keyroost 0.12.0

//! keyroost — desktop GUI for programming Token2 Molto2 / Molto2v2 tokens.
//!
//! Dark-themed by default, modeled loosely on Token2's PyQt5 layout: device
//! status across the top, slot list on the left, edit form on the right.

#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]

use std::time::{SystemTime, UNIX_EPOCH};

mod otp_pane;
#[cfg(feature = "qr")]
mod qrscan;
#[cfg(feature = "qr")]
mod screengrab;
mod settings;
mod ui;
use otp_pane::OtpState;
use settings::Settings;
use ui::device::{self, CapState, CapTab, Caps, Device, DeviceId, DeviceKind, DeviceView};
use ui::theme::{self, BtnKind, Mode, Palette};

use eframe::egui;
use keyroost_import::parse_otpauth;
use keyroost_proto::commands::{
    DisplayTimeout, HmacAlgo, OtpDigits, ProfileConfig, ProfilePublicData, TimeStep,
    DEFAULT_CUSTOMER_KEY,
};
use keyroost_transport::Token2ProgSession;
use keyroost_transport::{DeviceInfo, SeedDeleteOutcome, Session, TransportError};

use keyroost_ctap::client_pin::PinUvAuthToken;
use keyroost_ctap::cred_mgmt::{Credential, CredsMetadata, RelyingParty};
use keyroost_ctap::{AuthenticatorInfo, CtapHidDevice, InitResponse};

/// The version chip next to the wordmark in the top bar — the one place the
/// running app shows which version it is (#98). Compile-time, straight from
/// the workspace version, so it can never drift from the release.
const VERSION_LABEL: &str = concat!("v", env!("CARGO_PKG_VERSION"));

/// How the selected FIDO key is reached: over USB-HID (a `hidraw` path) or over
/// a PC/SC reader (NFC or contact, by reader name).
#[derive(Debug, Clone)]
enum FidoTarget {
    Hid(std::path::PathBuf),
    Pcsc(String),
}

/// The successful result of [`open_fido`]: the boxed CTAP transport, whether it
/// speaks CTAP2 (CBOR), and the HID `InitResponse` (HID only; `None` over PC/SC).
/// Aliased so the `open_fido` signature isn't `clippy::type_complexity`-complex.
type OpenFido = (
    Box<dyn keyroost_ctap::transport::CtapTransport>,
    bool,
    Option<InitResponse>,
);

/// Open a CTAP transport for `target`, returning the boxed transport, whether
/// it speaks CTAP2 (CBOR), and the HID `InitResponse` when available (HID only;
/// `None` over PC/SC, which has no INIT phase). The InitResponse carries the
/// firmware version shown on the hero for USB keys.
fn open_fido(target: &FidoTarget) -> Result<OpenFido, String> {
    match target {
        FidoTarget::Hid(path) => {
            let (dev, init) = CtapHidDevice::open(path).map_err(|e| e.to_string())?;
            let cbor = init.supports_cbor();
            Ok((Box::new(dev), cbor, Some(init)))
        }
        FidoTarget::Pcsc(reader) => {
            let dev =
                keyroost_transport::CtapPcscDevice::open(reader).map_err(|e| e.to_string())?;
            // After a successful FIDO applet SELECT we attempt CTAP2 regardless of
            // the exact version string (keys answer U2F_V2, FIDO_2_0, FIDO_2_1,
            // sometimes with trailing bytes). A genuinely U2F-only card will make
            // get_info return a clean CTAP error, which the caller surfaces —
            // rather than silently reporting "no CBOR" and leaving the UI idle.
            Ok((Box::new(dev), true, None))
        }
    }
}
use keyroost_hid::HidDevice;

const PROFILES: u8 = 100;

/// Error from an unlocked-session FIDO operation, carrying both a
/// human-readable message and whether it was a PIN / PIN-auth failure that
/// invalidated the session. Worker closures produce this so their completion
/// closures can decide (via [`App::fail_session_op`]) whether to auto-lock.
struct SessionOpError {
    message: String,
    relock: bool,
}

impl SessionOpError {
    /// A non-PIN failure (HID open, U2F-only device, etc.): never re-locks.
    fn msg(message: impl Into<String>) -> Self {
        Self {
            message: message.into(),
            relock: false,
        }
    }

    /// Classify a CTAP error: PIN / PIN-auth codes (`0x31` / `0x33` / `0x34`)
    /// mark the session as invalidated so the caller re-locks.
    fn from_ctap(err: keyroost_ctap::CtapError) -> Self {
        Self {
            relock: err.is_pin_auth_error(),
            message: err.to_string(),
        }
    }

    /// Classify a boxed error from an op path that returns `Box<dyn Error>`
    /// (e.g. passkey delete/refresh). Downcasts to [`CtapError`](keyroost_ctap::CtapError) to recover the
    /// status byte; non-CTAP errors never re-lock.
    fn from_boxed(err: Box<dyn std::error::Error>) -> Self {
        match err.downcast::<keyroost_ctap::CtapError>() {
            Ok(ctap) => Self::from_ctap(*ctap),
            Err(other) => Self::msg(other.to_string()),
        }
    }
}

impl std::fmt::Display for SessionOpError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&self.message)
    }
}

#[derive(Default)]
struct SecurityKeysState {
    /// CTAP info for the selected device, fetched lazily after selection.
    info: Option<AuthenticatorInfo>,
    init: Option<InitResponse>,
    /// User-facing error from the last enumeration / open / GetInfo call.
    error: Option<String>,
    /// Live PIN entry field (cleared after submit).
    pin_input: String,
    /// Active unlocked session: token + cached resident credentials.
    session: Option<UnlockedSession>,
    /// The device `session` was unlocked on. Follow-on operations (reload,
    /// delete, bio, large-blob writes) must obtain the session through
    /// `App::fido_session()`, which refuses it when this no longer matches
    /// the selection (KEY-012): the session retains the PIN, and a PIN
    /// cached for one key must never authorize work on another.
    session_device: Option<DeviceId>,
    /// Change-PIN modal state.
    change_pin: ChangePinDialog,
    /// Reset-confirmation modal state.
    reset: ResetDialog,
    /// Enrolled fingerprints, cached after a list. `None` until first read.
    fingerprints: Option<Vec<keyroost_ctap::Enrollment>>,
    /// Friendly-name buffer for the "enroll new fingerprint" field.
    fp_new_name: String,
    /// Shared live enroll progress, written by the worker after each captured
    /// sample and polled by the UI each frame to drive the wizard view.
    fp_progress: Option<std::sync::Arc<std::sync::Mutex<EnrollProgress>>>,
    /// Pending delete confirmation: the template id awaiting "Are you sure?".
    fp_confirm_delete: Option<Vec<u8>>,
    /// Inline rename editor: (template_id, new-name buffer).
    fp_rename: Option<(Vec<u8>, String)>,
    /// Pending advanced-config action awaiting typed confirmation + PIN.
    advanced: Option<AdvancedDialog>,
    /// Which sub-view of the FIDO2 tab is active (passkeys / fingerprints /
    /// settings), so the sections no longer stack in one long panel.
    subview: FidoSubview,
    /// Cached large-blob array, read on demand. `None` until first load.
    large_blobs: Option<keyroost_ctap::large_blobs::LargeBlobArray>,
    /// Capacity snapshot computed at load/reload time (needs the device's
    /// getInfo, which only the worker thread holds).
    lb_capacity: Option<keyroost_ctap::large_blobs::BlobCapacity>,
    /// Index of the entry currently expanded in the hex/ASCII viewer.
    lb_selected: Option<usize>,
    /// Pending "delete entry N" confirmation in the structured editor.
    lb_confirm_delete: Option<usize>,
    /// Pending "clear all storage" confirmation. Set by the first click on the
    /// destructive clear control; the confirmed click wipes every entry.
    lb_confirm_clear: bool,
    /// Status / result line for the last large-blob load or write.
    lb_status: Option<String>,
    /// Text buffer for the "add a note" field.
    lb_new_text: String,
    /// Whether the add-note composer is expanded (toggled by the Add button).
    lb_show_add: bool,
    /// Index of the note currently being edited inline, with its edit buffer.
    lb_editing: Option<usize>,
    lb_edit_text: String,
    /// Set once we've auto-loaded (or tried to) on first showing the Storage
    /// tab, so a failed read doesn't retry every frame. Reset when the selected
    /// device changes so a different key loads fresh.
    lb_autoloaded: bool,
    /// SSH certificates extracted by "Save certificate…", parked between the
    /// background decrypt job and the save dialog resolving, keyed by the
    /// request id its `FileTarget::SshCertSave` carries. A map rather than a
    /// single slot because nothing stops two save dialogs being open at once
    /// (the busy guard is released before the extract job's apply closure
    /// runs, and the dialogs are non-modal): with one shared slot the first
    /// dialog answered wrote whichever certificate happened to be parked.
    /// Empty when no save is in flight.
    ssh_cert_pending: std::collections::HashMap<u64, PendingSshCert>,
    /// Result line for the last "Save certificate…" action (extraction error,
    /// or the saved path plus the parsed cert summary). Shown in the Passkeys
    /// panel.
    ssh_cert_status: Option<String>,
}

#[derive(Default, Clone, Copy, Debug, PartialEq)]
enum FidoSubview {
    #[default]
    Passkeys,
    Fingerprints,
    Settings,
    LargeBlobs,
}

/// A pending `authenticatorConfig` action in the Advanced view. The action is
/// only dispatched once the user supplies the PIN (these commands need a token
/// with the AuthenticatorConfiguration permission) and, for irreversible ones,
/// confirms explicitly.
#[derive(Default)]
struct AdvancedDialog {
    action: AdvancedAction,
    /// PIN entry for this action (config needs its own permissioned token).
    pin_input: String,
    /// New minimum PIN length buffer (only for SetMinPin).
    min_pin_input: String,
    /// Whether to also force a PIN change (SetMinPin option).
    force_change: bool,
    /// The device the dialog was opened for. Apply is rejected — and the
    /// dialog dropped, wiping the PIN — when the selection has moved since
    /// (KEY-007): a PIN typed for one key must never be sent to another.
    device: Option<DeviceId>,
}

impl Drop for AdvancedDialog {
    /// Scrub the typed PIN when the dialog is torn down (e.g. on success, the
    /// dialog is replaced with `None`), matching the wipe-on-drop discipline of
    /// the other secret-bearing dialogs (ChangePinDialog, PivState).
    fn drop(&mut self) {
        wipe(&mut self.pin_input);
    }
}

#[derive(Default, Clone, Copy, PartialEq)]
enum AdvancedAction {
    #[default]
    None,
    ToggleAlwaysUv,
    SetMinPin,
    ForcePinChange,
    EnterpriseAttestation,
}

/// Live state of an in-progress fingerprint enrollment, shared between the
/// capture worker and the UI so the wizard can show per-sample progress.
#[derive(Clone)]
struct EnrollProgress {
    /// Total samples the sensor wants (from getFingerprintSensorInfo / begin).
    total: u64,
    /// Samples captured successfully so far.
    captured: u64,
    /// Human-readable status of the most recent sample (quality hint).
    last_message: String,
    /// Set when the flow finishes (Ok) or fails (Err message).
    done: Option<Result<(), String>>,
    /// Set by the UI's Cancel button; the worker checks it between samples,
    /// asks the device to cancel the current enrollment, and stops.
    cancel: std::sync::Arc<std::sync::atomic::AtomicBool>,
}

impl Default for EnrollProgress {
    fn default() -> Self {
        EnrollProgress {
            total: 0,
            captured: 0,
            last_message: "Touch the sensor to begin\u{2026}".into(),
            done: None,
            cancel: std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
        }
    }
}

/// State for the "reset key" confirmation. Reset wipes all credentials and the
/// PIN, so the user must type a confirmation word and then touch the key.
#[derive(Default)]
struct ResetDialog {
    open: bool,
    /// Typed confirmation (`reset` required to enable the button).
    confirm_input: String,
}

/// "Armed" reset: a FIDO authenticator only accepts a reset within ~10 s of
/// being powered on, which the plug-then-navigate-then-confirm flow can never
/// hit. So we confirm intent first, then watch for the user to unplug and
/// replug the key and fire the reset the instant it reconnects. Polled in
/// `update()` against the live FIDO HID list (no PC/SC, so it can't disturb
/// other cards).
struct ResetArm {
    /// The armed key's USB/HID serial, if it exposes one (SoloKeys / Nitrokey
    /// do; most YubiKeys don't). When present we track the key by serial, so it
    /// is recognised on re-insertion into *any* USB port, not just the same one.
    target_serial: Option<String>,
    /// The armed key's HID path at arm time. Used as the identity when there is
    /// no serial (`target_serial` is `None`): its disappearance is the "unplug"
    /// half of the dance, and a fresh path is treated as the re-insert.
    target_path: Option<std::path::PathBuf>,
    /// The armed key's *effective* serial from the resolver (USB serial, else
    /// the CCID-read YubiKey serial shown in the sidebar). In path mode this
    /// is the identity a re-inserted candidate must prove before the reset
    /// fires; without it (and without a HID serial) arming is refused —
    /// fail closed rather than reset the first same-model key (KEY-005).
    target_effective_serial: Option<String>,
    /// The armed key's USB vendor/product ids, captured at arm time. In path
    /// mode a fresh path must match these — so plugging in a *different*
    /// model while a reset is armed doesn't get it reset by mistake.
    target_ids: Option<(u16, u16)>,
    /// The selection the arm was set under. An armed ceremony belongs to one
    /// key, so every surface that speaks for it — the dialog's "now unplug the
    /// key" prompt above all — has to check that this is still the key on
    /// screen before saying anything.
    for_device: Option<DeviceId>,
    /// FIDO HID devices present at the previous poll, to diff against (path
    /// mode) — see [`HidIdentity`] for why this isn't a plain `Vec<PathBuf>`.
    prev_devices: Vec<HidIdentity>,
    /// True once the armed key has been unplugged; the next fresh insertion then
    /// fires the reset.
    saw_removal: bool,
}

/// One HID device's physical-connection identity at a poll, used to tell a
/// genuine reinsertion apart from a device that was there all along.
///
/// `/dev/hidrawN` paths are not proof of "the same still-connected device":
/// the kernel reuses a freed hidraw minor number, so an unplug immediately
/// followed by a replug can hand the reinserted key the very same path the
/// old one had (`hidraw0` -> disconnect -> `hidraw0` again), even though the
/// USB device number underneath it advanced (observed on hardware: `usb 1-3:
/// USB disconnect, device number 8` followed by `new full-speed USB device
/// number 9` — same `hidraw0`, different device). A path-only diff then reads
/// the reinserted key as "not fresh" — it's still in the previous snapshot by
/// that path — and the armed reset never fires; the touch prompt waits
/// forever for a replug the code already missed.
///
/// `usb_bus`/`usb_address` (sysfs `busnum`/`devnum`) are the kernel's own
/// per-attach counters, so they're what [`same_hid_connection`] compares
/// first. `hidapi` (macOS/Windows) doesn't expose USB topology, so identity
/// there falls back to the path — no better than before on those platforms,
/// but no worse either.
#[derive(Clone)]
struct HidIdentity {
    path: std::path::PathBuf,
    usb_bus: Option<u8>,
    usb_address: Option<u8>,
}

impl HidIdentity {
    fn of(d: &FidoHid) -> Self {
        HidIdentity {
            path: d.path.clone(),
            usb_bus: d.usb_bus,
            usb_address: d.usb_address,
        }
    }
}

/// Whether `a` and `b` are the same physical USB attach, for telling a
/// reinserted key apart from one that never left. Bus+address decide it when
/// both sides have them; otherwise this falls back to path equality, all the
/// hidapi backend can offer.
fn same_hid_connection(a: &HidIdentity, b: &HidIdentity) -> bool {
    match (a.usb_bus, a.usb_address, b.usb_bus, b.usb_address) {
        (Some(ab), Some(aa), Some(bb), Some(ba)) => ab == bb && aa == ba,
        _ => a.path == b.path,
    }
}

/// The device an open rename field is bound to, pinned when the field opens so
/// a background rescan can't retarget the save. See [`App::rename_target`].
#[derive(Clone)]
struct RenameTarget {
    /// Serial the new name will be written against (device serial, not the
    /// reader-name serial). A device with no serial can't be named.
    serial: String,
    /// The device's friendly name at open time, so the save removes the right
    /// old entry even if the live device's name has since changed.
    name_at_open: Option<String>,
}

struct UnlockedSession {
    token: PinUvAuthToken,
    metadata: CredsMetadata,
    /// Behind an `Arc`: the pane clones this every frame to escape the borrow
    /// of `self`, and credential lists (ids, user blobs) are not per-frame
    /// clone material.
    rps: std::sync::Arc<Vec<(RelyingParty, Vec<Credential>)>>,
    /// Enrolled fingerprints read at unlock (when the key supports bio), so the
    /// list shows immediately. `None` when bio is unsupported or the read failed.
    fingerprints: Option<Vec<keyroost_ctap::Enrollment>>,
    /// PIN retained for the unlocked session (wiped on lock). Bio writes
    /// (enroll/rename/delete) re-derive a fresh pinUvAuthToken per operation —
    /// the authenticator can invalidate a token after a UV-gated bio write, so
    /// reusing one across operations fails with PIN_AUTH_INVALID (0x33).
    pin: zeroize::Zeroizing<String>,
}

/// One FIDO HID device as the armed-reset poll sees it.
struct FidoHid {
    path: std::path::PathBuf,
    serial: Option<String>,
    ids: (u16, u16),
    /// USB bus/device-address of the underlying device (Linux sysfs backend
    /// only; `None` on the hidapi backend). Used by [`same_hid_connection`] to
    /// tell a reinserted key apart from a recycled `/dev/hidrawN` path.
    usb_bus: Option<u8>,
    usb_address: Option<u8>,
}

#[derive(Default)]
struct ChangePinDialog {
    /// Whether the inline PIN form is expanded.
    open: bool,
    old: String,
    new: String,
    /// Confirmation field for the new PIN — required for both setting a
    /// first-time PIN and changing an existing one (#79).
    confirm: String,
}

impl Drop for ChangePinDialog {
    /// Zeroize the typed PINs whenever the dialog is dropped — including the
    /// `= ChangePinDialog::default()` resets on cancel/success — so a typed
    /// (or mistyped) PIN doesn't linger in the buffer after the form closes.
    fn drop(&mut self) {
        wipe(&mut self.old);
        wipe(&mut self.new);
        wipe(&mut self.confirm);
    }
}

/// State for the OATH (TOTP) pane. The applet is driven over PC/SC, so a
/// "reader name" identifies the key rather than a hidraw path.
#[derive(Default)]
struct OathState {
    /// Credentials listed from the selected key, with their freshly-computed code.
    creds: Vec<OathRow>,
    /// Entries the card reported that could not be decoded (the listing is
    /// partial when non-zero) — surfaced so a reset isn't run against an
    /// inventory the user believes is complete.
    skipped: usize,
    /// True when the selected applet is password-protected and not yet unlocked.
    locked: bool,
    /// Password entry field (cleared after an unlock attempt).
    password_input: String,
    /// User-facing error/status from the last OATH operation.
    error: Option<String>,
    /// True once a list has been fetched for the current selection.
    loaded: bool,
    /// "Add credential" dialog state.
    add: OathAddDialog,
    /// Pending delete confirmation: the device the row was shown for and the
    /// credential name. Bound to a device so a confirmation opened for one
    /// key can neither render over nor delete from another (KEY-008).
    confirm_delete: Option<(DeviceId, String)>,
    /// Password accepted by the last successful unlock+list of the current
    /// selection. `password_input` is consumed (wiped) by every op's apply,
    /// so on-demand reads that happen much later — HOTP "Read code" — send
    /// this retained copy instead of an empty string (which could never
    /// unlock a protected applet and re-locked the pane every time).
    /// Cleared on selection change and on a rejected password.
    unlocked_password: Option<zeroize::Zeroizing<String>>,
    /// Pending applet-reset confirmation, bound to the device it was opened
    /// for (same KEY-008 posture as `confirm_delete`). Reset works without
    /// the password by design — it is the recovery for a forgotten one — so
    /// this is reachable from the locked view too.
    confirm_reset: Option<DeviceId>,
}

/// One credential row in the OATH pane: its stored name and the last code we
/// computed for it (empty until "Show code" / refresh).
struct OathRow {
    name: String,
    code: Option<String>,
    /// Counter-based credential: codes are computed only on explicit request
    /// (each computation advances the card's counter — a passive listing must
    /// not burn counter steps), and they don't expire, so no countdown ring.
    hotp: bool,
}

/// "Add credential" modal state for the OATH pane. Open iff `open` is true; the
/// name + base32 **secret** + type/touch fields render *inside* the centered
/// `modal_window` (not inline in the pane) so the secret entry and its result
/// stay on-screen, mirroring the PIV/OpenPGP credential modals (issue #31).
/// `busy` shows the spinner while `provision_oath`'s job is in flight; `result`
/// is `None` until it completes, then `Ok(())` on success or `Err(message)` on
/// failure — both shown in the modal.
#[derive(Default)]
struct OathAddDialog {
    open: bool,
    name: String,
    /// Base32 secret (entered masked).
    secret: String,
    /// True = TOTP, false = HOTP.
    totp: bool,
    require_touch: bool,
    /// True while the provision op is in flight (spinner + Submit disabled).
    busy: bool,
    /// Outcome of the last provision op, shown in the modal.
    result: Option<Result<(), String>>,
}

impl OathAddDialog {
    /// A freshly-opened dialog: empty fields, TOTP default, no in-flight op.
    /// (No `..Default::default()` — the `Drop` impl forbids struct-update.)
    fn opened() -> Self {
        OathAddDialog {
            open: true,
            name: String::new(),
            secret: String::new(),
            totp: true,
            require_touch: false,
            busy: false,
            result: None,
        }
    }

    /// Client-side validation of the entered fields, mirroring the guards in
    /// `provision_oath` so the modal can reject bad input before dispatching.
    /// Returns the trimmed name + decoded secret on success, or an error message.
    fn validate(&self) -> Result<(String, Vec<u8>), String> {
        let name = self.name.trim().to_owned();
        if name.is_empty() {
            return Err("credential name is required".into());
        }
        match keyroost_proto::codec::base32_decode(self.secret.trim()) {
            Ok(s) if !s.is_empty() => Ok((name, s)),
            Ok(_) => Err("secret is empty".into()),
            Err(e) => Err(format!("invalid base32 secret: {e}")),
        }
    }
}

// The form is replaced wholesale after submit; wipe the typed seed on drop.
impl Drop for OathAddDialog {
    fn drop(&mut self) {
        wipe(&mut self.secret);
    }
}

/// State for the OpenPGP pane. Like OATH, the applet is driven over PC/SC, so a
/// reader name identifies the card.
#[derive(Default)]
struct OpenPgpState {
    /// Last status read from the selected card.
    status: Option<keyroost_transport::OpenPgpStatus>,
    /// User-facing error from the last operation.
    error: Option<String>,
    /// Success/info line from the last write operation.
    notice: Option<String>,
    /// True once a status has been fetched for the current selection.
    loaded: bool,
    /// Admin PIN (PW3) entry, used for every write op. Cleared after use.
    admin_pin: String,
    /// Cardholder-name entry.
    name_input: String,
    /// Public-key-URL entry.
    url_input: String,
    /// The key (Signature / Decryption / Authentication) whose sub-tab is open.
    /// Every per-key action — generate on-card, import — targets this key, the
    /// same way the PIV pane's `selected_slot` drives its per-slot cards.
    selected_key: OpenPgpSlotSel,
    /// Algorithm chosen in the Generate-key modal for the selected slot.
    gen_alg: OpenPgpKeyAlgSel,
    /// The card's own Algorithm Information (`FA`) object, when it publishes
    /// one — feeds the Generate-key modal's algorithm choices. `None` means
    /// the card didn't publish one (pre-3.4 cards), not that it has none.
    supported: Option<keyroost_transport::AlgorithmInformation>,
    /// Path to an RSA key file for import-from-file (text-entered).
    import_path: String,
    /// Change-user-PIN (PW1) old/new entries. Cleared after use.
    user_pin_old: String,
    user_pin_new: String,
    /// Change-admin-PIN (PW3) old/new entries. Cleared after use.
    admin_pin_old: String,
    admin_pin_new: String,
    /// New user PIN for the unblock flow (reset retry counter); authorised by
    /// `admin_pin`. Cleared after use.
    unblock_new: String,
    /// "Use default admin PIN (PW3)" toggle in the credential modal: when set,
    /// the well-known factory default (`12345678`) fills `admin_pin` on Submit
    /// instead of whatever was typed. Reset per modal. (Most cards still on the
    /// factory PIN, so this saves typing during bring-up.)
    use_default_admin: bool,
    /// Credential-entry modal for the PIN changes + the admin-PIN-gated writes
    /// (open iff `Some`). The PW1/PW3 secret fields render *inside* this modal,
    /// not inline in the pane, so the entry and its result stay on-screen
    /// (issue #31). The non-secret parameters (name, URL, slot, file path) stay
    /// inline in the pane.
    cred_modal: Option<OpenPgpCredModal>,
}

impl OpenPgpState {
    /// Zeroize every PIN entry field. Called when the selection changes (a PIN
    /// typed for one card must not ride along to another) and on drop.
    fn wipe_secrets(&mut self) {
        wipe(&mut self.admin_pin);
        wipe(&mut self.user_pin_old);
        wipe(&mut self.user_pin_new);
        wipe(&mut self.admin_pin_old);
        wipe(&mut self.admin_pin_new);
        wipe(&mut self.unblock_new);
        self.use_default_admin = false;
    }
}

/// Which OpenPGP credential flow the modal is driving. The first three map 1:1
/// to the PIN operations (`change_openpgp_user_pin` / `change_openpgp_admin_pin`
/// / `unblock_openpgp_user_pin`); the rest are the admin-PIN (PW3)-gated writes
/// whose *secret* (the admin PIN) now lives in the modal while their non-secret
/// parameters (cardholder name, URL, slot, file path) stay inline in the pane.
/// The variant selects which secret fields the modal renders and which op
/// Submit dispatches to.
#[derive(Clone, Copy, PartialEq, Eq)]
enum OpenPgpCredKind {
    ChangeUserPin,
    ChangeAdminPin,
    UnblockUserPin,
    SetName,
    SetUrl,
    GenerateKey,
    GenerateImportKey,
    ImportKeyFile,
    Reset,
}

impl OpenPgpCredKind {
    /// Modal title, matching the FIDO/PIV dialogs' title style.
    fn title(self) -> &'static str {
        match self {
            OpenPgpCredKind::ChangeUserPin => "Change user PIN",
            OpenPgpCredKind::ChangeAdminPin => "Change admin PIN",
            OpenPgpCredKind::UnblockUserPin => "Unblock user PIN",
            OpenPgpCredKind::SetName => "Set cardholder name",
            OpenPgpCredKind::SetUrl => "Set public-key URL",
            OpenPgpCredKind::GenerateKey => "Generate key on-card",
            OpenPgpCredKind::GenerateImportKey => "Generate & import key",
            OpenPgpCredKind::ImportKeyFile => "Import key from file",
            OpenPgpCredKind::Reset => "Reset applet",
        }
    }
    /// Label for the modal's primary Submit button. Shorter than the title for
    /// the verbose flows so the button doesn't overflow.
    fn submit_label(self) -> &'static str {
        match self {
            OpenPgpCredKind::ChangeUserPin => "Change user PIN",
            OpenPgpCredKind::ChangeAdminPin => "Change admin PIN",
            OpenPgpCredKind::UnblockUserPin => "Unblock",
            OpenPgpCredKind::SetName => "Set name",
            OpenPgpCredKind::SetUrl => "Set URL",
            OpenPgpCredKind::GenerateKey => "Generate",
            OpenPgpCredKind::GenerateImportKey => "Generate & import",
            OpenPgpCredKind::ImportKeyFile => "Import",
            OpenPgpCredKind::Reset => "Reset applet",
        }
    }
    /// Spinner caption shown while this flow's op runs.
    fn busy_label(self) -> &'static str {
        match self {
            OpenPgpCredKind::ChangeUserPin => "Changing user PIN\u{2026}",
            OpenPgpCredKind::ChangeAdminPin => "Changing admin PIN\u{2026}",
            OpenPgpCredKind::UnblockUserPin => "Unblocking user PIN\u{2026}",
            OpenPgpCredKind::SetName => "Setting cardholder name\u{2026}",
            OpenPgpCredKind::SetUrl => "Setting public-key URL\u{2026}",
            OpenPgpCredKind::GenerateKey => "Generating key\u{2026}",
            OpenPgpCredKind::GenerateImportKey => "Generating & importing key\u{2026}",
            OpenPgpCredKind::ImportKeyFile => "Importing key from file\u{2026}",
            OpenPgpCredKind::Reset => "Resetting OpenPGP applet\u{2026}",
        }
    }
    /// In-modal success confirmation text. The key flows whose *detailed* result
    /// (the new fingerprint) still surfaces in the pane only need a generic
    /// confirmation here.
    fn success(self) -> &'static str {
        match self {
            OpenPgpCredKind::ChangeUserPin => "User PIN changed",
            OpenPgpCredKind::ChangeAdminPin => "Admin PIN changed",
            OpenPgpCredKind::UnblockUserPin => "User PIN unblocked",
            OpenPgpCredKind::SetName => "Cardholder name set",
            OpenPgpCredKind::SetUrl => "Public-key URL set",
            OpenPgpCredKind::GenerateKey => "Key generated",
            OpenPgpCredKind::GenerateImportKey => "Key generated and imported",
            OpenPgpCredKind::ImportKeyFile => "Key imported",
            OpenPgpCredKind::Reset => "Applet reset",
        }
    }
    /// True when this flow collects the *admin* PIN (PW3) — i.e. it shows the
    /// admin-PIN field and the "Use default admin PIN (PW3)" convenience toggle.
    /// The user-PIN change (PW1, self-authorising) and the reset (PIN-less) do
    /// not.
    fn needs_admin_pin(self) -> bool {
        matches!(
            self,
            OpenPgpCredKind::ChangeAdminPin
                | OpenPgpCredKind::UnblockUserPin
                | OpenPgpCredKind::SetName
                | OpenPgpCredKind::SetUrl
                | OpenPgpCredKind::GenerateKey
                | OpenPgpCredKind::GenerateImportKey
                | OpenPgpCredKind::ImportKeyFile
        )
    }
}

/// Live state of the OpenPGP credential-entry modal. Open iff
/// `OpenPgpState::cred_modal` is `Some`. Tracks the flow, whether its op is in
/// flight, and the op's result so the outcome is shown *in the modal* (issue
/// #31). `result` is `None` until the op completes, then `Ok(())` on success or
/// `Err(message)` on failure.
struct OpenPgpCredModal {
    kind: OpenPgpCredKind,
    busy: bool,
    result: Option<Result<(), String>>,
    /// The device the modal was opened for. Submit is rejected — and the
    /// modal closed — when the selection has moved since (KEY-013): the
    /// Reset flow needs no PIN, so this binding is the only thing standing
    /// between a stale modal and a factory reset of the wrong card.
    device: Option<DeviceId>,
}

impl OpenPgpCredModal {
    fn new(kind: OpenPgpCredKind, device: Option<DeviceId>) -> Self {
        OpenPgpCredModal {
            kind,
            busy: false,
            result: None,
            device,
        }
    }
}

/// The well-known OpenPGP Card factory-default admin PIN (PW3).
const OPENPGP_DEFAULT_ADMIN_PIN: &str = "12345678";

/// Inline new==confirm guard for the PIN-change flows, mirroring the op-level
/// backstop. Returns the error message when the two new entries diverge (and
/// the confirm field is non-empty). The admin-PIN-gated *writes* have no
/// new==confirm pair — they're validated by the ops' own client-side guards.
fn openpgp_cred_mismatch(pgp: &OpenPgpState, kind: OpenPgpCredKind) -> Option<&'static str> {
    // The OpenPGP PIN flows ask for old + new with no separate "confirm" field
    // (the original inline forms had none), so there is no mismatch to report.
    // The function exists to mirror the PIV modal's shape and to give a single
    // place to add a confirm guard later without touching the render path.
    let _ = (pgp, kind);
    None
}

/// Zeroize a secret-bearing text field (wipes the bytes, then leaves the
/// string empty — strictly better than `.clear()`, which only resets the
/// length and leaves the secret in the buffer).
fn wipe(s: &mut String) {
    use zeroize::Zeroize;
    s.zeroize();
}

/// Shared device-binding guard for background-job completions and modal
/// submissions. `captured` is the `DeviceId` recorded when the job was
/// dispatched (or the dialog/confirmation opened); `current` is the selection
/// now. The completion may act only when both exist and match — `None` on
/// either side fails closed, so an unbound completion can never act on
/// whatever happens to be selected. This is the one place the rule lives;
/// per-feature capture fields (Tasks: Molto session, FIDO session, advanced
/// dialog, OATH/OpenPGP confirmations) all route their decision through it.
///
/// Convention for users: dispatchers capture
/// `let for_device = self.selected_device.clone();` *before* `spawn_job`, and
/// the apply closure's first statement is
/// `if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) { return; }`.
fn completion_still_valid(captured: Option<&DeviceId>, current: Option<&DeviceId>) -> bool {
    matches!((captured, current), (Some(c), Some(now)) if c == now)
}

/// Whether a resident credential should offer the "Save certificate…" action.
/// True only for SSH relying parties (`ssh:*`) that also carry a largeBlob key:
/// the key is required to decrypt this credential's per-credential largeBlob
/// entry, so without one there is nothing an extract job could produce.
/// (Whether a certificate is *actually* stored is only knowable by reading the
/// device's largeBlob array — that stays in the background job, which reports
/// "no certificate stored" when the decrypt turns up nothing.)
fn ssh_cred_offers_cert(rp_id: &str, large_blob_key: Option<&[u8; 32]>) -> bool {
    rp_id.starts_with("ssh:") && large_blob_key.is_some()
}

/// One-line human summary of a parsed SSH certificate, shown beside the saved
/// path after "Save certificate…" succeeds.
fn ssh_cert_summary(info: &keyroost_ctap::ssh_cert::SshCertInfo) -> String {
    let kind = if info.cert_type == keyroost_ctap::ssh_cert::CERT_TYPE_USER {
        "user"
    } else {
        "host"
    };
    let principals = if info.principals.is_empty() {
        "(any)".to_string()
    } else {
        info.principals.join(", ")
    };
    format!(
        "{} ({kind}) \u{00b7} key id {} \u{00b7} principals {} \u{00b7} {}",
        info.key_type,
        info.key_id,
        principals,
        keyroost_ctap::ssh_cert::format_validity(info.valid_after, info.valid_before),
    )
}

/// Whether the user may override an `Unsupported` verdict for `extension`
/// ("Enable Anyway" below the Reset card; the CLI's `--force` is separate).
///
/// Only features the pane exposes as controls. Not overridable here:
/// - The internal reads GET METADATA, ATTEST and GET SLOT KEY STATUS: nothing
///   to switch on in the pane. "Enable Anyway" reaches GET METADATA and ATTEST
///   through the transport instead (`PivSessionState::set_send_unsupported_reads`,
///   set by `piv_cached_piv_session_state`), and the transport traces every
///   read the table skips or overrides.
/// - RESET (and the device-wide reset). It is potentially destructive, and a
///   one-click unlock would invite people to just try it. Reaching it means
///   deliberately exhausting the PIN and PUK retries first, so a failed
///   attempt on a device that turns out not to support it can leave the applet
///   locked with no way back — bricking the device. Unlocking a known-unsupported reset is
///   therefore left to the CLI's `--force`: the extra effort means only people
///   who know what they are doing take that path.
/// - Removing the management key outright (`MgmtAlgChoice::Delete`): that is
///   HID Crescendo's own command, not a feature another device might merely be
///   untested for.
///
/// For every other extension a device that really lacks the feature just
/// refuses the command and nothing changes.
///
/// Applied to the pane's controls. The transport's own gates keep resolving
/// from the real table, except that GET METADATA and ATTEST are sent anyway
/// for a key with "Enable Anyway" on (see above); the reset mechanism choice
/// is never overridden.
fn piv_user_overridable(extension: keyroost_piv::compat::PivExtension) -> bool {
    use keyroost_piv::compat::{MgmtAlgChoice, PivExtension};
    !matches!(
        extension,
        PivExtension::GetMetadata
            | PivExtension::Attest
            | PivExtension::GetSlotKeyStatus
            | PivExtension::Reset
            | PivExtension::ResetGlobal
            | PivExtension::ManagementKeyAlgorithm(MgmtAlgChoice::Delete)
    )
}

/// `gate` with "unsupported" downgraded to "unverified" when
/// [`piv_user_overridable`] allows it — the control works, with the same
/// warning an untested feature gets. Any other gate is returned unchanged.
fn piv_relax(
    extension: keyroost_piv::compat::PivExtension,
    gate: keyroost_piv::compat::FeatureGate,
) -> keyroost_piv::compat::FeatureGate {
    use keyroost_piv::compat::FeatureGate;
    match gate {
        FeatureGate::Unsupported if piv_user_overridable(extension) => FeatureGate::Unverified,
        other => other,
    }
}

/// How many user-facing PIV features keyroost's compatibility table lists as
/// unsupported on this device — the number the PIV card's "Compatibility
/// table" line shows. Counts only what "Ignore for this key" can actually
/// unlock (see `piv_user_overridable`), so RESET and HID
/// Crescendo's own commands never inflate it.
fn piv_compat_unsupported_count(
    fingerprint: keyroost_piv::fingerprint::AppletFingerprint,
    version: Option<&[u8]>,
    version_firmware: Option<&[u8]>,
) -> usize {
    use keyroost_piv::compat::{FeatureGate, MgmtAlgChoice, PivExtension};
    let mut features = vec![
        PivExtension::MoveKey,
        PivExtension::DeleteKey,
        PivExtension::PinManagementAuth,
        PivExtension::SetPinPukRetries,
        PivExtension::SetManagementKey,
        PivExtension::SlotPinPolicy,
        PivExtension::SlotTouchPolicy,
    ];
    features.extend(keyroost_piv::KeyAlg::ALL.map(PivExtension::SlotKeyAlgorithm));
    features.extend(
        [
            MgmtAlgChoice::TripleDes,
            MgmtAlgChoice::Aes128,
            MgmtAlgChoice::Aes192,
            MgmtAlgChoice::Aes256,
        ]
        .map(PivExtension::ManagementKeyAlgorithm),
    );
    features
        .into_iter()
        .filter(|&f| piv_user_overridable(f))
        .filter(|&f| {
            keyroost_piv::compat::resolve(f, fingerprint, version, version_firmware)
                == FeatureGate::Unsupported
        })
        .count()
}

/// Whether the FIDO Settings subview exists for the selected key.
/// authenticatorReset is a baseline CTAP2 command (present since CTAP 2.0),
/// so any key that answered getInfo with a CTAP2 version can be reset and
/// gets the tab; gating the tab on authenticatorConfig — a CTAP 2.1 feature —
/// hid the only reset path from CTAP 2.0-only keys (#81). The advanced
/// security-policy controls *inside* the tab stay gated on `authnrCfg`.
fn fido_settings_available(info: Option<&AuthenticatorInfo>) -> bool {
    info.is_some_and(|i| i.versions.iter().any(|v| v.starts_with("FIDO_2_")))
}

/// What `App::start_factory_reset_confirm` learned about the selected
/// device's PIV step before arming the confirm dialog — resolved one step
/// ahead of the dialog itself (fingerprinted the moment "Factory reset…" is
/// pressed, not deferred to when the reset actually runs), so
/// `factory_reset_confirm_summary` can describe exactly what that step will
/// do instead of hedging across every possibility. Mirrors
/// `keyroost_transport::PivResetPreview`, the same verdict the reset itself
/// resolves when it runs (`PivSession::factory_reset`, inside
/// `run_card_reset_step`) — fingerprinted again there rather than threaded
/// through from here: the two calls are only ever seconds apart and
/// `preview_factory_reset` costs no PIN/PUK attempt, so a fresh re-check is
/// cheap and can't go stale the way carrying this value forward could (the
/// confirm dialog can sit open for a while, or the key can be swapped and
/// swapped back — see `render_factory_reset_confirm`'s KEY-008 guard).
#[derive(Clone, Copy, PartialEq, Eq)]
enum FactoryResetPivPreview {
    /// The device's plan has no PIV step — nothing to fingerprint.
    NotOffered,
    /// The fingerprint attempt itself failed (no PC/SC reader for PIV,
    /// `PivSession::open` error, …) — the summary falls back to generic
    /// wording rather than blocking the whole confirm dialog on a
    /// diagnostic step's own failure.
    CheckFailed,
    /// The live verdict — `Unsupported` means neither reset mechanism is
    /// available, so `App::start_factory_reset_confirm` doesn't even plan a
    /// PIV step for this device (`keyroost_resolve::exclude_unresettable_piv`);
    /// `factory_reset_confirm_summary` never actually renders this variant's
    /// own text as a result (its `if plan.contains(&ResetStep::Piv)` guard
    /// skips the whole block), but it's still tracked here rather than
    /// folded into `NotOffered`/`CheckFailed` — those mean "nothing to say",
    /// this means "there was something to fingerprint, and the answer was
    /// no".
    Resolved(keyroost_transport::PivResetPreview),
}

/// Whether `piv_preview` says PIV can't be reset at all —
/// `App::render_factory_reset_confirm`/`App::run_factory_reset_gui` both
/// exclude [`keyroost_resolve::ResetStep::Piv`]
/// (`keyroost_resolve::exclude_unresettable_piv`) from the plan they rebuild
/// when this is true, rather than offering (or attempting) a step
/// `PivSession::factory_reset` would only refuse.
#[must_use]
fn factory_reset_piv_unresettable(preview: FactoryResetPivPreview) -> bool {
    matches!(
        preview,
        FactoryResetPivPreview::Resolved(keyroost_transport::PivResetPreview::Unsupported)
    )
}

/// State for the armed factory-reset confirm dialog: which device it's for
/// (KEY-008 — the dialog dies the instant the selection changes; see
/// `render_factory_reset_confirm`) and what's known about that device's PIV
/// step (see `FactoryResetPivPreview`).
#[derive(Clone)]
struct FactoryResetConfirmState {
    for_device: DeviceId,
    piv_preview: FactoryResetPivPreview,
    /// Whether `keyroost_transport::PivSession::global_reset_available`
    /// resolved true for this device: either `PivExtension::Reset` or
    /// `PivExtension::ResetGlobal` resolves something other than
    /// `Unsupported` (`Supported` or `Unverified`), *and*
    /// `PivQuirk::ResetNeedsManagementAuth` is set — today: every HID
    /// Crescendo fingerprint, C2300/C4000/Generic alike (see that method's
    /// doc for why `Generic` needs the OR, not just `ResetGlobal ==
    /// Supported`). The credential need this reflects comes from the quirk
    /// alone, not specifically from `ResetGlobal` — when true, the dialog
    /// shows the credential prompt (`App::factory_reset_mgmt_auth_field`)
    /// and `factory_reset_confirm_summary` says a credential is needed,
    /// regardless of which extension is the reason. Does **not** by itself
    /// decide whether `PivSession::factory_reset` ends up running the
    /// device-wide mechanism or the PIV-only one — `piv_preview` already
    /// carries that (see `FactoryResetPivPreview::Resolved`), so this crate
    /// doesn't track `reset_global_gate` separately any more.
    needs_reset_mgmt_auth: bool,
    /// This device's well-known factory-default management-key bytes, from
    /// the same fingerprint job that resolved `piv_preview`/
    /// `needs_reset_mgmt_auth`
    /// (`keyroost_transport::PivSession::default_management_key`). `None`
    /// when keyroost has no known default for this fingerprint/version —
    /// the same signal `App::piv_modal_mgmt_field` uses to disable its "Use
    /// default management key" checkbox rather than offer one that might be
    /// wrong. `App::factory_reset_mgmt_auth_field` mirrors that: disables
    /// the checkbox and shows the hex value in a tooltip only when this is
    /// `Some`.
    default_mgmt_key: Option<&'static [u8]>,
    /// [`keyroost_piv::compat::PivQuirk::ResetLongRunning`], from the same
    /// fingerprint job that resolved `piv_preview`/`needs_reset_mgmt_auth`/
    /// `default_mgmt_key` — `false` whenever that job never ran or never
    /// completed (`NotOffered`/`CheckFailed`), same as the other two fields
    /// default to their "nothing learned" value in those cases.
    /// `factory_reset_confirm_summary` appends
    /// [`keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT`] to the
    /// PIV note when this is set, same wording the PIV pane's "Reset applet"
    /// card and `keyroostctl piv reset` already show.
    reset_long_running: bool,
}

/// How the factory-reset confirm dialog's reset management-auth credential
/// prompt is currently resolved — the same three-way shape as
/// [`PivMgmtAuthMode`] (a typed field, a "use the well-known default"
/// convenience, or a PIN), kept as its own type because the credential
/// itself is a different one: whatever
/// [`keyroost_transport::PivSession::default_management_key`] resolves for
/// *this reset*, not necessarily the same value
/// [`PivMgmtAuthMode::Default`] resolves for a already-unlocked session's
/// other management operations (e.g. Generate Key) — the two happen to
/// coincide on HID Crescendo today (its only known default is its ACA
/// XAUTH key either way — see
/// [`keyroost_piv::compat::PivQuirk::Default9bManagementKey`]'s doc), but
/// nothing here assumes that holds for a future fingerprint.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
enum ResetMgmtAuthMode {
    /// Neither toggle ticked: `App::reset_mgmt_auth_input` holds a typed
    /// management-key hex string.
    #[default]
    Manual,
    /// "Use default management key":
    /// `FactoryResetConfirmState::default_mgmt_key`, resolved for the
    /// specific device this dialog is armed for.
    Default,
    /// "Use PIN": the ACA instance's own VERIFY PIN — not the standard PIV
    /// application PIN [`PivMgmtAuthMode::Pin`] means.
    Pin,
}

/// [`piv_mgmt_mode_after_toggle`]'s twin for [`ResetMgmtAuthMode`] — same
/// rule, different type: `mode_if_checked` if the click checked the box,
/// [`ResetMgmtAuthMode::Manual`] if it unchecked it, regardless of what
/// the mode held before.
#[must_use]
fn reset_mgmt_auth_mode_after_toggle(
    checked: bool,
    mode_if_checked: ResetMgmtAuthMode,
) -> ResetMgmtAuthMode {
    if checked {
        mode_if_checked
    } else {
        ResetMgmtAuthMode::Manual
    }
}

/// How the user authorized `PivSession::factory_reset`'s credential, when
/// `PivQuirk::ResetNeedsManagementAuth` means one is needed — the
/// factory-default management key, a typed management key, or a PIN for the
/// ACA's own VERIFY PIN reference (today's only real consumer of any of the
/// three is HID Crescendo's device-wide mechanism; a plain PIV reset needing
/// this same quirk would take the same shape, just via the standard PIV
/// management-key round instead — see `PivSession::factory_reset`'s doc).
/// Produced by `App::reset_mgmt_current_auth`, consumed by
/// `run_card_reset_step`'s `Piv` branch. Mirrors [`PivMgmtAuth`]'s shape for
/// the same reason that type exists — a single resolved form both the
/// dialog's validation and the worker job's actual call convert into
/// `keyroost_transport::CurrentMgmtAuth` the same way.
enum ResetMgmtAuth {
    Key(zeroize::Zeroizing<Vec<u8>>),
    Pin(zeroize::Zeroizing<String>),
}

/// The confirmation body for the Factory reset modal: what key, and exactly
/// which applets get wiped, with the two ceremonies that aren't a plain wipe
/// spelled out (PIV's actual precondition, per `piv_preview`; FIDO needs a
/// replug + touch).
fn factory_reset_confirm_summary(
    serial: &str,
    model: &str,
    plan: &[keyroost_resolve::ResetStep],
    piv_preview: FactoryResetPivPreview,
    needs_management_auth: bool,
    reset_long_running: bool,
) -> String {
    use keyroost_resolve::ResetStep;
    use keyroost_transport::{FactoryResetPlan, PivResetPreview};
    // `PivExtension::ResetGlobal` resolving `Supported` or `Unverified`
    // (`PivResetPreview::Global`) means the PIV step, if it runs, will take
    // at least one other applet down with it — the same device-wide
    // mechanism `StepOutcome::WipedGlobal` names post-hoc with
    // `PIV_GLOBAL_RESET_LABEL` once the reset has actually happened. Name it
    // the same way here, ahead of time, rather than letting the confirm
    // dialog undersell the PIV step as a bare "PIV".
    let piv_is_global = matches!(
        piv_preview,
        FactoryResetPivPreview::Resolved(PivResetPreview::Global)
    );
    let applets = plan
        .iter()
        .map(|s| match s {
            ResetStep::Piv if piv_is_global => keyroost_resolve::PIV_GLOBAL_RESET_LABEL,
            s => s.label(),
        })
        .collect::<Vec<_>>()
        .join(", ");
    let mut msg = format!(
        "Factory-reset {model} (serial {serial})?\n\nWipes: {applets}.\nEvery \
         credential, code, key, and PIN is erased. Each applet that completes \
         comes back in factory condition, ready to set up again."
    );
    if plan.contains(&ResetStep::Piv) {
        // Don't promise the key "stays fully usable" in the
        // `BurnPinPukThenReset` case: PIN/PUK are blocked on purpose there, so
        // a wipe that stops between the blocking and the RESET leaves PIV
        // locked until a reset finishes.
        let piv_note = match piv_preview {
            // Shouldn't happen — `start_factory_reset_confirm` always
            // fingerprints when the plan offers PIV — but fails into the same
            // wording `CheckFailed` gets rather than claim something about a
            // step that was never actually fingerprinted.
            FactoryResetPivPreview::NotOffered | FactoryResetPivPreview::CheckFailed => {
                "\n\nPIV: keyroost couldn't confirm this device's RESET support \
                 ahead of time. It will still attempt the standard path (block the \
                 PIN and PUK, then wipe) \u{2014} the report below the button says \
                 what actually happened."
            }
            // Unreachable via normal flow: `start_factory_reset_confirm`
            // drops `ResetStep::Piv` from the plan entirely whenever
            // `preview_factory_reset` resolves this (`exclude_unresettable_piv`),
            // so this whole block never runs for it. Kept for exhaustiveness
            // — empty string is the safe fallback if it's ever reached anyway
            // (e.g. a plan built before a fresh fingerprint changed the
            // answer).
            FactoryResetPivPreview::Resolved(PivResetPreview::Unsupported) => "",
            // The device-wide mechanism will run — nothing special to caveat
            // here: PIV just gets wiped along with the plan's other applets,
            // same as `BurnPinPukThenReset` below promises for the PIV-only
            // path, without that path's own PIN/PUK-blocking caveat (this
            // mechanism never touches either counter). The credential
            // sentence below covers the one thing worth calling out, when
            // the quirk applies.
            FactoryResetPivPreview::Resolved(PivResetPreview::Global) => "",
            // Also unreachable via normal flow, same reasoning as the
            // top-level `Unsupported` arm above — `preview_factory_reset` maps
            // `FactoryResetPlan::Unsupported` to the outer `PivResetPreview::
            // Unsupported`, never to `Piv(Unsupported)`.
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::Unsupported,
            )) => "",
            // Unlike `BurnPinPukThenReset` below, this authenticates once,
            // then sends RESET — a clean, atomic pass/fail with no
            // partial-blocking state the step report could reveal, so this
            // doesn't point at it the way the burn case does. The credential
            // sentence below (always shown alongside this arm, since
            // `NeedsManagementAuth` only resolves when the quirk applies)
            // says where the credential it authenticates with comes from.
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::NeedsManagementAuth,
            )) => {
                "\n\nPIV: this device resets via an authenticated management-key \
                 session \u{2014} keyroost authenticates with the credential \
                 entered below, then wipes."
            }
            // Also atomic, same reasoning as `NeedsManagementAuth` above: the
            // bare RESET attempt this case sends never touches the PIN or PUK
            // either, so it either wipes PIV outright or leaves it exactly as
            // it was — nothing partial for the step report to disambiguate.
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::Unverified,
            )) => {
                "\n\nPIV: keyroost's list has no RESET entry for this key, so it will \
                 try it without blocking the PIN and PUK first \u{2014} consult \
                 this device's own documentation for any precondition (commonly: \
                 the PIN and PUK both already blocked) and complete it manually if \
                 the attempt fails."
            }
            // The one case that isn't atomic: burning the PIN, then the PUK,
            // then sending RESET is three separate steps, and a failure
            // between any of them leaves PIV in a partial state this text
            // alone can't describe — hence pointing at the step report, unlike
            // every other case above.
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::BurnPinPukThenReset,
            )) => {
                "\n\nPIV: the PIN and PUK are intentionally blocked, then the applet \
                 is wiped (the standard reset path). If the wipe stops after the \
                 blocking, PIV stays locked until a reset finishes \u{2014} the \
                 report below the button says what state it's in."
            }
        };
        msg.push_str(piv_note);
        // `needs_management_auth` is `PivSession::global_reset_available`'s
        // boolean — `PivQuirk::ResetNeedsManagementAuth` applying, ANDed
        // with either `PivExtension::Reset` or `PivExtension::ResetGlobal`
        // not being a confirmed dead end. Whichever mechanism `piv_preview`
        // says will actually run (`Global` or `Piv(NeedsManagementAuth)`),
        // this same credential is what it needs, entered in the same field
        // (`App::factory_reset_mgmt_auth_field`) — so one sentence covers
        // both, rather than duplicating it into each arm above.
        if needs_management_auth {
            msg.push_str("\n\nResetting this device requires management auth, entered below.");
        }
        // `PivQuirk::ResetLongRunning` — same wording the PIV pane's "Reset
        // applet" card and `keyroostctl piv reset` already show, appended
        // here too so it isn't missed before the whole-device wipe starts.
        if reset_long_running {
            msg.push_str("\n\n");
            msg.push_str(keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT);
        }
    }
    if plan.contains(&ResetStep::Fido) {
        msg.push_str("\n\nFinishes with a step to unplug the key, plug it back in, and touch it.");
    }
    msg
}

/// One line of the factory-reset report pane.
///
/// Card applets resolve on the worker and arrive as finished
/// [`StepReport`](keyroost_resolve::StepReport)s. FIDO can't: its wipe is
/// handed to the armed reset dialog, which needs a replug and a touch, so its
/// row is seeded as `FidoPending` and only becomes a `Step` once that ceremony
/// answers. `StepOutcome` has no pending state — it lives in the shared
/// resolver crate the CLI consumes too — so the waiting state is modelled
/// here. Without this row a failed or abandoned FIDO finale left a report that
/// listed only the wiped card applets, reading as a completed whole-device
/// wipe while the passkeys and PIN were still on the key.
enum FactoryResetRow {
    /// A step that has answered, wiped or failed.
    Step(keyroost_resolve::StepReport),
    /// FIDO2 was in the plan and the replug + touch ceremony hasn't answered.
    FidoPending,
}

/// How a report line should be painted. Keeps the wording pure (testable
/// without a frame) while the renderer owns the palette lookup.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
enum RowTone {
    /// The step finished as asked.
    Done,
    /// Nothing went wrong, but the step hasn't happened yet.
    Waiting,
    /// The step wiped what it was supposed to, but something afterward
    /// still needs attention.
    Warn,
    /// The step did not wipe what it was supposed to.
    Bad,
    /// The step wasn't part of this run.
    Muted,
}

/// The text and tone for one factory-reset report line.
fn factory_reset_row_line(row: &FactoryResetRow) -> (String, RowTone) {
    use keyroost_resolve::StepOutcome;
    match row {
        FactoryResetRow::FidoPending => (
            // Route-neutral on purpose: a USB key finishes via the replug +
            // touch ceremony, a card in a reader resets in place after a
            // power cycle — the open reset dialog carries the specific
            // instructions for whichever this is.
            format!(
                "{}  not wiped yet \u{2014} finish the confirmation in the reset window",
                keyroost_resolve::ResetStep::Fido.label()
            ),
            RowTone::Waiting,
        ),
        FactoryResetRow::Step(r) => match &r.outcome {
            StepOutcome::Wiped => (format!("{}  wiped", r.step.label()), RowTone::Done),
            // Device-wide mechanism, not confined to PIV alone — name the
            // whole device instead of just the applet that triggered it.
            StepOutcome::WipedGlobal => (
                format!("{}  wiped", keyroost_resolve::PIV_GLOBAL_RESET_LABEL),
                RowTone::Done,
            ),
            StepOutcome::WipedWithWarning(e) => (
                format!("{}  wiped, but: {e}", r.step.label()),
                RowTone::Warn,
            ),
            StepOutcome::Failed(e) => (format!("{}  failed: {e}", r.step.label()), RowTone::Bad),
            StepOutcome::Skipped(reason) => (
                format!("{}  skipped: {reason}", r.step.label()),
                RowTone::Muted,
            ),
        },
    }
}

/// One-line factory-reset summary for the activity log: which steps wiped
/// cleanly, which wiped but left a follow-up warning, which failed (each
/// with its own reason), and which were skipped (each with its own reason)
/// — the same buckets `factory_reset_row_line` paints per-row in the
/// Overview pane, collapsed into one line so the activity log keeps a
/// permanent record of the run even after the pane's own report is
/// overwritten by the next one.
///
/// `StepOutcome::WipedWithWarning` counts toward *both* the "wiped" list
/// (the applet really was wiped — a reader scanning just that list must see
/// it there) and its own "warnings" list (the follow-up failure is real and
/// still needs its own line) — the one outcome that isn't confined to a
/// single bucket, matching what it actually is: a wipe that succeeded, with
/// a caveat.
fn factory_reset_report_summary(reports: &[keyroost_resolve::StepReport]) -> String {
    use keyroost_resolve::StepOutcome;
    let wiped: Vec<&str> = reports
        .iter()
        .filter(|r| {
            matches!(
                r.outcome,
                StepOutcome::Wiped | StepOutcome::WipedGlobal | StepOutcome::WipedWithWarning(_)
            )
        })
        .map(|r| match r.outcome {
            // Device-wide mechanism, not confined to PIV alone — name the
            // whole device instead of just the applet that triggered it.
            StepOutcome::WipedGlobal => keyroost_resolve::PIV_GLOBAL_RESET_LABEL,
            _ => r.step.label(),
        })
        .collect();
    let warnings: Vec<String> = reports
        .iter()
        .filter_map(|r| match &r.outcome {
            StepOutcome::WipedWithWarning(e) => Some(format!("{}: {e}", r.step.label())),
            _ => None,
        })
        .collect();
    let failed: Vec<String> = reports
        .iter()
        .filter_map(|r| match &r.outcome {
            StepOutcome::Failed(e) => Some(format!("{}: {e}", r.step.label())),
            _ => None,
        })
        .collect();
    let skipped: Vec<String> = reports
        .iter()
        .filter_map(|r| match &r.outcome {
            StepOutcome::Skipped(reason) => Some(format!("{}: {reason}", r.step.label())),
            _ => None,
        })
        .collect();
    let mut msg = format!(
        "wiped: {}",
        if wiped.is_empty() {
            "none".to_string()
        } else {
            wiped.join(", ")
        }
    );
    if !warnings.is_empty() {
        msg.push_str(&format!("; warnings: {}", warnings.join("; ")));
    }
    if !failed.is_empty() {
        msg.push_str(&format!("; failed: {}", failed.join("; ")));
    }
    if !skipped.is_empty() {
        msg.push_str(&format!("; skipped: {}", skipped.join("; ")));
    }
    msg
}

/// Fold the FIDO finale's outcome into the factory-reset report, replacing the
/// row seeded when the card sweep handed off. A FIDO reset that isn't part of
/// a factory-reset run (the standalone "Reset key" button) finds no FIDO row
/// and leaves the report untouched.
///
/// An already-answered FIDO row is replaced too, not just a pending one: the
/// report invites a retry after a failure, the retry runs against the same
/// selection (so nothing clears the report in between), and a row still
/// reading "failed" after a wipe that succeeded tells the user their passkeys
/// and PIN survived on a key that is actually empty. The latest outcome wins.
///
/// Only a caller that actually attempted the wipe may use this. Everything
/// else takes [`resolve_pending_fido_reset_row`].
///
/// Returns whether a row was actually found and replaced — `false` means this
/// wasn't part of a factory-reset run at all (a standalone "Reset key"), which
/// callers use to decide whether the finale is also worth a permanent
/// activity-log line rather than just an Overview-pane update (see
/// [`App::apply_factory_reset_sweep`]'s doc on why that permanent record
/// matters).
fn resolve_fido_reset_row(
    rows: &mut [FactoryResetRow],
    outcome: keyroost_resolve::StepOutcome,
) -> bool {
    if let Some(row) = rows.iter_mut().find(|r| match r {
        FactoryResetRow::FidoPending => true,
        FactoryResetRow::Step(r) => r.step == keyroost_resolve::ResetStep::Fido,
    }) {
        *row = FactoryResetRow::Step(keyroost_resolve::StepReport {
            step: keyroost_resolve::ResetStep::Fido,
            outcome,
        });
        true
    } else {
        false
    }
}

/// Resolve the FIDO row only while it is still waiting on the ceremony.
///
/// For callers that end a *dialog* rather than a wipe: cancelling the modal, or
/// refusing to arm it. They can't know whether the dialog they just closed was
/// the factory reset's finale or a standalone "Reset key" the user opened
/// afterwards — and the report survives both a tab switch and a replug, so a
/// stale one is still on screen. Overwriting an answered row from here turns a
/// finished "FIDO2 wiped" into "FIDO2 failed" the moment the user opens the
/// FIDO2 tab and backs out of the reset dialog, inviting them to repeat an
/// irreversible ceremony that already succeeded. A pending row is the only
/// evidence that this dialog owns the finale, so it is the only row these
/// callers may write.
///
/// Returns whether a pending row was actually found and resolved — `false`
/// covers both "no factory reset in flight" and "this row already answered",
/// neither of which is this dialog's finale to announce. `true` means this
/// really was the factory reset's FIDO step being decided just now, which
/// callers use to also give it a permanent activity-log line (see
/// [`resolve_fido_reset_row`]'s doc for why).
fn resolve_pending_fido_reset_row(
    rows: &mut [FactoryResetRow],
    outcome: keyroost_resolve::StepOutcome,
) -> bool {
    if let Some(row) = rows
        .iter_mut()
        .find(|r| matches!(r, FactoryResetRow::FidoPending))
    {
        *row = FactoryResetRow::Step(keyroost_resolve::StepReport {
            step: keyroost_resolve::ResetStep::Fido,
            outcome,
        });
        true
    } else {
        false
    }
}

/// Severity + activity-log line for a factory reset's FIDO finale outcome.
///
/// Callers reach here only after [`resolve_fido_reset_row`] or
/// [`resolve_pending_fido_reset_row`] confirms this really was the finale
/// being decided — otherwise the card sweep's own "factory reset finished"
/// line (written before the FIDO ceremony even starts, see
/// [`App::apply_factory_reset_sweep`]) is the only activity-log record of
/// the run, and never gets updated once FIDO's outcome is known. Reuses
/// [`factory_reset_row_line`]'s wording so the permanent log and the
/// Overview pane read as the same event.
fn factory_reset_fido_finale_log_line(
    outcome: &keyroost_resolve::StepOutcome,
) -> (Severity, String) {
    use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
    let severity = match outcome {
        // `WipedGlobal` never actually reaches here in practice (its sole
        // producer is PIV, and this function is only ever called for
        // `ResetStep::Fido`), but the match has to stay exhaustive.
        StepOutcome::Wiped | StepOutcome::WipedGlobal => Severity::Ok,
        StepOutcome::WipedWithWarning(_) | StepOutcome::Skipped(_) => Severity::Warn,
        StepOutcome::Failed(_) => Severity::Err,
    };
    let (text, _tone) = factory_reset_row_line(&FactoryResetRow::Step(StepReport {
        step: ResetStep::Fido,
        outcome: outcome.clone(),
    }));
    (severity, format!("factory reset \u{2014} {text}"))
}

/// Render a `PivSession::factory_reset` failure for the report pane.
///
/// Only one of its paths — the PIN/PUK burn dance — blocks the PIN and then
/// the PUK on its way to RESET, so only there can a failure between the
/// blocking and the wipe leave a card that is locked but not erased. The
/// confirmation modal promises the report says which state the card is in,
/// so every failure from that path has to carry that.
///
/// The variants each of `factory_reset`'s other paths (device-wide
/// mechanism, authenticated management-key RESET, unverified bare RESET,
/// or an outright refusal before anything ran) can return already say so
/// themselves — none of them ever blocks a PIN or PUK, so appending the
/// burn-dance disclosure to them would be wrong. Only an error that could
/// have come from the burn dance (a transport error mid-loop, an unexpected
/// status word the PIN/PUK mapping renders as a bare APDU failure, a host
/// RNG failure) gets the disclosure appended.
///
/// The way out, when it applies, is to run the factory reset again, not the
/// single-applet PIV reset: a fault in the PUK loop leaves the PIN blocked
/// and the PUK *not* blocked, and the card refuses a plain RESET until both
/// are blocked.
fn piv_factory_reset_message(e: TransportError) -> String {
    match e {
        // None of these touched the PIN or PUK: `Unsupported`/
        // `NeedsManagementAuth` refuse before the burn sequence even starts
        // (see `PivSession::plan_factory_reset`), `UnverifiedFailed` is the
        // bare-RESET path that deliberately skips pre-blocking, and
        // `GlobalFailed`/`ManagementAuthFailed` are the device-wide and
        // authenticated-management-key mechanisms — neither has any
        // PIN/PUK-blocking step to have left half-done. The "PIV may now be
        // locked" caveat below would be actively wrong for any of these, so
        // they pass through as-is — each variant's own `Display` already
        // says what actually happened.
        TransportError::PivResetUnsupported
        | TransportError::PivResetNeedsManagementAuth
        | TransportError::PivResetUnverifiedFailed(_)
        | TransportError::PivResetForcedFailed(_)
        | TransportError::PivResetGlobalFailed(_)
        | TransportError::PivResetManagementAuthFailed(_)
        | TransportError::PivResetIncomplete(_)
        | TransportError::PivPukGuessAccepted => e.to_string(),
        other => format!(
            "{other} (the wipe blocks the PIN and PUK before erasing, so PIV may \
             now be locked but not wiped \u{2014} that is not bricked: run the \
             factory reset again to finish it)"
        ),
    }
}

/// Whether the PIV pane's "Reset applet" card should show its "Factory reset
/// supported →" link to the whole-device factory reset (Overview tab): true
/// when `reset_global_gate` — a *different* extension,
/// `PivExtension::ResetGlobal`, a device-wide reset directive that takes PIV
/// down with it alongside at least one other applet — resolves
/// [`keyroost_piv::compat::FeatureGate::Supported`] (an *unverified* alternative isn't something to
/// steer a user toward) AND `reset_gate` (`PivExtension::Reset`, the
/// PIV-only path) is anything other than [`keyroost_piv::compat::FeatureGate::Supported`] (a
/// known-good PIV-only path has nothing to redirect away from — this is the
/// "leave as-is" case).
fn piv_reset_global_alternative_available(
    reset_gate: keyroost_piv::compat::FeatureGate,
    reset_global_gate: keyroost_piv::compat::FeatureGate,
) -> bool {
    use keyroost_piv::compat::FeatureGate;
    reset_global_gate == FeatureGate::Supported && reset_gate != FeatureGate::Supported
}

/// Whether the Generate Key modal's "Policy other than `default` requires
/// YubiKey or compatible token." caveat still needs to be shown below the
/// PIN/touch policy combos: true unless *both* gates are confirmed
/// [`keyroost_piv::compat::FeatureGate::Supported`] — at that point the caveat is stale noise on a
/// device already known to handle non-default policies, and the per-row
/// warning marker / disabled-combo hover above already cover the
/// unverified/unsupported cases on their own.
fn piv_policy_caveat_hint_needed(
    pin_policy_gate: keyroost_piv::compat::FeatureGate,
    touch_policy_gate: keyroost_piv::compat::FeatureGate,
) -> bool {
    use keyroost_piv::compat::FeatureGate;
    pin_policy_gate != FeatureGate::Supported || touch_policy_gate != FeatureGate::Supported
}

/// Run one non-FIDO applet reset off the UI thread, mapping the result to a
/// [`StepOutcome`](keyroost_resolve::StepOutcome) so a single failure is
/// recorded rather than aborting the sweep (continue-on-error, matching the
/// CLI's `factory-reset`). FIDO is never routed here — it is handed to the
/// armed `ResetDialog` flow, which owns the replug + touch ceremony.
fn run_card_reset_step(
    step: keyroost_resolve::ResetStep,
    reader: Option<&str>,
    hid_path: Option<&std::path::Path>,
    reset_mgmt_auth: Option<&ResetMgmtAuth>,
) -> keyroost_resolve::StepOutcome {
    use keyroost_resolve::{ResetStep, StepOutcome};

    // PIV gets its own path, ahead of the shared closure below:
    // `PivSession::factory_reset` decides on its own, from a live fingerprint,
    // whether to run the device-wide mechanism, a PIV-only reset, or skip the
    // applet outright (RESET known-unsupported on both axes, or a
    // precondition — an authenticated management-key session — with no
    // credential supplied) rather than fail it, a distinction the shared
    // Ok/Err mapping the other steps share can't express. See
    // `piv_factory_reset_message` for why none of the "never touched PIN/PUK"
    // errors get its usual caveat appended.
    if step == ResetStep::Piv {
        return (|| -> Result<StepOutcome, String> {
            let name = reader.ok_or("no PC/SC reader for the PIV applet")?;
            let current = reset_mgmt_auth.map(|auth| match auth {
                ResetMgmtAuth::Key(key) => keyroost_transport::CurrentMgmtAuth::Key(key),
                ResetMgmtAuth::Pin(pin) => keyroost_transport::CurrentMgmtAuth::Pin(pin.as_bytes()),
            });
            keyroost_transport::PivSession::with_transaction(
                name,
                |s| -> Result<StepOutcome, TransportError> {
                    Ok(match s.factory_reset(current) {
                Ok(keyroost_transport::FactoryResetOutcome::Wiped) => StepOutcome::Wiped,
                // The device-wide mechanism ran cleanly -- more than just PIV
                // was wiped, so the report should say so rather than naming
                // only the applet that happened to trigger it.
                Ok(keyroost_transport::FactoryResetOutcome::WipedGlobal) => {
                    StepOutcome::WipedGlobal
                }
                // The device IS wiped -- only the courtesy XAUTH-key restore
                // (the device-wide mechanism's own follow-up) failed.
                // `WipedWithWarning`, not `Failed`: the wipe itself is done,
                // so this must count as wiped everywhere that's what's being
                // asked (the pane re-init below, the "N wiped" report), but
                // the restore failure is real and still needs its own line.
                Ok(keyroost_transport::FactoryResetOutcome::WipedKeyRestoreFailed) => {
                    StepOutcome::WipedWithWarning(
                        "restoring XAUTH key 1 to the factory-delivery value afterward failed \
                         \u{2014} it's left cleared instead. Set it manually (PIV \u{2192} \
                         Change management key) if you need it back."
                            .into(),
                    )
                }
                Err(
                    e @ (TransportError::PivResetUnsupported
                    | TransportError::PivResetNeedsManagementAuth),
                ) => StepOutcome::Skipped(e.to_string()),
                Err(e) => StepOutcome::Failed(piv_factory_reset_message(e)),
            })
                },
            )
            .map_err(|e: TransportError| e.to_string())
        })()
        .unwrap_or_else(StepOutcome::Failed);
    }

    let run = || -> Result<(), String> {
        match step {
            ResetStep::Oath => {
                let name = reader.ok_or("no PC/SC reader for the OATH applet")?;
                let mut s =
                    keyroost_transport::OathSession::open(name).map_err(|e| e.to_string())?;
                s.factory_reset().map_err(|e| e.to_string())?;
            }
            ResetStep::OpenPgp => {
                let name = reader.ok_or("no PC/SC reader for the OpenPGP applet")?;
                let mut s =
                    keyroost_transport::OpenPgpSession::open(name).map_err(|e| e.to_string())?;
                s.factory_reset().map_err(|e| e.to_string())?;
            }
            ResetStep::Piv => unreachable!("handled above, before this closure"),
            ResetStep::Token2Otp => {
                // The OTP applet lives on the FIDO HID node when present, else on
                // the PC/SC reader. Mirror the CLI's `HidThenReader` behavior:
                // try USB-HID first, and on an open failure fall back to the
                // SAME device's reader — some firmware botches the HID applet
                // probe while its CCID side works (#82). Without this fallback a
                // GUI factory reset reported OTP `Failed` where the CLI succeeds.
                let mut s = match (hid_path, reader) {
                    (Some(p), reader) => {
                        match keyroost_transport::Token2OtpSession::open_hid_path(p, false) {
                            Ok(s) => s,
                            Err(hid_err) => match reader {
                                Some(name) => {
                                    keyroost_transport::Token2OtpSession::open_pcsc_reader(
                                        name, false,
                                    )
                                    .map_err(|e| {
                                        format!(
                                            "USB-HID failed ({hid_err}); the same key's \
                                             reader also failed ({e})"
                                        )
                                    })?
                                }
                                None => return Err(hid_err.to_string()),
                            },
                        }
                    }
                    (None, Some(name)) => {
                        keyroost_transport::Token2OtpSession::open_pcsc_reader(name, false)
                            .map_err(|e| e.to_string())?
                    }
                    (None, None) => return Err("no transport for the OTP applet".to_string()),
                };
                s.erase_all().map_err(|e| e.to_string())?;
            }
            ResetStep::Fido => {}
        }
        Ok(())
    };
    match run() {
        Ok(()) => StepOutcome::Wiped,
        Err(e) => StepOutcome::Failed(e),
    }
}

/// Whether to render the Reset card *outside* the Settings subview: the key
/// is CTAP2 (so resettable) but not unlocked. authenticatorReset takes no
/// PIN, and its primary use case is recovering from a forgotten or blocked
/// PIN — the one state in which unlock is impossible — so hiding it behind
/// the unlock-gated tabs removed reset exactly when it was needed. Once
/// unlocked, the Settings tab owns the card and this stays false.
fn show_standalone_reset(unlocked: bool, info: Option<&AuthenticatorInfo>) -> bool {
    !unlocked && fido_settings_available(info)
}

/// The subview to actually render: the current pick when its tab is offered,
/// else the first offered tab. The pick persists across selection changes,
/// so switching from a key with a fingerprint sensor (or credential
/// management) to one without would otherwise leave the pane on a tab the
/// new key doesn't have.
fn snap_subview(current: FidoSubview, tabs: &[(FidoSubview, &str)]) -> FidoSubview {
    if tabs.iter().any(|(v, _)| *v == current) {
        current
    } else {
        tabs.first().map(|(v, _)| *v).unwrap_or_default()
    }
}

/// The capability tab to actually render: the current pick when `offered`
/// (the selected device's own `Device::tabs()`) still has it, else the
/// first offered tab, else `Overview` (`offered` empty — a Molto2 token,
/// which has no capability tabs at all). Same shape as [`snap_subview`], one
/// level up: a per-device remembered pick (`App::cap_tab_by_device`) can be
/// stale exactly the same way a persisted `FidoSubview` pick can — switching
/// from a key with PIV to one without would otherwise leave the pane on a
/// tab the new key doesn't have.
fn snap_cap_tab(current: CapTab, offered: &[CapTab]) -> CapTab {
    if offered.contains(&current) {
        current
    } else {
        offered.first().copied().unwrap_or_default()
    }
}

/// What getInfo says about PIN support. An absent `clientPin` option means
/// the key has no PIN feature at all (CTAP getInfo semantics) — a different
/// state from "getInfo not read yet", which the pane previously conflated
/// with it (PIN-less authenticators showed a permanent "Reading key…").
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
enum PinSupport {
    /// No getInfo yet (still loading, or the read failed).
    Unknown,
    /// The key does not support clientPin.
    Unsupported,
    /// clientPin supported, no PIN set yet.
    NotSet,
    /// A PIN is set.
    Set,
}

fn pin_support(info: Option<&AuthenticatorInfo>) -> PinSupport {
    match info {
        None => PinSupport::Unknown,
        Some(i) => match i.option("clientPin") {
            None => PinSupport::Unsupported,
            Some(false) => PinSupport::NotSet,
            Some(true) => PinSupport::Set,
        },
    }
}

/// Decide whether a freshly appeared FIDO HID device may receive an armed
/// reset. `target_*` describe the key the user armed; `cand_*` the device
/// that just appeared. Vendor/product ids must match when known, and then a
/// *stable* identity must match: the USB HID serial when both sides expose
/// one, else the resolver's effective (CCID-derived) serial. When neither
/// side offers a stable identity the answer is `false` — fail closed; being
/// the first same-model path to show up is not an identity (KEY-005).
fn reset_reinsert_matches(
    target_hid_serial: Option<&str>,
    target_effective_serial: Option<&str>,
    target_ids: Option<(u16, u16)>,
    cand_hid_serial: Option<&str>,
    cand_effective_serial: Option<&str>,
    cand_ids: (u16, u16),
) -> bool {
    if let Some(ids) = target_ids {
        if ids != cand_ids {
            return false;
        }
    }
    if let (Some(t), Some(c)) = (target_hid_serial, cand_hid_serial) {
        return t == c;
    }
    if let (Some(t), Some(c)) = (target_effective_serial, cand_effective_serial) {
        return t == c;
    }
    false
}

/// The password an OATH op should send: the freshly typed entry when there
/// is one, else the password retained from the last successful unlock of the
/// current selection (see `OathState::unlocked_password`). Falls back to
/// empty — correct for an unprotected applet.
fn oath_effective_password(oath: &OathState) -> zeroize::Zeroizing<String> {
    if !oath.password_input.is_empty() {
        return zeroize::Zeroizing::new(oath.password_input.clone());
    }
    oath.unlocked_password
        .clone()
        .unwrap_or_else(|| zeroize::Zeroizing::new(String::new()))
}

/// Purge egui's retained plaintext for a masked text widget.
///
/// egui keeps an undo history (`TextEditState.undoer`) holding real, unmasked
/// snapshots of everything typed into a field, for the whole process lifetime;
/// `.password(true)` only masks *display*. So wiping the caller's `String`
/// buffer is not enough — the secret is still recoverable from egui's own
/// memory until the undo history is cleared. This clears it. Safe to call every
/// frame and on a widget that was never typed into (it only touches that
/// widget's stored state, if any).
///
/// Limitation: egui's `clear_undoer` *replaces* the undoer, so the snapshot
/// `String`s are freed, not zeroized — the API gives no access to the stored
/// text, so the old bytes can linger in freed heap pages until reused. This
/// still removes the secret from egui's live, trivially-queryable state; it is
/// not (and cannot be, from outside egui) a memory-scrubbing guarantee.
fn clear_edit_undo(ctx: &egui::Context, id: egui::Id) {
    if let Some(mut state) = egui::TextEdit::load_state(ctx, id) {
        state.clear_undoer();
        egui::TextEdit::store_state(ctx, id, state);
    }
}

/// True when a text widget's retained undo state could still hold typed
/// plaintext, i.e. a scrub (`clear_edit_undo`) would actually remove
/// something. The probe is (default cursor, empty text): `has_undo` is false
/// only for an empty history or one whose single snapshot IS that empty
/// state — neither holds a secret. `has_redo` catches text typed and then
/// undone; `is_in_flux` catches text typed too recently to be committed.
fn edit_state_needs_scrub(state: &egui::text_edit::TextEditState) -> bool {
    let undoer = state.undoer();
    let probe = (egui::text::CCursorRange::default(), String::new());
    undoer.has_undo(&probe) || undoer.has_redo(&probe) || undoer.is_in_flux()
}

/// Draw-time guard for a secret field: while it isn't holding keyboard focus,
/// purge its undo history (see [`clear_edit_undo`]). Call immediately after
/// adding any `.password(true)` field, passing its [`egui::Response`].
///
/// This deliberately keys on `has_focus()` (a level) rather than
/// `lost_focus()` (an edge): a dialog dismissed while its field still has
/// focus (Esc, ✕ mid-typing) removes the widget before any lost-focus edge
/// can be observed, while its `TextEditState` — undo plaintext included —
/// persists for the process lifetime. The level-triggered form scrubs that
/// stale state on the reopened dialog's first unfocused frame, which the
/// edge form would miss. `edit_state_needs_scrub` skips the rewrite when the
/// history is provably empty, so the steady-state cost is one state load per
/// secret field per frame, no store.
fn guard_secret_field(ctx: &egui::Context, resp: &egui::Response) {
    if resp.has_focus() {
        return;
    }
    if let Some(state) = egui::TextEdit::load_state(ctx, resp.id) {
        if edit_state_needs_scrub(&state) {
            clear_edit_undo(ctx, resp.id);
        }
    }
}

/// The shared "Scan QR" button: a Default button with the QR glyph painted into
/// it. Returns `true` when clicked. Collapses the repeated
/// `button_with_icon` + `paint_qr_icon` block at every scan-QR call site.
#[cfg(feature = "qr")]
pub(crate) fn scan_qr_button(ui: &mut egui::Ui, p: &Palette) -> bool {
    let (resp, icon_center, fg) = theme::button_with_icon(ui, p, BtnKind::Default, "Scan QR", 14.0);
    paint_qr_icon(ui, icon_center, fg);
    resp.clicked()
}

/// Where an OpenPGP key import gets its key material. Mirrors the CLI's
/// `--generate` / `--in <FILE>` choice.
#[derive(Clone, Copy, PartialEq, Eq)]
enum ImportSource {
    /// Generate a fresh RSA-2048 key on the host.
    Generate,
    /// Load an RSA-2048 key from a file (PKCS#1/PKCS#8, PEM or DER).
    FromFile,
}

/// Which key slot a GUI generate targets. Mirrors the CLI's slot choice.
#[derive(Default, Clone, Copy, PartialEq, Eq)]
enum OpenPgpSlotSel {
    #[default]
    Sign,
    Decrypt,
    Auth,
}

impl OpenPgpSlotSel {
    fn to_crt(self) -> keyroost_transport::KeyCrt {
        match self {
            OpenPgpSlotSel::Sign => keyroost_transport::KeyCrt::Sign,
            OpenPgpSlotSel::Decrypt => keyroost_transport::KeyCrt::Decrypt,
            OpenPgpSlotSel::Auth => keyroost_transport::KeyCrt::Auth,
        }
    }
    fn label(self) -> &'static str {
        match self {
            OpenPgpSlotSel::Sign => "signature",
            OpenPgpSlotSel::Decrypt => "decryption",
            OpenPgpSlotSel::Auth => "authentication",
        }
    }
    /// Capitalized tab label for the sub-tab strip (mirrors PIV slot tabs).
    fn tab_label(self) -> &'static str {
        match self {
            OpenPgpSlotSel::Sign => "Signature",
            OpenPgpSlotSel::Decrypt => "Decryption",
            OpenPgpSlotSel::Auth => "Authentication",
        }
    }
    /// This key's raw algorithm attributes and fingerprint out of an
    /// `OpenPgpStatus`, so the per-key state line can read directly from the
    /// selected key.
    fn status_fields(self, st: &keyroost_transport::OpenPgpStatus) -> (&[u8], &[u8; 20]) {
        match self {
            OpenPgpSlotSel::Sign => (&st.sig_attrs, &st.fingerprint_sig),
            OpenPgpSlotSel::Decrypt => (&st.dec_attrs, &st.fingerprint_dec),
            OpenPgpSlotSel::Auth => (&st.aut_attrs, &st.fingerprint_aut),
        }
    }
}

/// OpenPGP key-generation algorithm selector: the slot's current algorithm
/// ("card default"), or an explicit one.
#[derive(Clone, Copy, Default, PartialEq, Eq, Debug)]
enum OpenPgpKeyAlgSel {
    #[default]
    CardDefault,
    Alg(keyroost_transport::OpenPgpKeyAlg),
}

impl OpenPgpKeyAlgSel {
    fn to_alg(self) -> Option<keyroost_transport::OpenPgpKeyAlg> {
        match self {
            OpenPgpKeyAlgSel::CardDefault => None,
            OpenPgpKeyAlgSel::Alg(a) => Some(a),
        }
    }
    fn label(self) -> &'static str {
        match self {
            OpenPgpKeyAlgSel::CardDefault => "Card default",
            OpenPgpKeyAlgSel::Alg(a) => a.label(),
        }
    }
    /// The menu for `crt`'s slot: what the card lists in its Algorithm
    /// Information when it publishes one for that slot, else every algorithm
    /// that fits the slot — unknown means offer the surface and let the card
    /// answer, never a vendor table.
    fn choices(
        supported: Option<&keyroost_transport::AlgorithmInformation>,
        crt: keyroost_transport::KeyCrt,
    ) -> Vec<OpenPgpKeyAlgSel> {
        let mut out = vec![OpenPgpKeyAlgSel::CardDefault];
        let listed = supported.map(|i| i.key_algs(crt)).unwrap_or_default();
        if !listed.is_empty() {
            out.extend(listed.into_iter().map(OpenPgpKeyAlgSel::Alg));
        } else {
            out.extend(
                keyroost_transport::OpenPgpKeyAlg::ALL
                    .into_iter()
                    .filter(|a| a.attributes(crt).is_ok())
                    .map(OpenPgpKeyAlgSel::Alg),
            );
        }
        out
    }
}

/// Which credential-entry flow the PIV modal is currently driving. The first
/// three map 1:1 to the PIN/PUK operations (`piv_change_pin` / `piv_change_puk`
/// / `piv_unblock_pin`); the rest are the management-key-gated operations whose
/// *secrets* (management key and/or PIN) now live in the modal while their
/// non-secret parameters (slot, algorithm, file path, subject, …) stay inline
/// in the pane. The variant selects which secret fields the modal renders and
/// which op Submit dispatches to.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum PivCredKind {
    ChangePin,
    ChangePuk,
    UnblockPin,
    GenerateKey,
    ImportCert,
    SelfSign,
    RequestCsr,
    SetRetries,
    ChangeMgmtKey,
    DeleteCert,
    DeleteKey,
    MoveKey,
    NewChuid,
    /// Run every key self-test the selected slot's algorithm supports
    /// (decrypt / key-agree / sign, in that order). The PIN field is always
    /// optional — it's the user's choice whether to test with or without a
    /// PIN; no management key, and nothing on the card changes.
    SelfTest,
}

impl PivCredKind {
    /// Modal title, matching the FIDO dialogs' title style.
    fn title(self) -> &'static str {
        match self {
            PivCredKind::ChangePin => "Change PIN",
            PivCredKind::ChangePuk => "Change PUK",
            PivCredKind::UnblockPin => "Unblock PIN",
            PivCredKind::GenerateKey => "Generate key",
            PivCredKind::ImportCert => "Import certificate",
            PivCredKind::SelfSign => "Self-signed certificate",
            PivCredKind::RequestCsr => "Sign certificate request",
            PivCredKind::SetRetries => "Set retry counts",
            PivCredKind::ChangeMgmtKey => "Change management key",
            PivCredKind::DeleteCert => "Delete certificate",
            PivCredKind::DeleteKey => "Delete key",
            PivCredKind::MoveKey => "Move key",
            PivCredKind::NewChuid => "New CHUID",
            PivCredKind::SelfTest => "Key self-test",
        }
    }
    /// Label for the modal's primary Submit button. Shorter than the title for
    /// the verbose flows so the button doesn't overflow.
    fn submit_label(self) -> &'static str {
        match self {
            PivCredKind::GenerateKey => "Generate",
            PivCredKind::ImportCert => "Import",
            PivCredKind::SelfSign => "Create",
            PivCredKind::RequestCsr => "Sign & save",
            PivCredKind::SetRetries => "Set retry counts",
            PivCredKind::ChangeMgmtKey => "Change key",
            PivCredKind::DeleteCert => "Delete",
            PivCredKind::DeleteKey => "Delete",
            PivCredKind::MoveKey => "Move",
            PivCredKind::NewChuid => "Write",
            PivCredKind::SelfTest => "Run",
            _ => self.title(),
        }
    }
    /// Spinner caption shown while this flow's op runs (matches the busy label
    /// the underlying `spawn_job` op uses).
    fn busy_label(self) -> &'static str {
        match self {
            PivCredKind::ChangePin => "Changing PIV PIN\u{2026}",
            PivCredKind::ChangePuk => "Changing PUK\u{2026}",
            PivCredKind::UnblockPin => "Unblocking PIN\u{2026}",
            PivCredKind::GenerateKey => "Generating key\u{2026}",
            PivCredKind::ImportCert => "Importing certificate\u{2026}",
            PivCredKind::SelfSign => "Creating certificate\u{2026}",
            PivCredKind::RequestCsr => "Signing request\u{2026}",
            PivCredKind::SetRetries => "Setting retry counts\u{2026}",
            PivCredKind::ChangeMgmtKey => "Changing management key\u{2026}",
            PivCredKind::DeleteCert => "Deleting certificate\u{2026}",
            PivCredKind::DeleteKey => "Deleting key\u{2026}",
            PivCredKind::MoveKey => "Moving key\u{2026}",
            PivCredKind::NewChuid => "Writing a new CHUID\u{2026}",
            PivCredKind::SelfTest => "Running self-test\u{2026}",
        }
    }
    /// True when this flow collects the *current* management key (and therefore
    /// shows the "Use default management key" convenience toggle).
    fn needs_mgmt_key(self) -> bool {
        matches!(
            self,
            PivCredKind::GenerateKey
                | PivCredKind::ImportCert
                | PivCredKind::SelfSign
                | PivCredKind::SetRetries
                | PivCredKind::ChangeMgmtKey
                | PivCredKind::DeleteCert
                | PivCredKind::DeleteKey
                | PivCredKind::MoveKey
                | PivCredKind::NewChuid
        )
    }
    /// True for a flow that already collects a PIN of its own further down in
    /// the modal — `SelfSign`'s signing PIN, `SetRetries`' current PIN — for a
    /// reason unrelated to management auth. PIV has exactly one application
    /// PIN, so when `use_pin` is set on one of these,
    /// `piv_modal_mgmt_field` doesn't render a second PIN box asking for the
    /// same value twice: the dedicated field's PIN is reused directly for
    /// management auth too, in [`App::piv_current_mgmt_auth`].
    fn shares_pin_field(self) -> bool {
        matches!(self, PivCredKind::SelfSign | PivCredKind::SetRetries)
    }
}

/// Live state of the PIV credential-entry modal. Open iff `PivState::cred_modal`
/// is `Some`. Tracks the flow, whether its op is in flight, and the op's result
/// so the outcome is shown *in the modal* (issue #31 — feedback must not scroll
/// off-screen). `result` is `None` until the op completes, then `Ok(())` on
/// success or `Err(message)` on failure.
struct PivCredModal {
    kind: PivCredKind,
    busy: bool,
    result: Option<Result<(), String>>,
    /// A multi-line report shown under the success line: the per-operation
    /// pass list from a `SelfTest` run that fully passed (a failing run puts
    /// its report in `result`'s `Err` instead), or how a certificate import /
    /// self-signed certificate was stored when it was stored compressed.
    detail: Option<String>,
}

impl PivCredModal {
    fn new(kind: PivCredKind) -> Self {
        PivCredModal {
            kind,
            busy: false,
            result: None,
            detail: None,
        }
    }
}

/// How the management-key modal's "Use default management key" / "Use PIN"
/// toggles are currently resolved — one canonical field instead of two
/// independent `bool`s, so the two checkboxes can't drift into an
/// inconsistent combination (each is a pure view onto, and setter of, this
/// single value: checking one sets it to that variant; unchecking either
/// always returns to [`Self::Manual`], never leaves the other variant
/// standing from a stale toggle). [`Self::Manual`] — neither box ticked —
/// means "read the typed hex from `PivState::mgmt_key_input`", the ordinary
/// case this whole type exists to make unambiguous.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
enum PivMgmtAuthMode {
    /// Neither toggle is ticked: `PivState::mgmt_key_input` holds a typed
    /// management-key hex string.
    #[default]
    Manual,
    /// "Use default management key": the well-known factory default.
    Default,
    /// "Use PIN": `keyroost_piv::compat::PivExtension::PinManagementAuth`
    /// instead of a management key — see [`App::piv_current_mgmt_auth`].
    Pin,
}

/// What `PivState::mgmt_auth_mode` should become after one of the modal's
/// two toggle checkboxes is clicked: `mode_if_checked` if the click checked
/// it, `PivMgmtAuthMode::Manual` if the click unchecked it — unconditionally,
/// regardless of which variant `mgmt_auth_mode` held before. Factored out of
/// `App::piv_modal_mgmt_field` so this rule is unit-testable without an egui
/// context; it's also the fix for a real reported bug where two independent
/// `bool`s (one per checkbox), each resetting the other on check but not
/// consulting it on uncheck, could leave `mgmt_auth_mode`-equivalent state
/// stuck on a stale toggle after check-then-switch-then-uncheck.
#[must_use]
fn piv_mgmt_mode_after_toggle(checked: bool, mode_if_checked: PivMgmtAuthMode) -> PivMgmtAuthMode {
    if checked {
        mode_if_checked
    } else {
        PivMgmtAuthMode::Manual
    }
}

/// State for the PIV pane: a status snapshot plus the entry fields for the full
/// management surface (PIN/PUK, management key, key generation, certificate
/// import/export, reset), keyed by the selected device's reader name.
struct PivState {
    /// Last status read from the selected card.
    status: Option<keyroost_transport::PivStatus>,
    /// Per-slot detail, in canonical slot order, from the single
    /// [`keyroost_transport::PivSession::status_detailed`] call each refresh
    /// makes: the key algorithm (GET METADATA where authoritative, else a key
    /// generated this app run, else the slot certificate's
    /// SubjectPublicKeyInfo; `None` means no key in the slot, on any PIV
    /// card), and the certificate's Subject DN (`None` if the slot has no
    /// certificate or its DN failed to parse — degraded silently). Split out
    /// of [`keyroost_transport::PivSlotDetail`] into the shape the pane draws.
    slot_keys: Vec<(
        keyroost_piv::Slot,
        Option<keyroost_piv::KeyAlg>,
        Option<String>,
    )>,
    /// Per-slot PIN/touch policy, from the same `status_detailed` call that
    /// fills `slot_keys` (GET METADATA's policy bytes on firmware 5.3+, else
    /// the ATTEST certificate's key-policy extension on older firmware).
    /// `None` per-slot means unavailable: no YubiKey-compatible extensions
    /// answered, not necessarily an empty slot.
    slot_policies: Vec<(
        keyroost_piv::Slot,
        Option<(keyroost_piv::PinPolicy, keyroost_piv::TouchPolicy)>,
    )>,
    /// User-facing error from the last read/write.
    error: Option<String>,
    /// Success/info line from the last write operation.
    notice: Option<String>,
    /// True once a status has been fetched for the current selection.
    loaded: bool,
    /// Management key (hex) entered to authorize key-gen / cert-import /
    /// set-retries / management-key change. Cleared after use. Doubles as
    /// the PIN input when [`Self::mgmt_auth_mode`] is
    /// [`PivMgmtAuthMode::Pin`] and the flow has no dedicated PIN field of
    /// its own (see [`PivCredKind::shares_pin_field`]) — the same field,
    /// its label and hint swapped, rather than a second box. Only actually
    /// read when [`Self::mgmt_auth_mode`] is [`PivMgmtAuthMode::Manual`] or
    /// [`PivMgmtAuthMode::Pin`] — see that type's doc.
    mgmt_key_input: String,
    /// The management-key modal's "Use default management key" / "Use PIN"
    /// toggle state — see [`PivMgmtAuthMode`]. Reset per modal.
    mgmt_auth_mode: PivMgmtAuthMode,
    /// Change-PIN old/new/confirm entries. Cleared after use.
    pin_old: String,
    pin_new: String,
    pin_confirm: String,
    /// Change-PUK old/new/confirm entries. Cleared after use.
    puk_old: String,
    puk_new: String,
    puk_confirm: String,
    /// Unblock-PIN: PUK + new PIN entries. Cleared after use.
    unblock_puk: String,
    unblock_new_pin: String,
    /// PIN/PUK retry counts for set-retries, and the PIN that authorizes it.
    retries_pin: u8,
    retries_puk: u8,
    retries_pin_auth: String,
    /// The slot every key/certificate action targets. Chosen once by clicking a
    /// row in the status card (issue #31): the "Keys & certificates" section is
    /// slot-first now, so Generate / Create cert / Import / Export / Delete all
    /// act on this single selection instead of each carrying its own dropdown.
    selected_slot: PivSlotSel,
    /// Key-generation algorithm selector.
    gen_alg: keyroost_piv::KeyAlg,
    /// PIN/touch policy selectors in the Generate key modal. `Default`/
    /// `Default` (the initial selection) sends the plain PIV GENERATE
    /// ASYMMETRIC KEY PAIR APDU, with no policy tags, which is what every PIV
    /// card accepts; selecting anything else appends the Yubico extended
    /// policy tags (0xAA/0xAB), which only a YubiKey or compatible token
    /// honors. Reset per modal open.
    gen_pin_policy: keyroost_piv::PinPolicy,
    gen_touch_policy: keyroost_piv::TouchPolicy,
    /// Compression choice in the Import certificate and Self-signed
    /// certificate dialogs (the CLI's `--compress` / `--no-compress`).
    /// Reset to Automatic per modal open.
    cert_compression: PivCertCompressionSel,
    /// Certificate import file path.
    cert_path: String,
    /// Certificate export destination path.
    export_path: String,
    /// New management key (hex) + algorithm for a management-key rotation.
    new_mgmt_key_input: String,
    new_mgmt_alg: PivMgmtAlgSel,
    /// "Allow PIN unlock" checkbox in the management-key rotation dialog —
    /// whether the new key should also be stored PIN-protected (Yubico's
    /// `PivExtension::PinManagementAuth`; see
    /// `keyroost_transport::PivSession::set_management_key_pin_protected`).
    /// Reset to `false` per dialog open, same as `new_mgmt_key_input`; the
    /// row rendering this forces it to (effectively) `true` and disables
    /// editing on HID Crescendo, which unlocks management off the PIN
    /// already, with nothing to toggle — see the "Management key" row's own
    /// comment.
    new_mgmt_allow_pin_unlock: bool,
    /// Certificate creation: subject (bare name or full DN), validity, the PIN
    /// that authorizes the on-card signature, and the CSR destination.
    cert_subject: String,
    /// Validity period, entered as three counts that sum — years applied
    /// first, then months relative to that point, then a flat day count —
    /// fed to [`keyroost_piv::add_calendar_period`]. Mirrors `keyroostctl
    /// piv self-sign`'s combinable `--years`/`--months`/`--days` exactly.
    cert_valid_years: u32,
    cert_valid_months: u32,
    cert_valid_days: u32,
    sign_pin: String,
    csr_path: String,
    /// New CHUID: validity, same three-field shape and default as
    /// `cert_valid_years`/`cert_valid_months`/`cert_valid_days`, fed to
    /// [`keyroost_piv::add_calendar_period`] +
    /// [`keyroost_piv::yyyymmdd_from_unix_secs`].
    chuid_valid_years: u32,
    chuid_valid_months: u32,
    chuid_valid_days: u32,
    /// New CHUID: the GUID input, hex (canonical `8-4-4-4-12` dashed form as
    /// pre-filled, but [`keyroost_piv::parse_guid_hex`] accepts plain hex
    /// too). Pre-filled with a fresh [`keyroost_transport::random_chuid_guid`]
    /// each time the dialog opens, refreshable there, and editable so the
    /// user can substitute their own.
    chuid_guid: String,
    /// Reset confirmation modal: typed-`reset` text (modal open iff `Some`).
    confirm_reset: Option<String>,
    /// True from the moment any PIV device job — status read, PIN/PUK/
    /// management-key change, key generate/import/delete/move, self-test,
    /// self-sign/CSR, CHUID write, reset, ... — queues via `spawn_piv_job`
    /// until that job's apply closure runs. The pane reads this once,
    /// wrapping everything except the slot tab strip (and the retired-slot
    /// rail) in a single `add_enabled_ui` (see `cap_piv`) — disabling every
    /// button/field in the applet-wide and per-slot cards for the duration
    /// without hooking into each one individually, while scrolling and slot
    /// selection stay live. Not `self.busy()`: that flips true for *any*
    /// queued job app-wide (an unrelated OATH or FIDO action among them),
    /// which would dim the PIV pane over device work that has nothing to do
    /// with the PIV applet.
    inflight: bool,
    /// Credential-entry modal for PIN/PUK changes + unblock (open iff `Some`).
    /// The PIN/PUK secret fields above render *inside* this modal, not inline in
    /// the pane, so the entry and its result stay on-screen (issue #31).
    cred_modal: Option<PivCredModal>,
    /// Chosen destination slot for the Move-key flow (empty until the user picks
    /// one in the modal's destination combo). Reset when the modal closes.
    move_dest: Option<keyroost_piv::Slot>,
    /// Lazily-read occupancy of the 20 retired slots (`slot -> has_key`), cached
    /// so expanding the section only probes the card once. `None` until read;
    /// invalidated after a move so the section re-reads on its next expand.
    retired_occupancy: Option<Vec<(keyroost_piv::Slot, bool)>>,
}

// The pane is replaced wholesale on device switch (`self.piv =
// PivState::default()`); wiping on drop means the discarded fields don't
// leave PINs/keys in freed memory.
impl Drop for PivState {
    fn drop(&mut self) {
        wipe(&mut self.mgmt_key_input);
        self.mgmt_auth_mode = PivMgmtAuthMode::default();
        wipe(&mut self.pin_old);
        wipe(&mut self.pin_new);
        wipe(&mut self.pin_confirm);
        wipe(&mut self.puk_old);
        wipe(&mut self.puk_new);
        wipe(&mut self.puk_confirm);
        wipe(&mut self.unblock_puk);
        wipe(&mut self.unblock_new_pin);
        wipe(&mut self.retries_pin_auth);
        wipe(&mut self.new_mgmt_key_input);
        wipe(&mut self.sign_pin);
    }
}

impl Default for PivState {
    fn default() -> Self {
        PivState {
            status: None,
            slot_keys: Vec::new(),
            slot_policies: Vec::new(),
            error: None,
            notice: None,
            loaded: false,
            mgmt_key_input: String::new(),
            mgmt_auth_mode: PivMgmtAuthMode::default(),
            pin_old: String::new(),
            pin_new: String::new(),
            pin_confirm: String::new(),
            puk_old: String::new(),
            puk_new: String::new(),
            puk_confirm: String::new(),
            unblock_puk: String::new(),
            unblock_new_pin: String::new(),
            retries_pin: 3,
            retries_puk: 3,
            retries_pin_auth: String::new(),
            selected_slot: PivSlotSel::default(),
            gen_alg: keyroost_piv::KeyAlg::EccP256,
            gen_pin_policy: keyroost_piv::PinPolicy::Default,
            gen_touch_policy: keyroost_piv::TouchPolicy::Default,
            cert_compression: PivCertCompressionSel::Auto,
            cert_path: String::new(),
            export_path: String::new(),
            new_mgmt_key_input: String::new(),
            new_mgmt_alg: PivMgmtAlgSel::default(),
            new_mgmt_allow_pin_unlock: false,
            cert_subject: String::new(),
            cert_valid_years: 1,
            cert_valid_months: 0,
            cert_valid_days: 0,
            sign_pin: String::new(),
            csr_path: String::new(),
            chuid_valid_years: 1,
            chuid_valid_months: 0,
            chuid_valid_days: 0,
            chuid_guid: keyroost_transport::random_chuid_guid()
                .map(|g| keyroost_piv::format_guid(&g))
                .unwrap_or_default(),
            confirm_reset: None,
            inflight: false,
            cred_modal: None,
            move_dest: None,
            retired_occupancy: None,
        }
    }
}

/// PIV key-slot selector for the GUI controls.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
enum PivSlotSel {
    #[default]
    Auth,
    Sign,
    KeyMgmt,
    CardAuth,
    /// A Yubico retired key-management slot (n = 1..=20), selectable from the
    /// collapsible "Retired slots" section.
    Retired(u8),
}

impl PivSlotSel {
    fn to_slot(self) -> keyroost_piv::Slot {
        match self {
            PivSlotSel::Auth => keyroost_piv::Slot::Authentication,
            PivSlotSel::Sign => keyroost_piv::Slot::Signature,
            PivSlotSel::KeyMgmt => keyroost_piv::Slot::KeyManagement,
            PivSlotSel::CardAuth => keyroost_piv::Slot::CardAuthentication,
            PivSlotSel::Retired(n) => {
                keyroost_piv::Slot::retired(n).expect("PivSlotSel::Retired always holds 1..=20")
            }
        }
    }
    fn label(self) -> String {
        self.to_slot().label()
    }
}

/// The Compression dropdown in the Import certificate and Self-signed
/// certificate dialogs. Mirrors the CLI: Automatic = neither flag, Always =
/// `--compress`, Never = `--no-compress`.
#[derive(Clone, Copy, Default, Debug, PartialEq, Eq)]
enum PivCertCompressionSel {
    #[default]
    Auto,
    Always,
    Never,
}

impl PivCertCompressionSel {
    const ALL: [PivCertCompressionSel; 3] = [
        PivCertCompressionSel::Auto,
        PivCertCompressionSel::Always,
        PivCertCompressionSel::Never,
    ];
    fn label(self) -> &'static str {
        match self {
            PivCertCompressionSel::Auto => "Automatic (only if too large)",
            PivCertCompressionSel::Always => "Always",
            PivCertCompressionSel::Never => "Never",
        }
    }
    fn to_compression(self) -> keyroost_transport::CertCompression {
        use keyroost_transport::CertCompression;
        match self {
            PivCertCompressionSel::Auto => CertCompression::Auto,
            PivCertCompressionSel::Always => CertCompression::Always,
            PivCertCompressionSel::Never => CertCompression::Never,
        }
    }
}

/// Shown when Automatic compression had to store a certificate compressed;
/// the same note the CLI prints.
const PIV_AUTO_COMPRESSED_NOTE: &str = "The certificate did not fit on the card \
    uncompressed, so it was stored compressed (the PIV standard's gzip form). Most PIV \
    software reads compressed certificates, including Windows' built-in smart-card \
    driver in a community test; macOS's built-in PIV support has not been verified.";

/// The pane notice after a certificate was stored: `base`, the stored size
/// when compressed, and the Automatic note when that is why it was.
fn piv_cert_stored_notice(
    base: &str,
    compressed: bool,
    stored_len: usize,
    auto_compressed: bool,
) -> String {
    let mut s = base.to_owned();
    if compressed {
        s.push_str(&format!(
            " (stored compressed: {stored_len} bytes on the card)"
        ));
    }
    s.push('.');
    if auto_compressed {
        s.push(' ');
        s.push_str(PIV_AUTO_COMPRESSED_NOTE);
    }
    s
}

/// The dialog's success detail for a certificate stored compressed (one
/// line per paragraph); `None` when it was stored uncompressed.
fn piv_cert_stored_detail(
    compressed: bool,
    stored_len: usize,
    auto_compressed: bool,
) -> Option<String> {
    compressed.then(|| {
        let mut s = format!("Stored compressed: {stored_len} bytes on the card.");
        if auto_compressed {
            s.push('\n');
            s.push_str(PIV_AUTO_COMPRESSED_NOTE);
        }
        s
    })
}

/// With Compression set to Never, what to add to a "too large" refusal so
/// the user knows the dropdown can make it fit. `None` otherwise.
fn piv_cert_error_hint(e: &TransportError, choice: PivCertCompressionSel) -> Option<&'static str> {
    match e {
        TransportError::PivCertTooLarge {
            compressed_len: None,
            ..
        } if choice == PivCertCompressionSel::Never => {
            Some(" (set Compression to Automatic or Always)")
        }
        _ => None,
    }
}

/// The selected slot's state words: whether it holds a certificate (and
/// whether that is stored compressed or unreadable) or just a key, with the
/// key algorithm parenthesized after the state word it describes.
fn piv_slot_state_text(
    cert_unreadable: Option<keyroost_transport::CertUnreadable>,
    cert_present: bool,
    cert_compressed: bool,
    alg: Option<keyroost_piv::KeyAlg>,
) -> String {
    // "key present" and "certificate present" both get the algorithm
    // parenthesized right after the state word they describe — for the
    // no-certificate case that's "key present (…), no certificate", not
    // "…, no certificate (…)": the algorithm belongs to the key, and
    // there's no certificate for it to trail.
    match (cert_unreadable, cert_present, alg) {
        // A certificate is there but won't decode: say so, rather than
        // "empty", which would invite overwriting it unawares.
        (Some(reason), _, _) => format!("certificate present but unreadable ({reason})"),
        (None, true, alg) => {
            let parts: Vec<&str> = alg
                .map(keyroost_piv::KeyAlg::label)
                .into_iter()
                .chain(cert_compressed.then_some("compressed"))
                .collect();
            if parts.is_empty() {
                "certificate present".to_string()
            } else {
                format!("certificate present ({})", parts.join(", "))
            }
        }
        (None, false, Some(a)) => format!("key present ({}), no certificate", a.label()),
        (None, false, None) => "empty".to_string(),
    }
}

/// A PIV certificate-compression picker combo.
fn piv_cert_compression_combo(ui: &mut egui::Ui, id: &str, sel: &mut PivCertCompressionSel) {
    egui::ComboBox::from_id_salt(id)
        .selected_text(sel.label())
        .show_ui(ui, |ui| {
            for opt in PivCertCompressionSel::ALL {
                ui.selectable_value(sel, opt, opt.label());
            }
        });
}

// PIV key-generation algorithm selection uses `keyroost_piv::KeyAlg` directly
// (see `gen_alg` below) rather than a GUI-only wrapper enum — same pattern
// `gen_pin_policy`/`gen_touch_policy` already use for their domain types.
// `KeyAlg::ALL` lists every candidate for the combo
// (`piv_keyalg_combo`); which ones are actually selectable on the live device
// is a per-algorithm `keyroost_piv::compat::PivExtension::SlotKeyAlgorithm`
// gate, resolved where the combo is drawn, not baked into the selector type.

/// PIV management-key algorithm selector (for rotation). [`Self::Delete`] is
/// not an algorithm at all — HID Crescendo's ACA-only "management key" (see
/// [`keyroost_transport::CurrentMgmtAuth`]'s doc) can be deleted outright
/// instead of replaced, unlike a standard PIV management key, which is
/// mandatory — but it's still always offered, last, in [`Self::ALL`], on
/// every device, not only HID Crescendo: which options are actually
/// *selectable* on the live device is a per-choice
/// `keyroost_piv::compat::PivExtension::ManagementKeyAlgorithm` gate,
/// resolved where the combo is drawn (see `cap_piv`) and rendered as a
/// disabled entry rather than an omitted one — same split between "offered
/// set" and "live gate" that `KeyAlg`/`piv_keyalg_combo` already use for the
/// slot key-algorithm picker.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
enum PivMgmtAlgSel {
    #[default]
    Aes192,
    Aes128,
    Aes256,
    TripleDes,
    Delete,
}

impl PivMgmtAlgSel {
    /// `None` for [`Self::Delete`] — see this type's doc.
    fn to_alg(self) -> Option<keyroost_piv::MgmtAlg> {
        use keyroost_piv::MgmtAlg::*;
        match self {
            PivMgmtAlgSel::Aes192 => Some(Aes192),
            PivMgmtAlgSel::Aes128 => Some(Aes128),
            PivMgmtAlgSel::Aes256 => Some(Aes256),
            PivMgmtAlgSel::TripleDes => Some(TripleDes),
            PivMgmtAlgSel::Delete => None,
        }
    }
    /// This choice as a `keyroost_piv::compat::MgmtAlgChoice` — the argument
    /// [`keyroost_piv::compat::PivExtension::ManagementKeyAlgorithm`] gates on.
    /// A 1:1 mapping (unlike [`Self::to_alg`], `MgmtAlgChoice` has its own
    /// [`Self::Delete`]-equivalent variant, so this never returns `Option`).
    fn to_choice(self) -> keyroost_piv::compat::MgmtAlgChoice {
        use keyroost_piv::compat::MgmtAlgChoice;
        match self {
            PivMgmtAlgSel::Aes192 => MgmtAlgChoice::Aes192,
            PivMgmtAlgSel::Aes128 => MgmtAlgChoice::Aes128,
            PivMgmtAlgSel::Aes256 => MgmtAlgChoice::Aes256,
            PivMgmtAlgSel::TripleDes => MgmtAlgChoice::TripleDes,
            PivMgmtAlgSel::Delete => MgmtAlgChoice::Delete,
        }
    }
    fn label(self) -> &'static str {
        match self {
            PivMgmtAlgSel::Delete => "Delete",
            other => other
                .to_alg()
                .expect("every non-Delete variant has an algorithm")
                .label(),
        }
    }
    /// Every candidate for the management-key algorithm combo, in menu order
    /// — alphabetical by [`Self::label`] (`"3DES"`, `"AES-128"`, `"AES-192"`,
    /// `"AES-256"`), with [`Self::Delete`] last: it isn't a real algorithm
    /// name to sort alongside the rest (see this type's own doc), and
    /// `"Delete"` happens to sort after all four anyway. Offered identically
    /// on every device, standard PIV or HID Crescendo alike: which entries
    /// actually resolve selectable there is a live
    /// `keyroost_piv::compat::PivExtension::ManagementKeyAlgorithm` gate per
    /// candidate (see this type's own doc), not a difference in which
    /// candidates are listed. A standard device's mandatory management key
    /// has no delete mechanism keyroost implements, so `Delete` renders
    /// disabled there; HID Crescendo's ACA XAUTH key can be removed outright
    /// ([`keyroost_piv::fingerprint::hid_crescendo_aca_put_xauth_key_remove`]),
    /// so it's selectable there — same "list every candidate, gate each one
    /// live" shape `keyroost_piv::KeyAlg::ALL`/[`piv_keyalg_combo`] already
    /// use for the slot key-algorithm picker.
    ///
    /// Note `Self::ALL[0]` (`TripleDes`) is *not* [`Self::default`] (`Aes192`)
    /// — unlike before this was alphabetized, the two are no longer the same
    /// entry; see [`piv_mgmtalg_unsupported_fallback`]'s doc for where that
    /// used to matter.
    const ALL: [PivMgmtAlgSel; 5] = [
        PivMgmtAlgSel::TripleDes,
        PivMgmtAlgSel::Aes128,
        PivMgmtAlgSel::Aes192,
        PivMgmtAlgSel::Aes256,
        PivMgmtAlgSel::Delete,
    ];
}

/// A unit of work applied back to the [`App`] on the UI thread once a background
/// job finishes. Returned by the job closure and run inside `update()`.
type ApplyFn = Box<dyn FnOnce(&mut App) + Send>;
/// A background job: blocking device I/O that yields an [`ApplyFn`].
type Job = Box<dyn FnOnce() -> ApplyFn + Send>;

/// A single background worker thread. Device calls (CTAP / OATH over PC/SC) can
/// block for seconds — a touch-required credential or a 30s Reset window — so we
/// run them off the egui frame thread and apply their results back on the UI
/// thread. One thread keeps device access serialized (no concurrent card I/O).
struct Worker {
    job_tx: std::sync::mpsc::Sender<Job>,
    result_rx: std::sync::mpsc::Receiver<ApplyFn>,
}

impl Worker {
    /// `apdu_trace`: shared with the "APDU trace" checkbox in the activity
    /// log pane (see `App::activity_log`), read fresh at the start of every
    /// job rather than fixed at spawn time, so toggling it takes effect on
    /// the very next device operation. When on for a given job, that job's
    /// APDU trace is captured (see `keyroost_transport::trace`) and handed to
    /// its apply closure via `App::pending_trace`, for the next `log`/`log_bg`
    /// call inside it to attach. One capture per job — this thread runs jobs
    /// one at a time, start to finish, so "everything recorded between begin
    /// and take" is exactly "everything this job's device I/O did".
    fn spawn(
        ctx: egui::Context,
        apdu_trace: std::sync::Arc<std::sync::atomic::AtomicBool>,
    ) -> Self {
        let (job_tx, job_rx) = std::sync::mpsc::channel::<Job>();
        let (result_tx, result_rx) = std::sync::mpsc::channel::<ApplyFn>();
        std::thread::Builder::new()
            .name("keyroost-worker".into())
            .spawn(move || {
                while let Ok(job) = job_rx.recv() {
                    let debug = apdu_trace.load(std::sync::atomic::Ordering::Relaxed);
                    if debug {
                        keyroost_transport::trace::begin();
                    }
                    // A panicking job must not kill the worker: that would
                    // disconnect the result channel and wedge the busy guard
                    // (spawn_job would reject every future job forever). Catch
                    // it and deliver an error apply instead, so the frame loop
                    // still clears the busy bookkeeping and the thread lives on.
                    let apply = match std::panic::catch_unwind(std::panic::AssertUnwindSafe(job)) {
                        Ok(apply) => apply,
                        Err(_) => Box::new(|app: &mut App| {
                            app.log(
                                Severity::Err,
                                "a background device operation panicked and was aborted; \
                                 re-plug the key if it stops responding",
                            );
                        }) as ApplyFn,
                    };
                    let apply = match debug.then(keyroost_transport::trace::take).flatten() {
                        Some(trace) if !trace.is_empty() => Box::new(move |app: &mut App| {
                            app.pending_trace = Some(trace);
                            apply(app);
                            app.pending_trace = None; // in case `apply` never logged
                        }) as ApplyFn,
                        _ => apply,
                    };
                    if result_tx.send(apply).is_err() {
                        break; // UI gone
                    }
                    ctx.request_repaint(); // wake the frame loop to apply it
                }
            })
            .expect("spawn worker thread");
        Worker { job_tx, result_rx }
    }
}

fn main() -> eframe::Result<()> {
    // KEYROOST_X11=1 forces the GUI onto X11/XWayland instead of native Wayland.
    // On some compositors — observed on KDE Plasma 6.7 / KWin (issue #48) — the
    // native Wayland window loses focus shortly after startup and then stops
    // receiving keyboard/text/IME events, while the same binary works under
    // XWayland. winit selects the Wayland backend whenever WAYLAND_DISPLAY is
    // set, so clearing it for our own process makes winit fall back to X11
    // (XWayland provides DISPLAY) — the same effect as launching with
    // `env -u WAYLAND_DISPLAY keyroost`, without pulling in a direct winit
    // dependency. No-op when Wayland wasn't in use. Done before any thread is
    // spawned (the worker starts inside run_native), so the env edit is safe.
    if std::env::var_os("KEYROOST_X11").is_some() {
        std::env::remove_var("WAYLAND_DISPLAY");
    }

    // Backs the "APDU trace" checkbox in the activity log pane (see
    // `App::activity_log`): shared with the worker thread so a toggle takes
    // effect on the very next device operation, off by default. Not a CLI
    // flag — this is a runtime setting the user flips from the pane, not
    // something decided once at launch.
    let apdu_trace = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));

    let options = eframe::NativeOptions {
        viewport: egui::ViewportBuilder::default()
            .with_inner_size([1180.0, 760.0])
            .with_min_inner_size([900.0, 560.0])
            .with_title("keyroost"),
        ..Default::default()
    };
    eframe::run_native(
        "keyroost",
        options,
        Box::new(|cc| {
            // Register IBM Plex Sans + JetBrains Mono so the redesign's type
            // weights resolve. (Vendored under assets/.)
            theme::install_fonts(&cc.egui_ctx);
            // Restore the persisted UI preferences (theme mode + accent +
            // colorblind + zoom) from our own settings.json, defaulting to the
            // refined dark + blue accent the prototype ships with. eframe's own
            // storage is off in this crate (no `persistence` feature), so
            // `App::save()` never fires — `settings::Settings` carries the
            // persistence instead. A missing/corrupt file yields defaults.
            let saved = Settings::load();
            let mode: Mode = saved.mode.into();
            // Clamp the accent index against the live accent count in case the
            // file predates an accent being removed.
            let accent_idx = saved.accent.min(Palette::ACCENTS.len() - 1);
            let colorblind = saved.colorblind;
            // `Settings::load` already clamps zoom; clamp again defensively.
            let zoom = theme::clamp_zoom(saved.zoom);
            Palette::new(mode, Palette::ACCENTS[accent_idx], colorblind).apply(&cc.egui_ctx, mode);
            // Watch for reader hotplug so already-plugged-in or newly-inserted
            // devices appear without a manual Refresh. The watcher only flags a
            // shared bit and wakes the frame loop; `update()` does the rescan.
            let devices_dirty = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
            let reader_watch = {
                let dirty = devices_dirty.clone();
                let egui_ctx = cc.egui_ctx.clone();
                keyroost_transport::ReaderWatcher::spawn(move || {
                    dirty.store(true, std::sync::atomic::Ordering::Relaxed);
                    egui_ctx.request_repaint();
                })
            };
            let app = App {
                mode,
                accent_idx,
                colorblind,
                zoom,
                // Seed the persistence baseline with exactly what we loaded so
                // the first `persist_settings()` doesn't re-write an unchanged
                // file. The sanitized values (clamped zoom / accent) are what we
                // actually hold, so record those.
                last_saved_settings: Some(Settings {
                    zoom,
                    mode: mode.into(),
                    accent: accent_idx,
                    colorblind,
                }),
                worker: Some(Worker::spawn(cc.egui_ctx.clone(), apdu_trace.clone())),
                egui_ctx: Some(cc.egui_ctx.clone()),
                devices_dirty,
                reader_watch: Some(reader_watch),
                mds: ui::mds::MdsDb::load_bundled(),
                apdu_trace,
                ..Default::default()
            };
            Ok(Box::new(app))
        }),
    )
}

#[derive(Default)]
struct App {
    /// Active PC/SC session, if any.
    session: Option<Session>,
    /// The device id `session` was opened for. A mutating op may only take
    /// the session while this still matches `selected_device` (KEY-004): the
    /// apply closures of Molto ops hand the session back unconditionally, so
    /// the binding — not the `Option` — is what keeps a session opened for
    /// key A from serving actions the user aims at key B.
    molto_session_device: Option<DeviceId>,
    /// Last device info read.
    info: Option<DeviceInfo>,
    /// Whether the session has been authenticated.
    authenticated: bool,
    /// Active single-profile programmable-token session, if any.
    prog_session: Option<keyroost_transport::Token2ProgSession>,
    /// Last programmable-token info read (serial + on-device UTC time).
    prog_info: Option<keyroost_token2prog::Info>,
    /// Whether the programmable-token session has been authenticated.
    prog_authenticated: bool,
    /// Form state for programming the prog token (seed + config inputs).
    /// `Zeroizing` so the typed seed is scrubbed on drop, matching the OTP
    /// dialogs' Drop-wipe (and it is also wiped on a successful burn).
    prog_seed_input: zeroize::Zeroizing<String>,
    prog_seed_hex: bool,
    prog_algo_sha256: bool,
    prog_step_60: bool,
    prog_timeout_idx: usize,
    /// Last burn result for the prog pane: (success, message). Shown inline.
    prog_status: Option<(bool, String)>,
    /// Per-field "show secret" toggles for password inputs, keyed by a stable
    /// id. Absent = masked (the default).
    secret_reveal: std::collections::HashMap<&'static str, bool>,
    /// Customer key text the user typed.
    customer_key_input: String,
    /// Treat customer_key_input as hex vs ASCII.
    customer_key_hex: bool,
    /// Currently selected Molto2 profile slot (0..PROFILES-1).
    slot: u8,
    /// Per-slot public blocks (title / occupancy / config) from the sweep
    /// that runs when the device is opened. `None` until the sweep has
    /// succeeded — the slot list then degrades to bare slot numbers.
    /// Indexed by slot; always 100 entries when `Some`.
    slot_meta: Option<Vec<ProfilePublicData>>,
    /// Draft of the form fields for `selected` (per-slot; cleared on slot switch).
    draft: Draft,
    /// Rolling log of operations (newest last).
    log: Vec<LogLine>,
    /// Backs the "APDU trace" checkbox in the activity log pane. Shared with
    /// the worker thread (see `Worker::spawn`), which reads it fresh at the
    /// start of every job — toggling the checkbox takes effect on the very
    /// next device operation, not just future app runs.
    apdu_trace: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// The APDU trace captured for the job whose result is being applied
    /// right now, if the checkbox was on and that job recorded anything.
    /// Consumed (and cleared) by the first `log`/`log_bg` call in the apply closure;
    /// `Worker::spawn` also clears it after the apply closure returns, so it
    /// never bleeds into an unrelated, later log line.
    pending_trace: Option<Vec<String>>,
    /// otpauth:// import dialog state.
    import_dialog: ImportDialog,
    /// Bulk-import dialog state.
    bulk_dialog: BulkDialog,
    /// Unified device list (physical keys + Molto2 tokens), most recent scan.
    devices: Vec<Device>,
    /// Selected device id — stable across refreshes so the pane doesn't jump
    /// when an *unrelated* key is plugged or unplugged.
    selected_device: Option<DeviceId>,
    /// Which capability pane is showing for the selected key.
    cap_tab: CapTab,
    /// Each device's own last-shown `cap_tab`, so switching to another
    /// device's tab and back doesn't reset the pane to Overview — only the
    /// *currently* selected device's pick lives in `cap_tab` at any moment;
    /// `on_device_selected` is what moves the outgoing device's pick in here
    /// and restores the incoming device's. A pick that's stale for its
    /// device (the device no longer offers that tab) is corrected at render
    /// time by `snap_cap_tab`, the same way `security_keys.subview` already
    /// self-heals for FIDO's own sub-tabs — so entries here are never
    /// pruned on device disappearance the way `piv_session_state` is: an
    /// invalid entry is harmless, `snap_cap_tab` just falls through it.
    cap_tab_by_device: std::collections::HashMap<DeviceId, CapTab>,
    /// Error from the last device enumeration, surfaced in the sidebar.
    devices_error: Option<String>,
    /// When set: the OTP code we placed on the clipboard and the time
    /// (now_secs_f64 epoch) to clear it — codes shouldn't sit in
    /// clipboard-manager history forever. Cleared conditionally: only if the
    /// clipboard still holds that exact code.
    clipboard_clear_at: Option<(String, f64)>,
    /// True once the first automatic device scan has been kicked off.
    scanned: bool,
    /// Sidebar filter text (filters the visible device list by vendor/model).
    filter: String,
    /// FIDO security-key view state (CTAP info, PIN session, errors).
    security_keys: SecurityKeysState,
    /// FIDO Metadata Service database (bundled, plus any refreshed download).
    mds: ui::mds::MdsDb,
    /// Cached icon texture for the selected device's AAGUID, with the AAGUID it
    /// was decoded for so we re-upload only when the device changes.
    mds_icon: Option<(String, egui::TextureHandle)>,
    /// Last TOTP window index seen while the On-device OTP tab was showing live
    /// codes. When the window rolls over, the codes have expired, so the pane
    /// auto-reloads. `None` until first observed.
    otp_last_window: Option<u64>,
    /// OATH (TOTP) view state.
    oath: OathState,
    /// OpenPGP view state.
    openpgp: OpenPgpState,
    /// PIV read-only status view state.
    piv: PivState,
    /// Per-device cache of [`keyroost_transport::PivSessionState`] — the
    /// applet identity, applet-specific byte cache, and in-session public-
    /// key cache a `PivSession` would otherwise have to re-resolve from
    /// scratch every single action (sessions are opened fresh per action,
    /// never kept alive across them). Every PIV action reads its device's
    /// entry (or an empty default, the first time) before spawning its job,
    /// hands it to `PivSession::with_cached_transaction`, and — once the job's session is
    /// done with whatever it went on to do — stores `PivSession::state()`
    /// back here, so the *next* action on the same device gets to skip
    /// re-probing identity, and the public-key cache (bridging "generate" to
    /// a later "sign a CSR with it" on cards without GET METADATA) survives
    /// switching to another device's tab and back, which it did not before
    /// this map existed. `with_cached_transaction`'s own validation (PC/SC presence
    /// bookkeeping, ATR, raw SELECT response) is what makes trusting a
    /// carried-over entry safe even though the physical card in a reader can
    /// change between two actions — see that method's doc. Keyed by
    /// [`DeviceId`], not reader name: pruned in lockstep with `devices`
    /// wherever a device disappears, so an unplugged key's cached identity
    /// doesn't linger indefinitely.
    piv_session_state: std::collections::HashMap<DeviceId, keyroost_transport::PivSessionState>,
    /// Keys the user chose to "ignore the compatibility table" for, this app
    /// run only (never persisted): features the table lists as unsupported
    /// become unverified — usable, with a warning — except RESET. Applied to
    /// every PIV session for the key via `piv_cached_piv_session_state`, and
    /// to the pane's own gates via `piv_gate`. The GUI's counterpart of the
    /// CLI's per-command `--force`.
    piv_compat_ignored: std::collections::HashSet<DeviceId>,
    /// Token2 on-device OTP (TOTP/HOTP) view state.
    otp: OtpState,
    /// Dark / light theme (persisted via eframe storage).
    mode: Mode,
    /// Accent index into `Palette::ACCENTS` (persisted).
    accent_idx: usize,
    /// Colorblind-safe palette (blue/vermillion status colors) — persisted.
    colorblind: bool,
    /// Whether the activity-log drawer is open.
    log_open: bool,
    /// Whether the activity log is popped out into its own OS window (viewport)
    /// instead of the docked bottom drawer. Set by the header's detach icon,
    /// cleared by "Reattach"; the window's own close button clears this *and*
    /// `log_open` (collapsing the log). Only meaningful while `log_open` is true.
    log_detached: bool,
    /// Open help topic id, or `None` when the popover is closed.
    help_open: Option<&'static str>,
    /// Anchor point (the clicked "?" button's left-bottom) for the popover.
    help_anchor: egui::Pos2,
    /// OATH "copied" flash: (credential name, expiry unix-secs). Cleared after.
    copied: Option<(String, f64)>,
    /// Whether the OATH pane has auto-attempted a read for the current selection
    /// (so a hard error doesn't retry every frame). Reset on selection change.
    oath_tried: bool,
    /// Same guard for the PIV pane's auto-read.
    piv_tried: bool,
    /// Same guard for the OTP pane's auto-read.
    otp_tried: bool,
    /// True while the Molto2 factory-reset confirmation is showing.
    molto_reset_confirm: bool,
    /// True while the per-slot seed-delete confirmation card is showing.
    molto_delete_confirm: bool,
    /// Friendly-name draft for the selected device.
    rename_input: String,
    /// The device the open rename field targets, pinned when the field opens:
    /// its serial and its name-at-open. The save writes against *this* serial,
    /// not whatever `selected_device` happens to be at save time — a background
    /// rescan (e.g. the Molto2's flapping CCID reader) can silently move the
    /// selection between open and save, and without this pin the new name would
    /// land on the wrong key.
    rename_target: Option<RenameTarget>,
    /// Background worker for blocking device I/O. `None` only in tests.
    worker: Option<Worker>,
    /// Number of in-flight background jobs. While >0 the UI shows a spinner and
    /// disables actions that would issue overlapping device I/O.
    busy_jobs: u32,
    /// Human-readable description of what the worker is currently doing.
    busy_label: Option<String>,
    /// Set by the reader watcher on a PC/SC hotplug; consumed in `update()` to
    /// trigger a re-enumeration. Shared with the watcher thread.
    devices_dirty: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// While `Some`, a FIDO reset is armed and waiting for the key to be
    /// unplugged and plugged back in (see [`ResetArm`]).
    reset_arm: Option<ResetArm>,
    /// Pending whole-device factory-reset confirmation, bound to the device it
    /// was opened for (KEY-008 posture). None unless the modal is open.
    factory_reset_confirm: Option<FactoryResetConfirmState>,
    /// Validation error from the last "Yes, wipe this key" click on the
    /// factory-reset confirm dialog (e.g. bad hex in the reset management-auth
    /// credential field) — shown inline in that dialog, cleared on a fresh
    /// arm, a successful submit, or Cancel. Kept separate from `piv.error`:
    /// this error belongs to the confirm dialog, not the PIV pane, and must
    /// not leak into (or be clobbered by) that pane's own error state.
    factory_reset_confirm_error: Option<String>,
    /// Typed-`reset` text for the factory-reset confirm dialog's guard —
    /// mirrors `PivState::confirm_reset`/`typed_reset_modal`'s gate so both
    /// destructive-reset dialogs demand the same "type reset to confirm"
    /// ceremony before "Yes, wipe this key" arms. Cleared on arm, cancel, and
    /// successful submit alongside `factory_reset_confirm`/
    /// `factory_reset_confirm_error`.
    factory_reset_confirm_typed: String,
    /// Mode for the factory-reset confirm dialog's reset management-auth
    /// credential prompt (shown only when
    /// `FactoryResetConfirmState::needs_reset_mgmt_auth` is true). Lives on `App`,
    /// not inside `FactoryResetConfirmState`, for the same reason
    /// `PivState::mgmt_auth_mode` lives on `PivState` rather than inside
    /// whatever op is using it: it's user-typed UI state that must survive
    /// the confirm-arming round trip (fingerprinting runs as a background
    /// job in between) and be wiped explicitly on submit/cancel, not
    /// implicitly dropped with whatever state happened to be armed when it
    /// was typed.
    reset_mgmt_auth_mode: ResetMgmtAuthMode,
    /// Typed field backing `reset_mgmt_auth_mode`: a management-key hex
    /// string in `Manual` mode, a PIN in `Pin` mode. Wiped on submit and on
    /// dialog dismissal, same discipline as `PivState::mgmt_key_input`.
    reset_mgmt_auth_input: String,
    /// Live per-step report while a factory reset runs (empty when idle).
    factory_reset_report: Vec<FactoryResetRow>,
    /// Remaining scans in the current burst. A single scan races slow-to-
    /// register readers (the Molto2's CCID interface appears in pcscd a beat
    /// after the USB device), so startup and every hotplug schedule several
    /// staggered rescans instead of one.
    pending_scans: u8,
    /// When the next burst scan is due.
    next_scan_at: Option<std::time::Instant>,
    /// Background PC/SC hotplug watcher. `None` in tests / if it can't start.
    /// Held only to keep the thread alive; dropped on app exit.
    #[allow(dead_code)]
    reader_watch: Option<keyroost_transport::ReaderWatcher>,
    /// Result channel of the in-flight bulk-import stage (QR decode, vault
    /// decrypt, export parse). `Some` while one is running — these can take
    /// seconds (scrypt: minutes at the caps) and run on their own thread so
    /// they block neither the frame loop nor the device worker. One at a time.
    import_rx: Option<std::sync::mpsc::Receiver<ApplyFn>>,
    /// What the import thread is doing, for the dialog's progress row.
    import_label: Option<String>,
    /// Frame-loop handle for waking egui from helper threads. `None` in tests.
    egui_ctx: Option<egui::Context>,
    /// The `(mode, accent, colorblind)` triple whose Visuals are currently
    /// applied to the egui context — re-applied on change, not per frame.
    applied_theme: Option<(Mode, usize, bool)>,
    /// UI scale ("Text size", issue #42): egui's global zoom factor, which
    /// scales fonts AND painted symbols uniformly. Persisted via `settings.json`.
    /// `#[derive(Default)]` starts this at `0.0`; `theme::clamp_zoom` maps that
    /// (and any out-of-range value) back to 100%, so the default look is
    /// unchanged for existing users until they touch the control.
    zoom: f32,
    /// The zoom factor currently applied to the egui context — re-applied on
    /// change, not per frame (parallel to `applied_theme`).
    applied_zoom: Option<f32>,
    /// Slider preview while the "Text size" slider is actively dragged. The
    /// slider lives *inside* the UI it scales, so applying the zoom live during
    /// a drag would grow/shift the slider under the cursor and run the value
    /// away to the maximum (issue: slider runaway). Instead we stash the
    /// in-progress value here and keep the real `set_zoom_factor` untouched
    /// until the drag is released — see `text_size_control`. `None` means no
    /// drag in flight, so the readout/handle track the committed factor.
    zoom_pending: Option<f32>,
    /// Deadline for committing a +/− stepper preview (see `text_size_control`).
    /// The steppers stash their target in `zoom_pending` and set this; the zoom
    /// is applied once the user settles — pointer off the buttons, or this
    /// instant passes — so repeated clicks don't rescale the bar out from under
    /// the cursor mid-click. `None` when no stepper preview is pending.
    zoom_commit_at: Option<std::time::Instant>,
    /// The last `Settings` snapshot written to `settings.json` (or loaded at
    /// startup). `persist_settings()` compares the current UI state against
    /// this and only writes when something actually changed, so the disk isn't
    /// touched every frame. `None` until the first comparison.
    last_saved_settings: Option<Settings>,
    /// In-flight native file-chooser dialogs. rfd's xdg-portal backend is
    /// async, so each Browse…/Save… click spawns a helper thread that drives
    /// the dialog to completion and sends the chosen path back over a channel.
    /// `update()` drains this every frame and writes the path into the target
    /// field, so the picker never blocks the egui frame loop. One entry per
    /// open dialog; an entry is dropped once its result is consumed.
    pending_files: Vec<(
        FileTarget,
        std::sync::mpsc::Receiver<Option<std::path::PathBuf>>,
    )>,
    /// Monotonic id handed to each "Save certificate…" request so its dialog
    /// and its parked certificate stay paired. Never reset (not even on a
    /// selection change): an id must not be reused while a dialog opened for
    /// the previous key is still on screen.
    ssh_cert_next_id: u64,
}

/// Which path text field a resolved file-chooser result should populate. Keeps
/// the dialog plumbing generic — one helper, one drain loop, no per-field
/// duplication.
#[derive(Clone, Copy, PartialEq, Eq)]
enum FileTarget {
    /// OpenPGP "Import RSA-2048" key file (`openpgp.import_path`).
    OpenpgpImport,
    /// PIV "Sign & save CSR" destination (`piv.csr_path`).
    PivCsr,
    /// PIV "Import certificate" source file (`piv.cert_path`).
    PivCert,
    /// PIV "Export certificate" destination (`piv.export_path`).
    PivExport,
    /// Storage tab "Export…" destination for a large-blob entry. Carries the
    /// entry index so a second Export click (or a cancelled dialog) can never
    /// mismatch which entry a resolving dialog belongs to.
    LbExport(usize),
    /// Passkeys tab "Save certificate…" destination for an SSH credential's
    /// extracted cert. The cert text was decrypted by the background job and
    /// parked in `security_keys.ssh_cert_pending`; the resolving dialog writes
    /// it to the chosen path. Carries the request id that keys the parked
    /// certificate — same reason `LbExport` carries an index: two save dialogs
    /// can be open at once, and each must resolve to its own certificate.
    SshCertSave(u64),
}

/// An SSH certificate extracted from a credential's largeBlob, waiting for the
/// user to pick a destination in the save dialog. `summary` is the parsed
/// one-line description shown next to the saved path on success.
struct PendingSshCert {
    cert_pub: String,
    summary: String,
}

/// Take the certificate a resolving "Save certificate…" dialog is for out of
/// the parked-certificate map. Keyed by the dialog's request id, so two saves
/// in flight each get their own certificate instead of racing for one slot;
/// `None` when this dialog's certificate is gone (the selection changed, so
/// `clear_device_state` dropped it).
fn take_pending_cert(
    pending: &mut std::collections::HashMap<u64, PendingSshCert>,
    id: u64,
) -> Option<PendingSshCert> {
    pending.remove(&id)
}

impl App {
    /// Spawn a native file-chooser for `target`. `save` picks the dialog kind
    /// (Save… vs open); `filters` is `(name, &[extensions])` rows for the
    /// type dropdown; `default_name` seeds the filename on save dialogs.
    ///
    /// rfd's portal backend is async, so the dialog runs on a throwaway thread
    /// (driven by `pollster::block_on`) and the result returns over a channel
    /// drained in `update()` — the egui frame thread is never blocked. The
    /// frame loop is woken via `request_repaint` once the user dismisses the
    /// dialog so the picked path lands without waiting for the next input event.
    fn spawn_file_dialog(
        &mut self,
        target: FileTarget,
        save: bool,
        filters: &[(&'static str, &'static [&'static str])],
        default_name: Option<&str>,
    ) {
        let (tx, rx) = std::sync::mpsc::channel();
        let owned_filters: Vec<(String, Vec<String>)> = filters
            .iter()
            .map(|(name, exts)| {
                (
                    (*name).to_owned(),
                    exts.iter().map(|e| (*e).to_owned()).collect(),
                )
            })
            .collect();
        let default_name = default_name.map(str::to_owned);
        let egui_ctx = self.egui_ctx.clone();
        std::thread::spawn(move || {
            let result = pollster::block_on(async move {
                let mut dialog = rfd::AsyncFileDialog::new();
                for (name, exts) in &owned_filters {
                    let ext_refs: Vec<&str> = exts.iter().map(String::as_str).collect();
                    dialog = dialog.add_filter(name, &ext_refs);
                }
                if let Some(name) = &default_name {
                    dialog = dialog.set_file_name(name);
                }
                let handle = if save {
                    dialog.save_file().await
                } else {
                    dialog.pick_file().await
                };
                handle.map(|h| h.path().to_path_buf())
            });
            let _ = tx.send(result);
            if let Some(ctx) = egui_ctx {
                ctx.request_repaint();
            }
        });
        self.pending_files.push((target, rx));
    }

    /// Drain any resolved file-chooser dialogs and write the picked path into
    /// the matching text field. A `None` result (the user cancelled) leaves the
    /// field untouched. Entries are removed once they resolve. Called once per
    /// frame from `update()`.
    fn drain_file_dialogs(&mut self) {
        let mut i = 0;
        while i < self.pending_files.len() {
            match self.pending_files[i].1.try_recv() {
                Ok(result) => {
                    let (target, _) = self.pending_files.remove(i);
                    if let Some(path) = result {
                        let text = path.display().to_string();
                        match target {
                            FileTarget::OpenpgpImport => self.openpgp.import_path = text,
                            // PIV cert file ops pick the path first, then act:
                            // CSR and import need a secret, so open their modal;
                            // export writes straight to the chosen path.
                            FileTarget::PivCsr => {
                                self.piv.csr_path = text;
                                self.piv_cred_modal_close();
                                self.piv.cred_modal =
                                    Some(PivCredModal::new(PivCredKind::RequestCsr));
                            }
                            FileTarget::PivCert => {
                                self.piv.cert_path = text;
                                self.piv_cred_modal_close();
                                self.piv.cred_modal =
                                    Some(PivCredModal::new(PivCredKind::ImportCert));
                            }
                            FileTarget::PivExport => {
                                self.piv.export_path = text;
                                self.piv_export_cert();
                            }
                            FileTarget::LbExport(idx) => {
                                use keyroost_ctap::large_blobs::EntryKind;
                                // The array may have been reloaded, cleared, or
                                // shrunk between the Export click and the dialog
                                // resolving — fail loudly instead of writing the
                                // wrong entry or silently doing nothing.
                                let entry = self
                                    .security_keys
                                    .large_blobs
                                    .as_ref()
                                    .and_then(|arr| arr.entries.get(idx));
                                self.security_keys.lb_status = Some(match entry {
                                    None => {
                                        format!("Export failed: entry {idx} no longer exists")
                                    }
                                    Some(entry) => {
                                        let bytes = match entry.classify() {
                                            EntryKind::SshCert { wire, .. } => {
                                                keyroost_ctap::ssh_cert::to_cert_pub(&wire)
                                                    .map(String::into_bytes)
                                            }
                                            _ => Some(entry.ciphertext.clone()),
                                        };
                                        match bytes {
                                            None => "Export failed: could not re-encode \
                                                     certificate"
                                                .into(),
                                            Some(bytes) => match std::fs::write(&path, &bytes) {
                                                Ok(()) => format!(
                                                    "Exported entry {idx} ({} bytes) to {text}",
                                                    bytes.len()
                                                ),
                                                Err(e) => format!("Export failed: {e}"),
                                            },
                                        }
                                    }
                                });
                            }
                            FileTarget::SshCertSave(id) => {
                                // The cert text was decrypted by the background
                                // job and parked under this dialog's id; take
                                // *that* one and write it to the chosen path.
                                let pending =
                                    take_pending_cert(&mut self.security_keys.ssh_cert_pending, id);
                                self.security_keys.ssh_cert_status = Some(match pending {
                                    None => "Save failed: no certificate was ready \
                                             to write"
                                        .to_string(),
                                    Some(pending) => {
                                        match std::fs::write(&path, pending.cert_pub.as_bytes()) {
                                            Ok(()) => format!(
                                                "Saved certificate to {text}\n{}",
                                                pending.summary
                                            ),
                                            Err(e) => format!("Save failed: {e}"),
                                        }
                                    }
                                });
                            }
                        }
                    } else {
                        // Cancelled: drop whatever payload was waiting on this
                        // dialog so it can't be written by a later one.
                        self.discard_file_target(target);
                    }
                }
                Err(std::sync::mpsc::TryRecvError::Empty) => i += 1,
                Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                    let (target, _) = self.pending_files.remove(i);
                    self.discard_file_target(target);
                }
            }
        }
    }

    /// Drop the payload a dialog was holding when it produced no path — the
    /// user cancelled, or the helper thread went away. Only save-certificate
    /// dialogs park anything; without this a cancelled save would leave the
    /// extracted certificate in the map for the rest of the session.
    fn discard_file_target(&mut self, target: FileTarget) {
        if let FileTarget::SshCertSave(id) = target {
            self.security_keys.ssh_cert_pending.remove(&id);
        }
    }
}

#[derive(Default)]
struct Draft {
    /// 1..=12 byte title.
    title: String,
    /// Base32-encoded TOTP secret.
    secret_base32: String,
    algorithm: AlgoChoice,
    digits: DigitsChoice,
    time_step: StepChoice,
    display_timeout: TimeoutChoice,
}

#[derive(Default, Clone, Copy, PartialEq, Eq)]
enum AlgoChoice {
    #[default]
    Sha1,
    Sha256,
}
impl AlgoChoice {
    fn to_proto(self) -> HmacAlgo {
        match self {
            AlgoChoice::Sha1 => HmacAlgo::Sha1,
            AlgoChoice::Sha256 => HmacAlgo::Sha256,
        }
    }
}

#[derive(Default, Clone, Copy, PartialEq, Eq)]
enum DigitsChoice {
    Four,
    #[default]
    Six,
    Eight,
    Ten,
}
impl DigitsChoice {
    fn to_proto(self) -> OtpDigits {
        match self {
            DigitsChoice::Four => OtpDigits::Four,
            DigitsChoice::Six => OtpDigits::Six,
            DigitsChoice::Eight => OtpDigits::Eight,
            DigitsChoice::Ten => OtpDigits::Ten,
        }
    }
}

#[derive(Default, Clone, Copy, PartialEq, Eq)]
enum StepChoice {
    #[default]
    S30,
    S60,
}
impl StepChoice {
    fn to_proto(self) -> TimeStep {
        match self {
            StepChoice::S30 => TimeStep::Seconds30,
            StepChoice::S60 => TimeStep::Seconds60,
        }
    }
}

#[derive(Default, Clone, Copy, PartialEq, Eq)]
enum TimeoutChoice {
    S15,
    #[default]
    S30,
    S60,
    S120,
}
impl TimeoutChoice {
    fn to_proto(self) -> DisplayTimeout {
        match self {
            TimeoutChoice::S15 => DisplayTimeout::Sec15,
            TimeoutChoice::S30 => DisplayTimeout::Sec30,
            TimeoutChoice::S60 => DisplayTimeout::Sec60,
            TimeoutChoice::S120 => DisplayTimeout::Sec120,
        }
    }
}

#[derive(Default)]
struct ImportDialog {
    open: bool,
    uri: String,
}

#[derive(Default)]
struct BulkDialog {
    open: bool,
    path: String,
    /// Successfully parsed entries (cleared on each load).
    entries: Vec<keyroost_import::BulkEntry>,
    /// Last load error message, if any.
    error: Option<String>,
    /// Starting slot for programming.
    start: u8,
    /// Display timeout applied to every entry.
    display_timeout: TimeoutChoice,
    /// Password for encrypted Aegis vaults (revealed when the loader detects one).
    password: String,
    /// True once the loader has seen an encrypted vault at the current path.
    needs_password: bool,
}

struct LogLine {
    severity: Severity,
    kind: LogKind,
    text: String,
    /// The APDU trace behind this entry, captured on the worker thread while
    /// the "APDU trace" checkbox (see `App::activity_log`) was on. `None`
    /// with the checkbox off, for an entry with no device I/O behind it, or
    /// when a job recorded nothing. Printed in full under the entry —
    /// exactly the lines the CLI's own `--debug` would print.
    trace: Option<Vec<String>>,
}

#[derive(Clone, Copy)]
enum Severity {
    Info,
    Ok,
    Warn,
    Err,
}

/// Whether a log entry reports something the user directly asked for (a
/// button click that writes to, authenticates against, or otherwise acts on
/// a device) or something the app did on its own — a device scan, a status
/// sweep triggered by opening a tab or by selecting a device, a re-read that
/// follows a write to refresh the pane. Rendered with distinct weight (see
/// `App::activity_log`) so a quiet background poll never reads as though the
/// user had just done something.
#[derive(Clone, Copy, PartialEq, Eq)]
enum LogKind {
    User,
    Background,
}

/// Whether [`App::load_piv_status`] should reuse this device's cached
/// [`keyroost_transport::PivSessionState`] or force a from-scratch
/// resolution — independent of [`LogKind`]: how loudly a read is logged and
/// whether it trusts the cache are two separate questions. Today's sole
/// `Bypass` caller (the Refresh button) happens to also be the sole
/// `LogKind::User` caller, but that's a coincidence of what the button does,
/// not a rule tying the two together — a future caller is free to mix them
/// the other way.
#[derive(Clone, Copy, PartialEq, Eq)]
enum PivCache {
    /// Reuse this device's `piv_session_state` entry via
    /// [`keyroost_transport::PivSession::with_cached_transaction`] — the default for
    /// every unprompted read (first tab view, the re-read every write
    /// triggers): `with_cached_transaction`'s own checks already vouch for it, so
    /// there's no reason to distrust it just because nothing asked to.
    Reuse,
    /// Ignore whatever's cached and open via a plain
    /// [`keyroost_transport::PivSession::with_transaction`] — a real SELECT, a real
    /// fingerprint probe, no shortcuts, same as if this device had never
    /// been seen this app run. The result still gets stored back into
    /// `piv_session_state` afterward like any other read, so this doesn't
    /// leave the cache disabled going forward — it only forces *this* read
    /// to double-check it.
    Bypass,
}

impl App {
    /// Queue a blocking device job on the worker thread. `label` describes it for
    /// the busy indicator; `job` runs off-thread and returns a closure applied
    /// back to `self` on the UI thread. Falls back to running inline if there's
    /// no worker (tests).
    /// Returns `false` when the job was *not* queued (a job is already in
    /// flight, or the worker died). Callers that consumed user state to build
    /// the job — a typed PIN, a confirmed modal, a one-shot arm — must check
    /// the return and keep (or restore) that state on `false`, otherwise a
    /// click during a background read silently swallows the action.
    fn spawn_job<F>(&mut self, label: impl Into<String>, job: F) -> bool
    where
        F: FnOnce() -> ApplyFn + Send + 'static,
    {
        // Serialize device access: ignore a new job while one is in flight rather
        // than queueing overlapping card I/O behind a click the user can't see
        // landed. (A single worker thread would serialize anyway, but this also
        // stops a growing backlog of duplicate refreshes from rapid clicks.)
        if self.busy() {
            return false;
        }
        match &self.worker {
            Some(worker) => {
                self.busy_jobs += 1;
                self.busy_label = Some(label.into());
                if worker.job_tx.send(Box::new(job)).is_err() {
                    // Worker died; undo the bookkeeping so the UI doesn't hang.
                    self.busy_jobs -= 1;
                    self.busy_label = None;
                    return false;
                }
                true
            }
            None => {
                let apply = job();
                apply(self);
                true
            }
        }
    }

    /// Apply any finished background jobs. Called once per frame from `update()`.
    fn drain_worker(&mut self) {
        use std::sync::mpsc::TryRecvError;
        let mut applies: Vec<ApplyFn> = Vec::new();
        let mut disconnected = false;
        if let Some(w) = &self.worker {
            loop {
                match w.result_rx.try_recv() {
                    Ok(apply) => applies.push(apply),
                    Err(TryRecvError::Empty) => break,
                    Err(TryRecvError::Disconnected) => {
                        disconnected = true;
                        break;
                    }
                }
            }
        }
        for apply in applies {
            // Decrement *before* applying so an apply closure that chains another
            // job (e.g. refresh-readers → probe-lock) isn't blocked by the busy
            // guard in `spawn_job`.
            self.busy_jobs = self.busy_jobs.saturating_sub(1);
            if self.busy_jobs == 0 {
                self.busy_label = None;
            }
            apply(self);
        }
        if disconnected {
            // Last-resort safety net: jobs catch their own panics, so a dead
            // worker means the thread ended some other way. Clear the busy guard
            // so the UI can't wedge with an eternal spinner, then respawn a
            // worker so device actions keep working (falls back to inline
            // execution if there's no egui context, e.g. in tests).
            self.busy_jobs = 0;
            self.busy_label = None;
            let apdu_trace = self.apdu_trace.clone();
            self.worker = self
                .egui_ctx
                .clone()
                .map(|ctx| Worker::spawn(ctx, apdu_trace));
            self.log(
                Severity::Err,
                "the background worker stopped unexpectedly and was restarted",
            );
        }
    }

    /// True while any background device job is in flight.
    fn busy(&self) -> bool {
        self.busy_jobs > 0
    }

    /// True while a bulk-import stage runs on its own thread.
    fn import_busy(&self) -> bool {
        self.import_rx.is_some()
    }

    /// Run a bulk-import stage (QR decode / vault decrypt / export parse) on a
    /// dedicated thread. Not `spawn_job`: that queue serializes device I/O,
    /// and a multi-second scrypt must not park card operations behind it.
    fn run_import<F>(&mut self, label: impl Into<String>, job: F)
    where
        F: FnOnce() -> ApplyFn + Send + 'static,
    {
        if self.import_busy() {
            return;
        }
        let Some(ctx) = self.egui_ctx.clone() else {
            // Tests: no frame loop to wake; run inline.
            let apply = job();
            apply(self);
            return;
        };
        let (tx, rx) = std::sync::mpsc::channel::<ApplyFn>();
        let spawned = std::thread::Builder::new()
            .name("keyroost-import".into())
            .spawn(move || {
                let apply = job();
                if tx.send(apply).is_ok() {
                    ctx.request_repaint(); // wake the frame loop to apply it
                }
            });
        match spawned {
            Ok(_) => {
                self.import_rx = Some(rx);
                self.import_label = Some(label.into());
            }
            Err(e) => {
                self.bulk_dialog.error = Some(format!("could not start import thread: {}", e));
            }
        }
    }

    /// Apply a finished bulk-import stage. Called once per frame from
    /// `update()`, alongside `drain_worker`.
    fn drain_import(&mut self) {
        let received = match &self.import_rx {
            Some(rx) => rx.try_recv(),
            None => return,
        };
        match received {
            Ok(apply) => {
                self.import_rx = None;
                self.import_label = None;
                apply(self);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {}
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                // Import thread died (panicked) without sending a result.
                self.import_rx = None;
                self.import_label = None;
                self.bulk_dialog.error = Some("import failed unexpectedly".into());
            }
        }
    }

    /// Log something the user directly asked for: a write, an auth attempt,
    /// an export — anything that happened because of a specific click.
    /// Rendered at full weight (see `activity_log`). This is the visualization
    /// every explicit Molto2 action already used; every other module's
    /// explicit actions should log through this same entry point.
    fn log(&mut self, severity: Severity, text: impl Into<String>) {
        self.log_kind(severity, LogKind::User, text);
    }

    /// Log something the app did on its own — a device scan, a status sweep
    /// triggered by opening a tab or selecting a device, a re-read that
    /// follows a write to refresh the pane. Rendered muted (see
    /// `activity_log`) so it never competes visually with a user action.
    fn log_bg(&mut self, severity: Severity, text: impl Into<String>) {
        self.log_kind(severity, LogKind::Background, text);
    }

    fn log_kind(&mut self, severity: Severity, kind: LogKind, text: impl Into<String>) {
        // The activity log is device-centric: nearly every entry reports
        // something read from or done to the token currently in focus — a
        // status sweep, a write, an auth attempt. Prefix that token's display
        // name so the log stays legible when a session touches several keys.
        // Fleet-level lines (device-scan counts, "selection moved on" reset
        // notices) go through `log_global`, which skips the prefix.
        let text = match self.selected_device() {
            Some(d) => format!("{}: {}", d.title(), text.into()),
            None => text.into(),
        };
        self.push_log(severity, kind, text);
    }

    /// Log without the selected-token prefix `log_kind` adds — for entries that
    /// are about the device *fleet* or about a key that is no longer the
    /// selection (so its name would be the wrong one to show).
    fn log_global(&mut self, severity: Severity, kind: LogKind, text: impl Into<String>) {
        self.push_log(severity, kind, text.into());
    }

    fn push_log(&mut self, severity: Severity, kind: LogKind, text: String) {
        // The trace captured for whichever job's apply closure is running
        // right now (see `Worker::spawn`), if any — attached to the first log
        // line that closure produces, then consumed so a later, unrelated log
        // call in the same frame doesn't also claim it.
        let trace = self.pending_trace.take().filter(|t| !t.is_empty());
        self.log.push(LogLine {
            severity,
            kind,
            text,
            trace,
        });
        // Keep the log bounded; oldest entries are least interesting.
        if self.log.len() > 200 {
            let overflow = self.log.len() - 200;
            self.log.drain(0..overflow);
        }
    }

    fn customer_key_bytes(&self) -> Result<Vec<u8>, String> {
        if self.customer_key_input.is_empty() {
            return Ok(DEFAULT_CUSTOMER_KEY.to_vec());
        }
        if self.customer_key_hex {
            keyroost_proto::codec::hex_decode(&self.customer_key_input)
                .map_err(|e| format!("invalid customer key hex: {}", e))
        } else {
            Ok(self.customer_key_input.as_bytes().to_vec())
        }
    }

    /// Take the Molto2 session so a worker job can use it (the apply step
    /// hands it back). `None` — with the reason logged — when not connected;
    /// silently `None` while another job runs, so a click during a background
    /// read is dropped *before* any state is consumed.
    fn take_molto_session(&mut self) -> Option<Session> {
        if self.busy() {
            return None;
        }
        if !self.molto_session_usable() {
            // Session bound to a different device than the current selection
            // (e.g. a delayed open or hand-back landed after the user
            // switched keys). Never serve it; drop it instead (KEY-004).
            self.session = None;
            self.molto_session_device = None;
            self.log(Severity::Warn, "not connected");
            return None;
        }
        match self.session.take() {
            Some(s) => Some(s),
            None => {
                self.log(Severity::Warn, "not connected");
                None
            }
        }
    }

    /// True while the stored Molto2 session is bound to the current selection.
    fn molto_session_usable(&self) -> bool {
        completion_still_valid(
            self.molto_session_device.as_ref(),
            self.selected_device.as_ref(),
        )
    }

    fn authenticate(&mut self) {
        let key = match self.customer_key_bytes() {
            Ok(k) => zeroize::Zeroizing::new(k),
            Err(e) => {
                self.log(Severity::Err, e);
                return;
            }
        };
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job("Authenticating\u{2026}", move || {
            let result = s.authenticate(&key);
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(()) => {
                        app.authenticated = true;
                        app.log(Severity::Ok, "authenticated");
                    }
                    // The Display impl renders the tries-remaining count (or
                    // "unknown" when the card gave none).
                    Err(e @ TransportError::AuthFailed { .. }) => {
                        app.log(Severity::Err, e.to_string());
                    }
                    Err(e) => app.log(Severity::Err, format!("auth failed: {}", e)),
                }
            })
        });
    }

    fn apply_draft(&mut self) {
        if !self.ensure_auth() {
            return;
        }
        let secret = match keyroost_proto::codec::base32_decode(&self.draft.secret_base32) {
            Ok(s) if !s.is_empty() && s.len() <= 63 => zeroize::Zeroizing::new(s),
            Ok(s) => {
                self.log(
                    Severity::Err,
                    format!("seed must decode to 1..=63 bytes (got {})", s.len()),
                );
                return;
            }
            Err(e) => {
                self.log(Severity::Err, format!("seed base32 invalid: {}", e));
                return;
            }
        };
        let title = self.draft.title.trim().to_owned();
        if title.is_empty() || title.len() > 12 {
            self.log(Severity::Err, "title must be 1..=12 bytes");
            return;
        }
        let cfg = ProfileConfig {
            display_timeout: self.draft.display_timeout.to_proto(),
            algorithm: self.draft.algorithm.to_proto(),
            digits: self.draft.digits.to_proto(),
            time_step: self.draft.time_step.to_proto(),
            utc_time: unix_now(),
        };
        let p = self.slot;
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job(format!("Writing profile #{p}\u{2026}"), move || {
            let result = s
                .set_seed(p, &secret)
                .map_err(|e| format!("set_seed #{}: {}", p, e))
                .and_then(|()| {
                    s.set_title(p, &title)
                        .map_err(|e| format!("set_title #{}: {}", p, e))
                })
                .and_then(|()| {
                    s.set_config(p, &cfg)
                        .map_err(|e| format!("set_config #{}: {}", p, e))
                });
            let refreshed = result.is_ok().then(|| s.read_public_data(p).ok()).flatten();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(()) => {
                        // The seed now lives on the device; keeping it in the
                        // (masked) field for the app's lifetime is pure
                        // liability. Title/config drafts stay — convenient for
                        // programming a run of similar slots.
                        wipe(&mut app.draft.secret_base32);
                        if let (Some(meta), Some(block)) = (app.slot_meta.as_mut(), refreshed) {
                            if let Some(slot) = meta.get_mut(p as usize) {
                                *slot = block;
                            }
                        }
                        if app.slot_meta.is_none() {
                            app.resweep_slot_meta(LogKind::Background);
                        }
                        app.log(Severity::Ok, format!("profile #{} written", p));
                    }
                    Err(e) => app.log(Severity::Err, e),
                }
            })
        });
    }

    /// Write only the selected slot's title — no seed re-entry, no config.
    /// Needs auth (set_title is a secure command); the seed is untouched.
    fn apply_title_only(&mut self) {
        if !self.ensure_auth() {
            return;
        }
        let title = self.draft.title.trim().to_owned();
        if title.is_empty() || title.len() > 12 {
            self.log(Severity::Err, "title must be 1..=12 bytes");
            return;
        }
        let p = self.slot;
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job(format!("Writing title on #{p}\u{2026}"), move || {
            let result = s
                .set_title(p, &title)
                .map_err(|e| format!("set_title #{}: {}", p, e));
            let refreshed = result.is_ok().then(|| s.read_public_data(p).ok()).flatten();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(()) => {
                        if let (Some(meta), Some(block)) = (app.slot_meta.as_mut(), refreshed) {
                            if let Some(slot) = meta.get_mut(p as usize) {
                                *slot = block;
                            }
                        }
                        if app.slot_meta.is_none() {
                            app.resweep_slot_meta(LogKind::Background);
                        }
                        app.log(Severity::Ok, format!("title written on slot #{}", p));
                    }
                    Err(e) => app.log(Severity::Err, e),
                }
            })
        });
    }

    /// Delete the selected slot's seed. Keyless on the wire (the device
    /// accepts it from any card holder); the GUI's gate is the confirm
    /// card. The stored title survives — the refreshed block shows it.
    fn delete_seed_selected(&mut self) {
        let p = self.slot;
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job(format!("Deleting seed on #{p}\u{2026}"), move || {
            let result = s
                .delete_seed(p)
                .map_err(|e| format!("delete seed #{}: {}", p, e));
            let refreshed = result.is_ok().then(|| s.read_public_data(p).ok()).flatten();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(outcome) => {
                        if let (Some(meta), Some(block)) = (app.slot_meta.as_mut(), refreshed) {
                            if let Some(slot) = meta.get_mut(p as usize) {
                                *slot = block;
                            }
                        }
                        if app.slot_meta.is_none() {
                            app.resweep_slot_meta(LogKind::Background);
                        }
                        match outcome {
                            SeedDeleteOutcome::Deleted => app.log(
                                Severity::Ok,
                                format!("seed deleted from slot #{} (title kept)", p),
                            ),
                            SeedDeleteOutcome::AlreadyEmpty => {
                                app.log(Severity::Ok, format!("slot #{} was already empty", p))
                            }
                        }
                    }
                    Err(e) => app.log(Severity::Err, e),
                }
            })
        });
    }

    fn sync_time_selected(&mut self) {
        if !self.ensure_auth() {
            return;
        }
        let p = self.slot;
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job("Syncing time\u{2026}", move || {
            let result = s.sync_time(p, unix_now());
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(()) => app.log(Severity::Ok, format!("time synced on #{}", p)),
                    Err(e) => app.log(Severity::Err, format!("sync_time #{}: {}", p, e)),
                }
            })
        });
    }

    fn sync_time_all(&mut self) {
        if !self.ensure_auth() {
            return;
        }
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        // 100 slots × one APDU each — emphatically not frame-loop work.
        self.spawn_job("Syncing time on all profiles\u{2026}", move || {
            let mut ok = 0;
            let mut fail = 0;
            for p in 0..PROFILES {
                match s.sync_time(p, unix_now()) {
                    Ok(()) => ok += 1,
                    Err(_) => fail += 1,
                }
            }
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                let sev = if fail == 0 {
                    Severity::Ok
                } else {
                    Severity::Warn
                };
                app.log(sev, format!("time-sync-all: {} ok, {} failed", ok, fail));
            })
        });
    }

    /// Scan a TOTP QR from the screen, then run the normal otpauth import to
    /// fill the Molto2 draft — reusing the same parse+fill path as paste-a-URI.
    #[cfg(feature = "qr")]
    fn molto_scan_qr(&mut self) {
        match qrscan::scan_screens_for_otpauth() {
            Ok(uri) => {
                self.import_dialog.uri = uri;
                self.import_otpauth();
            }
            Err(e) => self.log(Severity::Err, format!("scan QR: {e}")),
        }
    }

    fn import_otpauth(&mut self) {
        let uri = self.import_dialog.uri.trim().to_owned();
        let parsed = match parse_otpauth(&uri) {
            Ok(p) => p,
            Err(e) => {
                self.log(Severity::Err, format!("import: {}", e));
                return;
            }
        };
        // Push parsed fields into the draft so the user can review before pushing.
        self.draft.title = parsed.suggested_title();
        // Show the original base32 from the URI rather than re-encoding the bytes.
        self.draft.secret_base32 = uri
            .find("secret=")
            .map(|i| {
                let rest = &uri[i + 7..];
                let end = rest.find('&').unwrap_or(rest.len());
                rest[..end].to_owned()
            })
            .unwrap_or_default();
        self.draft.algorithm = match parsed.algorithm {
            HmacAlgo::Sha1 => AlgoChoice::Sha1,
            HmacAlgo::Sha256 => AlgoChoice::Sha256,
        };
        self.draft.digits = match parsed.digits {
            OtpDigits::Four => DigitsChoice::Four,
            OtpDigits::Six => DigitsChoice::Six,
            OtpDigits::Eight => DigitsChoice::Eight,
            OtpDigits::Ten => DigitsChoice::Ten,
        };
        self.draft.time_step = match parsed.time_step {
            TimeStep::Seconds30 => StepChoice::S30,
            TimeStep::Seconds60 => StepChoice::S60,
        };
        self.log(
            Severity::Info,
            format!(
                "imported draft for #{} from URI; review and click Write profile",
                self.slot
            ),
        );
        self.import_dialog.open = false;
        self.import_dialog.uri.clear();
    }

    fn factory_reset(&mut self) {
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job("Requesting factory reset\u{2026}", move || {
            let result = s.factory_reset();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match result {
                    Ok(()) => {
                        // The wipe lands only when the user presses the device
                        // button, and the token stays connected through it with
                        // no completion signal — so we can't re-read the cleared
                        // state. Drop the now-doomed titles rather than keep
                        // showing them; a reselect re-sweeps the blank device.
                        app.slot_meta = None;
                        app.log(
                            Severity::Warn,
                            "factory-reset requested. Confirm with the \u{25B2} button on the device; reselect it afterward to refresh the slot list.",
                        );
                    }
                    Err(e) => app.log(Severity::Err, format!("factory_reset: {}", e)),
                }
            })
        });
    }

    /// Re-read all 100 public blocks and replace the slot list. Recovers the
    /// metadata display when a write found no existing list to patch (the
    /// open-time sweep had failed, leaving `slot_meta` `None`). `kind` should
    /// be `User` when this runs because the user clicked "Refresh slots", and
    /// `Background` for every other caller — a write's own fallback re-sweep,
    /// or any future automatic trigger — so the activity log renders each the
    /// way it actually happened.
    fn resweep_slot_meta(&mut self, kind: LogKind) {
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        self.spawn_job("Refreshing slots\u{2026}", move || {
            let meta = (0..PROFILES)
                .map(|p| s.read_public_data(p))
                .collect::<Result<Vec<_>, _>>();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                match meta {
                    Ok(m) => {
                        app.log_kind(Severity::Ok, kind, format!("{} slots read", m.len()));
                        app.slot_meta = Some(m);
                    }
                    Err(e) => app.log_kind(Severity::Warn, kind, format!("slot refresh: {e}")),
                }
            })
        });
    }

    fn bulk_load(&mut self) {
        if self.import_busy() {
            return;
        }
        let path = self.bulk_dialog.path.trim().to_owned();
        if path.is_empty() {
            self.bulk_dialog.error = Some("enter a file path first".into());
            return;
        }
        let password = zeroize::Zeroizing::new(self.bulk_dialog.password.clone());
        // Everything below — including the file read (slow media, network
        // mounts) and the format branching — runs on the import thread; the
        // frame loop only ever sees the finished apply step.
        self.run_import("Loading import file\u{2026}", move || {
            let bytes = match std::fs::read(&path) {
                Ok(b) => b,
                Err(e) => {
                    let msg = format!("read failed: {}", e);
                    return Box::new(move |app: &mut App| app.bulk_dialog.error = Some(msg));
                }
            };

            // Screenshot import: a PNG/JPEG (by magic bytes) goes through QR
            // decode — handles both standard otpauth:// enrollment codes and
            // Google Authenticator export batches.
            if keyroost_qr::looks_like_image(&bytes) {
                let result = keyroost_qr::entries_from_image(&bytes);
                return Box::new(move |app: &mut App| app.bulk_qr_loaded(result));
            }

            // Plaintext exports carry the seeds in clear — wipe-on-drop, same
            // as the decrypted variant.
            let text = match String::from_utf8(bytes) {
                Ok(t) => zeroize::Zeroizing::new(t),
                Err(_) => {
                    return Box::new(move |app: &mut App| {
                        app.bulk_dialog.error =
                            Some("file is neither a text export nor a PNG/JPEG image".into());
                    })
                }
            };

            // An encrypted Aegis vault needs the password; the scrypt KDF is
            // seconds of CPU at stock parameters — exactly why this thread
            // exists.
            let is_encrypted_aegis = keyroost_import::aegis::is_encrypted(&text).unwrap_or(false);
            if is_encrypted_aegis {
                if password.is_empty() {
                    return Box::new(move |app: &mut App| {
                        app.bulk_dialog.needs_password = true;
                        app.bulk_dialog.entries.clear();
                        app.bulk_dialog.error = Some(
                            "encrypted Aegis vault — enter password and click Load again".into(),
                        );
                    });
                }
                let result = match keyroost_import::aegis::decrypt(&text, password.as_bytes()) {
                    Ok(plaintext) => {
                        keyroost_import::parse_bulk_any(&plaintext).map_err(|e| e.to_string())
                    }
                    Err(e) => Err(format!("decrypt: {}", e)),
                };
                return Box::new(move |app: &mut App| {
                    app.bulk_dialog.needs_password = true;
                    app.bulk_text_loaded(result, path);
                });
            }

            let result = keyroost_import::parse_bulk_any(&text).map_err(|e| e.to_string());
            Box::new(move |app: &mut App| {
                app.bulk_dialog.needs_password = false;
                app.bulk_text_loaded(result, path);
            })
        });
    }

    /// Apply a finished QR-image decode to the bulk dialog.
    fn bulk_qr_loaded(&mut self, result: Result<keyroost_qr::QrImport, keyroost_qr::QrError>) {
        match result {
            Ok(import) => {
                self.bulk_dialog.error = None;
                self.bulk_dialog.needs_password = false;
                for s in &import.skipped {
                    self.log(
                        Severity::Err,
                        format!("skipped {:?}: {}", s.label, s.reason),
                    );
                }
                if let Some((i, n)) = import.batch {
                    self.log(
                        Severity::Info,
                        format!(
                            "this is QR {} of {} in the export — load the others too",
                            i + 1,
                            n
                        ),
                    );
                }
                self.log(
                    Severity::Info,
                    format!(
                        "loaded {} entries from QR image — delete the screenshot after a \
                         successful import",
                        import.entries.len()
                    ),
                );
                self.bulk_dialog.entries = import.entries;
            }
            Err(e) => {
                self.bulk_dialog.entries.clear();
                self.bulk_dialog.error = Some(e.to_string());
            }
        }
    }

    /// Apply a finished text-export parse (with or without vault decryption)
    /// to the bulk dialog.
    fn bulk_text_loaded(
        &mut self,
        result: Result<Vec<keyroost_import::BulkEntry>, String>,
        path: String,
    ) {
        match result {
            Ok(entries) => {
                self.bulk_dialog.entries = entries;
                self.bulk_dialog.error = None;
                wipe(&mut self.bulk_dialog.password);
                self.log(
                    Severity::Info,
                    format!(
                        "loaded {} entries from {}",
                        self.bulk_dialog.entries.len(),
                        path
                    ),
                );
            }
            Err(e) => {
                self.bulk_dialog.entries.clear();
                self.bulk_dialog.error = Some(e);
            }
        }
    }

    fn bulk_apply(&mut self) {
        if !self.ensure_auth() {
            return;
        }
        if self.bulk_dialog.entries.is_empty() {
            self.log(Severity::Warn, "no entries loaded");
            return;
        }
        let start = self.bulk_dialog.start;
        let n = self.bulk_dialog.entries.len();
        let last = (start as usize).saturating_add(n);
        if last > PROFILES as usize {
            self.log(
                Severity::Err,
                format!(
                    "{} entries starting at #{} would overflow slot 99 (would need #{})",
                    n,
                    start,
                    last - 1
                ),
            );
            return;
        }
        let timeout = self.bulk_dialog.display_timeout.to_proto();
        let entries = self.bulk_dialog.entries.clone();
        let Some(mut s) = self.take_molto_session() else {
            return;
        };
        // Up to 100 × 3 card writes — runs on the worker, log lines are
        // collected and replayed in the apply step.
        self.spawn_job(format!("Programming {n} profiles\u{2026}"), move || {
            let mut ok = 0;
            let mut fail = 0;
            let mut lines: Vec<(Severity, String)> = Vec::new();
            for (i, entry) in entries.into_iter().enumerate() {
                let p = start + i as u8;
                let title = entry.suggested_title();
                if title.is_empty() {
                    lines.push((Severity::Warn, format!("#{}: no title; skipping", p)));
                    fail += 1;
                    continue;
                }
                if let Err(e) = s.set_seed(p, &entry.secret) {
                    lines.push((Severity::Err, format!("#{} set_seed: {}", p, e)));
                    fail += 1;
                    continue;
                }
                if let Err(e) = s.set_title(p, &title) {
                    lines.push((Severity::Err, format!("#{} set_title: {}", p, e)));
                    fail += 1;
                    continue;
                }
                if let Err(e) = s.set_config(p, &entry.to_profile_config(unix_now(), timeout)) {
                    lines.push((Severity::Err, format!("#{} set_config: {}", p, e)));
                    fail += 1;
                    continue;
                }
                ok += 1;
            }
            // Public-block sweep, one APDU per slot (~1-2 s) — same soft
            // pattern as open_molto. A failed sweep must not affect the
            // import's reported success/failure, nor clobber existing
            // metadata; it just skips the refresh.
            let meta = (0..PROFILES)
                .map(|p| s.read_public_data(p))
                .collect::<Result<Vec<_>, _>>()
                .ok();
            Box::new(move |app: &mut App| {
                app.session = Some(s);
                for (sev, line) in lines {
                    app.log(sev, line);
                }
                let sev = if fail == 0 {
                    Severity::Ok
                } else {
                    Severity::Warn
                };
                app.log(sev, format!("bulk import: {} ok, {} failed", ok, fail));
                if let Some(m) = meta {
                    app.slot_meta = Some(m);
                }
                if fail == 0 {
                    app.bulk_dialog.open = false;
                }
            })
        });
    }

    fn ensure_auth(&mut self) -> bool {
        if self.authenticated {
            return true;
        }
        self.log(
            Severity::Warn,
            "not authenticated; click Authenticate first",
        );
        false
    }

    /// Open the currently-selected hidraw device, run CTAPHID_INIT and
    /// authenticatorGetInfo, and cache the result. Blocks the UI briefly —
    /// CTAP GetInfo typically completes in a few milliseconds.
    fn fetch_selected_info(&mut self) {
        self.security_keys.info = None;
        self.security_keys.init = None;
        self.security_keys.error = None;
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        // Tag the job with the device it reads — if the user switches devices
        // while it's in flight, the result must not be painted into the new
        // device's pane (or its row in the sidebar).
        let for_device = self.selected_device.clone();
        self.spawn_job("Reading key info\u{2026}", move || {
            // Off-thread: open the transport, run GetInfo. HID also yields an
            // InitResponse (firmware + CBOR capability); PC/SC (NFC/contact) has
            // no INIT phase, so we synthesize a minimal one and rely on GetInfo.
            let outcome = match open_fido(&target) {
                Ok((mut dev, cbor, init)) => {
                    let info = if cbor {
                        Some(keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string()))
                    } else {
                        None
                    };
                    Ok((init, info))
                }
                Err(e) => Err(format!("could not open key: {e}")),
            };
            // Back on the UI thread: store the results.
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                match outcome {
                    Ok((init, info)) => {
                        // Surface the key's firmware on the hero (e.g. "fw 5.7.4")
                        // when we have an InitResponse (USB-HID); PC/SC has none.
                        if let Some(init) = init {
                            let fw = format!(
                                "{}.{}.{}",
                                init.device_major, init.device_minor, init.device_build
                            );
                            if let Some(id) = for_device.clone() {
                                if let Some(dev) = app.devices.iter_mut().find(|d| d.id == id) {
                                    dev.firmware = fw;
                                }
                            }
                            app.security_keys.init = Some(init);
                        }
                        match info {
                            Some(Ok(info)) => {
                                // Refine the model from the AAGUID (e.g. "YubiKey" ->
                                // "YubiKey 5 Series with NFC") on the read device.
                                if let Some(model) = ui::aaguid::model_for_aaguid(&info.aaguid) {
                                    if let Some(id) = for_device {
                                        if let Some(dev) =
                                            app.devices.iter_mut().find(|d| d.id == id)
                                        {
                                            dev.model = model.to_string();
                                        }
                                    }
                                }
                                app.security_keys.info = Some(info);
                            }
                            Some(Err(e)) => {
                                app.security_keys.error = Some(format!("GetInfo failed: {}", e))
                            }
                            None => {
                                // CBOR was reported unavailable and we never even
                                // attempted GetInfo. Record it as an error rather
                                // than leaving the pane spinning on "Reading key…"
                                // forever (the spinner re-fires while info is None).
                                app.security_keys.error = Some(
                                    "this key did not present a CTAP2 (FIDO2) interface over \
                                     the reader; only U2F was detected"
                                        .to_string(),
                                );
                            }
                        }
                    }
                    Err(e) => app.security_keys.error = Some(e),
                }
            })
        });
    }

    /// Open the selected hidraw, run the PIN exchange, and populate the
    /// session with metadata + credential listing. Errors land in
    /// `security_keys.error`.
    fn try_unlock(&mut self) {
        // Check busy *before* consuming the typed PIN — spawn_job would drop
        // the job (and the PIN with it) if a background read is in flight.
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let pin = std::mem::take(&mut self.security_keys.pin_input);
        if pin.is_empty() {
            self.security_keys.error = Some("PIN is empty".into());
            return;
        }
        let for_device = self.selected_device.clone();
        self.spawn_job("Unlocking\u{2026} (enter PIN / touch)", move || {
            let result = Self::open_and_unlock(&target, &pin).map_err(|e| e.to_string());
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-unlock; discard (drops the PIN)
                }
                match result {
                    Ok(sess) => {
                        // Surface fingerprints read during unlock so the list shows
                        // without a separate Reload.
                        app.security_keys.fingerprints = sess.fingerprints.clone();
                        app.security_keys.session = Some(sess);
                        app.security_keys.session_device = for_device.clone();
                        app.security_keys.error = None;
                    }
                    Err(e) => app.security_keys.error = Some(format!("unlock failed: {}", e)),
                }
            })
        });
    }

    fn open_and_unlock(
        target: &FidoTarget,
        pin: &str,
    ) -> Result<UnlockedSession, Box<dyn std::error::Error>> {
        let (mut dev, cbor, _init) = open_fido(target)?;
        if !cbor {
            return Err("device is U2F-only".into());
        }
        let info = keyroost_ctap::get_info(&mut dev)?;
        // Request credential-management permission, plus bio-enrollment when the
        // key supports it, so the one cached session token authorizes both
        // passkey management and fingerprint operations. Permissions are a
        // bitmask; only OR in BIO_ENROLLMENT when advertised, since asking for an
        // unsupported permission would make the whole unlock fail.
        let mut perms = keyroost_ctap::client_pin::permissions::CREDENTIAL_MANAGEMENT;
        if info.option("bioEnroll").is_some()
            || info.option("userVerificationMgmtPreview").is_some()
        {
            perms |= keyroost_ctap::client_pin::permissions::BIO_ENROLLMENT;
        }
        let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(&mut dev, pin, &info, perms)?;
        // Hand the manager a clone and keep `token` for the cached session; the
        // token stays valid for the device session, so this avoids a redundant
        // second PIN/ECDH exchange just to rebuild it.
        let mut mgr =
            keyroost_ctap::cred_mgmt::CredentialManager::new(&mut dev, token.clone(), &info)?;
        let metadata = mgr.metadata()?;
        let parties = mgr.list_relying_parties()?;
        let mut rps = Vec::with_capacity(parties.len());
        for rp in parties {
            // A `None` hash marks an entry whose rpIdHash came back malformed:
            // list nothing rather than query against a wrong key.
            let creds = match rp.rp_id_hash {
                Some(hash) => mgr.list_credentials(&hash).unwrap_or_default(),
                None => Vec::new(),
            };
            rps.push((rp, creds));
        }
        // While the session is fresh, also read enrolled fingerprints (when the
        // key supports bio) so the Fingerprints list appears immediately without
        // a separate Reload. Best-effort: a failure here doesn't block unlock.
        let fingerprints = if info.option("bioEnroll").is_some()
            || info.option("userVerificationMgmtPreview").is_some()
        {
            let cmd_code = if info.option("bioEnroll").is_some() {
                keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT
            } else {
                keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT_PREVIEW
            };
            let mut bio =
                keyroost_ctap::bio_enroll::BioEnrollment::new(&mut dev, token.clone(), cmd_code);
            bio.enumerate().ok()
        } else {
            None
        };
        Ok(UnlockedSession {
            token,
            metadata,
            rps: std::sync::Arc::new(rps),
            fingerprints,
            pin: zeroize::Zeroizing::new(pin.to_owned()),
        })
    }

    /// The unlocked FIDO session, but only while it is still bound to the
    /// current selection (KEY-012). Every dispatcher that reuses the cached
    /// session/PIN must get it through here, not `security_keys.session`.
    fn fido_session(&self) -> Option<&UnlockedSession> {
        if completion_still_valid(
            self.security_keys.session_device.as_ref(),
            self.selected_device.as_ref(),
        ) {
            self.security_keys.session.as_ref()
        } else {
            None
        }
    }

    fn lock_session(&mut self) {
        self.security_keys.session = None;
        self.security_keys.session_device = None;
        wipe(&mut self.security_keys.pin_input);
    }

    /// Resolve a failed unlocked-session operation. When the underlying CTAP
    /// error is a PIN / PIN-auth failure (`0x31` / `0x33` / `0x34`) the key has
    /// invalidated the in-flight session, so we drop it and ask the user to
    /// unlock again. Any other failure keeps the existing behavior: surface the
    /// caller's contextual message. Auto-lock applies ONLY to operations that
    /// already hold a session — `try_unlock`'s own wrong-PIN handling is left
    /// untouched.
    fn fail_session_op(&mut self, err: &SessionOpError, context: &str) {
        if err.relock {
            self.lock_session();
            self.security_keys.error = Some(
                "the key re-locked (PIN or session changed) \u{2014} \
                 unlock again to continue."
                    .into(),
            );
        } else {
            self.security_keys.error = Some(format!("{context}: {err}"));
        }
    }

    fn refresh_credentials(&mut self) {
        // Check busy *before* taking the session — spawn_job would silently
        // drop the job, destroying the unlocked session (and its PIN token)
        // and logging the user out for clicking Reload at the wrong moment.
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        if self.fido_session().is_none() {
            return; // no session, or one bound to a different device (KEY-012)
        }
        let Some(session) = self.security_keys.session.take() else {
            return;
        };
        let token = session.token;
        let pin = session.pin;
        let for_device = self.selected_device.clone();
        self.spawn_job("Refreshing credentials\u{2026}", move || {
            let result =
                Self::refresh_with_token(&target, token, pin).map_err(SessionOpError::from_boxed);
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-refresh; drop the session + PIN
                }
                match result {
                    Ok(fresh) => {
                        app.security_keys.session = Some(fresh);
                        app.security_keys.session_device = for_device.clone();
                    }
                    Err(e) => app.fail_session_op(&e, "refresh failed"),
                }
            })
        });
    }

    fn refresh_with_token(
        target: &FidoTarget,
        token: PinUvAuthToken,
        pin: zeroize::Zeroizing<String>,
    ) -> Result<UnlockedSession, Box<dyn std::error::Error>> {
        let (mut dev, _cbor, _init) = open_fido(target)?;
        let info = keyroost_ctap::get_info(&mut dev)?;
        let mut mgr =
            keyroost_ctap::cred_mgmt::CredentialManager::new(&mut dev, token.clone(), &info)?;
        let metadata = mgr.metadata()?;
        let parties = mgr.list_relying_parties()?;
        let mut rps = Vec::with_capacity(parties.len());
        for rp in parties {
            // A `None` hash marks an entry whose rpIdHash came back malformed:
            // list nothing rather than query against a wrong key.
            let creds = match rp.rp_id_hash {
                Some(hash) => mgr.list_credentials(&hash).unwrap_or_default(),
                None => Vec::new(),
            };
            rps.push((rp, creds));
        }
        Ok(UnlockedSession {
            token,
            metadata,
            rps: std::sync::Arc::new(rps),
            fingerprints: None,
            pin,
        })
    }

    /// Pick the bio-enrollment command byte from the cached AuthenticatorInfo.
    /// Mirrors the CLI helper: standard 0x09 when `bioEnroll` is advertised,
    /// else the preview 0x40.
    fn bio_cmd_code(&self) -> Option<u8> {
        let info = self.security_keys.info.as_ref()?;
        if info.option("bioEnroll").is_some() {
            Some(keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT)
        } else if info.option("userVerificationMgmtPreview").is_some() {
            Some(keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT_PREVIEW)
        } else {
            None
        }
    }

    /// Open the device, derive a FRESH bio pinUvAuthToken from the PIN, and run
    /// `f` with an armed BioEnrollment. A fresh token per operation is required:
    /// the authenticator can invalidate a token after a UV-gated bio write, so
    /// reusing the unlock token across operations fails with 0x33.
    fn with_fresh_bio<T>(
        target: &FidoTarget,
        pin: &str,
        f: impl FnOnce(
            &mut keyroost_ctap::bio_enroll::BioEnrollment<
                Box<dyn keyroost_ctap::transport::CtapTransport>,
            >,
        ) -> Result<T, SessionOpError>,
    ) -> Result<T, SessionOpError> {
        let (mut dev, cbor, _init) = open_fido(target).map_err(SessionOpError::msg)?;
        if !cbor {
            return Err(SessionOpError::msg("device is U2F-only"));
        }
        let info = keyroost_ctap::get_info(&mut dev).map_err(SessionOpError::from_ctap)?;
        let cmd_code = if info.option("bioEnroll").is_some() {
            keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT
        } else if info.option("userVerificationMgmtPreview").is_some() {
            keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT_PREVIEW
        } else {
            return Err(SessionOpError::msg(
                "key does not support fingerprint enrollment",
            ));
        };
        let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
            &mut dev,
            pin,
            &info,
            keyroost_ctap::client_pin::permissions::BIO_ENROLLMENT,
        )
        .map_err(SessionOpError::from_ctap)?;
        let mut bio = keyroost_ctap::bio_enroll::BioEnrollment::new(&mut dev, token, cmd_code);
        f(&mut bio)
    }

    /// Refresh the cached fingerprint list.
    fn refresh_fingerprints(&mut self) {
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            self.security_keys.error = Some("unlock the key first".into());
            return;
        };
        let pin = session.pin.clone();
        let for_device = self.selected_device.clone();
        self.spawn_job("Reading fingerprints\u{2026}", move || {
            let result = Self::with_fresh_bio(&target, &pin, |bio| {
                bio.enumerate().map_err(SessionOpError::from_ctap)
            });
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                match result {
                    Ok(list) => {
                        app.security_keys.fingerprints = Some(list);
                        app.security_keys.error = None;
                    }
                    Err(e) => app.fail_session_op(&e, "fingerprint list failed"),
                }
            })
        });
    }

    /// Enroll a new fingerprint end-to-end (begin + capture loop) on a worker.
    /// Writes live progress to a shared cell so the UI can show a wizard with
    /// per-sample quality feedback.
    fn enroll_fingerprint(&mut self) {
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            self.security_keys.error = Some("unlock the key first".into());
            return;
        };
        let pin = session.pin.clone();
        let name = self.security_keys.fp_new_name.trim().to_owned();
        let name = if name.is_empty() { None } else { Some(name) };

        // Shared progress cell the worker updates and the UI polls each frame.
        let progress = std::sync::Arc::new(std::sync::Mutex::new(EnrollProgress::default()));
        // Pull out the cancel flag so the worker can poll it without locking the
        // whole progress mutex on every check.
        let cancel_flag = progress
            .lock()
            .map(|g| g.cancel.clone())
            .unwrap_or_default();
        self.security_keys.fp_progress = Some(progress.clone());

        let for_device = self.selected_device.clone();
        self.spawn_job("Enrolling fingerprint\u{2026}", move || {
            use keyroost_ctap::bio_enroll::sample_status_message;
            let result = (|| -> Result<Vec<keyroost_ctap::Enrollment>, SessionOpError> {
                let (mut dev, cbor, _init) = open_fido(&target).map_err(SessionOpError::msg)?;
                if !cbor {
                    return Err(SessionOpError::msg("device is U2F-only"));
                }
                // Wire the cooperative-cancel flag into the transport so a
                // capture blocked waiting for a touch aborts promptly (at the
                // next KEEPALIVE) when the user clicks Cancel.
                dev.set_cancel_flag(cancel_flag.clone());
                let info = keyroost_ctap::get_info(&mut dev).map_err(SessionOpError::from_ctap)?;
                let cmd_code = if info.option("bioEnroll").is_some() {
                    keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT
                } else {
                    keyroost_ctap::bio_enroll::CTAP2_BIO_ENROLLMENT_PREVIEW
                };
                // Fresh bio token per enroll, derived from the session PIN.
                let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
                    &mut dev,
                    &pin,
                    &info,
                    keyroost_ctap::client_pin::permissions::BIO_ENROLLMENT,
                )
                .map_err(SessionOpError::from_ctap)?;
                let mut bio =
                    keyroost_ctap::bio_enroll::BioEnrollment::new(&mut dev, token, cmd_code);

                // Learn how many samples the sensor wants, for the progress bar.
                let total = bio
                    .sensor_info()
                    .map(|i| i.max_capture_samples)
                    .unwrap_or(0);

                let (template_id, mut status) =
                    bio.enroll_begin(None).map_err(SessionOpError::from_ctap)?;
                // captured = total - remaining (clamped), so the bar advances
                // even though the protocol reports "remaining".
                let update = |p: &std::sync::Mutex<EnrollProgress>,
                              total: u64,
                              remaining: u64,
                              msg: &str| {
                    if let Ok(mut g) = p.lock() {
                        g.total = total;
                        g.captured = total.saturating_sub(remaining);
                        g.last_message = msg.to_string();
                    }
                };
                update(
                    &progress,
                    total.max(status.remaining_samples + 1),
                    status.remaining_samples,
                    sample_status_message(status.last_sample_status),
                );

                while status.remaining_samples > 0 {
                    // The capture below blocks waiting for a touch, but the
                    // transport checks the cancel flag on every KEEPALIVE, so a
                    // cancel returns the "cancelled" error promptly. Map that to
                    // a device-side cancel + a clean exit.
                    match bio.enroll_capture_next(&template_id, None) {
                        Ok(s) => status = s,
                        Err(e) if e.to_string().contains("cancelled") => {
                            // Clear the flag first, otherwise the cancel command
                            // itself would be cancelled at its first KEEPALIVE.
                            cancel_flag.store(false, std::sync::atomic::Ordering::Relaxed);
                            let _ = bio.cancel_enrollment();
                            return Err(SessionOpError::msg("cancelled"));
                        }
                        Err(e) => return Err(SessionOpError::from_ctap(e)),
                    }
                    let total = total.max(status.remaining_samples + 1);
                    update(
                        &progress,
                        total,
                        status.remaining_samples,
                        sample_status_message(status.last_sample_status),
                    );
                }

                if let Some(n) = &name {
                    bio.set_friendly_name(&template_id, n)
                        .map_err(SessionOpError::from_ctap)?;
                }
                bio.enumerate().map_err(SessionOpError::from_ctap)
            })();

            // Mark the shared cell done (success or failure) for the UI.
            if let Ok(mut g) = progress.lock() {
                g.done = Some(result.as_ref().map(|_| ()).map_err(|e| e.message.clone()));
                if result.is_ok() {
                    g.last_message = "Fingerprint enrolled.".into();
                    g.captured = g.total;
                }
            }

            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-enroll; the progress cell
                            // was already dropped + cancelled on selection change
                }
                match result {
                    Ok(list) => {
                        app.security_keys.fingerprints = Some(list);
                        app.security_keys.fp_new_name.clear();
                        app.security_keys.error = None;
                    }
                    Err(e) if e.message == "cancelled" => {
                        // User cancelled — dismiss the wizard without an error
                        // banner, and refresh the list so it reflects reality.
                        app.security_keys.fp_progress = None;
                        app.security_keys.error = None;
                        app.refresh_fingerprints();
                    }
                    Err(e) => app.fail_session_op(&e, "enroll failed"),
                }
                // Leave fp_progress in place briefly so the UI shows the final
                // "enrolled" state; it's cleared on the next user action.
            })
        });
    }

    /// Delete one fingerprint by template id, then refresh the list.
    fn delete_fingerprint(&mut self, template_id: Vec<u8>) {
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            return;
        };
        let pin = session.pin.clone();
        let for_device = self.selected_device.clone();
        self.spawn_job("Deleting fingerprint\u{2026}", move || {
            let result = Self::with_fresh_bio(&target, &pin, |bio| {
                bio.remove_enrollment(&template_id)
                    .map_err(SessionOpError::from_ctap)?;
                bio.enumerate().map_err(SessionOpError::from_ctap)
            });
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok(list) => app.security_keys.fingerprints = Some(list),
                    Err(e) => app.fail_session_op(&e, "delete failed"),
                }
            })
        });
    }

    /// Rename one fingerprint, then refresh the list.
    fn rename_fingerprint(&mut self, template_id: Vec<u8>, new_name: String) {
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            return;
        };
        let pin = session.pin.clone();
        let for_device = self.selected_device.clone();
        self.spawn_job("Renaming fingerprint\u{2026}", move || {
            let result = Self::with_fresh_bio(&target, &pin, |bio| {
                bio.set_friendly_name(&template_id, &new_name)
                    .map_err(SessionOpError::from_ctap)?;
                bio.enumerate().map_err(SessionOpError::from_ctap)
            });
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok(list) => app.security_keys.fingerprints = Some(list),
                    Err(e) => app.fail_session_op(&e, "rename failed"),
                }
            })
        });
    }

    /// Open the device and run `f` with a [`Configurator`](keyroost_ctap::config::Configurator) holding a fresh
    /// pinUvAuthToken that carries the AuthenticatorConfiguration permission.
    /// Mirrors `with_fresh_bio`; config commands need their own permissioned
    /// token, so they always take a PIN at action time.
    fn with_config<T>(
        target: &FidoTarget,
        pin: &str,
        f: impl FnOnce(
            &mut keyroost_ctap::config::Configurator<
                Box<dyn keyroost_ctap::transport::CtapTransport>,
            >,
        ) -> Result<T, SessionOpError>,
    ) -> Result<T, SessionOpError> {
        let (mut dev, cbor, _init) = open_fido(target).map_err(SessionOpError::msg)?;
        if !cbor {
            return Err(SessionOpError::msg("device is U2F-only"));
        }
        let info = keyroost_ctap::get_info(&mut dev).map_err(SessionOpError::from_ctap)?;
        if info.option("authnrCfg") != Some(true) {
            return Err(SessionOpError::msg(
                "this key does not support authenticatorConfig",
            ));
        }
        let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
            &mut dev,
            pin,
            &info,
            keyroost_ctap::client_pin::permissions::AUTHENTICATOR_CONFIGURATION,
        )
        .map_err(SessionOpError::from_ctap)?;
        let mut cfg = keyroost_ctap::config::Configurator::new(&mut dev, token, &info)
            .map_err(SessionOpError::from_ctap)?;
        f(&mut cfg)
    }

    /// Dispatch the pending Advanced action on a worker thread, then refresh the
    /// key's info so the view reflects the new state.
    fn run_advanced_action(&mut self) {
        if self.busy() {
            return;
        }
        let Some(dlg) = self.security_keys.advanced.as_ref() else {
            return;
        };
        let action = dlg.action;
        // Zeroizing so the worker closure's PIN copy is scrubbed when the job ends.
        let pin = zeroize::Zeroizing::new(dlg.pin_input.clone());
        let force_change = dlg.force_change;
        let min_pin = dlg.min_pin_input.trim().parse::<u32>().ok();
        let dlg_device = dlg.device.clone();

        // The dialog is bound to the device it opened for (KEY-007): if the
        // selection moved, the typed PIN must not be sent to the new key.
        // Dropping the dialog wipes the PIN (Drop impl).
        if !completion_still_valid(dlg_device.as_ref(), self.selected_device.as_ref()) {
            self.security_keys.advanced = None;
            self.security_keys.error = Some(
                "the selected key changed \u{2014} the settings change was cancelled; \
                 reopen it to retry"
                    .into(),
            );
            return;
        }

        let Some(target) = self.selected_fido_target() else {
            return;
        };

        // Validate inputs before spawning.
        if action == AdvancedAction::SetMinPin && min_pin.is_none() {
            self.security_keys.error = Some("Enter a whole number for the new minimum.".into());
            return;
        }
        if pin.is_empty() {
            self.security_keys.error = Some("Enter the device PIN to apply this change.".into());
            return;
        }

        let label = match action {
            AdvancedAction::ToggleAlwaysUv => "Updating always-UV\u{2026}",
            AdvancedAction::SetMinPin => "Setting minimum PIN length\u{2026}",
            AdvancedAction::ForcePinChange => "Requesting PIN change\u{2026}",
            AdvancedAction::EnterpriseAttestation => "Enabling enterprise attestation\u{2026}",
            AdvancedAction::None => return,
        };
        let for_device = self.selected_device.clone();
        self.spawn_job(label, move || {
            let result = Self::with_config(&target, &pin, |cfg| match action {
                AdvancedAction::ToggleAlwaysUv => {
                    cfg.toggle_always_uv().map_err(SessionOpError::from_ctap)
                }
                AdvancedAction::SetMinPin => cfg
                    .set_min_pin_length(min_pin, &[], force_change)
                    .map_err(SessionOpError::from_ctap),
                AdvancedAction::ForcePinChange => {
                    cfg.force_pin_change().map_err(SessionOpError::from_ctap)
                }
                AdvancedAction::EnterpriseAttestation => cfg
                    .enable_enterprise_attestation()
                    .map_err(SessionOpError::from_ctap),
                AdvancedAction::None => Ok(()),
            });
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-flight; discard
                }
                match result {
                    Ok(()) => {
                        app.security_keys.advanced = None;
                        app.security_keys.error = None;
                        // Re-read info so alwaysUv / minPinLength reflect the change.
                        app.fetch_selected_info();
                    }
                    Err(e) => {
                        // Drop the dialog on error too (KEY-007): a failed
                        // attempt must not keep the typed PIN alive for a
                        // retry against whatever is selected later.
                        app.security_keys.advanced = None;
                        app.fail_session_op(&e, "config change failed");
                    }
                }
            })
        });
    }

    fn delete_credential(&mut self, cred_id: Vec<u8>) {
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            return;
        };
        let token = session.token.clone();
        // The refresh after delete needs its own token; clone for the chained op.
        let token_refresh = token.clone();
        let pin_refresh = session.pin.clone();
        let for_device = self.selected_device.clone();
        self.spawn_job("Deleting credential\u{2026}", move || {
            // Delete, then re-list in the same job so the UI updates atomically.
            let result = Self::try_delete(&target, token, &cred_id)
                .and_then(|()| Self::refresh_with_token(&target, token_refresh, pin_refresh))
                .map_err(SessionOpError::from_boxed);
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-delete; drop the refresh
                }
                match result {
                    Ok(fresh) => {
                        app.security_keys.session = Some(fresh);
                        app.security_keys.session_device = for_device.clone();
                        app.security_keys.error = None;
                    }
                    Err(e) => app.fail_session_op(&e, "delete failed"),
                }
            })
        });
    }

    fn try_delete(
        target: &FidoTarget,
        token: PinUvAuthToken,
        cred_id: &[u8],
    ) -> Result<(), Box<dyn std::error::Error>> {
        let (mut dev, _cbor, _init) = open_fido(target)?;
        let info = keyroost_ctap::get_info(&mut dev)?;
        let mut mgr = keyroost_ctap::cred_mgmt::CredentialManager::new(&mut dev, token, &info)?;
        mgr.delete(cred_id)?;
        Ok(())
    }

    /// Extract and save the OpenSSH certificate stored in an SSH credential's
    /// largeBlob. The credential's largeBlob key was captured from the unlocked
    /// session at click time (the GUI already enumerated it), so — unlike the
    /// CLI, which starts cold and rebuilds a CredentialManager to fetch the key —
    /// the job needs no PIN token: reading the world-readable largeBlob array
    /// takes the device but no auth. On success the parsed cert is parked in
    /// `ssh_cert_pending` under this request's id and a save dialog carrying
    /// the same id opens, defaulting to a path-safe `<rp-id>-cert.pub`
    /// filename. PIN only, no touch.
    ///
    /// The largeBlob key is carried `Zeroizing` so the copy moved into the job
    /// (and the one dropped on an early return) doesn't leave 32 bytes of key
    /// material in freed memory — same treatment as the typed PINs.
    fn save_ssh_cert(&mut self, rp_id: String, large_blob_key: zeroize::Zeroizing<[u8; 32]>) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.ssh_cert_status = Some("No FIDO key selected.".into());
            return;
        };
        // Device-bound (KEY-012): only run while the unlocked session still
        // matches the current selection.
        if self.fido_session().is_none() {
            return;
        }
        // Pair this request with its dialog up front: a second "Save
        // certificate…" click gets its own id, so whichever dialog the user
        // answers first still writes its own certificate.
        let id = self.ssh_cert_next_id;
        self.ssh_cert_next_id = self.ssh_cert_next_id.wrapping_add(1);
        let for_device = self.selected_device.clone();
        self.spawn_job("Extracting certificate\u{2026}", move || {
            let result = Self::extract_ssh_cert(&target, &large_blob_key);
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-extract; discard the cert
                }
                match result {
                    Ok(pending) => {
                        app.security_keys.ssh_cert_pending.insert(id, pending);
                        app.security_keys.ssh_cert_status = None;
                        app.spawn_file_dialog(
                            FileTarget::SshCertSave(id),
                            true,
                            &[("SSH certificate", &["pub"]), ("All files", &["*"])],
                            Some(&keyroost_ctap::ssh_cert::default_cert_filename(&rp_id)),
                        );
                    }
                    Err(e) => app.security_keys.ssh_cert_status = Some(e),
                }
            })
        });
    }

    /// Open the device, read its largeBlob array, and decrypt this credential's
    /// certificate entry with `large_blob_key`. Returns the `-cert.pub` text plus
    /// a one-line parsed summary, or a human-readable error.
    fn extract_ssh_cert(
        target: &FidoTarget,
        large_blob_key: &[u8; 32],
    ) -> Result<PendingSshCert, String> {
        let (mut dev, cbor, _init) = open_fido(target)?;
        if !cbor {
            return Err("device is U2F-only; large blobs are not supported".into());
        }
        let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;
        if info.option("largeBlobs") != Some(true) {
            return Err("this key does not support the FIDO2 large-blob store".into());
        }
        // Read the world-readable array BEFORE any credential-management borrow —
        // matches the CLI's device-ownership ordering (see `enumerate_ssh_credentials`).
        let array = keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
        let wire =
            keyroost_ctap::large_blobs::extract_cert_from_entries(large_blob_key, &array.entries)
                .ok_or("no certificate is stored for this credential")?;
        let cert_pub = keyroost_ctap::ssh_cert::to_cert_pub(&wire)
            .ok_or("stored blob is not a valid OpenSSH certificate")?;
        // to_cert_pub already parsed the wire, so parse_wire here cannot fail;
        // fall back to a minimal label rather than erroring if it somehow does.
        let summary = keyroost_ctap::ssh_cert::parse_wire(&wire)
            .map(|info| ssh_cert_summary(&info))
            .unwrap_or_else(|| "OpenSSH certificate".to_string());
        Ok(PendingSshCert { cert_pub, summary })
    }

    fn submit_change_pin(&mut self) {
        // Check busy *before* consuming the typed PINs (see try_unlock).
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        // Zeroizing so the in-use copies (moved into the job, and any dropped on
        // an early return below) don't leave the PIN in freed memory.
        let old = zeroize::Zeroizing::new(std::mem::take(&mut self.security_keys.change_pin.old));
        let new = zeroize::Zeroizing::new(std::mem::take(&mut self.security_keys.change_pin.new));
        let confirm =
            zeroize::Zeroizing::new(std::mem::take(&mut self.security_keys.change_pin.confirm));
        if old.is_empty() || new.is_empty() {
            self.security_keys.error = Some("both PIN fields are required".into());
            return;
        }
        // Same validation as set-PIN: catch a mistyped new PIN before it's
        // committed to the device (a typo here can lock the key — #79).
        if new.chars().count() < 4 {
            self.security_keys.error = Some("PIN must be at least 4 characters".into());
            return;
        }
        if *new != *confirm {
            self.security_keys.error = Some("the two PINs don't match".into());
            return;
        }
        self.spawn_job("Changing PIN\u{2026}", move || {
            let result = Self::try_change_pin(&target, &old, &new).map_err(|e| e.to_string());
            Box::new(move |app: &mut App| match result {
                Ok(()) => {
                    app.security_keys.change_pin.open = false;
                    app.security_keys.error = None;
                    // Force re-unlock with the new PIN.
                    app.lock_session();
                }
                Err(e) => app.security_keys.error = Some(format!("change PIN failed: {}", e)),
            })
        });
    }

    fn try_change_pin(
        target: &FidoTarget,
        old: &str,
        new: &str,
    ) -> Result<(), Box<dyn std::error::Error>> {
        let (mut dev, _cbor, _init) = open_fido(target)?;
        keyroost_ctap::client_pin::change_pin(&mut dev, old, new)?;
        Ok(())
    }

    /// Set a first-time PIN on a key that has none (CTAP setPIN). Validates that
    /// the two entries match and meet the 4-char minimum, then re-reads info so
    /// the status flips to "PIN set".
    fn submit_set_pin(&mut self) {
        // Check busy *before* consuming the typed PINs (see try_unlock).
        if self.busy() {
            return;
        }
        let Some(target) = self.selected_fido_target() else {
            return;
        };
        let new = zeroize::Zeroizing::new(std::mem::take(&mut self.security_keys.change_pin.new));
        let confirm =
            zeroize::Zeroizing::new(std::mem::take(&mut self.security_keys.change_pin.confirm));
        if new.chars().count() < 4 {
            self.security_keys.error = Some("PIN must be at least 4 characters".into());
            return;
        }
        if *new != *confirm {
            self.security_keys.error = Some("the two PINs don't match".into());
            return;
        }
        self.spawn_job("Setting PIN\u{2026}", move || {
            let result = (|| -> Result<(), String> {
                let (mut dev, _cbor, _init) = open_fido(&target)?;
                keyroost_ctap::client_pin::set_pin(&mut dev, &new).map_err(|e| e.to_string())
            })();
            Box::new(move |app: &mut App| match result {
                Ok(()) => {
                    app.security_keys.change_pin = ChangePinDialog::default();
                    app.security_keys.error = None;
                    app.fetch_selected_info();
                }
                Err(e) => app.security_keys.error = Some(format!("set PIN failed: {e}")),
            })
        });
    }

    /// The transport descriptor for the selected FIDO key: a USB-HID path, or a
    /// PC/SC reader name (NFC or contact). Prefers HID when both are present (a
    /// USB key that also exposes a CCID interface).
    fn selected_fido_target(&self) -> Option<FidoTarget> {
        let d = self.selected_device()?;
        if let Some(p) = d.hid_path.clone() {
            return Some(FidoTarget::Hid(p));
        }
        if d.caps.has(Caps::FIDO2) {
            if let Some(r) = d.reader.clone() {
                return Some(FidoTarget::Pcsc(r));
            }
        }
        None
    }

    /// The selected key's USB-HID path, if any. Used only by the armed-reset
    /// hotplug tracker, which watches for a USB key being unplugged and
    /// replugged within the reset window — a USB-only concept (an NFC tap has no
    /// replug), so this intentionally returns `None` for reader-attached keys.
    fn selected_fido_hid_path(&self) -> Option<std::path::PathBuf> {
        self.selected_device().and_then(|d| d.hid_path.clone())
    }

    /// The reader to run an in-place card reset against — `Some` only for a
    /// FIDO2 device that is a card in a PC/SC reader with no USB-HID interface.
    ///
    /// The replug ceremony cannot work for such a device: there is nothing to
    /// unplug, no touch surface, and the arm's removal detector keys on a HID
    /// path the device does not have, so before this route existed the dialog
    /// simply polled forever (issue #84). A card gets the equivalent another
    /// way — PC/SC power-cycles it in the reader, which starts the same
    /// post-power-up window `authenticatorReset` must land in.
    ///
    /// A USB key that *also* exposes a CCID reader returns `None`: it has a
    /// real replug, and that ceremony's proof-of-possession is stronger than
    /// an in-place cycle, so it must not be bypassed just because a reader
    /// name is available.
    fn card_reset_reader(dev: Option<&keyroost_resolve::Device>) -> Option<String> {
        let d = dev?;
        if d.hid_path.is_none() && d.caps.has(Caps::FIDO2) {
            d.reader.clone()
        } else {
            None
        }
    }

    /// Fold a finished FIDO reset into the app, bound to the key the reset was
    /// dispatched for. Lifted out of `submit_reset_path`'s apply closure so the
    /// device-binding rule is exercisable without a key in hand; the guard is
    /// this function's first statement, which is what the closure's convention
    /// (see [`completion_still_valid`]) asks for.
    ///
    /// `for_device` is the selection at dispatch. The factory-reset report is
    /// app-global state that `on_device_selected` re-points at whatever key is
    /// selected now, so an unbound write paints one key's wipe under another
    /// key's name — the worst possible lie for this pane. A completion that
    /// outlives its selection is dropped, and said out loud in the log: the
    /// wipe did happen, and no report on screen can honestly show it.
    fn apply_reset_path_outcome(
        app: &mut App,
        for_device: Option<&DeviceId>,
        result: Result<(), String>,
    ) {
        if !completion_still_valid(for_device, app.selected_device.as_ref()) {
            // Selection changed mid-reset; don't paint A's outcome under B.
            let note = match &result {
                Ok(()) => "a security key finished its FIDO2 reset after the selection moved on \
                           \u{2014} its passkeys and PIN are wiped. The report on screen belongs \
                           to the key selected now, so it does not show that wipe."
                    .to_string(),
                Err(e) => format!(
                    "a security key's FIDO2 reset failed after the selection moved on \
                     \u{2014} its passkeys and PIN are still on it: {e}"
                ),
            };
            app.log(Severity::Warn, note);
            return;
        }
        match result {
            Ok(()) => {
                app.security_keys.session = None;
                app.security_keys.info = None;
                app.security_keys.error = None;
                // When this reset was a factory reset's finale, record it —
                // the Overview report is where the user is looking, and the
                // activity log, where the permanent record lives.
                let outcome = keyroost_resolve::StepOutcome::Wiped;
                if resolve_fido_reset_row(&mut app.factory_reset_report, outcome.clone()) {
                    let (severity, line) = factory_reset_fido_finale_log_line(&outcome);
                    app.log(severity, line);
                }
                // Re-read info so the PIN status reflects the wipe.
                app.fetch_selected_info();
            }
            Err(e) => {
                let msg = if e.contains("NOT_ALLOWED") || e.contains("0x30") {
                    "This key refused the reset. Most security keys (YubiKey \
                     included) only allow a FIDO reset within about 10 seconds \
                     of being plugged in. Unplug the key, plug it back in, then \
                     click \u{201C}Reset key\u{201D} again right away."
                        .to_string()
                } else {
                    format!("reset failed: {e}")
                };
                // `security_keys.error` is painted only in the FIDO2 and PIN
                // panes; a factory reset leaves the user on Overview, so the
                // failure has to land in the report too or the wipe looks
                // complete when the passkeys and PIN survived — and in the
                // activity log, so the permanent record doesn't stop at
                // whatever the card sweep alone finished with.
                let outcome = keyroost_resolve::StepOutcome::Failed(msg.clone());
                if resolve_fido_reset_row(&mut app.factory_reset_report, outcome.clone()) {
                    let (severity, line) = factory_reset_fido_finale_log_line(&outcome);
                    app.log(severity, line);
                }
                app.security_keys.error = Some(msg);
            }
        }
    }

    /// Wipe the FIDO key at `path` (authenticatorReset). Runs on the worker
    /// thread — the card needs a touch within ~30s, which the worker keeps off
    /// the UI frame. Used by the armed-reset flow, which targets the
    /// just-reconnected key rather than the (now stale) selection. On success
    /// the cached session and CTAP info are cleared.
    fn submit_reset_path(&mut self, path: std::path::PathBuf) -> bool {
        // The ceremony is device-bound like every other dispatcher: the key
        // being wiped is the one selected when the arm was set (selecting
        // another key disarms), and the outcome may only be written under that
        // selection.
        let for_device = self.selected_device.clone();
        self.spawn_job("Resetting key\u{2026} (touch now)", move || {
            let result = (|| -> Result<(), String> {
                // A just-replugged node (especially on a fresh port) can take a
                // moment to accept opens; retry briefly before giving up.
                let mut dev = None;
                for attempt in 0..10 {
                    match CtapHidDevice::open(&path) {
                        Ok((d, _)) => {
                            dev = Some(d);
                            break;
                        }
                        Err(e) if attempt == 9 => return Err(e.to_string()),
                        Err(_) => std::thread::sleep(std::time::Duration::from_millis(100)),
                    }
                }
                let mut dev = dev.ok_or_else(|| "could not open key".to_string())?;
                keyroost_ctap::reset(&mut dev).map_err(|e| e.to_string())
            })();
            Box::new(move |app: &mut App| {
                App::apply_reset_path_outcome(app, for_device.as_ref(), result)
            })
        })
    }

    /// Wipe the FIDO applet of a card sitting in `reader` (authenticatorReset,
    /// in place). The card analogue of [`Self::submit_reset_path`]: PC/SC
    /// power-cycles the card, which starts the post-power-up window the reset
    /// must land in, and the wipe is sent the moment the applet answers — no
    /// replug, no touch. Outcome lands through the same completion handler as
    /// the replug flow, so the factory-reset report and the FIDO2 pane both
    /// hear about it.
    fn submit_card_reset(&mut self, reader: String) -> bool {
        let for_device = self.selected_device.clone();
        self.spawn_job("Resetting card\u{2026}", move || {
            let result = (|| -> Result<(), String> {
                let mut dev = keyroost_transport::CtapPcscDevice::open_after_power_cycle(&reader)
                    .map_err(|e| e.to_string())?;
                keyroost_ctap::reset(&mut dev).map_err(|e| {
                    let s = e.to_string();
                    // Rewrite the refusal here, not in the shared handler: its
                    // NOT_ALLOWED advice ("unplug the key, plug it back in")
                    // is USB advice, and following it would eject the card
                    // for nothing.
                    if s.contains("NOT_ALLOWED") || s.contains("0x30") {
                        "the card refused the reset even straight after a power \
                         cycle. Some cards only accept a FIDO reset over NFC \
                         (contactless) rather than a contact reader \u{2014} \
                         try a contactless reader or the vendor's mobile app."
                            .to_string()
                    } else {
                        s
                    }
                })
            })();
            Box::new(move |app: &mut App| {
                App::apply_reset_path_outcome(app, for_device.as_ref(), result)
            })
        })
    }

    fn selected_oath_reader(&self) -> Option<String> {
        self.selected_device().and_then(|d| d.reader.clone())
    }

    /// Off-thread helper: open `name` and unlock with `password` if protected.
    fn oath_open_unlock(
        name: &str,
        password: &str,
    ) -> Result<keyroost_transport::OathSession, TransportError> {
        let mut session = keyroost_transport::OathSession::open(name)?;
        if session.password_required() {
            session.unlock(password)?;
        }
        Ok(session)
    }

    /// Off-thread helper: list credentials and compute each current TOTP. Also
    /// returns how many undecodable entries the card holds (partial listing).
    fn oath_list_rows(
        session: &mut keyroost_transport::OathSession,
    ) -> Result<(Vec<OathRow>, usize), TransportError> {
        let now = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .map(|d| d.as_secs())
            .unwrap_or(0);
        let listing = session.list()?;
        let mut rows = Vec::new();
        for c in listing.credentials {
            let hotp = matches!(c.oath_type, keyroost_oath::OathType::Hotp);
            // HOTP codes are never computed during a listing: the card
            // advances the credential's counter on every CALCULATE (the time
            // challenge is ignored), so a passive refresh would silently walk
            // the card out of the server's look-ahead window. The row shows a
            // "Read code" button instead.
            let code = if hotp {
                None
            } else {
                // A touch-required credential blocks until touched; fine off-thread.
                session
                    .calculate_totp(&c.name, now, 30)
                    .ok()
                    .map(|otp| otp.code)
            };
            rows.push(OathRow {
                name: c.name,
                code,
                hotp,
            });
        }
        // Group without headers: live TOTP codes first, on-demand HOTP rows
        // after (stable — card order preserved within each group).
        rows.sort_by_key(|r| r.hotp);
        Ok((rows, listing.skipped))
    }

    /// Compute one HOTP code on explicit request and patch it into the row.
    /// Deliberately not part of the listing: each computation advances the
    /// card's counter.
    fn read_hotp_code(&mut self, name: &str) {
        self.oath.error = None;
        let Some(reader) = self.selected_oath_reader() else {
            self.oath.error = Some("no OATH key selected".into());
            return;
        };
        let cred = name.to_owned();
        // The listing already consumed (wiped) password_input, so this read
        // sends the retained accepted password — an empty string here could
        // never unlock a protected applet and re-locked the pane every time.
        let password = oath_effective_password(&self.oath);
        let for_device = self.selected_device.clone();
        self.spawn_job("Reading code\u{2026}", move || {
            let result = (|| -> Result<String, TransportError> {
                let mut session = Self::oath_open_unlock(&reader, &password)?;
                Ok(session.calculate_hotp(&cred)?.code)
            })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                // The typed password is consumed whatever the outcome (mirrors
                // apply_oath_rows).
                wipe(&mut app.oath.password_input);
                match result {
                    Ok(code) => {
                        // This password worked (or none was needed): retain it,
                        // like a successful listing does.
                        app.oath.unlocked_password = Some(password);
                        if let Some(row) = app.oath.creds.iter_mut().find(|r| r.name == cred) {
                            row.code = Some(code);
                        }
                    }
                    Err(TransportError::OathPasswordRejected) => {
                        app.oath.unlocked_password = None;
                        app.oath.locked = true;
                        app.oath.error = Some("wrong OATH password".into());
                    }
                    Err(e) => app.oath.error = Some(e.to_string()),
                }
            })
        });
    }

    /// Store the outcome of an op that ends by (re)listing credentials.
    /// `password` is the password the op sent: on success it is retained in
    /// `unlocked_password` for later on-demand reads (HOTP "Read code" runs
    /// long after `password_input` was consumed); on a rejected password the
    /// retained copy is dropped too.
    fn apply_oath_rows(
        app: &mut App,
        result: Result<(Vec<OathRow>, usize), TransportError>,
        password: zeroize::Zeroizing<String>,
    ) {
        // The typed password is consumed whatever the outcome — success,
        // wrong-password, or a transport error must not leave it buffered for
        // an automatic retry against (potentially) a different key.
        wipe(&mut app.oath.password_input);
        // Mirror the outcome into the add modal when one is in flight (the
        // provision op routes through here), so success/error shows *in* the
        // dialog (issue #31) rather than only as a pane-level error line.
        let modal_busy = app.oath.add.open && app.oath.add.busy;
        match &result {
            Ok(_) if modal_busy => app.oath.add.result = Some(Ok(())),
            Err(TransportError::OathPasswordRejected) if modal_busy => {
                app.oath.add.result = Some(Err("wrong OATH password".into()));
            }
            Err(e) if modal_busy => app.oath.add.result = Some(Err(e.to_string())),
            _ => {}
        }
        if app.oath.add.open {
            app.oath.add.busy = false;
        }
        match result {
            Ok((rows, skipped)) => {
                // The applet accepted this password (or needed none): retain
                // it for on-demand reads against the same selection.
                app.oath.unlocked_password = Some(password);
                app.oath.creds = rows;
                app.oath.skipped = skipped;
                app.oath.loaded = true;
                app.oath.locked = false;
            }
            Err(TransportError::OathPasswordRejected) => {
                app.oath.unlocked_password = None;
                app.oath.locked = true;
                // The add modal already shows this; don't double-report when it
                // is the one that failed.
                if !modal_busy {
                    app.oath.error = Some("wrong OATH password".into());
                }
            }
            Err(e) => {
                // A transport error says nothing about the password; keep any
                // retained copy so a transient failure doesn't force a retype.
                if !modal_busy {
                    app.oath.error = Some(e.to_string());
                }
            }
        }
    }

    /// List credentials on the selected key, computing each current TOTP. Unlocks
    /// first with the entered password when the applet is protected.
    fn load_oath_creds(&mut self) {
        self.oath.error = None;
        let Some(name) = self.selected_oath_reader() else {
            self.oath.error = Some("no OATH key selected".into());
            return;
        };
        let password = oath_effective_password(&self.oath);
        let for_device = self.selected_device.clone();
        self.spawn_job("Reading OATH codes\u{2026}", move || {
            let result = Self::oath_open_unlock(&name, &password)
                .and_then(|mut session| Self::oath_list_rows(&mut session));
            Box::new(move |app: &mut App| {
                // Discard if the user switched devices while the read (which
                // can block on a touch) was in flight — device B's pane must
                // not show device A's codes.
                if completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    Self::apply_oath_rows(app, result, password);
                }
            })
        });
    }

    /// Provision the credential described by the add-dialog fields.
    fn provision_oath(&mut self) {
        self.oath.error = None;
        let Some(name) = self.selected_oath_reader() else {
            self.oath.error = Some("no OATH key selected".into());
            return;
        };
        // Validate before dispatch; the modal surfaces the reason on failure.
        let (cred_name, secret) = match self.oath.add.validate() {
            Ok((n, s)) => (n, zeroize::Zeroizing::new(s)),
            Err(e) => {
                self.oath.error = Some(e);
                return;
            }
        };
        let oath_type = if self.oath.add.totp {
            keyroost_oath::OathType::Totp
        } else {
            keyroost_oath::OathType::Hotp
        };
        let require_touch = self.oath.add.require_touch;
        let password = oath_effective_password(&self.oath);
        // The form stays open showing the spinner; it is wiped/closed on the
        // modal's Done (success) or Cancel/✕/Esc. Do not reset it here.
        let for_device = self.selected_device.clone();
        self.spawn_job("Adding credential\u{2026}", move || {
            let result = (|| -> Result<(Vec<OathRow>, usize), TransportError> {
                let mut session = Self::oath_open_unlock(&name, &password)?;
                session.put(&keyroost_oath::PutParams {
                    name: &cred_name,
                    secret: &secret,
                    oath_type,
                    algorithm: keyroost_oath::Algorithm::Sha1,
                    digits: 6,
                    require_touch,
                    imf: 0,
                })?;
                Self::oath_list_rows(&mut session)
            })();
            Box::new(move |app: &mut App| {
                if completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    Self::apply_oath_rows(app, result, password);
                }
            })
        });
    }

    /// Delete the named credential (already confirmed).
    fn delete_oath(&mut self, name: &str) {
        self.oath.error = None;
        let Some(reader) = self.selected_oath_reader() else {
            self.oath.error = Some("no OATH key selected".into());
            return;
        };
        let cred_name = name.to_owned();
        let password = oath_effective_password(&self.oath);
        let for_device = self.selected_device.clone();
        self.spawn_job("Deleting credential\u{2026}", move || {
            let result = (|| -> Result<(Vec<OathRow>, usize), TransportError> {
                let mut session = Self::oath_open_unlock(&reader, &password)?;
                session.delete(&cred_name)?;
                Self::oath_list_rows(&mut session)
            })();
            Box::new(move |app: &mut App| {
                if completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    Self::apply_oath_rows(app, result, password);
                }
            })
        });
    }

    /// Close the "Add credential" modal, wiping the typed secret. (`OathAddDialog`
    /// also wipes on drop; the explicit reset here makes the close-path intent
    /// clear and mirrors the PIV/OpenPGP `*_cred_modal_close` helpers.)
    fn oath_add_modal_close(&mut self) {
        wipe(&mut self.oath.add.secret);
        self.oath.add = OathAddDialog::default();
    }

    /// Centered "New credential" modal: the name + base32 **secret** + type/touch
    /// fields live *inside* the shared `modal_window` chrome (not inline in the
    /// pane), so the secret entry and its result stay on-screen — matching the
    /// PIV/OpenPGP credential modals (issue #31). Submit dispatches the unchanged
    /// `provision_oath`; the outcome is mirrored back via `apply_oath_rows`. The
    /// secret is wiped on Done/Cancel/✕/Esc.
    fn render_oath_add_modal(&mut self, ctx: &egui::Context, p: &Palette) {
        if !self.oath.add.open {
            return;
        }
        let busy = self.oath.add.busy;
        let result = self.oath.add.result.clone();

        let mut want_submit = false;
        let mut want_close = false;

        let closed = Self::modal_window(ctx, p, "oath_add", "New credential", 300.0, |ui| {
            match &result {
                Some(Ok(())) => {
                    // Success: confirmation + a single Done that dismisses.
                    ui.label(
                        egui::RichText::new("\u{2713} Credential added")
                            .font(theme::f_sb(13.0))
                            .color(p.ok),
                    );
                    ui.add_space(16.0);
                    if theme::button(ui, p, BtnKind::Primary, "Done").clicked() {
                        want_close = true;
                    }
                }
                _ => {
                    // Entry form (also the path while busy / after an error so the
                    // user can retry without losing the dialog).
                    ui.horizontal(|ui| {
                        ui.add_sized(
                            [96.0, 22.0],
                            egui::Label::new(
                                egui::RichText::new("Name")
                                    .font(theme::f_reg(13.0))
                                    .color(p.txt2),
                            ),
                        );
                        ui.add(
                            egui::TextEdit::singleline(&mut self.oath.add.name)
                                .hint_text("issuer:account")
                                .desired_width(300.0),
                        );
                    });
                    ui.add_space(4.0);
                    secret_field(
                        ui,
                        p,
                        "Secret",
                        &mut self.oath.add.secret,
                        "base32 (behind the QR code)",
                        96.0,
                        300.0,
                    );
                    #[cfg(feature = "qr")]
                    {
                        ui.add_space(4.0);
                        ui.horizontal(|ui| {
                            ui.add_space(100.0);
                            if scan_qr_button(ui, p) {
                                self.oath_scan_qr();
                            }
                        });
                    }
                    ui.horizontal(|ui| {
                        ui.add_sized(
                            [96.0, 22.0],
                            egui::Label::new(
                                egui::RichText::new("Type")
                                    .font(theme::f_reg(13.0))
                                    .color(p.txt2),
                            ),
                        );
                        ui.selectable_value(&mut self.oath.add.totp, true, "TOTP");
                        ui.selectable_value(&mut self.oath.add.totp, false, "HOTP");
                    });
                    ui.add_space(4.0);
                    ui.checkbox(&mut self.oath.add.require_touch, "Require touch");
                    card_note(
                        ui,
                        p,
                        "The secret is sent to the key, not written to disk by keyroost.",
                    );

                    if let Some(Err(e)) = &result {
                        ui.add_space(6.0);
                        ui.colored_label(p.err, e);
                    }

                    ui.add_space(16.0);
                    ui.horizontal(|ui| {
                        if busy {
                            ui.add(egui::Spinner::new());
                            ui.label(
                                egui::RichText::new("Adding credential\u{2026}")
                                    .font(theme::f_reg(12.5))
                                    .color(p.txt2),
                            );
                        } else {
                            if theme::button(ui, p, BtnKind::Primary, "Add").clicked() {
                                want_submit = true;
                            }
                            ui.add_space(8.0);
                            if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                                want_close = true;
                            }
                        }
                    });
                }
            }
        });

        // ✕ / Esc / Cancel dismiss too, but never yank the dialog out from under
        // a running op (mirrors the PIV/OpenPGP modals' busy handling).
        if (closed || want_close) && !busy {
            self.oath_add_modal_close();
            return;
        }
        if want_submit && !busy {
            // Mark busy first so the modal shows the spinner this frame; the op
            // writes the outcome back via `apply_oath_rows`.
            self.oath.add.busy = true;
            self.oath.add.result = None;
            self.oath.error = None;
            self.provision_oath();
            // If the op didn't actually queue — the worker was busy (no error
            // set; retry on the next click) or a client-side guard rejected the
            // input and stored the reason in `oath.error` — unstick the modal and
            // surface the guard reason in the dialog rather than the pane.
            if !self.busy() {
                let guard_err = self.oath.error.take();
                self.oath.add.busy = false;
                if let Some(e) = guard_err {
                    self.oath.add.result = Some(Err(e));
                }
            }
        }
    }

    /// Modal confirmation before deleting a credential (irreversible). Bound
    /// to the device it was opened for: if the selection has moved the
    /// confirmation is dropped instead of rendered, and the dispatch is
    /// re-checked, so `delete_oath` can never open a different reader than
    /// the one the user confirmed against (KEY-008).
    fn render_oath_delete_confirm(&mut self, ctx: &egui::Context) {
        let Some((for_device, name)) = self.oath.confirm_delete.clone() else {
            return;
        };
        if !completion_still_valid(Some(&for_device), self.selected_device.as_ref()) {
            self.oath.confirm_delete = None;
            return;
        }
        let mut decision: Option<bool> = None;
        egui::Window::new("Delete credential?")
            .collapsible(false)
            .resizable(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .show(ctx, |ui| {
                ui.label(format!(
                    "Permanently delete \u{201c}{name}\u{201d} from this key? \
                     This cannot be undone."
                ));
                ui.add_space(6.0);
                ui.horizontal(|ui| {
                    if ui.button("Delete").clicked() {
                        decision = Some(true);
                    }
                    if ui.button("Cancel").clicked() {
                        decision = Some(false);
                    }
                });
            });
        match decision {
            Some(true) => {
                self.oath.confirm_delete = None;
                self.delete_oath(&name);
            }
            Some(false) => self.oath.confirm_delete = None,
            None => {}
        }
    }

    /// Modal confirmation before factory-resetting the OATH applet. Same
    /// device binding as the delete confirmation (KEY-008): a stale
    /// confirmation is dropped, never rendered over the new selection.
    fn render_oath_reset_confirm(&mut self, ctx: &egui::Context) {
        let Some(for_device) = self.oath.confirm_reset.clone() else {
            return;
        };
        if !completion_still_valid(Some(&for_device), self.selected_device.as_ref()) {
            self.oath.confirm_reset = None;
            return;
        }
        let mut decision: Option<bool> = None;
        egui::Window::new("Reset OATH applet?")
            .collapsible(false)
            .resizable(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .show(ctx, |ui| {
                ui.label(
                    "Permanently wipe EVERY authenticator credential on this key \
                     and clear its password? This cannot be undone.",
                );
                ui.add_space(6.0);
                ui.horizontal(|ui| {
                    if ui.button("Reset applet").clicked() {
                        decision = Some(true);
                    }
                    if ui.button("Cancel").clicked() {
                        decision = Some(false);
                    }
                });
            });
        match decision {
            Some(true) => {
                self.oath.confirm_reset = None;
                self.reset_oath_applet();
            }
            Some(false) => self.oath.confirm_reset = None,
            None => {}
        }
    }

    /// Factory-reset the OATH applet on the selected key. Opens WITHOUT
    /// unlocking — the applet's RESET requires no password (it is the
    /// recovery path for a forgotten one) — then rebuilds the pane state
    /// from scratch, which now shows an empty, unprotected applet.
    fn reset_oath_applet(&mut self) {
        self.oath.error = None;
        let Some(reader) = self.selected_oath_reader() else {
            self.oath.error = Some("no OATH key selected".into());
            return;
        };
        let for_device = self.selected_device.clone();
        self.spawn_job("Resetting OATH applet\u{2026}", move || {
            let result = (|| -> Result<(), TransportError> {
                let mut session = keyroost_transport::OathSession::open(&reader)?;
                session.factory_reset()
            })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return;
                }
                match result {
                    Ok(()) => {
                        // Fresh state: the applet is now empty and unprotected;
                        // clearing oath_tried lets the pane re-list on its own.
                        app.oath = OathState::default();
                        app.oath_tried = false;
                    }
                    Err(e) => app.oath.error = Some(format!("reset failed: {e}")),
                }
            })
        });
    }

    /// The "Factory reset…" button's click handler: arms the confirm dialog
    /// for the selected device, but if its plan includes a PIV step,
    /// fingerprints PIV on the worker first — both `PivResetPreview`
    /// (`PivSession::preview_factory_reset` — read-only, no PIN/PUK attempt;
    /// tells the confirm dialog exactly which mechanism `factory_reset` will
    /// run, or that neither is available) and whether that mechanism needs a
    /// credential (`PivSession::global_reset_available`) — so the dialog's
    /// text can say exactly what will happen (or be skipped) instead of
    /// hedging across every possibility before the fact, and so it knows
    /// whether to show the credential prompt at all. Same verdict
    /// `PivSession::factory_reset` resolves again when the reset actually runs
    /// — see `FactoryResetPivPreview`'s doc for why that's a deliberate,
    /// cheap re-check rather than reused state (`needs_reset_mgmt_auth` itself,
    /// unlike `piv_preview`, IS carried forward into `run_factory_reset_gui`
    /// rather than re-fingerprinted — see that method's doc for why the two
    /// differ).
    ///
    /// A device with no PIV step arms immediately. A device with one arms
    /// only once the fingerprint job completes; a click while a job is
    /// already in flight silently drops (the button can simply be pressed
    /// again) — nothing user-typed is at stake here, unlike the callers
    /// `spawn_job`'s own doc warns about.
    fn start_factory_reset_confirm(&mut self) {
        let Some(dev) = self.selected_device().cloned() else {
            return;
        };
        self.factory_reset_confirm_typed.clear();
        let plan = keyroost_resolve::factory_reset_plan(dev.caps);
        if !plan.contains(&keyroost_resolve::ResetStep::Piv) {
            self.factory_reset_confirm = Some(FactoryResetConfirmState {
                for_device: dev.id,
                piv_preview: FactoryResetPivPreview::NotOffered,
                needs_reset_mgmt_auth: false,
                default_mgmt_key: None,
                reset_long_running: false,
            });
            return;
        }
        let Some(reader) = dev.reader.clone() else {
            // `Caps::PIV` says PIV should be reachable, but there's no PC/SC
            // reader to fingerprint it over (shouldn't happen in practice) —
            // arm with the same fallback wording an outright fingerprint
            // failure gets rather than get stuck offering nothing.
            self.factory_reset_confirm = Some(FactoryResetConfirmState {
                for_device: dev.id,
                piv_preview: FactoryResetPivPreview::CheckFailed,
                needs_reset_mgmt_auth: false,
                default_mgmt_key: None,
                reset_long_running: false,
            });
            return;
        };
        let for_device = dev.id;
        self.spawn_job("Checking PIV reset support\u{2026}", move || {
            let (preview, needs_reset_mgmt_auth, default_mgmt_key, reset_long_running) =
                keyroost_transport::PivSession::with_transaction(&reader, |s| {
                    // One fingerprint serves all four checks — see
                    // `PivSession::preview_factory_reset`/
                    // `global_reset_available`/`default_management_key`/
                    // `quirks`'s docs.
                    let preview = FactoryResetPivPreview::Resolved(s.preview_factory_reset());
                    Ok::<_, TransportError>((
                        preview,
                        s.global_reset_available(),
                        s.default_management_key(),
                        s.quirks()
                            .contains(&keyroost_piv::compat::PivQuirk::ResetLongRunning),
                    ))
                })
                .unwrap_or((
                    FactoryResetPivPreview::CheckFailed,
                    false,
                    None,
                    false,
                ));
            Box::new(move |app: &mut App| {
                if !completion_still_valid(Some(&for_device), app.selected_device.as_ref()) {
                    return;
                }
                app.factory_reset_confirm = Some(FactoryResetConfirmState {
                    for_device,
                    piv_preview: preview,
                    needs_reset_mgmt_auth,
                    default_mgmt_key,
                    reset_long_running,
                });
            })
        });
    }

    /// Confirm modal for the whole-device factory reset. Device-bound like
    /// `render_oath_reset_confirm`: it dies the instant the selection changes,
    /// so a confirmed wipe can only ever land on the key it was opened for
    /// (KEY-008). "Yes, wipe this key" starts the sequential reset job.
    fn render_factory_reset_confirm(&mut self, ctx: &egui::Context, p: &Palette) {
        let Some(FactoryResetConfirmState {
            for_device,
            piv_preview,
            needs_reset_mgmt_auth,
            default_mgmt_key,
            reset_long_running,
        }) = self.factory_reset_confirm.clone()
        else {
            return;
        };
        if !completion_still_valid(Some(&for_device), self.selected_device.as_ref()) {
            self.factory_reset_confirm = None;
            self.factory_reset_confirm_error = None;
            self.factory_reset_confirm_typed.clear();
            return;
        }
        let summary = match self.selected_device() {
            Some(dev) => {
                let mut plan = keyroost_resolve::factory_reset_plan(dev.caps);
                if factory_reset_piv_unresettable(piv_preview) {
                    keyroost_resolve::exclude_unresettable_piv(&mut plan);
                }
                factory_reset_confirm_summary(
                    &dev.serial,
                    &dev.model,
                    &plan,
                    piv_preview,
                    needs_reset_mgmt_auth,
                    reset_long_running,
                )
            }
            None => {
                self.factory_reset_confirm = None;
                self.factory_reset_confirm_error = None;
                self.factory_reset_confirm_typed.clear();
                return;
            }
        };
        let mut decision: Option<bool> = None;
        egui::Window::new("Factory reset this key?")
            .collapsible(false)
            .resizable(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .show(ctx, |ui| {
                ui.label(summary);
                if needs_reset_mgmt_auth {
                    ui.add_space(8.0);
                    self.factory_reset_mgmt_auth_field(ui, p, default_mgmt_key);
                }
                if let Some(err) = &self.factory_reset_confirm_error {
                    ui.add_space(6.0);
                    ui.colored_label(p.err, err);
                }
                ui.add_space(8.0);
                ui.horizontal(|ui| {
                    ui.label("Type \u{201c}reset\u{201d} to confirm:");
                    ui.add(
                        egui::TextEdit::singleline(&mut self.factory_reset_confirm_typed)
                            .desired_width(120.0),
                    );
                });
                ui.add_space(8.0);
                let armed = self.factory_reset_confirm_typed.trim() == "reset";
                ui.horizontal(|ui| {
                    ui.add_enabled_ui(armed, |ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Yes, wipe this key").clicked() {
                            decision = Some(true);
                        }
                    });
                    if ui.button("Cancel").clicked() {
                        decision = Some(false);
                    }
                });
            });
        match decision {
            Some(true) => {
                if self.run_factory_reset_gui() {
                    self.factory_reset_confirm = None;
                    self.factory_reset_confirm_error = None;
                    self.factory_reset_confirm_typed.clear();
                }
                // else: either a job is already in flight, or the entered
                // credential didn't validate (`factory_reset_confirm_error`
                // is now set) — either way keep the modal open so the
                // confirmed wipe isn't silently swallowed; the user can fix
                // the input or retry once the worker clears.
            }
            Some(false) => {
                self.factory_reset_confirm = None;
                self.factory_reset_confirm_error = None;
                self.factory_reset_confirm_typed.clear();
                wipe(&mut self.reset_mgmt_auth_input);
            }
            None => {}
        }
    }

    /// The factory-reset confirm dialog's management-auth credential prompt,
    /// shown whenever `FactoryResetConfirmState::needs_reset_mgmt_auth` is true —
    /// i.e. whenever `PivQuirk::ResetNeedsManagementAuth` applies.
    /// `PivSession::factory_reset` decides on its own, from the live
    /// fingerprint, which mechanism actually authenticates with what's typed
    /// here: HID Crescendo's ACA instance (today's only real consumer) or,
    /// on a fingerprint whose credential need is `PivExtension::Reset`
    /// alone, the standard PIV management-key round
    /// (`PivSession::authenticate_management_current`) — either way the same
    /// field, resolved into the same `keyroost_transport::CurrentMgmtAuth`.
    /// Same toggle-plus-field shape and wording as `App::piv_modal_mgmt_field`
    /// — "Use default management key" / "Use PIN" checkboxes, each a pure
    /// view onto (and setter of) `reset_mgmt_auth_mode`, plus the typed field
    /// underneath when neither is ticked or "Use PIN" is. `default_key` is
    /// `FactoryResetConfirmState::default_mgmt_key`, resolved for this
    /// device by the same fingerprint job that armed the dialog; mirroring
    /// `piv_modal_mgmt_field`, the checkbox is disabled — and reset back to
    /// `Manual` if it was already ticked when the device stopped offering
    /// one — whenever this is `None`, and shows the hex value in a tooltip
    /// when it's `Some`, rather than assuming HID's factory value the way
    /// this dialog used to. Unlike `piv_modal_mgmt_field`, there's no
    /// `PinManagementAuth`-style support gate on "Use PIN": both choices are
    /// always valid here, the only question is which credential the user has
    /// on hand.
    fn factory_reset_mgmt_auth_field(
        &mut self,
        ui: &mut egui::Ui,
        p: &Palette,
        default_key: Option<&'static [u8]>,
    ) {
        if default_key.is_none() && self.reset_mgmt_auth_mode == ResetMgmtAuthMode::Default {
            // Same rationale as `piv_modal_mgmt_field`'s reset: don't leave
            // the toggle checked for a default a device switch just took
            // away.
            self.reset_mgmt_auth_mode = ResetMgmtAuthMode::Manual;
        }
        ui.horizontal(|ui| {
            let mut is_default = self.reset_mgmt_auth_mode == ResetMgmtAuthMode::Default;
            let mut resp = ui.add_enabled(
                default_key.is_some(),
                egui::Checkbox::new(&mut is_default, "Use default management key"),
            );
            if let Some(key) = default_key {
                // Only on the enabled checkbox — a disabled one has no
                // applicable default to show.
                resp = resp.on_hover_text(format!("Default management key: {}", hex_lower(key)));
            }
            if resp.changed() {
                self.reset_mgmt_auth_mode =
                    reset_mgmt_auth_mode_after_toggle(is_default, ResetMgmtAuthMode::Default);
            }
            let mut is_pin = self.reset_mgmt_auth_mode == ResetMgmtAuthMode::Pin;
            if ui.checkbox(&mut is_pin, "Use PIN").changed() {
                self.reset_mgmt_auth_mode =
                    reset_mgmt_auth_mode_after_toggle(is_pin, ResetMgmtAuthMode::Pin);
            }
        });
        if self.reset_mgmt_auth_mode == ResetMgmtAuthMode::Default {
            return;
        }
        let use_pin = self.reset_mgmt_auth_mode == ResetMgmtAuthMode::Pin;
        let (label, hint) = if use_pin {
            ("PIN", "PIN")
        } else {
            // Deliberately not `piv_modal_mgmt_field`'s "hex (48/32/64
            // chars)": HID's ACA XAUTH key — the credential this actually
            // authenticates with on every fingerprint that needs this field
            // today — only ever supports TDES/AES-128 (8/16/24-byte keys),
            // never AES-256, unlike the standard PIV 0x9B round.
            ("Management key", "hex (16/32/48 chars)")
        };
        let mut reset_mgmt_rev = self
            .secret_reveal
            .get("reset-mgmt-auth")
            .copied()
            .unwrap_or(false);
        piv_secret_field(
            ui,
            p,
            label,
            &mut self.reset_mgmt_auth_input,
            &mut reset_mgmt_rev,
            hint,
            96.0,
            300.0,
        );
        self.secret_reveal.insert("reset-mgmt-auth", reset_mgmt_rev);
    }

    /// Resolve the credential the user entered for the factory reset's
    /// management-auth step: `FactoryResetConfirmState::default_mgmt_key`
    /// when "Use default management key" is ticked, a typed PIN with "Use
    /// PIN" ticked, otherwise the typed management-key hex. Mirrors
    /// `App::piv_current_mgmt_key`'s shape and error wording for the
    /// `Default` case (down to reusing the exact same "no known default"
    /// message) and `App::piv_current_mgmt_auth`'s role: the one call site
    /// both the dialog's validation and `run_factory_reset_gui` go through,
    /// so the resolution logic can't drift between the two.
    fn reset_mgmt_current_auth(&self) -> Result<ResetMgmtAuth, String> {
        match self.reset_mgmt_auth_mode {
            ResetMgmtAuthMode::Default => self
                .factory_reset_confirm
                .as_ref()
                .and_then(|c| c.default_mgmt_key)
                .map(|key| ResetMgmtAuth::Key(zeroize::Zeroizing::new(key.to_vec())))
                .ok_or_else(|| "This device has no known default management key.".to_string()),
            ResetMgmtAuthMode::Pin => Ok(ResetMgmtAuth::Pin(zeroize::Zeroizing::new(
                self.reset_mgmt_auth_input.clone(),
            ))),
            ResetMgmtAuthMode::Manual => {
                piv_mgmt_key_bytes(&self.reset_mgmt_auth_input).map(ResetMgmtAuth::Key)
            }
        }
    }

    /// Fold a finished card sweep into the app, bound to the key it ran
    /// against. Lifted out of `run_factory_reset_gui`'s apply closure for the
    /// same reason as [`App::apply_reset_path_outcome`]: the device-binding
    /// rule is the part worth testing, and it needs no key in hand.
    ///
    /// Every path through here logs a plain-language summary
    /// (`factory_reset_report_summary`: which steps wiped, failed, or were
    /// skipped, and why) — independent of `factory_reset_report` (the
    /// Overview pane's own live list, overwritten by the next run) and
    /// independent of any APDU trace. That `log`/`log_global` call is also
    /// what flushes a trace captured for this job: `App::push_log` is the
    /// sole consumer of `App::pending_trace` (see `Worker::spawn`'s doc), so
    /// a path through here that never logs would silently drop it — this
    /// function used to have exactly one such path (see the orphaned case
    /// below, which already logged, and the normal case, which didn't).
    ///
    /// The orphaned case is louder here than anywhere else in the file. By the
    /// time this runs, every card step has already been executed against the
    /// key the sweep was dispatched for — OATH, OpenPGP, PIV and the Token2 OTP
    /// applet are wiped or half-wiped whatever the selection now says.
    /// `reports` is the only record of that, and it carries the one line that
    /// tells "wiped" apart from "PIN and PUK blocked but not wiped" (PIV's
    /// failure text). Dropping it silently loses the difference, so an outcome
    /// that outlives its selection is said out loud in the log instead.
    fn apply_factory_reset_sweep(
        app: &mut App,
        for_device: Option<&DeviceId>,
        reports: Vec<keyroost_resolve::StepReport>,
        ends_in_fido: bool,
    ) {
        use keyroost_resolve::{ResetStep, StepOutcome};
        if !completion_still_valid(for_device, app.selected_device.as_ref()) {
            // Selection changed mid-sweep; don't paint A's outcome under B —
            // and deliberately don't open the FIDO dialog either, because
            // arming a wipe under the key on screen now is exactly what the
            // guard exists to prevent.
            let fido_txt = if ends_in_fido {
                format!(
                    " {} was left un-wiped \u{2014} the replug-and-touch ceremony never started.",
                    ResetStep::Fido.label()
                )
            } else {
                String::new()
            };
            app.log_global(
                Severity::Warn,
                LogKind::User,
                format!(
                    "a factory reset finished after the selection moved on \u{2014} {}.{fido_txt} \
                     Re-select that key to see its current state and finish the reset.",
                    factory_reset_report_summary(&reports)
                ),
            );
            return;
        }
        // Re-initialise each wiped applet's pane to a fresh, empty state
        // (mirrors the OATH reset apply), clearing its "tried" flag so the
        // pane re-lists on its own.
        for r in &reports {
            // `WipedGlobal` and `WipedWithWarning` count here too: the
            // applet itself really was wiped, either cleanly via the
            // device-wide mechanism or with a non-fatal follow-up (today:
            // PIV's courtesy XAUTH-key restore) that didn't go cleanly --
            // the pane's stale state still needs clearing either way.
            if matches!(
                r.outcome,
                StepOutcome::Wiped | StepOutcome::WipedGlobal | StepOutcome::WipedWithWarning(_)
            ) {
                match r.step {
                    ResetStep::Oath => {
                        app.oath = OathState::default();
                        app.oath_tried = false;
                    }
                    ResetStep::OpenPgp => {
                        app.openpgp = OpenPgpState::default();
                    }
                    // Fires regardless of which mechanism `PivSession::
                    // factory_reset` actually ran (device-wide or PIV-only) --
                    // `ResetStep::Piv` covers both; there's no separate step
                    // for the device-wide path any more.
                    ResetStep::Piv => {
                        app.piv = PivState::default();
                        app.piv_tried = false;
                    }
                    ResetStep::Token2Otp => {
                        app.otp = OtpState::default();
                        app.otp_tried = false;
                    }
                    ResetStep::Fido => {}
                }
            }
        }
        // Record the run in the activity log — independent of any APDU
        // trace: whether a factory reset ran, which applets it wiped, and
        // which steps failed or were skipped (and why). This is also the
        // call that flushes a captured APDU trace: `App::push_log` is the
        // sole consumer of `App::pending_trace` (see `Worker::spawn`'s doc),
        // so without a `log` call here, a trace captured for this whole job
        // had nowhere to attach and was silently discarded — this whole
        // function used to report only through `factory_reset_report`
        // (the Overview pane's own list), never through the activity log.
        // `WipedGlobal` counts as clean here (it's a full success, just via
        // a different mechanism), but deliberately not
        // `| StepOutcome::WipedWithWarning(_)`, unlike the pane-reinit loop
        // above: the applet is wiped either way, but a run with a warning
        // attached isn't a clean run, and `Severity::Warn` is what actually
        // gets that warning in front of the user.
        let severity = if reports
            .iter()
            .all(|r| matches!(r.outcome, StepOutcome::Wiped | StepOutcome::WipedGlobal))
        {
            Severity::Ok
        } else {
            Severity::Warn
        };
        app.log(
            severity,
            format!(
                "factory reset finished \u{2014} {}",
                factory_reset_report_summary(&reports)
            ),
        );
        app.factory_reset_report = reports.into_iter().map(FactoryResetRow::Step).collect();
        // Hand the FIDO finale to the tested armed-reset flow. Seed its
        // report row first: the ceremony can fail (no touch in time) or
        // be abandoned, and the pane must not read as a finished wipe
        // until FIDO actually answers — that outcome is routed to
        // `security_keys.error`, which the Overview tab never paints.
        if ends_in_fido {
            app.factory_reset_report.push(FactoryResetRow::FidoPending);
            app.security_keys.reset = ResetDialog {
                open: true,
                ..Default::default()
            };
        }
    }

    /// Run a whole-device factory reset: sweep every card applet in the shared
    /// plan off the UI thread (continue-on-error), record a per-step report,
    /// re-initialise the wiped panes, and — when the plan ends in FIDO — hand
    /// the finale to the existing armed `ResetDialog` (which owns the replug +
    /// touch ceremony), so no new FIDO logic is written here.
    ///
    /// If the armed `factory_reset_confirm` says a management-key credential
    /// is needed (`FactoryResetConfirmState::needs_reset_mgmt_auth` — set
    /// once, by `start_factory_reset_confirm`'s fingerprint, and carried
    /// forward rather than re-checked here): resolves the credential the user
    /// typed into the confirm dialog (`Self::reset_mgmt_current_auth`) and
    /// hands it to `run_card_reset_step`'s `Piv` branch, which passes it straight
    /// through to `PivSession::factory_reset` — that method decides on its own
    /// which mechanism actually consumes it (or, if neither `PivExtension::
    /// Reset` nor `ResetGlobal` is available, that it goes unused). Also
    /// excludes `ResetStep::Piv` from the plan entirely when
    /// `piv_preview` says neither mechanism is available at all
    /// (`factory_reset_piv_unresettable` /
    /// `keyroost_resolve::exclude_unresettable_piv`) — same decision
    /// `render_factory_reset_confirm` already made for the dialog text, made
    /// again here from the same stored `piv_preview` rather than a fresh
    /// fingerprint, for the reason the next paragraph gives.
    ///
    /// Unlike the individual PIV step's own fingerprint (deliberately
    /// re-run fresh every time it executes — see `FactoryResetPivPreview`'s
    /// doc), *what's in the plan* is decided once, when the dialog was
    /// armed, and not revisited here: re-deciding plan membership would need
    /// its own PC/SC round trip before this method could even build
    /// `card_steps`, which blocking-I/O-on-the-UI-thread this whole
    /// worker-job structure exists to avoid.
    ///
    /// An invalid credential returns `false` (same "keep the dialog open"
    /// signal a busy worker gives) with `factory_reset_confirm_error` set,
    /// instead of queuing a job that could only fail once it reached the
    /// card.
    fn run_factory_reset_gui(&mut self) -> bool {
        use keyroost_resolve::{ResetStep, StepReport};
        let Some(dev) = self.selected_device().cloned() else {
            return false;
        };
        let mut plan = keyroost_resolve::factory_reset_plan(dev.caps);
        let piv_preview = self
            .factory_reset_confirm
            .as_ref()
            .map(|c| c.piv_preview)
            .unwrap_or(FactoryResetPivPreview::NotOffered);
        if factory_reset_piv_unresettable(piv_preview) {
            keyroost_resolve::exclude_unresettable_piv(&mut plan);
        }
        if plan.is_empty() {
            return false;
        }
        let needs_reset_mgmt_auth = self
            .factory_reset_confirm
            .as_ref()
            .is_some_and(|c| c.needs_reset_mgmt_auth);
        let reset_mgmt_auth = if needs_reset_mgmt_auth {
            match self.reset_mgmt_current_auth() {
                Ok(auth) => Some(auth),
                Err(e) => {
                    self.factory_reset_confirm_error = Some(e);
                    return false;
                }
            }
        } else {
            None
        };
        self.factory_reset_confirm_error = None;
        // Capture the transport descriptors before going off-thread.
        let reader = dev.reader.clone();
        let hid_path = dev.hid_path.clone();
        let for_device = self.selected_device.clone();
        let ends_in_fido = plan.last() == Some(&ResetStep::Fido);
        // Card applets run on the worker; FIDO (if present) is left to the
        // armed ResetDialog after the card sweep completes.
        let card_steps: Vec<ResetStep> = plan
            .iter()
            .copied()
            .filter(|s| *s != ResetStep::Fido)
            .collect();
        // Clear any stale report so the pane shows this run's progress only.
        self.factory_reset_report.clear();
        self.spawn_job("Factory-resetting key\u{2026}", move || {
            let mut reports: Vec<StepReport> = Vec::new();
            for step in card_steps {
                let outcome = run_card_reset_step(
                    step,
                    reader.as_deref(),
                    hid_path.as_deref(),
                    reset_mgmt_auth.as_ref(),
                );
                reports.push(StepReport { step, outcome });
            }
            Box::new(move |app: &mut App| {
                wipe(&mut app.reset_mgmt_auth_input);
                App::apply_factory_reset_sweep(app, for_device.as_ref(), reports, ends_in_fido)
            })
        })
    }

    /// Reset confirmation: wiping a key is irreversible, so require the user to
    /// type `reset` before the button activates, then a physical touch.
    fn render_reset_dialog(&mut self, ctx: &egui::Context) {
        if !self.security_keys.reset.open {
            return;
        }
        let label = self
            .selected_device()
            .map(|d| match &d.name {
                Some(name) => name.clone(),
                None => format!("{} {}", d.vendor, d.model).trim().to_string(),
            })
            .unwrap_or_else(|| "this key".into());

        // A reset wipes credentials + the PIN but leaves the large-blob array
        // intact, so warn when this key supports it. Computed up front to avoid
        // borrowing `self` inside the window closure.
        let has_large_blobs = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.option("largeBlobs"))
            == Some(true);

        let mut window_open = true;
        let mut arm = false;
        let mut cancel = false;
        // A card in a reader takes the in-place route: power-cycle + immediate
        // reset, no replug and no touch. `None` for USB keys, which keep the
        // armed replug ceremony.
        let card_reader = Self::card_reset_reader(self.selected_device());
        // Device-scoped, not app-global: this dialog may belong to a different
        // key than the armed one, and telling the user to "unplug the key, then
        // plug it back in" under the wrong key's name invites a replug that
        // fires someone else's wipe.
        let waiting = self.reset_arm.as_ref().is_some_and(|arm| {
            completion_still_valid(arm.for_device.as_ref(), self.selected_device.as_ref())
        });
        egui::Window::new("Reset FIDO security key?")
            .collapsible(false)
            .resizable(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .open(&mut window_open)
            .show(ctx, |ui| {
                ui.colored_label(
                    egui::Color32::from_rgb(220, 110, 110),
                    format!("This wipes ALL credentials and the PIN on {label}."),
                );
                ui.label("This cannot be undone.");
                if has_large_blobs {
                    ui.add_space(6.0);
                    let muted = egui::Color32::from_rgb(150, 150, 150);
                    ui.colored_label(
                        muted,
                        "Note: a reset does not erase large-blob storage. Open the Storage tab",
                    );
                    ui.colored_label(
                        muted,
                        "and use \u{201c}Clear all storage\u{201d} to wipe every entry there.",
                    );
                }
                ui.add_space(6.0);
                if waiting {
                    // Armed: the clock starts when the key is re-inserted, so we
                    // wait for the unplug/replug and fire the moment it returns.
                    ui.add_space(2.0);
                    ui.horizontal(|ui| {
                        ui.spinner();
                        ui.label(
                            egui::RichText::new("Now unplug the key, then plug it back in.")
                                .strong(),
                        );
                    });
                    ui.label("The reset is sent the instant it reconnects \u{2014} then the");
                    ui.label("key will blink. Touch it to finish the wipe.");
                    ui.add_space(6.0);
                    if ui.button("Cancel").clicked() {
                        cancel = true;
                    }
                } else {
                    if card_reader.is_some() {
                        ui.label("A key only accepts a reset just after power-up. This one");
                        ui.label("sits in a card reader, so there is nothing to unplug \u{2014}");
                        ui.label("the card is power-cycled in place and the wipe sent");
                        ui.label("immediately. Keep the card on the reader.");
                    } else {
                        ui.label("A key only accepts a reset within ~10 seconds of being");
                        ui.label("plugged in, so after you confirm you'll re-insert it.");
                    }
                    ui.add_space(6.0);
                    ui.horizontal(|ui| {
                        ui.label("Type \u{201c}reset\u{201d} to confirm:");
                        ui.add(
                            egui::TextEdit::singleline(&mut self.security_keys.reset.confirm_input)
                                .desired_width(120.0),
                        );
                    });
                    ui.add_space(6.0);
                    let ready = self.security_keys.reset.confirm_input.trim() == "reset";
                    let go_label = if card_reader.is_some() {
                        "Reset card"
                    } else {
                        "Arm reset"
                    };
                    ui.horizontal(|ui| {
                        if ui.add_enabled(ready, egui::Button::new(go_label)).clicked() {
                            arm = true;
                        }
                        if ui.button("Cancel").clicked() {
                            cancel = true;
                        }
                    });
                }
            });
        if arm {
            if let Some(reader) = card_reader {
                // In-place card route: the wipe runs now, on the worker, and
                // its outcome lands through the same completion handler the
                // replug flow uses. The dialog's job is done.
                self.security_keys.reset = ResetDialog::default();
                if !self.submit_card_reset(reader) {
                    // Worker busy — nothing was submitted, and the dialog just
                    // closed. A pending report row must not sit there implying
                    // a wipe is coming.
                    let msg = "not started \u{2014} another device operation is in \
                               progress. Retry from the FIDO2 pane once it finishes; \
                               the card was not touched."
                        .to_string();
                    let outcome = keyroost_resolve::StepOutcome::Failed(msg.clone());
                    if resolve_pending_fido_reset_row(
                        &mut self.factory_reset_report,
                        outcome.clone(),
                    ) {
                        let (severity, line) = factory_reset_fido_finale_log_line(&outcome);
                        self.log(severity, line);
                    }
                    self.security_keys.error = Some(msg);
                }
            } else {
                self.arm_fido_reset();
            }
        } else if cancel || !window_open {
            // Cancel button, or the window's [x] close.
            self.security_keys.reset = ResetDialog::default();
            self.reset_arm = None;
            // If this dialog was a factory reset's FIDO finale, say so in the
            // report rather than leaving a row that reads as still in progress
            // — and in the activity log, whose "factory reset finished" line
            // was written before this ceremony even started and never
            // otherwise learns how it ended.
            // Pending-only: a row that already answered belongs to an earlier
            // ceremony this cancel didn't undo (the report outlives the dialog),
            // and rewriting a completed wipe as "failed" asks for it again.
            let outcome = keyroost_resolve::StepOutcome::Failed(
                "cancelled \u{2014} the passkeys and PIN are still on this key".into(),
            );
            if resolve_pending_fido_reset_row(&mut self.factory_reset_report, outcome.clone()) {
                let (severity, line) = factory_reset_fido_finale_log_line(&outcome);
                self.log(severity, line);
            }
        }
    }

    /// Arm the reset: snapshot the current FIDO keys so the poll can tell when
    /// ours leaves and a fresh one arrives. Prefer the armed key's HID serial
    /// (port-independent), then the resolver's effective (CCID) serial; refuse
    /// to arm with neither — a replugged key we can't re-identify must not be
    /// matched by "first same-model path" (KEY-005).
    fn arm_fido_reset(&mut self) {
        self.arm_fido_reset_with(Self::fido_devices());
    }

    /// The arming decision, with the live device list supplied by the caller.
    ///
    /// Separated from [`Self::arm_fido_reset`] so it can be unit-tested without
    /// enumerating hardware. Enumeration is not free of side effects off Linux:
    /// `keyroost_hid::enumerate` reads sysfs there, but goes through `hidapi`
    /// on macOS and Windows, and on macOS that means IOKit from whatever thread
    /// the test harness happens to be on — which aborted the whole test process
    /// with SIGTRAP. A unit test also has no business depending on what is
    /// physically plugged into the machine running it.
    fn arm_fido_reset_with(&mut self, devices: Vec<FidoHid>) {
        let target_path = self.selected_fido_hid_path();
        let target = target_path
            .as_ref()
            .and_then(|p| devices.iter().find(|d| &d.path == p));
        let target_serial = target.and_then(|d| d.serial.clone());
        let target_ids = target.map(|d| d.ids);
        let target_effective_serial = self
            .selected_device()
            .map(|d| d.serial.clone())
            .filter(|s| !s.is_empty());
        if target_serial.is_none() && target_effective_serial.is_none() {
            self.security_keys.reset = ResetDialog::default();
            // Ending the dialog ends the ceremony behind it, exactly as Cancel
            // does. Reaching this branch with an arm already live is possible —
            // the dialog reverts to its confirm form whenever the arm's key is
            // no longer the selection, so "Arm reset" can be pressed a second
            // time — and saying "not armed" while the earlier arm keeps polling
            // is the one combination that wipes a key after telling the user
            // nothing would happen.
            self.reset_arm = None;
            let msg = "not armed \u{2014} this key exposes no serial to re-identify it by after \
                       a replug, so the armed reset can't safely target it. Run `keyroostctl \
                       fido reset --yes` within ~10 s of plugging the key in instead. If this \
                       is a card reached through a virtual FIDO device, skip the bridge: \
                       select the card's reader row and reset there \u{2014} a card resets in \
                       place, no replug."
                .to_string();
            self.log(Severity::Err, msg.clone());
            // The dialog just vanished and the log panel is collapsed by
            // default, so neither surface is guaranteed to be read. Land the
            // refusal where the user is looking as well: the report row
            // (Overview) when this was a factory reset's finale, and
            // `security_keys.error` (the FIDO2 pane the standalone Reset button
            // lives on) either way. Leaving the seeded row pending would ask
            // for a replug-and-touch ceremony that is never coming. Pending-only
            // for the same reason as the cancel branch: nothing was attempted
            // here, so an already-answered row is not this refusal's to rewrite.
            let outcome = keyroost_resolve::StepOutcome::Failed(msg.clone());
            if resolve_pending_fido_reset_row(&mut self.factory_reset_report, outcome.clone()) {
                let (severity, line) = factory_reset_fido_finale_log_line(&outcome);
                self.log(severity, line);
            }
            self.security_keys.error = Some(msg);
        } else {
            self.reset_arm = Some(ResetArm {
                target_serial,
                target_path,
                target_ids,
                target_effective_serial,
                for_device: self.selected_device.clone(),
                prev_devices: devices.iter().map(HidIdentity::of).collect(),
                saw_removal: false,
            });
        }
    }

    /// Current FIDO HID devices. No PC/SC. Cheap on Linux (a sysfs read), but
    /// not side-effect-free elsewhere: `keyroost_hid` uses `hidapi` on macOS
    /// and Windows, so this reaches IOKit / the Win32 HID stack. Keep it out of
    /// unit tests — take [`Self::arm_fido_reset_with`] and pass a list instead.
    fn fido_devices() -> Vec<FidoHid> {
        keyroost_hid::enumerate()
            .unwrap_or_default()
            .into_iter()
            .filter(HidDevice::is_fido)
            .map(|h| FidoHid {
                path: h.path,
                serial: h.serial_number,
                ids: (h.vendor_id, h.product_id),
                usb_bus: h.usb_bus,
                usb_address: h.usb_address,
            })
            .collect()
    }

    /// The resolver's stable identity for the FIDO HID device at `path`, read
    /// the same way `target_effective_serial` was captured at arm time: the
    /// full `keyroost_resolve` correlation (HID + PC/SC probe), not just a
    /// USB iSerialNumber or a YubiKey CCID serial.
    ///
    /// This used to call [`keyroost_resolve::read_effective_serial`], which
    /// only ever resolves a HID `iSerialNumber` or — for `VID_YUBICO`
    /// specifically — a YubiKey CCID serial; every other card-derived serial
    /// (a Token2 PIN+/Bio3 key's OpenPGP-applet serial among them) made it
    /// return `Err` unconditionally. `target_effective_serial`, by contrast,
    /// comes from `self.selected_device()`, i.e. the *full* `correlate()`
    /// merge that `keyroost_resolve::enumerate()` runs — which pulls a
    /// serial from whichever applet a probed reader exposes, not only
    /// YubiKey's. So a serial-less Token2 FIDO+PGP key would arm (find a
    /// non-empty `target_effective_serial` from that merge) but could then
    /// never re-match on reinsertion (this function permanently returning
    /// `None` for it) — the reset dispatched at arm time was live, but the
    /// touch prompt never fires because `reset_reinsert_matches` never sees
    /// two `Some`s to compare. Matches the CLI's `fido_reset_after_replug`,
    /// which resolves the reinserted key with the identical
    /// `keyroost_resolve::enumerate()` call for exactly this reason.
    ///
    /// `None` when the device is gone or the identity can't be read *yet* (a
    /// just-replugged key's CCID interface takes a beat to register with
    /// pcscd) — callers retry on the next poll rather than guessing.
    fn fido_effective_serial(path: &std::path::Path) -> Option<String> {
        keyroost_resolve::enumerate()
            .unwrap_or_default()
            .into_iter()
            .find(|d| d.hid_path.as_deref() == Some(path))
            .map(|d| d.serial)
            .filter(|s| !s.is_empty())
    }

    /// Poll the live FIDO list while a reset is armed: once the armed key has
    /// been unplugged, fire the reset on its re-insertion (which the user
    /// does), inside the ~10 s window. Matches by HID serial when the key
    /// exposes one, else by the resolver's effective (CCID-read) serial; a
    /// fresh same-model path alone never fires the reset (KEY-005).
    fn poll_reset_arm(&mut self) {
        // Defence in depth. `on_device_selected` is the sole owner of ending an
        // armed ceremony, which means every path that moves the selection has
        // to route through it — one that forgets (the failed-scan path did)
        // leaves this poll firing an irreversible wipe for a key the UI has
        // moved off, with the dialog showing its un-armed confirm form (its
        // "now unplug the key" prompt is device-scoped for the same reason).
        // Cheaper to re-check the binding here than to rely on one owner.
        if !self.reset_arm.as_ref().is_some_and(|arm| {
            completion_still_valid(arm.for_device.as_ref(), self.selected_device.as_ref())
        }) {
            if self.reset_arm.take().is_some() {
                self.log_global(
                    Severity::Warn,
                    LogKind::User,
                    "the armed reset was cancelled \u{2014} the key it was armed for is no longer \
                     the one selected. Re-open \u{201C}Reset key\u{201D} on the key you want to \
                     wipe.",
                );
            }
            return;
        }
        let current = Self::fido_devices();
        let mut fire: Option<std::path::PathBuf> = None;
        if let Some(arm) = self.reset_arm.as_mut() {
            if let Some(target_serial) = arm.target_serial.clone() {
                // HID-serial mode: identity is port-independent.
                let here = current
                    .iter()
                    .find(|d| d.serial.as_deref() == Some(target_serial.as_str()));
                match here {
                    None => arm.saw_removal = true, // unplugged
                    Some(d) if arm.saw_removal => fire = Some(d.path.clone()),
                    Some(_) => {}
                }
            } else {
                // Effective-serial mode (no HID serial, e.g. most YubiKeys):
                // the armed path leaving is the unplug; a fresh *connection*
                // (see `HidIdentity` — not just a path unseen before, since a
                // hidraw minor number can be recycled straight back onto the
                // replugged key) is accepted as the re-insert only when its
                // stable identity matches the armed key's. The CCID probe
                // runs only for a model-matching fresh connection, and only
                // after removal.
                let present = |p: &std::path::PathBuf| current.iter().any(|d| &d.path == p);
                match &arm.target_path {
                    Some(t) if !present(t) => arm.saw_removal = true,
                    _ => {}
                }
                if arm.saw_removal {
                    fire = current
                        .iter()
                        .filter(|d| arm.target_ids.is_none() || arm.target_ids == Some(d.ids))
                        .filter(|d| {
                            let id = HidIdentity::of(d);
                            !arm.prev_devices.iter().any(|p| same_hid_connection(p, &id))
                        })
                        .find(|d| {
                            let cand_eff = Self::fido_effective_serial(&d.path);
                            reset_reinsert_matches(
                                arm.target_serial.as_deref(),
                                arm.target_effective_serial.as_deref(),
                                arm.target_ids,
                                d.serial.as_deref(),
                                cand_eff.as_deref(),
                                d.ids,
                            )
                        })
                        .map(|d| d.path.clone());
                }
            }
        }
        match fire {
            Some(path) => {
                // The replug window is one-shot. If the worker is mid-job the
                // submission is refused — keep the arm (and the stale
                // prev_devices, so the fresh connection still counts as new)
                // and let the next poll retry instead of silently losing the
                // reset.
                if self.submit_reset_path(path) {
                    self.reset_arm = None;
                    self.security_keys.reset = ResetDialog::default();
                }
            }
            None => {
                if let Some(arm) = self.reset_arm.as_mut() {
                    // Refresh the snapshot only until the unplug. After
                    // removal it must stay frozen: a fresh connection whose CCID
                    // serial isn't readable yet has to still count as fresh
                    // on the next poll, or the retry could never fire.
                    if !arm.saw_removal {
                        arm.prev_devices = current.iter().map(HidIdentity::of).collect();
                    }
                }
            }
        }
    }

    fn selected_openpgp_reader(&self) -> Option<String> {
        self.selected_device().and_then(|d| d.reader.clone())
    }

    /// Read the selected card's status on the worker thread.
    fn load_openpgp_status(&mut self) {
        self.openpgp.error = None;
        let Some(name) = self.selected_openpgp_reader() else {
            self.openpgp.error = Some("no OpenPGP card selected".into());
            return;
        };
        let for_device = self.selected_device.clone();
        self.spawn_job("Reading OpenPGP status\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_transport::OpenPgpStatus,
                    Option<keyroost_transport::AlgorithmInformation>,
                ),
                TransportError,
            > {
                let mut session = keyroost_transport::OpenPgpSession::open(&name)?;
                let status = session.status()?;
                let supported = session.supported_algorithms().unwrap_or(None);
                Ok((status, supported))
            })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                match result {
                    Ok((status, supported)) => {
                        app.openpgp.status = Some(status);
                        app.openpgp.supported = supported;
                        app.openpgp.loaded = true;
                    }
                    Err(e) => app.openpgp.error = Some(e.to_string()),
                }
            })
        });
    }

    /// Off-thread helper: open the card and verify the admin PIN (PW3). Shared by
    /// every write op so they all gate on PW3.
    fn openpgp_open_admin(
        name: &str,
        admin_pin: &str,
    ) -> Result<keyroost_transport::OpenPgpSession, TransportError> {
        let mut session = keyroost_transport::OpenPgpSession::open(name)?;
        session.verify_admin_pin(admin_pin.as_bytes())?;
        Ok(session)
    }

    /// Re-read status after a write and store it, surfacing `notice` on success.
    fn apply_openpgp_write(
        app: &mut App,
        result: Result<keyroost_transport::OpenPgpStatus, TransportError>,
        notice: String,
    ) {
        match result {
            Ok(status) => {
                app.openpgp.status = Some(status);
                app.openpgp.loaded = true;
                app.openpgp.error = None;
                app.openpgp.notice = Some(notice);
                wipe(&mut app.openpgp.admin_pin);
            }
            Err(e) => {
                app.openpgp.error = Some(e.to_string());
                wipe(&mut app.openpgp.admin_pin);
            }
        }
        Self::apply_openpgp_cred_result(app);
    }

    /// Mirror an OpenPGP write result into the credential modal so the outcome
    /// is shown in-modal (issue #31). Reads the pane status the apply closure
    /// just set: no error → `Ok(())`; an error → the message, with the modal
    /// kept open for a retry. `busy` always clears. No-op when the modal is
    /// closed (e.g. the flow was triggered some other way).
    fn apply_openpgp_cred_result(app: &mut App) {
        if let Some(m) = app.openpgp.cred_modal.as_mut() {
            m.busy = false;
            m.result = match &app.openpgp.error {
                Some(e) => Some(Err(e.clone())),
                None => Some(Ok(())),
            };
        }
    }

    /// The admin PIN (PW3) the modal's flows send: the typed `admin_pin`, or the
    /// well-known factory default when "Use default admin PIN (PW3)" is ticked.
    /// Mirrors the PIV `PivMgmtAuthMode::Default` convenience. Does not
    /// mutate state.
    fn openpgp_admin_pin_value(&self) -> String {
        if self.openpgp.use_default_admin {
            OPENPGP_DEFAULT_ADMIN_PIN.to_string()
        } else {
            self.openpgp.admin_pin.clone()
        }
    }

    /// Set the cardholder name (PW3-gated), then refresh status.
    fn set_openpgp_name(&mut self) {
        let Some(name) = self.selected_openpgp_reader() else {
            return;
        };
        let pin = zeroize::Zeroizing::new(self.openpgp_admin_pin_value());
        let value = self.openpgp.name_input.clone();
        self.openpgp.notice = None;
        self.spawn_job("Setting cardholder name…", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = Self::openpgp_open_admin(&name, &pin)?;
                s.set_cardholder_name(value.as_bytes())?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                Self::apply_openpgp_write(app, result, "Cardholder name set.".into())
            })
        });
    }

    /// Set the public-key URL (PW3-gated), then refresh status.
    fn set_openpgp_url(&mut self) {
        let Some(name) = self.selected_openpgp_reader() else {
            return;
        };
        let pin = zeroize::Zeroizing::new(self.openpgp_admin_pin_value());
        let value = self.openpgp.url_input.clone();
        self.openpgp.notice = None;
        self.spawn_job("Setting public-key URL…", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = Self::openpgp_open_admin(&name, &pin)?;
                s.set_url(value.as_bytes())?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                Self::apply_openpgp_write(app, result, "Public-key URL set.".into())
            })
        });
    }

    /// Generate + register a key in the selected slot (PW3-gated, destructive),
    /// then refresh status. May require a touch on the key.
    /// Returns `false` when the job couldn't be queued (worker busy) — the
    /// caller's confirm modal stays open so the confirmed click isn't lost.
    fn generate_openpgp_key(&mut self) -> bool {
        let Some(name) = self.selected_openpgp_reader() else {
            return true; // nothing to do; let the modal close
        };
        let pin = zeroize::Zeroizing::new(self.openpgp_admin_pin_value());
        let slot = self.openpgp.selected_key;
        let alg = self.openpgp.gen_alg.to_alg();
        let creation_time = unix_now();
        self.openpgp.notice = None;
        self.spawn_job("Generating key… (touch the key if it blinks)", move || {
            let result = (|| -> Result<(keyroost_transport::OpenPgpStatus, [u8; 20]), TransportError> {
                let mut s = Self::openpgp_open_admin(&name, &pin)?;
                let _ = s.generate_key(slot.to_crt(), alg)?;
                let fpr = s.register_key(slot.to_crt(), creation_time)?;
                Ok((s.status()?, fpr))
            })();
            Box::new(move |app: &mut App| {
                match result {
                    Ok((status, fpr)) => {
                        app.openpgp.status = Some(status);
                        app.openpgp.loaded = true;
                        app.openpgp.error = None;
                        app.openpgp.notice =
                            Some(format!("Generated {} key: {}", slot.label(), hex_lower(&fpr)));
                        wipe(&mut app.openpgp.admin_pin);
                    }
                    Err(e) => {
                        app.openpgp.error = Some(e.to_string());
                        wipe(&mut app.openpgp.admin_pin);
                    }
                }
                Self::apply_openpgp_cred_result(app);
            })
        })
    }

    /// Import a key into the selected slot (PW3-gated, destructive), then refresh
    /// status. The key material comes from host keygen or a file, obtained on the
    /// worker thread (keygen is slow). May require a touch on the key. Returns
    /// `false` when the job couldn't be queued (worker busy).
    fn import_openpgp_key(&mut self, source: ImportSource) -> bool {
        let Some(name) = self.selected_openpgp_reader() else {
            return true; // nothing to do; let the modal close
        };
        let pin = zeroize::Zeroizing::new(self.openpgp_admin_pin_value());
        let slot = self.openpgp.selected_key;
        let path = self.openpgp.import_path.clone();
        let creation_time = unix_now();
        self.openpgp.notice = None;
        let label = match source {
            ImportSource::Generate => "Generating & importing RSA-2048 key… (touch if it blinks)",
            ImportSource::FromFile => "Importing RSA key from file… (touch if it blinks)",
        };
        self.spawn_job(label, move || {
            // Obtain the key parts first (keygen / file parse on this worker
            // thread). Map every error to a String so success and the various
            // failure kinds (key, PIN, card) flow through one result channel.
            let result = (|| -> Result<(keyroost_transport::OpenPgpStatus, [u8; 20]), String> {
                let k = match source {
                    ImportSource::Generate => keyroost_rsakey::generate_2048(),
                    ImportSource::FromFile => {
                        keyroost_rsakey::load_from_file(std::path::Path::new(&path))
                    }
                }
                .map_err(|e| e.to_string())?;

                let mut s = Self::openpgp_open_admin(&name, &pin).map_err(|e| e.to_string())?;
                let parts = keyroost_transport::RsaPrivateKeyParts {
                    e: &k.e,
                    p: &k.p,
                    q: &k.q,
                    u: &k.u,
                    dp: &k.dp,
                    dq: &k.dq,
                    n: &k.n,
                };
                s.import_key(slot.to_crt(), &parts)
                    .map_err(|e| e.to_string())?;
                let fpr = s
                    .register_key(slot.to_crt(), creation_time)
                    .map_err(|e| e.to_string())?;
                let status = s.status().map_err(|e| e.to_string())?;
                Ok((status, fpr))
            })();
            Box::new(move |app: &mut App| {
                match result {
                    Ok((status, fpr)) => {
                        app.openpgp.status = Some(status);
                        app.openpgp.loaded = true;
                        app.openpgp.error = None;
                        app.openpgp.notice = Some(format!(
                            "Imported {} key: {}",
                            slot.label(),
                            hex_lower(&fpr)
                        ));
                        wipe(&mut app.openpgp.admin_pin);
                        app.openpgp.import_path.clear();
                    }
                    Err(e) => {
                        app.openpgp.error = Some(e);
                        wipe(&mut app.openpgp.admin_pin);
                    }
                }
                Self::apply_openpgp_cred_result(app);
            })
        })
    }

    /// Factory-reset the OpenPGP applet (destructive), then refresh status. No
    /// PIN needed — reset blocks the PINs itself. Returns `false` when the job
    /// couldn't be queued (worker busy).
    fn reset_openpgp(&mut self) -> bool {
        let Some(name) = self.selected_openpgp_reader() else {
            return true; // nothing to do; let the modal close
        };
        self.openpgp.notice = None;
        let for_device = self.selected_device.clone();
        self.spawn_job("Resetting OpenPGP applet…", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = keyroost_transport::OpenPgpSession::open(&name)?;
                s.factory_reset()?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-reset; don't paint A's outcome under B
                }
                Self::apply_openpgp_write(
                    app,
                    result,
                    "OpenPGP applet reset; keys wiped, PINs back to defaults.".into(),
                )
            })
        })
    }

    /// Change the user PIN (PW1) from old to new, then refresh status. No admin
    /// PIN needed — CHANGE REFERENCE DATA carries the old PIN itself.
    fn change_openpgp_user_pin(&mut self) {
        let Some(name) = self.selected_openpgp_reader() else {
            return;
        };
        let old = zeroize::Zeroizing::new(self.openpgp.user_pin_old.clone());
        let new = zeroize::Zeroizing::new(self.openpgp.user_pin_new.clone());
        self.openpgp.notice = None;
        self.spawn_job("Changing user PIN\u{2026}", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = keyroost_transport::OpenPgpSession::open(&name)?;
                s.change_user_pin(old.as_bytes(), new.as_bytes())?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                wipe(&mut app.openpgp.user_pin_old);
                wipe(&mut app.openpgp.user_pin_new);
                Self::apply_openpgp_write(app, result, "User PIN (PW1) changed.".into());
            })
        });
    }

    /// Change the admin PIN (PW3) from old to new, then refresh status.
    fn change_openpgp_admin_pin(&mut self) {
        let Some(name) = self.selected_openpgp_reader() else {
            return;
        };
        let old = zeroize::Zeroizing::new(self.openpgp.admin_pin_old.clone());
        let new = zeroize::Zeroizing::new(self.openpgp.admin_pin_new.clone());
        self.openpgp.notice = None;
        self.spawn_job("Changing admin PIN\u{2026}", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = keyroost_transport::OpenPgpSession::open(&name)?;
                s.change_admin_pin(old.as_bytes(), new.as_bytes())?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                wipe(&mut app.openpgp.admin_pin_old);
                wipe(&mut app.openpgp.admin_pin_new);
                Self::apply_openpgp_write(app, result, "Admin PIN (PW3) changed.".into());
            })
        });
    }

    /// Unblock the user PIN (PW1): set it to a new value, authorised by the admin
    /// PIN (PW3). Recovers a card whose user PIN is blocked without a reset.
    fn unblock_openpgp_user_pin(&mut self) {
        let Some(name) = self.selected_openpgp_reader() else {
            return;
        };
        let admin = zeroize::Zeroizing::new(self.openpgp_admin_pin_value());
        let new = zeroize::Zeroizing::new(self.openpgp.unblock_new.clone());
        self.openpgp.notice = None;
        self.spawn_job("Unblocking user PIN\u{2026}", move || {
            let result = (|| -> Result<keyroost_transport::OpenPgpStatus, TransportError> {
                let mut s = keyroost_transport::OpenPgpSession::open(&name)?;
                s.reset_retry_counter(admin.as_bytes(), new.as_bytes())?;
                s.status()
            })();
            Box::new(move |app: &mut App| {
                wipe(&mut app.openpgp.unblock_new);
                Self::apply_openpgp_write(app, result, "User PIN (PW1) unblocked.".into());
            })
        });
    }

    /// The reset confirmation modal for the PIV pane.
    fn render_piv_confirms(&mut self, ctx: &egui::Context) {
        if typed_reset_modal(
            ctx,
            "Reset PIV applet?",
            "This wipes ALL PIV keys, certificates, and PINs.",
            &["Only works when the PIN and PUK are already blocked."],
            &mut self.piv.confirm_reset,
        ) && self.piv_reset()
        {
            self.piv.confirm_reset = None;
        }
    }
}

/// A typed-"reset" confirmation modal, shared by the OpenPGP and PIV panes.
/// `confirm` is the modal state (`Some(typed text)` = open). Returns `true`
/// when the user confirmed; the *caller* fires the action and closes the
/// modal only if the action was actually queued — a busy worker must not
/// swallow a confirmed destructive click.
fn typed_reset_modal(
    ctx: &egui::Context,
    title: &str,
    warning: &str,
    extra_lines: &[&str],
    confirm: &mut Option<String>,
) -> bool {
    let Some(typed) = confirm.clone() else {
        return false;
    };
    let mut do_it = false;
    let mut cancel = false;
    let mut window_open = true;
    let mut buf = typed;
    egui::Window::new(title)
        .collapsible(false)
        .resizable(false)
        .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
        .open(&mut window_open)
        .show(ctx, |ui| {
            ui.colored_label(egui::Color32::from_rgb(220, 110, 110), warning);
            for line in extra_lines {
                ui.label(*line);
            }
            ui.label("This cannot be undone.");
            ui.add_space(6.0);
            ui.horizontal(|ui| {
                ui.label("Type \u{201c}reset\u{201d} to confirm:");
                ui.add(egui::TextEdit::singleline(&mut buf).desired_width(120.0));
            });
            ui.add_space(6.0);
            ui.horizontal(|ui| {
                let armed = buf.trim() == "reset";
                if ui.add_enabled(armed, egui::Button::new("Reset")).clicked() {
                    do_it = true;
                }
                if ui.button("Cancel").clicked() {
                    cancel = true;
                }
            });
        });
    if do_it {
        true
    } else {
        if cancel || !window_open {
            *confirm = None;
        } else {
            *confirm = Some(buf);
        }
        false
    }
}

/// Lowercase hex of a byte slice.
fn hex_lower(bytes: &[u8]) -> String {
    keyroost_proto::codec::hex_encode(bytes)
}

/// Decode a management-key hex field into wipe-on-drop bytes.
fn piv_mgmt_key_bytes(hex: &str) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
    keyroost_proto::codec::hex_decode(hex.trim())
        .map(zeroize::Zeroizing::new)
        .map_err(|e| format!("management key is not valid hex: {}", e))
}

/// The well-known factory-default PIV/XAUTH management-key bytes for a
/// device fingerprinted as `fingerprint` at `version`/`firmware_version`, if
/// keyroost has one on record —
/// [`keyroost_piv::compat::PivQuirk::Default9bManagementKey`], read off
/// [`keyroost_piv::compat::resolve_quirks`]. `None` means keyroost has no
/// known default for this device (an unrecognised fingerprint, or one the
/// quirk table deliberately leaves unseeded) — the modal's "Use default
/// management key" convenience toggle
/// ([`App::piv_modal_mgmt_field`]) disables itself in that case rather than
/// offering a default it can't actually supply. The slice's length is
/// whatever that fingerprint's management-key algorithm actually takes — 16
/// bytes for AES-128, 24 for 3-DES/AES-192, 32 for AES-256 — never assume 24.
fn piv_default_mgmt_key(
    fingerprint: keyroost_piv::fingerprint::AppletFingerprint,
    version: Option<&[u8]>,
    firmware_version: Option<&[u8]>,
) -> Option<&'static [u8]> {
    keyroost_piv::compat::default_9b_management_key(&keyroost_piv::compat::resolve_quirks(
        fingerprint,
        version,
        firmware_version,
    ))
}

/// How the user authorized a PIV management operation — the standard
/// management key (typed or the well-known default), or a PIN for
/// `keyroost_piv::compat::PivExtension::PinManagementAuth`. Produced by
/// `App::piv_current_mgmt_auth`, consumed by `piv_authenticate`.
enum PivMgmtAuth {
    Key(zeroize::Zeroizing<Vec<u8>>),
    Pin(zeroize::Zeroizing<String>),
}

/// Unlock PIV management on an already-open session per `auth`: the standard
/// GET METADATA/GENERAL AUTHENTICATE round for `PivMgmtAuth::Key`, or
/// `PivSession::authenticate_management_via_pin` for `PivMgmtAuth::Pin`. The
/// single call site every management-gated PIV job in this module runs
/// through, so the two authorization paths stay in sync.
fn piv_authenticate(
    s: &mut keyroost_transport::PivSession<'_>,
    auth: &PivMgmtAuth,
) -> Result<(), TransportError> {
    match auth {
        PivMgmtAuth::Key(key) => {
            let alg = s.resolve_management_key_algorithm(key.len())?;
            s.authenticate_management(alg, key)
        }
        PivMgmtAuth::Pin(pin) => s.authenticate_management_via_pin(pin.as_bytes()),
    }
}

/// Full uppercase hex of a byte slice (no truncation), matching the
/// credential-details display.
/// Render a masked secret input with a trailing eye toggle. `revealed` is read
/// for the initial mask state and updated in place when the eye is clicked, so
/// the caller can keep the flag wherever it likes. Returns the TextEdit
/// response. The buffer text is shown in clear when `*revealed`.
pub(crate) fn secret_edit(
    ui: &mut egui::Ui,
    p: &Palette,
    buf: &mut String,
    revealed: &mut bool,
    hint: &str,
    width: f32,
) -> egui::Response {
    let mut resp = None;
    ui.horizontal(|ui| {
        let mut edit = egui::TextEdit::singleline(buf)
            .vertical_align(egui::Align::Center)
            .desired_width(width);
        if !*revealed {
            edit = edit.password(true);
        }
        if !hint.is_empty() {
            edit = edit.hint_text(hint);
        }
        resp = Some(ui.add_sized([width, 32.0], edit));
        // Eye toggle, painted (the UI font has no emoji glyphs). Open eye =
        // shown, slashed eye = hidden.
        let (irect, ir) = ui.allocate_exact_size(egui::vec2(26.0, 32.0), egui::Sense::click());
        let col = if ir.hovered() { p.txt } else { p.txt2 };
        let c = irect.center();
        paint_eye_icon(ui, c, col);
        if !*revealed {
            // Slash across the eye to signal the hidden state.
            ui.painter().line_segment(
                [
                    egui::pos2(c.x - 8.0, c.y + 5.0),
                    egui::pos2(c.x + 8.0, c.y - 5.0),
                ],
                egui::Stroke::new(1.3, col),
            );
        }
        if ir.hovered() {
            ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
        }
        if ir.clicked() {
            *revealed = !*revealed;
        }
        let _ = ir.on_hover_text(if *revealed { "Hide" } else { "Show" });
    });
    let resp = resp.unwrap();
    // Scrub egui's retained plaintext once the field is no longer focused, so a
    // wiped buffer leaves nothing recoverable from egui memory.
    guard_secret_field(ui.ctx(), &resp);
    resp
}

fn hex_full(bytes: &[u8]) -> String {
    let mut s = String::with_capacity(bytes.len() * 2);
    for b in bytes {
        s.push_str(&format!("{:02X}", b));
    }
    s
}

fn hex_short(bytes: &[u8]) -> String {
    let mut s = String::with_capacity(bytes.len() * 2);
    for b in bytes.iter().take(8) {
        s.push_str(&format!("{:02x}", b));
    }
    if bytes.len() > 8 {
        s.push('…');
    }
    s
}

fn unix_now() -> u32 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|d| d.as_secs() as u32)
        .unwrap_or(0)
}

// --- Device-centric coordination (selection, theme, per-device loads) --------
impl App {
    /// The palette for the current theme + accent.
    fn palette(&self) -> Palette {
        Palette::new(
            self.mode,
            Palette::ACCENTS[self.accent_idx],
            self.colorblind,
        )
    }

    /// Persist the current UI preferences to `settings.json` — but only when
    /// something actually changed since the last write, so a per-change call
    /// site can fire freely without spamming the disk. Best-effort: a write
    /// failure is swallowed inside `Settings::save`, since a UI preference that
    /// won't persist must never crash the app. Called at the change points
    /// (theme toggle, accent pick, colorblind toggle, zoom commit) because
    /// eframe's own `save()` is disabled in this crate.
    fn persist_settings(&mut self) {
        let current = Settings {
            zoom: theme::clamp_zoom(self.zoom),
            mode: self.mode.into(),
            accent: self.accent_idx,
            colorblind: self.colorblind,
        };
        if self.last_saved_settings.as_ref() == Some(&current) {
            return;
        }
        current.save();
        self.last_saved_settings = Some(current);
    }

    /// The currently selected device, if the id still resolves to a present one.
    fn selected_device(&self) -> Option<&Device> {
        let id = self.selected_device.as_ref()?;
        self.devices.iter().find(|d| &d.id == id)
    }

    /// (Re)build the unified device list off-thread, then re-resolve selection.
    /// Queue a burst of staggered rescans (see `pending_scans`). The first runs
    /// as soon as the worker is free; the rest follow over the next few seconds
    /// so a slow-registering reader is caught without the user touching Refresh.
    fn schedule_scan_burst(&mut self) {
        self.pending_scans = 4;
        self.next_scan_at = None; // first scan is due immediately
    }

    fn refresh_devices(&mut self) {
        self.scanned = true;
        self.spawn_job("Scanning for devices\u{2026}", move || {
            let result = device::enumerate();
            Box::new(move |app: &mut App| match result {
                Ok(devices) => {
                    app.devices_error = None;
                    // Windows only needs `devices` mutable for the additive FIDO pass
                    // below; off-Windows the original binding flows through unchanged
                    // (a plain `let mut` here would be an unused-mut warning).
                    #[cfg(windows)]
                    let mut devices = devices;
                    // Windows non-admin: the FIDO2 capability is read from the HID
                    // usage page 0xF1D0, which a non-elevated process can't open
                    // (ERROR_ACCESS_DENIED). So FIDO access is detected separately
                    // via keyroost-winwebauthn (access-denied signal). This pass is
                    // strictly ADDITIVE — it never removes a resolved device — and
                    // is panic-isolated so an FFI fault can't empty the list.
                    //  * Multiprotocol keys already resolve (via PC/SC) — add the
                    //    FIDO2 cap so the tab appears.
                    //  * FIDO-only keys don't resolve at all — synthesize a minimal
                    //    device from the detected VID/PID.
                    // cap_fido2 then shows the "needs admin / use Windows settings"
                    // card for these.
                    #[cfg(windows)]
                    {
                        let fido_keys =
                            std::panic::catch_unwind(keyroost_winwebauthn::detect_fido_keys)
                                .unwrap_or_default();
                        if !fido_keys.is_empty() {
                            if devices.iter().any(|d| d.kind == DeviceKind::Key) {
                                for d in devices.iter_mut() {
                                    if d.kind == DeviceKind::Key && !d.caps.has(Caps::FIDO2) {
                                        d.caps.insert(Caps::FIDO2);
                                    }
                                }
                            } else {
                                for (i, k) in fido_keys.iter().enumerate() {
                                    let mut caps = Caps::default();
                                    caps.insert(Caps::FIDO2);
                                    let vid = k.vendor_id.unwrap_or(0);
                                    let pid = k.product_id.unwrap_or(0);
                                    let model = k
                                        .product
                                        .clone()
                                        .unwrap_or_else(|| "Security key".to_string());
                                    devices.push(Device {
                                        id: format!("winfido:{vid:04x}:{pid:04x}:{i}"),
                                        name: None,
                                        vendor: format!("{vid:04X}"),
                                        model,
                                        serial: String::new(),
                                        transport: "USB · FIDO HID (admin required)".into(),
                                        firmware: String::new(),
                                        caps,
                                        unverified: Caps::default(),
                                        kind: DeviceKind::Key,
                                        hid_path: None,
                                        reader: None,
                                    });
                                }
                            }
                        }
                    }
                    // Keep the current selection if that device is still present;
                    // otherwise fall back to the first device.
                    let keep = app
                        .selected_device
                        .as_ref()
                        .filter(|id| devices.iter().any(|d| &d.id == *id))
                        .cloned();
                    let next = keep.or_else(|| devices.first().map(|d| d.id.clone()));
                    let changed = next != app.selected_device;
                    let previous = app.selected_device.clone();
                    app.selected_device = next;
                    // Surface duplicate-serial ambiguity (KEY-015): same-serial
                    // keys stay separately selectable (distinct #-suffixed ids),
                    // but naming can't disambiguate them, so tell the user.
                    app.devices_error = duplicate_serial_note(
                        devices
                            .iter()
                            .filter(|d| d.kind == DeviceKind::Key && !d.serial.is_empty())
                            .map(|d| d.serial.as_str()),
                    );
                    // Background: every scan funnels through here, whether it
                    // was kicked off by a hotplug event, the first-frame
                    // auto-scan, or a "Refresh"/"Scan for devices" click — the
                    // staggered burst that follows any of them (`pending_scans`)
                    // makes "which scan did the user actually ask for" moot in
                    // practice, so all of them log at the same, muted weight.
                    app.log_global(
                        Severity::Info,
                        LogKind::Background,
                        format!(
                            "device scan: {} device{} found",
                            devices.len(),
                            if devices.len() == 1 { "" } else { "s" }
                        ),
                    );
                    app.devices = devices;
                    // A device that's genuinely gone shouldn't leave its
                    // cached PIV identity/pubkey data sitting in memory
                    // indefinitely. Prune here, against an actual fresh scan
                    // result, rather than on every selection change (nothing
                    // about switching *which* still-present device is
                    // selected implies any device disappeared) or on a
                    // failed scan (transient — doesn't mean the hardware
                    // actually went away, and wiping every entry over one
                    // pcscd hiccup would force a full re-fingerprint of
                    // everything on the next successful scan for no reason).
                    app.piv_session_state
                        .retain(|id, _| app.devices.iter().any(|d| &d.id == id));
                    if changed {
                        app.on_device_selected(previous);
                    }
                }
                Err(e) => {
                    app.log_global(
                        Severity::Warn,
                        LogKind::Background,
                        format!("device scan failed: {e}"),
                    );
                    App::apply_device_scan_failure(app, e);
                }
            })
        });
    }

    /// A scan that failed outright: no device list, and therefore no selection.
    /// Lifted out of `refresh_devices`'s apply closure so the teardown rule is
    /// exercisable without hardware.
    ///
    /// Clearing the selection here is a selection *change* like any other, and
    /// has to run the same teardown — `on_device_selected` is the sole owner of
    /// ending an armed FIDO ceremony, so assigning `None` directly left the arm
    /// live with nothing selected: the dialog (device-scoped) repaints its
    /// un-armed confirm form while the poll goes on watching for the replug,
    /// and every rescan path is suppressed while an arm exists, so the empty
    /// list could never recover on its own.
    fn apply_device_scan_failure(app: &mut App, error: String) {
        app.devices_error = Some(error);
        app.devices.clear();
        if let Some(previous) = app.selected_device.take() {
            // Same teardown as any other selection change. With nothing
            // selected it returns before dispatching any read.
            app.on_device_selected(Some(previous));
        }
    }

    /// Select a device by id (no-op if already selected).
    fn select_device(&mut self, id: DeviceId) {
        if self.selected_device.as_deref() == Some(id.as_str()) {
            return;
        }
        let previous = self.selected_device.replace(id);
        self.on_device_selected(previous);
    }

    /// Reset per-applet state for a new selection and kick off the cheap,
    /// no-touch reads (FIDO GetInfo; Molto2 session open). OATH/PGP/PIV reads
    /// stay deferred to their tab so selecting a key never triggers a surprise
    /// touch prompt. `previous` is the device id that was selected before
    /// this change (`None` if nothing was), needed only to save its
    /// `cap_tab` pick — everything else this resets is genuinely per-device
    /// UI/session state with nothing worth carrying forward under any id.
    fn on_device_selected(&mut self, previous: Option<DeviceId>) {
        if let Some(prev) = previous {
            self.cap_tab_by_device.insert(prev, self.cap_tab);
        }
        // The raw remembered pick, or `Overview` for a device seen for the
        // first time — `cap_tabs` corrects it at render time if it's stale
        // for this device (`snap_cap_tab`), so no need to consult
        // `self.devices` here just to pre-validate it.
        self.cap_tab = self
            .selected_device
            .as_ref()
            .and_then(|id| self.cap_tab_by_device.get(id))
            .copied()
            .unwrap_or_default();
        self.security_keys.info = None;
        self.security_keys.init = None;
        self.security_keys.session = None;
        self.security_keys.session_device = None;
        self.security_keys.error = None;
        // Large-blob state is per-key; drop it so the next key auto-loads fresh.
        self.security_keys.large_blobs = None;
        self.security_keys.lb_capacity = None;
        self.security_keys.lb_autoloaded = false;
        self.security_keys.lb_selected = None;
        self.security_keys.lb_editing = None;
        self.security_keys.lb_show_add = false;
        self.security_keys.lb_status = None;
        self.security_keys.lb_confirm_delete = None;
        self.security_keys.lb_confirm_clear = false;
        // SSH-cert extract state is per-key too (KEY-012): drop any parked certs
        // and the result line so a different key never shows the previous one's.
        // A dialog still open for the old key then resolves to "no certificate
        // was ready to write" rather than the new key's cert.
        self.security_keys.ssh_cert_pending.clear();
        self.security_keys.ssh_cert_status = None;
        // Fingerprint state is per-key: the cached list, the pending delete /
        // rename, the name draft, and a live enroll wizard must not carry
        // over (KEY-012). A running enroll worker is told to cancel; it
        // aborts at the next KEEPALIVE.
        self.security_keys.fingerprints = None;
        self.security_keys.fp_new_name.clear();
        self.security_keys.fp_confirm_delete = None;
        self.security_keys.fp_rename = None;
        if let Some(p) = self.security_keys.fp_progress.take() {
            if let Ok(g) = p.lock() {
                g.cancel.store(true, std::sync::atomic::Ordering::Relaxed);
            }
        }
        self.oath.creds.clear();
        self.oath.skipped = 0;
        self.oath.loaded = false;
        self.oath.locked = false;
        self.oath.error = None;
        self.oath.unlocked_password = None;
        self.openpgp.status = None;
        self.openpgp.loaded = false;
        self.openpgp.error = None;
        self.openpgp.notice = None;
        self.openpgp.name_input.clear();
        self.openpgp.url_input.clear();
        self.openpgp.supported = None;
        self.openpgp.gen_alg = OpenPgpKeyAlgSel::CardDefault;
        self.piv = PivState::default();
        // Typed secrets must never survive a selection change — a PIN entered
        // for one key would otherwise be sent to another (the OATH pane even
        // auto-submits its password on tab open), silently burning retry
        // counters on the wrong device.
        wipe(&mut self.security_keys.pin_input);
        wipe(&mut self.security_keys.change_pin.old);
        wipe(&mut self.security_keys.change_pin.new);
        wipe(&mut self.security_keys.change_pin.confirm);
        self.security_keys.change_pin.open = false;
        // A pending advanced-config dialog (and its typed PIN — wiped by the
        // Drop impl) must not survive onto another key (KEY-007).
        self.security_keys.advanced = None;
        wipe(&mut self.oath.password_input);
        wipe(&mut self.oath.add.secret);
        wipe(&mut self.otp.add.secret);
        self.openpgp.wipe_secrets();
        // Destructive confirmations are per-device: a delete/reset dialog
        // opened for one key must not survive onto another (KEY-008/KEY-013).
        self.oath.confirm_delete = None;
        self.openpgp.cred_modal = None;
        self.security_keys.reset = ResetDialog::default();
        // …and so is the *armed* ceremony behind that dialog. An arm outlives
        // its dialog otherwise (nothing else clears it once the dialog is gone),
        // and it is entirely invisible: the poll keeps running, so replugging
        // the key it was armed for wipes it with the user looking at another
        // key — and the outcome would land in whatever report is on screen.
        // An armed ceremony must not outlive the selection it was armed for.
        if self.reset_arm.take().is_some() {
            self.log_global(
                Severity::Warn,
                LogKind::User,
                "the armed reset was cancelled \u{2014} selecting another key ends the ceremony. \
                 Re-open \u{201C}Reset key\u{201D} on the key you want to wipe.",
            );
        }
        self.factory_reset_report.clear();
        self.oath_tried = false;
        self.piv_tried = false;
        self.otp_tried = false;
        self.otp = OtpState::default();
        self.molto_reset_confirm = false;
        self.molto_delete_confirm = false;
        self.close_rename();
        self.authenticated = false;
        self.session = None;
        self.molto_session_device = None;
        self.info = None;
        self.slot_meta = None;

        let Some(dev) = self.selected_device().cloned() else {
            return;
        };
        match dev.kind {
            DeviceKind::Token => self.open_molto(),
            DeviceKind::ProgToken => self.open_prog(),
            DeviceKind::Key if dev.caps.has(Caps::FIDO2) => self.fetch_selected_info(),
            DeviceKind::Key => {}
        }
    }

    /// Open the selected Molto2 token's PC/SC session and read its info, so the
    /// dedicated token pane has a live handle.
    fn open_molto(&mut self) {
        let Some(reader) = self.selected_device().and_then(|d| d.reader.clone()) else {
            return;
        };
        // Tag the job with the device it opens — a delayed completion must
        // not repopulate the pane after the user switches keys (KEY-004).
        let for_device = self.selected_device.clone();
        self.spawn_job("Opening Molto2\u{2026}", move || {
            let result = (|| -> Result<(Session, DeviceInfo, Option<Vec<ProfilePublicData>>), TransportError> {
                let mut s = Session::open_named(&reader)?;
                let info = s.read_info()?;
                // Public-block sweep, one APDU per slot (~1-2 s). A failed sweep
                // degrades to the bare slot list; it must never block the open.
                let meta = (0..PROFILES)
                    .map(|p| s.read_public_data(p))
                    .collect::<Result<Vec<_>, _>>()
                    .ok();
                Ok((s, info, meta))
            })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // user switched devices mid-open; drop the session
                }
                match result {
                    Ok((s, info, meta)) => {
                        // Background: this fires automatically whenever a
                        // Molto2 is selected, never from a click of the
                        // user's own — same treatment as the device scan
                        // that usually precedes it.
                        app.log_bg(Severity::Ok, format!("opened Molto2 {}", info.serial));
                        // Enumeration's gentle probe usually fills these already;
                        // refresh them here as a fallback in case that read failed.
                        if let Some(id) = for_device.clone() {
                            let named = keyroost_keyring::Keyring::load_default()
                                .ok()
                                .and_then(|k| k.name_for(Some(&info.serial)).map(str::to_owned));
                            if let Some(dev) = app.devices.iter_mut().find(|d| d.id == id) {
                                dev.serial = info.serial.clone();
                                if dev.name.is_none() {
                                    dev.name = named;
                                }
                            }
                        }
                        app.session = Some(s);
                        app.molto_session_device = for_device;
                        app.info = Some(info);
                        app.slot_meta = meta;
                        app.authenticated = false;
                    }
                    Err(e) => app.log_bg(Severity::Err, format!("open Molto2: {e}")),
                }
            })
        });
    }

    /// Open the selected programmable token's PC/SC session and read its info,
    /// so the pane can show the model, serial and on-device clock.
    fn open_prog(&mut self) {
        let Some(reader) = self.selected_device().and_then(|d| d.reader.clone()) else {
            return;
        };
        let for_device = self.selected_device.clone();
        self.spawn_job("Opening token\u{2026}", move || {
            let result =
                (|| -> Result<(Token2ProgSession, keyroost_token2prog::Info), TransportError> {
                    let mut s = Token2ProgSession::open_named(&reader)?;
                    let info = s.read_info()?;
                    Ok((s, info))
                })();
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // user switched devices mid-open
                }
                match result {
                    Ok((s, info)) => {
                        app.log(
                            Severity::Ok,
                            format!("opened programmable token {}", info.serial),
                        );
                        app.prog_session = Some(s);
                        app.prog_info = Some(info);
                        app.prog_authenticated = false;
                    }
                    Err(e) => app.log(Severity::Err, format!("open token: {e}")),
                }
            })
        });
    }

    /// Same contract as `spawn_job` (returns whether the job actually
    /// queued), but also manages `PivState::inflight` for the job's
    /// lifetime: set the moment it queues, cleared as the very first thing
    /// the apply closure does — before whatever outcome-specific work `job`
    /// goes on to do, same ordering `piv_reset` used to hand-roll for
    /// `reset_inflight` alone. Every PIV device job (status read, PIN/PUK/
    /// management-key change, key generate/import/delete/move, self-test,
    /// self-sign/CSR, CHUID write, reset, ...) should queue through this
    /// rather than `spawn_job` directly, so `cap_piv`'s two
    /// `add_enabled_ui(!self.piv.inflight, ...)` wraps disable the pane for
    /// any of them uniformly instead of each call site managing its own flag.
    fn spawn_piv_job<F>(&mut self, label: impl Into<String>, job: F) -> bool
    where
        F: FnOnce() -> ApplyFn + Send + 'static,
    {
        let queued = self.spawn_job(label, move || {
            let apply = job();
            Box::new(move |app: &mut App| {
                app.piv.inflight = false;
                apply(app);
            }) as ApplyFn
        });
        if queued {
            self.piv.inflight = true;
        }
        queued
    }

    /// The selected device's cached [`keyroost_transport::PivSessionState`]
    /// (an empty, freshly-`Default`ed one the first time this device's PIV
    /// tab does anything), cloned for a background job to move into its
    /// `PivSession::with_cached_transaction` call — cloned rather than borrowed because
    /// the job runs off-thread and can't hold a reference into `App`. Every
    /// PIV action calls this before `spawn_piv_job` and passes the result
    /// through; see the `piv_session_state` field's doc for the full round
    /// trip.
    fn piv_cached_piv_session_state(&self) -> keyroost_transport::PivSessionState {
        let mut state: keyroost_transport::PivSessionState = self
            .selected_device
            .as_ref()
            .and_then(|id| self.piv_session_state.get(id))
            .cloned()
            .unwrap_or_default();
        // "Enable Anyway" also lets the transport send the internal reads
        // (GET METADATA, ATTEST) the table would otherwise skip for this key.
        state.set_send_unsupported_reads(self.piv_compat_ignored_selected());
        state
    }

    /// Whether the user chose to ignore the compatibility table for the
    /// selected key (see `piv_compat_ignored`).
    fn piv_compat_ignored_selected(&self) -> bool {
        self.selected_device
            .as_ref()
            .is_some_and(|id| self.piv_compat_ignored.contains(id))
    }

    /// The compatibility table's gate for `extension` on this device, relaxed
    /// ("unsupported" → "unverified", except RESET) when the user chose to
    /// ignore the table for the selected key. Every PIV control's gate goes
    /// through here rather than `compat::resolve` directly.
    fn piv_gate(
        &self,
        extension: keyroost_piv::compat::PivExtension,
        fingerprint: keyroost_piv::fingerprint::AppletFingerprint,
        version: Option<&[u8]>,
        version_firmware: Option<&[u8]>,
    ) -> keyroost_piv::compat::FeatureGate {
        let gate = keyroost_piv::compat::resolve(extension, fingerprint, version, version_firmware);
        if self.piv_compat_ignored_selected() {
            piv_relax(extension, gate)
        } else {
            gate
        }
    }

    /// Store `state` as `device`'s cached PIV session state. Called from a
    /// PIV job's apply closure with the device id captured *before* the job
    /// was spawned (not `self.selected_device` as it stands when the apply
    /// closure runs) — unlike `app.piv.status` and the rest of the pane's
    /// live display, which a stale completion must discard (see
    /// `completion_still_valid`), this map is keyed by device id and simply
    /// unused by whatever's currently on screen if the selection moved on,
    /// so there's nothing to guard: storing it is correct and worth doing
    /// even for a device the user has since switched away from, precisely
    /// so switching back to it later still finds it cached. A `None` device
    /// (nothing was selected when the job was captured) is a no-op.
    fn store_piv_session_state(
        &mut self,
        device: Option<DeviceId>,
        state: keyroost_transport::PivSessionState,
    ) {
        if let Some(id) = device {
            self.piv_session_state.insert(id, state);
        }
    }

    /// Split a job result that also carries the session's final
    /// [`keyroost_transport::PivSessionState`] into the plain
    /// `Result<PivStatus, TransportError>` [`Self::apply_piv_write`] expects,
    /// storing the state for `device` along the way (a no-op on `Err`: a
    /// job whose `PivSession::with_cached_transaction` failed outright, or that never
    /// got as far as producing a final state, has nothing to store). Shared
    /// by every simple PIN/PUK/management-key/retries write, which
    /// otherwise all repeat this same split.
    fn store_and_unwrap_piv_write(
        &mut self,
        device: Option<DeviceId>,
        result: Result<
            (
                keyroost_transport::PivStatus,
                keyroost_transport::PivSessionState,
            ),
            TransportError,
        >,
    ) -> Result<keyroost_transport::PivStatus, TransportError> {
        match result {
            Ok((status, state)) => {
                self.store_piv_session_state(device, state);
                Ok(status)
            }
            Err(e) => Err(e),
        }
    }

    /// [`Self::store_and_unwrap_piv_write`] for a certificate import or
    /// self-signed certificate job, which also returns what the import
    /// stored ([`keyroost_transport::CertImport`]).
    fn store_and_unwrap_piv_cert_write(
        &mut self,
        device: Option<DeviceId>,
        result: Result<
            (
                keyroost_transport::PivStatus,
                keyroost_transport::PivSessionState,
                keyroost_transport::CertImport,
            ),
            TransportError,
        >,
    ) -> Result<
        (
            keyroost_transport::PivStatus,
            keyroost_transport::CertImport,
        ),
        TransportError,
    > {
        let (result, stored) = match result {
            Ok((status, state, stored)) => (Ok((status, state)), Some(stored)),
            Err(e) => (Err(e), None),
        };
        let status = self.store_and_unwrap_piv_write(device, result)?;
        Ok((status, stored.expect("Ok result carries the CertImport")))
    }

    /// [`Self::load_piv_status_with_cache`] with `cache` fixed to
    /// [`PivCache::Reuse`] — the common case: every caller except the
    /// Refresh button wants this. See that method's doc for the full
    /// contract.
    fn load_piv_status(&mut self, kind: LogKind) {
        self.load_piv_status_with_cache(kind, PivCache::Reuse);
    }

    /// Read the selected card's read-only PIV status snapshot: status + every
    /// slot's algorithm/subject/policy. `kind` should be `User` only when
    /// this runs because the user clicked "Refresh" — the initial read when
    /// the PIV tab is first opened, and the re-read every write triggers
    /// afterwards to pick up what it changed, both pass `Background` so the
    /// activity log renders them the way they actually happened (see
    /// `LogKind`). `cache` governs the separate question of whether this
    /// read trusts `piv_session_state` at all — see [`PivCache`]. Callers
    /// that always want [`PivCache::Reuse`] (everyone but the Refresh
    /// button) can go through [`Self::load_piv_status`] instead, which
    /// fixes it for them. The activity log line itself distinguishes the two
    /// outcomes a `Reuse` read can have: "PIV status read (N slots)" when
    /// [`keyroost_transport::PivSession::touched_card`] says a live APDU
    /// actually reached the card, "PIV status cache validated" when every
    /// value came out of the reused state with none.
    fn load_piv_status_with_cache(&mut self, kind: LogKind, cache: PivCache) {
        self.piv.error = None;
        let Some(reader) = self.selected_oath_reader() else {
            return;
        };
        let for_device = self.selected_device.clone();
        let cached_state = match cache {
            PivCache::Reuse => Some(self.piv_cached_piv_session_state()),
            // A fresh read still honours "Enable Anyway": an empty state never
            // matches the card, so this resolves everything from scratch like
            // the plain path, but with the user's choice carried in.
            PivCache::Bypass => self.piv_compat_ignored_selected().then(|| {
                let mut fresh = keyroost_transport::PivSessionState::default();
                fresh.set_send_unsupported_reads(true);
                fresh
            }),
        };
        self.spawn_piv_job("Reading PIV status\u{2026}", move || {
            // One transport call gathers the snapshot and every slot's
            // algorithm / Subject DN / PIN-touch policy, reading each slot's
            // GET METADATA and certificate object exactly once. Doing this
            // pane-side with `slot_key_algorithm` + `read_certificate` +
            // `slot_policy` per slot re-read the certificate two or three
            // times and GET METADATA twice (`PivSession` keeps no read cache).
            // `with_cached_transaction` carries forward whatever keys generated earlier
            // this app run were already cached — including across a device
            // switch and back — so there's no need to reseed `remember_pubkey`
            // per slot the way a plain `with_transaction` would have required;
            // `PivCache::Bypass` forgoes that on purpose — see this
            // method's doc.
            let result = match cached_state {
                Some(cached) => {
                    keyroost_transport::PivSession::with_cached_transaction(&reader, cached, |s| {
                        let detailed = s.status_detailed();
                        // Read before `state()` so it reflects this call's
                        // own status_detailed() and nothing after — whether
                        // *any* of it needed a live APDU, or every value came
                        // out of the state `with_cached_transaction` carried
                        // in with no card round trip at all.
                        let touched_card = s.touched_card();
                        Ok::<_, TransportError>((detailed, s.state(), touched_card))
                    })
                }
                None => keyroost_transport::PivSession::with_transaction(&reader, |s| {
                    let detailed = s.status_detailed();
                    let touched_card = s.touched_card();
                    Ok::<_, TransportError>((detailed, s.state(), touched_card))
                }),
            };
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                match result {
                    Ok((Ok(detailed), state, touched_card)) => {
                        app.store_piv_session_state(for_device.clone(), state);
                        let keyroost_transport::PivStatusDetailed { status, slots, .. } = detailed;
                        // `touched_card` false means every field above came
                        // out of the cache `with_cached_transaction` reused, with no
                        // live APDU at all — say so distinctly from an
                        // actual read, rather than implying this round trip
                        // hit the card when it didn't.
                        let message = if touched_card {
                            format!("PIV status read ({} slots)", slots.len())
                        } else {
                            "PIV status cache validated".to_string()
                        };
                        app.log_kind(Severity::Ok, kind, message);
                        app.piv.slot_keys = slots
                            .iter()
                            .map(|d| (d.slot, d.algorithm, d.subject.clone()))
                            .collect();
                        app.piv.slot_policies = slots.iter().map(|d| (d.slot, d.policy)).collect();
                        app.piv.status = Some(status);
                        app.piv.loaded = true;
                    }
                    Ok((Err(e), state, _touched_card)) => {
                        app.store_piv_session_state(for_device.clone(), state);
                        app.log_kind(Severity::Err, kind, format!("PIV status read: {e}"));
                        app.piv.error = Some(e.to_string());
                    }
                    Err(e) => {
                        app.log_kind(Severity::Err, kind, format!("PIV status read: {e}"));
                        app.piv.error = Some(e.to_string());
                    }
                }
            })
        });
    }

    /// Apply a PIV write result: on success store the notice and refreshed
    /// status; on error store the message. Shared by every PIV write action —
    /// also where every one of them logs, User-weight (the caller's `notice`
    /// already says what happened in plain terms; a click landed here to
    /// produce it).
    fn apply_piv_write(
        app: &mut App,
        result: Result<keyroost_transport::PivStatus, TransportError>,
        notice: String,
    ) {
        match result {
            Ok(status) => {
                app.log(Severity::Ok, notice.clone());
                app.piv.status = Some(status);
                app.piv.error = None;
                app.piv.notice = Some(notice);
                // Re-read so per-slot key algorithms (and anything the write
                // touched) reflect the new state without a manual Refresh —
                // background: it's a side-effect re-read, not the action the
                // user asked for (that's the log line just above).
                app.load_piv_status(LogKind::Background);
                // Any successful PIV write (delete, reset, move, ...) can change
                // retired-slot occupancy; drop the cache so the retired tab
                // re-reads fresh on its next open instead of showing stale
                // occupancy (see piv_move_key for the same invalidation).
                app.piv.retired_occupancy = None;
                // A retired-slot selection is stale once its occupancy cache is
                // dropped; snapping back to a
                // standard slot prevents acting on it with unknown occupancy —
                // notably the Generate overwrite guard, which would otherwise
                // see "unknown" as "empty" and skip its warning on a still-
                // occupied archived key.
                if matches!(app.piv.selected_slot, PivSlotSel::Retired(_)) {
                    app.piv.selected_slot = PivSlotSel::Auth;
                }
            }
            Err(e) => {
                app.log(Severity::Err, e.to_string());
                app.piv.notice = None;
                app.piv.error = Some(e.to_string());
            }
        }
    }

    /// Mirror a PIV PIN/PUK write result into the credential modal so the outcome
    /// is shown in-modal (issue #31). Reads the pane status `apply_piv_write` just
    /// set: success clears `busy` and records `Ok(())`; an error records the
    /// message and keeps the modal open for a retry. Cleared secrets on success
    /// are wiped by the op's apply closure regardless.
    fn apply_piv_cred_result(app: &mut App) {
        if let Some(m) = app.piv.cred_modal.as_mut() {
            m.busy = false;
            m.result = match &app.piv.error {
                Some(e) => Some(Err(e.clone())),
                None => Some(Ok(())),
            };
        }
    }

    /// [`Self::apply_piv_write`] + [`Self::apply_piv_cred_result`] for a
    /// certificate import or self-signed certificate: the notice (`base`
    /// plus how it was stored) and the dialog's detail mirror the CLI's
    /// output, and a too-large refusal under Never points at the dropdown.
    fn apply_piv_cert_write(
        app: &mut App,
        result: Result<
            (
                keyroost_transport::PivStatus,
                keyroost_transport::CertImport,
            ),
            TransportError,
        >,
        base: &str,
        choice: PivCertCompressionSel,
    ) {
        match result {
            Ok((status, stored)) => {
                let notice = piv_cert_stored_notice(
                    base,
                    stored.compressed,
                    stored.stored_len,
                    stored.auto_compressed,
                );
                Self::apply_piv_write(app, Ok(status), notice);
                if let Some(m) = app.piv.cred_modal.as_mut() {
                    m.detail = piv_cert_stored_detail(
                        stored.compressed,
                        stored.stored_len,
                        stored.auto_compressed,
                    );
                }
            }
            Err(e) => {
                let hint = piv_cert_error_hint(&e, choice);
                Self::apply_piv_write(app, Err(e), String::new());
                if let (Some(hint), Some(err)) = (hint, app.piv.error.as_mut()) {
                    err.push_str(hint);
                }
            }
        }
        Self::apply_piv_cred_result(app);
    }

    /// Change the PIV PIN. Validates new==confirm, runs off-thread, and surfaces
    /// the outcome both in the pane banner and in the credential modal.
    fn piv_change_pin(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        if self.piv.pin_new != self.piv.pin_confirm {
            self.piv.notice = None;
            self.piv.error = Some("the two new PINs don't match".into());
            return;
        }
        let (old, new) = (self.piv.pin_old.clone(), self.piv.pin_new.clone());
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Changing PIV PIN\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    s.change_pin(old.as_bytes(), new.as_bytes())?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.pin_old);
                wipe(&mut app.piv.pin_new);
                wipe(&mut app.piv.pin_confirm);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(app, result, "PIN changed.".into());
                Self::apply_piv_cred_result(app);
            })
        });
    }

    fn piv_change_puk(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        if self.piv.puk_new != self.piv.puk_confirm {
            self.piv.notice = None;
            self.piv.error = Some("the two new PUKs don't match".into());
            return;
        }
        let (old, new) = (self.piv.puk_old.clone(), self.piv.puk_new.clone());
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Changing PUK\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    s.change_puk(old.as_bytes(), new.as_bytes())?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.puk_old);
                wipe(&mut app.piv.puk_new);
                wipe(&mut app.piv.puk_confirm);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(app, result, "PUK changed.".into());
                Self::apply_piv_cred_result(app);
            })
        });
    }

    fn piv_unblock_pin(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let (puk, new) = (
            self.piv.unblock_puk.clone(),
            self.piv.unblock_new_pin.clone(),
        );
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Unblocking PIN\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    s.unblock_pin(puk.as_bytes(), new.as_bytes())?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.unblock_puk);
                wipe(&mut app.piv.unblock_new_pin);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(app, result, "PIN unblocked and reset.".into());
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// [`piv_default_mgmt_key`] for the currently selected card's last-read
    /// status — `None` before any status has been read, or when this
    /// fingerprint/version carries no
    /// [`keyroost_piv::compat::PivQuirk::Default9bManagementKey`]. The one
    /// place both [`Self::piv_current_mgmt_key`] and
    /// [`Self::piv_modal_mgmt_field`]'s checkbox-enablement check resolve
    /// this, so the two can't disagree about whether a default is on offer.
    fn piv_current_default_mgmt_key(&self) -> Option<&'static [u8]> {
        let status = self.piv.status.as_ref()?;
        piv_default_mgmt_key(
            status.applet_fingerprint,
            status.version.as_deref(),
            status.version_firmware.as_deref(),
        )
    }

    /// Resolve the *current* management key the user authorized this op with:
    /// this device's well-known factory default when "Use default management
    /// key" is ticked, otherwise the hex they typed. Decoding errors are
    /// surfaced the same way the inline field's were; ticking the toggle on a
    /// device with no known default (which the checkbox should already be
    /// disabled for — see [`Self::piv_modal_mgmt_field`]) surfaces the same
    /// way rather than silently falling back to a guess.
    fn piv_current_mgmt_key(&self) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
        if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Default {
            self.piv_current_default_mgmt_key()
                .map(|key| zeroize::Zeroizing::new(key.to_vec()))
                .ok_or_else(|| "This device has no known default management key.".to_string())
        } else {
            piv_mgmt_key_bytes(&self.piv.mgmt_key_input)
        }
    }

    /// Resolve how the user authorized `kind`'s management operation: the
    /// standard management key (default or typed — [`Self::piv_current_mgmt_key`])
    /// or, with "Use PIN" ticked, a PIN for
    /// `PivSession::authenticate_management_via_pin`. The PIN itself comes
    /// from `mgmt_key_input` normally, or — for a flow with a dedicated PIN
    /// field of its own (`PivCredKind::shares_pin_field`) — from that field
    /// directly, exactly the sequence [`piv_authenticate`] would run had the
    /// same PIN been typed into the management-key field instead: PIV has
    /// only one application PIN, so there's nothing to gain by asking twice.
    fn piv_current_mgmt_auth(&self, kind: PivCredKind) -> Result<PivMgmtAuth, String> {
        if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
            let pin = if kind.shares_pin_field() {
                match kind {
                    PivCredKind::SelfSign => &self.piv.sign_pin,
                    PivCredKind::SetRetries => &self.piv.retries_pin_auth,
                    _ => unreachable!("shares_pin_field() covers exactly these two kinds"),
                }
            } else {
                &self.piv.mgmt_key_input
            };
            return Ok(PivMgmtAuth::Pin(zeroize::Zeroizing::new(pin.clone())));
        }
        self.piv_current_mgmt_key().map(PivMgmtAuth::Key)
    }

    fn piv_set_retries(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::SetRetries) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let pin = zeroize::Zeroizing::new(self.piv.retries_pin_auth.clone());
        let (pin_tries, puk_tries) = (self.piv.retries_pin, self.piv.retries_puk);
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Setting PIV retry counts\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &mgmt)?;
                    s.verify_pin(pin.as_bytes())?;
                    s.set_pin_retries(pin_tries, puk_tries)?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                wipe(&mut app.piv.retries_pin_auth);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(
                    app,
                    result,
                    "Retry counts set; PIN/PUK reset to defaults.".into(),
                );
                Self::apply_piv_cred_result(app);
            })
        });
    }

    fn piv_generate_key(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::GenerateKey) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let slot = self.piv.selected_slot.to_slot();
        let alg = self.piv.gen_alg;
        let (pin_policy, touch_policy) = (self.piv.gen_pin_policy, self.piv.gen_touch_policy);
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Generating key\u{2026} (touch if it blinks)", move || {
            let result = keyroost_transport::PivSession::with_cached_transaction(
                &name,
                cached_state,
                |s| -> Result<_, TransportError> {
                    piv_authenticate(s, &mgmt)?;
                    let pubkey = s.generate_key(slot, alg, pin_policy, touch_policy)?;
                    let status = s.status()?;
                    Ok((pubkey, status, s.state()))
                },
            );
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                match result {
                    Ok((pubkey, status, state)) => {
                        app.log(
                            Severity::Ok,
                            format!("generated {} key in {}", alg.label(), slot.label()),
                        );
                        app.piv.status = Some(status);
                        app.piv.error = None;
                        // `generate_key` already remembered the new key in
                        // this session's own pubkey cache — see
                        // `PivSessionState::pubkey_cache`'s doc. Storing the
                        // updated state (rather than just discarding it) is
                        // what lets a later self-sign/CSR, or this same
                        // status refresh below, name the key on cards that
                        // don't answer GET METADATA — including after
                        // switching to another device's tab and back, which
                        // a bare per-job cache couldn't survive.
                        app.store_piv_session_state(for_device.clone(), state);
                        match keyroost_piv::spki::subject_public_key_info(&pubkey, alg) {
                            Ok(_) => {
                                app.piv.notice = Some(format!("Generated {} key.", alg.label()));
                            }
                            Err(e) => {
                                app.piv.notice = Some(format!(
                                    "Generated {} key (public-key encoding failed: {})",
                                    alg.label(),
                                    e
                                ));
                            }
                        }
                        // Re-read so the slot's "State:" line picks up the new
                        // key's algorithm immediately, same as every other PIV
                        // write (`apply_piv_write`) already does. This matters
                        // even more here than there: on firmware without GET
                        // METADATA, `slot_key_algorithm` has no certificate to
                        // fall back to yet (this slot didn't have one before
                        // generating and still doesn't), so without this
                        // refresh the pane would keep showing "empty" until
                        // some *other* write happened to trigger one.
                        app.load_piv_status(LogKind::Background);
                        // A retired slot's occupancy cache may now be stale
                        // (generation can target a retired slot); drop it so
                        // it re-reads fresh rather than keeping a cached
                        // "empty" for the slot just written to. Unlike
                        // `apply_piv_write`'s reset path, the selection itself
                        // stays put — the user is almost certainly about to
                        // look at (or self-sign/CSR) exactly the slot they
                        // just generated into.
                        app.piv.retired_occupancy = None;
                    }
                    Err(e) => {
                        app.log(Severity::Err, e.to_string());
                        app.piv.notice = None;
                        app.piv.error = Some(e.to_string());
                    }
                }
                Self::apply_piv_cred_result(app);
            })
        });
    }

    fn piv_import_cert(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::ImportCert) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let slot = self.piv.selected_slot.to_slot();
        let path = self.piv.cert_path.trim().to_owned();
        let choice = self.piv.cert_compression;
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        // `with_cached_transaction` restores the whole cached pubkey map (every slot, not
        // just this one) as part of resolving the session — see
        // `load_piv_status`/`piv_self_sign`'s docs for why a key generated
        // earlier this app run, including one that overwrote an older key
        // already loaded into this slot, has to be known before
        // `import_certificate`'s own key-match check
        // (`PivSession::reject_certificate_key_mismatch`) has anything to
        // compare against — without it, that check silently treats the
        // slot's key as unknowable and lets a stale certificate through even
        // when this app run knows better.
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Importing certificate\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_transport::PivStatus,
                    keyroost_transport::PivSessionState,
                    keyroost_transport::CertImport,
                ),
                TransportError,
            > {
                let bytes = std::fs::read(&path).map_err(|_| {
                    TransportError::MalformedResponse("cannot read certificate file")
                })?;
                let der = cert_bytes_to_der(&bytes)
                    .ok_or(TransportError::MalformedResponse("file is not PEM or DER"))?;
                keyroost_transport::PivSession::with_cached_transaction(
                    &name,
                    cached_state,
                    |s| {
                        piv_authenticate(s, &mgmt)?;
                        let stored = s.import_certificate(slot, &der, choice.to_compression())?;
                        let status = s.status()?;
                        Ok((status, s.state(), stored))
                    },
                )
            })();
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                let result = app.store_and_unwrap_piv_cert_write(for_device, result);
                Self::apply_piv_cert_write(app, result, "Certificate imported", choice);
            })
        });
    }

    /// Delete (clear) the certificate in the selected slot. The private
    /// key, if any, is left intact. Management-key authorized; works on every
    /// PIV card. Mirrors `piv_import_cert`'s shape: open → authenticate → call
    /// the transport method → re-read status (so the slot's cert state updates).
    fn piv_delete_cert(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::DeleteCert) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let slot = self.piv.selected_slot.to_slot();
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Deleting certificate\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &mgmt)?;
                    s.clear_certificate(slot)?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(
                    app,
                    result,
                    format!("Certificate removed from {}.", slot.label()),
                );
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Regenerate the "New CHUID" GUID input with a fresh random value —
    /// called when the dialog opens and by its "Refresh" button. Host-side
    /// only (no card I/O); leaves the field as-is on the vanishingly rare RNG
    /// failure rather than blanking a value the user may already be editing.
    fn piv_refresh_chuid_guid(&mut self) {
        if let Ok(guid) = keyroost_transport::random_chuid_guid() {
            self.piv.chuid_guid = keyroost_piv::format_guid(&guid);
        }
    }

    /// "Change management key"'s "Generate random key & Copy" link: fill `New
    /// key` with a fresh random key sized for `alg` and copy it to the
    /// clipboard. Host-side only (no card I/O); the field's prior contents
    /// are wiped, not just overwritten, same discipline as every other
    /// secret-bearing field this app clears. Auto-clears the clipboard after
    /// 45s like the OTP-code copy path, so the generated key doesn't sit in
    /// clipboard-manager history forever. Leaves the field as-is on the
    /// vanishingly rare RNG failure rather than blanking a value the user
    /// may already be editing. Reveals the field (same `secret_reveal` toggle
    /// its own eye icon uses) — the value just landed on the clipboard in
    /// plain text anyway, so hiding it in the field buys nothing and only
    /// stops the user checking what they generated.
    fn piv_generate_random_mgmt_key(&mut self, ctx: &egui::Context, alg: keyroost_piv::MgmtAlg) {
        let Ok(key) = keyroost_transport::random_management_key(alg) else {
            return;
        };
        let hex = hex_lower(&key);
        wipe(&mut self.piv.new_mgmt_key_input);
        self.piv.new_mgmt_key_input.push_str(&hex);
        ctx.copy_text(hex.clone());
        self.clipboard_clear_at = Some((hex, now_secs_f64() + 45.0));
        self.secret_reveal.insert("piv-new-mgmt-key", true);
    }

    /// Write a CHUID — the GUID from `chuid_guid` (a fresh random default,
    /// or whatever the user overwrote it with). Management-key authorized;
    /// applet-wide, not tied to any slot. Mirrors `piv_import_cert`'s shape:
    /// open \u{2192} authenticate \u{2192} call the transport method \u{2192} re-read status.
    /// Windows' PIV minidriver caches a card's contents by its CHUID's GUID,
    /// so this is what makes it notice a slot's certificate/key actually
    /// changed.
    fn piv_new_chuid(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::NewChuid) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let guid = match keyroost_piv::parse_guid_hex(&self.piv.chuid_guid) {
            Some(g) => g,
            None => {
                self.piv.error = Some(
                    "GUID must be 16 bytes of hex, dashes optional (e.g. \
                     aabbccdd-eeff-1122-3344-556677889900)"
                        .into(),
                );
                return;
            }
        };
        let expiration = keyroost_piv::yyyymmdd_from_unix_secs(keyroost_piv::add_calendar_period(
            u64::from(unix_now()),
            self.piv.chuid_valid_years,
            self.piv.chuid_valid_months,
            self.piv.chuid_valid_days,
        ));
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Writing a new CHUID\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &mgmt)?;
                    s.new_chuid(&guid, &expiration)?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(app, result, "New CHUID written.".into());
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Permanently delete (erase) the private key in the selected slot.
    /// Management-key authorized. DELETE KEY is a Yubico extension (fw 5.7+);
    /// the slot panel resolves `keyroost_piv::compat` into a three-way gate
    /// (enable / warn / dim), and an unsupported card refuses the APDU itself
    /// — the transport no longer version-gates.
    fn piv_delete_key(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::DeleteKey) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let slot = self.piv.selected_slot.to_slot();
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Deleting key\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &mgmt)?;
                    s.delete_key(slot)?;
                    // `delete_key` already evicted this slot from the
                    // session's own pubkey cache — nothing left to do here
                    // beyond storing the updated state back.
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(app, result, format!("Key erased from {}.", slot.label()));
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Relocate the selected slot's private key to the chosen destination slot
    /// (Yubico MOVE KEY). Mirrors `piv_delete_key`: management-key auth, then the
    /// move, then a status re-read. The source slot's certificate stays put.
    fn piv_move_key(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::MoveKey) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let src = self.piv.selected_slot.to_slot();
        let Some(dest) = self.piv.move_dest else {
            self.piv.error = Some("choose a destination slot".into());
            return;
        };
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Moving key\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &mgmt)?;
                    // The key itself relocated, not just its reference —
                    // `move_key` already carries a cached entry along with it
                    // in the session's own pubkey cache, same as
                    // `PivSession::move_key`'s in-session cache always has.
                    s.move_key(src, dest)?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(
                    app,
                    result,
                    format!("Key moved from {} to {}.", src.label(), dest.label()),
                );
                // Retired occupancy changed (source and/or destination); drop
                // the cache so the retired tab re-reads on its next open.
                app.piv.retired_occupancy = None;
                // A retired-slot selection is stale once its occupancy cache is
                // dropped; snapping back to a
                // standard slot prevents acting on it with unknown occupancy —
                // notably the Generate overwrite guard, which would otherwise
                // see "unknown" as "empty" and skip its warning on a still-
                // occupied archived key.
                if matches!(app.piv.selected_slot, PivSlotSel::Retired(_)) {
                    app.piv.selected_slot = PivSlotSel::Auth;
                }
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Lazily read which of the 20 retired slots hold a key (GET METADATA each),
    /// caching the result in `PivState::retired_occupancy`. Triggered once when
    /// the "Retired slots" section is expanded (or the move modal opens) rather
    /// than on every status refresh, keeping the common path to 4 slot reads.
    /// Returns whether the read was actually queued (mirrors `spawn_job`'s
    /// contract): `false` means no job is in flight, so callers must not act
    /// as though a load is pending.
    fn load_piv_retired_occupancy(&mut self) -> bool {
        let Some(reader) = self.selected_oath_reader() else {
            return false;
        };
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Reading retired slots\u{2026}", move || {
            let result = keyroost_transport::PivSession::with_cached_transaction(
                &reader,
                cached_state,
                |s| {
                    let occupancy: Vec<_> = keyroost_piv::Slot::retired_all()
                        .into_iter()
                        .map(|slot| (slot, s.slot_has_key(slot).unwrap_or(false)))
                        .collect();
                    Ok::<_, TransportError>((occupancy, s.state()))
                },
            );
            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-read; discard
                }
                match result {
                    Ok((v, state)) => {
                        app.store_piv_session_state(for_device.clone(), state);
                        // Background: this fires the first time the retired
                        // slots section is expanded, or the move-key modal is
                        // opened — neither is "the user asked to read retired
                        // occupancy", it's incidental to something else.
                        app.log_bg(
                            Severity::Ok,
                            format!("retired slot occupancy read ({} slots)", v.len()),
                        );
                        app.piv.retired_occupancy = Some(v);
                    }
                    Err(e) => {
                        app.log_bg(Severity::Warn, format!("retired slot occupancy: {e}"));
                        app.piv.error = Some(e.to_string());
                    }
                }
            })
        })
    }

    /// Whether the currently selected PIV slot already holds a private key.
    /// Thin wrapper over [`piv_slot_occupied`] reading the loaded caches; drives
    /// the Generate-key overwrite warning and the Import-cert replace note.
    fn piv_selected_occupied(&self) -> bool {
        piv_slot_occupied(
            self.piv.selected_slot,
            &self.piv.slot_keys,
            self.piv.retired_occupancy.as_deref(),
        )
    }

    /// The selected slot's `(PIN policy, touch policy)` from the last
    /// `status_detailed` read, or `None` when the card didn't report one.
    fn piv_selected_slot_policy(
        &self,
    ) -> Option<(keyroost_piv::PinPolicy, keyroost_piv::TouchPolicy)> {
        let sel = self.piv.selected_slot.to_slot();
        self.piv
            .slot_policies
            .iter()
            .find(|(s, _)| *s == sel)
            .and_then(|(_, pol)| *pol)
    }

    /// The selected slot's key algorithm (from the last `status_detailed`
    /// read) and whether it holds a certificate — the two facts the Test row
    /// gates its button on.
    fn piv_selected_test_target(&self) -> (Option<keyroost_piv::KeyAlg>, bool) {
        let sel = self.piv.selected_slot.to_slot();
        let entry = self.piv.slot_keys.iter().find(|(s, _, _)| *s == sel);
        let alg = entry.and_then(|(_, a, _)| *a);
        let has_cert = entry.is_some_and(|(_, _, dn)| dn.is_some())
            || self
                .piv
                .status
                .as_ref()
                .is_some_and(|st| st.slots.iter().any(|s| s.slot == sel && s.cert_present));
        (alg, has_cert)
    }

    /// Run every self-test the selected slot's key algorithm supports
    /// (decrypt, then key-agree, then sign): build a fixed challenge from the
    /// slot certificate's public key ([`keyroost_pivtest`]), run the
    /// private-key op on the card, and verify the reply against that public
    /// key. Read-only on the card — no write, no management key. The PIN
    /// field is always optional — it's the user's call whether to test with
    /// or without one, independent of the slot's (possibly misreported) PIN
    /// policy; the PIN is only sent to the card when the field is non-blank.
    /// Each operation's pass/fail is reported together.
    fn piv_self_test(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let pin = zeroize::Zeroizing::new(self.piv.sign_pin.clone());
        let slot = self.piv.selected_slot.to_slot();
        let want_touch = matches!(
            self.piv_selected_slot_policy().map(|(_, t)| t),
            Some(keyroost_piv::TouchPolicy::Always | keyroost_piv::TouchPolicy::Cached)
        );
        self.piv.notice = None;
        let label = if want_touch {
            "Running self-test\u{2026} \u{2014} touch the key"
        } else {
            "Running self-test\u{2026}"
        };
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job(label, move || {
            let outcome = run_piv_self_test(&name, slot, pin.as_bytes(), cached_state);
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.sign_pin);
                let (all_ok, text) = match &outcome {
                    // Skipped ops don't count as failures.
                    Ok((results, _)) => (
                        !results.iter().any(|(_, r)| r.is_failure()),
                        keyroost_pivtest::format_report(results),
                    ),
                    Err(e) => (false, e.clone()),
                };
                if let Ok((_, state)) = outcome {
                    app.store_piv_session_state(for_device, state);
                }
                if all_ok {
                    app.log(
                        Severity::Ok,
                        format!("PIV self-test on {} passed", slot.label()),
                    );
                    app.piv.error = None;
                    app.piv.notice = Some(text.clone());
                } else {
                    app.log(
                        Severity::Err,
                        format!("PIV self-test on {} failed", slot.label()),
                    );
                    app.piv.notice = None;
                    app.piv.error = Some(text.clone());
                }
                if let Some(m) = app.piv.cred_modal.as_mut() {
                    m.detail = all_ok.then_some(text);
                }
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Normalize the certificate-subject field: a bare name becomes `CN=name`;
    /// anything containing `=` is taken as a full distinguished name.
    fn piv_subject(&self) -> Option<String> {
        let s = self.piv.cert_subject.trim();
        if s.is_empty() {
            return None;
        }
        Some(if s.contains('=') {
            s.to_owned()
        } else {
            format!("CN={s}")
        })
    }

    /// Create a self-signed certificate for the selected slot's key and store
    /// it in the slot (management key authorizes the import, PIN the signing).
    fn piv_self_sign(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let mgmt = match self.piv_current_mgmt_auth(PivCredKind::SelfSign) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        let Some(subject) = self.piv_subject() else {
            self.piv.error = Some("enter a name for the certificate".into());
            return;
        };
        let pin = zeroize::Zeroizing::new(self.piv.sign_pin.clone());
        let slot = self.piv.selected_slot.to_slot();
        let years = self.piv.cert_valid_years;
        let months = self.piv.cert_valid_months;
        // Same "at least a day" floor `cert_days.max(1)` used before the
        // single field split into three: an all-zero combination would
        // otherwise produce a validity period that ends before it starts.
        let days = if years == 0 && months == 0 {
            self.piv.cert_valid_days.max(1)
        } else {
            self.piv.cert_valid_days
        };
        let choice = self.piv.cert_compression;
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        // `with_cached_transaction` restores whatever the session's pubkey cache already
        // knew — including a key generated earlier this app run, on cards
        // where the freshly-opened session otherwise has no other way to
        // learn it (see `load_piv_status`'s doc).
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job(
            "Creating self-signed certificate\u{2026} (touch if it blinks)",
            move || {
                let result = keyroost_transport::PivSession::with_cached_transaction(
                    &name,
                    cached_state,
                    |s| {
                        piv_authenticate(s, &mgmt)?;
                        let now = unix_now();
                        let (_, stored) = s.self_signed_certificate(
                            slot,
                            &subject,
                            i64::from(now),
                            keyroost_piv::add_calendar_period(u64::from(now), years, months, days),
                            pin.as_bytes(),
                            choice.to_compression(),
                        )?;
                        let status = s.status()?;
                        Ok((status, s.state(), stored))
                    },
                );
                Box::new(move |app: &mut App| {
                    wipe(&mut app.piv.sign_pin);
                    wipe(&mut app.piv.mgmt_key_input);
                    let result = app.store_and_unwrap_piv_cert_write(for_device, result);
                    Self::apply_piv_cert_write(
                        app,
                        result,
                        &format!("Self-signed certificate stored in {}", slot.label()),
                        choice,
                    );
                })
            },
        );
    }

    /// Sign a PKCS#10 certificate request on the card and save it as PEM.
    fn piv_request_csr(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let Some(subject) = self.piv_subject() else {
            self.piv.error = Some("enter a name for the certificate request".into());
            return;
        };
        // The path comes from a native save dialog, which already handled its
        // own "replace existing file?" prompt — so no empty / clobber checks
        // here.
        let path = self.piv.csr_path.trim().to_owned();
        let pin = zeroize::Zeroizing::new(self.piv.sign_pin.clone());
        let slot = self.piv.selected_slot.to_slot();
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        // See `piv_self_sign`: `with_cached_transaction` restores whatever the session's
        // pubkey cache already knew, including a key generated earlier this
        // app run.
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job(
            "Signing certificate request\u{2026} (touch if it blinks)",
            move || {
                let result = keyroost_transport::PivSession::with_cached_transaction(
                    &name,
                    cached_state,
                    |s| -> Result<_, TransportError> {
                        let pem = s.generate_csr(slot, &subject, pin.as_bytes())?;
                        std::fs::write(&path, pem.as_bytes()).map_err(|_| {
                            TransportError::MalformedResponse("cannot write destination file")
                        })?;
                        Ok(s.state())
                    },
                );
                Box::new(move |app: &mut App| {
                    wipe(&mut app.piv.sign_pin);
                    match result {
                        Ok(state) => {
                            app.store_piv_session_state(for_device, state);
                            app.log(
                                Severity::Ok,
                                format!("certificate request signed for {}", slot.label()),
                            );
                            app.piv.error = None;
                            app.piv.notice = Some("Certificate request signed and saved.".into());
                        }
                        Err(e) => {
                            app.log(Severity::Err, e.to_string());
                            app.piv.notice = None;
                            app.piv.error = Some(e.to_string());
                        }
                    }
                    Self::apply_piv_cred_result(app);
                })
            },
        );
    }

    fn piv_export_cert(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let slot = self.piv.selected_slot.to_slot();
        // The path comes from a native save dialog, which already handled its
        // own "replace existing file?" prompt — so no empty / clobber checks
        // here.
        let path = self.piv.export_path.trim().to_owned();
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Exporting certificate\u{2026}", move || {
            let result = keyroost_transport::PivSession::with_cached_transaction(
                &name,
                cached_state,
                |s| -> Result<_, TransportError> {
                    let der =
                        s.read_certificate(slot)?
                            .ok_or(TransportError::MalformedResponse(
                                "slot holds no certificate",
                            ))?;
                    std::fs::write(&path, &der).map_err(|_| {
                        TransportError::MalformedResponse("cannot write destination file")
                    })?;
                    Ok((der.len(), s.state()))
                },
            );
            Box::new(move |app: &mut App| match result {
                Ok((n, state)) => {
                    app.store_piv_session_state(for_device, state);
                    app.log(
                        Severity::Ok,
                        format!("exported {}-byte certificate from {}", n, slot.label()),
                    );
                    app.piv.error = None;
                    app.piv.notice = Some(format!("Exported {}-byte DER certificate.", n));
                }
                Err(e) => {
                    app.log(Severity::Err, e.to_string());
                    app.piv.notice = None;
                    app.piv.error = Some(e.to_string());
                }
            })
        });
    }

    fn piv_change_management_key(&mut self) {
        let Some(name) = self.selected_oath_reader() else {
            return;
        };
        let old = match self.piv_current_mgmt_auth(PivCredKind::ChangeMgmtKey) {
            Ok(a) => a,
            Err(e) => {
                self.piv.error = Some(e);
                return;
            }
        };
        // "Delete" (HID Crescendo only — see `PivMgmtAlgSel`'s doc) needs no
        // new-key input at all: an empty key goes to the card instead,
        // deleting XAUTH key 1 rather than replacing it. Every other
        // selection reads/validates the typed hex as usual.
        let new = match self.piv.new_mgmt_alg.to_alg() {
            Some(new_alg) => {
                let new = match piv_mgmt_key_bytes(&self.piv.new_mgmt_key_input) {
                    Ok(b) => b,
                    Err(e) => {
                        self.piv.error = Some(e);
                        return;
                    }
                };
                if new.len() != new_alg.key_len() {
                    self.piv.error = Some(format!(
                        "new management key is {} bytes; {} needs {}",
                        new.len(),
                        new_alg.label(),
                        new_alg.key_len()
                    ));
                    return;
                }
                Some((new_alg, new))
            }
            None => None,
        };
        // Whether to also maintain PIN-protected management-key storage
        // (`set_management_key_pin_protected`'s steps 2a/2b) alongside the
        // key change itself, gated on `PivExtension::PinManagementAuth` the
        // same way the checkbox row above is — the GUI has no `--force`
        // override the way `keyroostctl` does, so a device known unable to
        // support it stays on plain `set_management_key`, leaving Admin
        // Data / the PIN-protected object untouched either way. HID
        // Crescendo resolves this `Supported` unconditionally, so it always
        // takes the maintenance path — its own no-op lives inside
        // `set_management_key_pin_protected` itself, not here.
        //
        // `pin_unlock_gate` is kept (not just the derived `maintain_pin_unlock`
        // bool) because the worker closure below needs it again, at a finer
        // grain, to decide whether a `PinProtectMaintenance::Ran` write
        // failure is a real error (`Supported`) or expected background noise
        // worth a warning instead (`Unverified` — the only other value
        // reachable here, since `Unsupported` already means
        // `maintain_pin_unlock` is false).
        let pin_unlock_gate = {
            use keyroost_piv::compat::PivExtension;
            let (piv_fp, piv_ver, piv_fw_ver) = self.piv.status.as_ref().map_or(
                (
                    keyroost_piv::fingerprint::AppletFingerprint::Generic,
                    None,
                    None,
                ),
                |s| {
                    (
                        s.applet_fingerprint,
                        s.version.as_deref(),
                        s.version_firmware.as_deref(),
                    )
                },
            );
            self.piv_gate(PivExtension::PinManagementAuth, piv_fp, piv_ver, piv_fw_ver)
        };
        let maintain_pin_unlock = !matches!(
            pin_unlock_gate,
            keyroost_piv::compat::FeatureGate::Unsupported
        );
        let allow_pin_unlock = self.piv.new_mgmt_allow_pin_unlock;
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        self.spawn_piv_job("Changing management key\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    piv_authenticate(s, &old)?;
                    // A HID Crescendo unit whose management key isn't a real
                    // PIV object runs its own self-contained unlock right
                    // before PUT XAUTH KEY (see `set_management_key`'s doc)
                    // rather than relying on the `piv_authenticate` call
                    // above still being in force — `current` carries the
                    // same credential again for that path; every other
                    // device ignores it.
                    let current = match &old {
                        PivMgmtAuth::Key(key) => keyroost_transport::CurrentMgmtAuth::Key(key),
                        PivMgmtAuth::Pin(pin) => {
                            keyroost_transport::CurrentMgmtAuth::Pin(pin.as_bytes())
                        }
                    };
                    let mut pin_unlock_warning = None;
                    match &new {
                        Some((new_alg, new_key)) if maintain_pin_unlock => {
                            match s.set_management_key_pin_protected(
                                current,
                                *new_alg,
                                new_key,
                                false,
                                allow_pin_unlock,
                            )? {
                                keyroost_transport::PinProtectMaintenance::NotApplicable
                                | keyroost_transport::PinProtectMaintenance::Ran {
                                    printed_data: Ok(()),
                                } => {}
                                keyroost_transport::PinProtectMaintenance::Ran {
                                    printed_data: Err(e),
                                } => {
                                    // `Supported` is a confirmed device — a
                                    // failure there is real and still fails
                                    // the whole job, same as before this
                                    // outcome existed. Anything less certain
                                    // (only `Unverified` reaches here, per
                                    // `maintain_pin_unlock`'s own doc above)
                                    // was never confirmed to support this
                                    // write at all, so it's downgraded to a
                                    // warning the apply closure logs instead.
                                    if pin_unlock_gate == keyroost_piv::compat::FeatureGate::Supported {
                                        return Err(e);
                                    }
                                    let action = if allow_pin_unlock { "enable" } else { "disable" };
                                    pin_unlock_warning = Some(format!(
                                        "Could not {action} PIN-protected management-key \
                                         storage ({e}). keyroost's list has no entry for \
                                         this on this key."
                                    ));
                                }
                            }
                        }
                        Some((new_alg, new_key)) => {
                            s.set_management_key(current, *new_alg, new_key, false)?;
                        }
                        None => s.delete_management_key_hid_crescendo(current)?,
                    }
                    let status = s.status()?;
                    Ok((status, s.state(), pin_unlock_warning))
                });
            Box::new(move |app: &mut App| {
                wipe(&mut app.piv.mgmt_key_input);
                wipe(&mut app.piv.new_mgmt_key_input);
                let (result, pin_unlock_warning) = match result {
                    Ok((status, state, warning)) => (Ok((status, state)), warning),
                    Err(e) => (Err(e), None),
                };
                // Reflects what actually happened, not just what was asked
                // for: a `pin_unlock_warning` means the PIN-protected-storage
                // write itself failed (downgraded to a warning, logged
                // separately below) even though the management key change
                // succeeded — the status line must not then go on to claim
                // that write also succeeded.
                let notice = match &new {
                    Some((new_alg, _)) => {
                        let base = format!("Management key changed to {}.", new_alg.label());
                        if !maintain_pin_unlock || pin_unlock_warning.is_some() {
                            base
                        } else if allow_pin_unlock {
                            format!("{base} PIN-protected management-key storage enabled.")
                        } else {
                            format!("{base} PIN-protected management-key storage disabled (if it was set).")
                        }
                    }
                    None => "Management key deleted.".to_string(),
                };
                let result = app.store_and_unwrap_piv_write(for_device, result);
                let succeeded = result.is_ok();
                Self::apply_piv_write(app, result, notice);
                if succeeded {
                    if let Some(w) = pin_unlock_warning {
                        app.log(Severity::Warn, w);
                    }
                }
                Self::apply_piv_cred_result(app);
            })
        });
    }

    /// Returns `false` when the job couldn't be queued (worker busy) — the
    /// caller's confirm modal stays open so the confirmed click isn't lost.
    fn piv_reset(&mut self) -> bool {
        let Some(name) = self.selected_oath_reader() else {
            return true; // nothing to do; let the modal close
        };
        self.piv.notice = None;
        let for_device = self.selected_device.clone();
        let cached_state = self.piv_cached_piv_session_state();
        let queued = self.spawn_piv_job("Resetting PIV applet\u{2026}", move || {
            let result =
                keyroost_transport::PivSession::with_cached_transaction(&name, cached_state, |s| {
                    // The PIV pane's "Reset applet" card collects no
                    // management-key/PIN credential of its own (unlike the
                    // Overview tab's whole-device factory reset) — nothing to
                    // pass here today; see `force_reset_if_known_supported`'s
                    // doc for why the parameter exists regardless.
                    //
                    // `force_reset_if_known_supported`/`reset` already
                    // rebuild this session's state from nothing internally
                    // (see `PivSession::refresh`'s doc) — wipes every slot,
                    // nothing cached survives it — so `s.state()` below is
                    // already the post-reset state; there's nothing left to
                    // clear by hand.
                    s.force_reset_if_known_supported(None, false)?;
                    let status = s.status()?;
                    Ok((status, s.state()))
                });
            Box::new(move |app: &mut App| {
                let result = app.store_and_unwrap_piv_write(for_device, result);
                Self::apply_piv_write(
                    app,
                    result,
                    "PIV application reset to factory defaults.".into(),
                );
            })
        });
        // `queued` still matters here beyond `spawn_piv_job`'s own bookkeeping:
        // a worker already busy means the confirm modal should stay open for
        // the caller to retry, rather than closing on a click that did nothing.
        queued
    }

    /// Apply the three rename-dialog actions shared by the security-key hero and
    /// the Molto2 hero: open the inline field, cancel it, or commit the name.
    /// The flags are collected during the `ui` closures (where `self` is already
    /// borrowed) and applied here afterwards.
    fn apply_rename_actions(&mut self, dev: &Device, open: bool, cancel: bool, save: bool) {
        if open {
            if dev.serial.is_empty() {
                self.log(
                    Severity::Warn,
                    "this device exposes no serial, so it can't be named yet",
                );
            } else {
                self.rename_input = dev.name.clone().unwrap_or_default();
                // Pin the target now, so the eventual save writes against this
                // device even if a background rescan moves the selection first.
                self.rename_target = Some(RenameTarget {
                    serial: dev.serial.clone(),
                    name_at_open: dev.name.clone(),
                });
            }
        }
        if cancel {
            self.close_rename();
        }
        if save {
            self.save_device_name();
        }
    }

    /// Reset the inline-rename state (field closed, draft and pin cleared).
    fn close_rename(&mut self) {
        self.rename_input.clear();
        self.rename_target = None;
        // The scan-burst loop stops scheduling repaints while a rename field
        // is open (see `update`); wake the loop once so a paused burst
        // resumes now instead of waiting for the next input event.
        if let Some(ctx) = &self.egui_ctx {
            ctx.request_repaint();
        }
    }

    /// Persist (or clear) the friendly name for the device the rename field was
    /// opened against, keyed by the serial pinned at open time. Empty input
    /// removes the existing name. Writing against the *pinned* serial (not the
    /// live selection) is what keeps a mid-edit rescan from landing the name on
    /// the wrong key. The vendor is looked up from the live device list if that
    /// device is still present, else omitted — it's a display hint only.
    fn save_device_name(&mut self) {
        let Some(target) = self.rename_target.clone() else {
            // No pinned target (e.g. the device had no serial at open); nothing
            // to write.
            self.close_rename();
            return;
        };
        let name = self.rename_input.trim().to_owned();
        if !name.is_empty() {
            if let Err(e) = keyroost_keyring::validate_name(&name) {
                self.log(Severity::Err, format!("invalid name: {e}"));
                return; // keep the field open so the user can correct it
            }
        }
        let live = self.devices.iter().find(|d| d.serial == target.serial);
        let vendor = live.map(|d| d.vendor.to_ascii_lowercase());
        // A key without an explicit friendly name still shows one — its model
        // (see `DeviceView::title`). Resolving both sides of the change to a
        // concrete display name means one message covers rename, first naming
        // and clearing alike, with no special cases.
        let implicit = live
            .map(|d| d.model.clone())
            .unwrap_or_else(|| "this key".to_string());
        let old_display = target
            .name_at_open
            .clone()
            .unwrap_or_else(|| implicit.clone());
        let cleared = name.is_empty();
        let new_display = if cleared { implicit } else { name.clone() };
        let mut keyring = keyroost_keyring::Keyring::load_default().unwrap_or_default();
        // Drop the target's prior name — by the name pinned at open, then by
        // serial as a belt-and-braces (covers a name changed under us). This
        // covers both rename and clear.
        if let Some(current) = target.name_at_open.clone() {
            keyring.remove(&current);
        }
        if let Some(existing) = keyring.name_for(Some(&target.serial)) {
            let existing = existing.to_owned();
            keyring.remove(&existing);
        }
        if !name.is_empty() {
            let entry = keyroost_keyring::KeyEntry {
                name,
                serial: target.serial.clone(),
                source: keyroost_keyring::IdSource::default(),
                vendor,
                aaguid: None,
                note: None,
            };
            if let Err(e) = keyring.add(entry) {
                self.log(Severity::Err, format!("name: {e}"));
                return; // keep the field open; nothing was saved
            }
        }
        match keyring.save_default() {
            // Name the before and after explicitly rather than leaning on the
            // usual selected-token prefix: the device list still holds the old
            // name here (the refresh below is what picks up the change), so the
            // auto-prefix would show the pre-rename name.
            Ok(_) => self.log_global(
                Severity::Ok,
                LogKind::User,
                format!(
                    "{new_display}: name {}, was {old_display}",
                    if cleared { "cleared" } else { "saved" }
                ),
            ),
            Err(e) => self.log(Severity::Err, format!("save names: {e}")),
        }
        self.close_rename();
        self.refresh_devices();
    }

    /// Toggle the help popover for `topic`, anchored under the clicked "?".
    fn toggle_help(&mut self, topic: &'static str, anchor: egui::Pos2) {
        self.help_anchor = anchor;
        self.help_open = if self.help_open == Some(topic) {
            None
        } else {
            Some(topic)
        };
    }
}

/// `ViewportId` of the popped-out activity-log window — shared by the code that
/// spawns it (`App::activity_log_window`) and the code that brings it to the
/// front (the top bar's "Activity log" link while detached).
fn activity_log_viewport_id() -> egui::ViewportId {
    egui::ViewportId::from_hash_of("activity-log")
}

/// Current unix time as a float (for the OATH "copied" flash window).
fn now_secs_f64() -> f64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|d| d.as_secs_f64())
        .unwrap_or(0.0)
}

/// A flat panel frame with a fill and symmetric inner padding.
fn panel_frame(fill: egui::Color32, mx: f32, my: f32) -> egui::Frame {
    egui::Frame::NONE
        .fill(fill)
        .inner_margin(egui::Margin::symmetric(mx as i8, my as i8))
}

/// A rounded square "glyph tile". `ch = Some(c)` paints a letter; `None` paints a
/// small clock (the Molto2 token mark).
fn glyph_tile(
    ui: &mut egui::Ui,
    size: f32,
    fill: egui::Color32,
    fg: egui::Color32,
    ch: Option<char>,
) {
    let (rect, _) = ui.allocate_exact_size(egui::vec2(size, size), egui::Sense::hover());
    ui.painter()
        .rect_filled(rect, egui::CornerRadius::same((size * 0.28) as u8), fill);
    match ch {
        Some(c) => {
            ui.painter().text(
                rect.center(),
                egui::Align2::CENTER_CENTER,
                c,
                theme::f_bold(size * 0.5),
                fg,
            );
        }
        None => {
            let c = rect.center();
            let r = size * 0.26;
            ui.painter().circle_stroke(c, r, egui::Stroke::new(1.6, fg));
            ui.painter().line_segment(
                [c, c + egui::vec2(0.0, -r * 0.72)],
                egui::Stroke::new(1.6, fg),
            );
            ui.painter().line_segment(
                [c, c + egui::vec2(r * 0.55, 0.0)],
                egui::Stroke::new(1.6, fg),
            );
        }
    }
}

/// Does the device match the sidebar filter text?
fn matches_filter(d: &Device, q: &str) -> bool {
    let q = q.trim().to_ascii_lowercase();
    if q.is_empty() {
        return true;
    }
    d.vendor.to_ascii_lowercase().contains(&q)
        || d.model.to_ascii_lowercase().contains(&q)
        || d.title().to_ascii_lowercase().contains(&q)
}

/// Advisory shown when two or more connected keys report the same serial.
/// Friendly names are keyed by serial, so same-serial keys can't be told apart
/// by name — surface that rather than letting the user assume a name is unique.
/// Returns the first duplicated serial (deterministic order) or `None` when
/// every serial is distinct.
fn duplicate_serial_note<'a>(serials: impl Iterator<Item = &'a str>) -> Option<String> {
    use std::collections::BTreeMap;
    let mut counts: BTreeMap<&str, usize> = BTreeMap::new();
    for s in serials {
        *counts.entry(s).or_insert(0) += 1;
    }
    counts.into_iter().find(|&(_, n)| n > 1).map(|(serial, n)| {
        format!(
            "{n} connected keys report the same serial ({serial}); friendly names can't tell \
             them apart — pick each by its row in the list."
        )
    })
}

/// Short label for a capability tab.
fn cap_tab_label(t: CapTab) -> &'static str {
    match t {
        CapTab::Overview => "Overview",
        CapTab::Fido2 => "FIDO2",
        CapTab::Oath => "Authenticator",
        CapTab::Pgp => "OpenPGP",
        CapTab::Piv => "PIV",
        CapTab::Otp => "On-device OTP",
    }
}

/// A labelled password field row for the inline PIN form.
/// New==confirm guard for the PIV credential modal. Returns the inline error
/// message when the new secret and its confirmation differ, or `None` when they
/// match (or the flow has no confirm field, i.e. `UnblockPin`). Empty fields are
/// treated as "not yet a mismatch" so the error doesn't flash before the user
/// finishes typing.
fn piv_cred_mismatch(piv: &PivState, kind: PivCredKind) -> Option<&'static str> {
    let (new, confirm, msg) = match kind {
        PivCredKind::ChangePin => (
            &piv.pin_new,
            &piv.pin_confirm,
            "the two new PINs don't match",
        ),
        PivCredKind::ChangePuk => (
            &piv.puk_new,
            &piv.puk_confirm,
            "the two new PUKs don't match",
        ),
        // Unblock and the management-key-gated flows have no new==confirm pair;
        // their inputs are validated by the op's own client-side guards.
        PivCredKind::UnblockPin
        | PivCredKind::GenerateKey
        | PivCredKind::ImportCert
        | PivCredKind::SelfSign
        | PivCredKind::RequestCsr
        | PivCredKind::SetRetries
        | PivCredKind::ChangeMgmtKey
        | PivCredKind::DeleteCert
        | PivCredKind::DeleteKey
        | PivCredKind::MoveKey
        | PivCredKind::NewChuid
        | PivCredKind::SelfTest => return None,
    };
    if confirm.is_empty() || new == confirm {
        None
    } else {
        Some(msg)
    }
}

/// In-modal success confirmation text for each PIV credential flow. The
/// management-key-gated flows whose *detailed* result (e.g. the generated
/// public-key PEM) still surfaces in the pane only need a generic confirmation
/// here — the pane keeps showing the rich outcome.
fn piv_cred_success(kind: PivCredKind) -> &'static str {
    match kind {
        PivCredKind::ChangePin => "PIN changed",
        PivCredKind::ChangePuk => "PUK changed",
        PivCredKind::UnblockPin => "PIN unblocked and reset",
        PivCredKind::GenerateKey => "Key generated",
        PivCredKind::ImportCert => "Certificate imported",
        PivCredKind::SelfSign => "Certificate created",
        PivCredKind::RequestCsr => "Request signed and saved",
        PivCredKind::SetRetries => "Retry counts set",
        PivCredKind::ChangeMgmtKey => "Management key changed",
        PivCredKind::DeleteCert => "Certificate deleted",
        PivCredKind::DeleteKey => "Key deleted",
        PivCredKind::MoveKey => "Key moved",
        PivCredKind::NewChuid => "New CHUID written",
        PivCredKind::SelfTest => "Self-test complete",
    }
}

/// Run every [`keyroost_pivtest::SelfTest`] against the card on `reader`
/// (delegating the orchestration to [`keyroost_pivtest::run`]). Operations the
/// slot's key algorithm doesn't do come back `keyroost_pivtest::Outcome::Skipped`
/// (which carries the algorithm, so [`keyroost_pivtest::format_report`] can name
/// it) and are shown in the dialog like the others.
///
/// `Err` is a *setup* failure (couldn't open the card, no certificate in the
/// slot, unreadable key, PIN rejected) — nothing was tested.
///
/// The PIN is used only when `pin` is non-empty — never inferred from the
/// slot's PIN policy. That policy is left entirely to the caller to decide
/// whether to supply a PIN, so a test can deliberately be run without one to
/// see whether the card enforces its policy.
fn run_piv_self_test(
    reader: &str,
    slot: keyroost_piv::Slot,
    pin: &[u8],
    cached: keyroost_transport::PivSessionState,
) -> Result<
    (
        Vec<(keyroost_pivtest::SelfTest, keyroost_pivtest::Outcome)>,
        keyroost_transport::PivSessionState,
    ),
    String,
> {
    // The session itself can only report `TransportError` (from
    // `with_cached_transaction`'s own connect/SELECT machinery) — flattened
    // to `String` right at the end, via the outer `map_err`/`and_then`
    // below. Everything this closure does on its own (no certificate, an
    // unusable algorithm, a rejected PIN) keeps building its `String`
    // exactly as before, one level in, via `inner`.
    keyroost_transport::PivSession::with_cached_transaction(reader, cached, |s| {
        let inner = (|| -> Result<_, String> {
            // Verify against the slot CERTIFICATE's public key on purpose: the
            // cert is what other PIV software consumes, so a pass proves the
            // cert matches the slot's key material. A compressed cert is
            // inflated on read (#147/#148).
            let cert = s
                .read_certificate(slot)
                .map_err(|e| e.to_string())?
                .ok_or_else(|| format!("{} has no certificate to test against", slot.label()))?;
            let (alg, pubkey) = keyroost_piv::x509_parse::parse_certificate_public_key(&cert)
                .map_err(|e| format!("could not read the slot certificate's key: {e}"))?;

            if !keyroost_pivtest::SelfTest::all()
                .into_iter()
                .any(|op| keyroost_pivtest::supports(op, alg))
            {
                return Err(format!("no self-test applies to a {} key", alg.label()));
            }

            // Verify once up front so a wrong PIN fails the whole run (one
            // retry, not one per op). PIN-per-use slots (9C) drop the
            // verified state after each GENERAL AUTHENTICATE, so the per-op
            // closure re-verifies before every op after the first that
            // actually runs.
            let has_pin = !pin.is_empty();
            if has_pin {
                s.verify_pin(pin).map_err(|e| e.to_string())?;
            }
            let mut ran = 0usize;
            let results =
                keyroost_pivtest::run(alg, &pubkey, |op, input| -> Result<Vec<u8>, String> {
                    if has_pin && ran > 0 {
                        s.verify_pin(pin).map_err(|e| e.to_string())?;
                    }
                    ran += 1;
                    if op.is_key_agreement() {
                        s.key_agree(slot, alg, input)
                    } else if op == keyroost_pivtest::SelfTest::Decrypt {
                        s.decrypt(slot, alg, input)
                    } else {
                        s.sign(slot, alg, input)
                    }
                    .map_err(|e| e.to_string())
                });
            Ok((results, s.state()))
        })();
        Ok::<_, TransportError>(inner)
    })
    .map_err(|e| e.to_string())
    .and_then(|inner| inner)
}

/// Slots a key may be moved to: every standard + retired slot that is empty
/// and is not the source. `occupied(slot)` reports current key presence.
/// Whether `sel` currently holds a private key, read from the loaded occupancy
/// caches. Standard slots read `slot_keys` (a carried algorithm means a key is
/// present); a retired slot reads the lazily-populated `retired_occupancy`
/// cache (`None` cache, or a slot the cache doesn't list, is treated as empty).
/// Pure so the overwrite guard can be unit-tested without hardware or `self`.
fn piv_slot_occupied(
    sel: PivSlotSel,
    slot_keys: &[(
        keyroost_piv::Slot,
        Option<keyroost_piv::KeyAlg>,
        Option<String>,
    )],
    retired_occupancy: Option<&[(keyroost_piv::Slot, bool)]>,
) -> bool {
    match sel {
        PivSlotSel::Retired(n) => retired_occupancy
            .and_then(|v| v.iter().find(|(s, _)| *s == keyroost_piv::Slot::Retired(n)))
            .map(|(_, has)| *has)
            .unwrap_or(false),
        _ => {
            let sel_slot = sel.to_slot();
            slot_keys
                .iter()
                .find(|(s, _, _)| *s == sel_slot)
                .map(|(_, a, _)| a.is_some())
                .unwrap_or(false)
        }
    }
}

/// Whether a slot-emptiness-sensitive button should dim specifically because
/// the active slot is confirmed empty — the narrower criterion
/// `keyroost_piv::compat::PivExtension::GetSlotKeyStatus` unlocks. Shared by
/// "Delete key" (distinct from "Delete certificate"'s `selected_has_cert`
/// check — a different object, gated by a different extension) and "Import
/// certificate" (which has no separate firmware gate of its own to check
/// first, unlike "Delete key" — see that button's call site for why this is
/// only meaningful there once `delete_key_gate` itself isn't
/// `FeatureGate::Unsupported`).
///
/// `true` only when `get_slot_key_status_gate` resolves
/// [`FeatureGate::Supported`](keyroost_piv::compat::FeatureGate::Supported)
/// *and* `selected_has_key` is `false` — this device has a confirmed,
/// device-reported way to know slot occupancy (GET METADATA, or HID
/// Crescendo's own GET PIV PROPERTIES), and it says this slot has no key.
/// Every other combination — the gate isn't `Supported`, or it is and the
/// slot does hold a key — leaves the button enabled: without a reliable
/// device signal, a `None` algorithm reading could just as easily mean
/// "this device can't tell us" as "genuinely empty" (see
/// [`keyroost_piv::compat::PivExtension::GetSlotKeyStatus`]'s doc), and
/// hiding a real capability on a guess is worse than occasionally offering a
/// delete that fails deep with "slot has no key", or an import that a
/// key loaded out-of-band this session can't see would in fact have matched.
#[must_use]
fn slot_confirmed_empty(
    get_slot_key_status_gate: keyroost_piv::compat::FeatureGate,
    selected_has_key: bool,
) -> bool {
    use keyroost_piv::compat::FeatureGate;
    get_slot_key_status_gate == FeatureGate::Supported && !selected_has_key
}

fn move_key_eligible_destinations(
    src: keyroost_piv::Slot,
    occupied: &dyn Fn(keyroost_piv::Slot) -> bool,
) -> Vec<keyroost_piv::Slot> {
    keyroost_piv::Slot::all()
        .into_iter()
        .chain(keyroost_piv::Slot::retired_all())
        .filter(|&s| s != src && !occupied(s))
        .collect()
}

fn pin_field(ui: &mut egui::Ui, p: &Palette, label: &str, buf: &mut String) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [96.0, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        let resp = ui.add(
            egui::TextEdit::singleline(buf)
                .password(true)
                .desired_width(200.0),
        );
        guard_secret_field(ui.ctx(), &resp);
    });
    ui.add_space(4.0);
}

/// Like [`pin_field`] but with a hint and custom width — for secrets that are
/// longer than a PIN (the PIV management key). Masked: a management key is a
/// card-write credential and shouldn't sit readable on screen.
fn secret_field(
    ui: &mut egui::Ui,
    p: &Palette,
    label: &str,
    buf: &mut String,
    hint: &str,
    label_w: f32,
    w: f32,
) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [label_w, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        let resp = ui.add(
            egui::TextEdit::singleline(buf)
                .password(true)
                .hint_text(hint)
                .desired_width(w),
        );
        guard_secret_field(ui.ctx(), &resp);
    });
    ui.add_space(4.0);
}

/// Masked secret input with a reveal ("eye") toggle painted *inside* the
/// field itself, at its right edge, instead of beside it. A widened right
/// text margin keeps typed characters clear of the icon; the widget's outer
/// `desired_width` is untouched, so this drops into a spot already sized for
/// a plain masked `TextEdit` without changing that size — unlike
/// [`secret_edit`], which adds a separate icon column next to the field.
/// `revealed` is read for the initial mask state and flipped in place when
/// the eye is clicked. Used only by the PIV pane and the factory-reset
/// dialog (see [`piv_pin_field`]/[`piv_secret_field`]); every other secret
/// field in the app still uses [`secret_edit`] or a plain mask.
fn inline_secret_edit(
    ui: &mut egui::Ui,
    p: &Palette,
    buf: &mut String,
    revealed: &mut bool,
    hint: &str,
    width: f32,
) -> egui::Response {
    let mut edit = egui::TextEdit::singleline(buf)
        .desired_width(width)
        .margin(egui::Margin {
            left: 4,
            right: 30,
            top: 2,
            bottom: 2,
        });
    if !*revealed {
        edit = edit.password(true);
    }
    if !hint.is_empty() {
        edit = edit.hint_text(hint);
    }
    let resp = ui.add(edit);
    // Eye toggle painted over the field's own right edge. This claims no
    // extra layout space of its own — it only paints/interacts within the
    // rect the TextEdit above already occupies.
    let center = egui::pos2(resp.rect.right() - 13.0, resp.rect.center().y);
    let icon_rect = egui::Rect::from_center_size(center, egui::vec2(20.0, resp.rect.height()));
    let ir = ui.interact(icon_rect, resp.id.with("reveal"), egui::Sense::click());
    let col = if ir.hovered() { p.txt } else { p.txt2 };
    paint_eye_icon(ui, center, col);
    if !*revealed {
        // Slash across the eye to signal the hidden state.
        ui.painter().line_segment(
            [
                egui::pos2(center.x - 6.0, center.y + 4.0),
                egui::pos2(center.x + 6.0, center.y - 4.0),
            ],
            egui::Stroke::new(1.1, col),
        );
    }
    if ir.hovered() {
        ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
    }
    if ir.clicked() {
        *revealed = !*revealed;
    }
    let _ = ir.on_hover_text(if *revealed { "Hide" } else { "Show" });
    guard_secret_field(ui.ctx(), &resp);
    resp
}

/// Like [`pin_field`], but the value can be revealed via [`inline_secret_edit`]'s
/// in-field eye toggle, and the label column width is a caller-supplied
/// `label_w` rather than a hardcoded 96px — needed for the rows (`SelfSign`,
/// `SetRetries`) that share a column with a "Management key" row (see
/// [`label_text_width`]). PIV-pane/factory-reset-dialog only — see that
/// function's doc for why this isn't just a flag on `pin_field`.
fn piv_pin_field(
    ui: &mut egui::Ui,
    p: &Palette,
    label: &str,
    buf: &mut String,
    revealed: &mut bool,
    label_w: f32,
) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [label_w, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        inline_secret_edit(ui, p, buf, revealed, "", 200.0);
    });
    ui.add_space(4.0);
}

/// Like [`secret_field`], but with [`piv_pin_field`]'s inline reveal toggle.
/// Same scope note: PIV pane and factory-reset dialog only.
#[allow(clippy::too_many_arguments)]
fn piv_secret_field(
    ui: &mut egui::Ui,
    p: &Palette,
    label: &str,
    buf: &mut String,
    revealed: &mut bool,
    hint: &str,
    label_w: f32,
    w: f32,
) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [label_w, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        inline_secret_edit(ui, p, buf, revealed, hint, w);
    });
    ui.add_space(4.0);
}

/// Fine-print note inside a management card.
fn card_note(ui: &mut egui::Ui, p: &Palette, t: &str) {
    ui.label(
        egui::RichText::new(t)
            .font(theme::f_reg(12.0))
            .color(p.txt3),
    );
}

/// The "Valid for" fields shared by the certificate and CHUID cards: three
/// `DragValue`s — years, months, days, in that order — that sum, mirroring
/// `keyroostctl piv self-sign`/`new-chuid`'s combinable `--years`/`--months`/
/// `--days` exactly (see [`keyroost_piv::add_calendar_period`]). Renders
/// only the three fields, not the "Valid for" label itself — the two call
/// sites lay that out differently (a plain label vs. one column-aligned with
/// the field above it), so each renders its own. Each field's own range
/// tops out at what that unit alone could still represent from `now` —
/// generous rather than exact once more than one field is nonzero, since the
/// actual encoder clamps the summed result regardless.
fn piv_valid_for_fields(
    ui: &mut egui::Ui,
    now: u32,
    years: &mut u32,
    months: &mut u32,
    days: &mut u32,
) {
    ui.add(
        egui::DragValue::new(years)
            .range(0..=keyroost_piv::max_valid_years(u64::from(now)))
            .suffix(" y"),
    );
    ui.add(
        egui::DragValue::new(months)
            .range(0..=keyroost_piv::max_valid_months(u64::from(now)))
            .suffix(" mo"),
    );
    ui.add(
        egui::DragValue::new(days)
            .range(0..=keyroost_piv::max_valid_days(u64::from(now)))
            .suffix(" d"),
    );
}

/// A key/value detail row for the device-metadata card: a muted fixed-width
/// label on the left, the value on the right. Wraps long values.
fn mds_kv(ui: &mut egui::Ui, p: &Palette, key: &str, value: &str) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [150.0, 16.0],
            egui::Label::new(
                egui::RichText::new(key)
                    .font(theme::f_reg(12.0))
                    .color(p.txt3),
            )
            .wrap_mode(egui::TextWrapMode::Extend),
        );
        ui.label(
            egui::RichText::new(value)
                .font(theme::f_reg(12.5))
                .color(p.txt2),
        );
    });
    ui.add_space(3.0);
}

/// One "label  value" cell in the metadata grid, occupying width `w`. The label
/// is muted and fixed-width; the value sits immediately to its right so the pair
/// reads as a unit rather than drifting apart.
fn mds_cell(ui: &mut egui::Ui, p: &Palette, key: &str, value: &str, w: f32) {
    let label_w = 138.0_f32.min(w * 0.5);
    ui.allocate_ui(egui::vec2(w, 18.0), |ui| {
        ui.horizontal(|ui| {
            ui.spacing_mut().item_spacing.x = 10.0;
            ui.add_sized(
                [label_w, 16.0],
                egui::Label::new(
                    egui::RichText::new(key)
                        .font(theme::f_reg(12.0))
                        .color(p.txt3),
                )
                .wrap_mode(egui::TextWrapMode::Extend)
                .halign(egui::Align::LEFT),
            );
            ui.add(
                egui::Label::new(
                    egui::RichText::new(value)
                        .font(theme::f_reg(12.5))
                        .color(p.txt2),
                )
                .wrap_mode(egui::TextWrapMode::Truncate),
            );
        });
    });
}

/// A themed single-line text input with a fixed-width label — the non-password
/// sibling of [`pin_field`], for cardholder name / URL / file path.
fn text_field(ui: &mut egui::Ui, p: &Palette, label: &str, buf: &mut String, hint: &str, w: f32) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [96.0, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        ui.add(
            egui::TextEdit::singleline(buf)
                .hint_text(hint)
                .desired_width(w),
        );
    });
    ui.add_space(4.0);
}

/// Width for the New CHUID dialog's GUID input (and, to keep the two fields
/// visually aligned, its management-key input): the actually-rendered width
/// of a representative 36-character canonical GUID in the dialog's body
/// font, plus a little slack for the text edit's own internal padding and
/// for whatever font it ends up drawing with. Measured instead of a fixed
/// guess so the field tracks real font metrics rather than drifting from
/// them (and the dialog stops reserving space nothing actually needs).
fn chuid_guid_field_width(ctx: &egui::Context) -> f32 {
    // All-zero digits and dashes: close to the widest a canonical GUID gets
    // in most fonts, without needing per-character metrics.
    let sample = "00000000-0000-0000-0000-000000000000";
    let w = ctx
        .fonts_mut(|f| {
            f.layout_no_wrap(sample.to_owned(), theme::f_reg(13.0), egui::Color32::WHITE)
        })
        .size()
        .x;
    w + 24.0
}

/// Font-measured width (+ padding) of a label text — the general form behind
/// [`chuid_label_width`]. A fixed-guess label column (the app's usual 96px)
/// is only ever wide enough for the labels someone happened to test with;
/// when a dialog shows two rows sharing a label column and one label is
/// longer than the guess, that row's label overflows into the field next to
/// it, which then starts at a different x than the other row's field.
/// Measuring the actual longest label at the current font/zoom — the same
/// reason [`chuid_guid_field_width`] measures rather than guesses — avoids
/// that regardless of font metrics.
fn label_text_width(ctx: &egui::Context, text: &str) -> f32 {
    let w = ctx
        .fonts_mut(|f| f.layout_no_wrap(text.to_owned(), theme::f_reg(13.0), egui::Color32::WHITE))
        .size()
        .x;
    w + 8.0
}

/// Label-column width for the New CHUID dialog's rows, and for any other
/// dialog with a row sharing a column with a "Management key"/PIN row (see
/// `App::piv_modal_mgmt_field`'s label_w for callers): the rendered width of
/// "Management key" (the longest of the New CHUID dialog's three row labels
/// there — "GUID" and "Valid for" both fit inside it) plus a little padding.
fn chuid_label_width(ctx: &egui::Context) -> f32 {
    label_text_width(ctx, "Management key")
}

/// `ui.selectable_value`'s own row, but sized the same whether or not the
/// pointer is hovering it. Plain `ui.selectable_value` builds on
/// `Button::selectable`, which only forces `frame_when_inactive(true)` for
/// the *currently selected* row; every other row paints no stroke at rest
/// and reserves no space for one either. This app's theme (`Palette::apply`)
/// gives the `inactive` widget state a real 1px stroke width too — for text
/// fields' own visible boundary — where egui's own default is 0, so an
/// *unselected* row ends up measurably shorter at rest than hovered: 1px is
/// exactly what egui's frame math sets aside for the stroke it isn't
/// painting. In a combo popup with a small, fixed option list sitting close
/// to the popup's height cap, that per-row wobble was enough to tip the
/// whole list into needing a scrollbar the instant the pointer landed on a
/// row — every PIV dropdown built from a `for` loop over a fixed option set
/// (algorithm, management-key algorithm, PIN/touch policy, move destination)
/// hits this the same way. Forcing the frame on unconditionally makes the
/// reserved space — and so the row's height — independent of hover.
fn stable_selectable_value<'a, T: PartialEq>(
    ui: &mut egui::Ui,
    current: &mut T,
    value: T,
    text: impl egui::IntoAtoms<'a>,
) -> egui::Response {
    let selected = *current == value;
    let resp = ui.add(egui::Button::selectable(selected, text).frame_when_inactive(true));
    if resp.clicked() && *current != value {
        *current = value;
    }
    resp
}

/// Opacity for a gated (disabled) row in the PIV algorithm/policy combos —
/// [`piv_keyalg_combo`] and [`piv_mgmtalg_combo`] gate entries today;
/// `piv_policy_combo` sets it too even though every `PivPolicyOption` quirk
/// currently filters `options` instead of disabling a value in place (see
/// its `show_ui` closure) — so this is ready the day one does. The
/// move-destination combo is the one PIV dropdown left out: it only ever
/// offers an already-filtered, all-enabled slot list. egui's own default
/// (`Visuals::disabled_alpha`, 0.5) reads as barely-lighter-than-enabled at
/// this popup's font size, so a gated row and a pickable one are too close
/// in weight to tell apart at a glance; this app sets it lower, scoped to
/// just these popups' own `Ui` (see each `show_ui` closure), so it doesn't
/// touch other disabled widgets in the app.
const PIV_COMBO_DISABLED_ALPHA: f32 = 0.32;

/// A PIV key-algorithm picker combo, listing every `keyroost_piv::KeyAlg`
/// variant. `gate_of` resolves each candidate's
/// `keyroost_piv::compat::PivExtension::SlotKeyAlgorithm` gate on the live
/// device: an entry gating `Unsupported` renders disabled (dimmed, not
/// removed — the combo's shape stays the same as gates change) the same way
/// the Move/Delete-key rows dim on this device; `Unverified` entries stay
/// enabled and are instead called out together in a note below the combo
/// (see `cap_piv`), since a per-row marker doesn't fit a closed dropdown the
/// way it does an always-visible row.
fn piv_keyalg_combo(
    ui: &mut egui::Ui,
    id: &str,
    sel: &mut keyroost_piv::KeyAlg,
    gate_of: impl Fn(keyroost_piv::KeyAlg) -> keyroost_piv::compat::FeatureGate,
) {
    egui::ComboBox::from_id_salt(id)
        .selected_text(sel.label())
        .show_ui(ui, |ui| {
            // `disabled_alpha`'s egui default (0.5) leaves a gated row only
            // faintly lighter than an enabled one at this popup's font size —
            // see PIV_COMBO_DISABLED_ALPHA. Set on this popup's own `Ui`
            // (built fresh from the ambient style per `Palette::apply`'s
            // `ScrollStyle` comment above), so it reaches every row below
            // without touching disabled widgets elsewhere in the app.
            ui.style_mut().visuals.disabled_alpha = PIV_COMBO_DISABLED_ALPHA;
            for opt in keyroost_piv::KeyAlg::ALL {
                let enabled = gate_of(opt) != keyroost_piv::compat::FeatureGate::Unsupported;
                ui.add_enabled_ui(enabled, |ui| {
                    stable_selectable_value(ui, sel, opt, opt.label());
                });
            }
        });
}

/// If `sel` gates `Unsupported` under `gate_of`, snap it to the first
/// candidate in `keyroost_piv::KeyAlg::ALL` that doesn't — the slot
/// key-algorithm counterpart of [`piv_mgmtalg_unsupported_fallback`], same
/// reasoning: `fallback` (the caller's usual "widely-supported default", e.g.
/// `KeyAlg::EccP256`) is itself just one candidate and could be the very
/// entry gating `Unsupported` on some fingerprint, so it isn't returned
/// unconditionally — only once every algorithm in `ALL` gates `Unsupported`
/// and there's nothing better left to pick. Factored out of `cap_piv` so this
/// fallback rule is unit-testable without an egui context.
#[must_use]
fn piv_keyalg_unsupported_fallback(
    sel: keyroost_piv::KeyAlg,
    fallback: keyroost_piv::KeyAlg,
    gate_of: impl Fn(keyroost_piv::KeyAlg) -> keyroost_piv::compat::FeatureGate,
) -> keyroost_piv::KeyAlg {
    if gate_of(sel) != keyroost_piv::compat::FeatureGate::Unsupported {
        return sel;
    }
    keyroost_piv::KeyAlg::ALL
        .into_iter()
        .find(|&alg| gate_of(alg) != keyroost_piv::compat::FeatureGate::Unsupported)
        .unwrap_or(fallback)
}

/// An OpenPGP key-algorithm picker combo, restricted to `choices` (the card's
/// own Algorithm Information menu, or every algorithm that fits the slot).
fn openpgp_keyalg_combo(
    ui: &mut egui::Ui,
    id: &str,
    sel: &mut OpenPgpKeyAlgSel,
    choices: &[OpenPgpKeyAlgSel],
) {
    egui::ComboBox::from_id_salt(id)
        .selected_text(sel.label())
        .show_ui(ui, |ui| {
            for &opt in choices {
                ui.selectable_value(sel, opt, opt.label());
            }
        });
}

/// A PIV PIN/touch policy value selectable in the Generate key modal's combo
/// boxes: its display label and the full set of choices, in menu order.
/// `Default` is always first — it's the initial selection, and the plain PIV
/// APDU every card accepts. Also used for the slot state line's "pin: …,
/// touch: …" display.
trait PivPolicyOption: Copy + PartialEq + 'static {
    const ALL: &'static [Self];
    fn label(self) -> &'static str;
}

impl PivPolicyOption for keyroost_piv::PinPolicy {
    const ALL: &'static [Self] = &[Self::Default, Self::Never, Self::Once, Self::Always];
    fn label(self) -> &'static str {
        match self {
            Self::Never => "never",
            Self::Once => "once",
            Self::Always => "always",
            Self::Default => "default",
        }
    }
}

impl PivPolicyOption for keyroost_piv::TouchPolicy {
    const ALL: &'static [Self] = &[Self::Default, Self::Never, Self::Cached, Self::Always];
    fn label(self) -> &'static str {
        match self {
            Self::Never => "never",
            Self::Cached => "cached",
            Self::Always => "always",
            Self::Default => "default",
        }
    }
}

/// Snap `*sel` to `options[0]` if it isn't already one of `options` — the
/// generic counterpart of [`piv_mgmtalg_clamp`], used when a per-fingerprint
/// [`keyroost_piv::compat::PivQuirk`] (e.g.
/// [`SlotTouchPolicyCachedNotSupported`](keyroost_piv::compat::PivQuirk::SlotTouchPolicyCachedNotSupported))
/// has dropped a value from `options` that was previously selected — e.g. a
/// device switch left `Cached` selected on a fingerprint that doesn't accept
/// it. `T::ALL[0]` is always `Default`, so `options` never actually excludes
/// it (only `Once`/`Cached` are ever quirk-gated) — this only ever snaps back
/// to `Default`, never to some other survivor.
fn piv_policy_clamp<T: PivPolicyOption>(sel: &mut T, options: &[T]) {
    if let Some(&first) = options.first() {
        if !options.contains(sel) {
            *sel = first;
        }
    }
}

/// PIN/Touch Policy picker combo (Generate key modal). Generic over
/// [`PivPolicyOption`] — the type of `sel` alone picks the right label
/// function. `options` is the offered set — [`PivPolicyOption::ALL`] on a
/// device with no relevant quirk, or that list with one value removed (see
/// [`piv_policy_clamp`]) — mirroring [`piv_mgmtalg_combo`]'s own
/// caller-filtered-options shape.
fn piv_policy_combo<T: PivPolicyOption>(ui: &mut egui::Ui, id: &str, sel: &mut T, options: &[T]) {
    piv_policy_clamp(sel, options);
    egui::ComboBox::from_id_salt(id)
        .selected_text(sel.label())
        .show_ui(ui, |ui| {
            // No option is ever gated disabled today — quirk-excluded values
            // are dropped from `options` outright rather than shown dimmed —
            // but set the same dimming as the two combos above in case a
            // future quirk gates a policy value in place instead of
            // filtering it out (see `PIV_COMBO_DISABLED_ALPHA`).
            ui.style_mut().visuals.disabled_alpha = PIV_COMBO_DISABLED_ALPHA;
            for &opt in options {
                stable_selectable_value(ui, sel, opt, opt.label());
            }
        });
}

/// Snap `*sel` to `options[0]` if it isn't already one of `options` — used
/// so [`piv_mgmtalg_combo`] never shows a selection it isn't actually
/// offering (e.g. `*sel` left on an algorithm the previously-selected device
/// offered but this one doesn't). Factored out of that function so the
/// clamp rule is unit-testable without an egui context. No-op on an empty
/// `options` — there's nothing to snap to.
fn piv_mgmtalg_clamp(sel: &mut PivMgmtAlgSel, options: &[PivMgmtAlgSel]) {
    if let Some(&first) = options.first() {
        if !options.contains(sel) {
            *sel = first;
        }
    }
}

/// If `sel` gates `Unsupported` under `gate_of`, snap it to the first offered
/// option that doesn't — used so the management-key algorithm combo never
/// preselects a disabled entry. Deliberately not "snap to `options[0]`"
/// outright, the way [`piv_mgmtalg_clamp`] does for an *unoffered* selection:
/// `options[0]` (`TripleDes` on [`PivMgmtAlgSel::ALL`] today, now that it's
/// alphabetized — this reasoning predates that and originally named `Aes192`,
/// which was both `options[0]` *and* the type's `#[default]` at the time) can
/// itself be the very entry gating `Unsupported` — a HID Crescendo device's
/// XAUTH key never accepts AES-192, for instance — so falling back to it
/// again would leave the combo showing a disabled selection instead of fixing
/// anything. Falls back to `options[0]` only when
/// every offered option gates `Unsupported`, and leaves `sel` alone
/// (including when it isn't `Unsupported` to begin with) if `options` is
/// empty — there's nothing to snap to either way. Factored out of `cap_piv`
/// so this fallback rule is unit-testable without an egui context, the same
/// reason [`piv_mgmtalg_clamp`] is its own function.
#[must_use]
fn piv_mgmtalg_unsupported_fallback(
    sel: PivMgmtAlgSel,
    options: &[PivMgmtAlgSel],
    gate_of: impl Fn(PivMgmtAlgSel) -> keyroost_piv::compat::FeatureGate,
) -> PivMgmtAlgSel {
    if gate_of(sel) != keyroost_piv::compat::FeatureGate::Unsupported {
        return sel;
    }
    options
        .iter()
        .copied()
        .find(|&opt| gate_of(opt) != keyroost_piv::compat::FeatureGate::Unsupported)
        .or_else(|| options.first().copied())
        .unwrap_or(sel)
}

/// The management-key algorithm combo's per-algorithm "unverified" warning
/// list — every offered algorithm gating [`keyroost_piv::compat::FeatureGate::Unverified`],
/// *unless* `extension_gate`
/// (`keyroost_piv::compat::PivExtension::SetManagementKey`'s own gate, not a
/// per-algorithm one) is already
/// [`keyroost_piv::compat::FeatureGate::Unsupported`] — in which case this is
/// always empty. When the whole extension is unsupported, the "Change
/// management key…" button and the algorithm combo are already disabled with
/// their own blocked-hint tooltip (see `cap_piv`'s "Management key" row); a
/// caller can't pick an algorithm for a change it can't make at all, so
/// calling out individually "unverified" algorithms on top of that would be
/// misleading noise rather than useful information. Factored out of `cap_piv`
/// so this suppression rule is unit-testable without an egui context, the
/// same reason [`piv_mgmtalg_unsupported_fallback`] is its own function.
#[must_use]
fn piv_mgmtalg_unverified_labels(
    extension_gate: keyroost_piv::compat::FeatureGate,
    options: &[PivMgmtAlgSel],
    gate_of: impl Fn(PivMgmtAlgSel) -> keyroost_piv::compat::FeatureGate,
) -> Vec<&'static str> {
    if extension_gate == keyroost_piv::compat::FeatureGate::Unsupported {
        return Vec::new();
    }
    options
        .iter()
        .copied()
        .filter(|&opt| gate_of(opt) == keyroost_piv::compat::FeatureGate::Unverified)
        .map(PivMgmtAlgSel::label)
        .collect()
}

/// A PIV management-key-algorithm picker combo. `options` is the offered set
/// — [`PivMgmtAlgSel::ALL`] at every call site today, the same five entries
/// on every device (see that type's doc); kept as a parameter rather than
/// hard-coded so the clamp/fallback logic below stays generically testable.
/// If `*sel` isn't among `options`, it snaps to `options[0]` before drawing —
/// see [`piv_mgmtalg_clamp`].
///
/// `gate_of` resolves each candidate's
/// `keyroost_piv::compat::PivExtension::ManagementKeyAlgorithm` gate on the
/// live device, same shape and same treatment as [`piv_keyalg_combo`]'s own
/// `gate_of`: an entry gating `Unsupported` renders disabled (dimmed, not
/// removed — the combo's shape stays the same as gates change); `Unverified`
/// entries stay enabled and are instead called out together in a note above
/// the combo (see `cap_piv`).
fn piv_mgmtalg_combo(
    ui: &mut egui::Ui,
    id: &str,
    sel: &mut PivMgmtAlgSel,
    options: &[PivMgmtAlgSel],
    gate_of: impl Fn(PivMgmtAlgSel) -> keyroost_piv::compat::FeatureGate,
) {
    piv_mgmtalg_clamp(sel, options);
    egui::ComboBox::from_id_salt(id)
        .selected_text(sel.label())
        .show_ui(ui, |ui| {
            // See `piv_keyalg_combo`'s matching line: bump the dimming for
            // gated rows in this popup only.
            ui.style_mut().visuals.disabled_alpha = PIV_COMBO_DISABLED_ALPHA;
            for &opt in options {
                let enabled = gate_of(opt) != keyroost_piv::compat::FeatureGate::Unsupported;
                ui.add_enabled_ui(enabled, |ui| {
                    stable_selectable_value(ui, sel, opt, opt.label());
                });
            }
        });
}

/// Accept a certificate file's bytes as PEM or DER, returning DER. `None` when
/// the bytes are neither.
fn cert_bytes_to_der(bytes: &[u8]) -> Option<Vec<u8>> {
    if let Ok(text) = std::str::from_utf8(bytes) {
        if let Some(start) = text.find("-----BEGIN CERTIFICATE-----") {
            let after = &text[start + "-----BEGIN CERTIFICATE-----".len()..];
            let end = after.find("-----END CERTIFICATE-----")?;
            let b64: String = after[..end].split_whitespace().collect();
            return keyroost_proto::codec::base64_decode(&b64).ok();
        }
    }
    // Not PEM — accept DER (must begin with a SEQUENCE tag).
    if bytes.first() == Some(&0x30) {
        Some(bytes.to_vec())
    } else {
        None
    }
}

/// Paint a rounded glyph tile at `rect` with the painter (no widget allocation,
/// so it never steals clicks from a surrounding row). `ch = None` draws a clock.
fn paint_glyph_tile(
    ui: &egui::Ui,
    rect: egui::Rect,
    fill: egui::Color32,
    fg: egui::Color32,
    ch: Option<char>,
) {
    ui.painter().rect_filled(
        rect,
        egui::CornerRadius::same((rect.width() * 0.28) as u8),
        fill,
    );
    match ch {
        Some(c) => {
            ui.painter().text(
                rect.center(),
                egui::Align2::CENTER_CENTER,
                c,
                theme::f_bold(rect.width() * 0.5),
                fg,
            );
        }
        None => {
            let c = rect.center();
            let r = rect.width() * 0.26;
            ui.painter().circle_stroke(c, r, egui::Stroke::new(1.6, fg));
            ui.painter().line_segment(
                [c, c + egui::vec2(0.0, -r * 0.72)],
                egui::Stroke::new(1.6, fg),
            );
            ui.painter().line_segment(
                [c, c + egui::vec2(r * 0.55, 0.0)],
                egui::Stroke::new(1.6, fg),
            );
        }
    }
}

/// Paint a small rounded pill at `left_top` with the painter; returns its width
/// so the caller can advance a cursor.
fn paint_pill(
    ui: &egui::Ui,
    left_top: egui::Pos2,
    text: &str,
    fg: egui::Color32,
    bg: egui::Color32,
) -> f32 {
    let galley = ui.fonts_mut(|f| f.layout_no_wrap(text.to_string(), theme::f_sb(11.0), fg));
    let pad_x = 8.0;
    let h = 18.0;
    let w = galley.size().x + pad_x * 2.0;
    let rect = egui::Rect::from_min_size(left_top, egui::vec2(w, h));
    ui.painter()
        .rect_filled(rect, egui::CornerRadius::same(255), bg);
    let pos = egui::pos2(left_top.x + pad_x, rect.center().y - galley.size().y / 2.0);
    ui.painter().galley(pos, galley, fg);
    w
}

// ---- small vector icons, painted so they render regardless of font coverage
// (IBM Plex Sans lacks ⓘ / ◐ / ↻ / ⧉ / ✓ / ✕, which otherwise show as tofu) ----

/// Half-filled circle — the light/dark theme toggle.
fn paint_theme_icon(ui: &egui::Ui, center: egui::Pos2, r: f32, color: egui::Color32) {
    use std::f32::consts::{FRAC_PI_2, PI};
    ui.painter()
        .circle_stroke(center, r, egui::Stroke::new(1.3, color));
    let n = 20;
    let pts: Vec<egui::Pos2> = (0..=n)
        .map(|i| {
            let a = FRAC_PI_2 + PI * (i as f32 / n as f32);
            center + r * egui::vec2(a.cos(), a.sin())
        })
        .collect();
    ui.painter()
        .add(egui::Shape::convex_polygon(pts, color, egui::Stroke::NONE));
}

/// An eye (two lids + a pupil) — the colorblind-mode toggle.
fn paint_eye_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let stroke = egui::Stroke::new(1.3, color);
    let (w, h) = (8.0_f32, 4.6_f32);
    let n = 14;
    let lid = |sign: f32| -> Vec<egui::Pos2> {
        (0..=n)
            .map(|i| {
                let t = -1.0 + 2.0 * (i as f32 / n as f32);
                egui::pos2(center.x + t * w, center.y + sign * h * (1.0 - t * t))
            })
            .collect()
    };
    ui.painter().add(egui::Shape::line(lid(-1.0), stroke));
    ui.painter().add(egui::Shape::line(lid(1.0), stroke));
    ui.painter().circle_filled(center, 2.2, color);
}

/// Circular arrow — refresh / rescan. Clockwise, with a filled arrowhead at the
/// leading end (egui's y-down space makes increasing angle clockwise).
fn paint_refresh_icon(ui: &egui::Ui, center: egui::Pos2, r: f32, color: egui::Color32) {
    let stroke = egui::Stroke::new(1.4, color);
    let (a0, a1) = (0.5_f32, 5.6_f32);
    let n = 24;
    let pts: Vec<egui::Pos2> = (0..=n)
        .map(|i| {
            let a = a0 + (a1 - a0) * (i as f32 / n as f32);
            center + r * egui::vec2(a.cos(), a.sin())
        })
        .collect();
    ui.painter().add(egui::Shape::line(pts, stroke));
    // Filled arrowhead at the leading (clockwise) end, pointing along the motion.
    let end = center + r * egui::vec2(a1.cos(), a1.sin());
    let tangent = egui::vec2(-a1.sin(), a1.cos());
    let radial = egui::vec2(a1.cos(), a1.sin());
    let tip = end + tangent * 3.5;
    let b1 = end + radial * 2.6 - tangent * 0.8;
    let b2 = end - radial * 2.6 - tangent * 0.8;
    ui.painter().add(egui::Shape::convex_polygon(
        vec![tip, b1, b2],
        color,
        egui::Stroke::NONE,
    ));
}

/// Two stacked sheets — copy.
/// Format a Unix timestamp (seconds) as a human-readable UTC string
/// `YYYY-MM-DD HH:MM:SS UTC`. Self-contained civil-date conversion (Howard
/// Hinnant's algorithm) so no date crate is pulled in.
fn fmt_unix_utc(secs: u32) -> String {
    let days = (secs / 86_400) as i64;
    let rem = secs % 86_400;
    let (hh, mm, ss) = (rem / 3600, (rem % 3600) / 60, rem % 60);
    // days since 1970-01-01 -> civil date
    let z = days + 719_468;
    let era = z.div_euclid(146_097);
    let doe = z.rem_euclid(146_097);
    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
    let y = yoe + era * 400;
    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
    let mp = (5 * doy + 2) / 153;
    let d = doy - (153 * mp + 2) / 5 + 1;
    let m = if mp < 10 { mp + 3 } else { mp - 9 };
    let y = if m <= 2 { y + 1 } else { y };
    format!("{y:04}-{m:02}-{d:02} {hh:02}:{mm:02}:{ss:02} UTC")
}

fn paint_copy_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.3, color);
    let back = egui::Rect::from_min_size(center + egui::vec2(-1.0, -5.0), egui::vec2(7.0, 8.0));
    let front = egui::Rect::from_min_size(center + egui::vec2(-5.0, -1.0), egui::vec2(7.0, 8.0));
    ui.painter().rect_stroke(
        back,
        egui::CornerRadius::same(1),
        s,
        egui::StrokeKind::Inside,
    );
    ui.painter().rect_stroke(
        front,
        egui::CornerRadius::same(1),
        s,
        egui::StrokeKind::Inside,
    );
}

/// A small QR-glyph: three finder squares plus a couple of module dots.
#[cfg(feature = "qr")]
pub(crate) fn paint_qr_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.2, color);
    // Three finder squares (top-left, top-right, bottom-left).
    let finder = |min: egui::Vec2| {
        let r = egui::Rect::from_min_size(center + min, egui::vec2(3.4, 3.4));
        ui.painter()
            .rect_stroke(r, egui::CornerRadius::same(1), s, egui::StrokeKind::Inside);
    };
    finder(egui::vec2(-5.0, -5.0));
    finder(egui::vec2(1.6, -5.0));
    finder(egui::vec2(-5.0, 1.6));
    // A few modules in the data quadrant so it reads as a QR, not four boxes.
    let dot = |off: egui::Vec2| {
        ui.painter().rect_filled(
            egui::Rect::from_min_size(center + off, egui::vec2(1.2, 1.2)),
            egui::CornerRadius::ZERO,
            color,
        );
    };
    dot(egui::vec2(2.0, 2.0));
    dot(egui::vec2(4.0, 4.0));
    dot(egui::vec2(2.0, 4.4));
}

/// Checkmark — copied / confirmed.
fn paint_check_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.7, color);
    ui.painter().line_segment(
        [
            center + egui::vec2(-4.0, 0.0),
            center + egui::vec2(-1.0, 3.0),
        ],
        s,
    );
    ui.painter().line_segment(
        [
            center + egui::vec2(-1.0, 3.0),
            center + egui::vec2(4.0, -3.5),
        ],
        s,
    );
}

/// Cross — delete / dismiss.
fn paint_x_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.4, color);
    ui.painter().line_segment(
        [
            center + egui::vec2(-3.5, -3.5),
            center + egui::vec2(3.5, 3.5),
        ],
        s,
    );
    ui.painter().line_segment(
        [
            center + egui::vec2(-3.5, 3.5),
            center + egui::vec2(3.5, -3.5),
        ],
        s,
    );
}

/// The window body shared by the detach / reattach pair: a square shifted to the
/// bottom-left with its top-right corner left open for the arrow. Drawn
/// identically by both so the glyphs read as one control in two states. Of the
/// 8pt top and right edges only 3pt is drawn — a deep `5.0` corner cut — so the
/// frame stays well clear of the arrow that crosses that corner.
fn paint_window_body(painter: &egui::Painter, center: egui::Pos2, s: egui::Stroke) {
    let b = egui::Rect::from_min_size(center + egui::vec2(-6.0, -2.0), egui::vec2(8.0, 8.0));
    painter.add(egui::Shape::line(
        vec![
            egui::pos2(b.right() - 5.0, b.top()),
            b.left_top(),
            b.left_bottom(),
            b.right_bottom(),
            egui::pos2(b.right(), b.top() + 5.0),
        ],
        s,
    ));
}

/// A window frame with an arrow leaving its top-right corner — "pop this pane
/// out into its own window". Mirrors the external-link affordance the top bar's
/// "Learn \u{2197}" uses.
fn paint_detach_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.3, color);
    let painter = ui.painter();
    paint_window_body(painter, center, s);
    // Diagonal arrow crossing that corner, pointing out to the top-right.
    let tip = center + egui::vec2(6.0, -6.0);
    painter.line_segment([center + egui::vec2(-1.0, 1.0), tip], s);
    painter.add(egui::Shape::line(
        vec![tip + egui::vec2(-4.5, 0.0), tip, tip + egui::vec2(0.0, 4.5)],
        s,
    ));
}

/// The mirror of [`paint_detach_icon`]: same window frame, but the arrow flies
/// *in* through the open corner — "dock this back into the main window". Its tip
/// rests at the glyph centre, inside the body, pointing down-left; the head
/// keeps the same clearance from the frame that the detach arrow does.
fn paint_reattach_icon(ui: &egui::Ui, center: egui::Pos2, color: egui::Color32) {
    let s = egui::Stroke::new(1.3, color);
    let painter = ui.painter();
    paint_window_body(painter, center, s);
    let tip = center;
    painter.line_segment([center + egui::vec2(6.0, -6.0), tip], s);
    painter.add(egui::Shape::line(
        vec![tip + egui::vec2(4.5, 0.0), tip, tip + egui::vec2(0.0, -4.5)],
        s,
    ));
}

/// Paint one selectable device row. The whole row is a single painter-drawn
/// click target (no nested widgets), so clicking anywhere in it selects the
/// device — fixing the "only the gaps are clickable" inconsistency.
fn device_row(ui: &mut egui::Ui, p: &Palette, dev: &Device, selected: bool) -> bool {
    let w = ui.available_width();
    let h = 68.0;
    let (rect, resp) = ui.allocate_exact_size(egui::vec2(w, h), egui::Sense::click());
    let bg = if selected {
        p.raised
    } else if resp.hovered() {
        p.line_soft
    } else {
        egui::Color32::TRANSPARENT
    };
    ui.painter().rect(
        rect,
        egui::CornerRadius::same(11),
        bg,
        egui::Stroke::new(
            1.0,
            if selected {
                p.line
            } else {
                egui::Color32::TRANSPARENT
            },
        ),
        egui::StrokeKind::Inside,
    );
    if selected {
        ui.painter().rect_filled(
            egui::Rect::from_min_size(
                rect.left_top() + egui::vec2(0.0, 13.0),
                egui::vec2(3.0, h - 26.0),
            ),
            egui::CornerRadius::same(3),
            p.accent,
        );
    }

    let token = dev.kind == DeviceKind::Token || dev.kind == DeviceKind::ProgToken;
    let tile = egui::Rect::from_min_size(
        rect.left_top() + egui::vec2(14.0, (h - 38.0) / 2.0),
        egui::vec2(38.0, 38.0),
    );
    if token {
        paint_glyph_tile(ui, tile, p.brand_soft(), p.brand, None);
    } else {
        paint_glyph_tile(
            ui,
            tile,
            p.raised2,
            p.txt2,
            Some(
                dev.vendor
                    .chars()
                    .next()
                    .unwrap_or('?')
                    .to_ascii_uppercase(),
            ),
        );
    }

    let tx = tile.right() + 11.0;
    let right_pad = 16.0;
    // status dot, top-right
    ui.painter().circle_filled(
        egui::pos2(rect.right() - right_pad, rect.top() + 18.0),
        3.5,
        p.ok,
    );
    // vendor eyebrow
    ui.painter().text(
        egui::pos2(tx, rect.top() + 13.0),
        egui::Align2::LEFT_TOP,
        &dev.vendor,
        theme::f_sb(11.0),
        p.txt3,
    );
    // model, truncated to the available width
    let avail = (rect.right() - right_pad - 8.0) - tx;
    let galley = ui.fonts_mut(|f| {
        let mut job = egui::text::LayoutJob::single_section(
            dev.title().to_string(),
            egui::TextFormat {
                font_id: theme::f_sb(13.5),
                color: p.txt,
                ..Default::default()
            },
        );
        job.wrap = egui::text::TextWrapping {
            max_width: avail.max(0.0),
            max_rows: 1,
            break_anywhere: true,
            overflow_character: Some('\u{2026}'),
        };
        f.layout_job(job)
    });
    ui.painter()
        .galley(egui::pos2(tx, rect.top() + 26.0), galley, p.txt);
    // capability pills — labels come from the shared cap_badges() vocabulary so
    // the GUI and the CLI overview never disagree. Tokens keep the amber accent.
    let py = rect.top() + 46.0;
    let (fg, bg) = if token {
        (p.brand, p.brand_soft())
    } else {
        (p.txt2, p.raised2)
    };
    let mut px = tx;
    for (label, state) in dev.cap_badge_states() {
        // An unverified capability (offered on a hint, never checked against
        // the device) renders as a dimmer "OTP?" pill — same vocabulary as the
        // CLI's badge line, so the two never disagree about what was proven.
        if state == CapState::Unverified {
            let text = format!("{label}?");
            px += paint_pill(ui, egui::pos2(px, py), &text, p.txt3, bg) + 5.0;
        } else {
            px += paint_pill(ui, egui::pos2(px, py), label, fg, bg) + 5.0;
        }
    }
    if resp.hovered() {
        ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
    }
    resp.clicked()
}

impl eframe::App for App {
    // Note: `eframe::App::save` is intentionally not implemented. This crate
    // builds eframe without its `persistence` feature (to avoid pulling in
    // three extra crates), so `save()` would never be called. UI preferences
    // are persisted by `App::persist_settings` into `settings.json` instead —
    // see the `settings` module.

    fn ui(&mut self, root_ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
        // eframe 0.35 drives the app through `App::ui` with a root `Ui` rather
        // than the old `update(ctx)`. Our layout is panel-based: the four panels
        // below are shown into `root_ui`, while the dialogs/popovers (which still
        // take `&Context`) use this cheap `Context` handle cloned from it.
        let ctx_owned = root_ui.ctx().clone();
        let ctx = &ctx_owned;
        // Clipboard hygiene: ~45s after an OTP code was copied, clear the
        // clipboard so the code doesn't live on in clipboard-manager history —
        // but only if the clipboard still holds that exact code. Content the
        // user copied elsewhere in the meantime is never clobbered. arboard is
        // already in the tree via eframe's clipboard integration; if the
        // clipboard can't be read (e.g. some Wayland setups), fail open and
        // clear nothing rather than risk destroying foreign content.
        if let Some((ref code, t)) = self.clipboard_clear_at {
            let now = now_secs_f64();
            if now >= t {
                if let Ok(mut cb) = arboard::Clipboard::new() {
                    if cb.get_text().is_ok_and(|current| current == *code) {
                        let _ = cb.clear();
                    }
                }
                self.clipboard_clear_at = None;
            } else {
                ctx.request_repaint_after(std::time::Duration::from_secs_f64((t - now).max(0.1)));
            }
        }
        // Dropping a file on the window routes it to the bulk-import dialog —
        // the natural gesture for "import this screenshot/export".
        let dropped = ctx.input(|i| {
            i.raw
                .dropped_files
                .first()
                .and_then(|f| f.path.as_ref())
                .map(|p| p.display().to_string())
        });
        if let Some(path) = dropped {
            self.bulk_dialog.open = true;
            self.bulk_dialog.path = path;
            self.bulk_load();
        }

        // Apply any results from background device jobs and the import
        // thread before drawing.
        self.drain_worker();
        // While a device job is in flight (e.g. fingerprint enrollment writing
        // live progress to a shared cell), keep the frame loop ticking so the UI
        // reflects per-sample updates instead of freezing until the job ends.
        if self.busy() {
            ctx.request_repaint_after(std::time::Duration::from_millis(100));
        }
        self.drain_import();
        // Land any path picked by a native file-chooser into its target field.
        self.drain_file_dialogs();
        let p = self.palette();
        // Rebuilding + re-applying egui Visuals every frame is wasted work;
        // only do it when a theme knob actually changed.
        let theme_key = (self.mode, self.accent_idx, self.colorblind);
        if self.applied_theme != Some(theme_key) {
            p.apply(ctx, self.mode);
            self.applied_theme = Some(theme_key);
        }

        // UI scale ("Text size", issue #42). Let Ctrl +/-/scroll zoom the whole
        // UI immediately (egui then scales fonts AND painted symbols uniformly).
        ctx.options_mut(|o| o.zoom_with_keyboard = true);
        match self.applied_zoom {
            // First frame: push *our* persisted factor into the context. This
            // is also the persistence-conflict fix: eframe restores egui's own
            // memory (which includes egui's separately-persisted zoom factor)
            // before this runs, so two sources of truth exist. We resolve it by
            // making our "zoom" storage key authoritative — re-applying it here
            // every launch deterministically overrides whatever egui restored,
            // so the two can never drift (last writer is always us). We do NOT
            // read `ctx.zoom_factor()` back on this frame: doing so previously
            // clobbered the loaded value with a stale 1.0, which `save()` then
            // persisted, so the chosen size reset on every reopen.
            None => {
                self.zoom = theme::clamp_zoom(self.zoom);
                ctx.set_zoom_factor(self.zoom);
                self.applied_zoom = Some(self.zoom);
            }
            // Steady state: the context owns the live factor (Ctrl +/-/scroll
            // and the slider's on-release commit both write it via
            // `set_zoom_factor`). Mirror it back into `self.zoom` so the readout
            // and the persisted value stay in sync — but never while the slider
            // is mid-drag, since the drag stashes its preview in `zoom_pending`
            // and has not committed to the context yet.
            Some(_) => {
                if self.zoom_pending.is_none() {
                    // Ctrl +/- and Ctrl-scroll use egui's built-in keyboard zoom,
                    // which ignores our 80–200% slider bounds. If it ran past the
                    // limit, pull the context back to the clamp so the keyboard
                    // path obeys the same range as the slider (issue #42).
                    let live = ctx.zoom_factor();
                    let clamped = theme::clamp_zoom(live);
                    if (live - clamped).abs() > f32::EPSILON {
                        ctx.set_zoom_factor(clamped);
                    }
                    self.zoom = clamped;
                    self.applied_zoom = Some(self.zoom);
                    // The zoom only lands here once it's committed to the
                    // context (slider release, Ctrl +/-/scroll, or Reset), never
                    // mid-drag (guarded by `zoom_pending`). Persist on the
                    // committed value; `persist_settings` no-ops when the factor
                    // is unchanged, so this is cheap on every quiescent frame.
                    self.persist_settings();
                }
            }
        }

        // First frame: scan for devices automatically so the user isn't staring
        // at an empty pane wondering whether the app is broken.
        if !self.scanned {
            self.scanned = true;
            self.schedule_scan_burst();
        }

        // Armed FIDO reset: poll the live key list so we can fire the reset the
        // instant the user re-inserts the key. Runs before the hotplug refresh
        // and holds the worker slot, so a replug-triggered rescan can't beat the
        // reset to it.
        if self.reset_arm.is_some() {
            self.poll_reset_arm();
            ctx.request_repaint_after(std::time::Duration::from_millis(200));
        }

        // Reader hotplug: the watcher set this flag (and woke us). Start a
        // rescan burst (suppressed while a reset is armed, so its job can't
        // steal the worker slot).
        if self.reset_arm.is_none()
            && self
                .devices_dirty
                .swap(false, std::sync::atomic::Ordering::Relaxed)
        {
            self.schedule_scan_burst();
        }

        // Drive the rescan burst: run a scan when one is due and the worker is
        // free, then schedule the next. Spacing gives a slow reader (Molto2)
        // time to register with pcscd between attempts.
        //
        // Held off while an inline rename field is open: a scan replaces the
        // device list and can move the selection out from under the open field
        // (acute with the Molto2's flapping CCID reader). The pending count is
        // kept, and `close_rename` requests a repaint, so the burst resumes
        // the moment the field closes — without keeping a 2 Hz wakeup loop
        // armed for the whole edit.
        if self.reset_arm.is_none() && self.pending_scans > 0 {
            let now = std::time::Instant::now();
            let due = self.next_scan_at.is_none_or(|t| now >= t);
            let renaming = self.rename_target.is_some();
            if due && !self.busy() && !renaming {
                self.refresh_devices();
                self.pending_scans -= 1;
                self.next_scan_at = Some(now + std::time::Duration::from_millis(1500));
            }
            if self.pending_scans > 0 && !renaming {
                ctx.request_repaint_after(std::time::Duration::from_millis(500));
            }
        }

        self.top_bar(root_ui, &p);
        self.device_sidebar(root_ui, &p);
        if self.log_open && !self.log_detached {
            self.activity_log(root_ui, &p);
        }
        self.central(root_ui, &p);

        // Popped-out activity log: its own OS window, rendered every frame while
        // detached. "Reattach" docks it back into the bottom drawer; the
        // window's close button collapses the log entirely.
        if self.log_open && self.log_detached {
            self.activity_log_window(ctx, &p);
        }

        // Modal dialogs (reused from the per-applet logic) + Molto2 import dialogs.
        self.render_reset_dialog(ctx);
        self.render_advanced_confirm(ctx, &p);
        self.render_enroll_dialog(ctx, &p);
        if let Some(id) = self.render_fp_delete_confirm(ctx, &p) {
            self.delete_fingerprint(id);
        }
        self.render_oath_delete_confirm(ctx);
        self.render_oath_reset_confirm(ctx);
        self.render_factory_reset_confirm(ctx, &p);
        self.render_oath_add_modal(ctx, &p);
        self.render_openpgp_cred_modal(ctx, &p);
        self.render_piv_confirms(ctx);
        self.render_piv_cred_modal(ctx, &p);
        self.molto_dialogs(ctx, &p);

        // Help popover, painted last so it sits above everything.
        if let Some(topic) = self.help_open {
            if ui::help_popover(ctx, &p, topic, self.help_anchor) {
                self.help_open = None;
            }
        }

        // Keep OATH rings / Molto2 time ticking while a device is selected.
        // Only keep ticking when something actually animates (OATH countdown
        // rings, the Molto2 view, or the "copied" flash) — not on every static
        // pane, which would burn frames and feel sluggish.
        // Auto-refresh on-device TOTP codes when their time window rolls over.
        // The device returns codes only at read time, so once the window flips
        // the shown codes are stale; reload them (like clicking Refresh). Keyed
        // on the shortest period among the visible TOTP rows so a 30s entry
        // refreshes on its boundary even if a 60s entry is also present.
        if matches!(self.cap_tab, CapTab::Otp) && self.otp.loaded {
            let min_period = self
                .otp
                .rows
                .iter()
                .filter(|r| r.type_str.eq_ignore_ascii_case("TOTP") && r.code.is_some())
                .map(|r| if r.period == 0 { 30 } else { r.period as u64 })
                .min();
            if let Some(period) = min_period {
                let now = std::time::SystemTime::now()
                    .duration_since(std::time::UNIX_EPOCH)
                    .map(|d| d.as_secs())
                    .unwrap_or(0);
                let window = now / period;
                match self.otp_last_window {
                    Some(prev) if prev != window => {
                        self.otp_last_window = Some(window);
                        self.load_otp_entries();
                    }
                    None => self.otp_last_window = Some(window),
                    _ => {}
                }
            }
        } else {
            // Reset when leaving the tab so re-entry doesn't trigger a spurious
            // reload on a window that "changed" while we weren't watching.
            self.otp_last_window = None;
        }

        let animating = self.copied.is_some()
            || matches!(self.cap_tab, CapTab::Oath)
            || (matches!(self.cap_tab, CapTab::Overview)
                && self.oath.loaded
                && !self.oath.creds.is_empty())
            || (matches!(self.cap_tab, CapTab::Otp)
                && self
                    .otp
                    .rows
                    .iter()
                    .any(|r| r.type_str.eq_ignore_ascii_case("TOTP") && r.code.is_some()))
            || self
                .selected_device()
                .is_some_and(|d| d.kind == DeviceKind::Token);
        if animating {
            ctx.request_repaint_after(std::time::Duration::from_millis(500));
        }
    }
}

// --- Device-centric rendering ------------------------------------------------
impl App {
    /// Toggle the help popover for `topic`, anchored under the clicked "?" button.
    fn help_dot(&mut self, ui: &mut egui::Ui, p: &Palette, topic: &'static str) {
        let r = ui::help_button(ui, p, self.help_open == Some(topic));
        if r.hovered() {
            ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
        }
        if r.clicked() {
            self.toggle_help(topic, r.rect.left_bottom());
        }
    }

    /// Top bar: brand · "keyroost" · connected count | accents · theme · Learn ·
    /// Activity log · Refresh.
    fn top_bar(&mut self, root_ui: &mut egui::Ui, p: &Palette) {
        let ctx = root_ui.ctx().clone();
        // The bar height must track the zoom factor: at a larger text size the
        // glyph tile, labels and icons are all scaled up, and a fixed 52px panel
        // would clip them and let the left content overrun the right-hand
        // controls. Scale the base height by the live zoom so the bar grows with
        // its contents (clamped so it never collapses below the base).
        let zoom = theme::clamp_zoom(ctx.zoom_factor());
        let bar_h = (52.0 * zoom).max(52.0);
        egui::Panel::top("bar")
            .exact_size(bar_h)
            .frame(panel_frame(p.bar, 16.0, 0.0))
            .show(root_ui, |ui| {
                ui.horizontal_centered(|ui| {
                    glyph_tile(ui, 26.0, p.brand, p.accent_ink, Some('k'));
                    ui.add_space(8.0);
                    ui.label(
                        egui::RichText::new("keyroost")
                            .font(theme::f_bold(14.0))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    // Quiet version chip: the only place the app says which
                    // version it is (#98), so keep it visible but muted.
                    ui.label(
                        egui::RichText::new(VERSION_LABEL)
                            .font(theme::f_reg(11.0))
                            .color(p.txt3),
                    );
                    ui.add_space(12.0);
                    theme::status_dot(ui, p.ok, 7.0);
                    ui.add_space(5.0);
                    ui.label(
                        egui::RichText::new(format!("{} connected", self.devices.len()))
                            .font(theme::f_reg(12.0))
                            .color(p.txt2),
                    );
                    if self.busy() {
                        ui.add_space(12.0);
                        ui.spinner();
                        if let Some(label) = &self.busy_label {
                            // Truncate so a long status never pushes the left
                            // content into the right-hand controls (overlap on
                            // small / zoomed layouts).
                            ui.add(
                                egui::Label::new(
                                    egui::RichText::new(label.as_str())
                                        .font(theme::f_reg(12.0))
                                        .color(p.txt3),
                                )
                                .truncate(),
                            );
                        }
                    }

                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Ghost, "Refresh").clicked() {
                            self.schedule_scan_burst();
                        }
                        ui.add_space(4.0);
                        let log_color = if self.log_open { p.accent } else { p.txt2 };
                        if ui
                            .add(
                                egui::Label::new(
                                    egui::RichText::new("Activity log")
                                        .font(theme::f_sb(12.5))
                                        .color(log_color),
                                )
                                .sense(egui::Sense::click()),
                            )
                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                            .clicked()
                        {
                            if self.log_detached {
                                // The log is popped out into its own window;
                                // the link brings that window forward rather
                                // than toggling (and closing) the drawer that
                                // isn't showing.
                                ctx.send_viewport_cmd_to(
                                    activity_log_viewport_id(),
                                    egui::ViewportCommand::Focus,
                                );
                            } else {
                                self.log_open = !self.log_open;
                            }
                        }
                        ui.add_space(10.0);
                        ui.hyperlink_to(
                            egui::RichText::new("Learn \u{2197}")
                                .font(theme::f_sb(12.5))
                                .color(p.txt2),
                            ui::help::LEARN_BASE,
                        );
                        ui.add_space(10.0);
                        let (trect, tresp) =
                            ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                        paint_theme_icon(ui, trect.center(), 7.0, p.txt2);
                        if tresp
                            .on_hover_text("Toggle light / dark")
                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                            .clicked()
                        {
                            self.mode = match self.mode {
                                Mode::Dark => Mode::Light,
                                Mode::Light => Mode::Dark,
                            };
                            self.persist_settings();
                        }
                        ui.add_space(10.0);
                        let (erect, eresp) =
                            ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                        paint_eye_icon(
                            ui,
                            erect.center(),
                            if self.colorblind { p.accent } else { p.txt2 },
                        );
                        if eresp
                            .on_hover_text("Colorblind-safe colors")
                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                            .clicked()
                        {
                            self.colorblind = !self.colorblind;
                            self.persist_settings();
                        }
                        ui.add_space(10.0);
                        // "Text size" (issue #42): a compact UI-scale control.
                        // The slider drives egui's global zoom factor, which
                        // scales fonts AND painted symbols uniformly. A live "%"
                        // readout sits to the right (rightmost in this RTL row),
                        // with a "Reset" that appears only when off 100%.
                        self.text_size_control(ui, p);
                        ui.add_space(10.0);
                        for (i, c) in Palette::ACCENTS.iter().enumerate().rev() {
                            let (rect, resp) = ui
                                .allocate_exact_size(egui::vec2(16.0, 16.0), egui::Sense::click());
                            let on = i == self.accent_idx;
                            ui.painter().circle_filled(
                                rect.center(),
                                if on { 6.0 } else { 5.0 },
                                *c,
                            );
                            if on {
                                ui.painter().circle_stroke(
                                    rect.center(),
                                    7.5,
                                    egui::Stroke::new(1.5, p.txt),
                                );
                            }
                            if resp.hovered() {
                                ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
                            }
                            if resp.clicked() {
                                self.accent_idx = i;
                                self.persist_settings();
                            }
                        }
                    });
                });
            });
    }

    /// "Text size" control for the top bar (issue #42): a compact slider over
    /// egui's global zoom factor (80%–200%), with a live "%" readout and a
    /// "Reset" that surfaces only when the scale is off 100%. Writing the slider
    /// calls `set_zoom_factor`, so the whole UI — fonts and painted symbols —
    /// rescales uniformly. Lives inside the top bar's right-to-left layout, so
    /// widgets are added right-to-left: readout, slider, label, then Reset.
    fn text_size_control(&mut self, ui: &mut egui::Ui, p: &Palette) {
        // The slider lives inside the very UI it scales, so applying the zoom
        // *live* during a drag grows/shifts the slider track under the cursor
        // and runs the value away to the maximum. Fix: apply-on-release. While
        // dragging we edit a preview (`zoom_pending`) and leave the context
        // factor alone, so the UI stays stable; we commit `set_zoom_factor`
        // only when the drag ends. Keyboard/scroll zoom is unaffected (it has
        // no feedback loop) and keeps writing the context directly.
        //
        // The slider edits `factor`: the pending preview if a drag is in
        // flight, otherwise the committed live factor. The readout tracks the
        // same value so it follows the handle during the drag.
        let mut factor = self
            .zoom_pending
            .unwrap_or_else(|| theme::clamp_zoom(ui.ctx().zoom_factor()));

        // Live percentage readout (rightmost). FIXED width: as the value crosses
        // 99%→100% the glyph count goes 3→4; in the bar's right-to-left layout a
        // wider readout would shove the slider track left under the cursor and
        // make the value lurch (issue #42). `allocate_exact_size` reserves the
        // widest readout's box unconditionally (unlike `allocate_ui_with_layout`,
        // which advances by content width and so would still let the track move);
        // we then paint the value right-aligned inside it, so the slider geometry
        // is identical for "99%" and "100%".
        let pct = (factor * 100.0).round() as i32;
        let cell = ui.fonts_mut(|f| {
            f.layout_no_wrap("888%".to_owned(), theme::f_sb(12.0), p.txt2)
                .size()
        });
        let (rrect, _) = ui.allocate_exact_size(
            egui::vec2(cell.x.ceil(), cell.y.ceil()),
            egui::Sense::hover(),
        );
        ui.painter().text(
            rrect.right_center(),
            egui::Align2::RIGHT_CENTER,
            format!("{pct}%"),
            theme::f_sb(12.0),
            p.txt2,
        );
        ui.add_space(6.0);

        // The slider itself. Style its track/handle to the palette so it reads
        // as part of the bar rather than egui's default blue. egui draws both the
        // rail and the handle from `inactive.bg_fill`; on the LIGHT theme `raised2`
        // sits almost on top of the bar, so the rail, handle and steppers were
        // near-invisible (#59). Use a clearly darker control gray on light (the
        // dark bar keeps `raised2`, which already contrasts fine).
        let (track, track_hot) = match self.mode {
            Mode::Light => (theme::darken(p.bar, 0.16), theme::darken(p.bar, 0.26)),
            Mode::Dark => (p.raised2, theme::lighten(p.raised2, 0.08)),
        };
        let style = ui.style_mut();
        style.visuals.widgets.inactive.bg_fill = track;
        style.visuals.widgets.hovered.bg_fill = track_hot;
        style.visuals.widgets.active.bg_fill = p.accent;
        style.visuals.widgets.inactive.fg_stroke = egui::Stroke::new(1.0, p.txt2);
        style.visuals.widgets.hovered.fg_stroke = egui::Stroke::new(1.0, p.txt);
        style.spacing.slider_width = 92.0;

        // [+] / [−] steppers flanking the slider, each nudging the size by 1%
        // (0.01). The bar is laid out right-to-left, so to read "[−] slider [+]"
        // left-to-right we emit the [+] first, then the slider, then the [−].
        // A small closure paints one square stepper button and reports clicks.
        let step = |ui: &mut egui::Ui, glyph: &str| -> egui::Response {
            let (rect, resp) = ui.allocate_exact_size(egui::vec2(16.0, 16.0), egui::Sense::click());
            let hot = resp.hovered();
            ui.painter()
                .rect_filled(rect, 3.0, if hot { track_hot } else { track });
            ui.painter().text(
                rect.center(),
                egui::Align2::CENTER_CENTER,
                glyph,
                theme::f_sb(13.0),
                if hot { p.txt } else { p.txt2 },
            );
            resp.on_hover_cursor(egui::CursorIcon::PointingHand)
        };

        // [+] (rightmost of the trio in this RTL row). Preview only (stash in
        // `zoom_pending` + arm the commit timer); the rescale is deferred so the
        // button stays under the cursor for repeated clicks — see the commit
        // block after the [−] stepper.
        let plus = step(ui, "+");
        if plus.clicked() {
            factor = theme::clamp_zoom(factor + 0.01);
            self.zoom_pending = Some(factor);
            self.zoom_commit_at =
                Some(std::time::Instant::now() + std::time::Duration::from_millis(350));
        }
        ui.add_space(4.0);

        let resp = ui.add(
            egui::Slider::new(&mut factor, theme::ZOOM_MIN..=theme::ZOOM_MAX)
                .show_value(false)
                .trailing_fill(true),
        );
        if resp.dragged() {
            // Mid-drag: preview only, don't touch the context (avoids runaway).
            // A drag supersedes any pending stepper preview.
            self.zoom_pending = Some(theme::clamp_zoom(factor));
            self.zoom_commit_at = None;
        } else if resp.drag_stopped() {
            // Drag released: commit the chosen size to the context once.
            ui.ctx().set_zoom_factor(theme::clamp_zoom(factor));
            self.zoom_pending = None;
            self.zoom_commit_at = None;
        } else if resp.changed() {
            // Click/keyboard committed a value without a drag (e.g. arrow keys
            // or clicking the track): apply immediately, nothing to preview.
            ui.ctx().set_zoom_factor(theme::clamp_zoom(factor));
            self.zoom_pending = None;
            self.zoom_commit_at = None;
        }
        let resp = resp
            .on_hover_text("Text size — scales the whole interface (Ctrl + / Ctrl − also work)");

        ui.add_space(4.0);
        // [−] (leftmost of the trio). Preview-only like [+].
        let minus = step(ui, "\u{2212}");
        if minus.clicked() {
            factor = theme::clamp_zoom(factor - 0.01);
            self.zoom_pending = Some(factor);
            self.zoom_commit_at =
                Some(std::time::Instant::now() + std::time::Duration::from_millis(350));
        }

        // Commit a stepper preview once the user settles: pointer off both
        // buttons, or 350ms since the last click. The slider commits its own
        // preview on release, so a pending value reaching here is always from a
        // stepper. Deferring keeps the bar (and the buttons) from rescaling out
        // from under the cursor during a run of clicks; we repaint at the
        // deadline so it still applies if the pointer never moves.
        if let Some(at) = self.zoom_commit_at {
            let settled = (!plus.hovered() && !minus.hovered()) || std::time::Instant::now() >= at;
            if settled && !resp.dragged() {
                if let Some(f) = self.zoom_pending.take() {
                    ui.ctx().set_zoom_factor(f);
                }
                self.zoom_commit_at = None;
            } else {
                ui.ctx()
                    .request_repaint_after(at.saturating_duration_since(std::time::Instant::now()));
            }
        }

        ui.add_space(7.0);

        // Label.
        ui.label(
            egui::RichText::new("Text size")
                .font(theme::f_reg(12.0))
                .color(p.txt2),
        );

        // "Reset" appears only when we're off the default, so the chrome stays
        // quiet for users who never change it.
        if (factor - theme::ZOOM_DEFAULT).abs() > f32::EPSILON {
            ui.add_space(8.0);
            if ui
                .add(
                    egui::Label::new(
                        egui::RichText::new("Reset")
                            .font(theme::f_sb(12.0))
                            .color(p.accent),
                    )
                    .sense(egui::Sense::click()),
                )
                .on_hover_cursor(egui::CursorIcon::PointingHand)
                .clicked()
            {
                ui.ctx().set_zoom_factor(theme::ZOOM_DEFAULT);
                self.zoom_pending = None;
                self.zoom_commit_at = None;
            }
        }
    }

    /// Left device bar: header · filter · rows · footer tip.
    fn device_sidebar(&mut self, root_ui: &mut egui::Ui, p: &Palette) {
        egui::Panel::left("devices")
            .exact_size(286.0)
            .resizable(false)
            .frame(panel_frame(p.side, 14.0, 12.0))
            .show(root_ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("DEVICES")
                            .font(theme::f_bold(11.0))
                            .color(p.txt3),
                    );
                    ui.add_space(6.0);
                    theme::pill(ui, &self.devices.len().to_string(), p.txt2, p.raised2);
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        let (rrect, rresp) =
                            ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                        paint_refresh_icon(ui, rrect.center(), 6.5, p.txt2);
                        if rresp
                            .on_hover_text("Rescan")
                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                            .clicked()
                        {
                            self.schedule_scan_burst();
                        }
                    });
                });
                ui.add_space(8.0);
                ui.add(
                    egui::TextEdit::singleline(&mut self.filter)
                        .hint_text("Filter keys\u{2026}")
                        .desired_width(f32::INFINITY),
                );
                ui.add_space(8.0);

                if let Some(err) = &self.devices_error {
                    ui.colored_label(p.err, err);
                    ui.add_space(6.0);
                }

                let mut clicked: Option<DeviceId> = None;
                egui::ScrollArea::vertical()
                    .auto_shrink([false, false])
                    .show(ui, |ui| {
                        if self.devices.is_empty() {
                            ui.add_space(12.0);
                            ui.vertical_centered(|ui| {
                                ui.label(
                                    egui::RichText::new("No keys detected yet.")
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt3),
                                );
                            });
                        }
                        for dev in self
                            .devices
                            .iter()
                            .filter(|d| matches_filter(d, &self.filter))
                        {
                            let selected = self.selected_device.as_deref() == Some(dev.id.as_str());
                            if device_row(ui, p, dev, selected) {
                                clicked = Some(dev.id.clone());
                            }
                            ui.add_space(2.0);
                        }
                    });
                if let Some(id) = clicked {
                    self.select_device(id);
                }

                // Footer tip (only worth showing once a key is present).
                if !self.devices.is_empty() {
                    ui.with_layout(egui::Layout::bottom_up(egui::Align::Min), |ui| {
                        ui.add_space(4.0);
                        ui.horizontal_wrapped(|ui| {
                            ui.spacing_mut().item_spacing.x = 4.0;
                            ui.label(
                                egui::RichText::new("Several keys plugged in?")
                                    .font(theme::f_reg(12.0))
                                    .color(p.txt3),
                            );
                            ui.hyperlink_to(
                                egui::RichText::new("Give them names")
                                    .font(theme::f_sb(12.0))
                                    .color(p.accent),
                                ui::help::learn_url("/naming"),
                            );
                        });
                    });
                }
            });
    }

    /// Global activity-log drawer (bottom), replacing the Molto2-only log.
    fn activity_log(&mut self, root_ui: &mut egui::Ui, p: &Palette) {
        egui::Panel::bottom("log")
            .resizable(true)
            .default_size(180.0)
            // Enough to still show the header when dragged down; capped so
            // it can't swallow the whole window and crowd out the device
            // pane above it.
            .size_range(96.0..=560.0)
            .frame(panel_frame(p.bar, 16.0, 10.0))
            .show(root_ui, |ui| {
                self.activity_log_body(ui, p, false);
            });
    }

    /// Popped-out activity log: the same body rendered in its own OS window.
    /// Shown every frame while `log_detached`. Closing the window collapses the
    /// log entirely (same end state as the docked "Collapse" button); the
    /// header's "Reattach" button docks it back into the drawer instead.
    fn activity_log_window(&mut self, ctx: &egui::Context, p: &Palette) {
        let mut close_requested = false;
        ctx.show_viewport_immediate(
            activity_log_viewport_id(),
            egui::ViewportBuilder::default()
                .with_title("keyroost \u{2014} Activity log")
                .with_inner_size([620.0, 340.0])
                .with_min_inner_size([340.0, 140.0]),
            |ctx, _class| {
                egui::CentralPanel::default()
                    .frame(panel_frame(p.bar, 16.0, 10.0))
                    .show(ctx, |ui| {
                        self.activity_log_body(ui, p, true);
                    });
                if ctx.input(|i| i.viewport().close_requested()) {
                    close_requested = true;
                }
            },
        );
        if close_requested {
            // The window's close button collapses the log outright, rather
            // than dropping it back into the docked drawer.
            self.log_open = false;
            self.log_detached = false;
        }
    }

    /// The activity log's contents — header row plus the scrolling entry list —
    /// shared by the docked drawer and the popped-out window. `detached` picks
    /// the outer-right window control: the detach icon (plus "Collapse") when
    /// docked, its mirror image — the reattach icon — when popped out.
    fn activity_log_body(&mut self, ui: &mut egui::Ui, p: &Palette, detached: bool) {
        ui.horizontal(|ui| {
            ui.label(
                egui::RichText::new("ACTIVITY LOG")
                    .font(theme::f_bold(11.0))
                    .color(p.txt3),
            );
            ui.add_space(6.0);
            theme::pill(ui, "live", p.ok, p.ok_soft());
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                // Window control at the outer right in both states: an icon-only
                // affordance (detach glyph / its mirror) rather than a verb in
                // the row of text actions. The hit box is a full button-height
                // 32px tall so `Align::Center` lines the 18px glyph up with the
                // adjacent buttons and the "APDU trace" checkbox — a bare 18px
                // rect, allocated first in this row, centres against the row
                // before the buttons have grown it and ends up sitting high.
                let (wrect, wresp) =
                    ui.allocate_exact_size(egui::vec2(18.0, 32.0), egui::Sense::click());
                if detached {
                    paint_reattach_icon(ui, wrect.center(), p.txt2);
                    if wresp
                        .on_hover_text("Dock back into the main window")
                        .on_hover_cursor(egui::CursorIcon::PointingHand)
                        .clicked()
                    {
                        self.log_detached = false;
                    }
                } else {
                    paint_detach_icon(ui, wrect.center(), p.txt2);
                    if wresp
                        .on_hover_text("Open in a separate window")
                        .on_hover_cursor(egui::CursorIcon::PointingHand)
                        .clicked()
                    {
                        self.log_detached = true;
                    }
                    ui.add_space(6.0);
                    if theme::button(ui, p, BtnKind::Ghost, "Collapse").clicked() {
                        self.log_open = false;
                    }
                }
                ui.add_space(4.0);
                if theme::button(ui, p, BtnKind::Ghost, "Clear").clicked() {
                    // Drop every entry (and its APDU trace); the next device
                    // operation starts the log fresh.
                    self.log.clear();
                }
                ui.add_space(4.0);
                if theme::button(ui, p, BtnKind::Ghost, "Copy").clicked() {
                    // Traces ride along, indented under the entry they
                    // belong to — the point of the APDU trace is
                    // having the exact wire exchange to paste, not
                    // just the summary.
                    let all = self
                        .log
                        .iter()
                        .map(|l| match &l.trace {
                            Some(t) if !t.is_empty() => format!(
                                "{}\n{}",
                                l.text,
                                t.iter()
                                    .map(|apdu| format!("    {apdu}"))
                                    .collect::<Vec<_>>()
                                    .join("\n")
                            ),
                            _ => l.text.clone(),
                        })
                        .collect::<Vec<_>>()
                        .join("\n");
                    ui.ctx().copy_text(all);
                    // The user copied non-secret log text over the
                    // code; a pending auto-clear would clobber it.
                    self.clipboard_clear_at = None;
                }
                ui.add_space(10.0);
                // Runtime toggle for the worker thread's APDU capture
                // (see `Worker::spawn`) — no CLI flag, no restart:
                // flip it, and the very next device operation's trace
                // shows up under its log entry.
                let mut trace_on = self.apdu_trace.load(std::sync::atomic::Ordering::Relaxed);
                if ui.checkbox(&mut trace_on, "APDU trace").changed() {
                    self.apdu_trace
                        .store(trace_on, std::sync::atomic::Ordering::Relaxed);
                }
            });
        });
        ui.add_space(6.0);
        egui::ScrollArea::vertical()
            .stick_to_bottom(true)
            .auto_shrink([false, false])
            .show(ui, |ui| {
                for line in self.log.iter_mut() {
                    let base = match line.severity {
                        Severity::Ok => p.ok,
                        Severity::Warn => p.warn,
                        Severity::Err => p.err,
                        Severity::Info => p.txt2,
                    };
                    // User actions render exactly as every explicit
                    // Molto2 action always has: full-strength severity
                    // color, no prefix. Background entries — a device
                    // scan, a tab's initial status sweep, a re-read
                    // that follows a write — are alpha-muted toward
                    // the panel and get a leading "·", so the
                    // distinction survives colorblind palettes too and
                    // never reads as though the user just did
                    // something.
                    let (color, prefix, size) = match line.kind {
                        LogKind::User => (base, "", 12.0),
                        LogKind::Background => (theme::tint(base, 130), "\u{b7} ", 11.5),
                    };
                    ui.label(
                        egui::RichText::new(format!("{prefix}{}", line.text))
                            .font(theme::f_mono(size))
                            .color(color),
                    );
                    // APDU trace ("APDU trace" checkbox above):
                    // printed exactly like the CLI's own `--debug`
                    // output — the same formatted lines, captured
                    // verbatim (see `keyroost_transport::trace`) —
                    // indented under the entry they belong to.
                    if let Some(trace) = line.trace.as_ref() {
                        for apdu in trace {
                            ui.label(
                                egui::RichText::new(format!("    {apdu}"))
                                    .font(theme::f_mono(10.5))
                                    .color(p.txt3),
                            );
                        }
                    }
                }
            });
    }

    /// The central pane: empty state, the Molto2 token view, or the selected
    /// key's hero + capability tabs + active capability panel.
    fn central(&mut self, root_ui: &mut egui::Ui, p: &Palette) {
        egui::CentralPanel::default()
            .frame(panel_frame(p.surface, 0.0, 0.0))
            .show(root_ui, |ui| {
                match self.selected_device().cloned() {
                    None => self.empty_state(ui, p),
                    Some(dev) if dev.kind == DeviceKind::Token => self.molto_view(ui, p, &dev),
                    Some(dev) if dev.kind == DeviceKind::ProgToken => self.prog_view(ui, p, &dev),
                    Some(dev) => {
                        // Cap the content column to a readable width and center it.
                        // At wide window sizes a full-width card flings its label to
                        // the far left and its action to the far right, opening a dead
                        // gap in the middle that makes a row hard to read as one unit.
                        // A symmetric margin that grows past the base 26px once the
                        // pane exceeds ~920px keeps every pane (hero, tabs, cards) in
                        // one centered, legible column instead of stretching edge to
                        // edge — and removes the lopsided empty space on one side.
                        let hmargin = (((ui.available_width() - 920.0) * 0.5).max(26.0)).round();
                        egui::Frame::NONE
                            .inner_margin(egui::Margin::symmetric(hmargin as i8, 16))
                            .show(ui, |ui| {
                                self.device_hero(ui, p, &dev);
                                self.cap_tabs(ui, p, &dev);
                                ui.add_space(16.0);
                                // Hero + tabs stay pinned; the active pane scrolls.
                                // This is the one place every capability pane gets
                                // its overflow handling — a card-heavy OpenPGP pane
                                // or a key holding dozens of passkeys/TOTP codes
                                // scrolls instead of clipping at the window edge.
                                // Salted per tab so each pane keeps its own
                                // scroll position.
                                //
                                // Solid (space-reserving) scroll bars are the
                                // app-wide default set in `theme::Palette::apply`
                                // — no local override needed here. That default
                                // is what keeps this bar from floating over the
                                // cards' right edge (it used to sit on top of
                                // card borders and the panes' top-right action
                                // buttons).
                                egui::ScrollArea::vertical()
                                    .id_salt(("cap-pane", self.cap_tab as u8))
                                    .auto_shrink([false, false])
                                    .show(ui, |ui| {
                                        match self.cap_tab {
                                            CapTab::Overview => self.overview(ui, p, &dev),
                                            CapTab::Fido2 => self.cap_fido2(ui, p),
                                            CapTab::Oath => self.cap_oath(ui, p),
                                            CapTab::Pgp => self.cap_pgp(ui, p),
                                            CapTab::Piv => self.cap_piv(ui, p),
                                            CapTab::Otp => self.cap_otp(ui, p),
                                        }
                                        // Breathing room below the last card.
                                        ui.add_space(18.0);
                                    });
                            });
                    }
                }
            });
    }

    /// Welcoming first-run state shown when nothing is plugged in.
    fn empty_state(&mut self, ui: &mut egui::Ui, p: &Palette) {
        // Manually center a fixed-width column. `vertical_centered` doesn't
        // reliably center nested rows (a `horizontal` fills full width and
        // left-aligns), which is what jammed the buttons against the divider.
        let col_w = 440.0_f32;
        let pad = ((ui.available_width() - col_w) * 0.5).max(12.0);
        ui.add_space(90.0);
        ui.horizontal(|ui| {
            ui.add_space(pad);
            ui.allocate_ui_with_layout(
                egui::vec2(col_w, ui.available_height()),
                egui::Layout::top_down(egui::Align::Center),
                |ui| {
                    let (rect, _) = ui.allocate_exact_size(egui::vec2(64.0, 64.0), egui::Sense::hover());
                    ui.painter().rect_stroke(
                        rect,
                        egui::CornerRadius::same(16),
                        egui::Stroke::new(1.5, p.line),
                        egui::StrokeKind::Inside,
                    );
                    ui.painter().text(
                        rect.center(),
                        egui::Align2::CENTER_CENTER,
                        "\u{1F511}",
                        theme::f_reg(26.0),
                        p.txt3,
                    );
                    ui.add_space(18.0);
                    ui.label(egui::RichText::new("Plug in a security key to begin").font(theme::f_bold(19.0)).color(p.txt));
                    ui.add_space(8.0);
                    ui.label(
                        egui::RichText::new(
                            "keyroost manages YubiKeys, Nitrokeys, SoloKeys and Token2 tokens. Connect one over USB and it shows up in the list on the left.",
                        )
                        .font(theme::f_reg(13.0))
                        .color(p.txt2),
                    );
                    ui.add_space(22.0);
                    // Numbered steps: left-aligned within the centered column.
                    ui.allocate_ui_with_layout(egui::vec2(360.0, 0.0), egui::Layout::top_down(egui::Align::Min), |ui| {
                        for (n, step) in [
                            "Insert your key into a USB port",
                            "It appears in the Devices list automatically",
                            "Select it to view and manage everything it can do",
                        ]
                        .iter()
                        .enumerate()
                        {
                            ui.horizontal(|ui| {
                                let (badge, _) = ui.allocate_exact_size(egui::vec2(22.0, 22.0), egui::Sense::hover());
                                ui.painter().circle_filled(badge.center(), 11.0, p.accent_soft());
                                ui.painter().text(
                                    badge.center(),
                                    egui::Align2::CENTER_CENTER,
                                    format!("{}", n + 1),
                                    theme::f_sb(12.0),
                                    p.accent,
                                );
                                ui.add_space(10.0);
                                ui.label(egui::RichText::new(*step).font(theme::f_reg(13.0)).color(p.txt));
                            });
                            ui.add_space(10.0);
                        }
                    });
                    ui.add_space(14.0);
                    ui.horizontal(|ui| {
                        if theme::button(ui, p, BtnKind::Primary, "Scan for devices").clicked() {
                            self.schedule_scan_burst();
                        }
                        ui.add_space(8.0);
                        ui.hyperlink_to(
                            egui::RichText::new("Supported devices \u{2197}").font(theme::f_sb(12.5)).color(p.accent),
                            ui::help::learn_url("/devices"),
                        );
                    });
                    // Be honest on platforms without a HID backend yet: a plugged-in
                    // FIDO key simply won't appear, so say why rather than letting
                    // the user think it's broken.
                    if !keyroost_hid::hid_supported() {
                        ui.add_space(16.0);
                        ui.label(
                            egui::RichText::new(
                                "Note: FIDO / passkey security keys aren't supported on this platform yet. Smart-card features (OATH, OpenPGP, PIV, Token2 Molto2) work over PC/SC.",
                            )
                            .font(theme::f_reg(12.5))
                            .color(p.txt3),
                        );
                    }
                },
            );
        });
    }

    /// Device hero strip at the top of a key's pane.
    fn device_hero(&mut self, ui: &mut egui::Ui, p: &Palette, dev: &Device) {
        let mut open_rename = false;
        let mut do_save = false;
        let mut do_cancel = false;
        ui.horizontal(|ui| {
            glyph_tile(ui, 46.0, p.raised2, p.txt2, Some(dev.vendor.chars().next().unwrap_or('?').to_ascii_uppercase()));
            ui.add_space(12.0);
            ui.vertical(|ui| {
                ui.horizontal(|ui| {
                    if self.rename_target.is_some() {
                        let resp = ui.add_sized(
                            [200.0, 32.0],
                            egui::TextEdit::singleline(&mut self.rename_input)
                                .vertical_align(egui::Align::Center)
                                .hint_text("friendly-name"),
                        );
                        let enter = resp.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
                        if theme::button(ui, p, BtnKind::Primary, "Save").clicked() || enter {
                            do_save = true;
                        }
                        ui.add_space(4.0);
                        if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                            do_cancel = true;
                        }
                    } else {
                        ui.label(egui::RichText::new(dev.title()).font(theme::f_bold(21.0)).color(p.txt));
                        ui.add_space(5.0);
                        self.help_dot(ui, p, "device");
                        ui.add_space(8.0);
                        let label = if dev.name.is_some() { "Rename" } else { "Name this key" };
                        if ui
                            .add(
                                egui::Label::new(egui::RichText::new(label).font(theme::f_sb(12.0)).color(p.accent))
                                    .sense(egui::Sense::click()),
                            )
                            .clicked()
                        {
                            open_rename = true;
                        }
                    }
                });
                if self.rename_target.is_some() {
                    ui.add_space(3.0);
                    ui.label(
                        egui::RichText::new(
                            "Saves this key's serial with the name to keys.json on this computer \u{2014} nothing leaves your machine. Up to 64 characters.",
                        )
                        .font(theme::f_reg(11.5))
                        .color(p.txt3),
                    );
                }
                ui.add_space(2.0);
                let serial = if dev.serial.is_empty() { "\u{2014}".to_string() } else { dev.serial.clone() };
                let mut meta = format!("{} \u{00B7} #{} \u{00B7} {}", dev.vendor, serial, dev.transport);
                if !dev.firmware.is_empty() {
                    meta.push_str(&format!(" \u{00B7} fw {}", dev.firmware));
                }
                ui.label(egui::RichText::new(meta).font(theme::f_reg(12.5)).color(p.txt2));
            });
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                ui.label(egui::RichText::new("Connected").font(theme::f_sb(12.5)).color(p.txt2));
                ui.add_space(5.0);
                theme::status_dot(ui, p.ok, 8.0);
            });
        });
        self.apply_rename_actions(dev, open_rename, do_cancel, do_save);
        ui.add_space(14.0);
        let y = ui.cursor().top();
        ui.painter()
            .hline(ui.max_rect().x_range(), y, egui::Stroke::new(1.0, p.line));
    }

    /// Capability tab bar under the hero. The active tab gets `txt` + an accent
    /// underline; the rest are muted.
    fn cap_tabs(&mut self, ui: &mut egui::Ui, p: &Palette, dev: &Device) {
        // A per-device remembered pick (or a device swap under an unchanged
        // selection) can be stale for this device — see `snap_cap_tab`'s doc.
        self.cap_tab = snap_cap_tab(self.cap_tab, &dev.tabs());
        ui.add_space(12.0);
        let mut next = None;
        ui.horizontal(|ui| {
            ui.spacing_mut().item_spacing.x = 20.0;
            for t in dev.tabs() {
                let active = self.cap_tab == t;
                let color = if active { p.txt } else { p.txt3 };
                // A capability keyroost could not check against the device
                // gets a quiet "?" — the tab works exactly the same, the
                // marker only keeps an offer from reading as verified fact.
                let unverified = dev.tab_unverified(t);
                let label = if unverified {
                    format!("{} ?", cap_tab_label(t))
                } else {
                    cap_tab_label(t).to_string()
                };
                let mut resp = ui
                    .add(
                        egui::Label::new(
                            egui::RichText::new(label)
                                .font(theme::f_sb(13.5))
                                .color(color),
                        )
                        .sense(egui::Sense::click()),
                    )
                    .on_hover_cursor(egui::CursorIcon::PointingHand);
                if unverified {
                    resp = resp.on_hover_text(
                        "Not verified: no smart-card reader was available to \
                         confirm this feature on the key (reader missing or the \
                         smart-card service is not running). It is offered \
                         anyway — using it gives a definite answer.",
                    );
                }
                if active {
                    let y = resp.rect.bottom() + 6.0;
                    ui.painter().line_segment(
                        [
                            egui::pos2(resp.rect.left(), y),
                            egui::pos2(resp.rect.right(), y),
                        ],
                        egui::Stroke::new(2.0, p.accent),
                    );
                }
                if resp.clicked() {
                    next = Some(t);
                }
            }
        });
        if let Some(t) = next {
            self.cap_tab = t;
        }
    }

    /// A card header row: title · "?" help · right-aligned "Manage →". Returns
    /// true when Manage is clicked (caller switches `cap_tab`).
    fn card_head(
        &mut self,
        ui: &mut egui::Ui,
        p: &Palette,
        title: &str,
        topic: &'static str,
    ) -> bool {
        let mut go = false;
        ui.horizontal(|ui| {
            ui.label(
                egui::RichText::new(title)
                    .font(theme::f_sb(14.5))
                    .color(p.txt),
            );
            ui.add_space(6.0);
            self.help_dot(ui, p, topic);
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                if ui
                    .add(
                        egui::Label::new(
                            egui::RichText::new("Manage \u{2192}")
                                .font(theme::f_sb(12.5))
                                .color(p.accent),
                        )
                        .sense(egui::Sense::click()),
                    )
                    .on_hover_cursor(egui::CursorIcon::PointingHand)
                    .clicked()
                {
                    go = true;
                }
            });
        });
        go
    }

    /// Device-metadata card (FIDO Metadata Service): vendor icon, description,
    /// and certification status for the selected key's AAGUID. Shown only when
    /// the AAGUID is known to the MDS dataset. Renders nothing otherwise so it
    /// doesn't clutter the overview for unknown keys.
    fn mds_card(&mut self, ui: &mut egui::Ui, p: &Palette, _dev: &Device) {
        let Some(aaguid) = self.security_keys.info.as_ref().map(|i| i.aaguid) else {
            return;
        };
        // Look up first; clone the few fields we render so we don't hold an
        // immutable borrow of `self.mds` across the icon-texture mutation.
        let Some(entry) = self.mds.get(&aaguid).cloned() else {
            return;
        };
        let key = ui::aaguid::format_aaguid_pub(&aaguid);
        // Live versions reported by the device's authenticatorGetInfo, preferred
        // over the MDS statement's copy since they describe the actual unit.
        let device_versions: Vec<String> = self
            .security_keys
            .info
            .as_ref()
            .map(|i| i.versions.clone())
            .unwrap_or_default();

        // Decode + upload the icon once per AAGUID, cached in `self.mds_icon`.
        if let Some(icon_uri) = entry.icon.as_deref() {
            let need = self
                .mds_icon
                .as_ref()
                .map(|(k, _)| k != &key)
                .unwrap_or(true);
            if need {
                if let Some(img) = ui::mds::decode_icon(icon_uri) {
                    let tex = ui.ctx().load_texture(
                        format!("mds-icon-{key}"),
                        img,
                        egui::TextureOptions::LINEAR,
                    );
                    self.mds_icon = Some((key.clone(), tex));
                } else {
                    self.mds_icon = None;
                }
            }
        } else {
            self.mds_icon = None;
        }

        theme::card_frame(p).show(ui, |ui| {
            // Claim the full row width so this card matches the capability cards
            // below it (which stretch via their right-aligned "Manage" header).
            ui.set_min_width(ui.available_width());
            self.card_head_plain(ui, p, "Device metadata (FIDO MDS)", "mds");
            ui.add_space(8.0);
            ui.horizontal(|ui| {
                if let Some((k, tex)) = &self.mds_icon {
                    if k == &key {
                        let side = 44.0;
                        ui.add(
                            egui::Image::from_texture(tex)
                                .fit_to_exact_size(egui::vec2(side, side)),
                        );
                        ui.add_space(12.0);
                    }
                }
                ui.vertical(|ui| {
                    if !entry.description.is_empty() {
                        ui.label(
                            egui::RichText::new(&entry.description)
                                .font(theme::f_sb(14.0))
                                .color(p.txt),
                        );
                        ui.add_space(3.0);
                    }
                    // Certification badge (level highlighted) + advisory flag.
                    if let Some(label) = entry.certification_label() {
                        let (fg, bg) = if entry.is_advisory() {
                            (p.err, p.warn_soft())
                        } else {
                            (p.ok, p.ok_soft())
                        };
                        theme::pill(ui, &label, fg, bg);
                    }
                });
            });

            ui.add_space(12.0);

            // Short fields go into a two-column grid (label/value pairs, two
            // pairs per row) so the card fills its width and columns align.
            // Long fields (Versions, AAGUID) get their own full-width rows below.
            let mut pairs: Vec<(&str, String)> = Vec::new();
            if let Some(lvl) = entry.certification_level() {
                pairs.push(("Certification level", lvl.to_string()));
            }
            if let Some(date) = &entry.effective_date {
                let d = date.split(['T', ' ']).next().unwrap_or(date);
                pairs.push(("Certified since", d.to_string()));
            }
            if let Some(fam) = &entry.protocol_family {
                pairs.push(("Protocol family", fam.clone()));
            }

            // Lay the short fields out as tight "label  value" cells distributed
            // across the card width. Pick 1-3 columns based on available width so
            // each value sits right next to its label and the row stays filled.
            let avail = ui.available_width();
            let cols = if avail >= 760.0 {
                3
            } else if avail >= 470.0 {
                2
            } else {
                1
            };
            let cell_w = (avail - 18.0 * (cols as f32 - 1.0)) / cols as f32;
            egui::Grid::new("mds-meta-grid")
                .num_columns(cols)
                .spacing(egui::vec2(18.0, 10.0))
                .min_col_width(0.0)
                .show(ui, |ui| {
                    for (i, (k, v)) in pairs.iter().enumerate() {
                        mds_cell(ui, p, k, v, cell_w);
                        if (i + 1) % cols == 0 {
                            ui.end_row();
                        }
                    }
                    if !pairs.len().is_multiple_of(cols) {
                        ui.end_row();
                    }
                });

            // Long, full-width fields.
            let versions = if !device_versions.is_empty() {
                device_versions
            } else {
                entry.mds_versions.clone()
            };
            ui.add_space(8.0);
            if !versions.is_empty() {
                mds_kv(ui, p, "Versions", &versions.join(", "));
            }
            mds_kv(ui, p, "AAGUID", &key);
        });
        ui.add_space(14.0);
    }

    /// Card header with no "Manage →" affordance (for read-only info cards).
    fn card_head_plain(
        &mut self,
        ui: &mut egui::Ui,
        p: &Palette,
        title: &str,
        topic: &'static str,
    ) {
        ui.horizontal(|ui| {
            ui.label(
                egui::RichText::new(title)
                    .font(theme::f_sb(14.5))
                    .color(p.txt),
            );
            ui.add_space(6.0);
            self.help_dot(ui, p, topic);
        });
    }

    /// Overview tab: one summary card per capability, each with a `Manage →` jump.
    /// Scrolling comes from the shared capability-pane scroller in `central`.
    fn overview(&mut self, ui: &mut egui::Ui, p: &Palette, dev: &Device) {
        ui.vertical(|ui| {
            self.mds_card(ui, p, dev);
            if dev.caps.has(Caps::FIDO2) {
                theme::card_frame(p).show(ui, |ui| {
                    if self.card_head(ui, p, "Passkeys & sign-in (FIDO2)", "fido2") {
                        self.cap_tab = CapTab::Fido2;
                    }
                    ui.add_space(8.0);
                    // Windows non-admin: FIDO access is gated, so `info` never
                    // loads; show an admin-needed hint instead of a perpetual
                    // "Reading key…". The Manage → jump opens the full card.
                    #[cfg(windows)]
                    let non_admin = self.security_keys.info.is_none()
                        && keyroost_winwebauthn::fido_key_present();
                    #[cfg(not(windows))]
                    let non_admin = false;
                    if non_admin {
                        theme::pill(ui, "Administrator rights needed", p.warn, p.warn_soft());
                        ui.add_space(6.0);
                        ui.label(
                            egui::RichText::new(
                                "Open the FIDO2 tab to manage this key via Windows \
                                 settings or restart as administrator.",
                            )
                            .font(theme::f_reg(13.0))
                            .color(p.txt2),
                        );
                    } else {
                        match self
                            .security_keys
                            .info
                            .as_ref()
                            .and_then(|i| i.option("clientPin"))
                        {
                            Some(true) => {
                                ui.horizontal(|ui| {
                                    theme::pill(ui, "PIN set", p.ok, p.ok_soft());
                                    ui.add_space(8.0);
                                    ui.label(
                                        egui::RichText::new(
                                            "PIN configured \u{00B7} ready for passkeys",
                                        )
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt2),
                                    );
                                });
                            }
                            Some(false) => {
                                theme::pill(ui, "No PIN configured", p.warn, p.warn_soft());
                            }
                            None => {
                                ui.label(
                                    egui::RichText::new("Reading key\u{2026}")
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt3),
                                );
                            }
                        }
                    }
                });
                ui.add_space(14.0);
            }
            if dev.caps.has(Caps::OATH) {
                theme::card_frame(p).show(ui, |ui| {
                    if self.card_head(ui, p, "Authenticator codes (OATH)", "oath") {
                        self.cap_tab = CapTab::Oath;
                    }
                    ui.add_space(8.0);
                    if self.oath.loaded && !self.oath.creds.is_empty() {
                        let total = self.oath.creds.len();
                        let mut copy = None;
                        for row in self.oath.creds.iter().take(2) {
                            let is_copied =
                                self.copied.as_ref().is_some_and(|(n, _)| n == &row.name);
                            if let (Some(code), _, _) = oath_row(
                                ui,
                                p,
                                &row.name,
                                row.code.as_deref(),
                                row.hotp,
                                is_copied,
                                false,
                            ) {
                                copy = Some((row.name.clone(), code));
                            }
                            ui.add_space(6.0);
                        }
                        if total > 2 {
                            ui.label(
                                egui::RichText::new(format!("+{} more codes", total - 2))
                                    .font(theme::f_reg(12.5))
                                    .color(p.txt3),
                            );
                        }
                        if let Some((name, code)) = copy {
                            ui.ctx().copy_text(code.clone());
                            self.copied = Some((name, now_secs_f64() + 1.2));
                            self.clipboard_clear_at = Some((code, now_secs_f64() + 45.0));
                        }
                    } else {
                        ui.label(
                            egui::RichText::new("Open Authenticator to view live codes.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt3),
                        );
                    }
                });
                ui.add_space(14.0);
            }
            if dev.caps.has(Caps::PGP) {
                theme::card_frame(p).show(ui, |ui| {
                    if self.card_head(ui, p, "OpenPGP", "pgp") {
                        self.cap_tab = CapTab::Pgp;
                    }
                    ui.add_space(8.0);
                    if let Some(st) = &self.openpgp.status {
                        ui.horizontal_wrapped(|ui| {
                            ui.spacing_mut().item_spacing.x = 5.0;
                            theme::pill(
                                ui,
                                &format!(
                                    "Signature \u{00B7} {}",
                                    slot_summary(&st.sig_attrs, &st.fingerprint_sig)
                                ),
                                p.txt2,
                                p.raised2,
                            );
                            theme::pill(
                                ui,
                                &format!(
                                    "Encryption \u{00B7} {}",
                                    slot_summary(&st.dec_attrs, &st.fingerprint_dec)
                                ),
                                p.txt2,
                                p.raised2,
                            );
                            theme::pill(
                                ui,
                                &format!(
                                    "Auth \u{00B7} {}",
                                    slot_summary(&st.aut_attrs, &st.fingerprint_aut)
                                ),
                                p.txt2,
                                p.raised2,
                            );
                        });
                    } else {
                        ui.label(
                            egui::RichText::new("Open OpenPGP and Read status to view key slots.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt3),
                        );
                    }
                });
                ui.add_space(14.0);
            }
            if dev.caps.has(Caps::PIV) {
                theme::card_frame(p).show(ui, |ui| {
                    if self.card_head(ui, p, "PIV smart card", "piv") {
                        self.cap_tab = CapTab::Piv;
                    }
                    ui.add_space(8.0);
                    if let Some(st) = &self.piv.status {
                        ui.horizontal_wrapped(|ui| {
                            ui.spacing_mut().item_spacing.x = 5.0;
                            for slot in &st.slots {
                                let lab = format!(
                                    "{:02X} \u{00B7} {}",
                                    slot.slot.key_ref(),
                                    if slot.cert_unreadable.is_some() {
                                        "unreadable cert"
                                    } else if slot.cert_present {
                                        "cert"
                                    } else {
                                        "empty"
                                    }
                                );
                                theme::pill(ui, &lab, p.txt2, p.raised2);
                            }
                        });
                    } else {
                        ui.label(
                            egui::RichText::new("Open PIV to read certificate slots.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt3),
                        );
                    }
                });
            }
            if dev.caps.has(Caps::OTP) {
                ui.add_space(14.0);
                theme::card_frame(p).show(ui, |ui| {
                    if self.card_head(ui, p, "On-device OTP", "otp") {
                        self.cap_tab = CapTab::Otp;
                    }
                    ui.add_space(8.0);
                    if self.otp.loaded && !self.otp.rows.is_empty() {
                        let total = self.otp.rows.len();
                        for row in self.otp.rows.iter().take(2) {
                            let label = if row.account_name.is_empty() {
                                row.app_name.clone()
                            } else {
                                format!("{} \u{00B7} {}", row.app_name, row.account_name)
                            };
                            ui.horizontal(|ui| {
                                theme::pill(ui, row.type_str, p.txt2, p.raised2);
                                ui.label(
                                    egui::RichText::new(label)
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt2),
                                );
                            });
                            ui.add_space(4.0);
                        }
                        if total > 2 {
                            ui.label(
                                egui::RichText::new(format!("+{} more entries", total - 2))
                                    .font(theme::f_reg(12.5))
                                    .color(p.txt3),
                            );
                        }
                    } else {
                        ui.label(
                            egui::RichText::new("Open On-device OTP to view stored entries.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt3),
                        );
                    }
                });
            }
            // Whole-device factory reset — offered only for a Key (Molto2 keeps
            // its own reset in its pane; a bare ProgToken has no resettable
            // applet, so its plan is empty and no card renders).
            if dev.kind == DeviceKind::Key {
                let plan = keyroost_resolve::factory_reset_plan(dev.caps);
                if !plan.is_empty() {
                    ui.add_space(14.0);
                    let mut arm = false;
                    theme::card_frame(p)
                        .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
                        .show(ui, |ui| {
                            ui.horizontal(|ui| {
                                ui.label(
                                    egui::RichText::new("Factory reset")
                                        .font(theme::f_sb(14.5))
                                        .color(p.err),
                                );
                                ui.with_layout(
                                    egui::Layout::right_to_left(egui::Align::Center),
                                    |ui| {
                                        if theme::button(
                                            ui,
                                            p,
                                            BtnKind::Danger,
                                            "Factory reset\u{2026}",
                                        )
                                        .clicked()
                                        {
                                            arm = true;
                                        }
                                    },
                                );
                            });
                            ui.label(
                                egui::RichText::new(format!(
                                    "Resets every applet on this key ({}) to factory state. \
                                     Each step reports on its own \u{2014} anything that \
                                     doesn't complete is listed below.",
                                    plan.iter()
                                        .map(|s| s.label())
                                        .collect::<Vec<_>>()
                                        .join(", ")
                                ))
                                .font(theme::f_reg(12.5))
                                .color(p.txt2),
                            );
                            // Live per-step report while a reset runs (or its
                            // outcome afterwards, until the selection changes).
                            if !self.factory_reset_report.is_empty() {
                                ui.add_space(8.0);
                                for row in &self.factory_reset_report {
                                    let (text, tone) = factory_reset_row_line(row);
                                    let color = match tone {
                                        RowTone::Done => p.ok,
                                        RowTone::Waiting | RowTone::Warn => p.warn,
                                        RowTone::Bad => p.err,
                                        RowTone::Muted => p.txt3,
                                    };
                                    ui.label(
                                        egui::RichText::new(text)
                                            .font(theme::f_reg(12.5))
                                            .color(color),
                                    );
                                }
                            }
                        });
                    if arm {
                        self.start_factory_reset_confirm();
                    }
                }
            }
        });
    }

    /// FIDO2 / Passkeys tab — reuses the existing PIN + credentials section.
    /// Windows non-admin FIDO2 card: explain the admin requirement and offer to
    /// open Windows' security-key settings (PIN / reset / biometrics work there
    /// without elevation) or restart keyroost as administrator for full
    /// management here. Only built on Windows; the helper is inert elsewhere.
    #[cfg(windows)]
    fn fido2_non_admin_card(&mut self, ui: &mut egui::Ui, p: &Palette) {
        theme::card_frame(p).show(ui, |ui| {
            ui.label(
                egui::RichText::new("Administrator rights needed")
                    .font(theme::f_sb(14.5))
                    .color(p.txt),
            );
            ui.add_space(8.0);
            ui.label(
                egui::RichText::new(
                    "A security key is connected, but managing its FIDO2 settings \
                     (PIN, passkeys, reset, fingerprints) in this app requires \
                     administrator rights on Windows.",
                )
                .font(theme::f_reg(13.0))
                .color(p.txt2),
            );
            ui.add_space(4.0);
            ui.label(
                egui::RichText::new(
                    "Change the PIN, manage biometrics or reset the key without \
                     admin rights using Windows' built-in security-key settings, \
                     or restart this app as administrator for full management here.",
                )
                .font(theme::f_reg(13.0))
                .color(p.txt2),
            );
            ui.add_space(12.0);
            ui.horizontal(|ui| {
                if theme::button(
                    ui,
                    p,
                    BtnKind::Primary,
                    "Open Windows security-key settings",
                )
                .clicked()
                {
                    if let Err(e) = keyroost_winwebauthn::open_windows_security_key_settings() {
                        self.security_keys.error =
                            Some(format!("Couldn't open Windows security-key settings: {e}"));
                    }
                }
                if theme::button(ui, p, BtnKind::Default, "Restart as administrator").clicked() {
                    match keyroost_winwebauthn::relaunch_as_admin() {
                        // Elevated instance requested: exit this non-elevated one
                        // so only the admin process remains.
                        Ok(()) => std::process::exit(0),
                        Err(e) => {
                            self.security_keys.error =
                                Some(format!("Couldn't restart as administrator: {e}"));
                        }
                    }
                }
            });
        });
    }

    fn cap_fido2(&mut self, ui: &mut egui::Ui, p: &Palette) {
        // Non-admin Windows: if a FIDO key is present but we have no working FIDO
        // access (the HID interface is gated), show the admin-needed card with a
        // link to Windows' settings and an elevate button, instead of the normal
        // — and here non-functional — management UI.
        #[cfg(windows)]
        {
            let no_access = self.security_keys.info.is_none();
            if no_access && keyroost_winwebauthn::fido_key_present() {
                self.fido2_non_admin_card(ui, p);
                return;
            }
        }

        let pin = pin_support(self.security_keys.info.as_ref());

        // --- PIN & sign-in card (inline Set / Change PIN; no floating modal) ---
        let mut go_set = false;
        let mut go_change = false;
        let mut cancel = false;
        theme::card_frame(p).show(ui, |ui| {
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("PIN & sign-in")
                        .font(theme::f_sb(14.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pin");
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    let (kind, label) = match pin {
                        PinSupport::Set => (BtnKind::Default, "Change PIN"),
                        PinSupport::NotSet => (BtnKind::Primary, "Set a PIN"),
                        // Unknown (still reading) or no PIN feature at all:
                        // nothing to offer.
                        PinSupport::Unknown | PinSupport::Unsupported => return,
                    };
                    if theme::button(ui, p, kind, label).clicked() {
                        let open = !self.security_keys.change_pin.open;
                        // Replacing the dialog drops the old one, whose Drop
                        // zeroizes any typed PINs; then restore the toggle state.
                        self.security_keys.change_pin = ChangePinDialog::default();
                        self.security_keys.change_pin.open = open;
                        self.security_keys.error = None;
                    }
                    // Lock the whole session here, where the lock/unlock state
                    // lives — locking ends access to passkeys, fingerprints and
                    // settings alike, so it doesn't belong inside one panel.
                    if self.security_keys.session.is_some() {
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Ghost, "Lock").clicked() {
                            self.lock_session();
                        }
                    }
                });
            });
            ui.add_space(8.0);
            match pin {
                PinSupport::Set => {
                    ui.horizontal(|ui| {
                        theme::pill(ui, "PIN set", p.ok, p.ok_soft());
                        ui.add_space(8.0);
                        // Reflect whether the key is already unlocked: once a
                        // session is open, the "unlock below" prompt is stale.
                        let hint = if self.security_keys.session.is_some() {
                            "This key has a PIN."
                        } else {
                            "This key has a PIN. Unlock below to manage it."
                        };
                        ui.label(
                            egui::RichText::new(hint)
                                .font(theme::f_reg(13.0))
                                .color(p.txt2),
                        );
                    });
                }
                PinSupport::NotSet => {
                    ui.horizontal(|ui| {
                        theme::pill(ui, "No PIN yet", p.warn, p.warn_soft());
                        ui.add_space(8.0);
                        ui.label(
                            egui::RichText::new(
                                "Set a PIN to protect this key and turn on passkeys.",
                            )
                            .font(theme::f_reg(13.0))
                            .color(p.txt2),
                        );
                    });
                }
                PinSupport::Unsupported => {
                    // getInfo answered and clientPin isn't in the options map:
                    // the key has no PIN feature. Say so — this state used to
                    // fall into the None arm below and read "Reading key…"
                    // forever.
                    ui.horizontal(|ui| {
                        theme::pill(ui, "No PIN support", p.txt2, p.raised2);
                        ui.add_space(8.0);
                        ui.label(
                            egui::RichText::new("This key does not support a PIN.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt2),
                        );
                    });
                }
                PinSupport::Unknown => {
                    let msg = if self.security_keys.error.is_some() {
                        "Couldn't read this key."
                    } else {
                        // The initial read can be dropped if the worker was
                        // busy at selection time; retry rather than showing
                        // "Reading key…" forever.
                        if self.security_keys.info.is_none() && !self.busy() {
                            self.fetch_selected_info();
                        }
                        "Reading key\u{2026}"
                    };
                    ui.label(
                        egui::RichText::new(msg)
                            .font(theme::f_reg(13.0))
                            .color(p.txt3),
                    );
                }
            }

            if self.security_keys.change_pin.open {
                let setting = pin == PinSupport::NotSet;
                ui.add_space(10.0);
                egui::Frame::NONE
                    .fill(p.raised)
                    .inner_margin(egui::Margin::same(12))
                    .corner_radius(egui::CornerRadius::same(8))
                    .show(ui, |ui| {
                        ui.label(
                            egui::RichText::new(if setting {
                                "Create a PIN"
                            } else {
                                "Change PIN"
                            })
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                        );
                        ui.add_space(8.0);
                        if setting {
                            pin_field(ui, p, "New PIN", &mut self.security_keys.change_pin.new);
                            pin_field(ui, p, "Confirm", &mut self.security_keys.change_pin.confirm);
                        } else {
                            pin_field(ui, p, "Current PIN", &mut self.security_keys.change_pin.old);
                            pin_field(ui, p, "New PIN", &mut self.security_keys.change_pin.new);
                            pin_field(
                                ui,
                                p,
                                "Confirm new PIN",
                                &mut self.security_keys.change_pin.confirm,
                            );
                        }
                        ui.add_space(8.0);
                        ui.horizontal(|ui| {
                            if theme::button(
                                ui,
                                p,
                                BtnKind::Primary,
                                if setting { "Set PIN" } else { "Change PIN" },
                            )
                            .clicked()
                            {
                                if setting {
                                    go_set = true;
                                } else {
                                    go_change = true;
                                }
                            }
                            ui.add_space(6.0);
                            if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                                cancel = true;
                            }
                        });
                        ui.add_space(4.0);
                        ui.label(
                            egui::RichText::new("4\u{2013}63 characters.")
                                .font(theme::f_reg(11.5))
                                .color(p.txt3),
                        );
                    });
            }

            if let Some(err) = &self.security_keys.error {
                ui.add_space(6.0);
                ui.colored_label(p.err, err);
            }
        });
        if cancel {
            self.security_keys.change_pin = ChangePinDialog::default();
        }
        if go_set {
            self.submit_set_pin();
        }
        if go_change {
            self.submit_change_pin();
        }

        let unlocked = self.security_keys.session.is_some();
        let has_bio = self.bio_cmd_code().is_some();
        let supports_cfg = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.option("authnrCfg"))
            == Some(true);
        // The Settings tab itself is broader than the advanced controls: any
        // CTAP2 key can be reset (#81), so the tab shows whenever the key is
        // CTAP2 and only the authenticatorConfig section inside is cfg-gated.
        let settings_available = fido_settings_available(self.security_keys.info.as_ref());
        // Same option pair CredMgmt::new consults: the standard command, or
        // the pre-2.1 preview many CTAP 2.0 keys ship.
        let has_cred_mgmt = self.security_keys.info.as_ref().is_some_and(|i| {
            i.option("credMgmt") == Some(true) || i.option("credentialMgmtPreview") == Some(true)
        });
        let has_large_blobs = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.option("largeBlobs"))
            == Some(true);

        // When the key has a PIN but isn't unlocked yet, show a standalone
        // unlock card. Unlocking gates passkeys, fingerprints, and settings
        // alike, so it lives above the tabs rather than inside the Passkeys tab.
        if pin == PinSupport::Set && !unlocked {
            ui.add_space(14.0);
            let mut unlock = false;
            theme::card_frame(p).show(ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Unlock this key")
                            .font(theme::f_sb(14.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "unlock");
                });
                ui.add_space(8.0);
                ui.horizontal(|ui| {
                    let resp = ui.add_sized(
                        [220.0, 32.0],
                        egui::TextEdit::singleline(&mut self.security_keys.pin_input)
                            .vertical_align(egui::Align::Center)
                            .password(true)
                            .hint_text("Enter PIN to unlock this key"),
                    );
                    guard_secret_field(ui.ctx(), &resp);
                    let submit = theme::button(ui, p, BtnKind::Primary, "Unlock").clicked();
                    if submit
                        || (resp.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)))
                    {
                        unlock = true;
                    }
                });
                let extras = match (has_bio, settings_available) {
                    (true, true) => "passkeys, fingerprints, and settings",
                    (true, false) => "passkeys and fingerprints",
                    (false, true) => "passkeys and settings",
                    (false, false) => "passkeys",
                };
                ui.add_space(4.0);
                ui.label(
                    egui::RichText::new(format!("Unlock to manage {extras}."))
                        .font(theme::f_reg(11.5))
                        .color(p.txt3),
                );
            });
            if unlock {
                self.try_unlock();
            }

            // Read-only "Security policy" summary. getInfo is unauthenticated,
            // so the policy STATE is known without a PIN. Shown only on keys
            // that support authenticatorConfig (the same gate as the Settings
            // tab); the controls themselves still live in that tab post-unlock.
            if supports_cfg {
                let info = self.security_keys.info.as_ref();
                let always_uv = info.and_then(|i| i.option("alwaysUv"));
                let min_pin = info.and_then(|i| i.min_pin_length);
                let force_change = info.and_then(|i| i.force_pin_change);
                let ep = info.and_then(|i| i.option("ep"));

                ui.add_space(14.0);
                theme::card_frame(p).show(ui, |ui| {
                    ui.label(
                        egui::RichText::new("Security policy")
                            .font(theme::f_sb(14.5))
                            .color(p.txt),
                    );
                    ui.add_space(8.0);

                    let row = |ui: &mut egui::Ui, label: &str, value: String| {
                        ui.horizontal(|ui| {
                            ui.label(
                                egui::RichText::new(label)
                                    .font(theme::f_reg(12.0))
                                    .color(p.txt3),
                            );
                            ui.with_layout(
                                egui::Layout::right_to_left(egui::Align::Center),
                                |ui| {
                                    ui.label(
                                        egui::RichText::new(value)
                                            .font(theme::f_sb(12.0))
                                            .color(p.txt),
                                    );
                                },
                            );
                        });
                    };

                    row(
                        ui,
                        "Always require user verification",
                        match always_uv {
                            Some(true) => "On".to_string(),
                            Some(false) => "Off".to_string(),
                            None => "\u{2014}".to_string(),
                        },
                    );
                    ui.add_space(4.0);
                    row(
                        ui,
                        "Minimum PIN length",
                        match min_pin {
                            Some(n) => n.to_string(),
                            None => "\u{2014}".to_string(),
                        },
                    );
                    if force_change == Some(true) {
                        ui.add_space(4.0);
                        row(ui, "Force PIN change", "Required on next use".to_string());
                    }
                    if let Some(ep) = ep {
                        ui.add_space(4.0);
                        row(
                            ui,
                            "Enterprise attestation",
                            if ep { "Enabled" } else { "Supported" }.to_string(),
                        );
                    }

                    ui.add_space(8.0);
                    ui.label(
                        egui::RichText::new("Unlock to change these.")
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                });
            }
        }

        // Reset must stay reachable without the PIN: when the key is CTAP2
        // but can't be unlocked (PIN forgotten/blocked, not set, or clientPin
        // unsupported), render the Reset card standalone here — once
        // unlocked, the Settings tab below owns it instead.
        if show_standalone_reset(unlocked, self.security_keys.info.as_ref()) {
            ui.add_space(14.0);
            self.render_fido_reset_card(ui, p);
        }

        // Once unlocked, the sub-view tabs sit at the top of the content, each
        // owning its own panel below. Styled like the main capability tabs:
        // bold label with an accent underline on the active one.
        if unlocked {
            let mut tabs: Vec<(FidoSubview, &str)> = Vec::new();
            // Passkey management is its own capability (credMgmt, or the
            // pre-2.1 preview) — a CTAP2 key without it gets no Passkeys tab
            // rather than a tab whose only content errors at runtime.
            if has_cred_mgmt {
                tabs.push((FidoSubview::Passkeys, "Passkeys"));
            }
            if has_bio {
                tabs.push((FidoSubview::Fingerprints, "Fingerprints"));
            }
            if settings_available {
                tabs.push((FidoSubview::Settings, "Settings"));
            }
            if has_large_blobs {
                tabs.push((FidoSubview::LargeBlobs, "Storage"));
            }
            // The persisted pick can be stale (it outlives selection changes,
            // and the newly selected key may not offer the old tab): snap it
            // to a tab this key actually has before painting the strip.
            self.security_keys.subview = snap_subview(self.security_keys.subview, &tabs);
            ui.add_space(14.0);
            let mut next: Option<FidoSubview> = None;
            // Paint an opaque surface strip here first (full content width,
            // fixed height covering the label row + its underline) so the row has
            // a clean backing - drawn before the labels, so it sits under them.
            {
                let top = ui.cursor().top();
                let strip = egui::Rect::from_min_max(
                    egui::pos2(ui.max_rect().left(), top - 4.0),
                    egui::pos2(ui.max_rect().right(), top + 30.0),
                );
                ui.painter().rect_filled(strip, 0.0, p.surface);
            }
            ui.horizontal(|ui| {
                ui.spacing_mut().item_spacing.x = 20.0;
                for (view, label) in &tabs {
                    let active = self.security_keys.subview == *view;
                    let color = if active { p.txt } else { p.txt3 };
                    let resp = ui
                        .add(
                            egui::Label::new(
                                egui::RichText::new(*label)
                                    .font(theme::f_sb(13.5))
                                    .color(color),
                            )
                            .sense(egui::Sense::click()),
                        )
                        .on_hover_cursor(egui::CursorIcon::PointingHand);
                    if active {
                        let y = resp.rect.bottom() + 6.0;
                        ui.painter().line_segment(
                            [
                                egui::pos2(resp.rect.left(), y),
                                egui::pos2(resp.rect.right(), y),
                            ],
                            egui::Stroke::new(2.0, p.accent),
                        );
                    }
                    if resp.clicked() {
                        next = Some(*view);
                    }
                }
            });
            if let Some(v) = next {
                self.security_keys.subview = v;
            }
        } else {
            self.security_keys.subview = FidoSubview::Passkeys;
        }
        let subview = self.security_keys.subview;

        // --- Passkeys panel: only when unlocked and the Passkeys tab is active. ---
        if unlocked && subview == FidoSubview::Passkeys {
            ui.add_space(14.0);
            let mut reload = false;
            let mut delete: Option<Vec<u8>> = None;
            // Collected in the credential loop (below), applied after the card so
            // the extract job isn't dispatched while `self` is borrowed by the
            // cloned rps list: (rp id, credential's largeBlob key).
            // The largeBlob key is key material: carry it zeroizing from the
            // moment it leaves the credential listing.
            let mut save_cert: Option<(String, zeroize::Zeroizing<[u8; 32]>)> = None;
            theme::card_frame(p).show(ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Resident passkeys")
                            .font(theme::f_sb(14.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "passkeys");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "Reload").clicked() {
                            reload = true;
                        }
                    });
                });
                ui.add_space(8.0);
                let session_info = self.security_keys.session.as_ref().map(|s| {
                    (
                        s.metadata.existing_count,
                        s.metadata.max_remaining,
                        s.rps.clone(),
                    )
                });
                if let Some((existing, max_remaining, rps)) = session_info {
                    ui.label(
                        egui::RichText::new(format!(
                            "{existing} stored \u{00B7} room for {max_remaining} more"
                        ))
                        .font(theme::f_reg(12.5))
                        .color(p.txt2),
                    );
                    ui.add_space(6.0);
                    if rps.is_empty() {
                        ui.label(
                            egui::RichText::new("No passkeys stored on this key yet.")
                                .font(theme::f_reg(13.0))
                                .color(p.txt3),
                        );
                    }
                    // No inner scroller: the shared capability-pane scroller in
                    // `central` handles overflow, so a long passkey list flows
                    // down the page instead of trapping the wheel in a box.
                    ui.vertical(|ui| {
                        for (rp, creds) in rps.iter() {
                            let header =
                                if let Some(name) = rp.name.as_ref().filter(|s| !s.is_empty()) {
                                    format!("{}  ({})", rp.id, name)
                                } else {
                                    rp.id.clone()
                                };
                            ui.collapsing(header, |ui| {
                                if creds.is_empty() {
                                    ui.label("(no credentials)");
                                }
                                for c in creds {
                                    // Right-to-left so the Remove button claims its
                                    // space first; the identity column then fills the
                                    // remaining width and wraps within it (long hex
                                    // IDs no longer run under the button).
                                    ui.with_layout(
                                        egui::Layout::right_to_left(egui::Align::Min),
                                        |ui| {
                                            if theme::button(ui, p, BtnKind::Ghost, "Remove")
                                                .clicked()
                                            {
                                                delete = Some(c.credential_id.clone());
                                            }
                                            // SSH credentials that carry a largeBlob
                                            // key can hold an OpenSSH certificate;
                                            // offer to extract + save it. Extraction
                                            // is device I/O + decrypt, so it runs as a
                                            // background job (see `save_ssh_cert`).
                                            if ssh_cred_offers_cert(
                                                &rp.id,
                                                c.large_blob_key.as_ref(),
                                            ) {
                                                ui.add_space(6.0);
                                                if theme::button(
                                                    ui,
                                                    p,
                                                    BtnKind::Ghost,
                                                    "Save certificate\u{2026}",
                                                )
                                                .clicked()
                                                {
                                                    if let Some(key) = c.large_blob_key {
                                                        save_cert = Some((
                                                            rp.id.clone(),
                                                            zeroize::Zeroizing::new(key),
                                                        ));
                                                    }
                                                }
                                            }
                                            ui.add_space(8.0);
                                            ui.vertical(|ui| {
                                                // Distinct identity fields, like the
                                                // authenticator's credential details:
                                                // User Name (UPN), Display Name, User
                                                // ID, Credential ID.
                                                let row = |ui: &mut egui::Ui,
                                                           label: &str,
                                                           val: String,
                                                           mono: bool| {
                                                    if val.is_empty() {
                                                        return;
                                                    }
                                                    ui.horizontal_wrapped(|ui| {
                                                        ui.spacing_mut().item_spacing.x = 6.0;
                                                        ui.label(
                                                            egui::RichText::new(label)
                                                                .font(theme::f_sb(11.5))
                                                                .color(p.txt3),
                                                        );
                                                        let font = if mono {
                                                            theme::f_mono(11.5)
                                                        } else {
                                                            theme::f_reg(12.0)
                                                        };
                                                        ui.label(
                                                            egui::RichText::new(val)
                                                                .font(font)
                                                                .color(p.txt2),
                                                        );
                                                    });
                                                };
                                                row(
                                                    ui,
                                                    "User Name",
                                                    c.user.name.clone().unwrap_or_default(),
                                                    false,
                                                );
                                                row(
                                                    ui,
                                                    "Display Name",
                                                    c.user.display_name.clone().unwrap_or_default(),
                                                    false,
                                                );
                                                // User ID: text if printable ASCII,
                                                // else hex (often a random blob).
                                                let uid = if c.user.id.is_empty() {
                                                    String::new()
                                                } else if c
                                                    .user
                                                    .id
                                                    .iter()
                                                    .all(|b| b.is_ascii_graphic() || *b == b' ')
                                                {
                                                    String::from_utf8_lossy(&c.user.id).into_owned()
                                                } else {
                                                    hex_full(&c.user.id)
                                                };
                                                row(ui, "User ID", uid, true);
                                                row(
                                                    ui,
                                                    "Credential ID",
                                                    hex_full(&c.credential_id),
                                                    true,
                                                );
                                            });
                                        },
                                    );
                                    ui.separator();
                                }
                            });
                        }
                    });
                }
            });
            if reload {
                self.refresh_credentials();
            }
            if let Some(id) = delete {
                self.delete_credential(id);
            }
            if let Some((rp_id, key)) = save_cert {
                self.save_ssh_cert(rp_id, key);
            }
            // Result of the last "Save certificate…" (extraction error, or the
            // saved path plus the parsed cert summary).
            if let Some(status) = self.security_keys.ssh_cert_status.clone() {
                ui.add_space(8.0);
                theme::card_frame(p).show(ui, |ui| {
                    for line in status.lines() {
                        ui.label(
                            egui::RichText::new(line)
                                .font(theme::f_reg(12.5))
                                .color(p.txt2),
                        );
                    }
                });
            }
        }

        // --- Fingerprint management (only when unlocked and the key supports it) ---
        if subview == FidoSubview::Fingerprints
            && self.security_keys.session.is_some()
            && self.bio_cmd_code().is_some()
        {
            ui.add_space(14.0);
            let mut do_enroll = false;
            let mut do_refresh_fp = false;
            let mut fp_rename_commit: Option<(Vec<u8>, String)> = None;
            theme::card_frame(p).show(ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Fingerprints")
                            .font(theme::f_sb(14.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "fingerprint");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "Reload").clicked() {
                            do_refresh_fp = true;
                        }
                    });
                });
                ui.add_space(8.0);

                // Enroll wizard now renders as a centered modal overlay
                // (render_enroll_dialog, called from the top-level render). Keep
                // the flag so the list below is hidden while a capture runs.
                let enrolling = self.security_keys.fp_progress.is_some();

                // The list (None until first read). Hidden while the wizard runs.
                if !enrolling {
                    match &self.security_keys.fingerprints {
                        None => {
                            ui.label(
                                egui::RichText::new("Click Reload to read enrolled fingerprints.")
                                    .font(theme::f_reg(13.0))
                                    .color(p.txt3),
                            );
                        }
                        Some(list) if list.is_empty() => {
                            ui.label(
                                egui::RichText::new("No fingerprints enrolled yet.")
                                    .font(theme::f_reg(13.0))
                                    .color(p.txt3),
                            );
                        }
                        Some(list) => {
                            for e in list.iter() {
                                let id = e.template_id.clone();
                                ui.horizontal(|ui| {
                                    ui.monospace(hex_short(&id));
                                    // Inline rename editor for this row, or the name + buttons.
                                    let renaming = self
                                        .security_keys
                                        .fp_rename
                                        .as_ref()
                                        .is_some_and(|(rid, _)| rid == &id);
                                    if renaming {
                                        if let Some((_, buf)) =
                                            self.security_keys.fp_rename.as_mut()
                                        {
                                            ui.add_sized(
                                                [160.0, 32.0],
                                                egui::TextEdit::singleline(buf)
                                                    .vertical_align(egui::Align::Center),
                                            );
                                        }
                                        if theme::button(ui, p, BtnKind::Primary, "Save").clicked()
                                        {
                                            if let Some((rid, buf)) =
                                                self.security_keys.fp_rename.take()
                                            {
                                                fp_rename_commit = Some((rid, buf));
                                            }
                                        }
                                        if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked()
                                        {
                                            self.security_keys.fp_rename = None;
                                        }
                                    } else {
                                        let name =
                                            e.friendly_name.as_deref().unwrap_or("(unnamed)");
                                        ui.label(name);
                                        ui.with_layout(
                                            egui::Layout::right_to_left(egui::Align::Center),
                                            |ui| {
                                                if theme::button(ui, p, BtnKind::Ghost, "Delete")
                                                    .clicked()
                                                {
                                                    self.security_keys.fp_confirm_delete =
                                                        Some(id.clone());
                                                }
                                                if theme::button(ui, p, BtnKind::Ghost, "Rename")
                                                    .clicked()
                                                {
                                                    self.security_keys.fp_rename = Some((
                                                        id.clone(),
                                                        e.friendly_name.clone().unwrap_or_default(),
                                                    ));
                                                }
                                            },
                                        );
                                    }
                                });
                            }
                        }
                    }
                }

                ui.add_space(10.0);
                // Enroll a new fingerprint (hidden while a wizard is running).
                if !enrolling {
                    ui.horizontal(|ui| {
                        ui.add_sized(
                            [160.0, 32.0],
                            egui::TextEdit::singleline(&mut self.security_keys.fp_new_name)
                                .vertical_align(egui::Align::Center)
                                .hint_text("name (optional)"),
                        );
                        if theme::button(ui, p, BtnKind::Primary, "Enroll new\u{2026}").clicked() {
                            do_enroll = true;
                        }
                    });
                    ui.label(
                        egui::RichText::new(
                            "Enrolling asks you to touch the sensor several times. \
                             Keyboard-HID is not needed; this uses the FIDO interface.",
                        )
                        .font(theme::f_reg(11.0))
                        .color(p.txt3),
                    );
                }

                // --- Delete confirmation ("Are you sure?") ---
            });
            if do_refresh_fp {
                self.refresh_fingerprints();
            }
            if do_enroll {
                self.enroll_fingerprint();
            }
            if let Some((id, name)) = fp_rename_commit {
                self.rename_fingerprint(id, name);
            }
        }

        // --- Settings sub-view: advanced config + the danger reset card. ---
        if subview == FidoSubview::Settings {
            // Advanced (authenticatorConfig) security-policy controls — only
            // on keys that speak authenticatorConfig (CTAP 2.1). The Reset
            // card below renders unconditionally: authenticatorReset is
            // baseline CTAP2, and it must stay reachable on 2.0-only keys (#81).
            if supports_cfg {
                self.render_fido_advanced(ui, p);
            }

            ui.add_space(14.0);
            self.render_fido_reset_card(ui, p);
        }

        if subview == FidoSubview::LargeBlobs {
            self.render_large_blobs(ui, p);
        }
    }

    /// The destructive "Reset this key" card (red stroke; arms the
    /// typed-confirm ResetDialog, rendered app-level). Shown inside the
    /// Settings subview when unlocked, and standalone when the key can't be
    /// unlocked — authenticatorReset needs no PIN and is the recovery path
    /// for a forgotten/blocked one, so it must never hide behind unlock
    /// (see [`show_standalone_reset`]).
    fn render_fido_reset_card(&mut self, ui: &mut egui::Ui, p: &Palette) {
        let mut arm_reset = false;
        theme::card_frame(p)
            .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
            .show(ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Reset this key")
                            .font(theme::f_sb(14.5))
                            .color(p.err),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "reset");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Reset key\u{2026}").clicked() {
                            arm_reset = true;
                        }
                    });
                });
                ui.label(
                    egui::RichText::new(
                        "Wipes every passkey and the PIN on this key. Cannot be undone.",
                    )
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
                );
            });
        if arm_reset {
            self.security_keys.reset = ResetDialog {
                open: true,
                ..Default::default()
            };
        }
    }

    /// Append a keyroost text note to the array and write it back. Needs the
    /// unlocked session's PIN (the write path requires a Large-Blob-Write token).
    fn add_large_blob_note(&mut self, text: String) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.lb_status = Some("No FIDO key selected.".into());
            return;
        };
        let Some(session) = self.fido_session() else {
            self.security_keys.lb_status =
                Some("Unlock the key with your PIN first to add data.".into());
            return;
        };
        let pin = session.pin.clone();
        // Start from the currently-loaded array if we have one, else an empty
        // array (read fresh inside the worker to avoid clobbering RP entries we
        // never loaded).
        let loaded = self.security_keys.large_blobs.clone();

        let for_device = self.selected_device.clone();
        self.spawn_job("Saving to large blobs\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_ctap::large_blobs::LargeBlobArray,
                    keyroost_ctap::large_blobs::BlobCapacity,
                ),
                String,
            > {
                let (mut dev, cbor, _init) = open_fido(&target)?;
                if !cbor {
                    return Err("device is U2F-only".into());
                }
                let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;

                // Always re-read immediately before writing so we append onto the
                // authenticator's current array (not a stale cached copy), which
                // protects any RP entries written since our last load.
                let current =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let _ = loaded; // cached copy only informs the UI, not the write

                let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
                    &mut dev,
                    &pin,
                    &info,
                    keyroost_ctap::client_pin::permissions::LARGE_BLOB_WRITE,
                )
                .map_err(|e| e.to_string())?;

                let updated = current.with_text_note(&text);
                let serialized = updated.serialize_with_checksum();
                keyroost_ctap::large_blobs::write(&mut dev, &info, &token, &serialized)
                    .map_err(|e| e.to_string())?;

                let array =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let cap = array.capacity(&info);
                Ok((array, cap))
            })();

            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok((array, cap)) => {
                        let n = array.entries.len();
                        app.security_keys.large_blobs = Some(array);
                        app.security_keys.lb_capacity = Some(cap);
                        app.security_keys.lb_new_text.clear();
                        app.security_keys.lb_show_add = false;
                        app.security_keys.lb_status = Some(format!(
                            "Saved. {n} entr{} total.",
                            if n == 1 { "y" } else { "ies" }
                        ));
                        app.security_keys.error = None;
                    }
                    Err(e) => {
                        app.security_keys.lb_status = Some(format!("Save failed: {e}"));
                    }
                }
            })
        });
    }

    /// Replace the keyroost note at `idx` with `text` and write the array back.
    /// Refuses if the entry is not a keyroost note. Needs the session PIN.
    fn edit_large_blob_note(&mut self, idx: usize, text: String) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.lb_status = Some("No FIDO key selected.".into());
            return;
        };
        let Some(session) = self.fido_session() else {
            self.security_keys.lb_status =
                Some("Unlock the key with your PIN first to edit notes.".into());
            return;
        };
        let pin = session.pin.clone();

        let for_device = self.selected_device.clone();
        self.spawn_job("Saving edit to large blobs\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_ctap::large_blobs::LargeBlobArray,
                    keyroost_ctap::large_blobs::BlobCapacity,
                ),
                String,
            > {
                let (mut dev, cbor, _init) = open_fido(&target)?;
                if !cbor {
                    return Err("device is U2F-only".into());
                }
                let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;

                // Re-read live so we edit the authenticator's current array and
                // never clobber RP entries written since our last load.
                let current =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let updated = current.with_replaced_note(idx, &text).ok_or(
                    "that entry is not an editable keyroost note (it may have \
                            changed on the key — reload and try again)",
                )?;

                let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
                    &mut dev,
                    &pin,
                    &info,
                    keyroost_ctap::client_pin::permissions::LARGE_BLOB_WRITE,
                )
                .map_err(|e| e.to_string())?;

                let serialized = updated.serialize_with_checksum();
                keyroost_ctap::large_blobs::write(&mut dev, &info, &token, &serialized)
                    .map_err(|e| e.to_string())?;

                let array =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let cap = array.capacity(&info);
                Ok((array, cap))
            })();

            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok((array, cap)) => {
                        app.security_keys.large_blobs = Some(array);
                        app.security_keys.lb_capacity = Some(cap);
                        app.security_keys.lb_editing = None;
                        app.security_keys.lb_edit_text.clear();
                        app.security_keys.lb_status = Some("Note updated.".into());
                        app.security_keys.error = None;
                    }
                    Err(e) => {
                        app.security_keys.lb_status = Some(format!("Edit failed: {e}"));
                    }
                }
            })
        });
    }

    /// Read the large-blob array from the selected key (no PIN required) and
    /// cache it. Runs synchronously — a read is one or two small fragments.
    fn load_large_blobs(&mut self) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.lb_status = Some("No FIDO key selected.".into());
            return;
        };
        let result = (|| -> Result<
            (
                keyroost_ctap::large_blobs::LargeBlobArray,
                keyroost_ctap::large_blobs::BlobCapacity,
            ),
            String,
        > {
            let (mut dev, cbor, _init) = open_fido(&target)?;
            if !cbor {
                return Err("device is U2F-only".into());
            }
            let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;
            let array =
                keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
            let cap = array.capacity(&info);
            Ok((array, cap))
        })();
        match result {
            Ok((array, cap)) => {
                let n = array.entries.len();
                self.security_keys.large_blobs = Some(array);
                self.security_keys.lb_capacity = Some(cap);
                self.security_keys.lb_selected = None;
                self.security_keys.lb_status = Some(format!(
                    "Loaded {n} entr{}.",
                    if n == 1 { "y" } else { "ies" }
                ));
            }
            Err(e) => {
                self.security_keys.lb_status = Some(format!("Load failed: {e}"));
            }
        }
    }

    /// Delete entry `idx`, re-serialize the remaining entries with a fresh
    /// checksum, and write the array back. Needs a Large-Blob-Write token, which
    /// we derive from the unlocked session's PIN. Runs on the worker thread.
    fn delete_large_blob_entry(&mut self, idx: usize) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.lb_status = Some("No FIDO key selected.".into());
            return;
        };
        let Some(array) = self.security_keys.large_blobs.clone() else {
            return;
        };
        let Some(session) = self.fido_session() else {
            self.security_keys.lb_status =
                Some("Unlock the key with your PIN first to modify large blobs.".into());
            return;
        };
        if idx >= array.entries.len() {
            return;
        }
        let pin = session.pin.clone();

        // Capture the *target entry* (not its cached index). The actual removal
        // happens against a fresh read of the live array inside the worker, so an
        // RP entry written to the key since our last load is preserved and a
        // position shift can't delete the wrong entry. Matches the re-read shape
        // of `add_large_blob_note` / `edit_large_blob_note` / the CLI delete.
        let target_entry = array.entries[idx].clone();

        let for_device = self.selected_device.clone();
        self.spawn_job("Updating large blobs\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_ctap::large_blobs::LargeBlobArray,
                    keyroost_ctap::large_blobs::BlobCapacity,
                ),
                String,
            > {
                let (mut dev, cbor, _init) = open_fido(&target)?;
                if !cbor {
                    return Err("device is U2F-only".into());
                }
                let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;
                let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
                    &mut dev,
                    &pin,
                    &info,
                    keyroost_ctap::client_pin::permissions::LARGE_BLOB_WRITE,
                )
                .map_err(|e| e.to_string())?;

                // Re-read the live array and remove the matching entry from it
                // (by content, since `LargeBlobEntry` is `PartialEq`).
                let live =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let Some(pos) = live.entries.iter().position(|e| *e == target_entry) else {
                    return Err(
                        "that entry is no longer on the key (its storage changed since it was \
                         loaded) \u{2014} nothing was deleted; reload and try again."
                            .into(),
                    );
                };
                let mut entries = live.entries;
                entries.remove(pos);
                let updated = keyroost_ctap::large_blobs::LargeBlobArray {
                    entries,
                    raw_array: Vec::new(),
                };
                let serialized = updated.serialize_with_checksum();
                keyroost_ctap::large_blobs::write(&mut dev, &info, &token, &serialized)
                    .map_err(|e| e.to_string())?;

                // Read back so the view reflects the authenticator's actual state.
                let array =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let cap = array.capacity(&info);
                Ok((array, cap))
            })();

            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok((array, cap)) => {
                        let n = array.entries.len();
                        app.security_keys.large_blobs = Some(array);
                        app.security_keys.lb_capacity = Some(cap);
                        app.security_keys.lb_selected = None;
                        app.security_keys.lb_status =
                            Some(format!("Entry deleted. {n} remaining."));
                        app.security_keys.error = None;
                    }
                    Err(e) => {
                        app.security_keys.lb_status = Some(format!("Update failed: {e}"));
                    }
                }
            })
        });
    }

    /// Wipe the entire large-blob array: serialize an empty array with a fresh
    /// checksum and write it back. This is what a FIDO reset does NOT do, so it
    /// is the only way to erase plaintext notes that survive a reset. Mirrors
    /// `delete_large_blob_entry` but clears every entry. Needs a Large-Blob-Write
    /// token derived from the unlocked session's PIN. Runs on the worker thread.
    fn clear_large_blob_storage(&mut self) {
        let Some(target) = self.selected_fido_target() else {
            self.security_keys.lb_status = Some("No FIDO key selected.".into());
            return;
        };
        if self.security_keys.large_blobs.is_none() {
            return;
        }
        let Some(session) = self.fido_session() else {
            self.security_keys.lb_status =
                Some("Unlock the key with your PIN first to modify large blobs.".into());
            return;
        };
        let pin = session.pin.clone();

        // Wipe all entries: an empty array, re-serialized with checksum inside
        // the worker.
        let new_entries = Vec::new();

        let for_device = self.selected_device.clone();
        self.spawn_job("Clearing large blobs\u{2026}", move || {
            let result = (|| -> Result<
                (
                    keyroost_ctap::large_blobs::LargeBlobArray,
                    keyroost_ctap::large_blobs::BlobCapacity,
                ),
                String,
            > {
                let (mut dev, cbor, _init) = open_fido(&target)?;
                if !cbor {
                    return Err("device is U2F-only".into());
                }
                let info = keyroost_ctap::get_info(&mut dev).map_err(|e| e.to_string())?;
                let token = keyroost_ctap::client_pin::get_pin_uv_auth_token(
                    &mut dev,
                    &pin,
                    &info,
                    keyroost_ctap::client_pin::permissions::LARGE_BLOB_WRITE,
                )
                .map_err(|e| e.to_string())?;

                let updated = keyroost_ctap::large_blobs::LargeBlobArray {
                    entries: new_entries,
                    raw_array: Vec::new(),
                };
                let serialized = updated.serialize_with_checksum();
                keyroost_ctap::large_blobs::write(&mut dev, &info, &token, &serialized)
                    .map_err(|e| e.to_string())?;

                // Read back so the view reflects the authenticator's actual state.
                let array =
                    keyroost_ctap::large_blobs::read(&mut dev, &info).map_err(|e| e.to_string())?;
                let cap = array.capacity(&info);
                Ok((array, cap))
            })();

            Box::new(move |app: &mut App| {
                if !completion_still_valid(for_device.as_ref(), app.selected_device.as_ref()) {
                    return; // selection changed mid-op; discard the stale completion
                }
                match result {
                    Ok((array, cap)) => {
                        let n = array.entries.len();
                        app.security_keys.large_blobs = Some(array);
                        app.security_keys.lb_capacity = Some(cap);
                        app.security_keys.lb_selected = None;
                        app.security_keys.lb_status =
                            Some(format!("Storage cleared. {n} entries remaining."));
                        app.security_keys.error = None;
                    }
                    Err(e) => {
                        app.security_keys.lb_status = Some(format!("Clear failed: {e}"));
                    }
                }
            })
        });
    }

    /// Large-blob array viewer/editor (CTAP authenticatorLargeBlobs 0x0C).
    ///
    /// Reads the key-global serialized array (no PIN needed) and shows it both
    /// as a structured entry list and as a hex/ASCII dump. Deleting an entry
    /// re-serializes the remaining entries, recomputes the 16-byte checksum
    /// trailer, and writes the whole array back (which needs a PIN, because the
    /// write path requires a token with the Large Blob Write permission).
    fn render_large_blobs(&mut self, ui: &mut egui::Ui, p: &Palette) {
        ui.add_space(14.0);

        // Auto-load the array the first time this tab is shown, so entries
        // appear without a manual Load click. The flag stops a failed read from
        // retrying every frame; Reload remains available to refresh on demand.
        if !self.security_keys.lb_autoloaded && self.security_keys.large_blobs.is_none() {
            self.security_keys.lb_autoloaded = true;
            self.load_large_blobs();
        }

        // Header + Load/Reload control.
        let mut do_load = false;
        ui.horizontal(|ui| {
            ui.label(
                egui::RichText::new("Large blob storage")
                    .font(theme::f_sb(14.5))
                    .color(p.txt),
            );
            ui.add_space(6.0);
            self.help_dot(ui, p, "large_blobs");
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                let label = if self.security_keys.large_blobs.is_some() {
                    "Reload"
                } else {
                    "Load"
                };
                if theme::button(ui, p, BtnKind::Ghost, label).clicked() {
                    do_load = true;
                }
                ui.add_space(8.0);
                let add_label = if self.security_keys.lb_show_add {
                    "Close"
                } else {
                    "Add"
                };
                if theme::button(ui, p, BtnKind::Ghost, add_label).clicked() {
                    self.security_keys.lb_show_add = !self.security_keys.lb_show_add;
                }
                // "Clear all storage" wipes every entry — the only way to erase
                // plaintext notes a FIDO reset leaves behind. Show it only when
                // there is something to clear and the session is unlocked (the
                // write needs a PIN-derived token, like Delete). The first click
                // arms a confirm; the confirmed click fires below.
                let entry_count = self
                    .security_keys
                    .large_blobs
                    .as_ref()
                    .map(|a| a.entries.len())
                    .unwrap_or(0);
                let unlocked = self.security_keys.session.is_some();
                if entry_count > 0 && unlocked {
                    ui.add_space(8.0);
                    if theme::button(ui, p, BtnKind::Danger, "Clear all storage").clicked() {
                        self.security_keys.lb_confirm_clear = true;
                    }
                }
            });
        });
        ui.add_space(4.0);
        ui.label(
            egui::RichText::new(
                "This store is readable by anyone holding the key and is meant for \
                 RP-encrypted data \u{2014} not a place for plaintext secrets.",
            )
            .font(theme::f_reg(11.5))
            .color(p.txt3),
        );

        if let Some(cap) = self.security_keys.lb_capacity {
            ui.add_space(8.0);
            let frac = if cap.max_bytes == 0 {
                0.0
            } else {
                (cap.used_bytes as f32 / cap.max_bytes as f32).clamp(0.0, 1.0)
            };
            ui.horizontal(|ui| {
                ui.add(
                    egui::ProgressBar::new(frac)
                        .desired_width(160.0)
                        .desired_height(8.0),
                );
                ui.add_space(8.0);
                ui.label(
                    egui::RichText::new(format!(
                        "{} of {} bytes used \u{00b7} {} free \u{00b7} {} {}",
                        cap.used_bytes,
                        cap.max_bytes,
                        cap.free_bytes,
                        cap.entry_count,
                        if cap.entry_count == 1 {
                            "entry"
                        } else {
                            "entries"
                        },
                    ))
                    .font(theme::f_reg(11.5))
                    .color(p.txt2),
                );
            });
        }

        if let Some(status) = &self.security_keys.lb_status {
            ui.add_space(6.0);
            ui.label(
                egui::RichText::new(status)
                    .font(theme::f_reg(12.0))
                    .color(p.txt2),
            );
        }

        if do_load {
            self.load_large_blobs();
        }

        // Add-a-note composer — only when the user clicked Add. Requires an
        // unlocked session (the write needs a PIN-derived token); show a hint
        // instead when locked.
        if self.security_keys.lb_show_add {
            ui.add_space(12.0);
            theme::card_frame(p).show(ui, |ui| {
                ui.label(
                    egui::RichText::new("Add a text note")
                        .font(theme::f_sb(13.0))
                        .color(p.txt),
                );
                ui.add_space(4.0);
                ui.label(
                    egui::RichText::new(
                        "Stored as a keyroost entry you can read back here. It is NOT \
                         encrypted and is visible to anyone holding the key.",
                    )
                    .font(theme::f_reg(11.0))
                    .color(p.txt3),
                );
                ui.add_space(6.0);
                ui.add(
                    egui::TextEdit::multiline(&mut self.security_keys.lb_new_text)
                        .desired_rows(2)
                        .desired_width(f32::INFINITY)
                        .hint_text("Type a note to store on the key\u{2026}"),
                );
                ui.add_space(6.0);
                let unlocked = self.security_keys.session.is_some();
                let has_text = !self.security_keys.lb_new_text.trim().is_empty();
                ui.horizontal(|ui| {
                    let add = theme::button(ui, p, BtnKind::Primary, "Add note");
                    if add.clicked() && unlocked && has_text {
                        let text = self.security_keys.lb_new_text.clone();
                        self.add_large_blob_note(text);
                    }
                    if !unlocked {
                        ui.label(
                            egui::RichText::new("Unlock with your PIN to save.")
                                .font(theme::f_reg(11.0))
                                .color(p.txt3),
                        );
                    }
                });
            });
        }

        // Render the loaded array, if any.
        let Some(array) = self.security_keys.large_blobs.clone() else {
            return;
        };

        ui.add_space(10.0);
        if array.entries.is_empty() {
            ui.label(
                egui::RichText::new("The large-blob array is empty.")
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
            );
            return;
        }

        let mut delete_request: Option<usize> = None;
        let mut start_edit: Option<(usize, String)> = None;
        let mut save_edit: Option<(usize, String)> = None;
        let mut cancel_edit = false;
        let selected = self.security_keys.lb_selected;
        let editing = self.security_keys.lb_editing;
        for (idx, entry) in array.entries.iter().enumerate() {
            theme::card_frame(p).show(ui, |ui| {
                use keyroost_ctap::large_blobs::EntryKind;
                let classification = entry.classify();
                let note_text = match &classification {
                    EntryKind::Note(text) => Some(text.clone()),
                    _ => None,
                };
                ui.horizontal(|ui| {
                    let title = if note_text.is_some() {
                        format!("Note {}", idx + 1)
                    } else {
                        format!("Entry {}", idx + 1)
                    };
                    ui.label(
                        egui::RichText::new(title)
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    ui.add_space(8.0);
                    let meta = match &classification {
                        EntryKind::Note(_) => "keyroost text note".to_string(),
                        EntryKind::SshCert { .. } => format!(
                            "ssh-cert \u{00b7} {} bytes \u{00b7} relying-party data",
                            entry.ciphertext.len(),
                        ),
                        EntryKind::Opaque => format!(
                            "{} bytes ciphertext \u{00b7} {}-byte nonce \u{00b7} origSize {} \u{00b7} relying-party data",
                            entry.ciphertext.len(),
                            entry.nonce.len(),
                            entry.orig_size,
                        ),
                    };
                    ui.label(
                        egui::RichText::new(meta)
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Delete").clicked() {
                            delete_request = Some(idx);
                        }
                        let is_open = selected == Some(idx);
                        let toggle = if is_open { "Hide bytes" } else { "View bytes" };
                        if theme::button(ui, p, BtnKind::Ghost, toggle).clicked() {
                            self.security_keys.lb_selected =
                                if is_open { None } else { Some(idx) };
                        }
                        // Edit only applies to keyroost's own notes.
                        if note_text.is_some()
                            && editing != Some(idx)
                            && theme::button(ui, p, BtnKind::Ghost, "Edit").clicked()
                        {
                            start_edit = Some((idx, note_text.clone().unwrap_or_default()));
                        }
                        // Export is read-only, so it's always available
                        // regardless of session lock state.
                        if theme::button(ui, p, BtnKind::Ghost, "Export\u{2026}").clicked() {
                            let is_cert =
                                matches!(classification, EntryKind::SshCert { .. });
                            let default_name = if is_cert {
                                format!("entry-{idx}-cert.pub")
                            } else {
                                format!("large-blob-entry-{idx}.bin")
                            };
                            self.spawn_file_dialog(
                                FileTarget::LbExport(idx),
                                true,
                                &[("All files", &["*"])],
                                Some(&default_name),
                            );
                        }
                    });
                });
                // keyroost notes: inline editor when editing this entry, else
                // the decoded text read-only. SSH certificates get a parsed
                // field-by-field view; anything else (opaque RP data) shows
                // nothing extra here — its bytes remain available via "View
                // bytes" below.
                if editing == Some(idx) {
                    ui.add_space(6.0);
                    ui.add(
                        egui::TextEdit::multiline(&mut self.security_keys.lb_edit_text)
                            .desired_rows(2)
                            .desired_width(f32::INFINITY),
                    );
                    ui.add_space(6.0);
                    let unlocked = self.security_keys.session.is_some();
                    let has_text =
                        !self.security_keys.lb_edit_text.trim().is_empty();
                    ui.horizontal(|ui| {
                        if theme::button(ui, p, BtnKind::Primary, "Save").clicked()
                            && unlocked
                            && has_text
                        {
                            save_edit = Some((idx, self.security_keys.lb_edit_text.clone()));
                        }
                        if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                            cancel_edit = true;
                        }
                        if !unlocked {
                            ui.label(
                                egui::RichText::new("Unlock with your PIN to save.")
                                    .font(theme::f_reg(11.0))
                                    .color(p.txt3),
                            );
                        }
                    });
                } else if let Some(text) = &note_text {
                    ui.add_space(6.0);
                    ui.label(
                        egui::RichText::new(text)
                            .font(theme::f_reg(12.5))
                            .color(p.txt),
                    );
                } else if let EntryKind::SshCert { info, .. } = &classification {
                    ui.add_space(6.0);
                    egui::Grid::new(format!("lb_cert_{idx}"))
                        .num_columns(2)
                        .spacing([12.0, 2.0])
                        .show(ui, |ui| {
                            let row = |ui: &mut egui::Ui, k: &str, v: String| {
                                ui.label(
                                    egui::RichText::new(k).font(theme::f_reg(11.5)).color(p.txt3),
                                );
                                ui.label(
                                    egui::RichText::new(v).font(theme::f_reg(11.5)).color(p.txt),
                                );
                                ui.end_row();
                            };
                            let kind = if info.cert_type
                                == keyroost_ctap::ssh_cert::CERT_TYPE_USER
                            {
                                "user"
                            } else {
                                "host"
                            };
                            row(ui, "Type", format!("{} ({kind})", info.key_type));
                            row(ui, "Key ID", info.key_id.clone());
                            row(ui, "Serial", info.serial.to_string());
                            row(
                                ui,
                                "Principals",
                                if info.principals.is_empty() {
                                    "(any)".to_string()
                                } else {
                                    info.principals.join(", ")
                                },
                            );
                            row(
                                ui,
                                "Valid",
                                keyroost_ctap::ssh_cert::format_validity(
                                    info.valid_after,
                                    info.valid_before,
                                ),
                            );
                            for (n, v) in &info.critical_options {
                                row(
                                    ui,
                                    "Critical",
                                    if v.is_empty() {
                                        n.clone()
                                    } else {
                                        format!("{n}={v}")
                                    },
                                );
                            }
                            for ext in &info.extensions {
                                row(ui, "Extension", ext.clone());
                            }
                        });
                }
                if selected == Some(idx) {
                    ui.add_space(8.0);
                    Self::hex_ascii_view(ui, p, &entry.ciphertext);
                }
            });
            ui.add_space(8.0);
        }

        // Apply edit-related actions collected during the loop (kept outside it
        // to avoid borrowing `self` while iterating the cloned array).
        if let Some((idx, text)) = start_edit {
            self.security_keys.lb_editing = Some(idx);
            self.security_keys.lb_edit_text = text;
        }
        if cancel_edit {
            self.security_keys.lb_editing = None;
            self.security_keys.lb_edit_text.clear();
        }
        if let Some((idx, text)) = save_edit {
            self.edit_large_blob_note(idx, text);
        }

        // A delete is a write; confirm before touching the key.
        if let Some(idx) = delete_request {
            self.security_keys.lb_confirm_delete = Some(idx);
        }
        if let Some(idx) = self.security_keys.lb_confirm_delete {
            ui.add_space(6.0);
            theme::card_frame(p)
                .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
                .show(ui, |ui| {
                    ui.label(
                        egui::RichText::new(format!(
                            "Delete entry {} and rewrite the array? Requires your PIN.",
                            idx + 1
                        ))
                        .font(theme::f_reg(12.5))
                        .color(p.txt),
                    );
                    ui.add_space(6.0);
                    ui.horizontal(|ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Delete entry").clicked() {
                            self.security_keys.lb_confirm_delete = None;
                            self.delete_large_blob_entry(idx);
                        }
                        if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                            self.security_keys.lb_confirm_delete = None;
                        }
                    });
                });
        }

        // Clearing all storage is irreversible and wipes every note, so the
        // first click only arms this confirm; the user must confirm explicitly.
        if self.security_keys.lb_confirm_clear {
            let n = array.entries.len();
            ui.add_space(6.0);
            theme::card_frame(p)
                .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
                .show(ui, |ui| {
                    ui.label(
                        egui::RichText::new(format!(
                            "Wipe all {n} entr{} from this key? This erases every entry \u{2014} \
                             including any relying-party data (e.g. SSH certificates, sign-in \
                             records), not just keyroost notes. Cannot be undone; requires your PIN.",
                            if n == 1 { "y" } else { "ies" },
                        ))
                        .font(theme::f_reg(12.5))
                        .color(p.txt),
                    );
                    ui.add_space(6.0);
                    ui.horizontal(|ui| {
                        if theme::button(
                            ui,
                            p,
                            BtnKind::Danger,
                            &format!(
                                "Confirm \u{2014} wipe all {n} entr{}",
                                if n == 1 { "y" } else { "ies" }
                            ),
                        )
                        .clicked()
                        {
                            self.security_keys.lb_confirm_clear = false;
                            self.clear_large_blob_storage();
                        }
                        if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                            self.security_keys.lb_confirm_clear = false;
                        }
                    });
                });
        }
    }

    /// Render a byte slice as a side-by-side hex + ASCII dump, 16 bytes/row.
    fn hex_ascii_view(ui: &mut egui::Ui, p: &Palette, bytes: &[u8]) {
        let mut text = String::new();
        for (i, row) in bytes.chunks(16).enumerate() {
            let mut hex = String::new();
            let mut ascii = String::new();
            for (j, b) in row.iter().enumerate() {
                hex.push_str(&format!("{:02x} ", b));
                if j == 7 {
                    hex.push(' ');
                }
                ascii.push(if b.is_ascii_graphic() || *b == b' ' {
                    *b as char
                } else {
                    '.'
                });
            }
            // Pad short final rows so the ASCII column lines up.
            let width = 16 * 3 + 1;
            while hex.len() < width {
                hex.push(' ');
            }
            text.push_str(&format!("{:08x}  {} |{}|\n", i * 16, hex, ascii));
        }
        ui.add(
            egui::Label::new(
                egui::RichText::new(text.trim_end())
                    .font(theme::f_mono(11.5))
                    .color(p.txt2),
            )
            .wrap(),
        );
    }

    /// Advanced security-policy view (CTAP authenticatorConfig). Grouped here,
    /// behind the overflow menu, because several of these are irreversible and
    /// shouldn't sit alongside everyday controls. Each action takes the device
    /// PIN at apply time (config needs its own permissioned token) and the
    /// irreversible ones require an explicit typed confirmation.
    fn render_fido_advanced(&mut self, ui: &mut egui::Ui, p: &Palette) {
        let always_uv = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.option("alwaysUv"));
        // Enterprise attestation support: the `ep` option is present (true =
        // already enabled, false = supported but off) on keys that can do it,
        // and absent entirely on keys that can't. Hide the row when unsupported.
        let ep = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.option("ep"));
        let supports_ep = ep.is_some();
        let ep_enabled = ep == Some(true);
        let min_pin_length = self
            .security_keys
            .info
            .as_ref()
            .and_then(|i| i.min_pin_length);

        ui.add_space(14.0);
        theme::card_frame(p).show(ui, |ui| {
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("Security policy")
                        .font(theme::f_sb(14.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "settings");
            });
            ui.add_space(4.0);
            ui.label(
                egui::RichText::new(
                    "These change the key's security policy. Some are irreversible \
                     without a full reset \u{2014} read each note before applying.",
                )
                .font(theme::f_reg(12.0))
                .color(p.txt3),
            );
            ui.add_space(10.0);

            // Each row: a description + a button that arms the confirm dialog.
            let mut arm: Option<AdvancedAction> = None;

            // Always-UV (reversible toggle).
            ui.horizontal(|ui| {
                ui.vertical(|ui| {
                    ui.label(
                        egui::RichText::new("Always require user verification")
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    let state = match always_uv {
                        Some(true) => "Currently on \u{2014} every sign-in needs PIN or biometric.",
                        Some(false) => "Currently off.",
                        None => "State unknown.",
                    };
                    ui.label(
                        egui::RichText::new(state)
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                });
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Toggle").clicked() {
                        arm = Some(AdvancedAction::ToggleAlwaysUv);
                    }
                });
            });
            ui.add_space(8.0);

            // Set minimum PIN length (one-way).
            ui.horizontal(|ui| {
                ui.vertical(|ui| {
                    ui.label(
                        egui::RichText::new("Set minimum PIN length")
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    ui.label(
                        egui::RichText::new("Can only be raised, never lowered without a reset.")
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                    let current = match min_pin_length {
                        Some(n) => format!("Current minimum: {} characters", n),
                        None => "Current minimum: \u{2014}".to_string(),
                    };
                    ui.label(
                        egui::RichText::new(current)
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                });
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Set\u{2026}").clicked() {
                        arm = Some(AdvancedAction::SetMinPin);
                    }
                });
            });
            ui.add_space(8.0);

            // Force PIN change.
            ui.horizontal(|ui| {
                ui.vertical(|ui| {
                    ui.label(
                        egui::RichText::new("Force PIN change on next use")
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    ui.label(
                        egui::RichText::new("Useful before handing the key to someone else.")
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                });
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Force\u{2026}").clicked() {
                        arm = Some(AdvancedAction::ForcePinChange);
                    }
                });
            });
            // Enterprise attestation (one-way) — only shown on keys that
            // support it (the `ep` getInfo option is present).
            if supports_ep {
                ui.add_space(8.0);
                ui.horizontal(|ui| {
                    ui.vertical(|ui| {
                        ui.label(
                            egui::RichText::new("Enable enterprise attestation")
                                .font(theme::f_sb(13.0))
                                .color(p.txt),
                        );
                        let note = if ep_enabled {
                            "Currently on. Disabling it again requires a device reset."
                        } else {
                            "One-way: disabling it again requires a device reset."
                        };
                        ui.label(
                            egui::RichText::new(note)
                                .font(theme::f_reg(11.5))
                                .color(p.txt3),
                        );
                    });
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if ep_enabled {
                            // Already enabled: nothing actionable, show a pill.
                            theme::pill(ui, "Enabled", p.ok, p.ok_soft());
                        } else if theme::button(ui, p, BtnKind::Danger, "Enable\u{2026}").clicked()
                        {
                            arm = Some(AdvancedAction::EnterpriseAttestation);
                        }
                    });
                });
            }

            if let Some(action) = arm {
                // Fields listed explicitly: AdvancedDialog now has a Drop impl
                // (to wipe the PIN), so struct-update from `Default::default()`
                // is disallowed (can't move fields out of a Drop type).
                self.security_keys.advanced = Some(AdvancedDialog {
                    action,
                    pin_input: String::new(),
                    min_pin_input: String::new(),
                    force_change: false,
                    device: self.selected_device.clone(),
                });
                self.security_keys.error = None;
            }
        });
    }

    /// Inline confirm + PIN entry for an armed Advanced action.
    /// Confirm/apply overlay for an armed Advanced action. Rendered as a
    /// centered modal window (like the reset dialog) so it floats over the
    /// Settings panel instead of pushing the list down.
    /// Shared centered-modal chrome used by the Settings, fingerprint-delete,
    /// and enrollment dialogs so they all look identical: no native title bar,
    /// a custom frame (pop fill, line stroke, drop shadow, 20px padding), a
    /// title at button-font size with a painted X close, and Esc-to-dismiss.
    /// `body` draws the dialog contents. `width` is the dialog's max content
    /// width (300.0 is the shape every other caller uses; a caller with
    /// wider content — e.g. a GUID that needs to stay on one line — passes a
    /// larger value so the title row, and the close X pinned to its right
    /// edge, actually span the content instead of clipping/misaligning
    /// against it). Returns true if the X or Esc was used (the caller
    /// dismisses its own state).
    fn modal_window(
        ctx: &egui::Context,
        p: &Palette,
        id: &str,
        title: &str,
        width: f32,
        body: impl FnOnce(&mut egui::Ui),
    ) -> bool {
        let mut closed = ctx.input(|i| i.key_pressed(egui::Key::Escape));
        egui::Window::new(id)
            .collapsible(false)
            .resizable(false)
            .title_bar(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .frame(egui::Frame {
                inner_margin: egui::Margin::same(20),
                corner_radius: egui::CornerRadius::same(13),
                fill: p.pop,
                stroke: egui::Stroke::new(1.0, p.line),
                shadow: egui::epaint::Shadow {
                    offset: [0, 12],
                    blur: 40,
                    spread: 0,
                    color: egui::Color32::from_black_alpha(115),
                },
                ..Default::default()
            })
            .show(ctx, |ui| {
                ui.set_max_width(width);
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new(title)
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        let (xr, xresp) =
                            ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                        let xcolor = if xresp.hovered() { p.txt } else { p.txt3 };
                        paint_x_icon(ui, xr.center(), xcolor);
                        if xresp.clicked() {
                            closed = true;
                        }
                    });
                });
                ui.add_space(12.0);
                body(ui);
            });
        closed
    }

    /// Centered-modal enrollment dialog (same chrome as the Settings dialogs):
    /// live per-sample progress, a Cancel during capture, and a Done once the
    /// flow finishes.
    fn render_enroll_dialog(&mut self, ctx: &egui::Context, p: &Palette) {
        let Some(prog) = self.security_keys.fp_progress.clone() else {
            return;
        };

        // Snapshot the shared state under one short lock so the body closure
        // (which only borrows `ui`) doesn't need the mutex.
        let (captured, total, last_message, done) = {
            let Ok(g) = prog.lock() else { return };
            (
                g.captured,
                g.total.max(1),
                g.last_message.clone(),
                g.done.clone(),
            )
        };
        let frac = (captured as f32 / total as f32).clamp(0.0, 1.0);
        let finished = done.is_some();

        let mut want_cancel = false;
        let mut want_done = false;
        let closed =
            Self::modal_window(
                ctx,
                p,
                "fp_enroll",
                "Enroll fingerprint",
                300.0,
                |ui| match &done {
                    None => {
                        ui.label(
                            egui::RichText::new(format!(
                                "Enrolling \u{2014} sample {} of {}",
                                captured.min(total),
                                total
                            ))
                            .font(theme::f_sb(13.0))
                            .color(p.accent),
                        );
                        ui.add_space(8.0);
                        ui.add(egui::ProgressBar::new(frac).desired_width(280.0));
                        ui.add_space(6.0);
                        ui.label(
                            egui::RichText::new(format!("\u{1F446} {last_message}"))
                                .font(theme::f_reg(12.0))
                                .color(p.txt2),
                        );
                        ui.add_space(16.0);
                        if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                            want_cancel = true;
                        }
                    }
                    Some(Ok(())) => {
                        ui.label(
                            egui::RichText::new("\u{2713} Fingerprint enrolled")
                                .font(theme::f_sb(13.0))
                                .color(p.ok),
                        );
                        ui.add_space(8.0);
                        ui.add(egui::ProgressBar::new(1.0).desired_width(280.0));
                        ui.add_space(16.0);
                        if theme::button(ui, p, BtnKind::Primary, "Done").clicked() {
                            want_done = true;
                        }
                    }
                    Some(Err(e)) => {
                        ui.colored_label(p.err, format!("Enrollment failed: {e}"));
                        ui.add_space(16.0);
                        if theme::button(ui, p, BtnKind::Default, "Close").clicked() {
                            want_done = true;
                        }
                    }
                },
            );

        if want_cancel {
            // Signal the worker to abort the capture between samples.
            if let Ok(mut g) = prog.lock() {
                g.cancel.store(true, std::sync::atomic::Ordering::Relaxed);
                g.last_message = "Cancelling\u{2026}".into();
            }
        }
        // Done / Close / the X / Esc dismiss the dialog once the flow is
        // finished. While a capture is still running, the X/Esc act as Cancel
        // rather than leaving an orphaned worker.
        if want_done || (closed && finished) {
            self.security_keys.fp_progress = None;
        } else if closed && !finished {
            if let Ok(mut g) = prog.lock() {
                g.cancel.store(true, std::sync::atomic::Ordering::Relaxed);
                g.last_message = "Cancelling\u{2026}".into();
            }
        }
    }

    /// Centered-modal confirmation for deleting a fingerprint (same chrome as
    /// the Settings dialogs). Returns the template id to delete, if confirmed.
    fn render_fp_delete_confirm(&mut self, ctx: &egui::Context, p: &Palette) -> Option<Vec<u8>> {
        let id = self.security_keys.fp_confirm_delete.clone()?;
        let label = self
            .security_keys
            .fingerprints
            .as_ref()
            .and_then(|l| l.iter().find(|e| e.template_id == id))
            .and_then(|e| e.friendly_name.clone())
            .unwrap_or_else(|| hex_short(&id));

        let mut confirm = false;
        let mut cancel = false;
        let closed = Self::modal_window(ctx, p, "fp_delete", "Delete fingerprint?", 300.0, |ui| {
            ui.label(
                egui::RichText::new(format!(
                    "Delete fingerprint \u{201c}{label}\u{201d}? This cannot be undone."
                ))
                .font(theme::f_reg(12.5))
                .color(p.txt),
            );
            ui.add_space(16.0);
            ui.horizontal(|ui| {
                if theme::button(ui, p, BtnKind::Danger, "Delete").clicked() {
                    confirm = true;
                }
                ui.add_space(8.0);
                if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                    cancel = true;
                }
            });
        });

        if cancel || closed {
            self.security_keys.fp_confirm_delete = None;
            return None;
        }
        if confirm {
            self.security_keys.fp_confirm_delete = None;
            return Some(id);
        }
        None
    }

    fn render_advanced_confirm(&mut self, ctx: &egui::Context, p: &Palette) {
        let Some(dlg) = self.security_keys.advanced.as_ref() else {
            return;
        };
        let action = dlg.action;
        if action == AdvancedAction::None {
            return;
        }
        if !completion_still_valid(dlg.device.as_ref(), self.selected_device.as_ref()) {
            self.security_keys.advanced = None;
            return;
        }

        let (title, irreversible) = match action {
            AdvancedAction::ToggleAlwaysUv => ("Toggle always-UV", false),
            AdvancedAction::SetMinPin => ("Set minimum PIN length", true),
            AdvancedAction::ForcePinChange => ("Force a PIN change", false),
            AdvancedAction::EnterpriseAttestation => ("Enable enterprise attestation", true),
            AdvancedAction::None => return,
        };

        let mut apply = false;
        let mut cancel = false;
        // No built-in title bar, so handle Esc-to-dismiss ourselves.
        if ctx.input(|i| i.key_pressed(egui::Key::Escape)) {
            cancel = true;
        }
        egui::Window::new(title)
            .collapsible(false)
            .resizable(false)
            .title_bar(false)
            .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
            .frame(egui::Frame {
                inner_margin: egui::Margin::same(20),
                corner_radius: egui::CornerRadius::same(13),
                fill: p.pop,
                stroke: egui::Stroke::new(1.0, p.line),
                shadow: egui::epaint::Shadow {
                    offset: [0, 12],
                    blur: 40,
                    spread: 0,
                    color: egui::Color32::from_black_alpha(115),
                },
                ..Default::default()
            })
            .show(ctx, |ui| {
                ui.set_max_width(300.0);
                // Custom title at the button font size (the default window title
                // bar is dropped via title_bar(false), so render our own).
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new(title)
                            .font(theme::f_sb(13.0))
                            .color(p.txt),
                    );
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        let (xr, xresp) =
                            ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                        let xcolor = if xresp.hovered() { p.txt } else { p.txt3 };
                        paint_x_icon(ui, xr.center(), xcolor);
                        if xresp.clicked() {
                            cancel = true;
                        }
                    });
                });
                ui.add_space(12.0);
                if irreversible {
                    ui.label(
                        egui::RichText::new(
                            "This cannot be undone without a full reset of the key.",
                        )
                        .font(theme::f_reg(12.0))
                        .color(p.warn),
                    );
                    ui.add_space(12.0);
                }

                if action == AdvancedAction::SetMinPin {
                    ui.horizontal(|ui| {
                        ui.label("New minimum length");
                        if let Some(d) = self.security_keys.advanced.as_mut() {
                            ui.add(
                                egui::TextEdit::singleline(&mut d.min_pin_input)
                                    .desired_width(64.0)
                                    .hint_text("e.g. 6"),
                            );
                        }
                    });
                    ui.add_space(8.0);
                    if let Some(d) = self.security_keys.advanced.as_mut() {
                        ui.checkbox(&mut d.force_change, "Also force a PIN change now");
                    }
                    ui.add_space(12.0);
                }

                ui.horizontal(|ui| {
                    ui.label("Device PIN");
                    if let Some(d) = self.security_keys.advanced.as_mut() {
                        let resp = ui.add(
                            egui::TextEdit::singleline(&mut d.pin_input)
                                .password(true)
                                .desired_width(160.0),
                        );
                        guard_secret_field(ui.ctx(), &resp);
                    }
                });
                ui.add_space(16.0);

                ui.horizontal(|ui| {
                    let kind = if irreversible {
                        BtnKind::Danger
                    } else {
                        BtnKind::Primary
                    };
                    if theme::button(ui, p, kind, "Apply").clicked() {
                        apply = true;
                    }
                    ui.add_space(8.0);
                    if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                        cancel = true;
                    }
                });

                if let Some(err) = &self.security_keys.error {
                    ui.add_space(10.0);
                    ui.label(
                        egui::RichText::new(err)
                            .font(theme::f_reg(12.0))
                            .color(p.err),
                    );
                }
            });

        if apply {
            self.run_advanced_action();
        } else if cancel {
            // The Cancel button, the ✕, or pressing Esc all dismiss.
            self.security_keys.advanced = None;
            self.security_keys.error = None;
        }
    }

    /// Render the *current* management-key collector inside the modal, but only
    /// for the flows that need it (`PivCredKind::needs_mgmt_key`). Shows a "Use
    /// default management key" toggle (the common case — most users never rotate
    /// the well-known factory default) and, when it's off, the hex entry field.
    /// When the toggle is on the field is hidden and the op reads the default via
    /// `piv_current_mgmt_auth`. The toggle itself is disabled — greyed out,
    /// unclickable — whenever `Self::piv_current_default_mgmt_key` resolves
    /// `None`: this fingerprint/version carries no
    /// `keyroost_piv::compat::PivQuirk::Default9bManagementKey`, so keyroost has
    /// no default to offer rather than one that might just be wrong. When it
    /// does resolve `Some`, hovering the (enabled) checkbox shows the
    /// applicable default key as hex in a tooltip, so the user can see what
    /// they're about to authorize with before committing to it.
    ///
    /// When this device's fingerprint resolves
    /// `keyroost_piv::compat::PivExtension::PinManagementAuth` to `Supported`
    /// *or* `Unverified`, a second "Use PIN" toggle appears alongside it —
    /// with a warning-triangle marker next to it for `Unverified`, same as
    /// every other gated control in this pane, so the user can still try it
    /// but knows it hasn't been confirmed on this specific device.
    /// `Unsupported` hides the toggle entirely, same as before. Both toggles
    /// are pure views onto — and setters of — the single
    /// `PivState::mgmt_auth_mode` (see that type's doc for why): checking
    /// either sets the mode to that variant; unchecking either always
    /// returns to `PivMgmtAuthMode::Manual`, never leaves the other toggle's
    /// variant standing. With "Use PIN" on, the hex field either turns into
    /// a PIN entry (label "PIN", hint "PIN") — or, for a flow with a
    /// dedicated PIN field of its own (`PivCredKind::shares_pin_field`),
    /// disappears entirely, since that field's PIN is reused for management
    /// auth too (there is only one PIV application PIN).
    fn piv_modal_mgmt_field(&mut self, ui: &mut egui::Ui, p: &Palette, kind: PivCredKind) {
        if !kind.needs_mgmt_key() {
            return;
        }
        let pin_auth_gate = {
            let (fp, ver, fw) = self.piv.status.as_ref().map_or(
                (
                    keyroost_piv::fingerprint::AppletFingerprint::Generic,
                    None,
                    None,
                ),
                |s| {
                    (
                        s.applet_fingerprint,
                        s.version.as_deref(),
                        s.version_firmware.as_deref(),
                    )
                },
            );
            self.piv_gate(
                keyroost_piv::compat::PivExtension::PinManagementAuth,
                fp,
                ver,
                fw,
            )
        };
        let pin_auth_available = !matches!(
            pin_auth_gate,
            keyroost_piv::compat::FeatureGate::Unsupported
        );
        if !pin_auth_available && self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
            // Keeps state sane if a device switch mid-modal drops support out
            // from under an already-checked toggle.
            self.piv.mgmt_auth_mode = PivMgmtAuthMode::Manual;
        }
        let default_key = self.piv_current_default_mgmt_key();
        if default_key.is_none() && self.piv.mgmt_auth_mode == PivMgmtAuthMode::Default {
            // Same rationale as the "Use PIN" reset above: don't leave the
            // toggle checked for a default a device switch just took away.
            self.piv.mgmt_auth_mode = PivMgmtAuthMode::Manual;
        }
        ui.horizontal(|ui| {
            let mut is_default = self.piv.mgmt_auth_mode == PivMgmtAuthMode::Default;
            let mut resp = ui.add_enabled(
                default_key.is_some(),
                egui::Checkbox::new(&mut is_default, "Use default management key"),
            );
            if let Some(key) = default_key {
                // Only on the enabled checkbox — a disabled one has no
                // applicable default to show.
                resp = resp.on_hover_text(format!("Default management key: {}", hex_lower(key)));
            }
            if resp.changed() {
                self.piv.mgmt_auth_mode =
                    piv_mgmt_mode_after_toggle(is_default, PivMgmtAuthMode::Default);
            }
            if pin_auth_available {
                let mut is_pin = self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin;
                if ui.checkbox(&mut is_pin, "Use PIN").changed() {
                    self.piv.mgmt_auth_mode =
                        piv_mgmt_mode_after_toggle(is_pin, PivMgmtAuthMode::Pin);
                }
                if matches!(pin_auth_gate, keyroost_piv::compat::FeatureGate::Unverified) {
                    ui.add_space(4.0);
                    theme::warn_marker(ui, p).on_hover_text(format!(
                        "{} {}",
                        keyroost_piv::compat::PivExtension::PinManagementAuth.requirement(),
                        keyroost_piv::compat::FeatureGate::UNVERIFIED_SUFFIX
                    ));
                }
            }
        });
        if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Default {
            return;
        }
        let use_pin = self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin;
        if use_pin && kind.shares_pin_field() {
            return;
        }
        // Match whichever row shares a label column with this one, so the
        // fields line up: the New CHUID dialog's GUID row (and, for
        // `ChangeMgmtKey`, that same modal's own "New key" row below this
        // one), or — for `SelfSign`/`SetRetries` — the dedicated PIN row
        // below this one. "GUID"/"New key"/"PIN" are all short enough to fit
        // the shared 96px label box, but "Management key" isn't, so every
        // row sharing a column with it needs the wider, measured width or
        // their inputs start at different x. Field width stays each row's
        // own — only the label column needs to match. Every other flow
        // (nothing else visible to misalign against) keeps the narrower
        // default.
        let label_w = if matches!(
            kind,
            PivCredKind::NewChuid
                | PivCredKind::ChangeMgmtKey
                | PivCredKind::SelfSign
                | PivCredKind::SetRetries
        ) {
            chuid_label_width(ui.ctx())
        } else {
            96.0
        };
        let width = if kind == PivCredKind::NewChuid {
            chuid_guid_field_width(ui.ctx())
        } else {
            300.0
        };
        let (label, hint) = if use_pin {
            ("PIN", "PIN")
        } else {
            ("Management key", "hex (48/32/64 chars)")
        };
        let mut mgmt_key_rev = self
            .secret_reveal
            .get("piv-mgmt-key-input")
            .copied()
            .unwrap_or(false);
        piv_secret_field(
            ui,
            p,
            label,
            &mut self.piv.mgmt_key_input,
            &mut mgmt_key_rev,
            hint,
            label_w,
            width,
        );
        self.secret_reveal
            .insert("piv-mgmt-key-input", mgmt_key_rev);
    }

    /// The Compression row of the Import certificate and Self-signed
    /// certificate dialogs (the CLI's `--compress` / `--no-compress`), with
    /// the same help the CLI gives. `label_w` is the dialog's label column, so
    /// the row lines up with the management-key and PIN rows above it.
    fn piv_modal_compression_field(&mut self, ui: &mut egui::Ui, p: &Palette, label_w: f32) {
        ui.add_space(4.0);
        ui.horizontal(|ui| {
            ui.add_sized(
                [label_w, 22.0],
                egui::Label::new(
                    egui::RichText::new("Compression")
                        .font(theme::f_reg(13.0))
                        .color(p.txt2),
                ),
            );
            piv_cert_compression_combo(ui, "piv-cert-compression", &mut self.piv.cert_compression);
        });
        card_note(
            ui,
            p,
            "Compressed is the PIV standard's gzip form; some software may not read \
             compressed certificates. Automatic compresses only if the card refuses the \
             certificate as too large.",
        );
    }

    /// PIV credential-entry modal: drives the PIN/PUK flows (Change PIN / Change
    /// PUK / Unblock PIN) *and* the management-key-gated operations (generate
    /// key, import / self-sign / CSR, set retries, change management key) inside
    /// the shared `modal_window` chrome, so the secret fields *and* the op's
    /// result stay centered on-screen rather than scrolling off (issue #31).
    ///
    /// The secret fields live in `PivState` (rendered here, not inline in the
    /// pane); the inline pane keeps the *non-secret* parameters (slot, algorithm,
    /// file path, subject, validity, retry counts). The modal state
    /// (`PivState::cred_modal`) tracks the flow, an in-flight flag, and the op
    /// result. On Submit it validates (new==confirm for PIN/PUK; the ops' own
    /// client-side guards for the rest), then runs the existing op, which writes
    /// the outcome back into the modal via `apply_piv_cred_result`. Rich,
    /// non-secret results (e.g. the generated public-key PEM) still surface in
    /// the pane — the modal only shows a generic success line. Cancel / ✕ / Esc —
    /// and a successful Done — wipe the secret fields.
    fn render_piv_cred_modal(&mut self, ctx: &egui::Context, p: &Palette) {
        let Some(kind) = self.piv.cred_modal.as_ref().map(|m| m.kind) else {
            return;
        };
        let busy = self.piv.cred_modal.as_ref().is_some_and(|m| m.busy);
        let result = self.piv.cred_modal.as_ref().and_then(|m| m.result.clone());
        let detail = self.piv.cred_modal.as_ref().and_then(|m| m.detail.clone());
        // The self-test spinner asks for a touch when the selected slot's
        // touch policy needs one (mirrors the Generate-key spinner wording).
        let busy_text = if kind == PivCredKind::SelfTest
            && matches!(
                self.piv_selected_slot_policy().map(|(_, t)| t),
                Some(keyroost_piv::TouchPolicy::Always | keyroost_piv::TouchPolicy::Cached)
            ) {
            format!("{} \u{2014} touch the key", kind.busy_label())
        } else {
            kind.busy_label().to_owned()
        };

        let mut want_submit = false;
        let mut want_close = false;
        // Inline new==confirm guard, mirroring the op-level backstop. Shown as
        // the modal's error line; blocks Submit when set.
        let mismatch = piv_cred_mismatch(&self.piv, kind);
        // Whether the target slot already holds a key — drives the Generate-key
        // overwrite warning + relabel and the Import-cert replace note.
        // Precomputed before the closure borrows `self` mutably.
        let selected_occupied = self.piv_selected_occupied();

        // Move-key flow: precompute the source slot and the eligible destination
        // slots (empty, non-source) before the modal borrows `self` mutably. A
        // standard slot is occupied when its `slot_keys` entry carries a key
        // algorithm; a retired slot's occupancy comes from the lazily-read cache
        // (unknown → treated as empty; the transport re-checks and refuses an
        // occupied destination, so a stale cache can't cause a bad move).
        let move_src = self.piv.selected_slot.to_slot();
        let move_dests: Vec<keyroost_piv::Slot> = if kind == PivCredKind::MoveKey {
            let piv = &self.piv;
            let occupied = |s: keyroost_piv::Slot| -> bool {
                if matches!(s, keyroost_piv::Slot::Retired(_)) {
                    piv.retired_occupancy
                        .as_ref()
                        .and_then(|v| v.iter().find(|(rs, _)| *rs == s))
                        .map(|(_, has)| *has)
                        .unwrap_or(false)
                } else {
                    piv.slot_keys
                        .iter()
                        .find(|(sl, _, _)| *sl == s)
                        .map(|(_, alg, _)| alg.is_some())
                        .unwrap_or(false)
                }
            };
            move_key_eligible_destinations(move_src, &occupied)
        } else {
            Vec::new()
        };

        // New CHUID's GUID field needs to stay on one line at its full
        // canonical `8-4-4-4-12` width (36 characters); every other flow
        // fits the default. Sized from the same measured field width the
        // GUID/management-key inputs use, not a separate fixed guess, so
        // the dialog doesn't reserve space nothing in it actually needs:
        // label column + spacing + field + spacing + refresh icon + a
        // little breathing room before the edge.
        let width = if kind == PivCredKind::NewChuid {
            chuid_label_width(ctx) + 8.0 + chuid_guid_field_width(ctx) + 6.0 + 22.0 + 12.0
        } else {
            300.0
        };
        let closed = Self::modal_window(ctx, p, "piv_cred", kind.title(), width, |ui| {
            match &result {
                Some(Ok(())) => {
                    // Success: confirmation + a single Done that dismisses.
                    ui.label(
                        egui::RichText::new(format!("\u{2713} {}", piv_cred_success(kind)))
                            .font(theme::f_sb(13.0))
                            .color(p.ok),
                    );
                    // Per-operation breakdown (self-test): one line each.
                    if let Some(d) = &detail {
                        ui.add_space(6.0);
                        for line in d.lines() {
                            card_note(ui, p, line);
                        }
                    }
                    ui.add_space(16.0);
                    if theme::button(ui, p, BtnKind::Primary, "Done").clicked() {
                        want_close = true;
                    }
                }
                _ => {
                    // Entry form (also the path while busy / after an error so the
                    // user can retry without losing the dialog).
                    match kind {
                        PivCredKind::ChangePin => {
                            let mut old_rev = self
                                .secret_reveal
                                .get("piv-pin-old")
                                .copied()
                                .unwrap_or(false);
                            let mut new_rev = self
                                .secret_reveal
                                .get("piv-pin-new")
                                .copied()
                                .unwrap_or(false);
                            let mut confirm_rev = self
                                .secret_reveal
                                .get("piv-pin-confirm")
                                .copied()
                                .unwrap_or(false);
                            // Sized to "Confirm new PIN", the widest of this
                            // dialog's three labels, so all three fields'
                            // left edges line up (see `label_text_width`).
                            let label_w = label_text_width(ui.ctx(), "Confirm new PIN");
                            piv_pin_field(
                                ui,
                                p,
                                "Current PIN",
                                &mut self.piv.pin_old,
                                &mut old_rev,
                                label_w,
                            );
                            piv_pin_field(
                                ui,
                                p,
                                "New PIN",
                                &mut self.piv.pin_new,
                                &mut new_rev,
                                label_w,
                            );
                            piv_pin_field(
                                ui,
                                p,
                                "Confirm new PIN",
                                &mut self.piv.pin_confirm,
                                &mut confirm_rev,
                                label_w,
                            );
                            self.secret_reveal.insert("piv-pin-old", old_rev);
                            self.secret_reveal.insert("piv-pin-new", new_rev);
                            self.secret_reveal.insert("piv-pin-confirm", confirm_rev);
                            card_note(ui, p, "6\u{2013}8 characters.");
                        }
                        PivCredKind::ChangePuk => {
                            let mut old_rev = self
                                .secret_reveal
                                .get("piv-puk-old")
                                .copied()
                                .unwrap_or(false);
                            let mut new_rev = self
                                .secret_reveal
                                .get("piv-puk-new")
                                .copied()
                                .unwrap_or(false);
                            let mut confirm_rev = self
                                .secret_reveal
                                .get("piv-puk-confirm")
                                .copied()
                                .unwrap_or(false);
                            // Sized to "Confirm new PUK" — same rationale as
                            // `ChangePin` above.
                            let label_w = label_text_width(ui.ctx(), "Confirm new PUK");
                            piv_pin_field(
                                ui,
                                p,
                                "Current PUK",
                                &mut self.piv.puk_old,
                                &mut old_rev,
                                label_w,
                            );
                            piv_pin_field(
                                ui,
                                p,
                                "New PUK",
                                &mut self.piv.puk_new,
                                &mut new_rev,
                                label_w,
                            );
                            piv_pin_field(
                                ui,
                                p,
                                "Confirm new PUK",
                                &mut self.piv.puk_confirm,
                                &mut confirm_rev,
                                label_w,
                            );
                            self.secret_reveal.insert("piv-puk-old", old_rev);
                            self.secret_reveal.insert("piv-puk-new", new_rev);
                            self.secret_reveal.insert("piv-puk-confirm", confirm_rev);
                            card_note(ui, p, "8 characters.");
                        }
                        PivCredKind::UnblockPin => {
                            let mut puk_rev = self
                                .secret_reveal
                                .get("piv-unblock-puk")
                                .copied()
                                .unwrap_or(false);
                            let mut new_pin_rev = self
                                .secret_reveal
                                .get("piv-unblock-new-pin")
                                .copied()
                                .unwrap_or(false);
                            piv_pin_field(
                                ui,
                                p,
                                "PUK",
                                &mut self.piv.unblock_puk,
                                &mut puk_rev,
                                96.0,
                            );
                            piv_pin_field(
                                ui,
                                p,
                                "New PIN",
                                &mut self.piv.unblock_new_pin,
                                &mut new_pin_rev,
                                96.0,
                            );
                            self.secret_reveal.insert("piv-unblock-puk", puk_rev);
                            self.secret_reveal
                                .insert("piv-unblock-new-pin", new_pin_rev);
                            card_note(ui, p, "Recovers a blocked PIN without wiping any keys.");
                        }
                        // Management-key-gated flows: only the *secrets* live here;
                        // their non-secret parameters stay inline in the pane.
                        PivCredKind::GenerateKey => {
                            // Generating into an occupied slot silently destroys
                            // the existing private key (irreversible). Warn in
                            // red before the auth field, mirroring the delete
                            // cards; the submit button is relabelled below.
                            if selected_occupied {
                                let slot = self.piv.selected_slot.to_slot().label();
                                ui.colored_label(
                                    p.err,
                                    egui::RichText::new(format!(
                                        "This OVERWRITES and destroys the existing key in \
                                         {slot}. This cannot be undone."
                                    ))
                                    .font(theme::f_sb(12.5)),
                                );
                                ui.add_space(6.0);
                            }
                            self.piv_modal_mgmt_field(ui, p, kind);
                            card_note(ui, p, "Authorizes overwriting the slot with a fresh key.");
                            ui.add_space(8.0);

                            // PIN/touch policy (tags 0xAA/0xAB on GENERATE
                            // ASYMMETRIC KEYPAIR) are Yubico extensions, not SP
                            // 800-73-4 — gated the same three-way way
                            // (`keyroost_piv::compat`) Move/Delete key are
                            // elsewhere in this pane, just resolved locally
                            // here since this modal doesn't share those rows'
                            // gate locals. `default` needs neither extension
                            // and is unaffected either way.
                            use keyroost_piv::compat::{FeatureGate, PivExtension};
                            let (piv_fp, piv_ver, piv_fw_ver) = self.piv.status.as_ref().map_or(
                                (
                                    keyroost_piv::fingerprint::AppletFingerprint::Generic,
                                    None,
                                    None,
                                ),
                                |s| {
                                    (
                                        s.applet_fingerprint,
                                        s.version.as_deref(),
                                        s.version_firmware.as_deref(),
                                    )
                                },
                            );
                            let pin_policy_gate = self.piv_gate(
                                PivExtension::SlotPinPolicy,
                                piv_fp,
                                piv_ver,
                                piv_fw_ver,
                            );
                            let touch_policy_gate = self.piv_gate(
                                PivExtension::SlotTouchPolicy,
                                piv_fp,
                                piv_ver,
                                piv_fw_ver,
                            );
                            // Narrower than the two gates above: a device can
                            // support the extension in general yet reject one
                            // specific value (e.g. YubiKey firmware 4.0-4.2
                            // supports touch policy but not `cached`).
                            let policy_quirks =
                                keyroost_piv::compat::resolve_quirks(piv_fp, piv_ver, piv_fw_ver);
                            let pin_once_blocked = policy_quirks.contains(
                                &keyroost_piv::compat::PivQuirk::SlotPinPolicyOnceNotSupported,
                            );
                            let touch_cached_blocked = policy_quirks.contains(
                                &keyroost_piv::compat::PivQuirk::SlotTouchPolicyCachedNotSupported,
                            );
                            let pin_policy_unverified_hint = format!(
                                "{} {}",
                                PivExtension::SlotPinPolicy.requirement(),
                                FeatureGate::UNVERIFIED_SUFFIX
                            );
                            let pin_policy_blocked_hint = format!(
                                "{} {}",
                                PivExtension::SlotPinPolicy.requirement(),
                                FeatureGate::INCOMPATIBLE_SUFFIX
                            );
                            let touch_policy_unverified_hint = format!(
                                "{} {}",
                                PivExtension::SlotTouchPolicy.requirement(),
                                FeatureGate::UNVERIFIED_SUFFIX
                            );
                            let touch_policy_blocked_hint = format!(
                                "{} {}",
                                PivExtension::SlotTouchPolicy.requirement(),
                                FeatureGate::INCOMPATIBLE_SUFFIX
                            );
                            // `Unsupported` blocks the whole combo (matching
                            // Move/Delete key's own treatment) rather than
                            // just the one value the quirks above narrow —
                            // there's nothing to offer once the extension
                            // itself is known absent, so force the selection
                            // back to `default` rather than leave a stale
                            // non-default value the combo can no longer show
                            // as selectable.
                            if matches!(pin_policy_gate, FeatureGate::Unsupported) {
                                self.piv.gen_pin_policy = keyroost_piv::PinPolicy::Default;
                            }
                            if matches!(touch_policy_gate, FeatureGate::Unsupported) {
                                self.piv.gen_touch_policy = keyroost_piv::TouchPolicy::Default;
                            }
                            let pin_policy_options: Vec<keyroost_piv::PinPolicy> =
                                keyroost_piv::PinPolicy::ALL
                                    .iter()
                                    .copied()
                                    .filter(|&opt| {
                                        !(pin_once_blocked && opt == keyroost_piv::PinPolicy::Once)
                                    })
                                    .collect();
                            let touch_policy_options: Vec<keyroost_piv::TouchPolicy> =
                                keyroost_piv::TouchPolicy::ALL
                                    .iter()
                                    .copied()
                                    .filter(|&opt| {
                                        !(touch_cached_blocked
                                            && opt == keyroost_piv::TouchPolicy::Cached)
                                    })
                                    .collect();

                            ui.horizontal(|ui| {
                                ui.label(
                                    egui::RichText::new("Pin Policy")
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt2),
                                );
                                if matches!(pin_policy_gate, FeatureGate::Unverified) {
                                    ui.add_space(4.0);
                                    theme::warn_marker(ui, p)
                                        .on_hover_text(pin_policy_unverified_hint.as_str());
                                }
                                ui.add_space(8.0);
                                ui.add_enabled_ui(
                                    !matches!(pin_policy_gate, FeatureGate::Unsupported),
                                    |ui| {
                                        piv_policy_combo(
                                            ui,
                                            "piv-gen-pin-policy",
                                            &mut self.piv.gen_pin_policy,
                                            &pin_policy_options,
                                        );
                                    },
                                )
                                .response
                                .on_disabled_hover_text(pin_policy_blocked_hint.as_str());
                            });
                            ui.add_space(4.0);
                            ui.horizontal(|ui| {
                                ui.label(
                                    egui::RichText::new("Touch Policy")
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt2),
                                );
                                if matches!(touch_policy_gate, FeatureGate::Unverified) {
                                    ui.add_space(4.0);
                                    theme::warn_marker(ui, p)
                                        .on_hover_text(touch_policy_unverified_hint.as_str());
                                }
                                ui.add_space(8.0);
                                ui.add_enabled_ui(
                                    !matches!(touch_policy_gate, FeatureGate::Unsupported),
                                    |ui| {
                                        piv_policy_combo(
                                            ui,
                                            "piv-gen-touch-policy",
                                            &mut self.piv.gen_touch_policy,
                                            &touch_policy_options,
                                        );
                                    },
                                )
                                .response
                                .on_disabled_hover_text(touch_policy_blocked_hint.as_str());
                            });
                            if piv_policy_caveat_hint_needed(pin_policy_gate, touch_policy_gate) {
                                card_note(
                                    ui,
                                    p,
                                    "Policy other than `default` requires YubiKey or compatible \
                                     token.",
                                );
                            }
                        }
                        PivCredKind::ImportCert => {
                            card_note(ui, p, &format!("Reading {}", self.piv.cert_path));
                            self.piv_modal_mgmt_field(ui, p, kind);
                            // Same label column as the management-key row
                            // (ImportCert uses the default 96px box).
                            self.piv_modal_compression_field(ui, p, 96.0);
                            // Importing only replaces the public certificate
                            // object (no key loss) — a lighter note, not a red
                            // warning.
                            if selected_occupied {
                                let slot = self.piv.selected_slot.to_slot().label();
                                card_note(
                                    ui,
                                    p,
                                    &format!("This replaces the certificate currently in {slot}."),
                                );
                            }
                            card_note(ui, p, "Authorizes writing the certificate to the slot.");
                        }
                        PivCredKind::SelfSign => {
                            self.piv_modal_mgmt_field(ui, p, kind);
                            let mut sign_pin_rev = self
                                .secret_reveal
                                .get("piv-sign-pin")
                                .copied()
                                .unwrap_or(false);
                            // Matches `piv_modal_mgmt_field`'s own label
                            // column above, so the two fields' left edges
                            // line up.
                            piv_pin_field(
                                ui,
                                p,
                                "PIN",
                                &mut self.piv.sign_pin,
                                &mut sign_pin_rev,
                                chuid_label_width(ui.ctx()),
                            );
                            self.secret_reveal.insert("piv-sign-pin", sign_pin_rev);
                            self.piv_modal_compression_field(ui, p, chuid_label_width(ui.ctx()));
                            card_note(
                                ui,
                                p,
                                if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
                                    "The PIN unlocks management and authorizes the \
                                     on-card signature."
                                } else {
                                    "Management key authorizes the import; the PIN authorizes \
                                     the on-card signature."
                                },
                            );
                        }
                        PivCredKind::RequestCsr => {
                            card_note(ui, p, &format!("Saving to {}", self.piv.csr_path));
                            let mut sign_pin_rev = self
                                .secret_reveal
                                .get("piv-sign-pin")
                                .copied()
                                .unwrap_or(false);
                            piv_pin_field(
                                ui,
                                p,
                                "PIN",
                                &mut self.piv.sign_pin,
                                &mut sign_pin_rev,
                                96.0,
                            );
                            self.secret_reveal.insert("piv-sign-pin", sign_pin_rev);
                            card_note(ui, p, "The PIN authorizes the on-card signature.");
                        }
                        PivCredKind::SelfTest => {
                            let mut sign_pin_rev = self
                                .secret_reveal
                                .get("piv-sign-pin")
                                .copied()
                                .unwrap_or(false);
                            piv_pin_field(
                                ui,
                                p,
                                "PIN (optional)",
                                &mut self.piv.sign_pin,
                                &mut sign_pin_rev,
                                96.0,
                            );
                            self.secret_reveal.insert("piv-sign-pin", sign_pin_rev);
                            card_note(
                                ui,
                                p,
                                "PIN optional; device state and policy may still require it.",
                            );
                            card_note(
                                ui,
                                p,
                                "Runs every self-test the slot's key supports (decrypt / \
                                 key-agree / sign) and verifies each result against the \
                                 certificate's public key. Nothing on the card changes.",
                            );
                        }
                        PivCredKind::SetRetries => {
                            self.piv_modal_mgmt_field(ui, p, kind);
                            let mut retries_pin_rev = self
                                .secret_reveal
                                .get("piv-retries-pin")
                                .copied()
                                .unwrap_or(false);
                            // Matches `piv_modal_mgmt_field`'s own label
                            // column above, so the two fields' left edges
                            // line up.
                            piv_pin_field(
                                ui,
                                p,
                                "Current PIN",
                                &mut self.piv.retries_pin_auth,
                                &mut retries_pin_rev,
                                chuid_label_width(ui.ctx()),
                            );
                            self.secret_reveal
                                .insert("piv-retries-pin", retries_pin_rev);
                            card_note(
                                ui,
                                p,
                                if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
                                    "Resets PIN and PUK to factory defaults; the PIN both \
                                     unlocks management and authorizes the reset."
                                } else {
                                    "Resets PIN and PUK to factory defaults; needs the \
                                     management key and the current PIN."
                                },
                            );
                        }
                        PivCredKind::ChangeMgmtKey => {
                            self.piv_modal_mgmt_field(ui, p, kind);
                            // Shared with `piv_modal_mgmt_field`'s own
                            // "Management key"/"PIN" row above (see its
                            // comment) so this row's field starts at the same
                            // x. The "Generate random key & Copy" link and "Allow
                            // PIN unlock" checkbox below it are centered
                            // instead, not lined up under this column — see
                            // their own comments.
                            let label_w = chuid_label_width(ui.ctx());
                            match self.piv.new_mgmt_alg.to_alg() {
                                Some(alg) => {
                                    let new_key_hint = format!("hex ({} chars)", alg.key_len() * 2);
                                    let mut new_key_rev = self
                                        .secret_reveal
                                        .get("piv-new-mgmt-key")
                                        .copied()
                                        .unwrap_or(false);
                                    piv_secret_field(
                                        ui,
                                        p,
                                        "New key",
                                        &mut self.piv.new_mgmt_key_input,
                                        &mut new_key_rev,
                                        &new_key_hint,
                                        label_w,
                                        300.0,
                                    );
                                    self.secret_reveal.insert("piv-new-mgmt-key", new_key_rev);
                                    ui.add_space(2.0);
                                    // Centered rather than lined up under the
                                    // label column like the rows above/below
                                    // it — this link and the "Allow PIN
                                    // unlock" checkbox beneath it read as a
                                    // pair of standalone actions, not a
                                    // labeled field, so they share the
                                    // modal's horizontal center instead.
                                    ui.vertical_centered(|ui| {
                                        // Plain accent-colored `Label` +
                                        // `Sense::click()`, not `ui.link()` —
                                        // same pattern as the zoom "Reset"
                                        // link above: a pointing-hand cursor
                                        // on hover, but no underline.
                                        if ui
                                            .add(
                                                egui::Label::new(
                                                    egui::RichText::new(
                                                        "Generate random key & Copy",
                                                    )
                                                    .font(theme::f_sb(13.0))
                                                    .color(p.accent),
                                                )
                                                .sense(egui::Sense::click()),
                                            )
                                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                                            .on_hover_text(
                                                "Fill in a fresh random key of the selected \
                                                 length and copy it to the clipboard.",
                                            )
                                            .clicked()
                                        {
                                            self.piv_generate_random_mgmt_key(ui.ctx(), alg);
                                        }
                                    });
                                    // "Allow PIN unlock": whether the new key
                                    // is also stored PIN-protected (Yubico's
                                    // `PivExtension::PinManagementAuth`) —
                                    // gated the same three-way way the
                                    // GenerateKey modal's own PIN/touch
                                    // policy rows are, resolved locally here
                                    // since this modal doesn't share the
                                    // status card's gate locals. HID
                                    // Crescendo unlocks management off the
                                    // PIN already, with no key material to
                                    // store — forced on and disabled there
                                    // instead of gated, same "nothing to
                                    // toggle" treatment
                                    // `set_management_key_pin_protected`
                                    // itself gives that fingerprint (it skips
                                    // the maintenance step outright).
                                    use keyroost_piv::compat::{FeatureGate, PivExtension};
                                    let is_hid_crescendo = self.piv.status.as_ref().is_some_and(|s| {
                                        matches!(
                                            s.applet_fingerprint,
                                            keyroost_piv::fingerprint::AppletFingerprint::HidCrescendo(_)
                                        )
                                    });
                                    ui.add_space(4.0);
                                    // Centered under the link above, not under
                                    // the field label column — see that row's
                                    // comment.
                                    if is_hid_crescendo {
                                        self.piv.new_mgmt_allow_pin_unlock = true;
                                        ui.vertical_centered(|ui| {
                                            ui.add_enabled_ui(false, |ui| {
                                                ui.checkbox(
                                                    &mut self.piv.new_mgmt_allow_pin_unlock,
                                                    "Allow PIN unlock",
                                                );
                                            });
                                        });
                                    } else {
                                        let (piv_fp, piv_ver, piv_fw_ver) =
                                            self.piv.status.as_ref().map_or(
                                                (
                                                    keyroost_piv::fingerprint::AppletFingerprint::Generic,
                                                    None,
                                                    None,
                                                ),
                                                |s| {
                                                    (
                                                        s.applet_fingerprint,
                                                        s.version.as_deref(),
                                                        s.version_firmware.as_deref(),
                                                    )
                                                },
                                            );
                                        let pin_unlock_gate = self.piv_gate(
                                            PivExtension::PinManagementAuth,
                                            piv_fp,
                                            piv_ver,
                                            piv_fw_ver,
                                        );
                                        let pin_unlock_blocked_hint = format!(
                                            "{} {}",
                                            PivExtension::PinManagementAuth.requirement(),
                                            FeatureGate::INCOMPATIBLE_SUFFIX
                                        );
                                        // `ui.vertical_centered` only centers
                                        // a row correctly when the row is a
                                        // single widget claiming its own
                                        // natural size — `ui.horizontal`
                                        // always pre-claims the *full*
                                        // available width up front (so
                                        // multi-widget centering has nothing
                                        // left to center), which is exactly
                                        // why the checkbox-alone branches
                                        // above and below this one center
                                        // fine while this one (checkbox +
                                        // conditional warning icon, two
                                        // widgets on one line) didn't. Measure
                                        // the row's actual rendered width and
                                        // pad it into the middle by hand
                                        // instead; the padding is one frame
                                        // stale right after the icon
                                        // appears/disappears, which is
                                        // imperceptible for a row that only
                                        // changes on a device switch.
                                        let row_w_id =
                                            egui::Id::new("piv-allow-pin-unlock-row-width");
                                        let last_row_w =
                                            ui.data(|d| d.get_temp::<f32>(row_w_id)).unwrap_or(0.0);
                                        ui.horizontal(|ui| {
                                            ui.add_space(
                                                ((ui.available_width() - last_row_w) / 2.0)
                                                    .max(0.0),
                                            );
                                            let row = ui.horizontal(|ui| {
                                                ui.add_enabled_ui(
                                                    !matches!(
                                                        pin_unlock_gate,
                                                        FeatureGate::Unsupported
                                                    ),
                                                    |ui| {
                                                        ui.checkbox(
                                                            &mut self.piv.new_mgmt_allow_pin_unlock,
                                                            "Allow PIN unlock",
                                                        );
                                                    },
                                                )
                                                .response
                                                .on_disabled_hover_text(
                                                    pin_unlock_blocked_hint.as_str(),
                                                );
                                                if matches!(
                                                    pin_unlock_gate,
                                                    FeatureGate::Unverified
                                                ) {
                                                    ui.add_space(4.0);
                                                    theme::warn_marker(ui, p).on_hover_text(
                                                        format!(
                                                            "{} {}",
                                                            PivExtension::PinManagementAuth
                                                                .requirement(),
                                                            FeatureGate::UNVERIFIED_SUFFIX
                                                        )
                                                        .as_str(),
                                                    );
                                                }
                                            });
                                            ui.data_mut(|d| {
                                                d.insert_temp(row_w_id, row.response.rect.width())
                                            });
                                        });
                                    }
                                    card_note(
                                        ui,
                                        p,
                                        if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
                                            "Enter the PIN, then the new key. Select \"Allow \
                                             PIN Unlock\" to also unlock management with the \
                                             PIN, in addition to the management key."
                                        } else {
                                            "Enter the current key, then the new key. Select \
                                             \"Allow PIN unlock\" to also unlock management \
                                             with the PIN, in addition to the management key."
                                        },
                                    );
                                }
                                // "Delete" (HID Crescendo only, see
                                // `PivMgmtAlgSel`): no new-key field at all —
                                // an empty key is sent, deleting XAUTH key 1
                                // instead of replacing it.
                                None => {
                                    card_note(
                                        ui,
                                        p,
                                        if self.piv.mgmt_auth_mode == PivMgmtAuthMode::Pin {
                                            "Enter the PIN to unlock. This deletes the \
                                             management key rather than replacing it, \
                                             leaving the PIN as the only remaining \
                                             authentication mechanism."
                                        } else {
                                            "Enter the current key to unlock. This deletes \
                                             the management key rather than replacing it, \
                                             leaving the PIN as the only remaining \
                                             authentication mechanism."
                                        },
                                    );
                                }
                            }
                        }
                        PivCredKind::DeleteCert => {
                            let slot = self.piv.selected_slot.label();
                            ui.colored_label(
                                p.err,
                                egui::RichText::new(format!(
                                    "Removes the certificate in {slot}. The private key in \
                                     the slot remains. This cannot be undone."
                                ))
                                .font(theme::f_sb(12.5)),
                            );
                            ui.add_space(6.0);
                            self.piv_modal_mgmt_field(ui, p, kind);
                            card_note(ui, p, "The management key authorizes the deletion.");
                        }
                        PivCredKind::DeleteKey => {
                            let slot = self.piv.selected_slot.label();
                            ui.colored_label(
                                p.err,
                                egui::RichText::new(format!(
                                    "Permanently erases the private key in {slot}. This \
                                     cannot be undone."
                                ))
                                .font(theme::f_sb(12.5)),
                            );
                            ui.add_space(6.0);
                            self.piv_modal_mgmt_field(ui, p, kind);
                            card_note(
                                ui,
                                p,
                                "The management key authorizes the deletion. Needs \
                                 YubiKey 5.7+ or compatible third party device.",
                            );
                        }
                        PivCredKind::MoveKey => {
                            ui.label(
                                egui::RichText::new(format!(
                                    "Move the key in {} to another slot.",
                                    move_src.label()
                                ))
                                .font(theme::f_reg(12.5))
                                .color(p.txt2),
                            );
                            ui.add_space(6.0);
                            ui.horizontal(|ui| {
                                ui.label(
                                    egui::RichText::new("Destination")
                                        .font(theme::f_reg(13.0))
                                        .color(p.txt2),
                                );
                                ui.add_space(8.0);
                                let sel_text = self
                                    .piv
                                    .move_dest
                                    .map(|d| d.label())
                                    .unwrap_or_else(|| "Choose a slot\u{2026}".to_string());
                                egui::ComboBox::from_id_salt("piv-move-dest")
                                    .selected_text(sel_text)
                                    .show_ui(ui, |ui| {
                                        for dest in &move_dests {
                                            stable_selectable_value(
                                                ui,
                                                &mut self.piv.move_dest,
                                                Some(*dest),
                                                dest.label(),
                                            );
                                        }
                                    });
                            });
                            ui.add_space(6.0);
                            self.piv_modal_mgmt_field(ui, p, kind);
                            card_note(
                                ui,
                                p,
                                "Moves only the key; the certificate stays in the \
                                 source slot. Needs YubiKey 5.7+ or compatible third \
                                 party device.",
                            );
                        }
                        PivCredKind::NewChuid => {
                            self.piv_modal_mgmt_field(ui, p, kind);
                            ui.horizontal(|ui| {
                                ui.add_sized(
                                    [chuid_label_width(ui.ctx()), 22.0],
                                    egui::Label::new(
                                        egui::RichText::new("GUID")
                                            .font(theme::f_reg(13.0))
                                            .color(p.txt2),
                                    ),
                                );
                                ui.add(
                                    egui::TextEdit::singleline(&mut self.piv.chuid_guid)
                                        .hint_text("hex, dashes optional")
                                        .desired_width(chuid_guid_field_width(ui.ctx())),
                                );
                                ui.add_space(6.0);
                                let (rrect, rresp) = ui.allocate_exact_size(
                                    egui::vec2(22.0, 22.0),
                                    egui::Sense::click(),
                                );
                                paint_refresh_icon(ui, rrect.center(), 7.0, p.txt2);
                                if rresp
                                    .on_hover_text("Generate a new random GUID")
                                    .on_hover_cursor(egui::CursorIcon::PointingHand)
                                    .clicked()
                                {
                                    self.piv_refresh_chuid_guid();
                                }
                            });
                            ui.add_space(4.0);
                            ui.horizontal(|ui| {
                                // Same fixed label column the "GUID" row above
                                // uses, so the years field's left edge lines up
                                // with the GUID input's.
                                ui.add_sized(
                                    [chuid_label_width(ui.ctx()), 22.0],
                                    egui::Label::new(
                                        egui::RichText::new("Valid for")
                                            .font(theme::f_reg(13.0))
                                            .color(p.txt2),
                                    ),
                                );
                                piv_valid_for_fields(
                                    ui,
                                    unix_now(),
                                    &mut self.piv.chuid_valid_years,
                                    &mut self.piv.chuid_valid_months,
                                    &mut self.piv.chuid_valid_days,
                                );
                            });
                            card_note(
                                ui,
                                p,
                                "Writes a fresh card ID. Windows' generic smartcard \
                                 minidriver caches PIV data by the CHUID's GUID, so this \
                                 is what makes it notice a key or certificate actually \
                                 changed. The expiration date is informational only — it \
                                 has no technical implications.",
                            );
                        }
                    }

                    // Inline error/result line: the new==confirm mismatch, then
                    // the op's error (kept open for a retry).
                    if let Some(msg) = mismatch {
                        ui.add_space(6.0);
                        ui.colored_label(p.err, msg);
                    } else if let Some(Err(e)) = &result {
                        ui.add_space(6.0);
                        ui.colored_label(p.err, e);
                    }

                    ui.add_space(16.0);
                    ui.horizontal(|ui| {
                        if busy {
                            ui.add(egui::Spinner::new());
                            ui.label(
                                egui::RichText::new(busy_text.as_str())
                                    .font(theme::f_reg(12.5))
                                    .color(p.txt2),
                            );
                        } else {
                            // Relabel Generate as a conscious "Overwrite key"
                            // when the target slot is occupied; the op itself is
                            // unchanged.
                            let submit = if kind == PivCredKind::GenerateKey && selected_occupied {
                                "Overwrite key"
                            } else {
                                kind.submit_label()
                            };
                            if theme::button(ui, p, BtnKind::Primary, submit).clicked()
                                && mismatch.is_none()
                            {
                                want_submit = true;
                            }
                            ui.add_space(8.0);
                            if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                                want_close = true;
                            }
                        }
                    });
                }
            }
        });

        // ✕ / Esc dismiss too, but never yank the dialog out from under a
        // running op (mirrors the enroll dialog's busy handling).
        if (closed || want_close) && !busy {
            self.piv_cred_modal_close();
            return;
        }
        if want_submit && !busy {
            // Mark busy first so the modal shows the spinner this frame; the op
            // writes the result back via `apply_piv_cred_result`. If the worker
            // is busy (spawn_job returns false implicitly), the op simply no-ops
            // and the next click retries.
            if let Some(m) = self.piv.cred_modal.as_mut() {
                m.busy = true;
                m.result = None;
            }
            // Clear any stale pane error so a client-side guard tripping during
            // this dispatch is distinguishable from a previous failure.
            self.piv.error = None;
            match kind {
                PivCredKind::ChangePin => self.piv_change_pin(),
                PivCredKind::ChangePuk => self.piv_change_puk(),
                PivCredKind::UnblockPin => self.piv_unblock_pin(),
                PivCredKind::GenerateKey => self.piv_generate_key(),
                PivCredKind::ImportCert => self.piv_import_cert(),
                PivCredKind::SelfSign => self.piv_self_sign(),
                PivCredKind::RequestCsr => self.piv_request_csr(),
                PivCredKind::SetRetries => self.piv_set_retries(),
                PivCredKind::ChangeMgmtKey => self.piv_change_management_key(),
                PivCredKind::DeleteCert => self.piv_delete_cert(),
                PivCredKind::DeleteKey => self.piv_delete_key(),
                PivCredKind::MoveKey => self.piv_move_key(),
                PivCredKind::NewChuid => self.piv_new_chuid(),
                PivCredKind::SelfTest => self.piv_self_test(),
            }
            // If the op didn't actually queue, unstick the modal. This happens
            // either because the worker was busy (no error set — just retry on
            // the next click) or because a client-side guard rejected the input
            // (bad hex, wrong new-key length, empty subject/path) and stored the
            // reason in `piv.error` — surface that reason in the modal result so
            // it shows in the dialog rather than scrolling off in the pane.
            if !self.busy() {
                let guard_err = self.piv.error.clone();
                if let Some(m) = self.piv.cred_modal.as_mut() {
                    m.busy = false;
                    if let Some(e) = guard_err {
                        m.result = Some(Err(e));
                    }
                }
            }
        }
    }

    /// Close the PIV credential modal, wiping every PIN/PUK field it could have
    /// touched (cheap to over-wipe; all are secrets).
    fn piv_cred_modal_close(&mut self) {
        wipe(&mut self.piv.pin_old);
        wipe(&mut self.piv.pin_new);
        wipe(&mut self.piv.pin_confirm);
        wipe(&mut self.piv.puk_old);
        wipe(&mut self.piv.puk_new);
        wipe(&mut self.piv.puk_confirm);
        wipe(&mut self.piv.unblock_puk);
        wipe(&mut self.piv.unblock_new_pin);
        // Management-key-gated flows also route their secrets through this modal.
        wipe(&mut self.piv.mgmt_key_input);
        wipe(&mut self.piv.new_mgmt_key_input);
        wipe(&mut self.piv.sign_pin);
        wipe(&mut self.piv.retries_pin_auth);
        self.piv.mgmt_auth_mode = PivMgmtAuthMode::default();
        self.piv.new_mgmt_allow_pin_unlock = false;
        self.piv.move_dest = None;
        self.piv.gen_pin_policy = keyroost_piv::PinPolicy::Default;
        self.piv.gen_touch_policy = keyroost_piv::TouchPolicy::Default;
        self.piv.cert_compression = PivCertCompressionSel::Auto;
        self.piv.cred_modal = None;
    }

    /// Render the admin-PIN (PW3) collector inside the OpenPGP modal, but only
    /// for the flows that need it (`OpenPgpCredKind::needs_admin_pin`). Shows a
    /// "Use default admin PIN (PW3)" toggle (the factory default `12345678`,
    /// common during bring-up) and, when it's off, the masked PIN field. When the
    /// toggle is on the field is hidden and the op reads the default via
    /// `openpgp_admin_pin_value`.
    fn openpgp_modal_admin_field(&mut self, ui: &mut egui::Ui, p: &Palette, kind: OpenPgpCredKind) {
        if !kind.needs_admin_pin() {
            return;
        }
        ui.checkbox(
            &mut self.openpgp.use_default_admin,
            "Use default admin PIN (PW3)",
        );
        if !self.openpgp.use_default_admin {
            pin_field(ui, p, "Admin PIN", &mut self.openpgp.admin_pin);
        }
    }

    /// OpenPGP credential-entry modal: drives the PIN flows (Change user PIN /
    /// Change admin PIN / Unblock user PIN) *and* the admin-PIN (PW3)-gated writes
    /// (set cardholder name / URL, generate / import key) plus the factory reset,
    /// inside the shared `modal_window` chrome, so the secret fields *and* the
    /// op's result stay centered on-screen rather than scrolling off (issue #31).
    ///
    /// The secret fields live in `OpenPgpState` (rendered here, not inline in the
    /// pane); the inline pane keeps the *non-secret* parameters (name, URL, slot,
    /// file path). The modal state (`OpenPgpState::cred_modal`) tracks the flow,
    /// an in-flight flag, and the op result. On Submit it runs the existing op,
    /// which writes the outcome back into the modal via `apply_openpgp_cred_result`.
    /// Rich, non-secret results (e.g. the new key fingerprint) still surface in
    /// the pane — the modal only shows a generic success line. Cancel / ✕ / Esc —
    /// and a successful Done — wipe the secret fields.
    fn render_openpgp_cred_modal(&mut self, ctx: &egui::Context, p: &Palette) {
        let Some(kind) = self.openpgp.cred_modal.as_ref().map(|m| m.kind) else {
            return;
        };
        let busy = self.openpgp.cred_modal.as_ref().is_some_and(|m| m.busy);
        let result = self
            .openpgp
            .cred_modal
            .as_ref()
            .and_then(|m| m.result.clone());

        let mut want_submit = false;
        let mut want_close = false;
        // Inline new==confirm guard, mirroring the op-level backstop (currently
        // never fires — the OpenPGP PIN forms have no confirm field — but kept
        // for shape parity with the PIV modal).
        let mismatch = openpgp_cred_mismatch(&self.openpgp, kind);

        let closed = Self::modal_window(ctx, p, "openpgp_cred", kind.title(), 300.0, |ui| {
            match &result {
                Some(Ok(())) => {
                    // Success: confirmation + a single Done that dismisses.
                    ui.label(
                        egui::RichText::new(format!("\u{2713} {}", kind.success()))
                            .font(theme::f_sb(13.0))
                            .color(p.ok),
                    );
                    ui.add_space(16.0);
                    if theme::button(ui, p, BtnKind::Primary, "Done").clicked() {
                        want_close = true;
                    }
                }
                _ => {
                    // Entry form (also the path while busy / after an error so the
                    // user can retry without losing the dialog).
                    match kind {
                        OpenPgpCredKind::ChangeUserPin => {
                            pin_field(ui, p, "Current PIN", &mut self.openpgp.user_pin_old);
                            pin_field(ui, p, "New PIN", &mut self.openpgp.user_pin_new);
                            card_note(ui, p, "User PIN (PW1): 6\u{2013}127 characters.");
                        }
                        OpenPgpCredKind::ChangeAdminPin => {
                            pin_field(ui, p, "Current PIN", &mut self.openpgp.admin_pin_old);
                            pin_field(ui, p, "New PIN", &mut self.openpgp.admin_pin_new);
                            card_note(ui, p, "Admin PIN (PW3): 8\u{2013}127 characters.");
                        }
                        OpenPgpCredKind::UnblockUserPin => {
                            self.openpgp_modal_admin_field(ui, p, kind);
                            pin_field(ui, p, "New user PIN", &mut self.openpgp.unblock_new);
                            card_note(
                                ui,
                                p,
                                "Resets a blocked user PIN using the admin PIN (PW3).",
                            );
                        }
                        OpenPgpCredKind::SetName => {
                            self.openpgp_modal_admin_field(ui, p, kind);
                            card_note(ui, p, "Authorizes writing the cardholder name.");
                        }
                        OpenPgpCredKind::SetUrl => {
                            self.openpgp_modal_admin_field(ui, p, kind);
                            card_note(ui, p, "Authorizes writing the public-key URL.");
                        }
                        OpenPgpCredKind::GenerateKey => {
                            let crt = self.openpgp.selected_key.to_crt();
                            let choices =
                                OpenPgpKeyAlgSel::choices(self.openpgp.supported.as_ref(), crt);
                            ui.horizontal(|ui| {
                                ui.add_sized(
                                    [96.0, 22.0],
                                    egui::Label::new(
                                        egui::RichText::new("Algorithm")
                                            .font(theme::f_reg(13.0))
                                            .color(p.txt2),
                                    ),
                                );
                                openpgp_keyalg_combo(
                                    ui,
                                    "openpgp-gen-alg",
                                    &mut self.openpgp.gen_alg,
                                    &choices,
                                );
                            });
                            ui.add_space(4.0);
                            if self.openpgp.supported.is_none() {
                                card_note(
                                    ui,
                                    p,
                                    "This card does not list its algorithms; the card \
                                     rejects any it cannot do.",
                                );
                            }
                            self.openpgp_modal_admin_field(ui, p, kind);
                            card_note(
                                ui,
                                p,
                                "OVERWRITES the slot with a fresh on-card key (clearable \
                                 only by a full reset). May need a touch.",
                            );
                        }
                        OpenPgpCredKind::GenerateImportKey | OpenPgpCredKind::ImportKeyFile => {
                            self.openpgp_modal_admin_field(ui, p, kind);
                            card_note(
                                ui,
                                p,
                                "OVERWRITES the slot with the imported key (clearable only \
                                 by a full reset). May need a touch.",
                            );
                        }
                        OpenPgpCredKind::Reset => {
                            card_note(
                                ui,
                                p,
                                "Wipes ALL OpenPGP keys and restores default PINs. Works \
                                 even if the PINs are forgotten. No PIN needed.",
                            );
                        }
                    }

                    // Inline error/result line: the (currently inert) mismatch,
                    // then the op's error (kept open for a retry).
                    if let Some(msg) = mismatch {
                        ui.add_space(6.0);
                        ui.colored_label(p.err, msg);
                    } else if let Some(Err(e)) = &result {
                        ui.add_space(6.0);
                        ui.colored_label(p.err, e);
                    }

                    ui.add_space(16.0);
                    ui.horizontal(|ui| {
                        if busy {
                            ui.add(egui::Spinner::new());
                            ui.label(
                                egui::RichText::new(kind.busy_label())
                                    .font(theme::f_reg(12.5))
                                    .color(p.txt2),
                            );
                        } else {
                            let btn = if kind == OpenPgpCredKind::Reset {
                                BtnKind::Danger
                            } else {
                                BtnKind::Primary
                            };
                            if theme::button(ui, p, btn, kind.submit_label()).clicked()
                                && mismatch.is_none()
                            {
                                want_submit = true;
                            }
                            ui.add_space(8.0);
                            if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                                want_close = true;
                            }
                        }
                    });
                }
            }
        });

        // ✕ / Esc dismiss too, but never yank the dialog out from under a
        // running op (mirrors the PIV modal's busy handling).
        if (closed || want_close) && !busy {
            self.openpgp_cred_modal_close();
            return;
        }
        if want_submit && !busy {
            // The modal is bound to the device it opened for (KEY-013); a
            // stale one must close, not dispatch against the new selection.
            if !completion_still_valid(
                self.openpgp
                    .cred_modal
                    .as_ref()
                    .and_then(|m| m.device.as_ref()),
                self.selected_device.as_ref(),
            ) {
                self.openpgp_cred_modal_close();
                return;
            }
            // Mark busy first so the modal shows the spinner this frame; the op
            // writes the result back via `apply_openpgp_cred_result`.
            if let Some(m) = self.openpgp.cred_modal.as_mut() {
                m.busy = true;
                m.result = None;
            }
            self.openpgp.error = None;
            match kind {
                OpenPgpCredKind::ChangeUserPin => self.change_openpgp_user_pin(),
                OpenPgpCredKind::ChangeAdminPin => self.change_openpgp_admin_pin(),
                OpenPgpCredKind::UnblockUserPin => self.unblock_openpgp_user_pin(),
                OpenPgpCredKind::SetName => self.set_openpgp_name(),
                OpenPgpCredKind::SetUrl => self.set_openpgp_url(),
                OpenPgpCredKind::GenerateKey => {
                    self.generate_openpgp_key();
                }
                OpenPgpCredKind::GenerateImportKey => {
                    self.import_openpgp_key(ImportSource::Generate);
                }
                OpenPgpCredKind::ImportKeyFile => {
                    self.import_openpgp_key(ImportSource::FromFile);
                }
                OpenPgpCredKind::Reset => {
                    self.reset_openpgp();
                }
            }
            // If the op didn't actually queue, unstick the modal. Either the
            // worker was busy (no error set — retry on the next click) or a
            // client-side guard rejected the input and stored the reason in
            // `openpgp.error`; surface that in the modal so it shows in the
            // dialog rather than scrolling off in the pane.
            if !self.busy() {
                let guard_err = self.openpgp.error.clone();
                if let Some(m) = self.openpgp.cred_modal.as_mut() {
                    m.busy = false;
                    if let Some(e) = guard_err {
                        m.result = Some(Err(e));
                    }
                }
            }
        }
    }

    /// Close the OpenPGP credential modal, wiping every PIN field it could have
    /// touched (cheap to over-wipe; all are secrets) and clearing the
    /// use-default toggle.
    fn openpgp_cred_modal_close(&mut self) {
        self.openpgp.wipe_secrets();
        self.openpgp.cred_modal = None;
    }

    /// Authenticator / OATH tab — live codes with countdown rings + copy.
    fn cap_oath(&mut self, ui: &mut egui::Ui, p: &Palette) {
        // Auto-attempt a read once per selection (a hard error won't retry).
        if !self.oath_tried && !self.busy() && self.oath.error.is_none() && !self.oath.locked {
            self.oath_tried = true;
            self.load_oath_creds();
        }
        ui.horizontal(|ui| {
            ui.label(
                egui::RichText::new("Authenticator codes")
                    .font(theme::f_sb(14.5))
                    .color(p.txt),
            );
            ui.add_space(6.0);
            self.help_dot(ui, p, "oath");
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                if theme::button(ui, p, BtnKind::Primary, "+ Add credential").clicked() {
                    // Opens the centered "New credential" modal (rendered in the
                    // update loop alongside the other credential modals).
                    self.oath.add = OathAddDialog::opened();
                }
                ui.add_space(6.0);
                if theme::button(ui, p, BtnKind::Default, "Refresh").clicked() {
                    self.load_oath_creds();
                }
            });
        });
        ui.add_space(12.0);
        if let Some(err) = &self.oath.error {
            ui.colored_label(p.err, err);
            ui.add_space(6.0);
        }
        if self.oath.locked {
            theme::card_frame(p).show(ui, |ui| {
                ui.label(
                    egui::RichText::new("This key's OATH applet is password-protected.")
                        .font(theme::f_reg(13.0))
                        .color(p.txt),
                );
                ui.add_space(8.0);
                ui.horizontal(|ui| {
                    let resp = ui.add_sized(
                        [220.0, 32.0],
                        egui::TextEdit::singleline(&mut self.oath.password_input)
                            .vertical_align(egui::Align::Center)
                            .password(true),
                    );
                    guard_secret_field(ui.ctx(), &resp);
                    let submit = theme::button(ui, p, BtnKind::Primary, "Unlock").clicked();
                    // Enter in the field submits too, matching the FIDO2 unlock card
                    // and the other inline credential fields in this redesign.
                    if submit
                        || (resp.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)))
                    {
                        self.load_oath_creds();
                    }
                });
            });
            // Forgotten the password? Reset is the documented recovery and
            // needs no password — it must stay reachable from the locked
            // view, not hide behind the unlock it exists to replace.
            ui.add_space(14.0);
            self.render_oath_reset_card(ui, p);
            return;
        }
        if !self.oath.loaded {
            ui.label(
                egui::RichText::new("Reading codes\u{2026}")
                    .font(theme::f_reg(13.0))
                    .color(p.txt3),
            );
            return;
        }
        if self.oath.skipped > 0 {
            // Partial listing: the card holds entries we couldn't decode. Shown
            // before (and instead of) "No authenticator codes" — a key whose
            // only credentials are undecodable is NOT empty.
            ui.label(
                egui::RichText::new(format!(
                    "\u{26A0} {} entr{} on this key could not be decoded and {} not shown.",
                    self.oath.skipped,
                    if self.oath.skipped == 1 { "y" } else { "ies" },
                    if self.oath.skipped == 1 { "is" } else { "are" },
                ))
                .font(theme::f_reg(13.0))
                .color(p.warn),
            );
            ui.add_space(4.0);
        }
        if self.oath.creds.is_empty() {
            if self.oath.skipped == 0 {
                ui.label(
                    egui::RichText::new("No authenticator codes on this key.")
                        .font(theme::f_reg(13.0))
                        .color(p.txt3),
                );
            }
            // An empty applet can still carry a password; keep the reset
            // reachable so it can be cleared.
            ui.add_space(14.0);
            self.render_oath_reset_card(ui, p);
            return;
        }

        let mut copy: Option<(String, String)> = None;
        let mut delete: Option<String> = None;
        let mut read: Option<String> = None;
        theme::card_frame(p).show(ui, |ui| {
            let n = self.oath.creds.len();
            for (i, row) in self.oath.creds.iter().enumerate() {
                let is_copied = self.copied.as_ref().is_some_and(|(nm, _)| nm == &row.name);
                let (c, d, r) = oath_row(
                    ui,
                    p,
                    &row.name,
                    row.code.as_deref(),
                    row.hotp,
                    is_copied,
                    true,
                );
                if let Some(code) = c {
                    copy = Some((row.name.clone(), code));
                }
                if d {
                    delete = Some(row.name.clone());
                }
                if r {
                    read = Some(row.name.clone());
                }
                if i + 1 < n {
                    ui.add_space(5.0);
                    let y = ui.cursor().top();
                    ui.painter().hline(
                        ui.max_rect().x_range(),
                        y,
                        egui::Stroke::new(1.0, p.line_soft),
                    );
                    ui.add_space(5.0);
                }
            }
        });
        if let Some((name, code)) = copy {
            ui.ctx().copy_text(code.clone());
            self.copied = Some((name, now_secs_f64() + 1.2));
            self.clipboard_clear_at = Some((code, now_secs_f64() + 45.0));
        }
        if let Some(name) = delete {
            if let Some(dev) = self.selected_device.clone() {
                self.oath.confirm_delete = Some((dev, name));
            }
        }
        if let Some(name) = read {
            self.read_hotp_code(&name);
        }

        // Danger card at the bottom of the pane, mirroring the FIDO2 /
        // OpenPGP / PIV reset cards.
        ui.add_space(14.0);
        self.render_oath_reset_card(ui, p);
    }

    /// The destructive "Reset applet" card for the OATH pane (red stroke;
    /// arms the device-bound confirmation modal). Rendered at the bottom of
    /// the unlocked pane AND under the locked view's password prompt — the
    /// applet's RESET needs no password and is the documented recovery for a
    /// forgotten one, so it must never hide behind the unlock (the same
    /// principle as the standalone FIDO reset card, 0.7.6).
    fn render_oath_reset_card(&mut self, ui: &mut egui::Ui, p: &Palette) {
        let mut arm = false;
        theme::card_frame(p)
            .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
            .show(ui, |ui| {
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Reset applet")
                            .font(theme::f_sb(14.5))
                            .color(p.err),
                    );
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Reset applet\u{2026}").clicked() {
                            arm = true;
                        }
                    });
                });
                ui.label(
                    egui::RichText::new(
                        "Wipes every authenticator credential and clears the password. \
                         Works without the password — this is the recovery for a \
                         forgotten one. Cannot be undone.",
                    )
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
                );
            });
        if arm {
            self.oath.confirm_reset = self.selected_device.clone();
        }
    }

    /// OpenPGP tab — read-only status + the existing management section.
    fn cap_pgp(&mut self, ui: &mut egui::Ui, p: &Palette) {
        // Intents collected inside the UI closures and applied afterwards, so a
        // submit method's `&mut self` never overlaps a card's borrow. (Mirrors
        // the PIV pane.) `open_modal` carries the chosen credential flow.
        let mut do_refresh = false;
        let mut open_modal: Option<OpenPgpCredKind> = None;
        let mut browse_import_key = false;
        // The key the user clicked in the sub-tab strip this frame (applied
        // after the card borrows end). `selected` is a copy of the active key so
        // the immutable card closures can compare without borrowing self.
        let mut clicked_key: Option<OpenPgpSlotSel> = None;
        let selected = self.openpgp.selected_key;

        let note = |ui: &mut egui::Ui, t: &str| card_note(ui, p, t);

        // --- OpenPGP card status card (full-width, FIDO2 shape): title + help
        // left, Read status right, applet-wide status body, then the applet-wide
        // admin (Card details, PINs) folded in as setting-rows.
        theme::card_frame(p).show(ui, |ui| {
            ui.set_min_width(ui.available_width());
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("OpenPGP card")
                        .font(theme::f_sb(14.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pgp");
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Read status").clicked() {
                        do_refresh = true;
                    }
                });
            });
            ui.add_space(8.0);
            if let Some(err) = &self.openpgp.error {
                ui.colored_label(p.err, err);
                ui.add_space(6.0);
            }
            if let Some(notice) = &self.openpgp.notice {
                ui.colored_label(p.ok, notice);
                ui.add_space(6.0);
            }
            // Applet-wide status: AID / serial / PIN retries / signatures made.
            // The three per-key algorithm+fingerprint rows live under the sub-tab
            // strip now, not here.
            if let Some(status) = &self.openpgp.status {
                let serial = status
                    .serial()
                    .map_or("\u{2014}".to_string(), |s| format!("{s} (0x{s:08X})"));
                let sigs = status
                    .signature_count
                    .map_or("\u{2014}".to_string(), |n| n.to_string());
                ui.label(
                    egui::RichText::new(format!(
                        "AID {} \u{00B7} Serial {serial}",
                        hex_lower(&status.aid)
                    ))
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
                );
                ui.add_space(2.0);
                ui.label(
                    egui::RichText::new(format!(
                        "PIN retries PW1={} RC={} PW3={} \u{00B7} Signatures made {sigs}",
                        status.tries_pw1, status.tries_rc, status.tries_pw3
                    ))
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
                );
            } else if self.openpgp.error.is_none() {
                ui.label(
                    egui::RichText::new("Click Read status to read this card (no PIN or touch).")
                        .font(theme::f_reg(13.0))
                        .color(p.txt3),
                );
            }

            // Applet-wide administration folded in as FIDO2 setting-rows: the
            // cardholder details and the PIN operations apply to the whole card,
            // not to one key, so they sit with the applet status here.
            ui.add_space(12.0);

            // Card details: cardholder name + public-key URL. The values are
            // typed in the per-row text fields; both writes prompt for the admin
            // PIN (PW3) in a dialog.
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("Card details")
                        .font(theme::f_sb(13.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pgp-card-details");
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Set URL\u{2026}").clicked() {
                        open_modal = Some(OpenPgpCredKind::SetUrl);
                    }
                    ui.add_space(6.0);
                    if theme::button(ui, p, BtnKind::Default, "Set name\u{2026}").clicked() {
                        open_modal = Some(OpenPgpCredKind::SetName);
                    }
                });
            });
            ui.add_space(6.0);
            text_field(
                ui,
                p,
                "Name",
                &mut self.openpgp.name_input,
                "Surname<<Given",
                200.0,
            );
            ui.add_space(4.0);
            text_field(
                ui,
                p,
                "URL",
                &mut self.openpgp.url_input,
                "https://\u{2026}",
                240.0,
            );

            // PINs: change user / admin, unblock user. Each opens a dialog where
            // the PIN entry happens; nothing secret is typed inline.
            ui.add_space(10.0);
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("PINs")
                        .font(theme::f_sb(13.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pin");
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Unblock user PIN\u{2026}").clicked()
                    {
                        open_modal = Some(OpenPgpCredKind::UnblockUserPin);
                    }
                    ui.add_space(6.0);
                    if theme::button(ui, p, BtnKind::Default, "Change admin PIN\u{2026}").clicked()
                    {
                        open_modal = Some(OpenPgpCredKind::ChangeAdminPin);
                    }
                    ui.add_space(6.0);
                    if theme::button(ui, p, BtnKind::Default, "Change user PIN\u{2026}").clicked() {
                        open_modal = Some(OpenPgpCredKind::ChangeUserPin);
                    }
                });
            });
        });

        // --- Selected-key display data (shown under the key tab strip) -------
        // The active key's algorithm + fingerprint, read straight off the loaded
        // status. Precomputed here so the immutable card closures don't borrow
        // self.
        let sel_state: String = match &self.openpgp.status {
            Some(st) => {
                let (attrs, fpr) = selected.status_fields(st);
                if fpr.iter().all(|&b| b == 0) {
                    "no key".to_string()
                } else {
                    format!(
                        "{} \u{00B7} fpr {}",
                        keyroost_transport::describe_algorithm_attributes(attrs),
                        hex_lower(fpr)
                    )
                }
            }
            None => "read status to view this key".to_string(),
        };

        // --- Key sub-tab strip ----------------------------------------------
        // Signature / Decryption / Authentication, each a tab exactly like the
        // FIDO2 sub-tab strip: an opaque surface strip behind a row of bold
        // labels, the active one underlined with a 2px accent. Clicking a tab
        // selects that key; the Generate / Import cards below target it.
        ui.add_space(14.0);
        {
            let top = ui.cursor().top();
            let strip = egui::Rect::from_min_max(
                egui::pos2(ui.max_rect().left(), top - 4.0),
                egui::pos2(ui.max_rect().right(), top + 30.0),
            );
            ui.painter().rect_filled(strip, 0.0, p.surface);
        }
        ui.horizontal(|ui| {
            ui.spacing_mut().item_spacing.x = 20.0;
            for key in [
                OpenPgpSlotSel::Sign,
                OpenPgpSlotSel::Decrypt,
                OpenPgpSlotSel::Auth,
            ] {
                let active = selected == key;
                let color = if active { p.txt } else { p.txt3 };
                let resp = ui
                    .add(
                        egui::Label::new(
                            egui::RichText::new(key.tab_label())
                                .font(theme::f_sb(13.5))
                                .color(color),
                        )
                        .sense(egui::Sense::click()),
                    )
                    .on_hover_cursor(egui::CursorIcon::PointingHand);
                if active {
                    let y = resp.rect.bottom() + 6.0;
                    ui.painter().line_segment(
                        [
                            egui::pos2(resp.rect.left(), y),
                            egui::pos2(resp.rect.right(), y),
                        ],
                        egui::Stroke::new(2.0, p.accent),
                    );
                }
                if resp.clicked() {
                    clicked_key = Some(key);
                }
            }
        });

        // --- Selected key content (single column under the strip) -----------
        ui.add_space(14.0);
        ui.label(
            egui::RichText::new(format!("State: {sel_state}"))
                .font(theme::f_reg(12.5))
                .color(p.txt2),
        );
        ui.add_space(10.0);
        theme::card_frame(p).show(ui, |ui| {
            ui.set_min_width(ui.available_width());

            // Generate on-card: label + help left, Generate pinned right.
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("Generate on-card")
                        .font(theme::f_sb(13.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pgp-keys");
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    if theme::button(ui, p, BtnKind::Default, "Generate\u{2026}").clicked() {
                        open_modal = Some(OpenPgpCredKind::GenerateKey);
                    }
                });
            });
            note(
                ui,
                "Generating OVERWRITES this key (clearable only by a full reset). \
                 Prompts for the admin PIN; touch the key if it blinks.",
            );

            ui.add_space(12.0);
            // Import RSA-2048: file path + Browse left, the two import actions
            // pinned right.
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new("Import RSA-2048")
                        .font(theme::f_sb(13.5))
                        .color(p.txt),
                );
                ui.add_space(6.0);
                self.help_dot(ui, p, "pgp-keys");
            });
            ui.add_space(6.0);
            ui.horizontal(|ui| {
                text_field(
                    ui,
                    p,
                    "From file",
                    &mut self.openpgp.import_path,
                    "/path/to/key.pem (PKCS#1/8, PEM or DER)",
                    240.0,
                );
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    browse_import_key =
                        theme::button(ui, p, BtnKind::Default, "Browse\u{2026}").clicked();
                });
            });
            let have_path = !self.openpgp.import_path.trim().is_empty();
            ui.add_space(6.0);
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                if theme::button(ui, p, BtnKind::Default, "Import file\u{2026}").clicked()
                    && have_path
                {
                    open_modal = Some(OpenPgpCredKind::ImportKeyFile);
                }
                ui.add_space(6.0);
                if theme::button(ui, p, BtnKind::Default, "Generate & import\u{2026}").clicked() {
                    open_modal = Some(OpenPgpCredKind::GenerateImportKey);
                }
            });
        });
        ui.add_space(12.0);

        // Reset applet — its own destructive card with a red stroke at the
        // bottom of the pane (mirrors the FIDO2 / PIV "Reset" card), full width,
        // description left + red button right.
        theme::card_frame(p)
            .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
            .show(ui, |ui| {
                ui.set_min_width(ui.available_width());
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Reset applet")
                            .font(theme::f_sb(14.5))
                            .color(p.err),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "reset");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Danger, "Reset applet\u{2026}").clicked() {
                            open_modal = Some(OpenPgpCredKind::Reset);
                        }
                    });
                });
                ui.label(
                    egui::RichText::new(
                        "Wipes ALL OpenPGP keys and restores default PINs. Works even if \
                         the PINs are forgotten.",
                    )
                    .font(theme::f_reg(12.5))
                    .color(p.txt2),
                );
            });

        // Apply collected intents now that the card borrows have ended.
        if let Some(key) = clicked_key {
            self.openpgp.selected_key = key;
            self.openpgp.gen_alg = OpenPgpKeyAlgSel::CardDefault;
        }
        if do_refresh {
            self.load_openpgp_status();
        }
        if browse_import_key {
            self.spawn_file_dialog(
                FileTarget::OpenpgpImport,
                false,
                &[("Keys", &["pem", "der", "key"]), ("All files", &["*"])],
                None,
            );
        }
        // Open the chosen flow's credential modal, wiping any stale secret first
        // so a PIN typed for a previous flow can't ride along.
        if let Some(kind) = open_modal {
            self.openpgp.wipe_secrets();
            self.openpgp.error = None;
            self.openpgp.cred_modal =
                Some(OpenPgpCredModal::new(kind, self.selected_device.clone()));
        }
    }

    /// PIV tab — read-only status snapshot (auto-read on first view).
    fn cap_piv(&mut self, ui: &mut egui::Ui, p: &Palette) {
        use keyroost_piv::compat::{FeatureGate, PivExtension};
        if !self.piv_tried && !self.busy() {
            self.piv_tried = true;
            self.load_piv_status(LogKind::Background);
        }
        // Intents collected inside the UI closures and applied afterwards, so a
        // submit method's `&mut self` never overlaps a card's borrow.
        let mut do_refresh = false;
        let mut open_change_pin = false;
        let mut open_change_puk = false;
        let mut open_unblock = false;
        let mut open_generate = false;
        let mut open_import = false;
        let mut go_export = false;
        let mut open_self_sign = false;
        let mut open_csr = false;
        let mut open_set_retries = false;
        let mut open_change_mgmt = false;
        let mut open_delete_cert = false;
        let mut open_delete_key = false;
        let mut open_move_key = false;
        let mut open_self_test = false;
        let mut open_new_chuid = false;
        let mut toggle_compat_table = false;
        let mut click_retired_tab = false;
        let mut arm_reset = false;
        let mut go_to_overview = false;
        let mut copy_pem: Option<String> = None;
        // Slot the user clicked in the status card this frame (applied after the
        // card borrows end). `selected` is a copy of the active selection so the
        // immutable card closures can compare against it without borrowing self.
        let mut clicked_slot: Option<PivSlotSel> = None;
        let selected = self.piv.selected_slot;

        let note = |ui: &mut egui::Ui, t: &str| card_note(ui, p, t);

        // Yubico SET PIN RETRIES (`INS 0xFA`) sets the PIN's and PUK's retry
        // counters together in one APDU — there is no way to change one
        // without the other — so it's gated by a single extension rather
        // than a pair the way Move/Delete key are. Computed up front,
        // before the "Retry counts" row below (the per-slot gates further
        // down compute this same fingerprint/version triple again, for
        // their own slot-scoped purposes).
        let (retries_piv_fp, retries_piv_ver, retries_piv_fw_ver) =
            self.piv.status.as_ref().map_or(
                (
                    keyroost_piv::fingerprint::AppletFingerprint::Generic,
                    None,
                    None,
                ),
                |s| {
                    (
                        s.applet_fingerprint,
                        s.version.as_deref(),
                        s.version_firmware.as_deref(),
                    )
                },
            );
        let set_retries_gate = self.piv_gate(
            PivExtension::SetPinPukRetries,
            retries_piv_fp,
            retries_piv_ver,
            retries_piv_fw_ver,
        );
        let set_retries_unverified_hint = format!(
            "{} {}",
            PivExtension::SetPinPukRetries.requirement(),
            FeatureGate::UNVERIFIED_SUFFIX
        );
        let set_retries_blocked_hint = format!(
            "{} {}",
            PivExtension::SetPinPukRetries.requirement(),
            FeatureGate::INCOMPATIBLE_SUFFIX
        );
        // Change management key (Yubico SET MANAGEMENT KEY) is gated the
        // same way, from the same fingerprint/version triple as the retry
        // counts above — see the "Management key" row below.
        let change_mgmt_key_gate = self.piv_gate(
            PivExtension::SetManagementKey,
            retries_piv_fp,
            retries_piv_ver,
            retries_piv_fw_ver,
        );
        let change_mgmt_key_unverified_hint = format!(
            "{} {}",
            PivExtension::SetManagementKey.requirement(),
            FeatureGate::UNVERIFIED_SUFFIX
        );
        let change_mgmt_key_blocked_hint = format!(
            "{} {}",
            PivExtension::SetManagementKey.requirement(),
            FeatureGate::INCOMPATIBLE_SUFFIX
        );
        // Per-algorithm gates for the "Management key" row's algorithm
        // combo, below — same shape as `keyalg_gates` (the slot
        // key-algorithm combo's own gate table, built further down in this
        // function): resolved eagerly here (an owned array, not a closure
        // over `retries_piv_fp`/`retries_piv_ver`/`retries_piv_fw_ver`) for
        // the same borrow-lifetime reason `keyalg_gates`'s own doc gives. Not
        // every algorithm is universally implemented, standardized or not,
        // and `Delete` is a real HID-Crescendo-only capability rather than
        // always-unsupported filler — see
        // `PivExtension::ManagementKeyAlgorithm`'s own doc.
        let mgmtalg_gates: [(PivMgmtAlgSel, FeatureGate); PivMgmtAlgSel::ALL.len()] =
            PivMgmtAlgSel::ALL.map(|alg| {
                (
                    alg,
                    self.piv_gate(
                        PivExtension::ManagementKeyAlgorithm(alg.to_choice()),
                        retries_piv_fp,
                        retries_piv_ver,
                        retries_piv_fw_ver,
                    ),
                )
            });
        let mgmtalg_gate = move |alg: PivMgmtAlgSel| {
            mgmtalg_gates
                .iter()
                .find_map(|&(a, gate)| (a == alg).then_some(gate))
                .unwrap_or(FeatureGate::Unverified)
        };
        // Unsupported doesn't just dim the DragValues below -- with no way
        // to submit them, a count the user dragged in before this device
        // turned out incompatible (or left over from a previous, compatible
        // device, since this pane's state doesn't reset on every status
        // refresh) would otherwise sit there stale and misleading. Reset
        // both back to the same factory-default count `PivState::default()`
        // seeds them with, every frame this gate resolves `Unsupported` --
        // cheap and idempotent, and the fields are non-interactive anyway
        // while it holds.
        if matches!(set_retries_gate, FeatureGate::Unsupported) {
            self.piv.retries_pin = 3;
            self.piv.retries_puk = 3;
        }

        // --- PIV smart card status card (full-width, FIDO2 "PIN & sign-in"
        // shape): title + help left, Refresh right, applet/serial/retries body.
        //
        // Wrapped in `add_enabled_ui` rather than gating each button/field
        // below: egui propagates `enabled` down the whole child tree, so
        // this one call dims Refresh, the PIN/PUK/retries/management-key/
        // CHUID actions, and every input among them together, with nothing
        // to keep in sync as rows are added or reordered. `self.piv.inflight`
        // covers every PIV job, not just this card's own Refresh, so any
        // in-flight generate/import/delete/... elsewhere dims this card too.
        ui.add_enabled_ui(!self.piv.inflight, |ui| {
            theme::card_frame(p).show(ui, |ui| {
                ui.set_min_width(ui.available_width());
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("PIV smart card")
                            .font(theme::f_sb(14.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "Refresh").clicked() {
                            do_refresh = true;
                        }
                    });
                });
                ui.add_space(8.0);
                if let Some(err) = &self.piv.error {
                    ui.colored_label(p.err, err);
                    ui.add_space(6.0);
                }
                if let Some(n) = &self.piv.notice {
                    ui.colored_label(p.ok, n);
                    ui.add_space(6.0);
                }
                // Status body: version / serial / PIN retries collapsed onto one
                // dotted line.
                if let Some(st) = &self.piv.status {
                    // Tolerant of any non-empty GET VERSION reply, not just real
                    // Yubico firmware's 3 bytes — some third-party PIV applets
                    // that answer this vendor extension at all use a different
                    // byte count (observed: a Swissbit iShield Key 2 Pro replies
                    // with 4).
                    //
                    // `version_firmware` is the token's own firmware version
                    // (read through a fingerprint-specific probe only some
                    // tokens answer — currently a Nitrokey only), a separate
                    // axis from the PIV applet's own version above — see
                    // `PivStatus::version_firmware`'s doc for why the two
                    // aren't interchangeable. Shown only when it adds
                    // information: suppressed when it's absent, and folded
                    // into the "Applet" segment (rather than repeated as its
                    // own dotted field) when it equals the applet version, so
                    // the common case where a token doesn't distinguish the
                    // two axes doesn't show the same number twice.
                    let applet_ver = st.version.as_deref().map(keyroost_piv::format_version_bytes);
                    let fw_ver = st
                        .version_firmware
                        .as_deref()
                        .filter(|fw| Some(*fw) != st.version.as_deref())
                        .map(keyroost_piv::format_version_bytes);
                    let applet_field = match (applet_ver, fw_ver) {
                        (Some(av), Some(fw)) => format!("Applet {av} (FW v{fw})"),
                        (Some(av), None) => format!("Applet {av}"),
                        (None, Some(fw)) => format!("Applet FW v{fw}"),
                        (None, None) => "Applet \u{2014}".to_string(),
                    };
                    let serial = st
                        .serial
                        .map_or("\u{2014}".to_string(), keyroost_piv::format_serial_short);
                    let retries = st
                        .pin_retries
                        .map_or("\u{2014}".to_string(), |n| n.to_string());
                    // The token's own reported name when it has one (e.g. a
                    // Nitrokey's admin application); otherwise the generic name
                    // for its fingerprinted applet family — same fallback as
                    // `keyroostctl piv status`'s plain-text output.
                    let applet_name = if st.applet_name.is_empty() {
                        st.applet_fingerprint.applet_name().to_string()
                    } else {
                        st.applet_name.clone()
                    };
                    ui.label(
                        egui::RichText::new(format!(
                            "{applet_name} \u{00B7} {applet_field} \u{00B7} Serial {serial} \u{00B7} PIN retries {retries}"
                        ))
                        .font(theme::f_reg(12.5))
                        .color(p.txt2),
                    );
                    // CHUID — GUID and expiration only. FASC-N carries no
                    // information worth showing here (it's a fixed filler, not
                    // real card data — see keyroost_piv::encode_chuid) and stays
                    // out of the UI; `keyroostctl piv status` still prints it.
                    // The signature and LRC fields are omitted everywhere.
                    if let Some(chuid) = &st.chuid {
                        ui.label(
                            egui::RichText::new(format!(
                                "CHUID: GUID {} \u{00B7} Expires {}",
                                chuid.guid_display(),
                                chuid.expiration_display()
                            ))
                            .font(theme::f_reg(12.5))
                            .color(p.txt2),
                        );
                    }
                } else if self.piv.error.is_none() {
                    ui.label(
                        egui::RichText::new("Reading PIV status\u{2026}")
                            .font(theme::f_reg(13.0))
                            .color(p.txt3),
                    );
                }

                // Applet-wide administration: PIN & PUK, retry counts, and the
                // management key all apply to the whole applet rather than to one
                // slot, so they sit with the applet status here.
                ui.add_space(12.0);

                // PIN & PUK: bold label + help left, the three actions right.
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("PIN & PUK")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "pin");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "Unblock PIN\u{2026}").clicked() {
                            open_unblock = true;
                        }
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Default, "Change PUK\u{2026}").clicked() {
                            open_change_puk = true;
                        }
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Default, "Change PIN\u{2026}").clicked() {
                            open_change_pin = true;
                        }
                    });
                });

                // Retry counts: label + help left, the tries DragValues and the
                // apply button right-aligned. SET PIN RETRIES (Yubico `INS
                // 0xFA`) sets both counters in one APDU, so it's gated by the
                // single `set_retries_gate` above rather than a pair, unlike
                // Move/Delete key: `Unsupported` dims both DragValues and the
                // button together (there's nothing partial to offer) and resets
                // both counts to their factory default above, rather than
                // leaving a stale drag-in value behind a disabled field; and
                // `Unverified` only adds the same warning marker Move key uses,
                // leaving everything else live.
                ui.add_space(10.0);
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Retry counts")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-admin");
                    if matches!(set_retries_gate, FeatureGate::Unverified) {
                        ui.add_space(4.0);
                        theme::warn_marker(ui, p).on_hover_text(set_retries_unverified_hint.as_str());
                    }
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if matches!(set_retries_gate, FeatureGate::Unsupported) {
                            theme::button_disabled(ui, p, "Set retry counts\u{2026}")
                                .on_hover_text(set_retries_blocked_hint.as_str());
                        } else if theme::button(ui, p, BtnKind::Default, "Set retry counts\u{2026}")
                            .clicked()
                        {
                            open_set_retries = true;
                        }
                        ui.add_space(8.0);
                        let retries_unsupported = matches!(set_retries_gate, FeatureGate::Unsupported);
                        // A disabled `DragValue` still renders whatever number
                        // `self.piv.retries_{pin,puk}` currently holds — the
                        // factory-default `3` these two reset to just above, on
                        // a device that plain doesn't support setting retries at
                        // all. Left alone, that reads as a real reported count
                        // rather than the meaningless placeholder it is. Blank
                        // it via a custom formatter rather than the field's
                        // value: the value itself still has to stay a real `u8`
                        // (`DragValue` requires `Numeric`, and the same field
                        // backs the live, editable count on any device that
                        // *does* support this), so emptiness lives at the
                        // display layer, not the data.
                        let blank_when_unsupported = move |n: f64, _: std::ops::RangeInclusive<usize>| {
                            if retries_unsupported {
                                String::new()
                            } else {
                                format!("{}", n as u8)
                            }
                        };
                        ui.add_enabled(
                            !retries_unsupported,
                            egui::DragValue::new(&mut self.piv.retries_puk)
                                .range(1..=15u8)
                                .custom_formatter(blank_when_unsupported),
                        );
                        ui.label(
                            egui::RichText::new("PUK tries")
                                .font(theme::f_reg(13.0))
                                .color(p.txt2),
                        );
                        ui.add_space(8.0);
                        ui.add_enabled(
                            !retries_unsupported,
                            egui::DragValue::new(&mut self.piv.retries_pin)
                                .range(1..=15u8)
                                .custom_formatter(blank_when_unsupported),
                        );
                        ui.label(
                            egui::RichText::new("PIN tries")
                                .font(theme::f_reg(13.0))
                                .color(p.txt2),
                        );
                    });
                });

                // Management key: label + help left, algorithm combo and change
                // button right-aligned.
                ui.add_space(10.0);
                // Every candidate is offered on every device — including
                // `PivMgmtAlgSel::Delete`, HID Crescendo's "remove the
                // management key outright" choice, which renders disabled
                // rather than omitted on a device that can't do that — see
                // `PivMgmtAlgSel::ALL`'s own doc. Each option is gated
                // individually by `mgmtalg_gate` below, the same "list every
                // candidate, gate each one live" shape the Generate key
                // card's algorithm combo already uses.
                let mgmt_alg_options = &PivMgmtAlgSel::ALL[..];
                // Same "don't leave a selection the combo can no longer
                // offer" treatment as the Generate key card's algorithm
                // combo: a prior selection that's since become
                // known-unsupported (e.g. after switching devices) falls back
                // to the first offered option that's actually selectable —
                // see `piv_mgmtalg_unsupported_fallback`'s own doc for why
                // that isn't simply `mgmt_alg_options[0]`.
                self.piv.new_mgmt_alg = piv_mgmtalg_unsupported_fallback(
                    self.piv.new_mgmt_alg,
                    mgmt_alg_options,
                    mgmtalg_gate,
                );
                // Same `Unsupported`-only gate the "Change management key…"
                // button and the combo below both use, so button, combo, and
                // this per-algorithm warning all dim/suppress together — see
                // `piv_mgmtalg_unverified_labels`'s own doc for why the
                // warning specifically goes empty rather than merely
                // disabled.
                let mgmt_key_unsupported = matches!(change_mgmt_key_gate, FeatureGate::Unsupported);
                let mgmt_alg_unverified =
                    piv_mgmtalg_unverified_labels(change_mgmt_key_gate, mgmt_alg_options, mgmtalg_gate);
                let mgmt_alg_unverified_hint = format!(
                    "No entry for this key in keyroost's list: {}.",
                    mgmt_alg_unverified.join(", ")
                );
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Management key")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-admin");
                    let extension_unverified = matches!(change_mgmt_key_gate, FeatureGate::Unverified);
                    if extension_unverified || !mgmt_alg_unverified.is_empty() {
                        ui.add_space(4.0);
                        // Both hints can apply at once (whether the
                        // management key can be changed at all, and which
                        // algorithms an actual change could use) — combined
                        // into one tooltip rather than two markers, same as
                        // this row's other pairs of caveats.
                        let combined_hint = match (extension_unverified, mgmt_alg_unverified.is_empty()) {
                            (true, false) => {
                                format!("{change_mgmt_key_unverified_hint} {mgmt_alg_unverified_hint}")
                            }
                            (true, true) => change_mgmt_key_unverified_hint.clone(),
                            (false, false) => mgmt_alg_unverified_hint.clone(),
                            (false, true) => unreachable!("guarded by the `if` above"),
                        };
                        theme::warn_marker(ui, p).on_hover_text(combined_hint.as_str());
                    }
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if matches!(change_mgmt_key_gate, FeatureGate::Unsupported) {
                            theme::button_disabled(ui, p, "Change management key\u{2026}")
                                .on_hover_text(change_mgmt_key_blocked_hint.as_str());
                        } else if theme::button(ui, p, BtnKind::Default, "Change management key\u{2026}")
                            .clicked()
                        {
                            open_change_mgmt = true;
                        }
                        ui.add_space(8.0);
                        // `mgmt_key_unsupported` (computed above, alongside
                        // `mgmt_alg_unverified`) is the same `Unsupported`-only
                        // gate the "Change management key…" button above
                        // already uses, so button, combo, and the
                        // per-algorithm warning all dim/suppress together.
                        ui.add_enabled_ui(!mgmt_key_unsupported, |ui| {
                            piv_mgmtalg_combo(
                                ui,
                                "piv-new-mgmt-alg",
                                &mut self.piv.new_mgmt_alg,
                                mgmt_alg_options,
                                mgmtalg_gate,
                            );
                        })
                        .response
                        .on_disabled_hover_text(change_mgmt_key_blocked_hint.as_str());
                    });
                });

                // CHUID: label + help left, the write action right-aligned.
                ui.add_space(10.0);
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("CHUID")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-admin");
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "New CHUID\u{2026}").clicked() {
                            open_new_chuid = true;
                        }
                    });
                });
            });
        });

        // --- Selected-slot display data (shown under the slot tab strip) ---
        let sel_state: String = if let PivSlotSel::Retired(n) = selected {
            // Retired slots aren't tracked by `status.slots` / `slot_keys`
            // (those only cover the four standard slots), so an occupied
            // retired slot would otherwise fall through to "empty" below.
            // Consult the lazily-populated retired-occupancy cache instead —
            // the same one `selected_has_key` reads — so the label stays
            // honest before a user hits Generate/Import on an archived key.
            let has_key = self
                .piv
                .retired_occupancy
                .as_ref()
                .and_then(|v| v.iter().find(|(s, _)| *s == keyroost_piv::Slot::Retired(n)))
                .map(|(_, has)| *has);
            match has_key {
                Some(true) => "key present".to_string(),
                // Cache reports empty, or hasn't loaded yet for this slot:
                // fall back to the same "empty" wording used elsewhere.
                _ => "empty".to_string(),
            }
        } else {
            let sel_slot = selected.to_slot();
            let sel_status = self
                .piv
                .status
                .as_ref()
                .and_then(|s| s.slots.iter().find(|sl| sl.slot == sel_slot));
            let cert_present = sel_status.is_some_and(|sl| sl.cert_present);
            let cert_unreadable = sel_status.and_then(|sl| sl.cert_unreadable);
            let cert_compressed = sel_status.is_some_and(|sl| sl.cert_compressed);
            let entry = self.piv.slot_keys.iter().find(|(s, _, _)| *s == sel_slot);
            let alg = entry.and_then(|(_, a, _)| *a);
            let dn = entry.and_then(|(_, _, d)| d.as_deref());
            let mut s = piv_slot_state_text(cert_unreadable, cert_present, cert_compressed, alg);
            // PIN/touch policy, only alongside an actual key — an empty slot
            // has no policy to report, and showing "not available" there
            // would read as a hardware problem rather than just "no key yet".
            if cert_present || alg.is_some() {
                let policy = self
                    .piv
                    .slot_policies
                    .iter()
                    .find(|(s, _)| *s == sel_slot)
                    .and_then(|(_, p)| *p);
                s.push_str(" \u{00B7} ");
                match policy {
                    Some((pin, touch)) => {
                        s.push_str("pin: ");
                        s.push_str(pin.label());
                        s.push_str(", touch: ");
                        s.push_str(touch.label());
                    }
                    None => s.push_str("pin/touch policy not available"),
                }
            }
            if let Some(dn) = dn {
                s.push_str(" \u{00B7} ");
                if dn.chars().count() > 64 {
                    s.extend(dn.chars().take(63));
                    s.push('\u{2026}');
                } else {
                    s.push_str(dn);
                }
            }
            s
        };
        // Whether the active slot holds a private key — gates the Move button
        // (and Move source). Standard slots read from `slot_keys`; a retired slot
        // reads from the lazily-populated occupancy cache.
        let selected_has_key = piv_slot_occupied(
            selected,
            &self.piv.slot_keys,
            self.piv.retired_occupancy.as_deref(),
        );
        // Whether the active slot holds an X.509 certificate — gates Export.
        // Standard slots read `status.slots`; retired slots carry no cert
        // signal in the loaded state, and neither does the pane before its
        // first status read, so both resolve optimistically (the button stays
        // live and the low-level "slot holds no certificate" error still
        // guards). Only a standard slot the card has read and found certless
        // dims the button.
        let selected_has_cert = match selected {
            PivSlotSel::Retired(_) => true,
            _ => {
                !self.piv.loaded
                    || self.piv.status.as_ref().is_some_and(|s| {
                        s.slots
                            .iter()
                            .any(|sl| sl.slot == selected.to_slot() && sl.cert_present)
                    })
            }
        };
        // Move key / Delete key are Yubico extensions (MOVE/DELETE KEY), not
        // SP 800-73-4. `keyroost_piv::compat` resolves a per-fingerprint
        // known-support table against the applet's reported version into a
        // three-way gate: enable, enable-but-flag (support unverified on this
        // device), or dim. An unsupported card refuses the APDU on its own —
        // there is no transport-side version gate any more. Clearing a
        // certificate is standard PIV and works everywhere.
        let (piv_fp, piv_ver, piv_fw_ver) = self.piv.status.as_ref().map_or(
            (
                keyroost_piv::fingerprint::AppletFingerprint::Generic,
                None,
                None,
            ),
            |s| {
                (
                    s.applet_fingerprint,
                    s.version.as_deref(),
                    s.version_firmware.as_deref(),
                )
            },
        );
        let move_key_gate = self.piv_gate(PivExtension::MoveKey, piv_fp, piv_ver, piv_fw_ver);
        let delete_key_gate = self.piv_gate(PivExtension::DeleteKey, piv_fp, piv_ver, piv_fw_ver);
        // Whether this device has a confirmed, device-reported way to know a
        // slot's key occupancy (GET METADATA, or HID Crescendo's own GET PIV
        // PROPERTIES — see `keyroost_piv::compat::PivExtension::GetSlotKeyStatus`'s
        // doc). Consulted below (`slot_confirmed_empty`) to decide whether
        // "Delete key" can safely dim on an empty slot the same way "Delete
        // certificate" dims on a certless one, and whether "Import
        // certificate" can safely dim on one too (nothing there for a freshly
        // imported certificate's key to possibly match) — only when this
        // resolves `Supported` is `selected_has_key` trustworthy enough to
        // block on; everywhere else `None` could just as easily mean "this
        // device can't tell us" as "genuinely empty".
        let get_slot_key_status_gate =
            self.piv_gate(PivExtension::GetSlotKeyStatus, piv_fp, piv_ver, piv_fw_ver);
        // Reset (Yubico RESET, `INS 0xFB`) is gated the same way, from the
        // same fingerprint/version triple — see the "Reset applet" card
        // below.
        let reset_gate = self.piv_gate(PivExtension::Reset, piv_fp, piv_ver, piv_fw_ver);
        // A device-wide reset directive that takes PIV down with it alongside
        // at least one other applet — a distinct extension from `Reset`
        // above, resolved independently (see
        // `keyroost_piv::compat::PivExtension::ResetGlobal`'s doc). Checked
        // here only to decide whether the "Reset applet" card below should
        // point at the whole-device factory reset (Overview tab) as a known
        // alternative when the PIV-only path can't be trusted — never to
        // change what that card's own button does.
        let reset_global_gate =
            self.piv_gate(PivExtension::ResetGlobal, piv_fp, piv_ver, piv_fw_ver);
        let show_reset_global_alternative =
            piv_reset_global_alternative_available(reset_gate, reset_global_gate);
        // Whether this device is known to take unusually long to finish
        // RESET (`PivQuirk::ResetLongRunning`, e.g. observed over a minute
        // on ArekinathPivApplet::SwissbitIShield1) — surfaced below as a
        // standing note on the "Reset applet" card, not just a hover, so it
        // isn't missed the moment the device looks like it's hung.
        let reset_long_running = keyroost_piv::compat::resolve_quirks(piv_fp, piv_ver, piv_fw_ver)
            .contains(&keyroost_piv::compat::PivQuirk::ResetLongRunning);
        // Per-algorithm gates for the "Generate key" card's algorithm combo,
        // below — resolved eagerly here (an owned array, not a closure over
        // `piv_ver`/`piv_fw_ver`) because those two borrow `self.piv.status`
        // and the combo is drawn from deep inside closures that also need
        // `&mut self`; holding the borrow that long would conflict. Not every
        // algorithm is universally implemented, standardized or not — see
        // `PivExtension::SlotKeyAlgorithm`'s own doc.
        let keyalg_gates: [(keyroost_piv::KeyAlg, FeatureGate); keyroost_piv::KeyAlg::ALL.len()] =
            keyroost_piv::KeyAlg::ALL.map(|alg| {
                (
                    alg,
                    self.piv_gate(
                        PivExtension::SlotKeyAlgorithm(alg),
                        piv_fp,
                        piv_ver,
                        piv_fw_ver,
                    ),
                )
            });
        let keyalg_gate = move |alg: keyroost_piv::KeyAlg| {
            keyalg_gates
                .iter()
                .find_map(|&(a, gate)| (a == alg).then_some(gate))
                .unwrap_or(FeatureGate::Unverified)
        };
        // Explanations for the non-standard slot operations when the
        // fingerprint known-support table can't clear them — built from the shared
        // vocabulary in `keyroost_piv::compat` so this pane and the CLI say the
        // same thing: the extension's `requirement()` sentence, then a state
        // suffix. Each string is a hover: on the \u{26a0} marker by the row's
        // help dot for Unverified, on the dimmed button for Unsupported.
        // "Key deletion" / "Moving keys" keep each distinct from the Delete
        // row's other button, "Delete certificate\u{2026}" — and the Delete-key
        // \u{26a0} hover additionally appends that "Delete certificate" is
        // standard PIV and unaffected (see the hover call site).
        let move_key_unverified_hint = format!(
            "{} {}",
            PivExtension::MoveKey.requirement(),
            FeatureGate::UNVERIFIED_SUFFIX
        );
        let move_key_blocked_hint = format!(
            "{} {}",
            PivExtension::MoveKey.requirement(),
            FeatureGate::INCOMPATIBLE_SUFFIX
        );
        let delete_key_unverified_hint = format!(
            "{} {}",
            PivExtension::DeleteKey.requirement(),
            FeatureGate::UNVERIFIED_SUFFIX
        );
        let delete_key_blocked_hint = format!(
            "{} {}",
            PivExtension::DeleteKey.requirement(),
            FeatureGate::INCOMPATIBLE_SUFFIX
        );
        let reset_unverified_hint = format!(
            "{} {}",
            PivExtension::Reset.requirement(),
            FeatureGate::UNVERIFIED_SUFFIX
        );
        let reset_blocked_hint = format!(
            "{} {}",
            PivExtension::Reset.requirement(),
            FeatureGate::INCOMPATIBLE_SUFFIX
        );
        // Both certificate actions below (self-sign into the slot, and sign a
        // CSR) are signed *by this slot's key*. With no key there is nothing to
        // sign with and the on-card step fails deep in the flow ("slot has no
        // key…"), so the buttons are dimmed until a key is present and say why
        // on hover — same treatment as the Move/Delete-key rows.
        let no_slot_key_hint = "This slot has no key. Generate a key in this slot first \u{2014} \
             a self-signed certificate and a CSR are both signed by it.";
        // Both certificate actions need the slot's key to actually sign —
        // X25519 (and any future key-agreement-only algorithm) can only do
        // ECDH on this card, so `keyroost_piv::x509::signature_hash` rejects
        // it. Building a certificate for such a key needs a different
        // enrollment mechanism (CRMF/CMP-style, proving possession via key
        // agreement instead of a signature) that keyroost doesn't implement,
        // so the buttons dim rather than fail deep in the signing flow.
        // `None` (algorithm not yet known — e.g. a retired slot, which
        // `slot_keys` never covers) doesn't block: same "don't guess"
        // treatment the Test row gives an unknown algorithm.
        let sel_key_can_sign = self
            .piv_selected_test_target()
            .0
            .is_none_or(|a| keyroost_piv::x509::signature_hash(a).is_ok());
        let cant_sign_hint = "This slot's key only supports key agreement, not signing \u{2014} \
             it can't produce a self-signed certificate or a CSR. keyroost has no CRMF/CMP-style \
             enrollment for that kind of key.";
        let no_slot_cert_hint =
            "This slot holds no certificate to export. Import one, or create a self-signed \
             certificate above.";
        let no_move_key_hint =
            "This slot has no key to move \u{2014} generate one in this slot first.";
        let no_del_cert_hint = "This slot holds no certificate to delete.";
        let no_del_key_hint = "This slot holds no key to delete.";
        // "Import certificate" dims only when this device *confirms* the
        // slot is empty (same `slot_confirmed_empty` gate as "Delete key" —
        // see its doc): a certificate can't possibly match a key this slot
        // doesn't hold. When occupancy can't be confirmed, the button stays
        // enabled — a matching key may have been loaded out of band and this
        // session just can't see it; `PivSession::import_certificate` itself
        // still compares against whatever key it *can* find before writing.
        let no_import_cert_hint = "This slot has no key for a certificate to match \u{2014} \
             generate or move one into this slot first.";
        // --- Slot sub-tab strip ---------------------------------------------
        // Each PIV slot is a tab, exactly like the FIDO2 sub-tab strip
        // (Passkeys / Settings / Storage): an opaque surface strip behind a row
        // of bold labels, the active one underlined with a 2px accent. Clicking
        // a tab selects that slot; every action card below targets it.
        ui.add_space(14.0);
        // Opaque surface behind the tab labels. The strip wraps to more than one
        // line when the window is too narrow to hold every tab on one row — the
        // slot cards below would otherwise be pinned to the unwrapped width of
        // this row and spill past the pane's right edge. Because the wrapped
        // height isn't known until the row is laid out, reserve a paint slot
        // here and fill it from the row's real rect afterwards.
        let strip_bg = ui.painter().add(egui::Shape::Noop);
        let strip_resp = ui.horizontal_wrapped(|ui| {
            ui.spacing_mut().item_spacing.x = 20.0;
            // Rows are far enough apart that a wrapped second row clears the
            // accent underline (drawn 6px below the row above) with margin.
            ui.spacing_mut().item_spacing.y = 22.0;
            let tab = |ui: &mut egui::Ui, label: String, active: bool| -> bool {
                let color = if active { p.txt } else { p.txt3 };
                let resp = ui
                    .add(
                        egui::Label::new(
                            egui::RichText::new(label)
                                .font(theme::f_sb(13.5))
                                .color(color),
                        )
                        // Each tab is one atom: it moves to the next row whole
                        // rather than letting its own text break across two.
                        .wrap_mode(egui::TextWrapMode::Extend)
                        .sense(egui::Sense::click()),
                    )
                    .on_hover_cursor(egui::CursorIcon::PointingHand);
                if active {
                    let y = resp.rect.bottom() + 6.0;
                    ui.painter().line_segment(
                        [
                            egui::pos2(resp.rect.left(), y),
                            egui::pos2(resp.rect.right(), y),
                        ],
                        egui::Stroke::new(2.0, p.accent),
                    );
                }
                resp.clicked()
            };
            for slot in [
                PivSlotSel::Auth,
                PivSlotSel::Sign,
                PivSlotSel::KeyMgmt,
                PivSlotSel::CardAuth,
            ] {
                if tab(ui, slot.label(), selected == slot) {
                    clicked_slot = Some(slot);
                }
            }
            // The twenty retired slots are a peer of the four standard ones, so
            // they get a tab of their own rather than a section wedged between
            // this strip and the cards it heads. Their own pane then has room to
            // list all twenty — a wrapped row of chips here would have swamped
            // the strip the moment more than a couple held keys.
            let retired_active = matches!(selected, PivSlotSel::Retired(_));
            if tab(
                ui,
                "retired keys (82\u{2013}95)".to_string(),
                retired_active,
            ) {
                click_retired_tab = true;
            }
            // Anchored to the tab rather than a line of prose above the list:
            // the list's own dots already say what is occupied, so a sentence
            // there was only restating them. Shown while the tab is active so
            // the strip stays clean the rest of the time.
            if retired_active {
                ui.add_space(2.0);
                self.help_dot(ui, p, "piv-retired");
            }
        });
        {
            let row = strip_resp.response.rect;
            let strip = egui::Rect::from_min_max(
                egui::pos2(ui.max_rect().left(), row.top() - 4.0),
                egui::pos2(ui.max_rect().right(), row.bottom() + 6.0),
            );
            ui.painter()
                .set(strip_bg, egui::Shape::rect_filled(strip, 0.0, p.surface));
        }
        // --- Retired-slot rail (only on the retired tab) --------------------
        // All twenty slots, listed the way the Molto2 view lists its profiles:
        // one row each, a filled dot on the right for the ones holding a key,
        // the selected row filled with the soft accent. Occupancy is read
        // lazily the first time this tab is opened — checking it means asking
        // the card about each of the twenty in turn, which is not worth doing
        // on every status refresh.
        if matches!(selected, PivSlotSel::Retired(_)) {
            ui.add_space(14.0);
            match self.piv.retired_occupancy.clone() {
                Some(occ) => {
                    // Show as many rows as the pane can spare before the action
                    // cards below, then scroll. Twenty rows fit outright on a
                    // reasonably tall window.
                    let rail_h = (ui.available_height() - 300.0).clamp(150.0, 20.0 * 30.0);
                    egui::ScrollArea::vertical()
                        .id_salt("piv-retired-rail")
                        .auto_shrink([false, false])
                        .max_height(rail_h)
                        .show(ui, |ui| {
                            ui.set_width(300.0);
                            for (slot, has_key) in occ {
                                let keyroost_piv::Slot::Retired(n) = slot else {
                                    continue;
                                };
                                let sel_variant = PivSlotSel::Retired(n);
                                let active = selected == sel_variant;
                                let (rect, resp) = ui.allocate_exact_size(
                                    egui::vec2(ui.available_width(), 30.0),
                                    egui::Sense::click(),
                                );
                                let bg = if active {
                                    p.accent_soft()
                                } else if resp.hovered() {
                                    p.line_soft
                                } else {
                                    egui::Color32::TRANSPARENT
                                };
                                ui.painter().rect(
                                    rect,
                                    egui::CornerRadius::same(8),
                                    bg,
                                    egui::Stroke::NONE,
                                    egui::StrokeKind::Inside,
                                );
                                ui.painter().text(
                                    rect.left_center() + egui::vec2(12.0, 0.0),
                                    egui::Align2::LEFT_CENTER,
                                    format!("Slot {:02X} \u{00B7} retired key {n}", 0x81 + n),
                                    theme::f_mono(12.5),
                                    if active {
                                        p.accent
                                    } else if has_key {
                                        p.txt
                                    } else {
                                        p.txt3
                                    },
                                );
                                // Same affordance as the Molto2 rail's seed dot:
                                // presence is a mark on the row, not a word.
                                if has_key {
                                    ui.painter().circle_filled(
                                        egui::pos2(rect.right() - 12.0, rect.center().y),
                                        3.0,
                                        if active { p.accent } else { p.ok },
                                    );
                                }
                                let resp = resp.on_hover_text(if has_key {
                                    format!("{} \u{00B7} holds a key", slot.label())
                                } else {
                                    format!("{} \u{00B7} empty", slot.label())
                                });
                                if resp
                                    .on_hover_cursor(egui::CursorIcon::PointingHand)
                                    .clicked()
                                {
                                    clicked_slot = Some(sel_variant);
                                }
                            }
                        });
                }
                None => note(ui, "Reading retired slots\u{2026}"),
            }
        }
        // --- Selected slot content (single column under the strip) ----------
        // State line for the active slot, then the styled full-width action
        // cards (unchanged from the old detail column) in single-column flow.
        ui.add_space(14.0);
        ui.label(
            egui::RichText::new(format!("State: {sel_state}"))
                .font(theme::f_reg(12.5))
                .color(p.txt2),
        );
        ui.add_space(10.0);
        // Same `add_enabled_ui` inheritance trick as the status card above —
        // one wrap covers the per-slot action card and the "Reset applet"
        // card below it, dimming Generate/Certificate/Delete/Move/Test and
        // Reset together for any in-flight PIV job (`self.piv.inflight`).
        // The slot tab strip and retired-slot rail above this point stay
        // outside any wrap, so selecting a different slot (or a different
        // retired key) still works while a job is in flight.
        ui.add_enabled_ui(!self.piv.inflight, |ui| {
            theme::card_frame(p).show(ui, |ui| {
                ui.set_min_width(ui.available_width());

                // --- Generate key: bold label + help left, algorithm combo
                // and primary button pinned right (FIDO2 setting-row shape).
                // Each algorithm is gated independently
                // (`PivExtension::SlotKeyAlgorithm`, resolved eagerly into
                // `keyalg_gate` above) the same way Move/Delete key are gated
                // elsewhere in this pane — not every device implements every
                // algorithm, standardized or not (see that extension's own
                // doc).
                //
                // Same "don't leave a selection the combo can no longer
                // offer" treatment as the PIN/touch policy combos in the
                // Generate Key modal: a prior selection that's since become
                // known-unsupported (e.g. after switching readers) falls back
                // to the first selectable algorithm rather than staying
                // selected-but-disabled — see
                // `piv_keyalg_unsupported_fallback`'s own doc for why
                // `EccP256` is only a fallback-of-last-resort here, not
                // returned unconditionally.
                self.piv.gen_alg = piv_keyalg_unsupported_fallback(
                    self.piv.gen_alg,
                    keyroost_piv::KeyAlg::EccP256,
                    keyalg_gate,
                );
                let unverified_algs: Vec<&str> = keyroost_piv::KeyAlg::ALL
                    .into_iter()
                    .filter(|&alg| keyalg_gate(alg) == FeatureGate::Unverified)
                    .map(keyroost_piv::KeyAlg::label)
                    .collect();
                let gen_alg_unverified_hint = format!(
                    "No entry for this key in keyroost's list: {}.",
                    unverified_algs.join(", ")
                );
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Generate key")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-generate");
                    // Same warn-triangle convention as Move/Delete/Reset key below:
                    // sits right after the help dot rather than a printed line, so
                    // "support unverified" reads the same way everywhere in this
                    // pane instead of being the one section that just prints it.
                    if !unverified_algs.is_empty() {
                        ui.add_space(4.0);
                        theme::warn_marker(ui, p).on_hover_text(gen_alg_unverified_hint.as_str());
                    }
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if theme::button(ui, p, BtnKind::Default, "Generate\u{2026}").clicked() {
                            open_generate = true;
                        }
                        ui.add_space(8.0);
                        piv_keyalg_combo(ui, "piv-gen-alg", &mut self.piv.gen_alg, keyalg_gate);
                    });
                });
                // Derived from the per-device session cache rather than a
                // dedicated field: that cache now survives switching to
                // another device's tab and back (see `App::piv_session_state`'s
                // doc), so this naturally does too, and it always reflects
                // whichever slot is currently selected rather than "whatever
                // was last generated, regardless of slot".
                let gen_pubkey_pem = self
                    .selected_device
                    .as_ref()
                    .and_then(|id| self.piv_session_state.get(id))
                    .and_then(|state| state.cached_pubkey(self.piv.selected_slot.to_slot()))
                    .and_then(|(alg, key)| {
                        keyroost_piv::spki::subject_public_key_info(key, alg).ok()
                    })
                    .map(|der| keyroost_piv::spki::to_pem(&der));
                if let Some(pem) = &gen_pubkey_pem {
                    ui.add_space(6.0);
                    ui.add(
                        egui::TextEdit::multiline(&mut pem.as_str())
                            .desired_rows(4)
                            .desired_width(f32::INFINITY)
                            .font(egui::TextStyle::Monospace),
                    );
                    ui.add_space(4.0);
                    // `with_layout` must be nested inside a `ui.horizontal` (as
                    // every other right-aligned action row in this pane does),
                    // not called directly on the card's top-down `ui`: called
                    // bare, its child `Ui` inherits the *entire remaining
                    // vertical space* of the card as its max_rect, and
                    // `Align::Center` then centers the button within all of
                    // that leftover height — which the row then allocates back
                    // into the parent as its own height. On a window taller
                    // than default that reads as a big dead gap here with the
                    // button floating in the middle of it.
                    ui.horizontal(|ui| {
                        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                            if theme::button(ui, p, BtnKind::Ghost, "Copy public key").clicked() {
                                copy_pem = Some(pem.clone());
                            }
                        });
                    });
                }

                ui.add_space(12.0);
                // --- Certificate: title row carries both issue actions
                // right-aligned — "Sign & save CSR" then "Self-signed -> slot" —
                // same layout "Import/Export cert" below uses, rather than
                // sharing a row with the subject/validity inputs (three "Valid
                // for" fields plus two buttons would collapse/wrap at narrow
                // window widths). Each is signed by the slot's key, so both dim
                // with the same reason when the slot has none. "Sign & save
                // CSR" opens a save dialog first (see `drain_file_dialogs`);
                // "Self-signed -> slot" opens the PIN / management-key modal.
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Certificate")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-certificate");
                    // right_to_left: add "Self-signed" first so it sits at the
                    // far right, then "Sign & save CSR" to its left.
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if selected_has_key && sel_key_can_sign {
                            if theme::button(ui, p, BtnKind::Default, "Self-signed \u{2192} slot")
                                .clicked()
                            {
                                open_self_sign = true;
                            }
                        } else {
                            theme::button_disabled(ui, p, "Self-signed \u{2192} slot")
                                .on_hover_text(if selected_has_key {
                                    cant_sign_hint
                                } else {
                                    no_slot_key_hint
                                });
                        }
                        ui.add_space(8.0);
                        if selected_has_key && sel_key_can_sign {
                            if theme::button(ui, p, BtnKind::Default, "Sign & save CSR\u{2026}")
                                .clicked()
                            {
                                open_csr = true;
                            }
                        } else {
                            theme::button_disabled(ui, p, "Sign & save CSR\u{2026}").on_hover_text(
                                if selected_has_key {
                                    cant_sign_hint
                                } else {
                                    no_slot_key_hint
                                },
                            );
                        }
                    });
                });
                ui.add_space(6.0);
                text_field(
                    ui,
                    p,
                    "Name",
                    &mut self.piv.cert_subject,
                    "e.g. Alice — or full CN=Alice,O=Example,C=US",
                    300.0,
                );
                ui.horizontal(|ui| {
                    // Same 96px label column `text_field` uses for the "Name" row
                    // above, so this label lines up with it and the fields below
                    // start at the same x.
                    ui.add_sized(
                        [96.0, 22.0],
                        egui::Label::new(
                            egui::RichText::new("Valid for")
                                .font(theme::f_reg(13.0))
                                .color(p.txt2),
                        ),
                    );
                    piv_valid_for_fields(
                        ui,
                        unix_now(),
                        &mut self.piv.cert_valid_years,
                        &mut self.piv.cert_valid_months,
                        &mut self.piv.cert_valid_days,
                    );
                });

                ui.add_space(12.0);
                // --- Import / Export cert: both buttons on one right-aligned row,
                // "Import certificate" then "Export certificate". Import opens a
                // file picker then the management-key modal; Export opens a save
                // dialog and writes straight to the chosen path — no secret (see
                // `drain_file_dialogs`). Export dims when the slot holds no cert.
                // Import dims only when the slot is *confirmed* empty
                // (`slot_confirmed_empty`, same gate "Delete key" uses) — an
                // unconfirmed reading leaves it enabled, since a matching key may
                // have been loaded out of band this session can't see.
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Import/Export cert")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-import-export");
                    // right_to_left: add "Export" first so it sits at the far
                    // right, then "Import" to its left.
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if selected_has_cert {
                            if theme::button(ui, p, BtnKind::Default, "Export certificate\u{2026}")
                                .clicked()
                            {
                                go_export = true;
                            }
                        } else {
                            theme::button_disabled(ui, p, "Export certificate\u{2026}")
                                .on_hover_text(no_slot_cert_hint);
                        }
                        ui.add_space(8.0);
                        if slot_confirmed_empty(get_slot_key_status_gate, selected_has_key) {
                            theme::button_disabled(ui, p, "Import certificate\u{2026}")
                                .on_hover_text(no_import_cert_hint);
                        } else if theme::button(
                            ui,
                            p,
                            BtnKind::Default,
                            "Import certificate\u{2026}",
                        )
                        .clicked()
                        {
                            open_import = true;
                        }
                    });
                });

                ui.add_space(12.0);
                // --- Move key: its own row, above Delete. It used to be a button
                // inside the Delete row, which put a deliberately non-destructive
                // action under a destructive heading and left it sharing the delete
                // help text — the one place a user checking "is this safe?" would
                // look. The row is always shown so the capability stays
                // discoverable; the button is dimmed with a hover reason when the
                // slot has no key to move, or on pre-5.7 firmware.
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Move key")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-move");
                    // Support-unverified warning sits right after the help dot, by
                    // the operation's own explanation — not out by the button. It
                    // reflects the device's MOVE KEY support, so it shows whether or
                    // not this slot currently has a key for the button to act on
                    // (the button may be dimmed for "no key" underneath it).
                    if matches!(move_key_gate, FeatureGate::Unverified) {
                        ui.add_space(4.0);
                        theme::warn_marker(ui, p).on_hover_text(move_key_unverified_hint.as_str());
                    }
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        match move_key_gate {
                            // Known-unsupported on this device wins over "no key": the
                            // firmware reason is the one the user has to resolve
                            // first, and it holds whether or not the slot is empty.
                            FeatureGate::Unsupported => {
                                theme::button_disabled(ui, p, "Move key\u{2026}")
                                    .on_hover_text(move_key_blocked_hint.as_str());
                            }
                            // Unverified still runs — the card refuses if it truly
                            // can't — so the button stays live where there is a key;
                            // only the warning above marks the doubt.
                            FeatureGate::Supported | FeatureGate::Unverified => {
                                if !selected_has_key {
                                    theme::button_disabled(ui, p, "Move key\u{2026}")
                                        .on_hover_text(no_move_key_hint);
                                } else if theme::button(ui, p, BtnKind::Default, "Move key\u{2026}")
                                    .clicked()
                                {
                                    open_move_key = true;
                                }
                            }
                        }
                    });
                });
                ui.add_space(12.0);
                // --- Delete: bold label + help left, the two delete
                // actions right-aligned (Delete key is Danger, gated 5.7+).
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Delete")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-delete");
                    // Support-unverified warning for "Delete key" sits here, beside
                    // the row's help dot — not out by the button — so its hover
                    // text names "Delete key" explicitly and spells out that
                    // "Delete certificate" (the other button on this row) is
                    // standard PIV and unaffected.
                    if matches!(delete_key_gate, FeatureGate::Unverified) {
                        ui.add_space(4.0);
                        theme::warn_marker(ui, p).on_hover_text(format!(
                            "{delete_key_unverified_hint} \u{201c}Delete certificate\u{201d} is \
                         standard PIV and unaffected."
                        ));
                    }
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        match delete_key_gate {
                            // Unsupported blocks outright, regardless of slot
                            // content — an operation the device can't run at all
                            // is the reason to lead with, not slot occupancy.
                            FeatureGate::Unsupported => {
                                // Kept visible but dimmed on pre-5.7 firmware so the
                                // action is discoverable; the hover text says why it
                                // can't run yet.
                                theme::button_disabled(ui, p, "Delete key\u{2026}")
                                    .on_hover_text(delete_key_blocked_hint.as_str());
                            }
                            // Unverified still runs — the card refuses if it truly
                            // can't — so the button stays live unless the slot's
                            // emptiness is independently confirmed below; only the
                            // warning by the help dot marks the firmware doubt.
                            FeatureGate::Supported | FeatureGate::Unverified => {
                                if slot_confirmed_empty(get_slot_key_status_gate, selected_has_key)
                                {
                                    theme::button_disabled(ui, p, "Delete key\u{2026}")
                                        .on_hover_text(no_del_key_hint);
                                } else if theme::button(
                                    ui,
                                    p,
                                    BtnKind::Danger,
                                    "Delete key\u{2026}",
                                )
                                .clicked()
                                {
                                    open_delete_key = true;
                                }
                            }
                        }
                        ui.add_space(6.0);
                        // "Delete certificate" is standard PIV, so no firmware gate
                        // — but like Export it needs a certificate to act on. Same
                        // cert-presence signal, same optimistic fallback for retired
                        // slots / pre-first-read. "Delete key" only gets the
                        // equivalent empty-slot treatment when this device actually
                        // confirms slot occupancy
                        // (`PivExtension::GetSlotKeyStatus`, checked inside the
                        // match above via `slot_confirmed_empty`) — everywhere
                        // else it stays enabled whenever DELETE KEY itself is:
                        // without a confirmed signal, key presence is simply
                        // unknown, and a stale key is still worth an attempt to
                        // erase.
                        if selected_has_cert {
                            if theme::button(ui, p, BtnKind::Default, "Delete certificate\u{2026}")
                                .clicked()
                            {
                                open_delete_cert = true;
                            }
                        } else {
                            theme::button_disabled(ui, p, "Delete certificate\u{2026}")
                                .on_hover_text(no_del_cert_hint);
                        }
                    });
                });

                // --- Test: one button that runs every self-test the selected
                // slot's key supports (decrypt / key-agree / sign, in that order)
                // and reports each result. Read-only — the card operates but
                // nothing is written. Live only when the slot holds a certificate
                // with a key type keyroost can test. Placed last in the card,
                // below the other slot actions, since it's a diagnostic rather
                // than a slot-management action.
                ui.add_space(12.0);
                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Test")
                            .font(theme::f_sb(13.5))
                            .color(p.txt),
                    );
                    ui.add_space(6.0);
                    self.help_dot(ui, p, "piv-test");
                    let (test_alg, test_has_cert) = self.piv_selected_test_target();
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        if test_has_cert && test_alg.is_some() {
                            if theme::button(ui, p, BtnKind::Default, "Test\u{2026}").clicked() {
                                open_self_test = true;
                            }
                        } else {
                            let why = if !test_has_cert {
                                "Needs a certificate in this slot."
                            } else {
                                "The slot's key type is unknown."
                            };
                            ui.add_enabled_ui(false, |ui| {
                                theme::button(ui, p, BtnKind::Default, "Test\u{2026}")
                            })
                            .inner
                            .on_disabled_hover_text(why);
                        }
                    });
                });
            });
            ui.add_space(12.0);

            // Reset applet — its own destructive card with a red stroke at the
            // bottom of the pane (mirrors the FIDO2 "Reset this key" card exactly),
            // full width, description left + red button right.
            theme::card_frame(p)
                .stroke(egui::Stroke::new(1.0, theme::tint(p.err, 90)))
                .show(ui, |ui| {
                    ui.set_min_width(ui.available_width());
                    ui.horizontal(|ui| {
                        ui.label(
                            egui::RichText::new("Reset applet")
                                .font(theme::f_sb(14.5))
                                .color(p.err),
                        );
                        ui.add_space(6.0);
                        self.help_dot(ui, p, "reset");
                        // Same three-way gate as Move key / Delete key, from the
                        // same `keyroost_piv::compat` known-support table — see
                        // `reset_gate`'s definition above.
                        if matches!(reset_gate, FeatureGate::Unverified) {
                            ui.add_space(4.0);
                            theme::warn_marker(ui, p).on_hover_text(reset_unverified_hint.as_str());
                        }
                        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                            match reset_gate {
                                // Unverified still runs — the card refuses if it
                                // truly can't — so the button stays live; only
                                // the warning above marks the doubt.
                                FeatureGate::Supported | FeatureGate::Unverified => {
                                    if theme::button(ui, p, BtnKind::Danger, "Reset applet\u{2026}")
                                        .clicked()
                                    {
                                        arm_reset = true;
                                    }
                                }
                                FeatureGate::Unsupported => {
                                    // Kept visible but dimmed so the capability
                                    // stays discoverable; the hover text says why
                                    // it can't run yet.
                                    theme::button_disabled(ui, p, "Reset applet\u{2026}")
                                        .on_hover_text(reset_blocked_hint.as_str());
                                }
                            }
                        });
                    });
                    ui.label(
                        egui::RichText::new(if matches!(reset_gate, FeatureGate::Supported) {
                            // Known-supported: `force_reset_if_known_supported`
                            // burns the PIN/PUK retry counters itself when
                            // needed, so the precondition below no longer
                            // applies to what this button actually does.
                            "Wipes ALL PIV keys, certificates, and PINs."
                        } else {
                            "Wipes ALL PIV keys, certificates, and PINs. Typically requires both \
                         the PIN and PUK to already be blocked."
                        })
                        .font(theme::f_reg(12.5))
                        .color(p.txt2),
                    );
                    if reset_long_running {
                        ui.add_space(4.0);
                        ui.label(
                            egui::RichText::new(
                                keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT,
                            )
                            .font(theme::f_reg(12.5))
                            .color(p.warn),
                        );
                    }
                    if show_reset_global_alternative {
                        ui.add_space(6.0);
                        // Same click-sense-label style as the Overview cards' own
                        // "Manage →" jump (`App::card_head`) — an accent-colored
                        // text link, not a button, since this isn't itself an
                        // action, just a pointer to where the action lives; same
                        // browser-style pointing-hand cursor on hover, too.
                        if ui
                            .add(
                                egui::Label::new(
                                    egui::RichText::new("Factory reset supported \u{2192}")
                                        .font(theme::f_sb(12.5))
                                        .color(p.accent),
                                )
                                .sense(egui::Sense::click()),
                            )
                            .on_hover_cursor(egui::CursorIcon::PointingHand)
                            .clicked()
                        {
                            go_to_overview = true;
                        }
                    }
                });
            // Compatibility table: the last thing on the pane, shown only when
            // it matters — something is greyed out because the table says so,
            // or the user already chose to unlock it for this key.
            let ignored = self.piv_compat_ignored_selected();
            let unsupported = self.piv.status.as_ref().map_or(0, |st| {
                piv_compat_unsupported_count(
                    st.applet_fingerprint,
                    st.version.as_deref(),
                    st.version_firmware.as_deref(),
                )
            });
            if ignored || unsupported > 0 {
                ui.add_space(12.0);
                ui.horizontal(|ui| {
                    let (text, link, tip) = if ignored {
                        (
                            "Unsupported PIV features are enabled for this key.".to_string(),
                            "Undo",
                            "Grey them out again.",
                        )
                    } else {
                        (
                            if unsupported == 1 {
                                "1 PIV feature is marked unsupported for this key.".to_string()
                            } else {
                                format!(
                                    "{unsupported} PIV features are marked unsupported for this key."
                                )
                            },
                            "Enable Anyway",
                            "If this key can't do one of them, it will just refuse.",
                        )
                    };
                    ui.label(
                        egui::RichText::new(text)
                            .font(theme::f_reg(12.5))
                            .color(if ignored { p.warn } else { p.txt2 }),
                    );
                    if ui
                        .add(
                            egui::Label::new(
                                egui::RichText::new(link)
                                    .font(theme::f_sb(12.5))
                                    .color(p.accent),
                            )
                            .sense(egui::Sense::click()),
                        )
                        .on_hover_cursor(egui::CursorIcon::PointingHand)
                        .on_hover_text(tip)
                        .clicked()
                    {
                        toggle_compat_table = true;
                    }
                });
            }
        });

        // Apply collected intents now that the card borrows have ended.
        if let Some(slot) = clicked_slot {
            self.piv.selected_slot = slot;
        }
        if do_refresh {
            self.load_piv_status_with_cache(LogKind::User, PivCache::Bypass);
        }
        // The three buttons open the centered credential modal; the modal itself
        // (rendered once per frame) runs the actual op. Opening wipes any stale
        // fields first so a fresh dialog starts blank.
        if open_change_pin {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::ChangePin));
        }
        if open_change_puk {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::ChangePuk));
        }
        if open_unblock {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::UnblockPin));
        }
        // The management-key-gated operations open the centered credential modal
        // (which collects their secrets and runs the op on Submit) rather than
        // running directly. Opening wipes any stale secret fields first so a
        // fresh dialog starts blank.
        if open_generate {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::GenerateKey));
        }
        // Import / Export / CSR ask for the file first; the picked path is
        // routed by `drain_file_dialogs`, which then opens the secret modal
        // (import, CSR) or runs the write straight away (export).
        if open_import {
            self.spawn_file_dialog(
                FileTarget::PivCert,
                false,
                &[
                    ("Certificates", &["pem", "der", "crt", "cer"]),
                    ("All files", &["*"]),
                ],
                None,
            );
        }
        if go_export {
            self.spawn_file_dialog(
                FileTarget::PivExport,
                true,
                &[
                    ("Certificate (DER)", &["der", "cer"]),
                    ("Certificate (PEM)", &["pem", "crt"]),
                    ("All files", &["*"]),
                ],
                Some("cert.der"),
            );
        }
        if open_self_sign {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::SelfSign));
        }
        if open_csr {
            self.spawn_file_dialog(
                FileTarget::PivCsr,
                true,
                &[("CSR", &["csr", "pem"]), ("All files", &["*"])],
                Some("request.csr"),
            );
        }
        if open_set_retries {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::SetRetries));
        }
        if open_change_mgmt {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::ChangeMgmtKey));
        }
        if open_delete_cert {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::DeleteCert));
        }
        if open_delete_key {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::DeleteKey));
        }
        if open_self_test {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::SelfTest));
        }
        if open_move_key {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::MoveKey));
            // Populate retired occupancy so the destination combo can exclude
            // occupied retired slots (the transport re-checks regardless). If
            // the worker is busy the read just doesn't queue; occupancy stays
            // `None` and the modal falls back to treating retired slots as
            // available, with the transport's own occupied-destination check
            // as the backstop.
            if self.piv.retired_occupancy.is_none() {
                let _ = self.load_piv_retired_occupancy();
            }
        }
        if toggle_compat_table {
            if let Some(id) = self.selected_device.clone() {
                if !self.piv_compat_ignored.remove(&id) {
                    self.piv_compat_ignored.insert(id);
                }
            }
            // Re-read so the internal reads the table was skipping (GET
            // METADATA, ATTEST) run — or stop running — straight away.
            self.load_piv_status_with_cache(LogKind::Background, PivCache::Bypass);
        }
        if open_new_chuid {
            self.piv_cred_modal_close();
            self.piv.cred_modal = Some(PivCredModal::new(PivCredKind::NewChuid));
            self.piv_refresh_chuid_guid();
        }
        if click_retired_tab {
            // Opening the tab has to land on a concrete slot, because every
            // action card below targets one. Prefer the first slot that holds a
            // key — the reason to come here is usually an existing archived key
            // — and fall back to retired key 1 when none does or occupancy has
            // not been read yet.
            let first_used = self
                .piv
                .retired_occupancy
                .as_ref()
                .and_then(|occ| {
                    occ.iter()
                        .find(|(_, has)| *has)
                        .and_then(|(slot, _)| match slot {
                            keyroost_piv::Slot::Retired(n) => Some(*n),
                            _ => None,
                        })
                })
                .unwrap_or(1);
            self.piv.selected_slot = PivSlotSel::Retired(first_used);
            if self.piv.retired_occupancy.is_none() {
                // Nothing to undo if this doesn't queue: the pane shows
                // "Reading retired slots…" and the next click retries.
                let _ = self.load_piv_retired_occupancy();
            }
        }
        if arm_reset {
            self.piv.confirm_reset = Some(String::new());
        }
        if go_to_overview {
            self.cap_tab = CapTab::Overview;
        }
        if let Some(pem) = copy_pem {
            ui.ctx().copy_text(pem);
            self.clipboard_clear_at = None; // public key, not a secret to auto-clear
        }
    }

    /// The Molto2 token's dedicated amber view: hero band · customer-key strip ·
    /// 100-slot rail + editor.
    fn molto_view(&mut self, ui: &mut egui::Ui, p: &Palette, dev: &Device) {
        // Make brand-orange the accent throughout the Molto2 view, so its help
        // dots, links, selection highlights and primary action are all one
        // orange rather than mixing the app's blue accent into the token's
        // identity. Green stays for status, red for danger.
        let mp = Palette {
            accent: p.brand,
            ..*p
        };
        let p = &mp;
        let mut open_rename = false;
        let mut do_save = false;
        let mut do_cancel = false;
        // Hero (no amber band — the orange comes from the clock glyph + accents,
        // matching the security-key hero layout and avoiding a muddy brown tint).
        egui::Frame::NONE
            .inner_margin(egui::Margin::symmetric(26, 16))
            .show(ui, |ui| {
                ui.horizontal(|ui| {
                    glyph_tile(ui, 46.0, p.brand, p.accent_ink, None);
                    ui.add_space(12.0);
                    ui.vertical(|ui| {
                        ui.horizontal(|ui| {
                            if self.rename_target.is_some() {
                                let resp = ui.add_sized(
                                    [200.0, 32.0],
                                    egui::TextEdit::singleline(&mut self.rename_input)
                                        .vertical_align(egui::Align::Center)
                                        .hint_text("friendly-name"),
                                );
                                let enter = resp.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
                                if theme::button(ui, p, BtnKind::Primary, "Save").clicked() || enter {
                                    do_save = true;
                                }
                                ui.add_space(4.0);
                                if theme::button(ui, p, BtnKind::Ghost, "Cancel").clicked() {
                                    do_cancel = true;
                                }
                            } else {
                                ui.label(egui::RichText::new(dev.title()).font(theme::f_bold(21.0)).color(p.txt));
                                ui.add_space(6.0);
                                theme::pill(ui, "Programmable TOTP token", p.brand, p.brand_soft());
                                ui.add_space(4.0);
                                self.help_dot(ui, p, "molto");
                                ui.add_space(6.0);
                                let label = if dev.name.is_some() { "Rename" } else { "Name this token" };
                                if ui
                                    .add(
                                        egui::Label::new(egui::RichText::new(label).font(theme::f_sb(12.0)).color(p.accent))
                                            .sense(egui::Sense::click()),
                                    )
                                    .clicked()
                                {
                                    open_rename = true;
                                }
                            }
                        });
                        if self.rename_target.is_some() {
                            ui.add_space(3.0);
                            ui.label(
                                egui::RichText::new(
                                    "Saves this token's serial with the name to keys.json on this computer \u{2014} nothing leaves your machine.",
                                )
                                .font(theme::f_reg(11.5))
                                .color(p.txt3),
                            );
                        }
                        ui.add_space(2.0);
                        let serial = if dev.serial.is_empty() { "\u{2014}".to_string() } else { dev.serial.clone() };
                        ui.label(
                            egui::RichText::new(format!("{} \u{00B7} #{} \u{00B7} {} slots", dev.vendor, serial, PROFILES))
                                .font(theme::f_reg(12.5))
                                .color(p.txt2),
                        );
                    });
                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                        ui.label(egui::RichText::new("Connected").font(theme::f_sb(12.5)).color(p.txt2));
                        ui.add_space(5.0);
                        theme::status_dot(ui, p.ok, 8.0);
                    });
                });
            });
        self.apply_rename_actions(dev, open_rename, do_cancel, do_save);

        // --- Device-wide settings (apply to the whole token) ---
        egui::Frame::NONE
            .inner_margin(egui::Margin::symmetric(26, 14))
            .show(ui, |ui| {
                theme::card_frame(p).show(ui, |ui| {
                    ui.horizontal(|ui| {
                        ui.label(egui::RichText::new("Device").font(theme::f_sb(14.5)).color(p.txt));
                        ui.add_space(6.0);
                        self.help_dot(ui, p, "molto");
                    });
                    ui.add_space(10.0);
                    ui.horizontal(|ui| {
                        ui.add_sized(
                            [104.0, 22.0],
                            egui::Label::new(egui::RichText::new("Customer key").font(theme::f_reg(13.0)).color(p.txt2)),
                        );
                        self.help_dot(ui, p, "custkey");
                        ui.add_space(6.0);
                        let mut rev =
                            self.secret_reveal.get("customer-key").copied().unwrap_or(false);
                        secret_edit(
                            ui,
                            p,
                            &mut self.customer_key_input,
                            &mut rev,
                            "default if empty",
                            200.0,
                        );
                        self.secret_reveal.insert("customer-key", rev);
                        ui.checkbox(&mut self.customer_key_hex, "hex");
                        if theme::button(ui, p, BtnKind::Default, "Authenticate").clicked() {
                            self.authenticate();
                        }
                        if self.authenticated {
                            theme::pill(ui, "authed", p.ok, p.ok_soft());
                        }
                    });
                    ui.add_space(4.0);
                    ui.label(
                        egui::RichText::new("Programming any slot first needs the token's customer key (blank = factory default).")
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                    ui.add_space(12.0);
                    ui.horizontal(|ui| {
                        // Re-read every slot's public block on demand — keyless,
                        // so it works without authenticating. Covers a factory
                        // reset (which clears the list) and a failed open-sweep.
                        if theme::button(ui, p, BtnKind::Default, "Refresh slots").clicked() {
                            self.resweep_slot_meta(LogKind::User);
                        }
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Default, "Sync time on all").clicked() {
                            self.sync_time_all();
                        }
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Default, "Bulk import\u{2026}").clicked() {
                            self.bulk_dialog.open = true;
                            self.bulk_dialog.start = self.slot;
                        }
                        ui.add_space(6.0);
                        if theme::button(ui, p, BtnKind::Danger, "Factory reset\u{2026}").clicked() {
                            self.molto_reset_confirm = true;
                        }
                    });
                    if self.molto_reset_confirm {
                        ui.add_space(10.0);
                        egui::Frame::NONE
                            .fill(p.err_soft())
                            .inner_margin(egui::Margin::same(12))
                            .corner_radius(egui::CornerRadius::same(8))
                            .show(ui, |ui| {
                                ui.label(
                                    egui::RichText::new("Factory-reset the token? This wipes all slots, then asks you to confirm with the \u{25B2} button on the device itself.")
                                        .font(theme::f_reg(12.5))
                                        .color(p.txt),
                                );
                                ui.add_space(8.0);
                                ui.horizontal(|ui| {
                                    if theme::button(ui, p, BtnKind::Danger, "Yes, factory reset").clicked() {
                                        self.molto_reset_confirm = false;
                                        self.factory_reset();
                                    }
                                    ui.add_space(6.0);
                                    if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                                        self.molto_reset_confirm = false;
                                    }
                                });
                            });
                    }
                });
            });

        // --- Per-slot programming (applies only to the selected slot) ---
        egui::Frame::NONE
            .inner_margin(egui::Margin::symmetric(26, 4))
            .show(ui, |ui| {
                theme::card_frame(p).show(ui, |ui| {
                    ui.label(egui::RichText::new("Program a slot").font(theme::f_sb(14.5)).color(p.txt));
                    ui.add_space(4.0);
                    ui.label(
                        egui::RichText::new("Pick a slot and program it. Slot titles and occupancy are readable by anyone holding the token \u{2014} no key needed \u{2014} so don't put secrets in titles. Seeds and codes can't be read back; codes show on the device's own screen.")
                            .font(theme::f_reg(11.5))
                            .color(p.txt3),
                    );
                    ui.add_space(10.0);
                    ui.horizontal_top(|ui| {
                        ui.vertical(|ui| {
                            // Wide enough for "Slot NN · " plus a full 12-char
                            // title (the device's title limit) in the mono font,
                            // with the seed dot clear of the text.
                            ui.set_width(212.0);
                            // Fill the remaining height so the rail isn't a fixed
                            // block jammed at the window bottom; leave a margin.
                            let rail_h = (ui.available_height() - 48.0).max(160.0);
                            let mut pick = None;
                            egui::ScrollArea::vertical().auto_shrink([false, false]).max_height(rail_h).show(ui, |ui| {
                                for s in 0..PROFILES {
                                    let selected = s == self.slot;
                                    let (rect, resp) = ui.allocate_exact_size(egui::vec2(ui.available_width(), 30.0), egui::Sense::click());
                                    let bg = if selected {
                                        p.brand_soft()
                                    } else if resp.hovered() {
                                        p.line_soft
                                    } else {
                                        egui::Color32::TRANSPARENT
                                    };
                                    ui.painter().rect(
                                        rect,
                                        egui::CornerRadius::same(8),
                                        bg,
                                        egui::Stroke::NONE,
                                        egui::StrokeKind::Inside,
                                    );
                                    let meta = self
                                        .slot_meta
                                        .as_ref()
                                        .and_then(|m| m.get(s as usize));
                                    let label = match meta.and_then(|b| b.title.as_deref()) {
                                        Some(t) => format!("Slot {s:02} \u{00B7} {}", sanitize_title(t)),
                                        None => format!("Slot {s:02}"),
                                    };
                                    // Clip to the row (short of the seed dot) so a
                                    // maximal title can never paint over the form
                                    // column beside the rail.
                                    let text_clip = egui::Rect::from_min_max(
                                        rect.min,
                                        egui::pos2(rect.right() - 20.0, rect.max.y),
                                    );
                                    ui.painter().with_clip_rect(text_clip).text(
                                        rect.left_center() + egui::vec2(12.0, 0.0),
                                        egui::Align2::LEFT_CENTER,
                                        label,
                                        theme::f_mono(12.5),
                                        if selected { p.brand } else { p.txt2 },
                                    );
                                    if meta.is_some_and(|b| b.seed_present) {
                                        ui.painter().circle_filled(
                                            egui::pos2(rect.right() - 12.0, rect.center().y),
                                            3.0,
                                            p.brand,
                                        );
                                    }
                                    if resp.clicked() {
                                        pick = Some(s);
                                    }
                                }
                            });
                            if let Some(s) = pick {
                                self.slot = s;
                                self.molto_delete_confirm = false;
                            }
                        });
                        ui.add_space(24.0);
                        ui.vertical(|ui| {
                            ui.label(egui::RichText::new(format!("SLOT {:02}", self.slot)).font(theme::f_bold(11.0)).color(p.brand));
                            ui.add_space(10.0);
                            editor_row(ui, p, "Title", |ui| {
                                ui.add(egui::TextEdit::singleline(&mut self.draft.title).hint_text("\u{2264} 12 chars").desired_width(360.0));
                            });
                            editor_row(ui, p, "Secret", |ui| {
                                let mut rev = self
                                    .secret_reveal
                                    .get("molto-secret")
                                    .copied()
                                    .unwrap_or(false);
                                secret_edit(
                                    ui,
                                    p,
                                    &mut self.draft.secret_base32,
                                    &mut rev,
                                    "base32 secret",
                                    360.0,
                                );
                                self.secret_reveal.insert("molto-secret", rev);
                            });
                            // Two columns for the short choices, to use the width.
                            let field_label = |ui: &mut egui::Ui, w: f32, text: &str| {
                                ui.add_sized([w, 22.0], egui::Label::new(egui::RichText::new(text).font(theme::f_reg(13.0)).color(p.txt2)));
                            };
                            ui.horizontal(|ui| {
                                field_label(ui, 92.0, "Algorithm");
                                let cur = match self.draft.algorithm {
                                    AlgoChoice::Sha1 => "SHA1",
                                    AlgoChoice::Sha256 => "SHA256",
                                };
                                if let Some(v) = theme::segmented(ui, p, &["SHA1", "SHA256"], cur, p.brand) {
                                    self.draft.algorithm = if v == "SHA256" { AlgoChoice::Sha256 } else { AlgoChoice::Sha1 };
                                }
                                ui.add_space(30.0);
                                field_label(ui, 50.0, "Digits");
                                let cur = match self.draft.digits {
                                    DigitsChoice::Four => "4",
                                    DigitsChoice::Six => "6",
                                    DigitsChoice::Eight => "8",
                                    DigitsChoice::Ten => "10",
                                };
                                if let Some(v) = theme::segmented(ui, p, &["4", "6", "8", "10"], cur, p.brand) {
                                    self.draft.digits = match v.as_str() {
                                        "4" => DigitsChoice::Four,
                                        "8" => DigitsChoice::Eight,
                                        "10" => DigitsChoice::Ten,
                                        _ => DigitsChoice::Six,
                                    };
                                }
                            });
                            ui.add_space(8.0);
                            ui.horizontal(|ui| {
                                field_label(ui, 92.0, "Time step");
                                let cur = match self.draft.time_step {
                                    StepChoice::S30 => "30s",
                                    StepChoice::S60 => "60s",
                                };
                                if let Some(v) = theme::segmented(ui, p, &["30s", "60s"], cur, p.brand) {
                                    self.draft.time_step = if v == "60s" { StepChoice::S60 } else { StepChoice::S30 };
                                }
                                ui.add_space(30.0);
                                field_label(ui, 50.0, "Display");
                                let cur = match self.draft.display_timeout {
                                    TimeoutChoice::S15 => "15s",
                                    TimeoutChoice::S30 => "30s",
                                    TimeoutChoice::S60 => "60s",
                                    TimeoutChoice::S120 => "120s",
                                };
                                if let Some(v) = theme::segmented(ui, p, &["15s", "30s", "60s", "120s"], cur, p.brand) {
                                    self.draft.display_timeout = match v.as_str() {
                                        "15s" => TimeoutChoice::S15,
                                        "60s" => TimeoutChoice::S60,
                                        "120s" => TimeoutChoice::S120,
                                        _ => TimeoutChoice::S30,
                                    };
                                }
                            });
                            ui.add_space(8.0);
                            ui.horizontal(|ui| {
                                if theme::button(ui, p, BtnKind::Primary, "Write to slot").clicked() {
                                    self.apply_draft();
                                }
                                ui.add_space(6.0);
                                if theme::button(ui, p, BtnKind::Default, "Write title only").clicked() {
                                    self.apply_title_only();
                                }
                                ui.add_space(6.0);
                                if theme::button(ui, p, BtnKind::Danger, "Delete seed\u{2026}").clicked() {
                                    self.molto_delete_confirm = true;
                                }
                                ui.add_space(6.0);
                                if theme::button(ui, p, BtnKind::Default, "Import otpauth\u{2026}").clicked() {
                                    self.import_dialog.open = true;
                                }
                                ui.add_space(6.0);
                                #[cfg(feature = "qr")]
                                {
                                    if scan_qr_button(ui, p) {
                                        self.molto_scan_qr();
                                    }
                                }
                                #[cfg(feature = "qr")]
                                ui.add_space(6.0);
                                if theme::button(ui, p, BtnKind::Default, "Sync time").clicked() {
                                    self.sync_time_selected();
                                }
                            });
                            if self.molto_delete_confirm {
                                ui.add_space(10.0);
                                egui::Frame::NONE
                                    .fill(p.err_soft())
                                    .inner_margin(egui::Margin::same(12))
                                    .corner_radius(egui::CornerRadius::same(8))
                                    .show(ui, |ui| {
                                        ui.label(
                                            egui::RichText::new(format!(
                                                "Delete slot {:02}'s seed? Only the seed is wiped \u{2014} the title stays. No key is needed for this: anyone holding the token could do the same.",
                                                self.slot
                                            ))
                                            .font(theme::f_reg(12.5))
                                            .color(p.txt),
                                        );
                                        ui.add_space(8.0);
                                        ui.horizontal(|ui| {
                                            if theme::button(ui, p, BtnKind::Danger, "Yes, delete seed").clicked() {
                                                self.molto_delete_confirm = false;
                                                self.delete_seed_selected();
                                            }
                                            ui.add_space(6.0);
                                            if theme::button(ui, p, BtnKind::Default, "Cancel").clicked() {
                                                self.molto_delete_confirm = false;
                                            }
                                        });
                                    });
                            }
                        });
                    });
                });
            });
    }

    /// Pane for the single-profile programmable token: shows model/serial/clock
    /// and a form to program a seed + configuration. Uses the brand accent like
    /// the Molto2 view.
    fn prog_view(&mut self, ui: &mut egui::Ui, p: &Palette, dev: &Device) {
        let mp = Palette {
            accent: p.brand,
            ..*p
        };
        let p = &mp;

        // Hero: brand tile + model + serial + on-device clock.
        egui::Frame::NONE
            .inner_margin(egui::Margin::symmetric(26, 16))
            .show(ui, |ui| {
                ui.horizontal(|ui| {
                    glyph_tile(ui, 46.0, p.brand, p.accent_ink, None);
                    ui.add_space(12.0);
                    ui.vertical(|ui| {
                        ui.label(
                            egui::RichText::new(dev.title())
                                .font(theme::f_bold(18.0))
                                .color(p.txt),
                        );
                        let serial = self
                            .prog_info
                            .as_ref()
                            .map(|i| i.serial.clone())
                            .unwrap_or_else(|| dev.serial.clone());
                        ui.label(
                            egui::RichText::new(format!("Token2 · serial {serial}"))
                                .font(theme::f_reg(12.5))
                                .color(p.txt2),
                        );
                        if let Some(info) = &self.prog_info {
                            ui.label(
                                egui::RichText::new(format!(
                                    "device clock (UTC): {}",
                                    fmt_unix_utc(info.utc_time)
                                ))
                                .font(theme::f_reg(12.0))
                                .color(p.txt3),
                            );
                        }
                    });
                });
            });

        ui.separator();

        // Program form.
        egui::Frame::NONE
            .inner_margin(egui::Margin::symmetric(26, 12))
            .show(ui, |ui| {
                ui.label(
                    egui::RichText::new("Program seed & configuration")
                        .font(theme::f_sb(14.0))
                        .color(p.txt),
                );
                ui.add_space(8.0);

                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Seed:")
                            .font(theme::f_reg(12.5))
                            .color(p.txt2),
                    );
                    let hint = if self.prog_seed_hex { "hex" } else { "base32" };
                    let mut rev = self
                        .secret_reveal
                        .get("prog-seed")
                        .copied()
                        .unwrap_or(false);
                    secret_edit(ui, p, &mut self.prog_seed_input, &mut rev, hint, 320.0);
                    self.secret_reveal.insert("prog-seed", rev);
                    ui.checkbox(&mut self.prog_seed_hex, "hex");
                });
                ui.add_space(6.0);

                ui.horizontal(|ui| {
                    ui.label(
                        egui::RichText::new("Algorithm:")
                            .font(theme::f_reg(12.5))
                            .color(p.txt2),
                    );
                    egui::ComboBox::from_id_salt("prog-algo")
                        .selected_text(if self.prog_algo_sha256 {
                            "SHA256"
                        } else {
                            "SHA1"
                        })
                        .show_ui(ui, |ui| {
                            ui.selectable_value(&mut self.prog_algo_sha256, false, "SHA1");
                            ui.selectable_value(&mut self.prog_algo_sha256, true, "SHA256");
                        });
                    ui.add_space(12.0);
                    ui.label(
                        egui::RichText::new("Time step:")
                            .font(theme::f_reg(12.5))
                            .color(p.txt2),
                    );
                    egui::ComboBox::from_id_salt("prog-step")
                        .selected_text(if self.prog_step_60 { "60s" } else { "30s" })
                        .show_ui(ui, |ui| {
                            ui.selectable_value(&mut self.prog_step_60, false, "30s");
                            ui.selectable_value(&mut self.prog_step_60, true, "60s");
                        });
                    ui.add_space(12.0);
                    ui.label(
                        egui::RichText::new("Sleep:")
                            .font(theme::f_reg(12.5))
                            .color(p.txt2),
                    );
                    let timeouts = ["15s", "30s", "60s", "120s"];
                    egui::ComboBox::from_id_salt("prog-timeout")
                        .selected_text(timeouts[self.prog_timeout_idx.min(3)])
                        .show_ui(ui, |ui| {
                            for (i, t) in timeouts.iter().enumerate() {
                                ui.selectable_value(&mut self.prog_timeout_idx, i, *t);
                            }
                        });
                });
                ui.add_space(12.0);

                let busy = self.busy();
                let can_burn = !busy && !self.prog_seed_input.trim().is_empty();
                ui.horizontal(|ui| {
                    ui.add_enabled_ui(can_burn, |ui| {
                        if theme::button(ui, p, BtnKind::Primary, "Burn seed").clicked() {
                            self.prog_burn();
                        }
                    });
                    #[cfg(feature = "qr")]
                    {
                        ui.add_space(6.0);
                        if scan_qr_button(ui, p) {
                            self.prog_scan_qr();
                        }
                    }
                });
                ui.add_space(4.0);
                ui.label(
                    egui::RichText::new(
                        "Sets the configuration (clock + parameters) and writes the seed.",
                    )
                    .font(theme::f_reg(11.5))
                    .color(p.txt3),
                );

                if let Some((ok, msg)) = &self.prog_status {
                    ui.add_space(8.0);
                    ui.label(
                        egui::RichText::new(msg)
                            .font(theme::f_sb(12.5))
                            .color(if *ok { p.ok } else { p.err }),
                    );
                }
            });
    }

    /// Authenticate (fixed device key) and program config + seed in one job.
    fn prog_burn(&mut self) {
        self.prog_status = None;
        let Some(reader) = self.selected_device().and_then(|d| d.reader.clone()) else {
            return;
        };
        // Decode the seed up front so input errors surface before any I/O.
        let raw = self.prog_seed_input.trim().to_string();
        let seed = if self.prog_seed_hex {
            keyroost_proto::codec::hex_decode(&raw)
        } else {
            keyroost_proto::codec::base32_decode(&raw)
        };
        let seed = match seed {
            Ok(s) if !s.is_empty() && s.len() <= 63 => s,
            Ok(s) => {
                self.log(
                    Severity::Err,
                    format!("seed length {} out of range (1..=63)", s.len()),
                );
                return;
            }
            Err(e) => {
                self.log(Severity::Err, format!("invalid seed: {e}"));
                return;
            }
        };
        // Pad short seeds to the standard 20-byte TOTP length with trailing
        // zero bytes, matching the vendor tool. Without this a 10-byte base32
        // secret is stored as 10 bytes and the device's codes won't match an
        // authenticator app that uses the same secret padded to 20 bytes.
        let seed = zeroize::Zeroizing::new(keyroost_token2prog::pad_totp_seed(seed));
        let algo = if self.prog_algo_sha256 {
            keyroost_token2prog::HmacAlgo::Sha256
        } else {
            keyroost_token2prog::HmacAlgo::Sha1
        };
        let step = if self.prog_step_60 {
            keyroost_token2prog::TimeStep::Seconds60
        } else {
            keyroost_token2prog::TimeStep::Seconds30
        };
        let timeout = match self.prog_timeout_idx {
            0 => keyroost_token2prog::DisplayTimeout::Sec15,
            2 => keyroost_token2prog::DisplayTimeout::Sec60,
            3 => keyroost_token2prog::DisplayTimeout::Sec120,
            _ => keyroost_token2prog::DisplayTimeout::Sec30,
        };
        let now = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .map(|d| d.as_secs() as u32)
            .unwrap_or(0);
        let for_device = self.selected_device.clone();

        self.spawn_job("Programming token\u{2026}", move || {
            let result = (|| -> Result<(), String> {
                let mut s = Token2ProgSession::open_named(&reader).map_err(|e| e.to_string())?;
                // Refuse to program a device whose serial doesn't match a known
                // Token2 programmable-token model (mirrors the CLI's
                // `prog_guard_model`) — guards against writing to the wrong card
                // on a shared reader.
                let info = s.read_info().map_err(|e| e.to_string())?;
                if info.model().is_none() {
                    return Err(format!(
                        "serial '{}' does not match any known Token2 programmable-token \
                         model; refusing to program this device.",
                        info.serial
                    ));
                }
                s.authenticate().map_err(|e| e.to_string())?;
                let cfg = keyroost_token2prog::Config {
                    display_timeout: timeout,
                    algorithm: algo,
                    time_step: step,
                    utc_time: now,
                };
                s.set_config(&cfg).map_err(|e| e.to_string())?;
                s.set_seed(&seed).map_err(|e| e.to_string())?;
                Ok(())
            })();
            Box::new(move |app: &mut App| {
                if app.selected_device != for_device {
                    return; // user switched tokens mid-program
                }
                match result {
                    Ok(()) => {
                        app.log(Severity::Ok, "programmed token (config + seed)".to_string());
                        app.prog_status = Some((
                            true,
                            "Seed and configuration programmed successfully.".to_string(),
                        ));
                        // Scrub the typed seed (wipe, not clear — clear leaves the
                        // bytes in the buffer) and re-mask it for the next entry.
                        wipe(&mut app.prog_seed_input);
                        app.secret_reveal.insert("prog-seed", false);
                    }
                    Err(e) => {
                        app.log(Severity::Err, format!("program token: {e}"));
                        app.prog_status = Some((false, format!("Programming failed: {e}")));
                    }
                }
            })
        });
    }

    /// Shared QR-from-screen scan: returns the base32 secret (as written in the
    /// URI) plus the parsed `OtpAuth`, so callers can fill issuer/algorithm/etc.
    #[cfg(feature = "qr")]
    fn scan_qr_parsed(&mut self) -> Result<(String, keyroost_import::OtpAuth), String> {
        let uri = qrscan::scan_screens_for_otpauth()?;
        let parsed = parse_otpauth(&uri).map_err(|e| format!("QR parse failed: {e}"))?;
        let secret = uri
            .find("secret=")
            .map(|i| {
                let rest = &uri[i + 7..];
                let end = rest.find('&').unwrap_or(rest.len());
                rest[..end].to_owned()
            })
            .unwrap_or_default();
        if secret.is_empty() {
            return Err("scanned QR has no secret".into());
        }
        Ok((secret, parsed))
    }

    /// Fill the OATH "New credential" fields from a scanned screen QR.
    #[cfg(feature = "qr")]
    fn oath_scan_qr(&mut self) {
        match self.scan_qr_parsed() {
            Ok((secret, parsed)) => {
                self.oath.add.secret = secret;
                // The OATH dialog's name is "issuer:account"; fill it from the URI.
                let name = parsed.suggested_title();
                if !name.is_empty() {
                    self.oath.add.name = name;
                }
                self.oath.add.totp = true; // otpauth://totp
            }
            Err(e) => self.log(Severity::Err, format!("scan QR: {e}")),
        }
    }

    /// Fill the on-device OTP add-dialog fields from a scanned screen QR.
    #[cfg(feature = "qr")]
    fn otp_scan_qr(&mut self) {
        match self.scan_qr_parsed() {
            Ok((secret, parsed)) => {
                self.otp.add.secret = secret;
                if let Some(issuer) = &parsed.issuer {
                    self.otp.add.app_name = issuer.clone();
                }
                if let Some(account) = &parsed.account {
                    self.otp.add.account_name = account.clone();
                }
                self.otp.add.sha256 = matches!(parsed.algorithm, HmacAlgo::Sha256);
                self.otp.add.digits = parsed.digits as u8;
                self.otp.add.period = match parsed.time_step {
                    TimeStep::Seconds30 => 30,
                    TimeStep::Seconds60 => 60,
                };
                self.otp.add.totp = true; // otpauth://totp
            }
            Err(e) => self.log(Severity::Err, format!("scan QR: {e}")),
        }
    }

    /// Scan a TOTP QR from the screen and fill the prog seed form from it.
    #[cfg(feature = "qr")]
    fn prog_scan_qr(&mut self) {
        self.prog_status = None;
        match self.scan_qr_parsed() {
            Ok((secret, parsed)) => {
                self.prog_seed_input = zeroize::Zeroizing::new(secret);
                self.prog_seed_hex = false;
                // A freshly-scanned secret must not be revealed by a stale toggle.
                self.secret_reveal.insert("prog-seed", false);
                self.prog_algo_sha256 = matches!(parsed.algorithm, HmacAlgo::Sha256);
                self.prog_step_60 = matches!(parsed.time_step, TimeStep::Seconds60);
                self.prog_status = Some((
                    true,
                    "Filled seed and parameters from the scanned QR.".into(),
                ));
            }
            Err(e) => self.prog_status = Some((false, e)),
        }
    }

    /// The Molto2 import dialogs (otpauth:// + bulk). Reused verbatim from the
    /// original Molto2 view; only the entry point changed.
    fn molto_dialogs(&mut self, ctx: &egui::Context, _p: &Palette) {
        if self.bulk_dialog.open {
            let mut open = self.bulk_dialog.open;
            let mut do_load = false;
            let mut do_apply = false;
            egui::Window::new("Bulk import")
                .open(&mut open)
                .collapsible(false)
                .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
                .default_width(560.0)
                .show(ctx, |ui| {
                    ui.label("Export file path (Aegis JSON [plain or encrypted], 2FAS JSON, or otpauth:// list):");
                    ui.add(
                        egui::TextEdit::singleline(&mut self.bulk_dialog.path)
                            .desired_width(540.0)
                            .hint_text("/path/to/export.json"),
                    );
                    if self.bulk_dialog.needs_password {
                        ui.label("Aegis vault password:");
                        let resp = ui.add(
                            egui::TextEdit::singleline(&mut self.bulk_dialog.password)
                                .password(true)
                                .desired_width(360.0),
                        );
                        guard_secret_field(ui.ctx(), &resp);
                    }
                    ui.horizontal(|ui| {
                        let importing = self.import_busy();
                        if ui
                            .add_enabled(!importing, egui::Button::new("Load"))
                            .clicked()
                        {
                            do_load = true;
                        }
                        if importing {
                            ui.spinner();
                            if let Some(label) = &self.import_label {
                                ui.label(label.as_str());
                            }
                        }
                        ui.label("Start at profile:");
                        ui.add(
                            egui::DragValue::new(&mut self.bulk_dialog.start)
                                .clamp_existing_to_range(true)
                                .range(0..=99u8),
                        );
                        ui.label("Display timeout:");
                        egui::ComboBox::from_id_salt("bulk-timeout")
                            .selected_text(match self.bulk_dialog.display_timeout {
                                TimeoutChoice::S15 => "15s",
                                TimeoutChoice::S30 => "30s",
                                TimeoutChoice::S60 => "60s",
                                TimeoutChoice::S120 => "120s",
                            })
                            .show_ui(ui, |ui| {
                                ui.selectable_value(
                                    &mut self.bulk_dialog.display_timeout,
                                    TimeoutChoice::S15,
                                    "15s",
                                );
                                ui.selectable_value(
                                    &mut self.bulk_dialog.display_timeout,
                                    TimeoutChoice::S30,
                                    "30s",
                                );
                                ui.selectable_value(
                                    &mut self.bulk_dialog.display_timeout,
                                    TimeoutChoice::S60,
                                    "60s",
                                );
                                ui.selectable_value(
                                    &mut self.bulk_dialog.display_timeout,
                                    TimeoutChoice::S120,
                                    "120s",
                                );
                            });
                    });

                    if let Some(err) = &self.bulk_dialog.error {
                        ui.colored_label(egui::Color32::from_rgb(220, 100, 100), err);
                    }

                    if !self.bulk_dialog.entries.is_empty() {
                        ui.separator();
                        ui.label(format!(
                            "{} entries — will fill slots #{:02}..#{:02}",
                            self.bulk_dialog.entries.len(),
                            self.bulk_dialog.start,
                            self.bulk_dialog.start as usize + self.bulk_dialog.entries.len() - 1,
                        ));
                        egui::ScrollArea::vertical()
                            .max_height(220.0)
                            .show(ui, |ui| {
                                for (i, e) in self.bulk_dialog.entries.iter().enumerate() {
                                    let slot = self.bulk_dialog.start as usize + i;
                                    ui.label(format!(
                                        "#{:02}  {}  ({}/{:?}/{}d)",
                                        slot,
                                        e.suggested_title(),
                                        match e.algorithm {
                                            HmacAlgo::Sha1 => "SHA1",
                                            HmacAlgo::Sha256 => "SHA256",
                                        },
                                        e.time_step,
                                        e.digits as u8
                                    ));
                                }
                            });
                        ui.horizontal(|ui| {
                            // Block programming while a load is in flight so a
                            // stale entry list can't be written mid-replace.
                            let can_apply = self.authenticated && !self.import_busy();
                            if ui
                                .add_enabled(can_apply, egui::Button::new("Program all"))
                                .on_hover_text("Write seed, title, and config for every entry")
                                .clicked()
                            {
                                do_apply = true;
                            }
                            if ui.button("Close").clicked() {
                                self.bulk_dialog.open = false;
                            }
                        });
                    }
                });
            let was_open = self.bulk_dialog.open;
            self.bulk_dialog.open = open;
            // Scrub the typed vault password when the dialog closes (X button or
            // programmatic close), so a password that survived a decrypt error
            // — kept live to allow a retry — never lingers past the dialog.
            if was_open && !open {
                wipe(&mut self.bulk_dialog.password);
            }
            if do_load {
                self.bulk_load();
            }
            if do_apply {
                self.bulk_apply();
            }
        }

        if self.import_dialog.open {
            let mut open = self.import_dialog.open;
            let mut should_apply = false;
            egui::Window::new(format!("Import to profile #{:02}", self.slot))
                .open(&mut open)
                .collapsible(false)
                .resizable(false)
                .anchor(egui::Align2::CENTER_CENTER, [0.0, 0.0])
                .show(ctx, |ui| {
                    ui.label("Paste an otpauth:// URI:");
                    ui.add(
                        egui::TextEdit::multiline(&mut self.import_dialog.uri)
                            .desired_rows(3)
                            .desired_width(420.0)
                            .font(egui::TextStyle::Monospace),
                    );
                    ui.add_space(4.0);
                    ui.horizontal(|ui| {
                        if ui.button("Parse & populate fields").clicked() {
                            should_apply = true;
                        }
                        if ui.button("Cancel").clicked() {
                            self.import_dialog.open = false;
                            self.import_dialog.uri.clear();
                        }
                    });
                });
            self.import_dialog.open = open;
            if should_apply {
                self.import_otpauth();
            }
        }
    }
}

/// Paint one OATH credential row: issuer/account · code · countdown ring ·
/// seconds · copy (· delete). Returns `(Some(code) if copy clicked, delete?)`.
fn oath_row(
    ui: &mut egui::Ui,
    p: &Palette,
    name: &str,
    code: Option<&str>,
    hotp: bool,
    is_copied: bool,
    with_delete: bool,
) -> (Option<String>, bool, bool) {
    let (issuer, account) = match name.split_once(':') {
        Some((a, b)) => (a.to_string(), b.to_string()),
        None => (name.to_string(), String::new()),
    };
    let (secs, pct) = theme::totp_window(30);
    let code_color = if hotp {
        // HOTP codes don't expire — no about-to-roll warning color.
        p.accent
    } else if secs <= 5 {
        p.warn
    } else {
        p.accent
    };
    let mut copy = None;
    let mut delete = false;
    let mut read = false;
    ui.horizontal(|ui| {
        ui.vertical(|ui| {
            ui.horizontal(|ui| {
                ui.label(
                    egui::RichText::new(issuer)
                        .font(theme::f_sb(13.5))
                        .color(p.txt),
                );
                if hotp {
                    theme::pill(ui, "HOTP", p.txt2, p.line_soft);
                }
            });
            if !account.is_empty() {
                ui.label(
                    egui::RichText::new(account)
                        .font(theme::f_reg(12.0))
                        .color(p.txt3),
                );
            }
        });
        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
            if with_delete {
                let (xr, xresp) =
                    ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::click());
                paint_x_icon(ui, xr.center(), p.txt3);
                if xresp.on_hover_text("Delete").clicked() {
                    delete = true;
                }
                ui.add_space(8.0);
            }
            if hotp && code.is_none() {
                // No code yet: reading one advances the card's counter, so it
                // happens only on request. (No copy icon either — there's
                // nothing to copy.) The compact overview card doesn't handle
                // the click, so it gets a passive label instead of a button.
                if with_delete {
                    if theme::button(ui, p, BtnKind::Ghost, "Read code").clicked() {
                        read = true;
                    }
                } else {
                    ui.label(
                        egui::RichText::new("on demand")
                            .font(theme::f_reg(13.0))
                            .color(p.txt3),
                    );
                }
                return;
            }
            let (cr, cresp) = ui.allocate_exact_size(egui::vec2(20.0, 18.0), egui::Sense::click());
            if is_copied {
                paint_check_icon(ui, cr.center(), p.ok);
            } else {
                paint_copy_icon(ui, cr.center(), p.txt3);
            }
            if cresp.on_hover_text("Copy code").clicked() {
                if let Some(c) = code {
                    copy = Some(c.to_string());
                }
            }
            ui.add_space(10.0);
            if !hotp {
                // The countdown is a TOTP concept; an HOTP code stays valid
                // until used.
                ui.label(
                    egui::RichText::new(format!("{secs}s"))
                        .font(theme::f_reg(11.0))
                        .color(p.txt3),
                );
                ui.add_space(5.0);
                theme::ring(ui, pct, 20.0, code_color, p.line);
            }
            ui.add_space(14.0);
            match code {
                Some(c) => {
                    ui.label(
                        egui::RichText::new(c)
                            .font(theme::f_mono(19.0))
                            .color(code_color),
                    );
                }
                None => {
                    ui.label(
                        egui::RichText::new("touch")
                            .font(theme::f_reg(13.0))
                            .color(p.txt3),
                    );
                }
            }
        });
    });
    (copy, delete, read)
}

/// Flatten control characters out of a device-provided title before display
/// (same policy as the CLI's sanitize_cert_field).
fn sanitize_title(s: &str) -> String {
    s.chars()
        .map(|c| if c.is_control() { ' ' } else { c })
        .collect()
}

/// One labelled editor row in the Molto2 form: fixed-width label + a field.
fn editor_row(ui: &mut egui::Ui, p: &Palette, label: &str, add: impl FnOnce(&mut egui::Ui)) {
    ui.horizontal(|ui| {
        ui.add_sized(
            [92.0, 22.0],
            egui::Label::new(
                egui::RichText::new(label)
                    .font(theme::f_reg(13.0))
                    .color(p.txt2),
            ),
        );
        add(ui);
    });
    ui.add_space(8.0);
}

/// Summarize an OpenPGP key slot: its algorithm label, or "empty" when no key.
fn slot_summary(attrs: &[u8], fpr: &[u8; 20]) -> String {
    if fpr.iter().all(|&b| b == 0) {
        "empty".to_string()
    } else {
        keyroost_transport::describe_algorithm_attributes(attrs)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A minimal `PivStatus` reporting just `fingerprint`/`version` — enough
    /// to drive `App::piv_current_default_mgmt_key`'s resolution in a test.
    /// `PivStatus` is `#[non_exhaustive]`, so this crate can't use struct-
    /// literal syntax on it directly; go through `Default` and field
    /// assignment instead, same as the existing `PivStatus::default()` tests
    /// already do.
    fn piv_status_with(
        fingerprint: keyroost_piv::fingerprint::AppletFingerprint,
        version: Option<Vec<u8>>,
    ) -> keyroost_transport::PivStatus {
        let mut status = keyroost_transport::PivStatus::default();
        status.applet_fingerprint = fingerprint;
        status.version = version;
        status
    }

    /// A row built with `stable_selectable_value` must occupy the same
    /// height whether or not the pointer is hovering it — the property every
    /// PIV dropdown built from it (algorithm, management-key algorithm,
    /// PIN/touch policy, move destination) relies on to keep a combo popup
    /// sized close to its scroll cap from needing a scrollbar the instant
    /// the pointer lands on a row. Plain `ui.selectable_value` doesn't have
    /// this property: `Button::selectable` only reserves its frame's stroke
    /// width for the *currently selected* row, and this app's theme gives
    /// the `inactive` widget state a non-zero stroke width too (a text-field
    /// boundary fix, where egui's own default is zero), so an *unselected*
    /// row is measurably shorter at rest than hovered — see
    /// `stable_selectable_value`'s own doc for the exact mechanism.
    /// Exercises an *unselected* value, since that's the one plain
    /// `ui.selectable_value` sized inconsistently.
    #[test]
    fn stable_selectable_value_row_height_is_hover_invariant() {
        let ctx = egui::Context::default();
        crate::ui::theme::install_fonts(&ctx);
        Palette::new(Mode::Dark, Palette::ACCENTS[0], false).apply(&ctx, Mode::Dark);
        let mut current = keyroost_piv::KeyAlg::Rsa2048;
        let unselected = keyroost_piv::KeyAlg::Rsa3072;
        assert_ne!(current, unselected);
        let mut heights = vec![];
        let mut row_rect: Option<egui::Rect> = None;
        // Frame 0: no pointer — establishes the unhovered row's rect.
        // Frame 1: pointer moved onto that rect (registers as input, doesn't
        // yet affect layout — egui reads *last* frame's response to decide
        // *this* frame's widget state).
        // Frame 2: rendered again under sustained hover.
        for frame in 0..3 {
            let mut input = egui::RawInput {
                screen_rect: Some(egui::Rect::from_min_size(
                    egui::Pos2::ZERO,
                    egui::vec2(1200.0, 1200.0),
                )),
                ..Default::default()
            };
            if let Some(r) = row_rect.filter(|_| frame >= 1) {
                input.events.push(egui::Event::PointerMoved(r.center()));
            }
            let _ = ctx.run_ui(input, |ctx| {
                egui::CentralPanel::default().show(ctx, |ui| {
                    ui.set_min_width(160.0);
                    ui.style_mut().wrap_mode = Some(egui::TextWrapMode::Extend);
                    let resp =
                        stable_selectable_value(ui, &mut current, unselected, unselected.label());
                    heights.push(resp.rect.height());
                    row_rect = Some(resp.rect);
                });
            });
        }
        assert_eq!(
            heights[0], heights[2],
            "row height must not change once the pointer starts hovering it: {heights:?}"
        );
    }

    /// `Palette::apply` must set solid (space-reserving) scroll bars as the
    /// *ambient context style*, not a local `Ui`-scoped one — a `ComboBox`
    /// popup (`egui::containers::Popup`) always rebuilds its content `Ui`
    /// from `Context::style()`/`all_styles_mut`'s targets rather than
    /// inheriting whatever the calling `Ui` had locally overridden, so this
    /// is the only place a scroll style actually reaches a dropdown's own
    /// list. Without it, the default floating scroll bar grows its hit-rect
    /// on hover (`floating_width` -> `bar_width`) right over the row
    /// underneath, and the two fight for hover each frame the pointer sits on
    /// that boundary — the "generate key" algorithm dropdown's flickering
    /// scrollbar. Checked on both themes since `all_styles_mut` (unlike
    /// `set_visuals`) touches the style egui caches per `Theme`, not just
    /// whichever one is active when `apply` runs.
    #[test]
    fn palette_apply_sets_solid_scroll_bars_for_both_themes() {
        let ctx = egui::Context::default();
        for mode in [Mode::Dark, Mode::Light] {
            Palette::new(mode, Palette::ACCENTS[0], false).apply(&ctx, mode);
        }
        for theme in [egui::Theme::Dark, egui::Theme::Light] {
            ctx.style_mut_of(theme, |s| {
                assert!(
                    !s.spacing.scroll.floating,
                    "{theme:?} scroll style should be solid, not the default floating"
                );
            });
        }
    }

    #[test]
    fn openpgp_algorithm_choices_are_the_cards_list_or_everything() {
        use keyroost_transport::{KeyCrt, OpenPgpKeyAlg};
        // No FA: card default + every algorithm that fits the slot.
        let all = OpenPgpKeyAlgSel::choices(None, KeyCrt::Decrypt);
        assert_eq!(all[0], OpenPgpKeyAlgSel::CardDefault);
        assert!(all.contains(&OpenPgpKeyAlgSel::Alg(OpenPgpKeyAlg::X25519)));
        assert!(!all.contains(&OpenPgpKeyAlgSel::Alg(OpenPgpKeyAlg::Ed25519)));
        assert!(OpenPgpKeyAlgSel::choices(None, KeyCrt::Sign)
            .contains(&OpenPgpKeyAlgSel::Alg(OpenPgpKeyAlg::Ed25519)));
        // FA present: exactly what the card listed (modelled entries), in card order.
        let info = keyroost_transport::AlgorithmInformation {
            sig: vec![
                vec![0x16, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01],
                vec![0x01, 0x08, 0x00, 0x00, 0x20, 0x00],
            ],
            dec: vec![],
            aut: vec![],
        };
        assert_eq!(
            OpenPgpKeyAlgSel::choices(Some(&info), KeyCrt::Sign),
            vec![
                OpenPgpKeyAlgSel::CardDefault,
                OpenPgpKeyAlgSel::Alg(OpenPgpKeyAlg::Ed25519),
                OpenPgpKeyAlgSel::Alg(OpenPgpKeyAlg::Rsa2048)
            ]
        );
        // A slot the card lists nothing for still offers everything (unknown ≠ none).
        assert!(OpenPgpKeyAlgSel::choices(Some(&info), KeyCrt::Auth).len() > 1);
    }

    /// #98: the top bar's version chip is the only place the running app
    /// states its version — keep it a well-formed "vX.Y.Z" so it never
    /// regresses to an empty or unprefixed string.
    #[test]
    fn version_label_is_v_prefixed_semver() {
        let rest = VERSION_LABEL
            .strip_prefix('v')
            .expect("version label must start with 'v'");
        assert_eq!(rest, env!("CARGO_PKG_VERSION"));
        assert!(
            rest.split('.').count() >= 3
                && rest.split('.').take(3).all(|part| {
                    !part.is_empty() && part.chars().all(|c| c.is_ascii_digit() || c == '-')
                }),
            "version label {VERSION_LABEL:?} is not vMAJOR.MINOR.PATCH"
        );
    }

    #[test]
    fn factory_reset_summary_lists_applets_and_flags_piv_and_fido() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let mut caps = Caps::default();
        for c in [Caps::OATH, Caps::PIV, Caps::FIDO2] {
            caps.insert(c);
        }
        let msg = factory_reset_confirm_summary(
            "SN123",
            "Token2 PIN+",
            &factory_reset_plan(caps),
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::BurnPinPukThenReset,
            )),
            false,
            false,
        );
        assert!(msg.contains("SN123") && msg.contains("Token2 PIN+"));
        assert!(msg.contains("OATH") && msg.contains("PIV") && msg.contains("FIDO2"));
        // PIV disclosure and FIDO replug note are present.
        assert!(msg.contains("PIN and PUK"));
        assert!(msg.to_lowercase().contains("unplug"));
        // The summary must not promise an outcome the PIV path can't guarantee:
        // that path blocks the PIN and PUK before the wipe.
        assert!(!msg.contains("stays fully usable"));
    }

    /// The confirm dialog's PIV paragraph is fingerprinted ahead of time (see
    /// `App::start_factory_reset_confirm`), so it must actually say something
    /// different per `FactoryResetPivPreview` case — a user deciding whether
    /// to proceed needs to know which one they're looking at.
    #[test]
    fn factory_reset_summary_piv_note_matches_the_fingerprinted_plan() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let plan = factory_reset_plan(Caps::PIV);
        // `needs_management_auth` only matters to the credential sentence,
        // covered by dedicated tests below -- the PIV-only note text under
        // test here never depends on it, so `false` is a neutral stand-in
        // throughout.

        let needs_mgmt_auth = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::NeedsManagementAuth,
            )),
            false,
            false,
        );
        assert!(
            needs_mgmt_auth.contains("management-key"),
            "{needs_mgmt_auth}"
        );
        // Now genuinely attempted (authenticate, then RESET), not refused --
        // unlike every other atomic case here, this one does NOT say "will
        // NOT be wiped".
        assert!(
            !needs_mgmt_auth.contains("NOT be wiped"),
            "{needs_mgmt_auth}"
        );
        // Atomic: authenticate-then-RESET is a clean pass/fail, no partial
        // state for the step report to disambiguate, unlike the burn case.
        assert!(
            !needs_mgmt_auth.contains("the report below"),
            "{needs_mgmt_auth}"
        );

        let unverified = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(FactoryResetPlan::Unverified)),
            false,
            false,
        );
        assert!(unverified.contains("no RESET entry"), "{unverified}");
        assert!(unverified.contains("without blocking"), "{unverified}");
        // Also atomic (a bare RESET attempt, no PIN/PUK burn) -- same
        // reasoning as NeedsManagementAuth above.
        assert!(!unverified.contains("the report below"), "{unverified}");

        let burn_then_reset = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::BurnPinPukThenReset,
            )),
            false,
            false,
        );
        assert!(burn_then_reset.contains("PIN and PUK"), "{burn_then_reset}");
        // The one multi-step case (block PIN, block PUK, then RESET): a
        // failure partway through leaves PIV in a state this text alone
        // can't describe, so -- unlike every atomic case above -- it must
        // point at the step report.
        assert!(
            burn_then_reset.contains("the report below the button says what state it's in"),
            "{burn_then_reset}"
        );

        // The device-wide mechanism has nothing PIV-specific to caveat --
        // it's just another applet in the plan.
        let global = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Global),
            false,
            false,
        );
        assert!(!global.contains("PIV:"), "{global}");

        let check_failed = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::CheckFailed,
            false,
            false,
        );
        assert!(check_failed.contains("couldn't confirm"), "{check_failed}");

        // `NotOffered` inside a plan that DOES include PIV shouldn't happen in
        // practice, but must not panic or claim something false about a step
        // that was never fingerprinted -- it falls back to `CheckFailed`'s
        // wording.
        let not_offered = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::NotOffered,
            false,
            false,
        );
        assert_eq!(not_offered, check_failed);

        // A plan without PIV never gets a PIV paragraph, regardless of preview.
        let no_piv = factory_reset_confirm_summary(
            "SN",
            "Model",
            &factory_reset_plan(Caps::OATH),
            FactoryResetPivPreview::Resolved(PivResetPreview::Global),
            false,
            false,
        );
        assert!(!no_piv.contains("PIV:"), "{no_piv}");
    }

    /// `PivExtension::ResetGlobal` resolving `Global` means the PIV step, if
    /// it runs, takes at least one other applet down with it — the "Wipes:"
    /// list must say so up front (`PIV_GLOBAL_RESET_LABEL`), not report the
    /// bare `ResetStep::Piv::label()` a caller would otherwise read as
    /// "PIV, and only PIV, gets touched".
    #[test]
    fn factory_reset_summary_wipes_list_names_the_whole_device_when_global() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let mut caps = Caps::default();
        for c in [Caps::OATH, Caps::PIV] {
            caps.insert(c);
        }
        let plan = factory_reset_plan(caps);

        let global = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Global),
            false,
            false,
        );
        assert!(
            global.contains(&format!(
                "Wipes: OATH, {}",
                keyroost_resolve::PIV_GLOBAL_RESET_LABEL
            )),
            "{global}"
        );
        assert!(!global.contains("Wipes: OATH, PIV"), "{global}");
        // `PivResetPreview::Global` itself already folds `ResetGlobal`
        // resolving `Supported` *or* `Unverified` into one value (see that
        // variant's own doc) -- there's no separate case to test here, both
        // get this same label for the same reason: an unconfirmed
        // device-wide mechanism might still take other applets with it.

        // A PIV-only mechanism -- confirmed *not* device-wide -- keeps the
        // bare applet label.
        let piv_only = factory_reset_confirm_summary(
            "SN",
            "Model",
            &plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
                FactoryResetPlan::BurnPinPukThenReset,
            )),
            false,
            false,
        );
        assert!(piv_only.contains("Wipes: OATH, PIV"), "{piv_only}");
    }

    /// `PivResetPreview::Unsupported` never actually reaches the summary in
    /// practice (`start_factory_reset_confirm` excludes `ResetStep::Piv`
    /// from the plan whenever it's resolved -- see
    /// `factory_reset_piv_unresettable`), but the match still has to handle
    /// it, and defensively (a stale plan built before a fresh fingerprint
    /// changed the answer) it must not claim anything: empty string, same as
    /// its nested-`Unsupported` sibling that `preview_factory_reset` never
    /// actually produces.
    #[test]
    fn factory_reset_summary_unsupported_preview_says_nothing_if_ever_reached() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let plan = factory_reset_plan(Caps::PIV);
        for preview in [
            PivResetPreview::Unsupported,
            PivResetPreview::Piv(FactoryResetPlan::Unsupported),
        ] {
            let msg = factory_reset_confirm_summary(
                "SN",
                "Model",
                &plan,
                FactoryResetPivPreview::Resolved(preview),
                false,
                false,
            );
            assert!(!msg.contains("PIV:"), "{preview:?} {msg}");
        }
    }

    /// The management-auth credential sentence is gated purely on
    /// `needs_management_auth` (`PivQuirk::ResetNeedsManagementAuth`
    /// applying), independent of which mechanism `piv_preview` says will
    /// actually consume it -- appears exactly once whichever case is active,
    /// never duplicated by the PIV-only note above it (which, for
    /// `NeedsManagementAuth`, now separately says "authenticates ... then
    /// wipes" but doesn't itself repeat "management auth").
    #[test]
    fn factory_reset_summary_credential_sentence_is_gated_on_needs_management_auth_alone() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let plan = factory_reset_plan(Caps::PIV);
        for preview in [
            PivResetPreview::Global,
            PivResetPreview::Piv(FactoryResetPlan::NeedsManagementAuth),
        ] {
            let with_credential = factory_reset_confirm_summary(
                "SN",
                "Model",
                &plan,
                FactoryResetPivPreview::Resolved(preview),
                true,
                false,
            );
            assert_eq!(
                with_credential.matches("requires management auth").count(),
                1,
                "{preview:?} {with_credential}"
            );

            let without_credential = factory_reset_confirm_summary(
                "SN",
                "Model",
                &plan,
                FactoryResetPivPreview::Resolved(preview),
                false,
                false,
            );
            assert!(
                !without_credential.contains("requires management auth"),
                "{preview:?} {without_credential}"
            );
        }
    }

    /// `PivQuirk::ResetLongRunning` (e.g. ArekinathPivApplet::SwissbitIShield1)
    /// appends the same hint text the PIV pane's "Reset applet" card and
    /// `keyroostctl piv reset` already show, gated purely on the boolean --
    /// independent of which `FactoryResetPivPreview` case is active -- and
    /// only when the plan actually has a PIV step to warn about.
    #[test]
    fn factory_reset_summary_appends_the_long_running_hint_when_set() {
        use keyroost_resolve::{factory_reset_plan, Caps};
        use keyroost_transport::{FactoryResetPlan, PivResetPreview};
        let plan = factory_reset_plan(Caps::PIV);
        let preview = FactoryResetPivPreview::Resolved(PivResetPreview::Piv(
            FactoryResetPlan::BurnPinPukThenReset,
        ));

        let warned = factory_reset_confirm_summary("SN", "Model", &plan, preview, false, true);
        assert!(
            warned.contains(keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT),
            "{warned}"
        );

        let not_warned = factory_reset_confirm_summary("SN", "Model", &plan, preview, false, false);
        assert!(
            !not_warned.contains(keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT),
            "{not_warned}"
        );

        // A plan without PIV never gets the hint, even if the flag is set --
        // there's no PIV step for it to attach to.
        let no_piv_plan = factory_reset_plan(Caps::OATH);
        let no_piv = factory_reset_confirm_summary(
            "SN",
            "Model",
            &no_piv_plan,
            FactoryResetPivPreview::Resolved(PivResetPreview::Global),
            false,
            true,
        );
        assert!(
            !no_piv.contains(keyroost_piv::compat::PivQuirk::RESET_LONG_RUNNING_HINT),
            "{no_piv}"
        );
    }

    /// Two "Save certificate…" dialogs can be open at once (the busy guard is
    /// released before the extract job's apply closure runs, and the dialogs
    /// are not modal). Each must resolve to the certificate it was opened for —
    /// with the previous single global slot, whichever dialog was answered
    /// first wrote whatever cert happened to be parked.
    #[test]
    fn concurrent_save_cert_dialogs_resolve_to_their_own_certificates() {
        let mut pending = std::collections::HashMap::new();
        pending.insert(
            7,
            PendingSshCert {
                cert_pub: "alice-cert".into(),
                summary: "alice".into(),
            },
        );
        pending.insert(
            8,
            PendingSshCert {
                cert_pub: "bob-cert".into(),
                summary: "bob".into(),
            },
        );

        // Answer alice's dialog (opened first) while bob's is still open.
        let alice = take_pending_cert(&mut pending, 7).expect("alice's cert is parked");
        assert_eq!(alice.cert_pub, "alice-cert");
        // Bob's is untouched and still resolves to bob's cert.
        let bob = take_pending_cert(&mut pending, 8).expect("bob's cert is still parked");
        assert_eq!(bob.cert_pub, "bob-cert");
        // Each id resolves once; a re-run dialog reports "nothing to write"
        // rather than picking up a neighbour's certificate.
        assert!(take_pending_cert(&mut pending, 7).is_none());
        assert!(pending.is_empty());
    }

    /// A cancelled save must drop only its own parked certificate.
    #[test]
    fn cancelled_save_cert_dialog_drops_only_its_own_certificate() {
        let mut app = App::default();
        for (id, name) in [(1u64, "alice"), (2, "bob")] {
            app.security_keys.ssh_cert_pending.insert(
                id,
                PendingSshCert {
                    cert_pub: format!("{name}-cert"),
                    summary: name.into(),
                },
            );
        }
        app.discard_file_target(FileTarget::SshCertSave(1));
        assert!(!app.security_keys.ssh_cert_pending.contains_key(&1));
        assert_eq!(
            app.security_keys
                .ssh_cert_pending
                .get(&2)
                .map(|c| c.cert_pub.as_str()),
            Some("bob-cert")
        );
        // A target that parks nothing is a no-op.
        app.discard_file_target(FileTarget::PivExport);
        assert_eq!(app.security_keys.ssh_cert_pending.len(), 1);
    }

    /// The whole-device factory reset hands its FIDO step to the armed reset
    /// dialog, whose outcome only reaches `security_keys.error` — a pane the
    /// user isn't on. The seeded row keeps the report honest: it reads as not
    /// wiped until the ceremony answers, then flips to wiped or failed.
    #[test]
    fn factory_reset_fido_row_tracks_the_finale() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let seeded = || {
            vec![
                FactoryResetRow::Step(StepReport {
                    step: ResetStep::Oath,
                    outcome: StepOutcome::Wiped,
                }),
                FactoryResetRow::FidoPending,
            ]
        };

        // Seeded: FIDO reads as outstanding, never as wiped.
        let mut rows = seeded();
        let (text, tone) = factory_reset_row_line(&rows[1]);
        assert!(text.starts_with("FIDO2"), "{text}");
        assert!(text.contains("not wiped yet"), "{text}");
        assert_eq!(tone, RowTone::Waiting);

        // The touch landed.
        resolve_fido_reset_row(&mut rows, StepOutcome::Wiped);
        assert_eq!(
            factory_reset_row_line(&rows[1]),
            ("FIDO2  wiped".to_string(), RowTone::Done)
        );
        // The card steps are untouched by the finale.
        assert_eq!(
            factory_reset_row_line(&rows[0]),
            ("OATH  wiped".to_string(), RowTone::Done)
        );

        // No touch in time / the key refused: the row says so.
        let mut rows = seeded();
        resolve_fido_reset_row(&mut rows, StepOutcome::Failed("no touch".into()));
        let (text, tone) = factory_reset_row_line(&rows[1]);
        assert_eq!(text, "FIDO2  failed: no touch");
        assert_eq!(tone, RowTone::Bad);

        // A standalone "Reset key" (no factory reset in flight) must not invent
        // a report row.
        let mut plain = vec![FactoryResetRow::Step(StepReport {
            step: ResetStep::Oath,
            outcome: StepOutcome::Wiped,
        })];
        resolve_fido_reset_row(&mut plain, StepOutcome::Wiped);
        assert_eq!(plain.len(), 1);
        assert_eq!(
            factory_reset_row_line(&plain[0]),
            ("OATH  wiped".to_string(), RowTone::Done)
        );
    }

    /// A FIDO row that has already answered must not freeze that answer. The
    /// report invites a retry after a failed wipe and nothing clears it in
    /// between — the selection is unchanged across the replug, so the report
    /// survives — meaning a row still reading "failed" after a retry that
    /// succeeded tells the user their passkeys and PIN are on a key that is
    /// actually empty. The latest outcome has to win.
    #[test]
    fn factory_reset_fido_row_retry_supersedes_the_earlier_outcome() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let mut rows = vec![
            FactoryResetRow::Step(StepReport {
                step: ResetStep::Piv,
                outcome: StepOutcome::Wiped,
            }),
            FactoryResetRow::FidoPending,
        ];

        // First attempt: no touch in time.
        resolve_fido_reset_row(&mut rows, StepOutcome::Failed("no touch".into()));
        assert_eq!(factory_reset_row_line(&rows[1]).1, RowTone::Bad);

        // The user re-plugs, retries, and the wipe lands.
        resolve_fido_reset_row(&mut rows, StepOutcome::Wiped);
        assert_eq!(
            factory_reset_row_line(&rows[1]),
            ("FIDO2  wiped".to_string(), RowTone::Done)
        );
        assert_eq!(rows.len(), 2, "the retry must not append a second FIDO row");
        assert_eq!(
            factory_reset_row_line(&rows[0]),
            ("PIV  wiped".to_string(), RowTone::Done),
            "the card sweep's rows are the finale's business to leave alone"
        );

        // Still nothing invented when no FIDO row exists — an empty report
        // (standalone "Reset key" with no factory reset ever run) stays empty,
        // and a report of card steps only keeps exactly those steps.
        let mut empty: Vec<FactoryResetRow> = Vec::new();
        resolve_fido_reset_row(&mut empty, StepOutcome::Wiped);
        assert!(empty.is_empty());
        let mut cards = vec![FactoryResetRow::Step(StepReport {
            step: ResetStep::OpenPgp,
            outcome: StepOutcome::Failed("blocked".into()),
        })];
        resolve_fido_reset_row(&mut cards, StepOutcome::Wiped);
        assert_eq!(cards.len(), 1);
        assert_eq!(
            factory_reset_row_line(&cards[0]),
            ("OpenPGP  failed: blocked".to_string(), RowTone::Bad)
        );

        // …but replace-any is the *attempt* caller's privilege alone. Closing a
        // dialog attempts nothing, so a wipe that already landed has to survive
        // it: the report outlives the ceremony (a tab switch and a replug both
        // leave it standing), so the next dialog the user cancels is routinely
        // not the one this row came from.
        resolve_pending_fido_reset_row(
            &mut rows,
            StepOutcome::Failed(
                "cancelled \u{2014} the passkeys and PIN are still on this key".into(),
            ),
        );
        assert_eq!(
            factory_reset_row_line(&rows[1]),
            ("FIDO2  wiped".to_string(), RowTone::Done),
            "a cancel must not rewrite a finished wipe into a failure"
        );
        assert_eq!(rows.len(), 2);
    }

    /// The pending-only resolver still has to answer the row it *is* for: a
    /// factory reset whose FIDO finale the user cancels must stop reading
    /// "waiting for the unplug, replug, and touch" — that ceremony is over and
    /// the passkeys really are still there.
    #[test]
    fn cancelling_the_finale_resolves_a_pending_fido_row() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let mut rows = vec![
            FactoryResetRow::Step(StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            }),
            FactoryResetRow::FidoPending,
        ];
        resolve_pending_fido_reset_row(&mut rows, StepOutcome::Failed("cancelled".into()));
        assert_eq!(
            factory_reset_row_line(&rows[1]),
            ("FIDO2  failed: cancelled".to_string(), RowTone::Bad)
        );
        // A second cancel (the standalone dialog, opened and backed out of) has
        // nothing left to resolve and must leave the answer alone.
        resolve_pending_fido_reset_row(&mut rows, StepOutcome::Failed("cancelled again".into()));
        assert_eq!(
            factory_reset_row_line(&rows[1]),
            ("FIDO2  failed: cancelled".to_string(), RowTone::Bad)
        );
        // And it never invents a row where no factory reset is in flight.
        let mut empty: Vec<FactoryResetRow> = Vec::new();
        resolve_pending_fido_reset_row(&mut empty, StepOutcome::Failed("cancelled".into()));
        assert!(empty.is_empty());
    }

    /// Only `PivSession::factory_reset`'s PIN/PUK burn-dance path blocks the
    /// PIN and PUK before it erases, so only there can a failure in between
    /// leave the applet locked but intact. The confirmation modal promises
    /// the report says so — which means every failure that doesn't already
    /// describe the card's state has to carry the disclosure, matching what
    /// the CLI's factory reset prints for the same failures.
    #[test]
    fn piv_factory_reset_failures_disclose_the_blocked_credentials() {
        // Self-describing variants pass through untouched: appending "run the
        // factory reset again" would contradict them (Unsupported/
        // NeedsManagementAuth never blocked anything; UnverifiedFailed/
        // GlobalFailed/ManagementAuthFailed already explain themselves and
        // never touched a PIN or PUK either; the other two already say what
        // to do).
        let unsupported = piv_factory_reset_message(TransportError::PivResetUnsupported);
        assert_eq!(unsupported, TransportError::PivResetUnsupported.to_string());
        let needs_mgmt_auth =
            piv_factory_reset_message(TransportError::PivResetNeedsManagementAuth);
        assert_eq!(
            needs_mgmt_auth,
            TransportError::PivResetNeedsManagementAuth.to_string()
        );
        let unverified_failed = piv_factory_reset_message(
            TransportError::PivResetUnverifiedFailed(Box::new(TransportError::PivResetNotAllowed)),
        );
        assert_eq!(
            unverified_failed,
            TransportError::PivResetUnverifiedFailed(Box::new(TransportError::PivResetNotAllowed))
                .to_string()
        );
        let global_failed = piv_factory_reset_message(TransportError::PivResetGlobalFailed(
            Box::new(TransportError::PivSecurityNotSatisfied),
        ));
        assert_eq!(
            global_failed,
            TransportError::PivResetGlobalFailed(Box::new(TransportError::PivSecurityNotSatisfied))
                .to_string()
        );
        let mgmt_auth_failed =
            piv_factory_reset_message(TransportError::PivResetManagementAuthFailed(Box::new(
                TransportError::PivManagementAuthFailed,
            )));
        assert_eq!(
            mgmt_auth_failed,
            TransportError::PivResetManagementAuthFailed(Box::new(
                TransportError::PivManagementAuthFailed
            ))
            .to_string()
        );
        let incomplete =
            piv_factory_reset_message(TransportError::PivResetIncomplete("card state here"));
        assert_eq!(incomplete, "card state here");
        let guessed = piv_factory_reset_message(TransportError::PivPukGuessAccepted);
        assert_eq!(guessed, TransportError::PivPukGuessAccepted.to_string());

        // Everything else says nothing about the blocking on its own — an
        // unexpected status word in the PIN/PUK loop renders as a bare APDU
        // failure — so the disclosure is appended.
        let bare = piv_factory_reset_message(TransportError::Apdu {
            label: "piv pin/puk",
            sw1: 0x6a,
            sw2: 0x80,
        });
        assert!(bare.contains("piv pin/puk"), "{bare}");
        assert!(
            bare.contains("locked but not wiped"),
            "the half-wiped state has to be named: {bare}"
        );
        assert!(
            bare.contains("run the factory reset again"),
            "the way out has to be named: {bare}"
        );
        // Not the single-applet reset: a fault in the PUK loop leaves the PUK
        // unblocked, and the card refuses a plain RESET until both are blocked.
        assert!(!bare.contains("piv reset"), "{bare}");
    }

    /// The "Reset applet" card only points at the whole-device factory reset
    /// as a known alternative when a device-wide reset is itself confirmed
    /// (`ResetGlobal` `Supported`, not merely `Unverified`) AND PIV's own
    /// RESET isn't already the known-good path (`Reset` anything but
    /// `Supported`) — matching the spec's three cases (Unsupported -> show
    /// the link, Unverified -> show the link, Supported -> leave as-is) plus
    /// the `ResetGlobal` axis those three cases were silent on.
    #[test]
    fn piv_reset_global_alternative_available_matches_spec() {
        use keyroost_piv::compat::FeatureGate;

        // Reset::Supported -> leave as-is, regardless of ResetGlobal.
        for global in [
            FeatureGate::Supported,
            FeatureGate::Unverified,
            FeatureGate::Unsupported,
        ] {
            assert!(
                !piv_reset_global_alternative_available(FeatureGate::Supported, global),
                "Reset::Supported must never be redirected, ResetGlobal={global:?}"
            );
        }

        // Reset::Unsupported / Unverified, but ResetGlobal isn't a known
        // alternative either (Unverified or Unsupported) -> nothing to point at.
        for reset in [FeatureGate::Unsupported, FeatureGate::Unverified] {
            for global in [FeatureGate::Unverified, FeatureGate::Unsupported] {
                assert!(
                    !piv_reset_global_alternative_available(reset, global),
                    "reset={reset:?} global={global:?}"
                );
            }
        }

        // The two cases the link actually shows for.
        assert!(piv_reset_global_alternative_available(
            FeatureGate::Unsupported,
            FeatureGate::Supported
        ));
        assert!(piv_reset_global_alternative_available(
            FeatureGate::Unverified,
            FeatureGate::Supported
        ));
    }

    /// The Generate Key modal's "Policy other than `default` requires
    /// YubiKey or compatible token." caveat hides only when *both* the PIN
    /// and touch policy gates are confirmed `Supported` — any other
    /// combination (either axis `Unverified` or `Unsupported`) still needs
    /// it, since the per-row markers only warn about one axis at a time.
    #[test]
    fn piv_policy_caveat_hint_needed_only_hides_when_both_gates_are_supported() {
        use keyroost_piv::compat::FeatureGate;

        assert!(!piv_policy_caveat_hint_needed(
            FeatureGate::Supported,
            FeatureGate::Supported
        ));

        for pin in [
            FeatureGate::Supported,
            FeatureGate::Unverified,
            FeatureGate::Unsupported,
        ] {
            for touch in [
                FeatureGate::Supported,
                FeatureGate::Unverified,
                FeatureGate::Unsupported,
            ] {
                if pin == FeatureGate::Supported && touch == FeatureGate::Supported {
                    continue;
                }
                assert!(
                    piv_policy_caveat_hint_needed(pin, touch),
                    "pin={pin:?} touch={touch:?}"
                );
            }
        }
    }

    /// Refusing to arm (KEY-005: no serial to re-identify the key by after a
    /// replug) ends the run — the dialog closes and no reset is ever sent. The
    /// seeded FIDO row has to resolve too, or the report sits forever on
    /// "waiting for the unplug, replug, and touch", asking for a ceremony that
    /// is never coming, with the only explanation buried in a log panel that is
    /// collapsed by default.
    #[test]
    fn refusing_to_arm_resolves_the_pending_fido_row() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let mut app = App::default();
        app.security_keys.reset = ResetDialog {
            open: true,
            ..Default::default()
        };
        app.factory_reset_report = vec![
            FactoryResetRow::Step(StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            }),
            FactoryResetRow::FidoPending,
        ];

        // Nothing selected: no HID serial and no effective serial, which is the
        // refusal branch (the same state a key that exposes neither lands in).
        // Empty device list: no hardware is enumerated, so the outcome does not
        // depend on what is plugged into the machine running the test.
        app.arm_fido_reset_with(Vec::new());

        assert!(
            app.reset_arm.is_none(),
            "a key we can't re-identify must never arm"
        );
        assert!(!app.security_keys.reset.open, "the dialog is dismissed");
        let (text, tone) = factory_reset_row_line(&app.factory_reset_report[1]);
        assert_eq!(tone, RowTone::Bad, "{text}");
        assert!(
            !text.contains("not wiped yet"),
            "the row must not stay pending: {text}"
        );
        assert!(text.contains("not armed"), "{text}");
        assert!(
            text.contains("keyroostctl fido reset --yes"),
            "the row carries the way out: {text}"
        );
        // …and the same wording reaches a surface that isn't the collapsed log
        // panel for a standalone reset, which has no report row at all.
        assert!(
            app.security_keys
                .error
                .as_deref()
                .is_some_and(|e| e.contains("not armed")),
            "{:?}",
            app.security_keys.error
        );
        assert!(app.log.iter().any(|l| l.text.contains("not armed")));
        // The card sweep's own "factory reset finished" line was written
        // before this ceremony even started (see `apply_factory_reset_sweep`)
        // and never otherwise learns how FIDO ended — so the permanent record
        // needs its own line naming the FIDO outcome, not just the earlier
        // per-step summary.
        assert!(
            app.log
                .iter()
                .any(|l| l.text.contains("factory reset") && l.text.contains("FIDO2")),
            "the activity log must record the FIDO finale, not just the card \
             sweep's earlier summary: {:?}",
            app.log.iter().map(|l| &l.text).collect::<Vec<_>>()
        );
    }

    /// The FIDO finale is the one step that survives the job that started it:
    /// it waits for a replug, so its outcome can arrive long after dispatch.
    /// The report pane it writes into is app-global, re-pointed at whatever key
    /// is selected now — so an outcome that arrives for key A must never touch
    /// a report belonging to key B. Green "FIDO2 wiped" under B while B's
    /// passkeys and PIN are untouched is the worst line this pane can print.
    #[test]
    fn a_fido_reset_outcome_cannot_land_on_another_key() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let b: DeviceId = "serial:BBB".into();
        let seeded = |app: &mut App| {
            app.selected_device = Some(b.clone());
            app.security_keys.error = None;
            app.factory_reset_report = vec![
                FactoryResetRow::Step(StepReport {
                    step: ResetStep::Piv,
                    outcome: StepOutcome::Wiped,
                }),
                FactoryResetRow::FidoPending,
            ];
        };
        let mut app = App::default();

        // A's ceremony finishes with A wiped while B is on screen, mid-run.
        seeded(&mut app);
        App::apply_reset_path_outcome(&mut app, Some(&a), Ok(()));
        let (text, tone) = factory_reset_row_line(&app.factory_reset_report[1]);
        assert_eq!(
            tone,
            RowTone::Waiting,
            "B's FIDO row must stay pending: {text}"
        );
        assert!(text.contains("not wiped yet"), "{text}");

        // …and the failure direction is no better: B's pane must not show A's
        // error, which would send the user replugging the wrong key.
        seeded(&mut app);
        App::apply_reset_path_outcome(&mut app, Some(&a), Err("no touch".into()));
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[1]).1,
            RowTone::Waiting
        );
        assert!(
            app.security_keys.error.is_none(),
            "{:?}",
            app.security_keys.error
        );

        // An unbound completion (nothing captured, nothing selected) fails
        // closed too, rather than acting on whatever happens to be there.
        seeded(&mut app);
        App::apply_reset_path_outcome(&mut app, None, Ok(()));
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[1]).1,
            RowTone::Waiting
        );
        app.selected_device = None;
        App::apply_reset_path_outcome(&mut app, Some(&a), Ok(()));
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[1]).1,
            RowTone::Waiting
        );

        // The wipe still happened, so it can't pass in silence: no report on
        // screen can honestly show it, which leaves the log.
        assert!(
            app.log
                .iter()
                .filter(|l| l.text.contains("passkeys and PIN are wiped"))
                .count()
                >= 1,
            "a wipe that lands off-screen must still be recorded"
        );
        assert!(app.log.iter().any(|l| l.text.contains("still on it")));
    }

    /// The device guard must not cost the normal flow its outcome: the same key
    /// is selected throughout the replug (rescans are suppressed while a reset
    /// is armed), so the report has to record the wipe — and a retry after a
    /// failure still has to be able to correct the earlier row.
    #[test]
    fn a_same_device_fido_outcome_is_recorded_and_a_retry_supersedes_it() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some(a.clone()),
            factory_reset_report: vec![
                FactoryResetRow::Step(StepReport {
                    step: ResetStep::Oath,
                    outcome: StepOutcome::Wiped,
                }),
                FactoryResetRow::FidoPending,
            ],
            ..Default::default()
        };

        // First attempt: the key refused (outside its ~10 s window). The row
        // says so, and the FIDO2 pane carries the way out.
        App::apply_reset_path_outcome(&mut app, Some(&a), Err("CTAP2_ERR_NOT_ALLOWED".into()));
        let (text, tone) = factory_reset_row_line(&app.factory_reset_report[1]);
        assert_eq!(tone, RowTone::Bad, "{text}");
        assert!(text.contains("refused the reset"), "{text}");
        assert!(
            app.security_keys
                .error
                .as_deref()
                .is_some_and(|e| e.contains("refused the reset")),
            "{:?}",
            app.security_keys.error
        );
        // The Overview row isn't the only permanent record of this attempt —
        // the activity log needs its own line, or a session that ends here
        // (the user walks away instead of retrying) leaves only the card
        // sweep's earlier "factory reset finished — wiped: OATH" line, with no
        // mention that FIDO was ever attempted, let alone that it failed.
        assert!(
            app.log
                .iter()
                .any(|l| l.text.contains("factory reset") && l.text.contains("refused the reset")),
            "{:?}",
            app.log.iter().map(|l| &l.text).collect::<Vec<_>>()
        );

        // The retry lands: the row must be corrected, not appended to, or the
        // report claims passkeys survived on a key that is actually empty.
        App::apply_reset_path_outcome(&mut app, Some(&a), Ok(()));
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[1]),
            ("FIDO2  wiped".to_string(), RowTone::Done)
        );
        assert_eq!(app.factory_reset_report.len(), 2);
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[0]),
            ("OATH  wiped".to_string(), RowTone::Done),
            "the card sweep's rows are the finale's business to leave alone"
        );
        assert!(
            app.security_keys.error.is_none(),
            "the retry clears the error"
        );
        // The successful retry gets its own log line too, distinct from the
        // earlier failed attempt's.
        assert!(
            app.log
                .iter()
                .any(|l| l.text.contains("factory reset") && l.text.contains("FIDO2  wiped")),
            "{:?}",
            app.log.iter().map(|l| &l.text).collect::<Vec<_>>()
        );
        // Nothing was dropped on the floor, so nothing to warn about.
        assert!(!app
            .log
            .iter()
            .any(|l| l.text.contains("selection moved on")));
    }

    /// An armed ceremony belongs to the key it was armed for. Selecting another
    /// key drops the dialog, so the arm behind it would go on polling with no
    /// UI at all — and fire on the replug of a key the user has moved off.
    #[test]
    fn selecting_another_key_disarms_the_reset() {
        let mut app = App::default();
        app.selected_device = Some("serial:AAA".into());
        app.reset_arm = Some(ResetArm {
            target_serial: Some("AAA".into()),
            target_path: None,
            target_ids: None,
            target_effective_serial: Some("AAA".into()),
            for_device: app.selected_device.clone(),
            prev_devices: Vec::new(),
            saw_removal: true,
        });

        app.select_device("serial:BBB".into());

        assert!(
            app.reset_arm.is_none(),
            "an arm must not outlive the selection it was armed for"
        );
        // The user was told to unplug and replug; the ceremony ending has to be
        // visible somewhere, or the replug just does nothing forever.
        assert!(
            app.log
                .iter()
                .any(|l| l.text.contains("the armed reset was cancelled")),
            "the cancelled ceremony must be reported"
        );
    }

    /// A test arm for whichever key `for_device` names. The identity fields are
    /// irrelevant to the teardown rules these tests exercise; what matters is
    /// that a live ceremony exists.
    fn armed_for(for_device: &str) -> ResetArm {
        ResetArm {
            target_serial: Some("AAA".into()),
            target_path: None,
            target_ids: None,
            target_effective_serial: Some("AAA".into()),
            for_device: Some(for_device.into()),
            prev_devices: Vec::new(),
            saw_removal: true,
        }
    }

    /// The card sweep wipes four applets before its outcome comes back, so a
    /// selection that moved in between cannot undo any of it. The report is the
    /// only record — PIV's failure text is the one place "wiped" is told apart
    /// from "PIN and PUK blocked but not wiped" — so it cannot be dropped in
    /// silence. And the FIDO finale must NOT open: arming an irreversible wipe
    /// under whichever key is on screen now is what the guard exists to stop.
    #[test]
    fn an_orphaned_card_sweep_is_logged_and_arms_nothing() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some("serial:BBB".into()),
            ..Default::default()
        };
        let piv_failure = "PIN and PUK are blocked but the applet was not wiped";
        let reports = vec![
            StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            },
            StepReport {
                step: ResetStep::OpenPgp,
                outcome: StepOutcome::Wiped,
            },
            StepReport {
                step: ResetStep::Piv,
                outcome: StepOutcome::Failed(piv_failure.into()),
            },
        ];

        App::apply_factory_reset_sweep(&mut app, Some(&a), reports, true);

        // Nothing of A's run is painted under B…
        assert!(
            app.factory_reset_report.is_empty(),
            "A's report must not appear under B"
        );
        // …and above all, B is not armed for a wipe the user confirmed for A.
        assert!(
            !app.security_keys.reset.open,
            "the FIDO finale must never open under another key"
        );
        assert!(app.reset_arm.is_none());

        let warn = app
            .log
            .iter()
            .find(|l| l.text.contains("selection moved on"))
            .unwrap_or_else(|| panic!("a wipe that lands off-screen must still be recorded"));
        assert!(matches!(warn.severity, Severity::Warn));
        let text = &warn.text;
        assert!(text.contains("OATH"), "{text}");
        assert!(text.contains("OpenPGP"), "{text}");
        assert!(text.contains("PIV"), "{text}");
        assert!(
            text.contains(piv_failure),
            "PIV's exact failure is the only thing that says the card is locked \
             but not wiped: {text}"
        );
        assert!(
            text.contains("FIDO2") && text.contains("never started"),
            "the un-wiped finale has to be named: {text}"
        );

        // A plan without FIDO says nothing about a ceremony that was never in it.
        let mut app = App {
            selected_device: Some("serial:BBB".into()),
            ..Default::default()
        };
        App::apply_factory_reset_sweep(
            &mut app,
            Some(&a),
            vec![StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            }],
            false,
        );
        let text = &app
            .log
            .iter()
            .find(|l| l.text.contains("selection moved on"))
            .expect("still logged")
            .text;
        assert!(!text.contains("FIDO2"), "{text}");
    }

    /// The same sweep under the key it ran against still paints its report and
    /// still hands the finale to the armed dialog — the guard must not cost the
    /// normal flow its outcome.
    #[test]
    fn a_same_device_card_sweep_paints_its_report_and_opens_the_finale() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some(a.clone()),
            oath_tried: true,
            piv_tried: true,
            ..Default::default()
        };

        App::apply_factory_reset_sweep(
            &mut app,
            Some(&a),
            vec![
                StepReport {
                    step: ResetStep::Oath,
                    outcome: StepOutcome::Wiped,
                },
                StepReport {
                    step: ResetStep::Piv,
                    outcome: StepOutcome::Failed("card refused".into()),
                },
            ],
            true,
        );

        assert_eq!(app.factory_reset_report.len(), 3);
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[0]),
            ("OATH  wiped".to_string(), RowTone::Done)
        );
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[1]).1,
            RowTone::Bad
        );
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[2]).1,
            RowTone::Waiting,
            "the finale is seeded pending, not reported as done"
        );
        assert!(app.security_keys.reset.open, "the finale's dialog opens");
        // A wiped applet's pane re-lists itself; a failed one keeps its state.
        assert!(!app.oath_tried);
        assert!(app.piv_tried);
        assert!(!app
            .log
            .iter()
            .any(|l| l.text.contains("selection moved on")));
    }

    /// The success path used to report only through `factory_reset_report`
    /// (the Overview pane's list) and never through the activity log — which
    /// silently dropped any captured APDU trace too, since `App::push_log`
    /// (the sole consumer of `App::pending_trace`) was never called. Both
    /// gaps are covered here: a plain-language summary lands in the log
    /// (wiped/failed/skipped, independent of tracing), and a trace captured
    /// for the job actually attaches to that entry instead of being discarded.
    #[test]
    fn a_same_device_card_sweep_logs_a_summary_and_flushes_any_captured_trace() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some(a.clone()),
            pending_trace: Some(vec!["> SELECT".into(), "< 9000".into()]),
            ..Default::default()
        };

        App::apply_factory_reset_sweep(
            &mut app,
            Some(&a),
            vec![
                StepReport {
                    step: ResetStep::Oath,
                    outcome: StepOutcome::Wiped,
                },
                StepReport {
                    step: ResetStep::Piv,
                    outcome: StepOutcome::Skipped("PIV does not support RESET".into()),
                },
                StepReport {
                    step: ResetStep::Token2Otp,
                    outcome: StepOutcome::Failed("card refused".into()),
                },
            ],
            false,
        );

        let entry = app
            .log
            .iter()
            .find(|l| l.text.contains("factory reset finished"))
            .expect("factory reset must log a summary line");
        assert!(matches!(entry.severity, Severity::Warn)); // not everything wiped
        assert!(entry.text.contains("OATH"), "{}", entry.text);
        assert!(
            entry.text.contains("PIV does not support RESET"),
            "{}",
            entry.text
        );
        assert!(entry.text.contains("card refused"), "{}", entry.text);
        // The trace captured for this job attached to the summary line...
        assert_eq!(
            entry.trace.as_deref(),
            Some(&["> SELECT".to_string(), "< 9000".to_string()][..])
        );
        // ...and was consumed, not left to attach to some later, unrelated line.
        assert!(app.pending_trace.is_none());
    }

    /// All-`Wiped` reports log `Ok`, not `Warn` — the severity should read as
    /// success when nothing failed or was skipped.
    #[test]
    fn a_fully_wiped_sweep_logs_ok_severity() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some(a.clone()),
            ..Default::default()
        };
        App::apply_factory_reset_sweep(
            &mut app,
            Some(&a),
            vec![StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            }],
            false,
        );
        let entry = app
            .log
            .iter()
            .find(|l| l.text.contains("factory reset finished"))
            .expect("factory reset must log a summary line");
        assert!(matches!(entry.severity, Severity::Ok));
    }

    /// `WipedWithWarning` still re-initialises the applet's pane (it really
    /// was wiped) but logs `Warn`, not `Ok` (there's still something for the
    /// user to act on) -- the end-to-end path behind the exact scenario
    /// reported: a device-wide reset whose courtesy XAUTH-key restore failed
    /// showed up as "wiped: none; failed: PIV: ..." instead of naming PIV as
    /// wiped.
    #[test]
    fn a_wiped_with_warning_sweep_reinits_the_pane_but_logs_warn_severity() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let a: DeviceId = "serial:AAA".into();
        let mut app = App {
            selected_device: Some(a.clone()),
            piv_tried: true,
            ..Default::default()
        };
        App::apply_factory_reset_sweep(
            &mut app,
            Some(&a),
            vec![StepReport {
                step: ResetStep::Piv,
                outcome: StepOutcome::WipedWithWarning("restoring XAUTH key 1 failed".into()),
            }],
            false,
        );
        assert!(
            !app.piv_tried,
            "the pane must re-list; PIV really was wiped"
        );
        assert_eq!(
            factory_reset_row_line(&app.factory_reset_report[0]),
            (
                "PIV  wiped, but: restoring XAUTH key 1 failed".to_string(),
                RowTone::Warn
            )
        );
        let entry = app
            .log
            .iter()
            .find(|l| l.text.contains("factory reset finished"))
            .expect("factory reset must log a summary line");
        assert!(matches!(entry.severity, Severity::Warn));
        assert!(entry.text.contains("wiped: PIV"), "{}", entry.text);
        assert!(
            entry
                .text
                .contains("warnings: PIV: restoring XAUTH key 1 failed"),
            "{}",
            entry.text
        );
    }

    #[test]
    fn factory_reset_report_summary_names_every_bucket() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let summary = factory_reset_report_summary(&[
            StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            },
            StepReport {
                step: ResetStep::OpenPgp,
                outcome: StepOutcome::Failed("card refused".into()),
            },
            StepReport {
                step: ResetStep::Piv,
                outcome: StepOutcome::Skipped("not supported".into()),
            },
        ]);
        assert!(summary.contains("wiped: OATH"), "{summary}");
        assert!(
            summary.contains("failed: OpenPGP: card refused"),
            "{summary}"
        );
        assert!(summary.contains("skipped: PIV: not supported"), "{summary}");
    }

    /// A device-wide reset whose courtesy XAUTH-key restore fails is still a
    /// wipe: the step must show up in the "wiped" list (a reader scanning
    /// just that list must not conclude PIV was left untouched), and the
    /// restore failure must still get its own line so it isn't lost. Exact
    /// scenario reported: "wiped: none; failed: PIV: device wiped, but
    /// restoring XAUTH key 1..." -- PIV belongs in "wiped", not only in
    /// "failed".
    #[test]
    fn factory_reset_report_summary_counts_a_wiped_with_warning_step_as_wiped() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let summary = factory_reset_report_summary(&[StepReport {
            step: ResetStep::Piv,
            outcome: StepOutcome::WipedWithWarning("restoring XAUTH key 1 failed".into()),
        }]);
        assert!(summary.contains("wiped: PIV"), "{summary}");
        assert!(!summary.contains("wiped: none"), "{summary}");
        assert!(
            summary.contains("warnings: PIV: restoring XAUTH key 1 failed"),
            "{summary}"
        );
        assert!(!summary.contains("failed:"), "{summary}");
    }

    /// A PIV step wiped via the device-wide `ResetGlobal` mechanism took at
    /// least one other applet down with it, so naming only "PIV" undersells
    /// what happened — both the Overview row and the activity-log summary
    /// must name the whole device instead.
    #[test]
    fn factory_reset_global_piv_wipe_names_the_whole_device() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let report = StepReport {
            step: ResetStep::Piv,
            outcome: StepOutcome::WipedGlobal,
        };

        let (text, tone) = factory_reset_row_line(&FactoryResetRow::Step(report.clone()));
        assert_eq!(tone, RowTone::Done, "{text}");
        assert_eq!(text, "Whole device (via PIV)  wiped");
        assert!(!text.starts_with("PIV"), "{text}");

        let summary = factory_reset_report_summary(&[
            report,
            StepReport {
                step: ResetStep::Oath,
                outcome: StepOutcome::Wiped,
            },
        ]);
        assert!(
            summary.contains("wiped: Whole device (via PIV), OATH"),
            "{summary}"
        );
        assert!(!summary.contains("wiped: PIV"), "{summary}");
    }

    #[test]
    fn factory_reset_report_summary_names_none_wiped_when_nothing_wiped() {
        use keyroost_resolve::{ResetStep, StepOutcome, StepReport};
        let summary = factory_reset_report_summary(&[StepReport {
            step: ResetStep::Oath,
            outcome: StepOutcome::Failed("card refused".into()),
        }]);
        assert!(summary.contains("wiped: none"), "{summary}");
        assert!(!summary.contains("skipped"), "{summary}");
    }

    /// Refusing to arm (KEY-005) ends the ceremony, exactly as Cancel does. An
    /// earlier arm can still be live when this branch is reached — the dialog
    /// reverts to its confirm form whenever the arm's key is no longer the
    /// selection, so "Arm reset" is pressable a second time — and telling the
    /// user "not armed" while that arm keeps polling wipes the key on its next
    /// replug after the UI said nothing would happen.
    #[test]
    fn refusing_to_arm_clears_a_live_arm() {
        let mut app = App {
            security_keys: SecurityKeysState {
                reset: ResetDialog {
                    open: true,
                    ..Default::default()
                },
                ..Default::default()
            },
            reset_arm: Some(armed_for("serial:AAA")),
            ..Default::default()
        };

        // Nothing selected: no HID serial and no effective serial — the refusal
        // branch, reached without touching a key.
        // Empty device list: no hardware is enumerated, so the outcome does not
        // depend on what is plugged into the machine running the test.
        app.arm_fido_reset_with(Vec::new());

        assert!(
            app.reset_arm.is_none(),
            "a refusal that says \"not armed\" must not leave a ceremony polling"
        );
        assert!(!app.security_keys.reset.open);
    }

    /// A scan can fail outright (pcscd down, a wedged reader), which empties the
    /// list and the selection. That is a selection change like any other and has
    /// to run the same teardown: otherwise the arm stays live with nothing
    /// selected, the dialog repaints its un-armed confirm form while the poll
    /// keeps watching for the replug, and every rescan path is suppressed while
    /// an arm exists — so the empty list can never recover.
    #[test]
    fn a_failed_scan_disarms_the_reset() {
        let mut app = App {
            selected_device: Some("serial:AAA".into()),
            reset_arm: Some(armed_for("serial:AAA")),
            security_keys: SecurityKeysState {
                reset: ResetDialog {
                    open: true,
                    ..Default::default()
                },
                ..Default::default()
            },
            ..Default::default()
        };

        App::apply_device_scan_failure(&mut app, "pcsc: no service".into());

        assert_eq!(app.devices_error.as_deref(), Some("pcsc: no service"));
        assert!(app.devices.is_empty());
        assert!(app.selected_device.is_none());
        assert!(
            app.reset_arm.is_none(),
            "an armed ceremony must not outlive the selection it was armed for"
        );
        assert!(
            !app.security_keys.reset.open,
            "the dialog behind the ceremony goes with it"
        );
        assert!(
            app.log
                .iter()
                .any(|l| l.text.contains("the armed reset was cancelled")),
            "the user was told to replug; the ceremony ending has to be visible"
        );

        // Already empty: nothing to tear down, and the failure still lands.
        let mut app = App::default();
        App::apply_device_scan_failure(&mut app, "pcsc: no service".into());
        assert_eq!(app.devices_error.as_deref(), Some("pcsc: no service"));
        assert!(app.log.is_empty(), "no ceremony existed to report ending");
    }

    /// Defence in depth for the rule above: the poll refuses to fire for a key
    /// that isn't the selection, whatever any other path forgot to clean up.
    /// It returns before enumerating, so it never reaches a device.
    #[test]
    fn the_poll_refuses_to_fire_for_a_key_that_is_no_longer_selected() {
        let mut app = App {
            selected_device: Some("serial:BBB".into()),
            reset_arm: Some(armed_for("serial:AAA")),
            ..Default::default()
        };

        app.poll_reset_arm();

        assert!(
            app.reset_arm.is_none(),
            "an arm bound to another key must not survive a poll"
        );
        assert!(app
            .log
            .iter()
            .any(|l| l.text.contains("no longer the one selected")));
    }

    /// #81: the Settings tab (home of the only Reset path) must exist for any
    /// CTAP2 key — authenticatorReset is a baseline CTAP 2.0 command, so
    /// gating the tab on authenticatorConfig (a CTAP 2.1 feature) locked
    /// CTAP 2.0-only keys out of reset entirely.
    #[test]
    fn settings_tab_exists_for_any_ctap2_key() {
        let ctap20_only = AuthenticatorInfo {
            versions: vec!["U2F_V2".into(), "FIDO_2_0".into()],
            ..Default::default()
        };
        assert!(
            fido_settings_available(Some(&ctap20_only)),
            "a CTAP 2.0-only key is resettable and must get the Settings tab"
        );

        let ctap21 = AuthenticatorInfo {
            versions: vec!["FIDO_2_1".into()],
            options: vec![("authnrCfg".into(), true)],
            ..Default::default()
        };
        assert!(fido_settings_available(Some(&ctap21)));

        // FIDO_2_1_PRE keys predate the final 2.1 naming but are CTAP2.
        let pre = AuthenticatorInfo {
            versions: vec!["FIDO_2_1_PRE".into()],
            ..Default::default()
        };
        assert!(fido_settings_available(Some(&pre)));
    }

    #[test]
    fn settings_tab_absent_without_a_ctap2_key() {
        // No getInfo yet (or a CTAP1-only key, which can't answer getInfo):
        // nothing to reset over CTAP2 — no tab.
        assert!(!fido_settings_available(None));

        // A hypothetical U2F-only answer offers no CTAP2 reset either.
        let u2f_only = AuthenticatorInfo {
            versions: vec!["U2F_V2".into()],
            ..Default::default()
        };
        assert!(!fido_settings_available(Some(&u2f_only)));
    }

    /// The "Save certificate…" action shows only for resident credentials that
    /// are SSH relying parties (`ssh:*`) AND carry a largeBlob key — the key is
    /// mandatory to decrypt the per-credential cert entry, so without it there
    /// is nothing the action could extract.
    #[test]
    fn ssh_cred_offers_cert_gates_on_ssh_rp_and_key() {
        let key = [7u8; 32];
        // ssh:* with a key → offered.
        assert!(ssh_cred_offers_cert("ssh:demo", Some(&key)));
        assert!(ssh_cred_offers_cert("ssh:", Some(&key)));
        // ssh:* without a key → not offered (nothing to decrypt with).
        assert!(!ssh_cred_offers_cert("ssh:demo", None));
        // non-ssh RP → never offered, key or not.
        assert!(!ssh_cred_offers_cert("example.com", Some(&key)));
        assert!(!ssh_cred_offers_cert("example.com", None));
        // A prefix look-alike that isn't the ssh: scheme is not offered.
        assert!(!ssh_cred_offers_cert("sshy:demo", Some(&key)));
    }

    /// Reset is the recovery for a forgotten/blocked PIN and needs no PIN
    /// itself, so it must stay reachable when the key can't be unlocked —
    /// rendered standalone outside the (unlock-gated) Settings tab.
    #[test]
    fn reset_card_stands_alone_exactly_when_ctap2_but_locked() {
        let ctap2 = AuthenticatorInfo {
            versions: vec!["FIDO_2_0".into()],
            ..Default::default()
        };
        // Locked: forgotten/blocked PIN, no PIN set, or no clientPin at all.
        assert!(show_standalone_reset(false, Some(&ctap2)));
        // Unlocked: the Settings tab owns the card; no duplicate.
        assert!(!show_standalone_reset(true, Some(&ctap2)));
        // No CTAP2 getInfo: nothing reset could talk to.
        assert!(!show_standalone_reset(false, None));
    }

    /// A persisted subview pick must snap to a tab the selected key actually
    /// offers (capabilities differ across keys; the pick outlives selection).
    #[test]
    fn subview_snaps_to_an_offered_tab() {
        let tabs = [
            (FidoSubview::Settings, "Settings"),
            (FidoSubview::LargeBlobs, "Storage"),
        ];
        // Present pick is kept.
        assert_eq!(
            snap_subview(FidoSubview::Settings, &tabs),
            FidoSubview::Settings
        );
        // Stale pick (tab not offered on this key) snaps to the first tab.
        assert_eq!(
            snap_subview(FidoSubview::Fingerprints, &tabs),
            FidoSubview::Settings
        );
        assert_eq!(
            snap_subview(FidoSubview::Passkeys, &tabs),
            FidoSubview::Settings
        );
        // Degenerate empty list falls back to the default.
        assert_eq!(
            snap_subview(FidoSubview::Settings, &[]),
            FidoSubview::Passkeys
        );
    }

    /// `snap_cap_tab`'s own version of the rule directly above, one level up.
    #[test]
    fn cap_tab_snaps_to_an_offered_tab() {
        let tabs = [CapTab::Overview, CapTab::Fido2, CapTab::Oath];
        // Present pick is kept.
        assert_eq!(snap_cap_tab(CapTab::Fido2, &tabs), CapTab::Fido2);
        // Stale pick (tab not offered on this device) snaps to the first tab.
        assert_eq!(snap_cap_tab(CapTab::Piv, &tabs), CapTab::Overview);
        // Degenerate empty list (a Molto2 token, which has no capability
        // tabs at all) falls back to the default.
        assert_eq!(snap_cap_tab(CapTab::Fido2, &[]), CapTab::Overview);
    }

    /// Switching devices remembers each device's own last-shown `cap_tab`,
    /// rather than resetting every device to Overview — the bug this pair
    /// (`App::cap_tab_by_device` + `on_device_selected`) exists to fix.
    #[test]
    fn device_switch_restores_each_devices_own_cap_tab() {
        let mut app = App {
            selected_device: Some("serial:AAA".into()),
            cap_tab: CapTab::Piv,
            ..Default::default()
        };
        // Switch to a second device never seen before: starts fresh.
        let previous = app.selected_device.replace("serial:BBB".into());
        app.on_device_selected(previous);
        assert_eq!(app.cap_tab, CapTab::Overview);
        app.cap_tab = CapTab::Fido2;
        // Switch back to the first device: its own pick (Piv) comes back —
        // not Overview, and not the second device's Fido2 pick.
        let previous = app.selected_device.replace("serial:AAA".into());
        app.on_device_selected(previous);
        assert_eq!(app.cap_tab, CapTab::Piv);
    }

    /// getInfo with no `clientPin` option means the key has no PIN feature —
    /// distinct from "info not read yet", which the pane used to conflate
    /// with it (permanent "Reading key…" on PIN-less authenticators).
    #[test]
    fn pin_support_distinguishes_absent_option_from_missing_info() {
        assert_eq!(pin_support(None), PinSupport::Unknown);
        let no_pin_feature = AuthenticatorInfo {
            versions: vec!["FIDO_2_0".into()],
            ..Default::default()
        };
        assert_eq!(pin_support(Some(&no_pin_feature)), PinSupport::Unsupported);
        let pin_not_set = AuthenticatorInfo {
            options: vec![("clientPin".into(), false)],
            ..Default::default()
        };
        assert_eq!(pin_support(Some(&pin_not_set)), PinSupport::NotSet);
        let pin_set = AuthenticatorInfo {
            options: vec![("clientPin".into(), true)],
            ..Default::default()
        };
        assert_eq!(pin_support(Some(&pin_set)), PinSupport::Set);
    }

    #[test]
    fn duplicate_serial_note_flags_shared_serial() {
        let note = duplicate_serial_note(["ABC", "ABC", "DEF"].into_iter())
            .expect("a shared serial must produce an advisory");
        assert!(note.contains("ABC"), "advisory names the duplicated serial");
        assert!(note.contains('2'), "advisory states how many keys share it");
    }

    #[test]
    fn duplicate_serial_note_silent_when_all_distinct() {
        assert_eq!(duplicate_serial_note(["ABC", "DEF"].into_iter()), None);
        assert_eq!(duplicate_serial_note(std::iter::empty::<&str>()), None);
    }

    #[test]
    fn duplicate_serial_id_suffix_keeps_ids_distinct() {
        // Invariant Section E's correlate() must uphold and this GUI relies on:
        // same-serial keys get distinct, `#`-suffixed ids, so selection (which
        // keys off the full id in selected_device()) resolves each independently.
        let a = "serial:ABC#0";
        let b = "serial:ABC#1";
        assert_ne!(a, b);
    }

    /// egui retains a plaintext snapshot of every typed secret in the text
    /// widget's undo history for the process lifetime; `.password(true)` only
    /// masks display. `clear_edit_undo` must purge that history so a wiped
    /// buffer leaves nothing recoverable from egui memory.
    #[test]
    fn clear_edit_undo_purges_retained_plaintext() {
        let ctx = egui::Context::default();
        let id = egui::Id::new("pin-field-test");
        let empty = (egui::text::CCursorRange::default(), String::new());

        // Simulate egui recording undo history as the user types a PIN. An undo
        // point is committed only once a state has been stable for `stable_time`
        // (1s default), so feed the same secret across a ≥1s gap.
        let secret = (
            egui::text::CCursorRange::default(),
            "1234-secret-pin".to_string(),
        );
        let mut state = egui::TextEdit::load_state(&ctx, id).unwrap_or_default();
        let mut undoer = state.undoer();
        undoer.feed_state(0.0, &empty);
        undoer.feed_state(1.0, &secret);
        undoer.feed_state(2.0, &secret);
        state.set_undoer(undoer);
        egui::TextEdit::store_state(&ctx, id, state);

        // Precondition: history retains a snapshot differing from an empty field.
        let before = egui::TextEdit::load_state(&ctx, id).unwrap();
        assert!(
            before.undoer().has_undo(&empty),
            "test setup should have recorded undo history"
        );

        clear_edit_undo(&ctx, id);

        let after = egui::TextEdit::load_state(&ctx, id).unwrap();
        assert!(
            !after.undoer().has_undo(&empty),
            "undo history (and its plaintext) must be gone after clear_edit_undo"
        );
    }

    /// The scrub-needed check behind `guard_secret_field`: empty history is
    /// skipped, committed undo points / redo stacks / in-flux text are not.
    #[test]
    fn edit_state_scrub_check_detects_retained_plaintext() {
        let empty = (egui::text::CCursorRange::default(), String::new());
        let secret = (egui::text::CCursorRange::default(), "1234-pin".to_string());

        // A fresh state has nothing to scrub.
        let mut state = egui::text_edit::TextEditState::default();
        assert!(!edit_state_needs_scrub(&state));

        // Committed undo history must be detected… (an undo point commits
        // once a state has been stable ≥1s — same technique as
        // clear_edit_undo_purges_retained_plaintext above)
        let mut undoer = state.undoer();
        undoer.feed_state(0.0, &empty);
        undoer.feed_state(1.0, &secret);
        undoer.feed_state(2.0, &secret);
        state.set_undoer(undoer);
        assert!(edit_state_needs_scrub(&state));

        // …and clearing satisfies the check again.
        state.clear_undoer();
        assert!(!edit_state_needs_scrub(&state));

        // Text typed too recently to be a committed undo point still counts:
        // the plaintext lives in the undoer's flux buffer.
        let mut undoer = state.undoer();
        undoer.feed_state(3.0, &empty);
        undoer.feed_state(3.1, &secret);
        state.set_undoer(undoer);
        assert!(edit_state_needs_scrub(&state));
    }

    /// A job that panics inside the worker must not wedge the UI: the worker
    /// catches it, delivers an error apply (so busy clears), and stays alive to
    /// run later jobs. Before the fix the thread unwound, the result channel
    /// disconnected, and busy_jobs stuck at 1 forever.
    #[test]
    fn panicking_job_clears_busy_and_worker_survives() {
        let mut app = App {
            worker: Some(Worker::spawn(egui::Context::default(), Default::default())),
            ..Default::default()
        };
        // Silence the panic backtrace this test intentionally triggers.
        let prev = std::panic::take_hook();
        std::panic::set_hook(Box::new(|_| {}));

        app.spawn_job("boom", || -> ApplyFn {
            panic!("simulated device-op panic")
        });
        assert!(app.busy(), "busy set right after dispatch");

        // The worker still delivers an apply despite the panic.
        let apply = app
            .worker
            .as_ref()
            .unwrap()
            .result_rx
            .recv_timeout(std::time::Duration::from_secs(5))
            .expect("worker delivered an apply despite the panicking job");
        std::panic::set_hook(prev);
        app.busy_jobs -= 1;
        apply(&mut app);
        assert!(!app.busy(), "busy must clear after a panicking job");

        // The worker survived: a subsequent job still runs to completion.
        assert!(
            app.spawn_job("after", || Box::new(|app: &mut App| app.slot = 7)),
            "worker should accept jobs after a panic"
        );
        let apply = app
            .worker
            .as_ref()
            .unwrap()
            .result_rx
            .recv_timeout(std::time::Duration::from_secs(5))
            .expect("second job ran on the surviving worker");
        app.busy_jobs -= 1;
        apply(&mut app);
        assert_eq!(app.slot, 7);
    }

    /// A job dispatched to a real worker thread runs off-thread, and its result
    /// applies back to the App with the busy bookkeeping cleared.
    #[test]
    fn worker_round_trip_applies_result_and_clears_busy() {
        let mut app = App {
            worker: Some(Worker::spawn(egui::Context::default(), Default::default())),
            ..Default::default()
        };
        app.spawn_job("test", || Box::new(|app: &mut App| app.slot = 42));
        assert!(app.busy(), "busy should be set right after dispatch");

        // Wait for the worker to produce a result, then drain it.
        let worker = app.worker.as_ref().unwrap();
        let apply = worker
            .result_rx
            .recv_timeout(std::time::Duration::from_secs(5))
            .expect("worker produced a result");
        // Mimic drain_worker: decrement before applying.
        app.busy_jobs -= 1;
        apply(&mut app);

        assert_eq!(app.slot, 42);
        assert!(!app.busy(), "busy should clear once the result is applied");
    }

    /// While a job is in flight, a second dispatch is dropped (device access is
    /// serialized; rapid clicks don't queue overlapping card I/O).
    #[test]
    fn spawn_job_ignored_while_busy() {
        let mut app = App {
            worker: Some(Worker::spawn(egui::Context::default(), Default::default())),
            ..Default::default()
        };
        // Occupy the worker with a job whose result we don't drain.
        app.spawn_job("first", || Box::new(|_: &mut App| {}));
        assert_eq!(app.busy_jobs, 1);
        app.spawn_job("second", || Box::new(|app: &mut App| app.slot = 99));
        assert_eq!(
            app.busy_jobs, 1,
            "second dispatch must be ignored while busy"
        );
    }

    /// With no worker (the default), a job runs inline so headless tests and any
    /// non-GUI use still apply results.
    #[test]
    fn inline_when_no_worker() {
        let mut app = App::default();
        assert!(app.worker.is_none());
        app.spawn_job("inline", || Box::new(|app: &mut App| app.slot = 7));
        assert_eq!(app.slot, 7);
        assert!(!app.busy());
    }

    /// The PIV credential modal's new==confirm guard: matching (or still-empty)
    /// confirm fields pass; a divergent confirm reports the right message.
    #[test]
    fn piv_cred_mismatch_change_pin() {
        let mut piv = PivState::default();
        // Empty confirm is treated as "not yet a mismatch".
        piv.pin_new = "1234".into();
        assert_eq!(piv_cred_mismatch(&piv, PivCredKind::ChangePin), None);
        // Matching new/confirm: no error.
        piv.pin_confirm = "1234".into();
        assert_eq!(piv_cred_mismatch(&piv, PivCredKind::ChangePin), None);
        // Divergent confirm: the PIN-specific message.
        piv.pin_confirm = "9999".into();
        assert_eq!(
            piv_cred_mismatch(&piv, PivCredKind::ChangePin),
            Some("the two new PINs don't match")
        );
    }

    #[test]
    fn piv_cred_mismatch_change_puk() {
        let mut piv = PivState::default();
        piv.puk_new = "12345678".into();
        piv.puk_confirm = "00000000".into();
        assert_eq!(
            piv_cred_mismatch(&piv, PivCredKind::ChangePuk),
            Some("the two new PUKs don't match")
        );
        piv.puk_confirm = "12345678".into();
        assert_eq!(piv_cred_mismatch(&piv, PivCredKind::ChangePuk), None);
    }

    /// Unblock has no confirm field, so the guard never reports a mismatch even
    /// with arbitrary field contents.
    #[test]
    fn piv_cred_mismatch_unblock_never_fires() {
        let mut piv = PivState::default();
        piv.unblock_puk = "12345678".into();
        piv.unblock_new_pin = "1234".into();
        assert_eq!(piv_cred_mismatch(&piv, PivCredKind::UnblockPin), None);
    }

    /// The Pin Policy / Touch Policy dropdowns' initial selection, both on a
    /// fresh `PivState` and after the modal-close reset: `default` / `default`
    /// — the plain PIV APDU every card accepts.
    #[test]
    fn piv_gen_policy_dropdowns_default_to_default() {
        let fresh = PivState::default();
        assert_eq!(fresh.gen_pin_policy, keyroost_piv::PinPolicy::Default);
        assert_eq!(fresh.gen_touch_policy, keyroost_piv::TouchPolicy::Default);

        let mut app = App::default();
        app.piv.gen_pin_policy = keyroost_piv::PinPolicy::Never;
        app.piv.gen_touch_policy = keyroost_piv::TouchPolicy::Always;
        app.piv_cred_modal_close();
        assert_eq!(app.piv.gen_pin_policy, keyroost_piv::PinPolicy::Default);
        assert_eq!(app.piv.gen_touch_policy, keyroost_piv::TouchPolicy::Default);
    }

    /// `PivMgmtAlgSel::Delete` maps to no algorithm at all — the "delete the
    /// management key outright" choice HID Crescendo's own combo offers,
    /// distinct from every real `MgmtAlg`. `to_choice()`, unlike `to_alg()`,
    /// is total: `MgmtAlgChoice` has its own `Delete`-equivalent variant, so
    /// every `PivMgmtAlgSel` (including `Delete` itself) round-trips.
    #[test]
    fn piv_mgmt_alg_sel_delete_has_no_algorithm() {
        use keyroost_piv::compat::MgmtAlgChoice;
        assert_eq!(PivMgmtAlgSel::Delete.to_alg(), None);
        assert_eq!(PivMgmtAlgSel::Delete.label(), "Delete");
        assert_eq!(PivMgmtAlgSel::Delete.to_choice(), MgmtAlgChoice::Delete);
        for alg in [
            PivMgmtAlgSel::Aes192,
            PivMgmtAlgSel::Aes128,
            PivMgmtAlgSel::Aes256,
            PivMgmtAlgSel::TripleDes,
        ] {
            assert!(alg.to_alg().is_some());
            assert_ne!(alg.to_choice(), MgmtAlgChoice::Delete);
        }
    }

    /// The management-key combo offers every algorithm plus `Delete` last, on
    /// every device — `Delete` isn't trimmed off the list for a standard
    /// device the way it used to be; it's still offered there, just gated
    /// disabled live (via `PivExtension::ManagementKeyAlgorithm`) since a
    /// standard device's management key can't be removed outright.
    #[test]
    fn piv_mgmtalg_all_lists_delete_last() {
        assert_eq!(
            PivMgmtAlgSel::ALL,
            [
                PivMgmtAlgSel::TripleDes,
                PivMgmtAlgSel::Aes128,
                PivMgmtAlgSel::Aes192,
                PivMgmtAlgSel::Aes256,
                PivMgmtAlgSel::Delete,
            ]
        );
        assert_eq!(PivMgmtAlgSel::ALL.last(), Some(&PivMgmtAlgSel::Delete));
    }

    /// The Generate key card's initial selection (`App::piv`'s `new_mgmt_alg`
    /// field seeds from [`PivMgmtAlgSel::default`]) stays `Aes192` — a
    /// widely-supported starting point — independent of [`PivMgmtAlgSel::ALL`]'s
    /// own order. The two used to coincide (`Aes192` was `ALL[0]` too, before
    /// `ALL` was alphabetized to `TripleDes` first); this pins the `#[default]`
    /// attribute itself so a future reshuffle of `ALL` can't silently drag the
    /// default combo selection along with it.
    #[test]
    fn piv_mgmtalg_default_stays_aes192_despite_the_alphabetized_all_order() {
        assert_eq!(PivMgmtAlgSel::default(), PivMgmtAlgSel::Aes192);
        assert_ne!(PivMgmtAlgSel::ALL[0], PivMgmtAlgSel::default());
    }

    /// `piv_mgmtalg_clamp` snaps a selection the given options don't offer
    /// back to the first option, and leaves an already-valid selection
    /// alone.
    #[test]
    fn piv_mgmtalg_clamp_snaps_an_unoffered_selection_to_the_first_option() {
        // Already valid: left alone.
        let mut sel = PivMgmtAlgSel::Delete;
        piv_mgmtalg_clamp(&mut sel, &PivMgmtAlgSel::ALL);
        assert_eq!(sel, PivMgmtAlgSel::Delete);

        // A narrower list that excludes `Delete` (e.g. a hypothetical future
        // device the combo restricts further) clamps it away to that list's
        // first entry.
        let without_delete = [
            PivMgmtAlgSel::TripleDes,
            PivMgmtAlgSel::Aes128,
            PivMgmtAlgSel::Aes192,
            PivMgmtAlgSel::Aes256,
        ];
        let mut sel = PivMgmtAlgSel::Delete;
        piv_mgmtalg_clamp(&mut sel, &without_delete);
        assert_eq!(sel, PivMgmtAlgSel::TripleDes);
    }

    /// `piv_mgmtalg_unsupported_fallback` snaps a selection gating
    /// `Unsupported` to the first *selectable* offered option — not
    /// `options[0]` unconditionally, since `options[0]` (`TripleDes` on the
    /// alphabetized `ALL`) can itself be the disabled entry. A regression
    /// test for exactly that bug: the combo used to preselect `options[0]`
    /// even when it was disabled, because the old fallback snapped straight
    /// back to it without checking whether *it* was selectable too.
    #[test]
    fn piv_mgmtalg_unsupported_fallback_skips_a_disabled_first_option() {
        use keyroost_piv::compat::FeatureGate;

        // TripleDes (`options[0]`) is disabled; Aes128 is the next option in
        // `ALL`'s order (`[TripleDes, Aes128, Aes192, Aes256]`) and is
        // selectable, so it's the fallback.
        let gate = |alg: PivMgmtAlgSel| match alg {
            PivMgmtAlgSel::TripleDes => FeatureGate::Unsupported,
            _ => FeatureGate::Supported,
        };
        assert_eq!(
            piv_mgmtalg_unsupported_fallback(PivMgmtAlgSel::TripleDes, &PivMgmtAlgSel::ALL, gate),
            PivMgmtAlgSel::Aes128
        );

        // A selection that isn't `Unsupported` is left alone, even if a
        // *different* option would also be selectable.
        assert_eq!(
            piv_mgmtalg_unsupported_fallback(PivMgmtAlgSel::Aes128, &PivMgmtAlgSel::ALL, gate),
            PivMgmtAlgSel::Aes128
        );

        // Every option disabled: nothing better to select, so it falls back
        // to `options[0]` rather than panicking or leaving `sel` disabled
        // forever with no path back to a selectable state.
        let all_unsupported = |_: PivMgmtAlgSel| FeatureGate::Unsupported;
        assert_eq!(
            piv_mgmtalg_unsupported_fallback(
                PivMgmtAlgSel::TripleDes,
                &PivMgmtAlgSel::ALL,
                all_unsupported
            ),
            PivMgmtAlgSel::TripleDes
        );

        // Empty options: no-op regardless of gate.
        assert_eq!(
            piv_mgmtalg_unsupported_fallback(PivMgmtAlgSel::TripleDes, &[], gate),
            PivMgmtAlgSel::TripleDes
        );
    }

    /// `piv_mgmtalg_unverified_labels` suppresses the per-algorithm
    /// "unverified" warning entirely once `SetManagementKey` itself gates
    /// `Unsupported` — there's nothing to warn about picking an algorithm for
    /// a change that can't be made at all, and the disabled button/combo
    /// already carry their own blocked-hint tooltip.
    #[test]
    fn piv_mgmtalg_unverified_labels_are_suppressed_when_the_extension_is_unsupported() {
        use keyroost_piv::compat::FeatureGate;

        let all_unverified = |_: PivMgmtAlgSel| FeatureGate::Unverified;
        // Extension unsupported: empty, regardless of what the per-algorithm
        // gates would otherwise report.
        assert!(piv_mgmtalg_unverified_labels(
            FeatureGate::Unsupported,
            &PivMgmtAlgSel::ALL,
            all_unverified
        )
        .is_empty());

        // Extension merely unverified, or fully supported: the per-algorithm
        // list still comes through normally.
        assert_eq!(
            piv_mgmtalg_unverified_labels(
                FeatureGate::Unverified,
                &PivMgmtAlgSel::ALL,
                all_unverified
            )
            .len(),
            PivMgmtAlgSel::ALL.len()
        );
        assert_eq!(
            piv_mgmtalg_unverified_labels(
                FeatureGate::Supported,
                &PivMgmtAlgSel::ALL,
                all_unverified
            )
            .len(),
            PivMgmtAlgSel::ALL.len()
        );

        // Extension supported, but no option is individually unverified:
        // empty for an unrelated reason (nothing to report), not the
        // suppression rule.
        assert!(
            piv_mgmtalg_unverified_labels(FeatureGate::Supported, &PivMgmtAlgSel::ALL, |_| {
                FeatureGate::Supported
            })
            .is_empty()
        );
    }

    /// `piv_keyalg_unsupported_fallback` — the slot key-algorithm counterpart
    /// of `piv_mgmtalg_unsupported_fallback` — snaps a selection gating
    /// `Unsupported` to the first selectable algorithm in `KeyAlg::ALL`
    /// rather than unconditionally returning `fallback`: the caller's usual
    /// "widely-supported default" (`EccP256` at the one call site in
    /// `cap_piv`) is just another candidate and could itself be the disabled
    /// entry on some fingerprint.
    #[test]
    fn piv_keyalg_unsupported_fallback_skips_a_disabled_fallback_algorithm() {
        use keyroost_piv::compat::FeatureGate;
        use keyroost_piv::KeyAlg;

        // `EccP256` (the usual `fallback` argument) is itself disabled here;
        // `Rsa1024` is the first selectable algorithm in `ALL`'s order.
        let gate = |alg: KeyAlg| match alg {
            KeyAlg::EccP256 => FeatureGate::Unsupported,
            _ => FeatureGate::Supported,
        };
        assert_eq!(
            piv_keyalg_unsupported_fallback(KeyAlg::EccP256, KeyAlg::EccP256, gate),
            KeyAlg::Rsa1024
        );

        // A selection that isn't `Unsupported` is left alone.
        assert_eq!(
            piv_keyalg_unsupported_fallback(KeyAlg::Rsa2048, KeyAlg::EccP256, gate),
            KeyAlg::Rsa2048
        );

        // Every algorithm disabled: falls back to `fallback` outright —
        // nothing better to select.
        assert_eq!(
            piv_keyalg_unsupported_fallback(KeyAlg::EccP256, KeyAlg::EccP256, |_| {
                FeatureGate::Unsupported
            }),
            KeyAlg::EccP256
        );
    }

    /// `PivMgmtAlgSel::to_choice()` feeds `PivExtension::ManagementKeyAlgorithm`
    /// correctly end to end: a HID Crescendo device gates 3DES/AES-128/Delete
    /// `Supported` and AES-192/AES-256 `Unsupported`, while a YubiKey gates
    /// every real algorithm `Supported` and `Delete` `Unsupported` — the same
    /// verdicts `keyroost_piv::compat`'s own tests confirm directly against
    /// `MgmtAlgChoice`, exercised here through the GUI-side selector instead.
    #[test]
    fn piv_mgmtalg_sel_to_choice_resolves_the_expected_gate_per_fingerprint() {
        use keyroost_piv::compat::{FeatureGate, PivExtension};
        use keyroost_piv::fingerprint::{AppletFingerprint, HidCrescendoVariant};

        let gate = |fp: AppletFingerprint, sel: PivMgmtAlgSel| {
            keyroost_piv::compat::resolve(
                PivExtension::ManagementKeyAlgorithm(sel.to_choice()),
                fp,
                None,
                None,
            )
        };
        let hid = AppletFingerprint::HidCrescendo(HidCrescendoVariant::C2300);
        for sel in [
            PivMgmtAlgSel::TripleDes,
            PivMgmtAlgSel::Aes128,
            PivMgmtAlgSel::Delete,
        ] {
            assert_eq!(gate(hid, sel), FeatureGate::Supported, "{sel:?}");
        }
        for sel in [PivMgmtAlgSel::Aes192, PivMgmtAlgSel::Aes256] {
            assert_eq!(gate(hid, sel), FeatureGate::Unsupported, "{sel:?}");
        }
        for sel in [
            PivMgmtAlgSel::Aes192,
            PivMgmtAlgSel::Aes128,
            PivMgmtAlgSel::Aes256,
            PivMgmtAlgSel::TripleDes,
        ] {
            assert_eq!(
                gate(AppletFingerprint::YubiKey, sel),
                FeatureGate::Supported,
                "{sel:?}"
            );
        }
        assert_eq!(
            gate(AppletFingerprint::YubiKey, PivMgmtAlgSel::Delete),
            FeatureGate::Unsupported
        );
    }

    /// `piv_policy_clamp` — the PIN/touch policy counterpart of
    /// `piv_mgmtalg_clamp` — snaps a selection a `PivQuirk` has dropped from
    /// the offered list (e.g. `Once`/`Cached`) back to `Default`, and leaves
    /// an already-offered selection alone.
    #[test]
    fn piv_policy_clamp_snaps_an_unoffered_selection_to_default() {
        let cached_excluded: Vec<keyroost_piv::TouchPolicy> = keyroost_piv::TouchPolicy::ALL
            .iter()
            .copied()
            .filter(|&opt| opt != keyroost_piv::TouchPolicy::Cached)
            .collect();

        let mut sel = keyroost_piv::TouchPolicy::Cached;
        piv_policy_clamp(&mut sel, &cached_excluded);
        assert_eq!(sel, keyroost_piv::TouchPolicy::Default);

        // Already offered: left alone.
        let mut sel = keyroost_piv::TouchPolicy::Always;
        piv_policy_clamp(&mut sel, &cached_excluded);
        assert_eq!(sel, keyroost_piv::TouchPolicy::Always);

        // The full list never excludes `Default` itself, so a full-list
        // clamp never moves a valid selection.
        let mut sel = keyroost_piv::TouchPolicy::Cached;
        piv_policy_clamp(&mut sel, keyroost_piv::TouchPolicy::ALL);
        assert_eq!(sel, keyroost_piv::TouchPolicy::Cached);
    }

    /// The Compression dropdown: its choices and labels, the transport choice
    /// each maps to, and its initial selection on a fresh state and after
    /// the modal-close reset (Automatic, like the CLI with neither flag).
    #[test]
    fn piv_cert_compression_dropdown() {
        use keyroost_transport::CertCompression;
        let labels: Vec<_> = PivCertCompressionSel::ALL
            .iter()
            .map(|s| s.label())
            .collect();
        assert_eq!(labels, ["Automatic (only if too large)", "Always", "Never"]);
        assert_eq!(
            PivCertCompressionSel::Auto.to_compression(),
            CertCompression::Auto
        );
        assert_eq!(
            PivCertCompressionSel::Always.to_compression(),
            CertCompression::Always
        );
        assert_eq!(
            PivCertCompressionSel::Never.to_compression(),
            CertCompression::Never
        );

        assert_eq!(
            PivState::default().cert_compression,
            PivCertCompressionSel::Auto
        );
        let mut app = App::default();
        app.piv.cert_compression = PivCertCompressionSel::Never;
        app.piv_cred_modal_close();
        assert_eq!(app.piv.cert_compression, PivCertCompressionSel::Auto);
    }

    /// The success notice mirrors the CLI: the stored size when compressed,
    /// and the why-and-compatibility note when Automatic had to compress.
    #[test]
    fn piv_cert_stored_notice_and_detail() {
        assert_eq!(
            piv_cert_stored_notice("Certificate imported", false, 3087, false),
            "Certificate imported."
        );
        assert_eq!(piv_cert_stored_detail(false, 3087, false), None);

        assert_eq!(
            piv_cert_stored_notice("Certificate imported", true, 2900, false),
            "Certificate imported (stored compressed: 2900 bytes on the card)."
        );
        assert_eq!(
            piv_cert_stored_detail(true, 2900, false).as_deref(),
            Some("Stored compressed: 2900 bytes on the card.")
        );

        let auto = piv_cert_stored_notice("Certificate imported", true, 2900, true);
        assert!(
            auto.starts_with("Certificate imported (stored compressed: 2900 bytes on the card)."),
            "{auto}"
        );
        assert!(auto.ends_with(PIV_AUTO_COMPRESSED_NOTE), "{auto}");
        let detail = piv_cert_stored_detail(true, 2900, true).unwrap();
        assert!(detail.contains(PIV_AUTO_COMPRESSED_NOTE), "{detail}");

        let note = PIV_AUTO_COMPRESSED_NOTE;
        assert!(note.contains("did not fit"), "{note}");
        assert!(note.contains("Windows"), "{note}");
        assert!(note.contains("macOS"), "{note}");
        assert!(note.contains("not been verified"), "{note}");
        assert!(!note.to_lowercase().contains("unsupported"), "{note}");
    }

    /// With Compression set to Never, a too-large refusal points at the
    /// dropdown (the CLI names its flags instead).
    #[test]
    fn piv_cert_too_large_hint_only_for_never() {
        let slot = keyroost_piv::Slot::KeyManagement;
        let too_large = TransportError::PivCertTooLarge {
            slot,
            len: 6164,
            compressed_len: None,
        };
        let hint = piv_cert_error_hint(&too_large, PivCertCompressionSel::Never).unwrap();
        assert!(hint.contains("Compression"), "{hint}");
        assert!(hint.contains("Automatic"), "{hint}");
        assert_eq!(
            piv_cert_error_hint(&too_large, PivCertCompressionSel::Auto),
            None
        );
        assert_eq!(
            piv_cert_error_hint(
                &TransportError::PivCardFull { slot },
                PivCertCompressionSel::Never
            ),
            None
        );
    }

    /// The selected slot's state line marks a compressed certificate.
    #[test]
    fn piv_slot_state_text_marks_compression() {
        let p256 = Some(keyroost_piv::KeyAlg::EccP256);
        assert_eq!(
            piv_slot_state_text(None, true, true, p256),
            "certificate present (ECC P-256, compressed)"
        );
        assert_eq!(
            piv_slot_state_text(None, true, false, p256),
            "certificate present (ECC P-256)"
        );
        assert_eq!(
            piv_slot_state_text(None, true, true, None),
            "certificate present (compressed)"
        );
        assert_eq!(
            piv_slot_state_text(None, true, false, None),
            "certificate present"
        );
        assert_eq!(
            piv_slot_state_text(None, false, false, p256),
            "key present (ECC P-256), no certificate"
        );
        assert_eq!(piv_slot_state_text(None, false, false, None), "empty");
        assert_eq!(
            piv_slot_state_text(
                Some(keyroost_transport::CertUnreadable::Damaged),
                true,
                false,
                p256
            ),
            format!(
                "certificate present but unreadable ({})",
                keyroost_transport::CertUnreadable::Damaged
            )
        );
    }

    /// Each flow maps to its own title, busy caption, and success text.
    #[test]
    fn piv_cred_kind_strings_are_distinct() {
        let kinds = [
            PivCredKind::ChangePin,
            PivCredKind::ChangePuk,
            PivCredKind::UnblockPin,
        ];
        let titles: Vec<_> = kinds.iter().map(|k| k.title()).collect();
        assert_eq!(titles, ["Change PIN", "Change PUK", "Unblock PIN"]);
        assert_eq!(piv_cred_success(PivCredKind::ChangePin), "PIN changed");
        assert_eq!(piv_cred_success(PivCredKind::ChangePuk), "PUK changed");
        assert_eq!(
            piv_cred_success(PivCredKind::UnblockPin),
            "PIN unblocked and reset"
        );
        // Busy captions are non-empty and unique.
        let busy: Vec<_> = kinds.iter().map(|k| k.busy_label()).collect();
        assert!(busy.iter().all(|s| !s.is_empty()));
        assert_eq!(busy[0], "Changing PIV PIN\u{2026}");
    }

    /// A successful PIV write drops the retired-occupancy cache (so the
    /// section re-reads fresh on next expand). If a retired slot was selected
    /// when that happens, the selection must snap back to a standard slot —
    /// otherwise the Generate overwrite guard reads the now-cleared cache as
    /// "unknown occupancy" and treats that as empty, silently skipping its
    /// warning on what may still be an occupied archived key.
    #[test]
    fn apply_piv_write_success_clears_stale_retired_selection() {
        let mut app = App::default();
        app.piv.selected_slot = PivSlotSel::Retired(3);
        app.piv.retired_occupancy = Some(vec![(keyroost_piv::Slot::Retired(3), true)]);
        let status = keyroost_transport::PivStatus::default();
        App::apply_piv_write(&mut app, Ok(status), "did a thing".into());
        assert_eq!(
            app.piv.selected_slot,
            PivSlotSel::Auth,
            "a retired-slot selection must not survive its occupancy cache clearing"
        );
        assert!(app.piv.retired_occupancy.is_none());
    }

    /// A standard-slot selection is left untouched by the same invalidation —
    /// only a stale `Retired` selection needs to be reset.
    #[test]
    fn apply_piv_write_success_leaves_standard_selection_alone() {
        let mut app = App::default();
        app.piv.selected_slot = PivSlotSel::KeyMgmt;
        let status = keyroost_transport::PivStatus::default();
        App::apply_piv_write(&mut app, Ok(status), "did a thing".into());
        assert_eq!(app.piv.selected_slot, PivSlotSel::KeyMgmt);
    }

    /// The management-key-gated flows declare they collect the current
    /// management key (and therefore show the "Use default" toggle); the PIN/PUK
    /// and CSR flows do not.
    #[test]
    fn piv_cred_kind_mgmt_key_mapping() {
        assert!(PivCredKind::GenerateKey.needs_mgmt_key());
        assert!(PivCredKind::ImportCert.needs_mgmt_key());
        assert!(PivCredKind::SelfSign.needs_mgmt_key());
        assert!(PivCredKind::SetRetries.needs_mgmt_key());
        assert!(PivCredKind::ChangeMgmtKey.needs_mgmt_key());
        // Slot deletion is authorized by the management key (like generate).
        assert!(PivCredKind::DeleteCert.needs_mgmt_key());
        assert!(PivCredKind::DeleteKey.needs_mgmt_key());
        // Moving a key is authorized by the management key too.
        assert!(PivCredKind::MoveKey.needs_mgmt_key());
        // CSR signs with the PIN only — no management key.
        assert!(!PivCredKind::RequestCsr.needs_mgmt_key());
        // PIN/PUK flows never collect a management key.
        assert!(!PivCredKind::ChangePin.needs_mgmt_key());
        assert!(!PivCredKind::ChangePuk.needs_mgmt_key());
        assert!(!PivCredKind::UnblockPin.needs_mgmt_key());
    }

    /// Every new gated variant has a distinct, non-empty title / submit label /
    /// busy caption / success line.
    #[test]
    fn piv_cred_kind_gated_strings_are_present() {
        let kinds = [
            PivCredKind::GenerateKey,
            PivCredKind::ImportCert,
            PivCredKind::SelfSign,
            PivCredKind::RequestCsr,
            PivCredKind::SetRetries,
            PivCredKind::ChangeMgmtKey,
            PivCredKind::DeleteCert,
            PivCredKind::DeleteKey,
            PivCredKind::MoveKey,
        ];
        for k in kinds {
            assert!(!k.title().is_empty());
            assert!(!k.submit_label().is_empty());
            assert!(k.busy_label().ends_with('\u{2026}'));
            assert!(!piv_cred_success(k).is_empty());
        }
        // Mismatch guard only fires for the PIN/PUK change flows; gated flows
        // never report a new==confirm mismatch.
        let piv = PivState::default();
        for k in kinds {
            assert_eq!(piv_cred_mismatch(&piv, k), None);
        }
    }

    /// The overwrite-guard occupancy predicate reads the right cache for each
    /// selection kind: standard slots from `slot_keys`, retired slots from the
    /// lazily-populated `retired_occupancy` cache.
    #[test]
    fn piv_slot_occupied_reads_the_right_cache() {
        use keyroost_piv::{KeyAlg, Slot};

        // Standard-slot occupancy comes from `slot_keys`: a carried algorithm
        // means the slot holds a private key; `None` means empty.
        let slot_keys = vec![
            (Slot::Authentication, Some(KeyAlg::EccP256), None),
            (Slot::Signature, None, None),
        ];
        assert!(piv_slot_occupied(PivSlotSel::Auth, &slot_keys, None));
        // alg is None -> empty
        assert!(!piv_slot_occupied(PivSlotSel::Sign, &slot_keys, None));
        // slot absent from the cache -> treated as empty
        assert!(!piv_slot_occupied(PivSlotSel::CardAuth, &slot_keys, None));

        // Retired-slot occupancy comes from the `retired_occupancy` cache.
        let retired = vec![
            (Slot::retired(1).unwrap(), true),
            (Slot::retired(2).unwrap(), false),
        ];
        assert!(piv_slot_occupied(
            PivSlotSel::Retired(1),
            &slot_keys,
            Some(&retired)
        ));
        // listed but empty
        assert!(!piv_slot_occupied(
            PivSlotSel::Retired(2),
            &slot_keys,
            Some(&retired)
        ));
        // not listed in the cache -> false
        assert!(!piv_slot_occupied(
            PivSlotSel::Retired(3),
            &slot_keys,
            Some(&retired)
        ));
        // cache absent entirely -> false (unknown treated as empty)
        assert!(!piv_slot_occupied(PivSlotSel::Retired(1), &slot_keys, None));
    }

    #[test]
    fn slot_confirmed_empty_only_fires_on_a_confirmed_empty_slot() {
        use keyroost_piv::compat::FeatureGate;

        // Confirmed empty on a device that can actually tell us -> blocked.
        assert!(slot_confirmed_empty(FeatureGate::Supported, false));
        // Confirmed to hold a key -> never blocked, regardless of the gate.
        assert!(!slot_confirmed_empty(FeatureGate::Supported, true));
        // No reliable device signal (Unverified or Unsupported) -> never
        // blocked on emptiness, even if the (untrustworthy) reading says
        // empty -- this is the whole point of gating on
        // `GetSlotKeyStatus` rather than trusting `selected_has_key` alone.
        assert!(!slot_confirmed_empty(FeatureGate::Unverified, false));
        assert!(!slot_confirmed_empty(FeatureGate::Unsupported, false));
    }

    /// Given occupancy (slot -> has_key), the eligible move destinations are the
    /// empty slots that aren't the source — across standard *and* retired slots.
    #[test]
    fn move_key_destinations_exclude_occupied_and_source() {
        let occupied = |s: keyroost_piv::Slot| {
            s == keyroost_piv::Slot::Authentication // 9A occupied
                || s == keyroost_piv::Slot::retired(1).unwrap()
        };
        let src = keyroost_piv::Slot::KeyManagement;
        let dests = move_key_eligible_destinations(src, &occupied);
        assert!(!dests.contains(&src));
        assert!(!dests.contains(&keyroost_piv::Slot::Authentication)); // occupied
        assert!(!dests.contains(&keyroost_piv::Slot::retired(1).unwrap()));
        assert!(dests.contains(&keyroost_piv::Slot::retired(2).unwrap())); // empty
        assert!(dests.contains(&keyroost_piv::Slot::Signature)); // empty standard
    }

    /// The standard PIV factory default is 24 bytes of `01..08` ×3; Token2 PIN+
    /// ships its own vendor default. Both resolve via
    /// `PivQuirk::Default9bManagementKey`, at any reported version.
    #[test]
    fn piv_default_mgmt_key_is_well_known() {
        let std = piv_default_mgmt_key(
            keyroost_piv::fingerprint::AppletFingerprint::YubiKey,
            Some(&[0]),
            None,
        )
        .expect("YubiKey has a seeded default");
        assert_eq!(&std[..8], &[1, 2, 3, 4, 5, 6, 7, 8]);
        // Repeated three times.
        assert_eq!(&std[8..16], &std[..8]);
        assert_eq!(&std[16..24], &std[..8]);

        let t2 = piv_default_mgmt_key(
            keyroost_piv::fingerprint::AppletFingerprint::Token2,
            Some(&[0]),
            None,
        )
        .expect("Token2 has a seeded default");
        assert_ne!(std, t2);
    }

    /// A fingerprint keyroost has no seeded default for (`IdPrime`) resolves
    /// `None` — the signal `App::piv_modal_mgmt_field` disables the "Use
    /// default management key" checkbox on.
    #[test]
    fn piv_default_mgmt_key_none_for_an_unseeded_fingerprint() {
        // IdPrime no longer fits this test — it now carries its own seeded
        // default (`keyroost_piv::compat::IDPRIME_APPLET_QUIRKS`) — so this
        // uses OpenFips201::Generic instead, which still has none.
        assert_eq!(
            piv_default_mgmt_key(
                keyroost_piv::fingerprint::AppletFingerprint::OpenFips201(
                    keyroost_piv::fingerprint::OpenFips201Variant::Generic
                ),
                Some(&[0]),
                None
            ),
            None
        );
    }

    /// `OathAddDialog::validate` trims the name, requires it, base32-decodes the
    /// secret, and rejects an empty/invalid secret — the same guards the modal's
    /// Submit relies on before dispatching `provision_oath`.
    #[test]
    fn oath_add_dialog_validate() {
        // Empty name → error, regardless of the secret.
        let mut d = OathAddDialog::opened();
        d.name = "  ".into();
        d.secret = "JBSWY3DPEHPK3PXP".into();
        assert_eq!(d.validate().unwrap_err(), "credential name is required");

        // Empty secret → error.
        d.name = "acme:alice".into();
        d.secret = String::new();
        assert_eq!(d.validate().unwrap_err(), "secret is empty");

        // Non-base32 secret → "invalid base32 secret: …".
        d.secret = "not base32!!".into();
        assert!(d
            .validate()
            .unwrap_err()
            .starts_with("invalid base32 secret"));

        // Valid input → trimmed name + decoded secret bytes.
        d.name = "  acme:alice  ".into();
        d.secret = "JBSWY3DPEHPK3PXP".into();
        let (name, secret) = d.validate().expect("valid");
        assert_eq!(name, "acme:alice");
        assert_eq!(
            secret,
            keyroost_proto::codec::base32_decode("JBSWY3DPEHPK3PXP").unwrap()
        );
        assert!(!secret.is_empty());
    }

    /// `apply_oath_rows` mirrors the provision outcome into the open add modal
    /// (busy clears; success → `Ok`, error → `Err(message)`) and does *not*
    /// double-report into the pane-level `oath.error` while the modal owns the op.
    #[test]
    fn apply_oath_rows_mirrors_into_add_modal() {
        // Success path: modal busy → result Ok, busy cleared, rows applied.
        let mut app = App::default();
        app.oath.add = OathAddDialog::opened();
        app.oath.add.busy = true;
        App::apply_oath_rows(
            &mut app,
            Ok((
                vec![OathRow {
                    name: "x".into(),
                    code: None,
                    hotp: false,
                }],
                0,
            )),
            zeroize::Zeroizing::new(String::new()),
        );
        assert!(!app.oath.add.busy);
        assert_eq!(app.oath.add.result, Some(Ok(())));
        assert_eq!(app.oath.creds.len(), 1);
        assert!(app.oath.error.is_none());

        // Error path: wrong password surfaces in the modal, not the pane.
        let mut app = App::default();
        app.oath.add = OathAddDialog::opened();
        app.oath.add.busy = true;
        App::apply_oath_rows(
            &mut app,
            Err(TransportError::OathPasswordRejected),
            zeroize::Zeroizing::new(String::new()),
        );
        assert!(!app.oath.add.busy);
        assert_eq!(app.oath.add.result, Some(Err("wrong OATH password".into())));
        assert!(app.oath.error.is_none());

        // No modal open: the pane-level error path still works (unlock/refresh).
        let mut app = App::default();
        App::apply_oath_rows(
            &mut app,
            Err(TransportError::OathPasswordRejected),
            zeroize::Zeroizing::new(String::new()),
        );
        assert!(!app.oath.add.open);
        assert!(app.oath.locked);
        assert_eq!(app.oath.error.as_deref(), Some("wrong OATH password"));
    }

    /// With "Use default management key" ticked, `piv_current_mgmt_key` ignores
    /// the (possibly empty) hex field and yields this device's well-known
    /// default; with it off, it decodes the typed hex.
    #[test]
    fn piv_current_mgmt_key_honours_use_default() {
        let mut app = App::default();
        app.piv.status = Some(piv_status_with(
            keyroost_piv::fingerprint::AppletFingerprint::YubiKey,
            Some(vec![5, 7]),
        ));
        // Default toggle on, hex field empty → resolves to this device's
        // seeded default (YubiKey's, since that's the live fingerprint).
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Default;
        app.piv.mgmt_key_input.clear();
        let key = app.piv_current_mgmt_key().expect("default fills");
        assert_eq!(
            &key[..],
            piv_default_mgmt_key(
                keyroost_piv::fingerprint::AppletFingerprint::YubiKey,
                Some(&[5, 7]),
                None
            )
            .unwrap()
        );

        // Toggle off → uses the typed hex.
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Manual;
        app.piv.mgmt_key_input = "aabbccddeeff00112233445566778899aabbccddeeff0011".into();
        let typed = app.piv_current_mgmt_key().expect("valid hex");
        assert_eq!(typed.len(), 24);
        assert_eq!(typed[0], 0xaa);

        // Toggle off with bad hex → error surfaces.
        app.piv.mgmt_key_input = "nothex".into();
        assert!(app.piv_current_mgmt_key().is_err());
    }

    /// With "Use default management key" ticked but no live status read yet
    /// (or a fingerprint keyroost has no seeded default for), there's no
    /// default to fall back on — `piv_current_mgmt_key` surfaces an error
    /// rather than guessing.
    #[test]
    fn piv_current_mgmt_key_default_errors_without_a_known_default() {
        let mut app = App::default();
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Default;
        // No status read yet at all.
        assert!(app.piv_current_mgmt_key().is_err());

        // A live status, but for a fingerprint with no seeded default.
        // IdPrime no longer fits here either — see
        // `piv_default_mgmt_key_none_for_an_unseeded_fingerprint`.
        app.piv.status = Some(piv_status_with(
            keyroost_piv::fingerprint::AppletFingerprint::OpenFips201(
                keyroost_piv::fingerprint::OpenFips201Variant::Generic,
            ),
            None,
        ));
        assert!(app.piv_current_mgmt_key().is_err());
    }

    /// With "Use PIN" ticked, `piv_current_mgmt_auth` yields a `Pin`, sourced
    /// from `mgmt_key_input` for a flow with no PIN field of its own — the
    /// same field the checkbox turns from "Management key" into "PIN".
    #[test]
    fn piv_current_mgmt_auth_use_pin_reads_mgmt_key_input_by_default() {
        let mut app = App::default();
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Pin;
        app.piv.mgmt_key_input = "123456".into();
        match app.piv_current_mgmt_auth(PivCredKind::GenerateKey) {
            Ok(PivMgmtAuth::Pin(pin)) => assert_eq!(&*pin, "123456"),
            other => panic!("expected Pin(\"123456\"), got {}", other.is_ok()),
        }
    }

    /// For `SelfSign`/`SetRetries` — flows that already collect a PIN of
    /// their own — "Use PIN" reuses *that* field instead of
    /// `mgmt_key_input`: PIV has exactly one application PIN, so the two
    /// boxes would otherwise ask for the same value twice.
    #[test]
    fn piv_current_mgmt_auth_use_pin_shares_the_dedicated_pin_field() {
        let mut app = App::default();
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Pin;
        // Left blank/stale on purpose — must not be what gets read.
        app.piv.mgmt_key_input = "should-not-be-used".into();

        app.piv.sign_pin = "111111".into();
        match app.piv_current_mgmt_auth(PivCredKind::SelfSign) {
            Ok(PivMgmtAuth::Pin(pin)) => assert_eq!(&*pin, "111111"),
            other => panic!("expected Pin(\"111111\"), got {}", other.is_ok()),
        }

        app.piv.retries_pin_auth = "222222".into();
        match app.piv_current_mgmt_auth(PivCredKind::SetRetries) {
            Ok(PivMgmtAuth::Pin(pin)) => assert_eq!(&*pin, "222222"),
            other => panic!("expected Pin(\"222222\"), got {}", other.is_ok()),
        }
    }

    /// With "Use PIN" off, `piv_current_mgmt_auth` falls through to the
    /// existing management-key resolution unchanged.
    #[test]
    fn piv_current_mgmt_auth_without_use_pin_falls_back_to_mgmt_key() {
        let mut app = App::default();
        app.piv.status = Some(piv_status_with(
            keyroost_piv::fingerprint::AppletFingerprint::YubiKey,
            Some(vec![5, 7]),
        ));
        app.piv.mgmt_auth_mode = PivMgmtAuthMode::Default;
        match app.piv_current_mgmt_auth(PivCredKind::GenerateKey) {
            Ok(PivMgmtAuth::Key(key)) => assert_eq!(
                &key[..],
                piv_default_mgmt_key(
                    keyroost_piv::fingerprint::AppletFingerprint::YubiKey,
                    Some(&[5, 7]),
                    None
                )
                .unwrap()
            ),
            other => panic!("expected Key(default), got {}", other.is_ok()),
        }
    }

    /// Regression test for a reported bug: check "Use PIN", check "Use
    /// default management key" (which un-checks "Use PIN"), then un-check
    /// "Use default management key" again. With two independent `bool`s —
    /// each resetting the other on check but not consulting it on uncheck —
    /// the third step left `use_pin` from step 1 stuck, so neither checkbox
    /// was checked yet the field still asked for a PIN. `mgmt_auth_mode` is
    /// a single field precisely to make that state unrepresentable: each
    /// toggle is `piv_mgmt_mode_after_toggle`, applied unconditionally.
    #[test]
    fn mgmt_mode_toggle_sequence_ends_manual_not_stuck_on_pin() {
        // 1. check "Use PIN". (Starting mode is Manual either way — the
        // fresh-modal default — so the first toggle's result doesn't depend
        // on it.)
        let mut mode = piv_mgmt_mode_after_toggle(true, PivMgmtAuthMode::Pin);
        assert_eq!(mode, PivMgmtAuthMode::Pin);
        // 2. check "Use default management key".
        mode = piv_mgmt_mode_after_toggle(true, PivMgmtAuthMode::Default);
        assert_eq!(mode, PivMgmtAuthMode::Default);
        // 3. uncheck "Use default management key" — neither box is checked
        // now, so this must land on Manual (asking for the typed management
        // key), not silently revert to Pin.
        mode = piv_mgmt_mode_after_toggle(false, PivMgmtAuthMode::Default);
        assert_eq!(mode, PivMgmtAuthMode::Manual);
    }

    /// `piv_mgmt_mode_after_toggle` unconditionally: checking always lands on
    /// the given mode, unchecking always lands on `Manual`, regardless of
    /// which mode was current beforehand.
    #[test]
    fn piv_mgmt_mode_after_toggle_ignores_the_other_toggle_entirely() {
        assert_eq!(
            piv_mgmt_mode_after_toggle(true, PivMgmtAuthMode::Default),
            PivMgmtAuthMode::Default
        );
        assert_eq!(
            piv_mgmt_mode_after_toggle(true, PivMgmtAuthMode::Pin),
            PivMgmtAuthMode::Pin
        );
        assert_eq!(
            piv_mgmt_mode_after_toggle(false, PivMgmtAuthMode::Default),
            PivMgmtAuthMode::Manual
        );
        assert_eq!(
            piv_mgmt_mode_after_toggle(false, PivMgmtAuthMode::Pin),
            PivMgmtAuthMode::Manual
        );
    }

    #[test]
    fn reset_mgmt_auth_mode_after_toggle_ignores_the_other_toggle_entirely() {
        assert_eq!(
            reset_mgmt_auth_mode_after_toggle(true, ResetMgmtAuthMode::Default),
            ResetMgmtAuthMode::Default
        );
        assert_eq!(
            reset_mgmt_auth_mode_after_toggle(true, ResetMgmtAuthMode::Pin),
            ResetMgmtAuthMode::Pin
        );
        assert_eq!(
            reset_mgmt_auth_mode_after_toggle(false, ResetMgmtAuthMode::Default),
            ResetMgmtAuthMode::Manual
        );
        assert_eq!(
            reset_mgmt_auth_mode_after_toggle(false, ResetMgmtAuthMode::Pin),
            ResetMgmtAuthMode::Manual
        );
    }

    #[test]
    fn reset_mgmt_current_auth_default_reads_the_armed_dialogs_resolved_key() {
        let app = App {
            reset_mgmt_auth_mode: ResetMgmtAuthMode::Default,
            factory_reset_confirm: Some(FactoryResetConfirmState {
                for_device: "serial:AAA".into(),
                piv_preview: FactoryResetPivPreview::NotOffered,
                needs_reset_mgmt_auth: true,
                default_mgmt_key: Some(
                    &keyroost_piv::fingerprint::HID_CRESCENDO_ACA_FACTORY_XAUTH_KEY,
                ),
                reset_long_running: false,
            }),
            ..Default::default()
        };
        match app.reset_mgmt_current_auth() {
            Ok(ResetMgmtAuth::Key(key)) => assert_eq!(
                &*key,
                &keyroost_piv::fingerprint::HID_CRESCENDO_ACA_FACTORY_XAUTH_KEY
            ),
            other => panic!("expected the factory-default key, got {}", other.is_ok()),
        }
    }

    #[test]
    fn reset_mgmt_current_auth_default_with_no_known_default_errors() {
        // No `factory_reset_confirm` armed at all (e.g. a stale call) is the
        // same "no known default" case as one armed with `default_mgmt_key:
        // None` — both mean keyroost has nothing to offer for this device.
        let app = App {
            reset_mgmt_auth_mode: ResetMgmtAuthMode::Default,
            ..Default::default()
        };
        assert!(app.reset_mgmt_current_auth().is_err());
    }

    #[test]
    fn reset_mgmt_current_auth_pin_reads_the_typed_field() {
        let app = App {
            reset_mgmt_auth_mode: ResetMgmtAuthMode::Pin,
            reset_mgmt_auth_input: "123456".into(),
            ..Default::default()
        };
        match app.reset_mgmt_current_auth() {
            Ok(ResetMgmtAuth::Pin(pin)) => assert_eq!(&*pin, "123456"),
            other => panic!("expected Pin(\"123456\"), got {}", other.is_ok()),
        }
    }

    #[test]
    fn reset_mgmt_current_auth_manual_decodes_typed_hex() {
        let mut app = App {
            reset_mgmt_auth_mode: ResetMgmtAuthMode::Manual,
            reset_mgmt_auth_input: "00".repeat(24),
            ..Default::default()
        };
        match app.reset_mgmt_current_auth() {
            Ok(ResetMgmtAuth::Key(key)) => assert_eq!(&*key, &[0u8; 24]),
            other => panic!("expected a 24-byte zero key, got {}", other.is_ok()),
        }
        // Bad hex surfaces a decode error, same as the PIV modal's field.
        app.reset_mgmt_auth_input = "not hex".into();
        assert!(app.reset_mgmt_current_auth().is_err());
    }

    /// `piv_cred_modal_close` resets `mgmt_auth_mode` to `Manual` — covering
    /// both what `use_default_mgmt = false` already did and the previously
    /// missing `use_pin` reset (a real gap the two-bool design had: closing
    /// the modal left "Use PIN" ticked for the next flow that opens it).
    #[test]
    fn piv_cred_modal_close_resets_mgmt_auth_mode() {
        let mut app = App::default();
        for mode in [PivMgmtAuthMode::Default, PivMgmtAuthMode::Pin] {
            app.piv.mgmt_auth_mode = mode;
            app.piv_cred_modal_close();
            assert_eq!(app.piv.mgmt_auth_mode, PivMgmtAuthMode::Manual);
        }
    }

    /// `PivCredKind::shares_pin_field` covers exactly `SelfSign`/`SetRetries` —
    /// every other management-gated flow gets its own PIN box (or none) from
    /// `piv_modal_mgmt_field`, not a reused one.
    #[test]
    fn shares_pin_field_covers_exactly_self_sign_and_set_retries() {
        for kind in [
            PivCredKind::ChangePin,
            PivCredKind::ChangePuk,
            PivCredKind::UnblockPin,
            PivCredKind::GenerateKey,
            PivCredKind::ImportCert,
            PivCredKind::RequestCsr,
            PivCredKind::ChangeMgmtKey,
            PivCredKind::DeleteCert,
            PivCredKind::DeleteKey,
            PivCredKind::MoveKey,
            PivCredKind::NewChuid,
        ] {
            assert!(!kind.shares_pin_field(), "{kind:?} should not share");
        }
        assert!(PivCredKind::SelfSign.shares_pin_field());
        assert!(PivCredKind::SetRetries.shares_pin_field());
    }

    /// `apply_piv_cred_result` mirrors the pane outcome into the open modal:
    /// no error → `Ok`, error present → `Err(message)`, and `busy` clears.
    #[test]
    fn apply_piv_cred_result_mirrors_outcome() {
        let mut app = App::default();
        // Success path.
        app.piv.cred_modal = Some(PivCredModal {
            kind: PivCredKind::ChangePin,
            busy: true,
            result: None,
            detail: None,
        });
        app.piv.error = None;
        App::apply_piv_cred_result(&mut app);
        let m = app.piv.cred_modal.as_ref().unwrap();
        assert!(!m.busy);
        assert_eq!(m.result, Some(Ok(())));

        // Error path.
        app.piv.cred_modal = Some(PivCredModal::new(PivCredKind::ChangePuk));
        app.piv.cred_modal.as_mut().unwrap().busy = true;
        app.piv.error = Some("wrong PUK".into());
        App::apply_piv_cred_result(&mut app);
        let m = app.piv.cred_modal.as_ref().unwrap();
        assert!(!m.busy);
        assert_eq!(m.result, Some(Err("wrong PUK".into())));
    }

    /// `PivSlotSel::label` maps each selector to the canonical PIV slot name; the
    /// delete flows name this slot in their destructive warning and success line.
    #[test]
    fn piv_slot_sel_labels() {
        assert_eq!(PivSlotSel::Auth.label(), "authentication (9A)");
        assert_eq!(PivSlotSel::Sign.label(), "signature (9C)");
        assert_eq!(PivSlotSel::KeyMgmt.label(), "key management (9D)");
        assert_eq!(PivSlotSel::CardAuth.label(), "card authentication (9E)");
    }

    /// `OpenPgpCredKind::needs_admin_pin` is true for every admin-PIN (PW3)-gated
    /// flow and false for the self-authorising user-PIN change and the PIN-less
    /// reset — this is what decides whether the admin-PIN field + use-default
    /// toggle render in the modal.
    #[test]
    fn openpgp_cred_kind_needs_admin_pin_mapping() {
        use OpenPgpCredKind::*;
        for k in [
            ChangeAdminPin,
            UnblockUserPin,
            SetName,
            SetUrl,
            GenerateKey,
            GenerateImportKey,
            ImportKeyFile,
        ] {
            assert!(k.needs_admin_pin(), "{} should need PW3", k.title());
        }
        for k in [ChangeUserPin, Reset] {
            assert!(!k.needs_admin_pin(), "{} should not need PW3", k.title());
        }
    }

    /// With "Use default admin PIN (PW3)" ticked, `openpgp_admin_pin_value`
    /// ignores the (possibly empty) typed field and yields the well-known factory
    /// default; with it off, it returns the typed PIN verbatim.
    #[test]
    fn openpgp_admin_pin_value_honours_use_default() {
        let mut app = App::default();

        // Default toggle on, field empty → resolves to the factory default.
        app.openpgp.use_default_admin = true;
        app.openpgp.admin_pin.clear();
        assert_eq!(app.openpgp_admin_pin_value(), OPENPGP_DEFAULT_ADMIN_PIN);
        assert_eq!(app.openpgp_admin_pin_value(), "12345678");

        // Toggle off → uses the typed PIN.
        app.openpgp.use_default_admin = false;
        app.openpgp.admin_pin = "7654321".into();
        assert_eq!(app.openpgp_admin_pin_value(), "7654321");
    }

    /// `apply_openpgp_cred_result` mirrors the pane outcome into the open modal:
    /// no error → `Ok`, error present → `Err(message)`, and `busy` clears.
    #[test]
    fn apply_openpgp_cred_result_mirrors_outcome() {
        let mut app = App::default();

        // Success path.
        app.openpgp.cred_modal = Some(OpenPgpCredModal {
            kind: OpenPgpCredKind::SetName,
            busy: true,
            result: None,
            device: None,
        });
        app.openpgp.error = None;
        App::apply_openpgp_cred_result(&mut app);
        let m = app.openpgp.cred_modal.as_ref().unwrap();
        assert!(!m.busy);
        assert_eq!(m.result, Some(Ok(())));

        // Error path.
        app.openpgp.cred_modal = Some(OpenPgpCredModal::new(OpenPgpCredKind::ChangeAdminPin, None));
        app.openpgp.cred_modal.as_mut().unwrap().busy = true;
        app.openpgp.error = Some("wrong admin PIN".into());
        App::apply_openpgp_cred_result(&mut app);
        let m = app.openpgp.cred_modal.as_ref().unwrap();
        assert!(!m.busy);
        assert_eq!(m.result, Some(Err("wrong admin PIN".into())));
    }

    fn test_key(id: &str, serial: &str, name: Option<&str>) -> Device {
        Device {
            id: id.into(),
            name: name.map(str::to_owned),
            vendor: "Yubico".into(),
            model: "YubiKey".into(),
            serial: serial.into(),
            transport: "USB".into(),
            firmware: String::new(),
            caps: Caps::default(),
            unverified: Caps::default(),
            kind: DeviceKind::Key,
            hid_path: None,
            reader: None,
        }
    }

    /// Issue #84: a FIDO2 card in a reader must take the in-place reset route,
    /// and nothing else may. The replug ceremony physically cannot complete
    /// for a card (nothing to unplug, no touch surface, and the arm's removal
    /// detector keys on a HID path the card does not have), so routing it
    /// there hangs the dialog forever — which is exactly what was reported.
    #[test]
    fn card_reset_route_is_reader_only_devices_exactly() {
        // A card: FIDO2 over a reader, no HID interface -> in-place route.
        let mut card = test_key("reader:acs", "T2CARD01", None);
        card.caps.insert(Caps::FIDO2);
        card.reader = Some("ACS ACR122U 00 00".into());
        assert_eq!(
            App::card_reset_reader(Some(&card)).as_deref(),
            Some("ACS ACR122U 00 00")
        );

        // A USB key that ALSO exposes a CCID reader keeps the replug ceremony:
        // it has a real replug, whose proof-of-possession must not be bypassed
        // just because a reader name is available.
        let mut usb_both = card.clone();
        usb_both.hid_path = Some(std::path::PathBuf::from("/dev/hidraw9"));
        assert_eq!(App::card_reset_reader(Some(&usb_both)), None);

        // A plain USB key: no reader, no route.
        let mut usb = test_key("serial:U", "USB01", None);
        usb.caps.insert(Caps::FIDO2);
        usb.hid_path = Some(std::path::PathBuf::from("/dev/hidraw9"));
        assert_eq!(App::card_reset_reader(Some(&usb)), None);

        // A card without the FIDO applet (OATH/PIV-only) has nothing to reset
        // over CTAP; the reader alone must not create the route.
        let mut no_fido = test_key("reader:x", "NOFIDO", None);
        no_fido.reader = Some("Some Reader 00 00".into());
        assert_eq!(App::card_reset_reader(Some(&no_fido)), None);

        // No selection at all.
        assert_eq!(App::card_reset_reader(None), None);
    }

    #[test]
    fn rename_pins_target_serial_independent_of_selection() {
        // Opening the rename field pins the device's serial and name-at-open,
        // so a later selection change (e.g. a background rescan of a flapping
        // reader) can't retarget the save.
        let mut app = App::default();
        let a = test_key("serial:A", "AAA", Some("old-a"));
        app.apply_rename_actions(&a, /*open*/ true, false, false);
        assert!(app.rename_target.is_some());
        let t = app.rename_target.clone().expect("target pinned on open");
        assert_eq!(t.serial, "AAA");
        assert_eq!(t.name_at_open.as_deref(), Some("old-a"));

        // Selection moves to another key mid-edit — the pin is unchanged.
        app.devices = vec![test_key("serial:B", "BBB", Some("old-b"))];
        app.selected_device = Some("serial:B".into());
        let still = app.rename_target.clone().unwrap();
        assert_eq!(still.serial, "AAA", "pin must not follow the selection");

        // Cancel clears the pin and the field.
        app.apply_rename_actions(&a, false, /*cancel*/ true, false);
        assert!(app.rename_target.is_none());
    }

    #[test]
    fn rename_refuses_a_serial_less_device() {
        // A device with no serial can't be named — the field never opens and no
        // target is pinned.
        let mut app = App::default();
        let no_serial = test_key("winfido:x", "", None);
        app.apply_rename_actions(&no_serial, true, false, false);
        assert!(app.rename_target.is_none());
    }

    /// The OpenPGP mismatch guard is inert (the PIN forms have no confirm field),
    /// so it returns `None` for every flow — locks in the documented behaviour.
    #[test]
    fn openpgp_cred_mismatch_never_fires() {
        use OpenPgpCredKind::*;
        let pgp = OpenPgpState {
            user_pin_new: "111111".into(),
            admin_pin_new: "22222222".into(),
            ..Default::default()
        };
        for k in [
            ChangeUserPin,
            ChangeAdminPin,
            UnblockUserPin,
            SetName,
            SetUrl,
            GenerateKey,
            GenerateImportKey,
            ImportKeyFile,
            Reset,
        ] {
            assert!(openpgp_cred_mismatch(&pgp, k).is_none());
        }
    }

    /// The shared device-binding guard: a completion or modal submission may
    /// act only when the device captured at dispatch/open time still equals
    /// the current selection.
    #[test]
    fn completion_guard_requires_matching_selection() {
        let a: DeviceId = "serial:AAA".into();
        let b: DeviceId = "serial:BBB".into();
        assert!(completion_still_valid(Some(&a), Some(&a)));
        assert!(!completion_still_valid(Some(&a), Some(&b)));
    }

    /// `None` on either side fails closed: an unbound completion must never
    /// act on whatever happens to be selected, and a captured target must
    /// never fire with nothing selected.
    #[test]
    fn completion_guard_fails_closed_without_capture_or_selection() {
        let a: DeviceId = "serial:AAA".into();
        assert!(!completion_still_valid(None, Some(&a)));
        assert!(!completion_still_valid(Some(&a), None));
        assert!(!completion_still_valid(None, None));
    }

    /// KEY-004: the stored Molto2 session is bound to the device it was
    /// opened for; once the selection moves, no mutating op may take it.
    #[test]
    fn molto_session_stays_bound_to_the_device_it_opened_for() {
        let mut app = App {
            selected_device: Some("serial:AAA".into()),
            molto_session_device: Some("serial:AAA".into()),
            ..Default::default()
        };
        assert!(app.molto_session_usable());

        // The user switches selection: the binding no longer matches…
        app.selected_device = Some("serial:BBB".into());
        assert!(!app.molto_session_usable());
        // …and take_molto_session refuses, dropping the stale binding.
        assert!(app.take_molto_session().is_none());
        assert!(app.molto_session_device.is_none());
    }

    /// A selection change always severs the Molto session binding, so a
    /// handed-back session from an in-flight job can never be used later.
    #[test]
    fn selection_change_clears_the_molto_session_binding() {
        let mut app = App {
            molto_session_device: Some("serial:AAA".into()),
            ..Default::default()
        };
        app.on_device_selected(None);
        assert!(app.molto_session_device.is_none());
    }

    /// KEY-007: Apply on the advanced dialog is rejected (and the dialog
    /// dropped, wiping its PIN via the Drop impl) once the selection has
    /// moved from the device the dialog opened for.
    #[test]
    fn advanced_dialog_apply_rejected_after_selection_change() {
        let mut app = App {
            selected_device: Some("serial:AAA".into()),
            ..Default::default()
        };
        app.security_keys.advanced = Some(AdvancedDialog {
            action: AdvancedAction::ForcePinChange,
            pin_input: "123456".into(),
            min_pin_input: String::new(),
            force_change: false,
            device: Some("serial:AAA".into()),
        });
        app.selected_device = Some("serial:BBB".into());
        app.run_advanced_action();
        assert!(
            app.security_keys.advanced.is_none(),
            "a stale dialog must be dropped, not dispatched"
        );
        assert!(app.security_keys.error.is_some(), "the refusal is surfaced");
    }

    /// Selecting another device closes (and thereby zeroizes) the dialog.
    #[test]
    fn selection_change_clears_the_advanced_dialog() {
        let mut app = App::default();
        app.security_keys.advanced = Some(AdvancedDialog {
            action: AdvancedAction::SetMinPin,
            pin_input: "123456".into(),
            min_pin_input: "6".into(),
            force_change: false,
            device: Some("serial:AAA".into()),
        });
        app.on_device_selected(None);
        assert!(app.security_keys.advanced.is_none());
    }

    /// KEY-012: a selection change severs the FIDO session binding and every
    /// piece of pending fingerprint state, and signals cancel to a live
    /// enroll worker.
    #[test]
    fn selection_change_clears_fido_session_binding_and_fingerprint_state() {
        let mut app = App::default();
        app.security_keys.session_device = Some("serial:AAA".into());
        app.security_keys.fingerprints = Some(Vec::new());
        app.security_keys.fp_new_name = "index".into();
        app.security_keys.fp_confirm_delete = Some(vec![1, 2]);
        app.security_keys.fp_rename = Some((vec![1, 2], "thumb".into()));
        let progress = std::sync::Arc::new(std::sync::Mutex::new(EnrollProgress::default()));
        let cancel = progress.lock().unwrap().cancel.clone();
        app.security_keys.fp_progress = Some(progress);

        app.on_device_selected(None);

        assert!(app.security_keys.session_device.is_none());
        assert!(app.security_keys.fingerprints.is_none());
        assert!(app.security_keys.fp_new_name.is_empty());
        assert!(app.security_keys.fp_confirm_delete.is_none());
        assert!(app.security_keys.fp_rename.is_none());
        assert!(app.security_keys.fp_progress.is_none());
        assert!(
            cancel.load(std::sync::atomic::Ordering::Relaxed),
            "an in-flight enroll must be told to cancel"
        );
    }

    /// The HOTP-read regression: a successful listing consumes the typed
    /// password but retains the accepted copy, so a later on-demand HOTP
    /// read can still unlock the protected applet.
    #[test]
    fn oath_listing_retains_the_accepted_password_for_on_demand_reads() {
        let mut app = App::default();
        app.oath.password_input = "hunter2".into();
        let password = oath_effective_password(&app.oath);
        assert_eq!(&*password, "hunter2", "typed entry wins while present");

        App::apply_oath_rows(&mut app, Ok((Vec::new(), 0)), password);
        assert!(
            app.oath.password_input.is_empty(),
            "typed entry is consumed"
        );
        assert_eq!(
            app.oath.unlocked_password.as_deref().map(String::as_str),
            Some("hunter2"),
            "the accepted password is retained for on-demand reads"
        );
        // …which is exactly what read_hotp_code will now pick up:
        assert_eq!(&*oath_effective_password(&app.oath), "hunter2");
    }

    /// A rejected password is never retained (and re-locks the pane).
    #[test]
    fn oath_rejected_password_is_not_retained() {
        let mut app = App::default();
        app.oath.unlocked_password = Some(zeroize::Zeroizing::new("stale".into()));
        App::apply_oath_rows(
            &mut app,
            Err(TransportError::OathPasswordRejected),
            zeroize::Zeroizing::new("wrong".into()),
        );
        assert!(app.oath.unlocked_password.is_none());
        assert!(app.oath.locked);
    }

    /// KEY-008 / KEY-013: destructive confirmations (OATH delete, OpenPGP
    /// reset modal, FIDO reset dialog) are dropped the moment the selection
    /// changes — a confirmation opened for one key must never render over,
    /// or dispatch against, another.
    #[test]
    fn selection_change_clears_destructive_confirmations() {
        let mut app = App::default();
        app.oath.confirm_delete = Some(("serial:AAA".into(), "acct".into()));
        app.openpgp.cred_modal = Some(OpenPgpCredModal::new(
            OpenPgpCredKind::Reset,
            Some("serial:AAA".into()),
        ));
        app.security_keys.reset.open = true;

        app.on_device_selected(None);

        assert!(app.oath.confirm_delete.is_none());
        assert!(app.openpgp.cred_modal.is_none());
        assert!(!app.security_keys.reset.open);
    }

    /// The OATH delete confirmation is only armed with a concrete device
    /// captured; the guard then rejects a mismatch at confirm time.
    #[test]
    fn oath_delete_confirmation_is_device_bound() {
        let captured: DeviceId = "serial:AAA".into();
        let other: DeviceId = "serial:BBB".into();
        assert!(completion_still_valid(Some(&captured), Some(&captured)));
        assert!(!completion_still_valid(Some(&captured), Some(&other)));
    }

    /// KEY-005, the audited failure: the armed key exposes no serial of any
    /// kind and a same-VID/PID key appears on a fresh path. It must NOT be
    /// accepted — being the first same-model key to show up is not identity.
    #[test]
    fn reset_rearm_never_accepts_a_serial_less_same_model_key() {
        assert!(!reset_reinsert_matches(
            None,
            None,
            Some((0x1050, 0x0407)),
            None,
            None,
            (0x1050, 0x0407),
        ));
    }

    /// Only a matching *stable* identity re-arms the reset: the HID serial
    /// when both sides have one, else the resolver's effective (CCID) serial.
    /// An unreadable candidate identity fails closed (the poll retries).
    #[test]
    fn reset_rearm_matches_only_the_same_stable_identity() {
        let ids = Some((0x1050, 0x0407));
        // Effective (CCID-read) serial decides when there is no HID serial.
        assert!(reset_reinsert_matches(
            None,
            Some("15731286"),
            ids,
            None,
            Some("15731286"),
            (0x1050, 0x0407)
        ));
        assert!(!reset_reinsert_matches(
            None,
            Some("15731286"),
            ids,
            None,
            Some("9990001"),
            (0x1050, 0x0407)
        ));
        // Candidate identity not readable (yet): fail closed, retry later.
        assert!(!reset_reinsert_matches(
            None,
            Some("15731286"),
            ids,
            None,
            None,
            (0x1050, 0x0407)
        ));
        // HID serial decides when both sides expose one.
        assert!(reset_reinsert_matches(
            Some("S1"),
            None,
            ids,
            Some("S1"),
            None,
            (0x1050, 0x0407)
        ));
        assert!(!reset_reinsert_matches(
            Some("S1"),
            None,
            ids,
            Some("S2"),
            None,
            (0x1050, 0x0407)
        ));
        // A different model never matches, whatever the serials say.
        assert!(!reset_reinsert_matches(
            None,
            Some("15731286"),
            ids,
            None,
            Some("15731286"),
            (0x20a0, 0x42b2)
        ));
    }

    /// The bug this guards against: the kernel reuses a freed hidraw minor
    /// number, so a replug can hand the reinserted key the exact same
    /// `/dev/hidrawN` path the unplugged one had, while its USB device number
    /// (bus/address) has moved on. Reproduced on hardware: `hidraw0` before
    /// and after, `usb 1-3: ... device number 8` then `device number 9`. A
    /// path-only diff would call this candidate "not fresh" and the armed
    /// reset would never fire — the GUI hangs on the touch prompt forever.
    #[test]
    fn same_hid_connection_tells_a_recycled_path_apart_from_the_old_device() {
        let before = HidIdentity {
            path: "/dev/hidraw0".into(),
            usb_bus: Some(1),
            usb_address: Some(8),
        };
        let after_replug = HidIdentity {
            path: "/dev/hidraw0".into(), // recycled by the kernel
            usb_bus: Some(1),
            usb_address: Some(9), // advanced: a genuinely new attach
        };
        assert!(
            !same_hid_connection(&before, &after_replug),
            "same path, different device number: must count as a fresh connection"
        );
    }

    /// A device that never left keeps its bus/address, even if some unrelated
    /// churn elsewhere reshuffled other devices' hidraw paths.
    #[test]
    fn same_hid_connection_recognises_a_device_that_never_left() {
        let seen_before = HidIdentity {
            path: "/dev/hidraw1".into(),
            usb_bus: Some(1),
            usb_address: Some(4),
        };
        let seen_again = HidIdentity {
            path: "/dev/hidraw1".into(),
            usb_bus: Some(1),
            usb_address: Some(4),
        };
        assert!(same_hid_connection(&seen_before, &seen_again));
    }

    /// Without USB topology (the hidapi backend on macOS/Windows exposes
    /// none), identity falls back to the path — the pre-fix behaviour, kept
    /// as the best available signal on those platforms.
    #[test]
    fn same_hid_connection_falls_back_to_path_without_usb_topology() {
        let a = HidIdentity {
            path: "/dev/hidraw0".into(),
            usb_bus: None,
            usb_address: None,
        };
        let b = HidIdentity {
            path: "/dev/hidraw0".into(),
            usb_bus: None,
            usb_address: None,
        };
        let c = HidIdentity {
            path: "/dev/hidraw1".into(),
            usb_bus: None,
            usb_address: None,
        };
        assert!(same_hid_connection(&a, &b));
        assert!(!same_hid_connection(&a, &c));
    }
}

/// Randomized coverage (proptest, dev-only) on top of the example-based tests
/// above, for the pure device-binding guards the audit called out: these are
/// the GUI's fail-closed decisions and live in a binary crate the libfuzzer
/// workspace cannot reach.
#[cfg(test)]
mod prop_tests {
    use super::*;
    use proptest::prelude::*;

    proptest! {
        /// A completion may act only when both the captured and the current
        /// selection exist — `None` on either side always fails closed.
        #[test]
        fn completion_fails_closed_on_any_unbound_side(id in proptest::option::of(".*")) {
            prop_assert!(!completion_still_valid(None, id.as_ref()));
            prop_assert!(!completion_still_valid(id.as_ref(), None));
        }

        /// With both sides bound, the completion acts iff the ids are equal.
        #[test]
        fn completion_requires_exact_id_match(a in ".*", b in ".*") {
            prop_assert_eq!(completion_still_valid(Some(&a), Some(&b)), a == b);
            prop_assert!(completion_still_valid(Some(&a), Some(&a)));
        }

        /// KEY-005: a candidate with no stable identity (no HID serial, no
        /// effective serial) is NEVER accepted for an armed reset, whatever
        /// the armed target looks like — first-same-model-to-appear is not
        /// an identity.
        #[test]
        fn reset_never_accepts_a_serial_less_candidate(
            t_hid in proptest::option::of("[ -~]{0,12}"),
            t_eff in proptest::option::of("[ -~]{0,12}"),
            t_ids in proptest::option::of(any::<(u16, u16)>()),
            cand_ids in any::<(u16, u16)>(),
        ) {
            prop_assert!(!reset_reinsert_matches(
                t_hid.as_deref(),
                t_eff.as_deref(),
                t_ids,
                None,
                None,
                cand_ids,
            ));
        }

        /// A vendor/product-id mismatch rejects the candidate no matter how
        /// well the serials agree.
        #[test]
        fn reset_rejects_model_mismatch_regardless_of_serials(
            serial in "[ -~]{0,12}",
            t_ids in any::<(u16, u16)>(),
            cand_ids in any::<(u16, u16)>(),
        ) {
            prop_assume!(t_ids != cand_ids);
            prop_assert!(!reset_reinsert_matches(
                Some(&serial),
                Some(&serial),
                Some(t_ids),
                Some(&serial),
                Some(&serial),
                cand_ids,
            ));
        }

        /// Acceptance requires a *stable* identity match: when both sides
        /// expose a HID serial that comparison decides alone (the effective
        /// serial can't override it); otherwise both effective serials must
        /// exist and match. Any accepted candidate therefore matched on one
        /// of the two.
        #[test]
        fn reset_accepts_only_on_a_stable_serial_match(
            t_hid in proptest::option::of("[ -~]{0,4}"),
            t_eff in proptest::option::of("[ -~]{0,4}"),
            c_hid in proptest::option::of("[ -~]{0,4}"),
            c_eff in proptest::option::of("[ -~]{0,4}"),
            ids in any::<(u16, u16)>(),
        ) {
            let accepted = reset_reinsert_matches(
                t_hid.as_deref(),
                t_eff.as_deref(),
                Some(ids),
                c_hid.as_deref(),
                c_eff.as_deref(),
                ids,
            );
            let expected = match (&t_hid, &c_hid) {
                (Some(t), Some(c)) => t == c,
                _ => matches!((&t_eff, &c_eff), (Some(t), Some(c)) if t == c),
            };
            prop_assert_eq!(accepted, expected);
        }

        /// The duplicate-serial advisory fires iff some serial repeats, and
        /// names a serial that really is duplicated.
        #[test]
        fn duplicate_note_iff_some_serial_repeats(
            serials in proptest::collection::vec("[A-Z0-9]{0,4}", 0..8),
        ) {
            let note = duplicate_serial_note(serials.iter().map(|s| s.as_str()));
            let mut counts = std::collections::BTreeMap::<&str, usize>::new();
            for s in &serials {
                *counts.entry(s).or_insert(0) += 1;
            }
            let dup = counts.iter().find(|&(_, &n)| n > 1).map(|(s, _)| *s);
            match (note, dup) {
                (None, None) => {}
                (Some(note), Some(serial)) => prop_assert!(
                    note.contains(serial),
                    "advisory must name a duplicated serial: {note:?}"
                ),
                (note, dup) => prop_assert!(
                    false,
                    "advisory presence must track duplication: note={note:?} dup={dup:?}"
                ),
            }
        }
    }
}

#[cfg(test)]
mod piv_relax_tests {
    use super::*;
    use keyroost_piv::compat::{FeatureGate, MgmtAlgChoice, PivExtension};

    #[test]
    fn relax_turns_unsupported_into_unverified_except_reset() {
        let u = FeatureGate::Unsupported;
        assert_eq!(piv_relax(PivExtension::MoveKey, u), FeatureGate::Unverified);
        assert_eq!(piv_relax(PivExtension::Reset, u), FeatureGate::Unsupported);
        assert_eq!(
            piv_relax(PivExtension::GetMetadata, u),
            FeatureGate::Unsupported
        );
        assert_eq!(piv_relax(PivExtension::Attest, u), FeatureGate::Unsupported);
        assert_eq!(
            piv_relax(PivExtension::GetSlotKeyStatus, u),
            FeatureGate::Unsupported
        );
        assert_eq!(
            piv_relax(PivExtension::ResetGlobal, u),
            FeatureGate::Unsupported
        );
        assert_eq!(
            piv_relax(
                PivExtension::ManagementKeyAlgorithm(MgmtAlgChoice::Delete),
                u
            ),
            FeatureGate::Unsupported
        );
        assert_eq!(
            piv_relax(PivExtension::MoveKey, FeatureGate::Supported),
            FeatureGate::Supported
        );
    }
}