (id: string) => void }) {
+function CreateOrg({ onCreated, onCancel }: { onCreated: (id: string) => void; onCancel: () => void }) {
   const [name, setName] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
@@ -176,18 +200,19 @@ function CreateOrg({ onCreated }: { onCreated: (id: string) => void }) {
     );
   };
   return (
-    <form className="stack" onSubmit={submit}>
-      <h2 className="section-title">New organization</h2>
-      <div className="row">
-        <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Acme Ops" aria-label="Organization name" />
-        <button type="submit" className="secondary" disabled={!name.trim() || busy}>
-          Create
-        </button>
-      </div>
-      <p className="hint">You'll be its owner. Then create vaults in it and invite people.</p>
-      {error && <p className="error">{error}</p>}
+    <form className="quick-bar" onSubmit={submit}>
+      <span className="section-title">New team</span>
+      <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Acme Ops" aria-label="Team name" autoFocus />
+      <button type="button" className="quiet" onClick={onCancel}>
+        Cancel
+      </button>
+      <button type="submit" className="secondary" disabled={!name.trim() || busy}>
+        Create team
+      </button>
+      <small className="hint quick-hint">You'll be its owner. Then create vaults in it and invite people.</small>
+      {error && <p className="error quick-hint">{error}</p>}
       {limit && (
-        <div className="notice-box stack team-limit">
+        <div className="notice-box stack team-limit quick-hint">
           <p className="warn">{limit.charAt(0).toUpperCase() + limit.slice(1)}.</p>
           {!mobileOs && (
             <div className="row">
@@ -206,88 +231,6 @@ function CreateOrg({ onCreated }: { onCreated: (id: string) => void }) {
   );
 }
 
-/** `invite`: from a link, looked up at once (joining still waits for the fingerprint check). */
-function JoinOrg({ onJoined, invite }: { onJoined: (id: string) => void; invite?: string }) {
-  const [token, setToken] = useState(invite ?? "");
-  const [preview, setPreview] = useState<InvitePreview | null>(null);
-  const [matches, setMatches] = useState(false);
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState("");
-
-  const look = (code: string) => {
-    if (!code.trim()) return;
-    setBusy(true);
-    setError("");
-    teams.preview(code.trim()).then(
-      (p) => (setPreview(p), setMatches(false), setBusy(false)),
-      (err) => (setError(errorText(err)), setBusy(false)),
-    );
-  };
-  const lookUp = (e: FormEvent) => {
-    e.preventDefault();
-    look(token);
-  };
-  useEffect(() => {
-    if (invite) look(invite);
-  }, [invite]);
-  const join = () => {
-    if (!preview) return;
-    setBusy(true);
-    setError("");
-    teams.accept(token.trim(), preview.ownerFingerprint).then(
-      (id) => (setToken(""), setPreview(null), setBusy(false), onJoined(id)),
-      (err) => (setError(errorText(err)), setBusy(false)),
-    );
-  };
-
-  return (
-    <form className="stack" onSubmit={lookUp}>
-      <h2 className="section-title">Join with an invite</h2>
-      {!preview ? (
-        <div className="row">
-          <input
-            className="grow mono"
-            value={token}
-            onChange={(e) => setToken(e.target.value)}
-            placeholder="Invite code"
-            aria-label="Invite code"
-            spellCheck={false}
-            autoCapitalize="off"
-          />
-          <button type="submit" className="secondary" disabled={!token.trim() || busy}>
-            Look up
-          </button>
-        </div>
-      ) : (
-        <div className="notice-box stack">
-          <p>
-            <strong>{preview.orgName}</strong> invites {preview.email} as {ROLE_NAMES[preview.role].toLowerCase()} (sent by{" "}
-            {preview.inviterEmail}).
-          </p>
-          <p className="hint">
-            Ask the owner (or whoever invited you: it's in their member list) to read you the owner's fingerprint. Join only if
-            it matches this one:
-          </p>
-          <Fingerprint value={preview.ownerFingerprint} />
-          <label className="check">
-            <input type="checkbox" checked={matches} onChange={(e) => setMatches(e.target.checked)} />
-            <span>It matches the fingerprint they read to me</span>
-          </label>
-          <div className="row">
-            <button type="button" className="secondary grow" onClick={() => setPreview(null)}>
-              Cancel
-            </button>
-            <button type="button" className="primary grow" disabled={!matches || busy} onClick={join}>
-              Join {preview.orgName}
-            </button>
-          </div>
-        </div>
-      )}
-      {error && <p className="error">{error}</p>}
-    </form>
-  );
-}
-
 interface OrgProps {
   org: OrgInfo;
   vaults: VaultEntry[];
@@ -307,6 +250,8 @@ interface OrgProps {
   onTotp: () => void;
 }
 
+type OrgTab = "members" | "vaults" | "keys" | "settings" | "activity";
+
 function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose, onChanged, onGone, onSso, totpRequired, onTotp }: OrgProps) {
   const [members, setMembers] = useState<MemberView[] | null>(null);
   const [memberKeys, setMemberKeys] = useState<MemberKeyView[]>([]);
@@ -319,7 +264,11 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
   useEffect(loadKeys, [loadKeys, vaults]);
   const [invites, setInvites] = useState<InviteView[]>([]);
   const [details, setDetails] = useState<OrgDetails | null>(null);
+  const [requests, setRequests] = useState<DeviceRequest[]>([]);
   const [offboarding, setOffboarding] = useState<MemberView | null>(null);
+  // The member whose fingerprint is being compared (to confirm them, or certify them again).
+  const [confirming, setConfirming] = useState<string | null>(null);
+  const [inviting, setInviting] = useState(false);
   // Plans enforced and no usable plan (usable as the server counts it: a trial, an active plan or
   // its grace period): nothing in the team changes until it has one. Removing people,
   // transferring and deleting the team stay possible.
@@ -330,14 +279,19 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
   const admin = confirmed && (org.role === "owner" || org.role === "admin");
   const owner = org.role === "owner";
   const canCreateVaults = admin || (confirmed && !!details?.policies.membersCanCreateVaults);
+  const [tab, setTab] = useState<OrgTab>(admin ? "members" : "vaults");
 
+  const loadRequests = useCallback(() => {
+    if (confirmed) teams.deviceRequests(org.id).then(setRequests, () => {});
+  }, [org.id, confirmed]);
   const load = useCallback(() => {
     // Only confirmed members see the member list.
     if (!confirmed) return;
     teams.members(org.id).then(setMembers, (e) => setError(errorText(e)));
     teams.details(org.id).then(setDetails, (e) => setError(errorText(e)));
     if (admin) teams.invites(org.id).then(setInvites, (e) => setError(errorText(e)));
-  }, [org.id, confirmed, admin]);
+    loadRequests();
+  }, [org.id, confirmed, admin, loadRequests]);
   useEffect(load, [load]);
   // Back from the browser (a plan bought, say): the plan again.
   useEffect(() => {
@@ -369,50 +323,55 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
     );
   }
 
-  const lead = (details?.plansOffered || (confirmed && details?.ssoOffered)) && (
-    <>
-      {details?.plansOffered && (
-        <PlanLine
-          org={org}
-          plan={details.plan}
-          enforced={details.plansEnforced}
-          seatsUsed={members?.filter((m) => m.status === "confirmed").length ?? null}
-          portal={owner && details.portal && !mobileOs}
-        />
-      )}
-      {confirmed && details?.ssoOffered && <SsoLine org={org} onSignIn={onSso} />}
-    </>
-  );
+  const published = (account: string) => memberKeys.filter((k) => k.accountId === account && k.verified).length;
+  const keysRequired = details?.policies.requireMemberKeys === true;
+  const keysDue = confirmed && keysRequired && hasDirectory && !!me && published(me) === 0 && personalKeys.length > 0;
+  const confirm = (accountId: string) => (setTab("members"), setConfirming(accountId));
+
+  const tabs: [OrgTab, string, number | null][] = !confirmed
+    ? []
+    : admin
+      ? [
+          ["members", "Members", members?.length ?? null],
+          ["vaults", "Vaults", shared.length],
+          ["keys", "Your SSH keys", null],
+          ["settings", "Settings", null],
+          ["activity", "Activity", null],
+        ]
+      : [
+          ["vaults", "Vaults", shared.length],
+          ["members", "Members", members?.length ?? null],
+          ["keys", "Your SSH keys", null],
+        ];
 
   return (
     <Page
-      back={{ label: "All organizations", onClick: onBack }}
+      back={{ label: "Teams", onClick: onBack }}
       onClose={onClose}
       title={org.name}
       badge={<span className="kind-badge">{ROLE_NAMES[org.role]}</span>}
-      lead={lead || undefined}
-      aside={
-        admin ? (
+      lead={
+        (details?.plansOffered || (confirmed && details?.ssoOffered)) && (
           <>
-            <fieldset className="plain" disabled={locked}>
-              <Invites
+            {details?.plansOffered && (
+              <PlanLine
                 org={org}
-                owner={owner}
-                vaults={shared}
-                invites={invites}
-                domains={details?.policies.allowedEmailDomains ?? []}
-                onChanged={changed}
+                plan={details.plan}
+                enforced={details.plansEnforced}
+                seatsUsed={members?.filter((m) => m.status === "confirmed").length ?? null}
+                portal={owner && details.portal && !mobileOs}
               />
-            </fieldset>
-            {details && (
-              <fieldset className="plain" disabled={locked}>
-                <PolicyEditor key={JSON.stringify(details.policies)} org={org} details={details} onChanged={changed} />
-              </fieldset>
             )}
-            <ActivityLog org={org} />
-            {owner && <OwnerZone org={org} members={members ?? []} onChanged={changed} onGone={onGone} />}
+            {confirmed && details?.ssoOffered && <SsoLine org={org} onSignIn={onSso} />}
           </>
-        ) : undefined
+        )
+      }
+      actions={
+        admin && (
+          <button type="button" className="primary" disabled={locked} onClick={() => setInviting(true)}>
+            Invite people
+          </button>
+        )
       }
     >
       {!confirmed && (
@@ -423,16 +382,6 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
         </div>
       )}
       {error && <p className="error">{error}</p>}
-      {confirmed && totpRequired && (
-        <div className="notice-box warn stack">
-          <p>{org.name} requires two-step verification: its vaults open on your devices once your account has it.</p>
-          <div className="row">
-            <button type="button" className="primary" onClick={onTotp}>
-              Turn on two-step verification
-            </button>
-          </div>
-        </div>
-      )}
       {locked && (
         <p className="notice-box warn team-locked">
           {org.name} is locked until it has a plan: no new vaults, edits, invites, policies or published keys.
@@ -440,276 +389,359 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
           leaving still work.
         </p>
       )}
-      {/* Locked: giving access and new vaults wait for a plan; taking access away and rotating don't. */}
-      <div className="stack">
-        <h2 className="section-title">Vaults</h2>
-        {shared.length === 0 && (
-          <p className="hint">
-            {canCreateVaults ? "No vaults yet. Create one, then give members access." : "You can't open any of its vaults yet."}
-          </p>
-        )}
-        {vaults.length > 0 && (
-          <ul className="device-list">
-            {vaults.map((v) => (
-              <VaultRow key={v.id} vault={v} members={members ?? []} locked={locked} onChanged={changed} />
-            ))}
-          </ul>
-        )}
-        {canCreateVaults && (
-          <fieldset className="plain" disabled={locked}>
-            <NewVault orgId={org.id} onCreated={changed} />
-          </fieldset>
-        )}
-      </div>
-
       {confirmed && (
-        <fieldset className="plain" disabled={locked}>
-          <MyKeys
+        <NeedsYou
+          org={org}
+          admin={admin}
+          members={members ?? []}
+          requests={requests}
+          vaults={vaults}
+          totpRequired={totpRequired}
+          keysDue={keysDue}
+          onTotp={onTotp}
+          onConfirm={confirm}
+          onKeys={() => setTab("keys")}
+          onChanged={() => (loadRequests(), changed())}
+        />
+      )}
+      {tabs.length > 0 && (
+        <div className="page-tabs" role="tablist" aria-label={org.name}>
+          {tabs.map(([t, label, n]) => (
+            <button key={t} type="button" role="tab" aria-selected={tab === t} className={`page-tab ${tab === t ? "on" : ""}`} onClick={() => setTab(t)}>
+              {label}
+              {n !== null && <b>{n}</b>}
+            </button>
+          ))}
+        </div>
+      )}
+      {confirmed && tab === "members" && (
+        <>
+          <MembersTab
             org={org}
-            keys={personalKeys}
-            published={memberKeys.filter((k) => k.mine)}
-            ready={hasDirectory}
-            waiting={totpRequired}
-            onChanged={loadKeys}
+            members={members}
+            invites={admin ? invites : []}
+            published={published}
+            keysRequired={keysRequired}
+            admin={admin}
+            owner={owner}
+            locked={locked}
+            confirming={confirming}
+            setConfirming={setConfirming}
+            onChanged={changed}
+            onGone={onGone}
+            onOffboard={setOffboarding}
           />
-        </fieldset>
+          <DeviceRequests requests={requests} admin={admin} required={!!details?.policies.requireDeviceApproval} locked={locked} org={org} onChanged={loadRequests} />
+        </>
+      )}
+      {confirmed && tab === "vaults" && (
+        <VaultsTab vaults={vaults} members={members ?? []} orgId={org.id} canCreate={canCreateVaults} locked={locked} onChanged={changed} />
       )}
-      {confirmed && details && (
+      {confirmed && tab === "keys" && (
         <fieldset className="plain" disabled={locked}>
-          <DeviceRequests org={org} admin={admin} required={details.policies.requireDeviceApproval} />
+          <MyKeys org={org} keys={personalKeys} published={memberKeys.filter((k) => k.mine)} ready={hasDirectory} waiting={totpRequired} onChanged={loadKeys} />
         </fieldset>
       )}
-      {confirmed && (
-        <Members
+      {admin && tab === "settings" && details && (
+        <>
+          <fieldset className="plain" disabled={locked}>
+            <Settings key={JSON.stringify(details.policies)} org={org} details={details} onChanged={changed} />
+          </fieldset>
+          {owner && <OwnerZone org={org} members={members ?? []} onChanged={changed} onGone={onGone} />}
+        </>
+      )}
+      {admin && tab === "activity" && <ActivityLog org={org} />}
+      {inviting && (
+        <InviteDialog
           org={org}
-          keysRequired={details?.policies.requireMemberKeys === true}
-          members={members}
-          memberKeys={memberKeys}
-          admin={admin}
           owner={owner}
-          locked={locked}
+          vaults={shared}
+          domains={details?.policies.allowedEmailDomains ?? []}
+          onClose={() => setInviting(false)}
           onChanged={changed}
-          onGone={onGone}
-          onOffboard={setOffboarding}
         />
       )}
     </Page>
   );
 }
 
-function Leave({ org, me, onGone }: { org: OrgInfo; me: string; onGone: () => void }) {
-  const [sure, setSure] = useState(false);
+/** What waits for this account in the team: a member to confirm or certify again, a device to
+ * approve, a key to rotate, two-step verification, SSH keys to publish. Each with its action. */
+function NeedsYou({
+  org,
+  admin,
+  members,
+  requests,
+  vaults,
+  totpRequired,
+  keysDue,
+  onTotp,
+  onConfirm,
+  onKeys,
+  onChanged,
+}: {
+  org: OrgInfo;
+  admin: boolean;
+  members: MemberView[];
+  requests: DeviceRequest[];
+  vaults: VaultEntry[];
+  totpRequired: boolean;
+  keysDue: boolean;
+  onTotp: () => void;
+  onConfirm: (accountId: string) => void;
+  onKeys: () => void;
+  onChanged: () => void;
+}) {
+  const [busy, setBusy] = useState("");
   const [error, setError] = useState("");
+  const run = (what: string, p: Promise<unknown>) => {
+    setBusy(what);
+    setError("");
+    p.then(
+      () => (setBusy(""), onChanged()),
+      (e) => (setError(errorText(e)), setBusy("")),
+    );
+  };
+  const rows: { key: string; text: ReactNode; actions: ReactNode }[] = [];
+  if (totpRequired) {
+    rows.push({
+      key: "totp",
+      text: <>{org.name} requires two-step verification: its vaults open on your devices once your account has it.</>,
+      actions: (
+        <button type="button" className="primary small-button" onClick={onTotp}>
+          Turn on two-step verification
+        </button>
+      ),
+    });
+  }
+  if (admin) {
+    for (const m of members.filter((m) => m.status === "accepted")) {
+      rows.push({
+        key: `confirm:${m.accountId}`,
+        text: (
+          <>
+            <b>{m.email} joined.</b> Compare their fingerprint with them on a call or in person, then confirm them
+            {m.pendingVaults.length > 0 ? ": they get the vaults their invite offered." : "."}
+          </>
+        ),
+        actions: (
+          <button type="button" className="secondary small-button" onClick={() => onConfirm(m.accountId)}>
+            Confirm {m.email.split("@")[0]}…
+          </button>
+        ),
+      });
+    }
+    for (const m of members.filter((m) => m.status === "confirmed" && !m.verified && !m.me)) {
+      rows.push({
+        key: `verify:${m.accountId}`,
+        text: (
+          <>
+            <b>Certify {m.email} again:</b> the admin who confirmed them left, so devices that never verified them can't yet.
+          </>
+        ),
+        actions: (
+          <button type="button" className="secondary small-button" onClick={() => onConfirm(m.accountId)}>
+            Verify…
+          </button>
+        ),
+      });
+    }
+  }
+  for (const r of requests.filter((r) => r.status === "pending" && !r.thisDevice && (admin || r.mine))) {
+    const whose = r.mine ? "Your" : `${r.email ?? "A member"}'s`;
+    rows.push({
+      key: `device:${r.accountId}/${r.deviceId}`,
+      text: (
+        <>
+          <b>
+            {whose} new device{r.name ? `, ${r.name}` : ""}
+          </b>
+          {r.platform ? ` (${platformName(r.platform)})` : ""}, waits for approval to open the team's vaults.
+        </>
+      ),
+      actions: (
+        <>
+          <button
+            type="button"
+            className="secondary small-button"
+            disabled={!!busy}
+            onClick={() => run(`a:${r.deviceId}`, teams.decideDevice(org.id, r.accountId, r.deviceId, true))}
+          >
+            Approve
+          </button>
+          <button
+            type="button"
+            className="quiet small-button"
+            disabled={!!busy}
+            onClick={() => run(`d:${r.deviceId}`, teams.decideDevice(org.id, r.accountId, r.deviceId, false))}
+          >
+            Deny
+          </button>
+        </>
+      ),
+    });
+  }
+  for (const v of vaults.filter((v) => v.access === "manage" && v.rotationDue)) {
+    rows.push({
+      key: `rotate:${v.id}`,
+      text: (
+        <>
+          <b>{v.name ?? "A vault"}'s key should be rotated:</b> someone lost access since it was made. A new key keeps them out of what's
+          added next.
+        </>
+      ),
+      actions: (
+        <button type="button" className="secondary small-button" disabled={!!busy} onClick={() => run(`r:${v.id}`, teams.rotate(v.id))}>
+          {busy === `r:${v.id}` ? "Rotating…" : "Rotate key"}
+        </button>
+      ),
+    });
+  }
+  if (keysDue) {
+    rows.push({
+      key: "keys",
+      text: <>{org.name} asks members to publish the SSH keys they use on its servers, so that leaving can remove them.</>,
+      actions: (
+        <button type="button" className="secondary small-button" onClick={onKeys}>
+          Publish a key
+        </button>
+      ),
+    });
+  }
+  if (rows.length === 0 && !error) return null;
   return (
-    <>
-      <button
-        type="button"
-        className={`${sure ? "danger" : "ghost-danger"} small-button align-start`}
-        onClick={() => (sure ? teams.remove(org.id, me).then(onGone, (e) => setError(errorText(e))) : setSure(true))}
-      >
-        {sure ? `Really leave ${org.name}?` : "Leave"}
-      </button>
+    <section className="needs" aria-label="Needs you">
+      {rows.map((r) => (
+        <div key={r.key} className="need-row">
+          <span className="sq attention" aria-hidden="true" />
+          <span className="need-text">{r.text}</span>
+          <span className="need-actions">{r.actions}</span>
+        </div>
+      ))}
       {error && <p className="error">{error}</p>}
-    </>
+    </section>
   );
 }
 
-function VaultRow({ vault, members, locked, onChanged }: { vault: VaultEntry; members: MemberView[]; locked: boolean; onChanged: () => void }) {
-  const [editing, setEditing] = useState(false);
-  const [busy, setBusy] = useState(false);
+/** The team's vaults: what you can do in each, its key, and (for those you manage) who can open it. */
+function VaultsTab({
+  vaults,
+  members,
+  orgId,
+  canCreate,
+  locked,
+  onChanged,
+}: {
+  vaults: VaultEntry[];
+  members: MemberView[];
+  orgId: string;
+  canCreate: boolean;
+  locked: boolean;
+  onChanged: () => void;
+}) {
+  const [editing, setEditing] = useState<string | null>(null);
+  const [busy, setBusy] = useState<string | null>(null);
   const [error, setError] = useState("");
-  const manage = vault.access === "manage";
-  const rotate = () => {
-    setBusy(true);
+  const shared = vaults.filter((v) => !v.directory);
+  const rotate = (v: VaultEntry) => {
+    setBusy(v.id);
     setError("");
-    teams.rotate(vault.id).then(
-      () => (setBusy(false), onChanged()),
-      (e) => (setError(errorText(e)), setBusy(false)),
+    teams.rotate(v.id).then(
+      () => (setBusy(null), onChanged()),
+      (e) => (setError(errorText(e)), setBusy(null)),
     );
   };
+  // Shared vaults by name, then the member key directory.
+  const rows = [...shared, ...vaults.filter((v) => v.directory)];
   return (
     <>
-      <li className={manage && vault.rotationDue ? "due" : ""}>
-        <div>
-          <strong>{vault.name ?? "Shared vault"}</strong>
-          <span className="kind-badge">{vault.directory ? "Every member" : ACCESS_NAMES[vault.access]}</span>
-          <small>
-            {vault.directory
-              ? `Members' SSH public keys: ${vault.items} published`
-              : `${vault.items} item${vault.items === 1 ? "" : "s"}`}
-            {vault.rotationDue && " · someone lost access since the key was made"}
-          </small>
-        </div>
-        {manage && vault.rotationDue && (
-          <button type="button" className="rotate small-button" disabled={busy} onClick={rotate} title="Seal a new key to everyone who still has access">
-            {busy ? "Rotating…" : "Rotate key"}
-          </button>
-        )}
-        {manage && !vault.directory && (
-          <button type="button" className="secondary small-button" onClick={() => setEditing(!editing)}>
-            {editing ? "Done" : "Access"}
-          </button>
-        )}
-      </li>
-      {error && (
-        <li>
-          <p className="error">{error}</p>
-        </li>
+      {canCreate && (
+        <fieldset className="plain" disabled={locked}>
+          <NewVault orgId={orgId} onCreated={onChanged} />
+        </fieldset>
       )}
-      {editing && (
-        <li className="nested">
-          <AccessEditor vault={vault} members={members} locked={locked} onChanged={onChanged} />
-        </li>
+      {shared.length === 0 && (
+        <p className="hint">{canCreate ? "No vaults yet. Create one, then give members access." : "You can't open any of its vaults yet."}</p>
       )}
-    </>
-  );
-}
-
-function AccessSelect({ value, onChange, label, disabled }: { value: Access; onChange: (a: Access) => void; label: string; disabled?: boolean }) {
-  return (
-    <select className="compact" value={value} onChange={(e) => onChange(e.target.value as Access)} aria-label={label} disabled={disabled}>
-      {ACCESS_LEVELS.map((a) => (
-        <option key={a} value={a}>
-          {ACCESS_NAMES[a]}
-        </option>
-      ))}
-    </select>
-  );
-}
-
-function AccessEditor({ vault, members, locked, onChanged }: { vault: VaultEntry; members: MemberView[]; locked: boolean; onChanged: () => void }) {
-  const [list, setList] = useState<VaultAccess[] | null>(null);
-  const [add, setAdd] = useState("");
-  const [addAccess, setAddAccess] = useState<Access>("write");
-  const [revoked, setRevoked] = useState(false);
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState("");
-
-  const load = useCallback(() => {
-    teams.access(vault.id).then(setList, (e) => setError(errorText(e)));
-  }, [vault.id]);
-  useEffect(load, [load]);
-
-  const act = (p: Promise<void>, after?: () => void) => {
-    setBusy(true);
-    setError("");
-    p.then(
-      () => (after?.(), setBusy(false), load(), onChanged()),
-      (e) => (setError(errorText(e)), setBusy(false)),
-    );
-  };
-  const candidates = members.filter(
-    (m) => m.status === "confirmed" && m.role === "member" && !list?.some((a) => a.accountId === m.accountId),
-  );
-
-  return (
-    <div className="stack">
-      {list === null && !error && <p className="hint">Loading…</p>}
-      {list?.map((a) => (
-        <div className="row access-row" key={a.accountId}>
-          <span className="grow">{a.email || a.accountId}</span>
-          {a.implicit ? (
-            <span className="muted">{ACCESS_NAMES.manage} (owner or admin)</span>
-          ) : (
-            <>
-              <AccessSelect value={a.access} label={`Access for ${a.email}`} disabled={locked} onChange={(x) => act(teams.setAccess(vault.id, a.accountId, x))} />
-              <button
-                type="button"
-                className="ghost-danger small-button"
-                disabled={busy}
-                onClick={() => act(teams.revokeAccess(vault.id, a.accountId), () => setRevoked(true))}
-              >
-                Remove
-              </button>
-            </>
-          )}
-        </div>
-      ))}
-      {candidates.length > 0 && (
-        <div className="row">
-          <select className="grow" value={add} onChange={(e) => setAdd(e.target.value)} aria-label="Member to give access" disabled={locked}>
-            <option value="">Give a member access…</option>
-            {candidates.map((m) => (
-              <option key={m.accountId} value={m.accountId}>
-                {m.email}
-              </option>
-            ))}
-          </select>
-          <AccessSelect value={addAccess} onChange={setAddAccess} label="Access for the new member" disabled={locked} />
-          <button
-            type="button"
-            className="secondary small-button"
-            disabled={!add || busy || locked}
-            onClick={() => act(teams.setAccess(vault.id, add, addAccess), () => setAdd(""))}
-          >
-            Add
-          </button>
-        </div>
-      )}
-      {revoked && (
-        <p className="hint">
-          They can't sync this vault anymore, but what they already had stays on their devices. Rotate the key (the button
-          appears after the next sync) so they can't read anything added from now on, and change the passwords and keys they
-          could see.
-        </p>
+      {rows.length > 0 && (
+        <Table cols="minmax(170px, 1.4fr) 60px 100px 110px 140px" label="Vaults" head={["Vault", "Items", "You can", "Key"]}>
+          {rows.map((v, i) => {
+            const manage = v.access === "manage";
+            return (
+              <Fragment key={v.id}>
+                <TRow
+                  index={i}
+                  actions={
+                    <>
+                      {manage && v.rotationDue && (
+                        <TextAction warn onClick={() => rotate(v)}>
+                          {busy === v.id ? "Rotating…" : "Rotate key"}
+                        </TextAction>
+                      )}
+                      {manage && !v.directory && (
+                        <TextAction onClick={() => setEditing(editing === v.id ? null : v.id)}>{editing === v.id ? "Done" : "Access"}</TextAction>
+                      )}
+                    </>
+                  }
+                >
+                  <NameCell
+                    lead={<Icon name={v.directory ? "key" : "lock"} size={15} />}
+                    name={v.name ?? "Shared vault"}
+                    sub={v.directory ? "Members' SSH public keys" : undefined}
+                  />
+                  <Cell className="num">{v.items}</Cell>
+                  <Cell>{v.directory ? <span className="muted">Every member</span> : ACCESS_NAMES[v.access]}</Cell>
+                  <Cell>
+                    {v.rotationDue ? (
+                      <Chip state="attention">{manage ? "Rotate" : "Rotation due"}</Chip>
+                    ) : (
+                      <span className="muted">Current</span>
+                    )}
+                  </Cell>
+                </TRow>
+                {editing === v.id && (
+                  <div className="lexpand">
+                    <AccessEditor vault={v} members={members} locked={locked} onChanged={onChanged} />
+                  </div>
+                )}
+              </Fragment>
+            );
+          })}
+        </Table>
       )}
-      {members.some((m) => m.status === "accepted") && <p className="hint">Members waiting for confirmation can be added once confirmed.</p>}
-      {error && <p className="error">{error}</p>}
-    </div>
-  );
-}
-
-function NewVault({ orgId, onCreated }: { orgId: string; onCreated: () => void }) {
-  const [name, setName] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState("");
-  const submit = (e: FormEvent) => {
-    e.preventDefault();
-    if (!name.trim()) return;
-    setBusy(true);
-    setError("");
-    teams.createVault(orgId, name.trim()).then(
-      () => (setName(""), setBusy(false), onCreated()),
-      (err) => (setError(errorText(err)), setBusy(false)),
-    );
-  };
-  return (
-    <form className="stack" onSubmit={submit}>
-      <div className="row">
-        <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Staging" aria-label="New vault name" />
-        <button type="submit" className="secondary" disabled={!name.trim() || busy}>
-          New vault
-        </button>
-      </div>
       {error && <p className="error">{error}</p>}
-    </form>
+    </>
   );
 }
 
 interface MembersProps {
   org: OrgInfo;
   members: MemberView[] | null;
-  /** Keys published in the directory, to show who published theirs. */
-  memberKeys: MemberKeyView[];
+  /** Invites not accepted yet (owners and admins). */
+  invites: InviteView[];
+  /** How many SSH keys an account published (verified). */
+  published: (account: string) => number;
   admin: boolean;
   owner: boolean;
   /** The organization asks members to publish their SSH keys. */
   keysRequired: boolean;
+  /** The team has no usable plan: confirming people and changing roles wait for one. */
+  locked: boolean;
+  confirming: string | null;
+  setConfirming: (id: string | null) => void;
   onChanged: () => void;
   onGone: () => void;
   /** Removing a confirmed member goes through offboarding. */
   onOffboard: (m: MemberView) => void;
-  /** The team has no usable plan: confirming people and changing roles wait for one. */
-  locked: boolean;
 }
 
-function Members({ org, members, memberKeys, admin, owner, keysRequired, onChanged, onGone, onOffboard, locked }: MembersProps) {
-  const published = (account: string) => memberKeys.filter((k) => k.accountId === account && k.verified).length;
-  const [confirming, setConfirming] = useState<string | null>(null);
+/** Members, and the invites not accepted yet, in one table. */
+function MembersTab({ org, members, invites, published, keysRequired, admin, owner, locked, confirming, setConfirming, onChanged, onGone, onOffboard }: MembersProps) {
   const [matches, setMatches] = useState(false);
   const [removing, setRemoving] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
+  useEffect(() => setMatches(false), [confirming]);
 
   const act = (p: Promise<void>, then: () => void = onChanged) => {
     setBusy(true);
@@ -719,166 +751,279 @@ function Members({ org, members, memberKeys, admin, owner, keysRequired, onChang
       (e) => (setError(errorText(e)), setBusy(false)),
     );
   };
+  if (members === null) return error ? <p className="error">{error}</p> : <p className="hint">Loading…</p>;
 
   return (
-    <div className="stack">
-      <h2 className="section-title">Members</h2>
-      {members === null && !error && <p className="hint">Loading…</p>}
-      {members && (
-        <ul className="device-list">
-          {members.map((m) => {
-            const canRemove = !m.me && m.role !== "owner" && admin && (m.role === "member" || owner);
-            return (
-              <Fragment key={m.accountId}>
-                <li>
-                  <span className="member-initial" aria-hidden="true">
-                    {(m.email[0] ?? "?").toUpperCase()}
-                  </span>
-                  <div>
-                    <strong>{m.email}</strong>
-                    {m.me && <span className="kind-badge me">you</span>}
-                    <span className="kind-badge">{ROLE_NAMES[m.role]}</span>
-                    <small>
-                      {m.status === "accepted" ? "Waiting for confirmation" : m.verified ? "Keys verified" : "Keys not verified yet"}
-                      {m.status === "confirmed" && ` · ${published(m.accountId)} SSH key${published(m.accountId) === 1 ? "" : "s"} published`}
-                      {m.status === "confirmed" && keysRequired && published(m.accountId) === 0 && (
-                        <span className="warn-text"> · none yet, and the organization asks for them</span>
-                      )}
-                      <span className="mono"> · {m.fingerprint}</span>
-                    </small>
-                  </div>
-                  {admin && m.status === "confirmed" && !m.verified && !m.me && (
-                    <button
-                      type="button"
-                      className="secondary small-button"
-                      onClick={() => (setConfirming(confirming === m.accountId ? null : m.accountId), setMatches(false))}
-                      title="The admin who confirmed them left: compare their fingerprint and certify them again"
+    <>
+      <Table cols="minmax(170px, 1.8fr) 90px 110px 90px 130px" label="Members" head={["Member", "Role", "Keys", "SSH keys"]}>
+        {members.map((m, i) => {
+          const canRemove = !m.me && m.role !== "owner" && admin && (m.role === "member" || owner);
+          const n = published(m.accountId);
+          return (
+            <Fragment key={m.accountId}>
+              <TRow
+                index={i}
+                actions={
+                  <>
+                    {admin && m.status === "accepted" && (
+                      <TextAction onClick={() => setConfirming(confirming === m.accountId ? null : m.accountId)}>Confirm…</TextAction>
+                    )}
+                    {admin && m.status === "confirmed" && !m.verified && !m.me && (
+                      <TextAction onClick={() => setConfirming(confirming === m.accountId ? null : m.accountId)}>Verify…</TextAction>
+                    )}
+                    {canRemove && m.status === "confirmed" && (
+                      <button type="button" className="text-action danger" onClick={() => onOffboard(m)}>
+                        Remove…
+                      </button>
+                    )}
+                    {((canRemove && m.status === "accepted") || (m.me && m.role !== "owner")) &&
+                      (removing === m.accountId ? (
+                        <button
+                          type="button"
+                          className="text-action danger"
+                          disabled={busy}
+                          onClick={() => act(teams.remove(org.id, m.accountId), m.me ? onGone : onChanged)}
+                        >
+                          {m.me ? "Really leave?" : "Really remove?"}
+                        </button>
+                      ) : (
+                        <button type="button" className="text-action danger" onClick={() => setRemoving(m.accountId)}>
+                          {m.me ? "Leave" : "Remove"}
+                        </button>
+                      ))}
+                  </>
+                }
+              >
+                <NameCell name={m.email} beside={m.me && <span className="kind-badge me">you</span>} sub={m.fingerprint} subMono />
+                <Cell>
+                  {owner && !m.me && m.status === "confirmed" && m.role !== "owner" ? (
+                    <select
+                      className="compact"
+                      value={m.role}
+                      disabled={busy || locked}
+                      aria-label={`Role of ${m.email}`}
+                      title="Admins manage every vault and member"
+                      onChange={(e) => act(teams.setRole(org.id, m.accountId, e.target.value as Role))}
                     >
-                      Verify…
-                    </button>
+                      <option value="member">Member</option>
+                      <option value="admin">Admin</option>
+                    </select>
+                  ) : (
+                    ROLE_NAMES[m.role]
                   )}
-                  {admin && m.status === "accepted" && (
-                    <button
-                      type="button"
-                      className="primary small-button"
-                      disabled={locked}
-                      onClick={() => (setConfirming(confirming === m.accountId ? null : m.accountId), setMatches(false))}
-                    >
-                      Confirm…
-                    </button>
+                </Cell>
+                <Cell>
+                  {m.status === "accepted" ? (
+                    <Chip state="attention">To confirm</Chip>
+                  ) : m.verified ? (
+                    <Chip state="connected">Verified</Chip>
+                  ) : (
+                    <Chip state="attention">Not verified</Chip>
+                  )}
+                </Cell>
+                <Cell>
+                  {m.status !== "confirmed" ? (
+                    <span className="muted">–</span>
+                  ) : n > 0 ? (
+                    `${n} published`
+                  ) : keysRequired ? (
+                    <span className="warn-text">None yet</span>
+                  ) : (
+                    <span className="muted">None</span>
                   )}
-                  {owner && !m.me && m.status === "confirmed" && m.role !== "owner" && (
+                </Cell>
+              </TRow>
+              {confirming === m.accountId && (
+                <div className="lexpand stack">
+                  <p className="hint">
+                    Ask {m.email} to read you their fingerprint (Teams, on their device), on a call or in person. Confirm only if it
+                    matches:
+                  </p>
+                  <Fingerprint value={m.fingerprint} />
+                  {m.status === "accepted" && m.pendingVaults.length > 0 && <p className="hint">Confirming gives them the vault access their invite offered.</p>}
+                  <label className="check">
+                    <input type="checkbox" checked={matches} onChange={(e) => setMatches(e.target.checked)} />
+                    <span>It matches what they read to me</span>
+                  </label>
+                  <div className="row">
+                    <button type="button" className="quiet" onClick={() => setConfirming(null)}>
+                      Cancel
+                    </button>
                     <button
                       type="button"
-                      className="secondary small-button"
-                      disabled={busy || locked}
-                      onClick={() => act(teams.setRole(org.id, m.accountId, m.role === "admin" ? "member" : "admin"))}
-                      title={m.role === "admin" ? "They keep only the vault access you give them" : "Admins manage every vault and member"}
+                      className="primary"
+                      disabled={!matches || busy || (m.status === "accepted" && locked)}
+                      onClick={() =>
+                        act(
+                          m.status === "confirmed"
+                            ? teams.recertify(org.id, m.accountId, m.fingerprint)
+                            : teams.confirm(org.id, m.accountId, m.fingerprint),
+                        )
+                      }
                     >
-                      {m.role === "admin" ? "Make member" : "Make admin"}
+                      {m.status === "confirmed" ? `Certify ${m.email} again` : `Confirm ${m.email}`}
                     </button>
-                  )}
-                  {canRemove && m.status === "confirmed" && (
-                    <button type="button" className="ghost-danger small-button" onClick={() => onOffboard(m)}>
-                      Remove…
+                  </div>
+                </div>
+              )}
+            </Fragment>
+          );
+        })}
+        {invites.map((inv, i) => (
+          <TRow
+            key={inv.id}
+            index={members.length + i}
+            actions={
+              <button
+                type="button"
+                className="text-action danger"
+                onClick={() => (setError(""), teams.cancelInvite(org.id, inv.id).then(onChanged, (e) => setError(errorText(e))))}
+              >
+                Cancel invite
+              </button>
+            }
+          >
+            <NameCell name={inv.email} sub={`Invited · works until ${dateText(inv.expiresAt)}`} />
+            <Cell>{ROLE_NAMES[inv.role]}</Cell>
+            <Cell>
+              <Chip state="idle">Invited</Chip>
+            </Cell>
+            <Cell>
+              <span className="muted">–</span>
+            </Cell>
+          </TRow>
+        ))}
+      </Table>
+      {error && <p className="error">{error}</p>}
+    </>
+  );
+}
+
+/** The team's devices that asked to open its vaults, and the ones denied (approving is also in
+ * Needs you). */
+function DeviceRequests({
+  org,
+  requests,
+  admin,
+  required,
+  locked,
+  onChanged,
+}: {
+  org: OrgInfo;
+  requests: DeviceRequest[];
+  admin: boolean;
+  required: boolean;
+  locked: boolean;
+  onChanged: () => void;
+}) {
+  const [busy, setBusy] = useState<string | null>(null);
+  const [error, setError] = useState("");
+  if (requests.length === 0) {
+    return required ? (
+      <p className="hint">
+        New devices wait for approval before they open the team's vaults. None is waiting.
+        {!admin && " When you sign in on a new device, approve it here, from this one."}
+      </p>
+    ) : null;
+  }
+  const decide = (r: DeviceRequest, approve: boolean) => {
+    setBusy(r.deviceId);
+    setError("");
+    teams.decideDevice(org.id, r.accountId, r.deviceId, approve).then(
+      () => (setBusy(null), onChanged()),
+      (e) => (setError(errorText(e)), setBusy(null)),
+    );
+  };
+  return (
+    <section className="stack device-requests">
+      <h2 className="section-title">Devices waiting</h2>
+      <Table cols="minmax(170px, 1.4fr) minmax(150px, 1fr) 100px 170px" label="Devices waiting" head={["Device", "Whose", "State"]}>
+        {requests.map((r, i) => (
+          <TRow
+            key={`${r.accountId}/${r.deviceId}`}
+            index={i}
+            actions={
+              r.thisDevice ? (
+                <span className="hint">Approve it from another of your devices</span>
+              ) : (
+                <>
+                  <TextAction onClick={() => decide(r, true)}>Approve</TextAction>
+                  {r.status === "pending" && (
+                    <button type="button" className="text-action danger" disabled={busy !== null || locked} onClick={() => decide(r, false)}>
+                      Deny
                     </button>
                   )}
-                  {((canRemove && m.status === "accepted") || (m.me && m.role !== "owner")) &&
-                    (removing === m.accountId ? (
-                      <button
-                        type="button"
-                        className="danger small-button"
-                        disabled={busy}
-                        onClick={() => act(teams.remove(org.id, m.accountId), m.me ? onGone : onChanged)}
-                      >
-                        {m.me ? "Really leave?" : "Really remove?"}
-                      </button>
-                    ) : (
-                      <button type="button" className="ghost-danger small-button" onClick={() => setRemoving(m.accountId)}>
-                        {m.me ? "Leave" : "Remove"}
-                      </button>
-                    ))}
-                </li>
-                {confirming === m.accountId && (
-                  <li className="nested">
-                    <div className="stack">
-                      <p className="hint">
-                        Ask {m.email} to read you their fingerprint (Teams, on their device), on a call or in person. Confirm only
-                        if it matches:
-                      </p>
-                      <Fingerprint value={m.fingerprint} />
-                      {m.pendingVaults.length > 0 && (
-                        <p className="hint">Confirming gives them the vault access their invite offered.</p>
-                      )}
-                      <label className="check">
-                        <input type="checkbox" checked={matches} onChange={(e) => setMatches(e.target.checked)} />
-                        <span>It matches what they read to me</span>
-                      </label>
-                      <button
-                        type="button"
-                        className="primary"
-                        disabled={!matches || busy}
-                        onClick={() =>
-                          act(
-                            m.status === "confirmed"
-                              ? teams.recertify(org.id, m.accountId, m.fingerprint)
-                              : teams.confirm(org.id, m.accountId, m.fingerprint),
-                          )
-                        }
-                      >
-                        {m.status === "confirmed" ? `Certify ${m.email} again` : `Confirm ${m.email}`}
-                      </button>
-                    </div>
-                  </li>
-                )}
-              </Fragment>
-            );
-          })}
-        </ul>
-      )}
+                </>
+              )
+            }
+          >
+            <NameCell name={r.name ?? "A device"} sub={[r.platform && platformName(r.platform), `asked ${dateTimeText(r.requestedAt)}`].filter(Boolean).join(" · ")} />
+            <Cell className="trunc">{r.thisDevice ? "This device" : r.mine ? "Your device" : (r.email ?? "A member")}</Cell>
+            <Cell>{r.status === "denied" ? <Chip state="failed">Denied</Chip> : <Chip state="attention">Waiting</Chip>}</Cell>
+          </TRow>
+        ))}
+      </Table>
       {error && <p className="error">{error}</p>}
-    </div>
+    </section>
   );
 }
 
-interface InvitesProps {
+const domainOf = (email: string) => email.trim().split("@").pop()?.toLowerCase() ?? "";
+
+/** Invite people: several addresses at once, a role, and the vaults they get once confirmed. */
+function InviteDialog({
+  org,
+  owner,
+  vaults,
+  domains,
+  onClose,
+  onChanged,
+}: {
   org: OrgInfo;
   owner: boolean;
   vaults: VaultEntry[];
-  invites: InviteView[];
   /** The organization only invites addresses at these domains (empty = any). */
   domains: string[];
+  onClose: () => void;
   onChanged: () => void;
-}
-
-const domainOf = (email: string) => email.trim().split("@").pop()?.toLowerCase() ?? "";
-
-function Invites({ org, owner, vaults, invites, domains, onChanged }: InvitesProps) {
-  const [email, setEmail] = useState("");
+}) {
+  const ref = useRef<HTMLDialogElement>(null);
+  useEffect(() => {
+    ref.current?.showModal();
+  }, []);
+  const [text, setText] = useState("");
   const [role, setRole] = useState<Role>("member");
   const [grants, setGrants] = useState<Record<string, Access>>({});
-  const [created, setCreated] = useState<InviteView | null>(null);
-  const [copied, setCopied] = useState(false);
+  const [sent, setSent] = useState<InviteView[] | null>(null);
+  const [copied, setCopied] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
 
-  const wellFormed = /^[^@\s]+@[^@\s]+$/.test(email.trim());
-  const domainOk = domains.length === 0 || domains.includes(domainOf(email));
-  const valid = wellFormed && domainOk;
-  const submit = (e: FormEvent) => {
+  const emails = [...new Set(text.split(/[,;\s]+/).map((e) => e.trim()).filter(Boolean))];
+  const malformed = emails.filter((e) => !/^[^@\s]+@[^@\s]+$/.test(e));
+  const outside = domains.length ? emails.filter((e) => !malformed.includes(e) && !domains.includes(domainOf(e))) : [];
+  const valid = emails.length > 0 && malformed.length === 0 && outside.length === 0;
+  const send = async (e: FormEvent) => {
     e.preventDefault();
     if (!valid) return;
     setBusy(true);
     setError("");
     const vaultGrants = role === "admin" ? [] : Object.entries(grants).map(([vaultId, access]) => ({ vaultId, access }));
-    teams.invite(org.id, email.trim(), role, vaultGrants).then(
-      (inv) => (setCreated(inv), setCopied(false), setEmail(""), setGrants({}), setBusy(false), onChanged()),
-      (err) => (setError(errorText(err)), setBusy(false)),
-    );
-  };
-  const cancel = (id: string) => {
-    setError("");
-    teams.cancelInvite(org.id, id).then(onChanged, (e) => setError(errorText(e)));
+    const done: InviteView[] = [];
+    const failed: string[] = [];
+    for (const email of emails) {
+      try {
+        done.push(await teams.invite(org.id, email, role, vaultGrants));
+      } catch (err) {
+        failed.push(`${email}: ${errorText(err)}`);
+      }
+    }
+    setBusy(false);
+    if (done.length) {
+      setSent(done);
+      onChanged();
+    }
+    if (failed.length) setError(failed.join(" "));
   };
   const toggle = (id: string, on: boolean) =>
     setGrants((g) => {
@@ -889,166 +1034,600 @@ function Invites({ org, owner, vaults, invites, domains, onChanged }: InvitesPro
     });
 
   return (
-    <div className="stack">
-      <h2 className="section-title">Invites</h2>
-      {invites.length > 0 && (
-        <ul className="device-list">
-          {invites.map((i) => (
-            <li key={i.id}>
-              <div>
-                <strong>{i.email}</strong>
-                <span className="kind-badge">{ROLE_NAMES[i.role]}</span>
-                <small>Expires {dateText(i.expiresAt)}</small>
-              </div>
-              <button type="button" className="ghost-danger small-button" onClick={() => cancel(i.id)}>
-                Cancel
+    <dialog ref={ref} className="sheet invite-dialog" onCancel={(e) => (e.preventDefault(), onClose())} aria-labelledby="invite-title">
+      <h1 id="invite-title">Invite people to {org.name}</h1>
+      {sent ? (
+        <div className="stack">
+          {sent.some((i) => i.token) ? (
+            <>
+              <p>This server doesn't email invites. Send each person their code (it works once, for that address, for 7 days):</p>
+              {sent.map((i) => (
+                <div key={i.id} className="stack invite-sent">
+                  <span className="muted">{i.email}</span>
+                  <div className="row">
+                    <code className="invite-code grow">{i.token}</code>
+                    <button
+                      type="button"
+                      className="secondary small-button"
+                      onClick={() => void navigator.clipboard?.writeText(i.token ?? "").then(() => setCopied(i.id))}
+                    >
+                      {copied === i.id ? "Copied" : "Copy code"}
+                    </button>
+                  </div>
+                </div>
+              ))}
+            </>
+          ) : (
+            <p className="ok">Invite emailed to {sent.map((i) => i.email).join(", ")}.</p>
+          )}
+          <p className="hint">When they join, you compare each person's fingerprint with them before confirming them.</p>
+          {error && <p className="error">{error}</p>}
+          <div className="actions">
+            <span className="spacer" />
+            <button type="button" className="primary" onClick={onClose}>
+              Done
+            </button>
+          </div>
+        </div>
+      ) : (
+        <form className="stack" onSubmit={(e) => void send(e)}>
+          <label>
+            <span>Email addresses</span>
+            <input
+              value={text}
+              onChange={(e) => setText(e.target.value)}
+              placeholder="colleague@example.com, another@example.com"
+              aria-label="Emails to invite"
+              autoCapitalize="off"
+              spellCheck={false}
+              autoFocus
+            />
+          </label>
+          <p className={malformed.length || outside.length ? "warn" : "hint"}>
+            {malformed.length
+              ? `Not an email address: ${malformed.join(", ")}.`
+              : outside.length
+                ? `Invites go only to ${domains.map((d) => `@${d}`).join(", ")}: not ${outside.join(", ")}.`
+                : `MorphGate's server emails each one an invite that works once, for that address, for 7 days${domains.length ? `. Only addresses at ${domains.map((d) => `@${d}`).join(", ")}` : ""}.`}
+          </p>
+          {owner && (
+            <label>
+              <span>Role</span>
+              <select value={role} onChange={(e) => setRole(e.target.value as Role)} aria-label="Role">
+                <option value="member">Member: the vaults you give them</option>
+                <option value="admin">Admin: every vault and member</option>
+              </select>
+            </label>
+          )}
+          {role === "member" && vaults.length > 0 && (
+            <div className="stack grants">
+              <span className="field-label">Vaults they get once you confirm them</span>
+              {vaults.map((v) => (
+                <div className="row access-row" key={v.id}>
+                  <label className="check grow">
+                    <input type="checkbox" checked={v.id in grants} onChange={(e) => toggle(v.id, e.target.checked)} />
+                    <span>{v.name ?? "Shared vault"}</span>
+                  </label>
+                  {v.id in grants && (
+                    <AccessSelect value={grants[v.id]} label={`Access to ${v.name}`} onChange={(a) => setGrants((g) => ({ ...g, [v.id]: a }))} />
+                  )}
+                </div>
+              ))}
+            </div>
+          )}
+          {error && <p className="error">{error}</p>}
+          <div className="actions">
+            <span className="spacer" />
+            <button type="button" className="quiet" onClick={onClose}>
+              Cancel
+            </button>
+            <button type="submit" className="primary" disabled={!valid || busy}>
+              {busy ? "Sending…" : emails.length > 1 ? `Send ${emails.length} invites` : "Send invite"}
+            </button>
+          </div>
+        </form>
+      )}
+    </dialog>
+  );
+}
+
+/** One setting: what it is and does, and its control. */
+function SettingRow({ name, desc, children }: { name: ReactNode; desc: ReactNode; children: ReactNode }) {
+  return (
+    <div className="setting">
+      <span className="lstack setting-text">
+        <span className="setting-name">{name}</span>
+        <span className="lsub setting-desc">{desc}</span>
+      </span>
+      {children}
+    </div>
+  );
+}
+
+function Switch({ on, label, disabled, onChange }: { on: boolean; label: string; disabled?: boolean; onChange: (on: boolean) => void }) {
+  return (
+    <button type="button" role="switch" aria-checked={on} aria-label={label} className={`switch ${on ? "on" : ""}`} disabled={disabled} onClick={() => onChange(!on)}>
+      <i />
+    </button>
+  );
+}
+
+/** The team's policies, grouped, saved together. */
+function Settings({ org, details, onChanged }: { org: OrgInfo; details: OrgDetails; onChanged: () => void }) {
+  const [p, setP] = useState<Policies>(details.policies);
+  const [domains, setDomains] = useState(details.policies.allowedEmailDomains.join(", "));
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const list = domains
+    .split(/[,\s]+/)
+    .map((d) => d.trim().replace(/^@/, "").toLowerCase())
+    .filter(Boolean);
+  const next: Policies = { ...p, allowedEmailDomains: list };
+  const approvalOffered = details.features === null || details.features.includes("device_approval");
+  const dirty = JSON.stringify(next) !== JSON.stringify(details.policies);
+  const save = () => {
+    setBusy(true);
+    setError("");
+    teams.setPolicies(org.id, next).then(
+      () => (setBusy(false), onChanged()),
+      (e) => (setError(errorText(e)), setBusy(false)),
+    );
+  };
+  const discard = () => (setP(details.policies), setDomains(details.policies.allowedEmailDomains.join(", ")));
+  return (
+    <div className="stack team-settings">
+      <h2 className="section-title">Security</h2>
+      <div className="settings">
+        <SettingRow
+          name="Require two-step verification"
+          desc={
+            details.totpOffered
+              ? "Members without it can't open the team's vaults until they turn it on. MorphGate tells them why."
+              : "This server doesn't offer two-step verification."
+          }
+        >
+          <Switch on={p.requireTotp} label="Require two-step verification" disabled={!details.totpOffered && !p.requireTotp} onChange={(v) => setP({ ...p, requireTotp: v })} />
+        </SettingRow>
+        <SettingRow
+          name={
+            <>
+              Approve new devices
+              {!approvalOffered && <span className="kind-badge">Business plan</span>}
+            </>
+          }
+          desc="An owner or admin, or the member from a device already approved, approves each new device before it opens the team's vaults. Devices in use now stay approved."
+        >
+          <Switch
+            on={p.requireDeviceApproval}
+            label="Approve new devices"
+            disabled={!approvalOffered && !p.requireDeviceApproval}
+            onChange={(v) => setP({ ...p, requireDeviceApproval: v })}
+          />
+        </SettingRow>
+        {p.requireSso && (
+          <SettingRow name="Single sign-on" desc="Required for the team's vaults. It is set where the identity provider is, on the website.">
+            <span className="muted">Required</span>
+          </SettingRow>
+        )}
+      </div>
+      <h2 className="section-title">Members</h2>
+      <div className="settings">
+        <SettingRow name="Members can create vaults" desc="They manage the vaults they create. Owners and admins always can.">
+          <Switch on={p.membersCanCreateVaults} label="Members can create vaults" onChange={(v) => setP({ ...p, membersCanCreateVaults: v })} />
+        </SettingRow>
+        <SettingRow name="Invite only these domains" desc="Separate them with commas. Empty: any address.">
+          <input
+            className="setting-input"
+            value={domains}
+            onChange={(e) => setDomains(e.target.value)}
+            placeholder="example.com"
+            aria-label="Invite only these domains"
+            spellCheck={false}
+            autoCapitalize="off"
+          />
+        </SettingRow>
+        <SettingRow name="Ask members to publish their SSH keys" desc="So that removing someone finds their keys on the team's hosts. MorphGate reminds those who haven't.">
+          <Switch on={p.requireMemberKeys === true} label="Ask members to publish their SSH keys" onChange={(v) => setP({ ...p, requireMemberKeys: v })} />
+        </SettingRow>
+      </div>
+      {details.sessionLogsOffered && (
+        <>
+          <h2 className="section-title">Session logs</h2>
+          <div className="settings">
+            <SettingRow name="Delete session logs after" desc="Days after a session ends. 0 keeps them.">
+              <span className="row align-center">
+                <input
+                  className="setting-input days"
+                  type="number"
+                  min={0}
+                  max={3650}
+                  value={p.sessionLogRetentionDays}
+                  aria-label="Days to keep session logs"
+                  onChange={(e) => setP({ ...p, sessionLogRetentionDays: Math.max(0, Math.min(3650, Math.floor(Number(e.target.value) || 0))) })}
+                />
+                <span className="muted">days</span>
+              </span>
+            </SettingRow>
+          </div>
+        </>
+      )}
+      {dirty && (
+        <div className="settings-save">
+          <span className="muted grow">Not saved yet.</span>
+          <button type="button" className="quiet" disabled={busy} onClick={discard}>
+            Discard
+          </button>
+          <button type="button" className="primary" disabled={busy} onClick={save}>
+            Save settings
+          </button>
+        </div>
+      )}
+      {error && <p className="error">{error}</p>}
+    </div>
+  );
+}
+
+/** Ownership: handing the team to an admin, or deleting it (the master password confirms). */
+function OwnerZone({ org, members, onChanged, onGone }: { org: OrgInfo; members: MemberView[]; onChanged: () => void; onGone: () => void }) {
+  const [mode, setMode] = useState<"transfer" | "delete" | null>(null);
+  const [to, setTo] = useState("");
+  const [password, setPassword] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const admins = members.filter((m) => !m.me && m.role === "admin" && m.status === "confirmed");
+
+  const submit = (e: FormEvent) => {
+    e.preventDefault();
+    setBusy(true);
+    setError("");
+    const p = mode === "transfer" ? teams.transfer(org.id, to, password) : teams.deleteOrg(org.id, password);
+    p.then(
+      () => (setPassword(""), setBusy(false), setMode(null), mode === "delete" ? onGone() : onChanged()),
+      (err) => (setError(errorText(err)), setBusy(false)),
+    );
+  };
+
+  return (
+    <div className="stack">
+      <h2 className="section-title danger-title">Ownership</h2>
+      <div className="settings danger-zone">
+        <SettingRow name="Transfer ownership" desc={admins.length ? "To one of the team's admins. You stay an admin." : "To hand the team over, make someone an admin first."}>
+          <button type="button" className="secondary small-button" disabled={admins.length === 0 || mode !== null} onClick={() => setMode("transfer")}>
+            Transfer…
+          </button>
+        </SettingRow>
+        <SettingRow name={`Delete ${org.name}`} desc="Its vaults leave every member's devices, and the server deletes them. Members' own vaults stay. This can't be undone.">
+          <button type="button" className="ghost-danger small-button" disabled={mode !== null} onClick={() => setMode("delete")}>
+            Delete team…
+          </button>
+        </SettingRow>
+      </div>
+      {mode && (
+        <form className="notice-box stack" onSubmit={submit}>
+          {mode === "transfer" ? (
+            <>
+              <p>The new owner gets every right you have; you stay on as an admin.</p>
+              <select value={to} onChange={(e) => setTo(e.target.value)} aria-label="New owner">
+                <option value="">Choose an admin…</option>
+                {admins.map((m) => (
+                  <option key={m.accountId} value={m.accountId}>
+                    {m.email}
+                  </option>
+                ))}
+              </select>
+            </>
+          ) : (
+            <p className="warn">
+              Deletes {org.name} and all its vaults for everyone. Items in them disappear from every member's devices on their next sync.
+              This can't be undone.
+            </p>
+          )}
+          <label>
+            <span>Your master password</span>
+            <input type="password" value={password} onChange={(e) => setPassword(e.target.value)} autoComplete="current-password" />
+          </label>
+          <div className="row">
+            <button type="button" className="secondary grow" onClick={() => (setMode(null), setPassword(""), setError(""))}>
+              Cancel
+            </button>
+            <button
+              type="submit"
+              className={`${mode === "delete" ? "danger" : "primary"} grow`}
+              disabled={!password || busy || (mode === "transfer" && !to)}
+            >
+              {mode === "transfer" ? "Transfer" : `Delete ${org.name}`}
+            </button>
+          </div>
+        </form>
+      )}
+      {error && <p className="error">{error}</p>}
+    </div>
+  );
+}
+
+const PAGE = 50;
+
+/** The audit log: what the server saw (owners and admins). */
+function ActivityLog({ org }: { org: OrgInfo }) {
+  const [log, setLog] = useState<Activity | null>(null);
+  const [shown, setShown] = useState(PAGE);
+  const [error, setError] = useState("");
+  const [saved, setSaved] = useState("");
+  useEffect(() => {
+    teams.activity(org.id).then(setLog, (e) => setError(errorText(e)));
+  }, [org.id]);
+  const download = (format: "csv" | "jsonl") => {
+    setError("");
+    setSaved("");
+    teams.exportActivity(org.id, format).then(setSaved, (e) => setError(errorText(e)));
+  };
+  return (
+    <div className="stack">
+      {!log && !error && <p className="hint">Loading…</p>}
+      {log && (
+        <>
+          <div className="row wrap align-center">
+            <p className="hint grow">
+              The server records what it sees: membership, access, keys and policy changes. It can't see which hosts anyone opened or
+              what they ran.
+            </p>
+            <button type="button" className="secondary small-button" onClick={() => download("csv")}>
+              Download CSV
+            </button>
+            <button type="button" className="secondary small-button" onClick={() => download("jsonl")}>
+              Download JSON lines
+            </button>
+          </div>
+          {saved && <p className="ok">Saved {saved}</p>}
+          <ul className="activity">
+            {log.events.slice(0, shown).map((e) => (
+              <li key={e.seq}>
+                <time dateTime={e.at}>{dateTimeText(e.at)}</time>
+                <span>{describe(e, log.names)}</span>
+              </li>
+            ))}
+          </ul>
+          {shown < log.events.length && (
+            <button type="button" className="link align-start" onClick={() => setShown(shown + PAGE)}>
+              Show older
+            </button>
+          )}
+          {shown >= log.events.length && log.truncated && <p className="hint">Older events aren't shown in the app.</p>}
+        </>
+      )}
+      {error && <p className="error">{error}</p>}
+    </div>
+  );
+}
+
+/** A fingerprint in groups of four, easy to read out loud. */
+function Fingerprint({ value }: { value: string }) {
+  return (
+    <div className="fingerprint" aria-label={`Fingerprint ${value}`}>
+      {value.split("-").map((g, i) => (
+        <span key={i}>{g}</span>
+      ))}
+    </div>
+  );
+}
+
+/** `invite`: from a link, looked up at once (joining still waits for the fingerprint check). */
+function JoinOrg({ onJoined, invite }: { onJoined: (id: string) => void; invite?: string }) {
+  const [token, setToken] = useState(invite ?? "");
+  const [preview, setPreview] = useState<InvitePreview | null>(null);
+  const [matches, setMatches] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+
+  const look = (code: string) => {
+    if (!code.trim()) return;
+    setBusy(true);
+    setError("");
+    teams.preview(code.trim()).then(
+      (p) => (setPreview(p), setMatches(false), setBusy(false)),
+      (err) => (setError(errorText(err)), setBusy(false)),
+    );
+  };
+  const lookUp = (e: FormEvent) => {
+    e.preventDefault();
+    look(token);
+  };
+  useEffect(() => {
+    if (invite) look(invite);
+  }, [invite]);
+  const join = () => {
+    if (!preview) return;
+    setBusy(true);
+    setError("");
+    teams.accept(token.trim(), preview.ownerFingerprint).then(
+      (id) => (setToken(""), setPreview(null), setBusy(false), onJoined(id)),
+      (err) => (setError(errorText(err)), setBusy(false)),
+    );
+  };
+
+  return (
+    <form className="stack" onSubmit={lookUp}>
+      <h2 className="section-title">Join with an invite</h2>
+      {!preview ? (
+        <div className="row">
+          <input
+            className="grow mono"
+            value={token}
+            onChange={(e) => setToken(e.target.value)}
+            placeholder="Invite code"
+            aria-label="Invite code"
+            spellCheck={false}
+            autoCapitalize="off"
+          />
+          <button type="submit" className="secondary" disabled={!token.trim() || busy}>
+            Look up
+          </button>
+        </div>
+      ) : (
+        <div className="notice-box stack">
+          <p>
+            <strong>{preview.orgName}</strong> invites {preview.email} as {ROLE_NAMES[preview.role].toLowerCase()} (sent by{" "}
+            {preview.inviterEmail}).
+          </p>
+          <p className="hint">
+            Ask the owner (or whoever invited you: it's in their member list) to read you the owner's fingerprint. Join only if
+            it matches this one:
+          </p>
+          <Fingerprint value={preview.ownerFingerprint} />
+          <label className="check">
+            <input type="checkbox" checked={matches} onChange={(e) => setMatches(e.target.checked)} />
+            <span>It matches the fingerprint they read to me</span>
+          </label>
+          <div className="row">
+            <button type="button" className="secondary grow" onClick={() => setPreview(null)}>
+              Cancel
+            </button>
+            <button type="button" className="primary grow" disabled={!matches || busy} onClick={join}>
+              Join {preview.orgName}
+            </button>
+          </div>
+        </div>
+      )}
+      {error && <p className="error">{error}</p>}
+    </form>
+  );
+}
+
+function Leave({ org, me, onGone }: { org: OrgInfo; me: string; onGone: () => void }) {
+  const [sure, setSure] = useState(false);
+  const [error, setError] = useState("");
+  return (
+    <>
+      <button
+        type="button"
+        className={`${sure ? "danger" : "ghost-danger"} small-button align-start`}
+        onClick={() => (sure ? teams.remove(org.id, me).then(onGone, (e) => setError(errorText(e))) : setSure(true))}
+      >
+        {sure ? `Really leave ${org.name}?` : "Leave"}
+      </button>
+      {error && <p className="error">{error}</p>}
+    </>
+  );
+}
+
+function AccessSelect({ value, onChange, label, disabled }: { value: Access; onChange: (a: Access) => void; label: string; disabled?: boolean }) {
+  return (
+    <select className="compact" value={value} onChange={(e) => onChange(e.target.value as Access)} aria-label={label} disabled={disabled}>
+      {ACCESS_LEVELS.map((a) => (
+        <option key={a} value={a}>
+          {ACCESS_NAMES[a]}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+function AccessEditor({ vault, members, locked, onChanged }: { vault: VaultEntry; members: MemberView[]; locked: boolean; onChanged: () => void }) {
+  const [list, setList] = useState<VaultAccess[] | null>(null);
+  const [add, setAdd] = useState("");
+  const [addAccess, setAddAccess] = useState<Access>("write");
+  const [revoked, setRevoked] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+
+  const load = useCallback(() => {
+    teams.access(vault.id).then(setList, (e) => setError(errorText(e)));
+  }, [vault.id]);
+  useEffect(load, [load]);
+
+  const act = (p: Promise<void>, after?: () => void) => {
+    setBusy(true);
+    setError("");
+    p.then(
+      () => (after?.(), setBusy(false), load(), onChanged()),
+      (e) => (setError(errorText(e)), setBusy(false)),
+    );
+  };
+  const candidates = members.filter(
+    (m) => m.status === "confirmed" && m.role === "member" && !list?.some((a) => a.accountId === m.accountId),
+  );
+
+  return (
+    <div className="stack">
+      {list === null && !error && <p className="hint">Loading…</p>}
+      {list?.map((a) => (
+        <div className="row access-row" key={a.accountId}>
+          <span className="grow">{a.email || a.accountId}</span>
+          {a.implicit ? (
+            <span className="muted">{ACCESS_NAMES.manage} (owner or admin)</span>
+          ) : (
+            <>
+              <AccessSelect value={a.access} label={`Access for ${a.email}`} disabled={locked} onChange={(x) => act(teams.setAccess(vault.id, a.accountId, x))} />
+              <button
+                type="button"
+                className="ghost-danger small-button"
+                disabled={busy}
+                onClick={() => act(teams.revokeAccess(vault.id, a.accountId), () => setRevoked(true))}
+              >
+                Remove
               </button>
-            </li>
-          ))}
-        </ul>
-      )}
-      {created?.token && (
-        <div className="notice-box stack">
-          <p>
-            This server doesn't email invites. Send this code to {created.email} (it works once, for that address, for 7 days):
-          </p>
-          <code className="invite-code">{created.token}</code>
-          <div className="row">
-            <button
-              type="button"
-              className="secondary grow"
-              onClick={() => void navigator.clipboard?.writeText(created.token ?? "").then(() => setCopied(true))}
-            >
-              {copied ? "Copied" : "Copy code"}
-            </button>
-            <button type="button" className="secondary grow" onClick={() => setCreated(null)}>
-              Done
-            </button>
-          </div>
+            </>
+          )}
         </div>
-      )}
-      {created && !created.token && <p className="ok">Invite emailed to {created.email}.</p>}
-      <form className="stack" onSubmit={submit}>
+      ))}
+      {candidates.length > 0 && (
         <div className="row">
-          <input
-            className="grow"
-            type="email"
-            value={email}
-            onChange={(e) => setEmail(e.target.value)}
-            placeholder="colleague@example.com"
-            aria-label="Email to invite"
-            autoCapitalize="off"
-            spellCheck={false}
-          />
-          {owner && (
-            <select className="compact" value={role} onChange={(e) => setRole(e.target.value as Role)} aria-label="Role">
-              <option value="member">Member</option>
-              <option value="admin">Admin</option>
-            </select>
-          )}
-          <button type="submit" className="secondary" disabled={!valid || busy}>
-            Invite
+          <select className="grow" value={add} onChange={(e) => setAdd(e.target.value)} aria-label="Member to give access" disabled={locked}>
+            <option value="">Give a member access…</option>
+            {candidates.map((m) => (
+              <option key={m.accountId} value={m.accountId}>
+                {m.email}
+              </option>
+            ))}
+          </select>
+          <AccessSelect value={addAccess} onChange={setAddAccess} label="Access for the new member" disabled={locked} />
+          <button
+            type="button"
+            className="secondary small-button"
+            disabled={!add || busy || locked}
+            onClick={() => act(teams.setAccess(vault.id, add, addAccess), () => setAdd(""))}
+          >
+            Add
           </button>
         </div>
-        {role === "member" && vaults.length > 0 && (
-          <div className="stack grants">
-            <span className="hint">Vaults they get once you confirm them:</span>
-            {vaults.map((v) => (
-              <div className="row access-row" key={v.id}>
-                <label className="check grow">
-                  <input type="checkbox" checked={v.id in grants} onChange={(e) => toggle(v.id, e.target.checked)} />
-                  <span>{v.name ?? "Shared vault"}</span>
-                </label>
-                {v.id in grants && (
-                  <AccessSelect value={grants[v.id]} label={`Access to ${v.name}`} onChange={(a) => setGrants((g) => ({ ...g, [v.id]: a }))} />
-                )}
-              </div>
-            ))}
-          </div>
-        )}
-        {role === "admin" && <p className="hint">Admins open every vault of the organization and manage members.</p>}
-        {domains.length > 0 && (
-          <p className={wellFormed && !domainOk ? "warn" : "hint"}>Invites go only to {domains.map((d) => `@${d}`).join(", ")}.</p>
-        )}
-      </form>
+      )}
+      {revoked && (
+        <p className="hint">
+          They can't sync this vault anymore, but what they already had stays on their devices. Rotate the key (the button
+          appears after the next sync) so they can't read anything added from now on, and change the passwords and keys they
+          could see.
+        </p>
+      )}
+      {members.some((m) => m.status === "accepted") && <p className="hint">Members waiting for confirmation can be added once confirmed.</p>}
       {error && <p className="error">{error}</p>}
     </div>
   );
 }
 
-function OwnerZone({ org, members, onChanged, onGone }: { org: OrgInfo; members: MemberView[]; onChanged: () => void; onGone: () => void }) {
-  const [mode, setMode] = useState<"transfer" | "delete" | null>(null);
-  const [to, setTo] = useState("");
-  const [password, setPassword] = useState("");
+function NewVault({ orgId, onCreated }: { orgId: string; onCreated: () => void }) {
+  const [name, setName] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
-  const admins = members.filter((m) => !m.me && m.role === "admin" && m.status === "confirmed");
-
   const submit = (e: FormEvent) => {
     e.preventDefault();
+    if (!name.trim()) return;
     setBusy(true);
     setError("");
-    const p = mode === "transfer" ? teams.transfer(org.id, to, password) : teams.deleteOrg(org.id, password);
-    p.then(
-      () => (setPassword(""), setBusy(false), setMode(null), mode === "delete" ? onGone() : onChanged()),
+    teams.createVault(orgId, name.trim()).then(
+      () => (setName(""), setBusy(false), onCreated()),
       (err) => (setError(errorText(err)), setBusy(false)),
     );
   };
-
   return (
-    <div className="stack">
-      <h2 className="section-title">Ownership</h2>
-      {!mode && (
-        <div className="row">
-          <button type="button" className="secondary grow" disabled={admins.length === 0} onClick={() => setMode("transfer")}>
-            Transfer ownership
-          </button>
-          <button type="button" className="ghost-danger grow" onClick={() => setMode("delete")}>
-            Delete organization
-          </button>
-        </div>
-      )}
-      {!mode && admins.length === 0 && <p className="hint">To hand the organization over, make someone an admin first.</p>}
-      {mode && (
-        <form className="notice-box stack" onSubmit={submit}>
-          {mode === "transfer" ? (
-            <>
-              <p>The new owner gets every right you have; you stay on as an admin.</p>
-              <select value={to} onChange={(e) => setTo(e.target.value)} aria-label="New owner">
-                <option value="">Choose an admin…</option>
-                {admins.map((m) => (
-                  <option key={m.accountId} value={m.accountId}>
-                    {m.email}
-                  </option>
-                ))}
-              </select>
-            </>
-          ) : (
-            <p className="warn">
-              Deletes {org.name} and all its vaults for everyone. Items in them disappear from every member's devices on their next
-              sync. This can't be undone.
-            </p>
-          )}
-          <label>
-            <span>Your master password</span>
-            <input type="password" value={password} onChange={(e) => setPassword(e.target.value)} autoComplete="current-password" />
-          </label>
-          <div className="row">
-            <button type="button" className="secondary grow" onClick={() => (setMode(null), setPassword(""), setError(""))}>
-              Cancel
-            </button>
-            <button
-              type="submit"
-              className={`${mode === "delete" ? "danger" : "primary"} grow`}
-              disabled={!password || busy || (mode === "transfer" && !to)}
-            >
-              {mode === "transfer" ? "Transfer" : `Delete ${org.name}`}
-            </button>
-          </div>
-        </form>
-      )}
+    <form className="stack" onSubmit={submit}>
+      <div className="row">
+        <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Staging" aria-label="New vault name" />
+        <button type="submit" className="secondary" disabled={!name.trim() || busy}>
+          New vault
+        </button>
+      </div>
       {error && <p className="error">{error}</p>}
-    </div>
+    </form>
   );
 }
 
@@ -1118,76 +1697,6 @@ function PlanLine({
   );
 }
 
-/** Devices waiting to open the organization's vaults, and the ones denied. */
-function DeviceRequests({ org, admin, required }: { org: OrgInfo; admin: boolean; required: boolean }) {
-  const [requests, setRequests] = useState<DeviceRequest[] | null>(null);
-  const [busy, setBusy] = useState<string | null>(null);
-  const [error, setError] = useState("");
-  const load = useCallback(() => {
-    teams.deviceRequests(org.id).then(setRequests, (e) => setError(errorText(e)));
-  }, [org.id]);
-  useEffect(load, [load]);
-  if (!requests || (requests.length === 0 && !error)) {
-    return required ? (
-      <div className="stack">
-        <h2 className="section-title">Devices</h2>
-        <p className="hint">
-          New devices wait for approval before they open the organization's vaults. None is waiting.
-          {!admin && " When you sign in on a new device, approve it here, from this one."}
-        </p>
-      </div>
-    ) : null;
-  }
-  const decide = (r: DeviceRequest, approve: boolean) => {
-    setBusy(r.deviceId);
-    setError("");
-    teams.decideDevice(org.id, r.accountId, r.deviceId, approve).then(
-      () => (setBusy(null), load()),
-      (e) => (setError(errorText(e)), setBusy(null)),
-    );
-  };
-  const pending = requests.filter((r) => r.status === "pending");
-  return (
-    <div className="stack device-requests">
-      <h2 className="section-title">{pending.length > 0 ? "Waiting for approval" : "Devices"}</h2>
-      <ul className="device-list">
-        {requests.map((r) => (
-          <li key={`${r.accountId}/${r.deviceId}`} className="device-row">
-            <div className="grow">
-              <strong>{r.name ?? "A device"}</strong>
-              <div className="muted">
-                {[
-                  r.thisDevice ? "This device" : r.mine ? "Your device" : (r.email ?? "A member"),
-                  r.platform && platformName(r.platform),
-                  `asked ${dateTimeText(r.requestedAt)}`,
-                ]
-                  .filter(Boolean)
-                  .join(" · ")}
-              </div>
-            </div>
-            <span className={`kind-badge ${r.status === "denied" ? "danger" : ""}`}>{r.status === "denied" ? "Denied" : "Waiting"}</span>
-            {r.thisDevice ? (
-              <span className="hint">Approve it from another of your devices</span>
-            ) : (
-              <>
-                <button type="button" className="secondary small-button" disabled={busy !== null} onClick={() => decide(r, true)}>
-                  Approve
-                </button>
-                {r.status === "pending" && (
-                  <button type="button" className="ghost-danger small-button" disabled={busy !== null} onClick={() => decide(r, false)}>
-                    Deny
-                  </button>
-                )}
-              </>
-            )}
-          </li>
-        ))}
-      </ul>
-      {error && <p className="error">{error}</p>}
-    </div>
-  );
-}
-
 /** The organization's identity provider, and whether this device is signed in there. */
 function SsoLine({ org, onSignIn }: { org: OrgInfo; onSignIn: () => void }) {
   const [sso, setSso] = useState<SsoView | null>(null);
@@ -1213,98 +1722,6 @@ function SsoLine({ org, onSignIn }: { org: OrgInfo; onSignIn: () => void }) {
   );
 }
 
-function PolicyEditor({ org, details, onChanged }: { org: OrgInfo; details: OrgDetails; onChanged: () => void }) {
-  const [p, setP] = useState<Policies>(details.policies);
-  const [domains, setDomains] = useState(details.policies.allowedEmailDomains.join(", "));
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState("");
-  const list = domains
-    .split(/[,\s]+/)
-    .map((d) => d.trim().replace(/^@/, "").toLowerCase())
-    .filter(Boolean);
-  const next: Policies = { ...p, allowedEmailDomains: list };
-  const approvalOffered = details.features === null || details.features.includes("device_approval");
-  const dirty = JSON.stringify(next) !== JSON.stringify(details.policies);
-  const save = () => {
-    setBusy(true);
-    setError("");
-    teams.setPolicies(org.id, next).then(
-      () => (setBusy(false), onChanged()),
-      (e) => (setError(errorText(e)), setBusy(false)),
-    );
-  };
-  return (
-    <div className="stack">
-      <h2 className="section-title">Policies</h2>
-      <label className="check">
-        <input
-          type="checkbox"
-          checked={p.requireTotp}
-          disabled={!details.totpOffered && !p.requireTotp}
-          onChange={(e) => setP({ ...p, requireTotp: e.target.checked })}
-        />
-        <span>
-          Require two-step verification to open the organization's vaults
-          {!details.totpOffered && " (this server doesn't offer two-step verification)"}
-        </span>
-      </label>
-      <label className="check">
-        <input type="checkbox" checked={p.membersCanCreateVaults} onChange={(e) => setP({ ...p, membersCanCreateVaults: e.target.checked })} />
-        <span>Members can create vaults (they manage the ones they create)</span>
-      </label>
-      <label>
-        <span>Invite only addresses at these domains (empty: any)</span>
-        <input value={domains} onChange={(e) => setDomains(e.target.value)} placeholder="example.com, example.org" spellCheck={false} autoCapitalize="off" />
-      </label>
-      <label className="check">
-        <input
-          type="checkbox"
-          checked={p.requireDeviceApproval}
-          disabled={!approvalOffered && !p.requireDeviceApproval}
-          onChange={(e) => setP({ ...p, requireDeviceApproval: e.target.checked })}
-        />
-        <span>
-          Owners and admins approve new devices before they open the organization's vaults (members can approve their own, from a device
-          already approved). Devices in use now stay approved.
-          {!approvalOffered && " Needs the Business plan."}
-        </span>
-      </label>
-      <label className="check">
-        <input
-          type="checkbox"
-          checked={p.requireMemberKeys === true}
-          onChange={(e) => setP({ ...p, requireMemberKeys: e.target.checked })}
-        />
-        <span>
-          Members publish the SSH keys they use on the organization's servers (so leaving can remove them); the app reminds those who
-          haven't
-        </span>
-      </label>
-      {details.sessionLogsOffered && (
-        <label>
-          <span>Delete the team's session logs after this many days (0 keeps them)</span>
-          <input
-            type="number"
-            min={0}
-            max={3650}
-            value={p.sessionLogRetentionDays}
-            onChange={(e) => setP({ ...p, sessionLogRetentionDays: Math.max(0, Math.min(3650, Math.floor(Number(e.target.value) || 0))) })}
-          />
-        </label>
-      )}
-      {p.requireSso && (
-        <p className="hint">Single sign-on is required for the organization's vaults. It is set where the identity provider is, on the website.</p>
-      )}
-      {dirty && (
-        <button type="button" className="primary align-start" disabled={busy} onClick={save}>
-          Save policies
-        </button>
-      )}
-      {error && <p className="error">{error}</p>}
-    </div>
-  );
-}
-
 /** One audit event as a sentence. */
 function describe(e: Activity["events"][number], names: Record<string, string>): string {
   const who = (id: string | null) => (id ? (names[id] ?? "a former member") : "someone");
@@ -1315,9 +1732,9 @@ function describe(e: Activity["events"][number], names: Record<string, string>):
   const access = e.detail && e.detail in ACCESS_NAMES ? ` (${ACCESS_NAMES[e.detail as Access].toLowerCase()})` : "";
   switch (e.kind) {
     case "org_created":
-      return `${actor} created the organization`;
+      return `${actor} created the team`;
     case "org_updated":
-      return `${actor} changed the organization's name or policies`;
+      return `${actor} changed the team's name or settings`;
     case "member_invited":
       return `${actor} invited ${e.detail ?? "someone"}`;
     case "invite_cancelled":
@@ -1367,70 +1784,6 @@ function describe(e: Activity["events"][number], names: Record<string, string>):
   }
 }
 
-const PAGE = 50;
-
-/** The audit log: what the server saw (owners and admins). */
-function ActivityLog({ org }: { org: OrgInfo }) {
-  const [log, setLog] = useState<Activity | null>(null);
-  const [shown, setShown] = useState(PAGE);
-  const [open, setOpen] = useState(false);
-  const [error, setError] = useState("");
-  const [saved, setSaved] = useState("");
-  const load = () => {
-    setOpen(true);
-    setError("");
-    teams.activity(org.id).then(setLog, (e) => setError(errorText(e)));
-  };
-  const download = (format: "csv" | "jsonl") => {
-    setError("");
-    setSaved("");
-    teams.exportActivity(org.id, format).then(setSaved, (e) => setError(errorText(e)));
-  };
-  return (
-    <div className="stack">
-      <h2 className="section-title">Activity</h2>
-      {!open && (
-        <button type="button" className="secondary align-start" onClick={load}>
-          Show activity
-        </button>
-      )}
-      {open && !log && !error && <p className="hint">Loading…</p>}
-      {log && (
-        <>
-          <ul className="activity">
-            {log.events.slice(0, shown).map((e) => (
-              <li key={e.seq}>
-                <time dateTime={e.at}>{dateTimeText(e.at)}</time>
-                <span>{describe(e, log.names)}</span>
-              </li>
-            ))}
-          </ul>
-          {shown < log.events.length && (
-            <button type="button" className="link align-start" onClick={() => setShown(shown + PAGE)}>
-              Show older
-            </button>
-          )}
-          {shown >= log.events.length && log.truncated && <p className="hint">Older events aren't shown in the app.</p>}
-          <p className="hint">
-            The server records what it sees: membership, access, keys and policy changes. It can't see which hosts anyone
-            opened or what they ran.
-          </p>
-          <div className="row wrap">
-            <button type="button" className="secondary small-button" onClick={() => download("csv")}>
-              Download CSV
-            </button>
-            <button type="button" className="secondary small-button" onClick={() => download("jsonl")}>
-              Download JSON lines
-            </button>
-          </div>
-          {saved && <p className="ok">Saved {saved}</p>}
-        </>
-      )}
-      {error && <p className="error">{error}</p>}
-    </div>
-  );
-}
-
 /** This account's SSH keys published to the organization's member key directory. */
 function MyKeys({
   org,
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index 51135b4..ebaeac4 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -695,67 +695,6 @@ button.icon:hover {
   text-align: left;
 }
 
-.avatar {
-  position: relative;
-  display: grid;
-  flex: none;
-  place-items: center;
-  width: 24px;
-  height: 24px;
-  border-radius: var(--radius-xs);
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-  font-family: var(--font-display);
-  font-size: 11px;
-  font-weight: 600;
-}
-
-.avatar.on {
-  background: var(--gate);
-  color: var(--on-gate);
-}
-
-/* A host with an open session: a status square on the avatar's corner. */
-.avatar .live {
-  position: absolute;
-  right: -3px;
-  bottom: -3px;
-  width: 8px;
-  height: 8px;
-  border-radius: 2px;
-  background: var(--gate);
-  box-shadow: 0 0 0 2px var(--surface);
-}
-
-.avatar .live.connecting {
-  background: var(--cursor);
-  animation: blink 1s steps(1) infinite;
-}
-
-.avatar.key {
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-}
-
-.avatar.snippet {
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-  font-family: var(--font-mono);
-  font-size: 10px;
-}
-
-.avatar.tunnel {
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-  font-family: var(--font-sans);
-  font-size: 13px;
-}
-
-.avatar.tunnel.on {
-  background: var(--gate-soft);
-  color: var(--gate-ink);
-}
-
 button.switch {
   position: relative;
   flex: none;
@@ -854,16 +793,6 @@ button.switch.busy i {
   font-weight: 600;
 }
 
-.avatar.vpn {
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-}
-
-.avatar.vpn.on {
-  background: var(--gate-soft);
-  color: var(--gate-ink);
-}
-
 .key-line {
   display: flex;
   align-items: center;
@@ -3373,122 +3302,10 @@ button.nav-row.current {
   color: var(--gate-ink);
 }
 
-/* The list pages' rows: an avatar, the item, its buttons. */
-.item-list li {
-  flex-wrap: nowrap;
-}
-
-.list-avatar {
-  position: relative;
-  display: grid;
-  flex: none;
-  place-items: center;
-  width: 28px;
-  height: 28px;
-  border-radius: var(--radius-xs);
-  background: var(--surface-raised);
-  color: var(--ink-muted);
-  font-family: var(--font-display);
-  font-size: 12px;
-  font-weight: 600;
-}
-
-.item-list li.on .list-avatar {
-  background: var(--gate);
-  color: var(--on-gate);
-}
-
-.list-avatar .live {
-  position: absolute;
-  right: -3px;
-  bottom: -3px;
-  width: 8px;
-  height: 8px;
-  border-radius: 2px;
-  background: var(--gate);
-  box-shadow: 0 0 0 2px var(--surface);
-}
-
-.list-avatar .live.connecting {
-  background: var(--cursor);
-}
-
-.item-list li > div {
-  gap: 2px 6px;
-}
-
-.item-list li > div > strong {
-  margin-right: 2px;
-}
-
-.item-list small .mono,
-.item-list small.mono {
-  font-family: var(--font-mono);
-}
-
-.list-buttons {
-  display: flex;
-  flex: none;
-  flex-wrap: wrap;
-  align-items: center;
-  justify-content: flex-end;
-  gap: 6px;
-}
-
-/* Narrow: the buttons go under the item. */
-@container page (max-width: 560px) {
-  .item-list li {
-    flex-wrap: wrap;
-  }
-
-  .list-buttons {
-    flex-basis: 100%;
-    justify-content: flex-start;
-    padding-left: 40px;
-  }
-}
-
-.item-list .vault-tag,
-.item-list .tag,
-.group-title .vault-tag {
-  flex: none;
-  padding: 0 5px;
-  border: 1px solid var(--line-strong);
-  border-radius: var(--radius-xs);
-  color: var(--ink-muted);
-  font-size: 11px;
-  line-height: 16px;
-  font-weight: 600;
-}
-
-.item-list .tag {
-  border-style: dashed;
-  font-weight: 400;
-}
-
-.item-list .kind-badge {
-  margin: 0;
-}
-
 .error-text {
   color: var(--danger);
 }
 
-.group-title {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  color: var(--ink-muted);
-}
-
-.group-title h2 {
-  margin: 0;
-  color: var(--ink);
-  font-size: 15px;
-  line-height: 22px;
-  font-weight: 700;
-}
-
 .page-main > section.stack {
   gap: 8px;
 }
@@ -3561,23 +3378,6 @@ dialog.sheet.move-dialog {
   padding: 0 10px;
 }
 
-/* A title that opens what it names (a group on the Hosts and Groups pages). */
-button.title-link {
-  padding: 0;
-  border: 0;
-  background: none;
-  color: inherit;
-  font: inherit;
-  text-align: left;
-  cursor: pointer;
-}
-
-button.title-link:hover {
-  color: var(--gate-ink);
-  text-decoration: underline;
-  text-underline-offset: 3px;
-}
-
 .aside-list {
   display: flex;
   flex-direction: column;
@@ -3809,8 +3609,7 @@ fieldset.plain:disabled {
 }
 
 /* A host its cloud source no longer lists: kept, marked, for its owner to remove. */
-.kind-badge.gone,
-.item-list .kind-badge.gone {
+.kind-badge.gone {
   border-color: var(--danger);
   background: var(--danger-soft);
   color: var(--danger);
@@ -3872,16 +3671,7 @@ fieldset.plain:disabled {
   margin: 0;
 }
 
-.item-list li.picking {
-  cursor: pointer;
-  user-select: none;
-}
-
-.item-list li.picked {
-  background: var(--gate-soft);
-}
-
-.item-list input.pick {
+input.pick {
   flex: none;
   width: 16px;
   height: 16px;
@@ -3893,3 +3683,772 @@ fieldset.plain:disabled {
 .cloud-source .section-title .kind-badge {
   margin-left: 8px;
 }
+
+/* ------------------------------------------------------------ list pages: tables (Lists.tsx) */
+
+.visually-hidden {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  margin: -1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0 0 0 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+button.icon.page-close {
+  width: 32px;
+  height: 32px;
+}
+
+button.quiet {
+  border: 1px solid transparent;
+  background: none;
+  color: var(--ink-muted);
+}
+
+button.quiet:hover:not(:disabled) {
+  background: var(--surface-raised);
+  color: var(--ink);
+}
+
+.ltoolbar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+}
+
+.ltoolbar .search {
+  flex: 0 1 340px;
+  min-width: 200px;
+  height: var(--control-m);
+  margin: 0;
+}
+
+.filters {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+}
+
+button.filter {
+  height: 28px;
+  padding: 0 10px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-s);
+  background: none;
+  color: var(--ink-muted);
+  font-size: 12px;
+}
+
+button.filter b {
+  margin-left: 6px;
+  color: var(--ink);
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+}
+
+button.filter:hover:not(.on) {
+  background: var(--surface-raised);
+  color: var(--ink);
+}
+
+button.filter.on {
+  border-color: var(--gate-ink);
+  background: var(--gate-soft);
+  color: var(--ink);
+}
+
+.add-from {
+  position: relative;
+}
+
+.add-from > button {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.add-from > button svg {
+  transform: rotate(90deg);
+}
+
+.add-from .menu {
+  width: 320px;
+}
+
+/* Quick connect on the Hosts page. */
+.quick-bar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px 12px;
+  padding: 10px 12px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-m);
+  background: var(--surface);
+}
+
+.quick-bar input {
+  flex: 1 1 240px;
+  min-width: 0;
+}
+
+.quick-hint {
+  flex-basis: 100%;
+}
+
+/* Tabs within a page (Keys, Identities, Host CAs). */
+.page-tabs {
+  display: flex;
+  gap: 2px;
+  margin-top: -8px;
+  border-bottom: 1px solid var(--line);
+}
+
+button.page-tab {
+  position: relative;
+  height: 36px;
+  padding: 0 12px;
+  border: 0;
+  background: none;
+  color: var(--ink-muted);
+}
+
+button.page-tab b {
+  margin-left: 6px;
+  color: var(--ink-muted);
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+}
+
+button.page-tab:hover:not(.on) {
+  color: var(--ink);
+}
+
+button.page-tab.on {
+  color: var(--ink);
+  font-weight: 600;
+}
+
+button.page-tab.on::after {
+  content: "";
+  position: absolute;
+  right: 8px;
+  bottom: -1px;
+  left: 8px;
+  height: 2px;
+  background: var(--gate);
+}
+
+.ltable {
+  overflow-x: auto;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-m);
+  background: var(--surface);
+}
+
+.lthead,
+.lrow {
+  display: grid;
+  grid-template-columns: var(--cols);
+  align-items: center;
+  column-gap: 16px;
+  padding: 0 12px;
+}
+
+.lthead {
+  height: 32px;
+  border-bottom: 1px solid var(--line);
+}
+
+.lrow {
+  min-height: 44px;
+  padding-block: 4px;
+}
+
+.lrow.band {
+  background: var(--band);
+}
+
+.lrow:hover {
+  background: var(--surface-raised);
+}
+
+.lrow.picking {
+  cursor: pointer;
+  user-select: none;
+}
+
+.lrow.picked {
+  background: var(--gate-soft);
+}
+
+.lcell {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+}
+
+.lstack {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  min-width: 0;
+  overflow: hidden;
+}
+
+.lcell.num {
+  font-variant-numeric: tabular-nums;
+}
+
+.lfirst {
+  gap: 10px;
+}
+
+.lfirst .pick {
+  flex: none;
+}
+
+.lnamebtn {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+  max-width: 100%;
+  overflow: hidden;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: inherit;
+  font: inherit;
+  text-align: left;
+}
+
+button.lnamebtn:hover .lname {
+  text-decoration: underline;
+  text-decoration-color: var(--line-strong);
+  text-underline-offset: 3px;
+}
+
+.lnamebtn > svg {
+  flex: none;
+  color: var(--ink-muted);
+}
+
+.lname-row {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+  /* An address has no place to break: without this the row is as wide as it, and the name
+     can't shrink to an ellipsis. */
+  max-width: 100%;
+}
+
+.lname {
+  flex: 0 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  font-weight: 600;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* What goes beside a name shrinks too, so nothing runs into the next column. */
+.lname-row > .tag,
+.lname-row > .vault-tag,
+.lname-row > .kind-badge {
+  flex: 0 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.lsub {
+  overflow: hidden;
+  max-width: 100%;
+  color: var(--ink-muted);
+  font-size: 12px;
+  line-height: 16px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.trunc {
+  overflow: hidden;
+  min-width: 0;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.muted {
+  color: var(--ink-muted);
+}
+
+.ltags {
+  flex-wrap: wrap;
+  gap: 4px;
+}
+
+.ltable .tag,
+.ltable .vault-tag,
+.lghead .vault-tag,
+.use-card .tag {
+  flex: none;
+  padding: 0 5px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-xs);
+  color: var(--ink-muted);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  line-height: 16px;
+  white-space: nowrap;
+}
+
+.ltable .vault-tag,
+.lghead .vault-tag {
+  border-color: var(--line-strong);
+  font-family: var(--font-sans);
+  font-weight: 600;
+}
+
+.ltable .tag.up,
+.use-card .tag.up {
+  border-color: var(--gate-ink);
+  color: var(--gate-ink);
+}
+
+.ltable .kind-badge {
+  margin: 0;
+}
+
+.ltable .lcell.mono,
+.ltable .lsub.mono,
+.ltable .lcell .mono {
+  font-size: 12px;
+}
+
+.rowact {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 2px;
+  opacity: 0;
+  transition: opacity 120ms ease-out;
+}
+
+.lrow:hover .rowact,
+.lrow:focus-within .rowact {
+  opacity: 1;
+}
+
+@media (hover: none) {
+  .rowact {
+    opacity: 1;
+  }
+}
+
+button.text-action {
+  height: 26px;
+  padding: 0 8px;
+  border: 0;
+  border-radius: var(--radius-s);
+  background: none;
+  color: var(--gate-ink);
+  font-size: 12px;
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+button.text-action:hover {
+  background: var(--gate-soft);
+}
+
+button.text-action.warn {
+  color: var(--cursor-ink);
+}
+
+.lsection + .lsection {
+  border-top: 1px solid var(--line);
+}
+
+.lghead {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 4px 10px;
+  box-sizing: border-box;
+  padding: 8px 12px;
+  border-bottom: 1px solid var(--line);
+  background: var(--ground);
+}
+
+.lgname {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 0;
+  border: 0;
+  background: none;
+  color: var(--ink);
+  font-weight: 600;
+}
+
+button.lgname:hover {
+  text-decoration: underline;
+  text-decoration-color: var(--line-strong);
+  text-underline-offset: 3px;
+}
+
+.lgname svg {
+  color: var(--ink-muted);
+}
+
+.lgcount {
+  color: var(--ink-muted);
+  font-variant-numeric: tabular-nums;
+}
+
+.defaults {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 2px 12px;
+  color: var(--ink-muted);
+  font-size: 12px;
+}
+
+.defaults .mono {
+  color: var(--ink);
+}
+
+.lempty,
+.page-pad {
+  margin: 0;
+}
+
+.lempty {
+  padding: 10px 12px;
+}
+
+/* A connection's state: a square, from the mark's cursor (shape and colour). */
+.sq {
+  flex: none;
+  width: 10px;
+  height: 10px;
+  box-sizing: border-box;
+  border-radius: 2px;
+}
+
+.sq.connected {
+  background: var(--gate);
+}
+
+.sq.connecting {
+  height: 4px;
+  background: var(--cursor);
+  animation: blink 1s steps(1) infinite;
+}
+
+.sq.idle {
+  border: 1.5px solid var(--line-strong);
+}
+
+/* A state in a word. */
+.chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  height: 22px;
+  padding: 0 8px 0 6px;
+  border-radius: var(--radius-xs);
+  background: var(--surface-raised);
+  color: var(--ink);
+  font-size: 12px;
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.chip i {
+  width: 8px;
+  height: 8px;
+  box-sizing: border-box;
+  border-radius: 2px;
+}
+
+.chip.connected {
+  background: var(--gate-soft);
+}
+
+.chip.connected i {
+  background: var(--gate);
+}
+
+.chip.idle i {
+  border: 1.5px solid var(--line-strong);
+}
+
+.chip.attention {
+  background: var(--cursor-soft);
+}
+
+.chip.attention i {
+  background: var(--cursor);
+}
+
+.chip.failed {
+  background: var(--danger-soft);
+}
+
+.chip.failed i {
+  border: 2px solid var(--danger);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .rowact {
+    transition: none;
+  }
+
+  .sq.connecting {
+    animation: none;
+  }
+}
+
+/* What a group's hosts use, on its page. */
+.use-cards {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(190px, 1fr));
+  gap: 8px;
+}
+
+button.use-card {
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 2px;
+  min-width: 0;
+  padding: 10px 12px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius-m);
+  background: var(--surface);
+  text-align: left;
+}
+
+button.use-card:hover {
+  background: var(--surface-raised);
+}
+
+.use-name {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  max-width: 100%;
+  font-weight: 600;
+}
+
+.use-name svg {
+  flex: none;
+  color: var(--ink-muted);
+}
+
+/* Narrow pages (a phone, a small window): rows stack, their actions always shown. */
+@container page (max-width: 640px) {
+  .lthead {
+    display: none;
+  }
+
+  .lrow {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 2px 12px;
+    padding-block: 8px;
+  }
+
+  .lrow > .lfirst {
+    flex: 1 1 100%;
+  }
+
+  .lrow > .lcell:not(.lfirst) {
+    padding-left: 20px;
+    font-size: 12px;
+  }
+
+  .lrow > .lcell:empty {
+    display: none;
+  }
+
+  .rowact {
+    margin-left: auto;
+    opacity: 1;
+  }
+}
+
+/* The sidebar's host rows: the status square in the avatar's place. */
+.row-main > .sq {
+  margin-inline: 7px;
+}
+
+/* ------------------------------------------------------------ teams (TeamsPanel.tsx) */
+
+/* Joining with an invite, and this account's fingerprint, under the list of teams. */
+.teams-foot {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  gap: 24px;
+}
+
+/* What waits for this account in a team, each with its action. */
+.needs {
+  display: flex;
+  flex-direction: column;
+  border: 1px solid var(--cursor-ink);
+  border-radius: var(--radius-m);
+  background: var(--cursor-soft);
+}
+
+.need-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px 12px;
+  padding: 10px 12px;
+}
+
+.need-row + .need-row {
+  border-top: 1px solid var(--line);
+}
+
+.need-row .sq {
+  align-self: flex-start;
+  margin-top: 5px;
+}
+
+.need-text {
+  flex: 1 1 320px;
+  min-width: 0;
+}
+
+.need-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+
+.needs > .error {
+  margin: 0;
+  padding: 0 12px 10px;
+}
+
+/* A row's details, opened under it (a vault's access, comparing a fingerprint). */
+.lexpand {
+  padding: 12px 12px 14px 40px;
+  border-bottom: 1px solid var(--line);
+  background: var(--ground);
+}
+
+.lexpand.stack {
+  gap: 10px;
+}
+
+.lexpand .hint {
+  margin: 0;
+}
+
+button.text-action.danger {
+  color: var(--danger);
+}
+
+button.text-action.danger:hover {
+  background: var(--danger-soft);
+}
+
+/* Settings: a row per setting, what it does under its name, its control on the right. */
+.settings {
+  border: 1px solid var(--line);
+  border-radius: var(--radius-m);
+  background: var(--surface);
+}
+
+.setting {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px 16px;
+  padding: 12px;
+}
+
+.setting + .setting {
+  border-top: 1px solid var(--line);
+}
+
+.setting-text {
+  flex: 1 1 300px;
+}
+
+.setting-name {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-weight: 600;
+}
+
+.setting-desc {
+  white-space: normal;
+}
+
+.setting-input {
+  width: 220px;
+  max-width: 100%;
+}
+
+.setting-input.days {
+  width: 80px;
+  text-align: right;
+}
+
+.settings-save {
+  position: sticky;
+  bottom: 0;
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 12px;
+  border: 1px solid var(--line-strong);
+  border-radius: var(--radius-m);
+  background: var(--surface-raised);
+  box-shadow: var(--shadow-pop);
+}
+
+.team-settings > .section-title {
+  margin-top: 8px;
+}
+
+.danger-title {
+  color: var(--danger);
+}
+
+.settings.danger-zone {
+  border-color: var(--danger);
+}
+
+dialog.sheet.invite-dialog {
+  width: min(560px, calc(100% - 32px));
+}
+
+.invite-dialog h1 {
+  margin: 0 0 16px;
+  font-family: var(--font-display);
+  font-size: 20px;
+  line-height: 26px;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.invite-sent {
+  gap: 4px;
+}
diff --git a/docs/features/cloud-sources.md b/docs/features/cloud-sources.md
index 63c7d36..0eb0451 100644
--- a/docs/features/cloud-sources.md
+++ b/docs/features/cloud-sources.md
@@ -43,7 +43,7 @@ Refresh tokens rotate and a replayed one ends the sign-in, so `CloudState` lets
 
 ## Adding a source
 
-The Hosts page's **Clouds…** (desktop) opens "Clouds": each source, then a **Vault** choice and **Connect Vallic Cloud** (**Connect another Vallic account** once there is one), **Add AWS**, **Add Google Cloud**, **Add Azure**, **Add Hetzner Cloud**, **Add DigitalOcean**.
+The Hosts page's **Add from…** → **Clouds…** (desktop) opens "Clouds": each source, then a **Vault** choice and **Connect Vallic Cloud** (**Connect another Vallic account** once there is one), **Add AWS**, **Add Google Cloud**, **Add Azure**, **Add Hetzner Cloud**, **Add DigitalOcean**.
 
 ### Vallic Cloud
 
diff --git a/docs/features/hosts-groups-identities.md b/docs/features/hosts-groups-identities.md
index 00e2f26..183c876 100644
--- a/docs/features/hosts-groups-identities.md
+++ b/docs/features/hosts-groups-identities.md
@@ -106,21 +106,27 @@ An `attachment` is `name` (as added, without a path), `host_ref`, `blob` (hex SH
 
 The sidebar (`Sidebar.tsx`) is for connecting; the pages (`Lists.tsx`) are for managing.
 
+Every list page is a table (`Table`, `TRow`, `NameCell`): a row per item, its name first, which is the row's main action (connect a host, open anything else), then the columns people scan, then the row's other actions, shown on hover or keyboard focus (always on touch screens). Every other row carries the greenbar band. A page has one primary button; Close is a quiet × at the top right. A toolbar holds the search, filters (a page's most used tags, "Connected" or "Running") and **Select**. Below 640 px of page width the rows stack and their actions stay shown.
+
 On desktop, once the vault has hosts, the Hosts page is home: the workspace opens on it after unlocking, and closing the last tab or page returns to it (`home()` in `App.tsx`). With no hosts, home is quick connect. Closing the Hosts page itself goes to quick connect. On phones the start screen is the host list either way.
 
 | Sidebar part | What it does |
 | --- | --- |
 | Navigation | **Hosts**, **Groups**, **Keys** (keys and identities counted together), **Snippets**, **Tunnels** ("2 on"), **VPNs** ("1 up"), and **Session logs** once a host records |
 | Search | "Search hosts": label, hostname, user, tags |
+| Open | Hosts with a session, while any have one; a click goes to the host's latest tab |
 | Hosts | The plus (**New host**) and the group icon (**New group**); "Add your first host" when empty; hosts without a group, then each group, folding (remembered in `localStorage` as `morphgate.collapsed-groups`), with **Open the group** |
-| A host row | Click connects; `user@host:port`, "via" the jump host, a VPN mark, "gone" for a host its cloud no longer lists, the shared vault's name; **Browse files (SFTP)** (hidden when its cloud offers no SFTP) and **Edit host** |
+| A host row | A status square (connected, connecting, not connected) instead of a letter; click connects; `user@host:port`, "via" the jump host, a VPN mark, "gone" for a host its cloud no longer lists, the shared vault's name; **Browse files (SFTP)** (hidden when its cloud offers no SFTP) and **Edit host** |
 
 | Page | Content |
 | --- | --- |
-| Hosts | **Quick connect**, **Import…** and **Clouds…** (desktop), **Select**, **New group**, **New host**; "Not in a group", then a section per group with **Edit group** and what its hosts use; rows with **Connect**, **Files**, **Edit**, tags, and badges "gone from AWS" or the machine's state ("stopped") |
-| Groups | Each group with its host count and defaults; **Open**, **Edit** |
-| A group | Its hosts, the tunnels through them, their files (**Save**), and "What its hosts use" (identities, keys, jump hosts, VPNs); **Move to…**, **Edit group** |
-| Keys | Keys, then **Identities** (**New identity**) and **Host CAs** |
+| Hosts | **Add from…** (desktop: **Import…**, **Clouds…**), **New group**, **New host**. On desktop a **Quick connect** bar: what's typed (`user@host:port`) fills in quick connect, where the sign-in is chosen. Columns: Host (status square, name, `user@host:port`, the shared vault, "gone from AWS" or the machine's state), Route (direct, via a jump host, through a cloud or a proxy command, and the VPN, mint while up), Signs in with (identity, key, agent or password; "keeps its session", "recorded") and Tags (two, then "+N"). "Not in a group", then a section per group whose header names it (it opens the group's page), counts its hosts and shows what it gives them, with **Edit group**. Row actions: **Connect** (**New tab** for a host with a session, whose name goes to that session), **Browse files (SFTP)**, **Edit** |
+| Groups | Group, Hosts, What its hosts get, Connected; the name opens the group's page, **Edit** on the row |
+| A group | "What its hosts use" as cards (identities, keys, jump hosts, VPNs; each opens), then its hosts as on the Hosts page, the tunnels through them, their files (**Save**); **Move to…**, **Edit group** |
+| Keys | Tabs **Keys**, **Identities**, **Host CAs** with their counts; the page's primary button follows the tab (**New key**, **New identity**, **New host CA**). Keys: fingerprint, Used by, Certificate ("None", "Valid 30 d", "Expires in 3 d" under a week, "Expired", "No expiry", "Can't be read") |
+| Snippets | **Import…**, **New snippet**; Snippet, Command (its first line, "N lines"), Tags; **Paste** and **Run** while a terminal is connected, **Edit** |
+| Tunnels | The switch first, then Tunnel, Forwards, Through (with the host's status), State ("Running · N open", "Stopped", "Starting…"); **Edit** |
+| VPNs | VPN (its kind), Server, Used by, State ("Up", "Down", "Problem", with the problem under the name); **Edit** |
 
 ## Bulk changes
 
diff --git a/docs/features/importing.md b/docs/features/importing.md
index 7857875..e0d10d4 100644
--- a/docs/features/importing.md
+++ b/docs/features/importing.md
@@ -4,7 +4,7 @@ People arrive with hosts in another SSH client. The desktop app reads four sourc
 
 ## The page
 
-The Hosts page's **Import…** (desktop only) opens "Import hosts", which reads `~/.ssh/config` straight away.
+The Hosts page's **Add from…** → **Import…** (desktop only) opens "Import hosts", which reads `~/.ssh/config` straight away.
 
 | Control | Does |
 | --- | --- |
diff --git a/docs/features/port-forwarding.md b/docs/features/port-forwarding.md
index 55e4bc2..d2151c2 100644
--- a/docs/features/port-forwarding.md
+++ b/docs/features/port-forwarding.md
@@ -52,7 +52,7 @@ The form is valid with a host, a listen address, a listen port from 1 to 65535 (
 
 | Where | Control |
 | --- | --- |
-| Tunnels page (sidebar **Tunnels**, whose count reads "N on" while some run) | A switch per row ("Start tunnel" / "Stop tunnel"), **Edit**, **Select** for bulk delete and move, **New tunnel**. Rows read like `L :15432 → db:5432`, `R server:8080 → 127.0.0.1:3000` or `SOCKS :1080`, with "· N open" while connections are open, and "Through *host*" |
+| Tunnels page (sidebar **Tunnels**, whose count reads "N on" while some run) | A table: the switch first ("Start tunnel" / "Stop tunnel"), the name, what it forwards (`L :15432 → db:5432`, `R server:8080 → 127.0.0.1:3000` or `SOCKS :1080`), the host it goes through with its status, and its state ("Running", "Running · N open", "Stopped", "Starting…"); **Edit**, a "Running" filter, **Select** for bulk delete and move, **New tunnel** |
 | A group's page | The tunnels through its hosts, with the same switch |
 | The editor | **Save & start** |
 | Phone | The **More** screen lists tunnels with switches |
diff --git a/docs/features/ssh-keys-and-agents.md b/docs/features/ssh-keys-and-agents.md
index 6b5a4ef..cca30e2 100644
--- a/docs/features/ssh-keys-and-agents.md
+++ b/docs/features/ssh-keys-and-agents.md
@@ -6,7 +6,7 @@ How a connection uses them, and host keys, are in [SSH connections](ssh-connecti
 
 ## The Keys page
 
-**Keys** in the sidebar (the count is keys plus identities) opens a page: "SSH keys stay in the vault, encrypted, and are used from there: they are never written to disk." Each key shows its label, type, a **passphrase** badge when one is saved, its vault, its fingerprint and "Used by N hosts and M identities" or "Not used yet", with **Open**. **New key** is at the top. The side column holds **Identities** ([Hosts, groups and identities](hosts-groups-identities.md)) and **Host CAs** ([SSH connections](ssh-connections.md#host-cas)).
+**Keys** in the sidebar (the count is keys plus identities) opens a page: "SSH keys stay in the vault, encrypted, and are used from there: they are never written to disk." Its tabs are **Keys**, **Identities** ([Hosts, groups and identities](hosts-groups-identities.md)) and **Host CAs** ([SSH connections](ssh-connections.md#host-cas)). Each key shows its label, type, a **passphrase** badge when one is saved, its vault, its fingerprint, "N hosts, M identities" or "Not used yet", and its certificate's state; its name (or **Open** on the row) opens it. **New key** is at the top while the Keys tab is open.
 
 ### New SSH key (`NewKey`)
 
diff --git a/docs/features/teams.md b/docs/features/teams.md
index 296bc92..6fe4c13 100644
--- a/docs/features/teams.md
+++ b/docs/features/teams.md
@@ -65,22 +65,29 @@ Certificates bind keys to accounts and grant nothing; access stays with the serv
 
 Every verified key is pinned in `pinned_keys` with the email. A known account whose keys change is a hard error, never a prompt: "the keys of {email} changed; they must be removed and invited again". Members who don't verify go to `Trust.unverified`; the member list says "Keys not verified yet" and nothing is sealed to them ("can't verify that member's keys").
 
+## The pages
+
+**Teams** (`TeamsPanel`) lists the teams this account is in as a table: Team, You are (its role, or "Joined" until an admin confirms it), Vaults you open, and Needs you, from what this device knows: "Turn on two-step verification", "Sign in with single sign-on", "This device waits for approval" (or "This device was denied"), "{n} devices to approve", "Publish your SSH keys", "Rotate a vault's key"; "An admin confirms you next" while waiting. **New team** is the page's primary action. Under the list: **Join with an invite** and **Your fingerprint**.
+
+A team's page (`OrgView`) has the plan and single sign-on lines under its name, **Invite people** for owners and admins (its primary action), and **Needs you** above its tabs: members to confirm (**Confirm {name}…**) or certify again (**Verify…**), devices waiting (**Approve**, **Deny**), vaults whose key should be rotated (**Rotate key**), two-step verification the team requires, and the SSH keys it asks members to publish (**Publish a key**). Tabs: **Members** (members, then the invites not accepted yet: Role, Keys ("Verified", "To confirm", "Not verified"), SSH keys; then **Devices waiting**), **Vaults** (Items, You can, Key; **Access**, **Rotate key**), **Your SSH keys**, and for owners and admins **Settings** and **Activity**. Members see **Vaults** first. Before an admin confirms you, the page only says so, with your fingerprint and **Leave**. Lists are the tables of the other pages (`ListParts.tsx`).
+
 ## Creating a team
 
-**New organization** (placeholder "Acme Ops"), **Create**. `create_org()` picks a ULID, creates the organization, checks that the server put this account's real keys at the root of the owner chain, pins the root and creates the member key directory (if that fails, the next sync does it). A server with plans (such as morphgate.com) may refuse with `402 team_limit`, whose `limit` is how many teams an account may own without a plan. The app then says "you own {n} teams without a plan: choose a plan for one of them, or delete one, before creating another" and, on desktop, offers **Choose a plan ↗** (the account portal at `/account`); iOS and Android builds say "…, the most you can: delete one before creating another".
+**New team** opens a bar: **Team name** (placeholder "Acme Ops"), **Create team**. `create_org()` picks a ULID, creates the organization, checks that the server put this account's real keys at the root of the owner chain, pins the root and creates the member key directory (if that fails, the next sync does it). A server with plans (such as morphgate.com) may refuse with `402 team_limit`, whose `limit` is how many teams an account may own without a plan. The app then says "you own {n} teams without a plan: choose a plan for one of them, or delete one, before creating another" and, on desktop, offers **Choose a plan ↗** (the account portal at `/account`); iOS and Android builds say "…, the most you can: delete one before creating another".
 
 ## Inviting
 
-Owners and admins see **Invites** beside the team.
+**Invite people** (owners and admins; disabled while the team is locked) opens a dialog.
 
 | Control | Does |
 | --- | --- |
-| Email field (placeholder "colleague@example.com"), **Invite** | Enabled for a well-formed address (`^[^@\s]+@[^@\s]+$`) at an allowed domain ("Invites go only to @…") |
-| **Member** / **Admin** select | Owners only; only the owner invites admins. Admin invites carry no vault grants |
-| "Vaults they get once you confirm them:" checkboxes | Members only; each ticked vault gets an access select, **Can edit** by default |
-| Pending list, **Cancel** | One row per invite with "Expires {date}" |
-| "This server doesn't email invites. Send this code to {email} (it works once, for that address, for 7 days):", **Copy code**, **Done** | When the server returned the token (`mails_invites: false`) |
-| "Invite emailed to {email}." | Otherwise |
+| **Email addresses** (placeholder "colleague@example.com, another@example.com"), **Send invite** / **Send {n} invites** | Several at once, separated by commas, semicolons or spaces; each must be well formed (`^[^@\s]+@[^@\s]+$`, else "Not an email address: …") and at an allowed domain ("Invites go only to @…: not …"). One `org_invite` per address; those refused are named, the rest are sent |
+| **Role** | Owners only ("Member: the vaults you give them", "Admin: every vault and member"); only the owner invites admins. Admin invites carry no vault grants |
+| "Vaults they get once you confirm them" checkboxes | Members only; each ticked vault gets an access select, **Can edit** by default |
+| "This server doesn't email invites. Send each person their code (it works once, for that address, for 7 days):", a code per address with **Copy code**, **Done** | When the server returned the tokens (`mails_invites: false`) |
+| "Invite emailed to {emails}." | Otherwise |
+
+Invites not accepted yet are rows of **Members**: "Invited · works until {date}", **Cancel invite**.
 
 An invite page on the web opens `morphgate://invite?token=…&server=…` (or `morphgate://invite/{token}`). The app opens Teams with the code looked up, after checking that sync is on (otherwise it opens Sync, and Teams once sync is on) and that `server` is the server this device syncs with. Opened before the app has a vault, the first screen shows the invite and offers a new account with its address ([First run](vault-and-unlock.md#first-run)). A link never joins by itself. See [Deep links](deep-links.md).
 
@@ -88,11 +95,11 @@ An invite page on the web opens `morphgate://invite?token=…&server=…` (or `m
 
 **Join with an invite**: **Invite code**, **Look up**. `preview_invite()` reads the invite and verifies its owner chain from the first link, then shows the team, the invited address, the role, the sender and the current owner's fingerprint. The person ticks **It matches the fingerprint they read to me** and chooses **Join {team}**.
 
-`accept_invite()` reads the invite again and refuses when the owner's fingerprint is no longer the one shown ("the organization's keys changed while you were looking; check the fingerprint again") or when this device already pinned another root ("this organization's root key changed"). Then it accepts and pins the root. The member is `accepted`: the list says "Waiting for an admin to confirm you", and the team page shows their own fingerprint to read out, with **Leave**.
+`accept_invite()` reads the invite again and refuses when the owner's fingerprint is no longer the one shown ("the organization's keys changed while you were looking; check the fingerprint again") or when this device already pinned another root ("this organization's root key changed"). Then it accepts and pins the root. The member is `accepted`: the Teams list says "An admin confirms you next", and the team page shows their own fingerprint to read out, with **Leave**.
 
 ## Confirming and verifying members
 
-An admin chooses **Confirm…** next to a member "Waiting for confirmation", asks them to read their fingerprint (Teams, on their device), ticks **It matches what they read to me** and chooses **Confirm {email}**. `confirm_member()`:
+An admin chooses **Confirm…** on a member marked "To confirm" (or **Confirm {name}…** in Needs you), asks them to read their fingerprint (Teams, on their device), ticks **It matches what they read to me** and chooses **Confirm {email}**. `confirm_member()`:
 
 1. syncs the organization first (`refresh()`), then refuses a member already confirmed;
 2. compares the fingerprint of the keys the server lists now with the one the admin compared ("their keys don't match the fingerprint you compared; compare again") and with any pin ("this account's keys changed");
@@ -108,13 +115,13 @@ A member certificate counts only while its signer is an owner or admin. When the
 
 | Role | In the app |
 | --- | --- |
-| Owner | Everything below, plus **Make admin** / **Make member**, invites and confirms admins, removes admins, **Ownership** (transfer, delete), **Choose a plan ↗** / **Manage plan ↗** on desktop |
+| Owner | Everything below, plus the role select on members' rows, invites and confirms admins, removes admins, **Ownership** (transfer, delete), **Choose a plan ↗** / **Manage plan ↗** on desktop |
 | Admin | Opens and manages every vault, invites members, confirms, removes members, policies, **Activity**, device decisions |
 | Member | Opens the vaults granted, publishes SSH keys, approves their own new devices, creates vaults if the policy allows |
 
 `set_role()` to admin verifies the member's keys, seals them every organization vault's key ring and adds an admin certificate. To member it sends no keys; the server drops access that came only with the role and flags those vaults for rotation.
 
-**Transfer ownership** (enabled once there is a confirmed admin; "To hand the organization over, make someone an admin first.") signs an owner certificate for the chosen admin; the old owner stays an admin. **Delete organization** deletes it with all its vaults, then removes them from this device. Both ask for **Your master password**, sent as the AuthKey.
+**Transfer…** under **Ownership** on Settings (enabled once there is a confirmed admin; "To hand the team over, make someone an admin first.") signs an owner certificate for the chosen admin; the old owner stays an admin. **Delete team…** deletes it with all its vaults, then removes them from this device. Both ask for **Your master password**, sent as the AuthKey.
 
 ## Shared vaults and access
 
@@ -126,11 +133,11 @@ A member certificate counts only while its signer is an owner or admin. When the
 | `write` | **Can edit** | Also add, change and delete items |
 | `manage` | **Can manage** | Also see who has access, grant, revoke, rotate |
 
-**Access** next to a vault (managers, not the directory) lists who has it. Owners and admins show "Can manage (owner or admin)" and can't be changed. **Give a member access…** lists confirmed plain members without access, with an access select (**Can edit** by default) and **Add**. `set_access()` only changes the permission for someone who already has the vault; a new grant verifies their keys and seals every key generation. **Remove** revokes, then explains: "They can't sync this vault anymore, but what they already had stays on their devices. Rotate the key (the button appears after the next sync) so they can't read anything added from now on, and change the passwords and keys they could see."
+**Access** on a vault's row (Vaults tab; managers, not the directory) opens under it who has it. Owners and admins show "Can manage (owner or admin)" and can't be changed. **Give a member access…** lists confirmed plain members without access, with an access select (**Can edit** by default) and **Add**. `set_access()` only changes the permission for someone who already has the vault; a new grant verifies their keys and seals every key generation. **Remove** revokes, then explains: "They can't sync this vault anymore, but what they already had stays on their devices. Rotate the key (the button appears after the next sync) so they can't read anything added from now on, and change the passwords and keys they could see."
 
 ## Key rotation
 
-The server sets `rotation_due` on a vault when anyone loses access to it: revoked, removed, left, or made a member again. The vault row then says "someone lost access since the key was made"; managers get **Rotate key** ("Rotating…") and the sidebar shows **Teams · rotate a key**.
+The server sets `rotation_due` on a vault when anyone loses access to it: revoked, removed, left, or made a member again. The vault's Key column then says "Rotate" (to managers; "Rotation due" to others), Needs you says "{vault}'s key should be rotated: someone lost access since it was made.", managers get **Rotate key** ("Rotating…") there and on the row, and the sidebar shows **Teams · rotate a key**.
 
 `rotate()` syncs the organization first, generates a vault key, seals it with a grant signature to every account the server lists as having access (each must verify), and switches with `previous_key_id` set to the current key (the server refuses a stale one with `409`). This device keeps every older generation in `vault_keys` and re-seals its own copies of the vault's items under the new key; the next sync pushes them. Any device with write access finishes what is left on its next sync, and a push under an old key (`stale_key`) is re-sealed and sent again. Rotation keeps the person who left out of what is written next; it can't take back what they synced. That is [Offboarding](offboarding.md).
 
@@ -154,17 +161,17 @@ When a round finds the account in fewer organizations than the device knows (lef
 
 ## Policies
 
-Owners and admins edit **Policies**; **Save policies** appears once something changed. `org_policies_set` always sends the whole set.
+Owners and admins change them on **Settings**, grouped (Security, Members, Session logs), each with what it does and a switch or a field; **Save settings** and **Discard** appear once something changed. `org_policies_set` always sends the whole set.
 
 | Policy | Control | Notes |
 | --- | --- | --- |
-| `require_totp` | **Require two-step verification to open the organization's vaults** | Disabled without `features.totp` unless on ("(this server doesn't offer two-step verification)"). Members without it are told where they look for the vaults ([Two-step verification required](account-and-devices.md#two-step-verification-required)) |
-| `members_can_create_vaults` | **Members can create vaults (they manage the ones they create)** | |
-| `allowed_email_domains` | **Invite only addresses at these domains (empty: any)** | Split on commas and spaces, leading `@` dropped, lowercased; the invite form checks it too |
-| `require_device_approval` | **Owners and admins approve new devices before they open the organization's vaults (…)** | Disabled unless the plan lists `device_approval` (or the server has no plans) or it is on: "Needs the Business plan." |
-| `require_member_keys` | **Members publish the SSH keys they use on the organization's servers (so leaving can remove them); the app reminds those who haven't** | `Option<bool>`, sent only once set, since a server may refuse a policy it doesn't know. Only the apps act on it |
-| `session_log_retention_days` | **Delete the team's session logs after this many days (0 keeps them)** | Only with `features.blobs`; 0 to 3650 (`min(3650)`) |
-| `require_sso` | None; a hint when on | Set on the server along with the identity provider (on the reference server, `vault-sync-server sso --require`); sent back unchanged |
+| `require_totp` | **Require two-step verification** | Disabled without `features.totp` unless on ("This server doesn't offer two-step verification."). Members without it are told where they look for the vaults ([Two-step verification required](account-and-devices.md#two-step-verification-required)) |
+| `members_can_create_vaults` | **Members can create vaults** | |
+| `allowed_email_domains` | **Invite only these domains** (empty: any) | Split on commas and spaces, leading `@` dropped, lowercased; the invite form checks it too |
+| `require_device_approval` | **Approve new devices** | Disabled unless the plan lists `device_approval` (or the server has no plans) or it is on, marked **Business plan** |
+| `require_member_keys` | **Ask members to publish their SSH keys** (the app reminds those who haven't) | `Option<bool>`, sent only once set, since a server may refuse a policy it doesn't know. Only the apps act on it |
+| `session_log_retention_days` | **Delete session logs after** {n} days (0 keeps them) | Only with `features.blobs`; 0 to 3650 (`min(3650)`) |
+| `require_sso` | None; a **Single sign-on** row saying "Required" when on | Set on the server along with the identity provider (on the reference server, `vault-sync-server sso --require`); sent back unchanged |
 
 The server enforces every policy but `require_member_keys`. It may check more than the app does: the reference server refuses an entry in `allowed_email_domains` that isn't a domain name ("not a domain: …"), and refuses `require_totp` with `501 not_supported`, since it has no two-step verification.
 
@@ -174,15 +181,15 @@ On a server with plans (such as morphgate.com), `org_details` carries the team's
 
 ## Device approval, single sign-on and activity
 
-- **Devices** / **Waiting for approval** lists pending and denied devices (everyone's for owners and admins, your own otherwise) with **Approve** and **Deny**; this device's own row says "Approve it from another of your devices". A device that waits shows **Waiting for approval · {team}** (or "{team} denied this device") in the sidebar, which opens the `ApprovalWait` dialog (**Check again** syncs now).
+- **Devices waiting** (Members tab) lists pending and denied devices (everyone's for owners and admins, your own otherwise) with **Approve** and **Deny**; pending ones are in Needs you too; this device's own row says "Approve it from another of your devices". A device that waits shows **Waiting for approval · {team}** (or "{team} denied this device") in the sidebar, which opens the `ApprovalWait` dialog (**Check again** syncs now).
 - With a provider configured, the team page says "Single sign-on at {host}" and either "This device is signed in until {time}" or **Sign in**. Held vaults show **Sign in to {team}** in the sidebar. `SsoSignIn` opens the provider in the browser (`org_sso_start`), polls `org_sso_status` every 2 seconds (`POLL_MS`) until a session appears, then syncs; past `expires_in` it says "The sign-in expired. Start it again." The provider's protocol (OpenID Connect or SAML) is the server's business; the app only opens the address the server gives.
-- **Activity** (owners and admins), **Show activity**: `org_activity` reads every page (1000 events each, at most `ACTIVITY_PAGES` = 1000 pages) and keeps the newest `ACTIVITY_KEPT` = 5000; the panel shows 50 at a time (**Show older**). Names come from pinned emails and local vault names ("a former member", "a vault you can't open"). **Download CSV** and **Download JSON lines** save `morphgate-activity-{team}-{date}.{csv|jsonl}` in Downloads.
+- The **Activity** tab (owners and admins): `org_activity` reads every page (1000 events each, at most `ACTIVITY_PAGES` = 1000 pages) and keeps the newest `ACTIVITY_KEPT` = 5000; the panel shows 50 at a time (**Show older**). Names come from pinned emails and local vault names ("a former member", "a vault you can't open"). **Download CSV** and **Download JSON lines** save `morphgate-activity-{team}-{date}.{csv|jsonl}` in Downloads.
 
 ## Member key directory
 
-Offboarding needs to know which `authorized_keys` lines belong to someone, so members publish the public halves of the keys they use on the team's servers. The directory is an ordinary organization vault named "Member keys" (`DIRECTORY_NAME`) whose encrypted meta says `directory: true`, so servers need nothing new. Owners' and admins' apps create it and keep every confirmed member at `write`; if two appear, the lowest id is used. It shows as **Every member** with "Members' SSH public keys: {n} published".
+Offboarding needs to know which `authorized_keys` lines belong to someone, so members publish the public halves of the keys they use on the team's servers. The directory is an ordinary organization vault named "Member keys" (`DIRECTORY_NAME`) whose encrypted meta says `directory: true`, so servers need nothing new. Owners' and admins' apps create it and keep every confirmed member at `write`; if two appear, the lowest id is used. On the Vaults tab it shows as "Member keys" ("Members' SSH public keys"), **Every member**.
 
-**Your SSH keys** (until the directory reaches this device: "The organization's member key directory arrives with the next sync."): **Publish one of your keys…** lists the SSH keys of the personal vault not yet published; **Publish** (`member_key_publish`) stores a `member_key` item (`account_id`, `public_key` as OpenSSH `type base64`, `label`, `sig`) signed by this account; publishing the same key again returns the existing entry. **Unpublish** deletes the item. A reader accepts an entry only if its signature verifies with that member's own pinned key, so nobody else, the server included, can publish a key in someone's name; an entry still verifies after its author leaves. The member list shows "{n} SSH keys published" (verified entries only). With `require_member_keys` on, members without one see "none yet, and the organization asks for them" and the sidebar shows **Teams · publish your keys**.
+**Your SSH keys** (until the directory reaches this device: "The organization's member key directory arrives with the next sync."): **Publish one of your keys…** lists the SSH keys of the personal vault not yet published; **Publish** (`member_key_publish`) stores a `member_key` item (`account_id`, `public_key` as OpenSSH `type base64`, `label`, `sig`) signed by this account; publishing the same key again returns the existing entry. **Unpublish** deletes the item. A reader accepts an entry only if its signature verifies with that member's own pinned key, so nobody else, the server included, can publish a key in someone's name; an entry still verifies after its author leaves. The member list's SSH keys column shows "{n} published" (verified entries only). With `require_member_keys` on, members without one show "None yet", Needs you asks them to publish one (**Publish a key**), and the sidebar shows **Teams · publish your keys**.
 
 ## Data on this device
 
diff --git a/docs/features/terminal-and-snippets.md b/docs/features/terminal-and-snippets.md
index d59666c..2d30c03 100644
--- a/docs/features/terminal-and-snippets.md
+++ b/docs/features/terminal-and-snippets.md
@@ -122,7 +122,7 @@ A `snippet` item: `name` (trimmed), `body` (exactly as typed), `tags` (trimmed,
 | **Delete**, then **Really delete?** | Deletes |
 | **Close**, **Save snippet** / **Save changes** | |
 
-The Snippets page (sidebar **Snippets**) has **Edit** per row, and **Paste** and **Run** while a terminal is connected, **Select** for bulk delete and move, **Import…** and **New snippet**. On a phone, the terminal's **More** menu has **Snippets**.
+The Snippets page (sidebar **Snippets**) lists them as a table (name, the command's first line, tags), with **Edit** per row (or the name), and **Paste** and **Run** while a terminal is connected, a search and tag filters, **Select** for bulk delete and move, **Import…** and **New snippet**. On a phone, the terminal's **More** menu has **Snippets**.
 
 | Behavior | Detail |
 | --- | --- |
diff --git a/docs/features/vpn.md b/docs/features/vpn.md
index 8f73a0f..3a2a5c4 100644
--- a/docs/features/vpn.md
+++ b/docs/features/vpn.md
@@ -74,7 +74,7 @@ Field and certificate prompts time out after 5 minutes (`PROMPT_TIMEOUT`), which
 
 ## The VPN editor
 
-`VpnPanel` edits one profile; the VPNs page (`VpnsPage` in `Lists.tsx`, **New VPN**) lists them with their server and status, or what uses them ("Used by 2 hosts and 1 group", "Not used by a host yet").
+`VpnPanel` edits one profile; the VPNs page (`VpnsPage` in `Lists.tsx`, **New VPN**) lists them as a table: name and kind, server, what uses them ("2 hosts, 1 group", "No host yet") and their state ("Up", "Down", or "Problem" with the problem under the name).
 
 | Control | Does |
 | --- | --- |

From 52760daa5b41ba60514e6c3bf75a5834f9fcfcd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Wed, 21 Oct 2026 23:27:32 +0200
Subject: [PATCH 4/6] Fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 apps/desktop/src/ListParts.tsx  | 15 ++++++++++-----
 apps/desktop/src/Lists.tsx      | 14 +++-----------
 apps/desktop/src/TeamsPanel.tsx |  2 +-
 3 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/apps/desktop/src/ListParts.tsx b/apps/desktop/src/ListParts.tsx
index ad99de2..7ed6633 100644
--- a/apps/desktop/src/ListParts.tsx
+++ b/apps/desktop/src/ListParts.tsx
@@ -52,7 +52,7 @@ export function NameCell({
   name,
   beside,
   sub,
-  subMono,
+  subTone,
 }: {
   pick?: Pick;
   onOpen?: () => void;
@@ -62,9 +62,10 @@ export function NameCell({
   lead?: ReactNode;
   name: string;
   beside?: ReactNode;
-  sub?: ReactNode;
-  /** The line under it is machine text (an address). */
-  subMono?: boolean;
+  /** The line under it: text only, so it shrinks to an ellipsis (the whole of it on hover). */
+  sub?: string;
+  /** That line is machine text (an address), or a problem. */
+  subTone?: "mono" | "error";
 }) {
   const inner = (
     <>
@@ -74,7 +75,11 @@ export function NameCell({
           <span className="lname">{name}</span>
           {beside}
         </span>
-        {sub && <span className={`lsub ${subMono ? "mono" : ""}`}>{sub}</span>}
+        {sub && (
+          <span className={`lsub ${subTone === "mono" ? "mono" : subTone === "error" ? "error-text" : ""}`} title={sub}>
+            {sub}
+          </span>
+        )}
       </span>
     </>
   );
diff --git a/apps/desktop/src/Lists.tsx b/apps/desktop/src/Lists.tsx
index bea3904..370f33f 100644
--- a/apps/desktop/src/Lists.tsx
+++ b/apps/desktop/src/Lists.tsx
@@ -209,7 +209,7 @@ function HostRows({ list, things, ...p }: HostRowsProps) {
                 </>
               }
               sub={`${h.user}@${h.hostname}:${h.port}`}
-              subMono
+              subTone="mono"
             />
             <Cell>
               <HostRoute h={h} t={things} />
@@ -1131,16 +1131,8 @@ export function VpnsPage(p: VpnsProps) {
                   lead={<Icon name="vpn" size={15} />}
                   name={v.label}
                   beside={<VaultTag vaults={p.vaults} id={v.vaultId} />}
-                  sub={
-                    v.problem ? (
-                      <span className="error-text">{v.problem}</span>
-                    ) : (
-                      <>
-                        {vpnKindName(v.kind)}
-                        {v.active && v.address && <span className="mono"> · {v.address}</span>}
-                      </>
-                    )
-                  }
+                  sub={v.problem ?? `${vpnKindName(v.kind)}${v.active && v.address ? ` · ${v.address}` : ""}`}
+                  subTone={v.problem ? "error" : undefined}
                 />
                 <Cell className="mono trunc">{v.server}</Cell>
                 <Cell className="trunc">{use(v)}</Cell>
diff --git a/apps/desktop/src/TeamsPanel.tsx b/apps/desktop/src/TeamsPanel.tsx
index 9a3be3b..a7dc2d1 100644
--- a/apps/desktop/src/TeamsPanel.tsx
+++ b/apps/desktop/src/TeamsPanel.tsx
@@ -794,7 +794,7 @@ function MembersTab({ org, members, invites, published, keysRequired, admin, own
                   </>
                 }
               >
-                <NameCell name={m.email} beside={m.me && <span className="kind-badge me">you</span>} sub={m.fingerprint} subMono />
+                <NameCell name={m.email} beside={m.me && <span className="kind-badge me">you</span>} sub={m.fingerprint} subTone="mono" />
                 <Cell>
                   {owner && !m.me && m.status === "confirmed" && m.role !== "owner" ? (
                     <select

From ccd8cc4b88d1398685f08af7850a7042da59dc90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Thu, 22 Oct 2026 00:32:31 +0200
Subject: [PATCH 5/6] UI fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 apps/desktop/src/styles.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index ebaeac4..935c47d 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -3979,6 +3979,10 @@ button.lnamebtn:hover .lname {
   white-space: nowrap;
 }
 
+.lsub.error-text {
+  color: var(--danger);
+}
+
 .trunc {
   overflow: hidden;
   min-width: 0;

From 02590b6402e774d1d8fc522e88a1892f209c6389 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Valentino=20Me=C4=91imorec?= <valentino@medimorec.com>
Date: Thu, 22 Oct 2026 01:15:44 +0200
Subject: [PATCH 6/6] UI fixes & re-alignments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Valentino Međimorec <valentino@medimorec.com>
---
 CHANGELOG.md                             |  13 +-
 apps/desktop/e2e/flows.mjs               |   3 +-
 apps/desktop/e2e/layout.mjs              |  17 +-
 apps/desktop/e2e/mobile.mjs              |   4 +-
 apps/desktop/e2e/teams.mjs               |  23 ++-
 apps/desktop/src/App.tsx                 |  16 +-
 apps/desktop/src/Lists.tsx               |  46 +----
 apps/desktop/src/SessionLogs.tsx         | 210 +++++++++++++++++------
 apps/desktop/src/TeamsPanel.tsx          | 125 +++++++-------
 apps/desktop/src/styles.css              |  49 ++++++
 docs/features/hosts-groups-identities.md |   2 +-
 docs/features/session-logs.md            |   6 +-
 docs/features/teams.md                   |   6 +-
 13 files changed, 331 insertions(+), 189 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6db1f7b..3599478 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,15 +12,16 @@ prompt. Write them for users.
   an invite there (Joining a team?). An invite opened while sync is off opens as soon as you turn
   sync on: no need to open the link again.
 - MorphGate can suggest a strong master password: five random words, wherever you set one.
-- With saved hosts, MorphGate opens on your Hosts page, which has a quick connect bar: type
-  user@host:port and choose how to sign in.
+- With saved hosts, MorphGate opens on your Hosts page, with Quick connect beside New host.
 - Hosts, groups, keys, snippets, tunnels and VPNs are tables you can search and filter, each row's
   actions shown as you point at it. Hosts show whether they're connected instead of a letter, each
-  group says what it gives its hosts, and the sidebar lists your open sessions first. Keys,
-  identities and host CAs are tabs of the Keys page.
+  group says what it gives its hosts (which sit indented under it), and the sidebar lists your
+  open sessions first. Keys, identities and host CAs are tabs of the Keys page. Session logs can
+  be searched and narrowed to a vault, group or host.
 - A team's page starts with what needs you (a member to confirm, a device to approve, a key to
-  rotate), then has tabs for its members, vaults, your SSH keys, settings and activity. You can
-  invite several people at once, and Teams says per team what's waiting for you.
+  rotate), then has tabs for its members, vaults, your SSH keys, settings and activity. New vault
+  and the plan sit beside Invite people, and you can invite several people at once. Teams says
+  per team what's waiting for you.
 - When a team requires two-step verification and your account doesn't have it, MorphGate says so
   and takes you to turning it on, instead of the team's vaults silently not appearing.
 - Sync: every change now carries a version inside its signed envelope, and deletions are signed,
diff --git a/apps/desktop/e2e/flows.mjs b/apps/desktop/e2e/flows.mjs
index 02cf48c..b54a24a 100644
--- a/apps/desktop/e2e/flows.mjs
+++ b/apps/desktop/e2e/flows.mjs
@@ -138,8 +138,9 @@ export async function createTeam(s, name, vault) {
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === arguments[0] || null`, name), "the team's page");
   await s.pageTab("Vaults");
   await s.waitText("No vaults yet", ".panel");
-  await s.type('input[aria-label="New vault name"]', vault);
   await s.clickButton("New vault");
+  await s.type('input[aria-label="Vault name"]', vault);
+  await s.clickButton("Create vault");
   await s.wait(() => s.hasText(".panel .lname", vault), "the new vault");
   return fp;
 }
diff --git a/apps/desktop/e2e/layout.mjs b/apps/desktop/e2e/layout.mjs
index 1cf4674..ec1e408 100644
--- a/apps/desktop/e2e/layout.mjs
+++ b/apps/desktop/e2e/layout.mjs
@@ -161,6 +161,12 @@ try {
   await s.clickButton("Close");
   await s.wait(() => s.hasText(".panel .lname", "Tail nginx errors"), "the snippet on its page");
   await shoot(s, "snippets");
+  // A page's own page (its import) closes back to it, not home.
+  await s.clickButton("Import…");
+  await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Import snippets" || null`), "Import snippets");
+  await s.click(".panel.page .page-close");
+  await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Snippets" || null`), "back on Snippets");
+  ok("closing Import snippets returns to Snippets");
 
   await page(s, "Tunnels");
   await s.clickButton("New tunnel");
@@ -194,14 +200,23 @@ try {
   await s.click("button.sidebar-foot.teams");
   await s.wait(() => s.exec(`return [...document.querySelectorAll(".panel button")].some((b) => b.innerText === "New team") || null`), "the teams page");
   await shoot(s, "teams-list");
+  // Cancel puts the New team bar away and stays on Teams.
+  await s.clickButton("New team");
+  await s.wait(() => s.exec(`return document.querySelector('input[aria-label="Team name"]') ? true : null`), "the New team bar");
+  await shoot(s, "teams-new");
+  await s.click("form.quick-bar button.quiet");
+  await s.wait(() => s.exec(`return document.querySelector('input[aria-label="Team name"]') ? null : true`), "the bar to go");
+  assert.equal(await s.exec(`return document.querySelector(".panel.page h1")?.innerText`), "Teams");
+  ok("New team, then Cancel, stays on Teams");
   await s.clickButton("New team");
   await s.type('input[aria-label="Team name"]', "Acme Operations International");
   await s.clickButton("Create team");
   await s.wait(() => s.exec(`return document.querySelector(".panel.page h1")?.innerText === "Acme Operations International" || null`), "the team's page");
   await s.pageTab("Vaults");
   await s.waitText("No vaults yet", ".panel");
-  await s.type('input[aria-label="New vault name"]', "Production databases");
   await s.clickButton("New vault");
+  await s.type('input[aria-label="Vault name"]', "Production databases");
+  await s.clickButton("Create vault");
   await s.wait(() => s.hasText(".panel .lname", "Production databases"), "the new vault");
   await shoot(s, "org-vaults");
   await s.clickButton("Invite people");
diff --git a/apps/desktop/e2e/mobile.mjs b/apps/desktop/e2e/mobile.mjs
index 228a08d..1907e60 100644
--- a/apps/desktop/e2e/mobile.mjs
+++ b/apps/desktop/e2e/mobile.mjs
@@ -207,8 +207,8 @@ try {
   await tap('.m-sftp:not([hidden]) .m-bar button[aria-label="Back"]');
   await tapText(".m-nav button", "More");
   await tapText(".m-row", "Session logs");
-  await s.wait(() => s.hasText(".panel.page .device-list strong", "box"), "the recording in Session logs");
-  await tapText(".panel.page .device-list button", "Play");
+  await s.wait(() => s.hasText(".panel.page .lname", "box"), "the recording in Session logs");
+  await tapText(".panel.page .lrow .rowact button", "Play");
   await s.wait(
     async () => (await s.exec(`const r = document.querySelector(".player-screen .xterm-rows"); return r ? r.innerText : ""`)).includes("arrow-42") || null,
     "the recording to play",
diff --git a/apps/desktop/e2e/teams.mjs b/apps/desktop/e2e/teams.mjs
index 919f46f..5a6bd58 100644
--- a/apps/desktop/e2e/teams.mjs
+++ b/apps/desktop/e2e/teams.mjs
@@ -158,8 +158,9 @@ try {
   await alice.wait(() => alice.exec(`return document.querySelector(".panel.page h1")?.innerText === "Acme Ops" || null`), "the team's page");
   await alice.pageTab("Vaults");
   await alice.waitText("No vaults yet", ".panel");
-  await alice.type('input[aria-label="New vault name"]', "Production");
   await alice.clickButton("New vault");
+  await alice.type('input[aria-label="Vault name"]', "Production");
+  await alice.clickButton("Create vault");
   await alice.wait(() => alice.hasText(".panel .lname", "Production"), "the new vault");
   await alice.clickButton("Invite people");
   await alice.type('input[aria-label="Emails to invite"]', bobEmail);
@@ -202,6 +203,21 @@ try {
     "Bob's confirmation",
   );
   ok("Alice compared Bob's fingerprint and confirmed him");
+  // The owner's role menu on Bob's row stays inside its column, at every width.
+  for (const w of [860, 1024, 1280, 1600]) {
+    await alice.resize(w, 800);
+    const spill = await alice.wait(
+      () =>
+        alice.exec(`const sel = document.querySelector('select[aria-label^="Role of"]');
+          if (!sel) return null;
+          const cell = sel.closest('[role="cell"]').getBoundingClientRect(), r = sel.getBoundingClientRect();
+          return String(Math.round(Math.max(r.right - cell.right, cell.left - r.left, 0)));`),
+      "Bob's role menu",
+    );
+    assert.equal(spill, "0", `the role menu spills ${spill}px out of its column at ${w}px`);
+  }
+  await alice.screenshot(`${shots}/alice-members.png`);
+  await alice.resize(1280, 800);
 
   // Alice: a host in the shared vault.
   await alice.click('button[title="New host"]');
@@ -338,9 +354,10 @@ try {
   await turnOn(alice, "Members can create vaults");
   await openTeams(bob);
   await openOrg(bob, "Acme Ops");
-  await bob.wait(() => bob.exec(`return document.querySelector('input[aria-label="New vault name"]') ? true : null`), "Bob's new-vault form");
-  await bob.type('input[aria-label="New vault name"]', "Bob's tools");
+  await bob.wait(() => bob.exec(`return [...document.querySelectorAll(".page-actions button")].some((b) => b.innerText === "New vault" && !b.disabled) || null`), "Bob's New vault");
   await bob.clickButton("New vault");
+  await bob.type('input[aria-label="Vault name"]', "Bob's tools");
+  await bob.clickButton("Create vault");
   await bob.wait(() => bob.hasText(".panel .lname", "Bob's tools"), "Bob's vault");
   assert.ok(((await rowText(bob, "Bob's tools")) ?? "").includes("Can manage"));
   ok("Alice let members create vaults; Bob made one he manages");
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index dea7233..05fca81 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -182,6 +182,10 @@ type View =
 /** Views that fill the workspace: with no session open, the tab bar makes room for them too. */
 const PAGES = new Set<View["kind"]>(["hosts", "importHosts", "importSnippets", "cloud", "groups", "groupPage", "keys", "snippets", "forwards", "vpns", "logs", "teams", "sync"]);
 
+/** Pages opened from another page (Import from Snippets, a group from Groups): closing one
+ * returns to that page, where a page opened from the sidebar replaces the one shown. */
+const SUBPAGES = new Set<View["kind"]>(["importHosts", "importSnippets", "cloud", "groupPage", "logs"]);
+
 /** Editors: opening one from another keeps the first one's way back. */
 const EDITORS = new Set<View["kind"]>(["host", "identity", "group", "key", "snippet", "forward", "vpn", "hostCa"]);
 
@@ -355,9 +359,10 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
     if (v.kind === "tab" || v.kind === "quick") setTrail([]);
     else {
       // An editor replaces an editor, a page a page: what was under the first stays the way back.
+      // A page's own pages (its import, a group) keep it as the way back.
       const editor = (k: View["kind"]) => EDITORS.has(k);
       const from = view.kind === "tab" || view.kind === "quick" ? null : editor(view.kind);
-      if (view.kind !== "quick" && from !== editor(v.kind)) setTrail((t) => [...t, view].slice(-8));
+      if (view.kind !== "quick" && (from !== editor(v.kind) || SUBPAGES.has(v.kind))) setTrail((t) => [...t, view].slice(-8));
     }
     setView(v);
   };
@@ -539,11 +544,6 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
     if (t) open({ kind: "tab", key: t.key });
     else connectHost(h);
   };
-  // Quick connect, filled in from the Hosts page's bar.
-  const quickConnect = (to?: ConnectPrefill) => {
-    if (to) setLinked({ n: (linked?.n ?? 0) + 1, connect: to });
-    open({ kind: "quick" });
-  };
 
   const busy = (id: string, on: boolean) =>
     setPending((p) => {
@@ -858,7 +858,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
         />
       )}
       {view.kind === "logs" && (
-        <SessionLogsPanel key={view.hostId ?? "all"} hostId={view.hostId} hosts={hostList} look={deviceLook} onClose={close} />
+        <SessionLogsPanel key={view.hostId ?? "all"} hostId={view.hostId} hosts={hostList} groups={groupList} vaults={vaults} look={deviceLook} onClose={close} />
       )}
       {view.kind === "teams" && (
         <TeamsPanel
@@ -932,7 +932,7 @@ function Workspace({ onLock, termSettings, onSettingsChanged: loadTermSettings,
           onOpenGroup={(id) => open({ kind: "groupPage", id })}
           onImport={() => open({ kind: "importHosts" })}
           onCloud={() => open({ kind: "cloud" })}
-          onQuickConnect={mobile ? undefined : quickConnect}
+          onQuickConnect={mobile ? undefined : () => open({ kind: "quick" })}
           onClose={close}
         />
       )}
diff --git a/apps/desktop/src/Lists.tsx b/apps/desktop/src/Lists.tsx
index 370f33f..6789be4 100644
--- a/apps/desktop/src/Lists.tsx
+++ b/apps/desktop/src/Lists.tsx
@@ -28,7 +28,6 @@ import {
   type VaultEntry,
   type VpnView,
 } from "./api";
-import type { ConnectPrefill } from "./ConnectForm";
 import { Icon, type IconName } from "./Icon";
 import { AddFrom, Cell, Chip, Filters, IconAction, NameCell, StatusSq, Table, TextAction, Toolbar, TRow } from "./ListParts";
 import { MoveButton } from "./Move";
@@ -233,39 +232,6 @@ function HostRows({ list, things, ...p }: HostRowsProps) {
   );
 }
 
-/** Quick connect, as a bar: what's typed fills in the quick connect form. */
-function QuickBar({ onQuickConnect }: { onQuickConnect: (to?: ConnectPrefill) => void }) {
-  const [text, setText] = useState("");
-  const m = text.trim().match(/^(?:([^@\s]+)@)?(\[[^\]\s]+\]|[^:@\s]+)(?::(\d{1,5}))?$/);
-  const port = m?.[3] ? Number(m[3]) : null;
-  const to: ConnectPrefill | null = m && (port === null || (port > 0 && port < 65536)) ? { user: m[1] ?? null, host: m[2].replace(/^\[|\]$/g, ""), port, label: null } : null;
-  return (
-    <form
-      className="quick-bar"
-      onSubmit={(e) => {
-        e.preventDefault();
-        onQuickConnect(to ?? undefined);
-      }}
-    >
-      <span className="section-title">Quick connect</span>
-      <input
-        className="mono grow"
-        placeholder="user@host:port"
-        aria-label="Quick connect to user@host:port"
-        value={text}
-        onChange={(e) => setText(e.target.value)}
-        spellCheck={false}
-        autoCapitalize="off"
-        autoComplete="off"
-      />
-      <button type="submit" className="secondary" disabled={text.trim() !== "" && !to}>
-        Connect…
-      </button>
-      <small className="hint quick-hint">Fills in quick connect, where you choose how to sign in. Nothing is saved.</small>
-    </form>
-  );
-}
-
 interface HostsProps {
   hosts: HostView[];
   groups: GroupView[];
@@ -283,8 +249,8 @@ interface HostsProps {
   /** Hosts from OpenSSH's configuration (desktop). */
   onImport: () => void;
   onCloud: () => void;
-  /** Quick connect (desktop, where this page is home once there are hosts), filled in or not. */
-  onQuickConnect?: (to?: ConnectPrefill) => void;
+  /** Quick connect (desktop, where this page is home once there are hosts). */
+  onQuickConnect?: () => void;
   /** After a change made here (several deleted, moved to a group). */
   onChanged: () => void;
   onClose: () => void;
@@ -327,6 +293,11 @@ export function HostsPage(p: HostsProps) {
               ]}
             />
           )}
+          {p.onQuickConnect && (
+            <button type="button" className="secondary" onClick={p.onQuickConnect}>
+              Quick connect
+            </button>
+          )}
           <button type="button" className="secondary" onClick={() => p.onEditGroup()}>
             New group
           </button>
@@ -336,7 +307,6 @@ export function HostsPage(p: HostsProps) {
         </>
       }
     >
-      {p.onQuickConnect && <QuickBar onQuickConnect={p.onQuickConnect} />}
       {p.hosts.length === 0 ? (
         <Empty text="No hosts yet." action="Add your first host" onAction={() => p.onEdit()} />
       ) : (
@@ -416,7 +386,7 @@ export function HostsPage(p: HostsProps) {
                 if (narrowed && members.length === 0) return null;
                 const parts = groupParts(g, p);
                 return (
-                  <section key={g.id} className="lsection">
+                  <section key={g.id} className="lsection in-group">
                     <div className="lghead">
                       <button type="button" className="lgname" onClick={() => p.onOpenGroup(g.id!)} title={`Open the group ${g.name}`}>
                         <Icon name="group" size={14} />
diff --git a/apps/desktop/src/SessionLogs.tsx b/apps/desktop/src/SessionLogs.tsx
index b6830e7..87197ec 100644
--- a/apps/desktop/src/SessionLogs.tsx
+++ b/apps/desktop/src/SessionLogs.tsx
@@ -1,10 +1,12 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { listen } from "@tauri-apps/api/event";
 import { Terminal } from "@xterm/xterm";
-import { errorText, openLink, sessionLogs, type HostView, type SessionLogView } from "./api";
+import { errorText, openLink, sessionLogs, type GroupView, type HostView, type SessionLogView, type VaultEntry } from "./api";
 import { DEFAULT_FONT, xtermTheme } from "./themes";
 import type { TerminalLook } from "./TerminalView";
 import { Page } from "./Page";
+import { Cell, Chip, NameCell, Table, TextAction, Toolbar, TRow } from "./ListParts";
+import { useSelection } from "./Selection";
 import { mobileOs } from "./mobile/useMobile";
 
 /** Pauses longer than this play as this long. */
@@ -192,17 +194,46 @@ interface Props {
   /** Only this host's logs. */
   hostId?: string;
   hosts: HostView[];
+  groups: GroupView[];
+  vaults: VaultEntry[];
   look: TerminalLook;
   onClose: () => void;
 }
 
-export function SessionLogsPanel({ hostId, hosts, look, onClose }: Props) {
+const STATE_CHIPS: Record<SessionLogView["state"], "connected" | "idle" | "failed"> = {
+  local: "connected",
+  uploading: "idle",
+  remote: "idle",
+  failed: "failed",
+};
+
+/** A filter as a menu: "all", or one of its options. Only when there's more than one to choose. */
+function FilterSelect({ label, all, value, onChange, options }: { label: string; all: string; value: string; onChange: (v: string) => void; options: [string, string][] }) {
+  if (options.length < 2 && !value) return null;
+  return (
+    <select className={`filter-select ${value ? "on" : ""}`} aria-label={label} value={value} onChange={(e) => onChange(e.target.value)}>
+      <option value="">{all}</option>
+      {options.map(([id, name]) => (
+        <option key={id} value={id}>
+          {name}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+export function SessionLogsPanel({ hostId, hosts, groups, vaults, look, onClose }: Props) {
   const [logs, setLogs] = useState<SessionLogView[] | null>(null);
   const [error, setError] = useState("");
   const [notice, setNotice] = useState("");
   const [playing, setPlaying] = useState<{ id: string; cast: Cast } | null>(null);
   const [loading, setLoading] = useState<string | null>(null);
   const [deleting, setDeleting] = useState<string | null>(null);
+  const [query, setQuery] = useState("");
+  const [vaultF, setVaultF] = useState("");
+  const [groupF, setGroupF] = useState("");
+  const [hostF, setHostF] = useState("");
+  const sel = useSelection();
   const host = hosts.find((h) => h.id === hostId);
 
   const load = useCallback(() => {
@@ -232,7 +263,23 @@ export function SessionLogsPanel({ hostId, hosts, look, onClose }: Props) {
       () => (setDeleting(null), playing?.id === id && setPlaying(null), load()),
       (e) => setError(errorText(e)),
     );
-  const failed = logs?.filter((l) => l.state === "failed") ?? [];
+  const all = logs ?? [];
+  const failed = all.filter((l) => l.state === "failed");
+  const groupOf = (l: SessionLogView) => hosts.find((h) => h.id === l.hostId)?.groupId ?? null;
+  // What the filters offer: the vaults, groups and hosts the recordings are from.
+  const seen = <T,>(ids: (T | null)[]) => new Set(ids.filter((x): x is T => x !== null));
+  const vaultIds = seen(all.map((l) => l.vaultId));
+  const groupIds = seen(all.map(groupOf));
+  const hostIds = seen(all.map((l) => l.hostId));
+  const q = query.trim().toLowerCase();
+  const shown = all.filter(
+    (l) =>
+      (!q || [l.title, l.address, l.device].some((t) => t.toLowerCase().includes(q))) &&
+      (!vaultF || l.vaultId === vaultF) &&
+      (!groupF || groupOf(l) === groupF) &&
+      (!hostF || l.hostId === hostF),
+  );
+  const narrowed = !!q || !!vaultF || !!groupF || !!hostF;
 
   return (
     <Page
@@ -240,62 +287,111 @@ export function SessionLogsPanel({ hostId, hosts, look, onClose }: Props) {
       lead="Recorded sessions are encrypted with their vault's key and synced like the rest of it. Turn recording on per host, in the host editor."
       onClose={onClose}
     >
-        {error && <p className="error">{error}</p>}
-        {notice && <p className="ok">{notice}</p>}
-        {failed.length > 0 && (
-          <div className="notice-box row align-center">
-            <p className="warn grow">
-              {failed.length === 1 ? "A recording wasn't" : `${failed.length} recordings weren't`} uploaded: {failed[0].problem}
-              {failed[0].upgradeUrl && ". They stay on this device until the team is on that plan, then go up with the next try."}
-            </p>
-            {failed[0].upgradeUrl && !mobileOs && (
-              <button type="button" className="secondary small-button" onClick={() => void openLink(failed[0].upgradeUrl!).catch((e) => setError(errorText(e)))}>
-                Upgrade
-              </button>
-            )}
-            <button type="button" className="secondary small-button" onClick={() => void sessionLogs.retry().then(load)}>
-              Try again
+      {error && <p className="error">{error}</p>}
+      {notice && <p className="ok">{notice}</p>}
+      {failed.length > 0 && (
+        <div className="notice-box row align-center">
+          <p className="warn grow">
+            {failed.length === 1 ? "A recording wasn't" : `${failed.length} recordings weren't`} uploaded: {failed[0].problem}
+            {failed[0].upgradeUrl && ". They stay on this device until the team is on that plan, then go up with the next try."}
+          </p>
+          {failed[0].upgradeUrl && !mobileOs && (
+            <button type="button" className="secondary small-button" onClick={() => void openLink(failed[0].upgradeUrl!).catch((e) => setError(errorText(e)))}>
+              Upgrade
             </button>
-          </div>
-        )}
-        {playing && <SessionPlayer cast={playing.cast} look={look} onClose={() => setPlaying(null)} onSave={() => void save(playing.id)} />}
-        {logs === null && !error && <p className="hint">Loading…</p>}
-        {logs?.length === 0 && <p className="hint">No recordings yet.</p>}
-        {logs && logs.length > 0 && (
-          <ul className="device-list">
-            {logs.map((l) => (
-              <li key={l.id} className={playing?.id === l.id ? "current" : ""}>
-                <div>
-                  <strong>{l.title}</strong>
-                  <span className={`kind-badge ${l.state === "failed" ? "danger" : ""}`} title={l.problem ?? undefined}>
-                    {STATE_NAMES[l.state]}
-                  </span>
-                  <small>
-                    {when(l.startedAt)} · {length(l)} · {size(l.outputBytes)} printed
-                  </small>
-                  <small className="mono">
-                    {l.address} · recorded on {l.device}
-                  </small>
-                </div>
-                <button type="button" className="primary small-button" disabled={loading !== null} onClick={() => play(l.id)}>
-                  {loading === l.id ? "Opening…" : "Play"}
-                </button>
-                <button type="button" className="secondary small-button" onClick={() => void save(l.id)}>
-                  Save .cast
-                </button>
-                {deleting === l.id ? (
-                  <button type="button" className="danger small-button" onClick={() => void remove(l.id)}>
-                    Really delete?
-                  </button>
-                ) : (
-                  <button type="button" className="ghost-danger small-button" onClick={() => setDeleting(l.id)}>
-                    Delete
-                  </button>
+          )}
+          <button type="button" className="secondary small-button" onClick={() => void sessionLogs.retry().then(load)}>
+            Try again
+          </button>
+        </div>
+      )}
+      {playing && <SessionPlayer cast={playing.cast} look={look} onClose={() => setPlaying(null)} onSave={() => void save(playing.id)} />}
+      {logs === null && !error && <p className="hint">Loading…</p>}
+      {logs?.length === 0 && <p className="hint">No recordings yet.</p>}
+      {all.length > 0 && (
+        <>
+          <Toolbar
+            query={query}
+            setQuery={setQuery}
+            placeholder="Search by host, address or device"
+            label="Search session logs"
+            sel={sel}
+            any={false}
+            filters={
+              <div className="filters" role="group" aria-label="Show">
+                <FilterSelect
+                  label="Vault"
+                  all="Every vault"
+                  value={vaultF}
+                  onChange={setVaultF}
+                  options={vaults.filter((v) => vaultIds.has(v.id)).map((v) => [v.id, v.label])}
+                />
+                <FilterSelect
+                  label="Group"
+                  all="Every group"
+                  value={groupF}
+                  onChange={setGroupF}
+                  options={groups.filter((g) => g.id && groupIds.has(g.id)).map((g) => [g.id!, g.name])}
+                />
+                {!hostId && (
+                  <FilterSelect
+                    label="Host"
+                    all="Every host"
+                    value={hostF}
+                    onChange={setHostF}
+                    options={hosts.filter((h) => hostIds.has(h.id)).map((h) => [h.id, h.label])}
+                  />
                 )}
-              </li>
-            ))}
-          </ul>
-        )}
+              </div>
+            }
+          />
+          {shown.length === 0 ? (
+            <p className="hint page-pad">No recordings match{q ? ` “${query}”` : narrowed ? " these filters" : ""}.</p>
+          ) : (
+            <Table
+              cols="minmax(170px, 1.5fr) minmax(130px, 1fr) 70px minmax(110px, 1fr) 130px 150px"
+              label="Session logs"
+              head={["Session", "Started", "Length", "Recorded on", "State"]}
+            >
+              {shown.map((l, i) => (
+                <TRow
+                  key={l.id}
+                  index={i}
+                  className={playing?.id === l.id ? "current" : undefined}
+                  actions={
+                    <>
+                      <TextAction onClick={() => play(l.id)}>{loading === l.id ? "Opening…" : "Play"}</TextAction>
+                      <TextAction onClick={() => void save(l.id)}>Save .cast</TextAction>
+                      {deleting === l.id ? (
+                        <button type="button" className="text-action danger" onClick={() => void remove(l.id)}>
+                          Really delete?
+                        </button>
+                      ) : (
+                        <button type="button" className="text-action danger" onClick={() => setDeleting(l.id)}>
+                          Delete
+                        </button>
+                      )}
+                    </>
+                  }
+                >
+                  <NameCell onOpen={() => play(l.id)} title={`Play ${l.title}`} name={l.title} sub={l.address} subTone="mono" />
+                  <Cell>{when(l.startedAt)}</Cell>
+                  <Cell className="num">{length(l)}</Cell>
+                  <Cell className="lstack">
+                    <span className="trunc">{l.device}</span>
+                    <span className="lsub">{size(l.outputBytes)} printed</span>
+                  </Cell>
+                  <Cell>
+                    <span title={l.problem ?? undefined}>
+                      <Chip state={STATE_CHIPS[l.state]}>{STATE_NAMES[l.state]}</Chip>
+                    </span>
+                  </Cell>
+                </TRow>
+              ))}
+            </Table>
+          )}
+        </>
+      )}
     </Page>
   );
 }
diff --git a/apps/desktop/src/TeamsPanel.tsx b/apps/desktop/src/TeamsPanel.tsx
index a7dc2d1..262d4dc 100644
--- a/apps/desktop/src/TeamsPanel.tsx
+++ b/apps/desktop/src/TeamsPanel.tsx
@@ -269,6 +269,7 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
   // The member whose fingerprint is being compared (to confirm them, or certify them again).
   const [confirming, setConfirming] = useState<string | null>(null);
   const [inviting, setInviting] = useState(false);
+  const [newVault, setNewVault] = useState(false);
   // Plans enforced and no usable plan (usable as the server counts it: a trial, an active plan or
   // its grace period): nothing in the team changes until it has one. Removing people,
   // transferring and deleting the team stay possible.
@@ -323,6 +324,10 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
     );
   }
 
+  // The owner, on desktop, chooses or manages the team's plan in the account portal (servers with plans).
+  const portal = owner && !!details?.plansOffered && details.portal && !mobileOs;
+  const billing = () => void sync.openPortal(`/account/team/${org.id}/billing`).catch((e) => setError(errorText(e)));
+
   const published = (account: string) => memberKeys.filter((k) => k.accountId === account && k.verified).length;
   const keysRequired = details?.policies.requireMemberKeys === true;
   const keysDue = confirmed && keysRequired && hasDirectory && !!me && published(me) === 0 && personalKeys.length > 0;
@@ -355,11 +360,9 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
           <>
             {details?.plansOffered && (
               <PlanLine
-                org={org}
                 plan={details.plan}
                 enforced={details.plansEnforced}
                 seatsUsed={members?.filter((m) => m.status === "confirmed").length ?? null}
-                portal={owner && details.portal && !mobileOs}
               />
             )}
             {confirmed && details?.ssoOffered && <SsoLine org={org} onSignIn={onSso} />}
@@ -367,10 +370,24 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
         )
       }
       actions={
-        admin && (
-          <button type="button" className="primary" disabled={locked} onClick={() => setInviting(true)}>
-            Invite people
-          </button>
+        (portal || (confirmed && canCreateVaults) || admin) && (
+          <>
+            {confirmed && canCreateVaults && (
+              <button type="button" className="secondary" disabled={locked || newVault} onClick={() => (setTab("vaults"), setNewVault(true))}>
+                New vault
+              </button>
+            )}
+            {portal && (
+              <button type="button" className="secondary" onClick={billing}>
+                {details?.plan ? "Manage plan ↗" : "Choose a plan ↗"}
+              </button>
+            )}
+            {admin && (
+              <button type="button" className="primary" disabled={locked} onClick={() => setInviting(true)}>
+                Invite people
+              </button>
+            )}
+          </>
         )
       }
     >
@@ -435,7 +452,16 @@ function OrgView({ org, vaults, personalKeys, fingerprint, me, onBack, onClose,
         </>
       )}
       {confirmed && tab === "vaults" && (
-        <VaultsTab vaults={vaults} members={members ?? []} orgId={org.id} canCreate={canCreateVaults} locked={locked} onChanged={changed} />
+        <VaultsTab
+          vaults={vaults}
+          members={members ?? []}
+          orgId={org.id}
+          canCreate={canCreateVaults}
+          creating={newVault && !locked}
+          onCreating={setNewVault}
+          locked={locked}
+          onChanged={changed}
+        />
       )}
       {confirmed && tab === "keys" && (
         <fieldset className="plain" disabled={locked}>
@@ -629,6 +655,8 @@ function VaultsTab({
   members,
   orgId,
   canCreate,
+  creating,
+  onCreating,
   locked,
   onChanged,
 }: {
@@ -636,6 +664,9 @@ function VaultsTab({
   members: MemberView[];
   orgId: string;
   canCreate: boolean;
+  /** New vault (the page's action) opened its bar. */
+  creating: boolean;
+  onCreating: (on: boolean) => void;
   locked: boolean;
   onChanged: () => void;
 }) {
@@ -655,13 +686,9 @@ function VaultsTab({
   const rows = [...shared, ...vaults.filter((v) => v.directory)];
   return (
     <>
-      {canCreate && (
-        <fieldset className="plain" disabled={locked}>
-          <NewVault orgId={orgId} onCreated={onChanged} />
-        </fieldset>
-      )}
-      {shared.length === 0 && (
-        <p className="hint">{canCreate ? "No vaults yet. Create one, then give members access." : "You can't open any of its vaults yet."}</p>
+      {creating && <NewVault orgId={orgId} onCreated={() => (onCreating(false), onChanged())} onCancel={() => onCreating(false)} />}
+      {shared.length === 0 && !creating && (
+        <p className="hint">{canCreate ? "No vaults yet. Create one (New vault), then give members access." : "You can't open any of its vaults yet."}</p>
       )}
       {rows.length > 0 && (
         <Table cols="minmax(170px, 1.4fr) 60px 100px 110px 140px" label="Vaults" head={["Vault", "Items", "You can", "Key"]}>
@@ -755,7 +782,7 @@ function MembersTab({ org, members, invites, published, keysRequired, admin, own
 
   return (
     <>
-      <Table cols="minmax(170px, 1.8fr) 90px 110px 90px 130px" label="Members" head={["Member", "Role", "Keys", "SSH keys"]}>
+      <Table cols="minmax(160px, 1.8fr) 104px 110px 90px 130px" label="Members" head={["Member", "Role", "Keys", "SSH keys"]}>
         {members.map((m, i) => {
           const canRemove = !m.me && m.role !== "owner" && admin && (m.role === "member" || owner);
           const n = published(m.accountId);
@@ -798,7 +825,7 @@ function MembersTab({ org, members, invites, published, keysRequired, admin, own
                 <Cell>
                   {owner && !m.me && m.status === "confirmed" && m.role !== "owner" ? (
                     <select
-                      className="compact"
+                      className="cell-select"
                       value={m.role}
                       disabled={busy || locked}
                       aria-label={`Role of ${m.email}`}
@@ -1604,7 +1631,8 @@ function AccessEditor({ vault, members, locked, onChanged }: { vault: VaultEntry
   );
 }
 
-function NewVault({ orgId, onCreated }: { orgId: string; onCreated: () => void }) {
+/** New vault, as a bar (like New team): its name, Create vault or Cancel. */
+function NewVault({ orgId, onCreated, onCancel }: { orgId: string; onCreated: () => void; onCancel: () => void }) {
   const [name, setName] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState("");
@@ -1619,14 +1647,17 @@ function NewVault({ orgId, onCreated }: { orgId: string; onCreated: () => void }
     );
   };
   return (
-    <form className="stack" onSubmit={submit}>
-      <div className="row">
-        <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Staging" aria-label="New vault name" />
-        <button type="submit" className="secondary" disabled={!name.trim() || busy}>
-          New vault
-        </button>
-      </div>
-      {error && <p className="error">{error}</p>}
+    <form className="quick-bar" onSubmit={submit}>
+      <span className="section-title">New vault</span>
+      <input className="grow" value={name} onChange={(e) => setName(e.target.value)} placeholder="Staging" aria-label="Vault name" autoFocus />
+      <button type="button" className="quiet" onClick={onCancel}>
+        Cancel
+      </button>
+      <button type="submit" className="secondary" disabled={!name.trim() || busy}>
+        Create vault
+      </button>
+      <small className="hint quick-hint">Then give members access to it (Access, on its row).</small>
+      {error && <p className="error quick-hint">{error}</p>}
     </form>
   );
 }
@@ -1634,37 +1665,9 @@ function NewVault({ orgId, onCreated }: { orgId: string; onCreated: () => void }
 const day = (iso: string | null) => (iso ? dateText(iso) : "");
 
 /** The organization's plan (hosted servers), and what it means for its vaults. */
-function PlanLine({
-  org,
-  plan,
-  enforced,
-  seatsUsed,
-  portal,
-}: {
-  org: OrgInfo;
-  plan: OrgPlan | null;
-  enforced: boolean;
-  seatsUsed: number | null;
-  /** The owner can open the team's billing page. */
-  portal: boolean;
-}) {
-  const [error, setError] = useState("");
-  // The team's Billing tab in the account portal, signed in.
-  const billing = () => sync.openPortal(`/account/team/${org.id}/billing`).catch((e) => setError(errorText(e)));
+function PlanLine({ plan, enforced, seatsUsed }: { plan: OrgPlan | null; enforced: boolean; seatsUsed: number | null }) {
   if (!plan) {
-    return (
-      <div className="row access-row plan-line">
-        <p className={`grow ${enforced ? "warn" : "hint"}`}>
-          {enforced ? "No plan: shared vaults can be read but not changed until the team has a plan." : "No plan"}
-        </p>
-        {portal && (
-          <button type="button" className="secondary small-button" onClick={billing}>
-            Choose a plan ↗
-          </button>
-        )}
-        {error && <p className="error">{error}</p>}
-      </div>
-    );
+    return <p className={`plan-line ${enforced ? "warn" : "hint"}`}>{enforced ? "No plan: shared vaults can be read but not changed until the team has a plan." : "No plan"}</p>;
   }
   const name = plan.plan.charAt(0).toUpperCase() + plan.plan.slice(1);
   const seats = plan.seats != null ? ` · ${seatsUsed ?? "?"} of ${plan.seats} seats used` : "";
@@ -1684,17 +1687,7 @@ function PlanLine({
         return [`${name} plan${plan.expiresAt ? `, renews ${day(plan.expiresAt)}` : ""}${seats}`, "hint"];
     }
   })();
-  return (
-    <div className="row access-row plan-line">
-      <p className={`grow ${tone}`}>{text}</p>
-      {portal && (
-        <button type="button" className="secondary small-button" onClick={billing}>
-          Manage plan ↗
-        </button>
-      )}
-      {error && <p className="error">{error}</p>}
-    </div>
-  );
+  return <p className={`plan-line ${tone}`}>{text}</p>;
 }
 
 /** The organization's identity provider, and whether this device is signed in there. */
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index 935c47d..dd492e8 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -3762,6 +3762,33 @@ button.filter.on {
   color: var(--ink);
 }
 
+/* A filter with more choices than buttons fit (a vault, a group, a host). */
+select.filter-select {
+  width: auto;
+  max-width: 220px;
+  height: 28px;
+  padding-block: 0;
+  font-size: 12px;
+}
+
+select.filter-select.on {
+  border-color: var(--gate-ink);
+  background-color: var(--gate-soft);
+}
+
+.lrow.current {
+  background: var(--gate-soft);
+}
+
+/* A choice inside a table cell (a member's role): as wide as its column, no wider. */
+select.cell-select {
+  width: 100%;
+  min-width: 0;
+  height: 30px;
+  padding-block: 0;
+  font-size: 13px;
+}
+
 .add-from {
   position: relative;
 }
@@ -4081,6 +4108,24 @@ button.text-action.warn {
   border-top: 1px solid var(--line);
 }
 
+/* A group's hosts sit in from its header, a rule down from its icon, as in the sidebar. */
+.lsection.in-group .lrow {
+  position: relative;
+}
+
+.lsection.in-group .lrow > .lfirst {
+  padding-left: 22px;
+}
+
+.lsection.in-group .lrow::before {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  left: 18px;
+  border-left: 1px solid var(--line-strong);
+  content: "";
+}
+
 .lghead {
   display: flex;
   flex-wrap: wrap;
@@ -4281,6 +4326,10 @@ button.use-card:hover {
     font-size: 12px;
   }
 
+  .lsection.in-group .lrow > .lcell:not(.lfirst) {
+    padding-left: 42px;
+  }
+
   .lrow > .lcell:empty {
     display: none;
   }
diff --git a/docs/features/hosts-groups-identities.md b/docs/features/hosts-groups-identities.md
index 183c876..ebfa976 100644
--- a/docs/features/hosts-groups-identities.md
+++ b/docs/features/hosts-groups-identities.md
@@ -120,7 +120,7 @@ On desktop, once the vault has hosts, the Hosts page is home: the workspace open
 
 | Page | Content |
 | --- | --- |
-| Hosts | **Add from…** (desktop: **Import…**, **Clouds…**), **New group**, **New host**. On desktop a **Quick connect** bar: what's typed (`user@host:port`) fills in quick connect, where the sign-in is chosen. Columns: Host (status square, name, `user@host:port`, the shared vault, "gone from AWS" or the machine's state), Route (direct, via a jump host, through a cloud or a proxy command, and the VPN, mint while up), Signs in with (identity, key, agent or password; "keeps its session", "recorded") and Tags (two, then "+N"). "Not in a group", then a section per group whose header names it (it opens the group's page), counts its hosts and shows what it gives them, with **Edit group**. Row actions: **Connect** (**New tab** for a host with a session, whose name goes to that session), **Browse files (SFTP)**, **Edit** |
+| Hosts | **Add from…** (desktop: **Import…**, **Clouds…**), **Quick connect** (desktop: opens quick connect, where the sign-in is chosen), **New group**, **New host**. Columns: Host (status square, name, `user@host:port`, the shared vault, "gone from AWS" or the machine's state), Route (direct, via a jump host, through a cloud or a proxy command, and the VPN, mint while up), Signs in with (identity, key, agent or password; "keeps its session", "recorded") and Tags (two, then "+N"). "Not in a group", then a section per group whose header names it (it opens the group's page), counts its hosts and shows what it gives them, with **Edit group**; a group's hosts sit indented under it, a rule down from its icon as in the sidebar. Row actions: **Connect** (**New tab** for a host with a session, whose name goes to that session), **Browse files (SFTP)**, **Edit** |
 | Groups | Group, Hosts, What its hosts get, Connected; the name opens the group's page, **Edit** on the row |
 | A group | "What its hosts use" as cards (identities, keys, jump hosts, VPNs; each opens), then its hosts as on the Hosts page, the tunnels through them, their files (**Save**); **Move to…**, **Edit group** |
 | Keys | Tabs **Keys**, **Identities**, **Host CAs** with their counts; the page's primary button follows the tab (**New key**, **New identity**, **New host CA**). Keys: fingerprint, Used by, Certificate ("None", "Valid 30 d", "Expires in 3 d" under a week, "Expired", "No expiry", "Can't be read") |
diff --git a/docs/features/session-logs.md b/docs/features/session-logs.md
index 9bb746a..3d28858 100644
--- a/docs/features/session-logs.md
+++ b/docs/features/session-logs.md
@@ -77,7 +77,7 @@ The server can't read or delete items, so the log stays listed everywhere. Devic
 
 ## Viewing and replay
 
-The Session logs page (`SessionLogsPanel`) lists recordings from every vault, newest first, or one host's ("Session logs · *host*").
+The Session logs page (`SessionLogsPanel`) lists recordings from every vault, newest first, or one host's ("Session logs · *host*"), as a table: Session (its title and address; the name plays it), Started, Length, Recorded on (the device, "*size* printed") and State. Above it, a search (title, address, device) and menus that narrow it to one **Vault**, **Group** or **Host**, each shown when the recordings come from more than one.
 
 | Way in | Where |
 | --- | --- |
@@ -88,8 +88,8 @@ The Session logs page (`SessionLogsPanel`) lists recordings from every vault, ne
 
 | In a row | Shows or does |
 | --- | --- |
-| Title and state | **Synced** (`local`: every chunk here and uploaded), **Uploading** (a chunk pending), **On another device** (a chunk not here; fetched when played), **Not uploaded** (a chunk refused; the reason in the title) |
-| Details | Start time, length ("recording or cut short" without an end), "*size* printed", the address, "recorded on *device*" |
+| State | **Synced** (`local`: every chunk here and uploaded), **Uploading** (a chunk pending), **On another device** (a chunk not here; fetched when played), **Not uploaded** (a chunk refused; the reason in the title) |
+| Length | "recording or cut short" without an end |
 | **Play** ("Opening…") | Assembles the cast (`session_log_cast`) and opens the player |
 | **Save .cast** | `session_log_save`: Downloads (on iOS, Files › MorphGate) as `title-<first 10 characters of the id>.cast`; characters other than letters, digits, `-` and `.` become `-`, and `-2`, `-3`… avoid overwriting |
 | **Delete**, then **Really delete?** | Deletes the item; its chunks go here and, at the next sync, on the server |
diff --git a/docs/features/teams.md b/docs/features/teams.md
index 6fe4c13..770f392 100644
--- a/docs/features/teams.md
+++ b/docs/features/teams.md
@@ -69,7 +69,7 @@ Every verified key is pinned in `pinned_keys` with the email. A known account wh
 
 **Teams** (`TeamsPanel`) lists the teams this account is in as a table: Team, You are (its role, or "Joined" until an admin confirms it), Vaults you open, and Needs you, from what this device knows: "Turn on two-step verification", "Sign in with single sign-on", "This device waits for approval" (or "This device was denied"), "{n} devices to approve", "Publish your SSH keys", "Rotate a vault's key"; "An admin confirms you next" while waiting. **New team** is the page's primary action. Under the list: **Join with an invite** and **Your fingerprint**.
 
-A team's page (`OrgView`) has the plan and single sign-on lines under its name, **Invite people** for owners and admins (its primary action), and **Needs you** above its tabs: members to confirm (**Confirm {name}…**) or certify again (**Verify…**), devices waiting (**Approve**, **Deny**), vaults whose key should be rotated (**Rotate key**), two-step verification the team requires, and the SSH keys it asks members to publish (**Publish a key**). Tabs: **Members** (members, then the invites not accepted yet: Role, Keys ("Verified", "To confirm", "Not verified"), SSH keys; then **Devices waiting**), **Vaults** (Items, You can, Key; **Access**, **Rotate key**), **Your SSH keys**, and for owners and admins **Settings** and **Activity**. Members see **Vaults** first. Before an admin confirms you, the page only says so, with your fingerprint and **Leave**. Lists are the tables of the other pages (`ListParts.tsx`).
+A team's page (`OrgView`) has the plan and single sign-on lines under its name; its actions are **New vault** (for those who may create vaults), **Choose a plan ↗** / **Manage plan ↗** (the owner, on desktop, on a server with plans) and **Invite people** for owners and admins (its primary action); then **Needs you** above its tabs: members to confirm (**Confirm {name}…**) or certify again (**Verify…**), devices waiting (**Approve**, **Deny**), vaults whose key should be rotated (**Rotate key**), two-step verification the team requires, and the SSH keys it asks members to publish (**Publish a key**). Tabs: **Members** (members, then the invites not accepted yet: Role, Keys ("Verified", "To confirm", "Not verified"), SSH keys; then **Devices waiting**), **Vaults** (Items, You can, Key; **Access**, **Rotate key**), **Your SSH keys**, and for owners and admins **Settings** and **Activity**. Members see **Vaults** first. Before an admin confirms you, the page only says so, with your fingerprint and **Leave**. Lists are the tables of the other pages (`ListParts.tsx`).
 
 ## Creating a team
 
@@ -125,7 +125,7 @@ A member certificate counts only while its signer is an owner or admin. When the
 
 ## Shared vaults and access
 
-**New vault** (placeholder "Staging") is shown to owners and admins, and to members when `members_can_create_vaults` is on. `create_vault()` seals a new vault key to every confirmed owner and admin (each must verify: "can't verify the keys of {email}") and to the creator, and puts the name in an encrypted `meta` item signed by the creator, so the server never sees it.
+**New vault**, a page action shown to owners and admins and to members when `members_can_create_vaults` is on, opens the Vaults tab with a bar: **Vault name** (placeholder "Staging"), **Cancel**, **Create vault**. `create_vault()` seals a new vault key to every confirmed owner and admin (each must verify: "can't verify the keys of {email}") and to the creator, and puts the name in an encrypted `meta` item signed by the creator, so the server never sees it.
 
 | Access | Label | Can |
 | --- | --- | --- |
@@ -177,7 +177,7 @@ The server enforces every policy but `require_member_keys`. It may check more th
 
 ## Plans
 
-On a server with plans (such as morphgate.com), `org_details` carries the team's plan. The team page shows what the server reports: "{Plan} trial until {date}", "{Plan} plan, renews {date}", "The {Plan} plan ended {date}. Shared vaults keep syncing until {date}." (status `grace`), or "No plan", with seats used. Where the server enforces plans (`billing.plans_enforced`) and the team has no usable plan (`trialing`, `active` or `grace`), the team is locked: invites, policies, new vaults, publishing keys, device decisions, confirming and role changes are disabled, and its vaults count as view-only everywhere in the app (`orgs_locked`, `vaultEntries()`). Removing people, leaving, transferring and deleting stay possible. Phones and iPads (`mobileOs`) show no plan buttons: the app stores don't allow pointing at purchases outside them.
+On a server with plans (such as morphgate.com), `org_details` carries the team's plan. The team page shows what the server reports: "{Plan} trial until {date}", "{Plan} plan, renews {date}", "The {Plan} plan ended {date}. Shared vaults keep syncing until {date}." (status `grace`), or "No plan", with seats used; the owner's **Choose a plan ↗** (no plan) or **Manage plan ↗** beside **Invite people** opens the team's billing page in the account portal (`/account/team/{org}/billing`). Where the server enforces plans (`billing.plans_enforced`) and the team has no usable plan (`trialing`, `active` or `grace`), the team is locked: invites, policies, new vaults, publishing keys, device decisions, confirming and role changes are disabled, and its vaults count as view-only everywhere in the app (`orgs_locked`, `vaultEntries()`). Removing people, leaving, transferring and deleting stay possible. Phones and iPads (`mobileOs`) show no plan buttons: the app stores don't allow pointing at purchases outside them.
 
 ## Device approval, single sign-on and activity