From 7d0f9827656b5457528f347679c4081b95f826c5 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Mon, 12 Oct 2026 10:37:51 +0200
Subject: [PATCH 1/9] feat(extension): add theme switching and the Settings
 tab's first section (ext-theme)

Theme offers System default, Light and Dark, stored globally in `settings.global` so it also applies before an account is unlocked. The popup mirrors it in localStorage to paint the first frame in the right theme. The Settings tab lists its six sections; Appearance opens, the rest wait for ext-settings, which is trimmed to build on this change.
---
 browser-extension/ARCHITECTURE.md             |   3 +
 browser-extension/entrypoints/popup/App.tsx   |   2 +
 .../entrypoints/popup/components/Icon.tsx     |   4 +
 .../entrypoints/popup/components/Select.tsx   |  30 ++++++
 .../popup/components/components.test.tsx      |  13 +++
 .../entrypoints/popup/hooks/useSettings.ts    |  32 ++++++
 .../entrypoints/popup/hooks/useTheme.ts       |  18 ++++
 browser-extension/entrypoints/popup/main.tsx  |   2 +
 browser-extension/entrypoints/popup/popup.css |  11 +-
 .../entrypoints/popup/testing.ts              |   8 +-
 .../entrypoints/popup/theme.test.ts           |  46 ++++++++
 browser-extension/entrypoints/popup/theme.ts  |  39 +++++++
 .../entrypoints/popup/views/Placeholder.tsx   |   2 +-
 .../entrypoints/popup/views/Shell.test.tsx    |   6 +-
 .../entrypoints/popup/views/Shell.tsx         |  12 ++-
 .../popup/views/settings/Appearance.tsx       |  27 +++++
 .../popup/views/settings/Settings.test.tsx    | 101 ++++++++++++++++++
 .../popup/views/settings/Settings.tsx         |   7 ++
 .../popup/views/settings/SettingsIndex.tsx    |  48 +++++++++
 browser-extension/locales/en.yml              |  12 +++
 browser-extension/locales/nl.yml              |  12 +++
 browser-extension/openspec/README.md          |   7 +-
 .../openspec/changes/ext-settings/design.md   |  14 +--
 .../openspec/changes/ext-settings/proposal.md |  17 +--
 .../ext-settings/specs/settings/spec.md       |  14 +--
 .../openspec/changes/ext-settings/tasks.md    |  14 +--
 .../openspec/changes/ext-theme/design.md      |  63 +++++++++++
 .../openspec/changes/ext-theme/proposal.md    |  47 ++++++++
 .../changes/ext-theme/specs/theme/spec.md     |  96 +++++++++++++++++
 .../openspec/changes/ext-theme/tasks.md       |  29 +++++
 .../src/background/requests.test.ts           |  22 ++++
 browser-extension/src/background/requests.ts  |   7 ++
 browser-extension/src/messages.ts             |  13 +++
 browser-extension/src/settings/global.test.ts |  27 +++++
 browser-extension/src/settings/global.ts      |  22 ++++
 docs/browser-extension/privacy.md             |   3 +
 docs/browser-extension/using.md               |   6 +-
 37 files changed, 793 insertions(+), 43 deletions(-)
 create mode 100644 browser-extension/entrypoints/popup/components/Select.tsx
 create mode 100644 browser-extension/entrypoints/popup/hooks/useSettings.ts
 create mode 100644 browser-extension/entrypoints/popup/hooks/useTheme.ts
 create mode 100644 browser-extension/entrypoints/popup/theme.test.ts
 create mode 100644 browser-extension/entrypoints/popup/theme.ts
 create mode 100644 browser-extension/entrypoints/popup/views/settings/Appearance.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/settings/Settings.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
 create mode 100644 browser-extension/openspec/changes/ext-theme/design.md
 create mode 100644 browser-extension/openspec/changes/ext-theme/proposal.md
 create mode 100644 browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
 create mode 100644 browser-extension/openspec/changes/ext-theme/tasks.md
 create mode 100644 browser-extension/src/settings/global.test.ts
 create mode 100644 browser-extension/src/settings/global.ts

diff --git a/browser-extension/ARCHITECTURE.md b/browser-extension/ARCHITECTURE.md
index d6db4be78..5b2e9cec1 100644
--- a/browser-extension/ARCHITECTURE.md
+++ b/browser-extension/ARCHITECTURE.md
@@ -20,6 +20,7 @@ How the extension is put together. Decisions live in the ADRs under [openspec/ar
   - `settings.ts`: the per-account timeout settings and the policy clamp.
   - `verify.ts`: checks credentials before an account is stored.
   - `normalize-server-url.ts`: turns whatever was typed into a server URL.
+- `src/settings/global.ts`: settings that apply before an account is chosen, today the theme.
 - `src/vault/`:
   - `key-store.ts`: where the unlocked key lives ([ADR-002](openspec/architecture/adr-002-key-lifetime-and-vault-cache.md)).
   - `unlock.ts`: unlock, lock and the suite checks.
@@ -63,6 +64,8 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | `accounts` | local | Account records, app passwords included |
 | `activeAccountId` | local | The active account; heals itself when it points nowhere |
 | `settings.<id>` | local | Vault timeout and action |
+| `settings.global` | local | The theme; survives logout |
+| `keepiq.theme` | popup `localStorage` | A mirror of the theme for the first frame, never read by the background |
 | `suite.<id>` | local | The active suite row, private key still wrapped |
 | `vaultCache.<id>` | local | The snapshot: secret rows, folders, types, suite id and epoch, counts |
 | `vaultCheckedAt.<id>` | local | When the server was last checked |
diff --git a/browser-extension/entrypoints/popup/App.tsx b/browser-extension/entrypoints/popup/App.tsx
index f22797344..5831cebb7 100644
--- a/browser-extension/entrypoints/popup/App.tsx
+++ b/browser-extension/entrypoints/popup/App.tsx
@@ -5,6 +5,7 @@ import { Header } from './components/Header'
 import { Loading } from './components/Loading'
 import { useBackgroundMessage } from './hooks/useBackgroundMessage'
 import { usePopupState } from './hooks/usePopupState'
+import { useTheme } from './hooks/useTheme'
 import { AccountSwitcher } from './views/AccountSwitcher'
 import { AddAccount } from './views/AddAccount'
 import { LogInAgain } from './views/LogInAgain'
@@ -16,6 +17,7 @@ type Panel = 'switcher' | 'add_account' | null
 
 export default function App() {
 	const { state, error, dispatch } = usePopupState()
+	useTheme()
 	const [panel, setPanel] = useState<Panel>(null)
 	const refreshState = useCallback(() => void dispatch({ kind: 'vault.status', passive: true }), [dispatch])
 	// A lock from the timeout or another window swaps this popup to the unlock view.
diff --git a/browser-extension/entrypoints/popup/components/Icon.tsx b/browser-extension/entrypoints/popup/components/Icon.tsx
index 1c78a8041..9332176ce 100644
--- a/browser-extension/entrypoints/popup/components/Icon.tsx
+++ b/browser-extension/entrypoints/popup/components/Icon.tsx
@@ -16,6 +16,10 @@ const PATHS = {
 	search: <><circle cx="11" cy="11" r="7" /><path d="m21 21-4.3-4.3" /></>,
 	close: <path d="M18 6 6 18M6 6l12 12" />,
 	chevronDown: <path d="m6 9 6 6 6-6" />,
+	chevronRight: <path d="m9 18 6-6-6-6" />,
+	bell: <><path d="M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9" /><path d="M10.3 21a1.94 1.94 0 0 0 3.4 0" /></>,
+	info: <><circle cx="12" cy="12" r="9" /><path d="M12 16v-4M12 8h.01" /></>,
+	contrast: <><circle cx="12" cy="12" r="9" /><path d="M12 18a6 6 0 0 0 0-12z" /></>,
 	folder: <path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.7-.9l-.8-1.2A2 2 0 0 0 7.9 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z" />,
 	refresh: <><path d="M3 12a9 9 0 0 1 15.7-6L21 8" /><path d="M21 3v5h-5" /><path d="M21 12a9 9 0 0 1-15.7 6L3 16" /><path d="M8 16H3v5" /></>,
 	blocked: <><circle cx="12" cy="12" r="9" /><path d="m5.6 5.6 12.8 12.8" /></>,
diff --git a/browser-extension/entrypoints/popup/components/Select.tsx b/browser-extension/entrypoints/popup/components/Select.tsx
new file mode 100644
index 000000000..6e30b1e7e
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/Select.tsx
@@ -0,0 +1,30 @@
+import { useId } from 'react'
+import { Icon } from './Icon'
+
+export interface SelectOption<T extends string> {
+	value: T
+	label: string
+}
+
+interface Props<T extends string> {
+	label: string
+	value: T
+	options: SelectOption<T>[]
+	onChange: (value: T) => void
+	disabled?: boolean
+}
+
+export function Select<T extends string>({ label, value, options, onChange, disabled }: Props<T>) {
+	const id = useId()
+	return (
+		<div className="field">
+			<label className="field__label" htmlFor={id}>{label}</label>
+			<div className="select">
+				<select id={id} className="select__input" value={value} disabled={disabled} onChange={(event) => onChange(event.target.value as T)}>
+					{options.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}
+				</select>
+				<Icon name="chevronDown" />
+			</div>
+		</div>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/components.test.tsx b/browser-extension/entrypoints/popup/components/components.test.tsx
index 7bf803aeb..e38117732 100644
--- a/browser-extension/entrypoints/popup/components/components.test.tsx
+++ b/browser-extension/entrypoints/popup/components/components.test.tsx
@@ -9,6 +9,7 @@ import { Avatar, initials } from './Avatar'
 import { Button } from './Button'
 import { Header } from './Header'
 import { MaskedField } from './MaskedField'
+import { Select } from './Select'
 import { TabBar } from './TabBar'
 import { Toast } from './Toast'
 import { ShellContext } from '../shell-context'
@@ -92,6 +93,18 @@ describe('TabBar', () => {
 	})
 })
 
+describe('Select', () => {
+	it('is named by its label and reports the chosen value', async () => {
+		const onChange = vi.fn()
+		const options = [{ value: 'a', label: 'First' }, { value: 'b', label: 'Second' }]
+		render(<Select label="Pick" value="a" options={options} onChange={onChange} />)
+		const select = screen.getByRole<HTMLSelectElement>('combobox', { name: 'Pick' })
+		expect(select.value).toBe('a')
+		await userEvent.setup().selectOptions(select, 'Second')
+		expect(onChange).toHaveBeenCalledWith('b')
+	})
+})
+
 describe('Toast', () => {
 	it('keeps its live region mounted while empty', () => {
 		const { rerender } = render(<Toast message={null} />)
diff --git a/browser-extension/entrypoints/popup/hooks/useSettings.ts b/browser-extension/entrypoints/popup/hooks/useSettings.ts
new file mode 100644
index 000000000..4a2b48a44
--- /dev/null
+++ b/browser-extension/entrypoints/popup/hooks/useSettings.ts
@@ -0,0 +1,32 @@
+import { useCallback, useEffect, useState } from 'react'
+import type { GlobalSettings } from '@/src/messages'
+import { showTheme } from '../theme'
+import { request } from './useMessage'
+
+/** `failed`: the background did not answer the last read or write, which left the stored values as they were. */
+export function useSettings() {
+	const [settings, setSettings] = useState<GlobalSettings | null>(null)
+	const [failed, setFailed] = useState(false)
+
+	useEffect(() => {
+		let live = true
+		void request({ kind: 'settings.get' }).then((reply) => {
+			if (!live) return
+			if (reply) setSettings(reply)
+			else setFailed(true)
+		})
+		return () => {
+			live = false
+		}
+	}, [])
+
+	const update = useCallback(async (patch: Partial<GlobalSettings>) => {
+		const reply = await request({ kind: 'settings.set', patch })
+		setFailed(!reply)
+		if (!reply) return
+		setSettings(reply)
+		showTheme(reply.theme)
+	}, [])
+
+	return { settings, failed, update }
+}
diff --git a/browser-extension/entrypoints/popup/hooks/useTheme.ts b/browser-extension/entrypoints/popup/hooks/useTheme.ts
new file mode 100644
index 000000000..279594bb4
--- /dev/null
+++ b/browser-extension/entrypoints/popup/hooks/useTheme.ts
@@ -0,0 +1,18 @@
+import { useEffect } from 'react'
+import { followMirror, showTheme } from '../theme'
+import { request } from './useMessage'
+
+/** Keeps every screen in the stored theme, including those before an account is chosen. */
+export function useTheme() {
+	useEffect(() => {
+		let live = true
+		void request({ kind: 'settings.get' }).then((settings) => {
+			if (live && settings) showTheme(settings.theme)
+		})
+		window.addEventListener('storage', followMirror)
+		return () => {
+			live = false
+			window.removeEventListener('storage', followMirror)
+		}
+	}, [])
+}
diff --git a/browser-extension/entrypoints/popup/main.tsx b/browser-extension/entrypoints/popup/main.tsx
index 9594bbbee..a4c585de7 100644
--- a/browser-extension/entrypoints/popup/main.tsx
+++ b/browser-extension/entrypoints/popup/main.tsx
@@ -3,10 +3,12 @@ import { createRoot } from 'react-dom/client'
 import App from './App'
 import { language } from './i18n'
 import { holdPopupPort } from './port'
+import { applyTheme, mirroredTheme } from './theme'
 
 holdPopupPort()
 // Screen readers pick their voice by it.
 document.documentElement.lang = language()
+applyTheme(mirroredTheme())
 
 createRoot(document.getElementById('root')!).render(
 	<StrictMode>
diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index c011ed835..eda63cc0b 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -29,7 +29,7 @@
 	--shadow: 0 4px 16px rgb(16 24 40 / 0.14);
 }
 
-/* Dark follows the system unless ext-settings pins a theme with `data-theme`. */
+/* Dark follows the system unless the Theme setting pins one with `data-theme` (`theme.ts`). */
 @media (prefers-color-scheme: dark) {
 	:root:not([data-theme='light']) {
 		--bg: #14171c;
@@ -595,15 +595,20 @@ a {
 	color: var(--fg-muted);
 }
 
-.menu__item:hover:not(:disabled) {
+.menu__item:hover:not(:disabled, [aria-disabled='true']) {
 	background: var(--surface-hover);
 }
 
-.menu__item:disabled {
+.menu__item:is(:disabled, [aria-disabled='true']) {
 	opacity: 0.45;
 	cursor: not-allowed;
 }
 
+/* Pushes a trailing chevron to the row's edge. */
+.menu__label {
+	flex: 1;
+}
+
 .menu__item--danger,
 .menu__item--danger .icon {
 	color: var(--danger);
diff --git a/browser-extension/entrypoints/popup/testing.ts b/browser-extension/entrypoints/popup/testing.ts
index d976a93de..ef0984582 100644
--- a/browser-extension/entrypoints/popup/testing.ts
+++ b/browser-extension/entrypoints/popup/testing.ts
@@ -1,5 +1,5 @@
 import { vi } from 'vitest'
-import type { AccountSummary, DecryptField, DecryptedItem, ItemMeta, PopupState, PopupTab, Result, TypeMeta, VaultSnapshotReply } from '@/src/messages'
+import type { AccountSummary, DecryptField, DecryptedItem, GlobalSettings, ItemMeta, PopupState, PopupTab, Result, TypeMeta, VaultSnapshotReply } from '@/src/messages'
 
 export function account(overrides: Partial<AccountSummary> = {}): AccountSummary {
 	return {
@@ -71,14 +71,18 @@ interface FakeBackground {
 	tabUrl?: string
 	/** Kinds the background fails on, which reaches the popup as no reply. */
 	unanswered?: string[]
+	settings?: GlobalSettings
 }
 
 /** Answers each message kind the way the background would; returns the spy to inspect what was sent. */
 export function fakeBackground(options: FakeBackground = {}) {
 	const state = options.state ?? popupState({ screen: 'unlocked', active: account({ status: 'unlocked' }), lastTab: options.lastTab ?? 'vault' })
-	const reply = vi.fn(async (message: { kind: string; ids?: string[]; fields?: DecryptField[] }): Promise<unknown> => {
+	let settings: GlobalSettings = options.settings ?? { theme: 'system' }
+	const reply = vi.fn(async (message: { kind: string; ids?: string[]; fields?: DecryptField[]; patch?: Partial<GlobalSettings> }): Promise<unknown> => {
 		if (options.unanswered?.includes(message.kind)) return undefined
 		switch (message.kind) {
+			case 'settings.get': return settings
+			case 'settings.set': return (settings = { ...settings, ...message.patch })
 			case 'vault.snapshot': return options.snapshot ?? snapshotReply()
 			case 'vault.sync': return (options.snapshot as UnlockedSnapshot | undefined)?.sync ?? snapshotReply().sync
 			case 'item.decrypt': {
diff --git a/browser-extension/entrypoints/popup/theme.test.ts b/browser-extension/entrypoints/popup/theme.test.ts
new file mode 100644
index 000000000..ffd451414
--- /dev/null
+++ b/browser-extension/entrypoints/popup/theme.test.ts
@@ -0,0 +1,46 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { applyTheme, followMirror, mirroredTheme, showTheme, THEME_MIRROR_KEY } from './theme'
+
+const attribute = () => document.documentElement.dataset.theme
+
+afterEach(() => {
+	vi.restoreAllMocks()
+	localStorage.clear()
+	applyTheme('system')
+})
+
+describe('theme', () => {
+	it('pins light and dark, and leaves System default to the media query', () => {
+		applyTheme('dark')
+		expect(attribute()).toBe('dark')
+		applyTheme('light')
+		expect(attribute()).toBe('light')
+		applyTheme('system')
+		expect(attribute()).toBeUndefined()
+	})
+
+	it('mirrors what it shows, and reads anything unknown as System default', () => {
+		expect(mirroredTheme()).toBe('system')
+		showTheme('light')
+		expect(attribute()).toBe('light')
+		expect(mirroredTheme()).toBe('light')
+		localStorage.setItem(THEME_MIRROR_KEY, 'nord')
+		expect(mirroredTheme()).toBe('system')
+	})
+
+	it('still applies when localStorage throws', () => {
+		vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => { throw new DOMException('Blocked', 'SecurityError') })
+		vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => { throw new DOMException('Blocked', 'SecurityError') })
+		expect(mirroredTheme()).toBe('system')
+		showTheme('dark')
+		expect(attribute()).toBe('dark')
+	})
+
+	it('follows a change written by another window, and nothing else', () => {
+		followMirror(new StorageEvent('storage', { key: 'other', newValue: 'dark' }))
+		expect(attribute()).toBeUndefined()
+		followMirror(new StorageEvent('storage', { key: THEME_MIRROR_KEY, newValue: 'dark' }))
+		expect(attribute()).toBe('dark')
+	})
+})
diff --git a/browser-extension/entrypoints/popup/theme.ts b/browser-extension/entrypoints/popup/theme.ts
new file mode 100644
index 000000000..1d563da32
--- /dev/null
+++ b/browser-extension/entrypoints/popup/theme.ts
@@ -0,0 +1,39 @@
+import { THEMES, type Theme } from '@/src/messages'
+
+/**
+ * A display cache of `settings.global`, read before mounting so a pinned theme paints the first frame.
+ * `storage.local` stays the source of truth (ext-theme design).
+ */
+export const THEME_MIRROR_KEY = 'keepiq.theme'
+
+const isTheme = (value: unknown): value is Theme => THEMES.includes(value as never)
+
+/** System default sets no attribute, so `popup.css`'s `prefers-color-scheme` query decides. */
+export function applyTheme(theme: Theme) {
+	if (theme === 'system') delete document.documentElement.dataset.theme
+	else document.documentElement.dataset.theme = theme
+}
+
+// localStorage can be missing or throw, for example with site data blocked.
+export function mirroredTheme(): Theme {
+	try {
+		const stored = localStorage.getItem(THEME_MIRROR_KEY)
+		return isTheme(stored) ? stored : 'system'
+	} catch {
+		return 'system'
+	}
+}
+
+/** Writing the mirror also repaints other open extension pages, through their `storage` event. */
+export function showTheme(theme: Theme) {
+	applyTheme(theme)
+	try {
+		localStorage.setItem(THEME_MIRROR_KEY, theme)
+	} catch {
+		// The background's value still applies on every open.
+	}
+}
+
+export function followMirror(event: StorageEvent) {
+	if (event.key === THEME_MIRROR_KEY) applyTheme(isTheme(event.newValue) ? event.newValue : 'system')
+}
diff --git a/browser-extension/entrypoints/popup/views/Placeholder.tsx b/browser-extension/entrypoints/popup/views/Placeholder.tsx
index d7edb6a19..e2cd9917e 100644
--- a/browser-extension/entrypoints/popup/views/Placeholder.tsx
+++ b/browser-extension/entrypoints/popup/views/Placeholder.tsx
@@ -2,7 +2,7 @@ import { i18n } from '#i18n'
 import { EmptyState } from '../components/EmptyState'
 import type { IconName } from '../components/Icon'
 
-/** Generator, Send and Settings until their changes replace it. */
+/** Generator and Send until their changes replace it. */
 export function Placeholder({ icon, title }: { icon: IconName; title: string }) {
 	return (
 		<EmptyState icon={icon} title={title}>
diff --git a/browser-extension/entrypoints/popup/views/Shell.test.tsx b/browser-extension/entrypoints/popup/views/Shell.test.tsx
index 19f805883..77dedb89b 100644
--- a/browser-extension/entrypoints/popup/views/Shell.test.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.test.tsx
@@ -28,11 +28,11 @@ describe('Shell', () => {
 		const sent = fakeBackground()
 		render(<App />)
 		await title()
-		await userEvent.setup().click(screen.getByRole('button', { name: 'Settings' }))
-		expect((await title()).textContent).toBe('Settings')
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Generator' }))
+		expect((await title()).textContent).toBe('Generator')
 		expect(screen.getByText('This arrives in a later update.')).toBeTruthy()
 		expect(screen.queryByRole('searchbox')).toBeNull()
-		expect(sent).toHaveBeenCalledWith({ kind: 'popup.lastTab.set', tab: 'settings' })
+		expect(sent).toHaveBeenCalledWith({ kind: 'popup.lastTab.set', tab: 'generator' })
 	})
 
 	it('reopens on the last tab from its first frame', async () => {
diff --git a/browser-extension/entrypoints/popup/views/Shell.tsx b/browser-extension/entrypoints/popup/views/Shell.tsx
index ddc186544..ca6652819 100644
--- a/browser-extension/entrypoints/popup/views/Shell.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.tsx
@@ -13,6 +13,8 @@ import { useVaultSnapshot } from '../hooks/useVaultSnapshot'
 import { ShellContext } from '../shell-context'
 import { ItemDetail } from './ItemDetail'
 import { Placeholder } from './Placeholder'
+import { Settings } from './settings/Settings'
+import { sectionLabel, type SettingsSection } from './settings/SettingsIndex'
 import { VaultList } from './VaultList'
 
 const TOAST_MS = 2500
@@ -32,6 +34,7 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	// Read once: a later state refresh must not pull the user off the tab they picked.
 	const [current, setCurrent] = useState(lastTab)
 	const [detailId, setDetailId] = useState<string | null>(null)
+	const [section, setSection] = useState<SettingsSection | null>(null)
 	// A fresh object per call, so the same message twice restarts the timer.
 	const [toast, setToast] = useState<{ text: string } | null>(null)
 	const body = useRef<HTMLDivElement>(null)
@@ -67,6 +70,7 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	function select(next: PopupTab) {
 		setCurrent(next)
 		setDetailId(null)
+		setSection(null)
 		void request({ kind: 'popup.lastTab.set', tab: next })
 	}
 
@@ -95,11 +99,15 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 					</>
 				)
 				: <Loading />
+	} else if (current === 'settings') {
+		content = <Settings section={section} onOpen={setSection} />
 	} else {
 		content = <Placeholder icon={TABS.find((t) => t.id === current)!.icon} title={tabLabel(current)} />
 	}
 
-	const title = detail ? i18n.t('titles.viewItem') : tabLabel(current)
+	const inSection = current === 'settings' && section !== null
+	const title = detail ? i18n.t('titles.viewItem') : inSection ? sectionLabel(section) : tabLabel(current)
+	const back = detail ? () => setDetailId(null) : inSection ? () => setSection(null) : undefined
 
 	return (
 		<ShellContext.Provider value={context}>
@@ -108,7 +116,7 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 					title={title}
 					active={active}
 					onAvatarClick={onAccounts}
-					onBack={detail ? () => setDetailId(null) : undefined}
+					onBack={back}
 					onPopout={isPopout ? undefined : () => void popout()}
 				/>
 				<div className="popup__body" ref={body}>{content}</div>
diff --git a/browser-extension/entrypoints/popup/views/settings/Appearance.tsx b/browser-extension/entrypoints/popup/views/settings/Appearance.tsx
new file mode 100644
index 000000000..e4d555582
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/Appearance.tsx
@@ -0,0 +1,27 @@
+import { i18n } from '#i18n'
+import type { Theme } from '@/src/messages'
+import { ErrorBanner } from '../../components/ErrorBanner'
+import { Loading } from '../../components/Loading'
+import { Select } from '../../components/Select'
+import { errorText } from '../../errors'
+import { useSettings } from '../../hooks/useSettings'
+
+export function Appearance() {
+	const { settings, failed, update } = useSettings()
+	if (!settings) return failed ? <ErrorBanner>{errorText('not_responding', '')}</ErrorBanner> : <Loading />
+	return (
+		<div className="stack">
+			{failed && <ErrorBanner>{errorText('not_responding', '')}</ErrorBanner>}
+			<Select<Theme>
+				label={i18n.t('settings.theme')}
+				value={settings.theme}
+				options={[
+					{ value: 'system', label: i18n.t('settings.themeSystem') },
+					{ value: 'light', label: i18n.t('settings.themeLight') },
+					{ value: 'dark', label: i18n.t('settings.themeDark') },
+				]}
+				onChange={(theme) => void update({ theme })}
+			/>
+		</div>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
new file mode 100644
index 000000000..572ead587
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
@@ -0,0 +1,101 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import App from '../../App'
+import { everythingVisible, fakeBackground, popupState } from '../../testing'
+import { applyTheme, THEME_MIRROR_KEY } from '../../theme'
+
+afterEach(() => {
+	cleanup()
+	localStorage.clear()
+	applyTheme('system')
+})
+beforeEach(everythingVisible)
+
+const title = () => screen.findByRole('heading', { level: 1 })
+const theme = () => document.documentElement.dataset.theme
+
+async function openSettings() {
+	const user = userEvent.setup()
+	render(<App />)
+	await title()
+	await user.click(within(screen.getByRole('navigation', { name: 'Main' })).getByRole('button', { name: 'Settings' }))
+	return user
+}
+
+describe('Settings', () => {
+	it('lists the sections in order, with only Appearance open', async () => {
+		fakeBackground()
+		const user = await openSettings()
+		const rows = within(screen.getByRole('list')).getAllByRole('button')
+		expect(rows.map((row) => row.textContent)).toEqual(['Account security', 'Autofill', 'Notifications', 'Vault', 'Appearance', 'About'])
+		const unbuilt = rows.filter((row) => row.getAttribute('aria-disabled') === 'true')
+		expect(unbuilt.map((row) => row.textContent)).toEqual(['Account security', 'Autofill', 'Notifications', 'Vault', 'About'])
+		expect(unbuilt.every((row) => row.title === 'Available in a later update')).toBe(true)
+		await user.click(rows[0]!)
+		expect((await title()).textContent).toBe('Settings')
+	})
+
+	it('opens Appearance with the stored theme and goes back to the list', async () => {
+		fakeBackground({ settings: { theme: 'light' } })
+		const user = await openSettings()
+		await user.click(screen.getByRole('button', { name: 'Appearance' }))
+		expect((await title()).textContent).toBe('Appearance')
+		expect((await screen.findByRole<HTMLSelectElement>('combobox', { name: 'Theme' })).value).toBe('light')
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		expect((await title()).textContent).toBe('Settings')
+		expect(screen.getByRole('button', { name: 'Appearance' })).toBeTruthy()
+	})
+
+	it('repaints and mirrors a new theme at once', async () => {
+		const sent = fakeBackground()
+		const user = await openSettings()
+		await user.click(screen.getByRole('button', { name: 'Appearance' }))
+		await user.selectOptions(await screen.findByRole('combobox', { name: 'Theme' }), 'Dark')
+		expect(sent).toHaveBeenCalledWith({ kind: 'settings.set', patch: { theme: 'dark' } })
+		await waitFor(() => expect(theme()).toBe('dark'))
+		expect(localStorage.getItem(THEME_MIRROR_KEY)).toBe('dark')
+	})
+
+	it('keeps the stored theme when the background does not answer', async () => {
+		fakeBackground({ unanswered: ['settings.set'] })
+		const user = await openSettings()
+		await user.click(screen.getByRole('button', { name: 'Appearance' }))
+		const select = await screen.findByRole<HTMLSelectElement>('combobox', { name: 'Theme' })
+		await user.selectOptions(select, 'Dark')
+		await screen.findByText('Keepiq is not responding. Reload the extension and reopen this popup.')
+		expect(select.value).toBe('system')
+		expect(theme()).toBeUndefined()
+	})
+
+	it('returns to the list after leaving the tab', async () => {
+		fakeBackground()
+		const user = await openSettings()
+		await user.click(screen.getByRole('button', { name: 'Appearance' }))
+		const tabs = within(screen.getByRole('navigation', { name: 'Main' }))
+		await user.click(tabs.getByRole('button', { name: 'Vault' }))
+		await user.click(tabs.getByRole('button', { name: 'Settings' }))
+		expect((await title()).textContent).toBe('Settings')
+		expect(screen.queryByRole('combobox', { name: 'Theme' })).toBeNull()
+	})
+})
+
+describe('the stored theme', () => {
+	it('applies to the unlock screen and replaces a stale mirror', async () => {
+		localStorage.setItem(THEME_MIRROR_KEY, 'light')
+		fakeBackground({ state: popupState({ screen: 'unlock' }), settings: { theme: 'dark' } })
+		render(<App />)
+		expect((await title()).textContent).toBe('Unlock')
+		await waitFor(() => expect(theme()).toBe('dark'))
+		expect(localStorage.getItem(THEME_MIRROR_KEY)).toBe('dark')
+	})
+
+	it('follows a change made in another window', async () => {
+		fakeBackground()
+		render(<App />)
+		await title()
+		window.dispatchEvent(new StorageEvent('storage', { key: THEME_MIRROR_KEY, newValue: 'light' }))
+		expect(theme()).toBe('light')
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.tsx
new file mode 100644
index 000000000..5995b1d34
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.tsx
@@ -0,0 +1,7 @@
+import { Appearance } from './Appearance'
+import { SettingsIndex, type SettingsSection } from './SettingsIndex'
+
+/** The Settings tab: the section list, or the open section. Shell owns which, for its title and back control. */
+export function Settings({ section, onOpen }: { section: SettingsSection | null; onOpen: (section: SettingsSection) => void }) {
+	return section === 'appearance' ? <Appearance /> : <SettingsIndex onOpen={onOpen} />
+}
diff --git a/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx b/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
new file mode 100644
index 000000000..67cc4ebba
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
@@ -0,0 +1,48 @@
+import { i18n } from '#i18n'
+import { Icon, type IconName } from '../../components/Icon'
+
+export type SettingsSection = 'accountSecurity' | 'autofill' | 'notifications' | 'vault' | 'appearance' | 'about'
+
+/** Bitwarden's order (ADR-001); ext-settings fills in the rest. */
+const SECTIONS: { id: SettingsSection; icon: IconName }[] = [
+	{ id: 'accountSecurity', icon: 'shield' },
+	{ id: 'autofill', icon: 'key' },
+	{ id: 'notifications', icon: 'bell' },
+	{ id: 'vault', icon: 'vault' },
+	{ id: 'appearance', icon: 'contrast' },
+	{ id: 'about', icon: 'info' },
+]
+
+const BUILT: ReadonlySet<SettingsSection> = new Set(['appearance'])
+
+export function sectionLabel(section: SettingsSection): string {
+	switch (section) {
+		case 'accountSecurity': return i18n.t('settings.accountSecurity')
+		case 'autofill': return i18n.t('settings.autofill')
+		case 'notifications': return i18n.t('settings.notifications')
+		case 'vault': return i18n.t('settings.vault')
+		case 'appearance': return i18n.t('settings.appearance')
+		case 'about': return i18n.t('settings.about')
+	}
+}
+
+export function SettingsIndex({ onOpen }: { onOpen: (section: SettingsSection) => void }) {
+	const later = i18n.t('common.later')
+	return (
+		<ul className="card menu">
+			{SECTIONS.map(({ id, icon }) => {
+				const built = BUILT.has(id)
+				return (
+					<li key={id}>
+						{/* `aria-disabled` keeps it focusable, so the reason can be read. */}
+						<button type="button" className="menu__item" aria-disabled={built ? undefined : true} title={built ? undefined : later} onClick={built ? () => onOpen(id) : undefined}>
+							<Icon name={icon} />
+							<span className="menu__label">{sectionLabel(id)}</span>
+							<Icon name="chevronRight" />
+						</button>
+					</li>
+				)
+			})}
+		</ul>
+	)
+}
diff --git a/browser-extension/locales/en.yml b/browser-extension/locales/en.yml
index e32fc6465..d6eee5563 100644
--- a/browser-extension/locales/en.yml
+++ b/browser-extension/locales/en.yml
@@ -197,3 +197,15 @@ totp:
   changesIn:
     1: Changes in 1 second
     n: Changes in $1 seconds
+
+settings:
+  accountSecurity: Account security
+  autofill: Autofill
+  notifications: Notifications
+  vault: Vault
+  appearance: Appearance
+  about: About
+  theme: Theme
+  themeSystem: System default
+  themeLight: Light
+  themeDark: Dark
diff --git a/browser-extension/locales/nl.yml b/browser-extension/locales/nl.yml
index 978a5ddaf..815a39b84 100644
--- a/browser-extension/locales/nl.yml
+++ b/browser-extension/locales/nl.yml
@@ -196,3 +196,15 @@ totp:
   changesIn:
     1: Wijzigt over 1 seconde
     n: Wijzigt over $1 seconden
+
+settings:
+  accountSecurity: Accountbeveiliging
+  autofill: Automatisch invullen
+  notifications: Meldingen
+  vault: Kluis
+  appearance: Weergave
+  about: Over
+  theme: Thema
+  themeSystem: Systeemstandaard
+  themeLight: Licht
+  themeDark: Donker
diff --git a/browser-extension/openspec/README.md b/browser-extension/openspec/README.md
index 253c098d4..370474116 100644
--- a/browser-extension/openspec/README.md
+++ b/browser-extension/openspec/README.md
@@ -18,9 +18,10 @@ Changes build on each other in this order. Each proposal lists its predecessors
 3. `ext-vault-edit`: add, edit, delete, clone, move, folders
 4. `ext-generator`: password, passphrase and username generator
 5. `ext-send`: ephemeral sends
-6. `ext-settings`: the Settings tab
-7. `ext-autofill`: fill from popup, context menu, shortcut, save and update prompts
-8. `ext-toolbar-icon`: logged out, locked and unlocked icon, badge counter of matching logins
+6. `ext-theme`: the Theme setting, the Settings tab's section list and its Appearance view
+7. `ext-settings`: the rest of the Settings tab
+8. `ext-autofill`: fill from popup, context menu, shortcut, save and update prompts
+9. `ext-toolbar-icon`: logged out, locked and unlocked icon, badge counter of matching logins
 
 Later slices not yet specced: inline autofill menu, passkey provider, TOTP autofill, card and identity fill, password history, import and export. Website icons wait on a Keepiq change that stores a favicon on the secret (ADR-002).
 
diff --git a/browser-extension/openspec/changes/ext-settings/design.md b/browser-extension/openspec/changes/ext-settings/design.md
index 27e938983..1bee87253 100644
--- a/browser-extension/openspec/changes/ext-settings/design.md
+++ b/browser-extension/openspec/changes/ext-settings/design.md
@@ -22,7 +22,7 @@ Server facts used here, verified in the Keepiq app: `SettingsController::getUser
 ## Decisions
 
 - **One schema module, scoped keys.** `src/settings/schema.ts` exports a `SETTINGS` table of `{ key, scope: 'account' | 'global' | 'server', default, validate }` and the derived `SettingsValues` type. Every read passes through `validate` and falls back to the default, so an old or hand-edited record can never produce an unexpected type. Alternative: per-module keys with local defaults, which is what produced Bitwarden's settings drift.
-- **Two records, not one per key.** Account settings live in `storage.local` under `settings:<accountId>`, global (Appearance) under `settings:global`. One read per render, one write per change, and account removal deletes one key. Alternative: a key per setting, which needs a prefix scan to clear.
+- **Two records, not one per key.** Account settings live in `storage.local` under `settings.<accountId>`, global (Appearance) under ext-theme's `settings.global`. One read per render, one write per change, and account removal deletes one key. Alternative: a key per setting, which needs a prefix scan to clear.
 - **Appearance is global.** Theme must apply to the unlock and account-picker screens before an account is chosen, so it cannot be per account. Every other setting is per account because Bitwarden scopes them that way.
 - **The background owns reads and writes; components go through hooks.** The `useSettings` hook sends `settings.get` and `settings.set`, applies `applyPolicy` to the returned values for display, and hands views the clamped values plus the policy for labels. The background validates, writes and returns the full snapshot, and applies the same `applyPolicy` for enforcement. No component touches `browser.storage` or the API client (ADR-004). `settings.set` takes a partial patch so one message serves every toggle.
 - **Views compose shared components.** Every entry is a `SettingRow` (label, description, control slot) holding a `Toggle`, `Select` or link; the section list is a `SectionList`; the Never-timeout and PIN-on-disk confirmations are one `WarningDialog` with different copy; the PIN entry is a `PinDialog`. Alternative: markup per view, which is how the vanilla draft would have drifted.
@@ -34,7 +34,7 @@ Server facts used here, verified in the Keepiq app: `SettingsController::getUser
 - **Default item type stores the slug.** The control lists cached type rows by `label`, stores `name` as `default_secret_type`, and ext-vault-edit resolves the slug to a `typeId` at create time. If the slug matches no cached row the control falls back to `login`.
 - **Keyboard shortcut is read, not owned.** The background calls `browser.commands.getAll()`, which exists on both targets, and fills the snapshot's `shortcut` with the first command's binding or `null`; the `Autofill` view shows it or "Not set" when ext-autofill has not declared one. Chromium allows `browser.tabs.create({ url: 'chrome://extensions/shortcuts' })`; Firefox refuses privileged `about:` URLs from `tabs.create`, so Firefox gets instructions plus a Copy control. Detected with `import.meta.env.FIREFOX`.
 - **Add current site uses activeTab.** Opening the popup from the toolbar action grants `activeTab` for that tab, so `browser.tabs.query({ active: true, currentWindow: true })` returns the URL without a `tabs` permission.
-- **Theme via a root attribute from one hook.** `useTheme` runs in `<App />`, above the router, so it sets `data-theme` on the document root for every screen including unlock and the account picker, in a layout effect so the first paint is already themed; `popup.css` keeps `color-scheme: light dark` for System default and overrides the tokens under `[data-theme="light"]` and `[data-theme="dark"]`. Compact mode is a second attribute that tightens spacing tokens. Show animations toggles a `prefers-reduced-motion`-style class.
+- **Appearance extends ext-theme.** Theme and how it is applied come from ext-theme's design. Compact mode is a second root attribute next to its `data-theme` that tightens spacing tokens. Show animations toggles a `prefers-reduced-motion`-style class.
 - **About reads the manifest.** `browser.runtime.getManifest().version` is identical on both targets. Store URLs are constants set to `<store-url>` until publication; the view hides Rate the extension while the constant is a placeholder.
 
 ## Module layout
@@ -45,16 +45,16 @@ New:
 - `src/settings/policy.ts`: `applyPolicy`, `NO_POLICY`, the clamp type.
 - `src/settings/pin.ts`: derive, wrap, unwrap, blob codec, placement helper.
 - `src/settings/server-mirror.ts`: fetch, write, stale computation for `/api/settings/user`.
-- `entrypoints/popup/views/settings/SettingsIndex.tsx`: section list and navigation.
-- `entrypoints/popup/views/settings/AccountSecurity.tsx`, `Autofill.tsx`, `Notifications.tsx`, `Vault.tsx`, `Appearance.tsx`, `About.tsx`: one view per section.
-- `entrypoints/popup/components/SettingRow.tsx` (label, description, control slot), `Toggle.tsx`, `Select.tsx`, `SectionList.tsx`, `PinDialog.tsx`, `WarningDialog.tsx` (Never-timeout and PIN-on-disk confirmations).
-- `entrypoints/popup/hooks/useSettings.ts` (over `settings.get` and `settings.set`, policy clamp applied), `useServerSettings.ts` (stale indicator, disabled offline, `settings.server.set`), `useTheme.ts` (global theme on the document root, including unlock and account screens).
+- `entrypoints/popup/views/settings/AccountSecurity.tsx`, `Autofill.tsx`, `Notifications.tsx`, `Vault.tsx`, `About.tsx`: one view per section.
+- `entrypoints/popup/components/SettingRow.tsx` (label, description, control slot), `Toggle.tsx`, `PinDialog.tsx`, `WarningDialog.tsx` (Never-timeout and PIN-on-disk confirmations).
+- `entrypoints/popup/hooks/useServerSettings.ts` (stale indicator, disabled offline, `settings.server.set`).
 
 Edited:
 - `src/messages.ts`: the kinds below.
 - `entrypoints/background.ts`: handlers for the new kinds, timeout config fed from the store through `applyPolicy`, PIN blob purge on lock, timeout, logout, account removal and suite change, server mirror refresh at the end of sync.
 - ext-accounts-and-unlock's `Unlock` view component (`entrypoints/popup/views/Unlock.tsx`): a PIN field and "Use master password" link rendered when `useSettings` reports `pin.enabled`, sending `pin.unlock`.
-- `entrypoints/popup/popup.css`: theme and compact tokens.
+- ext-theme's `SettingsIndex.tsx` and `Settings.tsx` (open the five sections), `Appearance.tsx` (the other entries) and `useSettings.ts` (the full snapshot, policy clamp applied).
+- `entrypoints/popup/popup.css`: compact tokens.
 
 Nothing changes in `wxt.config.ts`. `storage` is already declared; `commands` belongs to ext-autofill.
 
diff --git a/browser-extension/openspec/changes/ext-settings/proposal.md b/browser-extension/openspec/changes/ext-settings/proposal.md
index ef9f8227b..74ab03e33 100644
--- a/browser-extension/openspec/changes/ext-settings/proposal.md
+++ b/browser-extension/openspec/changes/ext-settings/proposal.md
@@ -1,26 +1,29 @@
 ---
 kind: code
-depends_on: [ext-vault-browse]
+depends_on: [ext-vault-browse, ext-theme]
 chain:
   - ext-accounts-and-unlock
   - ext-vault-browse
   - ext-vault-edit
   - ext-generator
   - ext-send
+  - ext-theme
   - ext-settings
   - ext-autofill
 ---
 
 ## Why
 
-The popup shell from ext-accounts-and-unlock has a Settings tab with nothing behind it, and every other change in the chain needs a place to read its knobs from: the vault timeout and action (ADR-002), the clipboard clear delay, the autofill defaults, the theme. Without one schema those values end up as ad hoc `storage.local` keys with different defaults in every module.
+The popup shell from ext-accounts-and-unlock has a Settings tab with nothing behind it, and every other change in the chain needs a place to read its knobs from: the vault timeout and action (ADR-002), the clipboard clear delay, the autofill defaults. Without one schema those values end up as ad hoc `storage.local` keys with different defaults in every module.
 
-This change is spec 6 of 7 in the extension chain. It mirrors the Bitwarden browser extension's Settings tab (ADR-001) and defines the one settings schema every earlier and later change reads through.
+It mirrors the Bitwarden browser extension's Settings tab (ADR-001) and defines the one settings schema every earlier and later change reads through.
+
+ext-theme already delivers the Settings tab's section list, the Appearance view with Theme, the global `settings.global` record and the `settings.get`/`settings.set` pair. This change builds on all four.
 
 ## What Changes
 
-- A Settings tab with six sections, in Bitwarden's order and with Bitwarden's labels: Account security, Autofill, Notifications, Vault, Appearance, About.
-- One typed settings schema (`src/settings/schema.ts`) with keys, defaults, validation and a storage scope per key, read and written through a `settings.get` and `settings.set` message pair handled by the background.
+- The five sections ext-theme lists as "Available in a later update" open their views: Account security, Autofill, Notifications, Vault, About.
+- One typed settings schema (`src/settings/schema.ts`) with keys, defaults, validation and a storage scope per key, absorbing ext-theme's `src/settings/global.ts`, and `settings.get`/`settings.set` widened to the full `SettingsSnapshot`.
 - Account security: vault timeout and timeout action with the ADR-002 options and defaults, Lock now, Log out, Unlock with PIN, biometrics shown as unavailable, Change master password as a link to the Keepiq web app.
 - Unlock with PIN: the RSA private-key bytes are wrapped under a PBKDF2-derived PIN key and stored in `storage.local` or `storage.session` depending on the "Require master password on browser restart" toggle. The unlock screen gains a PIN field. Five wrong PINs revert to the master password.
 - Autofill, Notifications, Vault and Appearance settings entries with their storage, defaults and effect. The behaviour behind the autofill and notification entries is delivered by ext-autofill; folder management by ext-vault-edit. Only the entries live here.
@@ -58,8 +61,8 @@ Sync now reuses the sync routine from ext-vault-browse and adds no calls of its
 
 ## Impact
 
-- New: `src/settings/schema.ts`, `src/settings/store.ts`, `src/settings/policy.ts`, `src/settings/pin.ts`, `src/settings/server-mirror.ts`; React views `entrypoints/popup/views/settings/{SettingsIndex,AccountSecurity,Autofill,Notifications,Vault,Appearance,About}.tsx`; components `entrypoints/popup/components/{SettingRow,Toggle,Select,SectionList,PinDialog,WarningDialog}.tsx`; hooks `entrypoints/popup/hooks/{useSettings,useServerSettings,useTheme}.ts` (ADR-004).
-- Edited: `src/messages.ts` (settings, PIN and About message kinds), `entrypoints/background.ts` (handlers, timeout config fed from settings, PIN unlock, clearing the PIN blob on lock and logout), ext-accounts-and-unlock's `Unlock` view component (PIN field and "Use master password" link), `entrypoints/popup/popup.css` (theme tokens, compact mode).
+- New: `src/settings/schema.ts`, `src/settings/store.ts`, `src/settings/policy.ts`, `src/settings/pin.ts`, `src/settings/server-mirror.ts`; React views `entrypoints/popup/views/settings/{AccountSecurity,Autofill,Notifications,Vault,About}.tsx`; components `entrypoints/popup/components/{SettingRow,Toggle,PinDialog,WarningDialog}.tsx`; hook `entrypoints/popup/hooks/useServerSettings.ts` (ADR-004).
+- Edited: `src/messages.ts` (settings, PIN and About message kinds), `entrypoints/background.ts` (handlers, timeout config fed from settings, PIN unlock, clearing the PIN blob on lock and logout), ext-accounts-and-unlock's `Unlock` view component (PIN field and "Use master password" link), ext-theme's `SettingsIndex.tsx`, `Settings.tsx`, `Appearance.tsx` and `useSettings.ts`, `entrypoints/popup/popup.css` (compact mode).
 - Other changes in the chain read their knobs through `settings.get` instead of their own keys: ext-accounts-and-unlock (timeout, action), ext-vault-browse (clipboard clear, quick copy actions), ext-vault-edit (default item type), ext-autofill (every Autofill and Notifications entry).
 - No new manifest permissions. The `commands` entry the shortcut display reads is declared by ext-autofill.
 - Security: a PIN-wrapped copy of the private key can live in `storage.local`. Design.md states the trade-off and the mitigations.
diff --git a/browser-extension/openspec/changes/ext-settings/specs/settings/spec.md b/browser-extension/openspec/changes/ext-settings/specs/settings/spec.md
index 1626b83a9..9db104e9d 100644
--- a/browser-extension/openspec/changes/ext-settings/specs/settings/spec.md
+++ b/browser-extension/openspec/changes/ext-settings/specs/settings/spec.md
@@ -1,7 +1,7 @@
 ## ADDED Requirements
 
-### Requirement: Settings tab with six sections
-The extension SHALL show a Settings tab in the unlocked popup with the sections Account security, Autofill, Notifications, Vault, Appearance and About, in that order, each opening as its own view with a back control. The tab holds no state of its own; every view renders from the background's reply to `settings.get`.
+### Requirement: Every Settings section opens
+The extension SHALL open Account security, Autofill, Notifications, Vault and About from the section list ext-theme added, each as its own view with a back control, so no section shows "Available in a later update". The tab holds no state of its own; every view renders from the background's reply to `settings.get`.
 
 #### Scenario: Opening a section
 - **GIVEN** an unlocked account
@@ -220,12 +220,12 @@ The extension SHALL show Sync now with "Last sync: <time>" (or "Never" before th
 - **THEN** the control shows Login and a note that the server value is not available in this extension
 
 ### Requirement: Appearance settings
-The extension SHALL store in the global `storage.local` record the settings Theme (System default, Light, Dark; default System default), Compact mode (default off), Show animations (default on) and Show quick copy actions on vault (default on), and SHALL show Language read-only as the browser UI language. A theme change applies to the open popup immediately.
+The extension SHALL add to ext-theme's Appearance view, below Theme, and store in the global `storage.local` record the settings Compact mode (default off), Show animations (default on) and Show quick copy actions on vault (default on), and SHALL show Language read-only as the browser UI language.
 
-#### Scenario: Theme change
-- **GIVEN** Theme is System default and the OS is light
-- **WHEN** the user selects Dark
-- **THEN** the popup repaints dark without reopening and the unlock screen is dark on the next open
+#### Scenario: Compact mode
+- **GIVEN** Compact mode is off
+- **WHEN** the user turns it on
+- **THEN** the popup tightens its spacing without reopening
 
 #### Scenario: Language entry
 - **WHEN** the Appearance view renders
diff --git a/browser-extension/openspec/changes/ext-settings/tasks.md b/browser-extension/openspec/changes/ext-settings/tasks.md
index 441734549..75ccc3df1 100644
--- a/browser-extension/openspec/changes/ext-settings/tasks.md
+++ b/browser-extension/openspec/changes/ext-settings/tasks.md
@@ -1,14 +1,14 @@
 ## 1. Schema and store
 
-- [ ] 1.1 Create `src/settings/schema.ts` with the `SETTINGS` table (key, scope, default, validator) and the derived `SettingsValues` type for every entry in the spec
+- [ ] 1.1 Create `src/settings/schema.ts` with the `SETTINGS` table (key, scope, default, validator) and the derived `SettingsValues` type for every entry in the spec, absorbing ext-theme's `src/settings/global.ts`
   - Defaults match the spec: timeout 15 minutes, action Lock, clipboard 30 seconds, theme System default, autofill on page load off
   - Each validator returns the default for an unknown or malformed value
-- [ ] 1.2 Create `src/settings/store.ts` reading and writing `settings:<accountId>` and `settings:global` in `storage.local`, patching rather than replacing, and deleting the account record on account removal
+- [ ] 1.2 Create `src/settings/store.ts` reading and writing `settings.<accountId>` and `settings.global` in `storage.local`, patching rather than replacing, and deleting the account record on account removal
 - [ ] 1.3 Create `src/settings/policy.ts` with `TimeoutPolicy`, `NO_POLICY` and `applyPolicy` clamping the timeout and forcing the action without rewriting the stored value
 
 ## 2. Messages and background
 
-- [ ] 2.1 Add `settings.get`, `settings.set`, `settings.server.set`, `pin.enable`, `pin.disable`, `pin.unlock`, `about.get` and the `SettingsSnapshot`, `ServerSettings`, `PinUnlockResult`, `AboutInfo` types to `src/messages.ts`
+- [ ] 2.1 Widen ext-theme's `settings.get` and `settings.set` replies to `SettingsSnapshot`, and add `settings.server.set`, `pin.enable`, `pin.disable`, `pin.unlock`, `about.get` and the `SettingsSnapshot`, `ServerSettings`, `PinUnlockResult`, `AboutInfo` types to `src/messages.ts`
 - [ ] 2.2 Handle the new kinds in `entrypoints/background.ts` and feed the ADR-002 timeout config from the store through `applyPolicy` on every read
   - Request/response arms return the Promise; nothing new is fire-and-forget
   - The clipboard clear delay is read by ext-vault-browse through the same snapshot
@@ -25,15 +25,15 @@
 
 ## 5. Popup components, hooks and views
 
-- [ ] 5.1 Create the shared components under `entrypoints/popup/components/`: `SettingRow.tsx` (label, description, control slot), `Toggle.tsx`, `Select.tsx`, `SectionList.tsx`, `PinDialog.tsx`, `WarningDialog.tsx`
+- [ ] 5.1 Create the shared components under `entrypoints/popup/components/`: `SettingRow.tsx` (label, description, control slot), `Toggle.tsx`, `PinDialog.tsx`, `WarningDialog.tsx`; dropdowns reuse ext-theme's `Select.tsx`
   - No component imports `src/api` or `src/crypto` (ADR-004)
-- [ ] 5.2 Create the hooks under `entrypoints/popup/hooks/`: `useSettings.ts` over `settings.get` and `settings.set` with `applyPolicy` applied to the returned values, `useServerSettings.ts` with the stale indicator and disabled-offline state over `settings.server.set`, `useTheme.ts` applying the global theme to the document root from `<App />` so unlock and account screens are themed
-- [ ] 5.3 Create `entrypoints/popup/views/settings/SettingsIndex.tsx` with the six-section `SectionList`, per-section navigation and back control, wired into the Settings tab of the popup shell
+- [ ] 5.2 Extend ext-theme's `useSettings.ts` to the full snapshot with `applyPolicy` applied to the returned values, and create `useServerSettings.ts` with the stale indicator and disabled-offline state over `settings.server.set`
+- [ ] 5.3 Open the five remaining sections from ext-theme's `SettingsIndex.tsx` and route them in `Settings.tsx`
 - [ ] 5.4 Create `AccountSecurity.tsx`: timeout options with Custom entry and policy-aware hiding, Never `WarningDialog`, action with Log out note, Lock now, Log out with confirmation, PIN toggle with `PinDialog` and the on-disk `WarningDialog`, biometrics disabled, Change master password link, `session_timeout` shown read-only as "Web app default"
 - [ ] 5.5 Create `Autofill.tsx`: the five entries with their warnings and notes, the inline-menu "Coming later" state from `capabilities.inlineMenu`, shortcut display from the snapshot's `shortcut` with the Chromium link and the Firefox instructions, clear clipboard options
 - [ ] 5.6 Create `Notifications.tsx`: Ask to add, Ask to update, Excluded domains with Add current site via `activeTab`, free-text add, duplicate and empty rejection, remove; the Keepiq server notifications subsection driven by `useServerSettings` with revert-on-error behaviour
 - [ ] 5.7 Create `Vault.tsx`: Sync now with Last sync and the offline failure message, Folders entry opening the ext-vault-edit folder manager, Import and Export links to the web app, Default item type from cached types with the `login` fallback and note
-- [ ] 5.8 Create `Appearance.tsx` and extend `entrypoints/popup/popup.css`: theme tokens under `[data-theme]`, compact mode tokens, show animations class, quick copy actions toggle, read-only Language line
+- [ ] 5.8 Extend ext-theme's `Appearance.tsx` and `entrypoints/popup/popup.css`: compact mode tokens, show animations class, quick copy actions toggle, read-only Language line
 - [ ] 5.9 Create `About.tsx`: version and server URL from `about.get`, Help, Report a bug, Privacy policy, Keepiq web app links, Rate the extension hidden while the store constant is `<store-url>`
 
 ## 6. Verification
diff --git a/browser-extension/openspec/changes/ext-theme/design.md b/browser-extension/openspec/changes/ext-theme/design.md
new file mode 100644
index 000000000..3afe25ba7
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-theme/design.md
@@ -0,0 +1,63 @@
+## Context
+
+`popup.css` defines every color as a token on `:root`, with a light set by default and a dark set under `@media (prefers-color-scheme: dark)`, guarded by `:root:not([data-theme='light'])`, plus `[data-theme='light']` and `[data-theme='dark']` overrides that nothing sets yet. No component uses a literal color. So both themes exist and System default already works; this change adds the setting that sets `data-theme`.
+
+## Is System default possible?
+
+Yes, on both targets, with no JavaScript and no permission:
+
+- Extension pages get `prefers-color-scheme` like any page. Chrome reports its own appearance setting, which defaults to the OS; Firefox reports its website appearance setting, which defaults to the Firefox theme and through that the OS.
+- The media query re-evaluates while the popup is open, so an OS switch repaints it.
+- The background can't see the preference: an MV3 service worker has no `matchMedia`. Nothing in this change needs it there; a themed toolbar icon would.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Theme setting with System default, Light and Dark, applied to every popup screen before first paint.
+- The Settings tab's section list and an Appearance view, as the base ext-settings extends.
+
+**Non-Goals:**
+- Compact mode, animations, quick copy and the Language line (ext-settings).
+- Theming content-script UI such as save prompts (ext-autofill reads the same setting when it adds one).
+- New colors. The two token sets stay as they are.
+
+## Decisions
+
+- **System default sets no attribute.** `applyTheme('system')` removes `data-theme`, so the existing media query decides. Light and Dark set it, and the existing overrides win. No `matchMedia` listener is needed.
+- **Global record in `storage.local` under `settings.global`.** The theme must apply before an account is chosen, so it can't live in the per-account `settings.<id>` record. Account ids are UUIDs, so the key can't collide. ext-settings adds its other global keys to the same record.
+- **Types in `src/messages.ts`, storage in `src/settings/global.ts`.** The popup names `Theme` and `GlobalSettings` without importing storage code, as with `MAX_ACCOUNTS`.
+- **`settings.get` and `settings.set` are `PopupRequest` kinds** with their own replies (`GlobalSettings`), not `Result` arms, since they don't change the popup's screen. ext-settings widens the reply to its `SettingsSnapshot`.
+- **A `localStorage` mirror for the first frame.** The background's reply arrives after the first paint, and later still when the MV3 worker has to wake, so a user with a pinned theme would see the system's theme flash first. `main.tsx` reads `keepiq.theme` from `localStorage` synchronously and applies it before mounting. ADR-004 keeps `browser.storage` out of components, and this is not that: the mirror is a display cache of one word, never a source of truth, and `storage.local` stays authoritative. Every `localStorage` access is wrapped, so a missing or throwing store just means following the system until the reply.
+- **Other open windows follow through the `storage` event.** Writing the mirror fires `storage` in every other document of the extension's origin, so the pop-out window repaints without a broadcast from the background.
+- **`useTheme` in `<App />`, `useSettings` in the view.** `useTheme` reads `settings.get` once on mount, applies and mirrors it, and listens for the `storage` event. `useSettings` serves the Appearance view: it reads the record, sends `settings.set`, and on the reply applies and mirrors the theme. A failed write leaves the theme as it was and shows `not_responding`.
+- **Settings navigation lives in Shell.** Shell already owns the header's title and back control for the item detail; it keeps the open section the same way and resets it when the tab changes. `Settings.tsx` renders the section list or the open section.
+- **Unbuilt sections reuse the `common.later` pattern.** They are `aria-disabled` with a `title`, like the unbuilt item actions, so they stay focusable and the reason can be read.
+- **`Select` is a new shared component** in the `.select` style the folder filter uses, with a visible label. ext-settings reuses it for every dropdown.
+
+## Message contract
+
+```ts
+export type Theme = 'system' | 'light' | 'dark'
+export interface GlobalSettings { theme: Theme }
+
+// PopupRequest
+| { kind: 'settings.get' }
+| { kind: 'settings.set'; patch: Partial<GlobalSettings> }
+
+// PopupReplies
+'settings.get': GlobalSettings
+'settings.set': GlobalSettings
+```
+
+## Storage
+
+| Key | Area | Holds | Cleared by |
+| --- | --- | --- | --- |
+| `settings.global` | `storage.local` | `{ theme }` | Uninstall only |
+| `keepiq.theme` | extension origin `localStorage` | The theme name, a mirror | Uninstall; rewritten on every read |
+
+## Risks / Trade-offs
+
+- [The mirror and `storage.local` disagree] → The background's value wins on every open and rewrites the mirror; the worst case is one frame in the old theme.
+- [Five disabled sections look unfinished] → They state they arrive later, and they keep the section order fixed as ext-settings adds them.
+- [Firefox's System default follows Firefox, not the OS] → That's what the user set Firefox to; the label stays "System default" as in Bitwarden.
diff --git a/browser-extension/openspec/changes/ext-theme/proposal.md b/browser-extension/openspec/changes/ext-theme/proposal.md
new file mode 100644
index 000000000..c9eb08267
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-theme/proposal.md
@@ -0,0 +1,47 @@
+---
+kind: code
+depends_on: [ext-vault-browse, ext-i18n]
+chain:
+  - ext-accounts-and-unlock
+  - ext-vault-browse
+  - ext-i18n
+  - ext-theme
+---
+
+## Why
+
+The popup follows the system's light or dark preference, and nothing else. Most Keepiq users work in light mode, but a user whose OS is dark gets a dark popup with no way to change it. The tokens for both themes and the `data-theme` hook in `popup.css` already exist; what's missing is the setting, its storage and a place to change it.
+
+The Settings tab is still a placeholder, and ext-settings is too large to wait for. This change delivers the theme switch and the start of the Settings tab, and ext-settings builds on both.
+
+## What Changes
+
+- A Theme setting with System default (the default), Light and Dark, mirroring Bitwarden's Settings, Appearance, Theme.
+- The Settings tab gets its section list in Bitwarden's order. Appearance opens; the other five sections show as "Available in a later update" until ext-settings delivers them.
+- An Appearance view holding the Theme control only. Compact mode, animations, quick copy and the Language line stay with ext-settings.
+- The theme is global, not per account, so it also applies to the unlock, add-account and account-switcher screens.
+- `settings.get` and `settings.set` messages, the first part of the ext-settings contract, carrying the global settings record.
+- The popup applies the cached theme before its first paint, so a user who picked a theme never sees the other one flash.
+
+## Capabilities
+
+### New Capabilities
+- `theme`: the Theme setting, its storage, how the popup applies it, and the Settings section list.
+
+### Modified Capabilities
+
+None. `openspec/specs/` is empty today. ext-settings is trimmed to build on this change: its Settings tab, `settings.get`/`settings.set` and the Theme entry come from here.
+
+## Deviations from Bitwarden
+
+- **Unbuilt sections are listed but disabled**, so the section order stays the same as ext-settings fills them in.
+
+## Keepiq API used
+
+None. The theme is a local preference; the web app's theme is Nextcloud's and is not mirrored.
+
+## Impact
+
+- New: `src/settings/global.ts`, `entrypoints/popup/theme.ts`, `entrypoints/popup/hooks/useTheme.ts`, `entrypoints/popup/hooks/useSettings.ts`, `entrypoints/popup/views/settings/{Settings,SettingsIndex,Appearance}.tsx`, `entrypoints/popup/components/Select.tsx`, with their tests.
+- Edited: `src/messages.ts`, `src/background/requests.ts`, `entrypoints/popup/{main.tsx,App.tsx,popup.css}`, `views/Shell.tsx`, `components/Icon.tsx`, `testing.ts`, `locales/en.yml`, `locales/nl.yml`, `ARCHITECTURE.md`, `openspec/README.md`, ext-settings' proposal, spec, design and tasks, and `../docs/browser-extension/using.md`.
+- No new permissions.
diff --git a/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md b/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
new file mode 100644
index 000000000..291b8de89
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
@@ -0,0 +1,96 @@
+## ADDED Requirements
+
+### Requirement: Theme setting
+The extension SHALL offer the Theme options System default, Light and Dark, default System default. The value is global, not per account, and is stored in `storage.local` under `settings.global`. Nothing clears it automatically: it survives logout, account removal and browser restart, and goes with the extension's uninstall. A stored value that is not one of the three options is read as System default.
+
+#### Scenario: Fresh profile
+- **GIVEN** no `settings.global` record exists
+- **WHEN** the popup opens
+- **THEN** Theme reads as System default and the popup follows the system
+
+#### Scenario: Invalid stored value
+- **GIVEN** `settings.global` holds the theme `"nord"`
+- **WHEN** the background reads the settings
+- **THEN** Theme reads as System default
+
+#### Scenario: Survives logout
+- **GIVEN** Theme is Dark and one account is added
+- **WHEN** the user logs out of that account
+- **THEN** the add-account screen is dark
+
+### Requirement: System default follows the browser
+With Theme on System default, the extension SHALL follow the `prefers-color-scheme` media feature, which reflects the browser's light or dark preference and by default the OS. A change of that preference while the popup is open MUST repaint it without reopening.
+
+#### Scenario: OS switches while open
+- **GIVEN** Theme is System default and the OS is light
+- **WHEN** the OS switches to dark with the popup open
+- **THEN** the popup repaints dark
+
+#### Scenario: Pinned theme ignores the OS
+- **GIVEN** Theme is Light
+- **WHEN** the OS switches to dark with the popup open
+- **THEN** the popup stays light
+
+### Requirement: Theme applies everywhere at once
+The extension SHALL apply the theme to every popup screen, the unlock, add-account, log-in-again and account-switcher screens included, and to the pop-out window. A change applies to the open popup immediately and to any other open extension page without reopening it.
+
+#### Scenario: Change from Appearance
+- **GIVEN** Theme is System default and the OS is light
+- **WHEN** the user selects Dark
+- **THEN** the popup repaints dark without reopening
+- **AND** the unlock screen is dark on the next open
+
+#### Scenario: Pop-out open beside the popup
+- **GIVEN** a pop-out window is open
+- **WHEN** the user changes the theme in the toolbar popup
+- **THEN** the pop-out window repaints in the new theme
+
+### Requirement: No flash of the other theme
+The extension SHALL paint the first frame of the popup in the stored theme. To do that, the popup mirrors the theme into the extension origin's `localStorage` under `keepiq.theme`, reads it before mounting, and replaces it with the background's value once that arrives. The mirror holds only the theme name. When `localStorage` is unavailable, the first frame follows the system and the background's value applies when it arrives.
+
+#### Scenario: Reopen with a pinned theme
+- **GIVEN** Theme is Light, the mirror holds `light` and the OS is dark
+- **WHEN** the popup opens
+- **THEN** its first frame is light
+
+#### Scenario: Mirror lost
+- **GIVEN** Theme is Dark and the mirror is empty
+- **WHEN** the popup opens
+- **THEN** it follows the system until the background answers, then is dark
+- **AND** the mirror holds `dark` again
+
+### Requirement: Settings tab and Appearance view
+The extension SHALL show, in the Settings tab of the unlocked popup, the sections Account security, Autofill, Notifications, Vault, Appearance and About, in that order. Appearance opens its view, titled Appearance, with a back control to the section list. Sections without a view yet are shown disabled with "Available in a later update". The Appearance view holds the Theme control, labelled Theme, showing the stored value.
+
+#### Scenario: Opening Appearance
+- **GIVEN** an unlocked account
+- **WHEN** the user opens the Settings tab and taps Appearance
+- **THEN** the Appearance view shows Theme with its stored value
+- **AND** the back control returns to the section list
+
+#### Scenario: Section not built yet
+- **WHEN** the section list renders
+- **THEN** Account security, Autofill, Notifications, Vault and About are disabled and explain "Available in a later update"
+
+#### Scenario: Leaving the tab
+- **GIVEN** the Appearance view is open
+- **WHEN** the user switches to the Vault tab and back
+- **THEN** the section list shows
+
+#### Scenario: Background does not answer
+- **GIVEN** the background does not reply to `settings.set`
+- **WHEN** the user selects Dark
+- **THEN** the control returns to the stored value, the theme is unchanged, and an error says Keepiq is not responding
+
+### Requirement: Settings messages
+The background SHALL answer `settings.get` with the global settings record and `settings.set` with a partial patch, validating it, storing it and replying with the full record. A patch value that fails validation is ignored. `settings.get` does not count as user activity for the vault timeout; `settings.set` does. Both work whether or not an account is unlocked.
+
+#### Scenario: Invalid patch
+- **GIVEN** Theme is Light
+- **WHEN** the popup sends `settings.set` with theme `"blue"`
+- **THEN** the stored record is unchanged and the reply holds Light
+
+#### Scenario: Locked vault
+- **GIVEN** the active account is locked
+- **WHEN** the popup sends `settings.get`
+- **THEN** the reply holds the stored theme
diff --git a/browser-extension/openspec/changes/ext-theme/tasks.md b/browser-extension/openspec/changes/ext-theme/tasks.md
new file mode 100644
index 000000000..78ac7f331
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-theme/tasks.md
@@ -0,0 +1,29 @@
+## 1. Background
+
+- [x] 1.1 Add `Theme`, `GlobalSettings`, `THEMES` and the `settings.get` and `settings.set` request kinds and replies to `src/messages.ts`
+- [x] 1.2 Create `src/settings/global.ts`: read `settings.global` with invalid values as defaults, and a validated patch write, with its test
+- [x] 1.3 Handle both kinds in `src/background/requests.ts`; `settings.get` is not user activity
+  - Tests cover a locked vault, an invalid patch and the reply shape
+
+## 2. Applying the theme
+
+- [x] 2.1 Create `entrypoints/popup/theme.ts`: apply a theme to `data-theme`, and read and write the `keepiq.theme` mirror, every access wrapped, with its test
+- [x] 2.2 Apply the mirrored theme in `main.tsx` before mounting
+- [x] 2.3 Create `hooks/useTheme.ts` and run it in `<App />`: read `settings.get` once, apply and mirror it, follow the `storage` event
+- [x] 2.4 Update the theme comment in `popup.css`; the token sets stay as they are
+
+## 3. Settings tab
+
+- [x] 3.1 Create `components/Select.tsx` in the `.select` style, with a visible label, and add the section icons to `Icon.tsx`
+- [x] 3.2 Create `hooks/useSettings.ts` over `settings.get` and `settings.set`, applying and mirroring the theme on a reply
+- [x] 3.3 Create `views/settings/SettingsIndex.tsx`, `Appearance.tsx` and `Settings.tsx`, and wire them into Shell with the title and back control
+  - Unbuilt sections are `aria-disabled` with "Available in a later update"
+  - Switching tabs returns to the section list
+- [x] 3.4 Add the text to `locales/en.yml` and `locales/nl.yml`
+- [x] 3.5 Extend `fakeBackground` and add view tests: the section list, opening Appearance, changing the theme, a failed write, and the theme on the unlock screen
+
+## 4. Docs and checks
+
+- [x] 4.1 Trim ext-settings to build on this change; add the storage rows to `ARCHITECTURE.md`, the change to `openspec/README.md`, and a Theme section to `../docs/browser-extension/using.md` and `privacy.md`
+- [x] 4.2 Run `npm test`, `npm run typecheck`, `npm run lint`, `npm run build` and `npm run build:firefox`
+- [ ] 4.3 Walk through Chrome and Firefox: each theme on the unlock and vault screens, an OS switch on System default, a pop-out window following a change, and no flash on reopen
diff --git a/browser-extension/src/background/requests.test.ts b/browser-extension/src/background/requests.test.ts
index 4594a7622..7dfdd3c88 100644
--- a/browser-extension/src/background/requests.test.ts
+++ b/browser-extension/src/background/requests.test.ts
@@ -185,6 +185,28 @@ describe('last tab', () => {
 	})
 })
 
+describe('settings', () => {
+	it('reads and writes the theme while locked', async () => {
+		await lock(accountId)
+		expect(await send({ kind: 'settings.get' })).toEqual({ theme: 'system' })
+		expect(await send({ kind: 'settings.set', patch: { theme: 'dark' } })).toEqual({ theme: 'dark' })
+		expect(await send({ kind: 'settings.get' })).toEqual({ theme: 'dark' })
+	})
+
+	it('ignores an invalid theme', async () => {
+		await send({ kind: 'settings.set', patch: { theme: 'light' } })
+		expect(await send({ kind: 'settings.set', patch: { theme: 'blue' as never } })).toEqual({ theme: 'light' })
+	})
+
+	it('does not count a read as interaction', async () => {
+		await send({ kind: 'settings.set', patch: { theme: 'light' } })
+		const before = await browser.storage.session.get('lastInteractionAt')
+		await new Promise((resolve) => setTimeout(resolve, 5))
+		await send({ kind: 'settings.get' })
+		expect(await browser.storage.session.get('lastInteractionAt')).toEqual(before)
+	})
+})
+
 describe('clipboard.copied', () => {
 	it('schedules the clear with the default delay', async () => {
 		await send({ kind: 'clipboard.copied' })
diff --git a/browser-extension/src/background/requests.ts b/browser-extension/src/background/requests.ts
index 3167bf91b..7a252657a 100644
--- a/browser-extension/src/background/requests.ts
+++ b/browser-extension/src/background/requests.ts
@@ -2,6 +2,7 @@ import { accountStatus, getAccount, getActiveAccountId, type AccountRecord } fro
 import { scheduleClipboardClear } from '@/src/clipboard'
 import { rsaDecrypt } from '@/src/crypto'
 import { USE_ONLY_FIELDS, type AccountStatus, type DecryptReply, type DecryptedItem, type PopupReplies, type PopupRequest, type PopupTab, type VaultSnapshotReply } from '@/src/messages'
+import { readGlobalSettings, updateGlobalSettings } from '@/src/settings/global'
 import { getKey, LAST_TAB_KEY, sessionValues } from '@/src/vault/key-store'
 import { suggestionIds } from '@/src/vault/match'
 import { readSnapshot, toItemMeta } from '@/src/vault/store'
@@ -130,11 +131,17 @@ async function perform(message: PopupRequest): Promise<PopupReplies[PopupRequest
 		case 'popup.lastTab.set':
 			if (TABS.includes(message.tab)) await sessionValues.set({ [LAST_TAB_KEY]: message.tab })
 			return null
+		case 'settings.get':
+			return readGlobalSettings()
+		case 'settings.set':
+			return updateGlobalSettings(message.patch)
 	}
 }
 
 /** Re-reads and re-decrypts after a broadcast are the popup reacting to the background, not the user. */
 function isInteraction(message: PopupRequest): boolean {
+	// Every popup reads it on open, which `vault.status` already counts.
+	if (message.kind === 'settings.get') return false
 	if (message.kind === 'vault.snapshot') return message.opened === true
 	if (message.kind === 'item.decrypt') return message.passive !== true
 	return true
diff --git a/browser-extension/src/messages.ts b/browser-extension/src/messages.ts
index a2762fd37..d7675e258 100644
--- a/browser-extension/src/messages.ts
+++ b/browser-extension/src/messages.ts
@@ -68,6 +68,14 @@ export type PopupToBackground =
 
 export type PopupTab = 'vault' | 'generator' | 'send' | 'settings'
 
+export const THEMES = ['system', 'light', 'dark'] as const
+export type Theme = typeof THEMES[number]
+
+/** Settings that apply before an account is chosen, so they are not per account. */
+export interface GlobalSettings {
+	theme: Theme
+}
+
 export interface SyncStatus {
 	syncing: boolean
 	/** Last time the server confirmed the snapshot, `null` before the first sync. */
@@ -142,6 +150,8 @@ export type PopupRequest =
 	| { kind: 'clipboard.copied' }
 	| { kind: 'popup.popout'; tabId?: number }
 	| { kind: 'popup.lastTab.set'; tab: PopupTab }
+	| { kind: 'settings.get' }
+	| { kind: 'settings.set'; patch: Partial<GlobalSettings> }
 
 export interface PopupReplies {
 	'vault.sync': SyncStatus
@@ -150,10 +160,13 @@ export interface PopupReplies {
 	'clipboard.copied': null
 	'popup.popout': null
 	'popup.lastTab.set': null
+	'settings.get': GlobalSettings
+	'settings.set': GlobalSettings
 }
 
 export const POPUP_REQUEST_KINDS: ReadonlySet<string> = new Set<keyof PopupReplies>([
 	'vault.sync', 'vault.snapshot', 'item.decrypt', 'clipboard.copied', 'popup.popout', 'popup.lastTab.set',
+	'settings.get', 'settings.set',
 ])
 
 /** Background → popup broadcasts; nobody listens while the popup is closed. */
diff --git a/browser-extension/src/settings/global.test.ts b/browser-extension/src/settings/global.test.ts
new file mode 100644
index 000000000..038bc18bf
--- /dev/null
+++ b/browser-extension/src/settings/global.test.ts
@@ -0,0 +1,27 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { fakeBrowser } from 'wxt/testing/fake-browser'
+import { GLOBAL_SETTINGS_KEY, readGlobalSettings, updateGlobalSettings } from './global'
+
+beforeEach(() => fakeBrowser.reset())
+
+describe('global settings', () => {
+	it('defaults to the system theme', async () => {
+		expect(await readGlobalSettings()).toEqual({ theme: 'system' })
+	})
+
+	it('reads an unknown stored theme as the default', async () => {
+		await browser.storage.local.set({ [GLOBAL_SETTINGS_KEY]: { theme: 'nord' } })
+		expect(await readGlobalSettings()).toEqual({ theme: 'system' })
+	})
+
+	it('stores a valid patch and returns the record', async () => {
+		expect(await updateGlobalSettings({ theme: 'dark' })).toEqual({ theme: 'dark' })
+		expect(await readGlobalSettings()).toEqual({ theme: 'dark' })
+	})
+
+	it('ignores an invalid patch value', async () => {
+		await updateGlobalSettings({ theme: 'light' })
+		expect(await updateGlobalSettings({ theme: 'blue' as never })).toEqual({ theme: 'light' })
+		expect(await readGlobalSettings()).toEqual({ theme: 'light' })
+	})
+})
diff --git a/browser-extension/src/settings/global.ts b/browser-extension/src/settings/global.ts
new file mode 100644
index 000000000..3c183b445
--- /dev/null
+++ b/browser-extension/src/settings/global.ts
@@ -0,0 +1,22 @@
+import { THEMES, type GlobalSettings } from '@/src/messages'
+
+/** Account ids are UUIDs, so this never meets an account's `settings.<id>`. */
+export const GLOBAL_SETTINGS_KEY = 'settings.global'
+
+export const DEFAULT_GLOBAL_SETTINGS: GlobalSettings = { theme: 'system' }
+
+const isTheme = (value: unknown): value is GlobalSettings['theme'] => THEMES.includes(value as never)
+
+/** Invalid stored values read as their default. */
+export async function readGlobalSettings(): Promise<GlobalSettings> {
+	const stored = (await browser.storage.local.get(GLOBAL_SETTINGS_KEY))[GLOBAL_SETTINGS_KEY] as Partial<GlobalSettings> | undefined
+	return { theme: isTheme(stored?.theme) ? stored.theme : DEFAULT_GLOBAL_SETTINGS.theme }
+}
+
+/** Patch values that fail validation are ignored; returns the record as stored. */
+export async function updateGlobalSettings(patch: Partial<GlobalSettings>): Promise<GlobalSettings> {
+	const settings = await readGlobalSettings()
+	if (isTheme(patch.theme)) settings.theme = patch.theme
+	await browser.storage.local.set({ [GLOBAL_SETTINGS_KEY]: settings })
+	return settings
+}
diff --git a/docs/browser-extension/privacy.md b/docs/browser-extension/privacy.md
index 51b5e1643..f4dc0e8fe 100644
--- a/docs/browser-extension/privacy.md
+++ b/docs/browser-extension/privacy.md
@@ -27,6 +27,8 @@ While the vault is unlocked, the browser keeps your vault key in its session sto
 
 Your master password and your decrypted secrets are never stored. Decrypted values stay in memory while you look at them and are gone when you close the item or the extension.
 
+Your theme choice, for every account. It stays when you log out.
+
 When you are halfway through adding an account, the extension remembers the server address and user name until the browser closes, so closing the popup does not lose them. It never remembers the app password you typed.
 
 ## What the extension reads in your browser
@@ -35,6 +37,7 @@ When you are halfway through adding an account, the extension remembers the serv
 - **The pages you visit:** the extension's page script runs on every site, so that filling in logins can work there. Today it only tells the extension a page has loaded. It never receives your vault, and when autofill arrives it gets one login, after you chose it.
 - **Whether your computer is locked,** for the **On system lock** lock option, which comes with the settings screen.
 - **Your browser's language,** to show the extension in it. It stays in the extension.
+- **Whether your browser is set to light or dark,** for the **System default** theme. It stays in the extension.
 
 ## Permissions
 
diff --git a/docs/browser-extension/using.md b/docs/browser-extension/using.md
index 5ccbbee34..b42a13ccb 100644
--- a/docs/browser-extension/using.md
+++ b/docs/browser-extension/using.md
@@ -106,6 +106,10 @@ The extension keeps an encrypted copy of your vault in the browser. Without a co
 
 The extension checks your server for changes every 15 minutes while the vault is unlocked, and when you open it after a while. When your master password or vault key changed in Keepiq, the extension locks and asks for your current master password.
 
+## Theme
+
+The extension follows your browser's light or dark setting, which on most browsers follows your computer's. To pick one yourself, open **Settings**, **Appearance** and choose **Light** or **Dark** under **Theme**; **System default** follows the browser again. The choice applies to every account and stays when you log out.
+
 ## Language
 
 The extension speaks your browser's language. It is available in English and Dutch; in any other language it uses English. To change it, change your browser's language. Item names, folder names and item types come from your vault and stay as they are.
@@ -120,5 +124,5 @@ The extension talks to your own Nextcloud and sends nothing to Conduction. It ha
 - **Passkeys.** Sign in to websites with the passkeys in your vault.
 - **Adding and editing** items in the extension.
 - **Generator and Send**, as in the web app.
-- **Settings:** the lock delay, a PIN, when the clipboard is cleared and the theme.
+- **More settings:** the lock delay, a PIN and when the clipboard is cleared.
 - **Chrome Web Store and Firefox Add-ons.** Install and update the extension from a store.

From 014a0cebbb5ca296e0fd18bf66132372a303b0cd Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Mon, 12 Oct 2026 11:09:21 +0200
Subject: [PATCH 2/9] feat(extension): highlight and open the whole item row,
 except on its actions

The open button's hit area now stretches over the row under the action buttons, so the hover covers the full row and hovering an action highlights only that button, as in Bitwarden.
---
 browser-extension/entrypoints/popup/popup.css | 32 ++++++++++++++++---
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index eda63cc0b..2f9b3e33d 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -824,6 +824,7 @@ a {
 }
 
 .item {
+	position: relative;
 	display: flex;
 	align-items: center;
 	padding-right: 6px;
@@ -833,12 +834,31 @@ a {
 	border-top: 1px solid var(--border);
 }
 
-.item:first-child .item__main {
+.item:first-child,
+.item:first-child .item__main::after {
 	border-top-left-radius: 11px;
+	border-top-right-radius: 11px;
 }
 
-.item:last-child .item__main {
+.item:last-child,
+.item:last-child .item__main::after {
 	border-bottom-left-radius: 11px;
+	border-bottom-right-radius: 11px;
+}
+
+/*
+ * The open button covers the whole row, under the action buttons, so the row
+ * highlights and opens everywhere but on an action. The actions get no z-index:
+ * a stacking context there would trap their menus under the next row.
+ */
+.item__main::after {
+	content: '';
+	position: absolute;
+	inset: 0;
+}
+
+.item:has(.item__main:hover) {
+	background: var(--surface-hover);
 }
 
 .item__main {
@@ -856,11 +876,12 @@ a {
 	cursor: pointer;
 }
 
-.item__main:hover {
-	background: var(--surface-hover);
+.item__main:focus-visible {
+	outline: none;
 }
 
-.item__main:focus-visible {
+.item__main:focus-visible::after {
+	outline: 2px solid var(--accent);
 	outline-offset: -2px;
 }
 
@@ -909,6 +930,7 @@ a {
 }
 
 .item__actions {
+	position: relative;
 	display: flex;
 	flex: none;
 }

From a6afed0aaaf43e2f4ad89b7e7cc3b30faceadb74 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Mon, 12 Oct 2026 11:09:21 +0200
Subject: [PATCH 3/9] feat(extension): open item details and settings sections
 over the tab bar

As in Bitwarden, a page opened from a tab replaces the tab bar with a footer for its own actions, filled through `PageFooter`. The item detail's Edit and Delete move there; a page without actions shows no bar. The toast now sits above whichever bar is at the bottom.
---
 .../popup/components/PageFooter.tsx           |  9 +++++
 .../popup/components/components.test.tsx      | 15 +++++++-
 .../entrypoints/popup/hooks/hooks.test.tsx    |  2 +-
 browser-extension/entrypoints/popup/popup.css | 37 +++++++++++++------
 .../entrypoints/popup/shell-context.ts        |  4 +-
 .../popup/views/ItemDetail.test.tsx           | 20 +++++++---
 .../entrypoints/popup/views/ItemDetail.tsx    |  5 ++-
 .../entrypoints/popup/views/Shell.test.tsx    |  5 ++-
 .../entrypoints/popup/views/Shell.tsx         | 14 +++++--
 .../popup/views/VaultList.test.tsx            |  2 +-
 .../popup/views/settings/Settings.test.tsx    | 12 +++---
 .../changes/ext-theme/specs/theme/spec.md     |  6 +--
 .../openspec/changes/ext-theme/tasks.md       |  2 +-
 .../changes/ext-vault-browse/design.md        |  2 +-
 .../specs/item-detail/spec.md                 |  4 +-
 .../specs/popup-shell/spec.md                 | 15 +++++++-
 16 files changed, 112 insertions(+), 42 deletions(-)
 create mode 100644 browser-extension/entrypoints/popup/components/PageFooter.tsx

diff --git a/browser-extension/entrypoints/popup/components/PageFooter.tsx b/browser-extension/entrypoints/popup/components/PageFooter.tsx
new file mode 100644
index 000000000..b19f9404f
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/PageFooter.tsx
@@ -0,0 +1,9 @@
+import type { ReactNode } from 'react'
+import { createPortal } from 'react-dom'
+import { useShell } from '../shell-context'
+
+/** A page's actions, in the bar the tab bar leaves when the page opens over it. */
+export function PageFooter({ children }: { children: ReactNode }) {
+	const { footer } = useShell()
+	return footer ? createPortal(children, footer) : null
+}
diff --git a/browser-extension/entrypoints/popup/components/components.test.tsx b/browser-extension/entrypoints/popup/components/components.test.tsx
index e38117732..d8f77a403 100644
--- a/browser-extension/entrypoints/popup/components/components.test.tsx
+++ b/browser-extension/entrypoints/popup/components/components.test.tsx
@@ -9,6 +9,7 @@ import { Avatar, initials } from './Avatar'
 import { Button } from './Button'
 import { Header } from './Header'
 import { MaskedField } from './MaskedField'
+import { PageFooter } from './PageFooter'
 import { Select } from './Select'
 import { TabBar } from './TabBar'
 import { Toast } from './Toast'
@@ -93,6 +94,18 @@ describe('TabBar', () => {
 	})
 })
 
+describe('PageFooter', () => {
+	it('renders into the shell footer, and nowhere without one', () => {
+		const footer = document.body.appendChild(document.createElement('div'))
+		const context = { refreshState: () => {}, toast: () => {}, launch: () => {} }
+		const { rerender } = render(<ShellContext.Provider value={{ ...context, footer: null }}><PageFooter><button type="button">Edit</button></PageFooter></ShellContext.Provider>)
+		expect(screen.queryByRole('button', { name: 'Edit' })).toBeNull()
+		rerender(<ShellContext.Provider value={{ ...context, footer }}><PageFooter><button type="button">Edit</button></PageFooter></ShellContext.Provider>)
+		expect(footer.contains(screen.getByRole('button', { name: 'Edit' }))).toBe(true)
+		footer.remove()
+	})
+})
+
 describe('Select', () => {
 	it('is named by its label and reports the chosen value', async () => {
 		const onChange = vi.fn()
@@ -120,7 +133,7 @@ describe('MaskedField', () => {
 		const writeText = fakeClipboard()
 		const toast = vi.fn()
 		vi.spyOn(browser.runtime, 'sendMessage').mockResolvedValue(null as never)
-		render(<ShellContext.Provider value={{ refreshState: () => {}, toast, launch: () => {} }}><MaskedField label="CVV" value="123" masked /></ShellContext.Provider>)
+		render(<ShellContext.Provider value={{ refreshState: () => {}, toast, launch: () => {}, footer: null }}><MaskedField label="CVV" value="123" masked /></ShellContext.Provider>)
 		expect(screen.queryByText('123')).toBeNull()
 		await user.click(screen.getByRole('button', { name: 'Show CVV' }))
 		expect(screen.getByText('123')).toBeTruthy()
diff --git a/browser-extension/entrypoints/popup/hooks/hooks.test.tsx b/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
index dfb889cc9..0470f1022 100644
--- a/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
+++ b/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
@@ -15,7 +15,7 @@ import { useVaultSnapshot } from './useVaultSnapshot'
 afterEach(cleanup)
 
 function shell(overrides: { refreshState?: () => void; toast?: (text: string) => void } = {}) {
-	const value = { refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), ...overrides }
+	const value = { refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), footer: null, ...overrides }
 	const wrapper = ({ children }: { children: ReactNode }) => <ShellContext.Provider value={value}>{children}</ShellContext.Provider>
 	return { value, wrapper }
 }
diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index 2f9b3e33d..fd1226be9 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -661,13 +661,37 @@ a {
 	outline-offset: -2px;
 }
 
-/* Toast, above the tab bar */
+/* A page's own actions, in place of the tab bar. A page without any shows no bar. */
+
+.popup__footer {
+	flex: none;
+	display: flex;
+	gap: 8px;
+	padding: 12px 16px;
+	background: var(--surface);
+	border-top: 1px solid var(--border);
+}
+
+.popup__footer:empty {
+	display: none;
+}
+
+.popup__footer .btn {
+	flex: 1;
+}
+
+/* Toast, above whichever bar is at the bottom */
+
+.popup__bottom {
+	position: relative;
+	flex: none;
+}
 
 .toast {
 	position: absolute;
 	left: 16px;
 	right: 16px;
-	bottom: 68px;
+	bottom: calc(100% + 16px);
 	display: flex;
 	justify-content: center;
 	pointer-events: none;
@@ -1168,15 +1192,6 @@ a {
 	border-radius: 50%;
 }
 
-.detail-actions {
-	display: flex;
-	gap: 8px;
-}
-
-.detail-actions .btn {
-	flex: 1;
-}
-
 .btn[aria-disabled='true'] {
 	opacity: 0.45;
 	cursor: not-allowed;
diff --git a/browser-extension/entrypoints/popup/shell-context.ts b/browser-extension/entrypoints/popup/shell-context.ts
index 01e280012..ca007b4ce 100644
--- a/browser-extension/entrypoints/popup/shell-context.ts
+++ b/browser-extension/entrypoints/popup/shell-context.ts
@@ -6,8 +6,10 @@ export interface ShellContextValue {
 	toast: (message: string) => void
 	/** Opens a launchable url in a new tab. */
 	launch: (url: string) => void
+	/** Where a page opened over a tab puts its actions; `null` while a tab shows. */
+	footer: HTMLElement | null
 }
 
-export const ShellContext = createContext<ShellContextValue>({ refreshState: () => {}, toast: () => {}, launch: () => {} })
+export const ShellContext = createContext<ShellContextValue>({ refreshState: () => {}, toast: () => {}, launch: () => {}, footer: null })
 
 export const useShell = () => useContext(ShellContext)
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
index 8f0786282..4cd9889c5 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
@@ -1,13 +1,21 @@
 // @vitest-environment happy-dom
 import { cleanup, render, screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DecryptedItem, FolderMeta, ItemMeta } from '@/src/messages'
 import { ShellContext } from '../shell-context'
 import { fakeBackground, itemMeta, sentKinds, types } from '../testing'
 import { ItemDetail } from './ItemDetail'
 
-afterEach(cleanup)
+// Shell's footer bar, where the detail portals Edit and Delete.
+let footer: HTMLElement
+beforeEach(() => {
+	footer = document.body.appendChild(document.createElement('div'))
+})
+afterEach(() => {
+	cleanup()
+	footer.remove()
+})
 
 const folders: FolderMeta[] = [{ id: 'w', name: 'Work', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }]
 
@@ -16,7 +24,7 @@ function renderDetail(item: ItemMeta, decrypted?: DecryptedItem, decryptError?:
 	const refreshState = vi.fn()
 	const launch = vi.fn()
 	const view = render(
-		<ShellContext.Provider value={{ refreshState, toast: vi.fn(), launch }}>
+		<ShellContext.Provider value={{ refreshState, toast: vi.fn(), launch, footer }}>
 			<ItemDetail item={item} type={types.find((t) => t.id === item.typeId)} folders={folders} webAppUrl="https://cloud.example.org/index.php/apps/keepiq/" />
 		</ShellContext.Provider>,
 	)
@@ -64,7 +72,7 @@ describe('login credentials', () => {
 		const decrypts = () => sentKinds(sent).filter((kind) => kind === 'item.decrypt').length
 		expect(decrypts()).toBe(1)
 		view.rerender(
-			<ShellContext.Provider value={{ refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn() }}>
+			<ShellContext.Provider value={{ refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), footer }}>
 				<ItemDetail item={itemMeta({ updatedAt: '2026-04-01T00:00:00Z' })} type={types[0]} folders={folders} webAppUrl="https://cloud.example.org/index.php/apps/keepiq/" />
 			</ShellContext.Provider>,
 		)
@@ -215,10 +223,10 @@ describe('metadata and actions', () => {
 		expect(within(history).getByText('Expires')).toBeTruthy()
 	})
 
-	it('has Edit and Delete disabled until a later update', () => {
+	it('has Edit and Delete in the footer, disabled until a later update', () => {
 		renderDetail(itemMeta())
 		for (const name of ['Edit', 'Delete']) {
-			const button = screen.getByRole('button', { name })
+			const button = within(footer).getByRole('button', { name })
 			expect(button.getAttribute('aria-disabled')).toBe('true')
 			expect(button.getAttribute('title')).toBe('Available in a later update')
 		}
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
index d8cb232b2..5b816f947 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
@@ -9,6 +9,7 @@ import { Banner, ErrorBanner } from '../components/ErrorBanner'
 import { Icon } from '../components/Icon'
 import { Loading } from '../components/Loading'
 import { MaskedField } from '../components/MaskedField'
+import { PageFooter } from '../components/PageFooter'
 import { TotpCode } from '../components/TotpCode'
 import { blockedText } from '../errors'
 import { useDecryptedFields } from '../hooks/useDecryptedFields'
@@ -210,10 +211,10 @@ export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
 					))}
 				</dl>
 			</section>
-			<div className="detail-actions">
+			<PageFooter>
 				<button type="button" className="btn btn--primary" aria-disabled="true" title={later}>{i18n.t('item.edit')}</button>
 				<button type="button" className="btn btn--danger" aria-disabled="true" title={later}>{i18n.t('item.delete')}</button>
-			</div>
+			</PageFooter>
 		</div>
 	)
 }
diff --git a/browser-extension/entrypoints/popup/views/Shell.test.tsx b/browser-extension/entrypoints/popup/views/Shell.test.tsx
index 77dedb89b..03142abee 100644
--- a/browser-extension/entrypoints/popup/views/Shell.test.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.test.tsx
@@ -104,9 +104,12 @@ describe('Shell', () => {
 		await user.click(await screen.findByRole('button', { name: 'TOTP' }))
 		await user.click(screen.getByRole('button', { name: /^Authy/ }))
 		expect((await title()).textContent).toBe('View item')
-		expect(screen.queryByRole('navigation', { name: 'Main' })).toBeTruthy()
+		// The detail covers the tab bar and puts its own actions there.
+		expect(screen.queryByRole('navigation', { name: 'Main' })).toBeNull()
+		expect(screen.getByRole('button', { name: 'Edit' }).closest('.popup__footer')).toBeTruthy()
 		await user.click(screen.getByRole('button', { name: 'Back' }))
 		expect((await title()).textContent).toBe('Vault')
+		expect(screen.getByRole('navigation', { name: 'Main' })).toBeTruthy()
 		expect(screen.getByRole('button', { name: 'TOTP' }).getAttribute('aria-pressed')).toBe('true')
 		expect(screen.queryByRole('button', { name: /^Bank/ })).toBeNull()
 	})
diff --git a/browser-extension/entrypoints/popup/views/Shell.tsx b/browser-extension/entrypoints/popup/views/Shell.tsx
index ca6652819..e9d30312c 100644
--- a/browser-extension/entrypoints/popup/views/Shell.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.tsx
@@ -28,7 +28,7 @@ interface Props {
 	refreshState: () => void
 }
 
-/** The unlocked popup: tabs, and on Vault the list with an item detail stacked over it. */
+/** The unlocked popup: tabs, and pages such as an item's detail or a settings section opened over them. */
 export function Shell({ active, lastTab, hidden = false, onAccounts, refreshState }: Props) {
 	const tab = useCurrentTab()
 	// Read once: a later state refresh must not pull the user off the tab they picked.
@@ -37,6 +37,7 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	const [section, setSection] = useState<SettingsSection | null>(null)
 	// A fresh object per call, so the same message twice restarts the timer.
 	const [toast, setToast] = useState<{ text: string } | null>(null)
+	const [footer, setFooter] = useState<HTMLElement | null>(null)
 	const body = useRef<HTMLDivElement>(null)
 	const listScroll = useRef(0)
 	const { reply, failed, syncNow } = useVaultSnapshot(tab?.url, tab !== undefined)
@@ -60,7 +61,8 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 		refreshState,
 		toast: (text: string) => setToast({ text }),
 		launch: (url: string) => void browser.tabs.create({ url, windowId: tab?.windowId }).catch(() => setToast({ text: i18n.t('vault.openFailed') })),
-	}), [refreshState, tab?.windowId])
+		footer,
+	}), [refreshState, tab?.windowId, footer])
 
 	const open = useCallback((id: string) => {
 		listScroll.current = body.current?.scrollTop ?? 0
@@ -108,6 +110,8 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	const inSection = current === 'settings' && section !== null
 	const title = detail ? i18n.t('titles.viewItem') : inSection ? sectionLabel(section) : tabLabel(current)
 	const back = detail ? () => setDetailId(null) : inSection ? () => setSection(null) : undefined
+	// A page opened from a tab covers the tab bar, as in Bitwarden, and gets the bar for its own actions.
+	const page = back !== undefined
 
 	return (
 		<ShellContext.Provider value={context}>
@@ -120,8 +124,10 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 					onPopout={isPopout ? undefined : () => void popout()}
 				/>
 				<div className="popup__body" ref={body}>{content}</div>
-				<Toast message={toast?.text ?? null} />
-				<TabBar active={current} onSelect={select} />
+				<div className="popup__bottom">
+					<Toast message={toast?.text ?? null} />
+					{page ? <div className="popup__footer" ref={setFooter} /> : <TabBar active={current} onSelect={select} />}
+				</div>
 			</main>
 		</ShellContext.Provider>
 	)
diff --git a/browser-extension/entrypoints/popup/views/VaultList.test.tsx b/browser-extension/entrypoints/popup/views/VaultList.test.tsx
index d9f8d3473..1e1b8cfe3 100644
--- a/browser-extension/entrypoints/popup/views/VaultList.test.tsx
+++ b/browser-extension/entrypoints/popup/views/VaultList.test.tsx
@@ -20,7 +20,7 @@ function renderList(snapshot: UnlockedSnapshot, options: { tab?: CurrentTab; dec
 	const onOpen = vi.fn()
 	const syncNow = vi.fn()
 	render(
-		<ShellContext.Provider value={{ refreshState: vi.fn(), toast, launch }}>
+		<ShellContext.Provider value={{ refreshState: vi.fn(), toast, launch, footer: null }}>
 			<VaultList snapshot={snapshot} tab={options.tab ?? { id: 1, windowId: 1, url: undefined, host: null }} syncNow={syncNow} onOpen={onOpen} />
 		</ShellContext.Provider>,
 	)
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
index 572ead587..6b0bb017c 100644
--- a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
@@ -69,15 +69,15 @@ describe('Settings', () => {
 		expect(theme()).toBeUndefined()
 	})
 
-	it('returns to the list after leaving the tab', async () => {
+	it('covers the tab bar while a section is open, with no footer of its own', async () => {
 		fakeBackground()
 		const user = await openSettings()
 		await user.click(screen.getByRole('button', { name: 'Appearance' }))
-		const tabs = within(screen.getByRole('navigation', { name: 'Main' }))
-		await user.click(tabs.getByRole('button', { name: 'Vault' }))
-		await user.click(tabs.getByRole('button', { name: 'Settings' }))
-		expect((await title()).textContent).toBe('Settings')
-		expect(screen.queryByRole('combobox', { name: 'Theme' })).toBeNull()
+		await screen.findByRole('combobox', { name: 'Theme' })
+		expect(screen.queryByRole('navigation', { name: 'Main' })).toBeNull()
+		expect(document.querySelector('.popup__footer')!.childElementCount).toBe(0)
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		expect(screen.getByRole('navigation', { name: 'Main' })).toBeTruthy()
 	})
 })
 
diff --git a/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md b/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
index 291b8de89..d117fd332 100644
--- a/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
+++ b/browser-extension/openspec/changes/ext-theme/specs/theme/spec.md
@@ -72,10 +72,10 @@ The extension SHALL show, in the Settings tab of the unlocked popup, the section
 - **WHEN** the section list renders
 - **THEN** Account security, Autofill, Notifications, Vault and About are disabled and explain "Available in a later update"
 
-#### Scenario: Leaving the tab
+#### Scenario: Section covers the tab bar
 - **GIVEN** the Appearance view is open
-- **WHEN** the user switches to the Vault tab and back
-- **THEN** the section list shows
+- **THEN** the tab bar is not shown
+- **AND** back returns to the section list with the tab bar
 
 #### Scenario: Background does not answer
 - **GIVEN** the background does not reply to `settings.set`
diff --git a/browser-extension/openspec/changes/ext-theme/tasks.md b/browser-extension/openspec/changes/ext-theme/tasks.md
index 78ac7f331..539558f54 100644
--- a/browser-extension/openspec/changes/ext-theme/tasks.md
+++ b/browser-extension/openspec/changes/ext-theme/tasks.md
@@ -18,7 +18,7 @@
 - [x] 3.2 Create `hooks/useSettings.ts` over `settings.get` and `settings.set`, applying and mirroring the theme on a reply
 - [x] 3.3 Create `views/settings/SettingsIndex.tsx`, `Appearance.tsx` and `Settings.tsx`, and wire them into Shell with the title and back control
   - Unbuilt sections are `aria-disabled` with "Available in a later update"
-  - Switching tabs returns to the section list
+  - An open section covers the tab bar until back
 - [x] 3.4 Add the text to `locales/en.yml` and `locales/nl.yml`
 - [x] 3.5 Extend `fakeBackground` and add view tests: the section list, opening Appearance, changing the theme, a failed write, and the theme on the unlock screen
 
diff --git a/browser-extension/openspec/changes/ext-vault-browse/design.md b/browser-extension/openspec/changes/ext-vault-browse/design.md
index 2ba921a3d..8ff401698 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/design.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/design.md
@@ -52,7 +52,7 @@ Added:
 - `src/totp/totp.ts`: `parseTotpSeed(value)`, `generateCode(params, now)`, `secondsRemaining(period, now)`.
 - `src/clipboard.ts`: `copyText(text)` for the popup, `clearClipboard()` for the background with the Chrome offscreen and Firefox page paths.
 - `entrypoints/offscreen/index.html`, `entrypoints/offscreen/main.ts`: Chrome-only clipboard-clear document (`include: ['chrome']`).
-- `entrypoints/popup/views/Shell.tsx`: tab bar, view stack (list to detail and back), locked and logged-out gating, popout detection, last-tab round trip.
+- `entrypoints/popup/views/Shell.tsx`: tab bar, view stack (list to detail and back), locked and logged-out gating, popout detection, last-tab round trip. An open page replaces the tab bar with a footer bar that the page fills through `components/PageFooter.tsx`, a portal, so its actions stay with the page's own logic.
 - `entrypoints/popup/views/VaultList.tsx`: search, folder and type filters, suggestions section, sorted list, empty and offline states.
 - `entrypoints/popup/components/Suggestions.tsx`: the "Autofill suggestions" block above the list, its own component because ext-autofill adds an `onFill` callback to it.
 - `entrypoints/popup/components/Toast.tsx`: transient confirmation and failure messages, used first by copy and later by fill.
diff --git a/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md b/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
index 0c7093cfb..c85501711 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
@@ -113,12 +113,12 @@ The detail SHALL show "Created" and "Updated" from `createdAt` and `updatedAt` a
 - **THEN** both dates appear in the metadata section in the user's locale
 
 ### Requirement: Edit and Delete placeholders
-The detail SHALL show Edit and Delete buttons at the bottom, disabled with the tooltip "Available in a later update" until ext-vault-edit enables them. For blocked items they stay disabled after ext-vault-edit as well, and for use-only items Edit does, since the server refuses to change a use-only copy.
+The detail SHALL show Edit and Delete buttons in its page footer, fixed below the scrolling content, disabled with the tooltip "Available in a later update" until ext-vault-edit enables them. For blocked items they stay disabled after ext-vault-edit as well, and for use-only items Edit does, since the server refuses to change a use-only copy.
 
 #### Scenario: Buttons before ext-vault-edit
 - **GIVEN** ext-vault-edit is not implemented
 - **WHEN** the detail opens
-- **THEN** Edit and Delete are visible and disabled with the tooltip
+- **THEN** Edit and Delete are visible in the footer without scrolling, and disabled with the tooltip
 
 ### Requirement: Decrypted values are dropped on close
 The detail view MUST keep decrypted values, parsed payloads, TOTP state and reveal state in popup memory only, MUST clear them when the view closes, the popup closes or the vault locks, and MUST NOT persist them anywhere.
diff --git a/browser-extension/openspec/changes/ext-vault-browse/specs/popup-shell/spec.md b/browser-extension/openspec/changes/ext-vault-browse/specs/popup-shell/spec.md
index 4c5755d84..5874c6004 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/specs/popup-shell/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/specs/popup-shell/spec.md
@@ -14,6 +14,19 @@ The popup SHALL consist of a fixed header, a scrolling content area and a fixed
 - **WHEN** the user activates Settings
 - **THEN** the Settings tab becomes active, the content area swaps and the header title updates
 
+### Requirement: Pages cover the tab bar
+A page opened from a tab, such as an item detail or a settings section, SHALL replace the tab bar for as long as it is open, as in Bitwarden. The header shows the page's title and a back control, which returns to the tab and brings the tab bar back. In the tab bar's place the page MAY show a footer with its own actions; a page without actions shows no bar.
+
+#### Scenario: Opening an item
+- **GIVEN** the Vault tab is active
+- **WHEN** the user opens an item
+- **THEN** the tab bar is gone and the footer holds the item's Edit and Delete
+- **AND** back returns to the list with the tab bar
+
+#### Scenario: Page without actions
+- **WHEN** the user opens a settings section that has no actions
+- **THEN** neither the tab bar nor a footer is shown
+
 ### Requirement: Placeholder tabs until their changes land
 The Generator, Send and Settings tabs SHALL exist in the tab bar from this change and SHALL render a placeholder view stating that the feature arrives in a later update, until ext-generator, ext-send and ext-settings replace them.
 
@@ -49,7 +62,7 @@ While the vault is locked the popup SHALL show the unlock view from ext-accounts
 - **THEN** the popup replaces its content with the unlock view and drops every decrypted value from memory
 
 ### Requirement: Popup dimensions
-The popup SHALL be 380 px wide and 600 px high, and the content area scrolls while header and tab bar stay fixed, as in Bitwarden.
+The popup SHALL be 380 px wide and 600 px high, and the content area scrolls while the header and the tab bar or page footer stay fixed, as in Bitwarden.
 
 #### Scenario: Long vault list
 - **GIVEN** 300 items in the vault

From 51a200854128c7df0925ac1bd55f10be06c12787 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Mon, 12 Oct 2026 14:02:26 +0200
Subject: [PATCH 4/9] feat(extension): add, edit, clone, move and delete items
 and manage folders (ext-vault-edit)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The popup sends plaintext drafts and the background does all the encryption, after it proves the suite certificate matches the unlocked key and checks the server's active suite is still the cached one. Edits fetch the item fresh and save only what changed, with `baseUpdatedAt`; shared copies keep their use-only, read-only and expiring limits in the popup and the background. Folders get create, rename and Keepiq's three delete modes from Settings → Vault → Folders, always reading the server's children first.

The API client reads Keepiq's 428 refusals like a 403, which also fixes the manifest fallback when an admin turned off offline caching. Shared edits reaching recipients is recorded as ext-share-sync; the non-transactional folder delete is keepiq#1248.
---
 browser-extension/ARCHITECTURE.md             |  19 +-
 browser-extension/CLAUDE.md                   |   2 +-
 browser-extension/SECURITY.md                 |  11 +-
 .../components/AdditionalFieldsEditor.tsx     |  37 ++
 .../popup/components/ConfirmDialog.tsx        |  67 ++++
 .../popup/components/FolderNameDialog.tsx     |  53 +++
 .../popup/components/FolderTree.tsx           |  14 +
 .../entrypoints/popup/components/Header.tsx   |   6 +-
 .../entrypoints/popup/components/Icon.tsx     |   1 +
 .../entrypoints/popup/components/ItemCard.tsx |  31 +-
 .../entrypoints/popup/components/Menu.tsx     |   6 +-
 .../entrypoints/popup/components/TextArea.tsx |  30 ++
 .../popup/components/TypeSelect.tsx           |   9 +
 .../popup/components/components.test.tsx      | 164 +++++++-
 browser-extension/entrypoints/popup/errors.ts |  50 ++-
 .../entrypoints/popup/hooks/hooks.test.tsx    |  73 +++-
 .../entrypoints/popup/hooks/useItemDraft.ts   |  34 ++
 .../popup/hooks/useUnsavedChangesGuard.ts     |  15 +
 .../popup/hooks/useVaultSnapshot.ts           |  25 +-
 browser-extension/entrypoints/popup/popup.css | 286 ++++++++++++++
 .../entrypoints/popup/shell-context.ts        |  27 +-
 .../entrypoints/popup/testing.ts              |  47 ++-
 .../popup/views/FolderPicker.test.tsx         |  51 +++
 .../entrypoints/popup/views/FolderPicker.tsx  |  54 +++
 .../popup/views/ItemDetail.test.tsx           |  85 +++-
 .../entrypoints/popup/views/ItemDetail.tsx    |  27 +-
 .../popup/views/ItemDialogs.test.tsx          |  67 ++++
 .../entrypoints/popup/views/ItemDialogs.tsx   |  71 ++++
 .../entrypoints/popup/views/ItemForm.test.tsx | 290 ++++++++++++++
 .../entrypoints/popup/views/ItemForm.tsx      | 280 +++++++++++++
 .../entrypoints/popup/views/Shell.test.tsx    | 182 ++++++++-
 .../entrypoints/popup/views/Shell.tsx         | 169 +++++++-
 .../popup/views/VaultList.test.tsx            |  32 +-
 .../popup/views/settings/FolderManager.tsx    | 224 +++++++++++
 .../popup/views/settings/Settings.test.tsx    | 193 ++++++++-
 .../popup/views/settings/Settings.tsx         |  20 +-
 .../popup/views/settings/SettingsIndex.tsx    |  10 +-
 .../popup/views/settings/Vault.tsx            |  18 +
 browser-extension/locales/en.yml              | 109 ++++++
 browser-extension/locales/nl.yml              | 109 ++++++
 browser-extension/openspec/README.md          |   1 +
 .../adr-002-key-lifetime-and-vault-cache.md   |   4 +-
 .../adr-003-keepiq-api-contract.md            |  16 +-
 .../specs/credential-generator/spec.md        |   7 +-
 .../openspec/changes/ext-generator/tasks.md   |   2 +-
 .../changes/ext-share-sync/proposal.md        |  63 +++
 .../changes/ext-vault-browse/design.md        |   4 +-
 .../ext-vault-browse/specs/vault-sync/spec.md |   4 +-
 .../changes/ext-vault-browse/tasks.md         |   2 +-
 .../openspec/changes/ext-vault-edit/design.md | 108 ++++--
 .../changes/ext-vault-edit/proposal.md        |  14 +-
 .../specs/folder-management/spec.md           |  30 +-
 .../ext-vault-edit/specs/item-editing/spec.md |  98 ++++-
 .../openspec/changes/ext-vault-edit/tasks.md  |  64 +--
 browser-extension/src/accounts/store.ts       |   4 +-
 browser-extension/src/api/client.test.ts      |  11 +
 browser-extension/src/api/client.ts           |  13 +-
 browser-extension/src/api/types.ts            |   6 +-
 .../src/background/background.test.ts         |  10 +
 .../src/background/requests.test.ts           |  43 +-
 browser-extension/src/background/requests.ts  |  38 +-
 browser-extension/src/messages.ts             |  96 ++++-
 browser-extension/src/vault/fields.test.ts    | 154 ++++++++
 browser-extension/src/vault/fields.ts         | 233 +++++++++++
 browser-extension/src/vault/store.test.ts     |   8 +-
 browser-extension/src/vault/store.ts          |   4 +-
 browser-extension/src/vault/sync.test.ts      |  41 +-
 browser-extension/src/vault/sync.ts           |  33 +-
 browser-extension/src/vault/types.ts          |   2 +
 browser-extension/src/vault/write.test.ts     | 367 ++++++++++++++++++
 browser-extension/src/vault/write.ts          | 266 +++++++++++++
 docs/browser-extension/privacy.md             |   7 +-
 docs/browser-extension/using.md               |  35 +-
 73 files changed, 4547 insertions(+), 239 deletions(-)
 create mode 100644 browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/ConfirmDialog.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/FolderNameDialog.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/FolderTree.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/TextArea.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/TypeSelect.tsx
 create mode 100644 browser-extension/entrypoints/popup/hooks/useItemDraft.ts
 create mode 100644 browser-extension/entrypoints/popup/hooks/useUnsavedChangesGuard.ts
 create mode 100644 browser-extension/entrypoints/popup/views/FolderPicker.test.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/FolderPicker.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/ItemDialogs.test.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/ItemDialogs.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/ItemForm.test.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/ItemForm.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
 create mode 100644 browser-extension/entrypoints/popup/views/settings/Vault.tsx
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/proposal.md
 create mode 100644 browser-extension/src/vault/fields.test.ts
 create mode 100644 browser-extension/src/vault/fields.ts
 create mode 100644 browser-extension/src/vault/write.test.ts
 create mode 100644 browser-extension/src/vault/write.ts

diff --git a/browser-extension/ARCHITECTURE.md b/browser-extension/ARCHITECTURE.md
index 5b2e9cec1..c36db5f88 100644
--- a/browser-extension/ARCHITECTURE.md
+++ b/browser-extension/ARCHITECTURE.md
@@ -29,6 +29,8 @@ How the extension is put together. Decisions live in the ADRs under [openspec/ar
   - `match.ts`: base-domain matching for suggestions.
   - `list.ts`: sorting, filtering and the folder tree.
   - `payloads.ts`: parses card, identity and passkey payloads.
+  - `fields.ts`: the item form's model, limits and validation; pure, so the popup may use it.
+  - `write.ts`: item and folder writes, the only code that encrypts.
   - `url.ts`: the one rule for turning an item URL into a link.
   - `icons.ts`: type icons.
 - `src/background/`:
@@ -48,7 +50,8 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | Direction | Kinds | Reply |
 | --- | --- | --- |
 | Popup → background, account actions | `accounts.*`, `vault.unlock`, `vault.lock`, `vault.lockAll`, `vault.status` | `Result`: `{ ok: true, state }` or `{ ok: false, code }` |
-| Popup → background, vault requests | `vault.snapshot`, `vault.sync`, `item.decrypt`, `clipboard.copied`, `popup.popout`, `popup.lastTab.set` | The typed reply in `PopupReplies`; `undefined` when the background failed |
+| Popup → background, vault requests | `vault.snapshot`, `vault.sync`, `item.decrypt`, `clipboard.copied`, `popup.popout`, `popup.lastTab.set`, `settings.*` | The typed reply in `PopupReplies`; `undefined` when the background failed |
+| Popup → background, writes | `item.fetch`, `item.create`, `item.update`, `item.delete`, `folder.create`, `folder.rename`, `folder.children`, `folder.delete`, `folder.dismissNotice` | `WriteResult`: `{ ok: true, value }` or `{ ok: false, error }`, after the sync that follows a write |
 | Background → popup | `vault.changed`, `vault.locked` | None; the popup re-reads |
 | Background → offscreen | `offscreen.clearClipboard` | Whether it cleared |
 | Content → background | `page_ready` | None |
@@ -67,7 +70,8 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | `settings.global` | local | The theme; survives logout |
 | `keepiq.theme` | popup `localStorage` | A mirror of the theme for the first frame, never read by the background |
 | `suite.<id>` | local | The active suite row, private key still wrapped |
-| `vaultCache.<id>` | local | The snapshot: secret rows, folders, types, suite id and epoch, counts |
+| `vaultCache.<id>` | local | The snapshot: secret rows, folders, types, suite id and epoch, counts, the default item type |
+| `folderNotice.<id>` | local | The folder manager's plaintext-names notice was dismissed |
 | `vaultCheckedAt.<id>` | local | When the server was last checked |
 | `neverLockKey.<id>` | local | The unwrapped key, under the "Never" timeout only |
 | `privateKeyPkcs8.<id>` | session | The unwrapped key while unlocked |
@@ -91,12 +95,21 @@ Where `storage.session` is missing (Firefox below 115), session values live in b
 - **Triggers:** unlock, opening the popup with a missing or stale snapshot, the `vault-sync` alarm every 15 minutes, and "Sync now". One sync runs per account; a later trigger joins the one running.
 - **Probe:** the newest row and the total, plus the suite list. When nothing changed and the folder and type lists are under 60 minutes old, the sync only records the check time.
 - **Full:**
-  1. Fetch the manifest. On 403 or 404, at 1000 rows, or when the cached total is 1000 or more, page through the secret list instead.
+  1. Fetch the manifest, and the user settings beside it for the default item type. On a refusal (403 or 428) or 404, at 1000 rows, or when the cached total is 1000 or more, page through the secret list instead.
   2. Handle a two-factor block, then a suite change.
   3. Mark rows on blocked suites.
   4. Write the snapshot in one `set`.
 - **Logout during a sync:** checked after every write, and the writes are undone.
 
+### Writes
+
+- **The popup sends plaintext,** the background encrypts with the cached suite's certificate, once it proved that certificate matches the unlocked key and the server's active suite is still that one.
+- **Each write names its account,** and is refused when that is no longer the active one.
+- **Shared copies keep their limits** (use-only, read-only, expiring) in the popup and again in the background.
+- **Edit and Clone fetch the item fresh** from the server; Edit saves the changed fields with `baseUpdatedAt`, so a newer version is not overwritten.
+- **Every write records** whether the server answered, which drives the same offline flag as sync.
+- **A successful write runs a full sync** and replies after it, waiting for a sync that started earlier.
+
 ### Timeout
 
 - `enforce()` runs on the `vault-timeout` alarm and before every popup request, and locks or logs out each account past its timeout.
diff --git a/browser-extension/CLAUDE.md b/browser-extension/CLAUDE.md
index a91f0c997..4db5cf90a 100644
--- a/browser-extension/CLAUDE.md
+++ b/browser-extension/CLAUDE.md
@@ -82,7 +82,7 @@ empty. Each entry: the choice, the options, and what it blocks. -->
 - Whether the "Custom" vault timeout is capped (for example at 24 hours) or
   unbounded. Blocks the timeout options in `ext-settings` (ADR-002).
 - Whether the paginated fallback may persist the vault when the admin turned off
-  offline caching (the manifest answers 403). It does today, as `ext-vault-browse`
+  offline caching (the manifest refuses with 428). It does today, as `ext-vault-browse`
   specifies; the alternative keeps it in `storage.session` for the browser session only.
 
 ## Additional rules
diff --git a/browser-extension/SECURITY.md b/browser-extension/SECURITY.md
index 2de3603bf..e95222224 100644
--- a/browser-extension/SECURITY.md
+++ b/browser-extension/SECURITY.md
@@ -20,7 +20,7 @@ The extension uses the same end-to-end encryption as the Keepiq web app and is b
 | --- | --- | --- |
 | Master password | Nowhere | — |
 | Private key | `storage.session` (memory, cleared on browser restart). Firefox below 115 uses background page memory instead. | Lock, timeout, logout, browser restart, extension reload |
-| Decrypted values | Popup memory while shown, never the value of a use-only copy | Closing the item or the popup |
+| Decrypted values, unsaved forms | Popup memory while shown, never the value of a use-only copy | Closing the item, the form or the popup |
 | Ciphertext, names, URLs, folders, types | `storage.local` | Logout, account removal, a key change on the server |
 | App password | `storage.local` | Logout, account removal, the server answering 401 |
 | Account list and settings | `storage.local` | Account removal |
@@ -61,6 +61,15 @@ There is no remote wipe, so these checks stand in for it:
 - The popup gets item metadata and ids. It gets decrypted fields only on request, and ciphertext never. Of a use-only copy it gets only the login; the background refuses its value and additional fields.
 - No remote code is loaded, and the popup renders no HTML from vault data.
 
+## Saving
+
+- The popup sends what you typed to the background, which does all the encryption.
+- Before it encrypts, the extension checks that the server's active key is still the one it holds, and proves the server's certificate belongs to your unlocked key. Otherwise nothing is written.
+- A save goes to the account the popup showed, and is refused when another window switched accounts.
+- Edit fetches the item fresh, sends only what changed, and is refused when a newer version was saved elsewhere.
+- Shared copies keep their limits: a use-only copy is never shown, copied or changed, a read-only one can only be filed in a folder, and no restricted copy can be cloned.
+- Delete moves an item to Keepiq's trash and ends its shares. A folder delete is immediate, and "Delete items too" deletes them for good.
+
 ## Clipboard
 
 - Copy happens in the popup, under your click.
diff --git a/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx b/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
new file mode 100644
index 000000000..3a97a1dd7
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
@@ -0,0 +1,37 @@
+import { i18n } from '#i18n'
+import { customField, type CustomField, type FormErrors } from '@/src/vault/fields'
+import { fieldErrorText } from '../errors'
+import { Button, IconButton } from './Button'
+import { Icon } from './Icon'
+import { TextField } from './TextField'
+
+interface Props {
+	fields: CustomField[]
+	/** The errors to show now, keyed as `validate` keys them. */
+	errors: FormErrors
+	onChange: (fields: CustomField[]) => void
+}
+
+/** Values are masked until revealed; the blob stores no field type, so that is view state only. */
+export function AdditionalFieldsEditor({ fields, errors, onChange }: Props) {
+	const update = (id: number, patch: Partial<CustomField>) => onChange(fields.map((field) => field.id === id ? { ...field, ...patch } : field))
+	const error = (path: string) => errors[path] && fieldErrorText(errors[path])
+	return (
+		<div className="custom-fields">
+			{fields.map((field) => (
+				<div key={field.id} className="custom-field">
+					<div className="custom-field__inputs">
+						<TextField label={i18n.t('form.fieldName')} value={field.name} onChange={(name) => update(field.id, { name })} error={error(`field.${field.id}.name`)} autoComplete="off" />
+						<TextField label={field.name.trim() || i18n.t('form.fieldValue')} type="password" value={field.value} onChange={(value) => update(field.id, { value })} error={error(`field.${field.id}.value`)} autoComplete="off" />
+					</div>
+					<IconButton
+						icon="trash"
+						label={field.name.trim() ? i18n.t('form.removeField', { name: field.name.trim() }) : i18n.t('form.removeUnnamed')}
+						onClick={() => onChange(fields.filter((other) => other.id !== field.id))}
+					/>
+				</div>
+			))}
+			<Button variant="link" onClick={() => onChange([...fields, customField()])}><Icon name="plus" />{i18n.t('form.addField')}</Button>
+		</div>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/ConfirmDialog.tsx b/browser-extension/entrypoints/popup/components/ConfirmDialog.tsx
new file mode 100644
index 000000000..3d54ec68e
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/ConfirmDialog.tsx
@@ -0,0 +1,67 @@
+import { useEffect, useId, useRef, type KeyboardEvent, type ReactNode } from 'react'
+import { i18n } from '#i18n'
+import { Button } from './Button'
+import { Banner } from './ErrorBanner'
+
+export interface DialogAction {
+	label: string
+	onClick: () => void
+	variant?: 'primary' | 'secondary' | 'danger'
+	busy?: boolean
+	disabled?: boolean
+}
+
+interface Props {
+	title: string
+	children?: ReactNode
+	actions: DialogAction[]
+	onCancel: () => void
+	cancelLabel?: string
+	error?: string | null
+	/** Offered beside the error, for failures a second try can fix. */
+	onRetry?: () => void
+}
+
+const FOCUSABLE = 'button:not([disabled]), input:not([disabled]), select:not([disabled]), textarea:not([disabled]), a[href]'
+
+/** In the page, never `window.confirm`: Firefox closes an extension popup when a native dialog opens. */
+export function ConfirmDialog({ title, children, actions, onCancel, cancelLabel, error, onRetry }: Props) {
+	const id = useId()
+	const box = useRef<HTMLDivElement>(null)
+
+	useEffect(() => {
+		const opener = document.activeElement as HTMLElement | null
+		box.current?.querySelector<HTMLElement>(FOCUSABLE)?.focus()
+		return () => opener?.focus()
+	}, [])
+
+	function onKeyDown(event: KeyboardEvent) {
+		if (event.key === 'Escape') {
+			event.stopPropagation()
+			onCancel()
+		} else if (event.key === 'Tab') {
+			// Keeps focus inside, as `aria-modal` promises.
+			const all = [...(box.current?.querySelectorAll<HTMLElement>(FOCUSABLE) ?? [])]
+			const at = all.indexOf(document.activeElement as HTMLElement)
+			const next = event.shiftKey ? (at <= 0 ? all.length - 1 : at - 1) : (at === all.length - 1 ? 0 : at + 1)
+			event.preventDefault()
+			all[next]?.focus()
+		}
+	}
+
+	return (
+		<div className="dialog-backdrop" onMouseDown={(event) => event.target === event.currentTarget && onCancel()}>
+			<div className="dialog" role="dialog" aria-modal="true" aria-labelledby={id} ref={box} onKeyDown={onKeyDown}>
+				<h2 className="dialog__title" id={id}>{title}</h2>
+				{children && <div className="dialog__body">{children}</div>}
+				{error && <Banner tone="error" role="alert" action={onRetry && <Button variant="link" onClick={onRetry}>{i18n.t('vault.tryAgain')}</Button>}>{error}</Banner>}
+				<div className="dialog__actions">
+					{actions.map((action) => (
+						<Button key={action.label} variant={action.variant ?? 'primary'} busy={action.busy} disabled={action.disabled} onClick={action.onClick}>{action.label}</Button>
+					))}
+					<Button variant="secondary" onClick={onCancel}>{cancelLabel ?? i18n.t('common.cancel')}</Button>
+				</div>
+			</div>
+		</div>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/FolderNameDialog.tsx b/browser-extension/entrypoints/popup/components/FolderNameDialog.tsx
new file mode 100644
index 000000000..fe183c321
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/FolderNameDialog.tsx
@@ -0,0 +1,53 @@
+import { useState } from 'react'
+import { i18n } from '#i18n'
+import type { VaultWriteError } from '@/src/messages'
+import { writeErrorText } from '../errors'
+import { request } from '../hooks/useMessage'
+import { useShell } from '../shell-context'
+import { ConfirmDialog } from './ConfirmDialog'
+import { TextField } from './TextField'
+
+type Target = { create: { parentId: string | null } } | { rename: { id: string; name: string } }
+
+/** Create or rename one folder; the typed name survives every failure. `onDone` gets the new folder's id, `null` on rename. */
+export function FolderNameDialog({ target, onDone, onCancel }: { target: Target; onDone: (id: string | null) => void; onCancel: () => void }) {
+	const { accountId, refreshState } = useShell()
+	const [name, setName] = useState('rename' in target ? target.rename.name : '')
+	const [local, setLocal] = useState<string | null>(null)
+	const [failure, setFailure] = useState<{ error: VaultWriteError | undefined } | null>(null)
+	const [busy, setBusy] = useState(false)
+
+	async function save() {
+		const trimmed = name.trim()
+		// The server's own rules, so a typo costs no round trip.
+		if (!trimmed) return setLocal(i18n.t('fieldErrors.required'))
+		if (trimmed.includes('/')) return setLocal(i18n.t('fieldErrors.slash'))
+		setLocal(null)
+		setBusy(true)
+		const reply = 'create' in target
+			? await request({ kind: 'folder.create', accountId, name: trimmed, parentId: target.create.parentId })
+			: await request({ kind: 'folder.rename', accountId, id: target.rename.id, name: trimmed })
+		setBusy(false)
+		if (reply?.ok) return onDone(reply.value?.id ?? null)
+		if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') refreshState()
+		setFailure({ error: reply?.error })
+	}
+
+	const retryable = !failure?.error || failure.error.code === 'offline' || failure.error.code === 'server_error'
+	return (
+		<ConfirmDialog
+			title={'create' in target ? i18n.t('folders.newFolder') : i18n.t('folders.renameTitle')}
+			actions={[{ label: i18n.t('form.save'), onClick: () => void save(), busy }]}
+			onCancel={onCancel}
+			error={failure && writeErrorText(failure.error, 'folderName')}
+			onRetry={retryable ? () => void save() : undefined}
+		>
+			<form onSubmit={(event) => {
+				event.preventDefault()
+				void save()
+			}}>
+				<TextField label={i18n.t('folders.name')} value={name} onChange={setName} error={local} autoComplete="off" />
+			</form>
+		</ConfirmDialog>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/FolderTree.tsx b/browser-extension/entrypoints/popup/components/FolderTree.tsx
new file mode 100644
index 000000000..a5b6edbe6
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/FolderTree.tsx
@@ -0,0 +1,14 @@
+import type { CSSProperties, ReactNode } from 'react'
+import type { FolderMeta } from '@/src/messages'
+import { flattenFolders, type FlatFolder } from '@/src/vault/list'
+
+/** Folders indented by `parentId`, sorted by name per level; the picker and the manager draw the rows. */
+export function FolderTree({ folders, row }: { folders: FolderMeta[]; row: (folder: FlatFolder) => ReactNode }) {
+	return (
+		<ul className="folder-tree">
+			{flattenFolders(folders).map((folder) => (
+				<li key={folder.id} className="folder-tree__row" style={{ '--depth': folder.depth } as CSSProperties}>{row(folder)}</li>
+			))}
+		</ul>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/Header.tsx b/browser-extension/entrypoints/popup/components/Header.tsx
index 9dd6a0944..88730c978 100644
--- a/browser-extension/entrypoints/popup/components/Header.tsx
+++ b/browser-extension/entrypoints/popup/components/Header.tsx
@@ -2,6 +2,7 @@ import { i18n } from '#i18n'
 import type { AccountSummary } from '@/src/messages'
 import { Avatar } from './Avatar'
 import { IconButton } from './Button'
+import { Icon } from './Icon'
 import { accountName } from './LogOutConfirm'
 import { Logo } from './Logo'
 
@@ -11,16 +12,19 @@ interface Props {
 	onAvatarClick?: () => void
 	/** Set on views opened over another; replaces the logo. */
 	onBack?: () => void
+	/** Shows the New button, on the Vault tab. */
+	onAdd?: () => void
 	/** Shows the pop-out button; left out inside a popped-out window. */
 	onPopout?: () => void
 }
 
-export function Header({ title, active, onAvatarClick, onBack, onPopout }: Props) {
+export function Header({ title, active, onAvatarClick, onBack, onAdd, onPopout }: Props) {
 	return (
 		<header className="header">
 			{onBack ? <IconButton icon="back" label={i18n.t('common.back')} onClick={onBack} /> : <Logo size={22} />}
 			{/* A spacer while loading; an empty heading would still be announced. */}
 			{title ? <h1 className="header__title">{title}</h1> : <span className="header__title" />}
+			{onAdd && <button type="button" className="btn btn--primary btn--small" onClick={onAdd}><Icon name="plus" />{i18n.t('header.new')}</button>}
 			{onPopout && <IconButton icon="popout" label={i18n.t('header.popout')} onClick={onPopout} />}
 			{active && onAvatarClick && (
 				<button type="button" className="header__avatar" onClick={onAvatarClick} aria-label={i18n.t('header.accounts', { name: active.displayName })} title={accountName(active)}>
diff --git a/browser-extension/entrypoints/popup/components/Icon.tsx b/browser-extension/entrypoints/popup/components/Icon.tsx
index 9332176ce..d82ab8af7 100644
--- a/browser-extension/entrypoints/popup/components/Icon.tsx
+++ b/browser-extension/entrypoints/popup/components/Icon.tsx
@@ -15,6 +15,7 @@ const PATHS = {
 	more: <><circle cx="12" cy="5" r="1" /><circle cx="12" cy="12" r="1" /><circle cx="12" cy="19" r="1" /></>,
 	search: <><circle cx="11" cy="11" r="7" /><path d="m21 21-4.3-4.3" /></>,
 	close: <path d="M18 6 6 18M6 6l12 12" />,
+	trash: <><path d="M3 6h18M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2" /><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6M10 11v6M14 11v6" /></>,
 	chevronDown: <path d="m6 9 6 6 6-6" />,
 	chevronRight: <path d="m9 18 6-6-6-6" />,
 	bell: <><path d="M6 8a6 6 0 0 1 12 0c0 7 3 9 3 9H3s3-2 3-9" /><path d="M10.3 21a1.94 1.94 0 0 0 3.4 0" /></>,
diff --git a/browser-extension/entrypoints/popup/components/ItemCard.tsx b/browser-extension/entrypoints/popup/components/ItemCard.tsx
index 62e2e48a2..9a80bb110 100644
--- a/browser-extension/entrypoints/popup/components/ItemCard.tsx
+++ b/browser-extension/entrypoints/popup/components/ItemCard.tsx
@@ -4,9 +4,10 @@ import { generateCode, parseTotpSeed } from '@/src/totp/totp'
 import { typeIcon } from '@/src/vault/icons'
 import { launchUrl } from '@/src/vault/list'
 import { useClipboard } from '../hooks/useClipboard'
+import { language } from '../i18n'
 import { loginKey } from '../hooks/useDecryptedFields'
 import { request } from '../hooks/useMessage'
-import { useShell } from '../shell-context'
+import { useShell, type ItemActions } from '../shell-context'
 import { IconButton } from './Button'
 import { Icon } from './Icon'
 import { Menu, type MenuItem } from './Menu'
@@ -14,6 +15,24 @@ import { Menu, type MenuItem } from './Menu'
 /** Types whose `key` is a structured payload or a seed, not something to paste as a password. */
 const NO_PASSWORD = new Set(['totp', 'card', 'identity', 'passkey'])
 
+/** Edit, Clone, Move and Delete with the reason each is unavailable, for the More menu and item detail alike. */
+export function itemActions(item: ItemMeta, type: TypeMeta | undefined, offline: boolean, actions: ItemActions) {
+	const offlineReason = offline ? i18n.t('form.offline') : undefined
+	const blockedReason = item.blocked ? i18n.t('blocked.generic') : undefined
+	const passkeyReason = type?.name === 'passkey' ? i18n.t('item.passkeyNoClone') : undefined
+	// The share's limits, which the background enforces too (Keepiq `use-only-shares`, `expiring-shares`).
+	const useOnly = item.useOnly ? i18n.t('item.useOnly') : undefined
+	const readOnly = item.readOnly ? i18n.t('item.readOnly') : undefined
+	const expiring = item.accessExpiresAt ? i18n.t('item.expiringNoClone', { date: new Date(item.accessExpiresAt).toLocaleDateString(language()) }) : undefined
+	return {
+		// Edit reads the item first and refuses there when offline, so it is not refused for that up front.
+		edit: { label: i18n.t('item.edit'), onSelect: () => actions.edit(item.id), disabledReason: blockedReason ?? useOnly ?? readOnly },
+		clone: { label: i18n.t('item.clone'), onSelect: () => actions.clone(item.id), disabledReason: passkeyReason ?? blockedReason ?? useOnly ?? readOnly ?? expiring ?? offlineReason },
+		move: { label: i18n.t('item.move'), onSelect: () => actions.move(item), disabledReason: useOnly ?? offlineReason },
+		remove: { label: i18n.t('item.delete'), onSelect: () => actions.remove(item), disabledReason: offlineReason },
+	} satisfies Record<string, MenuItem>
+}
+
 interface Props {
 	item: ItemMeta
 	type: TypeMeta | undefined
@@ -57,7 +76,7 @@ export function ItemCard({ item, type, login, onOpen }: Props) {
 	if (item.hasLogin) copyItems.push({ label: i18n.t('item.copyUsername'), onSelect: () => void copyField('login', i18n.t('detail.username')) })
 	if (!item.useOnly && !NO_PASSWORD.has(type?.name ?? '')) copyItems.push({ label: i18n.t('item.copyPassword'), onSelect: () => void copyField('key', i18n.t('detail.password')) })
 	if (!item.useOnly && type?.name === 'totp') copyItems.push({ label: i18n.t('item.copyCode'), onSelect: () => void copyCode() })
-	const later = i18n.t('common.later')
+	const actions = itemActions(item, type, shell.offline, shell.items)
 
 	const subtitle = item.hasLogin ? login : type?.label
 
@@ -81,10 +100,10 @@ export function ItemCard({ item, type, login, onOpen }: Props) {
 					icon="more"
 					items={[
 						{ label: i18n.t('item.view'), onSelect: () => onOpen(item.id) },
-						{ label: i18n.t('item.edit'), onSelect: () => {}, disabledReason: later },
-						{ label: i18n.t('item.clone'), onSelect: () => {}, disabledReason: later },
-						{ label: i18n.t('item.move'), onSelect: () => {}, disabledReason: later },
-						{ label: i18n.t('item.delete'), onSelect: () => {}, disabledReason: later },
+						actions.edit,
+						actions.clone,
+						actions.move,
+						actions.remove,
 					]}
 				/>
 			</div>
diff --git a/browser-extension/entrypoints/popup/components/Menu.tsx b/browser-extension/entrypoints/popup/components/Menu.tsx
index 7deccc29b..7b35a762f 100644
--- a/browser-extension/entrypoints/popup/components/Menu.tsx
+++ b/browser-extension/entrypoints/popup/components/Menu.tsx
@@ -17,9 +17,11 @@ interface Props {
 	className?: string
 	pressed?: boolean
 	disabled?: boolean
+	/** Always open upward, e.g. from the footer bar below the scroll area. */
+	above?: boolean
 }
 
-export function Menu({ label, items, icon, text, className, pressed, disabled }: Props) {
+export function Menu({ label, items, icon, text, className, pressed, disabled, above = false }: Props) {
 	const [open, setOpen] = useState(false)
 	const [up, setUp] = useState(false)
 	const wrapper = useRef<HTMLDivElement>(null)
@@ -89,7 +91,7 @@ export function Menu({ label, items, icon, text, className, pressed, disabled }:
 				{text}
 			</button>
 			{open && (
-				<ul className={`popover${up ? ' popover--up' : ''}`} role="menu" id={id} aria-label={label}>
+				<ul className={`popover${up || above ? ' popover--up' : ''}`} role="menu" id={id} aria-label={label}>
 					{items.map((item) => (
 						<li key={item.label} role="none">
 							<button
diff --git a/browser-extension/entrypoints/popup/components/TextArea.tsx b/browser-extension/entrypoints/popup/components/TextArea.tsx
new file mode 100644
index 000000000..673e95105
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/TextArea.tsx
@@ -0,0 +1,30 @@
+import { useId, type TextareaHTMLAttributes } from 'react'
+
+interface Props extends Omit<TextareaHTMLAttributes<HTMLTextAreaElement>, 'onChange'> {
+	label: string
+	value: string
+	onChange: (value: string) => void
+	error?: string | null
+	/** For keys and certificates, where every character must be told apart. */
+	mono?: boolean
+}
+
+export function TextArea({ label, value, onChange, error, rows = 4, mono = false, ...rest }: Props) {
+	const id = useId()
+	return (
+		<div className="field">
+			<label className="field__label" htmlFor={id}>{label}</label>
+			<textarea
+				{...rest}
+				id={id}
+				className={`field__input field__input--area${mono ? ' field__input--mono' : ''}`}
+				rows={rows}
+				value={value}
+				onChange={(event) => onChange(event.target.value)}
+				aria-invalid={error ? true : undefined}
+				aria-describedby={error ? `${id}-error` : undefined}
+			/>
+			{error && <p className="field__error" id={`${id}-error`}>{error}</p>}
+		</div>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/TypeSelect.tsx b/browser-extension/entrypoints/popup/components/TypeSelect.tsx
new file mode 100644
index 000000000..9b3d6582f
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/TypeSelect.tsx
@@ -0,0 +1,9 @@
+import { i18n } from '#i18n'
+import type { TypeMeta } from '@/src/messages'
+import { Select } from './Select'
+
+/** Passkeys come from a passkey ceremony, so they are offered only to show an existing one's type. */
+export function TypeSelect({ types, value, onChange, disabled }: { types: TypeMeta[]; value: string; onChange: (typeId: string) => void; disabled?: boolean }) {
+	const options = types.filter((type) => type.name !== 'passkey' || type.id === value).map((type) => ({ value: type.id, label: type.label }))
+	return <Select label={i18n.t('form.type')} value={value} options={options} onChange={onChange} disabled={disabled} />
+}
diff --git a/browser-extension/entrypoints/popup/components/components.test.tsx b/browser-extension/entrypoints/popup/components/components.test.tsx
index d8f77a403..f5dba4cbf 100644
--- a/browser-extension/entrypoints/popup/components/components.test.tsx
+++ b/browser-extension/entrypoints/popup/components/components.test.tsx
@@ -1,20 +1,28 @@
 // @vitest-environment happy-dom
 import { cleanup, render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { useState } from 'react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { ErrorCode } from '@/src/messages'
 import { setLocale } from '@/src/testing/i18n'
-import { errorText } from '../errors'
+import { customField, type CustomField } from '@/src/vault/fields'
+import { errorText, writeErrorText } from '../errors'
+import { AdditionalFieldsEditor } from './AdditionalFieldsEditor'
 import { Avatar, initials } from './Avatar'
 import { Button } from './Button'
+import { ConfirmDialog } from './ConfirmDialog'
+import { FolderTree } from './FolderTree'
 import { Header } from './Header'
+import { TextArea } from './TextArea'
+import { TypeSelect } from './TypeSelect'
 import { MaskedField } from './MaskedField'
 import { PageFooter } from './PageFooter'
 import { Select } from './Select'
 import { TabBar } from './TabBar'
 import { Toast } from './Toast'
-import { ShellContext } from '../shell-context'
-import { account, fakeClipboard } from '../testing'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
+import { account, fakeBackground, fakeClipboard, sentOf, types } from '../testing'
+import { FolderNameDialog } from './FolderNameDialog'
 
 afterEach(cleanup)
 
@@ -80,6 +88,18 @@ describe('Header', () => {
 	it('leaves out the pop-out button when not given', () => {
 		render(<Header title="Vault" active={account()} />)
 		expect(screen.queryByRole('button', { name: 'Pop out' })).toBeNull()
+		expect(screen.queryByRole('button', { name: 'New' })).toBeNull()
+	})
+
+	it('puts a primary New left of Pop out', async () => {
+		const onAdd = vi.fn()
+		render(<Header title="Vault" active={account()} onAvatarClick={() => {}} onAdd={onAdd} onPopout={() => {}} />)
+		const buttons = screen.getAllByRole('button')
+		const add = screen.getByRole('button', { name: 'New' })
+		expect(add.className).toContain('btn--primary')
+		expect(buttons.indexOf(add)).toBe(buttons.indexOf(screen.getByRole('button', { name: 'Pop out' })) - 1)
+		await userEvent.setup().click(add)
+		expect(onAdd).toHaveBeenCalled()
 	})
 })
 
@@ -97,7 +117,7 @@ describe('TabBar', () => {
 describe('PageFooter', () => {
 	it('renders into the shell footer, and nowhere without one', () => {
 		const footer = document.body.appendChild(document.createElement('div'))
-		const context = { refreshState: () => {}, toast: () => {}, launch: () => {} }
+		const context = DEFAULT_SHELL
 		const { rerender } = render(<ShellContext.Provider value={{ ...context, footer: null }}><PageFooter><button type="button">Edit</button></PageFooter></ShellContext.Provider>)
 		expect(screen.queryByRole('button', { name: 'Edit' })).toBeNull()
 		rerender(<ShellContext.Provider value={{ ...context, footer }}><PageFooter><button type="button">Edit</button></PageFooter></ShellContext.Provider>)
@@ -133,7 +153,7 @@ describe('MaskedField', () => {
 		const writeText = fakeClipboard()
 		const toast = vi.fn()
 		vi.spyOn(browser.runtime, 'sendMessage').mockResolvedValue(null as never)
-		render(<ShellContext.Provider value={{ refreshState: () => {}, toast, launch: () => {}, footer: null }}><MaskedField label="CVV" value="123" masked /></ShellContext.Provider>)
+		render(<ShellContext.Provider value={{ ...DEFAULT_SHELL, toast }}><MaskedField label="CVV" value="123" masked /></ShellContext.Provider>)
 		expect(screen.queryByText('123')).toBeNull()
 		await user.click(screen.getByRole('button', { name: 'Show CVV' }))
 		expect(screen.getByText('123')).toBeTruthy()
@@ -150,3 +170,137 @@ describe('MaskedField', () => {
 		expect(screen.getByRole('button', { name: 'Copy username' })).toBeTruthy()
 	})
 })
+
+describe('ConfirmDialog', () => {
+	it('focuses inside, cancels on Escape and gives focus back', async () => {
+		const opener = document.body.appendChild(document.createElement('button'))
+		opener.focus()
+		const onCancel = vi.fn()
+		const onClick = vi.fn()
+		const { unmount } = render(<ConfirmDialog title="Delete item" actions={[{ label: 'Delete', variant: 'danger', onClick }]} onCancel={onCancel}><p>Sure?</p></ConfirmDialog>)
+		const dialog = screen.getByRole('dialog', { name: 'Delete item' })
+		expect(dialog.getAttribute('aria-modal')).toBe('true')
+		expect(document.activeElement?.textContent).toBe('Delete')
+		const user = userEvent.setup()
+		await user.click(screen.getByRole('button', { name: 'Delete' }))
+		expect(onClick).toHaveBeenCalled()
+		await user.keyboard('{Escape}')
+		expect(onCancel).toHaveBeenCalled()
+		unmount()
+		expect(document.activeElement).toBe(opener)
+		opener.remove()
+	})
+
+	it('keeps Tab inside the dialog', async () => {
+		render(<ConfirmDialog title="Delete item" actions={[{ label: 'Delete', onClick: () => {} }]} onCancel={() => {}} />)
+		const user = userEvent.setup()
+		await user.tab()
+		expect(document.activeElement?.textContent).toBe('Cancel')
+		await user.tab()
+		expect(document.activeElement?.textContent).toBe('Delete')
+	})
+
+	it('shows an error with Retry', async () => {
+		const onRetry = vi.fn()
+		render(<ConfirmDialog title="Delete item" actions={[]} onCancel={() => {}} error="Could not reach the server" onRetry={onRetry} />)
+		expect(screen.getByRole('alert').textContent).toContain('Could not reach the server')
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Try again' }))
+		expect(onRetry).toHaveBeenCalled()
+	})
+})
+
+describe('AdditionalFieldsEditor', () => {
+	function Editor({ initial = [] as CustomField[] }) {
+		const [fields, setFields] = useState(initial)
+		return <AdditionalFieldsEditor fields={fields} errors={{}} onChange={setFields} />
+	}
+
+	it('adds, masks, reveals and removes rows', async () => {
+		render(<Editor />)
+		const user = userEvent.setup()
+		await user.click(screen.getByRole('button', { name: 'Add field' }))
+		await user.type(screen.getByLabelText('Field name'), 'pin')
+		const value = screen.getByLabelText('pin') as HTMLInputElement
+		expect(value.type).toBe('password')
+		await user.click(screen.getByRole('button', { name: 'Show pin' }))
+		expect(value.type).toBe('text')
+		await user.click(screen.getByRole('button', { name: 'Remove pin' }))
+		expect(screen.queryByLabelText('Field name')).toBeNull()
+	})
+
+	it('shows the errors it is given on their row', () => {
+		const field = customField('Login', 'x')
+		render(<AdditionalFieldsEditor fields={[field]} errors={{ [`field.${field.id}.name`]: { code: 'reserved' } }} onChange={() => {}} />)
+		expect(screen.getByText('This name is reserved')).toBeTruthy()
+	})
+})
+
+describe('FolderTree and TypeSelect', () => {
+	it('indents children under their parent, sorted by name', () => {
+		const folders = [{ id: 'b', name: 'beta', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }, { id: 'w', name: 'Work', parentId: null }]
+		render(<FolderTree folders={folders} row={(folder) => folder.name} />)
+		const rows = screen.getAllByRole('listitem')
+		expect(rows.map((row) => [row.textContent, row.style.getPropertyValue('--depth')])).toEqual([['beta', '0'], ['Work', '0'], ['Clients', '1']])
+	})
+
+	it('offers a passkey only as the type an item already has', () => {
+		const { rerender } = render(<TypeSelect types={types} value="t-login" onChange={() => {}} />)
+		const labels = () => [...(screen.getByLabelText('Type') as HTMLSelectElement).options].map((option) => option.textContent)
+		expect(labels()).not.toContain('Passkey')
+		rerender(<TypeSelect types={types} value="t-passkey" onChange={() => {}} disabled />)
+		expect(labels()).toContain('Passkey')
+	})
+})
+
+describe('FolderNameDialog', () => {
+	it('refuses a blank name before any request', async () => {
+		const sent = fakeBackground()
+		render(<FolderNameDialog target={{ create: { parentId: null } }} onDone={() => {}} onCancel={() => {}} />)
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Save' }))
+		expect(screen.getByText('Name is required')).toBeTruthy()
+		expect(sentOf(sent, 'folder.create')).toEqual([])
+	})
+
+	it('renames from the current name, trimmed', async () => {
+		const sent = fakeBackground()
+		const onDone = vi.fn()
+		render(<FolderNameDialog target={{ rename: { id: 'w', name: 'Work' } }} onDone={onDone} onCancel={() => {}} />)
+		const user = userEvent.setup()
+		expect(screen.getByRole('dialog', { name: 'Rename folder' })).toBeTruthy()
+		await user.type(screen.getByLabelText('Folder name'), ' 2 {Enter}')
+		await vi.waitFor(() => expect(onDone).toHaveBeenCalledWith(null))
+		expect(sentOf(sent, 'folder.rename')).toEqual([{ kind: 'folder.rename', accountId: 'a1', id: 'w', name: 'Work 2' }])
+	})
+})
+
+describe('TextArea', () => {
+	it('is labelled and shows its error', async () => {
+		const onChange = vi.fn()
+		render(<TextArea label="Notes" value="" onChange={onChange} error="Too long (max 65536 bytes)" />)
+		const area = screen.getByRole('textbox', { name: 'Notes' })
+		expect(area.getAttribute('aria-invalid')).toBe('true')
+		expect(screen.getByText('Too long (max 65536 bytes)')).toBeTruthy()
+		await userEvent.setup().type(area, 'a')
+		expect(onChange).toHaveBeenCalledWith('a')
+	})
+})
+
+describe('writeErrorText', () => {
+	it('words a conflict by what was being written', () => {
+		const conflict = { code: 'conflict' } as const
+		expect(writeErrorText(conflict, 'edit')).toBe('This item was changed elsewhere. Go back and edit it again to see the latest version.')
+		expect(writeErrorText(conflict, 'folderName')).toBe('A folder with this name already exists here')
+		expect(writeErrorText(conflict, 'folderDelete')).toBe('This folder changed. Check the choices again.')
+		expect(writeErrorText(undefined)).toBe('Keepiq is not responding. Reload the extension and reopen this popup.')
+	})
+
+	it('words a blocked row by its reason', () => {
+		expect(writeErrorText({ code: 'blocked', reason: 'suite_revoked' })).toBe('Its encryption key was revoked.')
+		expect(writeErrorText({ code: 'blocked' })).toBe('This item is blocked.')
+	})
+
+	it('names a policy refusal, and keeps any other refusal neutral', () => {
+		expect(writeErrorText({ code: 'policy' })).toBe("Your organisation's policy does not allow this change")
+		expect(writeErrorText({ code: 'forbidden' })).toBe('Keepiq does not allow this change. The Keepiq web app shows why.')
+	})
+})
diff --git a/browser-extension/entrypoints/popup/errors.ts b/browser-extension/entrypoints/popup/errors.ts
index 76b3f591b..688ac6429 100644
--- a/browser-extension/entrypoints/popup/errors.ts
+++ b/browser-extension/entrypoints/popup/errors.ts
@@ -1,5 +1,7 @@
 import { i18n } from '#i18n'
-import { MAX_ACCOUNTS, type BlockReason, type ErrorCode, type NoticeCode } from '@/src/messages'
+import { MAX_ACCOUNTS, type BlockReason, type ErrorCode, type NoticeCode, type VaultWriteError } from '@/src/messages'
+import type { FieldError } from '@/src/vault/fields'
+import { language } from './i18n'
 
 /** What the user reads for each error code; `host` names the server where it matters. */
 export function errorText(code: ErrorCode, host: string): string {
@@ -34,8 +36,52 @@ export function noticeText(notice: NoticeCode): string {
 	}
 }
 
-export function blockedText(reason: BlockReason): string {
+/** What was being written, since a 400 or 409 means something different for each. */
+export type WriteContext = 'item' | 'edit' | 'folderName' | 'folderDelete'
+
+/** `undefined` is the background not answering. */
+export function writeErrorText(error: VaultWriteError | undefined, context: WriteContext = 'item'): string {
+	const folder = context === 'folderName' || context === 'folderDelete'
+	switch (error?.code) {
+		case undefined: return i18n.t('errors.notResponding')
+		case 'write_locked': return i18n.t('writeErrors.writeLocked')
+		case 'forbidden': return i18n.t('writeErrors.forbidden')
+		case 'policy': return i18n.t('writeErrors.policy')
+		case 'account_changed': return i18n.t('writeErrors.accountChanged')
+		case 'invalid': return context === 'folderDelete' ? i18n.t('writeErrors.folderChanged') : i18n.t('writeErrors.invalid')
+		case 'conflict':
+			if (context === 'edit') return i18n.t('writeErrors.stale')
+			if (context === 'folderName') return i18n.t('writeErrors.duplicateFolder')
+			return context === 'folderDelete' ? i18n.t('writeErrors.folderChanged') : i18n.t('writeErrors.invalid')
+		case 'not_found': return folder ? i18n.t('writeErrors.folderGone') : i18n.t('writeErrors.itemGone')
+		case 'blocked': return blockedText(error.reason)
+		case 'unreadable': return i18n.t('writeErrors.unreadable')
+		case 'restricted': return i18n.t('writeErrors.restricted')
+		case 'key_mismatch': return i18n.t('writeErrors.keyMismatch')
+		case 'offline': return i18n.t('writeErrors.offline')
+		case 'server_error': return i18n.t('writeErrors.serverError')
+		case 'session_revoked': return i18n.t('errors.sessionRevoked')
+		case 'locked':
+		case 'unknown':
+		default: return i18n.t('errors.unknown')
+	}
+}
+
+export function fieldErrorText(error: FieldError): string {
+	switch (error.code) {
+		case 'required': return i18n.t('fieldErrors.required')
+		case 'tooLong': return i18n.t('fieldErrors.tooLong', { max: error.max.toLocaleString(language()) })
+		case 'tooLongBytes': return i18n.t('fieldErrors.tooLongBytes', { max: String(error.max) })
+		case 'reserved': return i18n.t('fieldErrors.reserved')
+		case 'duplicate': return i18n.t('fieldErrors.duplicate')
+		case 'invalidTotp': return i18n.t('fieldErrors.invalidTotp')
+	}
+}
+
+/** `undefined` is a row the server blocked without a reason we know. */
+export function blockedText(reason: BlockReason | undefined): string {
 	switch (reason) {
+		case undefined: return i18n.t('blocked.generic')
 		case 'suite_missing': return i18n.t('blocked.suiteMissing')
 		case 'suite_revoked': return i18n.t('blocked.suiteRevoked')
 		case 'suite_compromised': return i18n.t('blocked.suiteCompromised')
diff --git a/browser-extension/entrypoints/popup/hooks/hooks.test.tsx b/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
index 0470f1022..99fefc818 100644
--- a/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
+++ b/browser-extension/entrypoints/popup/hooks/hooks.test.tsx
@@ -4,8 +4,11 @@ import userEvent from '@testing-library/user-event'
 import { createRef, type ReactNode } from 'react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { VaultSnapshotReply } from '@/src/messages'
-import { ShellContext } from '../shell-context'
-import { everythingVisible, fakeBackground, fakeClipboard, sentKinds, snapshotReply } from '../testing'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
+import { emptyValues } from '@/src/vault/fields'
+import { everythingVisible, fakeBackground, fakeClipboard, sentKinds, snapshotReply, types } from '../testing'
+import { useItemDraft } from './useItemDraft'
+import { useUnsavedChangesGuard } from './useUnsavedChangesGuard'
 import { useBackgroundMessage } from './useBackgroundMessage'
 import { useClipboard } from './useClipboard'
 import { useCurrentTab } from './useCurrentTab'
@@ -15,7 +18,7 @@ import { useVaultSnapshot } from './useVaultSnapshot'
 afterEach(cleanup)
 
 function shell(overrides: { refreshState?: () => void; toast?: (text: string) => void } = {}) {
-	const value = { refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), footer: null, ...overrides }
+	const value = { ...DEFAULT_SHELL, refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), ...overrides }
 	const wrapper = ({ children }: { children: ReactNode }) => <ShellContext.Provider value={value}>{children}</ShellContext.Provider>
 	return { value, wrapper }
 }
@@ -212,4 +215,68 @@ describe('useVaultSnapshot', () => {
 		await act(async () => replies[0]!(snapshotReply({ suggestionIds: ['old'] })))
 		expect(result.current.reply).toMatchObject({ suggestionIds: ['new'] })
 	})
+
+	it('answers an overtaken reload with the newer read', async () => {
+		const { send } = broadcasts()
+		const replies: Array<(reply: VaultSnapshotReply) => void> = []
+		vi.spyOn(browser.runtime, 'sendMessage').mockImplementation(() => new Promise((resolve) => replies.push(resolve as never)) as never)
+		const { result } = renderHook(() => useVaultSnapshot('https://github.com', true))
+		await waitFor(() => expect(replies).toHaveLength(1))
+		await act(async () => replies[0]!(snapshotReply()))
+		let reloaded!: Promise<VaultSnapshotReply | undefined>
+		act(() => void (reloaded = result.current.reload()))
+		send({ kind: 'vault.changed', sync: snapshotReply().sync })
+		await waitFor(() => expect(replies).toHaveLength(3))
+		await act(async () => replies[1]!(snapshotReply({ suggestionIds: ['old'] })))
+		await act(async () => replies[2]!(snapshotReply({ suggestionIds: ['new'] })))
+		expect(await reloaded).toMatchObject({ suggestionIds: ['new'] })
+	})
+})
+
+describe('useItemDraft', () => {
+	const initial = { ...emptyValues('t-login'), name: 'GitHub', login: 'alice' }
+
+	it('is clean until a value changes, and patches only that value', () => {
+		const { result } = renderHook(() => useItemDraft(initial, types))
+		expect(result.current.dirty).toBe(false)
+		act(() => result.current.update({ login: '' }))
+		expect(result.current.dirty).toBe(true)
+		expect(result.current.patch).toEqual({ login: null })
+	})
+
+	it('shows name refusals only after Save, field name refusals at once', () => {
+		const { result } = renderHook(() => useItemDraft({ ...initial, name: '' }, types))
+		act(() => result.current.update({ fields: [{ id: 1, name: 'url', value: 'x' }] }))
+		expect(result.current.errors).toEqual({ 'field.1.name': { code: 'reserved' } })
+		expect(result.current.blocked).toBe(true)
+		let draft: unknown
+		act(() => {
+			draft = result.current.submit()
+		})
+		expect(draft).toBeNull()
+		expect(result.current.errors).toMatchObject({ name: { code: 'required' } })
+	})
+
+	it('hands over the draft once valid', () => {
+		const { result } = renderHook(() => useItemDraft(initial, types))
+		let draft: unknown
+		act(() => {
+			draft = result.current.submit()
+		})
+		expect(draft).toMatchObject({ name: 'GitHub', login: 'alice', typeId: 't-login' })
+	})
+})
+
+describe('useUnsavedChangesGuard', () => {
+	it('registers a live dirty check with Shell and removes it on unmount', () => {
+		const setLeaveGuard = vi.fn()
+		const wrapper = ({ children }: { children: ReactNode }) => <ShellContext.Provider value={{ ...DEFAULT_SHELL, setLeaveGuard }}>{children}</ShellContext.Provider>
+		const { rerender, unmount } = renderHook(({ dirty }) => useUnsavedChangesGuard(dirty), { wrapper, initialProps: { dirty: false } })
+		const isDirty = setLeaveGuard.mock.calls[0]![0] as () => boolean
+		expect(isDirty()).toBe(false)
+		rerender({ dirty: true })
+		expect(isDirty()).toBe(true)
+		unmount()
+		expect(setLeaveGuard).toHaveBeenLastCalledWith(null)
+	})
 })
diff --git a/browser-extension/entrypoints/popup/hooks/useItemDraft.ts b/browser-extension/entrypoints/popup/hooks/useItemDraft.ts
new file mode 100644
index 000000000..2f858a93f
--- /dev/null
+++ b/browser-extension/entrypoints/popup/hooks/useItemDraft.ts
@@ -0,0 +1,34 @@
+import { useMemo, useState } from 'react'
+import type { ItemDraft, ItemPatch, TypeMeta } from '@/src/messages'
+import { diffDraft, isLiveError, toDraft, validate, type FormErrors, type FormValues } from '@/src/vault/fields'
+
+/** The form's values in popup memory only, compared with what it opened with. */
+export function useItemDraft(initial: FormValues, types: TypeMeta[]) {
+	const [values, setValues] = useState(initial)
+	const [attempted, setAttempted] = useState(false)
+	const typeName = (typeId: string) => types.find((type) => type.id === typeId)?.name
+	const currentType = typeName(values.typeId)
+
+	const errors = useMemo(() => validate(values, currentType), [values, currentType])
+	const draft = useMemo(() => toDraft(values, currentType), [values, currentType])
+	const [before] = useState(() => toDraft(initial, typeName(initial.typeId)))
+	const patch = useMemo(() => diffDraft(before, draft), [before, draft])
+
+	const shown: FormErrors = attempted ? errors : Object.fromEntries(Object.entries(errors).filter(([, error]) => isLiveError(error)))
+
+	return {
+		values,
+		typeName: currentType,
+		update: (change: Partial<FormValues>) => setValues((current) => ({ ...current, ...change })),
+		errors: shown,
+		/** A refusal that shows while typing keeps Save disabled. */
+		blocked: Object.values(errors).some(isLiveError),
+		dirty: Object.keys(patch).length > 0,
+		patch: patch as ItemPatch,
+		/** The draft when it may be saved; otherwise every error starts to show. */
+		submit: (): ItemDraft | null => {
+			setAttempted(true)
+			return Object.keys(errors).length === 0 ? draft : null
+		},
+	}
+}
diff --git a/browser-extension/entrypoints/popup/hooks/useUnsavedChangesGuard.ts b/browser-extension/entrypoints/popup/hooks/useUnsavedChangesGuard.ts
new file mode 100644
index 000000000..5b1b0ba08
--- /dev/null
+++ b/browser-extension/entrypoints/popup/hooks/useUnsavedChangesGuard.ts
@@ -0,0 +1,15 @@
+import { useEffect, useRef } from 'react'
+import { useShell } from '../shell-context'
+
+/** While mounted, Shell asks "Discard them?" before Back, Pop out or the account switcher drops a dirty form. Closing the popup still loses it. */
+export function useUnsavedChangesGuard(dirty: boolean): void {
+	const { setLeaveGuard } = useShell()
+	const latest = useRef(dirty)
+	useEffect(() => {
+		latest.current = dirty
+	})
+	useEffect(() => {
+		setLeaveGuard(() => latest.current)
+		return () => setLeaveGuard(null)
+	}, [setLeaveGuard])
+}
diff --git a/browser-extension/entrypoints/popup/hooks/useVaultSnapshot.ts b/browser-extension/entrypoints/popup/hooks/useVaultSnapshot.ts
index cffd243b6..1a626d3c7 100644
--- a/browser-extension/entrypoints/popup/hooks/useVaultSnapshot.ts
+++ b/browser-extension/entrypoints/popup/hooks/useVaultSnapshot.ts
@@ -7,19 +7,25 @@ import { request } from './useMessage'
 export function useVaultSnapshot(tabUrl: string | undefined, ready: boolean) {
 	const [reply, setReply] = useState<VaultSnapshotReply>()
 	const [failed, setFailed] = useState(false)
-	const latest = useRef(0)
+	const newest = useRef<Promise<VaultSnapshotReply | undefined>>(undefined)
 	const opened = useRef(false)
 
-	/** Only the newest request's reply is applied, whatever order replies arrive in. */
-	const load = useCallback(async () => {
-		const ticket = ++latest.current
+	/**
+	 * Only the newest read's reply is applied, whatever order replies arrive in. Each read returns the
+	 * reply applied, so a read overtaken by a newer one answers with the newer one's.
+	 */
+	const load = useCallback((): Promise<VaultSnapshotReply | undefined> => {
 		// The first read is the popup opening; later ones follow broadcasts and must not restart a failed sync.
 		const first = !opened.current
 		opened.current = true
-		const next = await request({ kind: 'vault.snapshot', tabUrl, opened: first })
-		if (ticket !== latest.current) return
-		if (next) setReply(next)
-		setFailed(!next)
+		const read: Promise<VaultSnapshotReply | undefined> = request({ kind: 'vault.snapshot', tabUrl, opened: first }).then((next) => {
+			if (newest.current !== read) return newest.current
+			if (next) setReply(next)
+			setFailed(!next)
+			return next
+		})
+		newest.current = read
+		return read
 	}, [tabUrl])
 
 	useEffect(() => {
@@ -36,5 +42,6 @@ export function useVaultSnapshot(tabUrl: string | undefined, ready: boolean) {
 		await load()
 	}, [load])
 
-	return { reply, failed, syncNow }
+	/** `reload` re-reads without syncing, e.g. after a write whose reply already followed its sync. */
+	return { reply, failed, syncNow, reload: load }
 }
diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index fd1226be9..6782f4d66 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -1196,3 +1196,289 @@ a {
 	opacity: 0.45;
 	cursor: not-allowed;
 }
+
+/* Fits the header, like Bitwarden's New button. */
+.btn--small {
+	height: 32px;
+	padding: 0 14px 0 10px;
+	gap: 4px;
+	font-size: 13px;
+}
+
+/* Item form */
+
+.form-card {
+	display: flex;
+	flex-direction: column;
+	gap: 14px;
+	padding: 14px;
+	overflow: visible;
+}
+
+.field__input--area {
+	height: auto;
+	min-height: 80px;
+	padding: 9px 12px;
+	line-height: 1.45;
+	background: var(--surface);
+	border: 1px solid var(--border-strong);
+	border-radius: var(--radius);
+	resize: vertical;
+}
+
+.field__input--area:focus {
+	border-color: var(--accent);
+	box-shadow: 0 0 0 3px var(--ring);
+}
+
+.field__input--area[aria-invalid='true'] {
+	border-color: var(--danger);
+}
+
+.field__input--mono {
+	font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+	font-size: 12.5px;
+}
+
+.picker-field {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+	height: 40px;
+	padding: 0 8px 0 12px;
+	font: inherit;
+	font-size: 14px;
+	text-align: left;
+	color: var(--fg);
+	background: var(--surface);
+	border: 1px solid var(--border-strong);
+	border-radius: var(--radius);
+	cursor: pointer;
+}
+
+.picker-field:focus-visible {
+	border-color: var(--accent);
+	outline: none;
+	box-shadow: 0 0 0 3px var(--ring);
+}
+
+.picker-field .icon {
+	color: var(--fg-muted);
+}
+
+.picker-field__value {
+	flex: 1;
+	min-width: 0;
+	overflow: hidden;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+}
+
+.custom-fields {
+	display: flex;
+	flex-direction: column;
+	gap: 12px;
+}
+
+.custom-fields > .btn--link {
+	align-self: flex-start;
+	padding-left: 0;
+}
+
+.custom-field {
+	display: flex;
+	align-items: flex-start;
+	gap: 4px;
+	align-self: stretch;
+}
+
+.custom-field + .custom-field {
+	padding-top: 12px;
+	border-top: 1px solid var(--border);
+}
+
+.custom-field__inputs {
+	flex: 1;
+	min-width: 0;
+	display: flex;
+	flex-direction: column;
+	gap: 8px;
+}
+
+/* Lines the remove button up with the first input, not its label. */
+.custom-field > .icon-btn {
+	margin-top: 26px;
+}
+
+.advanced {
+	display: flex;
+	flex-direction: column;
+	gap: 12px;
+}
+
+.advanced > summary {
+	font-size: 13px;
+	font-weight: 600;
+	color: var(--accent);
+	cursor: pointer;
+}
+
+.advanced[open] > summary {
+	margin-bottom: 12px;
+}
+
+/* Dialogs */
+
+.dialog-backdrop {
+	position: fixed;
+	inset: 0;
+	z-index: 50;
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	padding: 16px;
+	background: rgb(16 24 40 / 0.45);
+}
+
+.dialog {
+	display: flex;
+	flex-direction: column;
+	gap: 14px;
+	width: 100%;
+	max-height: 100%;
+	padding: 18px 16px 16px;
+	overflow-y: auto;
+	background: var(--surface);
+	border-radius: 14px;
+	box-shadow: var(--shadow);
+}
+
+.dialog__title {
+	margin: 0;
+	font-size: 16px;
+	font-weight: 600;
+}
+
+.dialog__body {
+	display: flex;
+	flex-direction: column;
+	gap: 12px;
+	font-size: 14px;
+}
+
+.dialog__body p {
+	margin: 0;
+}
+
+.dialog__actions {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 8px;
+}
+
+.dialog__actions .btn {
+	flex: 1 1 auto;
+}
+
+.resolution {
+	display: flex;
+	flex-direction: column;
+	gap: 12px;
+}
+
+/* Folders */
+
+/* Row menus must reach past the card. */
+.card--menus {
+	overflow: visible;
+}
+
+.folder-tree {
+	margin: 0;
+	padding: 0;
+	list-style: none;
+}
+
+.folder-tree__row {
+	padding-left: calc(var(--depth, 0) * 16px);
+}
+
+.picker {
+	display: flex;
+	flex-direction: column;
+	margin: 0 -8px;
+}
+
+.picker__choice {
+	display: flex;
+	align-items: center;
+	gap: 10px;
+	width: 100%;
+	padding: 9px 8px;
+	font: inherit;
+	font-size: 14px;
+	text-align: left;
+	color: var(--fg);
+	background: none;
+	border: 0;
+	border-radius: var(--radius);
+	cursor: pointer;
+}
+
+.picker__choice:hover:not(:disabled) {
+	background: var(--surface-hover);
+}
+
+.picker__choice:focus-visible {
+	outline: none;
+	box-shadow: inset 0 0 0 2px var(--ring);
+}
+
+.picker__choice .icon {
+	color: var(--fg-muted);
+}
+
+.picker__choice[aria-current='true'] {
+	font-weight: 600;
+}
+
+.picker__choice--new,
+.picker__choice--new .icon {
+	color: var(--accent);
+}
+
+.picker__label {
+	flex: 1;
+	min-width: 0;
+	overflow: hidden;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+}
+
+.picker__current .icon {
+	color: var(--accent);
+}
+
+.folder-row {
+	display: flex;
+	align-items: center;
+	gap: 10px;
+	padding: 6px 6px 6px 12px;
+}
+
+.folder-row > .icon {
+	color: var(--fg-muted);
+}
+
+.folder-row__name {
+	flex: 1;
+	min-width: 0;
+	overflow: hidden;
+	font-size: 14px;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+}
+
+.card .folder-tree__row + .folder-tree__row {
+	border-top: 1px solid var(--border);
+}
diff --git a/browser-extension/entrypoints/popup/shell-context.ts b/browser-extension/entrypoints/popup/shell-context.ts
index ca007b4ce..c39837778 100644
--- a/browser-extension/entrypoints/popup/shell-context.ts
+++ b/browser-extension/entrypoints/popup/shell-context.ts
@@ -1,6 +1,18 @@
 import { createContext, useContext } from 'react'
+import type { ItemMeta } from '@/src/messages'
+
+/** Shell runs these, so the list's More menu and item detail open the same form and dialogs. */
+export interface ItemActions {
+	add: () => void
+	edit: (id: string) => void
+	clone: (id: string) => void
+	move: (item: ItemMeta) => void
+	remove: (item: ItemMeta) => void
+}
 
 export interface ShellContextValue {
+	/** The account this popup shows, which every write names. */
+	accountId: string
 	/** Re-reads the popup state, e.g. after the background reported the vault locked. */
 	refreshState: () => void
 	toast: (message: string) => void
@@ -8,8 +20,21 @@ export interface ShellContextValue {
 	launch: (url: string) => void
 	/** Where a page opened over a tab puts its actions; `null` while a tab shows. */
 	footer: HTMLElement | null
+	/** The last request found the server unreachable, so writes wait. */
+	offline: boolean
+	syncNow: () => void
+	items: ItemActions
+	/** An open form's dirty check; Shell asks before Back, Pop out or the account switcher drops a dirty form. */
+	setLeaveGuard: (isDirty: (() => boolean) | null) => void
+}
+
+const noop = () => {}
+
+export const DEFAULT_SHELL: ShellContextValue = {
+	accountId: 'a1', refreshState: noop, toast: noop, launch: noop, footer: null, offline: false, syncNow: noop,
+	items: { add: noop, edit: noop, clone: noop, move: noop, remove: noop }, setLeaveGuard: noop,
 }
 
-export const ShellContext = createContext<ShellContextValue>({ refreshState: () => {}, toast: () => {}, launch: () => {}, footer: null })
+export const ShellContext = createContext<ShellContextValue>(DEFAULT_SHELL)
 
 export const useShell = () => useContext(ShellContext)
diff --git a/browser-extension/entrypoints/popup/testing.ts b/browser-extension/entrypoints/popup/testing.ts
index ef0984582..ae0d25cfb 100644
--- a/browser-extension/entrypoints/popup/testing.ts
+++ b/browser-extension/entrypoints/popup/testing.ts
@@ -1,5 +1,5 @@
 import { vi } from 'vitest'
-import type { AccountSummary, DecryptField, DecryptedItem, GlobalSettings, ItemMeta, PopupState, PopupTab, Result, TypeMeta, VaultSnapshotReply } from '@/src/messages'
+import type { AccountSummary, DecryptField, DecryptedItem, EditableItem, GlobalSettings, ItemMeta, PopupState, PopupTab, Result, TypeMeta, VaultSnapshotReply } from '@/src/messages'
 
 export function account(overrides: Partial<AccountSummary> = {}): AccountSummary {
 	return {
@@ -37,8 +37,9 @@ export function dispatchReturning(result: Result = ok()) {
 
 export function itemMeta(overrides: Partial<ItemMeta> = {}): ItemMeta {
 	return {
-		id: 'i1', name: 'GitHub', url: 'https://github.com', typeId: 't-login', folderId: null, hasLogin: true, blocked: false, useOnly: false,
-		createdAt: '2026-01-05T10:00:00Z', updatedAt: '2026-03-02T10:00:00Z', expiresAt: null, ...overrides,
+		id: 'i1', name: 'GitHub', url: 'https://github.com', typeId: 't-login', folderId: null, hasLogin: true, blocked: false,
+		createdAt: '2026-01-05T10:00:00Z', updatedAt: '2026-03-02T10:00:00Z', expiresAt: null,
+		useOnly: false, readOnly: false, accessExpiresAt: null, ...overrides,
 	}
 }
 
@@ -57,13 +58,20 @@ export function snapshotReply(overrides: Partial<UnlockedSnapshot> = {}): Unlock
 		suggestionIds: [],
 		sync: { syncing: false, syncedAt: new Date().toISOString(), offline: false, lastError: null },
 		webAppUrl: 'https://cloud.example.org/index.php/apps/keepiq/',
+		defaultSecretType: null,
+		folderNoticeDismissed: false,
 		...overrides,
 	}
 }
 
 interface FakeBackground {
 	state?: PopupState
-	snapshot?: VaultSnapshotReply
+	/** A function is read per request, so a test can change the vault after a write. */
+	snapshot?: VaultSnapshotReply | (() => VaultSnapshotReply)
+	/** Replies by kind, for the write requests; a function gets the message. */
+	replies?: Record<string, unknown>
+	/** `item.fetch` replies by id. */
+	items?: Record<string, EditableItem>
 	/** Decrypted fields per item id; an id missing here decrypts to nothing. */
 	decrypted?: Record<string, DecryptedItem>
 	decryptError?: 'locked' | 'blocked' | 'use_only' | 'decrypt_failed'
@@ -78,13 +86,28 @@ interface FakeBackground {
 export function fakeBackground(options: FakeBackground = {}) {
 	const state = options.state ?? popupState({ screen: 'unlocked', active: account({ status: 'unlocked' }), lastTab: options.lastTab ?? 'vault' })
 	let settings: GlobalSettings = options.settings ?? { theme: 'system' }
-	const reply = vi.fn(async (message: { kind: string; ids?: string[]; fields?: DecryptField[]; patch?: Partial<GlobalSettings> }): Promise<unknown> => {
+	const snapshot = () => (typeof options.snapshot === 'function' ? options.snapshot() : options.snapshot) ?? snapshotReply()
+	const reply = vi.fn(async (message: { kind: string; id?: string; ids?: string[]; fields?: DecryptField[]; patch?: Partial<GlobalSettings> }): Promise<unknown> => {
 		if (options.unanswered?.includes(message.kind)) return undefined
+		const canned = options.replies?.[message.kind]
+		if (canned !== undefined) return typeof canned === 'function' ? canned(message) : canned
 		switch (message.kind) {
 			case 'settings.get': return settings
 			case 'settings.set': return (settings = { ...settings, ...message.patch })
-			case 'vault.snapshot': return options.snapshot ?? snapshotReply()
-			case 'vault.sync': return (options.snapshot as UnlockedSnapshot | undefined)?.sync ?? snapshotReply().sync
+			case 'vault.snapshot': return snapshot()
+			case 'vault.sync': return (snapshot() as UnlockedSnapshot).sync ?? snapshotReply().sync
+			case 'item.fetch': {
+				const item = options.items?.[message.id!]
+				return item ? { ok: true, value: item } : { ok: false, error: { code: 'not_found' } }
+			}
+			case 'item.create': return { ok: true, value: { id: 'new' } }
+			case 'item.update': return { ok: true, value: { id: message.id } }
+			case 'item.delete':
+			case 'folder.rename':
+			case 'folder.delete': return { ok: true, value: null }
+			case 'folder.create': return { ok: true, value: { id: 'f-new' } }
+			case 'folder.children': return { ok: true, value: { directSecretCount: 0, subfolders: [] } }
+			case 'folder.dismissNotice': return null
 			case 'item.decrypt': {
 				if (options.decryptError) return { ok: false, error: options.decryptError }
 				const items = Object.fromEntries(message.ids!.map((id) => [id, Object.fromEntries(
@@ -103,6 +126,16 @@ export function fakeBackground(options: FakeBackground = {}) {
 	return reply
 }
 
+export function editableItem(overrides: Partial<EditableItem> = {}): EditableItem {
+	return {
+		id: 'i1', typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: null, key: 'hunter2', login: 'alice',
+		additionalFields: {}, updatedAt: '2026-03-02T10:00:00Z', ...overrides,
+	}
+}
+
+/** The messages of one kind sent so far. */
+export const sentOf = (spy: ReturnType<typeof fakeBackground>, kind: string) => spy.mock.calls.map(([message]) => message as Record<string, unknown>).filter((message) => message.kind === kind)
+
 /** The kinds sent so far, in order. */
 export const sentKinds = (spy: ReturnType<typeof fakeBackground>) => spy.mock.calls.map(([message]) => message.kind)
 
diff --git a/browser-extension/entrypoints/popup/views/FolderPicker.test.tsx b/browser-extension/entrypoints/popup/views/FolderPicker.test.tsx
new file mode 100644
index 000000000..27a6a7dee
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/FolderPicker.test.tsx
@@ -0,0 +1,51 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { FolderMeta } from '@/src/messages'
+import { fakeBackground, sentOf } from '../testing'
+import { FolderPicker } from './FolderPicker'
+
+afterEach(cleanup)
+
+const folders: FolderMeta[] = [{ id: 'w', name: 'Work', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }]
+
+function renderPicker(current: string | null, list = folders) {
+	const sent = fakeBackground()
+	const onPick = vi.fn()
+	const onCancel = vi.fn()
+	render(<FolderPicker title="Choose folder" folders={list} current={current} onPick={onPick} onCancel={onCancel} />)
+	return { sent, onPick, onCancel, user: userEvent.setup() }
+}
+
+const choices = () => within(screen.getByRole('dialog')).getAllByRole('button').map((button) => [button.textContent, button.getAttribute('aria-current')])
+
+describe('FolderPicker', () => {
+	it('lists No folder, the tree and New folder, with the current folder marked', () => {
+		renderPicker('c')
+		expect(choices()).toEqual([['No folder', null], ['Work', null], ['ClientsCurrent folder', 'true'], ['New folder', null], ['Cancel', null]])
+	})
+
+	it('lists only No folder and New folder without folders', () => {
+		renderPicker(null, [])
+		expect(choices().map(([text]) => text)).toEqual(['No folderCurrent folder', 'New folder', 'Cancel'])
+	})
+
+	it('returns the pick without a request, and null for No folder', async () => {
+		const { sent, onPick, user } = renderPicker('w')
+		await user.click(screen.getByRole('button', { name: 'Clients' }))
+		expect(onPick).toHaveBeenLastCalledWith('c')
+		await user.click(screen.getByRole('button', { name: 'No folder' }))
+		expect(onPick).toHaveBeenLastCalledWith(null)
+		expect(sent).not.toHaveBeenCalled()
+	})
+
+	it('creates a root folder and picks it', async () => {
+		const { sent, onPick, user } = renderPicker(null)
+		await user.click(screen.getByRole('button', { name: 'New folder' }))
+		await user.type(screen.getByLabelText('Folder name'), 'Banking')
+		await user.click(screen.getByRole('button', { name: 'Save' }))
+		await waitFor(() => expect(onPick).toHaveBeenCalledWith('f-new'))
+		expect(sentOf(sent, 'folder.create')).toEqual([{ kind: 'folder.create', accountId: 'a1', name: 'Banking', parentId: null }])
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/FolderPicker.tsx b/browser-extension/entrypoints/popup/views/FolderPicker.tsx
new file mode 100644
index 000000000..c1c6b994b
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/FolderPicker.tsx
@@ -0,0 +1,54 @@
+import { useState } from 'react'
+import { i18n } from '#i18n'
+import type { FolderMeta } from '@/src/messages'
+import { ConfirmDialog } from '../components/ConfirmDialog'
+import { FolderNameDialog } from '../components/FolderNameDialog'
+import { FolderTree } from '../components/FolderTree'
+import { Icon } from '../components/Icon'
+
+interface Props {
+	title: string
+	folders: FolderMeta[]
+	current: string | null
+	/** `null` is "No folder". */
+	onPick: (folderId: string | null) => void
+	onCancel: () => void
+	/** For a caller that writes the pick, as Move does. */
+	busy?: boolean
+	error?: string | null
+}
+
+function Choice({ label, current, onClick, disabled }: { label: string; current: boolean; onClick: () => void; disabled?: boolean }) {
+	return (
+		<button type="button" className="picker__choice" aria-current={current ? 'true' : undefined} disabled={disabled} onClick={onClick}>
+			<Icon name="folder" />
+			<span className="picker__label">{label}</span>
+			{current && <span className="picker__current"><Icon name="check" /><span className="sr-only">{i18n.t('folders.current')}</span></span>}
+		</button>
+	)
+}
+
+/** Picking sends nothing; "New folder" creates one at the root and picks it. */
+export function FolderPicker({ title, folders, current, onPick, onCancel, busy = false, error }: Props) {
+	const [creating, setCreating] = useState(false)
+	if (creating) {
+		// Back to the picker once the folder exists, so a failed pick shows its error there and Save cannot create it twice.
+		const done = (id: string | null) => {
+			setCreating(false)
+			if (id) onPick(id)
+		}
+		return <FolderNameDialog target={{ create: { parentId: null } }} onDone={done} onCancel={() => setCreating(false)} />
+	}
+	return (
+		<ConfirmDialog title={title} actions={[]} onCancel={onCancel} error={error}>
+			<div className="picker" aria-busy={busy}>
+				<Choice label={i18n.t('filters.noFolder')} current={current === null} disabled={busy} onClick={() => onPick(null)} />
+				<FolderTree folders={folders} row={(folder) => <Choice label={folder.name} current={folder.id === current} disabled={busy} onClick={() => onPick(folder.id)} />} />
+				<button type="button" className="picker__choice picker__choice--new" disabled={busy} onClick={() => setCreating(true)}>
+					<Icon name="plus" />
+					<span className="picker__label">{i18n.t('folders.newFolder')}</span>
+				</button>
+			</div>
+		</ConfirmDialog>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
index 4cd9889c5..446756270 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
@@ -3,7 +3,7 @@ import { cleanup, render, screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DecryptedItem, FolderMeta, ItemMeta } from '@/src/messages'
-import { ShellContext } from '../shell-context'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
 import { fakeBackground, itemMeta, sentKinds, types } from '../testing'
 import { ItemDetail } from './ItemDetail'
 
@@ -19,16 +19,17 @@ afterEach(() => {
 
 const folders: FolderMeta[] = [{ id: 'w', name: 'Work', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }]
 
-function renderDetail(item: ItemMeta, decrypted?: DecryptedItem, decryptError?: 'locked' | 'use_only') {
+function renderDetail(item: ItemMeta, decrypted?: DecryptedItem, decryptError?: 'locked' | 'use_only', offline = false) {
 	const sent = fakeBackground({ decrypted: decrypted && { [item.id]: decrypted }, decryptError })
 	const refreshState = vi.fn()
 	const launch = vi.fn()
+	const items = { add: vi.fn(), edit: vi.fn(), clone: vi.fn(), move: vi.fn(), remove: vi.fn() }
 	const view = render(
-		<ShellContext.Provider value={{ refreshState, toast: vi.fn(), launch, footer }}>
+		<ShellContext.Provider value={{ ...DEFAULT_SHELL, refreshState, launch, footer, items, offline }}>
 			<ItemDetail item={item} type={types.find((t) => t.id === item.typeId)} folders={folders} webAppUrl="https://cloud.example.org/index.php/apps/keepiq/" />
 		</ShellContext.Provider>,
 	)
-	return { sent, refreshState, launch, view }
+	return { sent, refreshState, launch, items, view }
 }
 
 const section = (title: string) => screen.getByRole('heading', { name: title }).closest('section')!
@@ -72,7 +73,7 @@ describe('login credentials', () => {
 		const decrypts = () => sentKinds(sent).filter((kind) => kind === 'item.decrypt').length
 		expect(decrypts()).toBe(1)
 		view.rerender(
-			<ShellContext.Provider value={{ refreshState: vi.fn(), toast: vi.fn(), launch: vi.fn(), footer }}>
+			<ShellContext.Provider value={{ ...DEFAULT_SHELL, footer }}>
 				<ItemDetail item={itemMeta({ updatedAt: '2026-04-01T00:00:00Z' })} type={types[0]} folders={folders} webAppUrl="https://cloud.example.org/index.php/apps/keepiq/" />
 			</ShellContext.Provider>,
 		)
@@ -86,7 +87,7 @@ describe('TOTP', () => {
 	it('shows a grouped code with a countdown', async () => {
 		renderDetail(itemMeta({ typeId: 't-totp', hasLogin: false }), { key: 'otpauth://totp/Example:alice?secret=GEZDGNBVGY3TQOJQ&digits=6&period=30' })
 		await vi.waitFor(() => expect(document.querySelector('.totp')!.textContent).toMatch(/^\d{3} \d{3}$/))
-		expect(screen.getByRole('timer').getAttribute('aria-label')).toMatch(/^Changes in \d+ seconds$/)
+		expect(screen.getByRole('timer').getAttribute('aria-label')).toMatch(/^Changes in \d+ seconds?$/)
 		expect(screen.queryByRole('heading', { name: 'Login credentials' })).toBeNull()
 	})
 
@@ -181,6 +182,12 @@ describe('blocked item', () => {
 		expect(screen.queryByRole('heading', { name: 'Login credentials' })).toBeNull()
 		expect(sentKinds(sent)).not.toContain('item.decrypt')
 	})
+
+	it('says it is blocked when the cached row has no reason', () => {
+		renderDetail(itemMeta({ blocked: true, hasLogin: false }))
+		expect(screen.getByText(/This item is blocked\./)).toBeTruthy()
+		expect(screen.getByRole('link', { name: 'Open the Keepiq web app' })).toBeTruthy()
+	})
 })
 
 describe('use-only copy', () => {
@@ -223,13 +230,65 @@ describe('metadata and actions', () => {
 		expect(within(history).getByText('Expires')).toBeTruthy()
 	})
 
-	it('has Edit and Delete in the footer, disabled until a later update', () => {
-		renderDetail(itemMeta())
-		for (const name of ['Edit', 'Delete']) {
-			const button = within(footer).getByRole('button', { name })
-			expect(button.getAttribute('aria-disabled')).toBe('true')
-			expect(button.getAttribute('title')).toBe('Available in a later update')
-		}
+	it('has Edit, Delete, Clone and Move in the footer', async () => {
+		const item = itemMeta()
+		const { items } = renderDetail(item)
+		const user = userEvent.setup()
+		await user.click(within(footer).getByRole('button', { name: 'Edit' }))
+		expect(items.edit).toHaveBeenCalledWith('i1')
+		await user.click(within(footer).getByRole('button', { name: 'Delete' }))
+		expect(items.remove).toHaveBeenCalledWith(item)
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		await user.click(screen.getByRole('menuitem', { name: 'Clone' }))
+		expect(items.clone).toHaveBeenCalledWith('i1')
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		await user.click(screen.getByRole('menuitem', { name: 'Move to folder' }))
+		expect(items.move).toHaveBeenCalledWith(item)
+	})
+
+	it('holds back the writes while offline, and says why', async () => {
+		const { items } = renderDetail(itemMeta(), undefined, undefined, true)
+		const user = userEvent.setup()
+		const remove = within(footer).getByRole('button', { name: 'Delete' })
+		expect(remove.getAttribute('aria-disabled')).toBe('true')
+		expect(remove.title).toBe('You are offline. Changes need a connection to Keepiq.')
+		await user.click(remove)
+		expect(items.remove).not.toHaveBeenCalled()
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		for (const name of ['Clone', 'Move to folder']) expect(screen.getByRole('menuitem', { name }).getAttribute('aria-disabled')).toBe('true')
+		// Edit reads the item first, which tells whether the server is back.
+		expect(within(footer).getByRole('button', { name: 'Edit' }).getAttribute('aria-disabled')).toBeNull()
+	})
+
+	it('offers no change to a use-only copy', async () => {
+		const { items } = renderDetail(itemMeta({ useOnly: true }), { login: 'bob' })
+		expect(await screen.findByText("Its owner doesn't let you view or copy this.")).toBeTruthy()
+		const edit = within(footer).getByRole('button', { name: 'Edit' })
+		expect(edit.title).toBe('Shared with you for signing in only')
+		const user = userEvent.setup()
+		await user.click(edit)
+		expect(items.edit).not.toHaveBeenCalled()
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		for (const name of ['Clone', 'Move to folder']) expect(screen.getByRole('menuitem', { name }).title).toBe('Shared with you for signing in only')
+	})
+
+	it('lets a read-only copy only be moved, and an expiring one not be cloned', async () => {
+		renderDetail(itemMeta({ readOnly: true }))
+		expect(within(footer).getByRole('button', { name: 'Edit' }).title).toBe('Shared from another organisation, so it can only be moved')
+		const user = userEvent.setup()
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		expect(screen.getByRole('menuitem', { name: 'Move to folder' }).getAttribute('aria-disabled')).toBeNull()
+		cleanup()
+		renderDetail(itemMeta({ accessExpiresAt: '2026-12-01T00:00:00Z' }))
+		expect(within(footer).getByRole('button', { name: 'Edit' }).getAttribute('aria-disabled')).toBeNull()
+		await user.click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		expect(screen.getByRole('menuitem', { name: 'Clone' }).title).toMatch(/^Your access ends .*2026, so it cannot be cloned$/)
+	})
+
+	it('cannot clone a passkey', async () => {
+		renderDetail(itemMeta({ typeId: 't-passkey' }))
+		await userEvent.setup().click(within(footer).getByRole('button', { name: 'More, GitHub' }))
+		expect(screen.getByRole('menuitem', { name: 'Clone' }).title).toBe('Passkeys cannot be cloned')
 	})
 
 	it('returns to the background state when the vault locked meanwhile', async () => {
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
index 5b816f947..602f0915e 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
@@ -7,8 +7,10 @@ import { cardBrand, cardLast4, parseObject, text } from '@/src/vault/payloads'
 import { IconButton } from '../components/Button'
 import { Banner, ErrorBanner } from '../components/ErrorBanner'
 import { Icon } from '../components/Icon'
+import { itemActions } from '../components/ItemCard'
 import { Loading } from '../components/Loading'
 import { MaskedField } from '../components/MaskedField'
+import { Menu, type MenuItem } from '../components/Menu'
 import { PageFooter } from '../components/PageFooter'
 import { TotpCode } from '../components/TotpCode'
 import { blockedText } from '../errors'
@@ -175,12 +177,28 @@ function Decrypted({ item, type, passive }: { item: ItemMeta; type: TypeMeta | u
 	return item.useOnly ? <UseOnly item={item} values={decrypted.item} /> : <Values item={item} type={type} values={decrypted.item} />
 }
 
+/** `aria-disabled` keeps the button focusable, so its reason can be read. */
+function ActionButton({ action, variant }: { action: MenuItem; variant: 'primary' | 'danger' }) {
+	return (
+		<button
+			type="button"
+			className={`btn btn--${variant}`}
+			aria-disabled={action.disabledReason ? true : undefined}
+			title={action.disabledReason}
+			onClick={action.disabledReason ? undefined : action.onSelect}
+		>
+			{action.label}
+		</button>
+	)
+}
+
 export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
 	// The version the user opened; a later one arrived by sync.
 	const [openedVersion] = useState(item.updatedAt)
 	const dates: Array<[string, string]> = [[i18n.t('detail.created'), item.createdAt], [i18n.t('detail.updated'), item.updatedAt]]
 	if (item.expiresAt) dates.push([i18n.t('detail.expires'), item.expiresAt])
-	const later = i18n.t('common.later')
+	const { items, offline } = useShell()
+	const actions = itemActions(item, type, offline, items)
 	return (
 		<div className="stack">
 			<header className="detail-head">
@@ -193,7 +211,7 @@ export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
 			{item.blocked
 				? (
 					<Banner tone="error" role="status">
-						{item.blockedReason ? blockedText(item.blockedReason) : i18n.t('blocked.generic')}
+						{blockedText(item.blockedReason)}
 						{item.migrationError && <><br />{item.migrationError}</>}
 						<br /><a href={webAppUrl} target="_blank" rel="noreferrer">{i18n.t('common.openWebApp')}</a>
 					</Banner>
@@ -212,8 +230,9 @@ export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
 				</dl>
 			</section>
 			<PageFooter>
-				<button type="button" className="btn btn--primary" aria-disabled="true" title={later}>{i18n.t('item.edit')}</button>
-				<button type="button" className="btn btn--danger" aria-disabled="true" title={later}>{i18n.t('item.delete')}</button>
+				<ActionButton action={actions.edit} variant="primary" />
+				<Menu label={i18n.t('item.moreMenu', { name: item.name })} icon="more" above items={[actions.clone, actions.move]} />
+				<ActionButton action={actions.remove} variant="danger" />
 			</PageFooter>
 		</div>
 	)
diff --git a/browser-extension/entrypoints/popup/views/ItemDialogs.test.tsx b/browser-extension/entrypoints/popup/views/ItemDialogs.test.tsx
new file mode 100644
index 000000000..1ab5b9e06
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/ItemDialogs.test.tsx
@@ -0,0 +1,67 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
+import { fakeBackground, itemMeta, sentOf } from '../testing'
+import { DeleteItemDialog, MoveItemDialog } from './ItemDialogs'
+
+afterEach(cleanup)
+
+function withShell(children: React.ReactNode, refreshState = vi.fn()) {
+	return <ShellContext.Provider value={{ ...DEFAULT_SHELL, refreshState }}>{children}</ShellContext.Provider>
+}
+
+describe('DeleteItemDialog', () => {
+	it('names the item and deletes it on confirm', async () => {
+		const sent = fakeBackground()
+		const onDeleted = vi.fn()
+		render(withShell(<DeleteItemDialog item={itemMeta()} onDeleted={onDeleted} onCancel={() => {}} />))
+		expect(screen.getByRole('dialog', { name: 'Delete item' }).textContent).toContain('Move GitHub to the trash? It stops being shared. You can restore it from the trash in the Keepiq web app.')
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Delete' }))
+		await waitFor(() => expect(onDeleted).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.delete')).toEqual([{ kind: 'item.delete', accountId: 'a1', id: 'i1' }])
+	})
+
+	it('stays open on a failure and retries', async () => {
+		let attempts = 0
+		fakeBackground({ replies: { 'item.delete': () => (++attempts === 1 ? { ok: false, error: { code: 'offline' } } : { ok: true, value: null }) } })
+		const onDeleted = vi.fn()
+		render(withShell(<DeleteItemDialog item={itemMeta()} onDeleted={onDeleted} onCancel={() => {}} />))
+		const user = userEvent.setup()
+		await user.click(screen.getByRole('button', { name: 'Delete' }))
+		expect((await screen.findByRole('alert')).textContent).toContain('Could not reach the server')
+		await user.click(screen.getByRole('button', { name: 'Try again' }))
+		await waitFor(() => expect(onDeleted).toHaveBeenCalled())
+	})
+
+	it('hands a locked vault back to the popup state', async () => {
+		fakeBackground({ replies: { 'item.delete': { ok: false, error: { code: 'locked' } } } })
+		const refreshState = vi.fn()
+		render(withShell(<DeleteItemDialog item={itemMeta()} onDeleted={() => {}} onCancel={() => {}} />, refreshState))
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Delete' }))
+		await waitFor(() => expect(refreshState).toHaveBeenCalled())
+	})
+})
+
+describe('MoveItemDialog', () => {
+	const folders = [{ id: 'w', name: 'Work', parentId: null }]
+
+	it('sends only the folder, and null for No folder', async () => {
+		const sent = fakeBackground()
+		const onMoved = vi.fn()
+		render(withShell(<MoveItemDialog item={itemMeta({ folderId: 'w' })} folders={folders} onMoved={onMoved} onCancel={() => {}} />))
+		await userEvent.setup().click(screen.getByRole('button', { name: 'No folder' }))
+		await waitFor(() => expect(onMoved).toHaveBeenCalledWith(null))
+		expect(sentOf(sent, 'item.update')).toEqual([{ kind: 'item.update', accountId: 'a1', id: 'i1', patch: { folderId: null } }])
+	})
+
+	it('closes without a request when the folder stays the same', async () => {
+		const sent = fakeBackground()
+		const onCancel = vi.fn()
+		render(withShell(<MoveItemDialog item={itemMeta({ folderId: 'w' })} folders={folders} onMoved={() => {}} onCancel={onCancel} />))
+		await userEvent.setup().click(screen.getByRole('button', { name: /^Work/ }))
+		expect(onCancel).toHaveBeenCalled()
+		expect(sentOf(sent, 'item.update')).toEqual([])
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/ItemDialogs.tsx b/browser-extension/entrypoints/popup/views/ItemDialogs.tsx
new file mode 100644
index 000000000..625e45758
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/ItemDialogs.tsx
@@ -0,0 +1,71 @@
+import { useState } from 'react'
+import { i18n } from '#i18n'
+import type { FolderMeta, ItemMeta, VaultWriteError } from '@/src/messages'
+import { ConfirmDialog } from '../components/ConfirmDialog'
+import { writeErrorText } from '../errors'
+import { request } from '../hooks/useMessage'
+import { useShell } from '../shell-context'
+import { FolderPicker } from './FolderPicker'
+
+type Failure = { error: VaultWriteError | undefined } | null
+
+const retryable = (failure: Failure) => !!failure && (!failure.error || failure.error.code === 'offline' || failure.error.code === 'server_error' || failure.error.code === 'write_locked')
+
+/** To Keepiq's trash, which also ends the item's shares (ADR-003); restoring is the web app's. */
+export function DeleteItemDialog({ item, onDeleted, onCancel }: { item: ItemMeta; onDeleted: () => Promise<void> | void; onCancel: () => void }) {
+	const { accountId, refreshState } = useShell()
+	const [busy, setBusy] = useState(false)
+	const [failure, setFailure] = useState<Failure>(null)
+
+	async function remove() {
+		setBusy(true)
+		setFailure(null)
+		const reply = await request({ kind: 'item.delete', accountId, id: item.id })
+		if (reply?.ok) return onDeleted()
+		setBusy(false)
+		if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') refreshState()
+		setFailure({ error: reply?.error })
+	}
+
+	return (
+		<ConfirmDialog
+			title={i18n.t('item.deleteTitle')}
+			actions={[{ label: i18n.t('item.delete'), variant: 'danger', busy, onClick: () => void remove() }]}
+			onCancel={onCancel}
+			error={failure && writeErrorText(failure.error)}
+			onRetry={retryable(failure) ? () => void remove() : undefined}
+		>
+			<p>{i18n.t('item.deleteConfirm', { name: item.name })}</p>
+		</ConfirmDialog>
+	)
+}
+
+/** Sends only `folderId`, which cannot overwrite another field, so it needs no fresh fetch. */
+export function MoveItemDialog({ item, folders, onMoved, onCancel }: { item: ItemMeta; folders: FolderMeta[]; onMoved: (folderId: string | null) => Promise<void> | void; onCancel: () => void }) {
+	const { accountId, refreshState } = useShell()
+	const [busy, setBusy] = useState(false)
+	const [failure, setFailure] = useState<Failure>(null)
+
+	async function move(folderId: string | null) {
+		if (folderId === item.folderId) return onCancel()
+		setBusy(true)
+		setFailure(null)
+		const reply = await request({ kind: 'item.update', accountId, id: item.id, patch: { folderId } })
+		if (reply?.ok) return onMoved(folderId)
+		setBusy(false)
+		if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') refreshState()
+		setFailure({ error: reply?.error })
+	}
+
+	return (
+		<FolderPicker
+			title={i18n.t('folders.moveTitle')}
+			folders={folders}
+			current={item.folderId}
+			onPick={(folderId) => void move(folderId)}
+			onCancel={onCancel}
+			busy={busy}
+			error={failure && writeErrorText(failure.error)}
+		/>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/views/ItemForm.test.tsx b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
new file mode 100644
index 000000000..030b22678
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
@@ -0,0 +1,290 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { EditableItem, FolderMeta } from '@/src/messages'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
+import { editableItem, fakeBackground, sentOf, snapshotReply, type UnlockedSnapshot } from '../testing'
+import { ItemForm, type FormMode } from './ItemForm'
+
+let footer: HTMLElement
+beforeEach(() => {
+	footer = document.body.appendChild(document.createElement('div'))
+})
+afterEach(() => {
+	cleanup()
+	footer.remove()
+})
+
+const folders: FolderMeta[] = [{ id: 'w', name: 'Work', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }]
+
+interface Options {
+	mode?: FormMode
+	id?: string
+	snapshot?: UnlockedSnapshot
+	tabUrl?: string
+	offline?: boolean
+	items?: Record<string, EditableItem>
+	replies?: Record<string, unknown>
+}
+
+function renderForm({ mode = 'add', id, snapshot = snapshotReply({ folders }), tabUrl, offline = false, items, replies }: Options = {}) {
+	const sent = fakeBackground({ snapshot, items, replies })
+	const shell = { ...DEFAULT_SHELL, footer, offline, toast: vi.fn(), refreshState: vi.fn(), syncNow: vi.fn(), setLeaveGuard: vi.fn() }
+	const onSaved = vi.fn()
+	const onCancel = vi.fn()
+	const onGone = vi.fn()
+	render(
+		<ShellContext.Provider value={shell}>
+			<ItemForm mode={mode} id={id} snapshot={snapshot} tabUrl={tabUrl} onSaved={onSaved} onCancel={onCancel} onGone={onGone} />
+		</ShellContext.Provider>,
+	)
+	return { sent, shell, onSaved, onCancel, onGone, user: userEvent.setup() }
+}
+
+const save = () => within(footer).getByRole('button', { name: 'Save' })
+const field = (label: string) => screen.getByLabelText(label) as HTMLInputElement
+const created = (sent: ReturnType<typeof fakeBackground>) => sentOf(sent, 'item.create').map((message) => message.draft)
+
+describe('adding', () => {
+	it('opens on a tab with its URL, No folder and the login type', () => {
+		renderForm({ tabUrl: 'https://example.com/login' })
+		expect(field('Website URL').value).toBe('https://example.com/login')
+		expect(screen.getByRole('button', { name: 'Choose a folder, now No folder' })).toBeTruthy()
+		expect((screen.getByLabelText('Type') as HTMLSelectElement).value).toBe('t-login')
+		for (const label of ['Name', 'Username', 'Password', 'Notes']) expect(field(label).value).toBe('')
+	})
+
+	it('preselects the user\'s default type and leaves passkeys out', () => {
+		renderForm({ snapshot: snapshotReply({ defaultSecretType: 'note' }) })
+		const type = screen.getByLabelText('Type') as HTMLSelectElement
+		expect(type.value).toBe('t-note')
+		expect([...type.options].map((option) => option.textContent)).not.toContain('Passkey')
+		expect(screen.getByRole('textbox', { name: 'Note' })).toBeTruthy()
+		expect(screen.queryByLabelText('Username')).toBeNull()
+	})
+
+	it('refuses a missing name without a request', async () => {
+		const { sent, user } = renderForm()
+		await user.click(save())
+		expect(screen.getByText('Name is required')).toBeTruthy()
+		expect(created(sent)).toEqual([])
+	})
+
+	it('creates a login with its notes and fields, then hands over the new id', async () => {
+		const { sent, onSaved, user } = renderForm({ tabUrl: 'https://github.com/login' })
+		await user.type(field('Name'), 'GitHub')
+		await user.type(field('Username'), 'alice')
+		await user.type(field('Password'), 'hunter2')
+		await user.type(field('Notes'), 'Recovery codes in the safe')
+		await user.click(screen.getByRole('button', { name: 'Add field' }))
+		await user.type(field('Field name'), 'pin')
+		await user.type(field('pin'), '1234')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+		expect(created(sent)).toEqual([{
+			typeId: 't-login', name: 'GitHub', url: 'https://github.com/login', folderId: null, key: 'hunter2', login: 'alice',
+			additionalFields: { pin: '1234', notes: 'Recovery codes in the safe' },
+		}])
+	})
+
+	it('refuses a reserved or duplicate field name while typing', async () => {
+		const { user } = renderForm()
+		await user.click(screen.getByRole('button', { name: 'Add field' }))
+		await user.type(screen.getAllByLabelText('Field name')[0]!, 'Login')
+		expect(screen.getByText('This name is reserved')).toBeTruthy()
+		expect((save() as HTMLButtonElement).disabled).toBe(true)
+		await user.clear(screen.getAllByLabelText('Field name')[0]!)
+		await user.type(screen.getAllByLabelText('Field name')[0]!, 'pin')
+		await user.click(screen.getByRole('button', { name: 'Add field' }))
+		await user.type(screen.getAllByLabelText('Field name')[1]!, 'pin')
+		expect(screen.getByText('A field with this name already exists')).toBeTruthy()
+		expect((save() as HTMLButtonElement).disabled).toBe(true)
+	})
+
+	it('refuses an invalid authenticator secret', async () => {
+		const { sent, user } = renderForm()
+		await user.selectOptions(screen.getByLabelText('Type'), 't-totp')
+		await user.type(field('Name'), 'GitHub 2FA')
+		await user.type(field('Authenticator key'), 'not a secret!')
+		await user.click(save())
+		expect(screen.getByText('Not a valid authenticator secret')).toBeTruthy()
+		expect(created(sent)).toEqual([])
+	})
+
+	it('writes changed TOTP options into the seed', async () => {
+		const { sent, onSaved, user } = renderForm()
+		await user.selectOptions(screen.getByLabelText('Type'), 't-totp')
+		await user.type(field('Name'), 'GitHub')
+		await user.type(field('Authenticator key'), 'JBSWY3DPEHPK3PXP')
+		await user.click(screen.getByText('Advanced'))
+		await user.selectOptions(screen.getByLabelText('Digits'), '8')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(created(sent)[0]).toMatchObject({ key: 'otpauth://totp/GitHub?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=8&period=30', login: null })
+	})
+
+	it('writes a card with all five members', async () => {
+		const { sent, onSaved, user } = renderForm()
+		await user.selectOptions(screen.getByLabelText('Type'), 't-card')
+		await user.type(field('Name'), 'Visa')
+		await user.type(field('Number'), '4111111111111111')
+		await user.type(field('Expiry'), '12/29')
+		await user.type(field('Cardholder'), 'Alice Doe')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(JSON.parse((created(sent)[0] as { key: string }).key)).toEqual({ number: '4111111111111111', expiry: '12/29', cvv: '', pin: '', cardholder: 'Alice Doe' })
+	})
+
+	it('reports itself dirty to the leave guard once something is typed', async () => {
+		const { shell, user } = renderForm({ tabUrl: 'https://github.com/' })
+		const isDirty = shell.setLeaveGuard.mock.calls[0]![0] as () => boolean
+		expect(isDirty()).toBe(false)
+		await user.type(field('Name'), 'x')
+		expect(isDirty()).toBe(true)
+	})
+})
+
+describe('folders', () => {
+	it('picks a nested folder without a request', async () => {
+		const { sent, onSaved, user } = renderForm()
+		await user.click(screen.getByRole('button', { name: 'Choose a folder, now No folder' }))
+		const dialog = screen.getByRole('dialog', { name: 'Choose folder' })
+		expect(within(dialog).getAllByRole('button').map((button) => button.textContent)).toEqual(['No folderCurrent folder', 'Work', 'Clients', 'New folder', 'Cancel'])
+		await user.click(within(dialog).getByRole('button', { name: 'Clients' }))
+		expect(screen.getByRole('button', { name: 'Choose a folder, now Work / Clients' })).toBeTruthy()
+		expect(sentOf(sent, 'folder.create')).toEqual([])
+		await user.type(field('Name'), 'GitHub')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(created(sent)[0]).toMatchObject({ folderId: 'c' })
+	})
+
+	it('creates a folder from the picker and keeps the other fields', async () => {
+		const { sent, onSaved, user } = renderForm()
+		await user.type(field('Name'), 'Bank')
+		await user.click(screen.getByRole('button', { name: 'Choose a folder, now No folder' }))
+		await user.click(screen.getByRole('button', { name: 'New folder' }))
+		await user.type(field('Folder name'), 'Banking')
+		await user.click(within(screen.getByRole('dialog', { name: 'New folder' })).getByRole('button', { name: 'Save' }))
+		await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+		expect(sentOf(sent, 'folder.create')).toEqual([{ kind: 'folder.create', accountId: 'a1', name: 'Banking', parentId: null }])
+		expect(field('Name').value).toBe('Bank')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(created(sent)[0]).toMatchObject({ folderId: 'f-new' })
+	})
+
+	it('refuses a slash in a new folder name', async () => {
+		const { sent, user } = renderForm()
+		await user.click(screen.getByRole('button', { name: 'Choose a folder, now No folder' }))
+		await user.click(screen.getByRole('button', { name: 'New folder' }))
+		await user.type(field('Folder name'), 'Work/Clients')
+		await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Save' }))
+		expect(screen.getByText('Folder names cannot contain slashes')).toBeTruthy()
+		expect(sentOf(sent, 'folder.create')).toEqual([])
+	})
+})
+
+describe('editing', () => {
+	it('fills from a fresh fetch and sends only the rename with the base version', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ additionalFields: { notes: 'n' } }) } })
+		expect((await screen.findByLabelText('Username') as HTMLInputElement).value).toBe('alice')
+		expect(field('Notes').value).toBe('n')
+		expect((screen.getByLabelText('Type') as HTMLSelectElement).disabled).toBe(true)
+		await user.type(field('Name'), ' work')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1'))
+		expect(sentOf(sent, 'item.update')).toEqual([{ kind: 'item.update', accountId: 'a1', id: 'i1', patch: { name: 'GitHub work' }, baseUpdatedAt: '2026-03-02T10:00:00Z' }])
+	})
+
+	it('clears an emptied username with null', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() } })
+		await user.clear(await screen.findByLabelText('Username'))
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch: { login: null } })
+	})
+
+	it('closes without a request when nothing changed', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() } })
+		await screen.findByLabelText('Username')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1'))
+		expect(sentOf(sent, 'item.update')).toEqual([])
+	})
+
+	it('keeps the typed values when the item changed elsewhere', async () => {
+		const { onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: false, error: { code: 'conflict' } } } })
+		await user.type(await screen.findByLabelText('Username'), '2')
+		await user.click(save())
+		expect(await screen.findByText('This item was changed elsewhere. Go back and edit it again to see the latest version.')).toBeTruthy()
+		expect(field('Username').value).toBe('alice2')
+		expect(onSaved).not.toHaveBeenCalled()
+	})
+
+	it('keeps the values on a write lock', async () => {
+		const { user } = renderForm({ replies: { 'item.create': { ok: false, error: { code: 'write_locked' } } } })
+		await user.type(field('Name'), 'GitHub')
+		await user.click(save())
+		expect(await screen.findByText('Vault is temporarily locked for a key migration, try again later')).toBeTruthy()
+		expect(field('Name').value).toBe('GitHub')
+	})
+
+	it('offers Retry when the server could not be reached', async () => {
+		let attempts = 0
+		const { onSaved, user } = renderForm({ replies: { 'item.create': () => (++attempts === 1 ? { ok: false, error: { code: 'offline' } } : { ok: true, value: { id: 'new' } }) } })
+		await user.type(field('Name'), 'GitHub')
+		await user.click(save())
+		await user.click(await screen.findByRole('button', { name: 'Try again' }))
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+	})
+
+	it('edits only name, folder and URL of a passkey', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'p', items: { p: editableItem({ id: 'p', typeId: 't-passkey', key: '', keyWithheld: true, login: null }) } })
+		expect(await screen.findByText('Passkey credentials can only be changed in the Keepiq web app')).toBeTruthy()
+		for (const label of ['Username', 'Password', 'Notes', 'Field name']) expect(screen.queryByLabelText(label)).toBeNull()
+		expect(screen.queryByRole('button', { name: 'Add field' })).toBeNull()
+		await user.type(field('Name'), '!')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch: { name: 'GitHub!' } })
+	})
+
+	it('leaves when the item was deleted elsewhere', async () => {
+		const { shell, onGone } = renderForm({ mode: 'edit', id: 'gone' })
+		await waitFor(() => expect(onGone).toHaveBeenCalled())
+		expect(shell.toast).toHaveBeenCalledWith('This item no longer exists')
+	})
+
+	it('refuses to edit a blocked item and says why', async () => {
+		renderForm({ mode: 'edit', id: 'b', replies: { 'item.fetch': { ok: false, error: { code: 'blocked', reason: 'suite_revoked' } } } })
+		const alert = await screen.findByRole('alert')
+		expect(alert.textContent).toContain('Its encryption key was revoked.')
+		expect(within(alert).getByRole('link', { name: 'Open the Keepiq web app' }).getAttribute('href')).toBe('https://cloud.example.org/index.php/apps/keepiq/')
+		expect(screen.queryByLabelText('Name')).toBeNull()
+	})
+})
+
+describe('cloning', () => {
+	it('prefills every field with the name suffixed and creates a new item', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'clone', id: 'i1', items: { i1: editableItem({ folderId: 'w', additionalFields: { pin: '1' } }) } })
+		expect((await screen.findByLabelText('Name') as HTMLInputElement).value).toBe('GitHub - Clone')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+		expect(created(sent)).toEqual([{
+			typeId: 't-login', name: 'GitHub - Clone', url: 'https://github.com', folderId: 'w', key: 'hunter2', login: 'alice', additionalFields: { pin: '1' },
+		}])
+		expect(sentOf(sent, 'item.update')).toEqual([])
+	})
+})
+
+describe('offline', () => {
+	it('disables Save and explains why, with a way to retry', async () => {
+		const { shell, user } = renderForm({ offline: true })
+		expect(screen.getByText('You are offline. Changes need a connection to Keepiq.')).toBeTruthy()
+		expect((save() as HTMLButtonElement).disabled).toBe(true)
+		await user.click(screen.getByRole('button', { name: 'Sync now' }))
+		expect(shell.syncNow).toHaveBeenCalled()
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/ItemForm.tsx b/browser-extension/entrypoints/popup/views/ItemForm.tsx
new file mode 100644
index 000000000..ef22c94cb
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/ItemForm.tsx
@@ -0,0 +1,280 @@
+import { useEffect, useId, useRef, useState, type ReactNode } from 'react'
+import { i18n } from '#i18n'
+import type { EditableItem, VaultSnapshotReply, VaultWriteError } from '@/src/messages'
+import { parseTotpSeed, type TotpAlgorithm } from '@/src/totp/totp'
+import { CARD_FIELDS, emptyValues, formKind, fromItem, IDENTITY_FIELDS, isMultiline, type CardField, type FormValues, type IdentityField } from '@/src/vault/fields'
+import { folderPath } from '@/src/vault/list'
+import { AdditionalFieldsEditor } from '../components/AdditionalFieldsEditor'
+import { Button } from '../components/Button'
+import { Banner } from '../components/ErrorBanner'
+import { Icon } from '../components/Icon'
+import { Loading } from '../components/Loading'
+import { PageFooter } from '../components/PageFooter'
+import { Select } from '../components/Select'
+import { TextArea } from '../components/TextArea'
+import { TextField } from '../components/TextField'
+import { TypeSelect } from '../components/TypeSelect'
+import { fieldErrorText, writeErrorText } from '../errors'
+import { useItemDraft } from '../hooks/useItemDraft'
+import { request } from '../hooks/useMessage'
+import { useUnsavedChangesGuard } from '../hooks/useUnsavedChangesGuard'
+import { useShell } from '../shell-context'
+import { FolderPicker } from './FolderPicker'
+
+type Unlocked = Extract<VaultSnapshotReply, { state: 'unlocked' }>
+
+export type FormMode = 'add' | 'edit' | 'clone'
+
+interface Props {
+	mode: FormMode
+	/** The item to edit or clone. */
+	id?: string
+	snapshot: Unlocked
+	/** The page the popup opened on, which a new item's Website URL starts as. */
+	tabUrl?: string
+	/** Awaited, so Save stays busy until the shell shows the result. */
+	onSaved: (id: string) => Promise<void> | void
+	onCancel: () => void
+	/** The item was deleted elsewhere. */
+	onGone: () => void
+}
+
+const isRetryable = (error: VaultWriteError | undefined) => !error || error.code === 'offline' || error.code === 'server_error' || error.code === 'write_locked'
+
+function FormSection({ title, children }: { title: string; children: ReactNode }) {
+	return (
+		<section className="section">
+			<h2 className="section__title">{title}</h2>
+			<div className="card form-card">{children}</div>
+		</section>
+	)
+}
+
+/** The user's default type, else `login`; never a passkey, which only a passkey ceremony creates. */
+function defaultTypeId(snapshot: Unlocked): string {
+	const usable = snapshot.types.filter((type) => type.name !== 'passkey')
+	return (usable.find((type) => type.name === snapshot.defaultSecretType) ?? usable.find((type) => type.name === 'login') ?? usable[0])?.id ?? ''
+}
+
+export function ItemForm(props: Props) {
+	if (props.mode === 'add') return <Form {...props} initial={emptyValues(defaultTypeId(props.snapshot), props.tabUrl ?? '')} />
+	return <Fetched {...props} id={props.id!} />
+}
+
+/** Edit and clone start from a fresh fetch, never the cache (ADR-002). */
+function Fetched(props: Props & { id: string }) {
+	const { id, mode, snapshot } = props
+	const shell = useShell()
+	const [state, setState] = useState<{ item?: EditableItem; failure?: { error: VaultWriteError | undefined } }>({})
+	const [attempt, setAttempt] = useState(0)
+	// Read at reply time, so a new callback from a re-render does not fetch again.
+	const latest = useRef({ shell, onGone: props.onGone })
+	useEffect(() => {
+		latest.current = { shell, onGone: props.onGone }
+	})
+
+	useEffect(() => {
+		let live = true
+		void request({ kind: 'item.fetch', accountId: latest.current.shell.accountId, id, purpose: mode === 'clone' ? 'clone' : 'edit' }).then((reply) => {
+			if (!live) return
+			if (reply?.ok) return setState({ item: reply.value })
+			if (reply?.error.code === 'not_found') {
+				latest.current.shell.toast(i18n.t('item.gone'))
+				return latest.current.onGone()
+			}
+			if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') latest.current.shell.refreshState()
+			setState({ failure: { error: reply?.error } })
+		})
+		return () => {
+			live = false
+		}
+	}, [id, mode, attempt])
+
+	if (state.item) {
+		const initial = fromItem(state.item)
+		if (mode === 'clone') initial.name = i18n.t('item.cloneName', { name: state.item.name })
+		return <Form {...props} item={state.item} initial={initial} />
+	}
+	if (!state.failure) return <Loading />
+	const { error } = state.failure
+	return (
+		<div className="stack">
+			{error?.code === 'blocked'
+				? (
+					<Banner tone="error" role="alert">
+						{writeErrorText(error)}
+						<br /><a href={snapshot.webAppUrl} target="_blank" rel="noreferrer">{i18n.t('common.openWebApp')}</a>
+					</Banner>
+				)
+				: (
+					<Banner tone="error" role="alert" action={isRetryable(error) && <Button variant="link" onClick={() => { setState({}); setAttempt((n) => n + 1) }}>{i18n.t('vault.tryAgain')}</Button>}>
+						{writeErrorText(error)}
+					</Banner>
+				)}
+		</div>
+	)
+}
+
+const ALGORITHMS: TotpAlgorithm[] = ['SHA1', 'SHA256', 'SHA512']
+
+function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { item?: EditableItem; initial: FormValues }) {
+	const shell = useShell()
+	const draft = useItemDraft(initial, snapshot.types)
+	useUnsavedChangesGuard(draft.dirty)
+	const [busy, setBusy] = useState(false)
+	const [failure, setFailure] = useState<{ error: VaultWriteError | undefined } | null>(null)
+	const [picking, setPicking] = useState(false)
+	const formId = useId()
+	const { values, update } = draft
+	const kind = formKind(draft.typeName)
+	const error = (path: string) => (draft.errors[path] ? fieldErrorText(draft.errors[path]) : null)
+
+	async function save() {
+		const next = draft.submit()
+		if (!next || shell.offline || busy) return
+		setBusy(true)
+		setFailure(null)
+		let reply
+		if (mode === 'edit' && item) {
+			if (!draft.dirty) {
+				await onSaved(item.id)
+				return
+			}
+			reply = await request({ kind: 'item.update', accountId: shell.accountId, id: item.id, patch: draft.patch, baseUpdatedAt: item.updatedAt })
+		} else {
+			reply = await request({ kind: 'item.create', accountId: shell.accountId, draft: next })
+		}
+		if (reply?.ok) {
+			await onSaved(reply.value.id)
+			return
+		}
+		setBusy(false)
+		if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') shell.refreshState()
+		setFailure({ error: reply?.error })
+	}
+
+	const card = (member: CardField) => (value: string) => update({ card: { ...values.card, [member]: value } })
+	const identity = (member: IdentityField) => (value: string) => update({ identity: { ...values.identity, [member]: value } })
+	const cardLabels: Record<CardField, string> = {
+		number: i18n.t('detail.number'), expiry: i18n.t('detail.expiry'), cvv: i18n.t('detail.cvv'), pin: i18n.t('detail.pin'), cardholder: i18n.t('detail.cardholder'),
+	}
+	const identityLabels: Record<IdentityField, string> = {
+		firstName: i18n.t('detail.firstName'), lastName: i18n.t('detail.lastName'), address: i18n.t('detail.address'),
+		phone: i18n.t('detail.phone'), email: i18n.t('detail.email'), bsn: i18n.t('detail.bsn'),
+	}
+	const masked: ReadonlySet<string> = new Set(['number', 'cvv', 'pin', 'bsn'])
+
+	let seed = { algorithm: 'SHA1' as TotpAlgorithm, digits: 6 as 6 | 8, period: 30 }
+	try {
+		seed = parseTotpSeed(values.secret)
+	} catch {
+		// The defaults stand in until the key parses.
+	}
+	const totp = { ...seed, ...values.totp }
+	const folderLabel = folderPath(snapshot.folders, values.folderId) ?? i18n.t('filters.noFolder')
+	const secretLabel = draft.typeName === 'login' || draft.typeName === 'database' || !draft.typeName
+		? i18n.t('detail.password')
+		: snapshot.types.find((type) => type.id === values.typeId)?.label ?? i18n.t('form.secret')
+
+	return (
+		<>
+			<form id={formId} className="stack" noValidate onSubmit={(event) => {
+				event.preventDefault()
+				void save()
+			}}>
+				{shell.offline && (
+					<Banner tone="warning" role="status" action={<Button variant="link" onClick={shell.syncNow}>{i18n.t('vault.syncNow')}</Button>}>
+						{i18n.t('form.offline')}
+					</Banner>
+				)}
+				{failure && (
+					<Banner tone="error" role="alert" action={isRetryable(failure.error) && <Button variant="link" onClick={() => void save()}>{i18n.t('vault.tryAgain')}</Button>}>
+						{writeErrorText(failure.error, mode === 'edit' ? 'edit' : 'item')}
+					</Banner>
+				)}
+				<FormSection title={i18n.t('form.itemDetails')}>
+					<TypeSelect types={snapshot.types} value={values.typeId} onChange={(typeId) => update({ typeId })} disabled={mode === 'edit'} />
+					<TextField label={i18n.t('form.name')} value={values.name} onChange={(name) => update({ name })} error={error('name')} autoComplete="off" />
+					<div className="field">
+						<span className="field__label" aria-hidden="true">{i18n.t('form.folder')}</span>
+						<button type="button" className="picker-field" aria-label={i18n.t('form.chooseFolder', { folder: folderLabel })} onClick={() => setPicking(true)}>
+							<Icon name="folder" />
+							<span className="picker-field__value">{folderLabel}</span>
+							<Icon name="chevronRight" />
+						</button>
+					</div>
+					{kind === 'note' && <TextArea label={i18n.t('form.note')} value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} rows={8} />}
+				</FormSection>
+
+				{kind === 'passkey' && <p className="hint">{i18n.t('form.passkeyReadOnly')}</p>}
+				{kind === 'credential' && (
+					<FormSection title={i18n.t('detail.loginCredentials')}>
+						<TextField label={i18n.t('detail.username')} value={values.login} onChange={(login) => update({ login })} error={error('login')} autoComplete="off" />
+						{isMultiline(draft.typeName)
+							? <TextArea label={secretLabel} value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} rows={6} spellCheck={false} mono />
+							// The generate button joins here with ext-generator's pick mode.
+							: <TextField label={secretLabel} type="password" value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} autoComplete="new-password" />}
+					</FormSection>
+				)}
+				{kind === 'totp' && (
+					<FormSection title={i18n.t('form.authenticator')}>
+						<TextField label={i18n.t('detail.authenticatorKey')} type="password" value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} autoComplete="off" spellCheck={false} />
+						<details className="advanced">
+							<summary>{i18n.t('form.advanced')}</summary>
+							<Select<TotpAlgorithm> label={i18n.t('form.algorithm')} value={totp.algorithm} options={ALGORITHMS.map((value) => ({ value, label: value }))} onChange={(algorithm) => update({ totp: { ...values.totp, algorithm } })} />
+							<Select label={i18n.t('form.digits')} value={String(totp.digits)} options={['6', '8'].map((value) => ({ value, label: value }))} onChange={(digits) => update({ totp: { ...values.totp, digits: digits === '8' ? 8 : 6 } })} />
+							<Select label={i18n.t('form.period')} value={String(totp.period)} options={[...new Set([30, 60, totp.period])].map((value) => ({ value: String(value), label: String(value) }))} onChange={(period) => update({ totp: { ...values.totp, period: Number(period) } })} />
+						</details>
+					</FormSection>
+				)}
+				{kind === 'card' && (
+					<FormSection title={i18n.t('detail.cardDetails')}>
+						{CARD_FIELDS.map((member) => (
+							<TextField key={member} label={cardLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.card[member]} onChange={card(member)} error={error(`card.${member}`)} autoComplete="off" />
+						))}
+						{error('secret') && <p className="field__error">{error('secret')}</p>}
+					</FormSection>
+				)}
+				{kind === 'identity' && (
+					<FormSection title={i18n.t('detail.identity')}>
+						{IDENTITY_FIELDS.map((member) => (
+							<TextField key={member} label={identityLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.identity[member]} onChange={identity(member)} error={error(`identity.${member}`)} autoComplete="off" />
+						))}
+						{error('secret') && <p className="field__error">{error('secret')}</p>}
+					</FormSection>
+				)}
+
+				<FormSection title={i18n.t('form.autofillOptions')}>
+					<TextField label={i18n.t('form.website')} value={values.url} onChange={(url) => update({ url })} error={error('url')} inputMode="url" autoComplete="off" spellCheck={false} />
+				</FormSection>
+				{kind !== 'passkey' && (
+					<FormSection title={i18n.t('detail.additionalFields')}>
+						<AdditionalFieldsEditor fields={values.fields} errors={draft.errors} onChange={(fields) => update({ fields })} />
+						{error('additionalFields') && <p className="field__error">{error('additionalFields')}</p>}
+					</FormSection>
+				)}
+				{kind !== 'passkey' && kind !== 'note' && (
+					<FormSection title={i18n.t('form.additionalOptions')}>
+						<TextArea label={i18n.t('detail.notes')} value={values.notes} onChange={(notes) => update({ notes })} error={error('notes')} />
+					</FormSection>
+				)}
+			</form>
+			<PageFooter>
+				<Button type="submit" form={formId} busy={busy} disabled={draft.blocked || shell.offline}>{i18n.t('form.save')}</Button>
+				<Button variant="secondary" onClick={onCancel}>{i18n.t('common.cancel')}</Button>
+			</PageFooter>
+			{picking && (
+				<FolderPicker
+					title={i18n.t('folders.pickTitle')}
+					folders={snapshot.folders}
+					current={values.folderId}
+					onPick={(folderId) => {
+						update({ folderId })
+						setPicking(false)
+					}}
+					onCancel={() => setPicking(false)}
+				/>
+			)}
+		</>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/views/Shell.test.tsx b/browser-extension/entrypoints/popup/views/Shell.test.tsx
index 03142abee..57ec0dfaf 100644
--- a/browser-extension/entrypoints/popup/views/Shell.test.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.test.tsx
@@ -3,7 +3,7 @@ import { act, cleanup, render, screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import App from '../App'
-import { everythingVisible, fakeBackground, itemMeta, popupState, sentKinds, snapshotReply } from '../testing'
+import { editableItem, everythingVisible, fakeBackground, itemMeta, popupState, sentKinds, sentOf, snapshotReply } from '../testing'
 
 afterEach(cleanup)
 beforeEach(everythingVisible)
@@ -163,3 +163,183 @@ describe('Shell', () => {
 		expect(create).toHaveBeenCalledWith({ url: 'https://github.com/', windowId: 3 })
 	})
 })
+
+describe('item writes', () => {
+	const footer = () => document.querySelector<HTMLElement>('.popup__footer')!
+
+	it('adds an item over the tab bar and opens it once saved', async () => {
+		let items = [itemMeta()]
+		const sent = fakeBackground({
+			snapshot: () => snapshotReply({ items }),
+			replies: {
+				'item.create': () => {
+					items = [...items, itemMeta({ id: 'new', name: 'Bank', url: null })]
+					return { ok: true, value: { id: 'new' } }
+				},
+			},
+		})
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: 'New' }))
+		expect((await title()).textContent).toBe('New item')
+		expect(screen.queryByRole('navigation', { name: 'Main' })).toBeNull()
+		// Opened on github.com/login, so the form starts with that page.
+		expect((screen.getByLabelText('Website URL') as HTMLInputElement).value).toBe('https://github.com/login')
+		await user.type(screen.getByLabelText('Name'), 'Bank')
+		await user.click(within(footer()).getByRole('button', { name: 'Save' }))
+		expect((await screen.findByRole('heading', { name: 'Bank' })).textContent).toBe('Bank')
+		expect((await title()).textContent).toBe('View item')
+		expect(screen.getByRole('status').textContent).toBe('Item saved')
+		expect(sentKinds(sent)).toContain('item.create')
+	})
+
+	it('prefills only the origin and path of the tab, never its query or fragment', async () => {
+		fakeBackground({ tabUrl: 'https://user:pw@app.example.com/callback?token=abc#access_token=xyz' })
+		render(<App />)
+		await userEvent.setup().click(await screen.findByRole('button', { name: 'New' }))
+		expect((screen.getByLabelText('Website URL') as HTMLInputElement).value).toBe('https://app.example.com/callback')
+	})
+
+	it('offers New item in the header on the Vault list only', async () => {
+		fakeBackground({ decrypted: { i1: { login: 'alice', key: 'pw' } } })
+		render(<App />)
+		const user = userEvent.setup()
+		await screen.findByRole('button', { name: 'New' })
+		await user.click(screen.getByRole('button', { name: /^GitHub/ }))
+		await screen.findByText('Login credentials')
+		expect(screen.queryByRole('button', { name: 'New' })).toBeNull()
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		await user.click(screen.getByRole('button', { name: 'Settings' }))
+		expect(screen.queryByRole('button', { name: 'New' })).toBeNull()
+	})
+
+	it('asks before Back drops typed changes, and not when nothing changed', async () => {
+		fakeBackground()
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: 'New' }))
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		expect((await title()).textContent).toBe('Vault')
+		expect(screen.queryByRole('dialog')).toBeNull()
+
+		await user.click(screen.getByRole('button', { name: 'New' }))
+		await user.type(screen.getByLabelText('Name'), 'Draft')
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		const dialog = screen.getByRole('dialog', { name: 'Unsaved changes' })
+		expect(dialog.textContent).toContain('You have unsaved changes. Discard them?')
+		await user.click(within(dialog).getByRole('button', { name: 'Keep editing' }))
+		expect((screen.getByLabelText('Name') as HTMLInputElement).value).toBe('Draft')
+		await user.click(within(footer()).getByRole('button', { name: 'Cancel' }))
+		await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Discard' }))
+		expect((await title()).textContent).toBe('Vault')
+		expect(screen.queryByLabelText('Name')).toBeNull()
+	})
+
+	it('edits from detail and returns to it', async () => {
+		const sent = fakeBackground({ decrypted: { i1: { login: 'alice', key: 'pw' } }, items: { i1: editableItem() } })
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		await user.click(within(footer()).getByRole('button', { name: 'Edit' }))
+		expect((await title()).textContent).toBe('Edit item')
+		await user.type(await screen.findByLabelText('Name'), ' work')
+		await user.click(within(footer()).getByRole('button', { name: 'Save' }))
+		await vi.waitFor(async () => expect((await title()).textContent).toBe('View item'))
+		expect(sentKinds(sent)).toContain('item.update')
+	})
+
+	it('deletes after the confirm dialog and returns to the list', async () => {
+		let items = [itemMeta()]
+		const sent = fakeBackground({
+			snapshot: () => snapshotReply({ items }),
+			replies: { 'item.delete': () => ((items = []), { ok: true, value: null }) },
+		})
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		await user.click(within(footer()).getByRole('button', { name: 'Delete' }))
+		const dialog = screen.getByRole('dialog', { name: 'Delete item' })
+		expect(dialog.textContent).toContain('Move GitHub to the trash?')
+		await user.click(within(dialog).getByRole('button', { name: 'Cancel' }))
+		expect(sentKinds(sent)).not.toContain('item.delete')
+		expect((await title()).textContent).toBe('View item')
+
+		await user.click(within(footer()).getByRole('button', { name: 'Delete' }))
+		await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Delete' }))
+		await vi.waitFor(async () => expect((await title()).textContent).toBe('Vault'))
+		expect(screen.getByRole('status').textContent).toBe('Item moved to the trash')
+		expect(sentOf(sent, 'item.delete')).toEqual([{ kind: 'item.delete', accountId: 'a1', id: 'i1' }])
+	})
+
+	it('keeps the item when the delete does not reach the server', async () => {
+		fakeBackground({ replies: { 'item.delete': { ok: false, error: { code: 'offline' } } } })
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		await user.click(within(footer()).getByRole('button', { name: 'Delete' }))
+		await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Delete' }))
+		expect((await within(screen.getByRole('dialog')).findByRole('alert')).textContent).toContain('Could not reach the server')
+		expect((await title()).textContent).toBe('View item')
+	})
+
+	it('moves into a folder with a folderId-only patch', async () => {
+		const sent = fakeBackground({ snapshot: snapshotReply({ folders: [{ id: 'w', name: 'Work', parentId: null }] }) })
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: 'More, GitHub' }))
+		await user.click(screen.getByRole('menuitem', { name: 'Move to folder' }))
+		await user.click(within(screen.getByRole('dialog', { name: 'Move to folder' })).getByRole('button', { name: 'Work' }))
+		await vi.waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+		expect(sentOf(sent, 'item.update')).toEqual([{ kind: 'item.update', accountId: 'a1', id: 'i1', patch: { folderId: 'w' } }])
+		expect(screen.getByRole('status').textContent).toBe('Moved to Work')
+	})
+
+	it('names a folder made in the move picker in its toast', async () => {
+		let folders: { id: string; name: string; parentId: string | null }[] = []
+		fakeBackground({
+			snapshot: () => snapshotReply({ folders }),
+			replies: { 'folder.create': () => ((folders = [{ id: 'f-new', name: 'Banking', parentId: null }]), { ok: true, value: { id: 'f-new' } }) },
+		})
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: 'More, GitHub' }))
+		await user.click(screen.getByRole('menuitem', { name: 'Move to folder' }))
+		await user.click(screen.getByRole('button', { name: 'New folder' }))
+		await user.type(screen.getByLabelText('Folder name'), 'Banking')
+		await user.click(within(screen.getByRole('dialog', { name: 'New folder' })).getByRole('button', { name: 'Save' }))
+		await vi.waitFor(() => expect(screen.getByRole('status').textContent).toBe('Moved to Banking'))
+	})
+
+	it('shows a failed move after New folder in the picker, so the folder is not created twice', async () => {
+		const sent = fakeBackground({ replies: { 'item.update': { ok: false, error: { code: 'server_error' } } } })
+		render(<App />)
+		const user = userEvent.setup()
+		await user.click(await screen.findByRole('button', { name: 'More, GitHub' }))
+		await user.click(screen.getByRole('menuitem', { name: 'Move to folder' }))
+		await user.click(screen.getByRole('button', { name: 'New folder' }))
+		await user.type(screen.getByLabelText('Folder name'), 'Banking')
+		await user.click(within(screen.getByRole('dialog', { name: 'New folder' })).getByRole('button', { name: 'Save' }))
+		const picker = await screen.findByRole('dialog', { name: 'Move to folder' })
+		expect(await within(picker).findByRole('alert')).toBeTruthy()
+		expect(screen.queryByRole('dialog', { name: 'New folder' })).toBeNull()
+		expect(sentOf(sent, 'folder.create')).toHaveLength(1)
+	})
+
+	it('asks before the account switcher drops typed changes, and closes the form for it', async () => {
+		fakeBackground()
+		render(<App />)
+		const user = userEvent.setup()
+		const avatar = () => screen.getByRole('button', { name: 'Accounts, signed in as Alice Doe' })
+		await user.click(await screen.findByRole('button', { name: 'New' }))
+		await user.type(screen.getByLabelText('Name'), 'Draft')
+		await user.click(avatar())
+		await user.click(within(screen.getByRole('dialog', { name: 'Unsaved changes' })).getByRole('button', { name: 'Keep editing' }))
+		expect((await title()).textContent).toBe('New item')
+		await user.click(avatar())
+		await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Discard' }))
+		expect((await title()).textContent).toBe('Accounts')
+		expect(screen.queryByLabelText('Name')).toBeNull()
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		expect((await title()).textContent).toBe('Vault')
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/Shell.tsx b/browser-extension/entrypoints/popup/views/Shell.tsx
index e9d30312c..5be9af3f2 100644
--- a/browser-extension/entrypoints/popup/views/Shell.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.tsx
@@ -1,6 +1,9 @@
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { i18n } from '#i18n'
-import type { AccountSummary, PopupTab } from '@/src/messages'
+import type { AccountSummary, ItemMeta, PopupTab } from '@/src/messages'
+import { folderPath } from '@/src/vault/list'
+import { webUrl } from '@/src/vault/url'
+import { ConfirmDialog } from '../components/ConfirmDialog'
 import { ErrorBanner } from '../components/ErrorBanner'
 import { Header } from '../components/Header'
 import { Loading } from '../components/Loading'
@@ -10,11 +13,13 @@ import { errorText } from '../errors'
 import { isPopout, useCurrentTab } from '../hooks/useCurrentTab'
 import { request } from '../hooks/useMessage'
 import { useVaultSnapshot } from '../hooks/useVaultSnapshot'
-import { ShellContext } from '../shell-context'
+import { ShellContext, type ItemActions } from '../shell-context'
+import { DeleteItemDialog, MoveItemDialog } from './ItemDialogs'
 import { ItemDetail } from './ItemDetail'
+import { ItemForm, type FormMode } from './ItemForm'
 import { Placeholder } from './Placeholder'
 import { Settings } from './settings/Settings'
-import { sectionLabel, type SettingsSection } from './settings/SettingsIndex'
+import { SECTION_PARENT, sectionLabel, type SettingsSection } from './settings/SettingsIndex'
 import { VaultList } from './VaultList'
 
 const TOAST_MS = 2500
@@ -28,19 +33,30 @@ interface Props {
 	refreshState: () => void
 }
 
-/** The unlocked popup: tabs, and pages such as an item's detail or a settings section opened over them. */
+type FormPage = { mode: FormMode; id?: string }
+
+type ShellDialog =
+	| { kind: 'delete'; item: ItemMeta }
+	| { kind: 'move'; item: ItemMeta }
+	| { kind: 'discard'; then: () => void }
+
+/** The unlocked popup: tabs, and pages such as an item's detail, its form or a settings section opened over them. */
 export function Shell({ active, lastTab, hidden = false, onAccounts, refreshState }: Props) {
 	const tab = useCurrentTab()
 	// Read once: a later state refresh must not pull the user off the tab they picked.
 	const [current, setCurrent] = useState(lastTab)
 	const [detailId, setDetailId] = useState<string | null>(null)
+	const [form, setForm] = useState<FormPage | null>(null)
 	const [section, setSection] = useState<SettingsSection | null>(null)
+	const [dialog, setDialog] = useState<ShellDialog | null>(null)
 	// A fresh object per call, so the same message twice restarts the timer.
 	const [toast, setToast] = useState<{ text: string } | null>(null)
 	const [footer, setFooter] = useState<HTMLElement | null>(null)
 	const body = useRef<HTMLDivElement>(null)
 	const listScroll = useRef(0)
-	const { reply, failed, syncNow } = useVaultSnapshot(tab?.url, tab !== undefined)
+	const onList = useRef(true)
+	const leaveGuard = useRef<(() => boolean) | null>(null)
+	const { reply, failed, syncNow, reload } = useVaultSnapshot(tab?.url, tab !== undefined)
 
 	useEffect(() => {
 		if (reply && reply.state !== 'unlocked') refreshState()
@@ -54,36 +70,99 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 
 	// Back restores where the list was scrolled.
 	useLayoutEffect(() => {
-		if (body.current) body.current.scrollTop = detailId === null ? listScroll.current : 0
-	}, [detailId])
+		onList.current = detailId === null && form === null
+		if (body.current) body.current.scrollTop = onList.current ? listScroll.current : 0
+	}, [detailId, form])
+
+	/** Opening a page from the list remembers its scroll position. */
+	const leaveList = useCallback(() => {
+		if (onList.current) listScroll.current = body.current?.scrollTop ?? 0
+	}, [])
+
+	const items = useMemo<ItemActions>(() => ({
+		add: () => {
+			leaveList()
+			setForm({ mode: 'add' })
+		},
+		edit: (id) => {
+			leaveList()
+			setForm({ mode: 'edit', id })
+		},
+		clone: (id) => {
+			leaveList()
+			setForm({ mode: 'clone', id })
+		},
+		move: (item) => setDialog({ kind: 'move', item }),
+		remove: (item) => setDialog({ kind: 'delete', item }),
+	}), [leaveList])
+
+	const snapshot = reply?.state === 'unlocked' ? reply : undefined
 
 	const context = useMemo(() => ({
+		accountId: active.id,
 		refreshState,
 		toast: (text: string) => setToast({ text }),
 		launch: (url: string) => void browser.tabs.create({ url, windowId: tab?.windowId }).catch(() => setToast({ text: i18n.t('vault.openFailed') })),
 		footer,
-	}), [refreshState, tab?.windowId, footer])
+		offline: snapshot?.sync.offline ?? false,
+		syncNow: () => void syncNow(),
+		items,
+		setLeaveGuard: (guard: (() => boolean) | null) => {
+			leaveGuard.current = guard
+		},
+	}), [active.id, refreshState, tab?.windowId, footer, snapshot?.sync.offline, syncNow, items])
+
+	/** Runs `then` now, or after the user agreed to drop a dirty form. */
+	function leave(then: () => void) {
+		if (leaveGuard.current?.()) setDialog({ kind: 'discard', then })
+		else then()
+	}
 
 	const open = useCallback((id: string) => {
-		listScroll.current = body.current?.scrollTop ?? 0
+		leaveList()
 		setDetailId(id)
-	}, [])
+	}, [leaveList])
 
 	function select(next: PopupTab) {
 		setCurrent(next)
 		setDetailId(null)
+		setForm(null)
 		setSection(null)
 		void request({ kind: 'popup.lastTab.set', tab: next })
 	}
 
+	/** A switch would drop the form unasked, and under the switcher its decrypted values would wait in the hidden page. */
+	function accounts() {
+		leave(() => {
+			setForm(null)
+			onAccounts()
+		})
+	}
+
 	async function popout() {
 		// `null` is the background's success reply; with no window opened, stay open.
 		if (await request({ kind: 'popup.popout', tabId: tab?.id }) === null) window.close()
 		else setToast({ text: i18n.t('vault.popoutFailed') })
 	}
 
-	const snapshot = reply?.state === 'unlocked' ? reply : undefined
+	/** The write's reply came after its sync, so one re-read shows the result. */
+	async function saved(id: string) {
+		await reload()
+		setDetailId(form?.mode === 'edit' ? detailId : id)
+		setForm(null)
+		setToast({ text: i18n.t('item.saved') })
+	}
+
+	const closeForm = useCallback(() => setForm(null), [])
+	const gone = useCallback(() => {
+		setForm(null)
+		setDetailId(null)
+	}, [])
+
 	const detail = snapshot && detailId !== null ? snapshot.items?.find((item) => item.id === detailId) : undefined
+	// Origin and path only: a query or fragment can hold a token, and the URL is stored unencrypted.
+	const tabPage = tab?.host ? webUrl(tab.url) : null
+	const tabUrl = tabPage ? `${tabPage.origin}${tabPage.pathname}` : undefined
 
 	let content: ReactNode
 	if (current === 'vault') {
@@ -93,25 +172,32 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 				? (
 					<>
 						{/* Hidden rather than unmounted, so back keeps search, filters and decrypted subtitles. */}
-						<div hidden={detail !== undefined}>
+						<div hidden={detail !== undefined || form !== null}>
 							<VaultList snapshot={snapshot} tab={tab} syncNow={() => void syncNow()} onOpen={open} />
 						</div>
+						{form && <ItemForm key={`${form.mode}:${form.id ?? ''}`} mode={form.mode} id={form.id} snapshot={snapshot} tabUrl={tabUrl} onSaved={saved} onCancel={() => leave(closeForm)} onGone={gone} />}
 						{/* Unmounted under a panel, so no decrypted value waits in the hidden DOM; it decrypts again on return. */}
-						{detail && !hidden && <ItemDetail key={detail.id} item={detail} type={snapshot.types.find((t) => t.id === detail.typeId)} folders={snapshot.folders} webAppUrl={snapshot.webAppUrl} />}
+						{detail && !form && !hidden && <ItemDetail key={detail.id} item={detail} type={snapshot.types.find((t) => t.id === detail.typeId)} folders={snapshot.folders} webAppUrl={snapshot.webAppUrl} />}
 					</>
 				)
 				: <Loading />
 	} else if (current === 'settings') {
-		content = <Settings section={section} onOpen={setSection} />
+		content = <Settings section={section} onOpen={setSection} snapshot={snapshot} />
 	} else {
 		content = <Placeholder icon={TABS.find((t) => t.id === current)!.icon} title={tabLabel(current)} />
 	}
 
 	const inSection = current === 'settings' && section !== null
-	const title = detail ? i18n.t('titles.viewItem') : inSection ? sectionLabel(section) : tabLabel(current)
-	const back = detail ? () => setDetailId(null) : inSection ? () => setSection(null) : undefined
+	let title = tabLabel(current)
+	if (form) title = form.mode === 'edit' ? i18n.t('titles.editItem') : i18n.t('titles.newItem')
+	else if (detail) title = i18n.t('titles.viewItem')
+	else if (inSection) title = sectionLabel(section)
+	let back: (() => void) | undefined
+	if (form) back = () => leave(closeForm)
+	else if (detail) back = () => setDetailId(null)
+	else if (inSection) back = () => setSection(SECTION_PARENT[section] ?? null)
 	// A page opened from a tab covers the tab bar, as in Bitwarden, and gets the bar for its own actions.
-	const page = back !== undefined
+	const page = form !== null || detail !== undefined || inSection
 
 	return (
 		<ShellContext.Provider value={context}>
@@ -119,15 +205,60 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 				<Header
 					title={title}
 					active={active}
-					onAvatarClick={onAccounts}
+					onAvatarClick={accounts}
 					onBack={back}
-					onPopout={isPopout ? undefined : () => void popout()}
+					onAdd={current === 'vault' && !page && snapshot?.items ? items.add : undefined}
+					onPopout={isPopout ? undefined : () => leave(() => void popout())}
 				/>
 				<div className="popup__body" ref={body}>{content}</div>
 				<div className="popup__bottom">
 					<Toast message={toast?.text ?? null} />
 					{page ? <div className="popup__footer" ref={setFooter} /> : <TabBar active={current} onSelect={select} />}
 				</div>
+				{dialog?.kind === 'discard' && (
+					<ConfirmDialog
+						title={i18n.t('form.unsavedTitle')}
+						actions={[{
+							label: i18n.t('form.discard'),
+							variant: 'danger',
+							onClick: () => {
+								leaveGuard.current = null
+								setDialog(null)
+								dialog.then()
+							},
+						}]}
+						cancelLabel={i18n.t('form.keepEditing')}
+						onCancel={() => setDialog(null)}
+					>
+						<p>{i18n.t('form.unsaved')}</p>
+					</ConfirmDialog>
+				)}
+				{dialog?.kind === 'delete' && (
+					<DeleteItemDialog
+						item={dialog.item}
+						onDeleted={async () => {
+							await reload()
+							setDialog(null)
+							setDetailId(null)
+							setToast({ text: i18n.t('item.deleted') })
+						}}
+						onCancel={() => setDialog(null)}
+					/>
+				)}
+				{dialog?.kind === 'move' && snapshot && (
+					<MoveItemDialog
+						item={dialog.item}
+						folders={snapshot.folders}
+						onMoved={async (folderId) => {
+							// The re-read, not this render's snapshot: the folder may have been made in the picker.
+							const next = await reload()
+							const folders = next?.state === 'unlocked' ? next.folders : snapshot.folders
+							setDialog(null)
+							setToast({ text: i18n.t('item.moved', { folder: folderPath(folders, folderId) ?? i18n.t('filters.noFolder') }) })
+						}}
+						onCancel={() => setDialog(null)}
+					/>
+				)}
 			</main>
 		</ShellContext.Provider>
 	)
diff --git a/browser-extension/entrypoints/popup/views/VaultList.test.tsx b/browser-extension/entrypoints/popup/views/VaultList.test.tsx
index 1e1b8cfe3..3e0b895a5 100644
--- a/browser-extension/entrypoints/popup/views/VaultList.test.tsx
+++ b/browser-extension/entrypoints/popup/views/VaultList.test.tsx
@@ -4,7 +4,7 @@ import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DecryptedItem } from '@/src/messages'
 import type { CurrentTab } from '../hooks/useCurrentTab'
-import { ShellContext } from '../shell-context'
+import { DEFAULT_SHELL, ShellContext } from '../shell-context'
 import { everythingVisible, fakeBackground, fakeClipboard, itemMeta, sentKinds, snapshotReply, types, type UnlockedSnapshot } from '../testing'
 import { VaultList } from './VaultList'
 
@@ -19,12 +19,13 @@ function renderList(snapshot: UnlockedSnapshot, options: { tab?: CurrentTab; dec
 	const launch = vi.fn()
 	const onOpen = vi.fn()
 	const syncNow = vi.fn()
+	const items = { add: vi.fn(), edit: vi.fn(), clone: vi.fn(), move: vi.fn(), remove: vi.fn() }
 	render(
-		<ShellContext.Provider value={{ refreshState: vi.fn(), toast, launch, footer: null }}>
+		<ShellContext.Provider value={{ ...DEFAULT_SHELL, toast, launch, items }}>
 			<VaultList snapshot={snapshot} tab={options.tab ?? { id: 1, windowId: 1, url: undefined, host: null }} syncNow={syncNow} onOpen={onOpen} />
 		</ShellContext.Provider>,
 	)
-	return { sent, toast, launch, onOpen, syncNow }
+	return { sent, toast, launch, onOpen, syncNow, items }
 }
 
 /** Names of the item cards in the main list, in order. */
@@ -207,19 +208,28 @@ describe('item cards', () => {
 		expect(sentKinds(sent)).not.toContain('clipboard.copied')
 	})
 
-	it('offers View and the edit actions disabled until a later update', async () => {
-		const { onOpen } = renderList(snapshotReply())
+	it('offers View and the edit actions', async () => {
+		const { onOpen, items } = renderList(snapshotReply())
 		const user = userEvent.setup()
-		await user.click(screen.getByRole('button', { name: 'More, GitHub' }))
-		for (const label of ['Edit', 'Clone', 'Move to folder', 'Delete']) {
-			const entry = screen.getByRole('menuitem', { name: label })
-			expect(entry.getAttribute('aria-disabled')).toBe('true')
-			expect(entry.getAttribute('title')).toBe('Available in a later update')
-		}
+		const more = () => user.click(screen.getByRole('button', { name: 'More, GitHub' }))
+		await more()
+		for (const label of ['Edit', 'Clone', 'Move to folder', 'Delete']) expect(screen.getByRole('menuitem', { name: label }).getAttribute('aria-disabled')).toBeNull()
+		await user.click(screen.getByRole('menuitem', { name: 'Edit' }))
+		expect(items.edit).toHaveBeenCalledWith('i1')
+		await more()
+		await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
+		expect(items.remove).toHaveBeenCalledWith(expect.objectContaining({ id: 'i1' }))
+		await more()
 		await user.click(screen.getByRole('menuitem', { name: 'View' }))
 		expect(onOpen).toHaveBeenCalledWith('i1')
 	})
 
+	it('does not edit or clone a blocked item', async () => {
+		renderList(snapshotReply({ items: [itemMeta({ blocked: true, hasLogin: false })] }))
+		await userEvent.setup().click(screen.getByRole('button', { name: 'More, GitHub' }))
+		for (const label of ['Edit', 'Clone']) expect(screen.getByRole('menuitem', { name: label }).title).toBe('This item is blocked.')
+	})
+
 	it('closes a menu on Escape and returns focus to its button', async () => {
 		renderList(snapshotReply())
 		const user = userEvent.setup()
diff --git a/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx b/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
new file mode 100644
index 000000000..a2412df13
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
@@ -0,0 +1,224 @@
+import { useEffect, useRef, useState } from 'react'
+import { i18n } from '#i18n'
+import type { FolderChildren, FolderDeletePlan, FolderMeta, SubfolderAction, VaultSnapshotReply, VaultWriteError, WriteResult } from '@/src/messages'
+import { Button } from '../../components/Button'
+import { ConfirmDialog } from '../../components/ConfirmDialog'
+import { EmptyState } from '../../components/EmptyState'
+import { Banner } from '../../components/ErrorBanner'
+import { FolderNameDialog } from '../../components/FolderNameDialog'
+import { FolderTree } from '../../components/FolderTree'
+import { Icon } from '../../components/Icon'
+import { Loading } from '../../components/Loading'
+import { Menu } from '../../components/Menu'
+import { Select } from '../../components/Select'
+import { writeErrorText } from '../../errors'
+import { request } from '../../hooks/useMessage'
+import { useShell } from '../../shell-context'
+
+type Unlocked = Extract<VaultSnapshotReply, { state: 'unlocked' }>
+
+type Dialog =
+	| { kind: 'create'; parentId: string | null }
+	| { kind: 'rename'; folder: FolderMeta }
+	| { kind: 'delete'; folder: FolderMeta }
+
+/** Settings → Vault → Folders, as in Bitwarden, over a real tree since Keepiq refuses `/` in names. */
+export function FolderManager({ snapshot }: { snapshot: Unlocked }) {
+	const { accountId, offline, toast } = useShell()
+	const [dialog, setDialog] = useState<Dialog | null>(null)
+	const [noticeShown, setNoticeShown] = useState(!snapshot.folderNoticeDismissed)
+	const { folders } = snapshot
+
+	function dismiss() {
+		setNoticeShown(false)
+		void request({ kind: 'folder.dismissNotice', accountId })
+	}
+
+	function done(message: string) {
+		setDialog(null)
+		toast(message)
+	}
+
+	return (
+		<div className="stack">
+			{noticeShown && (
+				<Banner tone="warning" role="status" action={<Button variant="link" onClick={dismiss}>{i18n.t('folders.dismiss')}</Button>}>
+					{i18n.t('folders.notice')}
+				</Banner>
+			)}
+			{offline && <Banner tone="warning" role="status">{i18n.t('form.offline')}</Banner>}
+			<div>
+				<Button variant="secondary" disabled={offline} onClick={() => setDialog({ kind: 'create', parentId: null })}><Icon name="plus" />{i18n.t('folders.add')}</Button>
+			</div>
+			{folders.length === 0
+				? <EmptyState icon="folder" title={i18n.t('folders.empty')} />
+				: (
+					<div className="card card--menus">
+						<FolderTree
+							folders={folders}
+							row={(flat) => {
+								const folder = folders.find((f) => f.id === flat.id)!
+								return (
+									<div className="folder-row">
+										<Icon name="folder" />
+										<span className="folder-row__name">{folder.name}</span>
+										<Menu
+											label={i18n.t('folders.more', { name: folder.name })}
+											icon="more"
+											disabled={offline}
+											items={[
+												{ label: i18n.t('folders.add'), onSelect: () => setDialog({ kind: 'create', parentId: folder.id }) },
+												{ label: i18n.t('folders.rename'), onSelect: () => setDialog({ kind: 'rename', folder }) },
+												{ label: i18n.t('folders.delete'), onSelect: () => setDialog({ kind: 'delete', folder }) },
+											]}
+										/>
+									</div>
+								)
+							}}
+						/>
+					</div>
+				)}
+			{(dialog?.kind === 'create' || dialog?.kind === 'rename') && (
+				<FolderNameDialog
+					target={dialog.kind === 'create' ? { create: { parentId: dialog.parentId } } : { rename: { id: dialog.folder.id, name: dialog.folder.name } }}
+					onDone={() => done(i18n.t('folders.saved'))}
+					onCancel={() => setDialog(null)}
+				/>
+			)}
+			{dialog?.kind === 'delete' && <DeleteFolderDialog folder={dialog.folder} snapshot={snapshot} onDeleted={() => done(i18n.t('folders.deleted'))} onCancel={() => setDialog(null)} />}
+		</div>
+	)
+}
+
+type Stage =
+	| { stage: 'loading' }
+	| { stage: 'plain' }
+	| { stage: 'cascade'; count: number }
+	| { stage: 'resolution'; children: FolderChildren; directSecrets: 'delete' | 'move'; subfolders: Record<string, SubfolderAction> }
+
+/** Which of Keepiq's three delete modes applies, from the server's children. */
+function stageFor(children: FolderChildren): Stage {
+	if (children.subfolders.length > 0) {
+		// Keep and Move to parent lose nothing, so they are the defaults.
+		return { stage: 'resolution', children, directSecrets: 'move', subfolders: Object.fromEntries(children.subfolders.map((sub) => [sub.id, 'keep'])) }
+	}
+	return children.directSecretCount > 0 ? { stage: 'cascade', count: children.directSecretCount } : { stage: 'plain' }
+}
+
+/**
+ * The counts come from the server, never the cache: the cache holds only live items, but "Delete
+ * items too" also destroys archived and trashed ones and anything added since the last sync.
+ */
+function DeleteFolderDialog({ folder, snapshot, onDeleted, onCancel }: { folder: FolderMeta; snapshot: Unlocked; onDeleted: () => void; onCancel: () => void }) {
+	const { accountId, refreshState, syncNow } = useShell()
+	const [state, setState] = useState<Stage>({ stage: 'loading' })
+	const [busy, setBusy] = useState(false)
+	/** `retry`: re-read the children, or send the same plan again; `null` when neither helps. */
+	const [failure, setFailure] = useState<{ text: string; retry: 'children' | 'delete' | null } | null>(null)
+	const lastPlan = useRef<FolderDeletePlan>({ mode: 'plain' })
+	const parent = snapshot.folders.find((f) => f.id === folder.parentId)?.name ?? i18n.t('filters.noFolder')
+
+	function fail(error: VaultWriteError | undefined, retry: 'children' | 'delete') {
+		if (error?.code === 'locked' || error?.code === 'session_revoked') refreshState()
+		const transient = !error || error.code === 'offline' || error.code === 'server_error' || error.code === 'write_locked'
+		setFailure({ text: writeErrorText(error, 'folderDelete'), retry: retry === 'children' || transient ? retry : null })
+	}
+
+	function showChildren(reply: WriteResult<FolderChildren> | undefined) {
+		if (reply?.ok) return setState(stageFor(reply.value))
+		fail(reply?.error, 'children')
+	}
+
+	async function loadChildren() {
+		setFailure(null)
+		showChildren(await request({ kind: 'folder.children', accountId, id: folder.id }))
+	}
+
+	useEffect(() => {
+		void request({ kind: 'folder.children', accountId, id: folder.id }).then(showChildren)
+		// Once, for the folder the dialog opened on.
+		// eslint-disable-next-line react-hooks/exhaustive-deps
+	}, [])
+
+	async function remove(plan: FolderDeletePlan) {
+		lastPlan.current = plan
+		setBusy(true)
+		setFailure(null)
+		const reply = await request({ kind: 'folder.delete', accountId, id: folder.id, plan })
+		setBusy(false)
+		if (reply?.ok) return onDeleted()
+		if (reply?.error.code === 'conflict' && plan.mode === 'resolution') {
+			// A kept subfolder's name is taken one level up. The server checks that only after it moved or
+			// purged the direct items, so the vault may already have changed: sync, and say so.
+			syncNow()
+			return setFailure({ text: i18n.t('writeErrors.keepClashAfter'), retry: 'children' })
+		}
+		// An item or a subfolder landed since the children were read: read them again and offer the matching choice.
+		if (reply?.error.code === 'conflict') return loadChildren()
+		// A 400 on a plan means a subfolder appeared since the children were read.
+		fail(reply?.error, reply?.error.code === 'invalid' ? 'children' : 'delete')
+	}
+
+	const onRetry = failure?.retry ? () => void (failure.retry === 'children' ? loadChildren() : remove(lastPlan.current)) : undefined
+	const common = { title: i18n.t('folders.deleteTitle'), onCancel, error: failure?.text, onRetry }
+
+	if (state.stage === 'loading') return <ConfirmDialog {...common} actions={[]}>{!failure && <Loading />}</ConfirmDialog>
+	if (state.stage === 'plain') {
+		return (
+			<ConfirmDialog {...common} actions={[{ label: i18n.t('folders.delete'), variant: 'danger', busy, onClick: () => void remove({ mode: 'plain' }) }]}>
+				<p>{i18n.t('folders.deleteConfirm', { name: folder.name })}</p>
+			</ConfirmDialog>
+		)
+	}
+	if (state.stage === 'cascade') {
+		return (
+			<ConfirmDialog
+				{...common}
+				actions={[
+					{ label: i18n.t('folders.deleteItems'), variant: 'danger', disabled: busy, onClick: () => void remove({ mode: 'cascade', cascade: 'delete' }) },
+					{ label: i18n.t('folders.moveItems'), disabled: busy, onClick: () => void remove({ mode: 'cascade', cascade: 'move' }) },
+				]}
+			>
+				<p>{i18n.t('folders.cascade', state.count, { name: folder.name, parent })}</p>
+				<p>{i18n.t('folders.countsAll')}</p>
+			</ConfirmDialog>
+		)
+	}
+	const { children, directSecrets, subfolders } = state
+	// Caught here because the server finds it only after moving or purging the direct items.
+	const taken = new Set(snapshot.folders.filter((f) => f.parentId === folder.parentId && f.id !== folder.id).map((f) => f.name.toLowerCase()))
+	const clashes = new Set(children.subfolders.filter((sub) => (subfolders[sub.id] ?? 'keep') === 'keep' && taken.has(sub.name.toLowerCase())).map((sub) => sub.id))
+	return (
+		<ConfirmDialog
+			{...common}
+			actions={[{ label: i18n.t('folders.delete'), variant: 'danger', busy, disabled: clashes.size > 0, onClick: () => void remove({ mode: 'resolution', directSecrets, subfolders }) }]}
+		>
+			<div className="resolution">
+				<p>{i18n.t('folders.countsAll')}</p>
+				{children.directSecretCount > 0 && (
+					<Select<'delete' | 'move'>
+						label={i18n.t('folders.directRow', { name: folder.name, items: i18n.t('folders.items', children.directSecretCount) })}
+						value={directSecrets}
+						options={[{ value: 'move', label: i18n.t('folders.directMove') }, { value: 'delete', label: i18n.t('folders.actionDelete') }]}
+						onChange={(value) => setState({ ...state, directSecrets: value })}
+					/>
+				)}
+				{children.subfolders.map((sub) => (
+					<div key={sub.id}>
+						<Select<SubfolderAction>
+							label={i18n.t('folders.subfolderRow', { name: sub.name, items: i18n.t('folders.items', sub.secretCount), subfolders: i18n.t('folders.subfolders', sub.subfolderCount) })}
+							value={subfolders[sub.id] ?? 'keep'}
+							options={[
+								{ value: 'keep', label: i18n.t('folders.actionKeep') },
+								{ value: 'move', label: i18n.t('folders.actionMove') },
+								{ value: 'delete', label: i18n.t('folders.actionDelete') },
+							]}
+							onChange={(value) => setState({ ...state, subfolders: { ...subfolders, [sub.id]: value } })}
+						/>
+						{clashes.has(sub.id) && <p className="field__error">{i18n.t('writeErrors.keepClash', { name: sub.name })}</p>}
+					</div>
+				))}
+			</div>
+		</ConfirmDialog>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
index 6b0bb017c..26bd004bf 100644
--- a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
@@ -3,7 +3,8 @@ import { cleanup, render, screen, waitFor, within } from '@testing-library/react
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import App from '../../App'
-import { everythingVisible, fakeBackground, popupState } from '../../testing'
+import type { FolderMeta } from '@/src/messages'
+import { everythingVisible, fakeBackground, itemMeta, popupState, sentOf, snapshotReply } from '../../testing'
 import { applyTheme, THEME_MIRROR_KEY } from '../../theme'
 
 afterEach(() => {
@@ -25,13 +26,13 @@ async function openSettings() {
 }
 
 describe('Settings', () => {
-	it('lists the sections in order, with only Appearance open', async () => {
+	it('lists the sections in order, with Vault and Appearance open', async () => {
 		fakeBackground()
 		const user = await openSettings()
 		const rows = within(screen.getByRole('list')).getAllByRole('button')
 		expect(rows.map((row) => row.textContent)).toEqual(['Account security', 'Autofill', 'Notifications', 'Vault', 'Appearance', 'About'])
 		const unbuilt = rows.filter((row) => row.getAttribute('aria-disabled') === 'true')
-		expect(unbuilt.map((row) => row.textContent)).toEqual(['Account security', 'Autofill', 'Notifications', 'Vault', 'About'])
+		expect(unbuilt.map((row) => row.textContent)).toEqual(['Account security', 'Autofill', 'Notifications', 'About'])
 		expect(unbuilt.every((row) => row.title === 'Available in a later update')).toBe(true)
 		await user.click(rows[0]!)
 		expect((await title()).textContent).toBe('Settings')
@@ -99,3 +100,189 @@ describe('the stored theme', () => {
 		expect(theme()).toBe('light')
 	})
 })
+
+describe('Folders', () => {
+	const work: FolderMeta = { id: 'w', name: 'Work', parentId: null }
+	const clients: FolderMeta = { id: 'c', name: 'Clients', parentId: 'w' }
+	const old: FolderMeta = { id: 'o', name: 'Old', parentId: null }
+
+	async function openFolders(options: Parameters<typeof fakeBackground>[0] = {}) {
+		const sent = fakeBackground(options)
+		const user = await openSettings()
+		await user.click(within(screen.getByRole('list')).getByRole('button', { name: 'Vault' }))
+		expect((await title()).textContent).toBe('Vault')
+		await user.click(screen.getByRole('button', { name: 'Folders' }))
+		expect((await title()).textContent).toBe('Folders')
+		return { sent, user }
+	}
+
+	const row = (name: string) => screen.getByText(name, { selector: '.folder-row__name' }).closest('li')!
+	async function choose(user: ReturnType<typeof userEvent.setup>, folder: string, action: string) {
+		await user.click(screen.getByRole('button', { name: `More, ${folder}` }))
+		await user.click(screen.getByRole('menuitem', { name: action }))
+	}
+	const dialog = () => screen.getByRole('dialog')
+
+	it('renders the tree indented and goes back to Vault', async () => {
+		const { user } = await openFolders({ snapshot: snapshotReply({ folders: [clients, work] }) })
+		expect(row('Clients').style.getPropertyValue('--depth')).toBe('1')
+		expect(row('Work').style.getPropertyValue('--depth')).toBe('0')
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		expect((await title()).textContent).toBe('Vault')
+	})
+
+	it('says when there are no folders, and dismisses the plaintext notice', async () => {
+		const { sent, user } = await openFolders()
+		expect(screen.getByText('No folders yet')).toBeTruthy()
+		expect(screen.getByRole('button', { name: 'Add folder' })).toBeTruthy()
+		await user.click(screen.getByRole('button', { name: 'Dismiss' }))
+		expect(screen.queryByText('Folder names are not encrypted')).toBeNull()
+		expect(sentOf(sent, 'folder.dismissNotice')).toHaveLength(1)
+	})
+
+	it('hides a dismissed notice', async () => {
+		await openFolders({ snapshot: snapshotReply({ folderNoticeDismissed: true }) })
+		expect(screen.queryByText('Folder names are not encrypted')).toBeNull()
+	})
+
+	it('creates a subfolder under its row', async () => {
+		const { sent, user } = await openFolders({ snapshot: snapshotReply({ folders: [work] }) })
+		await choose(user, 'Work', 'Add folder')
+		await user.type(screen.getByLabelText('Folder name'), 'Clients')
+		await user.click(within(dialog()).getByRole('button', { name: 'Save' }))
+		await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+		expect(sentOf(sent, 'folder.create')).toEqual([{ kind: 'folder.create', accountId: 'a1', name: 'Clients', parentId: 'w' }])
+	})
+
+	it('keeps the typed name when a sibling has it', async () => {
+		const { user } = await openFolders({ snapshot: snapshotReply({ folders: [work] }), replies: { 'folder.create': { ok: false, error: { code: 'conflict' } } } })
+		await user.click(screen.getByRole('button', { name: 'Add folder' }))
+		await user.type(screen.getByLabelText('Folder name'), 'Work')
+		await user.click(within(dialog()).getByRole('button', { name: 'Save' }))
+		expect(await within(dialog()).findByText('A folder with this name already exists here')).toBeTruthy()
+		expect((screen.getByLabelText('Folder name') as HTMLInputElement).value).toBe('Work')
+	})
+
+	it('renames with the new name only', async () => {
+		const { sent, user } = await openFolders({ snapshot: snapshotReply({ folders: [work] }) })
+		await choose(user, 'Work', 'Rename')
+		const name = screen.getByLabelText('Folder name')
+		await user.clear(name)
+		await user.type(name, 'Office')
+		await user.click(within(dialog()).getByRole('button', { name: 'Save' }))
+		await waitFor(() => expect(sentOf(sent, 'folder.rename')).toEqual([{ kind: 'folder.rename', accountId: 'a1', id: 'w', name: 'Office' }]))
+	})
+
+	it('keeps the rename dialog open on a write lock', async () => {
+		const { user } = await openFolders({ snapshot: snapshotReply({ folders: [work] }), replies: { 'folder.rename': { ok: false, error: { code: 'write_locked' } } } })
+		await choose(user, 'Work', 'Rename')
+		await user.type(screen.getByLabelText('Folder name'), '2')
+		await user.click(within(dialog()).getByRole('button', { name: 'Save' }))
+		expect(await within(dialog()).findByText('Vault is temporarily locked for a key migration, try again later')).toBeTruthy()
+		expect((screen.getByLabelText('Folder name') as HTMLInputElement).value).toBe('Work2')
+	})
+
+	it('deletes an empty folder with a plain delete', async () => {
+		const { sent, user } = await openFolders({ snapshot: snapshotReply({ folders: [old], items: [] }) })
+		await choose(user, 'Old', 'Delete')
+		expect(await within(dialog()).findByText('Delete Old? This cannot be undone.')).toBeTruthy()
+		await user.click(within(dialog()).getByRole('button', { name: 'Delete' }))
+		await waitFor(() => expect(sentOf(sent, 'folder.delete')).toEqual([{ kind: 'folder.delete', accountId: 'a1', id: 'o', plan: { mode: 'plain' } }]))
+	})
+
+	it('counts a leaf folder\'s items on the server, archived and trashed ones included', async () => {
+		// The cache holds 1 live item; the server counts 3.
+		const { sent, user } = await openFolders({
+			snapshot: snapshotReply({ folders: [old], items: [itemMeta({ folderId: 'o' })] }),
+			replies: { 'folder.children': { ok: true, value: { directSecretCount: 3, subfolders: [] } } },
+		})
+		await choose(user, 'Old', 'Delete')
+		expect(await within(dialog()).findByText('Delete Old and its 3 items, or move them to No folder?')).toBeTruthy()
+		expect(dialog().textContent).toContain('Archived and trashed items count too.')
+		expect(sentOf(sent, 'folder.children')).toEqual([{ kind: 'folder.children', accountId: 'a1', id: 'o' }])
+		await user.click(within(dialog()).getByRole('button', { name: 'Move items to parent' }))
+		await waitFor(() => expect(sentOf(sent, 'folder.delete')).toEqual([{ kind: 'folder.delete', accountId: 'a1', id: 'o', plan: { mode: 'cascade', cascade: 'move' } }]))
+	})
+
+	it('re-reads the children when an item landed after they were read', async () => {
+		let reads = 0
+		const { sent, user } = await openFolders({
+			snapshot: snapshotReply({ folders: [old], items: [] }),
+			replies: {
+				'folder.delete': (message: { plan: { mode: string } }) => (message.plan.mode === 'plain' ? { ok: false, error: { code: 'conflict' } } : { ok: true, value: null }),
+				'folder.children': () => ({ ok: true, value: { directSecretCount: reads++, subfolders: [] } }),
+			},
+		})
+		await choose(user, 'Old', 'Delete')
+		await user.click(await within(dialog()).findByRole('button', { name: 'Delete' }))
+		expect(await within(dialog()).findByText('Delete Old and its 1 item, or move it to No folder?')).toBeTruthy()
+		await user.click(within(dialog()).getByRole('button', { name: 'Delete items too' }))
+		await waitFor(() => expect(sentOf(sent, 'folder.delete').at(-1)).toMatchObject({ plan: { mode: 'cascade', cascade: 'delete' } }))
+	})
+
+	it('resolves a folder with subfolders, keeping them by default', async () => {
+		const children = { directSecretCount: 2, subfolders: [{ id: 'c', name: 'Clients', secretCount: 5, subfolderCount: 1 }] }
+		const { sent, user } = await openFolders({ snapshot: snapshotReply({ folders: [work, clients] }), replies: { 'folder.children': { ok: true, value: children } } })
+		await choose(user, 'Work', 'Delete')
+		const direct = await within(dialog()).findByLabelText('Items in Work, 2 items') as HTMLSelectElement
+		expect(direct.value).toBe('move')
+		const sub = within(dialog()).getByLabelText('Clients, 5 items, 1 subfolder') as HTMLSelectElement
+		expect([...sub.options].map((option) => option.textContent)).toEqual(['Keep', 'Move items to parent', 'Delete'])
+		await user.click(within(dialog()).getByRole('button', { name: 'Delete' }))
+		await waitFor(() => expect(sentOf(sent, 'folder.delete')).toEqual([{ kind: 'folder.delete', accountId: 'a1', id: 'w', plan: { mode: 'resolution', directSecrets: 'move', subfolders: { c: 'keep' } } }]))
+	})
+
+	it('refuses to keep a subfolder whose name is taken one level up, before anything is sent', async () => {
+		const children = { directSecretCount: 1, subfolders: [{ id: 'c', name: 'Clients', secretCount: 0, subfolderCount: 0 }] }
+		const rootClients: FolderMeta = { id: 'rc', name: 'clients', parentId: null }
+		const { sent, user } = await openFolders({ snapshot: snapshotReply({ folders: [work, clients, rootClients] }), replies: { 'folder.children': { ok: true, value: children } } })
+		await choose(user, 'Work', 'Delete')
+		expect(await within(dialog()).findByText(/^A folder named Clients already exists one level up/)).toBeTruthy()
+		const remove = within(dialog()).getByRole('button', { name: 'Delete' }) as HTMLButtonElement
+		expect(remove.disabled).toBe(true)
+		await user.selectOptions(within(dialog()).getByLabelText('Clients, 0 items, 0 subfolders'), 'move')
+		expect(remove.disabled).toBe(false)
+		expect(sentOf(sent, 'folder.delete')).toEqual([])
+	})
+
+	it('says so, syncs and stops when the server finds the name clash anyway', async () => {
+		const children = { directSecretCount: 1, subfolders: [{ id: 'c', name: 'Clients', secretCount: 0, subfolderCount: 0 }] }
+		const { sent, user } = await openFolders({
+			snapshot: snapshotReply({ folders: [work, clients] }),
+			replies: { 'folder.children': { ok: true, value: children }, 'folder.delete': { ok: false, error: { code: 'conflict' } } },
+		})
+		await choose(user, 'Work', 'Delete')
+		await user.click(await within(dialog()).findByRole('button', { name: 'Delete' }))
+		expect(await within(dialog()).findByText(/^A folder you chose to keep has the same name/)).toBeTruthy()
+		expect(sentOf(sent, 'folder.delete')).toHaveLength(1)
+		expect(sentOf(sent, 'folder.children')).toHaveLength(1)
+		await waitFor(() => expect(sentOf(sent, 'vault.sync')).toHaveLength(1))
+	})
+
+	it('asks again when a subfolder appeared since the children were read', async () => {
+		let reads = 0
+		const { sent, user } = await openFolders({
+			snapshot: snapshotReply({ folders: [work, clients] }),
+			replies: {
+				'folder.children': () => ({ ok: true, value: { directSecretCount: 0, subfolders: [{ id: 'c', name: 'Clients', secretCount: 0, subfolderCount: ++reads - 1 }] } }),
+				'folder.delete': { ok: false, error: { code: 'invalid' } },
+			},
+		})
+		await choose(user, 'Work', 'Delete')
+		await within(dialog()).findByLabelText('Clients, 0 items, 0 subfolders')
+		await user.click(within(dialog()).getByRole('button', { name: 'Delete' }))
+		expect(await within(dialog()).findByText('This folder changed. Check the choices again.')).toBeTruthy()
+		await user.click(within(dialog()).getByRole('button', { name: 'Try again' }))
+		expect(await within(dialog()).findByLabelText('Clients, 0 items, 1 subfolder')).toBeTruthy()
+		expect(sentOf(sent, 'folder.children')).toHaveLength(2)
+	})
+
+	it('disables every change while offline but still shows the tree', async () => {
+		const sync = { syncing: false, syncedAt: new Date().toISOString(), offline: true, lastError: 'network' as const }
+		await openFolders({ snapshot: snapshotReply({ folders: [work], sync }) })
+		expect(screen.getByText('You are offline. Changes need a connection to Keepiq.')).toBeTruthy()
+		expect((screen.getByRole('button', { name: 'Add folder' }) as HTMLButtonElement).disabled).toBe(true)
+		expect((screen.getByRole('button', { name: 'More, Work' }) as HTMLButtonElement).disabled).toBe(true)
+		expect(row('Work')).toBeTruthy()
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.tsx
index 5995b1d34..a8a2237e0 100644
--- a/browser-extension/entrypoints/popup/views/settings/Settings.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.tsx
@@ -1,7 +1,23 @@
+import type { VaultSnapshotReply } from '@/src/messages'
+import { Loading } from '../../components/Loading'
 import { Appearance } from './Appearance'
+import { FolderManager } from './FolderManager'
 import { SettingsIndex, type SettingsSection } from './SettingsIndex'
+import { Vault } from './Vault'
+
+interface Props {
+	section: SettingsSection | null
+	onOpen: (section: SettingsSection) => void
+	/** The folder manager renders from it; `undefined` while it loads. */
+	snapshot: Extract<VaultSnapshotReply, { state: 'unlocked' }> | undefined
+}
 
 /** The Settings tab: the section list, or the open section. Shell owns which, for its title and back control. */
-export function Settings({ section, onOpen }: { section: SettingsSection | null; onOpen: (section: SettingsSection) => void }) {
-	return section === 'appearance' ? <Appearance /> : <SettingsIndex onOpen={onOpen} />
+export function Settings({ section, onOpen, snapshot }: Props) {
+	switch (section) {
+		case 'appearance': return <Appearance />
+		case 'vault': return <Vault onOpen={onOpen} />
+		case 'folders': return snapshot ? <FolderManager snapshot={snapshot} /> : <Loading />
+		default: return <SettingsIndex onOpen={onOpen} />
+	}
 }
diff --git a/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx b/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
index 67cc4ebba..96d14ff5e 100644
--- a/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/SettingsIndex.tsx
@@ -1,10 +1,13 @@
 import { i18n } from '#i18n'
 import { Icon, type IconName } from '../../components/Icon'
 
-export type SettingsSection = 'accountSecurity' | 'autofill' | 'notifications' | 'vault' | 'appearance' | 'about'
+export type SettingsSection = 'accountSecurity' | 'autofill' | 'notifications' | 'vault' | 'appearance' | 'about' | 'folders'
+
+/** Pages inside a section, which back returns to. */
+export const SECTION_PARENT: Partial<Record<SettingsSection, SettingsSection>> = { folders: 'vault' }
 
 /** Bitwarden's order (ADR-001); ext-settings fills in the rest. */
-const SECTIONS: { id: SettingsSection; icon: IconName }[] = [
+const SECTIONS: { id: Exclude<SettingsSection, 'folders'>; icon: IconName }[] = [
 	{ id: 'accountSecurity', icon: 'shield' },
 	{ id: 'autofill', icon: 'key' },
 	{ id: 'notifications', icon: 'bell' },
@@ -13,7 +16,7 @@ const SECTIONS: { id: SettingsSection; icon: IconName }[] = [
 	{ id: 'about', icon: 'info' },
 ]
 
-const BUILT: ReadonlySet<SettingsSection> = new Set(['appearance'])
+const BUILT: ReadonlySet<SettingsSection> = new Set(['vault', 'appearance'])
 
 export function sectionLabel(section: SettingsSection): string {
 	switch (section) {
@@ -23,6 +26,7 @@ export function sectionLabel(section: SettingsSection): string {
 		case 'vault': return i18n.t('settings.vault')
 		case 'appearance': return i18n.t('settings.appearance')
 		case 'about': return i18n.t('settings.about')
+		case 'folders': return i18n.t('settings.folders')
 	}
 }
 
diff --git a/browser-extension/entrypoints/popup/views/settings/Vault.tsx b/browser-extension/entrypoints/popup/views/settings/Vault.tsx
new file mode 100644
index 000000000..3080aefa2
--- /dev/null
+++ b/browser-extension/entrypoints/popup/views/settings/Vault.tsx
@@ -0,0 +1,18 @@
+import { i18n } from '#i18n'
+import { Icon } from '../../components/Icon'
+import type { SettingsSection } from './SettingsIndex'
+
+/** Bitwarden's Settings → Vault; ext-settings adds Sync now, Import, Export and Default item type. */
+export function Vault({ onOpen }: { onOpen: (section: SettingsSection) => void }) {
+	return (
+		<ul className="card menu">
+			<li>
+				<button type="button" className="menu__item" onClick={() => onOpen('folders')}>
+					<Icon name="folder" />
+					<span className="menu__label">{i18n.t('settings.folders')}</span>
+					<Icon name="chevronRight" />
+				</button>
+			</li>
+		</ul>
+	)
+}
diff --git a/browser-extension/locales/en.yml b/browser-extension/locales/en.yml
index d6eee5563..bafa8ed74 100644
--- a/browser-extension/locales/en.yml
+++ b/browser-extension/locales/en.yml
@@ -44,6 +44,8 @@ titles:
   logInAgain: Log in again
   unlock: Unlock
   viewItem: View item
+  newItem: New item
+  editItem: Edit item
 
 tabs:
   label: Main
@@ -55,6 +57,7 @@ tabs:
 header:
   popout: Pop out
   accounts: Accounts, signed in as {name}
+  new: New
 
 unlock:
   masterPassword: Master password
@@ -135,6 +138,111 @@ item:
   clone: Clone
   move: Move to folder
   delete: Delete
+  cloneName: "{name} - Clone"
+  passkeyNoClone: Passkeys cannot be cloned
+  useOnly: Shared with you for signing in only
+  readOnly: Shared from another organisation, so it can only be moved
+  expiringNoClone: Your access ends {date}, so it cannot be cloned
+  saved: Item saved
+  deleted: Item moved to the trash
+  moved: Moved to {folder}
+  deleteTitle: Delete item
+  deleteConfirm: Move {name} to the trash? It stops being shared. You can restore it from the trash in the Keepiq web app.
+  gone: This item no longer exists
+
+form:
+  itemDetails: Item details
+  type: Type
+  name: Name
+  folder: Folder
+  chooseFolder: Choose a folder, now {folder}
+  website: Website URL
+  autofillOptions: Autofill options
+  additionalOptions: Additional options
+  authenticator: Authenticator
+  note: Note
+  secret: Secret
+  advanced: Advanced
+  algorithm: Algorithm
+  digits: Digits
+  period: Period in seconds
+  addField: Add field
+  fieldName: Field name
+  fieldValue: Value
+  removeField: Remove {name}
+  removeUnnamed: Remove field
+  save: Save
+  passkeyReadOnly: Passkey credentials can only be changed in the Keepiq web app
+  offline: You are offline. Changes need a connection to Keepiq.
+  unsavedTitle: Unsaved changes
+  unsaved: You have unsaved changes. Discard them?
+  discard: Discard
+  keepEditing: Keep editing
+
+fieldErrors:
+  required: Name is required
+  tooLong: At most {max} characters
+  tooLongBytes: Too long (max {max} bytes)
+  reserved: This name is reserved
+  duplicate: A field with this name already exists
+  invalidTotp: Not a valid authenticator secret
+  slash: Folder names cannot contain slashes
+
+writeErrors:
+  writeLocked: Vault is temporarily locked for a key migration, try again later
+  forbidden: Keepiq does not allow this change. The Keepiq web app shows why.
+  policy: Your organisation's policy does not allow this change
+  accountChanged: You switched to another account meanwhile, so nothing was saved. Switch back to save it.
+  keepClash: A folder named {name} already exists one level up. Choose Move items to parent or Delete for it, or rename one of them first.
+  keepClashAfter: A folder you chose to keep has the same name as one a level up, so the folder was not deleted. Its own items may already have been moved or deleted. Check the choices again.
+  invalid: Keepiq refused this change
+  stale: This item was changed elsewhere. Go back and edit it again to see the latest version.
+  itemGone: This item no longer exists
+  folderGone: This folder no longer exists
+  duplicateFolder: A folder with this name already exists here
+  folderChanged: This folder changed. Check the choices again.
+  offline: Could not reach the server
+  serverError: Keepiq is unavailable right now, try again later
+  unreadable: Could not read this item, so it cannot be edited here
+  restricted: This item was shared with you with limits, so it cannot be changed or copied here
+  keyMismatch: Keepiq sent an encryption key that does not match your vault, so nothing was saved. Tell your Keepiq administrator.
+
+folders:
+  add: Add folder
+  newFolder: New folder
+  rename: Rename
+  renameTitle: Rename folder
+  delete: Delete
+  more: More, {name}
+  name: Folder name
+  empty: No folders yet
+  notice: Folder names are not encrypted
+  dismiss: Dismiss
+  current: Current folder
+  pickTitle: Choose folder
+  moveTitle: Move to folder
+  saved: Folder saved
+  deleted: Folder deleted
+  deleteTitle: Delete folder
+  deleteConfirm: Delete {name}? This cannot be undone.
+  cascade:
+    1: Delete {name} and its 1 item, or move it to {parent}?
+    n: Delete {name} and its $1 items, or move them to {parent}?
+  countsAll: Archived and trashed items count too.
+  deleteItems: Delete items too
+  moveItems: Move items to parent
+  items:
+    1: 1 item
+    n: $1 items
+  subfolders:
+    1: 1 subfolder
+    n: $1 subfolders
+  directRow: Items in {name}, {items}
+  subfolderRow: "{name}, {items}, {subfolders}"
+  actionDelete: Delete
+  actionMove: Move items to parent
+  actionKeep: Keep
+  directMove: Move to parent
 
 clipboard:
   copied: "{what} copied"
@@ -205,6 +313,7 @@ settings:
   vault: Vault
   appearance: Appearance
   about: About
+  folders: Folders
   theme: Theme
   themeSystem: System default
   themeLight: Light
diff --git a/browser-extension/locales/nl.yml b/browser-extension/locales/nl.yml
index 815a39b84..d38888851 100644
--- a/browser-extension/locales/nl.yml
+++ b/browser-extension/locales/nl.yml
@@ -43,6 +43,8 @@ titles:
   logInAgain: Opnieuw inloggen
   unlock: Ontgrendelen
   viewItem: Item bekijken
+  newItem: Nieuw item
+  editItem: Item bewerken
 
 tabs:
   label: Hoofdmenu
@@ -54,6 +56,7 @@ tabs:
 header:
   popout: Openen in apart venster
   accounts: Accounts, ingelogd als {name}
+  new: Nieuw
 
 unlock:
   masterPassword: Hoofdwachtwoord
@@ -134,6 +137,111 @@ item:
   clone: Klonen
   move: Naar map verplaatsen
   delete: Verwijderen
+  cloneName: "{name} - Kloon"
+  passkeyNoClone: Passkeys kun je niet klonen
+  useOnly: Alleen met je gedeeld om in te loggen
+  readOnly: Gedeeld vanuit een andere organisatie, dus je kunt het alleen verplaatsen
+  expiringNoClone: Je toegang stopt op {date}, dus je kunt het niet klonen
+  saved: Item opgeslagen
+  deleted: Item naar de prullenbak verplaatst
+  moved: Verplaatst naar {folder}
+  deleteTitle: Item verwijderen
+  deleteConfirm: "{name} naar de prullenbak verplaatsen? Het wordt niet langer gedeeld. Je kunt het terugzetten vanuit de prullenbak in de Keepiq-webapp."
+  gone: Dit item bestaat niet meer
+
+form:
+  itemDetails: Itemgegevens
+  type: Type
+  name: Naam
+  folder: Map
+  chooseFolder: Kies een map, nu {folder}
+  website: Website-URL
+  autofillOptions: Opties voor automatisch invullen
+  additionalOptions: Extra opties
+  authenticator: Authenticator
+  note: Notitie
+  secret: Geheim
+  advanced: Geavanceerd
+  algorithm: Algoritme
+  digits: Cijfers
+  period: Periode in seconden
+  addField: Veld toevoegen
+  fieldName: Veldnaam
+  fieldValue: Waarde
+  removeField: "{name} verwijderen"
+  removeUnnamed: Veld verwijderen
+  save: Opslaan
+  passkeyReadOnly: De gegevens van een passkey kun je alleen in de Keepiq-webapp wijzigen
+  offline: Je bent offline. Voor wijzigingen is een verbinding met Keepiq nodig.
+  unsavedTitle: Niet-opgeslagen wijzigingen
+  unsaved: Je hebt wijzigingen die niet zijn opgeslagen. Wil je ze weggooien?
+  discard: Weggooien
+  keepEditing: Verder bewerken
+
+fieldErrors:
+  required: Naam is verplicht
+  tooLong: Maximaal {max} tekens
+  tooLongBytes: Te lang (maximaal {max} bytes)
+  reserved: Deze naam is gereserveerd
+  duplicate: Er bestaat al een veld met deze naam
+  invalidTotp: Geen geldige authenticatorsleutel
+  slash: Mapnamen mogen geen schuine streep bevatten
+
+writeErrors:
+  writeLocked: De kluis is tijdelijk vergrendeld voor een sleutelmigratie, probeer het later opnieuw
+  forbidden: Keepiq staat deze wijziging niet toe. De Keepiq-webapp laat zien waarom.
+  policy: Het beleid van je organisatie staat deze wijziging niet toe
+  accountChanged: Je bent intussen naar een ander account gewisseld, dus er is niets opgeslagen. Wissel terug om het op te slaan.
+  keepClash: Er bestaat al een map {name} één niveau hoger. Kies daarvoor Items naar bovenliggende map of Verwijderen, of wijzig eerst een van de namen.
+  keepClashAfter: Een map die je wilde behouden heeft dezelfde naam als een map één niveau hoger, dus de map is niet verwijderd. De items erin kunnen al verplaatst of verwijderd zijn. Controleer de keuzes opnieuw.
+  invalid: Keepiq heeft deze wijziging geweigerd
+  stale: Dit item is ergens anders gewijzigd. Ga terug en bewerk het opnieuw om de nieuwste versie te zien.
+  itemGone: Dit item bestaat niet meer
+  folderGone: Deze map bestaat niet meer
+  duplicateFolder: Hier bestaat al een map met deze naam
+  folderChanged: Deze map is gewijzigd. Controleer de keuzes opnieuw.
+  offline: Kan de server niet bereiken
+  serverError: Keepiq is nu niet beschikbaar, probeer het later opnieuw
+  unreadable: Dit item kan niet worden gelezen en dus hier niet worden bewerkt
+  restricted: Dit item is met beperkingen met je gedeeld, dus je kunt het hier niet wijzigen of kopiëren
+  keyMismatch: Keepiq stuurde een versleutelingssleutel die niet bij je kluis past, dus er is niets opgeslagen. Meld dit bij je Keepiq-beheerder.
+
+folders:
+  add: Map toevoegen
+  newFolder: Nieuwe map
+  rename: Naam wijzigen
+  renameTitle: Mapnaam wijzigen
+  delete: Verwijderen
+  more: Meer, {name}
+  name: Mapnaam
+  empty: Nog geen mappen
+  notice: Mapnamen zijn niet versleuteld
+  dismiss: Sluiten
+  current: Huidige map
+  pickTitle: Map kiezen
+  moveTitle: Naar map verplaatsen
+  saved: Map opgeslagen
+  deleted: Map verwijderd
+  deleteTitle: Map verwijderen
+  deleteConfirm: "{name} verwijderen? Dit kan niet ongedaan worden gemaakt."
+  cascade:
+    1: "{name} en het item erin verwijderen, of het item verplaatsen naar {parent}?"
+    n: "{name} en de $1 items erin verwijderen, of de items verplaatsen naar {parent}?"
+  countsAll: Gearchiveerde items en items in de prullenbak tellen ook mee.
+  deleteItems: Items ook verwijderen
+  moveItems: Items naar bovenliggende map
+  items:
+    1: 1 item
+    n: $1 items
+  subfolders:
+    1: 1 submap
+    n: $1 submappen
+  directRow: Items in {name}, {items}
+  subfolderRow: "{name}, {items}, {subfolders}"
+  actionDelete: Verwijderen
+  actionMove: Items naar bovenliggende map
+  actionKeep: Behouden
+  directMove: Naar bovenliggende map
 
 clipboard:
   copied: "{what} gekopieerd"
@@ -204,6 +312,7 @@ settings:
   vault: Kluis
   appearance: Weergave
   about: Over
+  folders: Mappen
   theme: Thema
   themeSystem: Systeemstandaard
   themeLight: Licht
diff --git a/browser-extension/openspec/README.md b/browser-extension/openspec/README.md
index 370474116..3abd181ba 100644
--- a/browser-extension/openspec/README.md
+++ b/browser-extension/openspec/README.md
@@ -22,6 +22,7 @@ Changes build on each other in this order. Each proposal lists its predecessors
 7. `ext-settings`: the rest of the Settings tab
 8. `ext-autofill`: fill from popup, context menu, shortcut, save and update prompts
 9. `ext-toolbar-icon`: logged out, locked and unlocked icon, badge counter of matching logins
+10. `ext-share-sync`: an edit of a shared item reaches every recipient's copy; a proposal so far, from the ext-vault-edit review
 
 Later slices not yet specced: inline autofill menu, passkey provider, TOTP autofill, card and identity fill, password history, import and export. Website icons wait on a Keepiq change that stores a favicon on the secret (ADR-002).
 
diff --git a/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md b/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
index e36477a0e..d692c86d5 100644
--- a/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
+++ b/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
@@ -68,11 +68,13 @@ A cached vault on a machine the user no longer controls cannot be remotely wiped
 - The suite. If a sync returns an active suite whose `id` or `unlockKeyEpoch` differs from the cached one, the cached ciphertext is undecryptable. The extension purges the cache and the key and forces a fresh unlock and full sync.
 - `blocked: true` rows. A revoked suite yields metadata-only rows. The extension shows them as blocked and never fills from them.
 
+A compromised server could also keep the suite id and epoch and swap only the certificate, so new secrets would be encrypted to its own key. The extension can catch this where the web app cannot, because its code does not come from the server: before it encrypts with a certificate, it proves the certificate matches the unlocked private key, which only the master password opens, and refuses every write otherwise. Before each write it also asks for the active suite: the server stamps a write with that suite whatever key it was encrypted to, so a key changed on another device since the last sync locks instead of writing an item no one can open.
+
 The window between revocation and next contact is bounded by the sync interval. Sync runs on unlock, on popup open when the last sync is older than the interval, on a fixed interval while unlocked, and after every local write. The interval is a named constant, not an emergent property.
 
 ## Sync
 
-There is no cursor. An unchanged vault must still cost one cheap call: sync first asks `GET /api/v1/secrets?sort=updated_at&direction=desc&limit=1` and compares the newest `updatedAt` and `total` with the cached snapshot; only when either differs, or the folder and type lists are stale, does it fetch `GET /api/v1/offline/manifest` and replace the local snapshot atomically. Deletions change `total`, edits and creates change `updatedAt`. When the manifest returns 403 (admin disabled) or 404, sync falls back to paginated `GET /api/v1/secrets` plus folders and types. A full fetch is acceptable because rows are small and vaults are hundreds of items, not hundreds of thousands.
+There is no cursor. An unchanged vault must still cost one cheap call: sync first asks `GET /api/v1/secrets?sort=updated_at&direction=desc&limit=1` and compares the newest `updatedAt` and `total` with the cached snapshot; only when either differs, or the folder and type lists are stale, does it fetch `GET /api/v1/offline/manifest` and replace the local snapshot atomically. Deletions change `total`, edits and creates change `updatedAt`. When the manifest is refused (admin disabled, ADR-003) or returns 404, sync falls back to paginated `GET /api/v1/secrets` plus folders and types. A full fetch is acceptable because rows are small and vaults are hundreds of items, not hundreds of thousands.
 
 ## Decryption is lazy
 
diff --git a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
index 7662b7852..ceeffab63 100644
--- a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
+++ b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
@@ -24,9 +24,10 @@ All paths relative to the base URL. All require the Basic auth above unless mark
 | --- | --- | --- |
 | Suites | `GET /api/v1/suites` | Returns a bare JSON array. Pick `status === 'active'`. Row carries `certificate` (X.509 PEM), `privateKey` (AES envelope, base64), `unlockKeyEpoch`. |
 | List secrets | `GET /api/v1/secrets` | Query: `folderId`, `search`, `sort` (`name`, `url`, `created_at`, `updated_at`, `last_used_at`), `direction`, `page` (1-based), `limit` (default 50, max 100), `typeId`. Envelope `{items,total,page,limit}`. When `search` is set the other filters are ignored. Sorts end in `name` with no unique tiebreaker, so tied rows can move between pages (keepiq#1234). |
-| Full snapshot | `GET /api/v1/offline/manifest` | `{suite, secrets, folders, types, syncedAt}`. Unpaginated. 403 when the admin disabled offline caching, 404 when no active suite. `syncedAt` is a server timestamp, not a cursor. Rows never use the blocked shape here. Secrets stop at 1000 by design (keepiq#1233); a full 1000 means page instead. Rows carry no `migrationError` (keepiq#1235). Under the two-factor policy `suite` is `null` and `unlockBlocked` is set. |
-| Secret CRUD | `GET/PUT/DELETE /api/v1/secrets/{id}`, `POST /api/v1/secrets` | Create takes `name` (required), `key` (required ciphertext), `url`, `typeId`, `folderId`, `login`, `additionalFields`; returns 201 with the row. `PUT` is a sparse patch: only fields present in the body change, `null` clears a field. Last write wins. Delete returns `{"status":"deleted"}`. |
-| Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Delete takes `?cascade=delete|move`. |
+| Full snapshot | `GET /api/v1/offline/manifest` | `{suite, secrets, folders, types, syncedAt}`. Unpaginated. Refused (428) when the admin disabled offline caching, 404 when no active suite. `syncedAt` is a server timestamp, not a cursor. Rows never use the blocked shape here. Secrets stop at 1000 by design (keepiq#1233); a full 1000 means page instead. Rows carry no `migrationError` (keepiq#1235). Under the two-factor policy `suite` is `null` and `unlockBlocked` is set. |
+| Secret CRUD | `GET/PUT/DELETE /api/v1/secrets/{id}`, `POST /api/v1/secrets` | Create takes `name` (required), `key` (required ciphertext), `url`, `typeId`, `folderId`, `login`, `additionalFields`; returns 201 with the row. `name` is at most 255 characters. `PUT` is a sparse patch: only fields present in the body change, `null` clears a field. With `baseUpdatedAt` it answers 409 when the stored `updatedAt` differs (whole seconds); without it the last write wins. Since 2026-09-30 `DELETE` moves the secret to the trash (`trashed_at`) and revokes every share of it, returning `{"status":"deleted","trashed":true}`; `POST …/restore` and `DELETE …/purge` restore or purge it, and a daily job purges after the admin's `trash_retention_days` (default 30). Trashed secrets are left out of lists and the manifest. |
+| Refusals | any route | The OCS controllers (secrets, folders, the manifest, suites, types) refuse with 428, not 403: Nextcloud turns a 403 there into an HTTP 200 envelope, so `OcsRefusalMiddleware` re-statuses it. The body keeps `message` and adds `error`, a vault policy's code or else `forbidden`. Plain controllers (`DELETE /api/v1/secrets/{id}`, settings) still answer 403, with a policy's `code` when there is one. A blocked suite, a folder someone else owns and a read-only copy all come without a code, so clients cannot tell those apart. The web app treats both statuses alike (`src/utils/refusal.js`). The middleware's comment cites measurements on Nextcloud 35 from 2026-10-04; the manifest's 428 was checked on the stable35 dev server on 2026-10-12. The key-proof guard (`VaultKeyProofMiddleware`) also answers 428, with `error: key_proof_required`, but on none of the routes the extension calls. |
+| Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Names are trimmed and refuse `/`; a duplicate sibling is 409. Children: `{directSecretCount, subfolders: [{id, name, secretCount, subfolderCount}]}`. Delete: an empty folder needs nothing, a leaf with items `?cascade=delete|move` (409 without), a folder with subfolders a JSON body `{directSecrets: 'delete'|'move', subfolders: {<id>: 'delete'|'move'|'keep'}}` naming every direct subfolder (409 without, 400 when one is missing). Folder deletes are immediate, with no trash, and count and delete archived and trashed items too. They are not transactional: a kept subfolder whose name is taken one level up answers 409 after the direct items were already moved or purged (keepiq#1248). |
 | Types | `GET /api/v1/secret-types` | Types are rows, resolve `typeId` from here. |
 | Sends | `POST/GET /api/v1/sends`, `DELETE /api/v1/sends/{id}` | See payload below. |
 | Public send access | `GET /api/v1/public/sends/{token}`, `POST …/access`, `POST …/confirm`, `POST …/failure` | Public, rate limited 15/min. The extension only needs the create side; the web app renders the recipient page. |
@@ -34,7 +35,7 @@ All paths relative to the base URL. All require the Basic auth above unless mark
 | Policy | `GET /api/settings/policy` | Read-only org password policy. |
 | Server generator | `POST /api/v1/generate-key` | `{length, includeSpecialCharacters, excludedCharacters, regex}` returns `{generatedKey}`. Not used by the extension; generation is client-side (ADR-001, Bitwarden parity, offline). |
 
-Error bodies are `{"message": "<text>"}`. Status codes: 400 invalid input, 401 bad credentials, 403 forbidden or suite blocked, 404 missing, 423 vault write-locked during a key migration (retry later, do not treat as an auth failure).
+Error bodies are `{"message": "<text>"}`. Status codes: 400 invalid input, 401 bad credentials, 403 or 428 refused (see Refusals), 404 missing, 423 vault write-locked during a key migration (retry later, do not treat as an auth failure).
 
 Out of reach for an app-password client: suite rotation, revocation and compromise recovery need a vault-key proof signed with the raw private key, and admin force-revoke needs Nextcloud password confirmation. The extension links to the web app for these.
 
@@ -54,8 +55,9 @@ Routes under `/api/v1/extension/*` belong to the in-tree reference extension in
 
 - `name`, `url`, `typeId`, `folderId` are plaintext. Search and URL matching work without unlocking.
 - `key`, `login`, `additionalFields` are ciphertext. `additionalFields` decrypts to a JSON object of name to value. Names `key`, `login`, `url` are reserved (case-insensitive).
-- When the owner's suite is revoked the same endpoints return a row with `blocked: true`, `blockedReason`, and no `key`, `login` or `additionalFields`. Clients handle both shapes.
-- `useOnly: true` marks a use-only share: the receiver may fill it, but clients never show or copy `key` or `additionalFields`. A missing `useOnly` counts as false.
+- A recipient's copy of a shared secret carries its limits: `useOnly` (fill only: clients never show or copy `key` or `additionalFields`, and the server refuses its edits), `accessExpiresAt` (access ends then; not `expiresAt`), `readOnly` (from another organisation; only `folderId` may change). A missing limit counts as none. The server cannot stop a client from cloning a restricted copy, so clients refuse that themselves (Keepiq `use-only-shares`, `expiring-shares`).
+- Each recipient holds a separate copy encrypted to their own key. An owner's change reaches them only when the editing client re-encrypts it for each and calls `PUT /api/v1/secrets/{id}/sync` (see `ext-share-sync`).
+- When the owner's suite is revoked the list returns a row with `blocked: true`, `blockedReason`, and no `key`, `login` or `additionalFields`; clients handle both shapes. `GET /api/v1/secrets/{id}` refuses such a row instead (`SecretService::get`), without a code.
 - System types: `login`, `api_key`, `ssh_key`, `certificate`, `note`, `database`, `totp`, `passkey`, `card`, `identity`. Users and admins can add more. Composite types (`totp`, `passkey`, `card`, `identity`) store their payload as JSON in `key`.
 - Folders: `{id, name, parentId, ownerType, ownerId, customIcon, customColor, createdAt, updatedAt}`, all plaintext, tree via `parentId`.
 
@@ -109,5 +111,5 @@ POST /api/v1/sends
 ## Server-side settings that affect the client
 
 - Admin `default_session_timeout` is one of `session`, `10min`, `30min` and is only a suggested default. The lock is client-enforced; the server has no session to kill.
-- Admin `offline_cache_enabled` gates the manifest endpoint with a 403. Per-user `offline_cache_optin` exists too. When the manifest is unavailable the client falls back to paginated listing.
+- Admin `offline_cache_enabled` gates the manifest endpoint with a refusal. Per-user `offline_cache_optin` exists too. When the manifest is unavailable the client falls back to paginated listing.
 - Admin `min_password_length` and `min_password_score` apply to master password changes, which the extension does not perform.
diff --git a/browser-extension/openspec/changes/ext-generator/specs/credential-generator/spec.md b/browser-extension/openspec/changes/ext-generator/specs/credential-generator/spec.md
index cc7e8c45f..91c42bcfc 100644
--- a/browser-extension/openspec/changes/ext-generator/specs/credential-generator/spec.md
+++ b/browser-extension/openspec/changes/ext-generator/specs/credential-generator/spec.md
@@ -125,7 +125,12 @@ The output box SHALL show the current value in a monospace font with digits and
 - **THEN** the value is on the clipboard and nothing is scheduled
 
 ### Requirement: Pick mode from the item form
-When the item form opens the generator in pick mode, the generator SHALL show a "Use this password" button in addition to Regenerate and Copy, SHALL keep the same options and history behaviour, and on click SHALL return the current value to the form field that requested it and navigate back to the form. Passphrases and usernames returned this way go to the field that requested them (login field for usernames, password field for the other two). Pick mode is never offered while locked, because there is no item form.
+The item form's Password field SHALL get a generate button that opens the generator in pick mode. When the item form opens the generator in pick mode, the generator SHALL show a "Use this password" button in addition to Regenerate and Copy, SHALL keep the same options and history behaviour, and on click SHALL return the current value to the form field that requested it and navigate back to the form. Passphrases and usernames returned this way go to the field that requested them (login field for usernames, password field for the other two). Pick mode is never offered while locked, because there is no item form.
+
+#### Scenario: Generate a password
+- **GIVEN** the add-item form is open for a `login` item
+- **WHEN** the user presses the generate button next to Password
+- **THEN** the popup MUST open the generator in pick mode
 
 #### Scenario: Use this password
 - **GIVEN** the item form's password field opened the generator in pick mode
diff --git a/browser-extension/openspec/changes/ext-generator/tasks.md b/browser-extension/openspec/changes/ext-generator/tasks.md
index fa051243a..0c4009930 100644
--- a/browser-extension/openspec/changes/ext-generator/tasks.md
+++ b/browser-extension/openspec/changes/ext-generator/tasks.md
@@ -39,7 +39,7 @@
 - [ ] 4.3 Add `entrypoints/popup/views/Generator.tsx` with `SubTabs` and the Password panel: `LengthSlider`, four class `OptionToggle`s, minimum numbers and minimum special inputs, avoid ambiguous toggle, policy clamp rendered as `lockedBy="Set by your organisation"`, generation via `src/generator/password.ts` on mount and on every option change with the value in `useState`.
 - [ ] 4.4 Add the Passphrase panel (number of words, separator, capitalize, include number) and the Username panel (type select, word toggles, email and domain inputs, Random or Website name sub-mode disabled with "No website detected" when `websiteHost` is null) to `Generator.tsx`, including the "Enter an email address" and "Wordlist unavailable" output states.
 - [ ] 4.5 Add `entrypoints/popup/views/GeneratorHistory.tsx` on `useGeneratorHistory`: newest first, `GeneratedValue` styling, relative time, Copy per entry, Clear with confirmation, empty state "No generated values yet"; record history on Regenerate, Copy, "Use this password" and sub-tab blur.
-- [ ] 4.6 Wire pick mode: `Generator` reads `{ pick: { field, onPick } }` from the shell router state, shows "Use this password", calls `onPick(value)` and navigates back; hook the item form's Generate buttons if `ext-vault-edit` has landed, otherwise leave the `pick` contract documented in `design.md`.
+- [ ] 4.6 Wire pick mode: `Generator` reads `{ pick: { field, onPick } }` from the shell router state, shows "Use this password", calls `onPick(value)` and navigates back; add the generate button next to the item form's Password, which `ext-vault-edit` leaves out.
 - [ ] 4.7 Register the Generator tab in `entrypoints/popup/App.tsx` and add the "Generate a password" link on the lock screen that renders `Generator` with the tab bar hidden and no `pick` state.
 
 ## 5. Verification
diff --git a/browser-extension/openspec/changes/ext-share-sync/proposal.md b/browser-extension/openspec/changes/ext-share-sync/proposal.md
new file mode 100644
index 000000000..fb5ce9be9
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/proposal.md
@@ -0,0 +1,63 @@
+---
+kind: code
+depends_on: [ext-vault-edit]
+chain:
+  - ext-accounts-and-unlock
+  - ext-vault-browse
+  - ext-vault-edit
+  - ext-share-sync
+---
+
+## Why
+
+ext-vault-edit saves an item with a sparse `PUT /api/v1/secrets/{id}`, which changes only the editor's own row. In Keepiq every recipient of a shared item holds a separate copy, encrypted to their own key, and the web app re-encrypts each changed value for every recipient after the `PUT` (`src/store/modules/secret.js` `updateSecret`). Without that, a password changed in the extension stays old for everyone it is shared with, and nobody is told. Found in the ext-vault-edit review (must-fix 3); kept as its own change because it is a feature of its own.
+
+## What Changes
+
+- After an edit that changes `key`, `login` or `additionalFields`, the background re-encrypts the new plaintext for every recipient, the way the web app does, before it replies.
+- Three paths, as in the web app:
+  - Owner with direct recipients: `GET /api/v1/secrets/{id}/shares` gives each recipient's copy id and certificate; `PUT /api/v1/secrets/{id}/sync` with `expectedUpdatedAt` and one `{secretId, encryptedKey, encryptedLogin, encryptedAdditionalFields}` per copy (`share.js` `syncUpdate`).
+  - Owner with recipients at partner organisations: per active federated share, fetch and verify the recipient's certificate, then `PUT /api/v1/federated-shares/{id}` with `certFingerprint`; suspend a share whose certificate no longer verifies (`federatedShare.js` `syncUpdate`, `verifyFederatedCertificate`).
+  - Team member with a `write` or `manage` grade editing their copy: `GET /api/v1/secrets/{id}/write-context` gives the source and the owner's certificate; re-encrypt for the source and every other recipient, then `PUT /api/v1/secrets/{sourceId}/sync` (`share.js` `syncAsTeamWriter`).
+- A failed fan-out keeps the editor's own update, as in the web app, but the popup says which recipients did not get the change instead of failing silently.
+- Plaintext fields (name, URL, folder) are not fanned out; the web app does not either.
+
+## Capabilities
+
+### New Capabilities
+
+- `share-sync`: an edit of a shared item reaches every recipient copy.
+
+### Modified Capabilities
+
+- `item-editing` (ext-vault-edit): Save reports the fan-out result.
+
+## Deviations from Bitwarden
+
+Mirrored feature: an edit of an item in a Bitwarden organisation collection, which every member sees at once.
+
+- Per-recipient copies. Bitwarden encrypts a shared item once under the organisation key; Keepiq has no shared key and stores one copy per recipient, so the editor's client re-encrypts for each (forced).
+- Recipient certificates come from the server. The extension can check the editor's own certificate against the unlocked private key (ext-vault-edit), but not another user's; it trusts local recipients' certificates as the web app does, and verifies federated ones as the web app does (open question).
+
+## Keepiq API used
+
+- `GET /api/v1/secrets/{id}/shares`
+- `PUT /api/v1/secrets/{id}/sync`
+- `GET /api/v1/secrets/{id}/write-context`
+- `GET /api/v1/secrets/{id}/federated-shares`
+- `POST /api/v1/federation/recipient-certificate`
+- `PUT /api/v1/federated-shares/{id}`
+- `POST /api/v1/federated-shares/{id}/suspend`
+
+Server rules: `ShareSyncService::syncUpdate` refuses a stale `expectedUpdatedAt` with 409, a read-only source, and a use-only copy (Keepiq specs `user-sharing`, `folder-permission-grades`, `federated-sharing`, `use-only-shares`).
+
+## Open questions
+
+- Should a group share or a team-folder membership need its own path, or are their copies all listed by `GET …/shares`?
+- How should the extension verify a federated recipient's certificate, given `verifyFederatedCertificate` in the web app?
+- What does the popup show when some recipients were updated and others failed, and can the user retry only those?
+
+## Impact
+
+- New: `src/vault/share-sync.ts`, with its test.
+- Edited: `src/vault/write.ts` (`updateItem` runs the fan-out), `src/messages.ts` (the fan-out result in the `item.update` reply), the item form's save result, ADR-003 (the sharing routes).
diff --git a/browser-extension/openspec/changes/ext-vault-browse/design.md b/browser-extension/openspec/changes/ext-vault-browse/design.md
index 8ff401698..9944359d3 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/design.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/design.md
@@ -23,7 +23,7 @@ Server facts come from ADR-003; the caching rules from ADR-002. Keepiq's own `of
 
 - **Sync schedule uses `browser.alarms`, not `setInterval`.** An MV3 service worker dies after about 30 seconds idle and takes timers with it; alarms survive and wake the worker on both MV3 and MV2. `SYNC_INTERVAL_MINUTES = 15` is exported from `src/vault/sync.ts` and used for the alarm period and the popup-open staleness test. Alternative: `setInterval` in the background, which silently stops on Chrome.
 - **Probe before pulling.** Scheduled and popup-open syncs first call `GET /api/v1/secrets?sort=updated_at&direction=desc&limit=1` and `GET /api/v1/suites` together, and compare `updatedAt` of the first row, `total` and the active suite with the last snapshot; unchanged means two small requests and no rewrite (ADR-002). The suite list is what notices a two-factor block or a key rotation while the vault is unchanged. Unlock, local writes and "Sync now" skip the probe. Alternative: always pull the manifest, which re-downloads the whole vault every 15 minutes for nothing.
-- **Manifest first, then paginated fallback.** `GET /api/v1/offline/manifest` (`OfflineController::manifest`) returns vaults under 1000 secrets in one round trip; 403 (admin disabled), 404 (no active suite) and a full 1000 rows (the server's limit by design) switch to `GET /api/v1/secrets?limit=100&page=N` (`SecretController::index`) plus `GET /api/v1/folders`, `GET /api/v1/secret-types`, `GET /api/v1/suites`. While the cached `total` is 1000 or more the manifest is skipped. Ties in the server's sort can move rows between pages (keepiq#1234), so a short count gets a second pass in another order; the snapshot keeps the server's `total`. Both paths produce the same `VaultSnapshot`. Alternative: always paginate, which costs several requests for nothing on the default configuration.
+- **Manifest first, then paginated fallback.** `GET /api/v1/offline/manifest` (`OfflineController::manifest`) returns vaults under 1000 secrets in one round trip; a refusal (admin disabled, ADR-003), 404 (no active suite) and a full 1000 rows (the server's limit by design) switch to `GET /api/v1/secrets?limit=100&page=N` (`SecretController::index`) plus `GET /api/v1/folders`, `GET /api/v1/secret-types`, `GET /api/v1/suites`. While the cached `total` is 1000 or more the manifest is skipped. Ties in the server's sort can move rows between pages (keepiq#1234), so a short count gets a second pass in another order; the snapshot keeps the server's `total`. Both paths produce the same `VaultSnapshot`. Alternative: always paginate, which costs several requests for nothing on the default configuration.
 - **One `storage.local` key per account holds the whole snapshot.** `storage.local.set({ ['vaultCache.' + accountId]: snapshot })` is a single write, so it is atomic for readers and trivially cleared. Plaintext metadata is stored as the server returns it, per ADR-002 (the web app encrypts metadata at rest under a key the extension deliberately never persists). `unlimitedStorage` is requested because Firefox caps `storage.local` at 5 MB without it and a few thousand RSA blobs approach that. Alternative: per-row keys, which need a transaction the API does not offer.
 - **Decryption stays in the background.** `item.decrypt` takes a list of ids and the fields wanted and returns plaintext; the popup never sees ciphertext or the key. Batched ids keep list rendering to one message per visible page of rows. Alternative: send the key to the popup, which widens the exposure surface for no gain.
 - **Copy is done by the popup, clear by the background.** `navigator.clipboard.writeText` works in the popup under a user gesture on both browsers. The popup then sends `clipboard.copied`; the background reads `settings.clearClipboardMs` (absent until ext-settings, meaning 30 seconds; `0` means never) and replaces any pending `clipboard-clear` alarm with a new one. Clearing needs a document: on Chrome MV3 an offscreen document (`entrypoints/offscreen/`, `offscreen` permission, reason `CLIPBOARD`), on Firefox MV2 the persistent background page. Both write without a user gesture, so both need `clipboardWrite`. `src/clipboard.ts` hides the split behind `clearClipboard()`. Alternative: a popup-side timer, which dies when the popup closes, which is always.
@@ -147,7 +147,7 @@ export type BackgroundToPopup =
 
 ## Open Questions
 
-- When the admin turned off offline caching (manifest 403), the paginated fallback still writes the vault ciphertext to `storage.local`, against the admin's intent. Alternative: keep that snapshot in `storage.session` only, losing offline reads after a browser restart.
+- When the admin turned off offline caching (the manifest is refused), the paginated fallback still writes the vault ciphertext to `storage.local`, against the admin's intent. Alternative: keep that snapshot in `storage.session` only, losing offline reads after a browser restart.
 
 - Sync interval value: 15 minutes proposed; confirm against the reviewer's Bitwarden reference.
 - Whether "Sync now" also belongs in the Vault tab header when not offline, or only in ext-settings.
diff --git a/browser-extension/openspec/changes/ext-vault-browse/specs/vault-sync/spec.md b/browser-extension/openspec/changes/ext-vault-browse/specs/vault-sync/spec.md
index 99e2f09db..14ddbcb17 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/specs/vault-sync/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/specs/vault-sync/spec.md
@@ -38,7 +38,7 @@ Before fetching a snapshot, a scheduled or popup-open sync SHALL request `GET /a
 - **THEN** the full snapshot is fetched and the suite change purges the key
 
 ### Requirement: Manifest first, paginated fallback
-The extension SHALL fetch the snapshot from `GET /api/v1/offline/manifest`. The manifest stops at 1000 secrets by design (keepiq#1233). When that request returns 403 or 404, or its `secrets` reach 1000, the extension SHALL instead fetch `GET /api/v1/secrets` with `sort=created_at`, `direction=asc` and `limit=100`, incrementing `page` until `page * limit >= total`, and skips the manifest altogether while the cached `total` is 1000 or more. The server's sort has no unique tiebreaker (keepiq#1234), so rows that tie may move between pages: a row seen twice is kept once, and when fewer rows than `total` arrived the extension SHALL page once more with `sort=updated_at` and `direction=desc`. A complete second pass replaces the first; an incomplete one is merged with it, so a row deleted between the passes may then stay listed until the next full sync. The snapshot records the server's `total`, so a row still missing does not make every probe download again. The fallback also fetches `GET /api/v1/folders`, `GET /api/v1/secret-types` and `GET /api/v1/suites` (selecting the row with `status === 'active'`), and assemble the same snapshot shape. All routes and shapes are as in ADR-003.
+The extension SHALL fetch the snapshot from `GET /api/v1/offline/manifest`. The manifest stops at 1000 secrets by design (keepiq#1233). When that request is refused (403 or 428, ADR-003) or returns 404, or its `secrets` reach 1000, the extension SHALL instead fetch `GET /api/v1/secrets` with `sort=created_at`, `direction=asc` and `limit=100`, incrementing `page` until `page * limit >= total`, and skips the manifest altogether while the cached `total` is 1000 or more. The server's sort has no unique tiebreaker (keepiq#1234), so rows that tie may move between pages: a row seen twice is kept once, and when fewer rows than `total` arrived the extension SHALL page once more with `sort=updated_at` and `direction=desc`. A complete second pass replaces the first; an incomplete one is merged with it, so a row deleted between the passes may then stay listed until the next full sync. The snapshot records the server's `total`, so a row still missing does not make every probe download again. The fallback also fetches `GET /api/v1/folders`, `GET /api/v1/secret-types` and `GET /api/v1/suites` (selecting the row with `status === 'active'`), and assemble the same snapshot shape. All routes and shapes are as in ADR-003.
 
 #### Scenario: Manifest available
 - **GIVEN** the server allows offline caching
@@ -46,7 +46,7 @@ The extension SHALL fetch the snapshot from `GET /api/v1/offline/manifest`. The
 - **THEN** one request to `GET /api/v1/offline/manifest` supplies suite, secrets, folders, types and `syncedAt`
 
 #### Scenario: Manifest disabled by the admin
-- **GIVEN** `GET /api/v1/offline/manifest` returns 403
+- **GIVEN** `GET /api/v1/offline/manifest` returns 428 with `"error": "forbidden"`
 - **WHEN** a sync runs
 - **THEN** the extension pages through `GET /api/v1/secrets` and fetches folders, types and suites
 - **AND** the assembled snapshot is stored exactly as a manifest result would be, with `syncedAt` set to the client time of completion
diff --git a/browser-extension/openspec/changes/ext-vault-browse/tasks.md b/browser-extension/openspec/changes/ext-vault-browse/tasks.md
index 5baef9c83..e4ec95100 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/tasks.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/tasks.md
@@ -3,7 +3,7 @@
 - [x] 1.1 Add `src/vault/types.ts` and `src/vault/store.ts` with `readSnapshot`, `writeSnapshot`, `clearSnapshot` and `toItemMeta` on one `storage.local` key per account
   - Handles both the full row and the blocked row shape from ADR-003
   - `clearSnapshot` is called from the logout and account-removal paths of ext-accounts-and-unlock
-- [x] 1.2 Add `src/vault/sync.ts`: change probe (`updated_at` desc, limit 1, compare `updatedAt` and `total`) with the suite list, manifest fetch, fallback on 403/404 or a full 1000 rows to paginated secrets (second pass on a short count) plus folders, types and suites, suite-change check, single in-flight promise, `SyncStatus`
+- [x] 1.2 Add `src/vault/sync.ts`: change probe (`updated_at` desc, limit 1, compare `updatedAt` and `total`) with the suite list, manifest fetch, fallback on a refusal (403 or 428), a 404 or a full 1000 rows to paginated secrets (second pass on a short count) plus folders, types and suites, suite-change check, single in-flight promise, `SyncStatus`
   - Uses `src/api/client.ts`; 401 is delegated to the account layer, 423 sets `lastError: 'busy'`
   - A failed fallback leaves the previous snapshot untouched
 - [x] 1.3 Wire sync triggers in `entrypoints/background.ts`: `vault-sync` alarm with `SYNC_INTERVAL_MINUTES`, unlock and lock hooks, popup-open staleness check, `vault.sync` arm; add `alarms` and `unlimitedStorage` to `wxt.config.ts`
diff --git a/browser-extension/openspec/changes/ext-vault-edit/design.md b/browser-extension/openspec/changes/ext-vault-edit/design.md
index d289029b8..003b37364 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/design.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/design.md
@@ -1,6 +1,6 @@
 ## Context
 
-ext-vault-browse leaves the vault read-only: sync fills `storage.local` with ciphertext rows, the popup lists and decrypts on render, and item detail shows Edit, Delete, Clone and Move as disabled. This change adds the write path. The constraints come from ADR-002 and ADR-003: the private key and the certificate live with the background, `PUT /api/v1/secrets/{id}` is a sparse last-write-wins patch whose `additionalFields` is one blob, and the server has no ETag or revision. Bitwarden's forms are the UI reference (ADR-001); the Keepiq web app's `secrets-write-ui` behaviour is the reference for what the server and the web app expect in the blobs.
+ext-vault-browse leaves the vault read-only: sync fills `storage.local` with ciphertext rows, the popup lists and decrypts on render, and item detail shows Edit, Delete, Clone and Move as disabled. This change adds the write path. The constraints come from ADR-002 and ADR-003: the private key and the certificate live with the background, `PUT /api/v1/secrets/{id}` is a sparse patch whose `additionalFields` is one blob, and the server has no ETag; only `baseUpdatedAt` stops a write over a newer version. Bitwarden's forms are the UI reference (ADR-001); the Keepiq web app's `secrets-write-ui` behaviour is the reference for what the server and the web app expect in the blobs.
 
 ## Goals / Non-Goals
 
@@ -21,42 +21,53 @@ ext-vault-browse leaves the vault read-only: sync fills `storage.local` with cip
 
 - **The background encrypts, the popup sends plaintext drafts.** The certificate and the private key are the background's per ADR-002, and one encrypt path is easier to audit. Alternative: ship the certificate to the popup; rejected because it doubles the crypto surface.
 - **Edit fresh-fetches and decrypts before the form opens.** ADR-002 names this as the mitigation for the whole-blob `additionalFields` patch. Alternative: edit the cached row and PUT; rejected because a stale cache silently deletes members another client added.
+- **Edit sends `baseUpdatedAt`.** The server refuses a `PUT` whose `baseUpdatedAt` differs from the stored `updatedAt` with a 409 (`OfflineEditGuard::assertUnchangedSince`), so an edit made elsewhere while the form was open is not overwritten. Move sends only `folderId` and no base, because it cannot clobber another field.
+- **The certificate is proven before it encrypts.** Sync stores whatever certificate the server sends under the same suite id and epoch, so `write.ts` encrypts a random value with it and decrypts it with the private key once per certificate, and refuses writes on a mismatch. The private key is the one thing a compromised server cannot swap, since only the master password opens its envelope.
+- **The active suite is read before each write.** The server stamps a write with its active suite, not the key it was encrypted to, so a key rotated elsewhere since the last sync locks instead of writing an item no one can open. It costs one request per save.
+- **Shared copies keep their limits in two places.** The popup hides what a use-only, read-only or expiring copy may not do, and the background refuses it again: `item.decrypt` withholds a use-only value, `item.fetch` refuses restricted copies by purpose, and `updateItem` refuses what the server would.
+- **Every write names its account.** A pop-out window can show account A while the toolbar popup switched to B, so the background refuses a write whose `accountId` is not the active account rather than saving it into B's vault.
+- **The URL prefill keeps only origin and path.** The URL is stored unencrypted, and a query or fragment can hold a token.
+- **A kept subfolder's name clash is caught before the delete.** The server checks it only after moving or purging the direct items and does not roll back, so the dialog checks the names it can see first, and on a 409 to a plan says items may already have moved, syncs and stops instead of re-reading in a loop.
+- **A refusal is worded by its code.** Keepiq's OCS routes refuse with 428 and an `error`, the rest with 403 and a `code` (ADR-003); the API client reads both as one refusal, as the web app does. Only a policy refusal names itself; a blocked suite, someone else's folder and a read-only copy look the same, so they get a neutral message.
+- **Shared edits reach only the editor's copy.** The web app's per-recipient fan-out is `ext-share-sync`.
+- **Server messages are never shown.** ext-i18n words every error from a code, so 400 and 409 get the extension's own text, chosen by what was being written.
 - **The popup computes the sparse patch, the background encrypts only what is in it.** The popup knows the fresh values and the user's edits; `additionalFields` is always sent whole when any member or the notes changed. Alternative: background diffs; rejected because it would need to hold the fresh plaintext across two messages.
 - **Empty `additionalFields` is an encrypted `{}`, not `null`.** The Keepiq web app does this (`secrets-write-ui`, "Remove the last additional field") and its detail view treats `{}` as "no fields". Scalar fields (`login`, `url`, `folderId`) clear with `null`, as ADR-003 defines.
 - **Notes live in `additionalFields.notes`.** The Keepiq importer already maps Bitwarden notes there (`src/import/parsers/bitwarden.js`), so imported vaults and extension-written notes agree. The editor hides the `notes` member from the custom-field rows and refuses a custom field named `notes`.
 - **Composite payloads mirror `src/cardIdentity/cardIdentity.js` and `src/totp/totp.js` of the web app.** Card and identity serialize exactly the web app's member lists with empty strings for unset members; TOTP keeps the seed as typed (URI or bare base32) and only rewrites the URI when the user changed an advanced field. Alternative: a richer Bitwarden-shaped payload; rejected because the web app would render it as invalid.
 - **Passkey is read-only.** The edit form never decrypts `key` for a `passkey` and the patch never contains `key`, so the credential JSON cannot be corrupted from the extension.
 - **Clone is fetch plus create in the popup.** No server clone exists (ADR-003); the popup fresh-fetches, prefills the add form and calls `item.create`. Passkeys are excluded because the clone would duplicate a credential the RP only knows once.
-- **Folder delete follows Keepiq's three modes.** Empty: plain `DELETE`. Non-empty leaf: `?cascade=delete|move`. With subfolders: `GET /children` then a `DELETE` with the resolution body (`FolderController::destroy` reads `subfolders` and `directSecrets` from the body). The picker and manager decide the mode from the cached rows, the server's 409 is the fallback when the cache is behind.
+- **Folder delete follows Keepiq's three modes.** Empty: plain `DELETE`. Non-empty leaf: `?cascade=delete|move`. With subfolders: a `DELETE` with the resolution body (`FolderController::destroy` reads `subfolders` and `directSecrets` from the body). The manager reads `GET /children` before every delete and picks the mode from it, never from the cache, which holds only live items while a cascade also destroys archived and trashed ones; a 409 means something landed since, and reads them again.
 - **After every successful write, run the ext-vault-browse sync instead of merging the response row.** ADR-002 says sync runs after every local write and the manifest replaces the snapshot atomically; merging one row would need a second code path for the same state.
-- **`default_secret_type` is fetched with `GET /api/settings/user` during sync and cached in `storage.local` with the account.** ext-settings later reuses the same cache. Alternative: wait for ext-settings; rejected because the add form needs a default now.
-- **Confirm and resolution dialogs are the `ConfirmDialog` React component, never `window.confirm`.** Firefox closes an extension popup when a native dialog opens; an in-popup component behaves the same in both browsers.
+- **`default_secret_type` is fetched with `GET /api/settings/user` during a full sync and kept in the snapshot.** It is cleared with the snapshot; ext-settings' server mirror replaces it. A failed read keeps `null`, which means `login`.
+- **Confirm and resolution dialogs are the `ConfirmDialog` React component, never `window.confirm`.** Firefox closes an extension popup when a native dialog opens; an in-popup component behaves the same in both browsers. The folder picker is a dialog too, so the form under it keeps its state without a page stack.
+- **Item actions live in Shell.** The list's More menu and item detail open the same form, picker and delete dialog through the shell context, so both behave the same.
 - **The popup is React per ADR-004.** Views compose components, components read state and trigger writes only through hooks that wrap the typed messages; no component imports `src/api` or `src/crypto`, so the encryption boundary stays in the background. Draft state, dirty tracking and validation live in `useItemDraft`, which calls `src/vault/fields.ts` (pure logic, allowed).
-- **Offline is derived from the last request outcome, reported by the background in the vault state.** `navigator.onLine` is unreliable in a service worker and says nothing about the Keepiq host.
+- **Offline is derived from the last request outcome.** Every write records its outcome in the same `SyncStatus.offline` the sync sets, so one flag drives the vault list's banner and the disabled writes. `navigator.onLine` is unreliable in a service worker and says nothing about the Keepiq host.
+- **A write waits for the sync it triggers.** The reply comes after the snapshot holds the change, so the popup can open the new item; a sync already running is awaited first, because it may have started before the write.
 
 ## Module layout
 
-- `src/vault/fields.ts` (new): reserved names, the 4096 and 65536 caps, per-type field schemas, card and identity serialize and parse, TOTP seed validation and URI rewrite, draft validation.
-- `src/vault/write.ts` (new): encrypt a draft or patch with the suite certificate via `src/crypto/`, call the API client for secrets and folders, map status codes to `VaultWriteError`, trigger sync.
-- `src/messages.ts` (edit): the write messages below and `online` on the vault state.
-- `entrypoints/background.ts` (edit): request/response arms for the write messages, returning the Promise as the existing `get_state` arm does.
-- `entrypoints/popup/views/ItemForm.tsx` (new): add, edit and clone screen composed from the components below.
-- `entrypoints/popup/views/FolderPicker.tsx` (new): "No folder", `FolderTree`, current folder marked, inline "New folder".
-- `entrypoints/popup/views/FolderManager.tsx` (new): `FolderTree` with create, rename, delete and the two delete dialogs.
-- `entrypoints/popup/components/TypeSelect.tsx` (new): type select over the cached `secret-types`.
-- `entrypoints/popup/components/AdditionalFieldsEditor.tsx` (new): repeatable name and value rows with per-row masking and the reserved, blank and duplicate refusals.
-- `entrypoints/popup/components/ConfirmDialog.tsx` (new): in-popup dialog for delete confirms, the cascade choice and the subfolder resolution plan.
-- `entrypoints/popup/components/FolderTree.tsx` (new): indented tree by `parentId`, shared by picker and manager.
-- Reused from ext-vault-browse and ext-accounts-and-unlock: `MaskedField`, `TextField`, `Button`, `ErrorBanner`.
-- `entrypoints/popup/hooks/useItemDraft.ts` (new): draft state, dirty tracking, validation via `src/vault/fields.ts`, patch computation against the fresh item.
-- `entrypoints/popup/hooks/useUnsavedChangesGuard.ts` (new): the discard prompt on in-popup navigation while a draft is dirty.
-- Write messages are sent through the `useMessage` hook from ext-accounts-and-unlock; no component imports `src/api` or `src/crypto`.
-- Vault list and item detail views from ext-vault-browse (edit): the "+" button and the live Edit, Delete, Clone and Move actions.
-- `entrypoints/popup/popup.css` (edit): form, row and dialog styles, split per component when a file grows.
+- `src/vault/fields.ts` (new): reserved names, the 255, 4096 and 65536 caps, per-type form fields, card and identity serialize and parse, TOTP seed validation and URI rewrite, form values to draft, draft diff, validation as codes.
+- `src/vault/write.ts` (new): encrypt a draft or patch with the cached suite certificate via `src/crypto/`, call the API client for secrets and folders, map failures to `VaultWriteError`, record the outcome, sync.
+- `src/vault/sync.ts` (edit): `recordOutcome` for writes, `syncAfterWrite`, and `default_secret_type` read during a full sync.
+- `src/messages.ts` (edit): the write requests below, and `defaultSecretType` and `folderNoticeDismissed` on the unlocked snapshot reply.
+- `src/background/requests.ts` (edit): the write arms, through the existing `PopupRequest` path.
+- `entrypoints/popup/views/ItemForm.tsx` (new): add, edit and clone page; edit and clone fetch first.
+- `entrypoints/popup/views/FolderPicker.tsx` (new): dialog with "No folder", `FolderTree`, the current folder marked, inline "New folder".
+- `entrypoints/popup/views/settings/Vault.tsx` (new): the Vault section with its Folders entry; ext-settings adds the rest.
+- `entrypoints/popup/views/settings/FolderManager.tsx` (new): `FolderTree` with create, rename and the three delete flows.
+- `entrypoints/popup/components/`: `TypeSelect`, `AdditionalFieldsEditor`, `ConfirmDialog` (the modal every dialog uses), `FolderTree`, `FolderNameDialog`.
+- `entrypoints/popup/hooks/useItemDraft.ts` (new): form values, dirty tracking, validation and the patch, all through `src/vault/fields.ts`.
+- `entrypoints/popup/hooks/useUnsavedChangesGuard.ts` (new): registers a dirty form with Shell, which asks before Back, Pop out or the account switcher drops it.
+- `entrypoints/popup/views/Shell.tsx` (edit): the form page, the item actions, the move and delete dialogs, the discard prompt.
+- Header (edit): the primary "New" button, which Shell shows on the Vault list only.
+- Item card and item detail (edit): the live Edit, Delete, Clone and Move actions.
+- No component imports `src/api` or `src/crypto`; writes go through `request` from `useMessage.ts`.
 
 ## Message contract
 
-Additions to `PopupToBackground` in `src/messages.ts`, request/response:
+Additions to `PopupRequest` in `src/messages.ts`, with their replies in `PopupReplies`:
 
 ```ts
 /** Plaintext draft. The background encrypts key, login and additionalFields. */
@@ -74,49 +85,66 @@ export interface ItemDraft {
 /** Fields the user changed. `null` clears. additionalFields is always whole. */
 export type ItemPatch = Partial<ItemDraft>
 
-export interface DecryptedItem extends ItemDraft {
+/** A fresh fetch, decrypted for the form. `DecryptedItem` is ext-vault-browse's partial decrypt. */
+export interface EditableItem extends ItemDraft {
 	id: string
 	updatedAt: string
 	/** Present only for passkey, where key is not decrypted. */
 	keyWithheld?: true
 }
 
+export interface FolderChildren {
+	directSecretCount: number
+	subfolders: Array<{ id: string; name: string; secretCount: number; subfolderCount: number }>
+}
+
 export type FolderDeletePlan =
 	| { mode: 'plain' }
 	| { mode: 'cascade'; cascade: 'delete' | 'move' }
 	| { mode: 'resolution'; directSecrets: 'delete' | 'move'; subfolders: Record<string, 'delete' | 'move' | 'keep'> }
 
-export type VaultWriteError =
-	| { code: 'write_locked' }            // 423
-	| { code: 'suite_blocked' }           // 403
-	| { code: 'invalid'; message: string } // 400
-	| { code: 'conflict'; message: string } // 409
-	| { code: 'not_found' }               // 404
-	| { code: 'blocked'; reason: string } // row.blocked === true
-	| { code: 'offline' }                 // no response
+export type WriteErrorCode =
+	| 'locked'          // no key
+	| 'session_revoked' // 401, already logged out
+	| 'write_locked'    // 423
+	| 'forbidden'       // a refusal without a code: blocked suite, someone else's folder, read-only copy
+	| 'policy'          // a refusal naming a vault policy
+	| 'account_changed' // the write named an account that is no longer active
+	| 'invalid'         // 400
+	| 'conflict'        // 409: duplicate folder, folder not empty, item changed since baseUpdatedAt
+	| 'not_found'       // 404
+	| 'blocked'         // the fetch was refused and the sync marked the item blocked, with `reason`
+	| 'unreadable'      // the fetched item does not decrypt or parse
+	| 'offline'         // no response
+	| 'server_error'    // 5xx
+	| 'restricted'      // a use-only, read-only or (for a clone) expiring shared copy
+	| 'key_mismatch'    // the suite certificate does not match the unlocked key
+	| 'unknown'
+
+export interface VaultWriteError { code: WriteErrorCode; reason?: BlockReason }
 
 export type WriteResult<T> = { ok: true; value: T } | { ok: false; error: VaultWriteError }
 
-export type PopupToBackground =
+export type PopupRequest =
 	| /* existing arms */
-	| { kind: 'item.fetch'; id: string }                    // → WriteResult<DecryptedItem>
+	| { kind: 'item.fetch'; id: string; purpose: 'edit' | 'clone' } // → WriteResult<EditableItem>
 	| { kind: 'item.create'; draft: ItemDraft }             // → WriteResult<{ id: string }>
-	| { kind: 'item.update'; id: string; patch: ItemPatch } // → WriteResult<{ id: string }>
+	| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string } // → WriteResult<{ id: string }>
 	| { kind: 'item.delete'; id: string }                   // → WriteResult<null>
 	| { kind: 'folder.create'; name: string; parentId: string | null } // → WriteResult<{ id: string }>
-	| { kind: 'folder.update'; id: string; name: string }   // → WriteResult<null>
+	| { kind: 'folder.rename'; id: string; name: string }   // → WriteResult<null>
 	| { kind: 'folder.children'; id: string }               // → WriteResult<FolderChildren>
 	| { kind: 'folder.delete'; id: string; plan: FolderDeletePlan } // → WriteResult<null>
+	| { kind: 'folder.dismissNotice' }                      // → null
 ```
 
-`FolderChildren` is the `GET /api/v1/folders/{id}/children` payload as ADR-003 and the Keepiq secrets spec define it. The vault state ext-vault-browse returns gains `online: boolean` and `defaultSecretType: string | null`. A 401 is handled by the account layer from ext-accounts-and-unlock before any of these arms see it.
+`FolderChildren` is the `GET /api/v1/folders/{id}/children` payload (`FolderDeletionService::describeChildren`). The unlocked snapshot reply gains `defaultSecretType: string | null` and `folderNoticeDismissed: boolean`. A 401 is handled by the account layer from ext-accounts-and-unlock before any of these arms see it. The notice flag is `folderNotice.<accountId>` in `storage.local`, cleared when the account is removed.
 
-Browser differences: `browser.tabs.query({ active: true, currentWindow: true })` for the URL prefill exists on MV3 and MV2 alike and needs the `tabs` permission ext-vault-browse adds. WebCrypto encrypt runs in the MV3 service worker and the MV2 background page identically. No `action` or `storage.session` use is added here.
+Browser differences: the URL prefill reuses `useCurrentTab` from ext-vault-browse, so a pop-out window prefills from the tab it came from. WebCrypto encrypt runs in the MV3 service worker and the MV2 background page identically. No `action` or `storage.session` use is added here.
 
 ## Risks / Trade-offs
 
-- [Last-write-wins: two clients editing the same item between fetch and save lose one edit] → The fresh fetch on Edit shortens the window to the seconds the form is open; the popup shows `updatedAt` in detail so the user can notice; a revision check needs a server change.
-- [The cached rows may say a folder is a leaf when the server has a new subfolder] → Treat the 409 "resolution required" as "re-fetch children and show the resolution dialog", never as a fatal error.
+- [Two clients edit the same item between fetch and save] → `baseUpdatedAt` makes the second save a 409; the form keeps the typed values and says the item changed elsewhere. The server compares whole seconds, so two saves within one second still race.
 - [Notes in `additionalFields.notes` collide with a user's own custom field named `notes`] → The editor refuses that name; older items with such a member show it as Notes.
 - [Composite JSON drifts from the web app's serializer] → `fields.ts` copies the member lists verbatim from `cardIdentity.js` and a task pins them in a round-trip check.
 - [A draft with a password is lost when the popup closes] → The unsaved-changes guard covers in-popup navigation; persistence would put plaintext in storage, which ADR-002 forbids.
diff --git a/browser-extension/openspec/changes/ext-vault-edit/proposal.md b/browser-extension/openspec/changes/ext-vault-edit/proposal.md
index eaa52eb8c..556a1132c 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/proposal.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/proposal.md
@@ -17,7 +17,7 @@ After ext-vault-browse the extension can show the vault but not change it: the E
 
 ## What Changes
 
-- Add item from the Vault tab via a "+" button, with a type select and type-specific fields, mirroring Bitwarden's "Add item" form.
+- Add item from the Vault tab via a "New" button in the header, with a type select and type-specific fields, mirroring Bitwarden's "Add item" form.
 - Edit, Delete, Clone and Move to folder on item detail become live.
 - Notes, additional (custom) fields and composite types (`totp`, `card`, `identity`) are editable; `passkey` items are editable only in name, folder and URL.
 - Folder management: create, rename and delete folders from Settings, and create a folder inline from the folder picker.
@@ -39,7 +39,7 @@ None.
 
 Mirrored feature: Bitwarden's browser extension "Add item" and item edit forms, the item detail menu (Edit, Clone, Move, Delete) and Settings → Vault → Folders.
 
-- No trash. Bitwarden soft-deletes into a 30-day trash; Keepiq has no trash, so Delete is a hard delete after a confirm dialog (forced by the API).
+- No trash view. Delete moves the item to Keepiq's trash, as Bitwarden's does, and also revokes its shares (forced by the server, Keepiq `vault-trash-and-archive`); restoring and purging are done in the Keepiq web app until a later change adds a trash view (chosen).
 - Notes have no column. Bitwarden stores notes as a first-class field; Keepiq has none, so the extension stores notes under `additionalFields.notes` for non-note types and in `key` for the `note` type. This follows the Keepiq importer, which already maps Bitwarden notes that way (deferred question).
 - Folder names are plaintext on the server. Bitwarden encrypts folder names; Keepiq's folder rows are plaintext by design (ADR-003, forced).
 - Folders are a real tree. Bitwarden emulates nesting with `/` in names; Keepiq rejects slashes and stores `parentId`, so the extension renders a tree (forced, Keepiq's spec wins per ADR-001).
@@ -48,6 +48,7 @@ Mirrored feature: Bitwarden's browser extension "Add item" and item edit forms,
 - Card and identity have Keepiq's smaller field sets (`number, expiry, cvv, pin, cardholder` and `firstName, lastName, address, phone, email, bsn`) instead of Bitwarden's, so items stay readable in the Keepiq web app (forced, Keepiq's spec wins).
 - Additional field masking is not persisted. Bitwarden stores a field type (text, hidden, boolean, linked); Keepiq's `additionalFields` blob is name to value only, so the per-row masking toggle is a view state (forced, deferred question).
 - Passkeys are read-only. Bitwarden lets the user remove a passkey from a login; the extension edits only name, folder and URL of a `passkey` item and never touches the credential JSON (chosen, deferred question).
+- Shared edits reach only the editor's copy. Bitwarden members share one cipher; each Keepiq recipient holds a copy encrypted to their own key, and re-encrypting it for them is `ext-share-sync`, which follows this change (chosen).
 - No password history. Bitwarden shows previous passwords; Keepiq has `GET /api/v1/secrets/{secretId}/versions`, which a later change can surface (chosen).
 - No draft persistence. Bitwarden keeps a draft when the popup is popped out; the extension warns before navigating away inside the popup and loses the draft when the popup closes (chosen, deferred question).
 
@@ -65,13 +66,14 @@ All from ADR-003.
 - `GET /api/v1/folders/{id}/children`
 - `DELETE /api/v1/folders/{id}`
 - `GET /api/v1/secret-types`
+- `GET /api/v1/suites` (before each write that encrypts)
 - `GET /api/settings/user`
 
 ## Impact
 
-- New: `src/vault/write.ts`, `src/vault/fields.ts`; React views `ItemForm`, `FolderPicker`, `FolderManager` under `entrypoints/popup/views/`; components `TypeSelect`, `AdditionalFieldsEditor`, `ConfirmDialog`, `FolderTree` under `entrypoints/popup/components/`; hooks `useItemDraft`, `useUnsavedChangesGuard` under `entrypoints/popup/hooks/` (ADR-004).
-- Reused: `MaskedField`, `TextField`, `Button`, `ErrorBanner` and `useMessage` from ext-vault-browse and ext-accounts-and-unlock.
-- Edited: `src/messages.ts` (write messages), `entrypoints/background.ts` (write handlers), the vault list and item detail views from ext-vault-browse (the "+" button and the enabled actions).
+- New: `src/vault/write.ts`, `src/vault/fields.ts`; React views `ItemForm`, `ItemDialogs`, `FolderPicker`, and `Vault` and `FolderManager` under `views/settings/`; components `TypeSelect`, `AdditionalFieldsEditor`, `ConfirmDialog`, `FolderTree`, `FolderNameDialog`, `TextArea`; hooks `useItemDraft`, `useUnsavedChangesGuard` (ADR-004).
+- Reused: `TextField`, `Select`, `Button`, `Banner`, `Menu`, `PageFooter` and `request` from earlier changes.
+- Edited: `src/messages.ts` (write requests), `src/background/requests.ts` (write arms), `src/vault/sync.ts` (outcomes, the user settings read), Shell and the header (the "New" button), item card and item detail (the live actions), the settings section list.
 - Depends on the API client and `src/crypto/` from ext-accounts-and-unlock and on sync, cached `secret-types`, the vault list and item detail from ext-vault-browse.
-- The generate button depends on ext-generator's "pick a password" mode; until that change lands the button is hidden.
+- The generate button next to Password comes with ext-generator's pick mode, which adds it to this form.
 - No new manifest permissions. The current-tab URL prefill uses the `tabs` permission ext-vault-browse already needs for URL matching.
diff --git a/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md b/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
index 8a61c7232..2a004d1d8 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
@@ -49,10 +49,18 @@ The extension SHALL rename a folder from the folder manager by sending `PUT /api
 The extension SHALL delete a folder with no items and no subfolders after the confirm dialog "Delete <name>? This cannot be undone." by sending `DELETE /api/v1/folders/{id}` without a cascade, then running sync.
 
 #### Scenario: Delete an empty folder
-- **GIVEN** the folder "Old" holds no items and no subfolders in the cache
+- **GIVEN** the server's children of the folder "Old" list no items and no subfolders
 - **WHEN** the user presses Delete and confirms
 - **THEN** `DELETE /api/v1/folders/{id}` MUST be sent without a query and "Old" MUST leave the tree
 
+### Requirement: Folder delete counts come from the server
+The extension SHALL call `GET /api/v1/folders/{id}/children` whenever the user deletes a folder, and choose the dialog and its counts from that reply, never from the cache. The server counts and deletes every item in the folder, archived and trashed ones and any added since the last sync included (`SecretMapper::countByFolder`), so every dialog that names a count MUST say "Archived and trashed items count too."
+
+#### Scenario: Cache behind the count
+- **GIVEN** the cache holds 1 item in "Old" and the server counts 3, two of them archived
+- **WHEN** the user presses Delete on "Old"
+- **THEN** the dialog MUST say "Delete Old and its 3 items, or move them to No folder?" and "Archived and trashed items count too."
+
 ### Requirement: Delete a non-empty leaf folder
 The extension SHALL, for a folder that holds items but no subfolders, ask "Delete <name> and its <n> items, or move them to <parent name or "No folder">?" with the choices "Delete items too" and "Move items to parent", mapping to `DELETE /api/v1/folders/{id}?cascade=delete` and `?cascade=move`. Bitwarden does not ask; Keepiq's delete protocol requires the choice.
 
@@ -84,7 +92,21 @@ The extension SHALL, for a folder with subfolders, call `GET /api/v1/folders/{id
 #### Scenario: Server rejects an incomplete plan
 - **GIVEN** a subfolder was created in the web app after the children call
 - **WHEN** the server answers 400
-- **THEN** the dialog MUST show the server's `message` and offer Retry, which re-fetches children
+- **THEN** the dialog MUST show "This folder changed. Check the choices again." and offer Retry, which re-fetches children
+
+#### Scenario: Item added after the children were read
+- **GIVEN** the server said "Old" was empty when the dialog opened, and an item landed in it since
+- **WHEN** the user confirms the plain delete and the server answers 409
+- **THEN** the extension MUST re-fetch children and open the dialog that matches them instead of failing
+
+#### Scenario: Kept subfolder's name is taken one level up
+- **GIVEN** "Work" holds the subfolder "Clients" and a root folder "Clients" exists
+- **WHEN** the resolution dialog for "Work" leaves "Clients" on Keep
+- **THEN** it MUST say "A folder named Clients already exists one level up…" and disable Delete, because the server finds the clash only after moving or purging the direct items
+
+#### Scenario: Server finds the clash anyway
+- **GIVEN** the cache missed the clashing name and the server answers 409 to a resolution plan
+- **THEN** the dialog MUST say the folder was not deleted and its own items may already have moved or gone, start a sync, and offer Retry, which re-reads the children
 
 ### Requirement: Folder picker
 The extension SHALL provide a folder picker used by the add-item form, the edit form and Move, listing "No folder" first and then the folder tree with indentation, the current folder marked, and a "New folder" entry at the end. Selection MUST return the `folderId` (or `null`) to the caller without a request.
@@ -100,7 +122,7 @@ The extension SHALL provide a folder picker used by the add-item form, the edit
 - **THEN** it MUST list "No folder" and "New folder" only
 
 ### Requirement: Folder names are plaintext
-The extension SHALL send and cache folder names as plaintext, as ADR-003 defines the folder rows. The folder manager MUST show the notice "Folder names are not encrypted" once per install, dismissible, stored as a flag in `storage.local` that account removal clears.
+The extension SHALL send and cache folder names as plaintext, as ADR-003 defines the folder rows. The folder manager MUST show the notice "Folder names are not encrypted" until dismissed, stored per account as `folderNotice.<accountId>` in `storage.local`, which account removal clears.
 
 #### Scenario: First visit
 - **GIVEN** the notice was never dismissed
@@ -108,7 +130,7 @@ The extension SHALL send and cache folder names as plaintext, as ADR-003 defines
 - **THEN** the notice MUST be shown with a Dismiss button
 
 ### Requirement: Folder write errors and offline
-The extension SHALL map folder write failures as item writes do: 423 shows the write-lock message, 403 the suite-blocked message, 400 and 409 the server's `message`, a network failure "Could not reach the server" with Retry, and every dialog MUST keep the typed values. While the background reports the server unreachable, Add folder, Rename and Delete MUST be disabled with "You are offline. Changes need a connection to Keepiq."
+The extension SHALL map folder write failures as item writes do: 423 shows the write-lock message, a refusal (403 or 428) the policy or the general refusal message, 400 "Keepiq refused this change", a 409 on create or rename the duplicate-name message, a network failure "Could not reach the server" with Retry, and every dialog MUST keep the typed values. The server's own `message` is not shown (ext-i18n). While the background reports the server unreachable, Add folder, Rename and Delete MUST be disabled with "You are offline. Changes need a connection to Keepiq."
 
 #### Scenario: Write lock on rename
 - **GIVEN** the user confirmed a rename
diff --git a/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md b/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
index 6de027761..b1b81a009 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
@@ -1,14 +1,19 @@
 ## ADDED Requirements
 
 ### Requirement: Add item form
-The extension SHALL offer a "+" button at the bottom right of the Vault tab list that opens an add-item form with a Type select, a required Name and the fields of the chosen type, as in Bitwarden's "Add item". The Type select MUST list the cached `secret-types` rows and default to the user's `default_secret_type` when cached, else `login`. For the `login` type the form MUST show Username, Password (masked, with reveal and generate buttons), Website URL, Folder (default "No folder"), Additional fields and Notes. The draft lives in popup memory only and is cleared when the popup closes.
+The extension SHALL offer a primary "New" button with a plus icon in the header of the Vault tab's list, left of the pop-out button as in Bitwarden, that opens an add-item form with a Type select, a required Name and the fields of the chosen type, as in Bitwarden's "Add item". The Type select MUST list the cached `secret-types` rows except `passkey`, which only a passkey ceremony creates, and default to the user's `default_secret_type` when cached, else `login`. For the `login` type the form MUST show Username, Password (masked, with a reveal button; ext-generator adds the generate button), Website URL, Folder (default "No folder"), Additional fields and Notes. The draft lives in popup memory only and is cleared when the popup closes.
 
 #### Scenario: Opening the form from a tab
 - **GIVEN** the vault is unlocked and the user opened the popup on a tab whose URL is `https://example.com/login`
-- **WHEN** the user presses "+" and keeps the default type `login`
+- **WHEN** the user presses New and keeps the default type `login`
 - **THEN** the form MUST prefill Website URL with `https://example.com/login`
 - **AND** Folder MUST read "No folder" and every other field MUST be empty
 
+#### Scenario: Tab URL with a token
+- **GIVEN** the tab's URL is `https://app.example.com/callback?token=abc#access_token=xyz`
+- **WHEN** the user presses New
+- **THEN** Website URL MUST read `https://app.example.com/callback`, since the URL is stored unencrypted
+
 #### Scenario: Default type from user settings
 - **GIVEN** the cached user settings carry `default_secret_type` = `note`
 - **WHEN** the add-item form opens
@@ -20,12 +25,6 @@ The extension SHALL offer a "+" button at the bottom right of the Vault tab list
 - **THEN** Save MUST be refused and the Name field MUST show "Name is required"
 - **AND** no request MUST be sent
 
-#### Scenario: Generate a password
-- **GIVEN** the add-item form is open for a `login` item
-- **WHEN** the user presses the generate button next to Password
-- **THEN** the popup MUST open the generator in "pick a password" mode
-- **AND** returning from the generator MUST place the picked value in Password and keep every other field the user filled
-
 ### Requirement: Additional fields editor
 The extension SHALL let the user add, edit and remove repeatable name and value rows under Additional fields, with a masking toggle per row. A row name that equals `key`, `login` or `url` case-insensitively MUST be refused with the reason "This name is reserved", a blank name MUST be refused, and a duplicate name MUST be refused. The masking toggle is view state only and is not stored, because the Keepiq blob has no field type.
 
@@ -97,14 +96,19 @@ The extension SHALL save a new item by sending the draft to the background, whic
 - **THEN** the body MUST omit `login`, MUST set `url` to `null` and MUST encrypt `{}` as `additionalFields`
 
 ### Requirement: Edit re-fetches before showing the form and saves sparsely
-The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}` and decrypt the response in the background instead of using the cached row, so a stale cache cannot overwrite a newer server value. The decrypted item lives in popup memory only and is cleared when the form closes. Save MUST send `PUT /api/v1/secrets/{id}` with only the fields the user changed; a changed `key` or `login` MUST be re-encrypted, a cleared `login`, `url` or `folderId` MUST be sent as `null`, and any change to notes or additional fields MUST re-send the whole `additionalFields` object built from the fresh fetch, since the server stores it as one blob.
+The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}` and decrypt the response in the background instead of using the cached row, so a stale cache cannot overwrite a newer server value. The decrypted item lives in popup memory only and is cleared when the form closes. Save MUST send `PUT /api/v1/secrets/{id}` with only the fields the user changed plus `baseUpdatedAt`, the fresh fetch's `updatedAt`; a changed `key` or `login` MUST be re-encrypted, a cleared `login`, `url` or `folderId` MUST be sent as `null`, and any change to notes or additional fields MUST re-send the whole `additionalFields` object built from the fresh fetch, since the server stores it as one blob. Type cannot be changed on edit, as in Bitwarden.
 
 #### Scenario: Rename only
 - **GIVEN** the user opened Edit and changed only Name
 - **WHEN** they save
-- **THEN** the `PUT` body MUST contain only `name`
+- **THEN** the `PUT` body MUST contain only `name` and `baseUpdatedAt`
 - **AND** no ciphertext MUST be re-encrypted or sent
 
+#### Scenario: Changed elsewhere while editing
+- **GIVEN** the user opened Edit and the item was changed in the web app before they saved
+- **WHEN** they save
+- **THEN** the server answers 409 and the form MUST keep the typed values and show "This item was changed elsewhere. Go back and edit it again to see the latest version."
+
 #### Scenario: Stale cache
 - **GIVEN** the cached row holds an older `login` than the server
 - **WHEN** the user presses Edit
@@ -121,17 +125,17 @@ The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}`
 - **THEN** the fresh fetch returns 404 and the popup MUST show "This item no longer exists", run sync and return to the list
 
 #### Scenario: Blocked item
-- **GIVEN** the fresh fetch returns a row with `blocked: true`
-- **WHEN** the form would open
-- **THEN** the popup MUST refuse to edit and show the blocked reason as ext-vault-browse does for detail
+- **GIVEN** the item's suite was revoked after the last sync, so the server refuses the fresh fetch (ADR-003)
+- **WHEN** the user presses Edit
+- **THEN** the extension MUST run sync, which marks the item blocked, and the popup MUST refuse to edit and show the blocked reason as ext-vault-browse does for detail
 
 ### Requirement: Delete with confirmation
-The extension SHALL delete an item only after the user confirms an in-popup dialog "Delete <name>? This cannot be undone." and MUST then call `DELETE /api/v1/secrets/{id}`, run sync and return to the list. There is no trash.
+The extension SHALL delete an item only after the user confirms an in-popup dialog "Move <name> to the trash? It stops being shared. You can restore it from the trash in the Keepiq web app." and MUST then call `DELETE /api/v1/secrets/{id}`, run sync and return to the list. The server moves the item to its trash and revokes every share of it (Keepiq `vault-trash-and-archive`); the extension has no trash view, so restoring is done in the web app.
 
 #### Scenario: Confirmed delete
 - **GIVEN** the detail view of "GitHub" is open
 - **WHEN** the user presses Delete and confirms
-- **THEN** `DELETE /api/v1/secrets/{id}` MUST be sent and the list MUST no longer show "GitHub"
+- **THEN** `DELETE /api/v1/secrets/{id}` MUST be sent, the list MUST no longer show "GitHub" and the toast MUST say "Item moved to the trash"
 
 #### Scenario: Cancelled delete
 - **GIVEN** the confirm dialog is open
@@ -165,7 +169,12 @@ The extension SHALL offer Move on item detail, which MUST open the folder picker
 - **THEN** the `PUT` body MUST be `{"folderId": null}`
 
 ### Requirement: Input limits
-The extension SHALL cap Name and Website URL at 4096 characters, every plaintext field and additional field value at 4096 characters, and the serialized `additionalFields` JSON and the `key` plaintext at 65536 UTF-8 bytes, mirroring the Keepiq import limits, and MUST refuse Save with a per-field message when a cap is exceeded.
+The extension SHALL cap Name at 255 characters, the width of the server's `name` column (Keepiq `item-name-limit`), Website URL, Username, every card and identity member and every additional field value at 4096 characters, and the serialized `additionalFields` JSON and the `key` plaintext at 65536 UTF-8 bytes, mirroring the Keepiq import limits, and MUST refuse Save with a per-field message when a cap is exceeded. Notes count only toward the `additionalFields` cap.
+
+#### Scenario: Name too long
+- **GIVEN** the user typed a 256-character Name
+- **WHEN** they press Save
+- **THEN** Save MUST be refused and Name MUST show "At most 255 characters"
 
 #### Scenario: Oversized note
 - **GIVEN** the user pasted 70000 bytes into Notes
@@ -173,7 +182,7 @@ The extension SHALL cap Name and Website URL at 4096 characters, every plaintext
 - **THEN** Save MUST be refused and Notes MUST show "Too long (max 65536 bytes)"
 
 ### Requirement: Write errors keep the user's input
-The extension SHALL map write failures to messages and MUST keep the form with the user's input intact after any failure. A 423 MUST show "Vault is temporarily locked for a key migration, try again later". A 403 MUST show "Your encryption suite is blocked, open Keepiq to resolve it". A 400 MUST show the server's `message`. A network failure MUST show "Could not reach the server" and offer Retry.
+The extension SHALL map write failures to messages and MUST keep the form with the user's input intact after any failure. A 423 MUST show "Vault is temporarily locked for a key migration, try again later". A refusal (403, or 428 on Keepiq's OCS routes, ADR-003) naming a policy code MUST show "Your organisation's policy does not allow this change", and any other refusal "Keepiq does not allow this change. The Keepiq web app shows why.", since a blocked suite, a folder someone else owns and a read-only copy look the same. A 400 MUST show "Keepiq refused this change"; the server's own `message` is not shown, because it is not in the browser's language (ext-i18n). A network failure MUST show "Could not reach the server" and offer Retry.
 
 #### Scenario: Write lock
 - **GIVEN** the user presses Save on a valid draft
@@ -186,7 +195,7 @@ The extension SHALL map write failures to messages and MUST keep the form with t
 - **THEN** the detail view MUST stay open with "Could not reach the server" and the item MUST remain in the list
 
 ### Requirement: Offline disables Save
-The extension SHALL disable Save, Delete, Clone and Move while the background reports the server unreachable, with the explanation "You are offline. Changes need a connection to Keepiq." Reading and copying items stays available.
+The extension SHALL disable Save, Delete, Clone and Move while the background reports the server unreachable, with the explanation "You are offline. Changes need a connection to Keepiq." Reading and copying items stays available. The flag is the one the vault list's offline banner shows; every write and sync updates it.
 
 #### Scenario: Offline while editing
 - **GIVEN** the edit form is open
@@ -199,10 +208,61 @@ The extension SHALL warn "You have unsaved changes. Discard them?" when the user
 
 #### Scenario: Navigating away
 - **GIVEN** the user changed a field on the add-item form
-- **WHEN** they press Back or switch tabs in the popup
+- **WHEN** they press Back or Pop out, or open the account switcher
 - **THEN** the warning MUST appear and Keep editing MUST return to the form with the values intact
 
 #### Scenario: No changes
 - **GIVEN** the user opened the form and changed nothing
 - **WHEN** they press Back
 - **THEN** the popup MUST return without a warning
+
+### Requirement: Writes encrypt only to the user's own key
+The extension SHALL encrypt a write only to a suite certificate it has proven to match the unlocked private key: before the first write with a certificate, it encrypts a random value with that certificate and decrypts it with the private key. When that fails, every write MUST be refused with "Keepiq sent an encryption key that does not match your vault, so nothing was saved. Tell your Keepiq administrator." and nothing is sent. Sync takes the certificate from the server and checks only the suite id and `unlockKeyEpoch`, so a compromised server could otherwise swap in its own key (ADR-002).
+
+#### Scenario: Swapped certificate
+- **GIVEN** a sync stored a certificate that does not belong to the user's private key, under the same suite id and epoch
+- **WHEN** the user saves a new item
+- **THEN** no request MUST be sent and the form MUST show the key mismatch message
+
+Before each write that encrypts, the background MUST also read the server's active suite. When that is not the cached suite, the write MUST NOT be sent and the sync MUST run, which locks the vault with "Your vault key changed in Keepiq. Unlock with your current master password.": the server stamps a write with its active suite, so an item encrypted to the old key would open for no one.
+
+#### Scenario: Key changed on another device
+- **GIVEN** the user rotated their vault key in the web app after the extension's last sync
+- **WHEN** they save an item in the extension
+- **THEN** no item MUST be written and the popup MUST show the unlock screen with the key-changed notice
+
+### Requirement: Writes name their account
+Every write request SHALL carry the id of the account the popup showed, and the background MUST refuse it with "You switched to another account meanwhile, so nothing was saved. Switch back to save it." when that is no longer the active account, so a form filled for one account never saves into another's vault.
+
+#### Scenario: Switched in another window
+- **GIVEN** a pop-out window shows an add-item form for account A
+- **WHEN** the user switches to account B in the toolbar popup, then saves in the pop-out window
+- **THEN** no request MUST reach either server and the form MUST show the message with its values kept
+
+### Requirement: Shared copies keep their limits
+The extension SHALL keep the limits Keepiq puts on a recipient's copy (Keepiq `use-only-shares`, `expiring-shares`, `federated-sharing`), in the popup and again in the background:
+- A use-only copy (`useOnly`) MUST NOT be edited, cloned or moved, and its value and additional fields MUST NOT be shown, copied or sent to the popup; only its login name may be (ext-vault-browse `item-detail`).
+- A read-only copy from another organisation (`readOnly`) MUST NOT be edited or cloned; it may be moved.
+- An expiring copy (`accessExpiresAt`) MUST NOT be cloned, since the clone would outlive the end date.
+Each unavailable action shows why.
+
+#### Scenario: Use-only copy in detail
+- **GIVEN** Bob holds a use-only copy of "Supplier portal"
+- **WHEN** he opens it
+- **THEN** the detail MUST show the login name and the note "Its owner doesn't let you view or copy this.", with no password row, reveal or copy
+- **AND** Edit, Clone and Move MUST be unavailable with "Shared with you for signing in only"
+
+#### Scenario: Clone of an expiring copy
+- **GIVEN** Bob's access to a copy ends on 1 December
+- **WHEN** he opens the More menu
+- **THEN** Clone MUST be unavailable with "Your access ends <date>, so it cannot be cloned"
+- **AND** an `item.fetch` for a clone of it MUST be refused by the background
+
+### Requirement: Edits of shared items
+An edit SHALL change only the editor's own copy; re-encrypting it for every recipient is `ext-share-sync`. Until that change lands, a changed password of a shared item does not reach its recipients, and the user guide MUST say so and point to the Keepiq web app.
+
+#### Scenario: Shared item edited
+- **GIVEN** Alice shared "Wifi" with Bob
+- **WHEN** Alice changes its password in the extension
+- **THEN** Alice's copy MUST hold the new password
+- **AND** Bob's copy keeps the old one until `ext-share-sync`
diff --git a/browser-extension/openspec/changes/ext-vault-edit/tasks.md b/browser-extension/openspec/changes/ext-vault-edit/tasks.md
index 912eb5ae8..e1ae1c30d 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/tasks.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/tasks.md
@@ -1,34 +1,52 @@
 ## 1. Field model and messages
 
-- [ ] 1.1 Create `src/vault/fields.ts` with the reserved names (`key`, `login`, `url`, plus `notes` for custom rows), the 4096 and 65536 caps, per-type field schemas, card and identity serialize and parse, TOTP seed validation and URI rewrite, and `validateDraft`.
+- [x] 1.1 Create `src/vault/fields.ts` with the reserved names (`key`, `login`, `url`, plus `notes` for custom rows), the 255, 4096 and 65536 caps, per-type form fields, card and identity serialize and parse, TOTP seed validation and URI rewrite, the draft diff and `validate`, with its test.
   - Card and identity member lists match `src/cardIdentity/cardIdentity.js` of the Keepiq app verbatim; unset members serialize as `''`.
   - A bare base32 seed is kept as typed; only a changed advanced field rewrites the seed into an `otpauth://totp/` URI.
-- [ ] 1.2 Add `ItemDraft`, `ItemPatch`, `DecryptedItem`, `FolderDeletePlan`, `VaultWriteError`, `WriteResult` and the eight write arms from design.md to `src/messages.ts`, and add `online` and `defaultSecretType` to the vault state.
+- [x] 1.2 Add `ItemDraft`, `ItemPatch`, `EditableItem`, `FolderChildren`, `FolderDeletePlan`, `VaultWriteError`, `WriteResult` and the nine write requests from design.md to `src/messages.ts`, and `defaultSecretType` and `folderNoticeDismissed` to the snapshot reply.
 
 ## 2. Background write path
 
-- [ ] 2.1 Create `src/vault/write.ts` with `createItem`: encrypt `key`, `login` and the `additionalFields` JSON with the active suite certificate through `src/crypto/`, `POST /api/v1/secrets`, then trigger sync and return the new id.
+- [x] 2.1 Create `src/vault/write.ts` with `createItem`: encrypt `key`, `login` and the `additionalFields` JSON with the cached suite certificate through `src/crypto/`, `POST /api/v1/secrets`, then sync and return the new id, with its test.
   - Empty `additionalFields` encrypts `{}`; an empty `login` is omitted; an empty `url` is `null`.
-- [ ] 2.2 Add `fetchItem` (fresh `GET /api/v1/secrets/{id}`, decrypt in the background, withhold `key` for `passkey`, map `blocked` rows) and `updateItem` (encrypt only the ciphertext members present in the patch, sparse `PUT`, trigger sync).
-- [ ] 2.3 Add `deleteItem` (`DELETE /api/v1/secrets/{id}`, trigger sync) and the folder functions: `createFolder`, `renameFolder`, `folderChildren`, `deleteFolder` building the query or the resolution body from `FolderDeletePlan`.
-- [ ] 2.4 Map responses to `VaultWriteError` (423, 403, 400, 409, 404, no response) in one place and set the `online` flag from every request outcome.
-- [ ] 2.5 Fetch `GET /api/settings/user` during sync and cache `default_secret_type` in `storage.local` with the account; clear it with the account data.
-- [ ] 2.6 Register the eight arms in `entrypoints/background.ts` as request/response arms returning the Promise, following the `get_state` pattern.
+- [x] 2.2 Add `fetchItem` (fresh `GET /api/v1/secrets/{id}`, decrypt in the background, withhold `key` for `passkey`, map `blocked` rows to their cached reason) and `updateItem` (encrypt only the ciphertext members present in the patch, sparse `PUT` with `baseUpdatedAt`, never a passkey's `key`, sync).
+- [x] 2.3 Add `deleteItem` (`DELETE /api/v1/secrets/{id}`, sync) and the folder functions: `createFolder`, `renameFolder`, `folderChildren`, `deleteFolder` building the query or the resolution body from `FolderDeletePlan`.
+- [x] 2.4 Map failures to `VaultWriteError` codes in one place, and record every request's outcome in the sync's offline flag through `recordOutcome`; a write replies after `syncAfterWrite`.
+- [x] 2.5 Fetch `GET /api/settings/user` during a full sync and keep `default_secret_type` in the snapshot, which logout and account removal clear; a failed read keeps `null`.
+- [x] 2.6 Handle the write requests in `src/background/requests.ts`, and keep the notice flag as `folderNotice.<id>`, removed with the account.
 
 ## 3. Popup views
 
-- [ ] 3.1 Create the hooks `entrypoints/popup/hooks/useItemDraft.ts` (draft state, dirty tracking, validation via `src/vault/fields.ts`, sparse patch against the fresh item) and `useUnsavedChangesGuard.ts` (the "You have unsaved changes. Discard them?" prompt on in-popup navigation while dirty).
-- [ ] 3.2 Create the components `TypeSelect.tsx`, `AdditionalFieldsEditor.tsx` (repeatable rows, per-row masking, reserved, blank and duplicate refusals), `ConfirmDialog.tsx` (in-popup dialog with a plain confirm, a two-choice cascade and a resolution-plan layout) and `FolderTree.tsx` under `entrypoints/popup/components/`.
-  - No component imports `src/api` or `src/crypto`; writes go through `useMessage` (ADR-004).
-- [ ] 3.3 Create `entrypoints/popup/views/ItemForm.tsx` composing `TypeSelect`, `TextField`, `MaskedField`, `AdditionalFieldsEditor`, `ErrorBanner` and `Button`: default type, required Name, type-specific fields, Folder field opening `FolderPicker`, Notes, per-field cap messages, the offline explanation disabling Save, and error banners with Retry that keep the typed values.
-  - Passkey items show only Name, Folder and Website URL plus the read-only notice.
-- [ ] 3.4 Prefill Website URL from `browser.tabs.query({ active: true, currentWindow: true })` when adding from a tab, add Password reveal through `MaskedField`, and wire the generate button to ext-generator's pick mode returning the value into the draft; hide the button while that mode does not exist.
-- [ ] 3.5 Add the "+" button to the Vault tab list and make Edit, Clone, Move and Delete live on item detail: Edit and Clone call `item.fetch` first, Clone suffixes " - Clone" and excludes passkeys, Delete uses `ConfirmDialog`, Move opens `FolderPicker` and sends a `folderId`-only patch.
-- [ ] 3.6 Create `entrypoints/popup/views/FolderPicker.tsx` ("No folder", `FolderTree`, current folder marked, inline "New folder" calling `folder.create` and selecting the result) and `FolderManager.tsx` at Settings → Vault → Folders ("Add folder" per level, rename, the empty, cascade and resolution delete flows through `ConfirmDialog` fed by `folder.children`, the offline state, and the dismissible plaintext-names notice stored in `storage.local` via the background).
-  - A 409 "resolution required" re-fetches children and opens the resolution dialog instead of failing.
-
-## 4. Verification
-
-- [ ] 4.1 Walk every scenario of both specs against the dev backend in Chrome and Firefox, including a round-trip of a `card`, an `identity` and a `totp` item opened afterwards in the Keepiq web app.
-  - No `chrome.*` in executable code, no decrypted value written to any storage, no encryption in popup code.
-- [ ] 4.2 Run `npm run typecheck`, `npm run lint`, `npm run build` and `npm run build:firefox`, then load `.output/chrome-mv3/` and `.output/firefox-mv2/` in both browsers and confirm add, edit, delete and folder delete each work once.
+- [x] 3.1 Create the hooks `useItemDraft.ts` (values, dirty tracking, validation and the patch through `src/vault/fields.ts`) and `useUnsavedChangesGuard.ts` (registers a dirty form with Shell, which asks "You have unsaved changes. Discard them?" before Back, Pop out or the account switcher).
+- [x] 3.2 Create the components `TypeSelect`, `AdditionalFieldsEditor` (repeatable rows, per-row masking, the refusals as given), `ConfirmDialog` (the in-page modal every dialog uses), `FolderTree`, `FolderNameDialog` and `TextArea`.
+  - No component imports `src/api` or `src/crypto`; writes go through `request` (ADR-004).
+- [x] 3.3 Create `views/ItemForm.tsx`: default type, required Name, type-specific fields, the Folder field opening `FolderPicker`, Notes, per-field messages, the offline explanation disabling Save, and error banners with Retry that keep the typed values.
+  - Passkey items show only Name, Folder and Website URL plus the read-only notice; Type is fixed on edit.
+- [x] 3.4 Prefill Website URL from the current tab when adding. The generate button is ext-generator's (its task 4.6).
+- [x] 3.5 Add a primary "New" button to the header on the Vault list, left of Pop out, and make Edit, Clone, Move and Delete live in the More menu and on item detail, through item actions in Shell: Edit and Clone fetch first, Clone suffixes " - Clone" and excludes passkeys, Delete confirms, Move sends a `folderId`-only patch.
+- [x] 3.6 Create `views/FolderPicker.tsx` and, at Settings → Vault → Folders, `views/settings/Vault.tsx` and `FolderManager.tsx`: Add folder per level, rename, the empty, cascade and resolution delete flows, the offline state and the dismissible plaintext-names notice.
+  - A 409 re-reads the children and opens the matching dialog; a 400 on a plan offers Retry, which re-reads them.
+
+## 4. Review fixes
+
+- [x] 4.1 Prove the suite certificate against the unlocked private key before the first write with it, and refuse writes with `key_mismatch` otherwise.
+- [x] 4.2 Carry `useOnly`, `readOnly` and `accessExpiresAt` into `ItemMeta`; block Edit, Clone and Move as each limit requires in the popup, `item.fetch` and `updateItem`; withhold a use-only value and fields from `item.decrypt`, the detail and the copy menu.
+- [x] 4.3 Ask the server for a folder's children on every delete, and say archived and trashed items count too.
+- [x] 4.4 Record the per-recipient fan-out as its own change, `ext-share-sync`.
+- [x] 4.5 Make every write name its account, and refuse it with `account_changed` when that is no longer the active one.
+- [x] 4.6 Prefill Website URL with the tab's origin and path only.
+- [x] 4.7 Word Delete as a move to the trash that ends sharing, in the dialog, toast, docs, spec and ADR-003.
+- [x] 4.8 Catch a kept subfolder's name clash before a folder delete, and on a 409 to a plan say so, sync and stop.
+- [x] 4.9 Word a refusal by its code: a policy refusal, or a neutral refusal for the rest.
+- [x] 4.10 Read the server's active suite before encrypting, and sync and refuse with `locked` when it is not the cached one.
+- [x] 4.11 Refuse an update for an item the cache does not hold, and leave the offline flag alone on a refusal of our own.
+- [x] 4.12 Keep a custom field named `__proto__`, name a folder made in the move picker in its toast, and put the account switcher behind the unsaved-changes prompt.
+- [x] 4.13 Read Keepiq's 428 refusal like a 403, with its `error` as the code, in writes and in the manifest fallback.
+- [x] 4.14 Answer an overtaken snapshot read with the newer one, and leave "New folder" for the picker once the folder exists.
+- [x] 4.15 Sync when the fresh fetch for Edit or Clone is refused, and name the blocked reason when the sync marks the item blocked.
+
+## 5. Docs and checks
+
+- [x] 5.1 Update `ARCHITECTURE.md`, ADR-002 (the certificate proof), ADR-003 (`baseUpdatedAt`, the 255 cap, folder delete, shared copies), and `../docs/browser-extension/using.md` and `privacy.md`.
+- [x] 5.2 Run `npm test`, `npm run typecheck`, `npm run lint`, `npm run build` and `npm run build:firefox`; no `chrome.*` in executable code, no decrypted value written to storage, no encryption in popup code.
+- [x] 5.3 Walk every scenario of both specs against the dev backend in Chrome and Firefox, including a `card`, an `identity` and a `totp` item opened afterwards in the Keepiq web app.
diff --git a/browser-extension/src/accounts/store.ts b/browser-extension/src/accounts/store.ts
index 400e0e109..d7a0e32a5 100644
--- a/browser-extension/src/accounts/store.ts
+++ b/browser-extension/src/accounts/store.ts
@@ -26,6 +26,8 @@ export interface AccountRecord {
 const ACCOUNTS = 'accounts'
 const ACTIVE = 'activeAccountId'
 export const suiteKey = (accountId: string) => `suite.${accountId}`
+/** Set once the folder manager's plaintext-names notice is dismissed. */
+export const folderNoticeKey = (accountId: string) => `folderNotice.${accountId}`
 
 export class AccountLimitReached extends Error {}
 export class DuplicateAccount extends Error {}
@@ -136,7 +138,7 @@ export async function markLoggedOut(accountId: string, revoked = false): Promise
 async function purge(accountId: string): Promise<void> {
 	await clearKey(accountId)
 	await clearSnapshot(accountId)
-	await browser.storage.local.remove([suiteKey(accountId), settingsKey(accountId)])
+	await browser.storage.local.remove([suiteKey(accountId), settingsKey(accountId), folderNoticeKey(accountId)])
 }
 
 /** Manual "Log out": the account is gone. The host permission is kept (another account may share it). */
diff --git a/browser-extension/src/api/client.test.ts b/browser-extension/src/api/client.test.ts
index abe58e753..39f626982 100644
--- a/browser-extension/src/api/client.test.ts
+++ b/browser-extension/src/api/client.test.ts
@@ -93,6 +93,17 @@ describe('errors', () => {
 		expect(error).toMatchObject({ status: 400, message: 'name is required' })
 	})
 
+	it.each([
+		[428, { message: 'Blocked', error: 'org_ownership_required' }, 'org_ownership_required'],
+		[428, { message: 'Offline caching is disabled', error: 'forbidden' }, undefined],
+		[403, { message: 'Blocked', code: 'org_ownership_required' }, 'org_ownership_required'],
+		[403, { message: 'Suite blocked' }, undefined],
+	])('reads a %i refusal and its reason', async (status, body, code) => {
+		fetchMock.mockResolvedValue(reply(status, body))
+		const error = await createClient(account).keepiq('PUT', '/api/v1/folders/1', {}).catch((e) => e)
+		expect(error).toMatchObject({ refused: true, code })
+	})
+
 	it('reports an HTML 404 on a Keepiq route as Keepiq not installed', async () => {
 		fetchMock.mockResolvedValue(reply(404, '<html>Not found</html>'))
 		await expect(createClient(account).listSuites()).rejects.toBeInstanceOf(KeepiqNotInstalled)
diff --git a/browser-extension/src/api/client.ts b/browser-extension/src/api/client.ts
index 4cec51de5..eb9a75da6 100644
--- a/browser-extension/src/api/client.ts
+++ b/browser-extension/src/api/client.ts
@@ -2,9 +2,15 @@ import { toBase64 } from '@/src/crypto/base64'
 import type { NextcloudUser, SuiteRow } from './types'
 
 export class ApiError extends Error {
-	constructor(readonly status: number, message: string) {
+	/** `code`: the body's machine-readable reason, e.g. a vault policy's, when the server sends one. */
+	constructor(readonly status: number, message: string, readonly code?: string) {
 		super(message)
 	}
+
+	/** Keepiq's OCS routes refuse with 428 (`OcsRefusalMiddleware`), since Nextcloud turns their 403 into a 200; both mean the same. */
+	get refused(): boolean {
+		return this.status === 403 || this.status === 428
+	}
 }
 export class SessionRevoked extends Error {
 	constructor() {
@@ -75,7 +81,10 @@ export function createClient(account: ClientAccount) {
 		if (response.status === 423) throw new VaultWriteLocked(423, message)
 		// Nextcloud answers unknown app routes with an HTML page.
 		if (response.status === 404 && json === undefined) throw new KeepiqNotInstalled(404, message)
-		throw new ApiError(response.status, message)
+		// A 428 names its reason as `error`, a 403 as `code`; `forbidden` names none.
+		const { error, code } = (json ?? {}) as { error?: unknown; code?: unknown }
+		const reason = [error, code].find((value): value is string => typeof value === 'string' && value !== 'forbidden')
+		throw new ApiError(response.status, message, reason)
 	}
 
 	return {
diff --git a/browser-extension/src/api/types.ts b/browser-extension/src/api/types.ts
index 1ca6c7623..57ed5f221 100644
--- a/browser-extension/src/api/types.ts
+++ b/browser-extension/src/api/types.ts
@@ -29,8 +29,12 @@ interface SecretBase {
 	possiblyCompromisedAt: string | null
 	tombstonedAt: string | null
 	tombstoneReason: string | null
-	/** A share the holder may sign in with but never view or copy. Absent from servers before 0.3.7. */
+	/** A recipient copy that may be filled but never shown, copied or changed. Absent from servers before 0.3.7. */
 	useOnly?: boolean
+	/** When the holder's access to this copy ends; not `expiresAt`, which is credential expiry. */
+	accessExpiresAt?: string | null
+	/** A copy from another organisation, which may only be filed in a folder. */
+	readOnly?: boolean
 }
 
 export interface OpenSecretRow extends SecretBase {
diff --git a/browser-extension/src/background/background.test.ts b/browser-extension/src/background/background.test.ts
index b167f928f..65efcb0be 100644
--- a/browser-extension/src/background/background.test.ts
+++ b/browser-extension/src/background/background.test.ts
@@ -119,6 +119,16 @@ describe('background entrypoint', () => {
 		expect(await deliver({ kind: 'item.decrypt', ids: ['x'], fields: ['key'] }, pageSender)).toBeUndefined()
 	})
 
+	it('ignores writes from a content script', async () => {
+		const account = await storedAccount()
+		await deliver({ kind: 'vault.unlock', accountId: account.id, method: { type: 'masterPassword', masterPassword: envelope.password } }, popupSender)
+		const draft = { typeId: 't', name: 'Planted', url: null, folderId: null, key: 'k', login: null, additionalFields: {} }
+		expect(await deliver({ kind: 'item.create', accountId: account.id, draft }, pageSender)).toBeUndefined()
+		expect(await deliver({ kind: 'folder.delete', accountId: account.id, id: 'f1', plan: { mode: 'cascade', cascade: 'delete' } }, pageSender)).toBeUndefined()
+		// The unlock's own sync only reads.
+		expect(fetchMock.mock.calls.filter(([, init]) => init?.method && init.method !== 'GET')).toEqual([])
+	})
+
 	it('creates the sync alarm on unlock and syncs the active account when it fires', async () => {
 		const account = await storedAccount()
 		await deliver({ kind: 'vault.unlock', accountId: account.id, method: { type: 'masterPassword', masterPassword: envelope.password } }, popupSender)
diff --git a/browser-extension/src/background/requests.test.ts b/browser-extension/src/background/requests.test.ts
index 7dfdd3c88..37a7a0052 100644
--- a/browser-extension/src/background/requests.test.ts
+++ b/browser-extension/src/background/requests.test.ts
@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { fakeBrowser } from 'wxt/testing/fake-browser'
-import { addAccount, markLoggedOut } from '@/src/accounts/store'
+import { addAccount, folderNoticeKey, markLoggedOut, removeAccount } from '@/src/accounts/store'
 import { settingsKey, writeSettings } from '@/src/accounts/settings'
 import { CLIPBOARD_ALARM } from '@/src/clipboard'
 import { pemToPkcs8, toBase64 } from '@/src/crypto'
@@ -150,6 +150,11 @@ describe('item.decrypt', () => {
 		}
 	})
 
+	it('withholds a use-only authenticator\'s seed too', async () => {
+		await snapshot([secretRow({ id: 't', useOnly: true, typeId: 't-totp', key: await encrypt('JBSWY3DPEHPK3PXP') })])
+		expect(await send({ kind: 'item.decrypt', ids: ['t'], fields: ['key'] })).toEqual({ ok: false, error: 'use_only' })
+	})
+
 	it('leaves a use-only copy out of a batch that asks for its value', async () => {
 		await snapshot([secretRow({ id: 'u', useOnly: true, key: await encrypt('hunter2') }), secretRow({ id: 'a', key: await encrypt('pw') })])
 		const reply = await send({ kind: 'item.decrypt', ids: ['u', 'a'], fields: ['key'] })
@@ -207,6 +212,42 @@ describe('settings', () => {
 	})
 })
 
+describe('vault writes', () => {
+	it('answers with the snapshot\'s default type and the folder notice flag', async () => {
+		await writeSnapshot(accountId, {
+			suite: { id: suiteRow.id, unlockKeyEpoch: 1 }, secrets: [], folders: [], types: typeRows,
+			syncedAt: new Date().toISOString(), listsSyncedAt: new Date().toISOString(), newestUpdatedAt: null, total: 0, defaultSecretType: 'note',
+		})
+		expect(await send({ kind: 'vault.snapshot' })).toMatchObject({ defaultSecretType: 'note', folderNoticeDismissed: false })
+		expect(await send({ kind: 'folder.dismissNotice', accountId })).toBeNull()
+		expect(await send({ kind: 'vault.snapshot' })).toMatchObject({ folderNoticeDismissed: true })
+	})
+
+	it('forgets the dismissed notice with the account', async () => {
+		await send({ kind: 'folder.dismissNotice', accountId })
+		await removeAccount(accountId)
+		expect(await browser.storage.local.get(folderNoticeKey(accountId))).toEqual({})
+	})
+
+	it('routes a write to the server', async () => {
+		fetchMock.mockResolvedValue(new Response(JSON.stringify({ message: 'Folder is not empty' }), { status: 409 }))
+		expect(await send({ kind: 'folder.delete', accountId, id: 'f1', plan: { mode: 'plain' } })).toEqual({ ok: false, error: { code: 'conflict' } })
+		expect(String(fetchMock.mock.calls[0]![0])).toBe('https://cloud.example.org/index.php/apps/keepiq/api/v1/folders/f1')
+	})
+
+	it('refuses a write meant for an account that is no longer active, without a request', async () => {
+		expect(await send({ kind: 'item.delete', accountId: 'another', id: 's1' })).toEqual({ ok: false, error: { code: 'account_changed' } })
+		expect(await send({ kind: 'folder.dismissNotice', accountId: 'another' })).toBeNull()
+		expect(fetchMock).not.toHaveBeenCalled()
+		expect(await browser.storage.local.get(folderNoticeKey(accountId))).toEqual({})
+	})
+
+	it('refuses a write that names no account', async () => {
+		expect(await send({ kind: 'item.delete', id: 's1' } as never)).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+})
+
 describe('clipboard.copied', () => {
 	it('schedules the clear with the default delay', async () => {
 		await send({ kind: 'clipboard.copied' })
diff --git a/browser-extension/src/background/requests.ts b/browser-extension/src/background/requests.ts
index 7a252657a..c8b08ce07 100644
--- a/browser-extension/src/background/requests.ts
+++ b/browser-extension/src/background/requests.ts
@@ -1,7 +1,7 @@
-import { accountStatus, getAccount, getActiveAccountId, type AccountRecord } from '@/src/accounts/store'
+import { accountStatus, folderNoticeKey, getAccount, getActiveAccountId, type AccountRecord } from '@/src/accounts/store'
 import { scheduleClipboardClear } from '@/src/clipboard'
 import { rsaDecrypt } from '@/src/crypto'
-import { USE_ONLY_FIELDS, type AccountStatus, type DecryptReply, type DecryptedItem, type PopupReplies, type PopupRequest, type PopupTab, type VaultSnapshotReply } from '@/src/messages'
+import { USE_ONLY_FIELDS, type AccountStatus, type DecryptReply, type DecryptedItem, type PopupReplies, type PopupRequest, type PopupTab, type VaultSnapshotReply, type VaultWrite } from '@/src/messages'
 import { readGlobalSettings, updateGlobalSettings } from '@/src/settings/global'
 import { getKey, LAST_TAB_KEY, sessionValues } from '@/src/vault/key-store'
 import { suggestionIds } from '@/src/vault/match'
@@ -9,6 +9,7 @@ import { readSnapshot, toItemMeta } from '@/src/vault/store'
 import type { StoredSecretRow, VaultSnapshot } from '@/src/vault/types'
 import { isStale, sync, syncStatus } from '@/src/vault/sync'
 import { cancelPopout, enforce, expectPopout, touch } from '@/src/vault/timeout'
+import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, renameFolder, updateItem } from '@/src/vault/write'
 
 const TABS: readonly PopupTab[] = ['vault', 'generator', 'send', 'settings']
 
@@ -47,6 +48,8 @@ async function snapshot(tabUrl: string | undefined, opened: boolean): Promise<Va
 		suggestionIds: suggestionIds(items ?? [], tabUrl),
 		sync: await syncStatus(account.id),
 		webAppUrl: `${account.serverUrl}/index.php/apps/keepiq/`,
+		defaultSecretType: cached?.defaultSecretType ?? null,
+		folderNoticeDismissed: (await browser.storage.local.get(folderNoticeKey(account.id)))[folderNoticeKey(account.id)] === true,
 	}
 }
 
@@ -135,6 +138,37 @@ async function perform(message: PopupRequest): Promise<PopupReplies[PopupRequest
 			return readGlobalSettings()
 		case 'settings.set':
 			return updateGlobalSettings(message.patch)
+		default:
+			return performWrite(message)
+	}
+}
+
+/** A write without the account it was meant for is refused, so a stale window never writes elsewhere. */
+async function performWrite(message: VaultWrite): Promise<PopupReplies[VaultWrite['kind']]> {
+	const accountId = message.accountId
+	if (typeof accountId !== 'string') return message.kind === 'folder.dismissNotice' ? null : { ok: false, error: { code: 'invalid' } }
+	switch (message.kind) {
+		case 'item.fetch':
+			return fetchItem(message.id, message.purpose === 'clone' ? 'clone' : 'edit', accountId)
+		case 'item.create':
+			return createItem(message.draft, accountId)
+		case 'item.update':
+			return updateItem(message.id, message.patch ?? {}, message.baseUpdatedAt, accountId)
+		case 'item.delete':
+			return deleteItem(message.id, accountId)
+		case 'folder.create':
+			return createFolder(message.name, message.parentId ?? null, accountId)
+		case 'folder.rename':
+			return renameFolder(message.id, message.name, accountId)
+		case 'folder.children':
+			return folderChildren(message.id, accountId)
+		case 'folder.delete':
+			return deleteFolder(message.id, message.plan ?? { mode: 'plain' }, accountId)
+		case 'folder.dismissNotice': {
+			const account = await activeUnlocked()
+			if (account?.id === accountId) await browser.storage.local.set({ [folderNoticeKey(account.id)]: true })
+			return null
+		}
 	}
 }
 
diff --git a/browser-extension/src/messages.ts b/browser-extension/src/messages.ts
index d7675e258..405c5106d 100644
--- a/browser-extension/src/messages.ts
+++ b/browser-extension/src/messages.ts
@@ -93,14 +93,18 @@ export interface ItemMeta {
 	folderId: string | null
 	hasLogin: boolean
 	blocked: boolean
-	/** Only its login decrypts; the rest is for filling, never for the popup. */
-	useOnly: boolean
 	/** Absent when the stored reason is not a known code. */
 	blockedReason?: BlockReason
 	migrationError?: string | null
 	createdAt: string
 	updatedAt: string
 	expiresAt: string | null
+	/** A shared copy that is only filled: of its values, only the login decrypts for the popup. */
+	useOnly: boolean
+	/** A copy from another organisation, which may only be moved. */
+	readOnly: boolean
+	/** When access to this shared copy ends. */
+	accessExpiresAt: string | null
 }
 
 export interface FolderMeta {
@@ -128,6 +132,9 @@ export type VaultSnapshotReply =
 		sync: SyncStatus
 		/** The account's Keepiq web app, for "open the web app" links. */
 		webAppUrl: string
+		/** The user's `default_secret_type` slug; `null` means `login`. */
+		defaultSecretType: string | null
+		folderNoticeDismissed: boolean
 	}
 
 export type DecryptField = 'login' | 'key' | 'additionalFields'
@@ -141,6 +148,60 @@ export type DecryptReply =
 	| { ok: true; items: Record<string, DecryptedItem> }
 	| { ok: false; error: 'locked' | 'blocked' | 'use_only' | 'decrypt_failed' }
 
+/** Plaintext draft. The background encrypts key, login and additionalFields; the popup never does. */
+export interface ItemDraft {
+	typeId: string
+	name: string
+	url: string | null
+	folderId: string | null
+	key: string
+	login: string | null
+	/** Name to value, `notes` included; `{}` when empty. */
+	additionalFields: Record<string, string>
+}
+
+/** The fields the user changed. `null` clears; `additionalFields` is always whole. */
+export type ItemPatch = Partial<ItemDraft>
+
+/** A fresh fetch, decrypted for the edit form. */
+export interface EditableItem extends ItemDraft {
+	id: string
+	updatedAt: string
+	/** A passkey's credential is never decrypted for editing, so `key` is empty. */
+	keyWithheld?: true
+}
+
+export interface FolderChildren {
+	directSecretCount: number
+	subfolders: Array<{ id: string; name: string; secretCount: number; subfolderCount: number }>
+}
+
+export type SubfolderAction = 'delete' | 'move' | 'keep'
+
+export type FolderDeletePlan =
+	| { mode: 'plain' }
+	| { mode: 'cascade'; cascade: 'delete' | 'move' }
+	| { mode: 'resolution'; directSecrets: 'delete' | 'move'; subfolders: Record<string, SubfolderAction> }
+
+/** `conflict` is a duplicate folder name, a folder that is not empty, or an item changed since `baseUpdatedAt`. */
+export type WriteErrorCode =
+	| 'locked' | 'session_revoked' | 'write_locked' | 'forbidden' | 'policy' | 'invalid' | 'conflict'
+	| 'not_found' | 'blocked' | 'unreadable' | 'offline' | 'server_error' | 'unknown'
+	/** A use-only, read-only or (for a clone) expiring shared copy. */
+	| 'restricted'
+	/** The suite's certificate does not match the unlocked key, so nothing is encrypted to it. */
+	| 'key_mismatch'
+	/** The write was meant for an account that is no longer the active one. */
+	| 'account_changed'
+
+export interface VaultWriteError {
+	code: WriteErrorCode
+	/** With `blocked`, when the row's reason is a known code. */
+	reason?: BlockReason
+}
+
+export type WriteResult<T> = { ok: true; value: T } | { ok: false; error: VaultWriteError }
+
 /** Popup → background requests with their own reply shapes, listed in `PopupReplies`. */
 export type PopupRequest =
 	| { kind: 'vault.sync' }
@@ -152,6 +213,25 @@ export type PopupRequest =
 	| { kind: 'popup.lastTab.set'; tab: PopupTab }
 	| { kind: 'settings.get' }
 	| { kind: 'settings.set'; patch: Partial<GlobalSettings> }
+	| VaultWrite
+
+/**
+ * Each names the account the popup showed, so a write never lands in another account's vault
+ * after a switch in another window.
+ */
+export type VaultWrite = { accountId: string } & (
+	/** `purpose`: a clone is refused for more restricted copies than an edit. */
+	| { kind: 'item.fetch'; id: string; purpose: 'edit' | 'clone' }
+	| { kind: 'item.create'; draft: ItemDraft }
+	/** `baseUpdatedAt`: the fetched version, so a save over a newer one is refused. */
+	| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string }
+	| { kind: 'item.delete'; id: string }
+	| { kind: 'folder.create'; name: string; parentId: string | null }
+	| { kind: 'folder.rename'; id: string; name: string }
+	| { kind: 'folder.children'; id: string }
+	| { kind: 'folder.delete'; id: string; plan: FolderDeletePlan }
+	| { kind: 'folder.dismissNotice' }
+)
 
 export interface PopupReplies {
 	'vault.sync': SyncStatus
@@ -162,11 +242,21 @@ export interface PopupReplies {
 	'popup.lastTab.set': null
 	'settings.get': GlobalSettings
 	'settings.set': GlobalSettings
+	'item.fetch': WriteResult<EditableItem>
+	'item.create': WriteResult<{ id: string }>
+	'item.update': WriteResult<{ id: string }>
+	'item.delete': WriteResult<null>
+	'folder.create': WriteResult<{ id: string }>
+	'folder.rename': WriteResult<null>
+	'folder.children': WriteResult<FolderChildren>
+	'folder.delete': WriteResult<null>
+	'folder.dismissNotice': null
 }
 
 export const POPUP_REQUEST_KINDS: ReadonlySet<string> = new Set<keyof PopupReplies>([
 	'vault.sync', 'vault.snapshot', 'item.decrypt', 'clipboard.copied', 'popup.popout', 'popup.lastTab.set',
-	'settings.get', 'settings.set',
+	'settings.get', 'settings.set', 'item.fetch', 'item.create', 'item.update', 'item.delete',
+	'folder.create', 'folder.rename', 'folder.children', 'folder.delete', 'folder.dismissNotice',
 ])
 
 /** Background → popup broadcasts; nobody listens while the popup is closed. */
diff --git a/browser-extension/src/vault/fields.test.ts b/browser-extension/src/vault/fields.test.ts
new file mode 100644
index 000000000..b9a21a8df
--- /dev/null
+++ b/browser-extension/src/vault/fields.test.ts
@@ -0,0 +1,154 @@
+import { describe, expect, it } from 'vitest'
+import type { EditableItem } from '@/src/messages'
+import { parseTotpSeed } from '@/src/totp/totp'
+import { customField, diffDraft, emptyValues, formKind, fromItem, toDraft, totpKey, validate, type FormValues } from './fields'
+
+function values(overrides: Partial<FormValues> = {}): FormValues {
+	return { ...emptyValues('t-login'), name: 'GitHub', ...overrides }
+}
+
+function item(overrides: Partial<EditableItem> = {}): EditableItem {
+	return {
+		id: 'i1', typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: null,
+		key: 'hunter2', login: 'alice', additionalFields: {}, updatedAt: '2026-03-02T10:00:00+00:00', ...overrides,
+	}
+}
+
+describe('formKind', () => {
+	it('gives composite types their own form and everything else a credential', () => {
+		expect(['note', 'totp', 'card', 'identity', 'passkey'].map(formKind)).toEqual(['note', 'totp', 'card', 'identity', 'passkey'])
+		expect(['login', 'database', 'api_key', 'server_access', undefined].map(formKind)).toEqual(Array(5).fill('credential'))
+	})
+})
+
+describe('toDraft', () => {
+	it('puts notes under `notes`, omits an empty username and clears an empty URL', () => {
+		expect(toDraft(values({ notes: 'Recovery codes in the safe' }), 'login')).toEqual({
+			typeId: 't-login', name: 'GitHub', url: null, folderId: null, key: '', login: null,
+			additionalFields: { notes: 'Recovery codes in the safe' },
+		})
+	})
+
+	it('stores a note in `key` without a username or notes member', () => {
+		const draft = toDraft(values({ secret: 'Wifi: hunter2', login: 'ignored', notes: 'typed under another type' }), 'note')
+		expect(draft).toMatchObject({ key: 'Wifi: hunter2', login: null, additionalFields: {} })
+	})
+
+	it('serializes a card exactly as the web app does', () => {
+		const card = { number: '4111 1111 1111 1111', expiry: '12/29', cvv: '', pin: '', cardholder: 'Alice Doe' }
+		expect(toDraft(values({ card }), 'card').key).toBe('{"number":"4111 1111 1111 1111","expiry":"12/29","cvv":"","pin":"","cardholder":"Alice Doe"}')
+	})
+
+	it('serializes an identity with all six members', () => {
+		const identity = { firstName: 'Alice', lastName: 'Doe', address: '', phone: '', email: 'alice@example.org', bsn: '' }
+		expect(JSON.parse(toDraft(values({ identity }), 'identity').key)).toEqual(identity)
+	})
+
+	it('keeps named custom fields and drops unnamed ones', () => {
+		const fields = [customField(' pin ', '1234'), customField('', '')]
+		expect(toDraft(values({ fields }), 'login').additionalFields).toEqual({ pin: '1234' })
+	})
+})
+
+describe('totpKey', () => {
+	it('keeps a bare secret as typed until an option changes', () => {
+		expect(toDraft(values({ secret: 'JBSWY3DPEHPK3PXP' }), 'totp').key).toBe('JBSWY3DPEHPK3PXP')
+	})
+
+	it('writes changed options into a URI labelled with the item name', () => {
+		const key = totpKey('jbswy3dpehpk3pxp', { digits: 8 }, 'Git Hub')
+		expect(key).toBe('otpauth://totp/Git%20Hub?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=8&period=30')
+		expect(parseTotpSeed(key)).toMatchObject({ digits: 8, period: 30, algorithm: 'SHA1' })
+	})
+
+	it('rewrites an existing URI and keeps its issuer', () => {
+		const key = totpKey('otpauth://totp/ACME:alice?secret=JBSWY3DPEHPK3PXP&issuer=ACME&period=30', { period: 60, algorithm: 'SHA256' }, 'ignored')
+		expect(parseTotpSeed(key)).toMatchObject({ period: 60, algorithm: 'SHA256', issuer: 'ACME', account: 'alice' })
+	})
+})
+
+describe('fromItem and diffDraft', () => {
+	it('round-trips an item without a change', () => {
+		const fetched = item({ additionalFields: { Notes: 'old', pin: '1234' } })
+		const form = fromItem(fetched)
+		expect(form).toMatchObject({ notes: 'old', notesKey: 'Notes', login: 'alice', secret: 'hunter2' })
+		expect(form.fields.map(({ name, value }) => [name, value])).toEqual([['pin', '1234']])
+		expect(diffDraft(toDraft(form, 'login'), toDraft(fromItem(fetched), 'login'))).toEqual({})
+	})
+
+	it('keeps a field named __proto__ through a save', () => {
+		const fetched = item({ additionalFields: JSON.parse('{"__proto__":"kept","pin":"1"}') as Record<string, string> })
+		const draft = toDraft({ ...fromItem(fetched), name: 'Renamed' }, 'login')
+		expect(JSON.stringify(draft.additionalFields)).toBe('{"__proto__":"kept","pin":"1"}')
+		expect(diffDraft(toDraft(fromItem(fetched), 'login'), draft)).toEqual({ name: 'Renamed' })
+	})
+
+	it('sends only a rename', () => {
+		const before = toDraft(fromItem(item()), 'login')
+		expect(diffDraft(before, toDraft({ ...fromItem(item()), name: 'GitHub work' }, 'login'))).toEqual({ name: 'GitHub work' })
+	})
+
+	it('clears an emptied username and URL with null', () => {
+		const before = toDraft(fromItem(item()), 'login')
+		expect(diffDraft(before, toDraft({ ...fromItem(item()), login: '', url: '' }, 'login'))).toEqual({ login: null, url: null })
+	})
+
+	it('sends the whole additional fields object when notes change, under their own name', () => {
+		const fetched = item({ additionalFields: { Notes: 'old', pin: '1234' } })
+		const patch = diffDraft(toDraft(fromItem(fetched), 'login'), toDraft({ ...fromItem(fetched), notes: 'new' }, 'login'))
+		expect(patch).toEqual({ additionalFields: { pin: '1234', Notes: 'new' } })
+	})
+
+	it('leaves an unreadable card alone until a member is typed', () => {
+		const fetched = item({ typeId: 't-card', key: 'legacy text', login: null })
+		expect(diffDraft(toDraft(fromItem(fetched), 'card'), toDraft(fromItem(fetched), 'card'))).toEqual({})
+	})
+
+	it('never sends a withheld passkey credential', () => {
+		const fetched = item({ typeId: 't-passkey', key: '', keyWithheld: true, login: null })
+		const patch = diffDraft(toDraft(fromItem(fetched), 'passkey'), toDraft({ ...fromItem(fetched), name: 'Renamed' }, 'passkey'))
+		expect(patch).toEqual({ name: 'Renamed' })
+	})
+})
+
+describe('validate', () => {
+	it('requires a name of at most 255 characters', () => {
+		expect(validate(values({ name: '  ' }), 'login')).toEqual({ name: { code: 'required' } })
+		expect(validate(values({ name: 'x'.repeat(255) }), 'login')).toEqual({})
+		expect(validate(values({ name: 'x'.repeat(256) }), 'login')).toEqual({ name: { code: 'tooLong', max: 255 } })
+	})
+
+	it('caps a URL and a username at 4096 characters', () => {
+		const errors = validate(values({ url: 'x'.repeat(4097), login: 'x'.repeat(4097) }), 'login')
+		expect(errors).toEqual({ url: { code: 'tooLong', max: 4096 }, login: { code: 'tooLong', max: 4096 } })
+	})
+
+	it('refuses reserved, blank and duplicate field names, ignoring case', () => {
+		const fields = [customField('Login', 'a'), customField('', 'b'), customField('pin', '1'), customField('PIN', '2'), customField('Notes', 'c')]
+		const ids = fields.map((field) => field.id)
+		expect(validate(values({ fields }), 'login')).toEqual({
+			[`field.${ids[0]}.name`]: { code: 'reserved' },
+			[`field.${ids[1]}.name`]: { code: 'required' },
+			[`field.${ids[3]}.name`]: { code: 'duplicate' },
+			[`field.${ids[4]}.name`]: { code: 'reserved' },
+		})
+	})
+
+	it('refuses an invalid authenticator secret', () => {
+		expect(validate(values({ secret: 'not a secret!' }), 'totp')).toEqual({ secret: { code: 'invalidTotp' } })
+		expect(validate(values({ secret: '' }), 'totp')).toEqual({ secret: { code: 'invalidTotp' } })
+	})
+
+	it('puts an oversized additional fields blob on Notes', () => {
+		expect(validate(values({ notes: 'x'.repeat(70000) }), 'login')).toEqual({ notes: { code: 'tooLongBytes', max: 65536 } })
+	})
+
+	it('counts the key in UTF-8 bytes', () => {
+		expect(validate(values({ secret: 'é'.repeat(32768) }), 'note')).toEqual({})
+		expect(validate(values({ secret: 'é'.repeat(32769) }), 'note')).toEqual({ secret: { code: 'tooLongBytes', max: 65536 } })
+	})
+
+	it('checks only name and URL for a passkey', () => {
+		expect(validate(values({ secret: '' }), 'passkey')).toEqual({})
+	})
+})
diff --git a/browser-extension/src/vault/fields.ts b/browser-extension/src/vault/fields.ts
new file mode 100644
index 000000000..0e959ef7c
--- /dev/null
+++ b/browser-extension/src/vault/fields.ts
@@ -0,0 +1,233 @@
+/** The item form's model: per-type fields, the payloads they serialize to, and the limits Keepiq enforces. */
+import type { EditableItem, ItemDraft, ItemPatch } from '@/src/messages'
+import { parseTotpSeed, type TotpAlgorithm } from '@/src/totp/totp'
+import { parseObject, text } from './payloads'
+
+/** The server's `name` column (Keepiq `item-name-limit`). */
+export const NAME_MAX = 255
+/** The Keepiq import limits (`ImportService::MAX_FIELD_LENGTH`, `MAX_BLOB_LENGTH`). */
+export const FIELD_MAX = 4096
+export const BLOB_MAX_BYTES = 65536
+
+/** Reserved by the server (ADR-003), plus `notes`, which holds the Notes field. */
+const RESERVED = new Set(['key', 'login', 'url', 'notes'])
+const NOTES = 'notes'
+
+/** Member order of the web app's `src/cardIdentity/cardIdentity.js`, so it renders what is written here. */
+export const CARD_FIELDS = ['number', 'expiry', 'cvv', 'pin', 'cardholder'] as const
+export const IDENTITY_FIELDS = ['firstName', 'lastName', 'address', 'phone', 'email', 'bsn'] as const
+export type CardField = typeof CARD_FIELDS[number]
+export type IdentityField = typeof IDENTITY_FIELDS[number]
+
+/** `credential` is a username plus a secret: logins, keys, databases and custom types. */
+export type FormKind = 'credential' | 'note' | 'totp' | 'card' | 'identity' | 'passkey'
+
+export function formKind(typeName: string | undefined): FormKind {
+	switch (typeName) {
+		case 'note':
+		case 'totp':
+		case 'card':
+		case 'identity':
+		case 'passkey':
+			return typeName
+		default:
+			return 'credential'
+	}
+}
+
+/** Secrets that span lines. */
+export const isMultiline = (typeName: string | undefined) => typeName === 'ssh_key' || typeName === 'certificate'
+
+export interface TotpOptions {
+	algorithm: TotpAlgorithm
+	digits: 6 | 8
+	period: number
+}
+
+export interface CustomField {
+	/** Stable across renames, for React keys and error paths. */
+	id: number
+	name: string
+	value: string
+}
+
+export interface FormValues {
+	typeId: string
+	name: string
+	url: string
+	folderId: string | null
+	login: string
+	/** A credential's or note's `key`, or a TOTP seed as typed. */
+	secret: string
+	/** Only the advanced TOTP options the user changed; any of them rewrites the seed as a URI. */
+	totp: Partial<TotpOptions>
+	card: Record<CardField, string>
+	identity: Record<IdentityField, string>
+	notes: string
+	/** The member the notes came from, so an edit writes them back under the same name. */
+	notesKey: string | null
+	fields: CustomField[]
+}
+
+const blank = <K extends string>(keys: readonly K[]) => Object.fromEntries(keys.map((key) => [key, ''])) as Record<K, string>
+
+let nextFieldId = 0
+export const customField = (name = '', value = ''): CustomField => ({ id: ++nextFieldId, name, value })
+
+export function emptyValues(typeId: string, url = '', folderId: string | null = null): FormValues {
+	return {
+		typeId, name: '', url, folderId, login: '', secret: '', totp: {},
+		card: blank(CARD_FIELDS), identity: blank(IDENTITY_FIELDS), notes: '', notesKey: null, fields: [],
+	}
+}
+
+function members<K extends string>(raw: string, keys: readonly K[]): Record<K, string> {
+	const payload = parseObject(raw) ?? {}
+	return Object.fromEntries(keys.map((key) => [key, text(payload, key)])) as Record<K, string>
+}
+
+export function fromItem(item: EditableItem): FormValues {
+	const values = emptyValues(item.typeId, item.url ?? '', item.folderId)
+	values.name = item.name
+	values.login = item.login ?? ''
+	values.secret = item.key
+	values.card = members(item.key, CARD_FIELDS)
+	values.identity = members(item.key, IDENTITY_FIELDS)
+	for (const [name, value] of Object.entries(item.additionalFields)) {
+		if (values.notesKey === null && name.toLowerCase() === NOTES) {
+			values.notes = value
+			values.notesKey = name
+		} else {
+			values.fields.push(customField(name, value))
+		}
+	}
+	return values
+}
+
+function serialize<K extends string>(values: Record<K, string>, keys: readonly K[]): string {
+	return JSON.stringify(Object.fromEntries(keys.map((key) => [key, values[key]])))
+}
+
+/** A bare seed stays as typed; changed options are written into an `otpauth://totp/` URI, labelled with the item name. */
+export function totpKey(seed: string, options: Partial<TotpOptions>, label: string): string {
+	if (Object.keys(options).length === 0) return seed
+	const value = seed.trim()
+	const params = { ...parseTotpSeed(value), ...options }
+	const uri = /^otpauth:\/\//i.test(value) ? new URL(value) : new URL(`otpauth://totp/${encodeURIComponent(label)}`)
+	uri.searchParams.set('secret', params.secret)
+	uri.searchParams.set('algorithm', params.algorithm)
+	uri.searchParams.set('digits', String(params.digits))
+	uri.searchParams.set('period', String(params.period))
+	return uri.toString()
+}
+
+function keyOf(values: FormValues, kind: FormKind): string {
+	switch (kind) {
+		case 'card': return serialize(values.card, CARD_FIELDS)
+		case 'identity': return serialize(values.identity, IDENTITY_FIELDS)
+		case 'passkey': return values.secret
+		case 'totp':
+			try {
+				return totpKey(values.secret, values.totp, values.name)
+			} catch {
+				// Refused by `validate` before anything is sent.
+				return values.secret
+			}
+		default: return values.secret
+	}
+}
+
+export function toDraft(values: FormValues, typeName: string | undefined): ItemDraft {
+	const kind = formKind(typeName)
+	const entries = values.fields.filter((field) => field.name.trim()).map((field): [string, string] => [field.name.trim(), field.value])
+	// A note's text is its `key`; notes it came with are kept, not offered.
+	if (values.notes !== '' && (kind !== 'note' || values.notesKey !== null)) entries.push([values.notesKey ?? NOTES, values.notes])
+	// `fromEntries` defines each name, so a field called `__proto__` is kept rather than setting the prototype.
+	const additionalFields: Record<string, string> = Object.fromEntries(entries)
+	return {
+		typeId: values.typeId,
+		name: values.name,
+		url: values.url.trim() || null,
+		folderId: values.folderId,
+		key: keyOf(values, kind),
+		login: kind === 'credential' && values.login !== '' ? values.login : null,
+		additionalFields,
+	}
+}
+
+function sameRecord(a: Record<string, string>, b: Record<string, string>): boolean {
+	const keys = Object.keys(a)
+	return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && a[key] === b[key])
+}
+
+/** What changed from `before` to `after`; both come from `toDraft`, so formatting alone never counts as a change. */
+export function diffDraft(before: ItemDraft, after: ItemDraft): ItemPatch {
+	const patch: ItemPatch = {}
+	if (before.typeId !== after.typeId) patch.typeId = after.typeId
+	if (before.name !== after.name) patch.name = after.name
+	if (before.url !== after.url) patch.url = after.url
+	if (before.folderId !== after.folderId) patch.folderId = after.folderId
+	if (before.key !== after.key) patch.key = after.key
+	if (before.login !== after.login) patch.login = after.login
+	if (!sameRecord(before.additionalFields, after.additionalFields)) patch.additionalFields = after.additionalFields
+	return patch
+}
+
+export type FieldError =
+	| { code: 'required' | 'reserved' | 'duplicate' | 'invalidTotp' }
+	| { code: 'tooLong' | 'tooLongBytes'; max: number }
+
+/**
+ * Keyed by field: `name`, `url`, `login`, `secret`, `notes`, `card.<member>`, `identity.<member>`,
+ * `field.<id>.name`, `field.<id>.value`, and `additionalFields` when the blob is too big without notes.
+ */
+export type FormErrors = Record<string, FieldError>
+
+const length = (value: string) => [...value].length
+const bytes = (value: string) => new TextEncoder().encode(value).length
+
+function capChars(errors: FormErrors, path: string, value: string, max = FIELD_MAX) {
+	if (length(value) > max) errors[path] = { code: 'tooLong', max }
+}
+
+export function validate(values: FormValues, typeName: string | undefined): FormErrors {
+	const kind = formKind(typeName)
+	const errors: FormErrors = {}
+	if (!values.name.trim()) errors.name = { code: 'required' }
+	else capChars(errors, 'name', values.name, NAME_MAX)
+	capChars(errors, 'url', values.url)
+	if (kind === 'passkey') return errors
+
+	if (kind === 'credential') capChars(errors, 'login', values.login)
+	if (kind === 'card') for (const member of CARD_FIELDS) capChars(errors, `card.${member}`, values.card[member])
+	if (kind === 'identity') for (const member of IDENTITY_FIELDS) capChars(errors, `identity.${member}`, values.identity[member])
+	if (kind === 'totp') {
+		try {
+			parseTotpSeed(values.secret)
+		} catch {
+			errors.secret = { code: 'invalidTotp' }
+		}
+	}
+	const draft = toDraft(values, typeName)
+	if (!errors.secret && bytes(draft.key) > BLOB_MAX_BYTES) errors.secret = { code: 'tooLongBytes', max: BLOB_MAX_BYTES }
+
+	const seen = new Set<string>()
+	for (const field of values.fields) {
+		const name = field.name.trim()
+		// A row left empty is dropped, not refused.
+		if (!name && !field.value) continue
+		const folded = name.toLowerCase()
+		if (!name) errors[`field.${field.id}.name`] = { code: 'required' }
+		else if (RESERVED.has(folded)) errors[`field.${field.id}.name`] = { code: 'reserved' }
+		else if (seen.has(folded)) errors[`field.${field.id}.name`] = { code: 'duplicate' }
+		seen.add(folded)
+		capChars(errors, `field.${field.id}.value`, field.value)
+	}
+	if (bytes(JSON.stringify(draft.additionalFields)) > BLOB_MAX_BYTES) {
+		errors[values.notes ? 'notes' : 'additionalFields'] = { code: 'tooLongBytes', max: BLOB_MAX_BYTES }
+	}
+	return errors
+}
+
+/** Errors shown while typing; the rest wait for Save, as in Bitwarden. */
+export const isLiveError = (error: FieldError) => error.code === 'reserved' || error.code === 'duplicate'
diff --git a/browser-extension/src/vault/store.test.ts b/browser-extension/src/vault/store.test.ts
index 32200b21d..65c347802 100644
--- a/browser-extension/src/vault/store.test.ts
+++ b/browser-extension/src/vault/store.test.ts
@@ -64,11 +64,17 @@ describe('toItemMeta', () => {
 	it('keeps metadata and only whether a login exists', () => {
 		const meta = toItemMeta(secretRow({ login: 'ciphertext' }))
 		expect(meta).toEqual({
-			id: 's1', name: 'GitHub', url: 'https://github.com', typeId: 't-login', folderId: null, hasLogin: true, blocked: false, useOnly: false,
+			id: 's1', name: 'GitHub', url: 'https://github.com', typeId: 't-login', folderId: null, hasLogin: true, blocked: false,
 			createdAt: '2026-01-05T10:00:00+00:00', updatedAt: '2026-03-02T10:00:00+00:00', expiresAt: null,
+			useOnly: false, readOnly: false, accessExpiresAt: null,
 		})
 	})
 
+	it('carries the limits of a shared copy', () => {
+		const meta = toItemMeta(secretRow({ useOnly: true, readOnly: true, accessExpiresAt: '2026-12-01T00:00:00+00:00' }))
+		expect(meta).toMatchObject({ useOnly: true, readOnly: true, accessExpiresAt: '2026-12-01T00:00:00+00:00' })
+	})
+
 	it('marks a use-only copy, blocked or not', () => {
 		expect(toItemMeta(secretRow({ useOnly: true })).useOnly).toBe(true)
 		expect(toItemMeta(blockedRow({ useOnly: true })).useOnly).toBe(true)
diff --git a/browser-extension/src/vault/store.ts b/browser-extension/src/vault/store.ts
index 6b53702ee..23dd5868a 100644
--- a/browser-extension/src/vault/store.ts
+++ b/browser-extension/src/vault/store.ts
@@ -58,10 +58,12 @@ export function toItemMeta(row: StoredSecretRow): ItemMeta {
 		folderId: row.folderId,
 		hasLogin: !row.blocked && row.login !== null && row.login !== undefined,
 		blocked: row.blocked === true,
-		useOnly: row.useOnly === true,
 		createdAt: row.createdAt,
 		updatedAt: row.updatedAt,
 		expiresAt: row.expiresAt,
+		useOnly: row.useOnly === true,
+		readOnly: row.readOnly === true,
+		accessExpiresAt: row.accessExpiresAt ?? null,
 	}
 	if (row.blocked) {
 		// A snapshot written by an older version holds English text here until the next sync.
diff --git a/browser-extension/src/vault/sync.test.ts b/browser-extension/src/vault/sync.test.ts
index 15bf0c8da..b0e18cba2 100644
--- a/browser-extension/src/vault/sync.test.ts
+++ b/browser-extension/src/vault/sync.test.ts
@@ -13,6 +13,8 @@ import type { VaultSnapshot } from './types'
 
 const fetchMock = vi.fn<typeof fetch>()
 const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
+/** What Keepiq answers when the admin disabled offline caching (ADR-003). */
+const manifestDisabled = () => json({ message: 'Offline caching is disabled by the administrator', error: 'forbidden' }, 428)
 const MINUTE = 60_000
 
 /** Routes by path; each handler gets the full URL. Unrouted paths 404 like Nextcloud does. */
@@ -58,20 +60,29 @@ function cached(overrides: Partial<VaultSnapshot> = {}): VaultSnapshot {
 }
 
 describe('full sync', () => {
-	it('takes the whole vault from the manifest in one request', async () => {
-		server({ '/api/v1/offline/manifest': () => json(manifest) })
+	it('takes the whole vault from the manifest, beside the user settings', async () => {
+		server({ '/api/v1/offline/manifest': () => json(manifest), '/api/settings/user': () => json({ default_secret_type: 'note' }) })
 		const status = await sync(accountId)
-		expect(paths()).toEqual(['/api/v1/offline/manifest'])
+		expect(paths()).toEqual(['/api/settings/user', '/api/v1/offline/manifest'])
 		const snapshot = await readSnapshot(accountId)
-		expect(snapshot).toMatchObject({ secrets: rows, folders: [folderRow()], total: 2, newestUpdatedAt: '2026-04-01T10:00:00+00:00' })
+		expect(snapshot).toMatchObject({ secrets: rows, folders: [folderRow()], total: 2, newestUpdatedAt: '2026-04-01T10:00:00+00:00', defaultSecretType: 'note' })
 		expect(status).toEqual({ syncing: false, syncedAt: snapshot!.syncedAt, offline: false, lastError: null })
 		expect(await isStale(accountId)).toBe(false)
 	})
 
-	it('pages through the secrets when the admin disabled the manifest', async () => {
+	it('keeps no default type when the user settings fail', async () => {
+		server({ '/api/v1/offline/manifest': () => json(manifest), '/api/settings/user': () => json({ message: 'Down' }, 503) })
+		expect(await sync(accountId)).toMatchObject({ offline: false, lastError: null })
+		expect(await readSnapshot(accountId)).toMatchObject({ defaultSecretType: null })
+	})
+
+	it.each([
+		['428, as Keepiq refuses on its OCS routes', manifestDisabled],
+		['a bare 403', () => json({ message: 'Offline caching is disabled' }, 403)],
+	])('pages through the secrets when the admin disabled the manifest, refused with %s', async (_, refusal) => {
 		const many = Array.from({ length: 150 }, (_, i) => secretRow({ id: `s${i}` }))
 		server({
-			'/api/v1/offline/manifest': () => json({ message: 'Offline caching is disabled' }, 403),
+			'/api/v1/offline/manifest': refusal,
 			'/api/v1/secrets': (url) => {
 				const page = Number(url.searchParams.get('page'))
 				return json({ items: many.slice((page - 1) * 100, page * 100), total: 150, page, limit: 100 })
@@ -103,7 +114,7 @@ describe('full sync', () => {
 		const before = cached()
 		await writeSnapshot(accountId, before)
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': (url) => url.searchParams.get('page') === '3'
 				? json({ message: 'Boom' }, 500)
 				: json({ items: Array.from({ length: 100 }, (_, i) => secretRow({ id: `n${i}` })), total: 500, page: 1, limit: 100 }),
@@ -181,7 +192,7 @@ describe('change probe', () => {
 		await writeSnapshot(accountId, cached())
 		server({ '/api/v1/offline/manifest': () => json(manifest) })
 		await sync(accountId, 'full')
-		expect(paths()).toEqual(['/api/v1/offline/manifest'])
+		expect(paths()).toEqual(['/api/settings/user', '/api/v1/offline/manifest'])
 	})
 })
 
@@ -230,7 +241,7 @@ describe('two-factor policy', () => {
 	it('does the same when the fallback suite comes without its key', async () => {
 		await writeSnapshot(accountId, cached())
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': () => json({ items: rows, total: 2, page: 1, limit: 100 }),
 			'/api/v1/folders': () => json([]),
 			'/api/v1/secret-types': () => json(typeRows),
@@ -278,7 +289,7 @@ describe('server quirks', () => {
 	it('pages again in another order when rows went missing, and keeps the server count', async () => {
 		const all = Array.from({ length: 101 }, (_, i) => secretRow({ id: `s${i}` }))
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': (url) => {
 				const page = Number(url.searchParams.get('page'))
 				// The first order loses s100 to a tie; the second returns everything.
@@ -297,7 +308,7 @@ describe('server quirks', () => {
 	it('drops a row deleted between the two passes', async () => {
 		const all = Array.from({ length: 101 }, (_, i) => secretRow({ id: `s${i}` }))
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': (url) => {
 				const page = Number(url.searchParams.get('page'))
 				// The first pass sees s0 but loses s100; s0 is deleted before the second.
@@ -318,7 +329,7 @@ describe('server quirks', () => {
 
 	it('stores the server count when a row stays missing, so the probe does not download again', async () => {
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': () => json({ items: rows, total: 3, page: 1, limit: 100 }),
 			'/api/v1/folders': () => json([]),
 			'/api/v1/secret-types': () => json([]),
@@ -331,7 +342,7 @@ describe('server quirks', () => {
 	it('keeps a row once when it shows up on two pages', async () => {
 		const page1 = Array.from({ length: 100 }, (_, i) => secretRow({ id: `s${i}` }))
 		server({
-			'/api/v1/offline/manifest': () => json({}, 403),
+			'/api/v1/offline/manifest': manifestDisabled,
 			'/api/v1/secrets': (url) => json(url.searchParams.get('page') === '1'
 				? { items: page1, total: 101, page: 1, limit: 100 }
 				: { items: [page1[99], secretRow({ id: 'last' })], total: 101, page: 2, limit: 100 }),
@@ -373,7 +384,7 @@ describe('server quirks', () => {
 	it('asks for the suites only when a row is on another suite', async () => {
 		server({ '/api/v1/offline/manifest': () => json(manifest) })
 		await sync(accountId)
-		expect(paths()).toEqual(['/api/v1/offline/manifest'])
+		expect(paths()).not.toContain('/api/v1/suites')
 	})
 })
 
@@ -466,7 +477,7 @@ describe('one sync at a time', () => {
 		await vi.waitFor(async () => expect((await syncStatus(accountId)).syncing).toBe(true))
 		release()
 		await first
-		expect(fetchMock).toHaveBeenCalledTimes(1)
+		expect(paths().filter((path) => path === '/api/v1/offline/manifest')).toHaveLength(1)
 		expect((await syncStatus(accountId)).syncing).toBe(false)
 	})
 })
diff --git a/browser-extension/src/vault/sync.ts b/browser-extension/src/vault/sync.ts
index 7ccf0242d..e513f7ea7 100644
--- a/browser-extension/src/vault/sync.ts
+++ b/browser-extension/src/vault/sync.ts
@@ -1,5 +1,5 @@
 import { ApiError, createClient, Offline, SessionRevoked, VaultWriteLocked, type Client } from '@/src/api/client'
-import type { BlockedSecretRow, FolderRow, OpenSecretRow, Page, SecretRow, SecretTypeRow, SuiteRow } from '@/src/api/types'
+import type { BlockedSecretRow, FolderRow, OpenSecretRow, Page, SecretRow, SecretTypeRow, SuiteRow, UserSettings } from '@/src/api/types'
 import { getAccount, suiteKey } from '@/src/accounts/store'
 import { broadcast } from '@/src/background/broadcast'
 import type { BlockReason, SyncStatus } from '@/src/messages'
@@ -56,6 +56,21 @@ export function sync(accountId: string, mode: SyncMode = 'full'): Promise<SyncSt
 	return started
 }
 
+/** A sync already running may have read the server before the write landed, so it is not joined. */
+export async function syncAfterWrite(accountId: string): Promise<SyncStatus> {
+	await inFlight.get(accountId)
+	return sync(accountId, 'full')
+}
+
+/** Any request that got an answer proves the server reachable, so writes keep the offline flag current too. */
+export async function recordOutcome(accountId: string, error: unknown): Promise<void> {
+	if (error instanceof SessionRevoked) return
+	const before = outcomes.get(accountId)?.offline ?? false
+	const unreachable = error instanceof Offline || (error instanceof ApiError && error.status >= 500)
+	outcomes.set(accountId, unreachable ? outcomeOf(error) : { offline: false, lastError: null })
+	if (before !== unreachable) broadcast({ kind: 'vault.changed', sync: await syncStatus(accountId) })
+}
+
 function outcomeOf(error: unknown): Pick<SyncStatus, 'offline' | 'lastError'> {
 	// The account layer already purged and logged out.
 	if (error instanceof SessionRevoked) return { offline: false, lastError: null }
@@ -136,13 +151,24 @@ type Fetched =
 	| { unlockBlocked: true }
 	| { unlockBlocked: false; suite: SuiteRow & { privateKey: string }; snapshot: VaultSnapshot }
 
+/** The add form's default type; `null` (meaning `login`) when the settings can't be read. */
+async function defaultSecretType(client: Client): Promise<string | null> {
+	try {
+		const settings = await client.keepiq<Partial<UserSettings>>('GET', '/api/settings/user')
+		return typeof settings.default_secret_type === 'string' && settings.default_secret_type ? settings.default_secret_type : null
+	} catch {
+		return null
+	}
+}
+
 async function fetchSnapshot(client: Client, skipManifest: boolean): Promise<Fetched> {
+	const defaultType = defaultSecretType(client)
 	let manifest: Manifest | null = null
 	try {
 		if (!skipManifest) manifest = await client.keepiq<Manifest>('GET', '/api/v1/offline/manifest')
 	} catch (error) {
-		// 403: the admin disabled offline caching. 404: no active suite.
-		if (!(error instanceof ApiError) || (error.status !== 403 && error.status !== 404)) throw error
+		// Refused: the admin disabled offline caching. 404: no active suite.
+		if (!(error instanceof ApiError) || (!error.refused && error.status !== 404)) throw error
 	}
 	// The two-factor policy withholds the suite; the web app drops its snapshot on this signal.
 	if (manifest?.unlockBlocked) return { unlockBlocked: true }
@@ -187,6 +213,7 @@ async function fetchSnapshot(client: Client, skipManifest: boolean): Promise<Fet
 			newestUpdatedAt: newest(stored),
 			// The server's count, so a row lost to paging does not make every probe download again.
 			total,
+			defaultSecretType: await defaultType,
 		},
 	}
 }
diff --git a/browser-extension/src/vault/types.ts b/browser-extension/src/vault/types.ts
index a8e3b6c95..2a0c7c0dc 100644
--- a/browser-extension/src/vault/types.ts
+++ b/browser-extension/src/vault/types.ts
@@ -19,6 +19,8 @@ export interface VaultSnapshot {
 	/** What the change probe compares against. */
 	newestUpdatedAt: string | null
 	total: number
+	/** `default_secret_type` from the user settings; absent in a snapshot written before it was read. */
+	defaultSecretType?: string | null
 }
 
 export type { ItemMeta, SyncStatus } from '@/src/messages'
diff --git a/browser-extension/src/vault/write.test.ts b/browser-extension/src/vault/write.test.ts
new file mode 100644
index 000000000..6822e34f1
--- /dev/null
+++ b/browser-extension/src/vault/write.test.ts
@@ -0,0 +1,367 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fakeBrowser } from 'wxt/testing/fake-browser'
+import { addAccount, suiteKey } from '@/src/accounts/store'
+import { importPrivateKey, pemToPkcs8, rsaDecrypt, toBase64 } from '@/src/crypto'
+import type { ItemDraft } from '@/src/messages'
+import { blockedRow, encrypt, folderRow, secretRow, typeRows } from '@/src/testing/vault'
+import { envelope, suiteRow } from '@/src/testing/vectors'
+import { hasKey, putKey } from './key-store'
+import { readSnapshot, writeSnapshot } from './store'
+import { sync, syncStatus } from './sync'
+import type { VaultSnapshot } from './types'
+import { lock } from './unlock'
+import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, renameFolder, updateItem } from './write'
+
+const fetchMock = vi.fn<typeof fetch>()
+const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
+
+interface Sent { method: string; path: string; body: Record<string, unknown> | undefined }
+
+/** Routes by `METHOD /path`; the suites and manifest answer with the rows given, so post-write syncs succeed. */
+function server(routes: Record<string, (sent: Sent) => Response | Promise<Response>> = {}, secrets = [secretRow()], suite = suiteRow) {
+	fetchMock.mockImplementation(async (input, init) => {
+		const url = new URL(String(input))
+		const sent: Sent = {
+			method: init?.method ?? 'GET',
+			path: url.pathname.replace('/index.php/apps/keepiq', '') + url.search,
+			body: init?.body ? JSON.parse(String(init.body)) : undefined,
+		}
+		const route = routes[`${sent.method} ${sent.path}`]
+		if (route) return route(sent)
+		if (sent.path === '/api/v1/suites') return json([suite])
+		if (sent.path === '/api/v1/offline/manifest') return json({ suite, secrets, folders: [folderRow()], types: typeRows, syncedAt: '' })
+		return json({ message: 'Not found' }, 404)
+	})
+}
+
+const sent = () => fetchMock.mock.calls.map(([input, init]) => `${init?.method ?? 'GET'} ${new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')}${new URL(String(input)).search}`)
+const writes = () => sent().filter((line) => !['GET /api/v1/offline/manifest', 'GET /api/settings/user', 'GET /api/v1/suites'].includes(line))
+const bodyOf = (line: string) => {
+	const index = sent().indexOf(line)
+	return JSON.parse(String(fetchMock.mock.calls[index]![1]!.body)) as Record<string, unknown>
+}
+
+let accountId: string
+let privateKey: CryptoKey
+const decrypt = (ciphertext: unknown) => rsaDecrypt(ciphertext as string, privateKey)
+
+async function snapshot(secrets: VaultSnapshot['secrets'] = [secretRow()]) {
+	const at = new Date().toISOString()
+	await writeSnapshot(accountId, {
+		suite: { id: suiteRow.id, unlockKeyEpoch: 1 }, secrets, folders: [folderRow()], types: typeRows,
+		syncedAt: at, listsSyncedAt: at, newestUpdatedAt: null, total: secrets.length,
+	})
+}
+
+const draft = (overrides: Partial<ItemDraft> = {}): ItemDraft => ({
+	typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: 'f1', key: 'hunter2', login: 'alice', additionalFields: {}, ...overrides,
+})
+
+beforeEach(async () => {
+	fakeBrowser.reset()
+	vi.stubGlobal('fetch', fetchMock)
+	fetchMock.mockReset()
+	vi.spyOn(console, 'error').mockImplementation(() => {})
+	accountId = (await addAccount({
+		serverUrl: 'https://cloud.example.org', uid: 'alice', loginName: 'alice', displayName: 'Alice', email: null, avatarDataUrl: null, appPassword: 'pw',
+	}, { ...suiteRow })).id
+	const pkcs8 = pemToPkcs8(envelope.privateKeyPem)
+	privateKey = await importPrivateKey(pkcs8)
+	await putKey(accountId, toBase64(pkcs8))
+	await snapshot()
+})
+
+describe('createItem', () => {
+	it('encrypts key, login and additional fields and sends the rest as plaintext', async () => {
+		server({ 'POST /api/v1/secrets': () => json(secretRow({ id: 'new' }), 201) })
+		expect(await createItem(draft({ additionalFields: { notes: 'Recovery codes' } }))).toEqual({ ok: true, value: { id: 'new' } })
+		const body = bodyOf('POST /api/v1/secrets')
+		expect(body).toMatchObject({ name: 'GitHub', url: 'https://github.com', typeId: 't-login', folderId: 'f1' })
+		expect(await decrypt(body.key)).toBe('hunter2')
+		expect(await decrypt(body.login)).toBe('alice')
+		expect(JSON.parse(await decrypt(body.additionalFields))).toEqual({ notes: 'Recovery codes' })
+		expect(JSON.stringify(body)).not.toContain('hunter2')
+	})
+
+	it('omits an empty username, nulls an empty URL and encrypts empty fields as {}', async () => {
+		server({ 'POST /api/v1/secrets': () => json(secretRow({ id: 'new' }), 201) })
+		await createItem(draft({ login: null, url: null }))
+		const body = bodyOf('POST /api/v1/secrets')
+		expect(body).not.toHaveProperty('login')
+		expect(body.url).toBeNull()
+		expect(await decrypt(body.additionalFields)).toBe('{}')
+	})
+
+	it('replies once a sync started after the write holds the new row', async () => {
+		let release!: () => void
+		const gate = new Promise<void>((resolve) => (release = resolve))
+		const before = [secretRow()]
+		const after = [secretRow(), secretRow({ id: 'new', name: 'New' })]
+		let created = false
+		fetchMock.mockImplementation(async (input, init) => {
+			const path = new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')
+			if (init?.method === 'POST') {
+				created = true
+				return json(secretRow({ id: 'new' }), 201)
+			}
+			if (path === '/api/v1/suites') return json([suiteRow])
+			if (path === '/api/v1/offline/manifest') {
+				const rows = created ? after : before
+				if (!created) await gate
+				return json({ suite: suiteRow, secrets: rows, folders: [], types: typeRows, syncedAt: '' })
+			}
+			return json({}, 404)
+		})
+		// A sync that read the vault before the write must not count as the one after it.
+		const running = sync(accountId, 'full')
+		const reply = createItem(draft())
+		await vi.waitFor(() => expect(created).toBe(true))
+		release()
+		await running
+		expect(await reply).toMatchObject({ ok: true })
+		expect((await readSnapshot(accountId))?.secrets.map((row) => row.id)).toEqual(['s1', 'new'])
+	})
+
+	it('refuses a certificate that does not match the unlocked key, without a request', async () => {
+		const { publicKey } = await crypto.subtle.generateKey({ name: 'RSA-OAEP', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' }, true, ['encrypt', 'decrypt'])
+		const spki = toBase64(new Uint8Array(await crypto.subtle.exportKey('spki', publicKey)))
+		// What a sync stores when the server swapped the certificate but kept the suite id and epoch.
+		await browser.storage.local.set({ [suiteKey(accountId)]: { ...suiteRow, certificate: `-----BEGIN PUBLIC KEY-----\n${spki}\n-----END PUBLIC KEY-----` } })
+		server({ 'POST /api/v1/secrets': () => json(secretRow({ id: 'new' }), 201) })
+		vi.spyOn(console, 'error').mockImplementation(() => {})
+		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'key_mismatch' } })
+		expect(await updateItem('s1', { key: 'new' })).toEqual({ ok: false, error: { code: 'key_mismatch' } })
+		expect(writes()).toEqual([])
+	})
+
+	it('locks instead of encrypting to a key the server replaced since the last sync', async () => {
+		const rotated = { ...suiteRow, id: 'suite-rotated' }
+		server({ 'POST /api/v1/secrets': () => json(secretRow({ id: 'new' }), 201) }, [], rotated)
+		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'locked' } })
+		expect(writes()).toEqual([])
+		expect(await hasKey(accountId)).toBe(false)
+	})
+
+	it('refuses while locked without a request', async () => {
+		await lock(accountId)
+		server()
+		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'locked' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+})
+
+describe('fetchItem', () => {
+	it('decrypts the server row, not the cache', async () => {
+		const fresh = secretRow({ key: await encrypt('new password'), login: await encrypt('bob'), additionalFields: await encrypt('{"notes":"n","pin":1234}') })
+		server({ 'GET /api/v1/secrets/s1': () => json(fresh) })
+		expect(await fetchItem('s1')).toEqual({
+			ok: true,
+			value: {
+				id: 's1', typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: null,
+				key: 'new password', login: 'bob', additionalFields: { notes: 'n', pin: '1234' }, updatedAt: fresh.updatedAt,
+			},
+		})
+	})
+
+	it('withholds a passkey credential', async () => {
+		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ typeId: 't-passkey', key: await encrypt('{"privateKey":"secret"}') })) })
+		const reply = await fetchItem('s1')
+		expect(reply).toMatchObject({ ok: true, value: { key: '', keyWithheld: true } })
+	})
+
+	it('syncs on a refusal and names a row the sync found blocked by its reason', async () => {
+		server({
+			'GET /api/v1/secrets/s1': () => json({ message: 'Encryption suite is revoked', error: 'forbidden' }, 428),
+			'GET /api/v1/suites': () => json([suiteRow, { ...suiteRow, id: 'suite-0', status: 'revoked' }]),
+		}, [secretRow({ encryptionSuiteId: 'suite-0' })])
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'blocked', reason: 'suite_revoked' } })
+		expect(await readSnapshot(accountId)).toMatchObject({ secrets: [{ id: 's1', blocked: true }] })
+	})
+
+	it('reports any other refusal as one', async () => {
+		server({ 'GET /api/v1/secrets/s1': () => json({ message: 'Not yours', error: 'forbidden' }, 428) })
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'forbidden' } })
+	})
+
+	it('reports a row that does not open', async () => {
+		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ key: await encrypt('k'), additionalFields: await encrypt('[1]') })) })
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'unreadable' } })
+	})
+
+	it.each([
+		['a use-only copy', { useOnly: true }, 'restricted', 'restricted'],
+		['a read-only copy from another organisation', { readOnly: true }, 'restricted', 'restricted'],
+		['an expiring copy', { accessExpiresAt: '2026-12-01T00:00:00+00:00' }, 'ok', 'restricted'],
+	])('opens %s for editing and cloning only as its limits allow', async (_, limits, edit, clone) => {
+		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ key: await encrypt('pw'), ...limits })) })
+		const outcome = async (purpose: 'edit' | 'clone') => {
+			const reply = await fetchItem('s1', purpose)
+			return reply.ok ? 'ok' : reply.error.code
+		}
+		expect(await outcome('edit')).toBe(edit)
+		expect(await outcome('clone')).toBe(clone)
+	})
+
+	it('syncs when the item is gone', async () => {
+		server({ 'GET /api/v1/secrets/s1': () => json({ message: 'Secret not found' }, 404) }, [])
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'not_found' } })
+		await vi.waitFor(async () => expect((await readSnapshot(accountId))?.secrets).toEqual([]))
+	})
+})
+
+describe('updateItem', () => {
+	it('sends only the changed plaintext with the base version', async () => {
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		expect(await updateItem('s1', { name: 'GitHub work' }, '2026-03-02T10:00:00+00:00')).toEqual({ ok: true, value: { id: 's1' } })
+		expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ name: 'GitHub work', baseUpdatedAt: '2026-03-02T10:00:00+00:00' })
+	})
+
+	it('clears with null and encrypts what changed', async () => {
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		await updateItem('s1', { login: null, url: null, folderId: null, key: 'new', additionalFields: { pin: '1' } })
+		const body = bodyOf('PUT /api/v1/secrets/s1')
+		expect(body).toMatchObject({ login: null, url: null, folderId: null })
+		expect(await decrypt(body.key)).toBe('new')
+		expect(await decrypt(body.additionalFields)).toBe('{"pin":"1"}')
+	})
+
+	it('never writes a passkey credential', async () => {
+		await snapshot([secretRow({ typeId: 't-passkey' })])
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		await updateItem('s1', { name: 'Renamed', key: '{}' })
+		expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ name: 'Renamed' })
+	})
+
+	it('refuses an item the cache does not hold, since its type and limits are unknown', async () => {
+		server({ 'PUT /api/v1/secrets/elsewhere': () => json(secretRow()) })
+		expect(await updateItem('elsewhere', { key: '{}' })).toEqual({ ok: false, error: { code: 'not_found' } })
+		expect(writes()).toEqual([])
+	})
+
+	it('checks the suite once for all it encrypts', async () => {
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		await updateItem('s1', { key: 'new', login: 'bob', additionalFields: { pin: '1' } })
+		expect(sent().filter((line) => line === 'GET /api/v1/suites')).toHaveLength(1)
+	})
+
+	it('refuses any change to a use-only copy, and all but filing for a read-only one', async () => {
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		await snapshot([secretRow({ useOnly: true })])
+		expect(await updateItem('s1', { folderId: 'f1' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		await snapshot([secretRow({ readOnly: true })])
+		expect(await updateItem('s1', { name: 'Mine now' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		expect(writes()).toEqual([])
+		expect(await updateItem('s1', { folderId: 'f1' })).toMatchObject({ ok: true })
+		expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ folderId: 'f1' })
+	})
+
+	it('keeps those limits on a copy whose suite is blocked', async () => {
+		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		await snapshot([blockedRow({ id: 's1', useOnly: true })])
+		expect(await updateItem('s1', { name: 'Mine now' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		await snapshot([blockedRow({ id: 's1', readOnly: true })])
+		expect(await updateItem('s1', { name: 'Mine now' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		expect(await updateItem('s1', { key: 'new' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		expect(writes()).toEqual([])
+	})
+
+	it('refuses a blank name', async () => {
+		server()
+		expect(await updateItem('s1', { name: ' ' })).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+})
+
+describe('errors and the offline flag', () => {
+	it.each([
+		[423, 'write_locked'], [403, 'forbidden'], [428, 'forbidden'], [400, 'invalid'], [409, 'conflict'], [404, 'not_found'], [503, 'server_error'],
+	])('maps %i to %s', async (status, code) => {
+		server({ 'DELETE /api/v1/secrets/s1': () => json({ message: 'English text' }, status) })
+		expect(await deleteItem('s1')).toEqual({ ok: false, error: { code } })
+	})
+
+	it.each([
+		['a 403 with a code', 403, { message: 'Blocked by policy', code: 'org_ownership_required' }, 'policy'],
+		['a 428 naming a policy', 428, { message: 'Blocked by policy', code: 'org_ownership_required', error: 'org_ownership_required' }, 'policy'],
+		['a 428 naming none', 428, { message: 'Forbidden', error: 'forbidden' }, 'forbidden'],
+	])('tells a policy refusal from any other refusal: %s', async (_, status, body, code) => {
+		server({ 'PUT /api/v1/folders/f1': () => json(body, status) })
+		expect(await renameFolder('f1', 'Office')).toEqual({ ok: false, error: { code } })
+	})
+
+	it('reads a 428 on saving an item as a refusal', async () => {
+		server({
+			'POST /api/v1/secrets': () => json({ message: 'Blocked by policy', code: 'org_ownership_required', error: 'org_ownership_required' }, 428),
+			'PUT /api/v1/secrets/s1': () => json({ message: 'Read-only copy', error: 'forbidden' }, 428),
+		})
+		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'policy' } })
+		expect(await updateItem('s1', { name: 'Renamed' })).toEqual({ ok: false, error: { code: 'forbidden' } })
+	})
+
+	it('refuses a write for an account that is no longer the active one', async () => {
+		server()
+		expect(await createItem(draft(), 'another')).toEqual({ ok: false, error: { code: 'account_changed' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+
+	it('goes offline when the server does not answer, and back when it does', async () => {
+		fetchMock.mockRejectedValue(new TypeError('Failed to fetch'))
+		expect(await deleteItem('s1')).toEqual({ ok: false, error: { code: 'offline' } })
+		expect(await syncStatus(accountId)).toMatchObject({ offline: true })
+		server({ 'DELETE /api/v1/secrets/s1': () => json({ status: 'deleted' }) }, [])
+		expect(await deleteItem('s1')).toEqual({ ok: true, value: null })
+		expect(await syncStatus(accountId)).toMatchObject({ offline: false })
+		expect((await readSnapshot(accountId))?.secrets).toEqual([])
+	})
+
+	it('stays offline after a refusal that never reached the server', async () => {
+		fetchMock.mockRejectedValue(new TypeError('Failed to fetch'))
+		await deleteItem('s1')
+		expect(await createFolder('Work/Clients', null)).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(await syncStatus(accountId)).toMatchObject({ offline: true })
+	})
+})
+
+describe('folders', () => {
+	it('creates a trimmed folder under its parent', async () => {
+		server({ 'POST /api/v1/folders': () => json(folderRow({ id: 'f2' }), 201) })
+		expect(await createFolder(' Banking ', 'f1')).toEqual({ ok: true, value: { id: 'f2' } })
+		expect(bodyOf('POST /api/v1/folders')).toEqual({ name: 'Banking', parentId: 'f1' })
+	})
+
+	it('refuses a blank name or a slash without a request', async () => {
+		server()
+		expect(await createFolder('Work/Clients', null)).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(await renameFolder('f1', '  ')).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+
+	it('renames with only the name', async () => {
+		server({ 'PUT /api/v1/folders/f1': () => json(folderRow({ name: 'Office' })) })
+		await renameFolder('f1', 'Office')
+		expect(bodyOf('PUT /api/v1/folders/f1')).toEqual({ name: 'Office' })
+	})
+
+	it('reads the children without syncing', async () => {
+		const children = { directSecretCount: 2, subfolders: [{ id: 'c', name: 'Clients', secretCount: 5, subfolderCount: 1 }] }
+		server({ 'GET /api/v1/folders/f1/children': () => json(children) })
+		expect(await folderChildren('f1')).toEqual({ ok: true, value: children })
+		expect(sent()).toEqual(['GET /api/v1/folders/f1/children'])
+	})
+
+	it('deletes in each of the three modes', async () => {
+		const deleted = () => json({ status: 'deleted' })
+		server({
+			'DELETE /api/v1/folders/f1': deleted,
+			'DELETE /api/v1/folders/f1?cascade=move': deleted,
+			'DELETE /api/v1/folders/f1?cascade=delete': deleted,
+		})
+		await deleteFolder('f1', { mode: 'plain' })
+		await deleteFolder('f1', { mode: 'cascade', cascade: 'move' })
+		await deleteFolder('f1', { mode: 'cascade', cascade: 'delete' })
+		await deleteFolder('f1', { mode: 'resolution', directSecrets: 'move', subfolders: { c: 'keep' } })
+		expect(writes()).toEqual(['DELETE /api/v1/folders/f1', 'DELETE /api/v1/folders/f1?cascade=move', 'DELETE /api/v1/folders/f1?cascade=delete', 'DELETE /api/v1/folders/f1'])
+		const plans = fetchMock.mock.calls.filter(([, init]) => init?.method === 'DELETE').map(([, init]) => init?.body)
+		expect(plans).toEqual([undefined, undefined, undefined, JSON.stringify({ directSecrets: 'move', subfolders: { c: 'keep' } })])
+	})
+})
diff --git a/browser-extension/src/vault/write.ts b/browser-extension/src/vault/write.ts
new file mode 100644
index 000000000..e1a85e8a1
--- /dev/null
+++ b/browser-extension/src/vault/write.ts
@@ -0,0 +1,266 @@
+/** Item and folder writes for the active account. All encryption happens here, never in the popup (ADR-004). */
+import { ApiError, createClient, Offline, SessionRevoked, VaultWriteLocked, type Client } from '@/src/api/client'
+import type { CachedSuite, FolderRow, OpenSecretRow, SecretRow } from '@/src/api/types'
+import { getAccount, getActiveAccountId, suiteKey, type AccountRecord } from '@/src/accounts/store'
+import { importPublicKey, rsaDecrypt, rsaEncrypt, toBase64 } from '@/src/crypto'
+import type { EditableItem, FolderChildren, FolderDeletePlan, ItemDraft, ItemPatch, VaultWriteError, WriteResult } from '@/src/messages'
+import { getKey } from './key-store'
+import { parseObject } from './payloads'
+import { readSnapshot } from './store'
+import { recordOutcome, syncAfterWrite } from './sync'
+
+class WriteFailure extends Error {
+	constructor(readonly error: VaultWriteError) {
+		super(error.code)
+	}
+}
+
+interface Context {
+	account: AccountRecord
+	client: Client
+	privateKey: CryptoKey
+}
+
+/**
+ * Writes need an unlocked vault, like reads: the lock is what guards a walk-up user (ADR-002). They
+ * also need the account the popup showed to still be the active one, or a form filled for one account
+ * would save into another's vault after a switch in another window.
+ */
+async function context(expected: string | undefined): Promise<Context> {
+	const id = await getActiveAccountId()
+	if (expected !== undefined && id !== expected) throw new WriteFailure({ code: 'account_changed' })
+	const account = id ? await getAccount(id) : undefined
+	if (account?.appPassword === null) throw new WriteFailure({ code: 'session_revoked' })
+	const privateKey = account ? await getKey(account.id) : null
+	if (!account || !privateKey) throw new WriteFailure({ code: 'locked' })
+	return { account, client: createClient(account), privateKey }
+}
+
+/** Certificates already proven to belong to the account's private key, per account. */
+const publicKeys = new Map<string, Promise<CryptoKey>>()
+
+/**
+ * The cached suite's certificate, once it proved to match the unlocked private key. Sync takes the
+ * certificate from the server, so a compromised server could swap in its own; only the private key,
+ * which only the master password opens, cannot be swapped.
+ */
+async function publicKey({ account, client, privateKey }: Context): Promise<CryptoKey> {
+	const suite = (await browser.storage.local.get(suiteKey(account.id)))[suiteKey(account.id)] as CachedSuite | undefined
+	if (!suite) throw new WriteFailure({ code: 'locked' })
+	// The server stamps a write with its active suite, whatever key it was encrypted to, so after a
+	// key change on another device the item would open for no one. The sync locks on the new suite.
+	const active = (await client.listSuites()).find((row) => row.status === 'active')
+	if (active && active.id !== suite.id) {
+		await syncAfterWrite(account.id)
+		throw new WriteFailure({ code: 'locked' })
+	}
+	const cacheKey = `${account.id}\n${suite.certificate}`
+	let key = publicKeys.get(cacheKey)
+	if (!key) {
+		key = matchingKey(suite.certificate, privateKey)
+		publicKeys.set(cacheKey, key)
+		key.catch(() => publicKeys.delete(cacheKey))
+	}
+	return key
+}
+
+async function matchingKey(certificate: string, privateKey: CryptoKey): Promise<CryptoKey> {
+	const key = await importPublicKey(certificate)
+	const probe = toBase64(crypto.getRandomValues(new Uint8Array(32)))
+	const opened = await rsaDecrypt(await rsaEncrypt(probe, key), privateKey).catch(() => null)
+	if (opened !== probe) {
+		console.error('[keepiq] the suite certificate does not match the unlocked key; refusing to encrypt to it')
+		throw new WriteFailure({ code: 'key_mismatch' })
+	}
+	return key
+}
+
+function writeError(error: unknown): VaultWriteError {
+	if (error instanceof WriteFailure) return error.error
+	if (error instanceof SessionRevoked) return { code: 'session_revoked' }
+	if (error instanceof VaultWriteLocked) return { code: 'write_locked' }
+	if (error instanceof Offline) return { code: 'offline' }
+	if (error instanceof ApiError) {
+		if (error.status === 400) return { code: 'invalid' }
+		// A blocked suite, a folder someone else owns and a read-only copy are all a bare refusal; only a policy names itself.
+		if (error.refused) return { code: error.code ? 'policy' : 'forbidden' }
+		if (error.status === 404) return { code: 'not_found' }
+		if (error.status === 409) return { code: 'conflict' }
+		if (error.status >= 500) return { code: 'server_error' }
+	}
+	console.error('[keepiq] write failed', error)
+	return { code: 'unknown' }
+}
+
+/** Runs one request, records whether the server answered, and replies once the sync holds the change. */
+async function run<T>(write: (context: Context) => Promise<T>, then: 'sync' | 'reply', accountId: string | undefined): Promise<WriteResult<T>> {
+	let ctx: Context
+	try {
+		ctx = await context(accountId)
+	} catch (error) {
+		return { ok: false, error: writeError(error) }
+	}
+	try {
+		const value = await write(ctx)
+		await recordOutcome(ctx.account.id, null)
+		if (then === 'sync') await syncAfterWrite(ctx.account.id)
+		return { ok: true, value }
+	} catch (error) {
+		// A refusal of our own may come before any request, so it says nothing about the server.
+		if (!(error instanceof WriteFailure)) await recordOutcome(ctx.account.id, error)
+		return { ok: false, error: writeError(error) }
+	}
+}
+
+const secretPath = (id: string) => `/api/v1/secrets/${encodeURIComponent(id)}`
+const folderPath = (id: string) => `/api/v1/folders/${encodeURIComponent(id)}`
+
+async function typeNameOf(accountId: string, typeId: string | null): Promise<string | undefined> {
+	return (await readSnapshot(accountId))?.types.find((type) => type.id === typeId)?.name
+}
+
+function isRestricted(row: Pick<SecretRow, 'useOnly' | 'readOnly' | 'accessExpiresAt'>, purpose: 'edit' | 'clone'): boolean {
+	return row.useOnly === true || row.readOnly === true || (purpose === 'clone' && !!row.accessExpiresAt)
+}
+
+/** Fresh from the server, not the cache: a stale `additionalFields` saved back would drop members (ADR-002). */
+export function fetchItem(id: string, purpose: 'edit' | 'clone' = 'edit', accountId?: string): Promise<WriteResult<EditableItem>> {
+	return run(async ({ account, client, privateKey }) => {
+		let row: OpenSecretRow
+		try {
+			row = await client.keepiq<OpenSecretRow>('GET', secretPath(id))
+		} catch (error) {
+			// The list still shows it until the next sync says otherwise.
+			if (error instanceof ApiError && error.status === 404) void syncAfterWrite(account.id)
+			// A row on a blocked suite is refused, not sent blocked; the sync marks it, with its reason as a code.
+			if (error instanceof ApiError && error.refused) {
+				await syncAfterWrite(account.id)
+				const cached = (await readSnapshot(account.id))?.secrets.find((secret) => secret.id === id)
+				if (cached?.blocked) throw new WriteFailure({ code: 'blocked', reason: cached.blockedReason })
+			}
+			throw error
+		}
+		// A use-only value is never shown, a read-only copy never changed, and a clone of any
+		// restricted copy would be a permanent, unrestricted one (Keepiq `use-only-shares`, `expiring-shares`).
+		if (isRestricted(row, purpose)) throw new WriteFailure({ code: 'restricted' })
+		const passkey = await typeNameOf(account.id, row.typeId) === 'passkey'
+		try {
+			const additional = row.additionalFields ? parseObject(await rsaDecrypt(row.additionalFields, privateKey)) : {}
+			if (!additional) throw new Error('additionalFields is not an object')
+			const item: EditableItem = {
+				id: row.id,
+				typeId: row.typeId ?? '',
+				name: row.name,
+				url: row.url,
+				folderId: row.folderId,
+				key: passkey ? '' : await rsaDecrypt(row.key, privateKey),
+				login: row.login ? await rsaDecrypt(row.login, privateKey) : null,
+				additionalFields: Object.fromEntries(Object.entries(additional).map(([name, value]) => [name, typeof value === 'string' ? value : JSON.stringify(value)])),
+				updatedAt: row.updatedAt,
+			}
+			if (passkey) item.keyWithheld = true
+			return item
+		} catch (error) {
+			console.error('[keepiq] could not open', id, 'for editing', error)
+			throw new WriteFailure({ code: 'unreadable' })
+		}
+	}, 'reply', accountId)
+}
+
+function isDraft(draft: unknown): draft is ItemDraft {
+	const d = draft as Partial<ItemDraft> | null
+	return typeof d?.name === 'string' && typeof d.typeId === 'string' && typeof d.key === 'string'
+		&& typeof d.additionalFields === 'object' && d.additionalFields !== null
+}
+
+export function createItem(draft: ItemDraft, accountId?: string): Promise<WriteResult<{ id: string }>> {
+	return run(async (ctx) => {
+		if (!isDraft(draft)) throw new WriteFailure({ code: 'invalid' })
+		const key = await publicKey(ctx)
+		const body: Record<string, unknown> = {
+			name: draft.name,
+			url: draft.url || null,
+			typeId: draft.typeId,
+			folderId: draft.folderId,
+			key: await rsaEncrypt(draft.key, key),
+			additionalFields: await rsaEncrypt(JSON.stringify(draft.additionalFields), key),
+		}
+		if (draft.login) body.login = await rsaEncrypt(draft.login, key)
+		const row = await ctx.client.keepiq<SecretRow>('POST', '/api/v1/secrets', body)
+		return { id: row.id }
+	}, 'sync', accountId)
+}
+
+/** A sparse `PUT`: only what the patch holds is encrypted and sent. */
+export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string, accountId?: string): Promise<WriteResult<{ id: string }>> {
+	return run(async (ctx) => {
+		const { account, client } = ctx
+		const cached = (await readSnapshot(account.id))?.secrets.find((secret) => secret.id === id)
+		// Its limits and type decide what may be written, so an item the cache does not hold is not.
+		if (!cached) throw new WriteFailure({ code: 'not_found' })
+		// What the server enforces too, refused here so no ciphertext is made for it.
+		if (cached.useOnly) throw new WriteFailure({ code: 'restricted' })
+		if (cached.readOnly && Object.keys(patch).some((field) => field !== 'folderId')) throw new WriteFailure({ code: 'restricted' })
+		const body: Record<string, unknown> = {}
+		if (patch.name !== undefined) {
+			if (typeof patch.name !== 'string' || !patch.name.trim()) throw new WriteFailure({ code: 'invalid' })
+			body.name = patch.name
+		}
+		if (patch.typeId) body.typeId = patch.typeId
+		if (patch.url !== undefined) body.url = patch.url || null
+		if (patch.folderId !== undefined) body.folderId = patch.folderId || null
+		let key: Promise<CryptoKey> | undefined
+		const encrypt = async (value: string) => rsaEncrypt(value, await (key ??= publicKey(ctx)))
+		// A passkey's credential is only ever written by a passkey ceremony.
+		const passkey = await typeNameOf(account.id, cached.typeId) === 'passkey'
+		if (typeof patch.key === 'string' && !passkey) body.key = await encrypt(patch.key)
+		if (patch.login !== undefined) body.login = patch.login ? await encrypt(patch.login) : null
+		if (patch.additionalFields) body.additionalFields = await encrypt(JSON.stringify(patch.additionalFields))
+		if (baseUpdatedAt) body.baseUpdatedAt = baseUpdatedAt
+		await client.keepiq('PUT', secretPath(id), body)
+		return { id }
+	}, 'sync', accountId)
+}
+
+/** Moves the item to Keepiq's trash, which also revokes its shares; restoring is the web app's. */
+export function deleteItem(id: string, accountId?: string): Promise<WriteResult<null>> {
+	return run(async ({ client }) => {
+		await client.keepiq('DELETE', secretPath(id))
+		return null
+	}, 'sync', accountId)
+}
+
+/** The server's own rules (`FolderTreeService`), checked first so a typo costs no round trip. */
+function folderName(name: string): string {
+	const trimmed = typeof name === 'string' ? name.trim() : ''
+	if (!trimmed || trimmed.includes('/')) throw new WriteFailure({ code: 'invalid' })
+	return trimmed
+}
+
+export function createFolder(name: string, parentId: string | null, accountId?: string): Promise<WriteResult<{ id: string }>> {
+	return run(async ({ client }) => {
+		const row = await client.keepiq<FolderRow>('POST', '/api/v1/folders', { name: folderName(name), parentId })
+		return { id: row.id }
+	}, 'sync', accountId)
+}
+
+export function renameFolder(id: string, name: string, accountId?: string): Promise<WriteResult<null>> {
+	return run(async ({ client }) => {
+		await client.keepiq('PUT', folderPath(id), { name: folderName(name) })
+		return null
+	}, 'sync', accountId)
+}
+
+export function folderChildren(id: string, accountId?: string): Promise<WriteResult<FolderChildren>> {
+	return run(({ client }) => client.keepiq<FolderChildren>('GET', `${folderPath(id)}/children`), 'reply', accountId)
+}
+
+/** Keepiq's three delete modes (`FolderDeletionService::delete`): empty, a leaf with items, or a folder with subfolders. */
+export function deleteFolder(id: string, plan: FolderDeletePlan, accountId?: string): Promise<WriteResult<null>> {
+	return run(async ({ client }) => {
+		if (plan.mode === 'cascade') await client.keepiq('DELETE', `${folderPath(id)}?cascade=${plan.cascade === 'delete' ? 'delete' : 'move'}`)
+		else if (plan.mode === 'resolution') await client.keepiq('DELETE', folderPath(id), { directSecrets: plan.directSecrets, subfolders: plan.subfolders })
+		else await client.keepiq('DELETE', folderPath(id))
+		return null
+	}, 'sync', accountId)
+}
diff --git a/docs/browser-extension/privacy.md b/docs/browser-extension/privacy.md
index f4dc0e8fe..bb0ad1bbe 100644
--- a/docs/browser-extension/privacy.md
+++ b/docs/browser-extension/privacy.md
@@ -11,7 +11,8 @@ Keepiq opens your Keepiq vault in your browser. Your vault lives on your organis
 The extension talks to your own Nextcloud, and to nobody else. It sends your server:
 
 - your Nextcloud user name and app password, with every request, to sign in;
-- requests for your profile (name, email address and picture), your encrypted vault key and your encrypted vault.
+- requests for your profile (name, email address and picture), your encrypted vault key, your encrypted vault and your Keepiq preferences, of which it uses the default item type;
+- the items and folders you add, change or delete. An item's secrets, user name, notes and additional fields are encrypted in the browser first; its name, web address, type and folder go as you typed them, as Keepiq stores them. Folder names are not encrypted.
 
 Your master password never leaves the browser. Neither do your decrypted secrets.
 
@@ -29,6 +30,10 @@ Your master password and your decrypted secrets are never stored. Decrypted valu
 
 Your theme choice, for every account. It stays when you log out.
 
+Per account, your default item type from Keepiq, with the vault copy, and whether you dismissed the notice that folder names are not encrypted, until you remove the account.
+
+An item you are adding or editing stays in memory only, and is gone when you save, leave the form or close the extension.
+
 When you are halfway through adding an account, the extension remembers the server address and user name until the browser closes, so closing the popup does not lose them. It never remembers the app password you typed.
 
 ## What the extension reads in your browser
diff --git a/docs/browser-extension/using.md b/docs/browser-extension/using.md
index b42a13ccb..9de1a4a0e 100644
--- a/docs/browser-extension/using.md
+++ b/docs/browser-extension/using.md
@@ -2,7 +2,7 @@
 
 The Keepiq browser extension opens your Keepiq vault from your browser's toolbar. You can find your logins, copy a user name, password or one-time code, and open the site. The extension opens your vault with your master password, in the browser. Your Nextcloud only ever sees encrypted values.
 
-The extension is in development. You can browse and copy today; filling in logins, saving new ones, the generator and Send come in later updates (see [Coming next](#coming-next)).
+The extension is in development. You can browse, copy, add, edit and delete today; filling in logins, saving them as you sign up, the generator and Send come in later updates (see [Coming next](#coming-next)).
 
 ## Getting the extension
 
@@ -84,7 +84,7 @@ Each item has three actions:
 
 - **Launch** opens the item's website in a new tab.
 - **Copy** copies the user name, the password or the current one-time code. Copied values are cleared from the clipboard after 30 seconds.
-- **More** has **View**. Its other actions, Edit, Clone, Move to folder and Delete, are shown but come in a later update.
+- **More** has **View**, **Edit**, **Clone**, **Move to folder** and **Delete**.
 
 The extension shows a type icon for each item. It does not load website icons, so no site learns which accounts you have.
 
@@ -96,13 +96,41 @@ An authenticator item shows its current code and counts down to the next one.
 
 A **blocked** item cannot be opened. Its key was revoked or compromised. The item says why and links to the web app, where you can see what to do.
 
+### Adding an item
+
+**New** at the top of the vault, next to the pop-out button, opens a new item. It starts with the type you chose as your default in Keepiq, or **Login**, and with the address of the site in your current tab. Pick a type, give the item a name and fill in what you need: a login has a user name and password, a card and an identity have their own fields, and an authenticator takes the setup key or `otpauth://` link the site gave you. **Additional fields** holds anything else, such as a PIN, and **Notes** holds free text. **Save** opens the new item.
+
+Passkeys are not added here; they are made when you sign up on a website with one.
+
+### Editing an item
+
+**Edit** on an item, or in its **More** menu, opens it with the values from your server, not from the copy in your browser, so nothing someone else changed meanwhile is lost. Only what you changed is saved. When the item was changed elsewhere while you were editing, the extension says so and keeps what you typed; go back and edit it again.
+
+**Clone** opens a new item with the same values and " - Clone" after the name. **Move to folder** moves the item without opening it. Leaving a form with changes asks whether to discard them; closing the extension drops them.
+
+A passkey item only lets you change its name, folder and website.
+
+An item someone shared with you keeps the limits they set. One shared for signing in only shows its user name but never its password or fields, and can't be edited, cloned or moved. One shared from another organisation can only be moved, and one whose access ends on a date can't be cloned. A password you change on an item you shared doesn't reach the people you shared it with yet; change it in the Keepiq web app so they get it too.
+
+### Deleting an item
+
+**Delete** asks first, then moves the item to Keepiq's trash, which also stops sharing it. You can restore it from the trash in the Keepiq web app until your organisation's retention ends, 30 days unless an admin changed it; after that it is gone for good.
+
+### Folders
+
+Open **Settings**, **Vault**, **Folders** to add, rename and delete folders. Folders can hold folders; **Add folder** in a folder's menu makes one inside it. A folder name cannot contain `/`. You can also add a folder while choosing one for an item.
+
+Deleting a folder that holds items asks whether to delete them too or move them to the folder above. The count it shows includes archived items and items in the trash, which go the same way. A folder with folders inside asks, for each of them, whether to keep it (it moves up a level), move its items up, or delete it.
+
+Folder names are not encrypted in Keepiq, so pick names you don't mind your server seeing.
+
 ### Pop out
 
 The pop-out button at the top opens the extension in its own window, which stays open while you work in the browser. Suggestions keep following the tab you opened it from.
 
 ## Offline
 
-The extension keeps an encrypted copy of your vault in the browser. Without a connection you can still unlock, search, open and copy. The vault shows **Offline** and when it last synced; **Sync now** tries again.
+The extension keeps an encrypted copy of your vault in the browser. Without a connection you can still unlock, search, open and copy. The vault shows **Offline** and when it last synced; **Sync now** tries again. Adding, changing and deleting need the connection, so they wait until it is back.
 
 The extension checks your server for changes every 15 minutes while the vault is unlocked, and when you open it after a while. When your master password or vault key changed in Keepiq, the extension locks and asks for your current master password.
 
@@ -122,7 +150,6 @@ The extension talks to your own Nextcloud and sends nothing to Conduction. It ha
 
 - **Fill in logins** on websites, and save new logins as you sign up.
 - **Passkeys.** Sign in to websites with the passkeys in your vault.
-- **Adding and editing** items in the extension.
 - **Generator and Send**, as in the web app.
 - **More settings:** the lock delay, a PIN and when the clipboard is cleared.
 - **Chrome Web Store and Firefox Add-ons.** Install and update the extension from a store.

From 75fde45b123f222295b6c5ee872af4febb36b59f Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Mon, 12 Oct 2026 15:03:36 +0200
Subject: [PATCH 5/9] fix(extension): read a 409 to a folder delete plan as
 nothing deleted (keepiq#1248)

Keepiq now refuses a folder delete before it moves or purges anything, so the dialog no longer warns that items may already have moved. It still checks the names it can see before sending, and syncs on a 409 so that check can name the clash; ADR-003 and the ext-vault-edit design and spec say the delete is all or nothing.
---
 .../entrypoints/popup/views/settings/FolderManager.tsx       | 5 ++---
 .../entrypoints/popup/views/settings/Settings.test.tsx       | 4 ++--
 browser-extension/locales/en.yml                             | 2 +-
 browser-extension/locales/nl.yml                             | 2 +-
 .../openspec/architecture/adr-003-keepiq-api-contract.md     | 2 +-
 browser-extension/openspec/changes/ext-vault-edit/design.md  | 2 +-
 .../changes/ext-vault-edit/specs/folder-management/spec.md   | 4 ++--
 browser-extension/openspec/changes/ext-vault-edit/tasks.md   | 1 +
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx b/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
index a2412df13..3f5d388e4 100644
--- a/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/FolderManager.tsx
@@ -148,8 +148,7 @@ function DeleteFolderDialog({ folder, snapshot, onDeleted, onCancel }: { folder:
 		setBusy(false)
 		if (reply?.ok) return onDeleted()
 		if (reply?.error.code === 'conflict' && plan.mode === 'resolution') {
-			// A kept subfolder's name is taken one level up. The server checks that only after it moved or
-			// purged the direct items, so the vault may already have changed: sync, and say so.
+			// The cache missed a folder one level up with a kept subfolder's name. Nothing changed; syncing lets the check below name it.
 			syncNow()
 			return setFailure({ text: i18n.t('writeErrors.keepClashAfter'), retry: 'children' })
 		}
@@ -185,7 +184,7 @@ function DeleteFolderDialog({ folder, snapshot, onDeleted, onCancel }: { folder:
 		)
 	}
 	const { children, directSecrets, subfolders } = state
-	// Caught here because the server finds it only after moving or purging the direct items.
+	// Caught here, so the choice can change before anything is sent.
 	const taken = new Set(snapshot.folders.filter((f) => f.parentId === folder.parentId && f.id !== folder.id).map((f) => f.name.toLowerCase()))
 	const clashes = new Set(children.subfolders.filter((sub) => (subfolders[sub.id] ?? 'keep') === 'keep' && taken.has(sub.name.toLowerCase())).map((sub) => sub.id))
 	return (
diff --git a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
index 26bd004bf..2ff7b2843 100644
--- a/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
+++ b/browser-extension/entrypoints/popup/views/settings/Settings.test.tsx
@@ -245,7 +245,7 @@ describe('Folders', () => {
 		expect(sentOf(sent, 'folder.delete')).toEqual([])
 	})
 
-	it('says so, syncs and stops when the server finds the name clash anyway', async () => {
+	it('says nothing was deleted, syncs and stops when the server finds the name clash anyway', async () => {
 		const children = { directSecretCount: 1, subfolders: [{ id: 'c', name: 'Clients', secretCount: 0, subfolderCount: 0 }] }
 		const { sent, user } = await openFolders({
 			snapshot: snapshotReply({ folders: [work, clients] }),
@@ -253,7 +253,7 @@ describe('Folders', () => {
 		})
 		await choose(user, 'Work', 'Delete')
 		await user.click(await within(dialog()).findByRole('button', { name: 'Delete' }))
-		expect(await within(dialog()).findByText(/^A folder you chose to keep has the same name/)).toBeTruthy()
+		expect(await within(dialog()).findByText(/^A folder you chose to keep has the same name.*, so nothing was deleted\./)).toBeTruthy()
 		expect(sentOf(sent, 'folder.delete')).toHaveLength(1)
 		expect(sentOf(sent, 'folder.children')).toHaveLength(1)
 		await waitFor(() => expect(sentOf(sent, 'vault.sync')).toHaveLength(1))
diff --git a/browser-extension/locales/en.yml b/browser-extension/locales/en.yml
index bafa8ed74..0f81a81ad 100644
--- a/browser-extension/locales/en.yml
+++ b/browser-extension/locales/en.yml
@@ -194,7 +194,7 @@ writeErrors:
   policy: Your organisation's policy does not allow this change
   accountChanged: You switched to another account meanwhile, so nothing was saved. Switch back to save it.
   keepClash: A folder named {name} already exists one level up. Choose Move items to parent or Delete for it, or rename one of them first.
-  keepClashAfter: A folder you chose to keep has the same name as one a level up, so the folder was not deleted. Its own items may already have been moved or deleted. Check the choices again.
+  keepClashAfter: A folder you chose to keep has the same name as one a level up, so nothing was deleted. Check the choices again.
   invalid: Keepiq refused this change
   stale: This item was changed elsewhere. Go back and edit it again to see the latest version.
   itemGone: This item no longer exists
diff --git a/browser-extension/locales/nl.yml b/browser-extension/locales/nl.yml
index d38888851..131e2cadc 100644
--- a/browser-extension/locales/nl.yml
+++ b/browser-extension/locales/nl.yml
@@ -193,7 +193,7 @@ writeErrors:
   policy: Het beleid van je organisatie staat deze wijziging niet toe
   accountChanged: Je bent intussen naar een ander account gewisseld, dus er is niets opgeslagen. Wissel terug om het op te slaan.
   keepClash: Er bestaat al een map {name} één niveau hoger. Kies daarvoor Items naar bovenliggende map of Verwijderen, of wijzig eerst een van de namen.
-  keepClashAfter: Een map die je wilde behouden heeft dezelfde naam als een map één niveau hoger, dus de map is niet verwijderd. De items erin kunnen al verplaatst of verwijderd zijn. Controleer de keuzes opnieuw.
+  keepClashAfter: Een map die je wilde behouden heeft dezelfde naam als een map één niveau hoger, dus er is niets verwijderd. Controleer de keuzes opnieuw.
   invalid: Keepiq heeft deze wijziging geweigerd
   stale: Dit item is ergens anders gewijzigd. Ga terug en bewerk het opnieuw om de nieuwste versie te zien.
   itemGone: Dit item bestaat niet meer
diff --git a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
index ceeffab63..a670e9991 100644
--- a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
+++ b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
@@ -27,7 +27,7 @@ All paths relative to the base URL. All require the Basic auth above unless mark
 | Full snapshot | `GET /api/v1/offline/manifest` | `{suite, secrets, folders, types, syncedAt}`. Unpaginated. Refused (428) when the admin disabled offline caching, 404 when no active suite. `syncedAt` is a server timestamp, not a cursor. Rows never use the blocked shape here. Secrets stop at 1000 by design (keepiq#1233); a full 1000 means page instead. Rows carry no `migrationError` (keepiq#1235). Under the two-factor policy `suite` is `null` and `unlockBlocked` is set. |
 | Secret CRUD | `GET/PUT/DELETE /api/v1/secrets/{id}`, `POST /api/v1/secrets` | Create takes `name` (required), `key` (required ciphertext), `url`, `typeId`, `folderId`, `login`, `additionalFields`; returns 201 with the row. `name` is at most 255 characters. `PUT` is a sparse patch: only fields present in the body change, `null` clears a field. With `baseUpdatedAt` it answers 409 when the stored `updatedAt` differs (whole seconds); without it the last write wins. Since 2026-09-30 `DELETE` moves the secret to the trash (`trashed_at`) and revokes every share of it, returning `{"status":"deleted","trashed":true}`; `POST …/restore` and `DELETE …/purge` restore or purge it, and a daily job purges after the admin's `trash_retention_days` (default 30). Trashed secrets are left out of lists and the manifest. |
 | Refusals | any route | The OCS controllers (secrets, folders, the manifest, suites, types) refuse with 428, not 403: Nextcloud turns a 403 there into an HTTP 200 envelope, so `OcsRefusalMiddleware` re-statuses it. The body keeps `message` and adds `error`, a vault policy's code or else `forbidden`. Plain controllers (`DELETE /api/v1/secrets/{id}`, settings) still answer 403, with a policy's `code` when there is one. A blocked suite, a folder someone else owns and a read-only copy all come without a code, so clients cannot tell those apart. The web app treats both statuses alike (`src/utils/refusal.js`). The middleware's comment cites measurements on Nextcloud 35 from 2026-10-04; the manifest's 428 was checked on the stable35 dev server on 2026-10-12. The key-proof guard (`VaultKeyProofMiddleware`) also answers 428, with `error: key_proof_required`, but on none of the routes the extension calls. |
-| Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Names are trimmed and refuse `/`; a duplicate sibling is 409. Children: `{directSecretCount, subfolders: [{id, name, secretCount, subfolderCount}]}`. Delete: an empty folder needs nothing, a leaf with items `?cascade=delete|move` (409 without), a folder with subfolders a JSON body `{directSecrets: 'delete'|'move', subfolders: {<id>: 'delete'|'move'|'keep'}}` naming every direct subfolder (409 without, 400 when one is missing). Folder deletes are immediate, with no trash, and count and delete archived and trashed items too. They are not transactional: a kept subfolder whose name is taken one level up answers 409 after the direct items were already moved or purged (keepiq#1248). |
+| Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Names are trimmed and refuse `/`; a duplicate sibling is 409. Children: `{directSecretCount, subfolders: [{id, name, secretCount, subfolderCount}]}`. Delete: an empty folder needs nothing, a leaf with items `?cascade=delete|move` (409 without), a folder with subfolders a JSON body `{directSecrets: 'delete'|'move', subfolders: {<id>: 'delete'|'move'|'keep'}}` naming every direct subfolder (409 without, 400 when one is missing). Folder deletes are immediate, with no trash, and count and delete archived and trashed items too. They are all or nothing: a refusal, such as a kept subfolder whose name is taken one level up (409), comes before anything is moved or purged (keepiq#1248). |
 | Types | `GET /api/v1/secret-types` | Types are rows, resolve `typeId` from here. |
 | Sends | `POST/GET /api/v1/sends`, `DELETE /api/v1/sends/{id}` | See payload below. |
 | Public send access | `GET /api/v1/public/sends/{token}`, `POST …/access`, `POST …/confirm`, `POST …/failure` | Public, rate limited 15/min. The extension only needs the create side; the web app renders the recipient page. |
diff --git a/browser-extension/openspec/changes/ext-vault-edit/design.md b/browser-extension/openspec/changes/ext-vault-edit/design.md
index 003b37364..ad8ab11d9 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/design.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/design.md
@@ -27,7 +27,7 @@ ext-vault-browse leaves the vault read-only: sync fills `storage.local` with cip
 - **Shared copies keep their limits in two places.** The popup hides what a use-only, read-only or expiring copy may not do, and the background refuses it again: `item.decrypt` withholds a use-only value, `item.fetch` refuses restricted copies by purpose, and `updateItem` refuses what the server would.
 - **Every write names its account.** A pop-out window can show account A while the toolbar popup switched to B, so the background refuses a write whose `accountId` is not the active account rather than saving it into B's vault.
 - **The URL prefill keeps only origin and path.** The URL is stored unencrypted, and a query or fragment can hold a token.
-- **A kept subfolder's name clash is caught before the delete.** The server checks it only after moving or purging the direct items and does not roll back, so the dialog checks the names it can see first, and on a 409 to a plan says items may already have moved, syncs and stops instead of re-reading in a loop.
+- **A kept subfolder's name clash is caught before the delete.** The dialog checks the names it can see first, so the choice can change before anything is sent. A 409 to a plan changed nothing; it says so and syncs, which lets the check name the clash, instead of re-reading in a loop.
 - **A refusal is worded by its code.** Keepiq's OCS routes refuse with 428 and an `error`, the rest with 403 and a `code` (ADR-003); the API client reads both as one refusal, as the web app does. Only a policy refusal names itself; a blocked suite, someone else's folder and a read-only copy look the same, so they get a neutral message.
 - **Shared edits reach only the editor's copy.** The web app's per-recipient fan-out is `ext-share-sync`.
 - **Server messages are never shown.** ext-i18n words every error from a code, so 400 and 409 get the extension's own text, chosen by what was being written.
diff --git a/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md b/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
index 2a004d1d8..b11df33c8 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/specs/folder-management/spec.md
@@ -102,11 +102,11 @@ The extension SHALL, for a folder with subfolders, call `GET /api/v1/folders/{id
 #### Scenario: Kept subfolder's name is taken one level up
 - **GIVEN** "Work" holds the subfolder "Clients" and a root folder "Clients" exists
 - **WHEN** the resolution dialog for "Work" leaves "Clients" on Keep
-- **THEN** it MUST say "A folder named Clients already exists one level up…" and disable Delete, because the server finds the clash only after moving or purging the direct items
+- **THEN** it MUST say "A folder named Clients already exists one level up…" and disable Delete before anything is sent
 
 #### Scenario: Server finds the clash anyway
 - **GIVEN** the cache missed the clashing name and the server answers 409 to a resolution plan
-- **THEN** the dialog MUST say the folder was not deleted and its own items may already have moved or gone, start a sync, and offer Retry, which re-reads the children
+- **THEN** the dialog MUST say nothing was deleted, start a sync, and offer Retry, which re-reads the children
 
 ### Requirement: Folder picker
 The extension SHALL provide a folder picker used by the add-item form, the edit form and Move, listing "No folder" first and then the folder tree with indentation, the current folder marked, and a "New folder" entry at the end. Selection MUST return the `folderId` (or `null`) to the caller without a request.
diff --git a/browser-extension/openspec/changes/ext-vault-edit/tasks.md b/browser-extension/openspec/changes/ext-vault-edit/tasks.md
index e1ae1c30d..3d100759b 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/tasks.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/tasks.md
@@ -44,6 +44,7 @@
 - [x] 4.13 Read Keepiq's 428 refusal like a 403, with its `error` as the code, in writes and in the manifest fallback.
 - [x] 4.14 Answer an overtaken snapshot read with the newer one, and leave "New folder" for the picker once the folder exists.
 - [x] 4.15 Sync when the fresh fetch for Edit or Clone is refused, and name the blocked reason when the sync marks the item blocked.
+- [x] 4.16 Read a 409 to a folder delete plan as nothing deleted, now that the server checks everything first (keepiq#1248).
 
 ## 5. Docs and checks
 

From e30b4048dac32aec3f5249edb5bb04cdec9ec272 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Fri, 16 Oct 2026 13:30:55 +0200
Subject: [PATCH 6/9] feat(extension): save an edit with every copy of a shared
 item in one request (ext-share-sync)

A change to the password, username or fields of an item saves through Keepiq's `PUT /api/v1/secrets/{id}/share-save` (keepiq#1254), which writes the editor's row, every local copy and every partner share in one transaction, or nothing. The background reads `write-context` for the path, sends empty lists first, and on 409 `incomplete` encrypts the change for each holder the server names, staging above 100 entries. A copy holder without a write grade saves only their own copy. A failed save keeps the form open with the reason; nothing about a save outlives its request, so there is no Try again record, kept result or save queue.

Partner shares get the whole value: the typed fields plus what the edit form showed, never a fresh row. Their certificates are verified in the background against the pinned partner root (a port of the web app's verifier, stricter in places, tested against the web app's fixture). A refusal suspends that share, an unreachable partner stops the save until the user saves without them, and verified certificates are kept in memory for five minutes. The item's detail notes an own-copy save, partners left to the owner, and paused shares.

The edit form shows every field a save vouches for: the username on every type, a note's notes and a card or identity key that isn't JSON. Multi-line secrets open masked and keep their line breaks, and spell check is off on every popup field.
---
 .gitleaks.toml                                |   5 +-
 browser-extension/ARCHITECTURE.md             |  14 +-
 browser-extension/SECURITY.md                 |  14 +-
 .../components/AdditionalFieldsEditor.tsx     |  16 +-
 .../popup/components/MaskedField.tsx          |   5 +-
 .../popup/components/SearchField.tsx          |   3 +-
 .../popup/components/ShareSaveNote.test.tsx   |  55 ++
 .../popup/components/ShareSaveNote.tsx        |  21 +
 .../entrypoints/popup/components/TextArea.tsx |  53 +-
 .../popup/components/TextField.tsx            |   9 +-
 .../popup/components/components.test.tsx      | 128 +++-
 browser-extension/entrypoints/popup/errors.ts |  15 +-
 .../entrypoints/popup/hooks/useItemDraft.ts   |   9 +-
 browser-extension/entrypoints/popup/popup.css |  19 +
 .../entrypoints/popup/testing.ts              |   5 +-
 .../popup/views/AddAccount.test.tsx           |   8 +
 .../entrypoints/popup/views/AddAccount.tsx    |   4 +-
 .../popup/views/ItemDetail.test.tsx           |  93 ++-
 .../entrypoints/popup/views/ItemDetail.tsx    |  48 +-
 .../entrypoints/popup/views/ItemForm.test.tsx | 417 ++++++++++-
 .../entrypoints/popup/views/ItemForm.tsx      | 137 ++--
 .../entrypoints/popup/views/Shell.test.tsx    |  98 +++
 .../entrypoints/popup/views/Shell.tsx         |  23 +-
 browser-extension/locales/en.yml              |  16 +-
 browser-extension/locales/nl.yml              |  16 +-
 browser-extension/openspec/README.md          |   2 +-
 .../adr-002-key-lifetime-and-vault-cache.md   |  13 +-
 .../adr-003-keepiq-api-contract.md            |   6 +-
 .../ext-autofill/specs/login-capture/spec.md  |  10 +-
 .../openspec/changes/ext-autofill/tasks.md    |   2 +-
 .../changes/ext-share-sync/.openspec.yaml     |   2 +
 .../openspec/changes/ext-share-sync/design.md | 109 +++
 .../changes/ext-share-sync/proposal.md        |  52 +-
 .../ext-share-sync/specs/item-editing/spec.md |  55 ++
 .../ext-share-sync/specs/share-sync/spec.md   | 216 ++++++
 .../openspec/changes/ext-share-sync/tasks.md  |  48 ++
 .../specs/item-detail/spec.md                 |   4 +-
 .../openspec/changes/ext-vault-edit/design.md |   6 +-
 .../ext-vault-edit/specs/item-editing/spec.md |  16 +-
 browser-extension/src/accounts/store.ts       |   3 +
 browser-extension/src/api/client.ts           |   6 +-
 .../src/background/background.test.ts         |  24 +-
 .../src/background/requests.test.ts           |  48 +-
 browser-extension/src/background/requests.ts  |   6 +-
 browser-extension/src/crypto/crypto.test.ts   |  52 +-
 .../src/crypto/federated-certificate.test.ts  | 523 +++++++++++++
 .../src/crypto/federated-certificate.ts       | 340 +++++++++
 browser-extension/src/crypto/index.ts         |   3 +-
 browser-extension/src/crypto/rsa.ts           |  39 +-
 browser-extension/src/messages.ts             |  48 +-
 .../src/testing/ca-constraints-chain.json     |  27 +
 .../testing/generate-ca-constraints-chain.sh  | 110 +++
 browser-extension/src/testing/vectors.ts      |  25 +
 browser-extension/src/vault/fields.test.ts    | 141 +++-
 browser-extension/src/vault/fields.ts         | 125 +++-
 browser-extension/src/vault/key-store.test.ts |   7 +-
 browser-extension/src/vault/key-store.ts      |   7 +-
 browser-extension/src/vault/payloads.test.ts  |   9 +-
 browser-extension/src/vault/payloads.ts       |   3 +
 .../src/vault/share-save.test.ts              | 702 ++++++++++++++++++
 browser-extension/src/vault/share-save.ts     | 321 ++++++++
 .../src/vault/verified-partners.test.ts       |  61 ++
 .../src/vault/verified-partners.ts            |  46 ++
 .../src/vault/write-error.test.ts             |  26 +
 browser-extension/src/vault/write-error.ts    |  27 +
 browser-extension/src/vault/write.test.ts     | 606 ++++++++++++++-
 browser-extension/src/vault/write.ts          | 194 +++--
 docs/browser-extension/using.md               |  11 +-
 68 files changed, 4991 insertions(+), 321 deletions(-)
 create mode 100644 browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
 create mode 100644 browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/.openspec.yaml
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/design.md
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
 create mode 100644 browser-extension/openspec/changes/ext-share-sync/tasks.md
 create mode 100644 browser-extension/src/crypto/federated-certificate.test.ts
 create mode 100644 browser-extension/src/crypto/federated-certificate.ts
 create mode 100644 browser-extension/src/testing/ca-constraints-chain.json
 create mode 100644 browser-extension/src/testing/generate-ca-constraints-chain.sh
 create mode 100644 browser-extension/src/vault/share-save.test.ts
 create mode 100644 browser-extension/src/vault/share-save.ts
 create mode 100644 browser-extension/src/vault/verified-partners.test.ts
 create mode 100644 browser-extension/src/vault/verified-partners.ts
 create mode 100644 browser-extension/src/vault/write-error.test.ts
 create mode 100644 browser-extension/src/vault/write-error.ts

diff --git a/.gitleaks.toml b/.gitleaks.toml
index d9bb0d4be..291ed5f64 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -3,11 +3,12 @@
 # sdk/testdata/ holds a throwaway RSA key and values encrypted to it. They are
 # conformance vectors that every client library and the server decrypt in
 # tests; the key protects nothing and is labelled TEST ONLY in each file.
+# The browser extension's CA-constraints fixture holds throwaway keys of the same kind.
 title = "keepiq"
 
 [extend]
 useDefault = true
 
 [allowlist]
-description = "Test-only conformance vectors for the client libraries"
-paths = ['''^sdk/testdata/''']
+description = "Test-only conformance vectors and certificate fixtures"
+paths = ['''^sdk/testdata/''', '''^browser-extension/src/testing/ca-constraints-chain\.json$''']
diff --git a/browser-extension/ARCHITECTURE.md b/browser-extension/ARCHITECTURE.md
index c36db5f88..37eead68b 100644
--- a/browser-extension/ARCHITECTURE.md
+++ b/browser-extension/ARCHITECTURE.md
@@ -14,7 +14,7 @@ How the extension is put together. Decisions live in the ADRs under [openspec/ar
 ## Modules
 
 - `src/api/`: the Keepiq client, the only code that calls `fetch`. Basic auth on the app password, `credentials: 'omit'`, a 401 that logs the account out ([ADR-003](openspec/architecture/adr-003-keepiq-api-contract.md)).
-- `src/crypto/`: PBKDF2 key derivation, AES-GCM envelope and RSA-OAEP, byte compatible with the web app (tested against `../tests/vectors/crypto/`).
+- `src/crypto/`: PBKDF2 key derivation, AES-GCM envelope and RSA-OAEP, byte compatible with the web app (tested against `../tests/vectors/crypto/`). `federated-certificate.ts` verifies a partner recipient's certificate chain, ported from the web app.
 - `src/accounts/`:
   - `store.ts`: the account list, behind one write queue.
   - `settings.ts`: the per-account timeout settings and the policy clamp.
@@ -30,7 +30,10 @@ How the extension is put together. Decisions live in the ADRs under [openspec/ar
   - `list.ts`: sorting, filtering and the folder tree.
   - `payloads.ts`: parses card, identity and passkey payloads.
   - `fields.ts`: the item form's model, limits and validation; pure, so the popup may use it.
-  - `write.ts`: item and folder writes, the only code that encrypts.
+  - `write.ts`: item and folder writes, the only code that encrypts to the user's own key.
+  - `share-save.ts`: saves a value change with every other copy of a shared item in one share-save.
+  - `verified-partners.ts`: partner certificates a failed save verified, kept in memory for 5 minutes.
+  - `write-error.ts`: maps a failed write to the code the popup words.
   - `url.ts`: the one rule for turning an item URL into a link.
   - `icons.ts`: type icons.
 - `src/background/`:
@@ -51,7 +54,7 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | --- | --- | --- |
 | Popup → background, account actions | `accounts.*`, `vault.unlock`, `vault.lock`, `vault.lockAll`, `vault.status` | `Result`: `{ ok: true, state }` or `{ ok: false, code }` |
 | Popup → background, vault requests | `vault.snapshot`, `vault.sync`, `item.decrypt`, `clipboard.copied`, `popup.popout`, `popup.lastTab.set`, `settings.*` | The typed reply in `PopupReplies`; `undefined` when the background failed |
-| Popup → background, writes | `item.fetch`, `item.create`, `item.update`, `item.delete`, `folder.create`, `folder.rename`, `folder.children`, `folder.delete`, `folder.dismissNotice` | `WriteResult`: `{ ok: true, value }` or `{ ok: false, error }`, after the sync that follows a write |
+| Popup → background, writes | `item.fetch`, `item.create`, `item.update`, `item.delete`, `folder.create`, `folder.rename`, `folder.children`, `folder.delete`, `folder.dismissNotice` | `WriteResult`: `{ ok: true, value }` or `{ ok: false, error }`, after the sync that follows a write; `item.fetch` and `folder.children` reply without one |
 | Background → popup | `vault.changed`, `vault.locked` | None; the popup re-reads |
 | Background → offscreen | `offscreen.clearClipboard` | Whether it cleared |
 | Content → background | `page_ready` | None |
@@ -78,6 +81,7 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | `unlockedAt.<id>`, `lastInteractionAt` | session | Timeout bookkeeping |
 | `popup:lastTab` | session | The popup tab to reopen |
 | `addAccountDraft` | session | Server URL and username while adding an account |
+| `editOpened.<id>` | session | Per edit form, for the 10 newest, keyed by the random `recordId` of the form's fetch: the ciphertext it showed in full, the row's `updatedAt` and the source's `sourceUpdatedAt`; a form's entry goes when its save is accepted, stays after a failed one, and all go when the key is cleared |
 
 Where `storage.session` is missing (Firefox below 115), session values live in background memory instead, and the draft is not kept.
 
@@ -106,7 +110,9 @@ Where `storage.session` is missing (Firefox below 115), session values live in b
 - **The popup sends plaintext,** the background encrypts with the cached suite's certificate, once it proved that certificate matches the unlocked key and the server's active suite is still that one.
 - **Each write names its account,** and is refused when that is no longer the active one.
 - **Shared copies keep their limits** (use-only, read-only, expiring) in the popup and again in the background.
-- **Edit and Clone fetch the item fresh** from the server; Edit saves the changed fields with `baseUpdatedAt`, so a newer version is not overwritten.
+- **Edit and Clone fetch the item fresh** from the server and open it only when its ciphertext matches the vault cache, after one sync on a mismatch (ADR-002); Edit saves the changed fields with `baseUpdatedAt`, so a newer version is not overwritten, and with its fetch's `recordId`, so the save vouches only for what its own form showed.
+- **A changed `key`, `login` or `additionalFields` saves through share-save**, the editor's row and every other copy in one transaction: `write-context` picks the owner path (local copies and partner shares), the copy-editor path (the source and the other copies) or a plain `PUT` of the editor's copy only. The first call carries empty lists; a 409 `incomplete` names what to encrypt for, at most three rounds. Partners get the typed fields plus what the form's `editOpened` record showed, never a fresh row. Any other edit is a plain `PUT`.
+- **A refused save writes nothing** and keeps the form open; when the reply to the final call is lost, the server wrote everything or nothing. Nothing about a save outlives the request but verified partner certificates, kept in background memory for 5 minutes and forgotten on lock, logout and account switch, and the server's version check orders concurrent saves. The `item.update` reply carries `shareSave` when the item's detail has a note to show.
 - **Every write records** whether the server answered, which drives the same offline flag as sync.
 - **A successful write runs a full sync** and replies after it, waiting for a sync that started earlier.
 
diff --git a/browser-extension/SECURITY.md b/browser-extension/SECURITY.md
index e95222224..ceea29594 100644
--- a/browser-extension/SECURITY.md
+++ b/browser-extension/SECURITY.md
@@ -21,6 +21,7 @@ The extension uses the same end-to-end encryption as the Keepiq web app and is b
 | Master password | Nowhere | — |
 | Private key | `storage.session` (memory, cleared on browser restart). Firefox below 115 uses background page memory instead. | Lock, timeout, logout, browser restart, extension reload |
 | Decrypted values, unsaved forms | Popup memory while shown, never the value of a use-only copy | Closing the item, the form or the popup |
+| Ciphertext of the 10 newest edit forms, with the item's and its source's version | `storage.session`, like the private key | That form's accepted save, or 10 newer entries; lock, timeout, logout, account removal, browser restart, extension reload. Closing the form or popup leaves it. |
 | Ciphertext, names, URLs, folders, types | `storage.local` | Logout, account removal, a key change on the server |
 | App password | `storage.local` | Logout, account removal, the server answering 401 |
 | Account list and settings | `storage.local` | Account removal |
@@ -39,6 +40,7 @@ The extension uses the same end-to-end encryption as the Keepiq web app and is b
 ## Server and network
 
 - The extension only talks to your own Nextcloud server. It sends no telemetry and doesn't fetch favicons from websites or icon services, and the Firefox manifest declares no data collection.
+- Every popup field turns off the browser's spell check, so cloud spelling services, such as Chrome's Enhanced spell check or Edge's Microsoft Editor, never receive vault text.
 - Requests go from the background only, with Basic auth on an app password and `credentials: 'omit'`, so browser cookies are never sent.
 - Server URLs must be `https`. Plain `http` is allowed only for `localhost`, `127.0.0.1` and `.test` hosts, for development.
 - Host access is requested per server, when you add an account. The extension holds no other host permissions.
@@ -66,10 +68,18 @@ There is no remote wipe, so these checks stand in for it:
 - The popup sends what you typed to the background, which does all the encryption.
 - Before it encrypts, the extension checks that the server's active key is still the one it holds, and proves the server's certificate belongs to your unlocked key. Otherwise nothing is written.
 - A save goes to the account the popup showed, and is refused when another window switched accounts.
-- Edit fetches the item fresh, sends only what changed, and is refused when a newer version was saved elsewhere.
+- Edit fetches the item fresh, sends only what changed, and is refused when a newer version was saved elsewhere. Edit and Clone only open what your vault already holds for that item, and a save gives partners the fields you didn't touch only as the form showed them in full, under the type the fetch checked. A swap while the form is open changes nothing partners get; a swap before the form opens is not caught (see Known limits, and [ADR-002](openspec/architecture/adr-002-key-lifetime-and-vault-cache.md#sharing)).
 - Shared copies keep their limits: a use-only copy is never shown, copied or changed, a read-only one can only be filed in a folder, and no restricted copy can be cloned.
 - Delete moves an item to Keepiq's trash and ends its shares. A folder delete is immediate, and "Delete items too" deletes them for good.
 
+## Shared items
+
+- A changed password, username or field of a shared item is encrypted again, in the background, for every copy the server lists, and saved in one request: the server writes your row, every copy in your organisation and every partner share together, or nothing. It refuses a save over a newer version of the item, or, for a team editor, of the original.
+- Recipients in your own organisation are trusted as the server lists them, with the certificate it serves, as in the Keepiq web app. A compromised server could list someone you never shared with, or make up a partner share, and get the password, username and fields of any item whose password, username or fields you edit, shared or not. When the form didn't show every part of an item, a partner share stops the save, so such a server gets only what you changed ([ADR-002](openspec/architecture/adr-002-key-lifetime-and-vault-cache.md#sharing)).
+- A recipient at a partner organisation gets nothing until their certificate chains to the partner root your server pinned and names them. Otherwise their share is paused. When their server can't be reached, nothing is saved until you choose to save without them, which pauses their share too.
+- Both your server and the partner's are still trusted for partner recipients: the check catches a certificate for the wrong person, an expired one, or one from another partner, not a server that lies.
+- The decrypted value lives in background memory for that one request. The popup only learns codes and the partner shares paused or not reached, and forgets them when it closes.
+
 ## Clipboard
 
 - Copy happens in the popup, under your click.
@@ -82,6 +92,8 @@ There is no remote wipe, so these checks stand in for it:
 - **The app password** is long-lived. It can't decrypt anything, but it does give read and write access to the ciphertext. You can revoke it from Nextcloud's security settings.
 - **Names, URLs and folders** are stored in plain text on disk, as the server returns them. They reveal which sites you have accounts on, though not the secrets.
 - **While the vault is unlocked,** anyone at the machine can use it, up to the timeout.
+- **The recipient list of a shared item** comes from the server, so editing a shared item trusts it (see Shared items).
+- **A server that swaps another item's value into this one before you open it for editing** is not caught. The form shows that value as this item's, masked if it is a password or another secret, and saving shares it with whoever the server lists. Fields the form doesn't show are never shared this way.
 - **Revocation takes effect on the next contact with the server:** at most the 15-minute sync interval, or sooner when the popup opens.
 - **A share that becomes use-only** shows as use-only after the next full sync: within an hour and a quarter, or at once after unlock or Sync now. The server doesn't change the copy's `updatedAt`, so the quick probe misses it.
 - **Offline caching turned off by an admin:** the extension still caches the vault on disk. Whether it should keep it in session storage instead is still open.
diff --git a/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx b/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
index 3a97a1dd7..55175295f 100644
--- a/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
+++ b/browser-extension/entrypoints/popup/components/AdditionalFieldsEditor.tsx
@@ -1,8 +1,10 @@
+import { useState } from 'react'
 import { i18n } from '#i18n'
-import { customField, type CustomField, type FormErrors } from '@/src/vault/fields'
+import { customField, hasLineBreak, keepLineBreaks, type CustomField, type FormErrors } from '@/src/vault/fields'
 import { fieldErrorText } from '../errors'
 import { Button, IconButton } from './Button'
 import { Icon } from './Icon'
+import { TextArea } from './TextArea'
 import { TextField } from './TextField'
 
 interface Props {
@@ -12,6 +14,14 @@ interface Props {
 	onChange: (fields: CustomField[]) => void
 }
 
+/** Only an opened value can hold a line break, as the single-line input takes none. */
+function FieldValue({ label, value, error, onChange }: { label: string; value: string; error: string | null | undefined; onChange: (value: string) => void }) {
+	const [original] = useState(value)
+	return hasLineBreak(original)
+		? <TextArea label={label} value={value} onChange={(typed) => onChange(keepLineBreaks(typed, original))} error={error} mono concealed />
+		: <TextField label={label} type="password" value={value} onChange={onChange} error={error} autoComplete="off" />
+}
+
 /** Values are masked until revealed; the blob stores no field type, so that is view state only. */
 export function AdditionalFieldsEditor({ fields, errors, onChange }: Props) {
 	const update = (id: number, patch: Partial<CustomField>) => onChange(fields.map((field) => field.id === id ? { ...field, ...patch } : field))
@@ -21,8 +31,8 @@ export function AdditionalFieldsEditor({ fields, errors, onChange }: Props) {
 			{fields.map((field) => (
 				<div key={field.id} className="custom-field">
 					<div className="custom-field__inputs">
-						<TextField label={i18n.t('form.fieldName')} value={field.name} onChange={(name) => update(field.id, { name })} error={error(`field.${field.id}.name`)} autoComplete="off" />
-						<TextField label={field.name.trim() || i18n.t('form.fieldValue')} type="password" value={field.value} onChange={(value) => update(field.id, { value })} error={error(`field.${field.id}.value`)} autoComplete="off" />
+						<TextField label={i18n.t('form.fieldName')} value={field.name} onChange={(name) => update(field.id, { name })} error={error(`field.${field.id}.name`)} autoComplete="off" verbatim />
+						<FieldValue label={field.name.trim() || i18n.t('form.fieldValue')} value={field.value} onChange={(value) => update(field.id, { value })} error={error(`field.${field.id}.value`)} />
 					</div>
 					<IconButton
 						icon="trash"
diff --git a/browser-extension/entrypoints/popup/components/MaskedField.tsx b/browser-extension/entrypoints/popup/components/MaskedField.tsx
index 8f49cb6e9..ded7a858b 100644
--- a/browser-extension/entrypoints/popup/components/MaskedField.tsx
+++ b/browser-extension/entrypoints/popup/components/MaskedField.tsx
@@ -17,6 +17,9 @@ interface Props {
 	copyable?: boolean
 }
 
+/** For display only: `pre-wrap` shows a lone CR as a space, so a CR-separated value would show on one line. */
+export const asLines = (value: string) => value.replace(/\r\n?/g, '\n')
+
 export function MaskedField({ label, value, masked = false, maskedText = '••••••••', what, actions, copyable = true }: Props) {
 	const [revealed, setRevealed] = useState(false)
 	const copy = useClipboard()
@@ -25,7 +28,7 @@ export function MaskedField({ label, value, masked = false, maskedText = '••
 		<div className="field-row">
 			<div className="field-row__text">
 				<span className="field-row__label">{label}</span>
-				<span className={`field-row__value${masked && revealed ? ' field-row__value--mono' : ''}`}>{hidden ? maskedText : value}</span>
+				<span className={`field-row__value${masked && revealed ? ' field-row__value--mono' : ''}`}>{hidden ? maskedText : asLines(value)}</span>
 			</div>
 			{masked && <IconButton icon={revealed ? 'eyeOff' : 'eye'} label={fieldAction(revealed ? 'field.hide' : 'field.show', label)} aria-pressed={revealed} onClick={() => setRevealed(!revealed)} />}
 			{actions}
diff --git a/browser-extension/entrypoints/popup/components/SearchField.tsx b/browser-extension/entrypoints/popup/components/SearchField.tsx
index 62cc03fc8..d5719d6ae 100644
--- a/browser-extension/entrypoints/popup/components/SearchField.tsx
+++ b/browser-extension/entrypoints/popup/components/SearchField.tsx
@@ -6,7 +6,8 @@ export function SearchField({ value, onChange, disabled }: { value: string; onCh
 	return (
 		<div className="search">
 			<Icon name="search" />
-			<input className="search__input" type="search" aria-label={i18n.t('filters.searchLabel')} placeholder={i18n.t('filters.search')} value={value} disabled={disabled} onChange={(event) => onChange(event.target.value)} />
+			{/* What is searched for names what the vault holds; see TextField for the spell check. */}
+			<input className="search__input" type="search" aria-label={i18n.t('filters.searchLabel')} placeholder={i18n.t('filters.search')} value={value} disabled={disabled} spellCheck={false} onChange={(event) => onChange(event.target.value)} />
 			{value && <IconButton icon="close" label={i18n.t('filters.clearSearch')} onClick={() => onChange('')} />}
 		</div>
 	)
diff --git a/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx b/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
new file mode 100644
index 000000000..f4dde280b
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
@@ -0,0 +1,55 @@
+// @vitest-environment happy-dom
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { ShareSaveNote as Note } from '@/src/messages'
+import { setLocale } from '@/src/testing/i18n'
+import { ShareSaveNote } from './ShareSaveNote'
+
+afterEach(cleanup)
+
+const WEB_APP = 'https://cloud.example.org/index.php/apps/keepiq/'
+const shown = (note: Note) => {
+	render(<ShareSaveNote note={note} webAppUrl={WEB_APP} />)
+	return screen.queryAllByRole('status').map((banner) => banner.textContent)
+}
+
+describe('ShareSaveNote', () => {
+	it.each([
+		['en', { scope: 'own_copy' }, ['Only your copy changed. The owner and the others it is shared with keep the old value.']],
+		['nl', { scope: 'own_copy' }, ['Alleen jouw kopie is gewijzigd. De eigenaar en de anderen met wie het gedeeld is, houden de oude waarde.']],
+		['en', { scope: 'copy', ownerOnly: true }, ['Saved. Recipients at partner organisations get this change when the owner next saves it.']],
+		['nl', { scope: 'copy', ownerOnly: true }, ['Opgeslagen. Ontvangers bij partnerorganisaties krijgen deze wijziging zodra de eigenaar het item weer opslaat.']],
+	] as const)('in %s, says %j', (locale, note, texts) => {
+		setLocale(locale)
+		expect(shown(note)).toEqual(texts)
+	})
+
+	it.each([
+		['en', 'Sharing with bob@cloud.partner.example and carol@cloud.partner.example is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.', 'Open the Keepiq web app'],
+		['nl', 'Delen met bob@cloud.partner.example en carol@cloud.partner.example is gepauzeerd, omdat hun certificaat niet kon worden geverifieerd of hun organisatie de deling niet meer accepteert. De Keepiq-webapp toont de deling.', 'Open de Keepiq-webapp'],
+	] as const)('in %s, names the suspended partners in a list of that language, with a link to the web app', (locale, text, link) => {
+		setLocale(locale)
+		expect(shown({ scope: 'source', suspended: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text + link])
+		expect(screen.getByRole('link', { name: link }).getAttribute('href')).toBe(WEB_APP)
+	})
+
+	it.each([
+		['en', 'Sharing with bob@cloud.partner.example and carol@cloud.partner.example is paused until you share this item with them again.'],
+		['nl', 'Delen met bob@cloud.partner.example en carol@cloud.partner.example is gepauzeerd tot je dit item opnieuw met hen deelt.'],
+	] as const)('in %s, names the partners saved without on a line of their own', (locale, text) => {
+		setLocale(locale)
+		expect(shown({ scope: 'source', paused: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text])
+	})
+
+	it('shows a suspended and a paused partner on two lines', () => {
+		setLocale('en')
+		expect(shown({ scope: 'source', suspended: ['bob@cloud.partner.example'], paused: ['carol@cloud.partner.example'] })).toEqual([
+			expect.stringContaining('Sharing with bob@cloud.partner.example is paused, because'),
+			'Sharing with carol@cloud.partner.example is paused until you share this item with them again.',
+		])
+	})
+
+	it('shows nothing for a source save that suspended no one', () => {
+		expect(shown({ scope: 'source', suspended: [], paused: [] })).toEqual([])
+	})
+})
diff --git a/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx b/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
new file mode 100644
index 000000000..60fc63a6b
--- /dev/null
+++ b/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
@@ -0,0 +1,21 @@
+import { i18n } from '#i18n'
+import type { ShareSaveNote as Note } from '@/src/messages'
+import { cloudIdList } from '../errors'
+import { Banner } from './ErrorBanner'
+
+/** What a save left to others, on the item's detail; Shell holds it for that item until the popup closes (share-sync). */
+export function ShareSaveNote({ note, webAppUrl }: { note: Note; webAppUrl: string }) {
+	return (
+		<>
+			{note.scope === 'own_copy' && <Banner tone="warning" role="status">{i18n.t('shareSave.ownCopy')}</Banner>}
+			{note.ownerOnly && <Banner tone="warning" role="status">{i18n.t('shareSave.ownerOnly')}</Banner>}
+			{note.suspended && note.suspended.length > 0 && (
+				<Banner tone="warning" role="status">
+					{i18n.t('shareSave.suspended', { cloudIds: cloudIdList(note.suspended) })}
+					<br /><a href={webAppUrl} target="_blank" rel="noreferrer">{i18n.t('common.openWebApp')}</a>
+				</Banner>
+			)}
+			{note.paused && note.paused.length > 0 && <Banner tone="warning" role="status">{i18n.t('shareSave.paused', { cloudIds: cloudIdList(note.paused) })}</Banner>}
+		</>
+	)
+}
diff --git a/browser-extension/entrypoints/popup/components/TextArea.tsx b/browser-extension/entrypoints/popup/components/TextArea.tsx
index 673e95105..513e6505d 100644
--- a/browser-extension/entrypoints/popup/components/TextArea.tsx
+++ b/browser-extension/entrypoints/popup/components/TextArea.tsx
@@ -1,30 +1,53 @@
-import { useId, type TextareaHTMLAttributes } from 'react'
+import { useId, useState, type TextareaHTMLAttributes } from 'react'
+import { fieldAction } from '../i18n'
+import { IconButton } from './Button'
 
-interface Props extends Omit<TextareaHTMLAttributes<HTMLTextAreaElement>, 'onChange'> {
+interface Props extends Omit<TextareaHTMLAttributes<HTMLTextAreaElement>, 'onChange' | 'spellCheck'> {
 	label: string
 	value: string
 	onChange: (value: string) => void
 	error?: string | null
 	/** For keys and certificates, where every character must be told apart. */
 	mono?: boolean
+	/** Dots until revealed, like a password field, as a text area cannot mask what it holds. An empty value has nothing to hide. */
+	concealed?: boolean
 }
 
-export function TextArea({ label, value, onChange, error, rows = 4, mono = false, ...rest }: Props) {
+export function TextArea({ label, value, onChange, error, rows = 4, mono = false, concealed = false, ...rest }: Props) {
 	const id = useId()
+	const [revealed, setRevealed] = useState(() => !concealed || value === '')
+	const errorId = error ? `${id}-error` : undefined
+	const labelElement = <label className="field__label" id={`${id}-label`} htmlFor={revealed ? id : undefined}>{label}</label>
 	return (
 		<div className="field">
-			<label className="field__label" htmlFor={id}>{label}</label>
-			<textarea
-				{...rest}
-				id={id}
-				className={`field__input field__input--area${mono ? ' field__input--mono' : ''}`}
-				rows={rows}
-				value={value}
-				onChange={(event) => onChange(event.target.value)}
-				aria-invalid={error ? true : undefined}
-				aria-describedby={error ? `${id}-error` : undefined}
-			/>
-			{error && <p className="field__error" id={`${id}-error`}>{error}</p>}
+			{concealed
+				? (
+					// The toggle keeps its place either way, so it keeps focus.
+					<div className="field__head">
+						{labelElement}
+						<IconButton icon={revealed ? 'eyeOff' : 'eye'} label={fieldAction(revealed ? 'field.hide' : 'field.show', label)} aria-pressed={revealed} onClick={() => setRevealed((r) => !r)} />
+					</div>
+				)
+				: labelElement}
+			{revealed
+				? (
+					<textarea
+						{...rest}
+						{...(concealed && { autoCapitalize: 'off', autoCorrect: 'off' })}
+						// As in TextField.
+						spellCheck={false}
+						id={id}
+						className={`field__input field__input--area${mono ? ' field__input--mono' : ''}`}
+						rows={rows}
+						value={value}
+						onChange={(event) => onChange(event.target.value)}
+						aria-invalid={error ? true : undefined}
+						aria-describedby={errorId}
+					/>
+				)
+				// A group, not a textbox: it names the dots by the label without claiming to be a control one can type in.
+				: <div className="field__box" role="group" aria-labelledby={`${id}-label`} aria-describedby={errorId}><span className="field__input field__masked">••••••••</span></div>}
+			{error && <p className="field__error" id={errorId}>{error}</p>}
 		</div>
 	)
 }
diff --git a/browser-extension/entrypoints/popup/components/TextField.tsx b/browser-extension/entrypoints/popup/components/TextField.tsx
index 9aaaef99b..07f3b6c09 100644
--- a/browser-extension/entrypoints/popup/components/TextField.tsx
+++ b/browser-extension/entrypoints/popup/components/TextField.tsx
@@ -2,16 +2,18 @@ import { forwardRef, useId, useState, type InputHTMLAttributes, type ReactNode }
 import { fieldAction } from '../i18n'
 import { IconButton } from './Button'
 
-interface Props extends Omit<InputHTMLAttributes<HTMLInputElement>, 'onChange'> {
+interface Props extends Omit<InputHTMLAttributes<HTMLInputElement>, 'onChange' | 'spellCheck'> {
 	label: string
 	value: string
 	onChange: (value: string) => void
 	hint?: ReactNode
 	error?: string | null
+	/** No capitals or corrections from a phone keyboard, e.g. for a username or URL. A password field always is. */
+	verbatim?: boolean
 }
 
 /** A labelled input; `type="password"` gets a show/hide toggle that keeps the value. */
-export const TextField = forwardRef<HTMLInputElement, Props>(function TextField({ label, value, onChange, hint, error, type = 'text', ...rest }, ref) {
+export const TextField = forwardRef<HTMLInputElement, Props>(function TextField({ label, value, onChange, hint, error, verbatim = false, type = 'text', ...rest }, ref) {
 	const id = useId()
 	const [revealed, setRevealed] = useState(false)
 	const isPassword = type === 'password'
@@ -22,6 +24,9 @@ export const TextField = forwardRef<HTMLInputElement, Props>(function TextField(
 			<div className="field__box">
 				<input
 					{...rest}
+					{...((verbatim || isPassword) && { autoCapitalize: 'off', autoCorrect: 'off' })}
+					// Every field here holds vault or account data, which a browser's spelling service may send to Google or Microsoft; a revealed password is plain text to it.
+					spellCheck={false}
 					ref={ref}
 					id={id}
 					className="field__input"
diff --git a/browser-extension/entrypoints/popup/components/components.test.tsx b/browser-extension/entrypoints/popup/components/components.test.tsx
index f5dba4cbf..05a0b5036 100644
--- a/browser-extension/entrypoints/popup/components/components.test.tsx
+++ b/browser-extension/entrypoints/popup/components/components.test.tsx
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { cleanup, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useState } from 'react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -14,9 +14,11 @@ import { ConfirmDialog } from './ConfirmDialog'
 import { FolderTree } from './FolderTree'
 import { Header } from './Header'
 import { TextArea } from './TextArea'
+import { TextField } from './TextField'
 import { TypeSelect } from './TypeSelect'
 import { MaskedField } from './MaskedField'
 import { PageFooter } from './PageFooter'
+import { SearchField } from './SearchField'
 import { Select } from './Select'
 import { TabBar } from './TabBar'
 import { Toast } from './Toast'
@@ -163,6 +165,17 @@ describe('MaskedField', () => {
 		expect(toast).toHaveBeenCalledWith('CVV copied')
 	})
 
+	it.each([['CR', 'line1\rline2'], ['CRLF', 'line1\r\nline2']])('shows a %s value on its own lines, and copies it as stored', async (_, value) => {
+		const user = userEvent.setup()
+		const writeText = fakeClipboard()
+		vi.spyOn(browser.runtime, 'sendMessage').mockResolvedValue(null as never)
+		render(<ShellContext.Provider value={{ ...DEFAULT_SHELL, toast: vi.fn() }}><MaskedField label="Key" value={value} masked /></ShellContext.Provider>)
+		await user.click(screen.getByRole('button', { name: 'Show key' }))
+		expect(document.querySelector('.field-row__value')!.textContent).toBe('line1\nline2')
+		await user.click(screen.getByRole('button', { name: 'Copy key' }))
+		expect(writeText).toHaveBeenCalledWith(value)
+	})
+
 	it('shows a plain value with only copy', () => {
 		render(<MaskedField label="Username" value="alice" />)
 		expect(screen.getByText('alice')).toBeTruthy()
@@ -228,6 +241,34 @@ describe('AdditionalFieldsEditor', () => {
 		expect(screen.queryByLabelText('Field name')).toBeNull()
 	})
 
+	it.each([
+		['LF', 'v1\nv2', 'v1\nv2!'],
+		['CRLF', 'v1\r\nv2', 'v1\r\nv2!'],
+		['CR', 'v1\rv2', 'v1\rv2!'],
+	])('keeps the %s lines of a value through an edit, masked until shown', async (_, value, sent) => {
+		const onChange = vi.fn()
+		const field = customField('recovery', value)
+		render(<AdditionalFieldsEditor fields={[field]} errors={{}} onChange={onChange} />)
+		expect(document.body.textContent).not.toContain('v1')
+		expect(screen.getByRole('group', { name: 'recovery' })).toBeTruthy()
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Show recovery' }))
+		const area = screen.getByLabelText('recovery') as HTMLTextAreaElement
+		expect([area.tagName, area.value]).toEqual(['TEXTAREA', value])
+		// happy-dom hands a text area's value back unchanged, where a browser gives LF.
+		fireEvent.change(area, { target: { value: 'v1\nv2!' } })
+		expect(onChange).toHaveBeenCalledWith([{ ...field, value: sent }])
+	})
+
+	it('keeps a value in its text area, and the focus there, once its last line break is deleted', async () => {
+		render(<Editor initial={[customField('recovery', 'v1\nv2')]} />)
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Show recovery' }))
+		const area = screen.getByLabelText('recovery')
+		area.focus()
+		fireEvent.change(area, { target: { value: 'v1v2' } })
+		expect(screen.getByLabelText('recovery')).toBe(area)
+		expect(document.activeElement).toBe(area)
+	})
+
 	it('shows the errors it is given on their row', () => {
 		const field = customField('Login', 'x')
 		render(<AdditionalFieldsEditor fields={[field]} errors={{ [`field.${field.id}.name`]: { code: 'reserved' } }} onChange={() => {}} />)
@@ -283,6 +324,62 @@ describe('TextArea', () => {
 		await userEvent.setup().type(area, 'a')
 		expect(onChange).toHaveBeenCalledWith('a')
 	})
+
+	it('when concealed, keeps the value out of the page until shown, and the toggle focused', async () => {
+		const user = userEvent.setup()
+		render(<TextArea label="Password" value={'line1\nline2'} onChange={vi.fn()} concealed />)
+		expect(screen.queryByRole('textbox')).toBeNull()
+		expect(document.body.textContent).not.toContain('line1')
+		await user.click(screen.getByRole('button', { name: 'Show password' }))
+		expect((screen.getByRole('textbox', { name: 'Password' }) as HTMLTextAreaElement).value).toBe('line1\nline2')
+		const hide = screen.getByRole('button', { name: 'Hide password' })
+		expect([hide.getAttribute('aria-pressed'), document.activeElement]).toEqual(['true', hide])
+		await user.click(hide)
+		expect(screen.queryByRole('textbox')).toBeNull()
+	})
+
+	it('when concealed, names the dots by its label and ties its error to them', () => {
+		render(<TextArea label="Password" value={'line1\nline2'} onChange={vi.fn()} error="Too long (max 65536 bytes)" concealed />)
+		const dots = screen.getByLabelText('Password')
+		expect(screen.getByRole('group', { name: 'Password' })).toBe(dots)
+		expect(dots.textContent).toBe('••••••••')
+		expect(document.getElementById(dots.getAttribute('aria-describedby')!)!.textContent).toBe('Too long (max 65536 bytes)')
+		// Pointing at no control until shown, a `for` would leave the label naming nothing.
+		expect(document.querySelector('label')!.hasAttribute('for')).toBe(false)
+	})
+
+	it('is never spell-checked, and autocorrected only when not concealed', async () => {
+		const attributes = (area: HTMLElement) => ['spellcheck', 'autocapitalize', 'autocorrect'].map((name) => area.getAttribute(name))
+		render(<><TextArea label="Notes" value="" onChange={vi.fn()} /><TextArea label="Key" value="k" onChange={vi.fn()} concealed /></>)
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Show key' }))
+		expect(attributes(screen.getByRole('textbox', { name: 'Notes' }))).toEqual(['false', null, null])
+		expect(attributes(screen.getByRole('textbox', { name: 'Key' }))).toEqual(['false', 'off', 'off'])
+	})
+})
+
+describe('TextField', () => {
+	it('never spell-checks or autocorrects a password field, also once revealed', async () => {
+		render(<TextField label="Password" type="password" value="hunter2" onChange={vi.fn()} />)
+		const input = screen.getByLabelText('Password') as HTMLInputElement
+		const attributes = () => [input.type, input.getAttribute('spellcheck'), input.getAttribute('autocapitalize'), input.getAttribute('autocorrect')]
+		expect(attributes()).toEqual(['password', 'false', 'off', 'off'])
+		await userEvent.setup().click(screen.getByRole('button', { name: 'Show password' }))
+		expect(attributes()).toEqual(['text', 'false', 'off', 'off'])
+	})
+
+	it('never spell-checks any other field, and autocorrects only one not kept verbatim', () => {
+		render(<><TextField label="Name" value="" onChange={vi.fn()} /><TextField label="Username" value="" onChange={vi.fn()} verbatim /></>)
+		const attributes = (label: string) => ['spellcheck', 'autocapitalize', 'autocorrect'].map((name) => screen.getByLabelText(label).getAttribute(name))
+		expect(attributes('Name')).toEqual(['false', null, null])
+		expect(attributes('Username')).toEqual(['false', 'off', 'off'])
+	})
+})
+
+describe('SearchField', () => {
+	it('is never spell-checked', () => {
+		render(<SearchField value="github" onChange={vi.fn()} />)
+		expect(screen.getByRole('searchbox').getAttribute('spellcheck')).toBe('false')
+	})
 })
 
 describe('writeErrorText', () => {
@@ -303,4 +400,33 @@ describe('writeErrorText', () => {
 		expect(writeErrorText({ code: 'policy' })).toBe("Your organisation's policy does not allow this change")
 		expect(writeErrorText({ code: 'forbidden' })).toBe('Keepiq does not allow this change. The Keepiq web app shows why.')
 	})
+
+	it.each([
+		['stale_source', 'The original of this shared item was changed after you opened it. Nothing was saved; open it again and redo your change.'],
+		['incomplete', 'The people this item is shared with kept changing while it was saved. Nothing was saved; please try again.'],
+		['bad_certificate', 'Keepiq sent an encryption key for someone this item is shared with that this browser could not read. Nothing was saved.'],
+		['unverified', "This item is shared with partner organisations, and this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app."],
+		['partner_lookup_limit', 'Too many partner lookups. Nothing was saved; try again in a minute.'],
+		['federation_unavailable', "Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator."],
+	] as const)('words a failed share-save: %s', (code, text) => {
+		expect(writeErrorText({ code }, 'edit')).toBe(text)
+	})
+
+	it.each([
+		['incomplete', 'Met wie dit item gedeeld is, veranderde steeds tijdens het opslaan. Er is niets opgeslagen; probeer het opnieuw.'],
+		['partner_lookup_limit', 'Te veel zoekopdrachten naar partners. Er is niets opgeslagen; probeer het over een minuut opnieuw.'],
+		['federation_unavailable', 'Je Keepiq-server kan niet delen met partnerorganisaties, dus dit item kan hier niet worden opgeslagen. Er is niets opgeslagen; vraag het je beheerder.'],
+	] as const)('words a failed share-save in Dutch: %s', (code, text) => {
+		setLocale('nl')
+		expect(writeErrorText({ code }, 'edit')).toBe(text)
+	})
+
+	it.each([
+		['en', "Nothing was saved: a partner organisation this item is shared with can't be reached (bob@cloud.partner.example and carol@cloud.partner.example). Try again later, or save without them, which pauses sharing this item with them until you share it with them again."],
+		['nl', 'Er is niets opgeslagen: een partnerorganisatie waarmee dit item gedeeld is, is niet bereikbaar (bob@cloud.partner.example en carol@cloud.partner.example). Probeer het later opnieuw, of sla op zonder hen. Dan wordt het delen van dit item met hen gepauzeerd tot je het opnieuw met hen deelt.'],
+	] as const)('names the unreachable partners in a list of the catalog\'s language: %s', (locale, text) => {
+		setLocale(locale)
+		const partners = [{ shareId: 'fs-bob', cloudId: 'bob@cloud.partner.example' }, { shareId: 'fs-carol', cloudId: 'carol@cloud.partner.example' }]
+		expect(writeErrorText({ code: 'partner_unreachable', partners }, 'edit')).toBe(text)
+	})
 })
diff --git a/browser-extension/entrypoints/popup/errors.ts b/browser-extension/entrypoints/popup/errors.ts
index 688ac6429..f8482061d 100644
--- a/browser-extension/entrypoints/popup/errors.ts
+++ b/browser-extension/entrypoints/popup/errors.ts
@@ -36,8 +36,8 @@ export function noticeText(notice: NoticeCode): string {
 	}
 }
 
-/** What was being written, since a 400 or 409 means something different for each. */
-export type WriteContext = 'item' | 'edit' | 'folderName' | 'folderDelete'
+/** What was being written, since a 400 or 409 means something different for each. `open` is the fetch an edit or clone starts from. */
+export type WriteContext = 'item' | 'edit' | 'open' | 'folderName' | 'folderDelete'
 
 /** `undefined` is the background not answering. */
 export function writeErrorText(error: VaultWriteError | undefined, context: WriteContext = 'item'): string {
@@ -51,6 +51,7 @@ export function writeErrorText(error: VaultWriteError | undefined, context: Writ
 		case 'invalid': return context === 'folderDelete' ? i18n.t('writeErrors.folderChanged') : i18n.t('writeErrors.invalid')
 		case 'conflict':
 			if (context === 'edit') return i18n.t('writeErrors.stale')
+			if (context === 'open') return i18n.t('writeErrors.unmatched')
 			if (context === 'folderName') return i18n.t('writeErrors.duplicateFolder')
 			return context === 'folderDelete' ? i18n.t('writeErrors.folderChanged') : i18n.t('writeErrors.invalid')
 		case 'not_found': return folder ? i18n.t('writeErrors.folderGone') : i18n.t('writeErrors.itemGone')
@@ -61,12 +62,22 @@ export function writeErrorText(error: VaultWriteError | undefined, context: Writ
 		case 'offline': return i18n.t('writeErrors.offline')
 		case 'server_error': return i18n.t('writeErrors.serverError')
 		case 'session_revoked': return i18n.t('errors.sessionRevoked')
+		case 'stale_source': return i18n.t('writeErrors.staleSource')
+		case 'incomplete': return i18n.t('writeErrors.incomplete')
+		case 'bad_certificate': return i18n.t('writeErrors.badCertificate')
+		case 'unverified': return i18n.t('writeErrors.unverified')
+		case 'partner_unreachable': return i18n.t('writeErrors.partnerUnreachable', { cloudIds: cloudIdList((error.partners ?? []).map((partner) => partner.cloudId)) })
+		case 'partner_lookup_limit': return i18n.t('writeErrors.partnerLookupLimit')
+		case 'federation_unavailable': return i18n.t('writeErrors.federationUnavailable')
 		case 'locked':
 		case 'unknown':
 		default: return i18n.t('errors.unknown')
 	}
 }
 
+/** Partner recipients named in a sentence of the catalog's language. */
+export const cloudIdList = (cloudIds: string[]) => new Intl.ListFormat(language(), { type: 'conjunction' }).format(cloudIds)
+
 export function fieldErrorText(error: FieldError): string {
 	switch (error.code) {
 		case 'required': return i18n.t('fieldErrors.required')
diff --git a/browser-extension/entrypoints/popup/hooks/useItemDraft.ts b/browser-extension/entrypoints/popup/hooks/useItemDraft.ts
index 2f858a93f..25dbb6c32 100644
--- a/browser-extension/entrypoints/popup/hooks/useItemDraft.ts
+++ b/browser-extension/entrypoints/popup/hooks/useItemDraft.ts
@@ -2,11 +2,14 @@ import { useMemo, useState } from 'react'
 import type { ItemDraft, ItemPatch, TypeMeta } from '@/src/messages'
 import { diffDraft, isLiveError, toDraft, validate, type FormErrors, type FormValues } from '@/src/vault/fields'
 
-/** The form's values in popup memory only, compared with what it opened with. */
-export function useItemDraft(initial: FormValues, types: TypeMeta[]) {
+/**
+ * The form's values in popup memory only, compared with what it opened with.
+ * `fetched`: the type an edit or clone opened with and the name it renders by, whatever the snapshot calls that type since.
+ */
+export function useItemDraft(initial: FormValues, types: TypeMeta[], fetched?: { id: string; name: string | undefined }) {
 	const [values, setValues] = useState(initial)
 	const [attempted, setAttempted] = useState(false)
-	const typeName = (typeId: string) => types.find((type) => type.id === typeId)?.name
+	const typeName = (typeId: string) => (fetched && typeId === fetched.id ? fetched.name : types.find((type) => type.id === typeId)?.name)
 	const currentType = typeName(values.typeId)
 
 	const errors = useMemo(() => validate(values, currentType), [values, currentType])
diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index 6782f4d66..b1efdf0c2 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -1134,6 +1134,7 @@ a {
 .field-row__value {
 	margin: 0;
 	font-size: 14px;
+	white-space: pre-wrap;
 	overflow-wrap: anywhere;
 }
 
@@ -1240,6 +1241,24 @@ a {
 	font-size: 12.5px;
 }
 
+.field__head {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: 8px;
+}
+
+/* Keeps the row as tall as a bare label. */
+.field__head .icon-btn {
+	margin: -8px -4px -8px 0;
+}
+
+.field__masked {
+	display: flex;
+	align-items: center;
+	color: var(--fg-muted);
+}
+
 .picker-field {
 	display: flex;
 	align-items: center;
diff --git a/browser-extension/entrypoints/popup/testing.ts b/browser-extension/entrypoints/popup/testing.ts
index ae0d25cfb..ab7dff306 100644
--- a/browser-extension/entrypoints/popup/testing.ts
+++ b/browser-extension/entrypoints/popup/testing.ts
@@ -101,6 +101,7 @@ export function fakeBackground(options: FakeBackground = {}) {
 				return item ? { ok: true, value: item } : { ok: false, error: { code: 'not_found' } }
 			}
 			case 'item.create': return { ok: true, value: { id: 'new' } }
+			// A save that reached everyone carries no `shareSave`.
 			case 'item.update': return { ok: true, value: { id: message.id } }
 			case 'item.delete':
 			case 'folder.rename':
@@ -126,9 +127,11 @@ export function fakeBackground(options: FakeBackground = {}) {
 	return reply
 }
 
+/** Its `typeName` is what `types` calls its type, unless given. */
 export function editableItem(overrides: Partial<EditableItem> = {}): EditableItem {
+	const typeId = overrides.typeId ?? 't-login'
 	return {
-		id: 'i1', typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: null, key: 'hunter2', login: 'alice',
+		id: 'i1', typeId, typeName: types.find((type) => type.id === typeId)?.name, name: 'GitHub', url: 'https://github.com', folderId: null, key: 'hunter2', login: 'alice',
 		additionalFields: {}, updatedAt: '2026-03-02T10:00:00Z', ...overrides,
 	}
 }
diff --git a/browser-extension/entrypoints/popup/views/AddAccount.test.tsx b/browser-extension/entrypoints/popup/views/AddAccount.test.tsx
index 377cdee3f..f419dc316 100644
--- a/browser-extension/entrypoints/popup/views/AddAccount.test.tsx
+++ b/browser-extension/entrypoints/popup/views/AddAccount.test.tsx
@@ -32,6 +32,14 @@ describe('AddAccount', () => {
 		expect(button).toHaveProperty('disabled', false)
 	})
 
+	it('keeps the server URL and username from a phone keyboard\'s corrections', () => {
+		render(<AddAccount dispatch={dispatchReturning()} />)
+		for (const label of ['Server URL', 'Username']) {
+			const input = screen.getByLabelText(label)
+			expect([label, input.getAttribute('autocapitalize'), input.getAttribute('autocorrect')]).toEqual([label, 'off', 'off'])
+		}
+	})
+
 	it('links to the server security settings once the URL is entered', async () => {
 		render(<AddAccount dispatch={dispatchReturning()} />)
 		const user = userEvent.setup()
diff --git a/browser-extension/entrypoints/popup/views/AddAccount.tsx b/browser-extension/entrypoints/popup/views/AddAccount.tsx
index 5bc9fd733..0ef00b677 100644
--- a/browser-extension/entrypoints/popup/views/AddAccount.tsx
+++ b/browser-extension/entrypoints/popup/views/AddAccount.tsx
@@ -99,8 +99,8 @@ export function AddAccount({ dispatch, onAdded }: Props) {
 
 	return (
 		<form className="stack" onSubmit={submit} noValidate>
-			<TextField ref={serverUrlField} label={i18n.t('addAccount.serverUrl')} value={serverUrl} onChange={(value) => setDraft({ serverUrl: value })} onBlur={updateSecurityLink} placeholder={i18n.t('addAccount.serverUrlPlaceholder')} autoFocus autoComplete="url" inputMode="url" />
-			<TextField ref={usernameField} label={i18n.t('addAccount.username')} value={username} onChange={(value) => setDraft({ username: value })} autoComplete="username" />
+			<TextField ref={serverUrlField} label={i18n.t('addAccount.serverUrl')} value={serverUrl} onChange={(value) => setDraft({ serverUrl: value })} onBlur={updateSecurityLink} placeholder={i18n.t('addAccount.serverUrlPlaceholder')} autoFocus autoComplete="url" inputMode="url" verbatim />
+			<TextField ref={usernameField} label={i18n.t('addAccount.username')} value={username} onChange={(value) => setDraft({ username: value })} autoComplete="username" verbatim />
 			<TextField
 				ref={appPasswordField}
 				label={i18n.t('common.appPassword')}
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
index 446756270..2d0bb84e0 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
@@ -2,9 +2,9 @@
 import { cleanup, render, screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type { DecryptedItem, FolderMeta, ItemMeta } from '@/src/messages'
+import type { DecryptedItem, FolderMeta, ItemMeta, ShareSaveNote } from '@/src/messages'
 import { DEFAULT_SHELL, ShellContext } from '../shell-context'
-import { fakeBackground, itemMeta, sentKinds, types } from '../testing'
+import { fakeBackground, fakeClipboard, itemMeta, sentKinds, types } from '../testing'
 import { ItemDetail } from './ItemDetail'
 
 // Shell's footer bar, where the detail portals Edit and Delete.
@@ -47,6 +47,27 @@ describe('header', () => {
 	})
 })
 
+describe('share-save note', () => {
+	const renderWith = (shareSave?: ShareSaveNote) => {
+		fakeBackground()
+		render(
+			<ShellContext.Provider value={{ ...DEFAULT_SHELL, footer }}>
+				<ItemDetail item={itemMeta()} type={types[0]} folders={folders} webAppUrl="https://cloud.example.org/index.php/apps/keepiq/" shareSave={shareSave} />
+			</ShellContext.Provider>,
+		)
+	}
+
+	it('shows the note under the header', () => {
+		renderWith({ scope: 'own_copy' })
+		expect(document.querySelector('.banner--warning')?.textContent).toBe('Only your copy changed. The owner and the others it is shared with keep the old value.')
+	})
+
+	it('shows none without one', () => {
+		renderWith()
+		expect(document.querySelector('.banner--warning')).toBeNull()
+	})
+})
+
 describe('login credentials', () => {
 	it('shows the username and a masked password that reveals in monospace', async () => {
 		const { sent } = renderDetail(itemMeta(), { login: 'alice', key: 'hunter2' })
@@ -109,6 +130,12 @@ describe('additional fields and notes', () => {
 		expect(within(section('Notes')).getByText(/line one/).textContent).toBe('line one\nline two')
 	})
 
+	it.each([['CR', 'a\rb\rc'], ['CRLF', 'a\r\nb\r\nc']])('shows %s notes and a note\'s text on their own lines', async (_, text) => {
+		renderDetail(itemMeta({ typeId: 't-note', hasLogin: false, url: null }), { key: text, additionalFields: JSON.stringify({ Notes: text }) })
+		await screen.findByRole('heading', { name: 'Notes' })
+		expect([...section('Notes').querySelectorAll('.notes')].map((note) => note.textContent)).toEqual(['a\nb\nc', 'a\nb\nc'])
+	})
+
 	it('says when the fields do not parse', async () => {
 		renderDetail(itemMeta(), { key: 'pw', additionalFields: '[1,2]' })
 		expect(await screen.findByText('Could not read additional fields')).toBeTruthy()
@@ -150,9 +177,65 @@ describe('card and identity', () => {
 		expect(within(identity).getByRole('button', { name: 'Show BSN' })).toBeTruthy()
 	})
 
-	it('says when the payload does not parse', async () => {
-		renderDetail(itemMeta({ typeId: 't-card', hasLogin: false, url: null }), { key: 'garbage' })
-		expect(await screen.findByText('Could not read this item')).toBeTruthy()
+	it.each([
+		['card', 'multi-line text', 'Card details', 'card', 'legacy\ncard text'],
+		['card', 'JSON after a space', 'Card details', 'card', ' {"number":"4111"}'],
+		['identity', 'a JSON array', 'Identity', 'identity', '["Alice"]'],
+	])('shows a key of type %s that is %s, which holds no members, as one masked secret, as the edit form does', async (name, _, title, label, key) => {
+		// After userEvent's own clipboard, which it would replace this with.
+		const user = userEvent.setup()
+		const copied = fakeClipboard()
+		renderDetail(itemMeta({ typeId: `t-${name}`, hasLogin: false, url: null }), { key })
+		const shown = await screen.findByRole('heading', { name: title }).then((h) => h.closest('section')!)
+		expect(shown.textContent).not.toContain(key)
+		await user.click(within(shown).getByRole('button', { name: `Show ${label}` }))
+		expect(within(shown).getByText(key, { normalizer: (value) => value }).className).toContain('field-row__value--mono')
+		await user.click(within(shown).getByRole('button', { name: `Copy ${label}` }))
+		expect(copied).toHaveBeenCalledWith(key)
+		expect(screen.queryByText('Could not read this item')).toBeNull()
+	})
+
+	it('shows nothing of a use-only card, not even a key that holds no members', async () => {
+		const { view } = renderDetail(itemMeta({ typeId: 't-card', useOnly: true, url: null }), { login: 'bob' })
+		expect(await screen.findByText('bob')).toBeTruthy()
+		expect(screen.queryByRole('heading', { name: 'Card details' })).toBeNull()
+		expect(view.container.querySelectorAll('button[aria-label^="Show"]')).toHaveLength(0)
+	})
+
+	it.each([
+		['card', 'text', 'Card details', 'legacy card text'],
+		['card', 'members', 'Card details', '{"number":"4111111111111111"}'],
+		['identity', 'text', 'Identity', 'legacy identity text'],
+	])('never shows the key of a use-only %s, holding %s, should one arrive', async (name, _, title, key) => {
+		const { view } = renderDetail(itemMeta({ typeId: `t-${name}`, useOnly: true, url: null }), { login: 'bob', key })
+		expect(await screen.findByText('bob')).toBeTruthy()
+		expect(screen.queryByRole('heading', { name: title })).toBeNull()
+		expect(view.container.querySelectorAll('button[aria-label^="Show"]')).toHaveLength(0)
+		expect(view.container.textContent).not.toMatch(/legacy|4111/)
+	})
+})
+
+describe('username', () => {
+	it.each([['totp'], ['card'], ['identity'], ['note']])('shows the username of a %s item with its website, as the edit form does', async (name) => {
+		const keys: Record<string, string> = { totp: 'JBSWY3DPEHPK3PXP', card: '{"number":"4111"}', identity: '{"firstName":"Alice"}', note: 'Wifi' }
+		renderDetail(itemMeta({ typeId: `t-${name}` }), { login: 'alice@example.com', key: keys[name] })
+		const autofill = await screen.findByRole('heading', { name: 'Autofill options' }).then((h) => h.closest('section')!)
+		expect(within(autofill).getByText('Username')).toBeTruthy()
+		expect(within(autofill).getByText('alice@example.com')).toBeTruthy()
+		expect(within(autofill).getByText('https://github.com')).toBeTruthy()
+		expect(screen.queryByRole('heading', { name: 'Login credentials' })).toBeNull()
+	})
+
+	it('keeps the Website title without one', async () => {
+		renderDetail(itemMeta({ typeId: 't-card', hasLogin: false }), { key: '{"number":"4111"}' })
+		expect(await screen.findByRole('heading', { name: 'Website' })).toBeTruthy()
+		expect(screen.queryByText('Username')).toBeNull()
+	})
+
+	it('never shows one for a passkey', async () => {
+		renderDetail(itemMeta({ typeId: 't-passkey', url: null }), { login: 'alice@example.com', key: JSON.stringify({ rpId: 'example.com', userName: 'pk-user' }) })
+		expect(await screen.findByText('example.com')).toBeTruthy()
+		expect(screen.queryByText('alice@example.com')).toBeNull()
 	})
 })
 
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
index 602f0915e..7a145a66c 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
@@ -1,17 +1,18 @@
 import { useState, type ReactNode } from 'react'
 import { i18n } from '#i18n'
-import { USE_ONLY_FIELDS, type DecryptField, type DecryptedItem, type FolderMeta, type ItemMeta, type TypeMeta } from '@/src/messages'
+import { USE_ONLY_FIELDS, type DecryptField, type DecryptedItem, type FolderMeta, type ItemMeta, type ShareSaveNote as Note, type TypeMeta } from '@/src/messages'
 import { typeIcon } from '@/src/vault/icons'
 import { folderPath, launchUrl } from '@/src/vault/list'
-import { cardBrand, cardLast4, parseObject, text } from '@/src/vault/payloads'
+import { cardBrand, cardLast4, parseObject, parsePayload, text } from '@/src/vault/payloads'
 import { IconButton } from '../components/Button'
 import { Banner, ErrorBanner } from '../components/ErrorBanner'
 import { Icon } from '../components/Icon'
 import { itemActions } from '../components/ItemCard'
 import { Loading } from '../components/Loading'
-import { MaskedField } from '../components/MaskedField'
+import { asLines, MaskedField } from '../components/MaskedField'
 import { Menu, type MenuItem } from '../components/Menu'
 import { PageFooter } from '../components/PageFooter'
+import { ShareSaveNote } from '../components/ShareSaveNote'
 import { TotpCode } from '../components/TotpCode'
 import { blockedText } from '../errors'
 import { useDecryptedFields } from '../hooks/useDecryptedFields'
@@ -23,6 +24,8 @@ interface Props {
 	type: TypeMeta | undefined
 	folders: FolderMeta[]
 	webAppUrl: string
+	/** What the last save of this item left to others; held by Shell. */
+	shareSave?: Note
 }
 
 /** Types with their own section instead of Login credentials. */
@@ -98,17 +101,20 @@ function Passkey({ payload }: { payload: Record<string, unknown> }) {
 	)
 }
 
-function Website({ item }: { item: ItemMeta }) {
+function Website({ item, username }: { item: ItemMeta; username?: string | null }) {
 	const launch = launchUrl(item.url)
 	const shell = useShell()
-	if (!item.url) return null
+	if (!item.url && !username) return null
 	return (
-		<Section title={i18n.t('detail.website')}>
-			<MaskedField
-				label={i18n.t('detail.website')}
-				value={item.url}
-				actions={launch && <IconButton icon="external" label={i18n.t('item.launch', { name: item.name })} onClick={() => shell.launch(launch)} />}
-			/>
+		<Section title={username ? i18n.t('form.autofillOptions') : i18n.t('detail.website')}>
+			{username && <MaskedField label={i18n.t('detail.username')} value={username} />}
+			{item.url && (
+				<MaskedField
+					label={i18n.t('detail.website')}
+					value={item.url}
+					actions={launch && <IconButton icon="external" label={i18n.t('item.launch', { name: item.name })} onClick={() => shell.launch(launch)} />}
+				/>
+			)}
 		</Section>
 	)
 }
@@ -138,7 +144,12 @@ function Values({ item, type, values }: { item: ItemMeta; type: TypeMeta | undef
 	}
 	const notes = [...(name === 'note' && key ? [key] : []), ...(extra ?? []).filter(([field]) => field.toLowerCase() === 'notes').map(([, value]) => value)]
 	const fields = (extra ?? []).filter(([field]) => field.toLowerCase() !== 'notes')
-	const payload = ['card', 'identity', 'passkey'].includes(name) ? parseObject(key) : null
+	// As the edit form reads them, so both show a key that is not members as one secret.
+	const members = name === 'card' || name === 'identity' ? parsePayload(key) : null
+	const passkey = name === 'passkey' ? parseObject(key) : null
+	// Outside Login credentials, the username goes with the website, as in the edit form's Autofill options.
+	const username = OWN_SECTION.has(name) && name !== 'passkey' && values.login ? values.login : null
+	const plainKey = (title: string) => (key ? <Section title={title}><MaskedField label={secretLabel(type)} value={key} masked /></Section> : null)
 
 	return (
 		<>
@@ -149,10 +160,10 @@ function Values({ item, type, values }: { item: ItemMeta; type: TypeMeta | undef
 				</Section>
 			)}
 			{name === 'totp' && <Section title={i18n.t('detail.authenticatorKey')}><TotpCode seed={key} /></Section>}
-			{name === 'card' && (payload ? <Card payload={payload} /> : <Unreadable title={i18n.t('detail.cardDetails')} message={i18n.t('detail.unreadable')} />)}
-			{name === 'identity' && (payload ? <Identity payload={payload} /> : <Unreadable title={i18n.t('detail.identity')} message={i18n.t('detail.unreadable')} />)}
-			{name === 'passkey' && (payload ? <Passkey payload={payload} /> : <Unreadable title={i18n.t('detail.passkey')} message={i18n.t('detail.unreadablePasskey')} />)}
-			<Website item={item} />
+			{name === 'card' && (members ? <Card payload={members} /> : plainKey(i18n.t('detail.cardDetails')))}
+			{name === 'identity' && (members ? <Identity payload={members} /> : plainKey(i18n.t('detail.identity')))}
+			{name === 'passkey' && (passkey ? <Passkey payload={passkey} /> : <Unreadable title={i18n.t('detail.passkey')} message={i18n.t('detail.unreadablePasskey')} />)}
+			<Website item={item} username={username} />
 			{extra === null
 				? <Unreadable title={i18n.t('detail.additionalFields')} message={i18n.t('detail.unreadableFields')} />
 				: fields.length > 0 && (
@@ -162,7 +173,7 @@ function Values({ item, type, values }: { item: ItemMeta; type: TypeMeta | undef
 				)}
 			{notes.length > 0 && (
 				<Section title={i18n.t('detail.notes')}>
-					{notes.map((note, i) => <p key={i} className="field-row notes">{note}</p>)}
+					{notes.map((note, i) => <p key={i} className="field-row notes">{asLines(note)}</p>)}
 				</Section>
 			)}
 		</>
@@ -192,7 +203,7 @@ function ActionButton({ action, variant }: { action: MenuItem; variant: 'primary
 	)
 }
 
-export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
+export function ItemDetail({ item, type, folders, webAppUrl, shareSave }: Props) {
 	// The version the user opened; a later one arrived by sync.
 	const [openedVersion] = useState(item.updatedAt)
 	const dates: Array<[string, string]> = [[i18n.t('detail.created'), item.createdAt], [i18n.t('detail.updated'), item.updatedAt]]
@@ -208,6 +219,7 @@ export function ItemDetail({ item, type, folders, webAppUrl }: Props) {
 					<p className="detail-head__meta">{type?.label ?? i18n.t('detail.item')} · {folderPath(folders, item.folderId) ?? i18n.t('filters.noFolder')}</p>
 				</div>
 			</header>
+			{shareSave && <ShareSaveNote note={shareSave} webAppUrl={webAppUrl} />}
 			{item.blocked
 				? (
 					<Banner tone="error" role="status">
diff --git a/browser-extension/entrypoints/popup/views/ItemForm.test.tsx b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
index 030b22678..d3dd266fb 100644
--- a/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
@@ -1,10 +1,11 @@
 // @vitest-environment happy-dom
-import { cleanup, render, screen, waitFor, within } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { EditableItem, FolderMeta } from '@/src/messages'
+import { CARD_FIELDS, IDENTITY_FIELDS, shownInFull } from '@/src/vault/fields'
 import { DEFAULT_SHELL, ShellContext } from '../shell-context'
-import { editableItem, fakeBackground, sentOf, snapshotReply, type UnlockedSnapshot } from '../testing'
+import { editableItem, fakeBackground, sentOf, snapshotReply, types, type UnlockedSnapshot } from '../testing'
 import { ItemForm, type FormMode } from './ItemForm'
 
 let footer: HTMLElement
@@ -81,7 +82,7 @@ describe('adding', () => {
 		await user.type(field('Field name'), 'pin')
 		await user.type(field('pin'), '1234')
 		await user.click(save())
-		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new', undefined))
 		expect(created(sent)).toEqual([{
 			typeId: 't-login', name: 'GitHub', url: 'https://github.com/login', folderId: null, key: 'hunter2', login: 'alice',
 			additionalFields: { pin: '1234', notes: 'Recovery codes in the safe' },
@@ -136,6 +137,41 @@ describe('adding', () => {
 		expect(JSON.parse((created(sent)[0] as { key: string }).key)).toEqual({ number: '4111111111111111', expiry: '12/29', cvv: '', pin: '', cardholder: 'Alice Doe' })
 	})
 
+	it('keeps a note and the notes from the spell checker, which may send them to a third party', async () => {
+		const { user } = renderForm()
+		expect(field('Notes').getAttribute('spellcheck')).toBe('false')
+		await user.selectOptions(screen.getByLabelText('Type'), 't-note')
+		expect(field('Note').getAttribute('spellcheck')).toBe('false')
+	})
+
+	it.each([
+		['login', ['Username', 'Website URL', 'Field name']],
+		['card', ['Website URL', 'Field name']],
+		['identity', ['Phone', 'Email', 'Website URL', 'Field name']],
+		['totp', ['Website URL', 'Field name']],
+	])('keeps every %s field from the spell checker, a revealed secret too, and %j from a phone keyboard\'s corrections', async (typeName, verbatim) => {
+		const { user } = renderForm()
+		await user.selectOptions(screen.getByLabelText('Type'), `t-${typeName}`)
+		await user.click(await screen.findByRole('button', { name: 'Add field' }))
+		for (const show of screen.getAllByRole('button', { name: /^Show / })) await user.click(show)
+		const inputs = [...document.querySelectorAll<HTMLInputElement | HTMLTextAreaElement>('input, textarea')]
+		expect(inputs.filter((input) => input.type === 'text').length).toBeGreaterThan(2)
+		expect(inputs.filter((input) => input.getAttribute('spellcheck') !== 'false').map((input) => input.id)).toEqual([])
+		for (const label of verbatim) expect([label, field(label).getAttribute('autocapitalize'), field(label).getAttribute('autocorrect')]).toEqual([label, 'off', 'off'])
+	})
+
+	it('keeps a username shown under the autofill options from a phone keyboard\'s corrections', async () => {
+		renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-note', key: 'Wifi', login: 'alice' }) } })
+		const username = await screen.findByLabelText('Username')
+		expect([username.getAttribute('autocapitalize'), username.getAttribute('autocorrect')]).toEqual(['off', 'off'])
+	})
+
+	it('gives an identity\'s email and phone the keyboards for them', async () => {
+		const { user } = renderForm()
+		await user.selectOptions(screen.getByLabelText('Type'), 't-identity')
+		expect([field('Email').getAttribute('inputmode'), field('Phone').getAttribute('inputmode')]).toEqual(['email', 'tel'])
+	})
+
 	it('reports itself dirty to the leave guard once something is typed', async () => {
 		const { shell, user } = renderForm({ tabUrl: 'https://github.com/' })
 		const isDirty = shell.setLeaveGuard.mock.calls[0]![0] as () => boolean
@@ -187,15 +223,158 @@ describe('folders', () => {
 })
 
 describe('editing', () => {
-	it('fills from a fresh fetch and sends only the rename with the base version', async () => {
-		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ additionalFields: { notes: 'n' } }) } })
+	it('fills from a fresh fetch and sends only the rename with the base version and the fetch\'s record', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ additionalFields: { notes: 'n' }, recordId: 'r1' }) } })
 		expect((await screen.findByLabelText('Username') as HTMLInputElement).value).toBe('alice')
 		expect(field('Notes').value).toBe('n')
 		expect((screen.getByLabelText('Type') as HTMLSelectElement).disabled).toBe(true)
 		await user.type(field('Name'), ' work')
 		await user.click(save())
-		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1'))
-		expect(sentOf(sent, 'item.update')).toEqual([{ kind: 'item.update', accountId: 'a1', id: 'i1', patch: { name: 'GitHub work' }, baseUpdatedAt: '2026-03-02T10:00:00Z' }])
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1', undefined))
+		expect(sentOf(sent, 'item.update')).toEqual([{ kind: 'item.update', accountId: 'a1', id: 'i1', patch: { name: 'GitHub work' }, baseUpdatedAt: '2026-03-02T10:00:00Z', recordId: 'r1' }])
+	})
+
+	it("hands the save's note to the shell", async () => {
+		const shareSave = { scope: 'own_copy' }
+		const { onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: true, value: { id: 'i1', shareSave } } } })
+		await user.type(await screen.findByLabelText('Username'), '2')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1', shareSave))
+	})
+
+	describe('when a partner organisation cannot be reached', () => {
+		const unreachable = (...cloudIds: string[]) => ({ ok: false, error: { code: 'partner_unreachable', partners: cloudIds.map((cloudId, i) => ({ shareId: `fs${i}`, cloudId })) } })
+
+		it('names the partners and saves the same draft without them', async () => {
+			let attempts = 0
+			const { sent, onSaved, user } = renderForm({
+				mode: 'edit', id: 'i1', items: { i1: editableItem({ recordId: 'r1' }) },
+				replies: { 'item.update': () => (++attempts === 1 ? unreachable('bob@cloud.partner.example', 'carol@cloud.partner.example') : { ok: true, value: { id: 'i1' } }) },
+			})
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			const alert = await screen.findByRole('alert')
+			expect(alert.textContent).toContain("a partner organisation this item is shared with can't be reached (bob@cloud.partner.example and carol@cloud.partner.example)")
+			expect(within(alert).queryByRole('button', { name: 'Try again' })).toBeNull()
+			await user.click(within(alert).getByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(onSaved).toHaveBeenCalledWith('i1', undefined))
+			const [first, second] = sentOf(sent, 'item.update')
+			expect(first).not.toHaveProperty('withoutUnreachable')
+			expect(second).toEqual({ ...first, withoutUnreachable: ['fs0', 'fs1'] })
+		})
+
+		it('offers Save without them again for a partner that fails only then', async () => {
+			let attempts = 0
+			const { sent, user } = renderForm({
+				mode: 'edit', id: 'i1', items: { i1: editableItem() },
+				replies: { 'item.update': () => (++attempts === 1 ? unreachable('bob@cloud.partner.example') : unreachable('bob@cloud.partner.example', 'carol@cloud.partner.example')) },
+			})
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(screen.getByRole('alert').textContent).toContain('carol@cloud.partner.example'))
+			await user.click(screen.getByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			expect(sentOf(sent, 'item.update')[2]).toMatchObject({ withoutUnreachable: ['fs0', 'fs1'] })
+		})
+
+		const bob = { shareId: 'fs-bob', cloudId: 'bob@cloud.partner.example' }
+		const carol = { shareId: 'fs-carol', cloudId: 'carol@cloud.partner.example' }
+		/** Bob fails the first save, Carol every later one. */
+		const bobThenCarol = () => {
+			let attempts = 0
+			return renderForm({
+				mode: 'edit', id: 'i1', items: { i1: editableItem() },
+				replies: { 'item.update': () => ({ ok: false, error: { code: 'partner_unreachable', partners: [++attempts === 1 ? bob : carol] } }) },
+			})
+		}
+
+		it('keeps the partners already agreed to when another one fails, and names them all', async () => {
+			const { sent, user } = bobThenCarol()
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(screen.getByRole('alert').textContent).toContain('(bob@cloud.partner.example and carol@cloud.partner.example)'))
+			await user.click(screen.getByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			expect(sentOf(sent, 'item.update').map((message) => message.withoutUnreachable)).toEqual([undefined, ['fs-bob'], ['fs-bob', 'fs-carol']])
+		})
+
+		it('asks again about every partner once the username, password or fields change', async () => {
+			const { sent, user } = bobThenCarol()
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(2))
+			await user.type(screen.getByLabelText('Username'), '3')
+			await user.click(save())
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			await waitFor(() => expect(screen.getByRole('alert').textContent).toContain('(carol@cloud.partner.example)'))
+			await user.click(screen.getByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(4))
+			expect(sentOf(sent, 'item.update')[3]).toMatchObject({ withoutUnreachable: ['fs-carol'] })
+		})
+
+		it('asks again about every partner once a username it did not change is cleared', async () => {
+			const { sent, user } = bobThenCarol()
+			await user.type(await screen.findByLabelText('Password'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(2))
+			await user.clear(screen.getByLabelText('Username'))
+			await user.click(save())
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			expect(sentOf(sent, 'item.update')[2]).toMatchObject({ patch: { key: 'hunter22', login: null } })
+			await waitFor(() => expect(screen.getByRole('alert').textContent).toContain('(carol@cloud.partner.example)'))
+		})
+
+		it('tries a Save without them again as it was, without asking again', async () => {
+			let attempts = 0
+			const { sent, user } = renderForm({
+				mode: 'edit', id: 'i1', items: { i1: editableItem() },
+				replies: { 'item.update': () => (++attempts === 1 ? { ok: false, error: { code: 'partner_unreachable', partners: [bob] } } : { ok: false, error: { code: 'offline' } }) },
+			})
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await user.click(await screen.findByRole('button', { name: 'Try again' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			expect(sentOf(sent, 'item.update').map((message) => message.withoutUnreachable)).toEqual([undefined, ['fs-bob'], ['fs-bob']])
+		})
+
+		it('tries it again without them only while the username, password and fields are the same', async () => {
+			let attempts = 0
+			const { sent, user } = renderForm({
+				mode: 'edit', id: 'i1', items: { i1: editableItem() },
+				replies: { 'item.update': () => (++attempts === 1 ? { ok: false, error: { code: 'partner_unreachable', partners: [bob] } } : { ok: false, error: { code: 'offline' } }) },
+			})
+			await user.type(await screen.findByLabelText('Username'), '2')
+			await user.click(save())
+			await user.click(await screen.findByRole('button', { name: 'Save without them' }))
+			await screen.findByRole('button', { name: 'Try again' })
+			await user.type(screen.getByLabelText('Username'), '3')
+			await user.click(screen.getByRole('button', { name: 'Try again' }))
+			await waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(3))
+			expect(sentOf(sent, 'item.update')[2]).not.toHaveProperty('withoutUnreachable')
+		})
+	})
+
+	it('points to the web app when partners could not get the item as shown', async () => {
+		const { user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: false, error: { code: 'unverified' } } } })
+		await user.type(await screen.findByLabelText('Username'), '2')
+		await user.click(save())
+		const alert = await screen.findByRole('alert')
+		expect(alert.textContent).toContain("this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app.")
+		expect(within(alert).getByRole('link', { name: 'Open the Keepiq web app' }).getAttribute('href')).toBe(snapshotReply().webAppUrl)
+	})
+
+	it('offers no Try again when the server cannot share with partners', async () => {
+		const { user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: false, error: { code: 'federation_unavailable' } } } })
+		await user.type(await screen.findByLabelText('Username'), '2')
+		await user.click(save())
+		const alert = await screen.findByRole('alert')
+		expect(alert.textContent).toBe("Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator.")
+		expect(within(alert).queryByRole('button')).toBeNull()
 	})
 
 	it('clears an emptied username with null', async () => {
@@ -237,11 +416,14 @@ describe('editing', () => {
 		await user.type(field('Name'), 'GitHub')
 		await user.click(save())
 		await user.click(await screen.findByRole('button', { name: 'Try again' }))
-		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new', undefined))
 	})
 
-	it('edits only name, folder and URL of a passkey', async () => {
-		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'p', items: { p: editableItem({ id: 'p', typeId: 't-passkey', key: '', keyWithheld: true, login: null }) } })
+	it.each([
+		['a passkey', 't-passkey'],
+		['a passkey the server sends as a login', 't-login'],
+	])('edits only name, folder and URL of %s', async (_, typeId) => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'p', items: { p: editableItem({ id: 'p', typeId, typeName: 'passkey', key: '', login: null }) } })
 		expect(await screen.findByText('Passkey credentials can only be changed in the Keepiq web app')).toBeTruthy()
 		for (const label of ['Username', 'Password', 'Notes', 'Field name']) expect(screen.queryByLabelText(label)).toBeNull()
 		expect(screen.queryByRole('button', { name: 'Add field' })).toBeNull()
@@ -264,6 +446,19 @@ describe('editing', () => {
 		expect(within(alert).getByRole('link', { name: 'Open the Keepiq web app' }).getAttribute('href')).toBe('https://cloud.example.org/index.php/apps/keepiq/')
 		expect(screen.queryByLabelText('Name')).toBeNull()
 	})
+
+	it('says when the fetched item does not match the vault, and fetches again on Try again', async () => {
+		let attempts = 0
+		const { user } = renderForm({
+			mode: 'edit', id: 'i1',
+			replies: { 'item.fetch': () => (++attempts === 1 ? { ok: false, error: { code: 'conflict' } } : { ok: true, value: editableItem() }) },
+		})
+		const alert = await screen.findByRole('alert')
+		expect(alert.textContent).toContain('Keepiq sent a version of this item that your vault does not hold, so it was not opened.')
+		expect(screen.queryByLabelText('Name')).toBeNull()
+		await user.click(within(alert).getByRole('button', { name: 'Try again' }))
+		expect((await screen.findByLabelText('Name') as HTMLInputElement).value).toBe('GitHub')
+	})
 })
 
 describe('cloning', () => {
@@ -271,12 +466,212 @@ describe('cloning', () => {
 		const { sent, onSaved, user } = renderForm({ mode: 'clone', id: 'i1', items: { i1: editableItem({ folderId: 'w', additionalFields: { pin: '1' } }) } })
 		expect((await screen.findByLabelText('Name') as HTMLInputElement).value).toBe('GitHub - Clone')
 		await user.click(save())
-		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new'))
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new', undefined))
 		expect(created(sent)).toEqual([{
 			typeId: 't-login', name: 'GitHub - Clone', url: 'https://github.com', folderId: 'w', key: 'hunter2', login: 'alice', additionalFields: { pin: '1' },
 		}])
 		expect(sentOf(sent, 'item.update')).toEqual([])
 	})
+
+	it('renders by the type the fetch opened it under until another is picked, so a rename since drops nothing', async () => {
+		// The snapshot calls the type a passkey by now, which would hide the password and drop the username.
+		const { sent, onSaved, user } = renderForm({ mode: 'clone', id: 'i1', items: { i1: editableItem({ typeId: 't-passkey', typeName: 'login' }) } })
+		expect((await screen.findByLabelText('Password') as HTMLInputElement).value).toBe('hunter2')
+		expect(field('Username').value).toBe('alice')
+		expect(screen.queryByText('Passkey credentials can only be changed in the Keepiq web app')).toBeNull()
+		const type = screen.getByLabelText('Type') as HTMLSelectElement
+		expect([type.disabled, type.selectedOptions[0]!.textContent]).toEqual([false, 'Login'])
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalledWith('new', undefined))
+		expect(created(sent)[0]).toMatchObject({ typeId: 't-passkey', key: 'hunter2', login: 'alice' })
+	})
+
+	it('renders by the snapshot once another type is picked', async () => {
+		const { user } = renderForm({ mode: 'clone', id: 'i1', items: { i1: editableItem({ typeId: 't-card', typeName: 'login', key: '{"number":"4111"}', login: null }) } })
+		expect((await screen.findByLabelText('Password') as HTMLInputElement).value).toBe('{"number":"4111"}')
+		await user.selectOptions(screen.getByLabelText('Type'), 't-identity')
+		expect(screen.getByRole('heading', { name: 'Identity' })).toBeTruthy()
+	})
+})
+
+describe('what an edit shows', () => {
+	const FIELDS = ['key', 'login', 'additionalFields'] as const
+	const card = (extra = '') => `{"number":"KEY-SEEN-1","expiry":"","cvv":"","pin":"","cardholder":""${extra}}`
+	const identity = '{"firstName":"KEY-SEEN-1","lastName":"","address":"","phone":"","email":"","bsn":""}'
+	/** Every value the form holds, in inputs and text areas alike. */
+	const shownValues = () => [...document.querySelectorAll<HTMLInputElement | HTMLTextAreaElement>('input, textarea')].map((input) => input.value)
+	const markersOf = (plaintext: string) => plaintext.match(/[A-Z]+-SEEN-\d/g)!
+
+	/** The background records a field only when `shownInFull` says so, so it must find every marker in the form exactly then. */
+	it.each([
+		['login', 'KEY-SEEN-1'], ['api_key', 'KEY-SEEN-1'], ['note', 'KEY-SEEN-1'], ['totp', 'KEY-SEEN-1'], ['passkey', 'KEY-SEEN-1'],
+		['card', card()], ['card', 'KEY-SEEN-1'], ['card', card(',"recovery":"KEY-SEEN-2"')], ['identity', identity], ['identity', card()],
+	])('agrees with shownInFull for a %s whose key is %s', async (typeName, key) => {
+		const plain = { key, login: 'LOGIN-SEEN-1', additionalFields: '{"pin":"FIELDS-SEEN-1","notes":"FIELDS-SEEN-2"}' }
+		renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: `t-${typeName}`, key, login: plain.login, additionalFields: JSON.parse(plain.additionalFields) }) } })
+		await screen.findByLabelText('Name')
+		const shown = shownValues().join('\n')
+		for (const field of FIELDS) {
+			expect([field, markersOf(plain[field]).every((marker) => shown.includes(marker))]).toEqual([field, shownInFull(field, plain[field], typeName)])
+		}
+	})
+
+	/** A value in every part `shownInFull` can count, so hiding any of them fails here. */
+	const sampleKey = (typeName: string) => {
+		const members = typeName === 'card' ? CARD_FIELDS : typeName === 'identity' ? IDENTITY_FIELDS : null
+		return members ? JSON.stringify(Object.fromEntries(members.map((member, i) => [member, `KEY-SEEN-${i}`]))) : 'KEY-SEEN-0'
+	}
+
+	it.each(types.map((type) => type.name))('shows each value of a %s item that shownInFull counts, which is all of it but a passkey\'s', async (typeName) => {
+		const plain = { key: sampleKey(typeName), login: 'LOGIN-SEEN-0', additionalFields: '{"pin":"FIELDS-SEEN-0","api":"FIELDS-SEEN-1","Notes":"FIELDS-SEEN-2"}' }
+		const passkey = typeName === 'passkey'
+		renderForm({
+			mode: 'edit', id: 'i1',
+			items: { i1: editableItem({ typeId: `t-${typeName}`, key: passkey ? '' : plain.key, login: plain.login, additionalFields: JSON.parse(plain.additionalFields) }) },
+		})
+		await screen.findByLabelText('Name')
+		const counted = FIELDS.filter((field) => shownInFull(field, plain[field], typeName))
+		expect(counted).toEqual(passkey ? [] : FIELDS)
+		const shown = shownValues()
+		for (const field of counted) for (const marker of markersOf(plain[field])) expect(shown).toContain(marker)
+	})
+
+	it('shows the username a note came with, keeps it while cleared, and clears it with null', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-note', key: 'Wifi', login: 'alice' }) } })
+		await user.clear(await screen.findByLabelText('Username'))
+		expect(field('Username').value).toBe('')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch: { login: null } })
+	})
+
+	it('shows a card key that is not a JSON object as one secret and saves it as typed', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-card', key: 'legacy card text', login: null }) } })
+		expect((await screen.findByLabelText('Card') as HTMLInputElement).value).toBe('legacy card text')
+		expect(screen.queryByLabelText('Number')).toBeNull()
+		await user.type(field('Card'), '!')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch: { key: 'legacy card text!' } })
+	})
+
+	/** A multi-line value as it is, which the default normalizer would join. */
+	const holding = (value: string) => screen.queryByDisplayValue(value, { normalizer: (shown) => shown })
+
+	it.each([
+		['LF', 'card', 'Card', 'line1\nline2'],
+		['LF', 'identity', 'Identity', 'line1\nline2'],
+		['LF', 'login', 'Password', 'line1\nline2'],
+		['CR', 'login', 'Password', 'line1\rline2'],
+		['CRLF', 'login', 'Password', 'line1\r\nline2'],
+	])('keeps the %s lines of a %s key through an edit, masked until shown', async (_, name, label, key) => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: `t-${name}`, key, login: null }) } })
+		await user.click(await screen.findByRole('button', { name: `Show ${label.toLowerCase()}` }))
+		const area = field(label)
+		expect(area.tagName).toBe('TEXTAREA')
+		expect(area.value).toBe(key)
+		await user.type(area, '!')
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch: { key: `${key}!` } })
+	})
+
+	// happy-dom hands a text area's value back unchanged, where a browser reads every break as LF; this sends what a browser would.
+	it.each([
+		['CRLF', 'Password', { key: 'a\r\nb' }, 'a\nb!', { key: 'a\r\nb!' }],
+		['CR', 'Password', { key: 'a\rb' }, 'a\nb!', { key: 'a\rb!' }],
+		['CRLF', 'Notes', { additionalFields: { notes: 'a\r\nb' } }, 'a\nb!', { additionalFields: { notes: 'a\r\nb!' } }],
+		['CR', 'Notes', { additionalFields: { notes: 'a\rb' } }, 'a\nb!', { additionalFields: { notes: 'a\rb!' } }],
+		['mixed', 'Password', { key: 'a\r\nb\nc' }, 'a\nb\nc!', { key: 'a\nb\nc!' }],
+	])('gives %s breaks back to the %s a browser hands over as LF', async (_, label, item, typed, patch) => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ login: null, ...item }) } })
+		await screen.findByLabelText('Name')
+		const show = screen.queryByRole('button', { name: `Show ${label.toLowerCase()}` })
+		if (show) await user.click(show)
+		fireEvent.change(field(label), { target: { value: typed } })
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		expect(sentOf(sent, 'item.update')[0]).toMatchObject({ patch })
+	})
+
+	it.each([
+		['Login', 't-login', 'Password'],
+		['Authenticator', 't-totp', 'Authenticator key'],
+	])('keeps the lines of a key typed under SSH key once switched to %s', async (_, typeId, label) => {
+		const snapshot = snapshotReply({ types: [...types, { id: 't-ssh_key', name: 'ssh_key', label: 'SSH key' }] })
+		const { user } = renderForm({ snapshot })
+		await user.selectOptions(screen.getByLabelText('Type'), 't-ssh_key')
+		await user.type(field('SSH key'), 'line1{Enter}line2')
+		await user.selectOptions(screen.getByLabelText('Type'), typeId)
+		const show = screen.queryByRole('button', { name: `Show ${label.toLowerCase()}` })
+		if (show) await user.click(show)
+		expect([field(label).tagName, field(label).value]).toEqual(['TEXTAREA', 'line1\nline2'])
+		await user.clear(field(label))
+		expect(field(label).tagName).toBe('TEXTAREA')
+	})
+
+	it.each([
+		['login', 'Password', 'password', 'line1\nline2'],
+		['card', 'Card', 'card', 'line1\r\nline2'],
+		['ssh_key', 'SSH key', 'SSH key', '-----BEGIN OPENSSH PRIVATE KEY-----'],
+		['totp', 'Authenticator key', 'authenticator key', 'JBSW Y3DP\r\nEHPK 3PXP'],
+	])('opens a %s key behind dots, as a password field would, with a toggle', async (name, label, named, key) => {
+		const snapshot = snapshotReply({ types: [...types, { id: 't-ssh_key', name: 'ssh_key', label: 'SSH key' }] })
+		const { user } = renderForm({ mode: 'edit', id: 'i1', snapshot, items: { i1: editableItem({ typeId: `t-${name}`, typeName: name, key, login: null }) } })
+		const show = await screen.findByRole('button', { name: `Show ${named}` })
+		expect(holding(key)).toBeNull()
+		expect(document.body.textContent).not.toContain('line1')
+		expect(document.body.textContent).not.toContain('BEGIN')
+		expect(show.getAttribute('aria-pressed')).toBe('false')
+		await user.click(show)
+		expect([field(label).tagName, field(label).value]).toEqual(['TEXTAREA', key])
+		expect(field(label).getAttribute('spellcheck')).toBe('false')
+		await user.click(screen.getByRole('button', { name: `Hide ${named}` }))
+		expect(holding(key)).toBeNull()
+	})
+
+	it('opens an empty multi-line secret ready to type in', async () => {
+		const snapshot = snapshotReply({ types: [...types, { id: 't-ssh_key', name: 'ssh_key', label: 'SSH key' }] })
+		const { user } = renderForm({ snapshot })
+		await user.selectOptions(screen.getByLabelText('Type'), 't-ssh_key')
+		expect(field('SSH key').tagName).toBe('TEXTAREA')
+		expect(screen.getByRole('button', { name: 'Hide SSH key' })).toBeTruthy()
+	})
+
+	it('shows in full what the fetch vouched for under its type, whatever the snapshot calls that type', async () => {
+		// The fetch's sync had the server call card type `t-card` a login, which vouched for item Y's identity in card X as one secret.
+		// The snapshot still calls it a card, under which the form would show blank card fields instead.
+		const y = '{"firstName":"Y-IDENTITY"}'
+		expect([shownInFull('key', y, 'login'), shownInFull('key', y, 'card')]).toEqual([true, false])
+		renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-card', typeName: 'login', key: y, login: null }) } })
+		expect((await screen.findByLabelText('Password') as HTMLInputElement).value).toBe(y)
+		expect(screen.queryByRole('heading', { name: 'Card details' })).toBeNull()
+		expect(screen.queryByLabelText('Number')).toBeNull()
+		const type = screen.getByLabelText('Type') as HTMLSelectElement
+		expect(type.selectedOptions[0]!.textContent).toBe('Login')
+	})
+
+	it('shows a plain key the fetch vouched for under card as one secret, whatever the snapshot calls that type', async () => {
+		renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-login', typeName: 'card', key: 'legacy card text', login: null }) } })
+		expect((await screen.findByLabelText('Card') as HTMLInputElement).value).toBe('legacy card text')
+		expect(screen.getByRole('heading', { name: 'Card details' })).toBeTruthy()
+		expect(screen.queryByLabelText('Number')).toBeNull()
+		expect(screen.queryByLabelText('Password')).toBeNull()
+		expect((screen.getByLabelText('Type') as HTMLSelectElement).selectedOptions[0]!.textContent).toBe('Card')
+	})
+
+	it('never sends a note\'s notes the form does not show, even another item\'s', async () => {
+		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem({ typeId: 't-note', key: 'Wifi', login: null, additionalFields: { notes: 'Y-RECOVERY-CODES' } }) } })
+		await user.click(await screen.findByRole('button', { name: 'Add field' }))
+		await user.type(field('Field name'), 'pin')
+		await user.type(field('pin'), '1')
+		const shown = shownValues()
+		await user.click(save())
+		await waitFor(() => expect(onSaved).toHaveBeenCalled())
+		const { additionalFields } = sentOf(sent, 'item.update')[0]!.patch as { additionalFields: Record<string, string> }
+		expect(additionalFields).toEqual({ pin: '1', notes: 'Y-RECOVERY-CODES' })
+		for (const value of Object.values(additionalFields)) expect(shown).toContain(value)
+	})
 })
 
 describe('offline', () => {
diff --git a/browser-extension/entrypoints/popup/views/ItemForm.tsx b/browser-extension/entrypoints/popup/views/ItemForm.tsx
index ef22c94cb..c8eb7320e 100644
--- a/browser-extension/entrypoints/popup/views/ItemForm.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemForm.tsx
@@ -1,8 +1,8 @@
 import { useEffect, useId, useRef, useState, type ReactNode } from 'react'
 import { i18n } from '#i18n'
-import type { EditableItem, VaultSnapshotReply, VaultWriteError } from '@/src/messages'
+import type { EditableItem, ShareSaveNote, VaultSnapshotReply, VaultWriteError, WriteResult } from '@/src/messages'
 import { parseTotpSeed, type TotpAlgorithm } from '@/src/totp/totp'
-import { CARD_FIELDS, emptyValues, formKind, fromItem, IDENTITY_FIELDS, isMultiline, type CardField, type FormValues, type IdentityField } from '@/src/vault/fields'
+import { CARD_FIELDS, emptyValues, formKind, formSections, fromItem, hasLineBreak, IDENTITY_FIELDS, isMultiline, keepLineBreaks, type CardField, type FormValues, type IdentityField } from '@/src/vault/fields'
 import { folderPath } from '@/src/vault/list'
 import { AdditionalFieldsEditor } from '../components/AdditionalFieldsEditor'
 import { Button } from '../components/Button'
@@ -32,8 +32,8 @@ interface Props {
 	snapshot: Unlocked
 	/** The page the popup opened on, which a new item's Website URL starts as. */
 	tabUrl?: string
-	/** Awaited, so Save stays busy until the shell shows the result. */
-	onSaved: (id: string) => Promise<void> | void
+	/** Awaited, so Save stays busy until the shell shows the result. `shareSave`: what an edit left to others. */
+	onSaved: (id: string, shareSave?: ShareSaveNote) => Promise<void> | void
 	onCancel: () => void
 	/** The item was deleted elsewhere. */
 	onGone: () => void
@@ -41,6 +41,13 @@ interface Props {
 
 const isRetryable = (error: VaultWriteError | undefined) => !error || error.code === 'offline' || error.code === 'server_error' || error.code === 'write_locked'
 
+type Partner = NonNullable<VaultWriteError['partners']>[number]
+
+/** The patch fields share-save sends to every copy. */
+const VALUE_FIELDS = ['key', 'login', 'additionalFields'] as const
+
+const unionOf = (earlier: Partner[], later: Partner[]) => [...earlier, ...later.filter((partner) => !earlier.some((known) => known.shareId === partner.shareId))]
+
 function FormSection({ title, children }: { title: string; children: ReactNode }) {
 	return (
 		<section className="section">
@@ -90,10 +97,12 @@ function Fetched(props: Props & { id: string }) {
 		}
 	}, [id, mode, attempt])
 
-	if (state.item) {
-		const initial = fromItem(state.item)
-		if (mode === 'clone') initial.name = i18n.t('item.cloneName', { name: state.item.name })
-		return <Form {...props} item={state.item} initial={initial} />
+	const { item } = state
+	if (item) {
+		// By the type the fetch opened it under: the snapshot's may be renamed since, which would hide or drop fields.
+		const initial = fromItem(item, item.typeName)
+		if (mode === 'clone') initial.name = i18n.t('item.cloneName', { name: item.name })
+		return <Form {...props} item={item} initial={initial} />
 	}
 	if (!state.failure) return <Loading />
 	const { error } = state.failure
@@ -107,8 +116,9 @@ function Fetched(props: Props & { id: string }) {
 					</Banner>
 				)
 				: (
-					<Banner tone="error" role="alert" action={isRetryable(error) && <Button variant="link" onClick={() => { setState({}); setAttempt((n) => n + 1) }}>{i18n.t('vault.tryAgain')}</Button>}>
-						{writeErrorText(error)}
+					// A conflict here can be a row written again while it opened, which the next attempt finds synced.
+					<Banner tone="error" role="alert" action={(isRetryable(error) || error?.code === 'conflict') && <Button variant="link" onClick={() => { setState({}); setAttempt((n) => n + 1) }}>{i18n.t('vault.tryAgain')}</Button>}>
+						{writeErrorText(error, 'open')}
 					</Banner>
 				)}
 		</div>
@@ -119,38 +129,61 @@ const ALGORITHMS: TotpAlgorithm[] = ['SHA1', 'SHA256', 'SHA512']
 
 function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { item?: EditableItem; initial: FormValues }) {
 	const shell = useShell()
-	const draft = useItemDraft(initial, snapshot.types)
+	const draft = useItemDraft(initial, snapshot.types, item && { id: item.typeId, name: item.typeName })
 	useUnsavedChangesGuard(draft.dirty)
 	const [busy, setBusy] = useState(false)
-	const [failure, setFailure] = useState<{ error: VaultWriteError | undefined } | null>(null)
+	/** `without` and `valueKey`: what the failed attempt sent, so Try again sends it again while the values are the same. */
+	const [failure, setFailure] = useState<{ error: VaultWriteError | undefined; without?: Partner[]; valueKey?: string } | null>(null)
 	const [picking, setPicking] = useState(false)
 	const formId = useId()
 	const { values, update } = draft
 	const kind = formKind(draft.typeName)
+	const sections = formSections(kind, values)
 	const error = (path: string) => (draft.errors[path] ? fieldErrorText(draft.errors[path]) : null)
+	// The partners agreed to so far hold for these values only; a later partner_unreachable names them with any new ones, so one click covers them all.
+	// Wrapped, so an untouched field and a cleared one differ.
+	const valueKey = JSON.stringify(VALUE_FIELDS.map((field) => (field in draft.patch ? [draft.patch[field]] : [])))
+	const [consent, setConsent] = useState<{ valueKey: string; partners: Partner[] }>()
+	if (consent && consent.valueKey !== valueKey) setConsent(undefined)
 
-	async function save() {
+	/** `without`: the partner shares to suspend, which the user agreed to after a `partner_unreachable` failure. */
+	async function save(without?: Partner[]) {
+		const withoutUnreachable = without?.map((partner) => partner.shareId)
 		const next = draft.submit()
 		if (!next || shell.offline || busy) return
 		setBusy(true)
 		setFailure(null)
-		let reply
+		let reply: WriteResult<{ id: string; shareSave?: ShareSaveNote }> | undefined
 		if (mode === 'edit' && item) {
 			if (!draft.dirty) {
 				await onSaved(item.id)
 				return
 			}
-			reply = await request({ kind: 'item.update', accountId: shell.accountId, id: item.id, patch: draft.patch, baseUpdatedAt: item.updatedAt })
+			reply = await request({ kind: 'item.update', accountId: shell.accountId, id: item.id, patch: draft.patch, baseUpdatedAt: item.updatedAt, recordId: item.recordId, ...(withoutUnreachable && { withoutUnreachable }) })
 		} else {
 			reply = await request({ kind: 'item.create', accountId: shell.accountId, draft: next })
 		}
 		if (reply?.ok) {
-			await onSaved(reply.value.id)
+			await onSaved(reply.value.id, reply.value.shareSave)
 			return
 		}
 		setBusy(false)
-		if (reply?.error.code === 'locked' || reply?.error.code === 'session_revoked') shell.refreshState()
-		setFailure({ error: reply?.error })
+		let failed = reply?.error
+		if (failed?.code === 'partner_unreachable') failed = { ...failed, partners: unionOf(without ?? consent?.partners ?? [], failed.partners ?? []) }
+		if (failed?.code === 'locked' || failed?.code === 'session_revoked') shell.refreshState()
+		setFailure({ error: failed, without, valueKey })
+	}
+
+	function failureAction({ error, without, valueKey: failedKey }: NonNullable<typeof failure>): ReactNode {
+		const partners = error?.code === 'partner_unreachable' ? error.partners : undefined
+		if (partners?.length) {
+			const onClick = () => {
+				setConsent({ valueKey, partners })
+				void save(partners)
+			}
+			return <Button variant="link" onClick={onClick}>{i18n.t('shareSave.saveWithout')}</Button>
+		}
+		return isRetryable(error) && <Button variant="link" onClick={() => void save(failedKey === valueKey ? without : undefined)}>{i18n.t('vault.tryAgain')}</Button>
 	}
 
 	const card = (member: CardField) => (value: string) => update({ card: { ...values.card, [member]: value } })
@@ -163,6 +196,7 @@ function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { it
 		phone: i18n.t('detail.phone'), email: i18n.t('detail.email'), bsn: i18n.t('detail.bsn'),
 	}
 	const masked: ReadonlySet<string> = new Set(['number', 'cvv', 'pin', 'bsn'])
+	const keyboards: Partial<Record<IdentityField, 'email' | 'tel'>> = { email: 'email', phone: 'tel' }
 
 	let seed = { algorithm: 'SHA1' as TotpAlgorithm, digits: 6 as 6 | 8, period: 30 }
 	try {
@@ -171,10 +205,20 @@ function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { it
 		// The defaults stand in until the key parses.
 	}
 	const totp = { ...seed, ...values.totp }
+	// Kept once on, so a key typed under SSH key keeps its lines under Login, and deleting the last break keeps the focus.
+	const [multiline, setMultiline] = useState(() => hasLineBreak(values.secret))
+	if (!multiline && hasLineBreak(values.secret)) setMultiline(true)
 	const folderLabel = folderPath(snapshot.folders, values.folderId) ?? i18n.t('filters.noFolder')
+	// Labelled as the type the form renders by, which after a rename the snapshot may hold under another id.
+	const rendered = draft.typeName === undefined ? undefined : snapshot.types.find((type) => type.id === values.typeId && type.name === draft.typeName) ?? snapshot.types.find((type) => type.name === draft.typeName)
+	const typeOptions = draft.typeName === undefined ? snapshot.types : snapshot.types.map((type) => (type.id === values.typeId ? { ...type, label: rendered?.label ?? draft.typeName! } : type))
 	const secretLabel = draft.typeName === 'login' || draft.typeName === 'database' || !draft.typeName
 		? i18n.t('detail.password')
-		: snapshot.types.find((type) => type.id === values.typeId)?.label ?? i18n.t('form.secret')
+		: rendered?.label ?? i18n.t('form.secret')
+	const areaChange = (field: 'secret' | 'notes') => (value: string) => update({ [field]: keepLineBreaks(value, initial[field]) })
+	const secretField = (label: string, autoComplete: string, area = multiline) => area
+		? <TextArea label={label} value={values.secret} onChange={areaChange('secret')} error={error('secret')} rows={6} mono concealed />
+		: <TextField label={label} type="password" value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} autoComplete={autoComplete} />
 
 	return (
 		<>
@@ -188,12 +232,13 @@ function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { it
 					</Banner>
 				)}
 				{failure && (
-					<Banner tone="error" role="alert" action={isRetryable(failure.error) && <Button variant="link" onClick={() => void save()}>{i18n.t('vault.tryAgain')}</Button>}>
+					<Banner tone="error" role="alert" action={failureAction(failure)}>
 						{writeErrorText(failure.error, mode === 'edit' ? 'edit' : 'item')}
+						{failure.error?.code === 'unverified' && <><br /><a href={snapshot.webAppUrl} target="_blank" rel="noreferrer">{i18n.t('common.openWebApp')}</a></>}
 					</Banner>
 				)}
 				<FormSection title={i18n.t('form.itemDetails')}>
-					<TypeSelect types={snapshot.types} value={values.typeId} onChange={(typeId) => update({ typeId })} disabled={mode === 'edit'} />
+					<TypeSelect types={typeOptions} value={values.typeId} onChange={(typeId) => update({ typeId })} disabled={mode === 'edit'} />
 					<TextField label={i18n.t('form.name')} value={values.name} onChange={(name) => update({ name })} error={error('name')} autoComplete="off" />
 					<div className="field">
 						<span className="field__label" aria-hidden="true">{i18n.t('form.folder')}</span>
@@ -203,22 +248,20 @@ function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { it
 							<Icon name="chevronRight" />
 						</button>
 					</div>
-					{kind === 'note' && <TextArea label={i18n.t('form.note')} value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} rows={8} />}
+					{kind === 'note' && <TextArea label={i18n.t('form.note')} value={values.secret} onChange={areaChange('secret')} error={error('secret')} rows={8} />}
 				</FormSection>
 
 				{kind === 'passkey' && <p className="hint">{i18n.t('form.passkeyReadOnly')}</p>}
 				{kind === 'credential' && (
 					<FormSection title={i18n.t('detail.loginCredentials')}>
-						<TextField label={i18n.t('detail.username')} value={values.login} onChange={(login) => update({ login })} error={error('login')} autoComplete="off" />
-						{isMultiline(draft.typeName)
-							? <TextArea label={secretLabel} value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} rows={6} spellCheck={false} mono />
-							// The generate button joins here with ext-generator's pick mode.
-							: <TextField label={secretLabel} type="password" value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} autoComplete="new-password" />}
+						{sections.login && <TextField label={i18n.t('detail.username')} value={values.login} onChange={(login) => update({ login })} error={error('login')} autoComplete="off" verbatim />}
+						{/* The generate button joins the single-line field with ext-generator's pick mode. */}
+						{secretField(secretLabel, 'new-password', isMultiline(draft.typeName) || multiline)}
 					</FormSection>
 				)}
 				{kind === 'totp' && (
 					<FormSection title={i18n.t('form.authenticator')}>
-						<TextField label={i18n.t('detail.authenticatorKey')} type="password" value={values.secret} onChange={(secret) => update({ secret })} error={error('secret')} autoComplete="off" spellCheck={false} />
+						{secretField(i18n.t('detail.authenticatorKey'), 'off')}
 						<details className="advanced">
 							<summary>{i18n.t('form.advanced')}</summary>
 							<Select<TotpAlgorithm> label={i18n.t('form.algorithm')} value={totp.algorithm} options={ALGORITHMS.map((value) => ({ value, label: value }))} onChange={(algorithm) => update({ totp: { ...values.totp, algorithm } })} />
@@ -227,35 +270,37 @@ function Form({ mode, item, initial, snapshot, onSaved, onCancel }: Props & { it
 						</details>
 					</FormSection>
 				)}
-				{kind === 'card' && (
-					<FormSection title={i18n.t('detail.cardDetails')}>
-						{CARD_FIELDS.map((member) => (
-							<TextField key={member} label={cardLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.card[member]} onChange={card(member)} error={error(`card.${member}`)} autoComplete="off" />
-						))}
-						{error('secret') && <p className="field__error">{error('secret')}</p>}
-					</FormSection>
-				)}
-				{kind === 'identity' && (
-					<FormSection title={i18n.t('detail.identity')}>
-						{IDENTITY_FIELDS.map((member) => (
-							<TextField key={member} label={identityLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.identity[member]} onChange={identity(member)} error={error(`identity.${member}`)} autoComplete="off" />
-						))}
-						{error('secret') && <p className="field__error">{error('secret')}</p>}
+				{(kind === 'card' || kind === 'identity') && (
+					<FormSection title={kind === 'card' ? i18n.t('detail.cardDetails') : i18n.t('detail.identity')}>
+						{sections.key === 'members'
+							? (
+								<>
+									{kind === 'card' && CARD_FIELDS.map((member) => (
+										<TextField key={member} label={cardLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.card[member]} onChange={card(member)} error={error(`card.${member}`)} autoComplete="off" />
+									))}
+									{kind === 'identity' && IDENTITY_FIELDS.map((member) => (
+										<TextField key={member} label={identityLabels[member]} type={masked.has(member) ? 'password' : 'text'} value={values.identity[member]} onChange={identity(member)} error={error(`identity.${member}`)} autoComplete="off" inputMode={keyboards[member]} verbatim={member in keyboards} />
+									))}
+									{error('secret') && <p className="field__error">{error('secret')}</p>}
+								</>
+							)
+							: secretField(secretLabel, 'off')}
 					</FormSection>
 				)}
 
 				<FormSection title={i18n.t('form.autofillOptions')}>
-					<TextField label={i18n.t('form.website')} value={values.url} onChange={(url) => update({ url })} error={error('url')} inputMode="url" autoComplete="off" spellCheck={false} />
+					{kind !== 'credential' && sections.login && <TextField label={i18n.t('detail.username')} value={values.login} onChange={(login) => update({ login })} error={error('login')} autoComplete="off" verbatim />}
+					<TextField label={i18n.t('form.website')} value={values.url} onChange={(url) => update({ url })} error={error('url')} inputMode="url" autoComplete="off" verbatim />
 				</FormSection>
-				{kind !== 'passkey' && (
+				{sections.fields && (
 					<FormSection title={i18n.t('detail.additionalFields')}>
 						<AdditionalFieldsEditor fields={values.fields} errors={draft.errors} onChange={(fields) => update({ fields })} />
 						{error('additionalFields') && <p className="field__error">{error('additionalFields')}</p>}
 					</FormSection>
 				)}
-				{kind !== 'passkey' && kind !== 'note' && (
+				{sections.notes && (
 					<FormSection title={i18n.t('form.additionalOptions')}>
-						<TextArea label={i18n.t('detail.notes')} value={values.notes} onChange={(notes) => update({ notes })} error={error('notes')} />
+						<TextArea label={i18n.t('detail.notes')} value={values.notes} onChange={areaChange('notes')} error={error('notes')} />
 					</FormSection>
 				)}
 			</form>
diff --git a/browser-extension/entrypoints/popup/views/Shell.test.tsx b/browser-extension/entrypoints/popup/views/Shell.test.tsx
index 57ec0dfaf..135ae5914 100644
--- a/browser-extension/entrypoints/popup/views/Shell.test.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.test.tsx
@@ -343,3 +343,101 @@ describe('item writes', () => {
 		expect((await title()).textContent).toBe('Vault')
 	})
 })
+
+describe('the share-save note after a save', () => {
+	const footer = () => document.querySelector<HTMLElement>('.popup__footer')!
+	const toast = () => document.querySelector('.toast')?.textContent
+	const notes = () => [...document.querySelectorAll('.banner--warning')].map((banner) => banner.textContent)
+	const OWN_COPY = 'Only your copy changed. The owner and the others it is shared with keep the old value.'
+
+	/** Answers each save of i1 with the next of `shareSaves`; `undefined` is a save that reached everyone. */
+	function background(...shareSaves: unknown[]) {
+		const options = {
+			snapshot: snapshotReply({ items: [itemMeta(), itemMeta({ id: 'i2', name: 'GitLab', url: 'https://gitlab.com' })] }),
+			decrypted: { i1: { login: 'alice', key: 'pw' }, i2: { login: 'alice', key: 'pw' } },
+			items: { i1: editableItem() },
+			replies: {
+				'item.update': () => {
+					const shareSave = shareSaves.shift()
+					return { ok: true, value: shareSave === undefined ? { id: 'i1' } : { id: 'i1', shareSave } }
+				},
+			},
+		}
+		const sent = fakeBackground(options)
+		return { sent, reopen: () => fakeBackground(options) }
+	}
+
+	async function editUsername(user: ReturnType<typeof userEvent.setup>) {
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		await user.click(within(footer()).getByRole('button', { name: 'Edit' }))
+		await user.type(await screen.findByLabelText('Username'), '2')
+		await user.click(within(footer()).getByRole('button', { name: 'Save' }))
+		await vi.waitFor(async () => expect((await title()).textContent).toBe('View item'))
+	}
+
+	it('shows only "Item saved" when everyone got the change', async () => {
+		background(undefined)
+		render(<App />)
+		await editUsername(userEvent.setup())
+		expect(toast()).toBe('Item saved')
+		expect(notes()).toEqual([])
+	})
+
+	it.each([
+		['only the editor\'s copy changed', { scope: 'own_copy' }, OWN_COPY],
+		['partners stay with the owner', { scope: 'copy', ownerOnly: true }, 'Saved. Recipients at partner organisations get this change when the owner next saves it.'],
+		['partners were suspended', { scope: 'source', suspended: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.Open the Keepiq web app'],
+		['partners were saved without', { scope: 'source', paused: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused until you share this item with them again.'],
+	])('notes on the item\'s detail that %s, beside "Item saved"', async (_, shareSave, text) => {
+		background(shareSave)
+		render(<App />)
+		await editUsername(userEvent.setup())
+		expect(toast()).toBe('Item saved')
+		expect(notes()).toEqual([text])
+	})
+
+	it('keeps the note for that item, and drops it once another item\'s detail opens', async () => {
+		background({ scope: 'own_copy' })
+		render(<App />)
+		const user = userEvent.setup()
+		await editUsername(user)
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		expect(notes()).toEqual([OWN_COPY])
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		await user.click(await screen.findByRole('button', { name: /^GitLab/ }))
+		expect(notes()).toEqual([])
+		await user.click(screen.getByRole('button', { name: 'Back' }))
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		expect(notes()).toEqual([])
+	})
+
+	it('shows no note in a reopened popup, and asks the background for none', async () => {
+		const { reopen } = background({ scope: 'own_copy' })
+		render(<App />)
+		const user = userEvent.setup()
+		await editUsername(user)
+		expect(notes()).toHaveLength(1)
+		cleanup()
+		const sent = reopen()
+		render(<App />)
+		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
+		expect((await title()).textContent).toBe('View item')
+		expect(notes()).toEqual([])
+		expect(sentKinds(sent).filter((kind) => !['vault.status', 'vault.snapshot', 'settings.get', 'item.decrypt', 'popup.lastTab.set'].includes(kind))).toEqual([])
+	})
+
+	it('drops the note once a later save of the item reaches everyone', async () => {
+		const { sent } = background({ scope: 'own_copy' }, undefined)
+		render(<App />)
+		const user = userEvent.setup()
+		await editUsername(user)
+		expect(notes()).toHaveLength(1)
+		await user.click(within(footer()).getByRole('button', { name: 'Edit' }))
+		await user.type(await screen.findByLabelText('Username'), '3')
+		await user.click(within(footer()).getByRole('button', { name: 'Save' }))
+		await vi.waitFor(() => expect(sentOf(sent, 'item.update')).toHaveLength(2))
+		await vi.waitFor(async () => expect((await title()).textContent).toBe('View item'))
+		expect(notes()).toEqual([])
+	})
+})
diff --git a/browser-extension/entrypoints/popup/views/Shell.tsx b/browser-extension/entrypoints/popup/views/Shell.tsx
index 5be9af3f2..d2154a6a0 100644
--- a/browser-extension/entrypoints/popup/views/Shell.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.tsx
@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { i18n } from '#i18n'
-import type { AccountSummary, ItemMeta, PopupTab } from '@/src/messages'
+import type { AccountSummary, ItemMeta, PopupTab, ShareSaveNote } from '@/src/messages'
 import { folderPath } from '@/src/vault/list'
 import { webUrl } from '@/src/vault/url'
 import { ConfirmDialog } from '../components/ConfirmDialog'
@@ -49,6 +49,8 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	const [form, setForm] = useState<FormPage | null>(null)
 	const [section, setSection] = useState<SettingsSection | null>(null)
 	const [dialog, setDialog] = useState<ShellDialog | null>(null)
+	// In memory only, so it is gone once the popup closes (share-sync).
+	const [shareSave, setShareSave] = useState<{ id: string; note: ShareSaveNote } | null>(null)
 	// A fresh object per call, so the same message twice restarts the timer.
 	const [toast, setToast] = useState<{ text: string } | null>(null)
 	const [footer, setFooter] = useState<HTMLElement | null>(null)
@@ -121,6 +123,7 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 	const open = useCallback((id: string) => {
 		leaveList()
 		setDetailId(id)
+		setShareSave((current) => (current?.id === id ? current : null))
 	}, [leaveList])
 
 	function select(next: PopupTab) {
@@ -145,10 +148,11 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 		else setToast({ text: i18n.t('vault.popoutFailed') })
 	}
 
-	/** The write's reply came after its sync, so one re-read shows the result. */
-	async function saved(id: string) {
+	/** The write's reply came after its sync, so one re-read shows the result. A note opens the item's detail, which shows it. */
+	async function saved(id: string, note?: ShareSaveNote) {
 		await reload()
-		setDetailId(form?.mode === 'edit' ? detailId : id)
+		setDetailId(form?.mode === 'edit' && !note ? detailId : id)
+		setShareSave(note ? { id, note } : null)
 		setForm(null)
 		setToast({ text: i18n.t('item.saved') })
 	}
@@ -177,7 +181,16 @@ export function Shell({ active, lastTab, hidden = false, onAccounts, refreshStat
 						</div>
 						{form && <ItemForm key={`${form.mode}:${form.id ?? ''}`} mode={form.mode} id={form.id} snapshot={snapshot} tabUrl={tabUrl} onSaved={saved} onCancel={() => leave(closeForm)} onGone={gone} />}
 						{/* Unmounted under a panel, so no decrypted value waits in the hidden DOM; it decrypts again on return. */}
-						{detail && !form && !hidden && <ItemDetail key={detail.id} item={detail} type={snapshot.types.find((t) => t.id === detail.typeId)} folders={snapshot.folders} webAppUrl={snapshot.webAppUrl} />}
+						{detail && !form && !hidden && (
+							<ItemDetail
+								key={detail.id}
+								item={detail}
+								type={snapshot.types.find((t) => t.id === detail.typeId)}
+								folders={snapshot.folders}
+								webAppUrl={snapshot.webAppUrl}
+								shareSave={shareSave?.id === detail.id ? shareSave.note : undefined}
+							/>
+						)}
 					</>
 				)
 				: <Loading />
diff --git a/browser-extension/locales/en.yml b/browser-extension/locales/en.yml
index 0f81a81ad..39c96f9fd 100644
--- a/browser-extension/locales/en.yml
+++ b/browser-extension/locales/en.yml
@@ -205,7 +205,22 @@ writeErrors:
   serverError: Keepiq is unavailable right now, try again later
   unreadable: Could not read this item, so it cannot be edited here
   restricted: This item was shared with you with limits, so it cannot be changed or copied here
+  unmatched: Keepiq sent a version of this item that your vault does not hold, so it was not opened.
   keyMismatch: Keepiq sent an encryption key that does not match your vault, so nothing was saved. Tell your Keepiq administrator.
+  staleSource: The original of this shared item was changed after you opened it. Nothing was saved; open it again and redo your change.
+  incomplete: The people this item is shared with kept changing while it was saved. Nothing was saved; please try again.
+  badCertificate: Keepiq sent an encryption key for someone this item is shared with that this browser could not read. Nothing was saved.
+  unverified: This item is shared with partner organisations, and this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app.
+  partnerUnreachable: "Nothing was saved: a partner organisation this item is shared with can't be reached ({cloudIds}). Try again later, or save without them, which pauses sharing this item with them until you share it with them again."
+  partnerLookupLimit: Too many partner lookups. Nothing was saved; try again in a minute.
+  federationUnavailable: Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator.
+
+shareSave:
+  saveWithout: Save without them
+  ownCopy: Only your copy changed. The owner and the others it is shared with keep the old value.
+  ownerOnly: Saved. Recipients at partner organisations get this change when the owner next saves it.
+  suspended: Sharing with {cloudIds} is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.
+  paused: Sharing with {cloudIds} is paused until you share this item with them again.
 
 folders:
   add: Add folder
@@ -264,7 +279,6 @@ detail:
   item: Item
   decrypting: Decrypting…
   decryptFailed: Could not decrypt this item
-  unreadable: Could not read this item
   unreadablePasskey: Could not read this passkey
   unreadableFields: Could not read additional fields
   loginCredentials: Login credentials
diff --git a/browser-extension/locales/nl.yml b/browser-extension/locales/nl.yml
index 131e2cadc..ec8e2ec52 100644
--- a/browser-extension/locales/nl.yml
+++ b/browser-extension/locales/nl.yml
@@ -204,7 +204,22 @@ writeErrors:
   serverError: Keepiq is nu niet beschikbaar, probeer het later opnieuw
   unreadable: Dit item kan niet worden gelezen en dus hier niet worden bewerkt
   restricted: Dit item is met beperkingen met je gedeeld, dus je kunt het hier niet wijzigen of kopiëren
+  unmatched: Keepiq stuurde een versie van dit item die je kluis niet heeft, dus het is niet geopend.
   keyMismatch: Keepiq stuurde een versleutelingssleutel die niet bij je kluis past, dus er is niets opgeslagen. Meld dit bij je Keepiq-beheerder.
+  staleSource: Het origineel van dit gedeelde item is gewijzigd nadat je het opende. Er is niets opgeslagen; open het opnieuw en voer je wijziging nog eens uit.
+  incomplete: Met wie dit item gedeeld is, veranderde steeds tijdens het opslaan. Er is niets opgeslagen; probeer het opnieuw.
+  badCertificate: Keepiq stuurde voor iemand met wie dit item gedeeld is een versleutelingssleutel die deze browser niet kon lezen. Er is niets opgeslagen.
+  unverified: Dit item is gedeeld met partnerorganisaties, en deze browser kan niet bevestigen dat ze het precies zo krijgen als jij het zag. Er is niets opgeslagen; voer deze wijziging uit in de Keepiq-webapp.
+  partnerUnreachable: "Er is niets opgeslagen: een partnerorganisatie waarmee dit item gedeeld is, is niet bereikbaar ({cloudIds}). Probeer het later opnieuw, of sla op zonder hen. Dan wordt het delen van dit item met hen gepauzeerd tot je het opnieuw met hen deelt."
+  partnerLookupLimit: Te veel zoekopdrachten naar partners. Er is niets opgeslagen; probeer het over een minuut opnieuw.
+  federationUnavailable: Je Keepiq-server kan niet delen met partnerorganisaties, dus dit item kan hier niet worden opgeslagen. Er is niets opgeslagen; vraag het je beheerder.
+
+shareSave:
+  saveWithout: Opslaan zonder hen
+  ownCopy: Alleen jouw kopie is gewijzigd. De eigenaar en de anderen met wie het gedeeld is, houden de oude waarde.
+  ownerOnly: Opgeslagen. Ontvangers bij partnerorganisaties krijgen deze wijziging zodra de eigenaar het item weer opslaat.
+  suspended: Delen met {cloudIds} is gepauzeerd, omdat hun certificaat niet kon worden geverifieerd of hun organisatie de deling niet meer accepteert. De Keepiq-webapp toont de deling.
+  paused: Delen met {cloudIds} is gepauzeerd tot je dit item opnieuw met hen deelt.
 
 folders:
   add: Map toevoegen
@@ -263,7 +278,6 @@ detail:
   item: Item
   decrypting: Ontsleutelen…
   decryptFailed: Kan dit item niet ontsleutelen
-  unreadable: Kan dit item niet lezen
   unreadablePasskey: Kan deze passkey niet lezen
   unreadableFields: Kan de extra velden niet lezen
   loginCredentials: Inloggegevens
diff --git a/browser-extension/openspec/README.md b/browser-extension/openspec/README.md
index 3abd181ba..fd81d0471 100644
--- a/browser-extension/openspec/README.md
+++ b/browser-extension/openspec/README.md
@@ -22,7 +22,7 @@ Changes build on each other in this order. Each proposal lists its predecessors
 7. `ext-settings`: the rest of the Settings tab
 8. `ext-autofill`: fill from popup, context menu, shortcut, save and update prompts
 9. `ext-toolbar-icon`: logged out, locked and unlocked icon, badge counter of matching logins
-10. `ext-share-sync`: an edit of a shared item reaches every recipient's copy; a proposal so far, from the ext-vault-edit review
+10. `ext-share-sync`: an edit of a shared item reaches every recipient's copy, from the ext-vault-edit review
 
 Later slices not yet specced: inline autofill menu, passkey provider, TOTP autofill, card and identity fill, password history, import and export. Website icons wait on a Keepiq change that stores a favicon on the secret (ADR-002).
 
diff --git a/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md b/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
index d692c86d5..c2413f8b3 100644
--- a/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
+++ b/browser-extension/openspec/architecture/adr-002-key-lifetime-and-vault-cache.md
@@ -20,7 +20,7 @@ Four adversaries against the data the extension holds. "Exposed" means the adver
 | --- | --- | --- | --- | --- |
 | Master password | Never (never sent) | Never stored; keylogger is out of scope for this design | Never stored | Never |
 | RSA private key | Never | Not on disk (`storage.session` is memory-backed); "Never" timeout is the exception and is warned | Exposed while unlocked, for the timeout window | Never (`storage.session` is not exposed to content scripts) |
-| Decrypted item fields | Never | Never on disk | Exposed for what is on screen while unlocked | One credential per fill, after explicit user choice |
+| Decrypted item fields | Never, except the whole value of an item whose `key`, `login` or `additionalFields` the user edits: any such item for the owner's server, shared or not, and one shared with its own users for a partner's server. When the item has a field the form does not show, the owner's server gets only the changed fields, and a partner share stops the save. A swap in a sync before the edit form opens makes that value any item's, as the form shows it (see Sharing) | Never on disk | Exposed for what is on screen while unlocked | One credential per fill, after explicit user choice |
 | Ciphertext and plaintext metadata (names, URLs, folders) | Already held by the server | Ciphertext useless without the key; names and URLs leak which sites the user has accounts on | Names and URLs visible while unlocked | Never |
 | App password | Already held by the server | Exposed; grants read and write of ciphertext via the API, not decryption | Exposed | Never |
 
@@ -41,6 +41,7 @@ The extension caches ciphertext on disk and never persists the private key or an
 | PBKDF2-derived unlock key | Memory, for the duration of one unlock | End of unlock |
 | RSA private key | `browser.storage.session` as PKCS#8 bytes, imported to a non-extractable `CryptoKey` per worker generation | Lock, timeout, browser restart, extension reload |
 | Decrypted item fields | Memory, per popup render or per fill | Popup close or fill completion |
+| Ciphertext an edit form opened, with the row's `updatedAt` and the source's `sourceUpdatedAt`, the 10 newest forms | `browser.storage.session` | That form's accepted save, or 10 newer entries; lock, timeout, logout, account removal, browser restart, extension reload. Closing the form or popup leaves it. |
 | Suite row, secret rows (ciphertext plus plaintext metadata), folders, types | `browser.storage.local` | Logout, account removal, suite change (`encryptionSuiteId` or `unlockKeyEpoch` differs on sync) |
 | App password | `browser.storage.local` | Logout, account removal, server returns 401 |
 | Account list, active account id, settings | `browser.storage.local` | Account removal |
@@ -72,6 +73,16 @@ A compromised server could also keep the suite id and epoch and swap only the ce
 
 The window between revocation and next contact is bounded by the sync interval. Sync runs on unlock, on popup open when the last sync is older than the interval, on a fixed interval while unlocked, and after every local write. The interval is a named constant, not an emergent property.
 
+## Sharing
+
+Each recipient of a shared item holds a copy encrypted to their own key, so an edit is re-encrypted in the background for every copy the server lists, and saved with them in one share-save that writes everything or nothing (`ext-share-sync`).
+
+- Local recipients' certificates are trusted as the server serves them, as in the web app and as Bitwarden trusts organisation membership. Only the user's own certificate can be proven against the unlocked key; a compromised server can therefore list a recipient the user never chose and receive the changed fields of any item the user edits, shared or not. Accepted, and the extension does not warn before the save.
+- Partner-organisation certificates must chain through CA certificates to the partner root the owner's server pinned and name the share's recipient. Both servers are still trusted, since the pin comes in the owner server's reply and the partner server holds its own CA keys; the check catches a certificate for the wrong user, an expired one, or a chain from another partner. The server names the partner shares a save must carry and they get the whole value, so the owner's server alone can make up a share under its own pin and receive the `key`, `login` and `additionalFields` of any item whose value the user edits, shared or not, unless the item has a field the form does not show, when the save stops. Accepted, as in the web app.
+- Every field is encrypted to the same key and nothing ties a ciphertext to its item, so a save sends what the user typed. The edit and clone fetches open a ciphertext only when it equals the vault cache's for that item, and a save gives partners untouched fields only as its own form's edit fetch recorded them, found by the random `recordId` the popup sends back, and only while the record's version is the save's `baseUpdatedAt`; a save naming none or an unknown one has no record. The fetch records a field only when it is empty or the form shows it in full (`shownInFull` in `src/vault/fields.ts`), so an unseen one, such as a passkey's credential or a card member the form has no field for, is never vouched for. The form shows every type's login except a passkey's, so an item the web app or the extension wrote has an unseen field only when it is a passkey. The edit form, and a clone until another type is picked, renders under the type name the fetch vouched under, not the popup's snapshot, so a type renamed in between cannot hide a field. Without a record for every untouched field, a save the server requires partner shares for fails with `unverified` and writes nothing; local copies need only the changed fields. A server that puts another item's ciphertext into this item's row in a sync before the edit form opens is outside these checks. Accepted: the form then shows that value as this item's, masked where it is a password, and the save sends it on. That can be any item's value, not only the edited one's.
+- The server orders concurrent saves: share-save refuses a stale `baseUpdatedAt`, and on the copy-editor path a stale `sourceBaseUpdatedAt`, the source version the edit form read or, without the form's record, the current one. The extension keeps no save state, queue or Retry.
+- The decrypted value lives in background memory for the one request. `storage.session` holds only what an edit form opened, as ciphertext, with the row and source versions.
+
 ## Sync
 
 There is no cursor. An unchanged vault must still cost one cheap call: sync first asks `GET /api/v1/secrets?sort=updated_at&direction=desc&limit=1` and compares the newest `updatedAt` and `total` with the cached snapshot; only when either differs, or the folder and type lists are stale, does it fetch `GET /api/v1/offline/manifest` and replace the local snapshot atomically. Deletions change `total`, edits and creates change `updatedAt`. When the manifest is refused (admin disabled, ADR-003) or returns 404, sync falls back to paginated `GET /api/v1/secrets` plus folders and types. A full fetch is acceptable because rows are small and vaults are hundreds of items, not hundreds of thousands.
diff --git a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
index a670e9991..98d174968 100644
--- a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
+++ b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
@@ -28,6 +28,10 @@ All paths relative to the base URL. All require the Basic auth above unless mark
 | Secret CRUD | `GET/PUT/DELETE /api/v1/secrets/{id}`, `POST /api/v1/secrets` | Create takes `name` (required), `key` (required ciphertext), `url`, `typeId`, `folderId`, `login`, `additionalFields`; returns 201 with the row. `name` is at most 255 characters. `PUT` is a sparse patch: only fields present in the body change, `null` clears a field. With `baseUpdatedAt` it answers 409 when the stored `updatedAt` differs (whole seconds); without it the last write wins. Since 2026-09-30 `DELETE` moves the secret to the trash (`trashed_at`) and revokes every share of it, returning `{"status":"deleted","trashed":true}`; `POST …/restore` and `DELETE …/purge` restore or purge it, and a daily job purges after the admin's `trash_retention_days` (default 30). Trashed secrets are left out of lists and the manifest. |
 | Refusals | any route | The OCS controllers (secrets, folders, the manifest, suites, types) refuse with 428, not 403: Nextcloud turns a 403 there into an HTTP 200 envelope, so `OcsRefusalMiddleware` re-statuses it. The body keeps `message` and adds `error`, a vault policy's code or else `forbidden`. Plain controllers (`DELETE /api/v1/secrets/{id}`, settings) still answer 403, with a policy's `code` when there is one. A blocked suite, a folder someone else owns and a read-only copy all come without a code, so clients cannot tell those apart. The web app treats both statuses alike (`src/utils/refusal.js`). The middleware's comment cites measurements on Nextcloud 35 from 2026-10-04; the manifest's 428 was checked on the stable35 dev server on 2026-10-12. The key-proof guard (`VaultKeyProofMiddleware`) also answers 428, with `error: key_proof_required`, but on none of the routes the extension calls. |
 | Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Names are trimmed and refuse `/`; a duplicate sibling is 409. Children: `{directSecretCount, subfolders: [{id, name, secretCount, subfolderCount}]}`. Delete: an empty folder needs nothing, a leaf with items `?cascade=delete|move` (409 without), a folder with subfolders a JSON body `{directSecrets: 'delete'|'move', subfolders: {<id>: 'delete'|'move'|'keep'}}` naming every direct subfolder (409 without, 400 when one is missing). Folder deletes are immediate, with no trash, and count and delete archived and trashed items too. They are all or nothing: a refusal, such as a kept subfolder whose name is taken one level up (409), comes before anything is moved or purged (keepiq#1248). |
+| Write context | `GET /api/v1/secrets/{id}/write-context` | `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId` equal to `id` means the caller's own item; otherwise `effectiveGrade` `owner` (a delegate), `write` or `manage` may save for every copy, anything else only their own. `ownerCertificate` is `null` when the owner has no active suite. 404 when the secret is gone. |
+| Share-save | `PUT /api/v1/secrets/{id}/share-save` | `{baseUpdatedAt, sourceBaseUpdatedAt?, patch, copies, skipped, federated?, suspend?, stage?}`, one transaction. `{id}` is the caller's own row; `sourceBaseUpdatedAt` is required on a copy. `patch` is the sparse body of `PUT /api/v1/secrets/{id}` and must carry `key`, `login` or `additionalFields` (400 `no_value_change`). Copies `{secretId, key?, login?, additionalFields?}` carry exactly the patch's value fields; `skipped` `{secretId, reason: 'no_vault_key'}`; partner shares `{shareId, certFingerprint, key, login, additionalFields}`, the whole value, owner path only; `suspend` `{shareId, reason}`. 200 `{secret, sourceUpdatedAt, copies, federated: {…, ownerOnly}}`. 409 `incomplete` with the required copies (`{secretId, holder, targetUserId}`) and partner shares (`{shareId, recipientCloudId}`), `stale` with `current`, `stale_source`. At most 100 entries per list per call; larger saves send chunks with `stage: {final: false}` (202 `{stageId}`) and commit with `stage: {id, final: true}`; a stage expires after 30 minutes (404 `stage_unknown`). Refusals come as 428. |
+| Recipient certificates | `POST /api/v1/shares/recipient-certificates` | `{userIds}`, 1 to 100 distinct (400 outside). `{recipients: [{userId, shareable: true, certificate} \| {userId, shareable: false, reason}]}`. |
+| Partner certificate | `POST /api/v1/federation/recipient-certificate` | `{cloudId}` → `{cloudId, certificate, chain, partnerRootFingerprint}`. Plain controller: 404 `unknown_recipient`, 403 `not_a_partner`, 409 `federation_unavailable`, 502 `partner_unreachable` or `bad_chain` (the partner served the wrong chain shape), the reason only as `message`. 60 per minute per user. |
 | Types | `GET /api/v1/secret-types` | Types are rows, resolve `typeId` from here. |
 | Sends | `POST/GET /api/v1/sends`, `DELETE /api/v1/sends/{id}` | See payload below. |
 | Public send access | `GET /api/v1/public/sends/{token}`, `POST …/access`, `POST …/confirm`, `POST …/failure` | Public, rate limited 15/min. The extension only needs the create side; the web app renders the recipient page. |
@@ -56,7 +60,7 @@ Routes under `/api/v1/extension/*` belong to the in-tree reference extension in
 - `name`, `url`, `typeId`, `folderId` are plaintext. Search and URL matching work without unlocking.
 - `key`, `login`, `additionalFields` are ciphertext. `additionalFields` decrypts to a JSON object of name to value. Names `key`, `login`, `url` are reserved (case-insensitive).
 - A recipient's copy of a shared secret carries its limits: `useOnly` (fill only: clients never show or copy `key` or `additionalFields`, and the server refuses its edits), `accessExpiresAt` (access ends then; not `expiresAt`), `readOnly` (from another organisation; only `folderId` may change). A missing limit counts as none. The server cannot stop a client from cloning a restricted copy, so clients refuse that themselves (Keepiq `use-only-shares`, `expiring-shares`).
-- Each recipient holds a separate copy encrypted to their own key. An owner's change reaches them only when the editing client re-encrypts it for each and calls `PUT /api/v1/secrets/{id}/sync` (see `ext-share-sync`).
+- Each recipient holds a separate copy encrypted to their own key. A change reaches them only when the editing client re-encrypts it for each and sends it with its own row in one `PUT /api/v1/secrets/{id}/share-save` (see `ext-share-sync`). The server tells partners about a new name or URL itself.
 - When the owner's suite is revoked the list returns a row with `blocked: true`, `blockedReason`, and no `key`, `login` or `additionalFields`; clients handle both shapes. `GET /api/v1/secrets/{id}` refuses such a row instead (`SecretService::get`), without a code.
 - System types: `login`, `api_key`, `ssh_key`, `certificate`, `note`, `database`, `totp`, `passkey`, `card`, `identity`. Users and admins can add more. Composite types (`totp`, `passkey`, `card`, `identity`) store their payload as JSON in `key`.
 - Folders: `{id, name, parentId, ownerType, ownerId, customIcon, customColor, createdAt, updatedAt}`, all plaintext, tree via `parentId`.
diff --git a/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md b/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
index 21162b69f..f21e536e9 100644
--- a/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
+++ b/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
@@ -86,14 +86,20 @@ When exactly one matching item holds the captured username and its decrypted `ke
 - **THEN** no update bar is shown
 
 ### Requirement: Update writes only the key
-The extension SHALL, on "Update", re-fetch the item with `GET /api/v1/secrets/{id}`, encrypt the captured password and `PUT /api/v1/secrets/{id}` with only `key` in the body, then sync. Other fields are left untouched.
+The extension SHALL, on "Update", save through `updateItem`: re-fetch the item with `GET /api/v1/secrets/{id}`, encrypt the captured password, and save a patch of only `key` with `baseUpdatedAt` through share-save, which reaches every other copy as `ext-share-sync` specifies, then sync. Other fields are left untouched. With no edit form behind the save, an item with partner shares fails with `unverified` and nothing is saved.
 
 #### Scenario: Successful update
 - **GIVEN** an update bar
 - **WHEN** the user clicks Update
-- **THEN** the request body contains only `key`
+- **THEN** the share-save patch contains only `key`, beside `baseUpdatedAt`
 - **AND** the bar reads "Password updated" and closes after three seconds
 
+#### Scenario: Item shared with a partner organisation
+- **GIVEN** an update bar for an item with an active partner share
+- **WHEN** the user clicks Update
+- **THEN** nothing is saved
+- **AND** the bar reads "This item is shared with partner organisations. Change its password in the extension's edit form or the Keepiq web app."
+
 #### Scenario: Item deleted meanwhile
 - **GIVEN** the re-fetch returns 404
 - **WHEN** the user clicks Update
diff --git a/browser-extension/openspec/changes/ext-autofill/tasks.md b/browser-extension/openspec/changes/ext-autofill/tasks.md
index 256bca87c..8bbd7ae97 100644
--- a/browser-extension/openspec/changes/ext-autofill/tasks.md
+++ b/browser-extension/openspec/changes/ext-autofill/tasks.md
@@ -36,7 +36,7 @@
 - [ ] 5.2 Write `src/autofill/capture-queue.ts` in the background: verify sender, drop when locked or excluded or the ask settings are off, compare against decrypted `login` and `key` of matching items to pick add, update or nothing, hold the entry in memory keyed by tab id with a five minute expiry, drop on tab close and lock, show on `tabs.onUpdated` complete within the same base domain, hide on leaving it
 - [ ] 5.3 Add `entrypoints/notification/` (bar UI as a vanilla DOM bundle, no React, per ADR-004) and `src/autofill/notification-host.ts` (iframe in a closed shadow root, fixed at the top of the page): the bar loads its state with `capture.state`, renders add and update modes, folder dropdown, Save, Update, Never for this site, close, and the saved and error states
   - Bar never receives the password; `capture.*` decisions are accepted only from the extension origin sender
-- [ ] 5.4 Implement `capture.save` (encrypt, `POST /api/v1/secrets` with host name, origin url, `login` type, folder, then sync), `capture.update` (`GET` then `PUT /api/v1/secrets/{id}` with only `key`, 404 falls back to add), and `capture.dismiss` with `never` appending the base domain to excluded domains
+- [ ] 5.4 Implement `capture.save` (encrypt, `POST /api/v1/secrets` with host name, origin url, `login` type, folder, then sync), `capture.update` (through `updateItem` in `src/vault/write.ts`, so a patch of only `key` reaches every copy through share-save as `ext-share-sync` specifies, and an item with partner shares fails with `unverified`; 404 falls back to add), and `capture.dismiss` with `never` appending the base domain to excluded domains
 
 ## 6. Verify
 
diff --git a/browser-extension/openspec/changes/ext-share-sync/.openspec.yaml b/browser-extension/openspec/changes/ext-share-sync/.openspec.yaml
new file mode 100644
index 000000000..b9ebfc72d
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-10-12
diff --git a/browser-extension/openspec/changes/ext-share-sync/design.md b/browser-extension/openspec/changes/ext-share-sync/design.md
new file mode 100644
index 000000000..f79c81cb1
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/design.md
@@ -0,0 +1,109 @@
+## Context
+
+ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item holds a copy encrypted to their own key, so the editing client must encrypt a changed value for every copy. Keepiq's `PUT /api/v1/secrets/{id}/share-save` (`ShareSaveController`, `ShareSaveService`, `lib/Service/ShareSave/`) takes the editor's patch and the ciphertext for every copy and partner share, and writes all of it in one transaction or nothing. The web app's client is `src/services/shareSave.js` (`saveShared`); the extension ports it. Where the web app and the server disagree, the server is the truth (`openspec/config.yaml`).
+
+## Goals / Non-Goals
+
+**Goals:**
+- A changed `key`, `login` or `additionalFields` reaches every direct, group, team-folder and partner-organisation copy the editor may write, in the same request as the editor's own row.
+- A save that fails writes nothing, and the form says why.
+
+**Non-Goals:**
+- Sharing, revoking, suspending by hand or changing a share's limits from the extension.
+- Partner-organisation recipients of an item a team editor changed; the server leaves them to the owner's next save.
+- Waiting out the partner lookup's rate limit, as the web app does.
+- A version restore, offline replay, or anything ext-vault-edit left out.
+
+## Decisions
+
+- **Only a value change goes through share-save.** A save whose body carries `key`, `login` or `additionalFields` takes share-save; any other save stays on `PUT /api/v1/secrets/{id}`, since share-save refuses a patch without one (`no_value_change`). A passkey's `key` is never in the body, so a passkey edit of its name, URL or folder never takes it. The patch is the same sparse body ext-vault-edit sends, without `baseUpdatedAt`, which moves to the envelope.
+- **One `write-context` read picks the path.** `GET /api/v1/secrets/{id}/write-context` answers `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId === id` is the owner path; otherwise `effectiveGrade` `owner`, `write` or `manage` is the copy-editor path, and anything else saves the editor's copy with a plain `PUT` and replies `own_copy`. The row alone can't tell a copy from a source, since a copy is owned by its holder. Delegates take the copy-editor path, as the server allows.
+- **The copy-editor path sends the source version the edit was made from.** `fetchItem` for edit reads `write-context` too and keeps its `sourceUpdatedAt` in the form's record, so the save's `sourceBaseUpdatedAt` refuses a source written since the form opened (409 `stale_source`), as the web app does. A save whose record is gone takes the `sourceUpdatedAt` of its own `write-context` read. An edit fetch whose `write-context` read fails fails as a whole, like a failed row fetch.
+- **A value change needs its base.** share-save refuses a body without `baseUpdatedAt` (400 `base_required`), so `updateItem` refuses a value change without one as `invalid` before any request; ext-autofill's `capture.update` passes the re-fetched row's.
+- **Empty lists first, then what the server requires.** As `saveShared`: the first call carries the patch and no entries. A 409 `incomplete` names the required copies (`{secretId, holder, targetUserId}`) and, on the owner path, partner shares (`{shareId, recipientCloudId}`); the background fills what is missing, drops what is no longer required and sends again, at most 3 rounds, then fails with `incomplete`.
+- **Local copies take the sparse patch.** Each copy carries exactly the value fields the patch carries, with the same null-ness, encrypted to its holder's certificate (`copy_fields_mismatch` otherwise). The owner holder uses `ownerCertificate`; recipients' certificates come from `POST /api/v1/shares/recipient-certificates`, at most 100 distinct ids per call. A recipient answered `shareable: false`, or an owner with no `ownerCertificate`, goes under `skipped` with `no_vault_key`. When the server refuses that skip (`skipRefused`), the background reads that certificate again once. A certificate that doesn't import fails the save with `bad_certificate`, since leaving the copy out would be refused anyway; so does a verified partner leaf whose key doesn't import.
+- **Partner shares take the whole value.** On the owner path each required partner share gets `key`, `login` and `additionalFields`, encrypted to the leaf the background verified, with `certFingerprint`, the lowercase hex SHA-256 of that leaf. The server replaces all three and refuses an empty `key`.
+- **The whole value is what the form showed.** Every item is encrypted to the same key and nothing ties a ciphertext to its item, so decrypting a fresh row would let the server pick what a partner receives. A partner's value is the typed fields plus each other field decrypted from the ciphertext the form's edit fetch opened, kept per form under its random `recordId` in `editOpened.<accountId>` in `storage.session`, so a stopped MV3 worker keeps it, with the row's `updatedAt`. share-save's `baseUpdatedAt` check means that ciphertext is still the item's, so the record is used only when its `updatedAt` equals the save's `baseUpdatedAt`. A field the form didn't show in full (a card member the form has no field for), a record that is gone or one of another version fails the save with `unverified`, before any partner is looked up, and the form points to the Keepiq web app. The edit fetch also refuses a row whose ciphertext the vault cache doesn't hold before or after a vault sync, so the form never opens another item's values.
+- **Partner certificates are verified in the background, ported from the web app.** `src/crypto/federated-certificate.ts` is a TypeScript port of `src/crypto/federatedCertificate.js`: pinned root by SHA-256, issuer-subject match and signature per link, `cA=TRUE` (and `keyCertSign` when `keyUsage` is present) above the leaf, common name, validity of every certificate. It allows the web app's 5 minutes of clock skew before `notBefore`. Stricter than the web app: the chain must be exactly the `[intermediate, root]` a partner serves (`FederationRootService.php:106-115`), with an intermediate that isn't self-issued; the leaf must have exactly one common name, a UTF8String in strict UTF-8, or a PrintableString, TeletexString or IA5String of printable ASCII (the host's OpenSSL `string_mask` decides, keepiq#1282), while a CA's name is held only to the issuer-subject match; an SPKI that isn't a SEQUENCE is `malformed`; every certificate's outer signature algorithm must equal the TBS one, its signature must have no unused bits, and RSA-PSS parameters must name MGF1 and trailer 1; the expected cloud id must not be empty, only the host's case is folded, and an unknown critical or repeated extension is refused. It is tested against every case of the web app's fixture. The secret is encrypted to the SPKI of the leaf that was verified, and a certificate with text outside its one PEM block or bytes after its DER is refused. The pin is the owner server's own `partnerRootFingerprint`. It uses `crypto.subtle.digest`, `importKey('spki')` and `verify` with RSASSA-PKCS1-v1_5 and RSA-PSS, all present in the MV3 service worker and the MV2 background page.
+- **The name is checked against the required share.** The leaf's common name must name the `recipientCloudId` the `incomplete` answer gives for that share, not the cloud id the lookup echoes back.
+- **Suspend only on a verdict about the recipient.** A verifier refusal, the server's own 502 `bad_chain` (`FederatedCertificateService::parseAnswer`, a partner serving the wrong chain shape), `unknown_recipient` (404) and `not_a_partner` (403) go under `suspend` with that reason, as the web app's `PARTNER_GONE`. These reasons arrive only as the body's `message` on a plain controller (`FederationController::recipientCertificate`), so `ApiError.message` is read there; it is never shown.
+- **An unreachable partner stops the save.** A 502 `partner_unreachable` fails the save with `partner_unreachable` and the shares it couldn't reach (`{shareId, cloudId}`). The form names their cloud ids and offers Save without them, which sends `item.update` again with those share ids as `withoutUnreachable`; the background then lists them under `suspend` with `partner_unreachable`. A share that fails only on that second save, and isn't in `withoutUnreachable`, stops it again; the form keeps the earlier consent, names every partner agreed to so far and sends them all, until the password, username or fields change. Try again after a failure resends the same request, Save without them included, while the values are unchanged; the footer Save is a fresh one. Chosen to mirror the web app: otherwise one partner that is down blocks every extension save of the item.
+- **The rate limit stops the save.** A 429 from the partner lookup fails the save with `partner_lookup_limit`, worded as "try again in a minute". The web app waits up to five minutes, but an MV3 worker can be stopped during a timer wait and a Chrome popup closes on any click outside it. A 409 `federation_unavailable` (Nextcloud below 33, without the OCM endpoint event) is a lasting state, so it gets its own code, worded as "ask your administrator", without Try again. Any other lookup failure is this server's, so it fails the save with the ordinary write code and suspends nothing; that includes a 200 without a `certificate` string, a `chain` of two strings and a 64-digit hex `partnerRootFingerprint`, the shape the server guarantees (`FederatedCertificateService::parseAnswer`, `FederationPartnerService::add`), since suspending can't be undone.
+- **Verified partner certificates are kept for 5 minutes.** As the web app's `verifiedPartners`: `{fingerprint, spki}` per account, share id and `recipientCloudId`, in background memory only, used only for the same cloud id, dropped once a save that used it succeeds, and all forgotten on lock, logout and account switch; a save that runs across a lock keeps nothing. So Save without them doesn't look every partner up again. It is public material.
+- **Saves above 100 entries are staged.** At most 100 entries in `copies` plus `skipped` and 100 in `federated` plus `suspend` per call; above that the background sends full chunks with `stage: {final: false}`, keeps the `stageId` from the 202 (a 202 without one fails as `unknown`), and the final call carries the patch and `stage: {id, final: true}`. Dropping an entry already staged starts a new stage; a 404 `stage_unknown` restarts it, counted as a round.
+- **Failures map through `writeError`.** A 409 `stale` is `conflict`, as for any save; `stale_source` is its own code, worded as "the original changed". `incomplete`, `bad_certificate`, `unverified`, `partner_unreachable`, `partner_lookup_limit` and `federation_unavailable` are new codes. The share-save's own `not_allowed`/`forbidden` refusals are `forbidden`, a policy refusal keeps `policy`; `OcsRefusalMiddleware` turns them into 428, which the API client reads like a 403. The `incomplete` lists come only in the 409 body, so `ApiError` carries the parsed `body`. `writeError` and `WriteFailure` live in `src/vault/write-error.ts`, so `share-save.ts` and `write.ts` share them without an import cycle.
+- **No automatic retry, nothing kept.** A failed save leaves the form open with the draft; the user saves again. Nothing about a save outlives its request but the verified partner certificates above: no Try again records, no kept result, no per-item queue, since the server's version check orders concurrent saves. The form's `editOpened` record is dropped once its save succeeds.
+- **Popup UX: a note on the item's detail. Default, may be overruled.** A save that reached everyone closes the form with "Item saved" as before. Three outcomes add a note on the item's detail, held in popup memory for that item until the popup closes: `own_copy` ("Only your copy changed…"), `ownerOnly` on the copy-editor path ("Recipients at partner organisations get this change when the owner next saves it."), partner shares the save suspended on a verdict about the recipient, by cloud id, and, as their own line, the shares the user suspended through Save without them (`paused`), the only lasting sign of that pause in the extension.
+- **Local recipients' certificates are trusted as the web app trusts them.** Only the user's own certificate can be proven (ADR-002); a recipient's can't. A compromised server can therefore list a recipient the user never chose and receive the next value of an edited item. This is the web app's and Bitwarden's organisation-membership trust; ADR-002 and `SECURITY.md` record the risk.
+
+## Data flow
+
+1. Popup: Edit sends `item.fetch` with `purpose: 'edit'`; `fetchItem` fetches the row, checks it against the vault cache, reads `write-context`, decrypts, and keeps the ciphertext it showed in full, the row's `updatedAt` and `sourceUpdatedAt` under a new `recordId`.
+2. Popup: Save sends `item.update` with the patch, `baseUpdatedAt`, `recordId` and, after Save without them, `withoutUnreachable`.
+3. Background `updateItem`: refuse restricted copies, encrypt the patch to the user's own key. Without a value field: `PUT /api/v1/secrets/{id}` as in ext-vault-edit. With one: `shareSave(...)`.
+   1. `GET /api/v1/secrets/{id}/write-context`; a copy without a write grade: `PUT /api/v1/secrets/{id}`, reply `own_copy`.
+   2. `PUT …/share-save` with `baseUpdatedAt`, `sourceBaseUpdatedAt` on the copy-editor path, the patch and empty lists.
+   3. On 409 `incomplete`: certificates per 100 ids, encrypt the sparse patch per copy; on the owner path build the whole value from the record, then per partner share look up, verify, encrypt, or list it under `suspend`; send again (staged above 100).
+4. `syncAfterWrite`, drop the form's record, reply `{ ok: true, value: { id, shareSave } }`.
+5. Popup: the form closes, Shell keeps `shareSave` for the item and opens its detail; `ShareSaveNote` renders it. A failure keeps the form open with `writeErrorText`, plus Save without them for `partner_unreachable`.
+
+## Module layout
+
+- `src/vault/verified-partners.ts` (new): the 5-minute memory of verified partner certificates, cleared by `clearKey` and on an account switch or add.
+- `src/vault/share-save.ts` (new): `shareSave`, the rounds, the certificate batching, the copy and partner entries and the staging; takes a client, a key and the form's record, so it has no account logic.
+- `src/crypto/federated-certificate.ts` (new): `verifyFederatedCertificate`, which resolves with `{ fingerprint, spki }`: the lowercase hex fingerprint Keepiq takes, and the verified leaf's key, which `importSpki` imports; `canonicalCloudId`, `FederatedCertificateError`; exported from `src/crypto/index.ts`.
+- `src/vault/write-error.ts` (new): `WriteFailure` and `writeError`, moved out of `write.ts`.
+- `src/vault/write.ts` (edit): `fetchItem` keeps the form's record; `updateItem` sends value changes through `shareSave` and drops the record after a success.
+- `src/messages.ts` (edit): `ShareSaveNote`, `withoutUnreachable` on `item.update`, the `item.update` reply, `partners` on `WriteFailure`, the new codes, and `recordId` on `EditableItem`.
+- `src/background/requests.ts` (edit): `item.update` passes `withoutUnreachable` on, dropping one that isn't a list of strings.
+- `src/api/client.ts` (edit): `ApiError` carries the parsed error `body`.
+- `entrypoints/popup/components/ShareSaveNote.tsx` (new): the note on the item's detail.
+- `entrypoints/popup/views/ItemForm.tsx`, `Shell.tsx`, `ItemDetail.tsx` (edit): Save without them, `onSaved(id, shareSave)`, Shell's state, the note on detail.
+- `entrypoints/popup/errors.ts` (edit): the new codes in `writeErrorText`.
+
+## Message contract
+
+```ts
+/** Shown on the item's detail after a save; absent when the save reached everyone. */
+export interface ShareSaveNote {
+	/** `source`: the editor owns the item; `copy`: a team editor or delegate; `own_copy`: only the editor's copy changed. */
+	scope: 'source' | 'copy' | 'own_copy'
+	/** Copy-editor path: partner shares exist that only the owner's next save reaches. */
+	ownerOnly?: true
+	/** Partner shares this save suspended on a verdict about the recipient, by cloud id. */
+	suspended?: string[]
+	/** Partner shares the user suspended through Save without them, by cloud id. */
+	paused?: string[]
+}
+
+// WriteFailure gains, for `partner_unreachable`:
+partners?: Array<{ shareId: string; cloudId: string }>
+
+// VaultWrite changes:
+| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string; recordId?: string; withoutUnreachable?: string[] }
+// PopupReplies changes:
+'item.update': WriteResult<{ id: string; shareSave?: ShareSaveNote }>
+```
+
+## Keepiq routes
+
+| Route | Body | Answer |
+| --- | --- | --- |
+| `GET /api/v1/secrets/{id}/write-context` | none | `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`; 404 when the secret is gone |
+| `PUT /api/v1/secrets/{id}/share-save` | `{baseUpdatedAt, sourceBaseUpdatedAt?, patch?, copies, skipped, federated?, suspend?, stage?}` | 200 `{secret, sourceUpdatedAt, copies: {written, skipped}, federated: {written, suspended, notified, queued, ownerOnly}}`; 202 `{stageId}` for a chunk; 409 `incomplete` `{path, sourceUpdatedAt, copies: {required, missing, unexpected, skipRefused}, federated: {required, missing, unexpected}}`, `stale` `{current, sourceUpdatedAt?}`, `stale_source`; 400 `too_many_entries`, `copy_fields_mismatch`, `no_value_change`, `invalid_body`, …; 428 (`OcsRefusalMiddleware`) `not_allowed`, `forbidden` or a policy code; 404 `not_found`, `stage_unknown`; 423 `write_locked` |
+| `POST /api/v1/shares/recipient-certificates` | `{userIds}`, 1 to 100 distinct | `{recipients: [{userId, shareable: true, certificate} \| {userId, shareable: false, reason}]}`; 400 outside the bounds |
+| `POST /api/v1/federation/recipient-certificate` | `{cloudId}` | `{cloudId, certificate, chain, partnerRootFingerprint}`; 404 `unknown_recipient`, 403 `not_a_partner`, 409 `federation_unavailable`, 502 `partner_unreachable` or `bad_chain`; 429 past 60 per minute per user |
+
+Entries: `copies` `{secretId, key?, login?, additionalFields?}`, `skipped` `{secretId, reason: 'no_vault_key'}`, `federated` `{shareId, certFingerprint, key, login, additionalFields}`, `suspend` `{shareId, reason}`. Controllers: `ShareSaveController` and `ShareController` are OCS, `FederationController` is plain. Routes in `appinfo/routes.php`.
+
+## Risks / Trade-offs
+
+- [A compromised server lists a recipient the user never chose] → Accepted as in the web app; recorded in ADR-002.
+- [A share created while a save runs encrypts the older value] → The next save's completeness check names it; closing it needs share creation to send the version it encrypted from (keepiq#1255).
+- [The reply to a save that committed is lost] → The form stays open with `offline`; saving again answers `conflict`, since the base moved, and opening the item shows the saved change.
+- [More than 60 partner shares] → The lookup limit fails the save with `partner_lookup_limit`; a batch lookup would close it (keepiq#1256).
+- [An unreachable partner suspended through Save without them] → Nothing resumes a suspended share; it stays suspended until the owner revokes it or shares again, and the form says so before the user confirms.
+- [A large team folder] → One certificate request per 100 members and RSA-OAEP encryption per copy and field, and one staged chunk per 100 entries; public-key encryption is cheap next to decryption.
+- [The MV3 worker stops mid-save] → An open `fetch` keeps it alive; if it dies, the popup gets no reply, and the server wrote everything or nothing.
+- [A request that hangs] → The save waits until it errors, since the client has no request timeout.
+- [Partner verifier drifts from the web app] → It is tested against the web app's own fixture chain, `../tests/fixtures/federation-chain.json`.
diff --git a/browser-extension/openspec/changes/ext-share-sync/proposal.md b/browser-extension/openspec/changes/ext-share-sync/proposal.md
index fb5ce9be9..f438f401d 100644
--- a/browser-extension/openspec/changes/ext-share-sync/proposal.md
+++ b/browser-extension/openspec/changes/ext-share-sync/proposal.md
@@ -10,54 +10,54 @@ chain:
 
 ## Why
 
-ext-vault-edit saves an item with a sparse `PUT /api/v1/secrets/{id}`, which changes only the editor's own row. In Keepiq every recipient of a shared item holds a separate copy, encrypted to their own key, and the web app re-encrypts each changed value for every recipient after the `PUT` (`src/store/modules/secret.js` `updateSecret`). Without that, a password changed in the extension stays old for everyone it is shared with, and nobody is told. Found in the ext-vault-edit review (must-fix 3); kept as its own change because it is a feature of its own.
+ext-vault-edit saves an item with a sparse `PUT /api/v1/secrets/{id}`, which changes only the editor's own row. In Keepiq every recipient of a shared item holds a separate copy, encrypted to their own key, so the editing client must encrypt each changed value again for every copy. Without that, a password changed in the extension stays old for everyone it is shared with, and nobody is told. Found in the ext-vault-edit review (must-fix 3); kept as its own change because it is a feature of its own.
+
+Keepiq now saves a shared secret and every copy of it in one transaction, through `PUT /api/v1/secrets/{id}/share-save` ([keepiq#1254](https://github.com/ConductionNL/keepiq/issues/1254), [keepiq#1258](https://github.com/ConductionNL/keepiq/pull/1258)). A save either reaches everyone or writes nothing, so the extension needs no Try again, no records that outlive the request and no per-item save queue. The web app saves through the same route (`src/services/shareSave.js`), which the extension ports.
 
 ## What Changes
 
-- After an edit that changes `key`, `login` or `additionalFields`, the background re-encrypts the new plaintext for every recipient, the way the web app does, before it replies.
-- Three paths, as in the web app:
-  - Owner with direct recipients: `GET /api/v1/secrets/{id}/shares` gives each recipient's copy id and certificate; `PUT /api/v1/secrets/{id}/sync` with `expectedUpdatedAt` and one `{secretId, encryptedKey, encryptedLogin, encryptedAdditionalFields}` per copy (`share.js` `syncUpdate`).
-  - Owner with recipients at partner organisations: per active federated share, fetch and verify the recipient's certificate, then `PUT /api/v1/federated-shares/{id}` with `certFingerprint`; suspend a share whose certificate no longer verifies (`federatedShare.js` `syncUpdate`, `verifyFederatedCertificate`).
-  - Team member with a `write` or `manage` grade editing their copy: `GET /api/v1/secrets/{id}/write-context` gives the source and the owner's certificate; re-encrypt for the source and every other recipient, then `PUT /api/v1/secrets/{sourceId}/sync` (`share.js` `syncAsTeamWriter`).
-- A failed fan-out keeps the editor's own update, as in the web app, but the popup says which recipients did not get the change instead of failing silently.
-- Plaintext fields (name, URL, folder) are not fanned out; the web app does not either.
+- An edit that changes `key`, `login` or `additionalFields` saves through `PUT /api/v1/secrets/{id}/share-save`; a rename, URL change or move stays on `PUT /api/v1/secrets/{id}`.
+- `GET /api/v1/secrets/{id}/write-context` picks the path:
+  - The editor owns the item: the save carries every local copy and every active partner share.
+  - The editor holds a copy with an `owner`, `write` or `manage` grade: the save goes through their copy and carries the source and every other copy. Partner shares stay with the owner's next save, and the popup says so.
+  - Any other copy: a plain `PUT` of the editor's copy only, and the popup says so.
+- The first request carries empty lists, so an unshared item saves at once. The server answers 409 `incomplete` with the copies and partner shares it requires; the background then reads their certificates, encrypts the change for each holder and sends again.
+- Partner certificates are verified in the background against the pinned partner root, ported from the web app. A certificate that fails, or a partner that no longer knows the recipient, suspends that share in the same save.
+- A partner that can't be reached stops the save; the form names it and offers Save without them, which suspends that share.
+- A failed save writes nothing: the form stays open with the reason, and the user saves again.
 
 ## Capabilities
 
 ### New Capabilities
 
-- `share-sync`: an edit of a shared item reaches every recipient copy.
+- `share-sync`: an edit of a shared item reaches every recipient copy in the same request.
 
 ### Modified Capabilities
 
-- `item-editing` (ext-vault-edit): Save reports the fan-out result.
+- `item-editing` (ext-vault-edit): Save of a value change goes through share-save and reports the note to show.
 
 ## Deviations from Bitwarden
 
 Mirrored feature: an edit of an item in a Bitwarden organisation collection, which every member sees at once.
 
-- Per-recipient copies. Bitwarden encrypts a shared item once under the organisation key; Keepiq has no shared key and stores one copy per recipient, so the editor's client re-encrypts for each (forced).
-- Recipient certificates come from the server. The extension can check the editor's own certificate against the unlocked private key (ext-vault-edit), but not another user's; it trusts local recipients' certificates as the web app does, and verifies federated ones as the web app does (open question).
+- Per-recipient copies. Bitwarden encrypts a shared item once under the organisation key; Keepiq has no shared key and stores one copy per recipient, so the editor's client encrypts for each (forced).
+- Recipient certificates come from the server. The extension proves only the user's own certificate (ext-vault-edit); it trusts local recipients' certificates as the web app does and as Bitwarden trusts organisation membership, and verifies partner-organisation certificates against the pinned partner root, as the web app does (forced).
+- An unreachable partner organisation stops the save until the user saves without them. Bitwarden has no partner organisations; the web app does the same (forced, Keepiq `federated-sharing`).
+- A recipient without a write grade edits only their own copy, as the server allows no more (forced, Keepiq `folder-permission-grades`).
 
 ## Keepiq API used
 
-- `GET /api/v1/secrets/{id}/shares`
-- `PUT /api/v1/secrets/{id}/sync`
 - `GET /api/v1/secrets/{id}/write-context`
-- `GET /api/v1/secrets/{id}/federated-shares`
+- `PUT /api/v1/secrets/{id}/share-save`
+- `POST /api/v1/shares/recipient-certificates`
 - `POST /api/v1/federation/recipient-certificate`
-- `PUT /api/v1/federated-shares/{id}`
-- `POST /api/v1/federated-shares/{id}/suspend`
-
-Server rules: `ShareSyncService::syncUpdate` refuses a stale `expectedUpdatedAt` with 409, a read-only source, and a use-only copy (Keepiq specs `user-sharing`, `folder-permission-grades`, `federated-sharing`, `use-only-shares`).
-
-## Open questions
+- `PUT /api/v1/secrets/{id}` (a copy without a write grade, and every save without a value change)
 
-- Should a group share or a team-folder membership need its own path, or are their copies all listed by `GET …/shares`?
-- How should the extension verify a federated recipient's certificate, given `verifyFederatedCertificate` in the web app?
-- What does the popup show when some recipients were updated and others failed, and can the user retry only those?
+Server rules: Keepiq `user-sharing`, `federated-sharing` and `folder-permission-grades` as changed by `openspec/changes/sharing-atomic-share-save`.
 
 ## Impact
 
-- New: `src/vault/share-sync.ts`, with its test.
-- Edited: `src/vault/write.ts` (`updateItem` runs the fan-out), `src/messages.ts` (the fan-out result in the `item.update` reply), the item form's save result, ADR-003 (the sharing routes).
+- New: `src/vault/share-save.ts`, `src/vault/verified-partners.ts`, `src/vault/write-error.ts`, `src/crypto/federated-certificate.ts` and the popup component `ShareSaveNote`, each with its test.
+- Edited: `src/api/client.ts` (`ApiError.body`), `src/vault/write.ts` (`fetchItem` records what the form opened, `updateItem` saves through share-save), `src/messages.ts` (the `item.update` request and reply), `src/background/requests.ts`, Shell, item form and item detail, both locales, ADR-002 and ADR-003, `SECURITY.md`, `ARCHITECTURE.md`, and `../docs/browser-extension/using.md`.
+- ext-autofill's `capture.update` saves through `updateItem`. With no edit form behind it, an item with partner shares can't be saved there, and the prompt says to change it in the extension's edit form or the web app.
+- Keepiq: once the extension has moved, `PUT /api/v1/secrets/{id}/sync` and `PUT /api/v1/federated-shares/{id}` can go (keepiq#1258).
diff --git a/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md b/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
new file mode 100644
index 000000000..d5505ee25
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
@@ -0,0 +1,55 @@
+## MODIFIED Requirements
+
+### Requirement: Edit re-fetches before showing the form and saves sparsely
+The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}` and `GET /api/v1/secrets/{id}/write-context` and decrypt the response in the background instead of using the cached row, so a stale cache cannot overwrite a newer server value. The decrypted item lives in popup memory only and is cleared when the form closes. Save MUST send only the fields the user changed with `baseUpdatedAt`, the fresh fetch's `updatedAt`: an edit that changes `key`, `login` or `additionalFields` as the `patch` of `PUT /api/v1/secrets/{id}/share-save` with `baseUpdatedAt` in its envelope, as `share-sync` specifies, and any other edit as the body of `PUT /api/v1/secrets/{id}`. A changed `key` or `login` MUST be re-encrypted, a cleared `login`, `url` or `folderId` MUST be sent as `null`, and any change to notes or additional fields MUST re-send the whole `additionalFields` object built from the fresh fetch, since the server stores it as one blob. Type cannot be changed on edit, as in Bitwarden, and the form renders under the type name the fetch checked the item against, not the popup's cached one.
+
+#### Scenario: Rename only
+- **GIVEN** the user opened Edit and changed only Name
+- **WHEN** they save
+- **THEN** the `PUT /api/v1/secrets/{id}` body MUST contain only `name` and `baseUpdatedAt`
+- **AND** no ciphertext MUST be re-encrypted or sent
+
+#### Scenario: Changed elsewhere while editing
+- **GIVEN** the user opened Edit and the item was changed in the web app before they saved
+- **WHEN** they save
+- **THEN** the server answers 409 and the form MUST keep the typed values and show "This item was changed elsewhere. Go back and edit it again to see the latest version."
+
+#### Scenario: Stale cache
+- **GIVEN** the cached row holds an older `login` than the server
+- **WHEN** the user presses Edit
+- **THEN** the form MUST show the server's decrypted `login`
+
+#### Scenario: Clear a field
+- **GIVEN** the user opened Edit and emptied Username
+- **WHEN** they save
+- **THEN** the share-save `patch` MUST contain `"login": null`
+
+#### Scenario: Item deleted elsewhere
+- **GIVEN** the item was deleted in the web app after the last sync
+- **WHEN** the user presses Edit
+- **THEN** the fresh fetch returns 404 and the popup MUST show "This item no longer exists", run sync and return to the list
+
+#### Scenario: Blocked item
+- **GIVEN** the item's suite was revoked after the last sync, so the server refuses the fresh fetch (ADR-003)
+- **WHEN** the user presses Edit
+- **THEN** the extension MUST run sync, which marks the item blocked, and the popup MUST refuse to edit and show the blocked reason as ext-vault-browse does for detail
+
+### Requirement: Edits of shared items
+An edit that changes `key`, `login` or `additionalFields` SHALL save the editor's row and every other copy in one `PUT /api/v1/secrets/{id}/share-save`, as `share-sync` specifies; any other edit saves through `PUT /api/v1/secrets/{id}`. A save either reaches everyone or writes nothing: a failure MUST keep the form open with the draft and the reason, and the user saves again. The `item.update` reply's value MUST carry `shareSave` when the item's detail has a note to show, as `share-sync` specifies, and a Move never does.
+
+#### Scenario: Shared item edited
+- **GIVEN** Alice shared "Wifi" with Bob
+- **WHEN** Alice changes its password in the extension
+- **THEN** Alice's copy and Bob's copy MUST hold the new password when the reply arrives
+- **AND** the popup MUST show the item's detail with "Item saved" and no note
+
+#### Scenario: Save fails
+- **GIVEN** Alice shared "Wifi" with Bob and the server stops answering during the save
+- **WHEN** she saves a new password
+- **THEN** the form MUST stay open with her change and the offline message
+- **AND** neither her copy nor Bob's MUST have changed
+
+#### Scenario: Renamed shared item
+- **GIVEN** Alice shared "Wifi" with Bob
+- **WHEN** she renames it to "Home wifi"
+- **THEN** the reply MUST carry no `shareSave` and Bob's copy keeps its own name
diff --git a/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
new file mode 100644
index 000000000..c33ac2843
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
@@ -0,0 +1,216 @@
+## ADDED Requirements
+
+### Requirement: A value change saves every copy in one request
+The extension SHALL save an edit whose body carries `key`, `login` or `additionalFields` through `PUT /api/v1/secrets/{id}/share-save`, and MUST save any other edit through `PUT /api/v1/secrets/{id}` as ext-vault-edit specifies. It MUST read `GET /api/v1/secrets/{id}/write-context` first and take exactly one path from it: the owner path when `sourceSecretId` is the edited id, the copy-editor path when it is not and `effectiveGrade` is `owner`, `write` or `manage`, and otherwise a plain `PUT /api/v1/secrets/{id}` of the editor's copy only. The first share-save MUST carry the patch, `baseUpdatedAt` and empty lists; on 409 `incomplete` the background MUST encrypt for what the answer requires, drop what it no longer requires and send again, and MUST fail the save with `incomplete` after three rounds, where each `incomplete` answer and each `stage_unknown` restart counts as one. Nothing about a save MUST outlive its request, beyond the form's record of what it opened, which a successful save drops, and verified partner certificates, kept in background memory for up to 5 minutes.
+
+#### Scenario: Password change of an owned, shared item
+- **GIVEN** Alice owns "Wifi" and shared it with Bob
+- **WHEN** she changes its password in the extension and saves
+- **THEN** the first share-save MUST carry no copies, the second MUST carry Bob's copy, and Alice's row and Bob's copy MUST change in the same request
+- **AND** no `PUT /api/v1/secrets/{id}` and no `/sync` request MUST be sent
+
+#### Scenario: Rename only
+- **GIVEN** Alice owns "Wifi" and shared it with Bob
+- **WHEN** she renames it and saves
+- **THEN** only `PUT /api/v1/secrets/{id}` MUST be sent, and no `write-context` or share-save
+
+#### Scenario: Item that is not shared
+- **GIVEN** Alice owns "Bank", which is shared with nobody
+- **WHEN** she changes its password
+- **THEN** one share-save with empty lists MUST save it, and no certificate MUST be looked up
+
+#### Scenario: The share list keeps changing
+- **GIVEN** the server answers three share-saves in a row with `incomplete`, naming a new recipient each time
+- **WHEN** Alice saves a new password
+- **THEN** the save MUST fail with `incomplete`, the form MUST stay open with "The people this item is shared with kept changing while it was saved. Nothing was saved; please try again.", and no fourth share-save MUST be sent
+
+### Requirement: An owner's change reaches every local copy
+On the owner path the extension SHALL fill every copy the `incomplete` answer requires, whether direct, group or team-folder, read recipient certificates with `POST /api/v1/shares/recipient-certificates` in batches of at most 100 distinct user ids, and encrypt to each certificate with RSA-OAEP as ADR-003 defines. Each copy entry MUST carry `secretId` and exactly the value fields the patch carries: `key` when it changed, `login` when it changed (`null` when cleared) and `additionalFields` when it changed, so an unchanged field is never cleared. A recipient answered `shareable: false` MUST be listed under `skipped` with `no_vault_key`; when the server refuses that skip, the background MUST read that recipient's certificate again once. A certificate that does not import MUST fail the save with `bad_certificate`. Use-only and expiring copies MUST be updated like any other, since their limits bind the holder, not the owner. Above 100 entries the save MUST go in staged chunks of at most 100 per list, committed by one final call.
+
+#### Scenario: Group and team-folder copies
+- **GIVEN** Alice shared "Wifi" directly with Bob, with the group Staff (Carol, Dan) and through the team folder Ops (Erin)
+- **WHEN** she changes its password
+- **THEN** one share-save MUST carry a copy entry for each of the four copies, each encrypted to that recipient's certificate
+
+#### Scenario: Only the changed field
+- **GIVEN** Alice changed only the username of a shared item
+- **WHEN** the save fills the copies
+- **THEN** each copy entry MUST contain `secretId` and `login` and MUST NOT contain `key` or `additionalFields`
+
+#### Scenario: Cleared username
+- **GIVEN** Alice emptied the username of a shared item
+- **WHEN** the save fills the copies
+- **THEN** the patch and each copy entry MUST contain `"login": null`
+
+#### Scenario: Recipient without a vault key
+- **GIVEN** Bob's suite was revoked, so the certificate lookup answers him as not shareable
+- **WHEN** Alice changes the password
+- **THEN** Bob's copy MUST be listed under `skipped` with `no_vault_key`, and the save MUST go through for everyone else
+
+#### Scenario: Certificate that does not import
+- **GIVEN** the server serves Carol a certificate that does not import
+- **WHEN** Alice changes the password
+- **THEN** nothing MUST be saved, and the form MUST say "Keepiq sent an encryption key for someone this item is shared with that this browser could not read. Nothing was saved."
+
+#### Scenario: Many recipients
+- **GIVEN** an item shared through a team folder with 230 members
+- **WHEN** its owner changes the password
+- **THEN** the certificates MUST be read in three requests of at most 100 user ids
+- **AND** the copies MUST go in two chunks of 100 with `stage.final` `false` and a final call with the last 30 and the patch
+
+### Requirement: A team editor's change reaches the owner and every other copy
+On the copy-editor path the extension SHALL send the share-save for the editor's own copy with `sourceBaseUpdatedAt` set to the `sourceUpdatedAt` the form's edit fetch read, or, without that record, the `sourceUpdatedAt` of its own `write-context` read. It MUST encrypt the patch's value fields to `ownerCertificate` for the source and to each recipient certificate for every other copy the answer requires, and MUST NOT send partner shares. When the reply says `ownerOnly`, the item's detail MUST say that partner organisations get the change with the owner's next save. A copy whose `effectiveGrade` is `read` or `none` MUST be saved with `PUT /api/v1/secrets/{id}` alone, and the item's detail MUST say that only the editor's copy changed.
+
+#### Scenario: Editor in a team folder
+- **GIVEN** Bob holds a `write` grade on the team folder that holds Alice's "Router" and its copies for Bob and Carol
+- **WHEN** Bob changes the password of his copy
+- **THEN** the share-save MUST go to Bob's copy id with `sourceBaseUpdatedAt` and copy entries for the source and Carol's copy, and none for Bob's copy
+
+#### Scenario: The original changed after the form opened
+- **GIVEN** Bob opened his copy of "Router" for editing, and Alice then changed the source
+- **WHEN** Bob saves a new password
+- **THEN** the server MUST answer 409 `stale_source`, nothing MUST be saved, and the form MUST say "The original of this shared item was changed after you opened it. Nothing was saved; open it again and redo your change."
+
+#### Scenario: Partners stay with the owner
+- **GIVEN** Alice's "Router" is also shared with `bob@cloud.partner.example`, and Carol holds a `write` grade on it
+- **WHEN** Carol saves a new password and the reply says `ownerOnly`
+- **THEN** no partner certificate MUST be looked up, and the item's detail MUST say "Saved. Recipients at partner organisations get this change when the owner next saves it."
+
+#### Scenario: Viewer edits their copy
+- **GIVEN** Carol holds a `read` grade, or a direct share without a grade, on "Router"
+- **WHEN** she changes the password of her copy
+- **THEN** only `PUT /api/v1/secrets/{id}` MUST be sent
+- **AND** the item's detail MUST show "Only your copy changed. The owner and the others it is shared with keep the old value."
+
+### Requirement: Partner-organisation recipients get the whole value the form showed
+On the owner path the extension SHALL, for each partner share the `incomplete` answer requires, look up the recipient's certificate with `POST /api/v1/federation/recipient-certificate` and `cloudId` set to the required share's `recipientCloudId`, verify it in the background, encrypt the whole `key`, `login` and `additionalFields` to it, and list it under `federated` with `certFingerprint`, the lowercase hex SHA-256 of the verified certificate. The whole value MUST be the typed fields plus each other field decrypted from the ciphertext the saving form's own edit fetch opened in full, found by the form's `recordId`; the extension MUST NOT decrypt a fresh row or a reply to build it. When the form did not open every value field in full, its record is gone, or the record is of another version than the save's `baseUpdatedAt`, the save MUST fail with `unverified` before any partner lookup. The edit fetch MUST refuse a row whose ciphertext the vault cache does not hold before or after a vault sync, so the form never opens another item's values.
+
+#### Scenario: A password change reaches Bob at a partner
+- **GIVEN** Alice shared "VPN" with `bob@cloud.partner.example`, whose share is active
+- **WHEN** she changes its password
+- **THEN** the extension MUST verify Bob's certificate and send his share the new value, login and additional fields encrypted to it, with its fingerprint, in the same share-save as her row
+
+#### Scenario: A field the form does not show
+- **GIVEN** a card whose `key` holds a `recovery` member, which the card form has no field for, and a partner share with `bob@cloud.partner.example`
+- **WHEN** Alice edits only the card's Notes and saves
+- **THEN** nothing MUST be saved, no partner MUST be looked up, and the form MUST say "This item is shared with partner organisations, and this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app."
+
+#### Scenario: The server answers the edit form with another item
+- **GIVEN** the server answers the edit fetch for "Wifi" with the ciphertext of another item, before and after a vault sync
+- **WHEN** Alice opens "Wifi" to edit it
+- **THEN** nothing MUST be decrypted and the form MUST say "Keepiq sent a version of this item that your vault does not hold, so it was not opened."
+
+#### Scenario: A field the form shows on every type
+- **GIVEN** a note with a login and a `notes` member in `additionalFields`, and a partner share
+- **WHEN** Alice opens it for editing
+- **THEN** the form MUST show Username and Notes with those values, as the Keepiq web app does
+- **AND** a save MUST send the partner share the whole value as shown
+
+### Requirement: Partner certificates are verified before anything is encrypted to them
+The extension SHALL accept a partner recipient's certificate only when each certificate is exactly one PEM block with nothing outside it and no bytes after its DER, no critical extension it does not understand and no extension twice, its chain is exactly the intermediate and the root, as a partner serves it, with an intermediate that is not self-issued, the leaf has exactly one common name, as a UTF8String, or a PrintableString, TeletexString or IA5String of printable ASCII, the SHA-256 of the chain's last certificate equals `partnerRootFingerprint`, each certificate's issuer equals the next one's subject and its signature verifies with the next one's key (RSASSA-PKCS1-v1_5 with SHA-256, or RSASSA-PSS with SHA-256 and MGF1-SHA-256), every certificate above the leaf carries basicConstraints with `cA=TRUE`, `keyCertSign` when it has `keyUsage`, and a `pathLenConstraint` the chain keeps, the leaf's common name names the share's `recipientCloudId` after scheme, trailing slash and host case are normalised, and the current time lies within the validity of every certificate, allowing 5 minutes of clock skew before `notBefore`, as the web app does. It MUST refuse with one of `malformed`, `untrusted_root`, `bad_chain`, `name_mismatch` or `not_valid_now`, the Keepiq web app's verifier's reasons, MUST run in the background with WebCrypto only, and MUST encrypt to the public key of the leaf it verified.
+
+#### Scenario: Verified certificate
+- **GIVEN** the Keepiq test chain for `bob@cloud.partner.example` and its pinned root
+- **WHEN** it is verified
+- **THEN** it MUST be accepted with the leaf's SHA-256 as lowercase hex and the leaf's public key
+
+#### Scenario: Someone else's certificate
+- **GIVEN** a chain that verifies but whose leaf names `mallory@cloud.partner.example`
+- **WHEN** it is verified for Bob's share
+- **THEN** it MUST be refused with `name_mismatch`
+
+#### Scenario: Expired certificate
+- **GIVEN** Bob's leaf certificate expired yesterday
+- **WHEN** it is verified
+- **THEN** it MUST be refused with `not_valid_now`
+
+#### Scenario: A user's certificate as issuer
+- **GIVEN** a leaf naming Bob signed with Mallory's own leaf key, followed by Mallory's leaf and the pinned chain
+- **WHEN** it is verified for Bob's share
+- **THEN** it MUST be refused with `bad_chain`
+
+#### Scenario: Another certificate in front of Bob's
+- **GIVEN** the lookup's `certificate` holds base64 of another certificate in front of Bob's PEM block
+- **WHEN** it is verified
+- **THEN** it MUST be refused with `malformed` and nothing MUST be encrypted to either key
+
+### Requirement: A partner the save can't reach stops it, unless the user saves without them
+A partner share whose certificate fails verification, or whose lookup answers `unknown_recipient`, `not_a_partner` or the server's own `bad_chain`, SHALL be listed under `suspend` with that reason and MUST NOT be sent ciphertext; the save goes on. A lookup answered 502 `partner_unreachable` MUST fail the save with `partner_unreachable` and the shares not reached, by share id and cloud id, unless the `item.update` named that share in `withoutUnreachable`; then it MUST be listed under `suspend` with `partner_unreachable`. The form MUST name the partners not reached and offer Save without them, saying that it pauses sharing with them until the item is shared with them again. A lookup answered 429 MUST fail the save with `partner_lookup_limit` without waiting, and one answered 409 `federation_unavailable` with `federation_unavailable`, without an offer to try again. A certificate verified within the last 5 minutes for the same share and `recipientCloudId` MAY be used again without a lookup; kept certificates MUST live in background memory only and MUST be forgotten on every lock, logout and account switch. Any other lookup failure, including a 200 answer without a `certificate` string, a `chain` of two strings and a 64-digit hex `partnerRootFingerprint`, is this server's and MUST fail the save with its ordinary write code, suspending nothing.
+
+#### Scenario: Certificate from another root
+- **GIVEN** the lookup for Bob returns a chain that ends at a root other than the pinned one
+- **WHEN** Alice saves a new password
+- **THEN** no ciphertext MUST be sent for Bob, his share MUST be listed under `suspend` with reason `untrusted_root`, and the save MUST go through
+- **AND** the item's detail MUST say "Sharing with bob@cloud.partner.example is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share."
+
+#### Scenario: The partner serves the wrong chain
+- **GIVEN** Alice's server answers Bob's lookup with 502 `bad_chain`
+- **WHEN** Alice saves a new password
+- **THEN** Bob's share MUST be listed under `suspend` with `bad_chain`, and the save MUST go through
+
+#### Scenario: Partner unreachable
+- **GIVEN** Bob's partner instance does not answer, so the lookup returns 502 `partner_unreachable`
+- **WHEN** Alice saves a new password
+- **THEN** nothing MUST be saved, and the form MUST name `bob@cloud.partner.example` and offer Save without them
+- **AND** when Alice presses it, the save MUST go through with Bob's share under `suspend` with `partner_unreachable`, looking up again only partners not verified within the last 5 minutes
+- **AND** the item's detail MUST say "Sharing with bob@cloud.partner.example is paused until you share this item with them again."
+
+#### Scenario: The server can't share with partners
+- **GIVEN** Alice's server answers the partner lookup with 409 `federation_unavailable`
+- **WHEN** Alice saves a new password of an item with a partner share
+- **THEN** nothing MUST be saved, and the form MUST say "Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator." without Try again
+
+#### Scenario: A second partner unreachable after Save without them
+- **GIVEN** Alice pressed Save without them for Bob, and that save fails because Carol can't be reached either
+- **WHEN** Alice presses Save without them again
+- **THEN** the save MUST send both Bob's and Carol's share ids in `withoutUnreachable`, and the form MUST have named both
+- **AND** after Alice changes the password, username or fields, the form MUST ask again for each partner
+
+#### Scenario: Another partner fails only on Save without them
+- **GIVEN** Alice pressed Save without them for Bob, and Carol's partner instance stops answering before that save
+- **WHEN** the save looks Carol up
+- **THEN** nothing MUST be saved, and the form MUST name Carol and offer Save without them again
+
+#### Scenario: Lookup rate limit
+- **GIVEN** an item with 70 partner shares, and the lookup answers 429 after 60
+- **WHEN** Alice saves a new password
+- **THEN** nothing MUST be saved, no further lookup MUST be sent, and the form MUST say "Too many partner lookups. Nothing was saved; try again in a minute."
+
+#### Scenario: A local error never suspends a partner
+- **GIVEN** Alice's own server answers Bob's certificate lookup with 500
+- **WHEN** Alice saves a new password
+- **THEN** nothing MUST be saved, Bob's share MUST NOT be listed under `suspend`, and the form MUST show the ordinary server error
+
+### Requirement: A failed save writes nothing and says why
+A save the server refuses, or that fails before the final share-save is answered, SHALL leave the form open with the draft and the reason, and MUST NOT be retried by the extension on its own. A 409 `stale` MUST be reported as `conflict`, `stale_source` as `stale_source`, no answer as `offline` and a 5xx as `server_error`, through the same mapping writes use; the share-save's own `not_allowed` or `forbidden` refusal MUST be reported as `forbidden`, and a policy refusal as `policy`.
+
+#### Scenario: Changed elsewhere meanwhile
+- **GIVEN** another browser saved "Wifi" after Alice opened it
+- **WHEN** Alice saves a new password
+- **THEN** the server MUST answer 409 `stale`, nothing MUST be saved, and the form MUST show the conflict message
+
+#### Scenario: Server unreachable during the save
+- **GIVEN** the server stops answering after the first `incomplete` answer
+- **WHEN** the save sends the filled share-save
+- **THEN** the form MUST stay open with the offline message, and saving again MUST send the whole save again
+
+### Requirement: Item detail shows what the save left to others
+The extension SHALL, after a save whose reply carries `shareSave`, close the form and open the item's detail with the "Item saved" toast as before, plus one note: "Only your copy changed. The owner and the others it is shared with keep the old value." for `own_copy`, "Saved. Recipients at partner organisations get this change when the owner next saves it." for `ownerOnly`, the suspended partners' warning, naming their cloud ids, for `suspended`, and "Sharing with <cloud ids> is paused until you share this item with them again." for `paused`, the shares the user suspended through Save without them. The note MUST be held in popup memory for that item only and MUST be gone when the popup closes or another item's detail opens. A save that reached everyone carries no `shareSave` and shows nothing beyond the toast.
+
+#### Scenario: Fully reached
+- **GIVEN** Alice shared "Wifi" with Bob and Carol
+- **WHEN** her new password reaches both
+- **THEN** the detail MUST show only the "Item saved" toast
+
+#### Scenario: Popup closed
+- **GIVEN** the detail shows the own-copy note
+- **WHEN** Carol closes and reopens the popup and opens the item
+- **THEN** no note MUST be shown
+
+### Requirement: Plaintext and recipient keys stay in background memory
+The decrypted value a save encrypts SHALL exist only in background memory for the request that needs it, and MUST NOT be written to any storage, sent to the popup or sent to a content script. Recipient certificates and lookup answers live in background memory for one save, except a verified partner certificate, kept there for up to 5 minutes as the previous requirement says. The popup receives only the note and failure codes, with partner share ids and cloud ids. Nothing new is written to `storage.local`; `storage.session` holds only the ciphertext an edit form opened and the row and source versions it read, per form, cleared when the key is. Every request goes from the background through the API client with `credentials: 'omit'`.
+
+#### Scenario: What the popup sees
+- **GIVEN** a save that reached Bob and suspended a partner share
+- **WHEN** the popup receives the reply
+- **THEN** it MUST contain no ciphertext, plaintext or certificate
diff --git a/browser-extension/openspec/changes/ext-share-sync/tasks.md b/browser-extension/openspec/changes/ext-share-sync/tasks.md
new file mode 100644
index 000000000..54f782cb4
--- /dev/null
+++ b/browser-extension/openspec/changes/ext-share-sync/tasks.md
@@ -0,0 +1,48 @@
+## 1. Messages and the partner verifier
+
+- [x] 1.1 Add `ShareSaveNote`, `withoutUnreachable` on `item.update`, `partners` on `WriteFailure` and the codes `stale_source`, `incomplete`, `bad_certificate`, `unverified`, `partner_unreachable`, `partner_lookup_limit` and `federation_unavailable` from design.md to `src/messages.ts`, and change the `item.update` reply to `WriteResult<{ id: string; shareSave?: ShareSaveNote }>`; answer it in `entrypoints/popup/testing.ts`.
+- [x] 1.2 Port `src/crypto/federatedCertificate.js` of the Keepiq app to `src/crypto/federated-certificate.ts` (`verifyFederatedCertificate`, `canonicalCloudId`, `FederatedCertificateError`), export it from `src/crypto/index.ts`, with its test against `../tests/fixtures/federation-chain.json`, read through a helper beside `vectors` in `src/testing/vectors.ts`.
+  - Accepts the pinned chain and returns the leaf's SHA-256 as lowercase hex and its SPKI, which the save encrypts to through `importSpki`.
+  - Allows 5 minutes of clock skew before `notBefore`, refuses a self-issued intermediate and a second common name, and runs every case of the web app's fixture.
+  - Refuses text outside the one PEM block and bytes after the DER, here and in `importPublicKey`.
+  - Requires `cA=TRUE`, `keyCertSign` when `keyUsage` is present, and the `pathLenConstraint` above the leaf, a chain of exactly the intermediate and the root, no unknown critical or repeated extension, and every certificate's validity, against `src/testing/ca-constraints-chain.json`.
+  - Refuses another root (`untrusted_root`), a broken link (`bad_chain`), another name (`name_mismatch`), a time outside validity (`not_valid_now`) and garbage (`malformed`), with the same cases as `tests/vitest/federatedCertificate.spec.js`.
+  - Bounds-checks every DER length, like `extractSpki` in `src/crypto/rsa.ts`.
+
+## 2. Background save
+
+- [x] 2.1 Create `src/vault/share-save.ts` with `shareSave`, a port of the web app's `saveShared` (`src/services/shareSave.js`), with its test.
+  - Reads `write-context` and takes the owner path, the copy-editor path (`owner`, `write` or `manage` on a copy) or a plain `PUT` of the editor's copy, replying `own_copy`.
+  - Sends the patch with `baseUpdatedAt` and empty lists first; on 409 `incomplete` fills what is required, drops what is not, and sends again, failing with `incomplete` after the third answer.
+- [x] 2.2 Local copies: certificates from `POST /api/v1/shares/recipient-certificates` in batches of at most 100 distinct ids, `ownerCertificate` for the owner holder, one copy entry per holder with exactly the patch's value fields.
+  - `login` cleared sends `null`; an unchanged field is absent from the entry.
+  - A recipient answered `shareable: false`, or an owner without `ownerCertificate`, goes under `skipped` with `no_vault_key`; a refused skip reads that certificate again once.
+  - A certificate that does not import fails with `bad_certificate`.
+  - Each ciphertext opens with the test vectors' private key (`envelope` in `src/testing/vectors.ts`) standing in for the recipient.
+- [x] 2.3 Copy-editor path: `sourceBaseUpdatedAt` from the form's record, or from `write-context` without one; entries for the source and every other copy the answer requires; no partner shares; `ownerOnly` from the reply.
+- [x] 2.4 Partner shares, owner path: per required share `POST /api/v1/federation/recipient-certificate` with its `recipientCloudId`, verify against that cloud id, encrypt the whole value to the verified leaf, and list it under `federated` with `certFingerprint`.
+  - The whole value is the typed fields plus the other fields decrypted from the form's `editOpened` record; a field it does not hold in full, a missing record, or one whose `updatedAt` isn't the save's `baseUpdatedAt` fails with `unverified` before any lookup.
+  - A verifier refusal, `unknown_recipient`, `not_a_partner` or the server's 502 `bad_chain` (read from `ApiError.message`) goes under `suspend` with that reason.
+  - 502 `partner_unreachable` fails with `partner_unreachable` and the shares not reached, unless `withoutUnreachable` names them, which puts them under `suspend`.
+  - 429 fails with `partner_lookup_limit`, 409 `federation_unavailable` with `federation_unavailable`; any other failure, also a 200 not in the server's shape, fails with its write code and suspends nothing.
+  - Verified certificates are kept in background memory for 5 minutes per account, share id and cloud id, and forgotten on lock, logout and account switch.
+- [x] 2.5 Staging: above 100 entries per list, full chunks with `stage: {final: false}` and the final call with the patch and `stage: {id, final: true}`; dropping a staged entry starts a new stage, and `stage_unknown` restarts it as a round.
+- [x] 2.6 In `fetchItem` for edit, read `write-context` and keep its `sourceUpdatedAt` and the row's `updatedAt` beside the opened ciphertext in the form's `editOpened` record.
+- [x] 2.7 In `updateItem`, send a body with `key`, `login` or `additionalFields` through `shareSave` and any other through `PUT /api/v1/secrets/{id}`; drop the form's record after a success; reply `{ id, shareSave }` when there is a note and `{ id }` otherwise, with tests for a rename, a move, a passkey edit, an unshared item and each failure code. Pass `withoutUnreachable` from `item.update` in `src/background/requests.ts`, dropping one that isn't a list of strings.
+
+## 3. Popup
+
+- [x] 3.1 Add the share-save texts to `locales/en.yml` and `locales/nl.yml` and the new codes to `writeErrorText` in `entrypoints/popup/errors.ts`.
+  - `stale_source` "The original of this shared item was changed after you opened it. Nothing was saved; open it again and redo your change.", `incomplete` "The people this item is shared with kept changing while it was saved. Nothing was saved; please try again.", `bad_certificate` "Keepiq sent an encryption key for someone this item is shared with that this browser could not read. Nothing was saved.", `unverified` "This item is shared with partner organisations, and this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app.", `partner_unreachable` "Nothing was saved: a partner organisation this item is shared with can't be reached ({cloudIds}). Try again later, or save without them, which pauses sharing this item with them until you share it with them again.", `partner_lookup_limit` "Too many partner lookups. Nothing was saved; try again in a minute.", `federation_unavailable` "Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator.", `saveWithout` "Save without them".
+  - Notes: `ownCopy` "Only your copy changed. The owner and the others it is shared with keep the old value.", `ownerOnly` "Saved. Recipients at partner organisations get this change when the owner next saves it.", `suspended` "Sharing with {cloudIds} is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.", `paused` "Sharing with {cloudIds} is paused until you share this item with them again."
+  - Cloud ids are joined with `Intl.ListFormat` in the catalog's language.
+- [x] 3.2 In `ItemForm`, show Save without them beside a `partner_unreachable` failure, which sends `item.update` again with the same draft and, as `withoutUnreachable`, those share ids plus every one agreed to earlier for the same password, username and fields; Try again after a failure resends that while the values are unchanged; with its tests.
+- [x] 3.3 Create `components/ShareSaveNote.tsx` for the note on the item's detail, with its test in English and Dutch; pass `shareSave` from `ItemForm` through `onSaved`, hold it in Shell for that item only, and show it on `ItemDetail`, with tests that a save that reached everyone shows only "Item saved". No import of `src/api` or `src/crypto` (ADR-004).
+
+## 4. Docs and checks
+
+- [x] 4.1 Update ADR-003 (rows for the four sharing routes and their answers from design.md), ADR-002 and `SECURITY.md` (the save trusts the server's recipient list; partner certificates are verified against the owner server's pin; partners get only what the form showed), and `ARCHITECTURE.md` (modules, the writes row of the messages table, the Writes flow).
+- [x] 4.2 Replace the shared-edit text in `../docs/browser-extension/using.md` with what the extension now does, including the notes and Save without them.
+- [x] 4.3 Update ext-autofill's `capture.update`: it saves through `updateItem`, and an item with partner shares fails with `unverified`, which the prompt words as "change it in the edit form or the Keepiq web app".
+- [x] 4.4 Run `npm test`, `npm run typecheck`, `npm run lint`, `npm run build` and `npm run build:firefox`; no `chrome.*` in executable code, no decrypted value or certificate written to storage or sent to the popup.
+- [ ] 4.5 Walk every scenario of both specs against the dev backend in Chrome and Firefox: a direct, a group and a team-folder recipient opening the new value in the Keepiq web app, a `write`-grade editor, a `read`-grade viewer, a recipient added mid-save, and a partner recipient when a partner instance is set up.
diff --git a/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md b/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
index c85501711..0e5b70cc3 100644
--- a/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-browse/specs/item-detail/spec.md
@@ -43,7 +43,7 @@ For items of type totp the detail SHALL parse the decrypted `key` as an `otpauth
 - **THEN** "Invalid authenticator key" is shown and no code is displayed or copyable
 
 ### Requirement: Websites section
-When the item has a `url` the detail SHALL show a "Website" entry with launch and copy actions using the same launch rules as the list card. Bitwarden's multiple URIs collapse to Keepiq's single `url`.
+When the item has a `url` the detail SHALL show a "Website" entry with launch and copy actions using the same launch rules as the list card. A totp, card, identity or note item with a `login` SHALL show its Username (value, copy) there too, under the title "Autofill options", as the edit form does; a passkey never shows it. Bitwarden's multiple URIs collapse to Keepiq's single `url`.
 
 #### Scenario: Launch from detail
 - **GIVEN** an item with url `https://example.com`
@@ -67,7 +67,7 @@ The detail SHALL show a "Notes" section with multi-line, unmasked text when the
 - **THEN** the Notes section shows the text with line breaks preserved and no Login credentials section is shown
 
 ### Requirement: Card and identity sections
-For type card the detail SHALL parse the decrypted `key` as `{number, expiry, cvv, pin, cardholder}` and render Cardholder and Expiry in plain text, Number, CVV and PIN masked with reveal and copy, and show the brand and last four digits derived in memory from the number. For type identity it SHALL parse `{firstName, lastName, address, phone, email, bsn}` and render all fields in plain text except BSN, which is masked with reveal and copy. A payload that does not parse shows "Could not read this item" and no fields.
+For type card the detail SHALL parse the decrypted `key` as `{number, expiry, cvv, pin, cardholder}` and render Cardholder and Expiry in plain text, Number, CVV and PIN masked with reveal and copy, and show the brand and last four digits derived in memory from the number. For type identity it SHALL parse `{firstName, lastName, address, phone, email, bsn}` and render all fields in plain text except BSN, which is masked with reveal and copy. A `key` that does not start with `{` or does not parse as a JSON object is shown as one secret, masked with reveal and copy, as the edit form shows it.
 
 #### Scenario: Card detail
 - **GIVEN** a card item with a Visa number ending 1111
diff --git a/browser-extension/openspec/changes/ext-vault-edit/design.md b/browser-extension/openspec/changes/ext-vault-edit/design.md
index ad8ab11d9..ae4c9b856 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/design.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/design.md
@@ -89,8 +89,10 @@ export type ItemPatch = Partial<ItemDraft>
 export interface EditableItem extends ItemDraft {
 	id: string
 	updatedAt: string
-	/** Present only for passkey, where key is not decrypted. */
-	keyWithheld?: true
+	/** The type the fetch checked the item under, absent for a type the vault does not know; `passkey`, with `key` empty, when the server or the cache says so. */
+	typeName?: string
+	/** Edit only: names this form's record of what it opened (ext-share-sync). */
+	recordId?: string
 }
 
 export interface FolderChildren {
diff --git a/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md b/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
index b1b81a009..9ad6c4b7c 100644
--- a/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
+++ b/browser-extension/openspec/changes/ext-vault-edit/specs/item-editing/spec.md
@@ -1,7 +1,7 @@
 ## ADDED Requirements
 
 ### Requirement: Add item form
-The extension SHALL offer a primary "New" button with a plus icon in the header of the Vault tab's list, left of the pop-out button as in Bitwarden, that opens an add-item form with a Type select, a required Name and the fields of the chosen type, as in Bitwarden's "Add item". The Type select MUST list the cached `secret-types` rows except `passkey`, which only a passkey ceremony creates, and default to the user's `default_secret_type` when cached, else `login`. For the `login` type the form MUST show Username, Password (masked, with a reveal button; ext-generator adds the generate button), Website URL, Folder (default "No folder"), Additional fields and Notes. The draft lives in popup memory only and is cleared when the popup closes.
+The extension SHALL offer a primary "New" button with a plus icon in the header of the Vault tab's list, left of the pop-out button as in Bitwarden, that opens an add-item form with a Type select, a required Name and the fields of the chosen type, as in Bitwarden's "Add item". The Type select MUST list the cached `secret-types` rows except `passkey`, which only a passkey ceremony creates, and default to the user's `default_secret_type` when cached, else `login`. For the `login` type the form MUST show Username, Password (masked, with a reveal button; ext-generator adds the generate button), Website URL, Folder (default "No folder"), Additional fields and Notes. A multi-line secret, such as an `ssh_key`, a `certificate` or a password holding a line break, MUST stay masked until the user presses Show, and stay multi-line once it holds a line break, also after the type changes; an edit MUST keep its CRLF or CR line breaks when it used one style throughout. Every other type except `passkey` MUST show Username when the edited item has a login, as the Keepiq web app does, and keep it while the form is open; cleared, it is saved as `null`. The draft lives in popup memory only and is cleared when the popup closes.
 
 #### Scenario: Opening the form from a tab
 - **GIVEN** the vault is unlocked and the user opened the popup on a tab whose URL is `https://example.com/login`
@@ -26,7 +26,7 @@ The extension SHALL offer a primary "New" button with a plus icon in the header
 - **AND** no request MUST be sent
 
 ### Requirement: Additional fields editor
-The extension SHALL let the user add, edit and remove repeatable name and value rows under Additional fields, with a masking toggle per row. A row name that equals `key`, `login` or `url` case-insensitively MUST be refused with the reason "This name is reserved", a blank name MUST be refused, and a duplicate name MUST be refused. The masking toggle is view state only and is not stored, because the Keepiq blob has no field type.
+The extension SHALL let the user add, edit and remove repeatable name and value rows under Additional fields, with a masking toggle per row. A value holding a line break MUST be a masked multi-line field that keeps its CRLF or CR style when it used one style throughout. A row name that equals `key`, `login` or `url` case-insensitively MUST be refused with the reason "This name is reserved", a blank name MUST be refused, and a duplicate name MUST be refused. The masking toggle is view state only and is not stored, because the Keepiq blob has no field type.
 
 #### Scenario: Reserved name is refused
 - **GIVEN** the user adds an additional field
@@ -44,7 +44,7 @@ The extension SHALL let the user add, edit and remove repeatable name and value
 - **THEN** the value MUST be shown in plain text until the toggle is pressed again or the form closes
 
 ### Requirement: Notes storage convention
-The extension SHALL store the Notes field of a non-`note` item under the `notes` member of `additionalFields`, and MUST store the text of a `note` item in `key`. Notes MUST never be sent as plaintext.
+The extension SHALL store the Notes field of a non-`note` item under the `notes` member of `additionalFields`, and MUST store the text of a `note` item in `key`. A `note` item that came with a `notes` member MUST show it as Notes and save it back under that member. Notes MUST never be sent as plaintext.
 
 #### Scenario: Notes on a login item
 - **GIVEN** the user fills Notes on a `login` item and adds no additional field
@@ -55,10 +55,10 @@ The extension SHALL store the Notes field of a non-`note` item under the `notes`
 #### Scenario: Note item
 - **GIVEN** the user chose the `note` type and typed a note
 - **WHEN** they save
-- **THEN** the note text MUST be encrypted into `key` and `login` MUST be omitted
+- **THEN** the note text MUST be encrypted into `key` and `login` MUST be omitted, since a new note shows no Username
 
 ### Requirement: Composite types
-The extension SHALL edit `totp` items as a Secret field holding an `otpauth://totp/...` URI or a bare base32 secret in `key`, with optional advanced fields (algorithm, digits, period) that are written back into the URI. `card` items MUST store `{number, expiry, cvv, pin, cardholder}` and `identity` items MUST store `{firstName, lastName, address, phone, email, bsn}` as JSON in `key`, serialized exactly as the Keepiq web app does, so the web app renders them. `passkey` items MUST be editable only in Name, Folder and Website URL; the form MUST never read, show or send the credential JSON in `key`.
+The extension SHALL edit `totp` items as a Secret field holding an `otpauth://totp/...` URI or a bare base32 secret in `key`, with optional advanced fields (algorithm, digits, period) that are written back into the URI. `card` items MUST store `{number, expiry, cvv, pin, cardholder}` and `identity` items MUST store `{firstName, lastName, address, phone, email, bsn}` as JSON in `key`, serialized exactly as the Keepiq web app does, so the web app renders them. A card or identity whose `key` is not a JSON object MUST be shown as one secret field, multi-line when it holds a line break (CR or LF), and saved as typed, so nothing it holds is lost, and one with missing members MUST keep its `key` until a member is typed. `passkey` items MUST be editable only in Name, Folder and Website URL; the form MUST never read, show or send the credential JSON in `key`.
 
 #### Scenario: TOTP with a bare secret
 - **GIVEN** the user chose `totp` and typed `JBSWY3DPEHPK3PXP` as the Secret
@@ -76,7 +76,7 @@ The extension SHALL edit `totp` items as a Secret field holding an `otpauth://to
 - **THEN** `key` MUST decrypt to a JSON object with exactly the five card members, `cvv` and `pin` as empty strings
 
 #### Scenario: Passkey stays read-only
-- **GIVEN** the user opens Edit on a `passkey` item
+- **GIVEN** the user opens Edit on a `passkey` item, by the fresh row's type or by the cached one
 - **WHEN** the form renders
 - **THEN** it MUST show Name, Folder and Website URL as editable and a notice "Passkey credentials can only be changed in the Keepiq web app"
 - **AND** saving MUST send a sparse `PUT` without `key`
@@ -96,7 +96,7 @@ The extension SHALL save a new item by sending the draft to the background, whic
 - **THEN** the body MUST omit `login`, MUST set `url` to `null` and MUST encrypt `{}` as `additionalFields`
 
 ### Requirement: Edit re-fetches before showing the form and saves sparsely
-The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}` and decrypt the response in the background instead of using the cached row, so a stale cache cannot overwrite a newer server value. The decrypted item lives in popup memory only and is cleared when the form closes. Save MUST send `PUT /api/v1/secrets/{id}` with only the fields the user changed plus `baseUpdatedAt`, the fresh fetch's `updatedAt`; a changed `key` or `login` MUST be re-encrypted, a cleared `login`, `url` or `folderId` MUST be sent as `null`, and any change to notes or additional fields MUST re-send the whole `additionalFields` object built from the fresh fetch, since the server stores it as one blob. Type cannot be changed on edit, as in Bitwarden.
+The extension SHALL, when the user presses Edit, call `GET /api/v1/secrets/{id}` and decrypt the response in the background instead of using the cached row, so a stale cache cannot overwrite a newer server value. The decrypted item lives in popup memory only and is cleared when the form closes. Save MUST send `PUT /api/v1/secrets/{id}` with only the fields the user changed plus `baseUpdatedAt`, the fresh fetch's `updatedAt`; a changed `key` or `login` MUST be re-encrypted, a cleared `login`, `url` or `folderId` MUST be sent as `null`, and any change to notes or additional fields MUST re-send the whole `additionalFields` object built from the fresh fetch, since the server stores it as one blob. Type cannot be changed on edit, as in Bitwarden, and the form renders under the type name the fetch checked the item against, not the popup's cached one.
 
 #### Scenario: Rename only
 - **GIVEN** the user opened Edit and changed only Name
@@ -143,7 +143,7 @@ The extension SHALL delete an item only after the user confirms an in-popup dial
 - **THEN** no request MUST be sent and the detail view MUST stay open
 
 ### Requirement: Clone
-The extension SHALL offer Clone on item detail, which MUST fresh-fetch and decrypt the item and open the add-item form prefilled with every field and the Name suffixed with " - Clone", as in Bitwarden. Saving MUST create a new item and leave the original untouched.
+The extension SHALL offer Clone on item detail, which MUST fresh-fetch and decrypt the item and open the add-item form prefilled with every field and the Name suffixed with " - Clone", as in Bitwarden. Until the user picks another type, the form MUST render under the type name the fetch returned, as Edit does. Saving MUST create a new item and leave the original untouched.
 
 #### Scenario: Clone a login
 - **GIVEN** the detail view of "GitHub" is open
diff --git a/browser-extension/src/accounts/store.ts b/browser-extension/src/accounts/store.ts
index d7a0e32a5..bfc264287 100644
--- a/browser-extension/src/accounts/store.ts
+++ b/browser-extension/src/accounts/store.ts
@@ -3,6 +3,7 @@ import type { CachedSuite } from '@/src/api/types'
 import { broadcast } from '@/src/background/broadcast'
 import { clearKey, hasKey, LAST_TAB_KEY, sessionValues, syncNeverLockKey } from '@/src/vault/key-store'
 import { clearSnapshot } from '@/src/vault/store'
+import { forgetVerifiedPartners } from '@/src/vault/verified-partners'
 import { DEFAULT_SETTINGS, settingsKey, writeSettings, type AccountSettings } from './settings'
 
 export { MAX_ACCOUNTS }
@@ -73,6 +74,7 @@ export async function getActiveAccountId(): Promise<string | null> {
 
 export async function setActive(accountId: string): Promise<void> {
 	if (!(await getAccount(accountId))) throw new Error(`Unknown account ${accountId}`)
+	if ((await getActiveAccountId()) !== accountId) forgetVerifiedPartners()
 	await browser.storage.local.set({ [ACTIVE]: accountId })
 }
 
@@ -94,6 +96,7 @@ export async function addAccount(fields: Omit<AccountRecord, 'id'>, suite: Cache
 		return added
 	})
 	// Only once the list holds it, or getActiveAccountId() would heal the pointer away.
+	forgetVerifiedPartners()
 	await browser.storage.local.set({ [ACTIVE]: record.id })
 	return record
 }
diff --git a/browser-extension/src/api/client.ts b/browser-extension/src/api/client.ts
index eb9a75da6..6807b12cf 100644
--- a/browser-extension/src/api/client.ts
+++ b/browser-extension/src/api/client.ts
@@ -2,8 +2,8 @@ import { toBase64 } from '@/src/crypto/base64'
 import type { NextcloudUser, SuiteRow } from './types'
 
 export class ApiError extends Error {
-	/** `code`: the body's machine-readable reason, e.g. a vault policy's, when the server sends one. */
-	constructor(readonly status: number, message: string, readonly code?: string) {
+	/** `code`: the body's machine-readable reason, e.g. a vault policy's, when the server sends one. `body`: the parsed answer, as a share-save's `incomplete` lists. */
+	constructor(readonly status: number, message: string, readonly code?: string, readonly body?: unknown) {
 		super(message)
 	}
 
@@ -84,7 +84,7 @@ export function createClient(account: ClientAccount) {
 		// A 428 names its reason as `error`, a 403 as `code`; `forbidden` names none.
 		const { error, code } = (json ?? {}) as { error?: unknown; code?: unknown }
 		const reason = [error, code].find((value): value is string => typeof value === 'string' && value !== 'forbidden')
-		throw new ApiError(response.status, message, reason)
+		throw new ApiError(response.status, message, reason, json)
 	}
 
 	return {
diff --git a/browser-extension/src/background/background.test.ts b/browser-extension/src/background/background.test.ts
index 65efcb0be..6043491ee 100644
--- a/browser-extension/src/background/background.test.ts
+++ b/browser-extension/src/background/background.test.ts
@@ -1,8 +1,9 @@
+import { readdirSync, readFileSync } from 'node:fs'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { fakeBrowser } from 'wxt/testing/fake-browser'
 import background from '@/entrypoints/background'
 import { addAccount } from '@/src/accounts/store'
-import { POPUP_PORT, type Result } from '@/src/messages'
+import { POPUP_PORT, POPUP_REQUEST_KINDS, type Result } from '@/src/messages'
 import { envelope, suiteRow } from '@/src/testing/vectors'
 import { hasKey } from '@/src/vault/key-store'
 import { SYNC_ALARM } from '@/src/vault/sync'
@@ -47,6 +48,14 @@ beforeEach(() => {
 	messageListener = addListener.mock.calls[0]![0] as never
 })
 
+/** The kinds the popup's code sends through `request`, read from its source. */
+function popupRequestKinds(): string[] {
+	const root = new URL('../../entrypoints/popup/', import.meta.url)
+	const files = readdirSync(root, { recursive: true, encoding: 'utf8' }).filter((file) => /\.tsx?$/.test(file) && !/\.test\.tsx?$/.test(file))
+	const kinds = files.flatMap((file) => [...readFileSync(new URL(file, root), 'utf8').matchAll(/\brequest\(\{ kind: '([^']+)'/g)].map((match) => match[1]!))
+	return [...new Set(kinds)]
+}
+
 async function storedAccount() {
 	return addAccount({
 		serverUrl: 'https://cloud.example.org', uid: 'alice', loginName: 'alice', displayName: 'Alice', email: null, avatarDataUrl: null, appPassword: 'pw',
@@ -81,6 +90,19 @@ describe('background entrypoint', () => {
 		}
 	})
 
+	it('routes every request kind the popup sends to the request handler', async () => {
+		const kinds = popupRequestKinds()
+		// So a change in how the popup calls `request` cannot leave this checking nothing.
+		expect(kinds).toEqual(expect.arrayContaining(['vault.snapshot', 'item.fetch', 'item.update']))
+		// A popout that opened would leave the next test expecting its window.
+		vi.spyOn(browser.windows, 'create').mockRejectedValue(new Error('no window'))
+		for (const kind of kinds) {
+			expect(POPUP_REQUEST_KINDS.has(kind), kind).toBe(true)
+			// What the account router answers a kind it does not know.
+			expect(await deliver({ kind, accountId: 'nobody', id: 'i1' }, popupSender), kind).not.toEqual({ ok: false, code: 'unknown' })
+		}
+	})
+
 	it('ignores account messages from a content script', async () => {
 		expect(await deliver({ kind: 'accounts.removeAll' }, pageSender)).toBeUndefined()
 		expect(await deliver({ kind: 'vault.status' }, { id: 'other-extension', url: 'chrome-extension://other-extension/x.html' })).toBeUndefined()
diff --git a/browser-extension/src/background/requests.test.ts b/browser-extension/src/background/requests.test.ts
index 37a7a0052..56632a559 100644
--- a/browser-extension/src/background/requests.test.ts
+++ b/browser-extension/src/background/requests.test.ts
@@ -7,7 +7,7 @@ import { pemToPkcs8, toBase64 } from '@/src/crypto'
 import type { PopupReplies, PopupRequest } from '@/src/messages'
 import { blockedRow, encrypt, folderRow, secretRow, typeRows } from '@/src/testing/vault'
 import { envelope, suiteRow } from '@/src/testing/vectors'
-import { hasKey, putKey } from '@/src/vault/key-store'
+import { editOpenedKey, hasKey, putKey, sessionValues } from '@/src/vault/key-store'
 import { writeSnapshot } from '@/src/vault/store'
 import type { VaultSnapshot } from '@/src/vault/types'
 import { onPopupClosed, onPopupOpened } from '@/src/vault/timeout'
@@ -246,6 +246,52 @@ describe('vault writes', () => {
 		expect(await send({ kind: 'item.delete', id: 's1' } as never)).toEqual({ ok: false, error: { code: 'invalid' } })
 		expect(fetchMock).not.toHaveBeenCalled()
 	})
+
+	describe('item.update', () => {
+		const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
+		const bob = { shareId: 'fs-bob', recipientCloudId: 'bob@cloud.partner.example' }
+		/** Item `s1`, shared with a partner when `partner`, whose instance does not answer. */
+		async function serve(partner: boolean) {
+			const row = secretRow({ key: await encrypt('pw') })
+			await snapshot([row])
+			fetchMock.mockImplementation(async (input, init) => {
+				const path = new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')
+				const body = init?.body ? JSON.parse(String(init.body)) as { federated: unknown[]; suspend: unknown[] } : undefined
+				if (path === '/api/v1/secrets/s1') return json(row)
+				if (path === '/api/v1/secrets/s1/write-context') return json({ sourceSecretId: 's1', effectiveGrade: 'owner', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: row.updatedAt })
+				if (path === '/api/v1/secrets/s1/share-save') {
+					return partner && body!.federated.length + body!.suspend.length === 0
+						? json({ error: 'incomplete', copies: { required: [] }, federated: { required: [bob] } }, 409)
+						: json({ secret: row, federated: { ownerOnly: false } })
+				}
+				if (path === '/api/v1/federation/recipient-certificate') return json({ message: 'partner_unreachable' }, 502)
+				if (path === '/api/v1/suites') return json([suiteRow])
+				if (path === '/api/v1/offline/manifest') return json({ suite: suiteRow, secrets: [row], folders: [folderRow()], types: typeRows, syncedAt: '' })
+				return json({ message: 'Unavailable' }, 503)
+			})
+			vi.spyOn(console, 'error').mockImplementation(() => {})
+			const opened = await send({ kind: 'item.fetch', accountId, id: 's1', purpose: 'edit' })
+			return { row, record: opened.ok ? opened.value.recordId : undefined }
+		}
+
+		it.each([
+			['its edit fetch\'s record, which it uses up', (record: string | undefined) => record, 0],
+			['a record that is not a string as none, and still saves', () => 5, 1],
+		])('passes a save %s', async (_, named, left) => {
+			const { row, record } = await serve(false)
+			expect(await send({ kind: 'item.update', accountId, id: 's1', patch: { key: 'new' }, baseUpdatedAt: row.updatedAt, recordId: named(record) } as never)).toMatchObject({ ok: true })
+			expect(JSON.parse(await sessionValues.get(editOpenedKey(accountId)) ?? '[]')).toHaveLength(left)
+		})
+
+		it.each([
+			['a list of share ids', ['fs-bob'], { ok: true }],
+			['one share id that is not in a list', 'fs-bob', { ok: false, error: { code: 'partner_unreachable', partners: [{ shareId: 'fs-bob', cloudId: bob.recipientCloudId }] } }],
+			['a list holding other than share ids', ['fs-bob', 5], { ok: false, error: { code: 'partner_unreachable' } }],
+		])('passes the partners to save without as %s, dropping anything else', async (_, withoutUnreachable, reply) => {
+			const { row, record } = await serve(true)
+			expect(await send({ kind: 'item.update', accountId, id: 's1', patch: { key: 'new' }, baseUpdatedAt: row.updatedAt, recordId: record, withoutUnreachable } as never)).toMatchObject(reply)
+		})
+	})
 })
 
 describe('clipboard.copied', () => {
diff --git a/browser-extension/src/background/requests.ts b/browser-extension/src/background/requests.ts
index c8b08ce07..05fbc710f 100644
--- a/browser-extension/src/background/requests.ts
+++ b/browser-extension/src/background/requests.ts
@@ -143,6 +143,9 @@ async function perform(message: PopupRequest): Promise<PopupReplies[PopupRequest
 	}
 }
 
+const isString = (value: unknown): value is string => typeof value === 'string'
+const isStrings = (value: unknown): value is string[] => Array.isArray(value) && value.every(isString)
+
 /** A write without the account it was meant for is refused, so a stale window never writes elsewhere. */
 async function performWrite(message: VaultWrite): Promise<PopupReplies[VaultWrite['kind']]> {
 	const accountId = message.accountId
@@ -153,7 +156,8 @@ async function performWrite(message: VaultWrite): Promise<PopupReplies[VaultWrit
 		case 'item.create':
 			return createItem(message.draft, accountId)
 		case 'item.update':
-			return updateItem(message.id, message.patch ?? {}, message.baseUpdatedAt, accountId)
+			return updateItem(message.id, message.patch ?? {}, message.baseUpdatedAt, accountId, isString(message.recordId) ? message.recordId : undefined,
+				isStrings(message.withoutUnreachable) ? message.withoutUnreachable : undefined)
 		case 'item.delete':
 			return deleteItem(message.id, accountId)
 		case 'folder.create':
diff --git a/browser-extension/src/crypto/crypto.test.ts b/browser-extension/src/crypto/crypto.test.ts
index ca4f73cef..55f52d127 100644
--- a/browser-extension/src/crypto/crypto.test.ts
+++ b/browser-extension/src/crypto/crypto.test.ts
@@ -1,8 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { decodeEnvelope, encodeEnvelope, IV_LENGTH, SALT_LENGTH } from './envelope'
 import { decryptPrivateKeyPem, deriveUnlockKey, InvalidMasterPassword } from './kdf'
-import { extractSpki, importPrivateKey, importPublicKey, pemToPkcs8, rsaDecrypt, rsaEncrypt } from './rsa'
-import { envelope, vectors } from '@/src/testing/vectors'
+import { fromBase64, toBase64 } from './base64'
+import { extractSpki, importPrivateKey, importPublicKey, importSpki, pemToPkcs8, rsaDecrypt, rsaEncrypt } from './rsa'
+import { envelope, federationChain, vectors } from '@/src/testing/vectors'
 
 // Written by the Keepiq web app, so passing them means byte compatibility.
 const fields = vectors('fields')
@@ -56,6 +57,53 @@ describe('rsa fields', async () => {
 			}
 		})
 	}
+
+	it('imports a SubjectPublicKeyInfo as an encrypt-only key', async () => {
+		const publicKey = await importSpki(extractSpki(derOf(envelope.certificatePem)))
+		expect(publicKey.usages).toEqual(['encrypt'])
+		expect(publicKey.extractable).toBe(false)
+		expect(await rsaDecrypt(await rsaEncrypt('x', publicKey), privateKey)).toBe('x')
+	})
+
+	it('rejects a SubjectPublicKeyInfo that is no SEQUENCE rather than throwing', async () => {
+		let pending: Promise<CryptoKey> | undefined
+		expect(() => (pending = importSpki(new Uint8Array([0x04, 0x00])))).not.toThrow()
+		await expect(pending).rejects.toThrow(/Malformed/)
+	})
+})
+
+const derOf = (pem: string) => fromBase64(pem.replace(/-----[A-Z ]+-----|\s/g, ''))
+const wrap = (label: string, der: Uint8Array) => `-----BEGIN ${label}-----\n${toBase64(der)}\n-----END ${label}-----`
+
+describe('PEM', () => {
+	const cert: string = envelope.certificatePem
+	const spki: string = envelope.publicKeyPem
+	// Another certificate, so a parser that takes the wrong one is caught.
+	const other = federationChain().mallory
+
+	it.each([
+		['text before the block', `${toBase64(derOf(other))}\n${cert}`],
+		['text after the block', `${cert}\n${toBase64(derOf(other))}`],
+		['two blocks', `${cert}\n${other}`],
+		['DER after the certificate', wrap('CERTIFICATE', new Uint8Array([...derOf(cert), ...derOf(other)]))],
+		['DER after the public key', wrap('PUBLIC KEY', new Uint8Array([...derOf(spki), 0x30, 0x00]))],
+		['mismatched labels', cert.replace('END CERTIFICATE', 'END PUBLIC KEY')],
+		['another label', wrap('PRIVATE KEY', derOf(cert))],
+		['characters outside base64', cert.replace('\n', '\n!')],
+	])('refuses a public key with %s by rejecting', async (_, pem) => {
+		await expect(importPublicKey(pem)).rejects.toThrow(/Malformed/)
+	})
+
+	it('refuses a private key with text around it or DER after it', () => {
+		const pem: string = envelope.privateKeyPem
+		expect(() => pemToPkcs8(`${pem}\n${pem}`)).toThrow(/Malformed/)
+		expect(() => pemToPkcs8(wrap('PRIVATE KEY', new Uint8Array([...derOf(pem), 0x30, 0x00])))).toThrow(/Malformed/)
+	})
+
+	it('allows whitespace around the block', async () => {
+		await expect(importPublicKey(`\r\n  ${cert.replace(/\n/g, '\r\n')}\n\n`)).resolves.toBeDefined()
+		expect(pemToPkcs8(`${envelope.privateKeyPem}\n`)).toEqual(pemToPkcs8(envelope.privateKeyPem))
+	})
 })
 
 describe('malformed input', () => {
diff --git a/browser-extension/src/crypto/federated-certificate.test.ts b/browser-extension/src/crypto/federated-certificate.test.ts
new file mode 100644
index 000000000..690c0ea5d
--- /dev/null
+++ b/browser-extension/src/crypto/federated-certificate.test.ts
@@ -0,0 +1,523 @@
+import { createPublicKey, X509Certificate } from 'node:crypto'
+import { beforeAll, describe, expect, it } from 'vitest'
+import { caConstraintsChain, FEDERATION_NAMES, federationChain } from '@/src/testing/vectors'
+import { fromBase64, toBase64 } from './base64'
+import { canonicalCloudId, FederatedCertificateError, verifyFederatedCertificate, type FederatedCertificateInput } from './federated-certificate'
+import { extractSpki, importPrivateKey, importSpki, pemToPkcs8, rsaDecrypt, rsaEncrypt } from './rsa'
+
+// The web app's own fixture: two CAs with the same names, so only the pin and the signatures tell them apart.
+const F = federationChain()
+const C = caConstraintsChain()
+const BOB = 'bob@cloud.partner.example'
+const CAROL = 'carol@cloud.partner.example'
+const MALLORY = 'mallory@cloud.partner.example'
+const FINGERPRINT = expect.stringMatching(/^[0-9a-f]{64}$/)
+
+const verify = (overrides: Partial<FederatedCertificateInput> = {}) => verifyFederatedCertificate({
+	certificate: F.bob, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint, cloudId: BOB, ...overrides,
+})
+
+const verifyMallory = (overrides: Partial<FederatedCertificateInput> = {}) => verifyFederatedCertificate({
+	certificate: C.mallory, chain: [C.intermediate, C.root], partnerRootFingerprint: C.rootFingerprint, cloudId: MALLORY, ...overrides,
+})
+
+const derOf = (pem: string) => fromBase64(pem.replace(/-----[A-Z ]+-----|\s/g, ''))
+const pemOf = (der: ArrayLike<number>) => `-----BEGIN CERTIFICATE-----\n${toBase64(Uint8Array.from(der))}\n-----END CERTIFICATE-----`
+
+/** A DER element of up to 64 KiB. */
+function der(tag: number, ...parts: ArrayLike<number>[]): number[] {
+	const body = parts.flatMap((part) => Array.from(part))
+	const n = body.length
+	return [tag, ...(n < 0x80 ? [n] : n < 0x100 ? [0x81, n] : [0x82, n >> 8, n & 0xff]), ...body]
+}
+
+/** Where an element's value lies. */
+function element(bytes: Uint8Array, offset: number): { start: number; end: number } {
+	let length = bytes[offset + 1]!
+	let start = offset + 2
+	if (length & 0x80) {
+		const count = length & 0x7f
+		length = 0
+		for (let i = 0; i < count; i++) length = length * 256 + bytes[start + i]!
+		start += count
+	}
+	return { start, end: start + length }
+}
+
+function indexOf(bytes: Uint8Array, pattern: number[], last = false): number {
+	const at = (i: number) => pattern.every((byte, j) => bytes[i + j] === byte)
+	for (let n = 0; n <= bytes.length - pattern.length; n++) {
+		const i = last ? bytes.length - pattern.length - n : n
+		if (at(i)) return i
+	}
+	throw new Error('pattern not found')
+}
+
+/** A certificate with its TBS fields changed and the signature left as it was, since these are refused before it is checked. */
+function withTbsFields(pem: string, edit: (fields: Uint8Array[]) => ArrayLike<number>[]): string {
+	const bytes = derOf(pem)
+	const certificate = element(bytes, 0)
+	const tbs = element(bytes, certificate.start)
+	const fields: Uint8Array[] = []
+	for (let at = tbs.start; at < tbs.end; at = element(bytes, at).end) fields.push(bytes.subarray(at, element(bytes, at).end))
+	return pemOf(der(0x30, der(0x30, ...edit(fields)), bytes.subarray(tbs.end, certificate.end)))
+}
+
+async function reasonOf(pending: Promise<unknown>): Promise<string> {
+	try {
+		await pending
+	} catch (error) {
+		expect(error).toBeInstanceOf(FederatedCertificateError)
+		return (error as FederatedCertificateError).reason
+	}
+	throw new Error('the certificate was accepted')
+}
+
+async function sha256Hex(pem: string): Promise<string> {
+	return Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', derOf(pem))), (b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+describe('verifyFederatedCertificate', () => {
+	it("accepts the pinned chain and returns the leaf's SHA-256 as lowercase hex", async () => {
+		const { fingerprint } = await verify()
+		expect(fingerprint).toMatch(/^[0-9a-f]{64}$/)
+		expect(fingerprint).toBe(await sha256Hex(F.bob))
+	})
+
+	it('accepts a renewal signed with RSASSA-PSS', async () => {
+		expect((await verify({ certificate: F.bobPss })).fingerprint).toBe(await sha256Hex(F.bobPss))
+	})
+
+	it('returns the key of the leaf it checked, which the recipient can open', async () => {
+		expect((await verify()).spki).toEqual(new Uint8Array(createPublicKey(F.bob).export({ type: 'spki', format: 'der' })))
+		const { spki } = await verifyMallory()
+		expect(spki).toEqual(extractSpki(derOf(C.mallory)))
+		const sealed = await rsaEncrypt('hunter2', await importSpki(spki))
+		expect(await rsaDecrypt(sealed, await importPrivateKey(pemToPkcs8(C.malloryKey)))).toBe('hunter2')
+	})
+
+	it('refuses another certificate smuggled around the checked one', async () => {
+		// The leaf base64 in front of a real PEM: a lenient parser checks one and encrypts to the other.
+		expect(await reasonOf(verify({ certificate: `${toBase64(derOf(C.forgedAlice))}\n${F.bob}` }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: `${F.bob}\n${toBase64(derOf(C.forgedAlice))}` }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: `${F.bob}${C.forgedAlice}` }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: `${F.bob}\n${F.mallory}` }))).toBe('malformed')
+		expect(await reasonOf(verify({ chain: [`${F.intermediateA}\n${F.bob}`, F.rootA] }))).toBe('malformed')
+		const trailing = new Uint8Array([...derOf(F.bob), ...derOf(C.forgedAlice)])
+		expect(await reasonOf(verify({ certificate: pemOf(trailing) }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: F.bob.replace('-----END CERTIFICATE-----', '-----END PUBLIC KEY-----') }))).toBe('malformed')
+	})
+
+	it('refuses a PEM block that is not labelled CERTIFICATE', async () => {
+		expect(await reasonOf(verify({ certificate: F.bob.replace(/CERTIFICATE/g, 'PUBLIC KEY') }))).toBe('malformed')
+	})
+
+	it('refuses a certificate with more than three parts', async () => {
+		// Bob's certificate has a two-byte long-form length: 30 82 hi lo.
+		expect(await reasonOf(verify({ certificate: pemOf(der(0x30, derOf(F.bob).subarray(4), [0x05, 0x00])) }))).toBe('malformed')
+	})
+
+	it('refuses a signature whose BIT STRING claims unused bits, though its bytes still verify', async () => {
+		const bytes = derOf(F.bob)
+		// A 2048-bit signature: 03 82 01 01, then the unused-bits count and 256 bytes.
+		expect(Array.from(bytes.subarray(-261, -256))).toEqual([0x03, 0x82, 0x01, 0x01, 0x00])
+		bytes[bytes.length - 257] = 0x01
+		expect(await reasonOf(verify({ certificate: pemOf(bytes) }))).toBe('malformed')
+	})
+
+	it('refuses an element that runs past the end of its parent', async () => {
+		const bytes = derOf(F.bob)
+		// The outer signature algorithm's OID now runs one byte past the end of its SEQUENCE.
+		bytes[indexOf(bytes, [0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b], true) + 1] = 0x0c
+		expect(await reasonOf(verify({ certificate: pemOf(bytes) }))).toBe('malformed')
+		// The common name, Mallory's last attribute, now one byte past its attribute but inside the certificate.
+		const mallory = derOf(C.mallory)
+		mallory[indexOf(mallory, [0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x1d, 0x6d]) + 6] = 0x1e
+		expect(await reasonOf(verifyMallory({ certificate: pemOf(mallory) }))).toBe('malformed')
+	})
+
+	it('refuses a DER length that runs past the buffer, without reading out of bounds', async () => {
+		expect(await reasonOf(verify({ certificate: pemOf(derOf(F.bob).slice(0, 200)) }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: pemOf([0x30, 0x84, 0xff, 0xff, 0xff, 0xff, 0x30]) }))).toBe('malformed')
+	})
+
+	it('refuses a second extensions block rather than leave it unread', async () => {
+		const twice = withTbsFields(F.intermediateA, (fields) => {
+			expect(fields.at(-1)![0]).toBe(0xa3)
+			return [...fields, fields.at(-1)!]
+		})
+		expect(await reasonOf(verify({ chain: [twice, F.rootA] }))).toBe('malformed')
+	})
+
+	it('refuses an extensions block that holds two lists', async () => {
+		const doubled = withTbsFields(F.intermediateA, (fields) => {
+			const block = fields.at(-1)!
+			const list = block.subarray(element(block, 0).start)
+			return [...fields.slice(0, -1), der(0xa3, list, list)]
+		})
+		expect(await reasonOf(verify({ chain: [doubled, F.rootA] }))).toBe('malformed')
+	})
+
+	it('refuses a chain that ends at another root', async () => {
+		expect(await reasonOf(verify({ certificate: F.bobOtherRoot, chain: [F.intermediateB, F.rootB] }))).toBe('untrusted_root')
+	})
+
+	it('refuses a certificate the pinned chain did not sign, even with the same issuer name', async () => {
+		expect(await reasonOf(verify({ certificate: F.bobOtherRoot }))).toBe('bad_chain')
+	})
+
+	it('refuses another common name than the share names', async () => {
+		expect(await reasonOf(verify({ certificate: F.mallory }))).toBe('name_mismatch')
+		expect(await reasonOf(verify({ cloudId: 'bob@cloud.elsewhere.example' }))).toBe('name_mismatch')
+		expect(await reasonOf(verify({ cloudId: 'not a cloud id' }))).toBe('name_mismatch')
+	})
+
+	it('refuses a common name and a cloud id that are both no cloud id', async () => {
+		// The sub-CA chains to the pinned root, and its common name has no `@`, like 'garbage'.
+		expect(await reasonOf(verifyMallory({ certificate: C.subIntermediate, cloudId: 'garbage' }))).toBe('name_mismatch')
+	})
+
+	it('matches the common name without the scheme an http instance writes', async () => {
+		await expect(verify({ cloudId: 'bob@http://cloud.partner.example' })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+		expect(await reasonOf(verify({ cloudId: 'BOB@cloud.partner.example' }))).toBe('name_mismatch')
+		expect(await reasonOf(verify({ cloudId: 'bob@cloud.partner.example.evil' }))).toBe('name_mismatch')
+		expect(await reasonOf(verify({ cloudId: 'bob@http://cloud.other.example' }))).toBe('name_mismatch')
+	})
+
+	it('refuses a certificate outside its validity', async () => {
+		expect(await reasonOf(verify({ now: Date.UTC(2300, 0, 1) }))).toBe('not_valid_now')
+		expect(await reasonOf(verify({ now: Date.UTC(2000, 0, 1) }))).toBe('not_valid_now')
+	})
+
+	it('allows a few minutes of clock skew on notBefore, not more', async () => {
+		// The chain was issued in one run, so its newest notBefore is the recipient's.
+		const issued = Date.parse(new X509Certificate(F.bob).validFrom)
+		const minutes = 60 * 1000
+		await expect(verify({ now: issued - 2 * minutes })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+		expect(await reasonOf(verify({ now: issued - 10 * minutes }))).toBe('not_valid_now')
+	})
+
+	it('refuses without a pin, without a chain, or with garbage', async () => {
+		expect(await reasonOf(verify({ partnerRootFingerprint: '' }))).toBe('untrusted_root')
+		expect(await reasonOf(verify({ partnerRootFingerprint: null }))).toBe('untrusted_root')
+		expect(await reasonOf(verify({ chain: [] }))).toBe('untrusted_root')
+		expect(await reasonOf(verify({ chain: 'not a list' }))).toBe('untrusted_root')
+		expect(await reasonOf(verify({ certificate: 'not a certificate' }))).toBe('malformed')
+		expect(await reasonOf(verify({ certificate: 42 }))).toBe('malformed')
+	})
+
+	it('compares the pin without regard to case', async () => {
+		await expect(verify({ partnerRootFingerprint: F.rootAFingerprint.toUpperCase() })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+})
+
+// The web app's own cases on its own fixture: re-issues of partner A's keys with other extensions or validity, so only those can refuse them.
+describe("verifyFederatedCertificate on the web app's chain constraints", () => {
+	it('reads every entry of the fixture, so a case added there is added here', () => {
+		expect(Object.keys(F).sort()).toEqual([...FEDERATION_NAMES].sort())
+	})
+
+	it('accepts a CA with basicConstraints and no keyUsage, and a pathLen the chain fits', async () => {
+		await expect(verify({ chain: [F.intermediateABasicConstraintsOnly, F.rootA] })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+		await expect(verify({ chain: [F.intermediateAPathLen0, F.rootA] })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it('accepts a recipient certificate marked CA', async () => {
+		await expect(verify({ certificate: F.leafMarkedCa, cloudId: MALLORY })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it('refuses a leaf signed with another leaf', async () => {
+		expect(await reasonOf(verify({ certificate: F.leafSignedByLeaf, chain: [F.mallory, F.intermediateA, F.rootA], cloudId: CAROL }))).toBe('bad_chain')
+		// Pinned at the intermediate, so only the issuing leaf's missing basicConstraints refuses it.
+		expect(await reasonOf(verify({ certificate: F.leafSignedByLeaf, chain: [F.mallory, F.intermediateA], partnerRootFingerprint: await sha256Hex(F.intermediateA), cloudId: CAROL }))).toBe('bad_chain')
+	})
+
+	it('refuses a chain other than an intermediate and the root, even one that verifies', async () => {
+		expect(await reasonOf(verify({ certificate: F.leafSignedByLeaf, chain: [F.leafMarkedCa, F.intermediateA, F.rootA], cloudId: CAROL }))).toBe('bad_chain')
+		expect(await reasonOf(verify({ certificate: F.leafSignedByRoot, chain: [F.rootA], cloudId: MALLORY }))).toBe('bad_chain')
+	})
+
+	it('refuses the root in place of the intermediate, though it signed the leaf', async () => {
+		expect(await reasonOf(verify({ certificate: F.leafSignedByRoot, chain: [F.rootA, F.rootA], cloudId: MALLORY }))).toBe('bad_chain')
+	})
+
+	it.each([
+		['without basicConstraints', 'intermediateANoBasicConstraints'],
+		['with CA:FALSE', 'intermediateANotCa'],
+		['whose keyUsage lacks keyCertSign', 'intermediateANoCertSign'],
+		['whose keyUsage sets keyCertSign only in its padding bits', 'intermediateAKeyCertSignInPadding'],
+	] as const)('refuses an issuer %s', async (_, name) => {
+		expect(await reasonOf(verify({ chain: [F[name], F.rootA] }))).toBe('bad_chain')
+	})
+
+	it('refuses a chain longer than a pathLen allows', async () => {
+		expect(await reasonOf(verify({ chain: [F.intermediateA, F.rootAPathLen0], partnerRootFingerprint: F.rootAPathLen0Fingerprint }))).toBe('bad_chain')
+	})
+
+	it('accepts an unknown extension on an issuer that is not critical, and a critical keyUsage', async () => {
+		await expect(verify({ chain: [F.intermediateAUnknownNonCritical, F.rootA] })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+		await expect(verify()).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it.each([
+		['an unknown critical extension', 'intermediateAUnknownCritical'],
+		['basicConstraints twice, CA:TRUE last', 'intermediateADuplicateBasicConstraints'],
+		['an empty keyUsage that claims unused bits', 'intermediateAEmptyKeyUsageWithUnusedBits'],
+	] as const)('refuses an issuer with %s', async (_, name) => {
+		expect(await reasonOf(verify({ chain: [F[name], F.rootA] }))).toBe('malformed')
+	})
+
+	it('refuses an issuer whose basicConstraints does not decode', async () => {
+		// The extnValue OCTET STRING of `critical, CA:TRUE`, retagged as a BIT STRING.
+		const bytes = derOf(F.intermediateABasicConstraintsOnly)
+		bytes[indexOf(bytes, [0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04]) + 8] = 0x03
+		expect(await reasonOf(verify({ chain: [pemOf(bytes), F.rootA] }))).toBe('malformed')
+	})
+
+	it.each<[string, Partial<FederatedCertificateInput>]>([
+		['an expired intermediate', { chain: [F.intermediateAExpired, F.rootA] }],
+		['an intermediate not yet valid', { chain: [F.intermediateANotYetValid, F.rootA] }],
+		['an expired root', { chain: [F.intermediateA, F.rootAExpired], partnerRootFingerprint: F.rootAExpiredFingerprint }],
+	])('refuses %s while the leaf is valid', async (_, overrides) => {
+		expect(await reasonOf(verify(overrides))).toBe('not_valid_now')
+	})
+})
+
+// Each bad certificate re-issues a good one's key and name, so only what it changes can refuse it.
+describe('verifyFederatedCertificate chain constraints', () => {
+	it('accepts CAs with basicConstraints and no keyUsage, and a pathLen the chain fits', async () => {
+		await expect(verifyMallory()).resolves.toMatchObject({ fingerprint: await sha256Hex(C.mallory) })
+		await expect(verifyMallory({ chain: [C.intermediatePathLen0, C.root] })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it('refuses a leaf signed with another leaf', async () => {
+		const alice = { certificate: C.forgedAlice, cloudId: 'alice@cloud.partner.example' }
+		expect(await reasonOf(verifyMallory({ ...alice, chain: [C.mallory, C.intermediate, C.root] }))).toBe('bad_chain')
+		// Pinned at the intermediate, so only mallory's lack of basicConstraints refuses it.
+		expect(await reasonOf(verifyMallory({ ...alice, chain: [C.mallory, C.intermediate], partnerRootFingerprint: await sha256Hex(C.intermediate) }))).toBe('bad_chain')
+	})
+
+	it('refuses a chain of other than an intermediate and the root, even one that verifies', async () => {
+		expect(await reasonOf(verifyMallory({ certificate: C.malloryByRoot, chain: [C.root] }))).toBe('bad_chain')
+		expect(await reasonOf(verifyMallory({ certificate: C.malloryByRoot, chain: [C.root, C.root] }))).toBe('bad_chain')
+		expect(await reasonOf(verifyMallory({ certificate: C.malloryBySubIntermediate, chain: [C.subIntermediate, C.intermediate, C.root] }))).toBe('bad_chain')
+	})
+
+	it.each([
+		['without basicConstraints', 'intermediateNoBasicConstraints'],
+		['with CA:FALSE', 'intermediateNotCa'],
+		['whose keyUsage lacks keyCertSign', 'intermediateNoCertSign'],
+	] as const)('refuses an issuer %s', async (_, name) => {
+		expect(await reasonOf(verifyMallory({ chain: [C[name], C.root] }))).toBe('bad_chain')
+	})
+
+	it('refuses a chain longer than a pathLen allows', async () => {
+		expect(await reasonOf(verifyMallory({ chain: [C.intermediate, C.rootPathLen0], partnerRootFingerprint: C.rootPathLen0Fingerprint }))).toBe('bad_chain')
+	})
+
+	it('accepts an unknown extension that is not critical', async () => {
+		await expect(verifyMallory({ certificate: C.malloryUnknownNonCritical })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it.each<[string, Partial<FederatedCertificateInput>]>([
+		['a leaf with an unknown critical extension', { certificate: C.malloryUnknownCritical }],
+		['an issuer with an unknown critical extension', { chain: [C.intermediateUnknownCritical, C.root] }],
+		['a leaf with an extension twice', { certificate: C.malloryDuplicateExtension }],
+		['an issuer with basicConstraints twice, CA:TRUE last', { chain: [C.intermediateDuplicateBasicConstraints, C.root] }],
+	])('refuses %s', async (_, overrides) => {
+		expect(await reasonOf(verifyMallory(overrides))).toBe('malformed')
+	})
+
+	it.each<[string, Partial<FederatedCertificateInput>]>([
+		['an expired intermediate', { chain: [C.intermediateExpired, C.root] }],
+		['an intermediate not yet valid', { chain: [C.intermediateNotYetValid, C.root] }],
+		['an expired root', { chain: [C.intermediate, C.rootExpired], partnerRootFingerprint: C.rootExpiredFingerprint }],
+	])('refuses %s while the leaf is valid', async (_, overrides) => {
+		expect(await reasonOf(verifyMallory(overrides))).toBe('not_valid_now')
+	})
+
+	it('reads the fixture without its note', () => {
+		expect(C).not.toHaveProperty('_note')
+	})
+})
+
+// Signed here with one throwaway key, so each certificate differs from a good one only where a test says.
+describe('verifyFederatedCertificate on chains built here', () => {
+	const OID = {
+		sha256Rsa: [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b],
+		pss: [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a],
+		mgf1: [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08],
+		sha256: [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01],
+		sha384: [0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02],
+		sha1: [0x2b, 0x0e, 0x03, 0x02, 0x1a],
+		commonName: [0x55, 0x04, 0x03],
+		basicConstraints: [0x55, 0x1d, 0x13],
+		keyUsage: [0x55, 0x1d, 0x0f],
+		subjectKeyId: [0x55, 0x1d, 0x0e],
+		authorityKeyId: [0x55, 0x1d, 0x23],
+	}
+	const utf8 = (text: string) => der(0x0c, new TextEncoder().encode(text))
+	const name = (...commonNames: number[][]) => der(0x30, ...commonNames.map((cn) => der(0x31, der(0x30, der(0x06, OID.commonName), cn))))
+	const extension = (id: number[], value: number[], critical = false) => der(0x30, der(0x06, id), critical ? der(0x01, [0xff]) : [], der(0x04, value))
+	const basicConstraints = (...fields: number[][]) => extension(OID.basicConstraints, der(0x30, ...fields), true)
+	const CA = basicConstraints(der(0x01, [0xff]))
+	const PKCS1 = der(0x30, der(0x06, OID.sha256Rsa), der(0x05))
+	const pss = ({ hash = OID.sha256, mask = OID.mgf1, maskHash = OID.sha256 } = {}) => der(0x30, der(0x06, OID.pss), der(0x30,
+		der(0xa0, der(0x30, der(0x06, hash))), der(0xa1, der(0x30, der(0x06, mask), der(0x30, der(0x06, maskHash)))), der(0xa2, der(0x02, [32]))))
+	const ROOT = name(utf8('Built Root CA'))
+	const INTERMEDIATE = name(utf8('Built Intermediate CA'))
+
+	interface Spec {
+		issuer: number[]
+		subject: number[]
+		extensions?: number[][]
+		/** The algorithm in the TBS, and outside it unless `outer` says otherwise. */
+		algorithm?: number[]
+		outer?: number[]
+		/** The throwaway key's SubjectPublicKeyInfo unless given. */
+		spki?: ArrayLike<number>
+	}
+
+	let keys: { spki: Uint8Array; pkcs1: CryptoKey; pss: CryptoKey }
+
+	beforeAll(async () => {
+		const pair = await crypto.subtle.generateKey({ name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' }, true, ['sign', 'verify'])
+		const pkcs8 = await crypto.subtle.exportKey('pkcs8', pair.privateKey)
+		keys = {
+			spki: new Uint8Array(await crypto.subtle.exportKey('spki', pair.publicKey)),
+			pkcs1: pair.privateKey,
+			pss: await crypto.subtle.importKey('pkcs8', pkcs8, { name: 'RSA-PSS', hash: 'SHA-256' }, false, ['sign']),
+		}
+	})
+
+	/** Signed with SHA-256: PSS with MGF1-SHA-256 and a 32-byte salt under any PSS algorithm, whatever its parameters claim. */
+	async function certificate({ issuer, subject, extensions, algorithm = PKCS1, outer = algorithm, spki = keys.spki }: Spec): Promise<string> {
+		const validity = der(0x30, der(0x17, new TextEncoder().encode('200101000000Z')), der(0x17, new TextEncoder().encode('491231235959Z')))
+		const tbs = der(0x30, der(0xa0, der(0x02, [2])), der(0x02, [1]), algorithm, issuer, validity, subject, spki, extensions ? der(0xa3, der(0x30, ...extensions)) : [])
+		const signature = algorithm.some((_, i) => OID.pss.every((byte, j) => algorithm[i + j] === byte))
+			? await crypto.subtle.sign({ name: 'RSA-PSS', saltLength: 32 }, keys.pss, Uint8Array.from(tbs))
+			: await crypto.subtle.sign('RSASSA-PKCS1-v1_5', keys.pkcs1, Uint8Array.from(tbs))
+		return pemOf(der(0x30, tbs, outer, der(0x03, [0x00], new Uint8Array(signature))))
+	}
+
+	type Parts = { root?: Partial<Spec>; intermediate?: Partial<Spec>; leaf?: Partial<Spec> }
+
+	/** A root, an intermediate and Mallory's leaf, each replaceable. */
+	async function build(parts: Parts = {}) {
+		const root = await certificate({ issuer: ROOT, subject: ROOT, extensions: [CA], ...parts.root })
+		const intermediate = await certificate({ issuer: ROOT, subject: INTERMEDIATE, extensions: [CA], ...parts.intermediate })
+		const leaf = await certificate({ issuer: INTERMEDIATE, subject: name(utf8(MALLORY)), ...parts.leaf })
+		return { root, intermediate, leaf }
+	}
+
+	async function verifyBuilt(parts: Parts = {}, cloudId = MALLORY) {
+		const { root, intermediate, leaf } = await build(parts)
+		return verifyFederatedCertificate({ certificate: leaf, chain: [intermediate, root], partnerRootFingerprint: await sha256Hex(root), cloudId })
+	}
+
+	it('accepts a chain of the profile Keepiq issues today, as lib/Service/certificate-extensions.cnf writes it', async () => {
+		// keyCertSign and cRLSign, with one unused bit; the key identifiers are not critical and not read.
+		const keyUsage = extension(OID.keyUsage, der(0x03, [0x01, 0x06]), true)
+		const keyIds = [extension(OID.subjectKeyId, der(0x04, new Uint8Array(20).fill(7))), extension(OID.authorityKeyId, der(0x30, der(0x80, new Uint8Array(20).fill(7))))]
+		const built = await build({
+			root: { extensions: [CA, keyUsage, keyIds[0]!, keyIds[1]!] },
+			intermediate: { extensions: [basicConstraints(der(0x01, [0xff]), der(0x02, [0x00])), keyUsage, ...keyIds] },
+			// openssl writes CA:FALSE as an empty SEQUENCE.
+			leaf: { extensions: [basicConstraints(), ...keyIds] },
+		})
+		await expect(verifyFederatedCertificate({ certificate: built.leaf, chain: [built.intermediate, built.root], partnerRootFingerprint: await sha256Hex(built.root), cloudId: MALLORY }))
+			.resolves.toMatchObject({ fingerprint: FINGERPRINT })
+		// OpenSSL agrees each link holds, so the builder and the parser don't share a wrong reading.
+		const [root, intermediate, leaf] = [built.root, built.intermediate, built.leaf].map((pem) => new X509Certificate(pem))
+		for (const [cert, issuer] of [[root, root], [intermediate, root], [leaf, intermediate]] as const) {
+			expect(cert!.checkIssued(issuer!)).toBe(true)
+			expect(cert!.verify(issuer!.publicKey)).toBe(true)
+		}
+	})
+
+	it('accepts a leaf signed with RSASSA-PSS, SHA-256 and MGF1-SHA-256', async () => {
+		await expect(verifyBuilt({ leaf: { algorithm: pss() } })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it.each([
+		['a hash other than SHA-256', { hash: OID.sha384 }],
+		['MGF1 with SHA-1', { maskHash: OID.sha1 }],
+		['a mask generation function other than MGF1', { mask: [...OID.mgf1.slice(0, -1), 0x09] }],
+	])('refuses a PSS signature whose parameters name %s, though it verifies with SHA-256', async (_, params) => {
+		expect(await reasonOf(verifyBuilt({ leaf: { algorithm: pss(params) } }))).toBe('bad_chain')
+	})
+
+	it.each([
+		['a hash that is no AlgorithmIdentifier', der(0x30, der(0x06, OID.pss), der(0x30, der(0xa0, der(0x02, [5]))))],
+		['no SEQUENCE', der(0x30, der(0x06, OID.pss), der(0x05))],
+		['a field it does not know', der(0x30, der(0x06, OID.pss), der(0x30, der(0xa4, der(0x02, [1]))))],
+	])('refuses PSS parameters with %s as malformed', async (_, algorithm) => {
+		expect(await reasonOf(verifyBuilt({ leaf: { algorithm } }))).toBe('malformed')
+	})
+
+	it('refuses a signature algorithm outside the TBS other than the one inside, though the signature verifies', async () => {
+		expect(await reasonOf(verifyBuilt({ leaf: { outer: der(0x30, der(0x06, OID.sha256Rsa)) } }))).toBe('malformed')
+	})
+
+	it("refuses a leaf whose issuer name is not the intermediate's, though the intermediate's key signed it", async () => {
+		expect(await reasonOf(verifyBuilt({ leaf: { issuer: name(utf8('Another CA')) } }))).toBe('bad_chain')
+	})
+
+	it('refuses an intermediate whose basicConstraints spells out cA FALSE', async () => {
+		expect(await reasonOf(verifyBuilt({ intermediate: { extensions: [basicConstraints(der(0x01, [0x00]))] } }))).toBe('bad_chain')
+	})
+
+	it('refuses a keyUsage that claims more than 7 unused bits', async () => {
+		expect(await reasonOf(verifyBuilt({ intermediate: { extensions: [CA, extension(OID.keyUsage, der(0x03, [0x08, 0x04, 0x00]), true)] } }))).toBe('malformed')
+	})
+
+	const ascii = (text: string) => Array.from(new TextEncoder().encode(text))
+	const bmp = (text: string) => der(0x1e, Array.from(text).flatMap((char) => [char.charCodeAt(0) >> 8, char.charCodeAt(0) & 0xff]))
+
+	it.each<[string, number[]]>([
+		['a second common name', name(utf8('alice@cloud.partner.example'), utf8(MALLORY))],
+		['a common name as a BMPString', name(bmp(MALLORY))],
+		['a common name that is no UTF-8', name(der(0x0c, [...ascii(MALLORY), 0xff]))],
+		...[0x1f, 0x7f, 0xe9].map((byte): [string, number[]] => [`a T61String common name with byte 0x${byte.toString(16)}`, name(der(0x14, [...ascii(MALLORY), byte]))]),
+		['an IA5String common name with a control character', name(der(0x16, [...ascii(MALLORY), 0x0a]))],
+		['a PrintableString common name with UTF-8 é', name(der(0x13, [...ascii(MALLORY), 0xc3, 0xa9]))],
+	])('refuses a leaf with %s', async (_, subject) => {
+		expect(await reasonOf(verifyBuilt({ leaf: { subject } }))).toBe('malformed')
+	})
+
+	it.each([
+		['a PrintableString', 0x13],
+		['a T61String of printable ASCII, as OpenSSL may write it', 0x14],
+		['an IA5String of printable ASCII', 0x16],
+	])('accepts a common name as %s', async (_, tag) => {
+		await expect(verifyBuilt({ leaf: { subject: name(der(tag, ascii(MALLORY))) } })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it('reads no common name of a CA, which only its name bytes and the pin identify', async () => {
+		const root = name(utf8('Built Root CA'), utf8('Built Root CA again'))
+		const intermediate = name(utf8('Built Intermediate CA'), bmp('Built Intermediate CA'))
+		await expect(verifyBuilt({ root: { issuer: root, subject: root }, intermediate: { issuer: root, subject: intermediate }, leaf: { issuer: intermediate } }))
+			.resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	})
+
+	it('keeps a byte order mark in the common name, so it names no one', async () => {
+		expect(await reasonOf(verifyBuilt({ leaf: { subject: name(der(0x0c, [0xef, 0xbb, 0xbf, ...ascii(MALLORY)])) } }))).toBe('name_mismatch')
+	})
+
+	it('refuses a leaf whose key is no SEQUENCE, though its chain verifies', async () => {
+		expect(await reasonOf(verifyBuilt({ leaf: { spki: der(0x04, keys.spki) } }))).toBe('malformed')
+	})
+})
+
+describe('canonicalCloudId', () => {
+	it.each([
+		['bob@http://Cloud.Partner.example/', 'bob@cloud.partner.example'],
+		['Bob@https://cloud.partner.example:8443/nc', 'Bob@cloud.partner.example:8443/nc'],
+		['bob@Cloud.Partner.example/NC/', 'bob@cloud.partner.example/NC'],
+		['bob', ''],
+		['bob@', ''],
+		[null, ''],
+	])('%s → %s', (input, expected) => {
+		expect(canonicalCloudId(input)).toBe(expected)
+	})
+})
diff --git a/browser-extension/src/crypto/federated-certificate.ts b/browser-extension/src/crypto/federated-certificate.ts
new file mode 100644
index 000000000..91fb35b12
--- /dev/null
+++ b/browser-extension/src/crypto/federated-certificate.ts
@@ -0,0 +1,340 @@
+/** A port of the Keepiq web app's `src/crypto/federatedCertificate.js`. Both servers are trusted, the pin arriving in the owner server's reply; this catches a certificate for the wrong user, an expired one, or a chain from another partner before anything is encrypted to it. */
+import { decodePem } from './rsa'
+
+const OID_COMMON_NAME = '2.5.4.3'
+const OID_BASIC_CONSTRAINTS = '2.5.29.19'
+const OID_KEY_USAGE = '2.5.29.15'
+const OID_SHA256_RSA = '1.2.840.113549.1.1.11'
+const OID_RSA_PSS = '1.2.840.113549.1.1.10'
+const OID_MGF1 = '1.2.840.113549.1.1.8'
+const OID_SHA256 = '2.16.840.1.101.3.4.2.1'
+const UTF8_STRING = 0x0c
+const PRINTABLE_STRING = 0x13
+const TELETEX_STRING = 0x14
+const IA5_STRING = 0x16
+
+/** How far `notBefore` may lie ahead of this clock, so a freshly renewed partner intermediate passes a clock running slightly behind; `notAfter` is strict. */
+const CLOCK_SKEW_MS = 5 * 60 * 1000
+
+export type FederatedCertificateReason = 'malformed' | 'untrusted_root' | 'bad_chain' | 'name_mismatch' | 'not_valid_now'
+
+export class FederatedCertificateError extends Error {
+	constructor(readonly reason: FederatedCertificateReason) {
+		super(reason)
+		this.name = 'FederatedCertificateError'
+	}
+}
+
+interface Element {
+	tag: number
+	/** Where the header starts. */
+	offset: number
+	start: number
+	end: number
+}
+
+type Algorithm = { import: RsaHashedImportParams; verify: AlgorithmIdentifier | RsaPssParams }
+
+interface Parsed {
+	der: Uint8Array<ArrayBuffer>
+	tbs: Uint8Array<ArrayBuffer>
+	/** `null` for a signature algorithm Keepiq does not use. */
+	algorithm: Algorithm | null
+	signature: Uint8Array<ArrayBuffer>
+	issuer: Uint8Array
+	subject: Uint8Array
+	notBefore: number
+	notAfter: number
+	spki: Uint8Array<ArrayBuffer>
+	/** A CA whose key usage, if it has one, includes keyCertSign. */
+	mayIssue: boolean
+	pathLen: number | null
+}
+
+const malformed = () => new FederatedCertificateError('malformed')
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
+
+function pemToDer(pem: unknown): Uint8Array<ArrayBuffer> {
+	const { label, der } = decodePem(typeof pem === 'string' ? pem : '')
+	if (label !== 'CERTIFICATE') throw malformed()
+	return der
+}
+
+function byteAt(bytes: Uint8Array, offset: number): number {
+	const byte = bytes[offset]
+	if (byte === undefined) throw malformed()
+	return byte
+}
+
+/** One DER element whose length fits in `limit`, so a hostile certificate can't read out of bounds. */
+function tlv(bytes: Uint8Array, offset: number, limit = bytes.length): Element {
+	const tag = byteAt(bytes, offset)
+	let cursor = offset + 1
+	let length = byteAt(bytes, cursor++)
+	if (length & 0x80) {
+		const count = length & 0x7f
+		if (count === 0 || count > 4) throw malformed()
+		length = 0
+		for (let i = 0; i < count; i++) length = length * 256 + byteAt(bytes, cursor++)
+	}
+	if (cursor + length > limit) throw malformed()
+	return { tag, offset, start: cursor, end: cursor + length }
+}
+
+function children(bytes: Uint8Array, parent: Element | undefined): Element[] {
+	if (!parent) throw malformed()
+	const out: Element[] = []
+	for (let cursor = parent.start; cursor < parent.end;) {
+		const child = tlv(bytes, cursor, parent.end)
+		out.push(child)
+		cursor = child.end
+	}
+	return out
+}
+
+/** The one element that fills `parent`, with `tag` when given. */
+function only(bytes: Uint8Array, parent: Element | undefined, tag?: number): Element {
+	const [child, extra] = children(bytes, parent)
+	if (!child || extra || (tag !== undefined && child.tag !== tag)) throw malformed()
+	return child
+}
+
+function uint(bytes: Uint8Array, element: Element): number {
+	const length = element.end - element.start
+	if (element.tag !== 0x02 || length < 1 || length > 4 || byteAt(bytes, element.start) & 0x80) throw malformed()
+	let value = 0
+	for (let i = element.start; i < element.end; i++) value = value * 256 + byteAt(bytes, i)
+	return value
+}
+
+function boolean(bytes: Uint8Array, element: Element): boolean {
+	if (element.tag !== 0x01 || element.end - element.start !== 1) throw malformed()
+	return byteAt(bytes, element.start) !== 0
+}
+
+function oid(bytes: Uint8Array, element: Element | undefined): string {
+	if (element?.tag !== 0x06) throw malformed()
+	const parts: number[] = []
+	let value = 0
+	for (let i = element.start; i < element.end; i++) {
+		const byte = byteAt(bytes, i)
+		value = value * 128 + (byte & 0x7f)
+		if ((byte & 0x80) === 0) {
+			if (parts.length === 0) parts.push(Math.floor(value / 40), value % 40)
+			else parts.push(value)
+			value = 0
+		}
+	}
+	return parts.join('.')
+}
+
+/** The whole element, header included; a copy, since WebCrypto takes `ArrayBuffer`-backed views. */
+function whole(bytes: Uint8Array<ArrayBuffer>, element: Element): Uint8Array<ArrayBuffer> {
+	return bytes.slice(element.offset, element.end)
+}
+
+const equalBytes = (a: Uint8Array, b: Uint8Array) => a.length === b.length && a.every((byte, i) => byte === b[i])
+
+function time(bytes: Uint8Array, element: Element | undefined): number {
+	if (!element) throw malformed()
+	const text = new TextDecoder().decode(bytes.subarray(element.start, element.end))
+	const match = /^(\d{2}|\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text)
+	if (!match) throw malformed()
+	let year = Number(match[1])
+	if (match[1]!.length === 2) year += year < 50 ? 2000 : 1900
+	return Date.UTC(year, Number(match[2]) - 1, Number(match[3]), Number(match[4]), Number(match[5]), Number(match[6]))
+}
+
+/** RFC 5280 § 4.2: each extension at most once, and none critical that this doesn't read. § 4.2.1.3 and § 4.2.1.9: without basicConstraints a certificate is no CA. */
+function issuing(bytes: Uint8Array, extensions: Element | undefined): Pick<Parsed, 'mayIssue' | 'pathLen'> {
+	let ca = false
+	let keyCertSign = true
+	let pathLen: number | null = null
+	const seen = new Set<string>()
+	for (const extension of extensions ? children(bytes, only(bytes, extensions, 0x30)) : []) {
+		if (extension.tag !== 0x30) throw malformed()
+		const [extnId, ...rest] = children(bytes, extension)
+		const value = rest.pop()
+		const [critical, extra] = rest
+		if (value?.tag !== 0x04 || extra) throw malformed()
+		const id = oid(bytes, extnId)
+		if (seen.has(id)) throw malformed()
+		seen.add(id)
+		if (critical && boolean(bytes, critical) && id !== OID_BASIC_CONSTRAINTS && id !== OID_KEY_USAGE) throw malformed()
+		if (id === OID_BASIC_CONSTRAINTS) {
+			const fields = children(bytes, only(bytes, value, 0x30))
+			let next = 0
+			if (fields[next]?.tag === 0x01) ca = boolean(bytes, fields[next++]!)
+			if (fields[next]?.tag === 0x02) pathLen = uint(bytes, fields[next++]!)
+			if (next !== fields.length) throw malformed()
+		} else if (id === OID_KEY_USAGE) {
+			const bits = only(bytes, value, 0x03)
+			const length = bits.end - bits.start
+			const unused = length > 0 ? byteAt(bytes, bits.start) : 0
+			if (length === 0 || unused > 7 || (length === 1 && unused !== 0)) throw malformed()
+			// After the unused-bits count, keyCertSign is bit 5 of the first byte; when that byte is also the last, its unused bits are padding.
+			const first = length > 1 ? byteAt(bytes, bits.start + 1) : 0
+			const mask = length === 2 ? (0xff << unused) & 0xff : 0xff
+			keyCertSign = (first & mask & 0x04) !== 0
+		}
+	}
+	return { mayIssue: ca && keyCertSign, pathLen: ca ? pathLen : null }
+}
+
+/** Only SHA-256, and for PSS only with MGF1-SHA-256: the PSS default is SHA-1. Parameters that don't decode are malformed. */
+function algorithmOf(bytes: Uint8Array, algorithm: Element): Algorithm | null {
+	const [id, params, extra] = children(bytes, algorithm)
+	if (extra) throw malformed()
+	const name = oid(bytes, id)
+	if (name === OID_SHA256_RSA) {
+		const pkcs1 = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }
+		return { import: pkcs1, verify: pkcs1 }
+	}
+	if (name !== OID_RSA_PSS || !params) return null
+	if (params.tag !== 0x30) throw malformed()
+	const algorithmId = (element: Element) => oid(bytes, children(bytes, element.tag === 0x30 ? element : undefined)[0])
+	let hash: string | null = null
+	let mask: string | null = null
+	let maskHash: string | null = null
+	let saltLength = 20
+	// RSASSA-PSS-params: [0] hash, [1] mask generation, [2] salt length, [3] trailer field.
+	for (const field of children(bytes, params)) {
+		const inner = only(bytes, field)
+		if (field.tag === 0xa0) hash = algorithmId(inner)
+		else if (field.tag === 0xa1) {
+			if (inner.tag !== 0x30) throw malformed()
+			const [maskId, maskParams] = children(bytes, inner)
+			mask = oid(bytes, maskId)
+			maskHash = maskParams ? algorithmId(maskParams) : null
+		} else if (field.tag === 0xa2) saltLength = uint(bytes, inner)
+		else if (field.tag !== 0xa3 || uint(bytes, inner) !== 1) throw malformed()
+	}
+	if (hash !== OID_SHA256 || mask !== OID_MGF1 || maskHash !== OID_SHA256) return null
+	return { import: { name: 'RSA-PSS', hash: 'SHA-256' }, verify: { name: 'RSA-PSS', saltLength } }
+}
+
+const ASCII_STRINGS = new Set([PRINTABLE_STRING, TELETEX_STRING, IA5_STRING])
+
+/** The other string types OpenSSL's `string_mask` may write a cloud id in, only as printable ASCII: any other byte reads differently per decoder. */
+function textOf(bytes: Uint8Array, value: Element): string {
+	const text = bytes.subarray(value.start, value.end)
+	if (value.tag === UTF8_STRING || (ASCII_STRINGS.has(value.tag) && text.every((byte) => byte >= 0x20 && byte <= 0x7e))) return utf8.decode(text)
+	throw malformed()
+}
+
+/** The leaf's one common name, which must be text this decodes exactly; a second could name someone else to a reader that takes the other. A CA's is never read. */
+function commonNameOf(subject: Uint8Array): string | null {
+	let commonName: string | null = null
+	for (const rdn of children(subject, tlv(subject, 0))) {
+		for (const attribute of children(subject, rdn)) {
+			const [type, value] = children(subject, attribute)
+			if (!type || !value || oid(subject, type) !== OID_COMMON_NAME) continue
+			if (commonName !== null) throw malformed()
+			commonName = textOf(subject, value)
+		}
+	}
+	return commonName
+}
+
+function parse(pem: unknown): Parsed {
+	const der = pemToDer(pem)
+	const outer = tlv(der, 0)
+	if (outer.tag !== 0x30 || outer.end !== der.length) throw malformed()
+	const [tbs, algorithm, signature, extra] = children(der, outer)
+	// A BIT STRING value starts with its unused-bits count, which a signature never has.
+	if (tbs?.tag !== 0x30 || algorithm?.tag !== 0x30 || signature?.tag !== 0x03 || extra || signature.end === signature.start || byteAt(der, signature.start) !== 0) throw malformed()
+	const fields = children(der, tbs)
+	const [, signed, issuer, validity, subject, spki, ...optional] = fields.slice(fields[0]?.tag === 0xa0 ? 1 : 0)
+	if (!signed || !issuer || !validity || !subject || spki?.tag !== 0x30) throw malformed()
+	// RFC 5280 § 4.1.1.2: the algorithm the signature covers is the one it is checked with.
+	if (!equalBytes(der.subarray(signed.offset, signed.end), der.subarray(algorithm.offset, algorithm.end))) throw malformed()
+	// The unique IDs and the extensions, each at most once and in order, so no second extensions block goes unread.
+	if (!optional.every((field, i) => [0x81, 0x82, 0xa3].includes(field.tag) && field.tag > (optional[i - 1]?.tag ?? 0))) throw malformed()
+	const [notBefore, notAfter] = children(der, validity)
+	return {
+		der,
+		tbs: whole(der, tbs),
+		algorithm: algorithmOf(der, algorithm),
+		signature: der.slice(signature.start + 1, signature.end),
+		issuer: whole(der, issuer),
+		subject: whole(der, subject),
+		notBefore: time(der, notBefore),
+		notAfter: time(der, notAfter),
+		spki: whole(der, spki),
+		...issuing(der, optional.find((field) => field.tag === 0xa3)),
+	}
+}
+
+async function signedBy(cert: Parsed, issuer: Parsed): Promise<boolean> {
+	if (!cert.algorithm || !equalBytes(cert.issuer, issuer.subject)) return false
+	try {
+		const key = await crypto.subtle.importKey('spki', issuer.spki, cert.algorithm.import, false, ['verify'])
+		return await crypto.subtle.verify(cert.algorithm.verify, key, cert.signature, cert.tbs)
+	} catch {
+		return false
+	}
+}
+
+async function sha256Hex(der: Uint8Array<ArrayBuffer>): Promise<string> {
+	const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', der))
+	return Array.from(digest, (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+/** `user@host[:port][/path]`: an http instance names its users `bob@http://host`, which is their certificate's common name, while the share holds `bob@host`. Only the host's case is folded. */
+export function canonicalCloudId(cloudId: unknown): string {
+	const text = String(cloudId ?? '')
+	const at = text.lastIndexOf('@')
+	if (at <= 0) return ''
+	const remote = text.slice(at + 1).replace(/^https?:\/\//i, '').replace(/\/+$/, '')
+	const host = remote.split('/', 1)[0]!
+	return remote === '' ? '' : `${text.slice(0, at)}@${host.toLowerCase()}${remote.slice(host.length)}`
+}
+
+export interface FederatedCertificateInput {
+	certificate: unknown
+	/** The partner's intermediate, then its root. */
+	chain: unknown
+	/** The owner server's pin, hex SHA-256. */
+	partnerRootFingerprint: unknown
+	/** The share's own `recipientCloudId`, never the lookup's echo of it. */
+	cloudId: string
+	now?: number
+}
+
+export interface VerifiedFederatedCertificate {
+	/** The leaf's SHA-256 as lowercase hex, the `certFingerprint` Keepiq takes. */
+	fingerprint: string
+	/** The leaf's SubjectPublicKeyInfo, for `importSpki`: a second parse of the PEM might not find the key that was checked. */
+	spki: Uint8Array<ArrayBuffer>
+}
+
+/** Rejects with a `FederatedCertificateError`. */
+export async function verifyFederatedCertificate({ certificate, chain, partnerRootFingerprint, cloudId, now = Date.now() }: FederatedCertificateInput): Promise<VerifiedFederatedCertificate> {
+	if (!Array.isArray(chain) || chain.length === 0) throw new FederatedCertificateError('untrusted_root')
+	// Keepiq's `FederationRootService::localChain` serves exactly these two.
+	if (chain.length !== 2) throw new FederatedCertificateError('bad_chain')
+	let certs: Parsed[]
+	let commonName: string | null
+	try {
+		certs = [certificate, ...chain].map(parse)
+		commonName = commonNameOf(certs[0]!.subject)
+	} catch (error) {
+		throw error instanceof FederatedCertificateError ? error : malformed()
+	}
+	const pinned = typeof partnerRootFingerprint === 'string' ? partnerRootFingerprint.toLowerCase() : ''
+	if (pinned === '' || await sha256Hex(certs[certs.length - 1]!.der) !== pinned) throw new FederatedCertificateError('untrusted_root')
+	// The first link must be the partner's intermediate, not its root again.
+	if (equalBytes(certs[1]!.issuer, certs[1]!.subject)) throw new FederatedCertificateError('bad_chain')
+	for (let i = 1; i < certs.length; i++) {
+		const issuer = certs[i]!
+		// pathLen counts the CAs below this one, not the leaf.
+		const mayIssue = issuer.mayIssue && (issuer.pathLen === null || i - 1 <= issuer.pathLen)
+		if (!mayIssue || !await signedBy(certs[i - 1]!, issuer)) throw new FederatedCertificateError('bad_chain')
+	}
+	const leaf = certs[0]!
+	const expected = canonicalCloudId(cloudId)
+	// Two names without `user@remote` both canonicalise to ''.
+	if (expected === '' || commonName === null || canonicalCloudId(commonName) !== expected) throw new FederatedCertificateError('name_mismatch')
+	if (certs.some((cert) => now + CLOCK_SKEW_MS < cert.notBefore || now > cert.notAfter)) throw new FederatedCertificateError('not_valid_now')
+	return { fingerprint: await sha256Hex(leaf.der), spki: leaf.spki }
+}
diff --git a/browser-extension/src/crypto/index.ts b/browser-extension/src/crypto/index.ts
index 685050494..a48b2640c 100644
--- a/browser-extension/src/crypto/index.ts
+++ b/browser-extension/src/crypto/index.ts
@@ -1,4 +1,5 @@
 export { fromBase64, toBase64 } from './base64'
 export { decodeEnvelope, encodeEnvelope } from './envelope'
+export { canonicalCloudId, FederatedCertificateError, verifyFederatedCertificate, type FederatedCertificateReason, type VerifiedFederatedCertificate } from './federated-certificate'
 export { decryptPrivateKeyPem, deriveUnlockKey, InvalidMasterPassword } from './kdf'
-export { importPrivateKey, importPublicKey, pemToPkcs8, rsaDecrypt, rsaEncrypt } from './rsa'
+export { importPrivateKey, importPublicKey, importSpki, pemToPkcs8, rsaDecrypt, rsaEncrypt } from './rsa'
diff --git a/browser-extension/src/crypto/rsa.ts b/browser-extension/src/crypto/rsa.ts
index 9d5eea673..ab8c1c362 100644
--- a/browser-extension/src/crypto/rsa.ts
+++ b/browser-extension/src/crypto/rsa.ts
@@ -4,12 +4,15 @@ const RSA_BLOCK_SIZE = 512
 const RSA_CHUNK_SIZE = 446
 const RSA_OAEP = { name: 'RSA-OAEP', hash: 'SHA-256' }
 
-function pemBody(pem: string): Uint8Array<ArrayBuffer> {
-	return fromBase64(pem.replace(/-----(BEGIN|END) [A-Z ]+-----/g, '').replace(/\s/g, ''))
+/** Exactly one block and nothing around it, so no second key rides along with the one a caller checked. */
+export function decodePem(pem: string): { label: string; der: Uint8Array<ArrayBuffer> } {
+	const match = /^\s*-----BEGIN ([A-Z ]+)-----([A-Za-z0-9+/=\s]+)-----END \1-----\s*$/.exec(pem)
+	if (!match) throw new Error('Malformed PEM: expected exactly one block')
+	return { label: match[1]!, der: fromBase64(match[2]!.replace(/\s/g, '')) }
 }
 
 export function pemToPkcs8(pem: string): Uint8Array<ArrayBuffer> {
-	return pemBody(pem)
+	return single(decodePem(pem).der)
 }
 
 export function importPrivateKey(pkcs8: Uint8Array<ArrayBuffer>): Promise<CryptoKey> {
@@ -39,10 +42,19 @@ function readDerLength(der: Uint8Array, offset: number): { length: number; conte
 	return { length, contentStart }
 }
 
+const SEQUENCE = 0x30
+
+/** One SEQUENCE and nothing after it: trailing bytes would be a second, unchecked value. */
+function single(der: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer> {
+	if (der[0] !== SEQUENCE) throw new Error('Malformed DER: not a SEQUENCE')
+	const { length, contentStart } = readDerLength(der, 1)
+	if (contentStart + length !== der.length) throw new Error('Malformed DER: bytes after the end')
+	return der
+}
+
 /** The SubjectPublicKeyInfo of an X.509 certificate: the TBS field after `subject`. */
 export function extractSpki(certDer: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer> {
-	const SEQUENCE = 0x30
-	if (certDer[0] !== SEQUENCE) throw new Error('Not a DER SEQUENCE (certificate expected)')
+	single(certDer)
 	const outer = readDerLength(certDer, 1)
 	if (certDer[outer.contentStart] !== SEQUENCE) throw new Error('Malformed certificate: tbsCertificate not a SEQUENCE')
 	const tbs = readDerLength(certDer, outer.contentStart + 1)
@@ -50,6 +62,7 @@ export function extractSpki(certDer: Uint8Array<ArrayBuffer>): Uint8Array<ArrayB
 	const fields: { tag: number; start: number; end: number }[] = []
 	for (let pos = tbs.contentStart; pos < tbsEnd;) {
 		const { length, contentStart } = readDerLength(certDer, pos + 1)
+		if (contentStart + length > tbsEnd) throw new Error('Malformed certificate: field past the tbsCertificate')
 		fields.push({ tag: byteAt(certDer, pos), start: pos, end: contentStart + length })
 		pos = contentStart + length
 	}
@@ -59,11 +72,17 @@ export function extractSpki(certDer: Uint8Array<ArrayBuffer>): Uint8Array<ArrayB
 	return certDer.slice(spki.start, spki.end)
 }
 
-/** Accepts an X.509 certificate PEM (the suite's `certificate`) or an SPKI PEM. */
-export function importPublicKey(pem: string): Promise<CryptoKey> {
-	const der = pemBody(pem)
-	const spki = pem.includes('BEGIN CERTIFICATE') ? extractSpki(der) : der
-	return crypto.subtle.importKey('spki', spki, RSA_OAEP, false, ['encrypt'])
+/** Async, so a key that isn't one DER SEQUENCE rejects like any other that doesn't import. */
+export async function importSpki(spki: Uint8Array<ArrayBuffer>): Promise<CryptoKey> {
+	return crypto.subtle.importKey('spki', single(spki), RSA_OAEP, false, ['encrypt'])
+}
+
+/** Accepts an X.509 certificate PEM (the suite's `certificate`) or an SPKI PEM; async, so a malformed one rejects too. */
+export async function importPublicKey(pem: string): Promise<CryptoKey> {
+	const { label, der } = decodePem(pem)
+	if (label === 'CERTIFICATE') return importSpki(extractSpki(der))
+	if (label === 'PUBLIC KEY') return importSpki(der)
+	throw new Error('Malformed PEM: expected a certificate or a public key')
 }
 
 /** `[uint32 BE chunk count][512-byte block] * count`, base64; 446-byte UTF-8 chunks (ADR-003). */
diff --git a/browser-extension/src/messages.ts b/browser-extension/src/messages.ts
index 405c5106d..aa9952145 100644
--- a/browser-extension/src/messages.ts
+++ b/browser-extension/src/messages.ts
@@ -167,8 +167,13 @@ export type ItemPatch = Partial<ItemDraft>
 export interface EditableItem extends ItemDraft {
 	id: string
 	updatedAt: string
-	/** A passkey's credential is never decrypted for editing, so `key` is empty. */
-	keyWithheld?: true
+	/**
+	 * The type name the fetch vouched for the fields under; the edit form renders by it, not the popup's snapshot. Absent for a type the vault does not know.
+	 * `passkey` when either the server or the cache says so, and `key` is then empty: a passkey's credential is never decrypted for editing.
+	 */
+	typeName?: string
+	/** An edit fetch's record of what its form showed, for that form's save to name; absent for a clone. */
+	recordId?: string
 }
 
 export interface FolderChildren {
@@ -183,7 +188,7 @@ export type FolderDeletePlan =
 	| { mode: 'cascade'; cascade: 'delete' | 'move' }
 	| { mode: 'resolution'; directSecrets: 'delete' | 'move'; subfolders: Record<string, SubfolderAction> }
 
-/** `conflict` is a duplicate folder name, a folder that is not empty, or an item changed since `baseUpdatedAt`. */
+/** `conflict` is a duplicate folder name, a folder that is not empty, an item changed since `baseUpdatedAt`, or a fetched item whose ciphertext the cache does not hold. */
 export type WriteErrorCode =
 	| 'locked' | 'session_revoked' | 'write_locked' | 'forbidden' | 'policy' | 'invalid' | 'conflict'
 	| 'not_found' | 'blocked' | 'unreadable' | 'offline' | 'server_error' | 'unknown'
@@ -193,15 +198,43 @@ export type WriteErrorCode =
 	| 'key_mismatch'
 	/** The write was meant for an account that is no longer the active one. */
 	| 'account_changed'
+	/** A shared item's source was written after its copy's edit form opened. */
+	| 'stale_source'
+	/** The share list kept changing over three share-save answers. */
+	| 'incomplete'
+	/** A recipient's certificate did not import. */
+	| 'bad_certificate'
+	/** Partner shares get the whole value, and the edit form did not show every field of it in full. */
+	| 'unverified'
+	/** `partners` names the partner shares whose instance did not answer. */
+	| 'partner_unreachable'
+	/** The partner lookup's limit of 60 per minute. */
+	| 'partner_lookup_limit'
+	/** The server runs a Nextcloud without the OCM endpoint event partner sharing needs (below 33). */
+	| 'federation_unavailable'
 
 export interface VaultWriteError {
 	code: WriteErrorCode
 	/** With `blocked`, when the row's reason is a known code. */
 	reason?: BlockReason
+	/** With `partner_unreachable`. */
+	partners?: Array<{ shareId: string; cloudId: string }>
 }
 
 export type WriteResult<T> = { ok: true; value: T } | { ok: false; error: VaultWriteError }
 
+/** Shown on the item's detail after a save; absent when the save reached everyone. */
+export interface ShareSaveNote {
+	/** `source`: the editor owns the item; `copy`: a team editor or delegate; `own_copy`: only the editor's copy changed. */
+	scope: 'source' | 'copy' | 'own_copy'
+	/** Copy-editor path: partner shares exist that only the owner's next save reaches. */
+	ownerOnly?: true
+	/** Partner shares this save suspended on a verdict about the recipient, by cloud id. */
+	suspended?: string[]
+	/** Partner shares the user suspended through Save without them, by cloud id. */
+	paused?: string[]
+}
+
 /** Popup → background requests with their own reply shapes, listed in `PopupReplies`. */
 export type PopupRequest =
 	| { kind: 'vault.sync' }
@@ -223,8 +256,11 @@ export type VaultWrite = { accountId: string } & (
 	/** `purpose`: a clone is refused for more restricted copies than an edit. */
 	| { kind: 'item.fetch'; id: string; purpose: 'edit' | 'clone' }
 	| { kind: 'item.create'; draft: ItemDraft }
-	/** `baseUpdatedAt`: the fetched version, so a save over a newer one is refused. */
-	| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string }
+	/**
+	 * `baseUpdatedAt`: the fetched version, so a save over a newer one is refused. `recordId`: the fetch's, without which a save that needs it for partners fails with `unverified`.
+	 * `withoutUnreachable`: partner share ids the user chose to suspend after a `partner_unreachable` failure.
+	 */
+	| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string; recordId?: string; withoutUnreachable?: string[] }
 	| { kind: 'item.delete'; id: string }
 	| { kind: 'folder.create'; name: string; parentId: string | null }
 	| { kind: 'folder.rename'; id: string; name: string }
@@ -244,7 +280,7 @@ export interface PopupReplies {
 	'settings.set': GlobalSettings
 	'item.fetch': WriteResult<EditableItem>
 	'item.create': WriteResult<{ id: string }>
-	'item.update': WriteResult<{ id: string }>
+	'item.update': WriteResult<{ id: string; shareSave?: ShareSaveNote }>
 	'item.delete': WriteResult<null>
 	'folder.create': WriteResult<{ id: string }>
 	'folder.rename': WriteResult<null>
diff --git a/browser-extension/src/testing/ca-constraints-chain.json b/browser-extension/src/testing/ca-constraints-chain.json
new file mode 100644
index 000000000..440a4b1e3
--- /dev/null
+++ b/browser-extension/src/testing/ca-constraints-chain.json
@@ -0,0 +1,27 @@
+{
+ "_note": "TEST ONLY: throwaway keys and certificates generated by generate-ca-constraints-chain.sh; they protect nothing.",
+ "root": "-----BEGIN CERTIFICATE-----\nMIIDWTCCAkGgAwIBAgITNRo9LZlh1YChQHNA1iKPrZNbIjANBgkqhkiG9w0BAQsF\nADBMMQswCQYDVQQGEwJOTDETMBEGA1UECgwKQ29uZHVjdGlvbjEPMA0GA1UECwwG\nS2VlcGlxMRcwFQYDVQQDDA5LZWVwaXEgUm9vdCBDQTAgFw0yNjEwMTIxNTQyMDda\nGA8yMTI2MDkxODE1NDIwN1owTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1\nY3Rpb24xDzANBgNVBAsMBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0Ew\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCaohHq/4zwGhOH8NFk8Jg+\ncwhijUIWnP/HuAv2aHKzAZiGbFnbWWuXhpkMYLhYmQqypJZRWJBXZMUmbg/uvQiW\nDDBPR+wPLD77PE3OoheSuR1zV927x3hVUEq2j/4cUhOcTzGLsAAbDU3xI2ZS2xUJ\nAtUE/HR/A6dm/MoOVmaK2C2tZkTWquuikl4zcP5g8gdze8VSL8qbZAEujQ8USgEV\nq0Il+PLBDR54dL7yGN2ZNLkPaBW05U+h0cfU7kmVU5zwYhfmbNNGTTktmRjG4N3W\nyHaPWElQifohPWDbdTK/4BEejEQG1O1qjZSF2dC6vMA5ga28s7XBnod2C33aQaFb\nAgMBAAGjMjAwMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFL3tBILn/Qr3kvvV\nUVZIHNggWFqGMA0GCSqGSIb3DQEBCwUAA4IBAQBCnu+38LN4lwMo7+VMg0TxUlem\n8K3UjHsp+c86Gt9A64sz07J4x3sXDi/VpSn1Q3Rhts9EHNW+PRNHGRj5TqmzaufT\nBeD1UqnE50Q8BXdjjXDhVwp8M1+jZv+Chm6rrlQLYd5yhA6m2HuXh0Q/465Owyb0\nwxp2oLD2EulJrIEcaTcwWQSknGraCAjJV7+eUU6KUaidibHMXLHk13f4lM/FZpUF\ngc6S43FCM78jL88a2+5uFNlrgfS8dwQRfkQWFhOjPPoBI+I8Cp1lFjSDLTx88kDn\n1lG00qPhzaaX6pJpw0txItnXskDNS1TMyHjrpB0gmJcO8dJevA8UhcGkdCEM\n-----END CERTIFICATE-----\n",
+ "rootPathLen0": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIUOsTLeDWVDc6mFS9vKcmh8ZS4KvIwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMEwxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExFzAVBgNVBAMMDktlZXBpcSBSb290IENB\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmqIR6v+M8BoTh/DRZPCY\nPnMIYo1CFpz/x7gL9mhyswGYhmxZ21lrl4aZDGC4WJkKsqSWUViQV2TFJm4P7r0I\nlgwwT0fsDyw++zxNzqIXkrkdc1fdu8d4VVBKto/+HFITnE8xi7AAGw1N8SNmUtsV\nCQLVBPx0fwOnZvzKDlZmitgtrWZE1qrropJeM3D+YPIHc3vFUi/Km2QBLo0PFEoB\nFatCJfjywQ0eeHS+8hjdmTS5D2gVtOVPodHH1O5JlVOc8GIX5mzTRk05LZkYxuDd\n1sh2j1hJUIn6IT1g23Uyv+ARHoxEBtTtao2UhdnQurzAOYGtvLO1wZ6Hdgt92kGh\nWwIDAQABozUwMzASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBS97QSC5/0K\n95L71VFWSBzYIFhahjANBgkqhkiG9w0BAQsFAAOCAQEAbqTjPMs5s8xEJXt+2KYQ\nRpZnvH6MNqofLAy5n1VTYgJdxi53CjK5oVbNvargW2e6+Rrv6W2OPjruIMuyyf7K\nVKNSJzjUFHYhLnAANa2VHanUGz4FmRhMqkKMsDWmfW8Er+V3DkuVgcWL6arZipEW\n6VCs2CgS+TU9wvzdBhcXqxb0cuc+cxvoRM8U7PULiCUMQIh5J4ni0ZFhsq+Xvt+C\nWg72Pc/r4qiHt9vKZAxmXPYNuMf39A2vYOVBtSHPGkT0GyAbdNVw313RoOxMIkbG\nAavBbkrJvk4llQiBPJGhNaJzleXXPMkRVbwQYZBqtenJLG2wh2XTStVu9iQWXTMl\nHQ==\n-----END CERTIFICATE-----\n",
+ "rootExpired": "-----BEGIN CERTIFICATE-----\nMIIDWDCCAkCgAwIBAgIURKrOwiwN3amDTYZRp/Dj0ky/qjowDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwHhcNMDAwMTAxMDAwMDAw\nWhcNMDEwMTAxMDAwMDAwWjBMMQswCQYDVQQGEwJOTDETMBEGA1UECgwKQ29uZHVj\ndGlvbjEPMA0GA1UECwwGS2VlcGlxMRcwFQYDVQQDDA5LZWVwaXEgUm9vdCBDQTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqiEer/jPAaE4fw0WTwmD5z\nCGKNQhac/8e4C/ZocrMBmIZsWdtZa5eGmQxguFiZCrKkllFYkFdkxSZuD+69CJYM\nME9H7A8sPvs8Tc6iF5K5HXNX3bvHeFVQSraP/hxSE5xPMYuwABsNTfEjZlLbFQkC\n1QT8dH8Dp2b8yg5WZorYLa1mRNaq66KSXjNw/mDyB3N7xVIvyptkAS6NDxRKARWr\nQiX48sENHnh0vvIY3Zk0uQ9oFbTlT6HRx9TuSZVTnPBiF+Zs00ZNOS2ZGMbg3dbI\ndo9YSVCJ+iE9YNt1Mr/gER6MRAbU7WqNlIXZ0Lq8wDmBrbyztcGeh3YLfdpBoVsC\nAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUve0Eguf9CveS+9VR\nVkgc2CBYWoYwDQYJKoZIhvcNAQELBQADggEBAClfSyXaOJ+bPd0d2x1OOGT+bscF\nZlqB97XQWRitnjOp7mnzIwL8dkQoGf4x9UxILhsHkm4N0AzFuTRn86MExyUOUZBQ\n29I4e9WFKdUoo8nBhKH3lHCKenR9ZoZQDgDk1uHGw/R48uRk6jjxVYdhJj8IKzG4\nrZmj3PS22r6mJ6yewVWxtx5P8EaFGvaN6R6GyFJtNT0N3fYf+tdcslMwEV8yOStu\nvqaTQd1vie7ibgtYw6SUEd5vtOBHKlTtvz6ujs3DJbBsg+YrDvjE+lA54teUKoho\nEL51ZX70NFlilASfcTkKO13qgJ664I7DEM+hYmbGXHiBFo84m8kWpcvLjfo=\n-----END CERTIFICATE-----\n",
+ "intermediate": "-----BEGIN CERTIFICATE-----\nMIIDgzCCAmugAwIBAgIUROm7zDquThdfLDPTNpILreI8Gu4wDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjUzBRMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFCHX\nID2+KRJsolSwjrcM61/VY1XaMB8GA1UdIwQYMBaAFL3tBILn/Qr3kvvVUVZIHNgg\nWFqGMA0GCSqGSIb3DQEBCwUAA4IBAQAetsGmLaW2FplmTGaU9CtnT7diIpkFLLNT\ndczsiCnBREk0E05FLxUYBSuyFeuIRWm0s4MVNl0w1qhNrjRU6/DqgWS1ikTDQnpi\nApInUqEbfCUImycE9Tz0R6GDCT6hZutah0jzohGZmDnUwv+lg5B/LE2H52KCE64b\n5uKA5Xfb1AX7yyeocJQD1VX/zVvF40xQsIRF3z6UgX/J8Sk0B0JEVRVHQxqhB9Ka\n3V5RlmILIGY0jatk4Ryulq4FdktguCTkhYH/z9FN02PTNjSJEH536W0cY/9gWxav\npt5lAaBH1iMvjjfczp57Fw1oPXhG8XlkNA2N7GWBZXFPes7ukaIn\n-----END CERTIFICATE-----\n",
+ "intermediateNoBasicConstraints": "-----BEGIN CERTIFICATE-----\nMIIDcjCCAlqgAwIBAgIUROm7zDquThdfLDPTNpILreI8Gu8wDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjQjBAMB0GA1UdDgQWBBQh1yA9vikSbKJUsI63DOtf1WNV\n2jAfBgNVHSMEGDAWgBS97QSC5/0K95L71VFWSBzYIFhahjANBgkqhkiG9w0BAQsF\nAAOCAQEAjPmmTsBZIqChNgavSnZ7MfgzbedhYT//EKjcmcwZw+K55tCltNO8xW4B\nDrfJ7N993EigvJbs4qzEvUo/ovovfBlE+b5tTzhO591OCUfJpIF+MWoqo0HS/SRb\n34Q05dSIbknNtbFfBzOcr0r5ZALhvIbpXfKyWhFrmzKiwZc1LwgD5oOyHVB/JZbX\niUKhzoS7it+zo+4DsdplhyF5AFjo+tfGQumVY6yrvB4UER7F3gSWfjanIiw5+cK4\nHg5nA/o5GlY3CGOg0zZHTX2BCgYKb13RaylTmSORgz2ZjMn2Q0IznzjX8QSsA9A4\nhEwL2GZAwEIAbo+d4tgeh4gNcFvMFw==\n-----END CERTIFICATE-----\n",
+ "intermediateNotCa": "-----BEGIN CERTIFICATE-----\nMIIDgDCCAmigAwIBAgIUROm7zDquThdfLDPTNpILreI8GvAwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjUDBOMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCHXID2+\nKRJsolSwjrcM61/VY1XaMB8GA1UdIwQYMBaAFL3tBILn/Qr3kvvVUVZIHNggWFqG\nMA0GCSqGSIb3DQEBCwUAA4IBAQCM9KLixH3plTbaZnG2EOPufwXTw5NsEoxxexVz\n2LTQSAOoRcgq/dMhMOeqheBO/eCQ8/Q0AWt8bwFtHWp5y6g2NAMWHH6L+KmJOb4p\nleTZDwUpBmr2P4Tt2lRX5vg6m8RJx5mjjwTTXOq67jwL+W3497Jy6R8F/um3uIWj\nuNon1BvDH0giyjKxfMILiKzPQaguJYAI2wmx19TAZjjPaZIAO/INhuC6K0tIyRZT\n0bhzcBQ8jTLGqcpXFJoNLrOpXQ058vKWUi9gY3KSDn+Y3AsKR5MaL6dUosL1a/Qq\n6R+3ERSiAZh8ixk5fAYmaWW/nXQUNaBN5u6E81FIgwVgZSSz\n-----END CERTIFICATE-----\n",
+ "intermediateNoCertSign": "-----BEGIN CERTIFICATE-----\nMIIDkzCCAnugAwIBAgIUROm7zDquThdfLDPTNpILreI8GvEwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD\nAgeAMB0GA1UdDgQWBBQh1yA9vikSbKJUsI63DOtf1WNV2jAfBgNVHSMEGDAWgBS9\n7QSC5/0K95L71VFWSBzYIFhahjANBgkqhkiG9w0BAQsFAAOCAQEAck+5UJ5QZQ5L\ntURbqRpbCHlnbQiNHjviFntLgHhOCDF3WPZ+TmxDpkkB8nXACjcQWq8RbTTbz13I\nEq2vzztOvMxiAlN4/G36TktUFP34ncDqqj3f6tnWs/YlRf1o8mOhJYxWIsKxGW/I\nypYRyyKN//7BnjHYAtu9qhreyxPSfz8pgXBwhQO0q+5MKY1x4P7Qj+F0OI9J9rBG\nCITIzYBCOIXoBLMgacKgebxKwQlVcc7UxfRGsbk/hibwWjcstayhFmB7pCF25e5o\nVK/GmukxIRpplZSrc86KRiuQ38Zn+nqHy7KMVyFS0VbVsRjsyGkKUQArSdOTodki\nma+fQ1i/+g==\n-----END CERTIFICATE-----\n",
+ "intermediatePathLen0": "-----BEGIN CERTIFICATE-----\nMIIDhjCCAm6gAwIBAgIUROm7zDquThdfLDPTNpILreI8GvIwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjVjBUMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYE\nFCHXID2+KRJsolSwjrcM61/VY1XaMB8GA1UdIwQYMBaAFL3tBILn/Qr3kvvVUVZI\nHNggWFqGMA0GCSqGSIb3DQEBCwUAA4IBAQAKhFgK70AtbhYIHxQ8aO3P3CvXMeZ/\nNIZx9yE7MOtJ64kMGzIQAkLgs95ZVn8/S+KCTsB9L/HD962+I0iW3VSnawlMc0ut\n+3LU3DvKTrDUt/rOtZbcTXKUvSCLcnOTcXPujAA/NNdQA6lTazOAdUTpQtH8Ozt9\nhxp+oJ70Dzpb04YVXQmrh5hVyhBK0cJmkrF4tbhBx1eJuAWjdNYoW3HyQwSXQlEp\nexWiSXKDcAfTAhB0ZY7yZYSBo7pgz+k5PviLs5iBBFOHhWCGCo/tLgwafhn45Vzb\nRFOvWCNo4FhU6YdUfsryzkJsli7ChshjgyiZcyy6I5FPDEinp6QrFOpV\n-----END CERTIFICATE-----\n",
+ "intermediateUnknownCritical": "-----BEGIN CERTIFICATE-----\nMIIDlzCCAn+gAwIBAgIUROm7zDquThdfLDPTNpILreI8GvMwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjZzBlMA8GA1UdEwEB/wQFMAMBAf8wEgYJKwYBBAGGjR8B\nAQH/BAIFADAdBgNVHQ4EFgQUIdcgPb4pEmyiVLCOtwzrX9VjVdowHwYDVR0jBBgw\nFoAUve0Eguf9CveS+9VRVkgc2CBYWoYwDQYJKoZIhvcNAQELBQADggEBABuWibDU\nESyNGLi4VQHY0MHadHq54o0I7uNiIxeGcunQquYMZpuKV8+UX15PUCZwu0qTI2Z3\nHRnAY7Z2JaXWL3nXOwskWIKHS3TkcN9bgtoJ9vVtBszwsVNQ38K8xGixNRG2OXeG\nHXwuq2eoZrQnDgxLjthmRD9TU61BXycWCeCGcil6sKqL84r7O22YM1t6icZNkLl5\nDJl0/9J85I1ryHRdwLVXykcjDhZKcGgQ4htTbyy5B2Zh7ctS1J3zGSBTRXlb92za\nTsqblsCVsF8ARCbScrMMf8hn91ZJP/aCLmZWtBH+VKMfBa88lul57BzKCra8CuhI\nsd6kHXfdOfwAko0=\n-----END CERTIFICATE-----\n",
+ "intermediateDuplicateBasicConstraints": "-----BEGIN CERTIFICATE-----\nMIIDkTCCAnmgAwIBAgIUROm7zDquThdfLDPTNpILreI8GvQwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA3\nWhgPMjEyNjA5MTgxNTQyMDdaMFQxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMQ8wDQYDVQQLDAZLZWVwaXExHzAdBgNVBAMMFktlZXBpcSBJbnRlcm1l\nZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDt41dcizyu\nil4xre5ypk9fBpypioFuu5KYZC0UYSJdhnz/4Oe5IqOay9W8MzhhJET0iMTWsMn3\nz9rQDe1l3wGCDkEwz7xkUPnZeGVBeUsTTraCsLXdw0Bz+1TAP7JzsSjcRRKjiBZl\nI8MvsoyIEi8IeVh5dpz7q5/svTU89eVG/17BLM256ngjns0kwtzA8AM8Kf32kF97\nt6BFp50VtntEsGgu8DARdUu/cL/L2a2HNSUzrgFTTh0qbGYH50kZHM+0/OISYbz0\nBpU14pCbuXqtOYbAM8S4h2d9VHFCxzswt4JL2Rc7PCgeWpGPf6XwC6F/p8y7Gung\nTEPtKYwDgfcZAgMBAAGjYTBfMAwGA1UdEwEB/wQCMAAwDwYDVR0TAQH/BAUwAwEB\n/zAdBgNVHQ4EFgQUIdcgPb4pEmyiVLCOtwzrX9VjVdowHwYDVR0jBBgwFoAUve0E\nguf9CveS+9VRVkgc2CBYWoYwDQYJKoZIhvcNAQELBQADggEBAFW+XSu9u69BBNMq\n2qwat9igct8VbQu+bZ4N42s1vV70G3K4tm8GcDATvjUx19apxuivtbZFeNH94Ipr\n1HFKlplBQRHsDAZRdZBYjd0rwwh/sLyX0tkupGzeK0WOXcfEdpoLQEZycKzFYiiE\nGJeqe2svFPRXZ/x/1rZ1qrOp3QZUGxzWy7h3Sg3OpUT+wCkvWjB0O6t+VJaTyk7m\ntT3j87xorcE/4X5wRAiRXiaK2foWOhS7+TU4Vsm4TbCWkHgRbICn0+HWBdc7tdsm\nEk5BvVtRtlygPi51T0S63vYawOaziWyAtvzZwO+/DIteRTLqyGtb2KwpVtjsMEe1\nBpy6xn4=\n-----END CERTIFICATE-----\n",
+ "intermediateExpired": "-----BEGIN CERTIFICATE-----\nMIIDgTCCAmmgAwIBAgIUROm7zDquThdfLDPTNpILreI8GvUwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwHhcNMDAwMTAxMDAwMDAw\nWhcNMDEwMTAxMDAwMDAwWjBUMQswCQYDVQQGEwJOTDETMBEGA1UECgwKQ29uZHVj\ndGlvbjEPMA0GA1UECwwGS2VlcGlxMR8wHQYDVQQDDBZLZWVwaXEgSW50ZXJtZWRp\nYXRlIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7eNXXIs8rope\nMa3ucqZPXwacqYqBbruSmGQtFGEiXYZ8/+DnuSKjmsvVvDM4YSRE9IjE1rDJ98/a\n0A3tZd8Bgg5BMM+8ZFD52XhlQXlLE062grC13cNAc/tUwD+yc7Eo3EUSo4gWZSPD\nL7KMiBIvCHlYeXac+6uf7L01PPXlRv9ewSzNuep4I57NJMLcwPADPCn99pBfe7eg\nRaedFbZ7RLBoLvAwEXVLv3C/y9mthzUlM64BU04dKmxmB+dJGRzPtPziEmG89AaV\nNeKQm7l6rTmGwDPEuIdnfVRxQsc7MLeCS9kXOzwoHlqRj3+l8Auhf6fMuxrp4ExD\n7SmMA4H3GQIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQh1yA9\nvikSbKJUsI63DOtf1WNV2jAfBgNVHSMEGDAWgBS97QSC5/0K95L71VFWSBzYIFha\nhjANBgkqhkiG9w0BAQsFAAOCAQEAEEWmzbUyUGtYjrRKhjsoYOQLDUqb4DNWRwmJ\n+a7HNmJFlsVbEdUN9oHOLAyMkhrz12iBccUxahUeHC5ScQmZJf2cFbmLmh84GxHz\nxIqNQhJFAn7cMrelY7ww8dF7r7XKClQyQa9jKq5V17Xz8SR1phmc9AhCjPHHSoJA\nxKiepYEZrdQ+QeJ1u8ZmyC/JBj/0ZIBsRyNPdF5P2SiZVYCFJtn8kounEtjkPhl6\nGAWOAfJe9U5ph2+EyfVZw/cKTgFSVdDefdoVzG9lZtFb6RlTnN/Bz9HJZiqQ4OKO\nSDHZmxhG8Wgo6DaMAEIz6+pvDGBNPnBhNTPtTdvsRHJEwc1Tbw==\n-----END CERTIFICATE-----\n",
+ "intermediateNotYetValid": "-----BEGIN CERTIFICATE-----\nMIIDhTCCAm2gAwIBAgIUROm7zDquThdfLDPTNpILreI8GvYwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIhgPMjIwMDAxMDEwMDAw\nMDBaGA8yMjAxMDEwMTAwMDAwMFowVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNv\nbmR1Y3Rpb24xDzANBgNVBAsMBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVy\nbWVkaWF0ZSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO3jV1yL\nPK6KXjGt7nKmT18GnKmKgW67kphkLRRhIl2GfP/g57kio5rL1bwzOGEkRPSIxNaw\nyffP2tAN7WXfAYIOQTDPvGRQ+dl4ZUF5SxNOtoKwtd3DQHP7VMA/snOxKNxFEqOI\nFmUjwy+yjIgSLwh5WHl2nPurn+y9NTz15Ub/XsEszbnqeCOezSTC3MDwAzwp/faQ\nX3u3oEWnnRW2e0SwaC7wMBF1S79wv8vZrYc1JTOuAVNOHSpsZgfnSRkcz7T84hJh\nvPQGlTXikJu5eq05hsAzxLiHZ31UcULHOzC3gkvZFzs8KB5akY9/pfALoX+nzLsa\n6eBMQ+0pjAOB9xkCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU\nIdcgPb4pEmyiVLCOtwzrX9VjVdowHwYDVR0jBBgwFoAUve0Eguf9CveS+9VRVkgc\n2CBYWoYwDQYJKoZIhvcNAQELBQADggEBAAFbjOEqSfcuKl7lximlVTYOyarzVVaz\nc8if9rd3scyv0u5KE8hPT9u8cKcY0ypyYeL2RGHOxOVqI2KrIMxbZ+XnAUP8H48z\n55XlZFIVJDdtbLolhFPSkm/VhBaxWZvHWK2PludjvR23riH6/08/Mqv+6bvP+Bbb\nTvaSjRgGROwvzVbXZ9EgW6siqkZJCcKgb49flATlqMcdveoBg3p2zT583VitUCwC\nsbGttazRYwzSIUfZiB9sqrRq0pFLM1HJnEcacMfA1idUAgfOTlaMzkoj0m9gyuRh\n/ExcIyskZhcbGMx/AhxHM4L7kaEVxEtD+zu9NgKoCFq610wQs1FbUWI=\n-----END CERTIFICATE-----\n",
+ "subIntermediate": "-----BEGIN CERTIFICATE-----\nMIIDgjCCAmqgAwIBAgIUQMQqYAjQdQQV5vA79WGT4uTs6ogwDQYJKoZIhvcNAQEL\nBQAwVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVybWVkaWF0ZSBDQTAgFw0yNjEw\nMTIxNTQyMDdaGA8yMTI2MDkxODE1NDIwN1owSzELMAkGA1UEBhMCTkwxEzARBgNV\nBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsMBktlZXBpcTEWMBQGA1UEAwwNS2VlcGlx\nIFN1YiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJZtfVlBzCuL\nXVpMfjgvmTNHQIIGHDC/lud2jF+qIvmffZlBCp+7H8JWnbbTR0sj2Lhn3aDrguKE\ntS3t+K6SVyh/7cGy4eYcwH5h524JaVt56Lj+Bx9Ilo1wTCf3XNAaUZCuoaRt41mt\nEptb+qLHFNgs3l30FNUlr3tqtLvMQL6CIFpbo6neJkd3MfW2AKh0uuDdSU0ewXUE\nYKa6r4A9guYAVdocddn/ZQarnGo3tm4+ZiDsyK2DuVMHtNEFqeQHC9hFqpbzN00I\nbcYrt3hJWt8kAkiUwtfTyI0ITR/hdo4NyLxaAJnLxEzIqt7expXOnhwFtEzv8j2s\nf7qwAMdEEJUCAwEAAaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7gOn\ngzknPB/0oKVsMIuyBdjZKxYwHwYDVR0jBBgwFoAUIdcgPb4pEmyiVLCOtwzrX9Vj\nVdowDQYJKoZIhvcNAQELBQADggEBABchTkbYQjKlq0uti34NEhIb9WxfjtmIJcA/\nGQyMChfc9NPNExOnMmw1ZkaqVZ6SmGJMYdMPKKxhm4SG0YmtuDeY7NzRrBpyQa/n\n5xWlfaI1wKk5z37/w2j0nsiArERiTbGnalZ23kcYtWKH/M2cxVo+8s5PiwNnNtF4\nc47JQYR/ZQ9woxejk7Gkvcj1SQesL9hPpxj8znJqWENXwyuuhxxQvABdtsTF82Td\nA9UXbyFkUHUYuJtjI1d9+82N9gep+3HuDIP2ZV7IoHnWm2uOsYgT/8nCI+hBrb4n\nQqGmNwFZ0wkpw5tNBFRmEanvcE2mxOYS8+azEo0iIynO+bjIf/k=\n-----END CERTIFICATE-----\n",
+ "mallory": "-----BEGIN CERTIFICATE-----\nMIIEcDCCA1igAwIBAgIUQMQqYAjQdQQV5vA79WGT4uTs6okwDQYJKoZIhvcNAQEL\nBQAwVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVybWVkaWF0ZSBDQTAgFw0yNjEw\nMTIxNTQyMDdaGA8yMTI2MDkxODE1NDIwN1owSjELMAkGA1UEBhMCTkwxEzARBgNV\nBAoMCkNvbmR1Y3Rpb24xJjAkBgNVBAMMHW1hbGxvcnlAY2xvdWQucGFydG5lci5l\neGFtcGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9EQAKRheEpvz\nodNbbrZtVgoVxPmqWj3ImVkOAtuNB58CFM89UmURzpeGm4NAXFcuF4twkDn/93kp\n1whgNZ3bsrdsSjE0Rx8mxMnUoAQVERnCpb09XmT4SZ5shvG2jSLiICaQnF99DfmJ\n9IFgb8qbJEofxCTP+IOHMmrWIutiqzVOHg9gZIizpbWpax4e0zA9zwQ6ONncHMtL\nv6epv4Bznuu022QcDLg8mRrmjswNFXWmchaFzRxbl7hCjO/4xW0RCaVfA/Gs3QNy\njnAybe/SUWTyTPbVBJ9Yk0+tF47JyiJEcl1vgSGu9VU1vrYQXVf+Nv9DVSekpDa9\nMewKfSsRvDhosE+AF/HTTWWSUAb05CUVkhq5u3MIdDHDAefTvahsLQdfjWdua7ZB\nD4DDQc1YH65/X7ah1LRSDGdb9zCbhP5mRWXjvohkz/ZUkM15nvdm0wHld5xw+aGa\nTvlhPxCAoy1nG5DU0JrK441e/0rMAYyIB9g6JaPVN49PZgpiNTxYCELyRSYEYbYC\nTx1uNiPeWpHIUhI9pF9NJ2kdFV8MIRhN536dudp1Fl76EsY58cvBsFdsKAp7xErZ\n8Px6oLYZtKbLkazKiOGvtuhx+dSDi8oMN3UVL0RQ8OEnNpESlFU/R9lDveObOc8N\n30J1mXbjbDfklS4egnw6x0H5pRlPorUCAwEAAaNCMEAwHQYDVR0OBBYEFKMNW/U3\nvXpeuVox573YRUNz62A7MB8GA1UdIwQYMBaAFCHXID2+KRJsolSwjrcM61/VY1Xa\nMA0GCSqGSIb3DQEBCwUAA4IBAQA05F3rqh+23DkqMwAQYpvbtGXexvhOL3OHx4kh\nQZXQMJvKxB1Ln3NJDN/m/eQsB/9isWClhMRnKdgagHmOHrcmGfGdvxP8eJnAf/xe\nO2N/efLA1eg8lfEfS8zjQCYasAwSgoYd0BvaqAjogM7HhrK2OAUl5RqDrkhgZJ18\ns3DnujWpn5w9iJphqNxc2BA94EXo0/Y/APREBBci2cuIElyt3eEwIc5TA0pdIUvu\nLjqVk0YRV3GZsg+O5HTW4oW0oEd5Gpl8uIyfb9JiuESwVik/mIQNyLKDDccBXNjU\njf79gfoZJm5h2OcrDn7hTeHH0133gJ1rU4ZzqW4ZN30EmyLe\n-----END CERTIFICATE-----\n",
+ "malloryUnknownCritical": "-----BEGIN CERTIFICATE-----\nMIIEhDCCA2ygAwIBAgIUQMQqYAjQdQQV5vA79WGT4uTs6oowDQYJKoZIhvcNAQEL\nBQAwVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVybWVkaWF0ZSBDQTAgFw0yNjEw\nMTIxNTQyMDdaGA8yMTI2MDkxODE1NDIwN1owSjELMAkGA1UEBhMCTkwxEzARBgNV\nBAoMCkNvbmR1Y3Rpb24xJjAkBgNVBAMMHW1hbGxvcnlAY2xvdWQucGFydG5lci5l\neGFtcGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9EQAKRheEpvz\nodNbbrZtVgoVxPmqWj3ImVkOAtuNB58CFM89UmURzpeGm4NAXFcuF4twkDn/93kp\n1whgNZ3bsrdsSjE0Rx8mxMnUoAQVERnCpb09XmT4SZ5shvG2jSLiICaQnF99DfmJ\n9IFgb8qbJEofxCTP+IOHMmrWIutiqzVOHg9gZIizpbWpax4e0zA9zwQ6ONncHMtL\nv6epv4Bznuu022QcDLg8mRrmjswNFXWmchaFzRxbl7hCjO/4xW0RCaVfA/Gs3QNy\njnAybe/SUWTyTPbVBJ9Yk0+tF47JyiJEcl1vgSGu9VU1vrYQXVf+Nv9DVSekpDa9\nMewKfSsRvDhosE+AF/HTTWWSUAb05CUVkhq5u3MIdDHDAefTvahsLQdfjWdua7ZB\nD4DDQc1YH65/X7ah1LRSDGdb9zCbhP5mRWXjvohkz/ZUkM15nvdm0wHld5xw+aGa\nTvlhPxCAoy1nG5DU0JrK441e/0rMAYyIB9g6JaPVN49PZgpiNTxYCELyRSYEYbYC\nTx1uNiPeWpHIUhI9pF9NJ2kdFV8MIRhN536dudp1Fl76EsY58cvBsFdsKAp7xErZ\n8Px6oLYZtKbLkazKiOGvtuhx+dSDi8oMN3UVL0RQ8OEnNpESlFU/R9lDveObOc8N\n30J1mXbjbDfklS4egnw6x0H5pRlPorUCAwEAAaNWMFQwEgYJKwYBBAGGjR8BAQH/\nBAIFADAdBgNVHQ4EFgQUow1b9Te9el65WjHnvdhFQ3PrYDswHwYDVR0jBBgwFoAU\nIdcgPb4pEmyiVLCOtwzrX9VjVdowDQYJKoZIhvcNAQELBQADggEBAHWLv84ipxv4\napqfZRdjduTUeFl0j9i2L6TbWc2XnseHlqDqQDmKYEMags6g569aCiPDKDBU4wE2\nimjr4/K+9m5olMrDU1UExh3fJJNMl4g8fh3IK92vYL2kJqu85XizUxKo+X7fx73c\nCzy6iyZOW36Mn8W4dPsXsALeUGAzvl5TeowC8obQQmvfX77mAiYDxCFcHxVFgnjl\nnssjzM6KLt9+wc2TC+atEP1i2ak6GaGJvCwOO28NuMNlFo59vCbNNQnLlXTxcuzN\n9kotILZ9SGcJzhe7Cv1XrSedA5+oJignluVTg507LIqpegh9YecMWzwiaw1P6uQg\nYGNU/4f1nZc=\n-----END CERTIFICATE-----\n",
+ "malloryUnknownNonCritical": "-----BEGIN CERTIFICATE-----\nMIIEgTCCA2mgAwIBAgIUQMQqYAjQdQQV5vA79WGT4uTs6oswDQYJKoZIhvcNAQEL\nBQAwVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVybWVkaWF0ZSBDQTAgFw0yNjEw\nMTIxNTQyMDdaGA8yMTI2MDkxODE1NDIwN1owSjELMAkGA1UEBhMCTkwxEzARBgNV\nBAoMCkNvbmR1Y3Rpb24xJjAkBgNVBAMMHW1hbGxvcnlAY2xvdWQucGFydG5lci5l\neGFtcGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9EQAKRheEpvz\nodNbbrZtVgoVxPmqWj3ImVkOAtuNB58CFM89UmURzpeGm4NAXFcuF4twkDn/93kp\n1whgNZ3bsrdsSjE0Rx8mxMnUoAQVERnCpb09XmT4SZ5shvG2jSLiICaQnF99DfmJ\n9IFgb8qbJEofxCTP+IOHMmrWIutiqzVOHg9gZIizpbWpax4e0zA9zwQ6ONncHMtL\nv6epv4Bznuu022QcDLg8mRrmjswNFXWmchaFzRxbl7hCjO/4xW0RCaVfA/Gs3QNy\njnAybe/SUWTyTPbVBJ9Yk0+tF47JyiJEcl1vgSGu9VU1vrYQXVf+Nv9DVSekpDa9\nMewKfSsRvDhosE+AF/HTTWWSUAb05CUVkhq5u3MIdDHDAefTvahsLQdfjWdua7ZB\nD4DDQc1YH65/X7ah1LRSDGdb9zCbhP5mRWXjvohkz/ZUkM15nvdm0wHld5xw+aGa\nTvlhPxCAoy1nG5DU0JrK441e/0rMAYyIB9g6JaPVN49PZgpiNTxYCELyRSYEYbYC\nTx1uNiPeWpHIUhI9pF9NJ2kdFV8MIRhN536dudp1Fl76EsY58cvBsFdsKAp7xErZ\n8Px6oLYZtKbLkazKiOGvtuhx+dSDi8oMN3UVL0RQ8OEnNpESlFU/R9lDveObOc8N\n30J1mXbjbDfklS4egnw6x0H5pRlPorUCAwEAAaNTMFEwDwYJKwYBBAGGjR8BBAIF\nADAdBgNVHQ4EFgQUow1b9Te9el65WjHnvdhFQ3PrYDswHwYDVR0jBBgwFoAUIdcg\nPb4pEmyiVLCOtwzrX9VjVdowDQYJKoZIhvcNAQELBQADggEBAIE3Lepv0c/4dqKX\nDR+UC8yU2AniG5EN3HGWQoWjYdQvkDaQSbnae8fHAzf8uFAdecZIPK7HD5MvkeE5\nabOOmqOZJHV9q25WSfDkyqIsMGC/PWZ2XjPqCENVzacnowtQg67kyoCh0oAiz/2S\nZqbbrItci6xE2kNmWTez6DH4rm1J7Mfz7KCcDhZORmmmPmjb40n5VIhzBqx2KkrA\nG4Dsaka8TE7bAzVDYN8WTpQ9MmNNZLBAGRgWvrXQC4bqMigS79W0kc86fQwVLCUP\nbWSYXlLjo/B7CmYZV6d37eeGdudAC6I89Sr2oX3rPMSN9Uawdl22XzLPW8KOrvNh\nbSKSw8U=\n-----END CERTIFICATE-----\n",
+ "malloryDuplicateExtension": "-----BEGIN CERTIFICATE-----\nMIIEkjCCA3qgAwIBAgIUQMQqYAjQdQQV5vA79WGT4uTs6owwDQYJKoZIhvcNAQEL\nBQAwVDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEfMB0GA1UEAwwWS2VlcGlxIEludGVybWVkaWF0ZSBDQTAgFw0yNjEw\nMTIxNTQyMDdaGA8yMTI2MDkxODE1NDIwN1owSjELMAkGA1UEBhMCTkwxEzARBgNV\nBAoMCkNvbmR1Y3Rpb24xJjAkBgNVBAMMHW1hbGxvcnlAY2xvdWQucGFydG5lci5l\neGFtcGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9EQAKRheEpvz\nodNbbrZtVgoVxPmqWj3ImVkOAtuNB58CFM89UmURzpeGm4NAXFcuF4twkDn/93kp\n1whgNZ3bsrdsSjE0Rx8mxMnUoAQVERnCpb09XmT4SZ5shvG2jSLiICaQnF99DfmJ\n9IFgb8qbJEofxCTP+IOHMmrWIutiqzVOHg9gZIizpbWpax4e0zA9zwQ6ONncHMtL\nv6epv4Bznuu022QcDLg8mRrmjswNFXWmchaFzRxbl7hCjO/4xW0RCaVfA/Gs3QNy\njnAybe/SUWTyTPbVBJ9Yk0+tF47JyiJEcl1vgSGu9VU1vrYQXVf+Nv9DVSekpDa9\nMewKfSsRvDhosE+AF/HTTWWSUAb05CUVkhq5u3MIdDHDAefTvahsLQdfjWdua7ZB\nD4DDQc1YH65/X7ah1LRSDGdb9zCbhP5mRWXjvohkz/ZUkM15nvdm0wHld5xw+aGa\nTvlhPxCAoy1nG5DU0JrK441e/0rMAYyIB9g6JaPVN49PZgpiNTxYCELyRSYEYbYC\nTx1uNiPeWpHIUhI9pF9NJ2kdFV8MIRhN536dudp1Fl76EsY58cvBsFdsKAp7xErZ\n8Px6oLYZtKbLkazKiOGvtuhx+dSDi8oMN3UVL0RQ8OEnNpESlFU/R9lDveObOc8N\n30J1mXbjbDfklS4egnw6x0H5pRlPorUCAwEAAaNkMGIwDwYJKwYBBAGGjR8BBAIF\nADAPBgkrBgEEAYaNHwEEAgUAMB0GA1UdDgQWBBSjDVv1N716XrlaMee92EVDc+tg\nOzAfBgNVHSMEGDAWgBQh1yA9vikSbKJUsI63DOtf1WNV2jANBgkqhkiG9w0BAQsF\nAAOCAQEAWvdpdUVa1hggxDDTvFEV+wc0rx+DUbESKnli/Iu2Ss+whN9/2WLKuArN\nu7uTWJQCrrT4+UJtAz1skY9B/DxGcUfNwxjb2TBDSFNKUkUt4b4l8w1bRdoDtj8K\nxLAzqKnUti1K29laQ0dg2f0WiowM6bT/XxhsM2f1g8OKcnn2v+B5k/lLgnEluHsn\ncyDusiEe206SfV9RSucKaPE8j8vlI35jE1Vx4suxFFyUK4O7rpLjKoUzNt/aqA+M\nDVtev5LP200YMTLutVgdz55Vpaiwwoz44nXz6ukYkpJnlPBRGeXwalLFIuMBFuXZ\n7WP4WkwdaPZme4bj5CnydUvrBw2+og==\n-----END CERTIFICATE-----\n",
+ "malloryByRoot": "-----BEGIN CERTIFICATE-----\nMIIEaDCCA1CgAwIBAgIUROm7zDquThdfLDPTNpILreI8GvcwDQYJKoZIhvcNAQEL\nBQAwTDELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEXMBUGA1UEAwwOS2VlcGlxIFJvb3QgQ0EwIBcNMjYxMDEyMTU0MjA4\nWhgPMjEyNjA5MTgxNTQyMDhaMEoxCzAJBgNVBAYTAk5MMRMwEQYDVQQKDApDb25k\ndWN0aW9uMSYwJAYDVQQDDB1tYWxsb3J5QGNsb3VkLnBhcnRuZXIuZXhhbXBsZTCC\nAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPREACkYXhKb86HTW262bVYK\nFcT5qlo9yJlZDgLbjQefAhTPPVJlEc6XhpuDQFxXLheLcJA5//d5KdcIYDWd27K3\nbEoxNEcfJsTJ1KAEFREZwqW9PV5k+EmebIbxto0i4iAmkJxffQ35ifSBYG/KmyRK\nH8Qkz/iDhzJq1iLrYqs1Th4PYGSIs6W1qWseHtMwPc8EOjjZ3BzLS7+nqb+Ac57r\ntNtkHAy4PJka5o7MDRV1pnIWhc0cW5e4Qozv+MVtEQmlXwPxrN0Dco5wMm3v0lFk\n8kz21QSfWJNPrReOycoiRHJdb4EhrvVVNb62EF1X/jb/Q1UnpKQ2vTHsCn0rEbw4\naLBPgBfx001lklAG9OQlFZIaubtzCHQxwwHn072obC0HX41nbmu2QQ+Aw0HNWB+u\nf1+2odS0UgxnW/cwm4T+ZkVl476IZM/2VJDNeZ73ZtMB5XeccPmhmk75YT8QgKMt\nZxuQ1NCayuONXv9KzAGMiAfYOiWj1TePT2YKYjU8WAhC8kUmBGG2Ak8dbjYj3lqR\nyFISPaRfTSdpHRVfDCEYTed+nbnadRZe+hLGOfHLwbBXbCgKe8RK2fD8eqC2GbSm\ny5Gsyojhr7bocfnUg4vKDDd1FS9EUPDhJzaREpRVP0fZQ73jmznPDd9CdZl242w3\n5JUuHoJ8OsdB+aUZT6K1AgMBAAGjQjBAMB0GA1UdDgQWBBSjDVv1N716XrlaMee9\n2EVDc+tgOzAfBgNVHSMEGDAWgBS97QSC5/0K95L71VFWSBzYIFhahjANBgkqhkiG\n9w0BAQsFAAOCAQEAV32KCI1pICpPUB0uPMY46x7ryVgfEoRLoRMvhsnRX31MB2wF\nRXynhMgdJzb590otY2fyMhS6vF43ZwOrJW/3rLc/+4XVgu+gYnf6mn+oixe1jlFb\nmBBCA1A789hQyGoPTXMQZFoyWc6NCN/S4jcEHajZ/teoZWCsWcHxQ33/py3mjhOs\nKAJfz5Z7kmB2XSXGMCkleAaZADyk3qsIp4A3iCKl4tGgMOr5WF3qqYG90eKazt8N\nRG+5SAynqAgZyXuocKCoMclEtTZUkSwOSHwXEG9hlnd9137ciY0idR1vvM/MmMQ6\nzSVC8cxTEmyAY1KXYAwyPlyWW0gjNAybVkfmww==\n-----END CERTIFICATE-----\n",
+ "malloryBySubIntermediate": "-----BEGIN CERTIFICATE-----\nMIIEZzCCA0+gAwIBAgIUF+oFD2PVpC8XMWSoofzpl+spcwUwDQYJKoZIhvcNAQEL\nBQAwSzELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xDzANBgNVBAsM\nBktlZXBpcTEWMBQGA1UEAwwNS2VlcGlxIFN1YiBDQTAgFw0yNjEwMTIxNTQyMDha\nGA8yMTI2MDkxODE1NDIwOFowSjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1\nY3Rpb24xJjAkBgNVBAMMHW1hbGxvcnlAY2xvdWQucGFydG5lci5leGFtcGxlMIIC\nIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9EQAKRheEpvzodNbbrZtVgoV\nxPmqWj3ImVkOAtuNB58CFM89UmURzpeGm4NAXFcuF4twkDn/93kp1whgNZ3bsrds\nSjE0Rx8mxMnUoAQVERnCpb09XmT4SZ5shvG2jSLiICaQnF99DfmJ9IFgb8qbJEof\nxCTP+IOHMmrWIutiqzVOHg9gZIizpbWpax4e0zA9zwQ6ONncHMtLv6epv4Bznuu0\n22QcDLg8mRrmjswNFXWmchaFzRxbl7hCjO/4xW0RCaVfA/Gs3QNyjnAybe/SUWTy\nTPbVBJ9Yk0+tF47JyiJEcl1vgSGu9VU1vrYQXVf+Nv9DVSekpDa9MewKfSsRvDho\nsE+AF/HTTWWSUAb05CUVkhq5u3MIdDHDAefTvahsLQdfjWdua7ZBD4DDQc1YH65/\nX7ah1LRSDGdb9zCbhP5mRWXjvohkz/ZUkM15nvdm0wHld5xw+aGaTvlhPxCAoy1n\nG5DU0JrK441e/0rMAYyIB9g6JaPVN49PZgpiNTxYCELyRSYEYbYCTx1uNiPeWpHI\nUhI9pF9NJ2kdFV8MIRhN536dudp1Fl76EsY58cvBsFdsKAp7xErZ8Px6oLYZtKbL\nkazKiOGvtuhx+dSDi8oMN3UVL0RQ8OEnNpESlFU/R9lDveObOc8N30J1mXbjbDfk\nlS4egnw6x0H5pRlPorUCAwEAAaNCMEAwHQYDVR0OBBYEFKMNW/U3vXpeuVox573Y\nRUNz62A7MB8GA1UdIwQYMBaAFO4Dp4M5Jzwf9KClbDCLsgXY2SsWMA0GCSqGSIb3\nDQEBCwUAA4IBAQCSVH1Idgl/8urtqM4z/AU8fRpfbAjQT/Rr9Htq0LBMJpPFk6mO\nmE1AWEqXN3IP++cls9clQQE9frNNmdOYLkuWp+i1dMbWTKFh+EUj5AJ+WILJHnOo\n014pzC9QuawvnqrMhMz34Z5xmqgwfbaPVq8NInpdieIZkRRfTuAxteRj5cvT0hL1\nQ22KU8vcv2SSK6hRAj3Td9opmE1+L+g0dqhAyxj3WFn/JmN1P2NEU4RahAgPjVDX\nbnTIQNk6CKMpkBrX6iXo3Z5SqZBiEoBYVAqsGq051GFLLElErvMoYLJ2bapDaGCZ\nKBGjXnbMSyhWh8rwu4QGVe5RZgtQTQYXCkiT\n-----END CERTIFICATE-----\n",
+ "forgedAlice": "-----BEGIN CERTIFICATE-----\nMIIFZDCCA0ygAwIBAgIUUHTXxQ58OYMR0c8nQaj7oLSdELMwDQYJKoZIhvcNAQEL\nBQAwSjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCkNvbmR1Y3Rpb24xJjAkBgNVBAMM\nHW1hbGxvcnlAY2xvdWQucGFydG5lci5leGFtcGxlMCAXDTI2MTAxMjE1NDIwOFoY\nDzIxMjYwOTE4MTU0MjA4WjBIMQswCQYDVQQGEwJOTDETMBEGA1UECgwKQ29uZHVj\ndGlvbjEkMCIGA1UEAwwbYWxpY2VAY2xvdWQucGFydG5lci5leGFtcGxlMIICIjAN\nBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAv7kVTBrd5URY5eWn3ewfBN7XJ7YE\nzOEPYLsj7fFD7Nk1S4A9uy351ditu6KaaOHklTrSgOakJu8kwneQlCEAq4/+cUYG\nmO04ZckiZDOOCwBtg3ScziwkvOVLVtf9pGfYcBhHXFgE3CLYXNR8+qrFNKC+KqqE\nlJaKaT3JCMabU2aJsqGF6T4AAMFWOVCsAT6rJHSwgJ0zUeR0D1XocDXKqZuiSVYz\nQOXoqgh4Q1WkkLEwETadK+F6ilRs/GUMQwxceiGl/cYhN2vX0DU1ja5V/GihRVuh\ncHdTD5QG5dJmixKOIyQN9Bf4K6c2cTK7wF3+4QWaRTAbWUQQI6cKS6BOGDGvAExD\nHgoUaJNMAvk8FyZVmdRJ/6MbxvTMsF0IQG02jVjOvuE51XXcAqzYi0CmWrXmp9C8\nZdIZgOu2P/aQWX+cwpJBaEyxPshjk45KU2ewZ3RFvqaIVZFVqsPF/jJfGbu2Mv7I\novDtgQYdz2fH3fF4Ajj5CLBSX/scmalTFmXDcQnPBxCRAdGgkamCxqj+P2Uk2sn9\nZMn1VDwQQ2TFE+k/r9w071gjtpcioC33ipvkK8lvqajC/h0llsfizNZmpRgEL6zh\nTaCXBUuD6byQQNZzcqtxpZjyomesejKg/uU1B0+nhxg4kzeBjzHIgslmeXjdb+uL\nqGKtk08O3oVwHUMCAwEAAaNCMEAwHQYDVR0OBBYEFBjwWVmapVooWHA5mUe8tGne\ntjnnMB8GA1UdIwQYMBaAFKMNW/U3vXpeuVox573YRUNz62A7MA0GCSqGSIb3DQEB\nCwUAA4ICAQBw2PeNIImPcFhHfmGbKYd+RxDsa5HPcwYQb6znJ61gCFCTXGHeF9jR\nulOx1Xe+Do7LrV6xVjGQa3GahgkKCuvPHDSg9a/DeF207Qp7Z7tHibY1YbGfEmjz\ngs+6ZuMLa4/kSaOVJZwNGee6CCbaI84vDc87EM8GRLhNZy5PH0zstSYNygdh3uD3\nmA6y9gdEWJp3Gvfd3RvnYbhh5jdQQdHqPihjrxGTmDcvB9IVartqtgQqOiy3TUxx\n13E15gMwmUEVPDGbrcrNpjtq1gZWRXisy+E3eCJDTl463ecSJR/LPcorKiDRWWKE\n8yEKj6iUTehEBpxE7PwbgMC2APfye0N40OYzx9Ni0oV0pPNHvGVJXEvEplb7dYTb\n0hU60Sloota5NmqvKpfNRXcCOYOuBZxSrEeaJZJmvqvwT2cZwdDtgJqLQEpEIO+U\nLhXiCvcEfpXl2Xv0DTk4mugZbQIoVmliJFX+eBoGgqla/5rzypoIAEKG9bobmlni\nZle88qA5+o9wg/KBS4TuYTYrm4ysIi0phlj79qK+nfDMvJgtSxwHrfk2iVc3UR7k\nWM34niW34tcSrvD5DdC9JqJiCSi8yyxPMGOuEsBldoGgMK8rLHZUOo6S5hutubMe\nnuc0lcB7AjIlmJKKJi18BSrJx1RHSlhPp/h5EwOFvv9IICzMBIoxgg==\n-----END CERTIFICATE-----\n",
+ "rootFingerprint": "00f47154d2f2bf3c24d0fff4e4747fc56c1f9ac1fc0e10b7979942f08b01efe7",
+ "rootPathLen0Fingerprint": "b3054cac74a04ff881cf19b49c09f604da8ff7e40cea720aacd9a1de7082dcc0",
+ "rootExpiredFingerprint": "dcd463df969870b96067c66fcdbd40ec8af3c4766cafdfcc4366f212030052e2",
+ "malloryKey": "-----BEGIN PRIVATE KEY-----\nMIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQD0RAApGF4Sm/Oh\n01tutm1WChXE+apaPciZWQ4C240HnwIUzz1SZRHOl4abg0BcVy4Xi3CQOf/3eSnX\nCGA1nduyt2xKMTRHHybEydSgBBURGcKlvT1eZPhJnmyG8baNIuIgJpCcX30N+Yn0\ngWBvypskSh/EJM/4g4cyatYi62KrNU4eD2BkiLOltalrHh7TMD3PBDo42dwcy0u/\np6m/gHOe67TbZBwMuDyZGuaOzA0VdaZyFoXNHFuXuEKM7/jFbREJpV8D8azdA3KO\ncDJt79JRZPJM9tUEn1iTT60XjsnKIkRyXW+BIa71VTW+thBdV/42/0NVJ6SkNr0x\n7Ap9KxG8OGiwT4AX8dNNZZJQBvTkJRWSGrm7cwh0McMB59O9qGwtB1+NZ25rtkEP\ngMNBzVgfrn9ftqHUtFIMZ1v3MJuE/mZFZeO+iGTP9lSQzXme92bTAeV3nHD5oZpO\n+WE/EICjLWcbkNTQmsrjjV7/SswBjIgH2Dolo9U3j09mCmI1PFgIQvJFJgRhtgJP\nHW42I95akchSEj2kX00naR0VXwwhGE3nfp252nUWXvoSxjnxy8GwV2woCnvEStnw\n/Hqgthm0psuRrMqI4a+26HH51IOLygw3dRUvRFDw4Sc2kRKUVT9H2UO945s5zw3f\nQnWZduNsN+SVLh6CfDrHQfmlGU+itQIDAQABAoICADn2bvFRgnU5A4mpjV9Ks8xA\nbWUF96odUh4tdzkvXxppXYWRndQQ/rY+16bMcPfYiiv1HztiP/66BjcsGiRu9qTE\niNJcNbMQzdLRr/5eqZ8atUk+DDN7kz1o9gjZj7+TAQSvEg7BS/wGdHmMP9WXRtRI\nMJyLPbyTfX/1wSWdJJdK+WQBsxZ4J+URJAgyqA7mOiyHLMezztsYVLvAbfPu58DU\n3uBWs59DEsIkE4TcH9ixR9N3y71d1tA8XbJy+V3j4TCgSNk3PpVdjZAGSLk0uPwu\nj566zdagd1TRidn2vKSWGBbpXB3Q3+MAmtXL/zsfN8hWL2SkGRoMkT2o7N5B252P\nOSOVs3NKGHcfyFWW7dkBcCVX6WpQIHEvjFCu+pY0YlqHgLczP3CJmimwuOviwaVT\nHXyrKRB0E0MYQXnWfv9Ru0cHxuE4hs7wg/6Rf8CwEEv1Pv5kZYVDMnS9HOHNnRZa\n43pr40PIuDpEVv1Zck81dw2ObKJFEHuuEWgIRhSPruIK2L/CiSWU1J12t5Kf2c5m\n+q+2O4PIaBsYbdWyqRffNrgV2p9krhrNYbYKc0ROfdyJO0ySMyzh3HyTdhDzLbYT\n2a2GfrjB10YwYBxRDd4MxOusaA0QjN7B8KUby4hZgTCPCWKO/+Z2BKYJXMeXAQ31\nv9elOHGbBVjdutZO3DErAoIBAQD7DUZSY4PCULx9ebJUnwRaDgTRUJh/2J3rbTSQ\nQadZL+SxRmhJhAjzcQEWh7bkU/KSTEfdBzCkMSQkPKlzsPkzPow/rkZIXtHUx9jt\na1FH4TxSnUjW2WxtmrKcNmnhBRP7qlgAJ5xzrv6kkpCK0aZbe8zCv3piLq/g5xWz\nkcNLQyX8YwBj/LBJJ5i8Lbig768ipwTejs1JMQuWaqhGNxG41o2bzsfQ2zOgGw+f\nx53ztMMQYUtHe2ujrhMCmz5ROtgVzZWydJ4x8IXxE2dJbzGofWWEqd4zF5+NY1uE\nEMs+rJOfJwsgw+48TsQHXc8IXiTGapq3049JmKjWkF9ty8p7AoIBAQD5FHwfpat6\nTnyW0YmiT6+ObrYJPWDaPECEWoXSDkTpjV99340jI8g4aO/jngvKxrEAy11wNLW1\nFcSwUWtA9ty9KU61btzQhXqVF/S3f3Kzwsq39TszuG5AhaQO+1ORdoGW3NmzIrHD\nEpf75diQqC2dFHHX3n8DWRmBCdC4CJsh0yZQr9X1pXty05zZ2QhjvTDO5J0EOI5p\nEawOu6R5LR61vTVhrFkBzGXejyajbMrQkOXRpoIqjmHnW00/fFRCAsSbEg+hRnJz\nf1p0clsdayr/75btgHhXtGDYYUaLgsIqYCIpNQbW+3QR1+vMCfSoqxM7F1W/eHoZ\njhho7jB7GhiPAoIBADKjS9LkdbglFs/sUxcUeAk+GKSrsAbhh4DsJxUN2RZ5PZSw\nUeq6MiAAZCrKNw65DA2MS1Z+08Xaj6KrhbZrNOisLhfOLCj+zy4vHUdORTfNa6By\nTzXe5yr4cBxoMVUM9CnoAxYM51bCLmS9l2AYx4heYT/K5YGWTy17DvqIZS7yHWBa\nC8MfPeOTlBAo3LvBfL7tl2LYxPmFZgPyAX0gMHfq9uc9fzpWbIRX0P/2gJqelFXi\neg+yClUakIUPETPLPbiwHgi/0wTZsfqdYlECl66XlHl81e/STQF00AnEZWp/3srU\nUj9KpewOKyYdOtxCOQK4j/qSNq2umCenOUhpOa8CggEAPNj+QZTtQSGvWgCySM6C\nqp7tJXCzGl0hvbOHgXsu5oc8zrkv92ekX/Nytv5DDzRexTzpBKI7yZMZy6D4PJSR\n9DwFGFmO4/nXqliB1dnyoWtyrmHgJpBljqmXHHnVPnHe0oX9QL+3AVqnekf6Ecyj\n5/24me2mxaCclGNbc7nWe/rjH071S98zOyfq52UXoZX0OHaszP0r/QruJ2M7mMam\n++rPAZ9i1weh0y7RV5caLL1ZB1BP+Cl0TVqGkn3C76VRdjiBTPqytvhjlpLhI1ys\n0n0rN7XssDBGgFWzMB2vZT662ao0k4w2HK3M0rmT5Sh1uDfJIM9DtL57xBZ8DXag\njQKCAQBX2iYc0o0nu15VlYrd0afW1PSI3ZCR1nA8zifHpxo0sTq5UZXGOmyR2tK6\nZZ8jvd3ghUMW6nr3MFgyCpiRpjsJFoLcA1cm2XRUUyZ+9rgXS3wRPHcGDldiJBEp\nRGSAJhR+G87wCoYKOvLlkEDWpqUltCPn53lcp7fq7NShd/dXaM8KHuLdwWUebftX\nE6e3bcmtHHvyO8q6BwnqnZdNCSUEyadKu1mVhyc7C5+ADFgvfOdJLDQnIUNgTEb1\nIoHBIVWEs8jrgXIT/FJUAkxEJSV0uBzaSfowqmOFvZGMXUPAUF46ZIiPBnTHtIaE\nhEIWAiDh98qZoM6BCMWwIXn9cJdu\n-----END PRIVATE KEY-----\n"
+}
diff --git a/browser-extension/src/testing/generate-ca-constraints-chain.sh b/browser-extension/src/testing/generate-ca-constraints-chain.sh
new file mode 100644
index 000000000..a23e1183e
--- /dev/null
+++ b/browser-extension/src/testing/generate-ca-constraints-chain.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Prints ca-constraints-chain.json: a partner CA with the fewest extensions a verifier must accept (CAs carry only basicConstraints CA:TRUE, leaves none), a leaf forged with another leaf's key, and re-issues of the same keys with bad constraints, extensions, validity or chain length, so only that tells them apart.
+# The profile Keepiq issues today (lib/Service/certificate-extensions.cnf) is built in federated-certificate.test.ts.
+# Needs OpenSSL 3.4 or later for -not_before and -not_after.
+# Usage: bash src/testing/generate-ca-constraints-chain.sh > src/testing/ca-constraints-chain.json
+set -euo pipefail
+W=$(mktemp -d)
+trap 'rm -rf "$W"' EXIT
+DAYS=36500
+ROOT_DN="/C=NL/O=Conduction/OU=Keepiq/CN=Keepiq Root CA"
+INT_DN="/C=NL/O=Conduction/OU=Keepiq/CN=Keepiq Intermediate CA"
+# A private-enterprise arc no verifier knows.
+UNKNOWN=1.3.6.1.4.1.99999.1
+EXPIRED=(-not_before 20000101000000Z -not_after 20010101000000Z)
+NOT_YET_VALID=(-not_before 22000101000000Z -not_after 22010101000000Z)
+
+openssl genrsa -out "$W/root.key" 2048 2>/dev/null
+root() { # name extension [openssl options]
+	openssl req -x509 -key "$W/root.key" -out "$W/$1.pem" -subj "$ROOT_DN" -days $DAYS -sha256 \
+		-config /dev/null -addext "$2" "${@:3}" 2>/dev/null
+}
+root root basicConstraints=critical,CA:true
+root rootPathLen0 basicConstraints=critical,CA:true,pathlen:0
+root rootExpired basicConstraints=critical,CA:true "${EXPIRED[@]}"
+
+csr() { # name subject bits
+	openssl req -newkey "rsa:$3" -nodes -keyout "$W/$1.key" -out "$W/$1.csr" -subj "$2" 2>/dev/null
+}
+issue() { # name csr issuer extensions [openssl options]
+	local ext=()
+	if [ -n "$4" ]; then
+		printf '%s\n' "$4" > "$W/$1.ext"
+		ext=(-extfile "$W/$1.ext")
+	fi
+	openssl x509 -req -in "$W/$2.csr" -CA "$W/$3.pem" -CAkey "$W/$3.key" -CAcreateserial \
+		-out "$W/$1.pem" -days $DAYS -sha256 "${ext[@]}" "${@:5}" 2>/dev/null
+	[ "$1" = "$2" ] || cp "$W/$2.key" "$W/$1.key"
+}
+# openssl drops a repeated extension, so this splices one in before the certificate's own and re-signs it.
+duplicate() { # name issuer extension-hex
+	python3 - "$W/$1.pem" "$W/$2.key" "$3" <<'PY'
+import base64, subprocess, sys, textwrap
+path, key, extension = sys.argv[1:4]
+der = base64.b64decode("".join(line for line in open(path).read().splitlines() if not line.startswith("-----")))
+def tlv(b, i):
+	n, s = b[i + 1], i + 2
+	if n & 0x80:
+		k = n & 0x7f
+		n, s = int.from_bytes(b[s:s + k], "big"), s + k
+	return b[i], s, s + n
+def enc(tag, body):
+	n = len(body)
+	size = (n.bit_length() + 7) // 8
+	return bytes([tag]) + (bytes([n]) if n < 128 else bytes([0x80 | size]) + n.to_bytes(size, "big")) + body
+_, cert_start, _ = tlv(der, 0)
+_, tbs_start, tbs_end = tlv(der, cert_start)
+i = tbs_start
+while der[i] != 0xa3:
+	i = tlv(der, i)[2]
+_, seq_start, _ = tlv(der, tlv(der, i)[1])
+tbs = enc(0x30, der[tbs_start:i] + enc(0xa3, enc(0x30, bytes.fromhex(extension) + der[seq_start:tbs_end])))
+algorithm = der[tbs_end:tlv(der, tbs_end)[2]]
+signature = subprocess.run(["openssl", "dgst", "-sha256", "-sign", key], input=tbs, capture_output=True, check=True).stdout
+body = base64.b64encode(enc(0x30, tbs + algorithm + enc(0x03, b"\0" + signature))).decode()
+open(path, "w").write("-----BEGIN CERTIFICATE-----\n" + "\n".join(textwrap.wrap(body, 64)) + "\n-----END CERTIFICATE-----\n")
+PY
+}
+CA='basicConstraints=critical,CA:true'
+csr int "$INT_DN" 2048
+issue intermediate int root "$CA"
+issue intermediateNoBasicConstraints int root 'subjectKeyIdentifier=hash'
+issue intermediateNotCa int root 'basicConstraints=critical,CA:false'
+issue intermediateNoCertSign int root "$CA"$'\nkeyUsage=critical,digitalSignature'
+issue intermediatePathLen0 int root 'basicConstraints=critical,CA:true,pathlen:0'
+issue intermediateUnknownCritical int root "$CA"$'\n'"$UNKNOWN=critical,ASN1:NULL"
+# A critical basicConstraints without cA in front of its CA:TRUE one, so a verifier that lets the last win accepts it.
+issue intermediateDuplicateBasicConstraints int root "$CA"
+duplicate intermediateDuplicateBasicConstraints root 300c0603551d130101ff04023000
+issue intermediateExpired int root "$CA" "${EXPIRED[@]}"
+issue intermediateNotYetValid int root "$CA" "${NOT_YET_VALID[@]}"
+csr subIntermediate "/C=NL/O=Conduction/OU=Keepiq/CN=Keepiq Sub CA" 2048
+issue subIntermediate subIntermediate intermediate "$CA"
+
+# 4096 bits, as Keepiq user keys are: rsaEncrypt writes 512-byte blocks.
+csr mallory /C=NL/O=Conduction/CN=mallory@cloud.partner.example 4096
+issue mallory mallory intermediate ''
+issue malloryUnknownCritical mallory intermediate "$UNKNOWN=critical,ASN1:NULL"
+issue malloryUnknownNonCritical mallory intermediate "$UNKNOWN=ASN1:NULL"
+# A second copy of the $UNKNOWN extension it already carries.
+issue malloryDuplicateExtension mallory intermediate "$UNKNOWN=ASN1:NULL"
+duplicate malloryDuplicateExtension intermediate 300f06092b06010401868d1f0104020500
+issue malloryByRoot mallory root ''
+issue malloryBySubIntermediate mallory subIntermediate ''
+# A partner user holds their own leaf key, so they can sign a leaf naming a colleague.
+csr forgedAlice /C=NL/O=Conduction/CN=alice@cloud.partner.example 4096
+issue forgedAlice forgedAlice mallory ''
+
+fp() { openssl x509 -in "$W/$1.pem" -outform DER | sha256sum | cut -d' ' -f1; }
+python3 - "$W" "$(fp root)" "$(fp rootPathLen0)" "$(fp rootExpired)" <<'PY'
+import json, sys
+w, root, root_path_len_0, root_expired = sys.argv[1:5]
+r = lambda n: open(f"{w}/{n}").read()
+names = ["root", "rootPathLen0", "rootExpired", "intermediate", "intermediateNoBasicConstraints", "intermediateNotCa", "intermediateNoCertSign", "intermediatePathLen0",
+	"intermediateUnknownCritical", "intermediateDuplicateBasicConstraints", "intermediateExpired", "intermediateNotYetValid", "subIntermediate",
+	"mallory", "malloryUnknownCritical", "malloryUnknownNonCritical", "malloryDuplicateExtension", "malloryByRoot", "malloryBySubIntermediate", "forgedAlice"]
+out = {"_note": "TEST ONLY: throwaway keys and certificates generated by generate-ca-constraints-chain.sh; they protect nothing."}
+out.update({n: r(f"{n}.pem") for n in names})
+out.update(rootFingerprint=root, rootPathLen0Fingerprint=root_path_len_0, rootExpiredFingerprint=root_expired, malloryKey=r("mallory.key"))
+print(json.dumps(out, indent=1))
+PY
diff --git a/browser-extension/src/testing/vectors.ts b/browser-extension/src/testing/vectors.ts
index 678d0037d..612848be9 100644
--- a/browser-extension/src/testing/vectors.ts
+++ b/browser-extension/src/testing/vectors.ts
@@ -7,6 +7,31 @@ export function vectors(name: 'envelope' | 'fields') {
 
 export const envelope = vectors('envelope')
 
+/** Every entry of the web app's fixture, which a test holds it to, so a case it adds can't go unread here. */
+export const FEDERATION_NAMES = [
+	'rootA', 'rootAFingerprint', 'rootAPathLen0', 'rootAPathLen0Fingerprint', 'rootAExpired', 'rootAExpiredFingerprint', 'rootB', 'rootBFingerprint',
+	'intermediateA', 'intermediateB', 'intermediateABasicConstraintsOnly', 'intermediateADuplicateBasicConstraints', 'intermediateAEmptyKeyUsageWithUnusedBits',
+	'intermediateAExpired', 'intermediateAKeyCertSignInPadding', 'intermediateANoBasicConstraints', 'intermediateANoCertSign', 'intermediateANotCa',
+	'intermediateANotYetValid', 'intermediateAPathLen0', 'intermediateAUnknownCritical', 'intermediateAUnknownNonCritical',
+	'bob', 'bobPss', 'bobOtherRoot', 'mallory', 'leafMarkedCa', 'leafSignedByLeaf', 'leafSignedByRoot',
+] as const
+
+/** Real openssl certificates from the app repo's `tests/fixtures/generate-federation-chain.sh`. */
+export function federationChain(): Record<typeof FEDERATION_NAMES[number], string> {
+	return JSON.parse(readFileSync(new URL('../../../tests/fixtures/federation-chain.json', import.meta.url), 'utf8'))
+}
+
+type CaConstraintsName = 'root' | 'rootFingerprint' | 'rootPathLen0' | 'rootPathLen0Fingerprint' | 'rootExpired' | 'rootExpiredFingerprint'
+	| 'intermediate' | 'intermediateNoBasicConstraints' | 'intermediateNotCa' | 'intermediateNoCertSign' | 'intermediatePathLen0'
+	| 'intermediateUnknownCritical' | 'intermediateDuplicateBasicConstraints' | 'intermediateExpired' | 'intermediateNotYetValid' | 'subIntermediate'
+	| 'mallory' | 'malloryKey' | 'malloryUnknownCritical' | 'malloryUnknownNonCritical' | 'malloryDuplicateExtension' | 'malloryByRoot' | 'malloryBySubIntermediate'
+	| 'forgedAlice'
+
+/** From `generate-ca-constraints-chain.sh` next to it, without its `_note`. */
+export function caConstraintsChain(): Record<CaConstraintsName, string> {
+	return JSON.parse(readFileSync(new URL('./ca-constraints-chain.json', import.meta.url), 'utf8'), (key, value) => key === '_note' ? undefined : value)
+}
+
 export const suiteRow = {
 	id: 'suite-1',
 	status: 'active',
diff --git a/browser-extension/src/vault/fields.test.ts b/browser-extension/src/vault/fields.test.ts
index b9a21a8df..b842c6f10 100644
--- a/browser-extension/src/vault/fields.test.ts
+++ b/browser-extension/src/vault/fields.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import type { EditableItem } from '@/src/messages'
 import { parseTotpSeed } from '@/src/totp/totp'
-import { customField, diffDraft, emptyValues, formKind, fromItem, toDraft, totpKey, validate, type FormValues } from './fields'
+import { CARD_FIELDS, customField, diffDraft, emptyValues, formKind, fromItem, IDENTITY_FIELDS, keepLineBreaks, shownInFull, toDraft, totpKey, validate, type FormValues } from './fields'
 
 function values(overrides: Partial<FormValues> = {}): FormValues {
 	return { ...emptyValues('t-login'), name: 'GitHub', ...overrides }
@@ -29,11 +29,16 @@ describe('toDraft', () => {
 		})
 	})
 
-	it('stores a note in `key` without a username or notes member', () => {
+	it('stores a new note in `key` without a username or notes member', () => {
 		const draft = toDraft(values({ secret: 'Wifi: hunter2', login: 'ignored', notes: 'typed under another type' }), 'note')
 		expect(draft).toMatchObject({ key: 'Wifi: hunter2', login: null, additionalFields: {} })
 	})
 
+	it('keeps the username and notes a note came with, as the form shows them', () => {
+		const form = fromItem(item({ typeId: 't-note', key: 'Wifi', login: 'alice', additionalFields: { Notes: 'old' } }), 'note')
+		expect(toDraft(form, 'note')).toMatchObject({ key: 'Wifi', login: 'alice', additionalFields: { Notes: 'old' } })
+	})
+
 	it('serializes a card exactly as the web app does', () => {
 		const card = { number: '4111 1111 1111 1111', expiry: '12/29', cvv: '', pin: '', cardholder: 'Alice Doe' }
 		expect(toDraft(values({ card }), 'card').key).toBe('{"number":"4111 1111 1111 1111","expiry":"12/29","cvv":"","pin":"","cardholder":"Alice Doe"}')
@@ -50,6 +55,24 @@ describe('toDraft', () => {
 	})
 })
 
+describe('keepLineBreaks', () => {
+	it.each([
+		['CRLF', 'a\r\nb', 'a\r\nb\r\nc'],
+		['a lone CR', 'a\rb', 'a\rb\rc'],
+		['LF', 'a\nb', 'a\nb\nc'],
+		['mixed breaks, which cannot be told apart', 'a\r\nb\nc', 'a\nb\nc'],
+		['no break', 'ab', 'a\nb\nc'],
+	])('gives an edited text area the breaks of a secret that used %s', (_, original, expected) => {
+		// What a browser's text area reads back: LF only.
+		expect(keepLineBreaks('a\nb\nc', original)).toBe(expected)
+	})
+
+	it('reads breaks a text area left as set, as happy-dom does, the same way', () => {
+		expect(keepLineBreaks('a\r\nb\nc', 'a\r\nb')).toBe('a\r\nb\r\nc')
+		expect(keepLineBreaks('a\rb\nc', 'a\rb')).toBe('a\rb\rc')
+	})
+})
+
 describe('totpKey', () => {
 	it('keeps a bare secret as typed until an option changes', () => {
 		expect(toDraft(values({ secret: 'JBSWY3DPEHPK3PXP' }), 'totp').key).toBe('JBSWY3DPEHPK3PXP')
@@ -68,46 +91,71 @@ describe('totpKey', () => {
 })
 
 describe('fromItem and diffDraft', () => {
+	/** What a save of `fetched` sends after `edit`, as the form computes it. */
+	const patchOf = (fetched: EditableItem, type: string, edit: (values: FormValues) => Partial<FormValues> = () => ({})) => {
+		const form = fromItem(fetched, type)
+		return diffDraft(toDraft(form, type), toDraft({ ...form, ...edit(form) }, type))
+	}
+
 	it('round-trips an item without a change', () => {
 		const fetched = item({ additionalFields: { Notes: 'old', pin: '1234' } })
-		const form = fromItem(fetched)
+		const form = fromItem(fetched, 'login')
 		expect(form).toMatchObject({ notes: 'old', notesKey: 'Notes', login: 'alice', secret: 'hunter2' })
 		expect(form.fields.map(({ name, value }) => [name, value])).toEqual([['pin', '1234']])
-		expect(diffDraft(toDraft(form, 'login'), toDraft(fromItem(fetched), 'login'))).toEqual({})
+		expect(patchOf(fetched, 'login')).toEqual({})
 	})
 
 	it('keeps a field named __proto__ through a save', () => {
 		const fetched = item({ additionalFields: JSON.parse('{"__proto__":"kept","pin":"1"}') as Record<string, string> })
-		const draft = toDraft({ ...fromItem(fetched), name: 'Renamed' }, 'login')
+		const draft = toDraft({ ...fromItem(fetched, 'login'), name: 'Renamed' }, 'login')
 		expect(JSON.stringify(draft.additionalFields)).toBe('{"__proto__":"kept","pin":"1"}')
-		expect(diffDraft(toDraft(fromItem(fetched), 'login'), draft)).toEqual({ name: 'Renamed' })
+		expect(patchOf(fetched, 'login', () => ({ name: 'Renamed' }))).toEqual({ name: 'Renamed' })
 	})
 
 	it('sends only a rename', () => {
-		const before = toDraft(fromItem(item()), 'login')
-		expect(diffDraft(before, toDraft({ ...fromItem(item()), name: 'GitHub work' }, 'login'))).toEqual({ name: 'GitHub work' })
+		expect(patchOf(item(), 'login', () => ({ name: 'GitHub work' }))).toEqual({ name: 'GitHub work' })
 	})
 
 	it('clears an emptied username and URL with null', () => {
-		const before = toDraft(fromItem(item()), 'login')
-		expect(diffDraft(before, toDraft({ ...fromItem(item()), login: '', url: '' }, 'login'))).toEqual({ login: null, url: null })
+		expect(patchOf(item(), 'login', () => ({ login: '', url: '' }))).toEqual({ login: null, url: null })
+	})
+
+	it.each(['note', 'totp', 'card', 'identity'])('keeps a %s\'s username editable once it came with one, and clears it with null', (type) => {
+		const fetched = item({ typeId: `t-${type}`, key: '' })
+		expect(patchOf(fetched, type, () => ({ login: 'bob' }))).toEqual({ login: 'bob' })
+		expect(patchOf(fetched, type, () => ({ login: '' }))).toEqual({ login: null })
+		expect(patchOf(item({ typeId: `t-${type}`, key: '', login: null }), type, () => ({ login: 'bob' }))).toEqual({})
 	})
 
 	it('sends the whole additional fields object when notes change, under their own name', () => {
 		const fetched = item({ additionalFields: { Notes: 'old', pin: '1234' } })
-		const patch = diffDraft(toDraft(fromItem(fetched), 'login'), toDraft({ ...fromItem(fetched), notes: 'new' }, 'login'))
-		expect(patch).toEqual({ additionalFields: { pin: '1234', Notes: 'new' } })
+		expect(patchOf(fetched, 'login', () => ({ notes: 'new' }))).toEqual({ additionalFields: { pin: '1234', Notes: 'new' } })
 	})
 
-	it('leaves an unreadable card alone until a member is typed', () => {
-		const fetched = item({ typeId: 't-card', key: 'legacy text', login: null })
-		expect(diffDraft(toDraft(fromItem(fetched), 'card'), toDraft(fromItem(fetched), 'card'))).toEqual({})
+	it('shows a card or identity key that is not a JSON object as one secret, and writes it back as typed', () => {
+		for (const key of ['legacy text', '[1]', ' {"number":"4111"}', '{broken']) {
+			const fetched = item({ typeId: 't-card', key, login: null })
+			expect(fromItem(fetched, 'card')).toMatchObject({ plainKey: true, secret: key })
+			expect(patchOf(fetched, 'card')).toEqual({})
+			expect(patchOf(fetched, 'card', () => ({ secret: 'new' }))).toEqual({ key: 'new' })
+		}
+		expect(fromItem(item({ typeId: 't-identity', key: 'legacy text' }), 'identity').plainKey).toBe(true)
+		expect(fromItem(item({ typeId: 't-card', key: '' }), 'card').plainKey).toBe(false)
+		expect(fromItem(item({ key: 'hunter2' }), 'login').plainKey).toBe(false)
+	})
+
+	it('sends a card it opened with missing members or a number unchanged until a member is typed', () => {
+		const fetched = item({ typeId: 't-card', key: '{"number":4111,"cardholder":"Alice"}', login: null })
+		expect(fromItem(fetched, 'card').card).toEqual({ number: '4111', expiry: '', cvv: '', pin: '', cardholder: 'Alice' })
+		expect(patchOf(fetched, 'card', () => ({ notes: 'n' }))).toEqual({ additionalFields: { notes: 'n' } })
+		expect(patchOf(fetched, 'card', (values) => ({ card: { ...values.card, cvv: '123' } }))).toEqual({
+			key: '{"number":"4111","expiry":"","cvv":"123","pin":"","cardholder":"Alice"}',
+		})
 	})
 
 	it('never sends a withheld passkey credential', () => {
-		const fetched = item({ typeId: 't-passkey', key: '', keyWithheld: true, login: null })
-		const patch = diffDraft(toDraft(fromItem(fetched), 'passkey'), toDraft({ ...fromItem(fetched), name: 'Renamed' }, 'passkey'))
-		expect(patch).toEqual({ name: 'Renamed' })
+		const fetched = item({ typeId: 't-passkey', key: '', login: null })
+		expect(patchOf(fetched, 'passkey', () => ({ name: 'Renamed' }))).toEqual({ name: 'Renamed' })
 	})
 })
 
@@ -121,6 +169,8 @@ describe('validate', () => {
 	it('caps a URL and a username at 4096 characters', () => {
 		const errors = validate(values({ url: 'x'.repeat(4097), login: 'x'.repeat(4097) }), 'login')
 		expect(errors).toEqual({ url: { code: 'tooLong', max: 4096 }, login: { code: 'tooLong', max: 4096 } })
+		const note = fromItem(item({ typeId: 't-note', key: 'Wifi' }), 'note')
+		expect(validate({ ...note, login: 'x'.repeat(4097) }, 'note')).toEqual({ login: { code: 'tooLong', max: 4096 } })
 	})
 
 	it('refuses reserved, blank and duplicate field names, ignoring case', () => {
@@ -152,3 +202,58 @@ describe('validate', () => {
 		expect(validate(values({ secret: '' }), 'passkey')).toEqual({})
 	})
 })
+
+describe('shownInFull', () => {
+	const TYPES = ['login', 'database', 'ssh_key', undefined, 'note', 'totp', 'card', 'identity', 'passkey']
+	const card = JSON.stringify(Object.fromEntries(CARD_FIELDS.map((member) => [member, `${member} value`])))
+	const identity = JSON.stringify(Object.fromEntries(IDENTITY_FIELDS.map((member) => [member, `${member} value`])))
+	const shownUnder = (field: 'key' | 'login' | 'additionalFields', plaintext: string) => TYPES.filter((type) => shownInFull(field, plaintext, type))
+
+	it('counts an empty field as shown under every type', () => {
+		for (const field of ['key', 'login', 'additionalFields'] as const) {
+			expect(shownUnder(field, '')).toEqual(TYPES)
+			expect(TYPES.every((type) => shownInFull(field, null, type))).toBe(true)
+		}
+	})
+
+	const notPasskey = TYPES.filter((type) => type !== 'passkey')
+
+	it('shows a username under every type but a passkey, as the web app does', () => {
+		expect(shownUnder('login', 'alice')).toEqual(notPasskey)
+	})
+
+	it('shows a plain key in full for every type but a passkey, a card or identity one as its one secret field', () => {
+		for (const key of ['Y-BANK-PASSWORD\nsecond line', '[1]', ` ${card}`, '{broken']) expect(shownUnder('key', key)).toEqual(notPasskey)
+	})
+
+	it('shows a card or identity key when every member is one the form has a field for, holding text or a number', () => {
+		expect(shownUnder('key', card)).toEqual(TYPES.filter((type) => type !== 'passkey' && type !== 'identity'))
+		expect(shownInFull('key', identity, 'identity')).toBe(true)
+		expect(shownInFull('key', '{"number":4111,"cardholder":"Alice"}', 'card')).toBe(true)
+		expect(shownInFull('key', '{}', 'card')).toBe(true)
+		const hidden = [
+			card.replace('}', ',"recovery":"Y-BANK-PASSWORD"}'),
+			card.replace('"cvv":"cvv value"', '"cvv":"Y-BANK-PASSWORD","cvv":"cvv value"'),
+			card.replace('"pin":"pin value"', '"pin":{"code":"Y-BANK-PASSWORD"}'),
+			card.replace('"pin":"pin value"', '"pin":["Y-BANK-PASSWORD"]'),
+			card.replace('"pin":"pin value"', '"pin":true'),
+			card.replace('"pin":"pin value"', '"pin":null'),
+			'{"number":"4111","__proto__":"Y-BANK-PASSWORD"}',
+			card.replace(':', ': '),
+			'{"number":4.10}',
+		]
+		for (const key of hidden) expect(shownInFull('key', key, 'card')).toBe(false)
+		expect(shownInFull('key', identity.replace('}', ',"recovery":"Y-BANK-PASSWORD"}'), 'identity')).toBe(false)
+	})
+
+	it('shows additional fields in full for all but a passkey, notes included', () => {
+		expect(shownUnder('additionalFields', '{"pin":"1234","meta":{"a":1}}')).toEqual(notPasskey)
+		expect(shownUnder('additionalFields', '{"pin":"1234","Notes":"Y-BANK-PASSWORD"}')).toEqual(notPasskey)
+	})
+
+	it('refuses additional fields whose parse loses something, as a duplicate member does', () => {
+		for (const fields of ['{"pin":"Y-BANK-PASSWORD","pin":"1234"}', '{"meta":{"a":"Y-BANK-PASSWORD","a":1}}', '{ "pin": "1234" }', '[1]']) {
+			expect(shownUnder('additionalFields', fields)).toEqual([])
+		}
+	})
+})
diff --git a/browser-extension/src/vault/fields.ts b/browser-extension/src/vault/fields.ts
index 0e959ef7c..9d75dd629 100644
--- a/browser-extension/src/vault/fields.ts
+++ b/browser-extension/src/vault/fields.ts
@@ -1,7 +1,7 @@
 /** The item form's model: per-type fields, the payloads they serialize to, and the limits Keepiq enforces. */
-import type { EditableItem, ItemDraft, ItemPatch } from '@/src/messages'
+import type { DecryptField, EditableItem, ItemDraft, ItemPatch } from '@/src/messages'
 import { parseTotpSeed, type TotpAlgorithm } from '@/src/totp/totp'
-import { parseObject, text } from './payloads'
+import { parseObject, parsePayload, text } from './payloads'
 
 /** The server's `name` column (Keepiq `item-name-limit`). */
 export const NAME_MAX = 255
@@ -38,6 +38,20 @@ export function formKind(typeName: string | undefined): FormKind {
 /** Secrets that span lines. */
 export const isMultiline = (typeName: string | undefined) => typeName === 'ssh_key' || typeName === 'certificate'
 
+/** A single-line input would join the lines of such a value. */
+export const hasLineBreak = (value: string) => /[\r\n]/.test(value)
+
+/**
+ * A text area reads every line break as LF (the HTML `textarea` API value), so text that used CRLF or CR throughout gets it back on an edit.
+ * Mixed breaks come back as LF, as the edited lines cannot reliably be matched to the original's breaks.
+ */
+export function keepLineBreaks(typed: string, original: string): string {
+	const breaks = original.match(/\r\n|\r|\n/g) ?? []
+	const lf = typed.replace(/\r\n?/g, '\n')
+	const style = breaks[0]
+	return style && style !== '\n' && breaks.every((b) => b === style) ? lf.replace(/\n/g, style) : lf
+}
+
 export interface TotpOptions {
 	algorithm: TotpAlgorithm
 	digits: 6 | 8
@@ -57,7 +71,11 @@ export interface FormValues {
 	url: string
 	folderId: string | null
 	login: string
-	/** A credential's or note's `key`, or a TOTP seed as typed. */
+	/** The item came with a username, which every type but a passkey then shows, as the web app does. */
+	loginShown: boolean
+	/** A card's or identity's `key` that is not a JSON object, shown and written as one secret, so an edit neither hides it nor overwrites it with empty members. */
+	plainKey: boolean
+	/** A credential's or note's `key`, a TOTP seed as typed, or a `plainKey`. */
 	secret: string
 	/** Only the advanced TOTP options the user changed; any of them rewrites the seed as a URI. */
 	totp: Partial<TotpOptions>
@@ -76,20 +94,48 @@ export const customField = (name = '', value = ''): CustomField => ({ id: ++next
 
 export function emptyValues(typeId: string, url = '', folderId: string | null = null): FormValues {
 	return {
-		typeId, name: '', url, folderId, login: '', secret: '', totp: {},
+		typeId, name: '', url, folderId, login: '', loginShown: false, plainKey: false, secret: '', totp: {},
 		card: blank(CARD_FIELDS), identity: blank(IDENTITY_FIELDS), notes: '', notesKey: null, fields: [],
 	}
 }
 
+export interface FormSections {
+	login: boolean
+	/** The key as one secret field, as the composite's member fields, or not at all. */
+	key: 'secret' | 'members' | null
+	fields: boolean
+	notes: boolean
+}
+
+/** What the form shows; the form renders from it, and `shownInFull` counts by it. */
+export function formSections(kind: FormKind, values: Pick<FormValues, 'loginShown' | 'plainKey' | 'notesKey'>): FormSections {
+	if (kind === 'passkey') return { login: false, key: null, fields: false, notes: false }
+	return {
+		login: kind === 'credential' || values.loginShown,
+		key: (kind === 'card' || kind === 'identity') && !values.plainKey ? 'members' : 'secret',
+		fields: true,
+		// A note's text is its `key`, so it shows Notes only for the notes it came with.
+		notes: kind !== 'note' || values.notesKey !== null,
+	}
+}
+
+/** Additional fields as the form edits them: text, and any other JSON value as its JSON. */
+export const fieldTexts = (payload: Record<string, unknown>): Record<string, string> =>
+	Object.fromEntries(Object.entries(payload).map(([name, value]) => [name, typeof value === 'string' ? value : JSON.stringify(value)]))
+
 function members<K extends string>(raw: string, keys: readonly K[]): Record<K, string> {
 	const payload = parseObject(raw) ?? {}
 	return Object.fromEntries(keys.map((key) => [key, text(payload, key)])) as Record<K, string>
 }
 
-export function fromItem(item: EditableItem): FormValues {
+export function fromItem(item: EditableItem, typeName: string | undefined): FormValues {
 	const values = emptyValues(item.typeId, item.url ?? '', item.folderId)
 	values.name = item.name
 	values.login = item.login ?? ''
+	values.loginShown = values.login !== ''
+	const kind = formKind(typeName)
+	// An empty key gets the empty member fields to fill in, as in the web app's edit form.
+	values.plainKey = (kind === 'card' || kind === 'identity') && item.key !== '' && !parsePayload(item.key)
 	values.secret = item.key
 	values.card = members(item.key, CARD_FIELDS)
 	values.identity = members(item.key, IDENTITY_FIELDS)
@@ -122,26 +168,21 @@ export function totpKey(seed: string, options: Partial<TotpOptions>, label: stri
 }
 
 function keyOf(values: FormValues, kind: FormKind): string {
-	switch (kind) {
-		case 'card': return serialize(values.card, CARD_FIELDS)
-		case 'identity': return serialize(values.identity, IDENTITY_FIELDS)
-		case 'passkey': return values.secret
-		case 'totp':
-			try {
-				return totpKey(values.secret, values.totp, values.name)
-			} catch {
-				// Refused by `validate` before anything is sent.
-				return values.secret
-			}
-		default: return values.secret
+	if (formSections(kind, values).key === 'members') return kind === 'card' ? serialize(values.card, CARD_FIELDS) : serialize(values.identity, IDENTITY_FIELDS)
+	if (kind !== 'totp') return values.secret
+	try {
+		return totpKey(values.secret, values.totp, values.name)
+	} catch {
+		// Refused by `validate` before anything is sent.
+		return values.secret
 	}
 }
 
 export function toDraft(values: FormValues, typeName: string | undefined): ItemDraft {
 	const kind = formKind(typeName)
-	const entries = values.fields.filter((field) => field.name.trim()).map((field): [string, string] => [field.name.trim(), field.value])
-	// A note's text is its `key`; notes it came with are kept, not offered.
-	if (values.notes !== '' && (kind !== 'note' || values.notesKey !== null)) entries.push([values.notesKey ?? NOTES, values.notes])
+	const sections = formSections(kind, values)
+	const entries = sections.fields ? values.fields.filter((field) => field.name.trim()).map((field): [string, string] => [field.name.trim(), field.value]) : []
+	if (sections.notes && values.notes !== '') entries.push([values.notesKey ?? NOTES, values.notes])
 	// `fromEntries` defines each name, so a field called `__proto__` is kept rather than setting the prototype.
 	const additionalFields: Record<string, string> = Object.fromEntries(entries)
 	return {
@@ -150,7 +191,7 @@ export function toDraft(values: FormValues, typeName: string | undefined): ItemD
 		url: values.url.trim() || null,
 		folderId: values.folderId,
 		key: keyOf(values, kind),
-		login: kind === 'credential' && values.login !== '' ? values.login : null,
+		login: sections.login && values.login !== '' ? values.login : null,
 		additionalFields,
 	}
 }
@@ -173,6 +214,41 @@ export function diffDraft(before: ItemDraft, after: ItemDraft): ItemPatch {
 	return patch
 }
 
+const unopened: EditableItem = { id: '', typeId: '', name: '', url: null, folderId: null, key: '', login: null, additionalFields: {}, updatedAt: '' }
+
+/** JSON that is compact and canonical, so no duplicate member hides behind the one the parse keeps. */
+function canonicalObject(raw: string): Record<string, unknown> | null {
+	const payload = parseObject(raw)
+	return payload && JSON.stringify(payload) === raw ? payload : null
+}
+
+/**
+ * Whether the edit form shows all of a field's plaintext under this type, since a save leaves an untouched field as it is and partners get it whole (ADR-002).
+ * Composite members count when each is one the form has a field for, holding what that field shows.
+ */
+export function shownInFull(field: DecryptField, plaintext: string | null, typeName: string | undefined): boolean {
+	if (!plaintext) return true
+	const kind = formKind(typeName)
+	switch (field) {
+		case 'login': return formSections(kind, fromItem({ ...unopened, login: plaintext }, typeName)).login
+		case 'key': {
+			const values = fromItem({ ...unopened, key: plaintext }, typeName)
+			const shown = formSections(kind, values).key
+			if (shown !== 'members') return shown === 'secret'
+			const fields: Record<string, string> = kind === 'card' ? values.card : values.identity
+			const payload = canonicalObject(plaintext)
+			return !!payload && Object.entries(payload).every(([member, value]) => Object.hasOwn(fields, member) && fields[member] === (typeof value === 'number' ? String(value) : value))
+		}
+		case 'additionalFields': {
+			const payload = canonicalObject(plaintext)
+			if (!payload) return false
+			const values = fromItem({ ...unopened, additionalFields: fieldTexts(payload) }, typeName)
+			const sections = formSections(kind, values)
+			return sections.fields && (sections.notes || values.notesKey === null)
+		}
+	}
+}
+
 export type FieldError =
 	| { code: 'required' | 'reserved' | 'duplicate' | 'invalidTotp' }
 	| { code: 'tooLong' | 'tooLongBytes'; max: number }
@@ -198,9 +274,10 @@ export function validate(values: FormValues, typeName: string | undefined): Form
 	capChars(errors, 'url', values.url)
 	if (kind === 'passkey') return errors
 
-	if (kind === 'credential') capChars(errors, 'login', values.login)
-	if (kind === 'card') for (const member of CARD_FIELDS) capChars(errors, `card.${member}`, values.card[member])
-	if (kind === 'identity') for (const member of IDENTITY_FIELDS) capChars(errors, `identity.${member}`, values.identity[member])
+	const sections = formSections(kind, values)
+	if (sections.login) capChars(errors, 'login', values.login)
+	if (kind === 'card' && sections.key === 'members') for (const member of CARD_FIELDS) capChars(errors, `card.${member}`, values.card[member])
+	if (kind === 'identity' && sections.key === 'members') for (const member of IDENTITY_FIELDS) capChars(errors, `identity.${member}`, values.identity[member])
 	if (kind === 'totp') {
 		try {
 			parseTotpSeed(values.secret)
diff --git a/browser-extension/src/vault/key-store.test.ts b/browser-extension/src/vault/key-store.test.ts
index a44dfbe6a..a8d58a213 100644
--- a/browser-extension/src/vault/key-store.test.ts
+++ b/browser-extension/src/vault/key-store.test.ts
@@ -3,7 +3,7 @@ import { fakeBrowser } from 'wxt/testing/fake-browser'
 import { pemToPkcs8, toBase64 } from '@/src/crypto'
 import { TIMEOUT_POLICY, writeSettings } from '@/src/accounts/settings'
 import { envelope } from '@/src/testing/vectors'
-import { clearKey, getKey, hasKey, neverLockKey, putKey, syncNeverLockKey } from './key-store'
+import { clearKey, editOpenedKey, getKey, hasKey, neverLockKey, putKey, sessionValues, syncNeverLockKey } from './key-store'
 
 const pkcs8 = toBase64(pemToPkcs8(envelope.privateKeyPem))
 
@@ -26,8 +26,9 @@ describe('key store on storage.session', () => {
 		expect(key?.usages).toEqual(['decrypt'])
 	})
 
-	it('clears the key', async () => {
+	it('clears the key, and what edit forms opened with it', async () => {
 		await putKey('a', pkcs8)
+		await browser.storage.session.set({ [editOpenedKey('a')]: '[{"id":"s1"}]' })
 		await clearKey('a')
 		expect(await hasKey('a')).toBe(false)
 		expect(await getKey('a')).toBeNull()
@@ -95,7 +96,9 @@ describe('key store without storage.session (Firefox < 115)', () => {
 		await putKey('m', pkcs8)
 		expect(await hasKey('m')).toBe(true)
 		expect(await browser.storage.local.get(null)).toEqual({})
+		await sessionValues.set({ [editOpenedKey('m')]: '[]' })
 		await clearKey('m')
 		expect(await hasKey('m')).toBe(false)
+		expect(await sessionValues.get(editOpenedKey('m'))).toBeUndefined()
 	})
 })
diff --git a/browser-extension/src/vault/key-store.ts b/browser-extension/src/vault/key-store.ts
index fe0122ea8..3bca88762 100644
--- a/browser-extension/src/vault/key-store.ts
+++ b/browser-extension/src/vault/key-store.ts
@@ -7,11 +7,14 @@
 import { importPrivateKey } from '@/src/crypto'
 import { fromBase64 } from '@/src/crypto/base64'
 import { effectiveSettings } from '@/src/accounts/settings'
+import { forgetVerifiedPartners } from './verified-partners'
 
 const sessionKey = (accountId: string) => `privateKeyPkcs8.${accountId}`
 export const unlockedAtKey = (accountId: string) => `unlockedAt.${accountId}`
 export const neverLockKey = (accountId: string) => `neverLockKey.${accountId}`
 export const LAST_TAB_KEY = 'popup:lastTab'
+/** The ciphertext and source version open edit forms hold (`write.ts`), cleared with the key. */
+export const editOpenedKey = (accountId: string) => `editOpened.${accountId}`
 
 const memory = new Map<string, string>()
 /** Imported once per worker generation; the bytes are the source of truth. */
@@ -73,9 +76,11 @@ export async function getKey(accountId: string): Promise<CryptoKey | null> {
 	return key
 }
 
+/** Every lock and logout goes through here. */
 export async function clearKey(accountId: string): Promise<void> {
 	imported.delete(accountId)
-	await session.remove([sessionKey(accountId), unlockedAtKey(accountId)])
+	forgetVerifiedPartners()
+	await session.remove([sessionKey(accountId), unlockedAtKey(accountId), editOpenedKey(accountId)])
 	await browser.storage.local.remove(neverLockKey(accountId))
 }
 
diff --git a/browser-extension/src/vault/payloads.test.ts b/browser-extension/src/vault/payloads.test.ts
index 968757b92..fb08c7644 100644
--- a/browser-extension/src/vault/payloads.test.ts
+++ b/browser-extension/src/vault/payloads.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { typeIcon } from './icons'
-import { cardBrand, cardLast4, parseObject, text } from './payloads'
+import { cardBrand, cardLast4, parseObject, parsePayload, text } from './payloads'
 
 describe('parseObject', () => {
 	it('accepts only JSON objects', () => {
@@ -9,6 +9,13 @@ describe('parseObject', () => {
 	})
 })
 
+describe('parsePayload', () => {
+	it('reads members only from a key that starts a JSON object', () => {
+		expect(parsePayload('{"number":"4111"}')).toEqual({ number: '4111' })
+		for (const key of ['', ' {"number":"4111"}', '[1]', '{broken', 'legacy text']) expect(parsePayload(key)).toBeNull()
+	})
+})
+
 describe('text', () => {
 	it('reads strings and numbers, anything else as empty', () => {
 		expect(text({ a: 'x', b: 4, c: null, d: {} }, 'a')).toBe('x')
diff --git a/browser-extension/src/vault/payloads.ts b/browser-extension/src/vault/payloads.ts
index 7a355f86e..6dc0bdcb2 100644
--- a/browser-extension/src/vault/payloads.ts
+++ b/browser-extension/src/vault/payloads.ts
@@ -11,6 +11,9 @@ export function parseObject(raw: string | undefined): Record<string, unknown> |
 	}
 }
 
+/** A card's or identity's members, as the web app's `parsePayload` reads them: only from a key that starts a JSON object. */
+export const parsePayload = (key: string): Record<string, unknown> | null => (key.startsWith('{') ? parseObject(key) : null)
+
 /** A field as display text; missing and non-string values read as empty. */
 export function text(payload: Record<string, unknown>, field: string): string {
 	const value = payload[field]
diff --git a/browser-extension/src/vault/share-save.test.ts b/browser-extension/src/vault/share-save.test.ts
new file mode 100644
index 000000000..fed3f3fee
--- /dev/null
+++ b/browser-extension/src/vault/share-save.test.ts
@@ -0,0 +1,702 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createClient } from '@/src/api/client'
+import { importPrivateKey, pemToPkcs8, rsaDecrypt, verifyFederatedCertificate } from '@/src/crypto'
+import { decodePem, extractSpki } from '@/src/crypto/rsa'
+import { encrypt, secretRow } from '@/src/testing/vault'
+import { envelope, federationChain } from '@/src/testing/vectors'
+import { clearKey } from './key-store'
+import { shareSave, VALUE_FIELDS, type Opened, type ShareSaveInput, type Values } from './share-save'
+import { forgetVerifiedPartners, VERIFIED_PARTNER_TTL_MS } from './verified-partners'
+import { writeError } from './write-error'
+
+vi.mock('@/src/crypto', async (importOriginal) => {
+	const actual = await importOriginal<typeof import('@/src/crypto')>()
+	return { ...actual, verifyFederatedCertificate: vi.fn(actual.verifyFederatedCertificate) }
+})
+
+const F = federationChain()
+const CERT = envelope.certificatePem as string
+const BASE = '2026-03-02T10:00:00+00:00'
+const SOURCE_AT = '2026-03-01T09:00:00+00:00'
+const BOB = { shareId: 'fs-bob', recipientCloudId: 'bob@cloud.partner.example' }
+const CAROL = { shareId: 'fs-carol', recipientCloudId: 'carol@cloud.partner.example' }
+
+const fetchMock = vi.fn<typeof fetch>()
+const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
+const client = createClient({ serverUrl: 'https://cloud.example.org', uid: 'alice', loginName: 'alice', appPassword: 'pw' })
+let privateKey: CryptoKey
+const decrypt = (ciphertext: unknown) => rsaDecrypt(ciphertext as string, privateKey)
+
+type Entry = Record<string, unknown>
+interface Body {
+	baseUpdatedAt: string
+	sourceBaseUpdatedAt?: string | null
+	patch?: Record<string, unknown>
+	copies: Array<Entry & { secretId: string }>
+	skipped: Array<{ secretId: string; reason: string }>
+	federated?: Array<Entry & { shareId: string }>
+	suspend?: Array<{ shareId: string; reason: string }>
+	stage?: { id?: string; final: boolean }
+}
+interface RequiredCopy { secretId: string; holder: 'owner' | 'recipient'; targetUserId: string | null }
+
+/** The sharing graph the fake server judges a share-save by, as `ShareSaveScope` does. */
+interface World {
+	copyPath: boolean
+	copies: RequiredCopy[]
+	shares: Array<typeof BOB>
+	/** Copies whose holder has a vault key, so the server refuses their skip. */
+	keyed: Set<string>
+	ownerOnly: boolean
+	ownerCertificate: string | null
+	effectiveGrade: string
+	/** Per user id; absent or `null` is not shareable. */
+	certificates: Record<string, string | null>
+	/** Per cloud id; absent is Bob's own verified chain. */
+	lookups: Record<string, () => Response | Promise<Response>>
+	/** Runs before each final call is judged, by its number from 1; a response replaces the judgement. */
+	onFinal?: (attempt: number) => Response | void
+}
+
+let world: World
+/** Every share-save body, chunks included. */
+let saves: Body[]
+let stages: Map<string, Body[]>
+let finals: number
+
+const recipient = (secretId: string, targetUserId: string): RequiredCopy => ({ secretId, holder: 'recipient', targetUserId })
+const finalCalls = () => saves.filter((body) => body.stage?.final !== false)
+const lastFinal = () => finalCalls().at(-1)!
+const sent = () => fetchMock.mock.calls.map(([input, init]) => `${init?.method ?? 'GET'} ${new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')}`)
+const bodiesOf = (line: string) => fetchMock.mock.calls.filter((_, i) => sent()[i] === line).map(([, init]) => JSON.parse(String(init!.body)) as Record<string, unknown>)
+
+function judge(body: Body): Response {
+	saves.push(body)
+	const local = body.copies.length + body.skipped.length
+	const remote = (body.federated?.length ?? 0) + (body.suspend?.length ?? 0)
+	if (local > 100 || remote > 100) return json({ error: 'too_many_entries' }, 400)
+	if (body.stage?.id && !stages.has(body.stage.id)) return json({ error: 'stage_unknown', message: 'The stage does not exist or expired' }, 404)
+	if (body.stage?.final === false) {
+		if (local + remote === 0) return json({ error: 'empty_chunk' }, 400)
+		const id = body.stage.id ?? crypto.randomUUID()
+		if (!body.stage.id) stages.clear()
+		stages.set(id, [...stages.get(id) ?? [], body])
+		return json({ stageId: id }, 202)
+	}
+	const replaced = world.onFinal?.(++finals)
+	if (replaced) return replaced
+	const parts = [...(body.stage?.id ? stages.get(body.stage.id)! : []), body]
+	const copies = parts.flatMap((part) => part.copies)
+	const skipped = parts.flatMap((part) => part.skipped)
+	const federated = parts.flatMap((part) => part.federated ?? [])
+	const suspend = parts.flatMap((part) => part.suspend ?? [])
+	const fields = VALUE_FIELDS.filter((field) => field in body.patch!)
+	for (const copy of copies) {
+		if (VALUE_FIELDS.filter((field) => field in copy).join() !== fields.join() || fields.some((field) => (copy[field] === null) !== (body.patch![field] === null))) {
+			return json({ error: 'copy_fields_mismatch' }, 400)
+		}
+	}
+	const named = [...copies, ...skipped].map((entry) => entry.secretId)
+	const shareIds = [...federated, ...suspend].map((entry) => entry.shareId)
+	if (new Set(named).size !== named.length || new Set(shareIds).size !== shareIds.length) return json({ error: 'duplicate_entry' }, 400)
+	const skipRefused = skipped.filter((skip) => world.keyed.has(skip.secretId)).map((skip) => skip.secretId)
+	const required = world.copies.map((copy) => copy.secretId)
+	const shares = world.copyPath ? [] : world.shares
+	const incomplete = required.some((id) => !named.includes(id)) || named.some((id) => !required.includes(id)) || skipRefused.length > 0
+		|| shares.some((share) => !shareIds.includes(share.shareId)) || shareIds.some((id) => !shares.some((share) => share.shareId === id))
+	if (incomplete) {
+		return json({
+			error: 'incomplete', path: world.copyPath ? 'copy' : 'owner', sourceUpdatedAt: SOURCE_AT,
+			copies: { required: world.copies, missing: [], unexpected: [], skipRefused }, federated: { required: shares, missing: [], unexpected: [] },
+		}, 409)
+	}
+	return json({
+		secret: secretRow(), sourceUpdatedAt: '2026-03-02T10:00:01+00:00', copies: { written: copies.length, skipped: skipped.length },
+		federated: { written: federated.length, suspended: suspend.length, notified: federated.length, queued: 0, ownerOnly: world.ownerOnly },
+	})
+}
+
+function route(method: string, path: string, body: Record<string, unknown> | undefined): Response | Promise<Response> {
+	if (method === 'GET' && path.endsWith('/write-context')) {
+		return json({ sourceSecretId: world.copyPath ? 'src' : 's1', effectiveGrade: world.effectiveGrade, ownerCertificate: world.ownerCertificate, sourceUpdatedAt: SOURCE_AT })
+	}
+	if (method === 'PUT' && path.endsWith('/share-save')) return judge(body as unknown as Body)
+	if (method === 'POST' && path === '/api/v1/shares/recipient-certificates') {
+		return json({ recipients: (body!.userIds as string[]).map((userId) => (world.certificates[userId] ? { userId, shareable: true, certificate: world.certificates[userId] } : { userId, shareable: false, reason: 'no_active_suite' })) })
+	}
+	if (method === 'POST' && path === '/api/v1/federation/recipient-certificate') {
+		const cloudId = body!.cloudId as string
+		return world.lookups[cloudId]?.() ?? json({ cloudId, certificate: F.bob, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint })
+	}
+	if (method === 'PUT' && path.startsWith('/api/v1/secrets/')) return json(secretRow())
+	return json({ message: 'Not found' }, 404)
+}
+
+beforeEach(async () => {
+	vi.stubGlobal('fetch', fetchMock)
+	fetchMock.mockReset()
+	fetchMock.mockImplementation(async (input, init) => {
+		const url = new URL(String(input))
+		return route(init?.method ?? 'GET', url.pathname.replace('/index.php/apps/keepiq', ''), init?.body ? JSON.parse(String(init.body)) : undefined)
+	})
+	vi.spyOn(console, 'error').mockImplementation(() => {})
+	privateKey ??= await importPrivateKey(pemToPkcs8(envelope.privateKeyPem))
+	world = {
+		copyPath: false, copies: [], shares: [], keyed: new Set(), ownerOnly: false, ownerCertificate: CERT, effectiveGrade: 'owner',
+		certificates: { bob: CERT, carol: CERT, dan: CERT, erin: CERT }, lookups: {},
+	}
+	saves = []
+	stages = new Map()
+	finals = 0
+	forgetVerifiedPartners()
+})
+
+/** What the form showed of X: its password, username and fields, as ciphertext. */
+async function openedX(overrides: Partial<Opened> = {}): Promise<Opened> {
+	return {
+		shown: { key: await encrypt('x-password'), login: await encrypt('alice'), additionalFields: await encrypt('{"notes":"X notes"}') },
+		updatedAt: BASE, sourceUpdatedAt: SOURCE_AT, ...overrides,
+	}
+}
+
+/** A password change to `new`, unless `plain` says otherwise; the patch's own ciphertext is the server's business. */
+function save(overrides: Partial<ShareSaveInput> = {}) {
+	const plain: Values = overrides.plain ?? { key: 'new' }
+	const patch = Object.fromEntries(Object.entries(plain).map(([field, value]) => [field, value === null ? null : `own:${field}`]))
+	return shareSave(client, privateKey, { accountId: 'a1', id: 's1', patch, plain, baseUpdatedAt: BASE, opened: undefined, withoutUnreachable: new Set(), ...overrides })
+}
+
+/** What the popup would be told. */
+async function failure(pending: Promise<unknown>) {
+	const error = await pending.then(() => new Error('saved'), (caught: unknown) => caught)
+	return writeError(error)
+}
+
+describe('rounds', () => {
+	it('saves an item shared with nobody in one share-save with empty lists, and looks up nothing', async () => {
+		expect(await save()).toBeUndefined()
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context', 'PUT /api/v1/secrets/s1/share-save'])
+		expect(saves).toEqual([{ baseUpdatedAt: BASE, patch: { key: 'own:key' }, copies: [], skipped: [], federated: [], suspend: [] }])
+	})
+
+	it('sends the patch with no copies first, then Bob\'s copy, encrypted to his certificate', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		expect(await save()).toBeUndefined()
+		expect(saves.map((body) => body.copies.map((copy) => copy.secretId))).toEqual([[], ['c-bob']])
+		expect(await decrypt(saves[1]!.copies[0]!.key)).toBe('new')
+		expect(saves[1]!.patch).toEqual({ key: 'own:key' })
+		expect(sent()).not.toContain('PUT /api/v1/secrets/s1')
+	})
+
+	it('fails with incomplete after the third incomplete answer, sending no fourth share-save', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		world.onFinal = (attempt) => {
+			world.copies = [...world.copies, recipient(`c-new${attempt}`, 'carol')]
+		}
+		expect(await failure(save())).toEqual({ code: 'incomplete' })
+		expect(finalCalls()).toHaveLength(3)
+	})
+
+	it('drops a copy the answer no longer requires and fills the one it newly requires', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.copies = [recipient('c-carol', 'carol')]
+		}
+		expect(await save()).toBeUndefined()
+		expect(lastFinal().copies.map((copy) => copy.secretId)).toEqual(['c-carol'])
+		// Bob's certificate is not looked up again.
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates').map((body) => body.userIds)).toEqual([['bob'], ['carol']])
+	})
+})
+
+describe('local copies', () => {
+	it('fills a direct, two group and a team-folder copy from one certificate request', async () => {
+		world.copies = [recipient('c-bob', 'bob'), recipient('c-carol', 'carol'), recipient('c-dan', 'dan'), recipient('c-erin', 'erin')]
+		await save()
+		expect(lastFinal().copies.map((copy) => copy.secretId)).toEqual(['c-bob', 'c-carol', 'c-dan', 'c-erin'])
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates')).toEqual([{ userIds: ['bob', 'carol', 'dan', 'erin'] }])
+		for (const copy of lastFinal().copies) expect(await decrypt(copy.key)).toBe('new')
+	})
+
+	it('asks once for a holder of two copies', async () => {
+		world.copies = [recipient('c-bob-direct', 'bob'), recipient('c-bob-group', 'bob')]
+		await save()
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates')).toEqual([{ userIds: ['bob'] }])
+		expect(lastFinal().copies).toHaveLength(2)
+	})
+
+	it('sends only the changed username, and nothing of the password or fields', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		await save({ plain: { login: 'bob' } })
+		expect(Object.keys(lastFinal().copies[0]!).sort()).toEqual(['login', 'secretId'])
+		expect(await decrypt(lastFinal().copies[0]!.login)).toBe('bob')
+	})
+
+	it('clears a username with null in the patch and in each copy', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		await save({ plain: { login: null } })
+		expect(lastFinal().patch).toEqual({ login: null })
+		expect(lastFinal().copies).toEqual([{ secretId: 'c-bob', login: null }])
+	})
+
+	it('skips a holder without a vault key, and saves for everyone else', async () => {
+		world.copies = [recipient('c-bob', 'bob'), recipient('c-carol', 'carol')]
+		world.certificates.bob = null
+		expect(await save()).toBeUndefined()
+		expect(lastFinal().skipped).toEqual([{ secretId: 'c-bob', reason: 'no_vault_key' }])
+		expect(lastFinal().copies.map((copy) => copy.secretId)).toEqual(['c-carol'])
+	})
+
+	it('reads a certificate again once when the server refuses its skip', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		world.certificates.bob = null
+		world.keyed.add('c-bob')
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.certificates.bob = CERT
+		}
+		expect(await save()).toBeUndefined()
+		expect(lastFinal().copies.map((copy) => copy.secretId)).toEqual(['c-bob'])
+		expect(lastFinal().skipped).toEqual([])
+	})
+
+	it('does not read it a third time when the skip is refused again', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		world.certificates.bob = null
+		world.keyed.add('c-bob')
+		expect(await failure(save())).toEqual({ code: 'incomplete' })
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates')).toHaveLength(2)
+	})
+
+	it.each([
+		['a garbled certificate', '-----BEGIN CERTIFICATE-----\nAAAA\n-----END CERTIFICATE-----'],
+		['text that is no PEM', 'not a certificate'],
+	])('fails with bad_certificate for %s, sending nothing more', async (_, certificate) => {
+		world.copies = [recipient('c-bob', 'bob'), recipient('c-carol', 'carol')]
+		world.certificates.carol = certificate
+		expect(await failure(save())).toEqual({ code: 'bad_certificate' })
+		expect(saves).toHaveLength(1)
+	})
+
+	it('reads 230 members\' certificates in three requests and stages two chunks of 100 before a final call with the last 30', async () => {
+		world.copies = Array.from({ length: 230 }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		await save()
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates').map((body) => (body.userIds as string[]).length)).toEqual([100, 100, 30])
+		const [first, chunk1, chunk2, final] = saves
+		expect(first!.copies).toEqual([])
+		expect([chunk1, chunk2].map((chunk) => [chunk!.copies.length, chunk!.stage, 'patch' in chunk!])).toEqual([[100, { final: false }, false], [100, { id: expect.any(String), final: false }, false]])
+		expect(chunk2!.stage!.id).toBe(stages.keys().next().value)
+		expect(final!.copies).toHaveLength(30)
+		expect(final!.patch).toEqual({ key: 'own:key' })
+		expect(final!.stage).toEqual({ id: chunk2!.stage!.id, final: true })
+		expect(await decrypt(final!.copies[29]!.key)).toBe('new')
+	})
+
+	it.each([
+		[100, [], 100],
+		[101, [100], 1],
+	])('sends %i copies in chunks of %j and a final call with %i', async (count, chunks, last) => {
+		world.copies = Array.from({ length: count }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		await save()
+		expect(saves.filter((body) => body.stage?.final === false).map((body) => body.copies.length)).toEqual(chunks)
+		expect(lastFinal().copies).toHaveLength(last)
+	})
+
+	it('starts a new stage when the answer drops a copy already staged', async () => {
+		world.copies = Array.from({ length: 102 }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.copies = world.copies.slice(1)
+		}
+		await save()
+		const chunks = saves.filter((body) => body.stage?.final === false)
+		expect(chunks.map((chunk) => [chunk.copies.length, chunk.stage?.id])).toEqual([[100, undefined], [100, undefined]])
+		expect(chunks[1]!.copies.map((copy) => copy.secretId)).not.toContain('c0')
+		const [first, second] = saves.filter((body) => body.stage?.final === true)
+		expect(second!.stage!.id).not.toBe(first!.stage!.id)
+		expect(second!.copies).toHaveLength(1)
+	})
+
+	/** Every final call with a stage finds it expired, until `expiries` ran out. */
+	function expireStages(expiries: number) {
+		fetchMock.mockImplementation(async (input, init) => {
+			const path = new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')
+			const body = init?.body ? JSON.parse(String(init.body)) as Body : undefined
+			if (body?.stage?.final === true && expiries-- > 0) stages.clear()
+			return route(init?.method ?? 'GET', path, body as never)
+		})
+	}
+
+	it('restarts an expired stage, counted as a round', async () => {
+		world.copies = Array.from({ length: 101 }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		expireStages(1)
+		expect(await save()).toBeUndefined()
+		expect(saves.filter((body) => body.stage?.final === false).map((chunk) => chunk.stage)).toEqual([{ final: false }, { final: false }])
+		expect(saves.filter((body) => body.stage?.final === true)).toHaveLength(2)
+	})
+
+	it('fails as unknown when a staged chunk is answered without a stage id, sending no final call', async () => {
+		world.copies = Array.from({ length: 101 }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		fetchMock.mockImplementation(async (input, init) => {
+			const body = init?.body ? JSON.parse(String(init.body)) as Body : undefined
+			if (body?.stage?.final === false) return json({}, 202)
+			return route(init?.method ?? 'GET', new URL(String(input)).pathname.replace('/index.php/apps/keepiq', ''), body as never)
+		})
+		expect(await failure(save())).toEqual({ code: 'unknown' })
+		expect(saves).toHaveLength(1)
+	})
+
+	it('fails with incomplete when an expired stage is the third round', async () => {
+		world.copies = Array.from({ length: 101 }, (_, i) => recipient(`c${i}`, `user${i}`))
+		world.certificates = Object.fromEntries(world.copies.map((copy) => [copy.targetUserId, CERT]))
+		expireStages(Infinity)
+		expect(await failure(save())).toEqual({ code: 'incomplete' })
+		expect(saves.filter((body) => body.stage?.final === true)).toHaveLength(2)
+	})
+})
+
+describe('the copy-editor path', () => {
+	beforeEach(() => {
+		world.copyPath = true
+		world.effectiveGrade = 'write'
+		world.copies = [{ secretId: 'src', holder: 'owner', targetUserId: null }, recipient('c-carol', 'carol')]
+	})
+
+	it('saves through the editor\'s copy with the source version the form read, for the source and every other copy', async () => {
+		await save({ opened: await openedX({ sourceUpdatedAt: '2026-02-01T00:00:00+00:00' }) })
+		const body = lastFinal()
+		expect(body.sourceBaseUpdatedAt).toBe('2026-02-01T00:00:00+00:00')
+		expect(body.copies.map((copy) => copy.secretId)).toEqual(['src', 'c-carol'])
+		expect(await decrypt(body.copies[0]!.key)).toBe('new')
+		expect(body).not.toHaveProperty('federated')
+		expect(body).not.toHaveProperty('suspend')
+		expect(bodiesOf('POST /api/v1/shares/recipient-certificates')).toEqual([{ userIds: ['carol'] }])
+	})
+
+	it.each([
+		['manage', 'a team manager'],
+		['owner', 'a delegate'],
+	])('saves for the source and every other copy on the %s grade, as %s', async (grade) => {
+		world.effectiveGrade = grade
+		expect(await save()).toBeUndefined()
+		expect(lastFinal().copies.map((copy) => copy.secretId)).toEqual(['src', 'c-carol'])
+		expect(lastFinal().sourceBaseUpdatedAt).toBe(SOURCE_AT)
+		expect(sent()).not.toContain('PUT /api/v1/secrets/s1')
+	})
+
+	it('takes the source version of its own write-context read without the form\'s record', async () => {
+		await save()
+		expect(lastFinal().sourceBaseUpdatedAt).toBe(SOURCE_AT)
+	})
+
+	it('says when partner shares stay with the owner\'s next save, and looks no partner up', async () => {
+		world.ownerOnly = true
+		expect(await save()).toEqual({ scope: 'copy', ownerOnly: true })
+		expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+	})
+
+	it('skips the source when its owner has no vault key, and reads write-context again when that skip is refused', async () => {
+		world.ownerCertificate = null
+		world.keyed.add('src')
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.ownerCertificate = CERT
+		}
+		await save()
+		expect(saves[1]!.skipped).toEqual([{ secretId: 'src', reason: 'no_vault_key' }])
+		expect(lastFinal().copies.map((copy) => copy.secretId).sort()).toEqual(['c-carol', 'src'])
+		expect(sent().filter((line) => line.endsWith('/write-context'))).toHaveLength(2)
+	})
+
+	it('reports a source written since the form opened as stale_source', async () => {
+		world.onFinal = () => json({ error: 'stale_source', message: 'The source changed since the edit was made', sourceUpdatedAt: '2026-03-03T00:00:00+00:00' }, 409)
+		expect(await failure(save())).toEqual({ code: 'stale_source' })
+	})
+
+	it.each(['read', 'none'])('saves only the editor\'s copy with a plain PUT on a %s grade', async (grade) => {
+		world.effectiveGrade = grade
+		expect(await save()).toEqual({ scope: 'own_copy' })
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context', 'PUT /api/v1/secrets/s1'])
+		expect(bodiesOf('PUT /api/v1/secrets/s1')).toEqual([{ key: 'own:key', baseUpdatedAt: BASE }])
+	})
+})
+
+describe('partner shares', () => {
+	const fingerprint = async (pem: string) => Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', decodePem(pem).der)), (byte) => byte.toString(16).padStart(2, '0')).join('')
+
+	beforeEach(() => {
+		world.shares = [BOB]
+	})
+
+	it('sends Bob the whole value with the fingerprint of the certificate it verified, looked up by his share\'s cloud id', async () => {
+		expect(await save({ opened: await openedX() })).toBeUndefined()
+		expect(bodiesOf('POST /api/v1/federation/recipient-certificate')).toEqual([{ cloudId: BOB.recipientCloudId }])
+		const [entry] = lastFinal().federated!
+		expect(Object.keys(entry!).sort()).toEqual(['additionalFields', 'certFingerprint', 'key', 'login', 'shareId'])
+		expect(entry!.certFingerprint).toBe(await fingerprint(F.bob))
+		expect(lastFinal().suspend).toEqual([])
+	})
+
+	it('builds the whole value from what was typed and what the form opened, never from the row', async () => {
+		vi.mocked(verifyFederatedCertificate).mockResolvedValueOnce({ fingerprint: 'ab'.repeat(32), spki: extractSpki(decodePem(CERT).der) })
+		await save({ opened: await openedX() })
+		const [entry] = lastFinal().federated!
+		expect([await decrypt(entry!.key), await decrypt(entry!.login), await decrypt(entry!.additionalFields)]).toEqual(['new', 'alice', '{"notes":"X notes"}'])
+		expect(sent()).not.toContain('GET /api/v1/secrets/s1')
+	})
+
+	it('sends an empty username or fields as null', async () => {
+		await save({ opened: await openedX({ shown: { key: await encrypt('x-password'), login: null, additionalFields: null } }) })
+		expect(lastFinal().federated![0]).toMatchObject({ login: null, additionalFields: null })
+	})
+
+	it('needs no record when every field was typed', async () => {
+		expect(await save({ plain: { key: 'new', login: 'bob', additionalFields: '{}' } })).toBeUndefined()
+		expect(lastFinal().federated).toHaveLength(1)
+	})
+
+	it.each([
+		['the form\'s record is gone', async () => undefined],
+		['the form did not show the fields in full', async () => openedX({ shown: { key: await encrypt('x-password'), login: null } })],
+		['the record is of another version', async () => openedX({ updatedAt: '2026-01-01T00:00:00+00:00' })],
+	])('fails with unverified before any lookup when %s', async (_, opened) => {
+		expect(await failure(save({ opened: await opened() }))).toEqual({ code: 'unverified' })
+		expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+		expect(saves).toHaveLength(1)
+	})
+
+	it('needs no record for an item without partner shares', async () => {
+		world.shares = []
+		world.copies = [recipient('c-bob', 'bob')]
+		expect(await save()).toBeUndefined()
+	})
+
+	it.each([
+		['a chain to another root', () => json({ cloudId: BOB.recipientCloudId, certificate: F.bobOtherRoot, chain: [F.intermediateB, F.rootB], partnerRootFingerprint: F.rootAFingerprint }), 'untrusted_root'],
+		['someone else\'s certificate', () => json({ cloudId: 'mallory@cloud.partner.example', certificate: F.mallory, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint }), 'name_mismatch'],
+		['garbage', () => json({ cloudId: BOB.recipientCloudId, certificate: 'garbage', chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint }), 'malformed'],
+		['a recipient the partner does not know', () => json({ message: 'unknown_recipient' }, 404), 'unknown_recipient'],
+		['an instance that is no partner any more', () => json({ message: 'not_a_partner' }, 403), 'not_a_partner'],
+		['a partner that served this server the wrong chain', () => json({ message: 'bad_chain' }, 502), 'bad_chain'],
+	])('suspends Bob\'s share for %s, sends him nothing, and names him on the note', async (_, answer, reason) => {
+		world.lookups[BOB.recipientCloudId] = answer
+		expect(await save({ opened: await openedX() })).toEqual({ scope: 'source', suspended: [BOB.recipientCloudId] })
+		expect(lastFinal().federated).toEqual([])
+		expect(lastFinal().suspend).toEqual([{ shareId: BOB.shareId, reason }])
+	})
+
+	it('verifies against the share\'s cloud id, not the one the lookup echoes back', async () => {
+		world.lookups[BOB.recipientCloudId] = () => json({ cloudId: 'mallory@cloud.partner.example', certificate: F.bob, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint })
+		expect(await save({ opened: await openedX() })).toBeUndefined()
+		expect(lastFinal().federated).toHaveLength(1)
+	})
+
+	it('stops on an unreachable partner, naming it, and sends nothing more', async () => {
+		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
+		expect(await failure(save({ opened: await openedX() }))).toEqual({ code: 'partner_unreachable', partners: [{ shareId: BOB.shareId, cloudId: BOB.recipientCloudId }] })
+		expect(saves).toHaveLength(1)
+	})
+
+	it('suspends an unreachable partner the user saves without, and names it on the note as paused', async () => {
+		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
+		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({ scope: 'source', paused: [BOB.recipientCloudId] })
+		expect(lastFinal().suspend).toEqual([{ shareId: BOB.shareId, reason: 'partner_unreachable' }])
+	})
+
+	it('names a paused and a suspended partner apart', async () => {
+		world.shares = [BOB, CAROL]
+		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
+		world.lookups[CAROL.recipientCloudId] = () => json({ message: 'unknown_recipient' }, 404)
+		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({ scope: 'source', suspended: [CAROL.recipientCloudId], paused: [BOB.recipientCloudId] })
+	})
+
+	it('stops again for a partner that fails only on Save without them, naming every partner it could not reach', async () => {
+		world.shares = [BOB, CAROL]
+		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
+		world.lookups[CAROL.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
+		expect(await failure(save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) }))).toEqual({
+			code: 'partner_unreachable', partners: [{ shareId: BOB.shareId, cloudId: BOB.recipientCloudId }, { shareId: CAROL.shareId, cloudId: CAROL.recipientCloudId }],
+		})
+		expect(saves).toHaveLength(1)
+	})
+
+	it('stops at the lookup limit without waiting or looking up further', async () => {
+		world.shares = Array.from({ length: 70 }, (_, i) => ({ shareId: `fs${i}`, recipientCloudId: `user${i}@cloud.partner.example` }))
+		let lookups = 0
+		for (const share of world.shares) {
+			world.lookups[share.recipientCloudId] = () => (++lookups > 60 ? json({ message: 'Too many requests' }, 429) : json({ message: 'unknown_recipient' }, 404))
+		}
+		expect(await failure(save({ opened: await openedX() }))).toEqual({ code: 'partner_lookup_limit' })
+		expect(lookups).toBe(61)
+		expect(saves).toHaveLength(1)
+	})
+
+	it.each([
+		['a 500', () => json({ message: 'Internal error' }, 500), 'server_error'],
+		['a Nextcloud too old for partner sharing', () => json({ message: 'federation_unavailable' }, 409), 'federation_unavailable'],
+		['another 409', () => json({ message: 'Conflict' }, 409), 'server_error'],
+		['a verdict reason with another status than its own', () => json({ message: 'not_a_partner' }, 404), 'not_found'],
+		['bad_chain with a 500', () => json({ message: 'bad_chain' }, 500), 'server_error'],
+		['no answer', () => Promise.reject(new TypeError('Failed to fetch')), 'offline'],
+		['a 200 without a certificate', () => json({ cloudId: BOB.recipientCloudId, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint }), 'server_error'],
+		['a 200 with a chain of one', () => json({ cloudId: BOB.recipientCloudId, certificate: F.bob, chain: [F.intermediateA], partnerRootFingerprint: F.rootAFingerprint }), 'server_error'],
+		['a 200 with a chain of other than text', () => json({ cloudId: BOB.recipientCloudId, certificate: F.bob, chain: [F.intermediateA, 42], partnerRootFingerprint: F.rootAFingerprint }), 'server_error'],
+		['a 200 without a pin', () => json({ cloudId: BOB.recipientCloudId, certificate: F.bob, chain: [F.intermediateA, F.rootA] }), 'server_error'],
+		['a 200 with a pin of other than 64 hex digits', () => json({ cloudId: BOB.recipientCloudId, certificate: F.bob, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: `${F.rootAFingerprint}0` }), 'server_error'],
+	])('fails on %s from this server and suspends nothing', async (_, answer, code) => {
+		world.lookups[BOB.recipientCloudId] = answer
+		expect(await failure(save({ opened: await openedX() }))).toEqual({ code })
+		expect(saves).toHaveLength(1)
+	})
+
+	it.each([
+		['is no key', [0x30, 0x03, 0x02, 0x01, 0x01]],
+		['is no SEQUENCE', [0x04, 0x00]],
+	])('fails with bad_certificate when the verified leaf\'s key %s, sending nothing more', async (_, spki) => {
+		vi.mocked(verifyFederatedCertificate).mockResolvedValueOnce({ fingerprint: 'ab'.repeat(32), spki: new Uint8Array(spki) })
+		expect(await failure(save({ opened: await openedX() }))).toEqual({ code: 'bad_certificate' })
+		expect(saves).toHaveLength(1)
+	})
+
+	it('fails with unreadable when what the form opened does not decrypt, before any lookup', async () => {
+		expect(await failure(save({ opened: await openedX({ shown: { key: await encrypt('x-password'), login: 'not-ciphertext', additionalFields: null } }) }))).toEqual({ code: 'unreadable' })
+		expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+	})
+
+	it('drops a partner share and a suspend the answer no longer requires', async () => {
+		world.shares = [BOB, CAROL]
+		world.lookups[CAROL.recipientCloudId] = () => json({ message: 'unknown_recipient' }, 404)
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.shares = []
+		}
+		expect(await save({ opened: await openedX() })).toBeUndefined()
+		expect(finalCalls().map((body) => [body.federated!.map((entry) => entry.shareId), body.suspend!.map((entry) => entry.shareId)])).toEqual([[[], []], [[BOB.shareId], [CAROL.shareId]], [[], []]])
+	})
+
+	it('starts a new stage when the answer drops a partner share already staged', async () => {
+		world.shares = Array.from({ length: 102 }, (_, i) => ({ shareId: `fs${i}`, recipientCloudId: `user${i}@cloud.partner.example` }))
+		for (const share of world.shares) world.lookups[share.recipientCloudId] = () => json({ message: 'unknown_recipient' }, 404)
+		world.onFinal = (attempt) => {
+			if (attempt === 2) world.shares = world.shares.slice(1)
+		}
+		await save({ opened: await openedX() })
+		const chunks = saves.filter((body) => body.stage?.final === false)
+		expect(chunks.map((chunk) => [chunk.suspend!.length, chunk.stage?.id])).toEqual([[100, undefined], [100, undefined]])
+		expect(chunks[1]!.suspend!.map((entry) => entry.shareId)).not.toContain('fs0')
+		const [first, second] = saves.filter((body) => body.stage?.final === true)
+		expect(second!.stage!.id).not.toBe(first!.stage!.id)
+		expect(second!.suspend).toHaveLength(1)
+	})
+
+	it('stages more than 100 partner shares like copies', async () => {
+		world.shares = Array.from({ length: 101 }, (_, i) => ({ shareId: `fs${i}`, recipientCloudId: `user${i}@cloud.partner.example` }))
+		for (const share of world.shares) world.lookups[share.recipientCloudId] = () => json({ message: 'unknown_recipient' }, 404)
+		await save({ opened: await openedX() })
+		expect(saves.filter((body) => body.stage?.final === false).map((body) => body.suspend!.length)).toEqual([100])
+		expect(lastFinal().suspend).toHaveLength(1)
+	})
+
+	it('ignores ownerOnly on the owner path', async () => {
+		world.shares = []
+		world.ownerOnly = true
+		expect(await save()).toBeUndefined()
+	})
+})
+
+describe('verified partner certificates', () => {
+	const unreachable = () => json({ message: 'partner_unreachable' }, 502)
+	const lookups = () => bodiesOf('POST /api/v1/federation/recipient-certificate').map((body) => body.cloudId)
+	const [bob, carol] = [BOB.recipientCloudId, CAROL.recipientCloudId]
+
+	beforeEach(() => {
+		world.shares = [BOB, CAROL]
+		world.lookups[carol] = unreachable
+	})
+
+	/** Bob verifies and Carol doesn't answer, so nothing is saved. */
+	async function failOnCarol(accountId = 'a1') {
+		expect(await failure(save({ accountId, opened: await openedX() }))).toMatchObject({ code: 'partner_unreachable' })
+	}
+	const saveWithoutCarol = async () => save({ opened: await openedX(), withoutUnreachable: new Set([CAROL.shareId]) })
+
+	it('uses Bob\'s for Save without them, and looks him up again after the save that used it went through', async () => {
+		await failOnCarol()
+		expect(await saveWithoutCarol()).toEqual({ scope: 'source', paused: [carol] })
+		expect(lookups()).toEqual([bob, carol, carol])
+		expect(lastFinal().federated!.map((entry) => entry.shareId)).toEqual([BOB.shareId])
+		await saveWithoutCarol()
+		expect(lookups()).toEqual([bob, carol, carol, bob, carol])
+	})
+
+	it('keeps it for 5 minutes from when it was verified', async () => {
+		const start = Date.now()
+		const clock = vi.spyOn(Date, 'now').mockReturnValue(start)
+		await failOnCarol()
+		clock.mockReturnValue(start + VERIFIED_PARTNER_TTL_MS - 1)
+		await failOnCarol()
+		expect(lookups()).toEqual([bob, carol, carol])
+		clock.mockReturnValue(start + VERIFIED_PARTNER_TTL_MS)
+		await failOnCarol()
+		expect(lookups()).toEqual([bob, carol, carol, bob, carol])
+	})
+
+	it('looks Bob up again when his share now names another cloud id', async () => {
+		await failOnCarol()
+		const moved = { ...BOB, recipientCloudId: 'bob@cloud.elsewhere.example' }
+		world.shares = [moved, CAROL]
+		expect(await saveWithoutCarol()).toEqual({ scope: 'source', suspended: [moved.recipientCloudId], paused: [carol] })
+		expect(lookups()).toEqual([bob, carol, moved.recipientCloudId, carol])
+	})
+
+	it('keeps them per account', async () => {
+		await failOnCarol('a2')
+		await saveWithoutCarol()
+		expect(lookups()).toEqual([bob, carol, bob, carol])
+	})
+
+	it('forgets them all on a lock', async () => {
+		await failOnCarol()
+		await clearKey('a1')
+		await saveWithoutCarol()
+		expect(lookups()).toEqual([bob, carol, bob, carol])
+	})
+
+	it('keeps nothing from a save a lock ran across', async () => {
+		world.lookups[carol] = async () => {
+			await clearKey('a1')
+			return unreachable()
+		}
+		await failOnCarol()
+		world.lookups[carol] = unreachable
+		await saveWithoutCarol()
+		expect(lookups()).toEqual([bob, carol, bob, carol])
+	})
+})
+
+describe('failures', () => {
+	it.each([
+		['a newer version', json({ error: 'stale', message: 'Stale', current: secretRow() }, 409), { code: 'conflict' }],
+		['its own refusal', json({ error: 'not_allowed', message: 'Only the owner…' }, 428), { code: 'forbidden' }],
+		['a bare refusal', json({ error: 'forbidden', message: 'A use-only copy cannot be changed' }, 428), { code: 'forbidden' }],
+		['a policy', json({ error: 'org_ownership_required', code: 'org_ownership_required', message: 'Policy' }, 428), { code: 'policy' }],
+		['a write lock', json({ error: 'write_locked', message: 'Locked' }, 423), { code: 'write_locked' }],
+		['a 400', json({ error: 'copy_fields_mismatch' }, 400), { code: 'invalid' }],
+	])('maps %s through writeError', async (_, answer, error) => {
+		world.onFinal = () => answer
+		expect(await failure(save())).toEqual(error)
+	})
+
+	it('fails as offline when the server stops answering after the first incomplete answer', async () => {
+		world.copies = [recipient('c-bob', 'bob')]
+		let answered = 0
+		fetchMock.mockImplementation(async (input, init) => {
+			const path = new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')
+			if (path.endsWith('/share-save') && ++answered > 1) throw new TypeError('Failed to fetch')
+			return route(init?.method ?? 'GET', path, init?.body ? JSON.parse(String(init.body)) : undefined)
+		})
+		expect(await failure(save())).toEqual({ code: 'offline' })
+		expect(answered).toBe(2)
+	})
+})
diff --git a/browser-extension/src/vault/share-save.ts b/browser-extension/src/vault/share-save.ts
new file mode 100644
index 000000000..c6d03c611
--- /dev/null
+++ b/browser-extension/src/vault/share-save.ts
@@ -0,0 +1,321 @@
+/** A value change of a possibly shared item in one `PUT /api/v1/secrets/{id}/share-save`, ported from the web app's `saveShared` (`src/services/shareSave.js`); the server's rules are in `ShareSaveService`. */
+import { ApiError, type Client } from '@/src/api/client'
+import { FederatedCertificateError, importPublicKey, importSpki, rsaDecrypt, rsaEncrypt, verifyFederatedCertificate, type VerifiedFederatedCertificate } from '@/src/crypto'
+import type { DecryptField, ShareSaveNote } from '@/src/messages'
+import { verifiedPartners } from './verified-partners'
+import { WriteFailure } from './write-error'
+
+export const VALUE_FIELDS: readonly DecryptField[] = ['key', 'login', 'additionalFields']
+
+/** `ShareSaveRequest::MAX_ENTRIES` per list pair, and `ShareController::MAX_RECIPIENT_PROBE`. */
+const BATCH = 100
+const MAX_ROUNDS = 3
+const COPY_EDITOR_GRADES = new Set(['owner', 'write', 'manage'])
+/**
+ * Lookup refusals that are a verdict on the recipient, with the status each comes with; the plain controller sends them only as `message`.
+ * `bad_chain` is the server's own check that the partner served an intermediate and a root.
+ */
+const PARTNER_GONE = new Map([['unknown_recipient', 404], ['not_a_partner', 403], ['bad_chain', 502]])
+
+const secretPath = (id: string) => `/api/v1/secrets/${encodeURIComponent(id)}`
+
+/** Plaintext or ciphertext per value field, `null` for an empty one. */
+export type Values = Partial<Record<DecryptField, string | null>>
+
+/** What an edit form opened: the ciphertext of each field it showed in full, the row version, and the source version `write-context` named. */
+export interface Opened {
+	shown: Values
+	updatedAt: string
+	sourceUpdatedAt: string | null
+}
+
+export interface WriteContext {
+	sourceSecretId: string
+	effectiveGrade: string
+	ownerCertificate: string | null
+	sourceUpdatedAt: string | null
+}
+
+export async function readWriteContext(client: Client, id: string): Promise<WriteContext> {
+	const context = await client.keepiq<Partial<Record<keyof WriteContext, unknown>> | null>('GET', `${secretPath(id)}/write-context`)
+	if (typeof context?.sourceSecretId !== 'string') throw new WriteFailure({ code: 'unknown' })
+	const text = (value: unknown) => (typeof value === 'string' && value ? value : null)
+	return {
+		sourceSecretId: context.sourceSecretId,
+		effectiveGrade: text(context.effectiveGrade) ?? 'none',
+		ownerCertificate: text(context.ownerCertificate),
+		sourceUpdatedAt: text(context.sourceUpdatedAt),
+	}
+}
+
+export interface ShareSaveInput {
+	accountId: string
+	id: string
+	/** The editor's own sparse patch, value fields already encrypted to the editor. */
+	patch: Record<string, unknown>
+	/** The patch's value fields as typed, `null` where cleared. */
+	plain: Values
+	baseUpdatedAt: string
+	/** The saving form's record; absent when it is gone or the save had no form. */
+	opened: Opened | undefined
+	withoutUnreachable: ReadonlySet<string>
+}
+
+interface RequiredCopy { secretId: string; holder: string; targetUserId: string | null }
+interface RequiredShare { shareId: string; recipientCloudId: string }
+
+const isString = (value: unknown): value is string => typeof value === 'string' && value !== ''
+const listOf = (value: unknown): unknown[] => (Array.isArray(value) ? value : [])
+
+function incompleteOf(body: unknown) {
+	const answer = body as { copies?: { required?: unknown; skipRefused?: unknown }; federated?: { required?: unknown } } | null
+	const copies = listOf(answer?.copies?.required).flatMap((row): RequiredCopy[] => {
+		const r = row as Partial<Record<keyof RequiredCopy, unknown>> | null
+		return isString(r?.secretId) ? [{ secretId: r.secretId, holder: String(r.holder), targetUserId: isString(r.targetUserId) ? r.targetUserId : null }] : []
+	})
+	const shares = listOf(answer?.federated?.required).flatMap((row): RequiredShare[] => {
+		const r = row as Partial<Record<keyof RequiredShare, unknown>> | null
+		return isString(r?.shareId) && isString(r.recipientCloudId) ? [{ shareId: r.shareId, recipientCloudId: r.recipientCloudId }] : []
+	})
+	return { copies, skipRefused: new Set(listOf(answer?.copies?.skipRefused).filter(isString)), shares }
+}
+
+/** The share-save's own refusals that read otherwise through `writeError`. */
+function refusalOf(error: unknown): unknown {
+	if (!(error instanceof ApiError)) return error
+	if (error.status === 409 && error.code === 'stale_source') return new WriteFailure({ code: 'stale_source' })
+	if (error.refused && error.code === 'not_allowed') return new WriteFailure({ code: 'forbidden' })
+	return error
+}
+
+/** Exactly the fields the patch carries, with the same null-ness, or the server refuses it (`copy_fields_mismatch`). */
+async function sealSparse(plain: Values, key: CryptoKey): Promise<Values> {
+	const sealed: Values = {}
+	for (const field of VALUE_FIELDS) {
+		const value = plain[field]
+		if (value !== undefined) sealed[field] = value === null ? null : await rsaEncrypt(value, key)
+	}
+	return sealed
+}
+
+async function sealWhole(value: Values, key: CryptoKey) {
+	return {
+		key: await rsaEncrypt(value.key ?? '', key),
+		login: value.login ? await rsaEncrypt(value.login, key) : null,
+		additionalFields: value.additionalFields ? await rsaEncrypt(value.additionalFields, key) : null,
+	}
+}
+
+type PartnerOutcome = { verified: VerifiedFederatedCertificate } | { suspend: string } | 'unreachable'
+
+/** Looks the partner recipient up and verifies the answer against the share's own cloud id, not the lookup's echo of it. */
+async function lookUp(client: Client, share: RequiredShare): Promise<PartnerOutcome> {
+	let answer: Record<string, unknown> | null
+	try {
+		answer = await client.keepiq('POST', '/api/v1/federation/recipient-certificate', { cloudId: share.recipientCloudId })
+	} catch (error) {
+		if (!(error instanceof ApiError)) throw error
+		if (error.status === 429) throw new WriteFailure({ code: 'partner_lookup_limit' })
+		if (error.status === 502 && error.message === 'partner_unreachable') return 'unreachable'
+		if (PARTNER_GONE.get(error.message) === error.status) return { suspend: error.message }
+		// This server failed, not the partner, so nothing is suspended; its 409 is its own refusal, as a Nextcloud too old for partner sharing, not a newer version.
+		if (error.status === 409) throw new WriteFailure({ code: error.message === 'federation_unavailable' ? 'federation_unavailable' : 'server_error' })
+		throw error
+	}
+	// `FederatedCertificateService::parseAnswer` guarantees this shape, and `FederationPartnerService::add` the pin's, so another is this server's fault, and a suspension can't be undone.
+	const chain = answer?.chain
+	const pin = answer?.partnerRootFingerprint
+	if (typeof answer?.certificate !== 'string' || !Array.isArray(chain) || chain.length !== 2 || !chain.every((pem) => typeof pem === 'string') || typeof pin !== 'string' || !/^[0-9a-f]{64}$/i.test(pin)) {
+		throw new WriteFailure({ code: 'server_error' })
+	}
+	try {
+		return { verified: await verifyFederatedCertificate({ certificate: answer.certificate, chain, partnerRootFingerprint: pin, cloudId: share.recipientCloudId }) }
+	} catch (error) {
+		if (error instanceof FederatedCertificateError) return { suspend: error.reason }
+		throw error
+	}
+}
+
+/** Resolves with the note the item's detail shows, or `undefined` when everyone got the change; a rejection wrote nothing, unless the reply to the final call was lost. */
+export async function shareSave(client: Client, privateKey: CryptoKey, input: ShareSaveInput): Promise<ShareSaveNote | undefined> {
+	const partners = verifiedPartners(input.accountId)
+	try {
+		const note = await save(client, privateKey, input, partners)
+		partners.succeeded()
+		return note
+	} catch (error) {
+		partners.failed()
+		throw error
+	}
+}
+
+async function save(client: Client, privateKey: CryptoKey, { id, patch, plain, baseUpdatedAt, opened, withoutUnreachable }: ShareSaveInput, partners: ReturnType<typeof verifiedPartners>): Promise<ShareSaveNote | undefined> {
+	const context = await readWriteContext(client, id)
+	const copyPath = context.sourceSecretId !== id
+	if (copyPath && !COPY_EDITOR_GRADES.has(context.effectiveGrade)) {
+		await client.keepiq('PUT', secretPath(id), { ...patch, baseUpdatedAt })
+		return { scope: 'own_copy' }
+	}
+	const sourceBaseUpdatedAt = opened?.sourceUpdatedAt ?? context.sourceUpdatedAt
+	let ownerCertificate = context.ownerCertificate
+
+	const copies = new Map<string, Values & { secretId: string }>()
+	const skipped = new Map<string, { secretId: string; reason: 'no_vault_key' }>()
+	const federated = new Map<string, Awaited<ReturnType<typeof sealWhole>> & { shareId: string; certFingerprint: string }>()
+	const suspend = new Map<string, { shareId: string; reason: string }>()
+	const cloudIds = new Map<string, string>()
+	const certificates = new Map<string, string | null>()
+	const keys = new Map<string, Promise<CryptoKey>>()
+	/** Holders whose skip the server refused and whose certificate was read again; once each. */
+	const reread = new Set<string>()
+	let whole: Values | undefined
+	let stage: { id: string | null; sent: Set<string> } = { id: null, sent: new Set() }
+
+	const keyOf = (certificate: string) => {
+		let key = keys.get(certificate)
+		if (!key) keys.set(certificate, key = importPublicKey(certificate).catch(() => {
+			throw new WriteFailure({ code: 'bad_certificate' })
+		}))
+		return key
+	}
+
+	/** The typed fields plus every other one as the form opened it in full; the server's rows are never decrypted for it (ADR-002). */
+	const wholeValue = async (): Promise<Values> => {
+		const value: Values = {}
+		// The form's ciphertext is the item's only at the version the save is checked against.
+		const current = opened && Date.parse(opened.updatedAt) === Date.parse(baseUpdatedAt)
+		for (const field of VALUE_FIELDS) {
+			if (plain[field] !== undefined) {
+				value[field] = plain[field]
+				continue
+			}
+			if (!current || !(field in opened.shown)) throw new WriteFailure({ code: 'unverified' })
+			const ciphertext = opened.shown[field]
+			try {
+				value[field] = ciphertext ? await rsaDecrypt(ciphertext, privateKey) : null
+			} catch (error) {
+				console.error('[keepiq] could not open', id, 'for its partner shares', error)
+				throw new WriteFailure({ code: 'unreadable' })
+			}
+		}
+		return value
+	}
+
+	const send = async (): Promise<unknown> => {
+		const unsent = <T>(map: Map<string, T>, prefix: string) => [...map].filter(([key]) => !stage.sent.has(prefix + key)).map(([key, entry]) => ({ key: prefix + key, entry }))
+		let local = [...unsent(copies, 'c:'), ...unsent(skipped, 's:')]
+		let remote = [...unsent(federated, 'f:'), ...unsent(suspend, 'p:')]
+		const pick = (part: Array<{ key: string; entry: object }>, prefix: string) => part.filter(({ key }) => key.startsWith(prefix)).map(({ entry }) => entry)
+		const lists = (localPart: typeof local, remotePart: typeof remote) => ({
+			copies: pick(localPart, 'c:'),
+			skipped: pick(localPart, 's:'),
+			...(copyPath ? {} : { federated: pick(remotePart, 'f:'), suspend: pick(remotePart, 'p:') }),
+		})
+		const envelope = { baseUpdatedAt, ...(copyPath ? { sourceBaseUpdatedAt } : {}) }
+		const url = `${secretPath(id)}/share-save`
+		// A chunk goes only while a list holds more than the bound, so each is full on that list and never empty.
+		while (local.length > BATCH || remote.length > BATCH) {
+			const localPart = local.slice(0, BATCH)
+			const remotePart = remote.slice(0, BATCH)
+			const answer = await client.keepiq<{ stageId?: unknown } | null>('PUT', url, { ...envelope, ...lists(localPart, remotePart), stage: stage.id ? { id: stage.id, final: false } : { final: false } })
+			if (!isString(answer?.stageId)) throw new WriteFailure({ code: 'unknown' })
+			stage.id = answer.stageId
+			for (const { key } of [...localPart, ...remotePart]) stage.sent.add(key)
+			local = local.slice(BATCH)
+			remote = remote.slice(BATCH)
+		}
+		return client.keepiq('PUT', url, { ...envelope, patch, ...lists(local, remote), ...(stage.id ? { stage: { id: stage.id, final: true } } : {}) })
+	}
+
+	type Drop = <T>(map: Map<string, T>, prefix: string, keep: (key: string) => boolean) => void
+
+	const fillPartners = async (required: RequiredShare[], drop: Drop) => {
+		const shareIds = new Set(required.map((share) => share.shareId))
+		drop(federated, 'f:', (key) => shareIds.has(key))
+		drop(suspend, 'p:', (key) => shareIds.has(key))
+		const todo = required.filter((share) => !federated.has(share.shareId) && !suspend.has(share.shareId))
+		if (todo.length === 0) return
+		const value = whole ??= await wholeValue()
+		const unreachable: RequiredShare[] = []
+		for (const share of todo) {
+			const kept = partners.get(share)
+			const outcome = kept ? { verified: kept } : await lookUp(client, share)
+			cloudIds.set(share.shareId, share.recipientCloudId)
+			if (outcome === 'unreachable') unreachable.push(share)
+			else if ('suspend' in outcome) suspend.set(share.shareId, { shareId: share.shareId, reason: outcome.suspend })
+			else {
+				const key = await importSpki(outcome.verified.spki).catch(() => {
+					throw new WriteFailure({ code: 'bad_certificate' })
+				})
+				if (!kept) partners.add(share, outcome.verified)
+				federated.set(share.shareId, { shareId: share.shareId, certFingerprint: outcome.verified.fingerprint, ...await sealWhole(value, key) })
+			}
+		}
+		// Only shares the user agreed to leave out are suspended; naming every unreachable one lets one Save without them cover them all.
+		if (unreachable.some((share) => !withoutUnreachable.has(share.shareId))) {
+			throw new WriteFailure({ code: 'partner_unreachable', partners: unreachable.map((share) => ({ shareId: share.shareId, cloudId: share.recipientCloudId })) })
+		}
+		for (const share of unreachable) suspend.set(share.shareId, { shareId: share.shareId, reason: 'partner_unreachable' })
+	}
+
+	const fill = async (body: unknown) => {
+		const required = incompleteOf(body)
+		let restage = false
+		// An entry already staged cannot be taken back, so dropping one starts a new stage.
+		const drop: Drop = (map, prefix, keep) => {
+			for (const key of [...map.keys()]) {
+				if (keep(key)) continue
+				map.delete(key)
+				restage ||= stage.sent.has(prefix + key)
+			}
+		}
+		const copyIds = new Set(required.copies.map((copy) => copy.secretId))
+		drop(copies, 'c:', (key) => copyIds.has(key))
+		drop(skipped, 's:', (key) => copyIds.has(key) && !required.skipRefused.has(key))
+		for (const holder of required.copies.filter((copy) => required.skipRefused.has(copy.secretId) && !reread.has(copy.secretId))) {
+			reread.add(holder.secretId)
+			if (holder.holder === 'owner') ownerCertificate = (await readWriteContext(client, id)).ownerCertificate
+			else if (holder.targetUserId) certificates.delete(holder.targetUserId)
+		}
+		const todo = required.copies.filter((copy) => !copies.has(copy.secretId) && !skipped.has(copy.secretId))
+		const lookups = [...new Set(todo.flatMap((copy) => (copy.holder !== 'owner' && copy.targetUserId && !certificates.has(copy.targetUserId) ? [copy.targetUserId] : [])))]
+		for (let i = 0; i < lookups.length; i += BATCH) {
+			const batch = lookups.slice(i, i + BATCH)
+			const answer = await client.keepiq<{ recipients?: unknown } | null>('POST', '/api/v1/shares/recipient-certificates', { userIds: batch })
+			for (const userId of batch) certificates.set(userId, null)
+			for (const row of listOf(answer?.recipients)) {
+				const r = row as { userId?: unknown; shareable?: unknown; certificate?: unknown } | null
+				if (isString(r?.userId) && r.shareable === true && isString(r.certificate)) certificates.set(r.userId, r.certificate)
+			}
+		}
+		for (const holder of todo) {
+			const certificate = holder.holder === 'owner' ? ownerCertificate : holder.targetUserId ? certificates.get(holder.targetUserId) : null
+			if (certificate) copies.set(holder.secretId, { secretId: holder.secretId, ...await sealSparse(plain, await keyOf(certificate)) })
+			else skipped.set(holder.secretId, { secretId: holder.secretId, reason: 'no_vault_key' })
+		}
+		if (!copyPath) await fillPartners(required.shares, drop)
+		if (restage) stage = { id: null, sent: new Set() }
+	}
+
+	let rounds = 0
+	let answer: unknown
+	for (;;) {
+		try {
+			answer = await send()
+			break
+		} catch (error) {
+			const restart = error instanceof ApiError && error.status === 404 && error.code === 'stage_unknown' && stage.id !== null
+			if (!restart && !(error instanceof ApiError && error.status === 409 && error.code === 'incomplete')) throw refusalOf(error)
+			if (++rounds >= MAX_ROUNDS) throw new WriteFailure({ code: 'incomplete' })
+			if (restart) stage = { id: null, sent: new Set() }
+			else await fill(error.body)
+		}
+	}
+	if (copyPath) return (answer as { federated?: { ownerOnly?: unknown } } | null)?.federated?.ownerOnly === true ? { scope: 'copy', ownerOnly: true } : undefined
+	// Those the user left out through Save without them get their own line, worded for a pause, not a verdict on the recipient.
+	const named = (paused: boolean) => [...suspend.values()].filter((entry) => (entry.reason === 'partner_unreachable') === paused).map((entry) => cloudIds.get(entry.shareId)!)
+	const suspended = named(false)
+	const paused = named(true)
+	if (suspended.length === 0 && paused.length === 0) return undefined
+	return { scope: 'source', ...(suspended.length > 0 && { suspended }), ...(paused.length > 0 && { paused }) }
+}
diff --git a/browser-extension/src/vault/verified-partners.test.ts b/browser-extension/src/vault/verified-partners.test.ts
new file mode 100644
index 000000000..3bccadac8
--- /dev/null
+++ b/browser-extension/src/vault/verified-partners.test.ts
@@ -0,0 +1,61 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { fakeBrowser } from 'wxt/testing/fake-browser'
+import { addAccount, setActive } from '@/src/accounts/store'
+import { suiteRow } from '@/src/testing/vectors'
+import { forgetVerifiedPartners, verifiedPartners } from './verified-partners'
+
+const BOB = { shareId: 'fs-bob', recipientCloudId: 'bob@cloud.partner.example' }
+const CAROL = { shareId: 'fs-carol', recipientCloudId: 'carol@cloud.partner.example' }
+const VERIFIED = { fingerprint: 'ab'.repeat(32), spki: new Uint8Array([1]) }
+
+/** A save of `accountId` that verified `share` and then failed or went through. */
+function saved(outcome: 'failed' | 'succeeded', accountId = 'a1', share = BOB) {
+	const save = verifiedPartners(accountId)
+	save.add(share, VERIFIED)
+	save[outcome]()
+}
+const kept = (accountId = 'a1', share = BOB) => verifiedPartners(accountId).get(share)
+
+const account = (uid: string) => addAccount({
+	serverUrl: 'https://cloud.example.org', uid, loginName: uid, displayName: uid, email: null, avatarDataUrl: null, appPassword: 'pw',
+}, { ...suiteRow })
+
+beforeEach(() => {
+	fakeBrowser.reset()
+	forgetVerifiedPartners()
+})
+
+describe('verifiedPartners', () => {
+	it('keeps what a failed save verified, and nothing a save that went through verified', () => {
+		saved('failed')
+		saved('succeeded', 'a1', CAROL)
+		expect(kept()).toEqual(VERIFIED)
+		expect(kept('a1', CAROL)).toBeUndefined()
+	})
+
+	it('drops only what a save that went through used', () => {
+		saved('failed')
+		saved('failed', 'a1', CAROL)
+		const save = verifiedPartners('a1')
+		save.get(BOB)
+		save.succeeded()
+		expect(kept()).toBeUndefined()
+		expect(kept('a1', CAROL)).toEqual(VERIFIED)
+	})
+
+	it('forgets them on an account switch, not on choosing the active account again', async () => {
+		const alice = await account('alice')
+		const bob = await account('bob')
+		saved('failed', bob.id)
+		await setActive(bob.id)
+		expect(kept(bob.id)).toEqual(VERIFIED)
+		await setActive(alice.id)
+		expect(kept(bob.id)).toBeUndefined()
+	})
+
+	it('forgets them when an added account becomes the active one', async () => {
+		saved('failed')
+		await account('alice')
+		expect(kept()).toBeUndefined()
+	})
+})
diff --git a/browser-extension/src/vault/verified-partners.ts b/browser-extension/src/vault/verified-partners.ts
new file mode 100644
index 000000000..1aef72517
--- /dev/null
+++ b/browser-extension/src/vault/verified-partners.ts
@@ -0,0 +1,46 @@
+/** Partner certificates a failed save verified, so Save without them or Try again doesn't look every partner up again against the lookup limit (the web app's `verifiedPartners`). Public material, in background memory only. */
+import type { VerifiedFederatedCertificate } from '@/src/crypto'
+
+export const VERIFIED_PARTNER_TTL_MS = 5 * 60 * 1000
+
+interface Kept { recipientCloudId: string; verified: VerifiedFederatedCertificate; at: number }
+interface Share { shareId: string; recipientCloudId: string }
+
+const kept = new Map<string, Kept>()
+/** Bumped by every forget, so a save that ran across one keeps nothing. */
+let epoch = 0
+
+const keyOf = (accountId: string, shareId: string) => `${accountId}\n${shareId}`
+
+/** On every lock, logout and account switch. */
+export function forgetVerifiedPartners(): void {
+	kept.clear()
+	epoch++
+}
+
+/** One save's view: what it may reuse, and what it verified, kept only when it fails. */
+export function verifiedPartners(accountId: string) {
+	const started = epoch
+	const used = new Map<string, Kept>()
+	const fresh = (entry: Kept) => Date.now() - entry.at < VERIFIED_PARTNER_TTL_MS
+	return {
+		get(share: Share): VerifiedFederatedCertificate | undefined {
+			const entry = kept.get(keyOf(accountId, share.shareId))
+			if (!entry || !fresh(entry) || entry.recipientCloudId !== share.recipientCloudId) return undefined
+			used.set(share.shareId, entry)
+			return entry.verified
+		},
+		add(share: Share, verified: VerifiedFederatedCertificate): void {
+			used.set(share.shareId, { recipientCloudId: share.recipientCloudId, verified, at: Date.now() })
+		},
+		/** The share got this save's value, so the next save looks it up again. */
+		succeeded(): void {
+			for (const shareId of used.keys()) kept.delete(keyOf(accountId, shareId))
+		},
+		failed(): void {
+			if (epoch !== started) return
+			for (const [key, entry] of kept) if (!fresh(entry)) kept.delete(key)
+			for (const [shareId, entry] of used) kept.set(keyOf(accountId, shareId), entry)
+		},
+	}
+}
diff --git a/browser-extension/src/vault/write-error.test.ts b/browser-extension/src/vault/write-error.test.ts
new file mode 100644
index 000000000..54b6e1030
--- /dev/null
+++ b/browser-extension/src/vault/write-error.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it, vi } from 'vitest'
+import { ApiError, Offline, SessionRevoked, VaultWriteLocked } from '@/src/api/client'
+import { WriteFailure, writeError } from './write-error'
+
+describe('writeError', () => {
+	it.each([
+		['our own refusal', new WriteFailure({ code: 'restricted' }), 'restricted'],
+		['a revoked session', new SessionRevoked(), 'session_revoked'],
+		['a key migration', new VaultWriteLocked(423, 'Locked'), 'write_locked'],
+		['no answer', new Offline(), 'offline'],
+		['a 400', new ApiError(400, 'Bad'), 'invalid'],
+		['a bare 428', new ApiError(428, 'Forbidden'), 'forbidden'],
+		['a 403 naming a policy', new ApiError(403, 'Policy', 'org_ownership_required'), 'policy'],
+		['a 404', new ApiError(404, 'Gone'), 'not_found'],
+		['a 409', new ApiError(409, 'Stale'), 'conflict'],
+		['a 502', new ApiError(502, 'Bad gateway'), 'server_error'],
+	])('maps %s', (_, error, code) => {
+		expect(writeError(error)).toEqual({ code })
+	})
+
+	it('logs what it cannot name', () => {
+		const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+		expect(writeError(new ApiError(429, 'Too many'))).toEqual({ code: 'unknown' })
+		expect(log).toHaveBeenCalled()
+	})
+})
diff --git a/browser-extension/src/vault/write-error.ts b/browser-extension/src/vault/write-error.ts
new file mode 100644
index 000000000..00a2bed93
--- /dev/null
+++ b/browser-extension/src/vault/write-error.ts
@@ -0,0 +1,27 @@
+/** The one mapping from a failed write to the code the popup words; share-save reports through it too. */
+import { ApiError, Offline, SessionRevoked, VaultWriteLocked } from '@/src/api/client'
+import type { VaultWriteError } from '@/src/messages'
+
+/** A refusal of our own, before or instead of a request. */
+export class WriteFailure extends Error {
+	constructor(readonly error: VaultWriteError) {
+		super(error.code)
+	}
+}
+
+export function writeError(error: unknown): VaultWriteError {
+	if (error instanceof WriteFailure) return error.error
+	if (error instanceof SessionRevoked) return { code: 'session_revoked' }
+	if (error instanceof VaultWriteLocked) return { code: 'write_locked' }
+	if (error instanceof Offline) return { code: 'offline' }
+	if (error instanceof ApiError) {
+		if (error.status === 400) return { code: 'invalid' }
+		// A blocked suite, a folder someone else owns and a read-only copy are all a bare refusal; only a policy names itself.
+		if (error.refused) return { code: error.code ? 'policy' : 'forbidden' }
+		if (error.status === 404) return { code: 'not_found' }
+		if (error.status === 409) return { code: 'conflict' }
+		if (error.status >= 500) return { code: 'server_error' }
+	}
+	console.error('[keepiq] write failed', error)
+	return { code: 'unknown' }
+}
diff --git a/browser-extension/src/vault/write.test.ts b/browser-extension/src/vault/write.test.ts
index 6822e34f1..4637d4c65 100644
--- a/browser-extension/src/vault/write.test.ts
+++ b/browser-extension/src/vault/write.test.ts
@@ -1,23 +1,35 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { fakeBrowser } from 'wxt/testing/fake-browser'
 import { addAccount, suiteKey } from '@/src/accounts/store'
-import { importPrivateKey, pemToPkcs8, rsaDecrypt, toBase64 } from '@/src/crypto'
-import type { ItemDraft } from '@/src/messages'
+import { importPrivateKey, pemToPkcs8, rsaDecrypt, toBase64, verifyFederatedCertificate } from '@/src/crypto'
+import { decodePem, extractSpki } from '@/src/crypto/rsa'
+import type { EditableItem, ItemDraft, WriteResult } from '@/src/messages'
 import { blockedRow, encrypt, folderRow, secretRow, typeRows } from '@/src/testing/vault'
-import { envelope, suiteRow } from '@/src/testing/vectors'
-import { hasKey, putKey } from './key-store'
+import { envelope, federationChain, suiteRow } from '@/src/testing/vectors'
+import { customField, diffDraft, formSections, fromItem, toDraft, type FormValues } from './fields'
+import { editOpenedKey, hasKey, putKey } from './key-store'
 import { readSnapshot, writeSnapshot } from './store'
 import { sync, syncStatus } from './sync'
 import type { VaultSnapshot } from './types'
 import { lock } from './unlock'
 import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, renameFolder, updateItem } from './write'
 
+vi.mock('@/src/crypto', async (importOriginal) => {
+	const actual = await importOriginal<typeof import('@/src/crypto')>()
+	return { ...actual, rsaDecrypt: vi.fn(actual.rsaDecrypt), rsaEncrypt: vi.fn(actual.rsaEncrypt), verifyFederatedCertificate: vi.fn(actual.verifyFederatedCertificate) }
+})
+
 const fetchMock = vi.fn<typeof fetch>()
 const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
 
 interface Sent { method: string; path: string; body: Record<string, unknown> | undefined }
 
-/** Routes by `METHOD /path`; the suites and manifest answer with the rows given, so post-write syncs succeed. */
+const SOURCE_AT = '2026-03-01T09:00:00+00:00'
+
+/**
+ * Routes by `METHOD /path`; the suites and manifest answer with the rows given, so post-write syncs succeed.
+ * Unrouted, `write-context` names the item its own source and a share-save finds it shared with nobody.
+ */
 function server(routes: Record<string, (sent: Sent) => Response | Promise<Response>> = {}, secrets = [secretRow()], suite = suiteRow) {
 	fetchMock.mockImplementation(async (input, init) => {
 		const url = new URL(String(input))
@@ -30,16 +42,18 @@ function server(routes: Record<string, (sent: Sent) => Response | Promise<Respon
 		if (route) return route(sent)
 		if (sent.path === '/api/v1/suites') return json([suite])
 		if (sent.path === '/api/v1/offline/manifest') return json({ suite, secrets, folders: [folderRow()], types: typeRows, syncedAt: '' })
+		const own = /^\/api\/v1\/secrets\/([^/]+)\/(write-context|share-save)$/.exec(sent.path)
+		if (own?.[2] === 'write-context' && sent.method === 'GET') return json({ sourceSecretId: decodeURIComponent(own[1]!), effectiveGrade: 'owner', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT })
+		if (own?.[2] === 'share-save' && sent.method === 'PUT') return json({ secret: secretRow(), federated: { ownerOnly: false } })
 		return json({ message: 'Not found' }, 404)
 	})
 }
 
 const sent = () => fetchMock.mock.calls.map(([input, init]) => `${init?.method ?? 'GET'} ${new URL(String(input)).pathname.replace('/index.php/apps/keepiq', '')}${new URL(String(input)).search}`)
 const writes = () => sent().filter((line) => !['GET /api/v1/offline/manifest', 'GET /api/settings/user', 'GET /api/v1/suites'].includes(line))
-const bodyOf = (line: string) => {
-	const index = sent().indexOf(line)
-	return JSON.parse(String(fetchMock.mock.calls[index]![1]!.body)) as Record<string, unknown>
-}
+const bodiesOf = (line: string) => fetchMock.mock.calls.filter((_, i) => sent()[i] === line).map(([, init]) => JSON.parse(String(init!.body)) as Record<string, unknown>)
+const bodyOf = (line: string) => bodiesOf(line)[0]!
+const lastBodyOf = (line: string) => bodiesOf(line).at(-1)!
 
 let accountId: string
 let privateKey: CryptoKey
@@ -53,6 +67,16 @@ async function snapshot(secrets: VaultSnapshot['secrets'] = [secretRow()]) {
 	})
 }
 
+/** What an edit fetch hands its form to save with. */
+const recordOf = (reply: WriteResult<EditableItem>) => (reply.ok ? reply.value.recordId : undefined)
+
+/** The edit forms' records in session storage, oldest first. */
+async function records(): Promise<Array<Record<string, unknown> & { id: string }>> {
+	const list = (await browser.storage.session.get(editOpenedKey(accountId)))[editOpenedKey(accountId)] as string | undefined
+	return JSON.parse(list ?? '[]') as Array<Record<string, unknown> & { id: string }>
+}
+const recordIds = async () => (await records()).map((entry) => entry.id)
+
 const draft = (overrides: Partial<ItemDraft> = {}): ItemDraft => ({
 	typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: 'f1', key: 'hunter2', login: 'alice', additionalFields: {}, ...overrides,
 })
@@ -61,6 +85,7 @@ beforeEach(async () => {
 	fakeBrowser.reset()
 	vi.stubGlobal('fetch', fetchMock)
 	fetchMock.mockReset()
+	vi.mocked(rsaDecrypt).mockClear()
 	vi.spyOn(console, 'error').mockImplementation(() => {})
 	accountId = (await addAccount({
 		serverUrl: 'https://cloud.example.org', uid: 'alice', loginName: 'alice', displayName: 'Alice', email: null, avatarDataUrl: null, appPassword: 'pw',
@@ -130,7 +155,7 @@ describe('createItem', () => {
 		server({ 'POST /api/v1/secrets': () => json(secretRow({ id: 'new' }), 201) })
 		vi.spyOn(console, 'error').mockImplementation(() => {})
 		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'key_mismatch' } })
-		expect(await updateItem('s1', { key: 'new' })).toEqual({ ok: false, error: { code: 'key_mismatch' } })
+		expect(await updateItem('s1', { key: 'new' }, secretRow().updatedAt)).toEqual({ ok: false, error: { code: 'key_mismatch' } })
 		expect(writes()).toEqual([])
 	})
 
@@ -151,22 +176,165 @@ describe('createItem', () => {
 })
 
 describe('fetchItem', () => {
-	it('decrypts the server row, not the cache', async () => {
-		const fresh = secretRow({ key: await encrypt('new password'), login: await encrypt('bob'), additionalFields: await encrypt('{"notes":"n","pin":1234}') })
-		server({ 'GET /api/v1/secrets/s1': () => json(fresh) })
+	/** The server answers with `row`, and the cache already holds it. */
+	async function serve(row: ReturnType<typeof secretRow>) {
+		await snapshot([row])
+		server({ 'GET /api/v1/secrets/s1': () => json(row) }, [row])
+	}
+
+	it('opens the server row without a sync when the cache holds its ciphertext', async () => {
+		const row = secretRow({ key: await encrypt('pw'), login: await encrypt('bob'), additionalFields: await encrypt('{"notes":"n","pin":1234}') })
+		await serve(row)
 		expect(await fetchItem('s1')).toEqual({
 			ok: true,
 			value: {
-				id: 's1', typeId: 't-login', name: 'GitHub', url: 'https://github.com', folderId: null,
-				key: 'new password', login: 'bob', additionalFields: { notes: 'n', pin: '1234' }, updatedAt: fresh.updatedAt,
+				id: 's1', typeId: 't-login', typeName: 'login', name: 'GitHub', url: 'https://github.com', folderId: null,
+				key: 'pw', login: 'bob', additionalFields: { notes: 'n', pin: '1234' }, updatedAt: row.updatedAt, recordId: expect.any(String),
 			},
 		})
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1', 'GET /api/v1/secrets/s1/write-context'])
+	})
+
+	it('records the ciphertext it showed, its version and the source version for an edit, and reads no source version for a clone', async () => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await serve(row)
+		await fetchItem('s1')
+		expect(await records()).toEqual([{ id: 's1', recordId: expect.any(String), shown: { key: row.key, login: null, additionalFields: null }, updatedAt: row.updatedAt, sourceUpdatedAt: SOURCE_AT }])
+		fetchMock.mockClear()
+		await fetchItem('s1', 'clone')
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1'])
+	})
+
+	it('names a new record for each edit form, and none for a clone', async () => {
+		await serve(secretRow({ key: await encrypt('pw') }))
+		const [first, second] = [recordOf(await fetchItem('s1')), recordOf(await fetchItem('s1'))]
+		expect(first).toEqual(expect.any(String))
+		expect(second).not.toBe(first)
+		expect(recordOf(await fetchItem('s1', 'clone'))).toBeUndefined()
+		expect(await recordIds()).toEqual(['s1', 's1'])
+	})
+
+	it('opens a newer row once the sync it starts brings that row into the cache', async () => {
+		const fresh = secretRow({ key: await encrypt('new password'), updatedAt: '2026-10-12T12:00:00+00:00' })
+		server({ 'GET /api/v1/secrets/s1': () => json(fresh) }, [fresh])
+		expect(await fetchItem('s1')).toMatchObject({ ok: true, value: { key: 'new password', updatedAt: fresh.updatedAt } })
+		expect(sent()).toContain('GET /api/v1/offline/manifest')
+	})
+
+	it.each(['edit', 'clone'] as const)('for %s, refuses ciphertext the cache still does not hold after a sync, without opening it', async (purpose) => {
+		// It would not decrypt, so opening it would read as `unreadable`.
+		server({ 'GET /api/v1/secrets/s1': () => json(secretRow({ key: 'not-ciphertext' })) })
+		expect(await fetchItem('s1', purpose)).toEqual({ ok: false, error: { code: 'conflict' } })
+		expect(sent().filter((line) => line === 'GET /api/v1/offline/manifest')).toHaveLength(1)
+	})
+
+	it.each([
+		['does not answer', () => Promise.reject(new TypeError('Failed to fetch')), 'offline'],
+		['answers 503', () => json({ message: 'Unavailable' }, 503), 'server_error'],
+		['finds the vault write-locked', () => json({ message: 'Vault is locked for writing' }, 423), 'write_locked'],
+	])('reports an outage, not a swapped item, when the sync it starts %s', async (_, manifest, code) => {
+		// It would not decrypt, so opening it would read as `unreadable`.
+		server({ 'GET /api/v1/secrets/s1': () => json(secretRow({ key: 'not-ciphertext' })), 'GET /api/v1/offline/manifest': manifest })
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code } })
+		expect(await browser.storage.session.get(editOpenedKey(accountId))).toEqual({})
+	})
+
+	it('fails an edit whose source version does not read, keeping nothing', async () => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		server({ 'GET /api/v1/secrets/s1': () => json(row), 'GET /api/v1/secrets/s1/write-context': () => json({ message: 'Unavailable' }, 503) }, [row])
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'server_error' } })
+		expect(await recordIds()).toEqual([])
+		expect(vi.mocked(rsaDecrypt)).not.toHaveBeenCalled()
+	})
+
+	it.each([
+		['the cache does not hold the item', [], { code: 'not_found' }],
+		['the cache holds it blocked', [secretRow({ encryptionSuiteId: 'suite-0' })], { code: 'blocked', reason: 'suite_revoked' }],
+	])('refuses a row when %s', async (_, manifest, error) => {
+		await snapshot([])
+		server({
+			'GET /api/v1/secrets/s1': () => json(secretRow()),
+			'GET /api/v1/suites': () => json([suiteRow, { ...suiteRow, id: 'suite-0', status: 'revoked' }]),
+		}, manifest)
+		expect(await fetchItem('s1')).toEqual({ ok: false, error })
+	})
+
+	it('never lets another item\'s values reach an edit or its save', async () => {
+		const x = secretRow({ key: await encrypt('x-password'), additionalFields: await encrypt('{"pin":"0000"}') })
+		const y = secretRow({ id: 's2', key: await encrypt('y-password'), additionalFields: await encrypt('{"recovery":"Y-RECOVERY-CODES","pin":"1234"}') })
+		await snapshot([x, y])
+		// Item Y's ciphertext under X's id.
+		server({ 'GET /api/v1/secrets/s1': () => json({ ...x, key: y.key, additionalFields: y.additionalFields }) }, [x, y])
+		const opened = await fetchItem('s1')
+		expect(opened).toEqual({ ok: false, error: { code: 'conflict' } })
+		expect(JSON.stringify(opened)).not.toContain('Y-RECOVERY-CODES')
+		expect(writes()).toEqual(['GET /api/v1/secrets/s1'])
+		expect(await recordIds()).toEqual([])
+	})
+
+	it('keeps what two forms opening at once each opened', async () => {
+		const x = secretRow({ key: await encrypt('x-password') })
+		const y = secretRow({ id: 's2', key: await encrypt('y-password') })
+		await snapshot([x, y])
+		server({ 'GET /api/v1/secrets/s1': () => json(x), 'GET /api/v1/secrets/s2': () => json(y) }, [x, y])
+		const set = browser.storage.session.set.bind(browser.storage.session)
+		// Slow writes, so the second form reads the list before the first writes it back.
+		vi.spyOn(browser.storage.session, 'set').mockImplementation(async (values) => {
+			await new Promise((resolve) => setTimeout(resolve, 50))
+			return set(values)
+		})
+		await Promise.all([fetchItem('s1'), fetchItem('s2')])
+		expect((await recordIds()).sort()).toEqual(['s1', 's2'])
+	})
+
+	it('keeps what the 10 newest edit forms opened, one entry per form', async () => {
+		const rows = await Promise.all(Array.from({ length: 11 }, async (_, i) => secretRow({ id: `s${i + 1}`, key: await encrypt(`password ${i + 1}`) })))
+		await snapshot(rows)
+		server(Object.fromEntries(rows.map((row) => [`GET /api/v1/secrets/${row.id}`, () => json(row)])), rows)
+		for (const row of [...rows, rows[5]!]) expect(await fetchItem(row.id)).toMatchObject({ ok: true })
+		expect(await recordIds()).toEqual(['s3', 's4', 's5', 's6', 's7', 's8', 's9', 's10', 's11', 's6'])
+	})
+
+	it('keeps nothing when a lock lands while it writes', async () => {
+		const x = secretRow({ key: await encrypt('x-password') })
+		await snapshot([x])
+		server({ 'GET /api/v1/secrets/s1': () => json(x) }, [x])
+		const set = browser.storage.session.set.bind(browser.storage.session)
+		vi.spyOn(browser.storage.session, 'set').mockImplementation(async (values) => {
+			if (editOpenedKey(accountId) in values) await lock(accountId)
+			return set(values)
+		})
+		await fetchItem('s1')
+		expect(await browser.storage.session.get(editOpenedKey(accountId))).toEqual({})
+	})
+
+	it('keeps nothing for a form that does not open', async () => {
+		await snapshot([secretRow({ key: 'not-ciphertext' })])
+		server({ 'GET /api/v1/secrets/s1': () => json(secretRow({ key: 'not-ciphertext' })) }, [secretRow({ key: 'not-ciphertext' })])
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'unreadable' } })
+		expect(await recordIds()).toEqual([])
+	})
+
+	it('keeps the id it was asked for, which the form saves to', async () => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		server({ 'GET /api/v1/secrets/s1': () => json({ ...row, id: 's2' }) }, [row])
+		expect(await fetchItem('s1')).toMatchObject({ ok: true, value: { id: 's1' } })
 	})
 
 	it('withholds a passkey credential', async () => {
-		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ typeId: 't-passkey', key: await encrypt('{"privateKey":"secret"}') })) })
+		await serve(secretRow({ typeId: 't-passkey', key: await encrypt('{"privateKey":"secret"}') }))
 		const reply = await fetchItem('s1')
-		expect(reply).toMatchObject({ ok: true, value: { key: '', keyWithheld: true } })
+		expect(reply).toMatchObject({ ok: true, value: { typeName: 'passkey', key: '' } })
+	})
+
+	it('withholds a passkey credential the server sends under another type', async () => {
+		const passkey = secretRow({ typeId: 't-passkey', key: await encrypt('{"privateKey":"secret"}') })
+		await snapshot([passkey])
+		server({ 'GET /api/v1/secrets/s1': () => json({ ...passkey, typeId: 't-login' }) }, [passkey])
+		// The passkey form, which offers no password a save would drop.
+		expect(await fetchItem('s1')).toMatchObject({ ok: true, value: { typeId: 't-login', typeName: 'passkey', key: '' } })
 	})
 
 	it('syncs on a refusal and names a row the sync found blocked by its reason', async () => {
@@ -184,7 +352,7 @@ describe('fetchItem', () => {
 	})
 
 	it('reports a row that does not open', async () => {
-		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ key: await encrypt('k'), additionalFields: await encrypt('[1]') })) })
+		await serve(secretRow({ key: await encrypt('k'), additionalFields: await encrypt('[1]') }))
 		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'unreadable' } })
 	})
 
@@ -193,7 +361,7 @@ describe('fetchItem', () => {
 		['a read-only copy from another organisation', { readOnly: true }, 'restricted', 'restricted'],
 		['an expiring copy', { accessExpiresAt: '2026-12-01T00:00:00+00:00' }, 'ok', 'restricted'],
 	])('opens %s for editing and cloning only as its limits allow', async (_, limits, edit, clone) => {
-		server({ 'GET /api/v1/secrets/s1': async () => json(secretRow({ key: await encrypt('pw'), ...limits })) })
+		await serve(secretRow({ key: await encrypt('pw'), ...limits }))
 		const outcome = async (purpose: 'edit' | 'clone') => {
 			const reply = await fetchItem('s1', purpose)
 			return reply.ok ? 'ok' : reply.error.code
@@ -210,19 +378,24 @@ describe('fetchItem', () => {
 })
 
 describe('updateItem', () => {
+	const BASE = secretRow().updatedAt
+
 	it('sends only the changed plaintext with the base version', async () => {
 		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
-		expect(await updateItem('s1', { name: 'GitHub work' }, '2026-03-02T10:00:00+00:00')).toEqual({ ok: true, value: { id: 's1' } })
-		expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ name: 'GitHub work', baseUpdatedAt: '2026-03-02T10:00:00+00:00' })
+		expect(await updateItem('s1', { name: 'GitHub work' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ name: 'GitHub work', baseUpdatedAt: BASE })
 	})
 
-	it('clears with null and encrypts what changed', async () => {
-		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
-		await updateItem('s1', { login: null, url: null, folderId: null, key: 'new', additionalFields: { pin: '1' } })
-		const body = bodyOf('PUT /api/v1/secrets/s1')
-		expect(body).toMatchObject({ login: null, url: null, folderId: null })
-		expect(await decrypt(body.key)).toBe('new')
-		expect(await decrypt(body.additionalFields)).toBe('{"pin":"1"}')
+	it('clears with null and encrypts what changed, with the base version beside the patch', async () => {
+		server()
+		await updateItem('s1', { login: null, url: null, folderId: null, key: 'new', additionalFields: { pin: '1' } }, BASE)
+		const body = bodyOf('PUT /api/v1/secrets/s1/share-save')
+		expect(body.baseUpdatedAt).toBe(BASE)
+		const patch = body.patch as Record<string, unknown>
+		expect(patch).toMatchObject({ login: null, url: null, folderId: null })
+		expect(patch).not.toHaveProperty('baseUpdatedAt')
+		expect(await decrypt(patch.key)).toBe('new')
+		expect(await decrypt(patch.additionalFields)).toBe('{"pin":"1"}')
 	})
 
 	it('never writes a passkey credential', async () => {
@@ -234,13 +407,19 @@ describe('updateItem', () => {
 
 	it('refuses an item the cache does not hold, since its type and limits are unknown', async () => {
 		server({ 'PUT /api/v1/secrets/elsewhere': () => json(secretRow()) })
-		expect(await updateItem('elsewhere', { key: '{}' })).toEqual({ ok: false, error: { code: 'not_found' } })
+		expect(await updateItem('elsewhere', { key: '{}' }, BASE)).toEqual({ ok: false, error: { code: 'not_found' } })
 		expect(writes()).toEqual([])
 	})
 
+	it('refuses a password, username or fields change without the version it was made from, before any request', async () => {
+		server()
+		expect(await updateItem('s1', { login: 'bob' })).toEqual({ ok: false, error: { code: 'invalid' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+
 	it('checks the suite once for all it encrypts', async () => {
-		server({ 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
-		await updateItem('s1', { key: 'new', login: 'bob', additionalFields: { pin: '1' } })
+		server()
+		await updateItem('s1', { key: 'new', login: 'bob', additionalFields: { pin: '1' } }, BASE)
 		expect(sent().filter((line) => line === 'GET /api/v1/suites')).toHaveLength(1)
 	})
 
@@ -261,7 +440,7 @@ describe('updateItem', () => {
 		expect(await updateItem('s1', { name: 'Mine now' })).toEqual({ ok: false, error: { code: 'restricted' } })
 		await snapshot([blockedRow({ id: 's1', readOnly: true })])
 		expect(await updateItem('s1', { name: 'Mine now' })).toEqual({ ok: false, error: { code: 'restricted' } })
-		expect(await updateItem('s1', { key: 'new' })).toEqual({ ok: false, error: { code: 'restricted' } })
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: false, error: { code: 'restricted' } })
 		expect(writes()).toEqual([])
 	})
 
@@ -270,6 +449,369 @@ describe('updateItem', () => {
 		expect(await updateItem('s1', { name: ' ' })).toEqual({ ok: false, error: { code: 'invalid' } })
 		expect(fetchMock).not.toHaveBeenCalled()
 	})
+
+	it('uses up its form\'s record on a save that changes no password, username or field', async () => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		server({ 'GET /api/v1/secrets/s1': () => json(row), 'PUT /api/v1/secrets/s1': () => json(row) }, [row])
+		const form = recordOf(await fetchItem('s1'))
+		expect(await recordIds()).toEqual(['s1'])
+		expect(await updateItem('s1', { name: 'Renamed' }, row.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1' } })
+		expect(await recordIds()).toEqual([])
+	})
+})
+
+describe('updateItem through share-save', () => {
+	const F = federationChain()
+	const BASE = secretRow().updatedAt
+	const BOB_COPY = { secretId: 'c-bob', holder: 'recipient', targetUserId: 'bob' }
+	const BOB = { shareId: 'fs-bob', recipientCloudId: 'bob@cloud.partner.example' }
+	const SHARE_SAVE = 'PUT /api/v1/secrets/s1/share-save'
+	const isShareSaveLine = (line: string) => line.includes('write-context') || line.includes('share-save') || line.includes('certificate')
+
+	interface Sharing { copies?: object[]; shares?: object[]; ownerOnly?: boolean }
+	interface Lists { copies: Array<{ secretId: string }>; skipped: Array<{ secretId: string }>; federated?: Array<{ shareId: string }>; suspend?: Array<{ shareId: string }> }
+
+	/** The certificate lookups and a share-save that requires `copies` and `shares`, answering `incomplete` until the lists name them all. */
+	const shared = ({ copies = [], shares = [], ownerOnly = false }: Sharing = {}) => ({
+		'POST /api/v1/shares/recipient-certificates': ({ body }: Sent) => json({ recipients: (body!.userIds as string[]).map((userId) => ({ userId, shareable: true, certificate: envelope.certificatePem })) }),
+		'POST /api/v1/federation/recipient-certificate': ({ body }: Sent) => json({ cloudId: body!.cloudId, certificate: F.bob, chain: [F.intermediateA, F.rootA], partnerRootFingerprint: F.rootAFingerprint }),
+		[SHARE_SAVE]: ({ body }: Sent) => {
+			const lists = body as unknown as Lists
+			const named = [...lists.copies, ...lists.skipped].length
+			const partners = [...lists.federated ?? [], ...lists.suspend ?? []].length
+			if (named !== copies.length || partners !== shares.length) return json({ error: 'incomplete', copies: { required: copies, skipRefused: [] }, federated: { required: shares } }, 409)
+			return json({ secret: secretRow(), federated: { ownerOnly } })
+		},
+	})
+
+	/** The partner gets ciphertext the test vectors' key opens, as if Bob's certificate held it. */
+	const partnerOpens = () => vi.mocked(verifyFederatedCertificate).mockResolvedValueOnce({ fingerprint: 'ab'.repeat(32), spki: extractSpki(decodePem(envelope.certificatePem).der) })
+	const partnerValue = async () => {
+		const [entry] = lastBodyOf(SHARE_SAVE).federated as Array<Record<string, unknown>>
+		return { key: await decrypt(entry!.key), login: entry!.login && await decrypt(entry!.login), additionalFields: entry!.additionalFields && await decrypt(entry!.additionalFields) }
+	}
+
+	it('saves a password change of an unshared item in one share-save, and replies once the vault sync holds it', async () => {
+		server()
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		const order = sent()
+		expect(order.filter(isShareSaveLine)).toEqual(['GET /api/v1/secrets/s1/write-context', SHARE_SAVE])
+		expect(order.indexOf(SHARE_SAVE)).toBeLessThan(order.lastIndexOf('GET /api/v1/offline/manifest'))
+		expect(order).not.toContain('PUT /api/v1/secrets/s1')
+	})
+
+	it('saves Bob\'s copy in the same request as the row, with no plain PUT and no sync of copies', async () => {
+		server(shared({ copies: [BOB_COPY] }))
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		const [first, second] = bodiesOf(SHARE_SAVE)
+		expect(first!.copies).toEqual([])
+		expect(await decrypt((second!.copies as Array<{ key: string }>)[0]!.key)).toBe('new')
+		expect(sent().filter((line) => line === 'PUT /api/v1/secrets/s1' || line.endsWith('/sync'))).toEqual([])
+	})
+
+	it.each([
+		['a rename', { name: 'Home wifi' }],
+		['a move', { folderId: 'f1' }],
+		['a URL change', { url: 'https://example.org' }],
+	])('saves %s with a plain PUT and no share-save', async (_, patch) => {
+		server({ ...shared({ copies: [BOB_COPY] }), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		expect(await updateItem('s1', patch, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		expect(sent().filter(isShareSaveLine)).toEqual([])
+	})
+
+	it('saves a passkey\'s name with a plain PUT, never its credential', async () => {
+		await snapshot([secretRow({ typeId: 't-passkey' })])
+		server({ ...shared({ copies: [BOB_COPY] }), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		expect(await updateItem('s1', { name: 'Renamed', key: '{}' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		expect(sent().filter(isShareSaveLine)).toEqual([])
+	})
+
+	it.each([
+		['the copy-editor path names partners only the owner reaches', { sourceSecretId: 'src', effectiveGrade: 'write' }, { ownerOnly: true }, { scope: 'copy', ownerOnly: true }],
+		['a read grade saves only the editor\'s copy', { sourceSecretId: 'src', effectiveGrade: 'read' }, {}, { scope: 'own_copy' }],
+	])('replies with the note when %s', async (_, context, sharing, note) => {
+		server({
+			...shared(sharing),
+			'GET /api/v1/secrets/s1/write-context': () => json({ ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT, ...context }),
+			'PUT /api/v1/secrets/s1': () => json(secretRow()),
+		})
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1', shareSave: note } })
+	})
+
+	it('saves through a copy with the source version its edit fetch read, not the one at save time', async () => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		let source = '2026-02-01T00:00:00+00:00'
+		server({
+			...shared({ copies: [{ secretId: 'src', holder: 'owner', targetUserId: null }] }),
+			'GET /api/v1/secrets/s1': () => json(row),
+			'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId: 'src', effectiveGrade: 'write', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: source }),
+		}, [row])
+		const form = recordOf(await fetchItem('s1'))
+		source = '2026-03-03T00:00:00+00:00'
+		await updateItem('s1', { key: 'new' }, row.updatedAt, undefined, form)
+		expect(bodiesOf(SHARE_SAVE).map((body) => body.sourceBaseUpdatedAt)).toEqual(['2026-02-01T00:00:00+00:00', '2026-02-01T00:00:00+00:00'])
+	})
+
+	it('replies to a save that reached Bob and suspended a partner with the partner\'s cloud id only, no ciphertext, plaintext or certificate', async () => {
+		const x = secretRow({ key: await encrypt('x-password') })
+		await snapshot([x])
+		server({
+			...shared({ copies: [BOB_COPY], shares: [BOB] }),
+			'GET /api/v1/secrets/s1': () => json(x),
+			'POST /api/v1/federation/recipient-certificate': () => json({ message: 'unknown_recipient' }, 404),
+		}, [x])
+		const form = recordOf(await fetchItem('s1'))
+		expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', suspended: [BOB.recipientCloudId] } } })
+		expect(lastBodyOf(SHARE_SAVE).copies).toHaveLength(1)
+	})
+
+	describe('a failed save', () => {
+		let x: ReturnType<typeof secretRow>
+		beforeEach(async () => {
+			x = secretRow({ key: await encrypt('x-password') })
+			await snapshot([x])
+		})
+
+		/** Opens the edit form against `routes` and saves a new password from it. */
+		async function saveFrom(routes: Record<string, (sent: Sent) => Response | Promise<Response>>, withoutUnreachable?: string[]) {
+			server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json(x), ...routes }, [x])
+			const form = recordOf(await fetchItem('s1'))
+			return updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form, withoutUnreachable)
+		}
+
+		it.each([
+			['a newer version', { [SHARE_SAVE]: () => json({ error: 'stale', message: 'Stale', current: secretRow() }, 409) }, { code: 'conflict' }],
+			['a newer source', { [SHARE_SAVE]: () => json({ error: 'stale_source', message: 'Stale source' }, 409) }, { code: 'stale_source' }],
+			['a share list that keeps changing', { [SHARE_SAVE]: () => json({ error: 'incomplete', copies: { required: [{ ...BOB_COPY, secretId: crypto.randomUUID() }], skipRefused: [] }, federated: { required: [] } }, 409) }, { code: 'incomplete' }],
+			['a certificate that does not import', { 'POST /api/v1/shares/recipient-certificates': () => json({ recipients: [{ userId: 'bob', shareable: true, certificate: 'garbage' }] }) }, { code: 'bad_certificate' }],
+			['an unreachable partner', { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'partner_unreachable' }, 502) }, { code: 'partner_unreachable', partners: [{ shareId: BOB.shareId, cloudId: BOB.recipientCloudId }] }],
+			['the partner lookup limit', { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'Too many' }, 429) }, { code: 'partner_lookup_limit' }],
+			['a Nextcloud too old for partner sharing', { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'federation_unavailable' }, 409) }, { code: 'federation_unavailable' }],
+			['a server that stops answering', { [SHARE_SAVE]: () => Promise.reject(new TypeError('Failed to fetch')) }, { code: 'offline' }],
+		])('reports %s, writes nothing more and keeps the form\'s record for the next save', async (_, routes, error) => {
+			expect(await saveFrom(routes)).toEqual({ ok: false, error })
+			expect(await recordIds()).toEqual(['s1'])
+		})
+
+		it('reports unverified for partners when the form\'s record is gone', async () => {
+			server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }) }, [x])
+			expect(await updateItem('s1', { key: 'new' }, x.updatedAt)).toEqual({ ok: false, error: { code: 'unverified' } })
+			expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+		})
+
+		it('saves without an unreachable partner the user named, suspending its share', async () => {
+			const unreachable = { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'partner_unreachable' }, 502) }
+			expect(await saveFrom(unreachable, [BOB.shareId])).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', paused: [BOB.recipientCloudId] } } })
+			expect(lastBodyOf(SHARE_SAVE).suspend).toEqual([{ shareId: BOB.shareId, reason: 'partner_unreachable' }])
+			expect(await recordIds()).toEqual([])
+		})
+
+		it('suspends a partner on the server\'s own 502 bad_chain, without going offline', async () => {
+			const badChain = { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'bad_chain' }, 502) }
+			expect(await saveFrom(badChain)).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', suspended: [BOB.recipientCloudId] } } })
+			expect(lastBodyOf(SHARE_SAVE).suspend).toEqual([{ shareId: BOB.shareId, reason: 'bad_chain' }])
+			expect(await syncStatus(accountId)).toMatchObject({ offline: false })
+		})
+
+		it('fails a lookup answer not in the server\'s shape without suspending or going offline', async () => {
+			const unshaped = { 'POST /api/v1/federation/recipient-certificate': () => json({ cloudId: BOB.recipientCloudId, chain: [] }) }
+			expect(await saveFrom(unshaped)).toEqual({ ok: false, error: { code: 'server_error' } })
+			expect(bodiesOf(SHARE_SAVE)).toHaveLength(1)
+			expect(await syncStatus(accountId)).toMatchObject({ offline: false })
+		})
+	})
+
+	describe('with a partner share', () => {
+		let x: ReturnType<typeof secretRow>
+
+		beforeEach(async () => {
+			x = secretRow({ key: await encrypt('x-password'), login: await encrypt('alice'), additionalFields: await encrypt('{"notes":"X notes"}') })
+			await snapshot([x])
+		})
+
+		/** The edit form's fetch, which the cache holds; returns the record its save names. */
+		async function openForm() {
+			server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json(x) }, [x])
+			const opened = await fetchItem('s1')
+			expect(opened).toMatchObject({ ok: true, value: { additionalFields: { notes: 'X notes' } } })
+			return recordOf(opened)
+		}
+
+		it('sends the partner the whole value as the edit form opened it, and uses up the form\'s record', async () => {
+			const form = await openForm()
+			partnerOpens()
+			expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1' } })
+			expect(await partnerValue()).toEqual({ key: 'new', login: 'alice', additionalFields: '{"notes":"X notes"}' })
+			// A second save from the same form, whose record the first used up.
+			expect(await updateItem('s1', { key: 'newer' }, x.updatedAt, undefined, form)).toEqual({ ok: false, error: { code: 'unverified' } })
+		})
+
+		it.each([
+			['another record', 'made-up'],
+			['no record', undefined],
+		])('fails partners as unverified on a save naming %s, though a form of the item opened', async (_, named) => {
+			await openForm()
+			expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, named)).toEqual({ ok: false, error: { code: 'unverified' } })
+			expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+		})
+
+		it('sends each of two forms of the item, opened at two versions, what it showed', async () => {
+			const first = await openForm()
+			const x2 = { ...x, additionalFields: await encrypt('{"notes":"X2 notes"}'), updatedAt: '2026-03-02T11:00:00+00:00' }
+			await snapshot([x2])
+			server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json(x2) }, [x2])
+			const second = recordOf(await fetchItem('s1'))
+			partnerOpens()
+			expect(await updateItem('s1', { key: 'new' }, x2.updatedAt, undefined, second)).toEqual({ ok: true, value: { id: 's1' } })
+			expect((await partnerValue()).additionalFields).toBe('{"notes":"X2 notes"}')
+			partnerOpens()
+			expect(await updateItem('s1', { key: 'newer' }, x.updatedAt, undefined, first)).toEqual({ ok: true, value: { id: 's1' } })
+			expect(await partnerValue()).toEqual({ key: 'newer', login: 'alice', additionalFields: '{"notes":"X notes"}' })
+		})
+
+		it('keeps what the form opened across a worker restart', async () => {
+			const form = await openForm()
+			vi.resetModules()
+			const restarted = await import('./write')
+			expect(await restarted.updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1' } })
+		})
+
+		it('sends the partner what the form opened, never another item\'s value a sync put in the cache since', async () => {
+			const y = secretRow({ id: 's2', additionalFields: await encrypt('{"recovery":"Y-RECOVERY-CODES"}') })
+			const swapped = { ...x, additionalFields: y.additionalFields }
+			await snapshot([x, y])
+			const form = await openForm()
+			server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }) }, [swapped, y])
+			await sync(accountId)
+			expect((await readSnapshot(accountId))?.secrets[0]).toMatchObject({ additionalFields: y.additionalFields })
+			partnerOpens()
+			expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toMatchObject({ ok: true })
+			expect((await partnerValue()).additionalFields).toBe('{"notes":"X notes"}')
+			expect(Object.keys((lastBodyOf(SHARE_SAVE).copies as object[])[0]!).sort()).toEqual(['key', 'secretId'])
+		})
+
+		describe('by what the edit form shows', () => {
+			const card = '{"number":"4111","expiry":"12/29","cvv":"","pin":"","cardholder":"Alice"}'
+			const identity = '{"firstName":"Alice","lastName":"Doe","address":"","phone":"","email":"","bsn":""}'
+			type Plain = { key: string; login?: string; additionalFields?: string }
+
+			/** Item `s1` of `type`, which a sync cached and the server serves alike. */
+			async function serveItem(type: string, plain: Plain) {
+				const row = secretRow({
+					typeId: `t-${type}`, key: await encrypt(plain.key), login: plain.login ? await encrypt(plain.login) : null,
+					additionalFields: plain.additionalFields ? await encrypt(plain.additionalFields) : null,
+				})
+				await snapshot([row])
+				server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json(row) }, [row])
+				return row
+			}
+
+			/** Opens the item as the popup does and saves what `edit` changes, through the form's own functions. */
+			async function editInForm(type: string, edit: (values: FormValues) => Partial<FormValues>, baseUpdatedAt: string) {
+				const opened = await fetchItem('s1')
+				if (!opened.ok) throw new Error(opened.error.code)
+				// The form renders by the type the fetch vouched under.
+				expect(opened.value.typeName).toBe(type)
+				const values = fromItem(opened.value, type)
+				const after = { ...values, ...edit(values) }
+				const patch = diffDraft(toDraft(values, type), toDraft(after, type))
+				expect(Object.keys(patch).length).toBeGreaterThan(0)
+				return { values: after, result: await updateItem('s1', patch, baseUpdatedAt, undefined, recordOf(opened)) }
+			}
+
+			const noteText = (values: FormValues) => ({ secret: `${values.secret} edited` })
+			const notes = () => ({ notes: 'edited' })
+
+			it.each([
+				['a card member the form has no field for', 'card', { key: card.replace('}', ',"recovery":"Y-BANK-PASSWORD"}') }, notes],
+				['a duplicate card member', 'card', { key: card.replace('"cvv":""', '"cvv":"Y-BANK-PASSWORD","cvv":""') }, notes],
+				['a duplicate additional field', 'login', { key: 'x-password', additionalFields: '{"pin":"Y-BANK-PASSWORD","pin":"1234"}' }, () => ({ secret: 'new' })],
+			] as const)('saves nothing for %s, before any partner lookup', async (_, type, plain, edit) => {
+				const row = await serveItem(type, plain)
+				expect((await editInForm(type, edit, row.updatedAt)).result).toEqual({ ok: false, error: { code: 'unverified' } })
+				expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+				expect(bodiesOf(SHARE_SAVE)).toHaveLength(1)
+			})
+
+			it.each([
+				['a note without a username', 'note', { key: 'Wifi: hunter2', additionalFields: '{}' }, noteText],
+				['a note with its username and notes, which the form shows', 'note', { key: 'Wifi: hunter2', login: 'alice', additionalFields: '{"notes":"Old"}' }, noteText],
+				['a TOTP item with its username', 'totp', { key: 'JBSWY3DPEHPK3PXP', login: 'alice' }, notes],
+				['a card whose members the form shows', 'card', { key: card, login: 'alice', additionalFields: '{"notes":"Old"}' }, notes],
+				['a card with members missing or a number, sent as it was', 'card', { key: '{"number":4111,"cardholder":"Alice"}' }, notes],
+				['a card key that is not JSON, which the form shows as one secret', 'card', { key: 'legacy card text' }, notes],
+				['an identity whose members the form shows', 'identity', { key: identity }, notes],
+				['an identity key that is a JSON array, which the form shows as one secret', 'identity', { key: '["Alice"]' }, notes],
+				['a login with its username', 'login', { key: 'x-password', login: 'alice', additionalFields: '{"pin":"1234"}' }, () => ({ secret: 'new' })],
+			] as const)('sends the partner %s', async (_, type, plain, edit) => {
+				const row = await serveItem(type, plain)
+				partnerOpens()
+				const { result } = await editInForm(type, edit, row.updatedAt)
+				expect(result).toEqual({ ok: true, value: { id: 's1' } })
+				// A key the save left alone goes to partners as the edit fetch recorded it, never re-serialized.
+				if (edit === notes) {
+					expect((await partnerValue()).key).toBe(plain.key)
+					expect(Object.keys((lastBodyOf(SHARE_SAVE).copies as object[])[0]!).sort()).toEqual(['additionalFields', 'secretId'])
+				}
+			})
+
+			it('counts a field shown in full only when the cached type shows it so too, not just the type the server sends', async () => {
+				const cached = secretRow({ typeId: 't-card', key: await encrypt(card.replace('}', ',"recovery":"Y-BANK-PASSWORD"}')) })
+				await snapshot([cached])
+				server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json({ ...cached, typeId: 't-login' }) }, [cached])
+				expect((await editInForm('login', notes, cached.updatedAt)).result).toEqual({ ok: false, error: { code: 'unverified' } })
+				expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
+			})
+
+			it('sends a note\'s notes member because the form shows it', async () => {
+				// Item Y's notes under note X, in the cache too, so the edit fetch opens them.
+				const row = await serveItem('note', { key: 'Wifi: hunter2', additionalFields: '{"notes":"Y-RECOVERY-CODES"}' })
+				const { values, result } = await editInForm('note', (opened) => ({ fields: [...opened.fields, customField('pin', '1')] }), row.updatedAt)
+				expect(result).toMatchObject({ ok: true })
+				const shown: Record<string, string> = Object.fromEntries(values.fields.map((field) => [field.name, field.value]))
+				if (formSections('note', values).notes) shown[values.notesKey ?? 'notes'] = values.notes
+				const copy = (lastBodyOf(SHARE_SAVE).copies as Array<Record<string, string>>)[0]!
+				expect(JSON.parse(await decrypt(copy.additionalFields))).toEqual(shown)
+				expect(shown).toMatchObject({ notes: 'Y-RECOVERY-CODES' })
+			})
+		})
+
+		describe('when session storage refuses a write', () => {
+			/** Fails each `storage.session.set` that writes `key`, as a full store does. */
+			function refuse(key: string) {
+				const set = browser.storage.session.set.bind(browser.storage.session)
+				vi.spyOn(browser.storage.session, 'set').mockImplementation(async (values) => {
+					if (key in values) throw new Error('QUOTA_BYTES quota exceeded')
+					return set(values)
+				})
+			}
+
+			it('still reports the save as one and syncs when it cannot drop what the form opened', async () => {
+				const form = await openForm()
+				refuse(editOpenedKey(accountId))
+				expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1' } })
+				expect(sent().lastIndexOf('GET /api/v1/offline/manifest')).toBeGreaterThan(sent().lastIndexOf(SHARE_SAVE))
+			})
+
+			it('opens the form without a record, so its save fails partners as unverified', async () => {
+				server({ ...shared({ copies: [BOB_COPY], shares: [BOB] }), 'GET /api/v1/secrets/s1': () => json(x) }, [x])
+				refuse(editOpenedKey(accountId))
+				const opened = await fetchItem('s1')
+				expect(opened).toMatchObject({ ok: true, value: { key: 'x-password' } })
+				expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, recordOf(opened))).toEqual({ ok: false, error: { code: 'unverified' } })
+			})
+		})
+	})
+
+	it('refuses for another account or a locked vault before any request', async () => {
+		server()
+		expect(await updateItem('s1', { key: 'new' }, BASE, 'another')).toEqual({ ok: false, error: { code: 'account_changed' } })
+		await lock(accountId)
+		expect(await updateItem('s1', { key: 'new' }, BASE, accountId)).toEqual({ ok: false, error: { code: 'locked' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
 })
 
 describe('errors and the offline flag', () => {
diff --git a/browser-extension/src/vault/write.ts b/browser-extension/src/vault/write.ts
index e1a85e8a1..609791be6 100644
--- a/browser-extension/src/vault/write.ts
+++ b/browser-extension/src/vault/write.ts
@@ -1,19 +1,17 @@
 /** Item and folder writes for the active account. All encryption happens here, never in the popup (ADR-004). */
-import { ApiError, createClient, Offline, SessionRevoked, VaultWriteLocked, type Client } from '@/src/api/client'
+import { ApiError, createClient, type Client } from '@/src/api/client'
 import type { CachedSuite, FolderRow, OpenSecretRow, SecretRow } from '@/src/api/types'
 import { getAccount, getActiveAccountId, suiteKey, type AccountRecord } from '@/src/accounts/store'
 import { importPublicKey, rsaDecrypt, rsaEncrypt, toBase64 } from '@/src/crypto'
-import type { EditableItem, FolderChildren, FolderDeletePlan, ItemDraft, ItemPatch, VaultWriteError, WriteResult } from '@/src/messages'
-import { getKey } from './key-store'
+import type { EditableItem, FolderChildren, FolderDeletePlan, ItemDraft, ItemPatch, ShareSaveNote, WriteResult } from '@/src/messages'
+import { fieldTexts, shownInFull } from './fields'
+import { editOpenedKey, getKey, hasKey, sessionValues } from './key-store'
 import { parseObject } from './payloads'
+import { readWriteContext, shareSave, VALUE_FIELDS, type Opened, type Values } from './share-save'
 import { readSnapshot } from './store'
 import { recordOutcome, syncAfterWrite } from './sync'
-
-class WriteFailure extends Error {
-	constructor(readonly error: VaultWriteError) {
-		super(error.code)
-	}
-}
+import type { StoredSecretRow } from './types'
+import { WriteFailure, writeError } from './write-error'
 
 interface Context {
 	account: AccountRecord
@@ -75,23 +73,6 @@ async function matchingKey(certificate: string, privateKey: CryptoKey): Promise<
 	return key
 }
 
-function writeError(error: unknown): VaultWriteError {
-	if (error instanceof WriteFailure) return error.error
-	if (error instanceof SessionRevoked) return { code: 'session_revoked' }
-	if (error instanceof VaultWriteLocked) return { code: 'write_locked' }
-	if (error instanceof Offline) return { code: 'offline' }
-	if (error instanceof ApiError) {
-		if (error.status === 400) return { code: 'invalid' }
-		// A blocked suite, a folder someone else owns and a read-only copy are all a bare refusal; only a policy names itself.
-		if (error.refused) return { code: error.code ? 'policy' : 'forbidden' }
-		if (error.status === 404) return { code: 'not_found' }
-		if (error.status === 409) return { code: 'conflict' }
-		if (error.status >= 500) return { code: 'server_error' }
-	}
-	console.error('[keepiq] write failed', error)
-	return { code: 'unknown' }
-}
-
 /** Runs one request, records whether the server answered, and replies once the sync holds the change. */
 async function run<T>(write: (context: Context) => Promise<T>, then: 'sync' | 'reply', accountId: string | undefined): Promise<WriteResult<T>> {
 	let ctx: Context
@@ -115,14 +96,99 @@ async function run<T>(write: (context: Context) => Promise<T>, then: 'sync' | 'r
 const secretPath = (id: string) => `/api/v1/secrets/${encodeURIComponent(id)}`
 const folderPath = (id: string) => `/api/v1/folders/${encodeURIComponent(id)}`
 
-async function typeNameOf(accountId: string, typeId: string | null): Promise<string | undefined> {
-	return (await readSnapshot(accountId))?.types.find((type) => type.id === typeId)?.name
+/** From one snapshot read, since a sync may rename types in between. */
+async function typeNamesOf(accountId: string, typeIds: Array<string | null>): Promise<Array<string | undefined>> {
+	const types = (await readSnapshot(accountId))?.types
+	return typeIds.map((typeId) => types?.find((type) => type.id === typeId)?.name)
 }
 
+const typeNameOf = async (accountId: string, typeId: string | null) => (await typeNamesOf(accountId, [typeId]))[0]
+
 function isRestricted(row: Pick<SecretRow, 'useOnly' | 'readOnly' | 'accessExpiresAt'>, purpose: 'edit' | 'clone'): boolean {
 	return row.useOnly === true || row.readOnly === true || (purpose === 'clone' && !!row.accessExpiresAt)
 }
 
+const cachedRow = async (accountId: string, id: string) => (await readSnapshot(accountId))?.secrets.find((secret) => secret.id === id)
+
+const holds = (cached: StoredSecretRow | undefined, row: OpenSecretRow): cached is OpenSecretRow =>
+	!!cached && !cached.blocked && VALUE_FIELDS.every((field) => (row[field] || null) === (cached[field] || null))
+
+/**
+ * Every item is encrypted to the same key, so a fetched ciphertext the cache does not hold for this item may be another's, and the form would save it back and share it as typed (ADR-002).
+ * One sync lets a row written since the last one through.
+ */
+async function cachedMatch(accountId: string, id: string, row: OpenSecretRow): Promise<OpenSecretRow> {
+	let cached = await cachedRow(accountId, id)
+	if (holds(cached, row)) return cached
+	// A sync never throws, so an outage would otherwise read as a swapped ciphertext.
+	const { lastError } = await syncAfterWrite(accountId)
+	if (lastError) throw new WriteFailure({ code: lastError === 'network' ? 'offline' : lastError === 'busy' ? 'write_locked' : 'server_error' })
+	cached = await cachedRow(accountId, id)
+	if (holds(cached, row)) return cached
+	if (!cached) throw new WriteFailure({ code: 'not_found' })
+	if (cached.blocked) throw new WriteFailure({ code: 'blocked', reason: cached.blockedReason })
+	console.error('[keepiq] the server answered', id, 'with ciphertext the vault does not hold for it; not opening it')
+	throw new WriteFailure({ code: 'conflict' })
+}
+
+/**
+ * What each edit form opened, by its `recordId`, for its save to send partners exactly that (`share-save.ts`).
+ * Not the cache, since a sync in between may put another item's ciphertext in the row (ADR-002). In session storage, since the MV3 worker stops while a form is open.
+ */
+type FormRecord = Opened & { id: string; recordId: string }
+
+/** A form closed without saving leaves its entry behind, and a ciphertext may be large. */
+const RECORD_LIMIT = 10
+
+/** The list is read, changed and written back, so two forms opening at once must not interleave. */
+let records: Promise<unknown> = Promise.resolve()
+function queued<T>(task: () => Promise<T>): Promise<T> {
+	const next = records.then(task)
+	records = next.catch(() => undefined)
+	return next
+}
+
+async function readRecords(key: string): Promise<FormRecord[]> {
+	try {
+		const list: unknown = JSON.parse(await sessionValues.get(key) ?? '[]')
+		return Array.isArray(list) ? list as FormRecord[] : []
+	} catch {
+		return []
+	}
+}
+
+/** Sets the record of one edit form, or drops it for `undefined`. */
+function swapRecord(accountId: string, id: string, recordId: string, value: Opened | undefined): Promise<void> {
+	return queued(async () => {
+		const key = editOpenedKey(accountId)
+		const list = await readRecords(key)
+		const others = list.filter((entry) => entry.id !== id || entry.recordId !== recordId)
+		if (!value && others.length === list.length) return
+		await sessionValues.set({ [key]: JSON.stringify((value ? [...others, { ...value, id, recordId }] : others).slice(-RECORD_LIMIT)) })
+		// A lock that cleared the list while this ran must not find it back.
+		if (!(await hasKey(accountId))) await sessionValues.remove([key])
+	})
+}
+
+async function findRecord(accountId: string, id: string, recordId: string): Promise<Opened | undefined> {
+	const entry = (await readRecords(editOpenedKey(accountId))).find((candidate) => candidate.id === id && candidate.recordId === recordId)
+	if (typeof entry?.shown !== 'object' || entry.shown === null || typeof entry.updatedAt !== 'string') return undefined
+	return { shown: entry.shown, updatedAt: entry.updatedAt, sourceUpdatedAt: typeof entry.sourceUpdatedAt === 'string' ? entry.sourceUpdatedAt : null }
+}
+
+/** Session storage may refuse a write, as when full; the form then opens or saves without its record. */
+function unrecorded(error: unknown): undefined {
+	console.error('[keepiq] could not update what an edit form opened; going without', error)
+	return undefined
+}
+
+/** Only what the form shows in full under the type it opens with and the cached one; an empty field hides nothing. */
+async function recordOpened(accountId: string, id: string, recordId: string, row: OpenSecretRow, typeNames: Array<string | undefined>, plain: Values, sourceUpdatedAt: string | null): Promise<void> {
+	const shown = VALUE_FIELDS.filter((field) => !row[field] || (plain[field] !== undefined && typeNames.every((name) => shownInFull(field, plain[field]!, name))))
+	// Refused, the form opens without it, and a save of it that needs the record for partners fails with `unverified`.
+	await swapRecord(accountId, id, recordId, { shown: Object.fromEntries(shown.map((field) => [field, row[field] || null])), updatedAt: row.updatedAt, sourceUpdatedAt }).catch(unrecorded)
+}
+
 /** Fresh from the server, not the cache: a stale `additionalFields` saved back would drop members (ADR-002). */
 export function fetchItem(id: string, purpose: 'edit' | 'clone' = 'edit', accountId?: string): Promise<WriteResult<EditableItem>> {
 	return run(async ({ account, client, privateKey }) => {
@@ -135,7 +201,7 @@ export function fetchItem(id: string, purpose: 'edit' | 'clone' = 'edit', accoun
 			// A row on a blocked suite is refused, not sent blocked; the sync marks it, with its reason as a code.
 			if (error instanceof ApiError && error.refused) {
 				await syncAfterWrite(account.id)
-				const cached = (await readSnapshot(account.id))?.secrets.find((secret) => secret.id === id)
+				const cached = await cachedRow(account.id, id)
 				if (cached?.blocked) throw new WriteFailure({ code: 'blocked', reason: cached.blockedReason })
 			}
 			throw error
@@ -143,27 +209,41 @@ export function fetchItem(id: string, purpose: 'edit' | 'clone' = 'edit', accoun
 		// A use-only value is never shown, a read-only copy never changed, and a clone of any
 		// restricted copy would be a permanent, unrestricted one (Keepiq `use-only-shares`, `expiring-shares`).
 		if (isRestricted(row, purpose)) throw new WriteFailure({ code: 'restricted' })
-		const passkey = await typeNameOf(account.id, row.typeId) === 'passkey'
+		const cached = await cachedMatch(account.id, id, row)
+		// The source version this edit is made from, which a save through a copy must name.
+		const sourceUpdatedAt = purpose === 'edit' ? (await readWriteContext(client, id)).sourceUpdatedAt : null
+		const typeNames = await typeNamesOf(account.id, [row.typeId, cached.typeId])
+		// Either side naming a passkey withholds it, so a swapped type id does not open the credential.
+		const passkey = typeNames.includes('passkey')
+		let item: EditableItem
+		let fields: string | null
 		try {
-			const additional = row.additionalFields ? parseObject(await rsaDecrypt(row.additionalFields, privateKey)) : {}
+			fields = row.additionalFields ? await rsaDecrypt(row.additionalFields, privateKey) : null
+			const additional = fields === null ? {} : parseObject(fields)
 			if (!additional) throw new Error('additionalFields is not an object')
-			const item: EditableItem = {
-				id: row.id,
+			item = {
+				// The id checked against the cache, since the form saves to this one.
+				id,
 				typeId: row.typeId ?? '',
+				// So the form never offers the withheld key for editing.
+				typeName: passkey ? 'passkey' : typeNames[0],
 				name: row.name,
 				url: row.url,
 				folderId: row.folderId,
 				key: passkey ? '' : await rsaDecrypt(row.key, privateKey),
 				login: row.login ? await rsaDecrypt(row.login, privateKey) : null,
-				additionalFields: Object.fromEntries(Object.entries(additional).map(([name, value]) => [name, typeof value === 'string' ? value : JSON.stringify(value)])),
+				additionalFields: fieldTexts(additional),
 				updatedAt: row.updatedAt,
 			}
-			if (passkey) item.keyWithheld = true
-			return item
 		} catch (error) {
 			console.error('[keepiq] could not open', id, 'for editing', error)
 			throw new WriteFailure({ code: 'unreadable' })
 		}
+		if (purpose === 'edit') {
+			item.recordId = crypto.randomUUID()
+			await recordOpened(account.id, id, item.recordId, row, typeNames, { key: passkey ? undefined : item.key, login: item.login, additionalFields: fields }, sourceUpdatedAt)
+		}
+		return item
 	}, 'reply', accountId)
 }
 
@@ -191,11 +271,14 @@ export function createItem(draft: ItemDraft, accountId?: string): Promise<WriteR
 	}, 'sync', accountId)
 }
 
-/** A sparse `PUT`: only what the patch holds is encrypted and sent. */
-export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string, accountId?: string): Promise<WriteResult<{ id: string }>> {
+/**
+ * A sparse save: only what the patch holds is encrypted and sent. A changed password, username or field goes through share-save, which writes every copy in the same request or nothing (`share-save.ts`);
+ * anything else is a plain `PUT`.
+ */
+export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string, accountId?: string, recordId?: string, withoutUnreachable: readonly string[] = []): Promise<WriteResult<{ id: string; shareSave?: ShareSaveNote }>> {
 	return run(async (ctx) => {
-		const { account, client } = ctx
-		const cached = (await readSnapshot(account.id))?.secrets.find((secret) => secret.id === id)
+		const { account, client, privateKey } = ctx
+		const cached = await cachedRow(account.id, id)
 		// Its limits and type decide what may be written, so an item the cache does not hold is not.
 		if (!cached) throw new WriteFailure({ code: 'not_found' })
 		// What the server enforces too, refused here so no ciphertext is made for it.
@@ -209,16 +292,31 @@ export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string,
 		if (patch.typeId) body.typeId = patch.typeId
 		if (patch.url !== undefined) body.url = patch.url || null
 		if (patch.folderId !== undefined) body.folderId = patch.folderId || null
-		let key: Promise<CryptoKey> | undefined
-		const encrypt = async (value: string) => rsaEncrypt(value, await (key ??= publicKey(ctx)))
+		// Kept as typed for the copies, which get it encrypted to each holder.
+		const plain: Values = {}
 		// A passkey's credential is only ever written by a passkey ceremony.
 		const passkey = await typeNameOf(account.id, cached.typeId) === 'passkey'
-		if (typeof patch.key === 'string' && !passkey) body.key = await encrypt(patch.key)
-		if (patch.login !== undefined) body.login = patch.login ? await encrypt(patch.login) : null
-		if (patch.additionalFields) body.additionalFields = await encrypt(JSON.stringify(patch.additionalFields))
-		if (baseUpdatedAt) body.baseUpdatedAt = baseUpdatedAt
-		await client.keepiq('PUT', secretPath(id), body)
-		return { id }
+		if (typeof patch.key === 'string' && !passkey) plain.key = patch.key
+		if (patch.login !== undefined) plain.login = patch.login || null
+		if (patch.additionalFields) plain.additionalFields = JSON.stringify(patch.additionalFields)
+		const valueChange = VALUE_FIELDS.some((field) => plain[field] !== undefined)
+		// share-save refuses a save without the version it was made from.
+		if (valueChange && !baseUpdatedAt) throw new WriteFailure({ code: 'invalid' })
+		let key: Promise<CryptoKey> | undefined
+		for (const field of VALUE_FIELDS) {
+			const value = plain[field]
+			if (value !== undefined) body[field] = value === null ? null : await rsaEncrypt(value, await (key ??= publicKey(ctx)))
+		}
+		let note: ShareSaveNote | undefined
+		if (valueChange) {
+			const opened = recordId ? await findRecord(account.id, id, recordId) : undefined
+			note = await shareSave(client, privateKey, { accountId: account.id, id, patch: body, plain, baseUpdatedAt: baseUpdatedAt!, opened, withoutUnreachable: new Set(withoutUnreachable) })
+		} else {
+			await client.keepiq('PUT', secretPath(id), baseUpdatedAt ? { ...body, baseUpdatedAt } : body)
+		}
+		// Its form closes; a failed save keeps it, so saving again still sends what the form showed.
+		if (recordId) await swapRecord(account.id, id, recordId, undefined).catch(unrecorded)
+		return note ? { id, shareSave: note } : { id }
 	}, 'sync', accountId)
 }
 
diff --git a/docs/browser-extension/using.md b/docs/browser-extension/using.md
index 9de1a4a0e..d72eff077 100644
--- a/docs/browser-extension/using.md
+++ b/docs/browser-extension/using.md
@@ -110,7 +110,16 @@ Passkeys are not added here; they are made when you sign up on a website with on
 
 A passkey item only lets you change its name, folder and website.
 
-An item someone shared with you keeps the limits they set. One shared for signing in only shows its user name but never its password or fields, and can't be edited, cloned or moved. One shared from another organisation can only be moved, and one whose access ends on a date can't be cloned. A password you change on an item you shared doesn't reach the people you shared it with yet; change it in the Keepiq web app so they get it too.
+An item someone shared with you keeps the limits they set. One shared for signing in only shows its user name but never its password or fields, and can't be edited, cloned or moved. One shared from another organisation can only be moved, and one whose access ends on a date can't be cloned.
+
+When you change the password, user name or fields of an item you own and shared, the extension saves it for everyone it is shared with in one go, directly, through a group or team folder, or at a partner organisation, before it says **Item saved**. Either everyone gets the change or nothing is saved: when a save fails, the form stays open with your change and the reason, and you save again. A new name, website or folder stays your own.
+
+- **Team editor or delegate:** when you edit an item through a team folder where you may write, or as the owner's delegate, the owner's item and the copies in your own organisation are updated too. Recipients at a partner organisation get it with the owner's next save, and the item says so.
+- **Partner organisation can't be reached:** nothing is saved, and the form names the recipients there. **Save without them** saves anyway and pauses sharing with them until the item is shared with them again, and the item says so.
+- **Partner certificate can't be verified, or their organisation no longer accepts the share:** sharing with them is paused, the save goes through, and the item says so; the Keepiq web app shows the share.
+- **Your server can't share with partner organisations:** an item shared with one can't be saved in the extension; ask your administrator.
+- **Part of the item the form doesn't show:** for an item shared with a partner organisation, such as a card with a detail the form has no field for, the extension can't confirm they would get the item exactly as you saw it, so nothing is saved; make the change in the Keepiq web app.
+- **Shared with you without the right to change it for everyone:** your change stays in your own copy, and the item says so.
 
 ### Deleting an item
 

From 49e3e74bd380b6cad061c20d0c3d48cd1f5bc5e1 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Fri, 16 Oct 2026 15:23:48 +0200
Subject: [PATCH 7/9] feat(extension): make a shared copy without edit rights
 view-only (ext-share-sync)

A copy whose write-context grade isn't owner, write or manage can no longer be edited. Before, the extension saved such an edit to that copy alone, leaving it out of step with the owner's and everyone else's. The item's detail asks `item.editable` and shows Edit as unavailable with the reason, while Clone and Move stay; the edit fetch and every save but a folder move refuse the copy with `view_only`, so the own-copy save and its note are gone.

The grade comes from the server alone, so group members become editors once Keepiq gives them the write grade (keepiq#1285), and a per-share permission (keepiq#1286) needs no client change. The web app's counterpart is keepiq#1287. privacy.md now also lists the edit check an item's detail sends and what a shared save sends.
---
 browser-extension/ARCHITECTURE.md             |   6 +-
 browser-extension/SECURITY.md                 |   2 +-
 .../entrypoints/popup/components/ItemCard.tsx |   7 +-
 .../popup/components/ShareSaveNote.test.tsx   |  14 +-
 .../popup/components/ShareSaveNote.tsx        |   1 -
 browser-extension/entrypoints/popup/errors.ts |   1 +
 .../entrypoints/popup/testing.ts              |   1 +
 .../popup/views/ItemDetail.test.tsx           |  51 ++++++-
 .../entrypoints/popup/views/ItemDetail.tsx    |  20 ++-
 .../entrypoints/popup/views/ItemForm.test.tsx |  24 ++-
 .../entrypoints/popup/views/Shell.test.tsx    |  20 +--
 browser-extension/locales/en.yml              |   2 +-
 browser-extension/locales/nl.yml              |   2 +-
 .../adr-003-keepiq-api-contract.md            |   2 +-
 .../ext-autofill/specs/login-capture/spec.md  |   2 +-
 .../openspec/changes/ext-share-sync/design.md |  26 ++--
 .../changes/ext-share-sync/proposal.md        |   8 +-
 .../ext-share-sync/specs/item-editing/spec.md |  26 ++++
 .../ext-share-sync/specs/share-sync/spec.md   |  35 +++--
 .../openspec/changes/ext-share-sync/tasks.md  |   8 +-
 .../src/background/requests.test.ts           |   6 +
 browser-extension/src/background/requests.ts  |   4 +-
 browser-extension/src/messages.ts             |   9 +-
 .../src/vault/share-save.test.ts              |  43 ++++--
 browser-extension/src/vault/share-save.ts     |  17 ++-
 browser-extension/src/vault/write.test.ts     | 142 +++++++++++++++---
 browser-extension/src/vault/write.ts          |  27 +++-
 docs/browser-extension/privacy.md             |   2 +
 docs/browser-extension/using.md               |   4 +-
 29 files changed, 397 insertions(+), 115 deletions(-)

diff --git a/browser-extension/ARCHITECTURE.md b/browser-extension/ARCHITECTURE.md
index 37eead68b..5c503ffe2 100644
--- a/browser-extension/ARCHITECTURE.md
+++ b/browser-extension/ARCHITECTURE.md
@@ -54,7 +54,7 @@ All types are in `src/messages.ts`. The background only answers extension pages;
 | --- | --- | --- |
 | Popup → background, account actions | `accounts.*`, `vault.unlock`, `vault.lock`, `vault.lockAll`, `vault.status` | `Result`: `{ ok: true, state }` or `{ ok: false, code }` |
 | Popup → background, vault requests | `vault.snapshot`, `vault.sync`, `item.decrypt`, `clipboard.copied`, `popup.popout`, `popup.lastTab.set`, `settings.*` | The typed reply in `PopupReplies`; `undefined` when the background failed |
-| Popup → background, writes | `item.fetch`, `item.create`, `item.update`, `item.delete`, `folder.create`, `folder.rename`, `folder.children`, `folder.delete`, `folder.dismissNotice` | `WriteResult`: `{ ok: true, value }` or `{ ok: false, error }`, after the sync that follows a write; `item.fetch` and `folder.children` reply without one |
+| Popup → background, writes | `item.fetch`, `item.editable`, `item.create`, `item.update`, `item.delete`, `folder.create`, `folder.rename`, `folder.children`, `folder.delete`, `folder.dismissNotice` | `WriteResult`: `{ ok: true, value }` or `{ ok: false, error }`, after the sync that follows a write; `item.fetch`, `item.editable` and `folder.children` reply without one |
 | Background → popup | `vault.changed`, `vault.locked` | None; the popup re-reads |
 | Background → offscreen | `offscreen.clearClipboard` | Whether it cleared |
 | Content → background | `page_ready` | None |
@@ -109,9 +109,9 @@ Where `storage.session` is missing (Firefox below 115), session values live in b
 
 - **The popup sends plaintext,** the background encrypts with the cached suite's certificate, once it proved that certificate matches the unlocked key and the server's active suite is still that one.
 - **Each write names its account,** and is refused when that is no longer the active one.
-- **Shared copies keep their limits** (use-only, read-only, expiring) in the popup and again in the background.
+- **Shared copies keep their limits** (use-only, read-only, expiring, view-only) in the popup and again in the background. A copy is view-only when `write-context` gives it no `owner`, `write` or `manage` grade; the detail asks with `item.editable` unless Edit is already unavailable, and the edit fetch and every save but a move refuse it.
 - **Edit and Clone fetch the item fresh** from the server and open it only when its ciphertext matches the vault cache, after one sync on a mismatch (ADR-002); Edit saves the changed fields with `baseUpdatedAt`, so a newer version is not overwritten, and with its fetch's `recordId`, so the save vouches only for what its own form showed.
-- **A changed `key`, `login` or `additionalFields` saves through share-save**, the editor's row and every other copy in one transaction: `write-context` picks the owner path (local copies and partner shares), the copy-editor path (the source and the other copies) or a plain `PUT` of the editor's copy only. The first call carries empty lists; a 409 `incomplete` names what to encrypt for, at most three rounds. Partners get the typed fields plus what the form's `editOpened` record showed, never a fresh row. Any other edit is a plain `PUT`.
+- **A changed `key`, `login` or `additionalFields` saves through share-save**, the editor's row and every other copy in one transaction: `write-context` picks the owner path (local copies and partner shares), or the copy-editor path (the source and the other copies). The first call carries empty lists; a 409 `incomplete` names what to encrypt for, at most three rounds. Partners get the typed fields plus what the form's `editOpened` record showed, never a fresh row. Any other edit is a plain `PUT`, after a `write-context` read unless it only moves the item.
 - **A refused save writes nothing** and keeps the form open; when the reply to the final call is lost, the server wrote everything or nothing. Nothing about a save outlives the request but verified partner certificates, kept in background memory for 5 minutes and forgotten on lock, logout and account switch, and the server's version check orders concurrent saves. The `item.update` reply carries `shareSave` when the item's detail has a note to show.
 - **Every write records** whether the server answered, which drives the same offline flag as sync.
 - **A successful write runs a full sync** and replies after it, waiting for a sync that started earlier.
diff --git a/browser-extension/SECURITY.md b/browser-extension/SECURITY.md
index ceea29594..e4a8ee0a3 100644
--- a/browser-extension/SECURITY.md
+++ b/browser-extension/SECURITY.md
@@ -69,7 +69,7 @@ There is no remote wipe, so these checks stand in for it:
 - Before it encrypts, the extension checks that the server's active key is still the one it holds, and proves the server's certificate belongs to your unlocked key. Otherwise nothing is written.
 - A save goes to the account the popup showed, and is refused when another window switched accounts.
 - Edit fetches the item fresh, sends only what changed, and is refused when a newer version was saved elsewhere. Edit and Clone only open what your vault already holds for that item, and a save gives partners the fields you didn't touch only as the form showed them in full, under the type the fetch checked. A swap while the form is open changes nothing partners get; a swap before the form opens is not caught (see Known limits, and [ADR-002](openspec/architecture/adr-002-key-lifetime-and-vault-cache.md#sharing)).
-- Shared copies keep their limits: a use-only copy is never shown, copied or changed, a read-only one can only be filed in a folder, and no restricted copy can be cloned.
+- Shared copies keep their limits: a use-only copy is never shown, copied or changed, a read-only one can only be filed in a folder, one shared to view only can't be changed but can be cloned or filed, and a use-only, read-only or expiring copy can't be cloned.
 - Delete moves an item to Keepiq's trash and ends its shares. A folder delete is immediate, and "Delete items too" deletes them for good.
 
 ## Shared items
diff --git a/browser-extension/entrypoints/popup/components/ItemCard.tsx b/browser-extension/entrypoints/popup/components/ItemCard.tsx
index 9a80bb110..07a500919 100644
--- a/browser-extension/entrypoints/popup/components/ItemCard.tsx
+++ b/browser-extension/entrypoints/popup/components/ItemCard.tsx
@@ -15,18 +15,19 @@ import { Menu, type MenuItem } from './Menu'
 /** Types whose `key` is a structured payload or a seed, not something to paste as a password. */
 const NO_PASSWORD = new Set(['totp', 'card', 'identity', 'passkey'])
 
-/** Edit, Clone, Move and Delete with the reason each is unavailable, for the More menu and item detail alike. */
-export function itemActions(item: ItemMeta, type: TypeMeta | undefined, offline: boolean, actions: ItemActions) {
+/** Edit, Clone, Move and Delete with the reason each is unavailable, for the More menu and item detail alike. `viewOnly`: the detail's `item.editable` answer, which the list does not ask. */
+export function itemActions(item: ItemMeta, type: TypeMeta | undefined, offline: boolean, actions: ItemActions, viewOnly = false) {
 	const offlineReason = offline ? i18n.t('form.offline') : undefined
 	const blockedReason = item.blocked ? i18n.t('blocked.generic') : undefined
 	const passkeyReason = type?.name === 'passkey' ? i18n.t('item.passkeyNoClone') : undefined
 	// The share's limits, which the background enforces too (Keepiq `use-only-shares`, `expiring-shares`).
 	const useOnly = item.useOnly ? i18n.t('item.useOnly') : undefined
 	const readOnly = item.readOnly ? i18n.t('item.readOnly') : undefined
+	const viewOnlyReason = viewOnly ? i18n.t('item.viewOnly') : undefined
 	const expiring = item.accessExpiresAt ? i18n.t('item.expiringNoClone', { date: new Date(item.accessExpiresAt).toLocaleDateString(language()) }) : undefined
 	return {
 		// Edit reads the item first and refuses there when offline, so it is not refused for that up front.
-		edit: { label: i18n.t('item.edit'), onSelect: () => actions.edit(item.id), disabledReason: blockedReason ?? useOnly ?? readOnly },
+		edit: { label: i18n.t('item.edit'), onSelect: () => actions.edit(item.id), disabledReason: blockedReason ?? useOnly ?? readOnly ?? viewOnlyReason },
 		clone: { label: i18n.t('item.clone'), onSelect: () => actions.clone(item.id), disabledReason: passkeyReason ?? blockedReason ?? useOnly ?? readOnly ?? expiring ?? offlineReason },
 		move: { label: i18n.t('item.move'), onSelect: () => actions.move(item), disabledReason: useOnly ?? offlineReason },
 		remove: { label: i18n.t('item.delete'), onSelect: () => actions.remove(item), disabledReason: offlineReason },
diff --git a/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx b/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
index f4dde280b..f4be6f790 100644
--- a/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
+++ b/browser-extension/entrypoints/popup/components/ShareSaveNote.test.tsx
@@ -15,10 +15,8 @@ const shown = (note: Note) => {
 
 describe('ShareSaveNote', () => {
 	it.each([
-		['en', { scope: 'own_copy' }, ['Only your copy changed. The owner and the others it is shared with keep the old value.']],
-		['nl', { scope: 'own_copy' }, ['Alleen jouw kopie is gewijzigd. De eigenaar en de anderen met wie het gedeeld is, houden de oude waarde.']],
-		['en', { scope: 'copy', ownerOnly: true }, ['Saved. Recipients at partner organisations get this change when the owner next saves it.']],
-		['nl', { scope: 'copy', ownerOnly: true }, ['Opgeslagen. Ontvangers bij partnerorganisaties krijgen deze wijziging zodra de eigenaar het item weer opslaat.']],
+		['en', { ownerOnly: true }, ['Saved. Recipients at partner organisations get this change when the owner next saves it.']],
+		['nl', { ownerOnly: true }, ['Opgeslagen. Ontvangers bij partnerorganisaties krijgen deze wijziging zodra de eigenaar het item weer opslaat.']],
 	] as const)('in %s, says %j', (locale, note, texts) => {
 		setLocale(locale)
 		expect(shown(note)).toEqual(texts)
@@ -29,7 +27,7 @@ describe('ShareSaveNote', () => {
 		['nl', 'Delen met bob@cloud.partner.example en carol@cloud.partner.example is gepauzeerd, omdat hun certificaat niet kon worden geverifieerd of hun organisatie de deling niet meer accepteert. De Keepiq-webapp toont de deling.', 'Open de Keepiq-webapp'],
 	] as const)('in %s, names the suspended partners in a list of that language, with a link to the web app', (locale, text, link) => {
 		setLocale(locale)
-		expect(shown({ scope: 'source', suspended: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text + link])
+		expect(shown({suspended: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text + link])
 		expect(screen.getByRole('link', { name: link }).getAttribute('href')).toBe(WEB_APP)
 	})
 
@@ -38,18 +36,18 @@ describe('ShareSaveNote', () => {
 		['nl', 'Delen met bob@cloud.partner.example en carol@cloud.partner.example is gepauzeerd tot je dit item opnieuw met hen deelt.'],
 	] as const)('in %s, names the partners saved without on a line of their own', (locale, text) => {
 		setLocale(locale)
-		expect(shown({ scope: 'source', paused: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text])
+		expect(shown({paused: ['bob@cloud.partner.example', 'carol@cloud.partner.example'] })).toEqual([text])
 	})
 
 	it('shows a suspended and a paused partner on two lines', () => {
 		setLocale('en')
-		expect(shown({ scope: 'source', suspended: ['bob@cloud.partner.example'], paused: ['carol@cloud.partner.example'] })).toEqual([
+		expect(shown({suspended: ['bob@cloud.partner.example'], paused: ['carol@cloud.partner.example'] })).toEqual([
 			expect.stringContaining('Sharing with bob@cloud.partner.example is paused, because'),
 			'Sharing with carol@cloud.partner.example is paused until you share this item with them again.',
 		])
 	})
 
 	it('shows nothing for a source save that suspended no one', () => {
-		expect(shown({ scope: 'source', suspended: [], paused: [] })).toEqual([])
+		expect(shown({suspended: [], paused: [] })).toEqual([])
 	})
 })
diff --git a/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx b/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
index 60fc63a6b..14d1789b2 100644
--- a/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
+++ b/browser-extension/entrypoints/popup/components/ShareSaveNote.tsx
@@ -7,7 +7,6 @@ import { Banner } from './ErrorBanner'
 export function ShareSaveNote({ note, webAppUrl }: { note: Note; webAppUrl: string }) {
 	return (
 		<>
-			{note.scope === 'own_copy' && <Banner tone="warning" role="status">{i18n.t('shareSave.ownCopy')}</Banner>}
 			{note.ownerOnly && <Banner tone="warning" role="status">{i18n.t('shareSave.ownerOnly')}</Banner>}
 			{note.suspended && note.suspended.length > 0 && (
 				<Banner tone="warning" role="status">
diff --git a/browser-extension/entrypoints/popup/errors.ts b/browser-extension/entrypoints/popup/errors.ts
index f8482061d..11a7658cf 100644
--- a/browser-extension/entrypoints/popup/errors.ts
+++ b/browser-extension/entrypoints/popup/errors.ts
@@ -58,6 +58,7 @@ export function writeErrorText(error: VaultWriteError | undefined, context: Writ
 		case 'blocked': return blockedText(error.reason)
 		case 'unreadable': return i18n.t('writeErrors.unreadable')
 		case 'restricted': return i18n.t('writeErrors.restricted')
+		case 'view_only': return i18n.t('item.viewOnly')
 		case 'key_mismatch': return i18n.t('writeErrors.keyMismatch')
 		case 'offline': return i18n.t('writeErrors.offline')
 		case 'server_error': return i18n.t('writeErrors.serverError')
diff --git a/browser-extension/entrypoints/popup/testing.ts b/browser-extension/entrypoints/popup/testing.ts
index ab7dff306..845680d60 100644
--- a/browser-extension/entrypoints/popup/testing.ts
+++ b/browser-extension/entrypoints/popup/testing.ts
@@ -103,6 +103,7 @@ export function fakeBackground(options: FakeBackground = {}) {
 			case 'item.create': return { ok: true, value: { id: 'new' } }
 			// A save that reached everyone carries no `shareSave`.
 			case 'item.update': return { ok: true, value: { id: message.id } }
+			case 'item.editable': return { ok: true, value: { editable: true } }
 			case 'item.delete':
 			case 'folder.rename':
 			case 'folder.delete': return { ok: true, value: null }
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
index 2d0bb84e0..da39dd348 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
@@ -4,7 +4,8 @@ import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { DecryptedItem, FolderMeta, ItemMeta, ShareSaveNote } from '@/src/messages'
 import { DEFAULT_SHELL, ShellContext } from '../shell-context'
-import { fakeBackground, fakeClipboard, itemMeta, sentKinds, types } from '../testing'
+import { setLocale } from '@/src/testing/i18n'
+import { fakeBackground, fakeClipboard, itemMeta, sentKinds, sentOf, types } from '../testing'
 import { ItemDetail } from './ItemDetail'
 
 // Shell's footer bar, where the detail portals Edit and Delete.
@@ -19,8 +20,8 @@ afterEach(() => {
 
 const folders: FolderMeta[] = [{ id: 'w', name: 'Work', parentId: null }, { id: 'c', name: 'Clients', parentId: 'w' }]
 
-function renderDetail(item: ItemMeta, decrypted?: DecryptedItem, decryptError?: 'locked' | 'use_only', offline = false) {
-	const sent = fakeBackground({ decrypted: decrypted && { [item.id]: decrypted }, decryptError })
+function renderDetail(item: ItemMeta, decrypted?: DecryptedItem, decryptError?: 'locked' | 'use_only', offline = false, editable?: unknown) {
+	const sent = fakeBackground({ decrypted: decrypted && { [item.id]: decrypted }, decryptError, replies: editable === undefined ? undefined : { 'item.editable': editable } })
 	const refreshState = vi.fn()
 	const launch = vi.fn()
 	const items = { add: vi.fn(), edit: vi.fn(), clone: vi.fn(), move: vi.fn(), remove: vi.fn() }
@@ -58,8 +59,8 @@ describe('share-save note', () => {
 	}
 
 	it('shows the note under the header', () => {
-		renderWith({ scope: 'own_copy' })
-		expect(document.querySelector('.banner--warning')?.textContent).toBe('Only your copy changed. The owner and the others it is shared with keep the old value.')
+		renderWith({ ownerOnly: true })
+		expect(document.querySelector('.banner--warning')?.textContent).toBe('Saved. Recipients at partner organisations get this change when the owner next saves it.')
 	})
 
 	it('shows none without one', () => {
@@ -368,6 +369,46 @@ describe('metadata and actions', () => {
 		expect(screen.getByRole('menuitem', { name: 'Clone' }).title).toMatch(/^Your access ends .*2026, so it cannot be cloned$/)
 	})
 
+	it.each([
+		['en', 'Shared with you to view only. Ask its owner for edit rights to change it.'],
+		['nl', 'Met je gedeeld om alleen te bekijken. Vraag de eigenaar om bewerkrechten om het te wijzigen.'],
+	] as const)('in %s, offers no edit of a view-only copy and says why, while Clone and Move stay', async (locale, reason) => {
+		setLocale(locale)
+		const { sent, items } = renderDetail(itemMeta(), undefined, undefined, false, { ok: true, value: { editable: false } })
+		const edit = within(footer).getByRole('button', { name: locale === 'en' ? 'Edit' : 'Bewerken' })
+		await vi.waitFor(() => expect(edit.getAttribute('aria-disabled')).toBe('true'))
+		expect(sentOf(sent, 'item.editable')).toEqual([{ kind: 'item.editable', accountId: 'a1', id: 'i1' }])
+		expect(edit.title).toBe(reason)
+		const user = userEvent.setup()
+		await user.click(edit)
+		expect(items.edit).not.toHaveBeenCalled()
+		await user.click(within(footer).getByRole('button', { name: locale === 'en' ? 'More, GitHub' : 'Meer, GitHub' }))
+		for (const menuitem of screen.getAllByRole('menuitem')) expect(menuitem.getAttribute('aria-disabled')).toBeNull()
+	})
+
+	it.each([
+		['before the answer arrives', () => new Promise(() => {})],
+		['when the request fails', { ok: false, error: { code: 'server_error' } }],
+		['when the background does not answer', () => undefined],
+	])('keeps Edit available %s', async (_, editable) => {
+		const { sent, items } = renderDetail(itemMeta(), undefined, undefined, false, editable)
+		await vi.waitFor(() => expect(sentKinds(sent)).toContain('item.editable'))
+		await new Promise((resolve) => setTimeout(resolve, 0))
+		const edit = within(footer).getByRole('button', { name: 'Edit' })
+		expect(edit.getAttribute('aria-disabled')).toBeNull()
+		await userEvent.setup().click(edit)
+		expect(items.edit).toHaveBeenCalledWith('i1')
+	})
+
+	it.each([
+		['a use-only', { useOnly: true }],
+		['a read-only', { readOnly: true }],
+	])('does not ask whether %s copy is editable', async (_, restriction) => {
+		const { sent } = renderDetail(itemMeta(restriction), { login: 'bob' }, undefined, false, { ok: true, value: { editable: false } })
+		await vi.waitFor(() => expect(sentKinds(sent)).toContain('item.decrypt'))
+		expect(sentKinds(sent)).not.toContain('item.editable')
+	})
+
 	it('cannot clone a passkey', async () => {
 		renderDetail(itemMeta({ typeId: 't-passkey' }))
 		await userEvent.setup().click(within(footer).getByRole('button', { name: 'More, GitHub' }))
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
index 7a145a66c..ac61afbfd 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
@@ -1,4 +1,4 @@
-import { useState, type ReactNode } from 'react'
+import { useEffect, useState, type ReactNode } from 'react'
 import { i18n } from '#i18n'
 import { USE_ONLY_FIELDS, type DecryptField, type DecryptedItem, type FolderMeta, type ItemMeta, type ShareSaveNote as Note, type TypeMeta } from '@/src/messages'
 import { typeIcon } from '@/src/vault/icons'
@@ -16,6 +16,7 @@ import { ShareSaveNote } from '../components/ShareSaveNote'
 import { TotpCode } from '../components/TotpCode'
 import { blockedText } from '../errors'
 import { useDecryptedFields } from '../hooks/useDecryptedFields'
+import { request } from '../hooks/useMessage'
 import { language } from '../i18n'
 import { useShell } from '../shell-context'
 
@@ -208,8 +209,21 @@ export function ItemDetail({ item, type, folders, webAppUrl, shareSave }: Props)
 	const [openedVersion] = useState(item.updatedAt)
 	const dates: Array<[string, string]> = [[i18n.t('detail.created'), item.createdAt], [i18n.t('detail.updated'), item.updatedAt]]
 	if (item.expiresAt) dates.push([i18n.t('detail.expires'), item.expiresAt])
-	const { items, offline } = useShell()
-	const actions = itemActions(item, type, offline, items)
+	const { accountId, items, offline } = useShell()
+	const [viewOnly, setViewOnly] = useState(false)
+	// Until it answers, or when it fails, Edit stays: the edit fetch and the save check again.
+	useEffect(() => {
+		// Edit is unavailable for these already, so the answer would change nothing.
+		if (item.blocked || item.useOnly || item.readOnly) return
+		let live = true
+		void request({ kind: 'item.editable', accountId, id: item.id }).then((reply) => {
+			if (live && reply?.ok) setViewOnly(!reply.value.editable)
+		})
+		return () => {
+			live = false
+		}
+	}, [accountId, item.id, item.blocked, item.useOnly, item.readOnly])
+	const actions = itemActions(item, type, offline, items, viewOnly)
 	return (
 		<div className="stack">
 			<header className="detail-head">
diff --git a/browser-extension/entrypoints/popup/views/ItemForm.test.tsx b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
index d3dd266fb..3f48afdb6 100644
--- a/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemForm.test.tsx
@@ -4,6 +4,7 @@ import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { EditableItem, FolderMeta } from '@/src/messages'
 import { CARD_FIELDS, IDENTITY_FIELDS, shownInFull } from '@/src/vault/fields'
+import { setLocale } from '@/src/testing/i18n'
 import { DEFAULT_SHELL, ShellContext } from '../shell-context'
 import { editableItem, fakeBackground, sentOf, snapshotReply, types, type UnlockedSnapshot } from '../testing'
 import { ItemForm, type FormMode } from './ItemForm'
@@ -235,7 +236,7 @@ describe('editing', () => {
 	})
 
 	it("hands the save's note to the shell", async () => {
-		const shareSave = { scope: 'own_copy' }
+		const shareSave = { ownerOnly: true }
 		const { onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: true, value: { id: 'i1', shareSave } } } })
 		await user.type(await screen.findByLabelText('Username'), '2')
 		await user.click(save())
@@ -377,6 +378,27 @@ describe('editing', () => {
 		expect(within(alert).queryByRole('button')).toBeNull()
 	})
 
+	it.each([
+		['en', 'Shared with you to view only. Ask its owner for edit rights to change it.'],
+		['nl', 'Met je gedeeld om alleen te bekijken. Vraag de eigenaar om bewerkrechten om het te wijzigen.'],
+	] as const)('in %s, says a copy became view-only since the form opened, keeping the values and offering no Try again', async (locale, text) => {
+		setLocale(locale)
+		const { onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() }, replies: { 'item.update': { ok: false, error: { code: 'view_only' } } } })
+		await user.type(await screen.findByLabelText(locale === 'en' ? 'Username' : 'Gebruikersnaam'), '2')
+		await user.click(within(footer).getByRole('button', { name: locale === 'en' ? 'Save' : 'Opslaan' }))
+		const alert = await screen.findByRole('alert')
+		expect(alert.textContent).toBe(text)
+		expect(within(alert).queryByRole('button')).toBeNull()
+		expect(field(locale === 'en' ? 'Username' : 'Gebruikersnaam').value).toBe('alice2')
+		expect(onSaved).not.toHaveBeenCalled()
+	})
+
+	it('says why a view-only copy does not open for editing', async () => {
+		renderForm({ mode: 'edit', id: 'i1', replies: { 'item.fetch': { ok: false, error: { code: 'view_only' } } } })
+		expect((await screen.findByRole('alert')).textContent).toBe('Shared with you to view only. Ask its owner for edit rights to change it.')
+		expect(screen.queryByLabelText('Name')).toBeNull()
+	})
+
 	it('clears an emptied username with null', async () => {
 		const { sent, onSaved, user } = renderForm({ mode: 'edit', id: 'i1', items: { i1: editableItem() } })
 		await user.clear(await screen.findByLabelText('Username'))
diff --git a/browser-extension/entrypoints/popup/views/Shell.test.tsx b/browser-extension/entrypoints/popup/views/Shell.test.tsx
index 135ae5914..e51a99b11 100644
--- a/browser-extension/entrypoints/popup/views/Shell.test.tsx
+++ b/browser-extension/entrypoints/popup/views/Shell.test.tsx
@@ -348,7 +348,8 @@ describe('the share-save note after a save', () => {
 	const footer = () => document.querySelector<HTMLElement>('.popup__footer')!
 	const toast = () => document.querySelector('.toast')?.textContent
 	const notes = () => [...document.querySelectorAll('.banner--warning')].map((banner) => banner.textContent)
-	const OWN_COPY = 'Only your copy changed. The owner and the others it is shared with keep the old value.'
+	const OWNER_ONLY_NOTE = { ownerOnly: true }
+	const OWNER_ONLY = 'Saved. Recipients at partner organisations get this change when the owner next saves it.'
 
 	/** Answers each save of i1 with the next of `shareSaves`; `undefined` is a save that reached everyone. */
 	function background(...shareSaves: unknown[]) {
@@ -384,10 +385,9 @@ describe('the share-save note after a save', () => {
 	})
 
 	it.each([
-		['only the editor\'s copy changed', { scope: 'own_copy' }, OWN_COPY],
-		['partners stay with the owner', { scope: 'copy', ownerOnly: true }, 'Saved. Recipients at partner organisations get this change when the owner next saves it.'],
-		['partners were suspended', { scope: 'source', suspended: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.Open the Keepiq web app'],
-		['partners were saved without', { scope: 'source', paused: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused until you share this item with them again.'],
+		['partners stay with the owner', OWNER_ONLY_NOTE, OWNER_ONLY],
+		['partners were suspended', {suspended: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.Open the Keepiq web app'],
+		['partners were saved without', {paused: ['bob@cloud.partner.example'] }, 'Sharing with bob@cloud.partner.example is paused until you share this item with them again.'],
 	])('notes on the item\'s detail that %s, beside "Item saved"', async (_, shareSave, text) => {
 		background(shareSave)
 		render(<App />)
@@ -397,13 +397,13 @@ describe('the share-save note after a save', () => {
 	})
 
 	it('keeps the note for that item, and drops it once another item\'s detail opens', async () => {
-		background({ scope: 'own_copy' })
+		background(OWNER_ONLY_NOTE)
 		render(<App />)
 		const user = userEvent.setup()
 		await editUsername(user)
 		await user.click(screen.getByRole('button', { name: 'Back' }))
 		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
-		expect(notes()).toEqual([OWN_COPY])
+		expect(notes()).toEqual([OWNER_ONLY])
 		await user.click(screen.getByRole('button', { name: 'Back' }))
 		await user.click(await screen.findByRole('button', { name: /^GitLab/ }))
 		expect(notes()).toEqual([])
@@ -413,7 +413,7 @@ describe('the share-save note after a save', () => {
 	})
 
 	it('shows no note in a reopened popup, and asks the background for none', async () => {
-		const { reopen } = background({ scope: 'own_copy' })
+		const { reopen } = background(OWNER_ONLY_NOTE)
 		render(<App />)
 		const user = userEvent.setup()
 		await editUsername(user)
@@ -424,11 +424,11 @@ describe('the share-save note after a save', () => {
 		await user.click(await screen.findByRole('button', { name: /^GitHub/ }))
 		expect((await title()).textContent).toBe('View item')
 		expect(notes()).toEqual([])
-		expect(sentKinds(sent).filter((kind) => !['vault.status', 'vault.snapshot', 'settings.get', 'item.decrypt', 'popup.lastTab.set'].includes(kind))).toEqual([])
+		expect(sentKinds(sent).filter((kind) => !['vault.status', 'vault.snapshot', 'settings.get', 'item.decrypt', 'item.editable', 'popup.lastTab.set'].includes(kind))).toEqual([])
 	})
 
 	it('drops the note once a later save of the item reaches everyone', async () => {
-		const { sent } = background({ scope: 'own_copy' }, undefined)
+		const { sent } = background(OWNER_ONLY_NOTE, undefined)
 		render(<App />)
 		const user = userEvent.setup()
 		await editUsername(user)
diff --git a/browser-extension/locales/en.yml b/browser-extension/locales/en.yml
index 39c96f9fd..1ab06487d 100644
--- a/browser-extension/locales/en.yml
+++ b/browser-extension/locales/en.yml
@@ -142,6 +142,7 @@ item:
   passkeyNoClone: Passkeys cannot be cloned
   useOnly: Shared with you for signing in only
   readOnly: Shared from another organisation, so it can only be moved
+  viewOnly: Shared with you to view only. Ask its owner for edit rights to change it.
   expiringNoClone: Your access ends {date}, so it cannot be cloned
   saved: Item saved
   deleted: Item moved to the trash
@@ -217,7 +218,6 @@ writeErrors:
 
 shareSave:
   saveWithout: Save without them
-  ownCopy: Only your copy changed. The owner and the others it is shared with keep the old value.
   ownerOnly: Saved. Recipients at partner organisations get this change when the owner next saves it.
   suspended: Sharing with {cloudIds} is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.
   paused: Sharing with {cloudIds} is paused until you share this item with them again.
diff --git a/browser-extension/locales/nl.yml b/browser-extension/locales/nl.yml
index ec8e2ec52..a87595f99 100644
--- a/browser-extension/locales/nl.yml
+++ b/browser-extension/locales/nl.yml
@@ -141,6 +141,7 @@ item:
   passkeyNoClone: Passkeys kun je niet klonen
   useOnly: Alleen met je gedeeld om in te loggen
   readOnly: Gedeeld vanuit een andere organisatie, dus je kunt het alleen verplaatsen
+  viewOnly: Met je gedeeld om alleen te bekijken. Vraag de eigenaar om bewerkrechten om het te wijzigen.
   expiringNoClone: Je toegang stopt op {date}, dus je kunt het niet klonen
   saved: Item opgeslagen
   deleted: Item naar de prullenbak verplaatst
@@ -216,7 +217,6 @@ writeErrors:
 
 shareSave:
   saveWithout: Opslaan zonder hen
-  ownCopy: Alleen jouw kopie is gewijzigd. De eigenaar en de anderen met wie het gedeeld is, houden de oude waarde.
   ownerOnly: Opgeslagen. Ontvangers bij partnerorganisaties krijgen deze wijziging zodra de eigenaar het item weer opslaat.
   suspended: Delen met {cloudIds} is gepauzeerd, omdat hun certificaat niet kon worden geverifieerd of hun organisatie de deling niet meer accepteert. De Keepiq-webapp toont de deling.
   paused: Delen met {cloudIds} is gepauzeerd tot je dit item opnieuw met hen deelt.
diff --git a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
index 98d174968..7318fa9be 100644
--- a/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
+++ b/browser-extension/openspec/architecture/adr-003-keepiq-api-contract.md
@@ -28,7 +28,7 @@ All paths relative to the base URL. All require the Basic auth above unless mark
 | Secret CRUD | `GET/PUT/DELETE /api/v1/secrets/{id}`, `POST /api/v1/secrets` | Create takes `name` (required), `key` (required ciphertext), `url`, `typeId`, `folderId`, `login`, `additionalFields`; returns 201 with the row. `name` is at most 255 characters. `PUT` is a sparse patch: only fields present in the body change, `null` clears a field. With `baseUpdatedAt` it answers 409 when the stored `updatedAt` differs (whole seconds); without it the last write wins. Since 2026-09-30 `DELETE` moves the secret to the trash (`trashed_at`) and revokes every share of it, returning `{"status":"deleted","trashed":true}`; `POST …/restore` and `DELETE …/purge` restore or purge it, and a daily job purges after the admin's `trash_retention_days` (default 30). Trashed secrets are left out of lists and the manifest. |
 | Refusals | any route | The OCS controllers (secrets, folders, the manifest, suites, types) refuse with 428, not 403: Nextcloud turns a 403 there into an HTTP 200 envelope, so `OcsRefusalMiddleware` re-statuses it. The body keeps `message` and adds `error`, a vault policy's code or else `forbidden`. Plain controllers (`DELETE /api/v1/secrets/{id}`, settings) still answer 403, with a policy's `code` when there is one. A blocked suite, a folder someone else owns and a read-only copy all come without a code, so clients cannot tell those apart. The web app treats both statuses alike (`src/utils/refusal.js`). The middleware's comment cites measurements on Nextcloud 35 from 2026-10-04; the manifest's 428 was checked on the stable35 dev server on 2026-10-12. The key-proof guard (`VaultKeyProofMiddleware`) also answers 428, with `error: key_proof_required`, but on none of the routes the extension calls. |
 | Folders | `GET/POST /api/v1/folders`, `GET /api/v1/folders/{id}/children`, `PUT/DELETE /api/v1/folders/{id}` | Names are trimmed and refuse `/`; a duplicate sibling is 409. Children: `{directSecretCount, subfolders: [{id, name, secretCount, subfolderCount}]}`. Delete: an empty folder needs nothing, a leaf with items `?cascade=delete|move` (409 without), a folder with subfolders a JSON body `{directSecrets: 'delete'|'move', subfolders: {<id>: 'delete'|'move'|'keep'}}` naming every direct subfolder (409 without, 400 when one is missing). Folder deletes are immediate, with no trash, and count and delete archived and trashed items too. They are all or nothing: a refusal, such as a kept subfolder whose name is taken one level up (409), comes before anything is moved or purged (keepiq#1248). |
-| Write context | `GET /api/v1/secrets/{id}/write-context` | `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId` equal to `id` means the caller's own item; otherwise `effectiveGrade` `owner` (a delegate), `write` or `manage` may save for every copy, anything else only their own. `ownerCertificate` is `null` when the owner has no active suite. 404 when the secret is gone. |
+| Write context | `GET /api/v1/secrets/{id}/write-context` | `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId` equal to `id` means the caller's own item; otherwise `effectiveGrade` `owner` (a delegate), `write` or `manage` may save for every copy, anything else only their own; the extension treats such a copy as view-only and doesn't save it alone. Grades come only from team folders for now; group members get none until keepiq#1285. `ownerCertificate` is `null` when the owner has no active suite. 404 when the secret is gone. |
 | Share-save | `PUT /api/v1/secrets/{id}/share-save` | `{baseUpdatedAt, sourceBaseUpdatedAt?, patch, copies, skipped, federated?, suspend?, stage?}`, one transaction. `{id}` is the caller's own row; `sourceBaseUpdatedAt` is required on a copy. `patch` is the sparse body of `PUT /api/v1/secrets/{id}` and must carry `key`, `login` or `additionalFields` (400 `no_value_change`). Copies `{secretId, key?, login?, additionalFields?}` carry exactly the patch's value fields; `skipped` `{secretId, reason: 'no_vault_key'}`; partner shares `{shareId, certFingerprint, key, login, additionalFields}`, the whole value, owner path only; `suspend` `{shareId, reason}`. 200 `{secret, sourceUpdatedAt, copies, federated: {…, ownerOnly}}`. 409 `incomplete` with the required copies (`{secretId, holder, targetUserId}`) and partner shares (`{shareId, recipientCloudId}`), `stale` with `current`, `stale_source`. At most 100 entries per list per call; larger saves send chunks with `stage: {final: false}` (202 `{stageId}`) and commit with `stage: {id, final: true}`; a stage expires after 30 minutes (404 `stage_unknown`). Refusals come as 428. |
 | Recipient certificates | `POST /api/v1/shares/recipient-certificates` | `{userIds}`, 1 to 100 distinct (400 outside). `{recipients: [{userId, shareable: true, certificate} \| {userId, shareable: false, reason}]}`. |
 | Partner certificate | `POST /api/v1/federation/recipient-certificate` | `{cloudId}` → `{cloudId, certificate, chain, partnerRootFingerprint}`. Plain controller: 404 `unknown_recipient`, 403 `not_a_partner`, 409 `federation_unavailable`, 502 `partner_unreachable` or `bad_chain` (the partner served the wrong chain shape), the reason only as `message`. 60 per minute per user. |
diff --git a/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md b/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
index f21e536e9..1605f5358 100644
--- a/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
+++ b/browser-extension/openspec/changes/ext-autofill/specs/login-capture/spec.md
@@ -86,7 +86,7 @@ When exactly one matching item holds the captured username and its decrypted `ke
 - **THEN** no update bar is shown
 
 ### Requirement: Update writes only the key
-The extension SHALL, on "Update", save through `updateItem`: re-fetch the item with `GET /api/v1/secrets/{id}`, encrypt the captured password, and save a patch of only `key` with `baseUpdatedAt` through share-save, which reaches every other copy as `ext-share-sync` specifies, then sync. Other fields are left untouched. With no edit form behind the save, an item with partner shares fails with `unverified` and nothing is saved.
+The extension SHALL, on "Update", save through `updateItem`: re-fetch the item with `GET /api/v1/secrets/{id}`, encrypt the captured password, and save a patch of only `key` with `baseUpdatedAt` through share-save, which reaches every other copy as `ext-share-sync` specifies, then sync. Other fields are left untouched. With no edit form behind the save, an item with partner shares fails with `unverified` and nothing is saved, and a view-only copy fails with `view_only`, which the bar words as the item being shared with the user to view only.
 
 #### Scenario: Successful update
 - **GIVEN** an update bar
diff --git a/browser-extension/openspec/changes/ext-share-sync/design.md b/browser-extension/openspec/changes/ext-share-sync/design.md
index f79c81cb1..4d6a08b46 100644
--- a/browser-extension/openspec/changes/ext-share-sync/design.md
+++ b/browser-extension/openspec/changes/ext-share-sync/design.md
@@ -17,8 +17,12 @@ ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item
 ## Decisions
 
 - **Only a value change goes through share-save.** A save whose body carries `key`, `login` or `additionalFields` takes share-save; any other save stays on `PUT /api/v1/secrets/{id}`, since share-save refuses a patch without one (`no_value_change`). A passkey's `key` is never in the body, so a passkey edit of its name, URL or folder never takes it. The patch is the same sparse body ext-vault-edit sends, without `baseUpdatedAt`, which moves to the envelope.
-- **One `write-context` read picks the path.** `GET /api/v1/secrets/{id}/write-context` answers `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId === id` is the owner path; otherwise `effectiveGrade` `owner`, `write` or `manage` is the copy-editor path, and anything else saves the editor's copy with a plain `PUT` and replies `own_copy`. The row alone can't tell a copy from a source, since a copy is owned by its holder. Delegates take the copy-editor path, as the server allows.
+- **One `write-context` read picks the path.** `GET /api/v1/secrets/{id}/write-context` answers `{sourceSecretId, effectiveGrade, ownerCertificate, sourceUpdatedAt}`. `sourceSecretId === id` is the owner path; otherwise `effectiveGrade` `owner`, `write` or `manage` is the copy-editor path, and anything else is a view-only copy (below). The row alone can't tell a copy from a source, since a copy is owned by its holder. Delegates take the copy-editor path, as the server allows.
 - **The copy-editor path sends the source version the edit was made from.** `fetchItem` for edit reads `write-context` too and keeps its `sourceUpdatedAt` in the form's record, so the save's `sourceBaseUpdatedAt` refuses a source written since the form opened (409 `stale_source`), as the web app does. A save whose record is gone takes the `sourceUpdatedAt` of its own `write-context` read. An edit fetch whose `write-context` read fails fails as a whole, like a failed row fetch.
+- **A copy without write permission is view-only.** Keepiq's server lets such a holder change their own copy alone, which leaves it out of step with the owner's and everyone else's; the extension doesn't offer that, as Bitwarden's "Can view" (chosen; the web app is keepiq#1287).
+  - When an item's detail opens, unless Edit is already unavailable (blocked, use-only or read-only), the popup asks `item.editable`; the background reads `write-context` and answers `editable: false` only for a copy (`sourceSecretId !== id`) whose `effectiveGrade` isn't `owner`, `write` or `manage`. The detail then shows Edit as unavailable with "Shared with you to view only. Ask its owner for edit rights to change it.", as for the other limits; Clone and Move stay. The list doesn't ask per row, so a list row's Edit opens the form and the edit fetch refuses it. Like `item.fetch`, the request counts as activity for the vault timeout.
+  - Until it answers, or when the read fails, Edit stays available, since the background checks again: `fetchItem` for edit refuses such a copy with `view_only` before decrypting, and `updateItem` refuses any patch but a folder move on it, reading `write-context` first for a patch with anything besides `folderId`.
+  - The grade comes from the server alone, so group members become editors once the server treats them as writers (keepiq#1285), and a per-share permission (keepiq#1286) lands here unchanged.
 - **A value change needs its base.** share-save refuses a body without `baseUpdatedAt` (400 `base_required`), so `updateItem` refuses a value change without one as `invalid` before any request; ext-autofill's `capture.update` passes the re-fetched row's.
 - **Empty lists first, then what the server requires.** As `saveShared`: the first call carries the patch and no entries. A 409 `incomplete` names the required copies (`{secretId, holder, targetUserId}`) and, on the owner path, partner shares (`{shareId, recipientCloudId}`); the background fills what is missing, drops what is no longer required and sends again, at most 3 rounds, then fails with `incomplete`.
 - **Local copies take the sparse patch.** Each copy carries exactly the value fields the patch carries, with the same null-ness, encrypted to its holder's certificate (`copy_fields_mismatch` otherwise). The owner holder uses `ownerCertificate`; recipients' certificates come from `POST /api/v1/shares/recipient-certificates`, at most 100 distinct ids per call. A recipient answered `shareable: false`, or an owner with no `ownerCertificate`, goes under `skipped` with `no_vault_key`. When the server refuses that skip (`skipRefused`), the background reads that certificate again once. A certificate that doesn't import fails the save with `bad_certificate`, since leaving the copy out would be refused anyway; so does a verified partner leaf whose key doesn't import.
@@ -33,15 +37,15 @@ ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item
 - **Saves above 100 entries are staged.** At most 100 entries in `copies` plus `skipped` and 100 in `federated` plus `suspend` per call; above that the background sends full chunks with `stage: {final: false}`, keeps the `stageId` from the 202 (a 202 without one fails as `unknown`), and the final call carries the patch and `stage: {id, final: true}`. Dropping an entry already staged starts a new stage; a 404 `stage_unknown` restarts it, counted as a round.
 - **Failures map through `writeError`.** A 409 `stale` is `conflict`, as for any save; `stale_source` is its own code, worded as "the original changed". `incomplete`, `bad_certificate`, `unverified`, `partner_unreachable`, `partner_lookup_limit` and `federation_unavailable` are new codes. The share-save's own `not_allowed`/`forbidden` refusals are `forbidden`, a policy refusal keeps `policy`; `OcsRefusalMiddleware` turns them into 428, which the API client reads like a 403. The `incomplete` lists come only in the 409 body, so `ApiError` carries the parsed `body`. `writeError` and `WriteFailure` live in `src/vault/write-error.ts`, so `share-save.ts` and `write.ts` share them without an import cycle.
 - **No automatic retry, nothing kept.** A failed save leaves the form open with the draft; the user saves again. Nothing about a save outlives its request but the verified partner certificates above: no Try again records, no kept result, no per-item queue, since the server's version check orders concurrent saves. The form's `editOpened` record is dropped once its save succeeds.
-- **Popup UX: a note on the item's detail. Default, may be overruled.** A save that reached everyone closes the form with "Item saved" as before. Three outcomes add a note on the item's detail, held in popup memory for that item until the popup closes: `own_copy` ("Only your copy changed…"), `ownerOnly` on the copy-editor path ("Recipients at partner organisations get this change when the owner next saves it."), partner shares the save suspended on a verdict about the recipient, by cloud id, and, as their own line, the shares the user suspended through Save without them (`paused`), the only lasting sign of that pause in the extension.
+- **Popup UX: a note on the item's detail. Default, may be overruled.** A save that reached everyone closes the form with "Item saved" as before. These outcomes add a note on the item's detail, held in popup memory for that item until the popup closes: `ownerOnly` on the copy-editor path ("Recipients at partner organisations get this change when the owner next saves it."), partner shares the save suspended on a verdict about the recipient, by cloud id, and, as their own line, the shares the user suspended through Save without them (`paused`), the only lasting sign of that pause in the extension.
 - **Local recipients' certificates are trusted as the web app trusts them.** Only the user's own certificate can be proven (ADR-002); a recipient's can't. A compromised server can therefore list a recipient the user never chose and receive the next value of an edited item. This is the web app's and Bitwarden's organisation-membership trust; ADR-002 and `SECURITY.md` record the risk.
 
 ## Data flow
 
-1. Popup: Edit sends `item.fetch` with `purpose: 'edit'`; `fetchItem` fetches the row, checks it against the vault cache, reads `write-context`, decrypts, and keeps the ciphertext it showed in full, the row's `updatedAt` and `sourceUpdatedAt` under a new `recordId`.
+1. Popup: the item's detail asks `item.editable`, and shows Edit as unavailable for a view-only copy. Edit sends `item.fetch` with `purpose: 'edit'`; `fetchItem` fetches the row, checks it against the vault cache, reads `write-context`, refuses a view-only copy, decrypts, and keeps the ciphertext it showed in full, the row's `updatedAt` and `sourceUpdatedAt` under a new `recordId`.
 2. Popup: Save sends `item.update` with the patch, `baseUpdatedAt`, `recordId` and, after Save without them, `withoutUnreachable`.
-3. Background `updateItem`: refuse restricted copies, encrypt the patch to the user's own key. Without a value field: `PUT /api/v1/secrets/{id}` as in ext-vault-edit. With one: `shareSave(...)`.
-   1. `GET /api/v1/secrets/{id}/write-context`; a copy without a write grade: `PUT /api/v1/secrets/{id}`, reply `own_copy`.
+3. Background `updateItem`: refuse restricted copies, encrypt the patch to the user's own key. A folder move alone: `PUT /api/v1/secrets/{id}`. Any other patch reads `write-context` first and refuses a view-only copy with `view_only`. Without a value field: `PUT /api/v1/secrets/{id}` as in ext-vault-edit. With one: `shareSave(...)`.
+   1. The path from that `write-context` read.
    2. `PUT …/share-save` with `baseUpdatedAt`, `sourceBaseUpdatedAt` on the copy-editor path, the patch and empty lists.
    3. On 409 `incomplete`: certificates per 100 ids, encrypt the sparse patch per copy; on the owner path build the whole value from the record, then per partner share look up, verify, encrypt, or list it under `suspend`; send again (staged above 100).
 4. `syncAfterWrite`, drop the form's record, reply `{ ok: true, value: { id, shareSave } }`.
@@ -53,12 +57,12 @@ ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item
 - `src/vault/share-save.ts` (new): `shareSave`, the rounds, the certificate batching, the copy and partner entries and the staging; takes a client, a key and the form's record, so it has no account logic.
 - `src/crypto/federated-certificate.ts` (new): `verifyFederatedCertificate`, which resolves with `{ fingerprint, spki }`: the lowercase hex fingerprint Keepiq takes, and the verified leaf's key, which `importSpki` imports; `canonicalCloudId`, `FederatedCertificateError`; exported from `src/crypto/index.ts`.
 - `src/vault/write-error.ts` (new): `WriteFailure` and `writeError`, moved out of `write.ts`.
-- `src/vault/write.ts` (edit): `fetchItem` keeps the form's record; `updateItem` sends value changes through `shareSave` and drops the record after a success.
+- `src/vault/write.ts` (edit): `fetchItem` keeps the form's record and refuses a view-only copy; `updateItem` refuses one too, sends value changes through `shareSave` and drops the record after a success; `itemEditable` answers `item.editable`.
 - `src/messages.ts` (edit): `ShareSaveNote`, `withoutUnreachable` on `item.update`, the `item.update` reply, `partners` on `WriteFailure`, the new codes, and `recordId` on `EditableItem`.
-- `src/background/requests.ts` (edit): `item.update` passes `withoutUnreachable` on, dropping one that isn't a list of strings.
+- `src/background/requests.ts` (edit): `item.update` passes `withoutUnreachable` on, dropping one that isn't a list of strings; the `item.editable` arm.
 - `src/api/client.ts` (edit): `ApiError` carries the parsed error `body`.
 - `entrypoints/popup/components/ShareSaveNote.tsx` (new): the note on the item's detail.
-- `entrypoints/popup/views/ItemForm.tsx`, `Shell.tsx`, `ItemDetail.tsx` (edit): Save without them, `onSaved(id, shareSave)`, Shell's state, the note on detail.
+- `entrypoints/popup/views/ItemForm.tsx`, `Shell.tsx`, `ItemDetail.tsx` (edit): Save without them, `onSaved(id, shareSave)`, Shell's state, the note on detail, and Edit unavailable on a view-only copy.
 - `entrypoints/popup/errors.ts` (edit): the new codes in `writeErrorText`.
 
 ## Message contract
@@ -66,8 +70,6 @@ ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item
 ```ts
 /** Shown on the item's detail after a save; absent when the save reached everyone. */
 export interface ShareSaveNote {
-	/** `source`: the editor owns the item; `copy`: a team editor or delegate; `own_copy`: only the editor's copy changed. */
-	scope: 'source' | 'copy' | 'own_copy'
 	/** Copy-editor path: partner shares exist that only the owner's next save reaches. */
 	ownerOnly?: true
 	/** Partner shares this save suspended on a verdict about the recipient, by cloud id. */
@@ -79,10 +81,14 @@ export interface ShareSaveNote {
 // WriteFailure gains, for `partner_unreachable`:
 partners?: Array<{ shareId: string; cloudId: string }>
 
+// WriteErrorCode gains `view_only`.
+
 // VaultWrite changes:
 | { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string; recordId?: string; withoutUnreachable?: string[] }
+| { kind: 'item.editable'; id: string }
 // PopupReplies changes:
 'item.update': WriteResult<{ id: string; shareSave?: ShareSaveNote }>
+'item.editable': WriteResult<{ editable: boolean }>
 ```
 
 ## Keepiq routes
diff --git a/browser-extension/openspec/changes/ext-share-sync/proposal.md b/browser-extension/openspec/changes/ext-share-sync/proposal.md
index f438f401d..b5a5a42d1 100644
--- a/browser-extension/openspec/changes/ext-share-sync/proposal.md
+++ b/browser-extension/openspec/changes/ext-share-sync/proposal.md
@@ -20,7 +20,7 @@ Keepiq now saves a shared secret and every copy of it in one transaction, throug
 - `GET /api/v1/secrets/{id}/write-context` picks the path:
   - The editor owns the item: the save carries every local copy and every active partner share.
   - The editor holds a copy with an `owner`, `write` or `manage` grade: the save goes through their copy and carries the source and every other copy. Partner shares stay with the owner's next save, and the popup says so.
-  - Any other copy: a plain `PUT` of the editor's copy only, and the popup says so.
+  - Any other copy is view-only: Edit is unavailable with the reason, and the background refuses to save anything but a move to a folder.
 - The first request carries empty lists, so an unshared item saves at once. The server answers 409 `incomplete` with the copies and partner shares it requires; the background then reads their certificates, encrypts the change for each holder and sends again.
 - Partner certificates are verified in the background against the pinned partner root, ported from the web app. A certificate that fails, or a partner that no longer knows the recipient, suspends that share in the same save.
 - A partner that can't be reached stops the save; the form names it and offers Save without them, which suspends that share.
@@ -34,7 +34,7 @@ Keepiq now saves a shared secret and every copy of it in one transaction, throug
 
 ### Modified Capabilities
 
-- `item-editing` (ext-vault-edit): Save of a value change goes through share-save and reports the note to show.
+- `item-editing` (ext-vault-edit): Save of a value change goes through share-save and reports the note to show, and a copy without write permission is view-only.
 
 ## Deviations from Bitwarden
 
@@ -43,7 +43,7 @@ Mirrored feature: an edit of an item in a Bitwarden organisation collection, whi
 - Per-recipient copies. Bitwarden encrypts a shared item once under the organisation key; Keepiq has no shared key and stores one copy per recipient, so the editor's client encrypts for each (forced).
 - Recipient certificates come from the server. The extension proves only the user's own certificate (ext-vault-edit); it trusts local recipients' certificates as the web app does and as Bitwarden trusts organisation membership, and verifies partner-organisation certificates against the pinned partner root, as the web app does (forced).
 - An unreachable partner organisation stops the save until the user saves without them. Bitwarden has no partner organisations; the web app does the same (forced, Keepiq `federated-sharing`).
-- A recipient without a write grade edits only their own copy, as the server allows no more (forced, Keepiq `folder-permission-grades`).
+- A recipient without a write grade can't edit the item, as in Bitwarden's "Can view". Keepiq's server would let them change their own copy alone, which leaves it out of step with everyone else's; the extension doesn't offer that (chosen, keepiq#1287 for the web app). Group members are meant to be writers; until keepiq#1285 the server doesn't treat them as such.
 
 ## Keepiq API used
 
@@ -58,6 +58,6 @@ Server rules: Keepiq `user-sharing`, `federated-sharing` and `folder-permission-
 ## Impact
 
 - New: `src/vault/share-save.ts`, `src/vault/verified-partners.ts`, `src/vault/write-error.ts`, `src/crypto/federated-certificate.ts` and the popup component `ShareSaveNote`, each with its test.
-- Edited: `src/api/client.ts` (`ApiError.body`), `src/vault/write.ts` (`fetchItem` records what the form opened, `updateItem` saves through share-save), `src/messages.ts` (the `item.update` request and reply), `src/background/requests.ts`, Shell, item form and item detail, both locales, ADR-002 and ADR-003, `SECURITY.md`, `ARCHITECTURE.md`, and `../docs/browser-extension/using.md`.
+- Edited: `src/api/client.ts` (`ApiError.body`), `src/vault/write.ts` (`fetchItem` records what the form opened, `updateItem` saves through share-save), `src/messages.ts` (the `item.update` request and reply, `item.editable`), `src/background/requests.ts`, Shell, item form and item detail, both locales, ADR-002 and ADR-003, `SECURITY.md`, `ARCHITECTURE.md`, and `../docs/browser-extension/using.md` and `privacy.md`.
 - ext-autofill's `capture.update` saves through `updateItem`. With no edit form behind it, an item with partner shares can't be saved there, and the prompt says to change it in the extension's edit form or the web app.
 - Keepiq: once the extension has moved, `PUT /api/v1/secrets/{id}/sync` and `PUT /api/v1/federated-shares/{id}` can go (keepiq#1258).
diff --git a/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md b/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
index d5505ee25..921e39cf6 100644
--- a/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
+++ b/browser-extension/openspec/changes/ext-share-sync/specs/item-editing/spec.md
@@ -53,3 +53,29 @@ An edit that changes `key`, `login` or `additionalFields` SHALL save the editor'
 - **GIVEN** Alice shared "Wifi" with Bob
 - **WHEN** she renames it to "Home wifi"
 - **THEN** the reply MUST carry no `shareSave` and Bob's copy keeps its own name
+
+### Requirement: Shared copies keep their limits
+The extension SHALL keep the limits Keepiq puts on a recipient's copy (Keepiq `use-only-shares`, `expiring-shares`, `federated-sharing`, `folder-permission-grades`), in the popup and again in the background:
+- A use-only copy (`useOnly`) MUST NOT be edited, cloned or moved, and its value and additional fields MUST NOT be shown, copied or sent to the popup; only its login name may be (ext-vault-browse `item-detail`).
+- A read-only copy from another organisation (`readOnly`) MUST NOT be edited or cloned; it may be moved.
+- A copy without write permission, one whose `write-context` grade isn't `owner`, `write` or `manage`, MUST NOT be edited; it may be cloned and moved (`share-sync`).
+- An expiring copy (`accessExpiresAt`) MUST NOT be cloned, since the clone would outlive the end date.
+Each unavailable action shows why.
+
+#### Scenario: Use-only copy in detail
+- **GIVEN** Bob holds a use-only copy of "Supplier portal"
+- **WHEN** he opens it
+- **THEN** the detail MUST show the login name and the note "Its owner doesn't let you view or copy this.", with no password row, reveal or copy
+- **AND** Edit, Clone and Move MUST be unavailable with "Shared with you for signing in only"
+
+#### Scenario: Clone of an expiring copy
+- **GIVEN** Bob's access to a copy ends on 1 December
+- **WHEN** he opens the More menu
+- **THEN** Clone MUST be unavailable with "Your access ends <date>, so it cannot be cloned"
+- **AND** an `item.fetch` for a clone of it MUST be refused by the background
+
+#### Scenario: View-only copy in detail
+- **GIVEN** Bob holds a copy of "Router" shared with him directly, without a grade
+- **WHEN** he opens it
+- **THEN** Edit MUST be unavailable with "Shared with you to view only. Ask its owner for edit rights to change it."
+- **AND** an `item.fetch` for an edit of it MUST be refused by the background
diff --git a/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
index c33ac2843..11240803c 100644
--- a/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
+++ b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
@@ -1,7 +1,7 @@
 ## ADDED Requirements
 
 ### Requirement: A value change saves every copy in one request
-The extension SHALL save an edit whose body carries `key`, `login` or `additionalFields` through `PUT /api/v1/secrets/{id}/share-save`, and MUST save any other edit through `PUT /api/v1/secrets/{id}` as ext-vault-edit specifies. It MUST read `GET /api/v1/secrets/{id}/write-context` first and take exactly one path from it: the owner path when `sourceSecretId` is the edited id, the copy-editor path when it is not and `effectiveGrade` is `owner`, `write` or `manage`, and otherwise a plain `PUT /api/v1/secrets/{id}` of the editor's copy only. The first share-save MUST carry the patch, `baseUpdatedAt` and empty lists; on 409 `incomplete` the background MUST encrypt for what the answer requires, drop what it no longer requires and send again, and MUST fail the save with `incomplete` after three rounds, where each `incomplete` answer and each `stage_unknown` restart counts as one. Nothing about a save MUST outlive its request, beyond the form's record of what it opened, which a successful save drops, and verified partner certificates, kept in background memory for up to 5 minutes.
+The extension SHALL save an edit whose body carries `key`, `login` or `additionalFields` through `PUT /api/v1/secrets/{id}/share-save`, and MUST save any other edit through `PUT /api/v1/secrets/{id}` as ext-vault-edit specifies. It MUST read `GET /api/v1/secrets/{id}/write-context` first and take exactly one path from it: the owner path when `sourceSecretId` is the edited id, the copy-editor path when it is not and `effectiveGrade` is `owner`, `write` or `manage`, and otherwise none, since that copy is view-only. The first share-save MUST carry the patch, `baseUpdatedAt` and empty lists; on 409 `incomplete` the background MUST encrypt for what the answer requires, drop what it no longer requires and send again, and MUST fail the save with `incomplete` after three rounds, where each `incomplete` answer and each `stage_unknown` restart counts as one. Nothing about a save MUST outlive its request, beyond the form's record of what it opened, which a successful save drops, and verified partner certificates, kept in background memory for up to 5 minutes.
 
 #### Scenario: Password change of an owned, shared item
 - **GIVEN** Alice owns "Wifi" and shared it with Bob
@@ -12,7 +12,7 @@ The extension SHALL save an edit whose body carries `key`, `login` or `additiona
 #### Scenario: Rename only
 - **GIVEN** Alice owns "Wifi" and shared it with Bob
 - **WHEN** she renames it and saves
-- **THEN** only `PUT /api/v1/secrets/{id}` MUST be sent, and no `write-context` or share-save
+- **THEN** `write-context` and `PUT /api/v1/secrets/{id}` MUST be sent, and no share-save
 
 #### Scenario: Item that is not shared
 - **GIVEN** Alice owns "Bank", which is shared with nobody
@@ -59,7 +59,12 @@ On the owner path the extension SHALL fill every copy the `incomplete` answer re
 - **AND** the copies MUST go in two chunks of 100 with `stage.final` `false` and a final call with the last 30 and the patch
 
 ### Requirement: A team editor's change reaches the owner and every other copy
-On the copy-editor path the extension SHALL send the share-save for the editor's own copy with `sourceBaseUpdatedAt` set to the `sourceUpdatedAt` the form's edit fetch read, or, without that record, the `sourceUpdatedAt` of its own `write-context` read. It MUST encrypt the patch's value fields to `ownerCertificate` for the source and to each recipient certificate for every other copy the answer requires, and MUST NOT send partner shares. When the reply says `ownerOnly`, the item's detail MUST say that partner organisations get the change with the owner's next save. A copy whose `effectiveGrade` is `read` or `none` MUST be saved with `PUT /api/v1/secrets/{id}` alone, and the item's detail MUST say that only the editor's copy changed.
+On the copy-editor path the extension SHALL send the share-save for the editor's own copy with `sourceBaseUpdatedAt` set to the `sourceUpdatedAt` the form's edit fetch read, or, without that record, the `sourceUpdatedAt` of its own `write-context` read. It MUST encrypt the patch's value fields to `ownerCertificate` for the source and to each recipient certificate for every other copy the answer requires, and MUST NOT send partner shares. When the reply says `ownerOnly`, the item's detail MUST say that partner organisations get the change with the owner's next save.
+
+#### Scenario: Group member once the server treats them as a writer
+- **GIVEN** Alice shared "Router" with the group Staff, and the server answers Bob's `write-context` with `write` (keepiq#1285)
+- **WHEN** Bob changes the password of his copy
+- **THEN** the save MUST take the copy-editor path, as for a team-folder editor, and reach Alice's source and every other member's copy
 
 #### Scenario: Editor in a team folder
 - **GIVEN** Bob holds a `write` grade on the team folder that holds Alice's "Router" and its copies for Bob and Carol
@@ -76,11 +81,23 @@ On the copy-editor path the extension SHALL send the share-save for the editor's
 - **WHEN** Carol saves a new password and the reply says `ownerOnly`
 - **THEN** no partner certificate MUST be looked up, and the item's detail MUST say "Saved. Recipients at partner organisations get this change when the owner next saves it."
 
-#### Scenario: Viewer edits their copy
+### Requirement: A copy without write permission is view-only
+The extension SHALL treat a copy whose `write-context` names another `sourceSecretId` and an `effectiveGrade` other than `owner`, `write` or `manage` as view-only. When an item's detail opens, unless Edit is already unavailable because the item is blocked, use-only or read-only, the popup MUST ask the background with `item.editable`, which reads `write-context` and answers whether the item may be edited; a view-only copy MUST show Edit as unavailable on its detail with "Shared with you to view only. Ask its owner for edit rights to change it.", while Clone and Move stay available. The list row's More menu doesn't ask, so its Edit opens the form, whose edit fetch the background refuses with that text. Until the answer arrives, or when the read fails, Edit stays available. In the background, `item.fetch` for edit MUST refuse a view-only copy with `view_only` before anything is decrypted, and `item.update` MUST refuse any patch on it other than a move to a folder with `view_only`, before anything is written. The extension MUST NOT save anything but a folder move to a view-only copy.
+
+#### Scenario: Viewer opens their copy
 - **GIVEN** Carol holds a `read` grade, or a direct share without a grade, on "Router"
-- **WHEN** she changes the password of her copy
-- **THEN** only `PUT /api/v1/secrets/{id}` MUST be sent
-- **AND** the item's detail MUST show "Only your copy changed. The owner and the others it is shared with keep the old value."
+- **WHEN** she opens it
+- **THEN** Edit MUST be unavailable with "Shared with you to view only. Ask its owner for edit rights to change it.", and Clone and Move MUST be available
+
+#### Scenario: A save of a view-only copy from an older form
+- **GIVEN** Carol's edit form for "Router" opened before her grade was lowered to `read`
+- **WHEN** she saves a new password
+- **THEN** nothing MUST be sent but `write-context`, and the form MUST show the view-only text
+
+#### Scenario: Viewer files their copy
+- **GIVEN** Carol holds a view-only copy of "Router"
+- **WHEN** she moves it to her folder "Network"
+- **THEN** the move MUST be saved with `PUT /api/v1/secrets/{id}` carrying only `folderId`
 
 ### Requirement: Partner-organisation recipients get the whole value the form showed
 On the owner path the extension SHALL, for each partner share the `incomplete` answer requires, look up the recipient's certificate with `POST /api/v1/federation/recipient-certificate` and `cloudId` set to the required share's `recipientCloudId`, verify it in the background, encrypt the whole `key`, `login` and `additionalFields` to it, and list it under `federated` with `certFingerprint`, the lowercase hex SHA-256 of the verified certificate. The whole value MUST be the typed fields plus each other field decrypted from the ciphertext the saving form's own edit fetch opened in full, found by the form's `recordId`; the extension MUST NOT decrypt a fresh row or a reply to build it. When the form did not open every value field in full, its record is gone, or the record is of another version than the save's `baseUpdatedAt`, the save MUST fail with `unverified` before any partner lookup. The edit fetch MUST refuse a row whose ciphertext the vault cache does not hold before or after a vault sync, so the form never opens another item's values.
@@ -195,7 +212,7 @@ A save the server refuses, or that fails before the final share-save is answered
 - **THEN** the form MUST stay open with the offline message, and saving again MUST send the whole save again
 
 ### Requirement: Item detail shows what the save left to others
-The extension SHALL, after a save whose reply carries `shareSave`, close the form and open the item's detail with the "Item saved" toast as before, plus one note: "Only your copy changed. The owner and the others it is shared with keep the old value." for `own_copy`, "Saved. Recipients at partner organisations get this change when the owner next saves it." for `ownerOnly`, the suspended partners' warning, naming their cloud ids, for `suspended`, and "Sharing with <cloud ids> is paused until you share this item with them again." for `paused`, the shares the user suspended through Save without them. The note MUST be held in popup memory for that item only and MUST be gone when the popup closes or another item's detail opens. A save that reached everyone carries no `shareSave` and shows nothing beyond the toast.
+The extension SHALL, after a save whose reply carries `shareSave`, close the form and open the item's detail with the "Item saved" toast as before, plus its notes: "Saved. Recipients at partner organisations get this change when the owner next saves it." for `ownerOnly`, the suspended partners' warning, naming their cloud ids, for `suspended`, and "Sharing with <cloud ids> is paused until you share this item with them again." for `paused`, the shares the user suspended through Save without them. The note MUST be held in popup memory for that item only and MUST be gone when the popup closes or another item's detail opens. A save that reached everyone carries no `shareSave` and shows nothing beyond the toast.
 
 #### Scenario: Fully reached
 - **GIVEN** Alice shared "Wifi" with Bob and Carol
@@ -203,7 +220,7 @@ The extension SHALL, after a save whose reply carries `shareSave`, close the for
 - **THEN** the detail MUST show only the "Item saved" toast
 
 #### Scenario: Popup closed
-- **GIVEN** the detail shows the own-copy note
+- **GIVEN** the detail shows the note that partners get the change with the owner's next save
 - **WHEN** Carol closes and reopens the popup and opens the item
 - **THEN** no note MUST be shown
 
diff --git a/browser-extension/openspec/changes/ext-share-sync/tasks.md b/browser-extension/openspec/changes/ext-share-sync/tasks.md
index 54f782cb4..6b26afe30 100644
--- a/browser-extension/openspec/changes/ext-share-sync/tasks.md
+++ b/browser-extension/openspec/changes/ext-share-sync/tasks.md
@@ -12,7 +12,7 @@
 ## 2. Background save
 
 - [x] 2.1 Create `src/vault/share-save.ts` with `shareSave`, a port of the web app's `saveShared` (`src/services/shareSave.js`), with its test.
-  - Reads `write-context` and takes the owner path, the copy-editor path (`owner`, `write` or `manage` on a copy) or a plain `PUT` of the editor's copy, replying `own_copy`.
+  - Reads `write-context` and takes the owner path or the copy-editor path (`owner`, `write` or `manage` on a copy).
   - Sends the patch with `baseUpdatedAt` and empty lists first; on 409 `incomplete` fills what is required, drops what is not, and sends again, failing with `incomplete` after the third answer.
 - [x] 2.2 Local copies: certificates from `POST /api/v1/shares/recipient-certificates` in batches of at most 100 distinct ids, `ownerCertificate` for the owner holder, one copy entry per holder with exactly the patch's value fields.
   - `login` cleared sends `null`; an unchanged field is absent from the entry.
@@ -29,20 +29,22 @@
 - [x] 2.5 Staging: above 100 entries per list, full chunks with `stage: {final: false}` and the final call with the patch and `stage: {id, final: true}`; dropping a staged entry starts a new stage, and `stage_unknown` restarts it as a round.
 - [x] 2.6 In `fetchItem` for edit, read `write-context` and keep its `sourceUpdatedAt` and the row's `updatedAt` beside the opened ciphertext in the form's `editOpened` record.
 - [x] 2.7 In `updateItem`, send a body with `key`, `login` or `additionalFields` through `shareSave` and any other through `PUT /api/v1/secrets/{id}`; drop the form's record after a success; reply `{ id, shareSave }` when there is a note and `{ id }` otherwise, with tests for a rename, a move, a passkey edit, an unshared item and each failure code. Pass `withoutUnreachable` from `item.update` in `src/background/requests.ts`, dropping one that isn't a list of strings.
+- [x] 2.8 View-only copies: add `item.editable` (`itemEditable` in `write.ts`, its arm in `requests.ts`) answering `{ editable }` from `write-context`, false only for a copy whose grade isn't `owner`, `write` or `manage`; have `fetchItem` for edit refuse such a copy with `view_only` before decrypting, and `updateItem` refuse any patch but a folder move on it, reading `write-context` first for a patch with anything besides `folderId`; remove the own-copy save and `ShareSaveNote.scope`, which nothing reads without it; with tests, including a grade lowered after the form opened.
 
 ## 3. Popup
 
 - [x] 3.1 Add the share-save texts to `locales/en.yml` and `locales/nl.yml` and the new codes to `writeErrorText` in `entrypoints/popup/errors.ts`.
   - `stale_source` "The original of this shared item was changed after you opened it. Nothing was saved; open it again and redo your change.", `incomplete` "The people this item is shared with kept changing while it was saved. Nothing was saved; please try again.", `bad_certificate` "Keepiq sent an encryption key for someone this item is shared with that this browser could not read. Nothing was saved.", `unverified` "This item is shared with partner organisations, and this browser can't confirm they would get it exactly as you saw it. Nothing was saved; make this change in the Keepiq web app.", `partner_unreachable` "Nothing was saved: a partner organisation this item is shared with can't be reached ({cloudIds}). Try again later, or save without them, which pauses sharing this item with them until you share it with them again.", `partner_lookup_limit` "Too many partner lookups. Nothing was saved; try again in a minute.", `federation_unavailable` "Your Keepiq server can't share with partner organisations, so this item can't be saved here. Nothing was saved; ask your administrator.", `saveWithout` "Save without them".
-  - Notes: `ownCopy` "Only your copy changed. The owner and the others it is shared with keep the old value.", `ownerOnly` "Saved. Recipients at partner organisations get this change when the owner next saves it.", `suspended` "Sharing with {cloudIds} is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.", `paused` "Sharing with {cloudIds} is paused until you share this item with them again."
+  - Notes: `ownerOnly` "Saved. Recipients at partner organisations get this change when the owner next saves it.", `suspended` "Sharing with {cloudIds} is paused, because their certificate could not be verified or their organisation no longer accepts it. The Keepiq web app shows the share.", `paused` "Sharing with {cloudIds} is paused until you share this item with them again."
   - Cloud ids are joined with `Intl.ListFormat` in the catalog's language.
 - [x] 3.2 In `ItemForm`, show Save without them beside a `partner_unreachable` failure, which sends `item.update` again with the same draft and, as `withoutUnreachable`, those share ids plus every one agreed to earlier for the same password, username and fields; Try again after a failure resends that while the values are unchanged; with its tests.
 - [x] 3.3 Create `components/ShareSaveNote.tsx` for the note on the item's detail, with its test in English and Dutch; pass `shareSave` from `ItemForm` through `onSaved`, hold it in Shell for that item only, and show it on `ItemDetail`, with tests that a save that reached everyone shows only "Item saved". No import of `src/api` or `src/crypto` (ADR-004).
+- [x] 3.4 On `ItemDetail`, ask `item.editable` when it opens, unless Edit is already unavailable (blocked, use-only, read-only), and show Edit as unavailable on a view-only copy with "Shared with you to view only. Ask its owner for edit rights to change it." in both locales, as for the other limits (the list row's Edit is refused by the edit fetch); Clone and Move stay; Edit stays available until the answer and when it fails; `view_only` worded by `writeErrorText`; remove the `ownCopy` note; with tests in English and Dutch.
 
 ## 4. Docs and checks
 
 - [x] 4.1 Update ADR-003 (rows for the four sharing routes and their answers from design.md), ADR-002 and `SECURITY.md` (the save trusts the server's recipient list; partner certificates are verified against the owner server's pin; partners get only what the form showed), and `ARCHITECTURE.md` (modules, the writes row of the messages table, the Writes flow).
-- [x] 4.2 Replace the shared-edit text in `../docs/browser-extension/using.md` with what the extension now does, including the notes and Save without them.
+- [x] 4.2 Replace the shared-edit text in `../docs/browser-extension/using.md` with what the extension now does, including the notes, Save without them and view-only copies, and list in `../docs/browser-extension/privacy.md` what a shared save and an item's detail send.
 - [x] 4.3 Update ext-autofill's `capture.update`: it saves through `updateItem`, and an item with partner shares fails with `unverified`, which the prompt words as "change it in the edit form or the Keepiq web app".
 - [x] 4.4 Run `npm test`, `npm run typecheck`, `npm run lint`, `npm run build` and `npm run build:firefox`; no `chrome.*` in executable code, no decrypted value or certificate written to storage or sent to the popup.
 - [ ] 4.5 Walk every scenario of both specs against the dev backend in Chrome and Firefox: a direct, a group and a team-folder recipient opening the new value in the Keepiq web app, a `write`-grade editor, a `read`-grade viewer, a recipient added mid-save, and a partner recipient when a partner instance is set up.
diff --git a/browser-extension/src/background/requests.test.ts b/browser-extension/src/background/requests.test.ts
index 56632a559..0e186098a 100644
--- a/browser-extension/src/background/requests.test.ts
+++ b/browser-extension/src/background/requests.test.ts
@@ -247,6 +247,12 @@ describe('vault writes', () => {
 		expect(fetchMock).not.toHaveBeenCalled()
 	})
 
+	it('answers item.editable from the item\'s write-context', async () => {
+		fetchMock.mockResolvedValue(new Response(JSON.stringify({ sourceSecretId: 'src', effectiveGrade: 'read', ownerCertificate: null, sourceUpdatedAt: null })))
+		expect(await send({ kind: 'item.editable', accountId, id: 's1' })).toEqual({ ok: true, value: { editable: false } })
+		expect(String(fetchMock.mock.calls[0]![0])).toBe('https://cloud.example.org/index.php/apps/keepiq/api/v1/secrets/s1/write-context')
+	})
+
 	describe('item.update', () => {
 		const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
 		const bob = { shareId: 'fs-bob', recipientCloudId: 'bob@cloud.partner.example' }
diff --git a/browser-extension/src/background/requests.ts b/browser-extension/src/background/requests.ts
index 05fbc710f..475a86bbb 100644
--- a/browser-extension/src/background/requests.ts
+++ b/browser-extension/src/background/requests.ts
@@ -9,7 +9,7 @@ import { readSnapshot, toItemMeta } from '@/src/vault/store'
 import type { StoredSecretRow, VaultSnapshot } from '@/src/vault/types'
 import { isStale, sync, syncStatus } from '@/src/vault/sync'
 import { cancelPopout, enforce, expectPopout, touch } from '@/src/vault/timeout'
-import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, renameFolder, updateItem } from '@/src/vault/write'
+import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, itemEditable, renameFolder, updateItem } from '@/src/vault/write'
 
 const TABS: readonly PopupTab[] = ['vault', 'generator', 'send', 'settings']
 
@@ -160,6 +160,8 @@ async function performWrite(message: VaultWrite): Promise<PopupReplies[VaultWrit
 				isStrings(message.withoutUnreachable) ? message.withoutUnreachable : undefined)
 		case 'item.delete':
 			return deleteItem(message.id, accountId)
+		case 'item.editable':
+			return itemEditable(message.id, accountId)
 		case 'folder.create':
 			return createFolder(message.name, message.parentId ?? null, accountId)
 		case 'folder.rename':
diff --git a/browser-extension/src/messages.ts b/browser-extension/src/messages.ts
index aa9952145..1ec026297 100644
--- a/browser-extension/src/messages.ts
+++ b/browser-extension/src/messages.ts
@@ -194,6 +194,8 @@ export type WriteErrorCode =
 	| 'not_found' | 'blocked' | 'unreadable' | 'offline' | 'server_error' | 'unknown'
 	/** A use-only, read-only or (for a clone) expiring shared copy. */
 	| 'restricted'
+	/** A shared copy whose grade lets its holder view it, not edit it. */
+	| 'view_only'
 	/** The suite's certificate does not match the unlocked key, so nothing is encrypted to it. */
 	| 'key_mismatch'
 	/** The write was meant for an account that is no longer the active one. */
@@ -225,8 +227,6 @@ export type WriteResult<T> = { ok: true; value: T } | { ok: false; error: VaultW
 
 /** Shown on the item's detail after a save; absent when the save reached everyone. */
 export interface ShareSaveNote {
-	/** `source`: the editor owns the item; `copy`: a team editor or delegate; `own_copy`: only the editor's copy changed. */
-	scope: 'source' | 'copy' | 'own_copy'
 	/** Copy-editor path: partner shares exist that only the owner's next save reaches. */
 	ownerOnly?: true
 	/** Partner shares this save suspended on a verdict about the recipient, by cloud id. */
@@ -262,6 +262,8 @@ export type VaultWrite = { accountId: string } & (
 	 */
 	| { kind: 'item.update'; id: string; patch: ItemPatch; baseUpdatedAt?: string; recordId?: string; withoutUnreachable?: string[] }
 	| { kind: 'item.delete'; id: string }
+	/** Whether the server's grade lets the user edit the item; a view-only copy is `false`. */
+	| { kind: 'item.editable'; id: string }
 	| { kind: 'folder.create'; name: string; parentId: string | null }
 	| { kind: 'folder.rename'; id: string; name: string }
 	| { kind: 'folder.children'; id: string }
@@ -282,6 +284,7 @@ export interface PopupReplies {
 	'item.create': WriteResult<{ id: string }>
 	'item.update': WriteResult<{ id: string; shareSave?: ShareSaveNote }>
 	'item.delete': WriteResult<null>
+	'item.editable': WriteResult<{ editable: boolean }>
 	'folder.create': WriteResult<{ id: string }>
 	'folder.rename': WriteResult<null>
 	'folder.children': WriteResult<FolderChildren>
@@ -291,7 +294,7 @@ export interface PopupReplies {
 
 export const POPUP_REQUEST_KINDS: ReadonlySet<string> = new Set<keyof PopupReplies>([
 	'vault.sync', 'vault.snapshot', 'item.decrypt', 'clipboard.copied', 'popup.popout', 'popup.lastTab.set',
-	'settings.get', 'settings.set', 'item.fetch', 'item.create', 'item.update', 'item.delete',
+	'settings.get', 'settings.set', 'item.fetch', 'item.create', 'item.update', 'item.delete', 'item.editable',
 	'folder.create', 'folder.rename', 'folder.children', 'folder.delete', 'folder.dismissNotice',
 ])
 
diff --git a/browser-extension/src/vault/share-save.test.ts b/browser-extension/src/vault/share-save.test.ts
index fed3f3fee..b1334f4ed 100644
--- a/browser-extension/src/vault/share-save.test.ts
+++ b/browser-extension/src/vault/share-save.test.ts
@@ -5,7 +5,7 @@ import { decodePem, extractSpki } from '@/src/crypto/rsa'
 import { encrypt, secretRow } from '@/src/testing/vault'
 import { envelope, federationChain } from '@/src/testing/vectors'
 import { clearKey } from './key-store'
-import { shareSave, VALUE_FIELDS, type Opened, type ShareSaveInput, type Values } from './share-save'
+import { isViewOnly, readWriteContext, shareSave, VALUE_FIELDS, type Opened, type ShareSaveInput, type Values } from './share-save'
 import { forgetVerifiedPartners, VERIFIED_PARTNER_TTL_MS } from './verified-partners'
 import { writeError } from './write-error'
 
@@ -159,11 +159,12 @@ async function openedX(overrides: Partial<Opened> = {}): Promise<Opened> {
 	}
 }
 
-/** A password change to `new`, unless `plain` says otherwise; the patch's own ciphertext is the server's business. */
-function save(overrides: Partial<ShareSaveInput> = {}) {
+/** A password change to `new`, unless `plain` says otherwise, after the caller's `write-context` read; the patch's own ciphertext is the server's business. */
+async function save(overrides: Partial<ShareSaveInput> = {}) {
 	const plain: Values = overrides.plain ?? { key: 'new' }
 	const patch = Object.fromEntries(Object.entries(plain).map(([field, value]) => [field, value === null ? null : `own:${field}`]))
-	return shareSave(client, privateKey, { accountId: 'a1', id: 's1', patch, plain, baseUpdatedAt: BASE, opened: undefined, withoutUnreachable: new Set(), ...overrides })
+	const context = await readWriteContext(client, 's1')
+	return shareSave(client, privateKey, { accountId: 'a1', id: 's1', patch, plain, baseUpdatedAt: BASE, context, opened: undefined, withoutUnreachable: new Set(), ...overrides })
 }
 
 /** What the popup would be told. */
@@ -394,7 +395,7 @@ describe('the copy-editor path', () => {
 
 	it('says when partner shares stay with the owner\'s next save, and looks no partner up', async () => {
 		world.ownerOnly = true
-		expect(await save()).toEqual({ scope: 'copy', ownerOnly: true })
+		expect(await save()).toEqual({ ownerOnly: true })
 		expect(sent()).not.toContain('POST /api/v1/federation/recipient-certificate')
 	})
 
@@ -415,11 +416,25 @@ describe('the copy-editor path', () => {
 		expect(await failure(save())).toEqual({ code: 'stale_source' })
 	})
 
-	it.each(['read', 'none'])('saves only the editor\'s copy with a plain PUT on a %s grade', async (grade) => {
+	it.each(['read', 'none'])('refuses a view-only copy on a %s grade with view_only, sending nothing', async (grade) => {
 		world.effectiveGrade = grade
-		expect(await save()).toEqual({ scope: 'own_copy' })
-		expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context', 'PUT /api/v1/secrets/s1'])
-		expect(bodiesOf('PUT /api/v1/secrets/s1')).toEqual([{ key: 'own:key', baseUpdatedAt: BASE }])
+		expect(await failure(save())).toEqual({ code: 'view_only' })
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context'])
+	})
+})
+
+describe('isViewOnly', () => {
+	const context = (sourceSecretId: string, effectiveGrade: string) => ({ sourceSecretId, effectiveGrade, ownerCertificate: null, sourceUpdatedAt: null })
+
+	it.each([
+		['a copy on a read grade', true, 'src', 'read'],
+		['a copy without a grade', true, 'src', 'none'],
+		['a copy on a write grade', false, 'src', 'write'],
+		['a copy on a manage grade', false, 'src', 'manage'],
+		['a delegate\'s copy on the owner grade', false, 'src', 'owner'],
+		['the source, whatever its grade', false, 's1', 'none'],
+	])('calls %s view-only: %s', (_, viewOnly, sourceSecretId, grade) => {
+		expect(isViewOnly('s1', context(sourceSecretId, grade))).toBe(viewOnly)
 	})
 })
 
@@ -482,7 +497,7 @@ describe('partner shares', () => {
 		['a partner that served this server the wrong chain', () => json({ message: 'bad_chain' }, 502), 'bad_chain'],
 	])('suspends Bob\'s share for %s, sends him nothing, and names him on the note', async (_, answer, reason) => {
 		world.lookups[BOB.recipientCloudId] = answer
-		expect(await save({ opened: await openedX() })).toEqual({ scope: 'source', suspended: [BOB.recipientCloudId] })
+		expect(await save({ opened: await openedX() })).toEqual({suspended: [BOB.recipientCloudId] })
 		expect(lastFinal().federated).toEqual([])
 		expect(lastFinal().suspend).toEqual([{ shareId: BOB.shareId, reason }])
 	})
@@ -501,7 +516,7 @@ describe('partner shares', () => {
 
 	it('suspends an unreachable partner the user saves without, and names it on the note as paused', async () => {
 		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
-		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({ scope: 'source', paused: [BOB.recipientCloudId] })
+		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({paused: [BOB.recipientCloudId] })
 		expect(lastFinal().suspend).toEqual([{ shareId: BOB.shareId, reason: 'partner_unreachable' }])
 	})
 
@@ -509,7 +524,7 @@ describe('partner shares', () => {
 		world.shares = [BOB, CAROL]
 		world.lookups[BOB.recipientCloudId] = () => json({ message: 'partner_unreachable' }, 502)
 		world.lookups[CAROL.recipientCloudId] = () => json({ message: 'unknown_recipient' }, 404)
-		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({ scope: 'source', suspended: [CAROL.recipientCloudId], paused: [BOB.recipientCloudId] })
+		expect(await save({ opened: await openedX(), withoutUnreachable: new Set([BOB.shareId]) })).toEqual({suspended: [CAROL.recipientCloudId], paused: [BOB.recipientCloudId] })
 	})
 
 	it('stops again for a partner that fails only on Save without them, naming every partner it could not reach', async () => {
@@ -623,7 +638,7 @@ describe('verified partner certificates', () => {
 
 	it('uses Bob\'s for Save without them, and looks him up again after the save that used it went through', async () => {
 		await failOnCarol()
-		expect(await saveWithoutCarol()).toEqual({ scope: 'source', paused: [carol] })
+		expect(await saveWithoutCarol()).toEqual({paused: [carol] })
 		expect(lookups()).toEqual([bob, carol, carol])
 		expect(lastFinal().federated!.map((entry) => entry.shareId)).toEqual([BOB.shareId])
 		await saveWithoutCarol()
@@ -646,7 +661,7 @@ describe('verified partner certificates', () => {
 		await failOnCarol()
 		const moved = { ...BOB, recipientCloudId: 'bob@cloud.elsewhere.example' }
 		world.shares = [moved, CAROL]
-		expect(await saveWithoutCarol()).toEqual({ scope: 'source', suspended: [moved.recipientCloudId], paused: [carol] })
+		expect(await saveWithoutCarol()).toEqual({suspended: [moved.recipientCloudId], paused: [carol] })
 		expect(lookups()).toEqual([bob, carol, moved.recipientCloudId, carol])
 	})
 
diff --git a/browser-extension/src/vault/share-save.ts b/browser-extension/src/vault/share-save.ts
index c6d03c611..c4c761630 100644
--- a/browser-extension/src/vault/share-save.ts
+++ b/browser-extension/src/vault/share-save.ts
@@ -48,6 +48,9 @@ export async function readWriteContext(client: Client, id: string): Promise<Writ
 	}
 }
 
+/** A copy without a write grade, which the server would let its holder change alone, out of step with everyone else's (share-sync). */
+export const isViewOnly = (id: string, context: WriteContext) => context.sourceSecretId !== id && !COPY_EDITOR_GRADES.has(context.effectiveGrade)
+
 export interface ShareSaveInput {
 	accountId: string
 	id: string
@@ -56,6 +59,8 @@ export interface ShareSaveInput {
 	/** The patch's value fields as typed, `null` where cleared. */
 	plain: Values
 	baseUpdatedAt: string
+	/** The caller's `write-context` read, which picks the path. */
+	context: WriteContext
 	/** The saving form's record; absent when it is gone or the save had no form. */
 	opened: Opened | undefined
 	withoutUnreachable: ReadonlySet<string>
@@ -149,13 +154,9 @@ export async function shareSave(client: Client, privateKey: CryptoKey, input: Sh
 	}
 }
 
-async function save(client: Client, privateKey: CryptoKey, { id, patch, plain, baseUpdatedAt, opened, withoutUnreachable }: ShareSaveInput, partners: ReturnType<typeof verifiedPartners>): Promise<ShareSaveNote | undefined> {
-	const context = await readWriteContext(client, id)
+async function save(client: Client, privateKey: CryptoKey, { id, patch, plain, baseUpdatedAt, context, opened, withoutUnreachable }: ShareSaveInput, partners: ReturnType<typeof verifiedPartners>): Promise<ShareSaveNote | undefined> {
+	if (isViewOnly(id, context)) throw new WriteFailure({ code: 'view_only' })
 	const copyPath = context.sourceSecretId !== id
-	if (copyPath && !COPY_EDITOR_GRADES.has(context.effectiveGrade)) {
-		await client.keepiq('PUT', secretPath(id), { ...patch, baseUpdatedAt })
-		return { scope: 'own_copy' }
-	}
 	const sourceBaseUpdatedAt = opened?.sourceUpdatedAt ?? context.sourceUpdatedAt
 	let ownerCertificate = context.ownerCertificate
 
@@ -311,11 +312,11 @@ async function save(client: Client, privateKey: CryptoKey, { id, patch, plain, b
 			else await fill(error.body)
 		}
 	}
-	if (copyPath) return (answer as { federated?: { ownerOnly?: unknown } } | null)?.federated?.ownerOnly === true ? { scope: 'copy', ownerOnly: true } : undefined
+	if (copyPath) return (answer as { federated?: { ownerOnly?: unknown } } | null)?.federated?.ownerOnly === true ? { ownerOnly: true } : undefined
 	// Those the user left out through Save without them get their own line, worded for a pause, not a verdict on the recipient.
 	const named = (paused: boolean) => [...suspend.values()].filter((entry) => (entry.reason === 'partner_unreachable') === paused).map((entry) => cloudIds.get(entry.shareId)!)
 	const suspended = named(false)
 	const paused = named(true)
 	if (suspended.length === 0 && paused.length === 0) return undefined
-	return { scope: 'source', ...(suspended.length > 0 && { suspended }), ...(paused.length > 0 && { paused }) }
+	return { ...(suspended.length > 0 && { suspended }), ...(paused.length > 0 && { paused }) }
 }
diff --git a/browser-extension/src/vault/write.test.ts b/browser-extension/src/vault/write.test.ts
index 4637d4c65..b37908977 100644
--- a/browser-extension/src/vault/write.test.ts
+++ b/browser-extension/src/vault/write.test.ts
@@ -12,7 +12,7 @@ import { readSnapshot, writeSnapshot } from './store'
 import { sync, syncStatus } from './sync'
 import type { VaultSnapshot } from './types'
 import { lock } from './unlock'
-import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, renameFolder, updateItem } from './write'
+import { createFolder, createItem, deleteFolder, deleteItem, fetchItem, folderChildren, itemEditable, renameFolder, updateItem } from './write'
 
 vi.mock('@/src/crypto', async (importOriginal) => {
 	const actual = await importOriginal<typeof import('@/src/crypto')>()
@@ -147,7 +147,7 @@ describe('createItem', () => {
 		expect((await readSnapshot(accountId))?.secrets.map((row) => row.id)).toEqual(['s1', 'new'])
 	})
 
-	it('refuses a certificate that does not match the unlocked key, without a request', async () => {
+	it('refuses a certificate that does not match the unlocked key, without a write', async () => {
 		const { publicKey } = await crypto.subtle.generateKey({ name: 'RSA-OAEP', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' }, true, ['encrypt', 'decrypt'])
 		const spki = toBase64(new Uint8Array(await crypto.subtle.exportKey('spki', publicKey)))
 		// What a sync stores when the server swapped the certificate but kept the suite id and epoch.
@@ -156,7 +156,8 @@ describe('createItem', () => {
 		vi.spyOn(console, 'error').mockImplementation(() => {})
 		expect(await createItem(draft())).toEqual({ ok: false, error: { code: 'key_mismatch' } })
 		expect(await updateItem('s1', { key: 'new' }, secretRow().updatedAt)).toEqual({ ok: false, error: { code: 'key_mismatch' } })
-		expect(writes()).toEqual([])
+		// updateItem reads the grade before it encrypts.
+		expect(writes()).toEqual(['GET /api/v1/secrets/s1/write-context'])
 	})
 
 	it('locks instead of encrypting to a key the server replaced since the last sync', async () => {
@@ -248,6 +249,32 @@ describe('fetchItem', () => {
 		expect(vi.mocked(rsaDecrypt)).not.toHaveBeenCalled()
 	})
 
+	it.each([
+		['a team-folder read grade', 'read'],
+		['a direct share without a grade', null],
+	])('refuses to edit a copy on %s with view_only before decrypting, keeping nothing, and still clones it', async (_, effectiveGrade) => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		server({
+			'GET /api/v1/secrets/s1': () => json(row),
+			'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId: 'src', effectiveGrade, ownerCertificate: null, sourceUpdatedAt: SOURCE_AT }),
+		}, [row])
+		expect(await fetchItem('s1')).toEqual({ ok: false, error: { code: 'view_only' } })
+		expect(vi.mocked(rsaDecrypt)).not.toHaveBeenCalled()
+		expect(await recordIds()).toEqual([])
+		expect(await fetchItem('s1', 'clone')).toMatchObject({ ok: true, value: { key: 'pw' } })
+	})
+
+	it.each(['write', 'manage', 'owner'])('opens a copy on the %s grade for editing', async (effectiveGrade) => {
+		const row = secretRow({ key: await encrypt('pw') })
+		await snapshot([row])
+		server({
+			'GET /api/v1/secrets/s1': () => json(row),
+			'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId: 'src', effectiveGrade, ownerCertificate: null, sourceUpdatedAt: SOURCE_AT }),
+		}, [row])
+		expect(await fetchItem('s1')).toMatchObject({ ok: true, value: { key: 'pw', recordId: expect.any(String) } })
+	})
+
 	it.each([
 		['the cache does not hold the item', [], { code: 'not_found' }],
 		['the cache holds it blocked', [secretRow({ encryptionSuiteId: 'suite-0' })], { code: 'blocked', reason: 'suite_revoked' }],
@@ -512,11 +539,17 @@ describe('updateItem through share-save', () => {
 
 	it.each([
 		['a rename', { name: 'Home wifi' }],
-		['a move', { folderId: 'f1' }],
 		['a URL change', { url: 'https://example.org' }],
-	])('saves %s with a plain PUT and no share-save', async (_, patch) => {
+	])('saves %s with write-context and a plain PUT, and no share-save', async (_, patch) => {
 		server({ ...shared({ copies: [BOB_COPY] }), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
 		expect(await updateItem('s1', patch, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		expect(sent().filter(isShareSaveLine)).toEqual(['GET /api/v1/secrets/s1/write-context'])
+		expect(sent()).toContain('PUT /api/v1/secrets/s1')
+	})
+
+	it('saves a move with a plain PUT alone, reading no grade', async () => {
+		server({ ...shared({ copies: [BOB_COPY] }), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+		expect(await updateItem('s1', { folderId: 'f1' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
 		expect(sent().filter(isShareSaveLine)).toEqual([])
 	})
 
@@ -524,19 +557,64 @@ describe('updateItem through share-save', () => {
 		await snapshot([secretRow({ typeId: 't-passkey' })])
 		server({ ...shared({ copies: [BOB_COPY] }), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
 		expect(await updateItem('s1', { name: 'Renamed', key: '{}' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
-		expect(sent().filter(isShareSaveLine)).toEqual([])
+		expect(sent().filter(isShareSaveLine)).toEqual(['GET /api/v1/secrets/s1/write-context'])
 	})
 
-	it.each([
-		['the copy-editor path names partners only the owner reaches', { sourceSecretId: 'src', effectiveGrade: 'write' }, { ownerOnly: true }, { scope: 'copy', ownerOnly: true }],
-		['a read grade saves only the editor\'s copy', { sourceSecretId: 'src', effectiveGrade: 'read' }, {}, { scope: 'own_copy' }],
-	])('replies with the note when %s', async (_, context, sharing, note) => {
+	it('replies with the note when the copy-editor path names partners only the owner reaches', async () => {
 		server({
-			...shared(sharing),
-			'GET /api/v1/secrets/s1/write-context': () => json({ ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT, ...context }),
-			'PUT /api/v1/secrets/s1': () => json(secretRow()),
+			...shared({ ownerOnly: true }),
+			'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId: 'src', effectiveGrade: 'write', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT }),
+		})
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1', shareSave: { ownerOnly: true } } })
+	})
+
+	it('saves a group member\'s change on the write grade for Alice\'s source and every other member\'s copy, reading write-context once', async () => {
+		const sourceAndMembers = [{ secretId: 'src', holder: 'owner', targetUserId: null }, { secretId: 'c-carol', holder: 'recipient', targetUserId: 'carol' }, { secretId: 'c-dan', holder: 'recipient', targetUserId: 'dan' }]
+		server({
+			...shared({ copies: sourceAndMembers }),
+			'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId: 'src', effectiveGrade: 'write', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT }),
+		})
+		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+		const body = lastBodyOf(SHARE_SAVE)
+		expect(body.sourceBaseUpdatedAt).toBe(SOURCE_AT)
+		expect((body.copies as Array<{ secretId: string }>).map((copy) => copy.secretId)).toEqual(['src', 'c-carol', 'c-dan'])
+		expect(body).not.toHaveProperty('federated')
+		expect(sent().filter((line) => line.endsWith('/write-context'))).toHaveLength(1)
+	})
+
+	describe('a view-only copy', () => {
+		const VIEW_ONLY = { sourceSecretId: 'src', effectiveGrade: 'read', ownerCertificate: envelope.certificatePem, sourceUpdatedAt: SOURCE_AT }
+
+		it.each([
+			['a new password', { key: 'new' }],
+			['a rename', { name: 'Mine now' }],
+			['a username and a folder', { login: 'carol', folderId: 'f1' }],
+		])('refuses %s with view_only, sending nothing but write-context', async (_, patch) => {
+			server({ 'GET /api/v1/secrets/s1/write-context': () => json(VIEW_ONLY), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+			expect(await updateItem('s1', patch, BASE)).toEqual({ ok: false, error: { code: 'view_only' } })
+			expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context'])
+		})
+
+		it('refuses a save from a form that opened before the grade was lowered, keeping its record', async () => {
+			const row = secretRow({ key: await encrypt('pw') })
+			await snapshot([row])
+			let grade = 'write'
+			server({ 'GET /api/v1/secrets/s1': () => json(row), 'GET /api/v1/secrets/s1/write-context': () => json({ ...VIEW_ONLY, effectiveGrade: grade }) }, [row])
+			const form = recordOf(await fetchItem('s1'))
+			expect(form).toEqual(expect.any(String))
+			grade = 'read'
+			fetchMock.mockClear()
+			expect(await updateItem('s1', { key: 'new' }, row.updatedAt, undefined, form)).toEqual({ ok: false, error: { code: 'view_only' } })
+			expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context'])
+			expect(await recordIds()).toEqual(['s1'])
+		})
+
+		it('files it with a PUT of only its folder', async () => {
+			server({ 'GET /api/v1/secrets/s1/write-context': () => json(VIEW_ONLY), 'PUT /api/v1/secrets/s1': () => json(secretRow()) })
+			expect(await updateItem('s1', { folderId: 'f-network' }, BASE)).toEqual({ ok: true, value: { id: 's1' } })
+			expect(bodyOf('PUT /api/v1/secrets/s1')).toEqual({ folderId: 'f-network', baseUpdatedAt: BASE })
+			expect(sent()).not.toContain('GET /api/v1/secrets/s1/write-context')
 		})
-		expect(await updateItem('s1', { key: 'new' }, BASE)).toEqual({ ok: true, value: { id: 's1', shareSave: note } })
 	})
 
 	it('saves through a copy with the source version its edit fetch read, not the one at save time', async () => {
@@ -563,7 +641,7 @@ describe('updateItem through share-save', () => {
 			'POST /api/v1/federation/recipient-certificate': () => json({ message: 'unknown_recipient' }, 404),
 		}, [x])
 		const form = recordOf(await fetchItem('s1'))
-		expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', suspended: [BOB.recipientCloudId] } } })
+		expect(await updateItem('s1', { key: 'new' }, x.updatedAt, undefined, form)).toEqual({ ok: true, value: { id: 's1', shareSave: {suspended: [BOB.recipientCloudId] } } })
 		expect(lastBodyOf(SHARE_SAVE).copies).toHaveLength(1)
 	})
 
@@ -603,14 +681,14 @@ describe('updateItem through share-save', () => {
 
 		it('saves without an unreachable partner the user named, suspending its share', async () => {
 			const unreachable = { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'partner_unreachable' }, 502) }
-			expect(await saveFrom(unreachable, [BOB.shareId])).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', paused: [BOB.recipientCloudId] } } })
+			expect(await saveFrom(unreachable, [BOB.shareId])).toEqual({ ok: true, value: { id: 's1', shareSave: {paused: [BOB.recipientCloudId] } } })
 			expect(lastBodyOf(SHARE_SAVE).suspend).toEqual([{ shareId: BOB.shareId, reason: 'partner_unreachable' }])
 			expect(await recordIds()).toEqual([])
 		})
 
 		it('suspends a partner on the server\'s own 502 bad_chain, without going offline', async () => {
 			const badChain = { 'POST /api/v1/federation/recipient-certificate': () => json({ message: 'bad_chain' }, 502) }
-			expect(await saveFrom(badChain)).toEqual({ ok: true, value: { id: 's1', shareSave: { scope: 'source', suspended: [BOB.recipientCloudId] } } })
+			expect(await saveFrom(badChain)).toEqual({ ok: true, value: { id: 's1', shareSave: {suspended: [BOB.recipientCloudId] } } })
 			expect(lastBodyOf(SHARE_SAVE).suspend).toEqual([{ shareId: BOB.shareId, reason: 'bad_chain' }])
 			expect(await syncStatus(accountId)).toMatchObject({ offline: false })
 		})
@@ -814,6 +892,36 @@ describe('updateItem through share-save', () => {
 	})
 })
 
+describe('itemEditable', () => {
+	const grade = (sourceSecretId: string, effectiveGrade: string | null) => server({ 'GET /api/v1/secrets/s1/write-context': () => json({ sourceSecretId, effectiveGrade, ownerCertificate: null, sourceUpdatedAt: SOURCE_AT }) })
+
+	it.each([
+		['a copy on a team-folder read grade', 'src', 'read', false],
+		['a copy shared directly without a grade', 'src', null, false],
+		['a copy on the write grade', 'src', 'write', true],
+		['a copy on the manage grade', 'src', 'manage', true],
+		['a delegate\'s copy on the owner grade', 'src', 'owner', true],
+		['the source', 's1', 'owner', true],
+	])('answers %s from write-context alone, without a sync', async (_, sourceSecretId, effectiveGrade, editable) => {
+		grade(sourceSecretId, effectiveGrade)
+		expect(await itemEditable('s1')).toEqual({ ok: true, value: { editable } })
+		expect(sent()).toEqual(['GET /api/v1/secrets/s1/write-context'])
+	})
+
+	it('fails as a write does when write-context does not read', async () => {
+		server({ 'GET /api/v1/secrets/s1/write-context': () => json({ message: 'Unavailable' }, 503) })
+		expect(await itemEditable('s1')).toEqual({ ok: false, error: { code: 'server_error' } })
+	})
+
+	it('refuses for another account or a locked vault before any request', async () => {
+		grade('src', 'read')
+		expect(await itemEditable('s1', 'another')).toEqual({ ok: false, error: { code: 'account_changed' } })
+		await lock(accountId)
+		expect(await itemEditable('s1', accountId)).toEqual({ ok: false, error: { code: 'locked' } })
+		expect(fetchMock).not.toHaveBeenCalled()
+	})
+})
+
 describe('errors and the offline flag', () => {
 	it.each([
 		[423, 'write_locked'], [403, 'forbidden'], [428, 'forbidden'], [400, 'invalid'], [409, 'conflict'], [404, 'not_found'], [503, 'server_error'],
diff --git a/browser-extension/src/vault/write.ts b/browser-extension/src/vault/write.ts
index 609791be6..a7bc03e6c 100644
--- a/browser-extension/src/vault/write.ts
+++ b/browser-extension/src/vault/write.ts
@@ -7,7 +7,7 @@ import type { EditableItem, FolderChildren, FolderDeletePlan, ItemDraft, ItemPat
 import { fieldTexts, shownInFull } from './fields'
 import { editOpenedKey, getKey, hasKey, sessionValues } from './key-store'
 import { parseObject } from './payloads'
-import { readWriteContext, shareSave, VALUE_FIELDS, type Opened, type Values } from './share-save'
+import { isViewOnly, readWriteContext, shareSave, VALUE_FIELDS, type Opened, type Values, type WriteContext } from './share-save'
 import { readSnapshot } from './store'
 import { recordOutcome, syncAfterWrite } from './sync'
 import type { StoredSecretRow } from './types'
@@ -210,8 +210,13 @@ export function fetchItem(id: string, purpose: 'edit' | 'clone' = 'edit', accoun
 		// restricted copy would be a permanent, unrestricted one (Keepiq `use-only-shares`, `expiring-shares`).
 		if (isRestricted(row, purpose)) throw new WriteFailure({ code: 'restricted' })
 		const cached = await cachedMatch(account.id, id, row)
-		// The source version this edit is made from, which a save through a copy must name.
-		const sourceUpdatedAt = purpose === 'edit' ? (await readWriteContext(client, id)).sourceUpdatedAt : null
+		let sourceUpdatedAt: string | null = null
+		if (purpose === 'edit') {
+			const writeContext = await readWriteContext(client, id)
+			if (isViewOnly(id, writeContext)) throw new WriteFailure({ code: 'view_only' })
+			// The source version this edit is made from, which a save through a copy must name.
+			sourceUpdatedAt = writeContext.sourceUpdatedAt
+		}
 		const typeNames = await typeNamesOf(account.id, [row.typeId, cached.typeId])
 		// Either side naming a passkey withholds it, so a swapped type id does not open the credential.
 		const passkey = typeNames.includes('passkey')
@@ -283,7 +288,8 @@ export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string,
 		if (!cached) throw new WriteFailure({ code: 'not_found' })
 		// What the server enforces too, refused here so no ciphertext is made for it.
 		if (cached.useOnly) throw new WriteFailure({ code: 'restricted' })
-		if (cached.readOnly && Object.keys(patch).some((field) => field !== 'folderId')) throw new WriteFailure({ code: 'restricted' })
+		const moveOnly = Object.keys(patch).every((field) => field === 'folderId')
+		if (cached.readOnly && !moveOnly) throw new WriteFailure({ code: 'restricted' })
 		const body: Record<string, unknown> = {}
 		if (patch.name !== undefined) {
 			if (typeof patch.name !== 'string' || !patch.name.trim()) throw new WriteFailure({ code: 'invalid' })
@@ -302,6 +308,12 @@ export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string,
 		const valueChange = VALUE_FIELDS.some((field) => plain[field] !== undefined)
 		// share-save refuses a save without the version it was made from.
 		if (valueChange && !baseUpdatedAt) throw new WriteFailure({ code: 'invalid' })
+		// The grade may have been lowered since the form opened; a move files the holder's own copy, so it needs none.
+		let writeContext: WriteContext | undefined
+		if (!moveOnly) {
+			writeContext = await readWriteContext(client, id)
+			if (isViewOnly(id, writeContext)) throw new WriteFailure({ code: 'view_only' })
+		}
 		let key: Promise<CryptoKey> | undefined
 		for (const field of VALUE_FIELDS) {
 			const value = plain[field]
@@ -310,7 +322,7 @@ export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string,
 		let note: ShareSaveNote | undefined
 		if (valueChange) {
 			const opened = recordId ? await findRecord(account.id, id, recordId) : undefined
-			note = await shareSave(client, privateKey, { accountId: account.id, id, patch: body, plain, baseUpdatedAt: baseUpdatedAt!, opened, withoutUnreachable: new Set(withoutUnreachable) })
+			note = await shareSave(client, privateKey, { accountId: account.id, id, patch: body, plain, baseUpdatedAt: baseUpdatedAt!, context: writeContext!, opened, withoutUnreachable: new Set(withoutUnreachable) })
 		} else {
 			await client.keepiq('PUT', secretPath(id), baseUpdatedAt ? { ...body, baseUpdatedAt } : body)
 		}
@@ -320,6 +332,11 @@ export function updateItem(id: string, patch: ItemPatch, baseUpdatedAt?: string,
 	}, 'sync', accountId)
 }
 
+/** For the item's detail to show Edit as unavailable up front; `fetchItem` and `updateItem` check again. */
+export function itemEditable(id: string, accountId?: string): Promise<WriteResult<{ editable: boolean }>> {
+	return run(async ({ client }) => ({ editable: !isViewOnly(id, await readWriteContext(client, id)) }), 'reply', accountId)
+}
+
 /** Moves the item to Keepiq's trash, which also revokes its shares; restoring is the web app's. */
 export function deleteItem(id: string, accountId?: string): Promise<WriteResult<null>> {
 	return run(async ({ client }) => {
diff --git a/docs/browser-extension/privacy.md b/docs/browser-extension/privacy.md
index bb0ad1bbe..1d788324f 100644
--- a/docs/browser-extension/privacy.md
+++ b/docs/browser-extension/privacy.md
@@ -13,6 +13,8 @@ The extension talks to your own Nextcloud, and to nobody else. It sends your ser
 - your Nextcloud user name and app password, with every request, to sign in;
 - requests for your profile (name, email address and picture), your encrypted vault key, your encrypted vault and your Keepiq preferences, of which it uses the default item type;
 - the items and folders you add, change or delete. An item's secrets, user name, notes and additional fields are encrypted in the browser first; its name, web address, type and folder go as you typed them, as Keepiq stores them. Folder names are not encrypted.
+- when you open an item, a check whether you may edit it, which names the item;
+- when you change a shared item's secrets, user name or fields, a lookup of the encryption certificates of everyone it is shared with (by user id, or by cloud id at a partner organisation), and the change encrypted for each of them.
 
 Your master password never leaves the browser. Neither do your decrypted secrets.
 
diff --git a/docs/browser-extension/using.md b/docs/browser-extension/using.md
index d72eff077..8ecbf2bb6 100644
--- a/docs/browser-extension/using.md
+++ b/docs/browser-extension/using.md
@@ -110,7 +110,7 @@ Passkeys are not added here; they are made when you sign up on a website with on
 
 A passkey item only lets you change its name, folder and website.
 
-An item someone shared with you keeps the limits they set. One shared for signing in only shows its user name but never its password or fields, and can't be edited, cloned or moved. One shared from another organisation can only be moved, and one whose access ends on a date can't be cloned.
+An item someone shared with you keeps the limits they set. One shared for signing in only shows its user name but never its password or fields, and can't be edited, cloned or moved. One shared from another organisation can only be moved, one shared to view only can't be edited, and one whose access ends on a date can't be cloned.
 
 When you change the password, user name or fields of an item you own and shared, the extension saves it for everyone it is shared with in one go, directly, through a group or team folder, or at a partner organisation, before it says **Item saved**. Either everyone gets the change or nothing is saved: when a save fails, the form stays open with your change and the reason, and you save again. A new name, website or folder stays your own.
 
@@ -119,7 +119,7 @@ When you change the password, user name or fields of an item you own and shared,
 - **Partner certificate can't be verified, or their organisation no longer accepts the share:** sharing with them is paused, the save goes through, and the item says so; the Keepiq web app shows the share.
 - **Your server can't share with partner organisations:** an item shared with one can't be saved in the extension; ask your administrator.
 - **Part of the item the form doesn't show:** for an item shared with a partner organisation, such as a card with a detail the form has no field for, the extension can't confirm they would get the item exactly as you saw it, so nothing is saved; make the change in the Keepiq web app.
-- **Shared with you without the right to change it for everyone:** your change stays in your own copy, and the item says so.
+- **Shared with you to view only:** Edit is unavailable on the item, with the reason; from the list's More menu it opens and says why. You can still clone the item or move it to one of your folders. That holds for a direct share, a group share and a team folder where you're a Viewer.
 
 ### Deleting an item
 

From 6aaaf89d57d1bf31e39c0d9f6bf60557c0db6669 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Fri, 16 Oct 2026 15:33:41 +0200
Subject: [PATCH 8/9] feat(extension): put Edit at the start of the item footer
 and Delete at the end as a trash icon

As in Bitwarden, the item detail's footer has Edit on the left at its natural width, and the More menu and a red trash-can Delete on the right, as 40px icon buttons with 20px glyphs that read as a pair. Delete keeps "Delete" as its accessible name and tooltip, and an unavailable action is dimmed with its reason as before. The item form's Save and Cancel keep their full-width footer.
---
 browser-extension/entrypoints/popup/popup.css | 43 ++++++++++++++++++-
 .../popup/views/ItemDetail.test.tsx           | 26 +++++++++++
 .../entrypoints/popup/views/ItemDetail.tsx    | 24 +++++++----
 docs/browser-extension/using.md               |  2 +-
 4 files changed, 84 insertions(+), 11 deletions(-)

diff --git a/browser-extension/entrypoints/popup/popup.css b/browser-extension/entrypoints/popup/popup.css
index b1efdf0c2..62b412cbc 100644
--- a/browser-extension/entrypoints/popup/popup.css
+++ b/browser-extension/entrypoints/popup/popup.css
@@ -403,6 +403,24 @@ a {
 	background: var(--surface-hover);
 }
 
+.icon-btn--danger,
+.icon-btn--danger:hover {
+	color: var(--danger);
+}
+
+.icon-btn--danger:hover:not([aria-disabled='true']) {
+	background: var(--danger-soft);
+}
+
+.icon-btn[aria-disabled='true'] {
+	opacity: 0.4;
+	cursor: not-allowed;
+}
+
+.icon-btn[aria-disabled='true']:hover {
+	background: none;
+}
+
 .spinner {
 	width: 14px;
 	height: 14px;
@@ -676,10 +694,33 @@ a {
 	display: none;
 }
 
-.popup__footer .btn {
+.popup__footer > .btn {
 	flex: 1;
 }
 
+/* The item detail's: Edit at the start, More and Delete at the end, as in Bitwarden. */
+.detail-actions {
+	flex: 1;
+	display: flex;
+	align-items: center;
+	gap: 2px;
+}
+
+.detail-actions > .btn {
+	margin-right: auto;
+}
+
+/* As tall as Edit, with a glyph to match its weight. */
+.detail-actions .icon-btn {
+	width: 40px;
+	height: 40px;
+}
+
+.detail-actions .icon-btn .icon {
+	width: 20px;
+	height: 20px;
+}
+
 /* Toast, above whichever bar is at the bottom */
 
 .popup__bottom {
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
index da39dd348..ee207556e 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.test.tsx
@@ -272,6 +272,14 @@ describe('blocked item', () => {
 		expect(screen.getByText(/This item is blocked\./)).toBeTruthy()
 		expect(screen.getByRole('link', { name: 'Open the Keepiq web app' })).toBeTruthy()
 	})
+
+	it('offers no edit and says why, while Delete stays', () => {
+		renderDetail(itemMeta({ blocked: true, hasLogin: false }))
+		const edit = within(footer).getByRole('button', { name: 'Edit' })
+		expect(edit.getAttribute('aria-disabled')).toBe('true')
+		expect(edit.title).toBe('This item is blocked.')
+		expect(within(footer).getByRole('button', { name: 'Delete' }).getAttribute('aria-disabled')).toBeNull()
+	})
 })
 
 describe('use-only copy', () => {
@@ -330,9 +338,27 @@ describe('metadata and actions', () => {
 		expect(items.move).toHaveBeenCalledWith(item)
 	})
 
+	it.each([
+		['en', 'Edit', 'More, GitHub', 'Delete'],
+		['nl', 'Bewerken', 'Meer, GitHub', 'Verwijderen'],
+	] as const)('in %s, puts Edit first and Delete last, as a named icon button', (locale, edit, more, remove) => {
+		setLocale(locale)
+		renderDetail(itemMeta())
+		const buttons = within(footer).getAllByRole('button')
+		expect(buttons.map((b) => b.getAttribute('aria-label') ?? b.textContent)).toEqual([edit, more, remove])
+		expect(buttons[0]!.className).toBe('btn btn--primary')
+		const trash = within(footer).getByRole('button', { name: remove })
+		expect(trash).toBe(buttons.at(-1))
+		expect(trash.className).toBe('icon-btn icon-btn--danger')
+		expect(trash.title).toBe(remove)
+		expect(trash.textContent).toBe('')
+		expect(trash.querySelector('svg')).toBeTruthy()
+	})
+
 	it('holds back the writes while offline, and says why', async () => {
 		const { items } = renderDetail(itemMeta(), undefined, undefined, true)
 		const user = userEvent.setup()
+		// The icon button keeps its name; the reason takes its tooltip.
 		const remove = within(footer).getByRole('button', { name: 'Delete' })
 		expect(remove.getAttribute('aria-disabled')).toBe('true')
 		expect(remove.title).toBe('You are offline. Changes need a connection to Keepiq.')
diff --git a/browser-extension/entrypoints/popup/views/ItemDetail.tsx b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
index ac61afbfd..20f6e06b7 100644
--- a/browser-extension/entrypoints/popup/views/ItemDetail.tsx
+++ b/browser-extension/entrypoints/popup/views/ItemDetail.tsx
@@ -6,7 +6,7 @@ import { folderPath, launchUrl } from '@/src/vault/list'
 import { cardBrand, cardLast4, parseObject, parsePayload, text } from '@/src/vault/payloads'
 import { IconButton } from '../components/Button'
 import { Banner, ErrorBanner } from '../components/ErrorBanner'
-import { Icon } from '../components/Icon'
+import { Icon, type IconName } from '../components/Icon'
 import { itemActions } from '../components/ItemCard'
 import { Loading } from '../components/Loading'
 import { asLines, MaskedField } from '../components/MaskedField'
@@ -189,17 +189,21 @@ function Decrypted({ item, type, passive }: { item: ItemMeta; type: TypeMeta | u
 	return item.useOnly ? <UseOnly item={item} values={decrypted.item} /> : <Values item={item} type={type} values={decrypted.item} />
 }
 
-/** `aria-disabled` keeps the button focusable, so its reason can be read. */
-function ActionButton({ action, variant }: { action: MenuItem; variant: 'primary' | 'danger' }) {
+/**
+ * `aria-disabled` keeps the button focusable, so its reason can be read. With `icon`, the
+ * label is only its name and tooltip, and the reason takes the tooltip's place.
+ */
+function ActionButton({ action, className, icon }: { action: MenuItem; className: string; icon?: IconName }) {
 	return (
 		<button
 			type="button"
-			className={`btn btn--${variant}`}
+			className={className}
+			aria-label={icon && action.label}
 			aria-disabled={action.disabledReason ? true : undefined}
-			title={action.disabledReason}
+			title={action.disabledReason ?? (icon && action.label)}
 			onClick={action.disabledReason ? undefined : action.onSelect}
 		>
-			{action.label}
+			{icon ? <Icon name={icon} /> : action.label}
 		</button>
 	)
 }
@@ -256,9 +260,11 @@ export function ItemDetail({ item, type, folders, webAppUrl, shareSave }: Props)
 				</dl>
 			</section>
 			<PageFooter>
-				<ActionButton action={actions.edit} variant="primary" />
-				<Menu label={i18n.t('item.moreMenu', { name: item.name })} icon="more" above items={[actions.clone, actions.move]} />
-				<ActionButton action={actions.remove} variant="danger" />
+				<div className="detail-actions">
+					<ActionButton action={actions.edit} className="btn btn--primary" />
+					<Menu label={i18n.t('item.moreMenu', { name: item.name })} icon="more" above items={[actions.clone, actions.move]} />
+					<ActionButton action={actions.remove} className="icon-btn icon-btn--danger" icon="trash" />
+				</div>
 			</PageFooter>
 		</div>
 	)
diff --git a/docs/browser-extension/using.md b/docs/browser-extension/using.md
index 8ecbf2bb6..7ee41344d 100644
--- a/docs/browser-extension/using.md
+++ b/docs/browser-extension/using.md
@@ -123,7 +123,7 @@ When you change the password, user name or fields of an item you own and shared,
 
 ### Deleting an item
 
-**Delete** asks first, then moves the item to Keepiq's trash, which also stops sharing it. You can restore it from the trash in the Keepiq web app until your organisation's retention ends, 30 days unless an admin changed it; after that it is gone for good.
+**Delete**, the red trash can at the bottom right of an item, asks first, then moves the item to Keepiq's trash, which also stops sharing it. You can restore it from the trash in the Keepiq web app until your organisation's retention ends, 30 days unless an admin changed it; after that it is gone for good.
 
 ### Folders
 

From 848e5d896ae02380e57ed248d997cd5c3fb25703 Mon Sep 17 00:00:00 2001
From: SudoThijn <thijn@conduction.nl>
Date: Fri, 16 Oct 2026 16:29:43 +0200
Subject: [PATCH 9/9] fix(extension): refuse a partner certificate marked CA as
 the recipient's (keepiq#1257)

A recipient's leaf with basicConstraints cA=TRUE is now refused with bad_chain, whatever its keyUsage says, as the web app does. Older certificates that carry it are not kept working, by decision on keepiq#1257.
---
 .../openspec/changes/ext-share-sync/design.md |  2 +-
 .../ext-share-sync/specs/share-sync/spec.md   |  7 +++++-
 .../openspec/changes/ext-share-sync/tasks.md  |  1 +
 .../src/crypto/federated-certificate.test.ts  | 23 +++++++++++++------
 .../src/crypto/federated-certificate.ts       | 10 ++++----
 5 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/browser-extension/openspec/changes/ext-share-sync/design.md b/browser-extension/openspec/changes/ext-share-sync/design.md
index 4d6a08b46..08d455fc7 100644
--- a/browser-extension/openspec/changes/ext-share-sync/design.md
+++ b/browser-extension/openspec/changes/ext-share-sync/design.md
@@ -28,7 +28,7 @@ ext-vault-edit saves the editor's own row only. Each recipient of a Keepiq item
 - **Local copies take the sparse patch.** Each copy carries exactly the value fields the patch carries, with the same null-ness, encrypted to its holder's certificate (`copy_fields_mismatch` otherwise). The owner holder uses `ownerCertificate`; recipients' certificates come from `POST /api/v1/shares/recipient-certificates`, at most 100 distinct ids per call. A recipient answered `shareable: false`, or an owner with no `ownerCertificate`, goes under `skipped` with `no_vault_key`. When the server refuses that skip (`skipRefused`), the background reads that certificate again once. A certificate that doesn't import fails the save with `bad_certificate`, since leaving the copy out would be refused anyway; so does a verified partner leaf whose key doesn't import.
 - **Partner shares take the whole value.** On the owner path each required partner share gets `key`, `login` and `additionalFields`, encrypted to the leaf the background verified, with `certFingerprint`, the lowercase hex SHA-256 of that leaf. The server replaces all three and refuses an empty `key`.
 - **The whole value is what the form showed.** Every item is encrypted to the same key and nothing ties a ciphertext to its item, so decrypting a fresh row would let the server pick what a partner receives. A partner's value is the typed fields plus each other field decrypted from the ciphertext the form's edit fetch opened, kept per form under its random `recordId` in `editOpened.<accountId>` in `storage.session`, so a stopped MV3 worker keeps it, with the row's `updatedAt`. share-save's `baseUpdatedAt` check means that ciphertext is still the item's, so the record is used only when its `updatedAt` equals the save's `baseUpdatedAt`. A field the form didn't show in full (a card member the form has no field for), a record that is gone or one of another version fails the save with `unverified`, before any partner is looked up, and the form points to the Keepiq web app. The edit fetch also refuses a row whose ciphertext the vault cache doesn't hold before or after a vault sync, so the form never opens another item's values.
-- **Partner certificates are verified in the background, ported from the web app.** `src/crypto/federated-certificate.ts` is a TypeScript port of `src/crypto/federatedCertificate.js`: pinned root by SHA-256, issuer-subject match and signature per link, `cA=TRUE` (and `keyCertSign` when `keyUsage` is present) above the leaf, common name, validity of every certificate. It allows the web app's 5 minutes of clock skew before `notBefore`. Stricter than the web app: the chain must be exactly the `[intermediate, root]` a partner serves (`FederationRootService.php:106-115`), with an intermediate that isn't self-issued; the leaf must have exactly one common name, a UTF8String in strict UTF-8, or a PrintableString, TeletexString or IA5String of printable ASCII (the host's OpenSSL `string_mask` decides, keepiq#1282), while a CA's name is held only to the issuer-subject match; an SPKI that isn't a SEQUENCE is `malformed`; every certificate's outer signature algorithm must equal the TBS one, its signature must have no unused bits, and RSA-PSS parameters must name MGF1 and trailer 1; the expected cloud id must not be empty, only the host's case is folded, and an unknown critical or repeated extension is refused. It is tested against every case of the web app's fixture. The secret is encrypted to the SPKI of the leaf that was verified, and a certificate with text outside its one PEM block or bytes after its DER is refused. The pin is the owner server's own `partnerRootFingerprint`. It uses `crypto.subtle.digest`, `importKey('spki')` and `verify` with RSASSA-PKCS1-v1_5 and RSA-PSS, all present in the MV3 service worker and the MV2 background page.
+- **Partner certificates are verified in the background, ported from the web app.** `src/crypto/federated-certificate.ts` is a TypeScript port of `src/crypto/federatedCertificate.js`: pinned root by SHA-256, issuer-subject match and signature per link, `cA=TRUE` (and `keyCertSign` when `keyUsage` is present) above the leaf, common name, validity of every certificate. It allows the web app's 5 minutes of clock skew before `notBefore`. Stricter than the web app: the chain must be exactly the `[intermediate, root]` a partner serves (`FederationRootService.php:106-115`), with an intermediate that isn't self-issued; the leaf must not set `cA=TRUE` (keepiq#1257) and must have exactly one common name, a UTF8String in strict UTF-8, or a PrintableString, TeletexString or IA5String of printable ASCII (the host's OpenSSL `string_mask` decides, keepiq#1282), while a CA's name is held only to the issuer-subject match; an SPKI that isn't a SEQUENCE is `malformed`; every certificate's outer signature algorithm must equal the TBS one, its signature must have no unused bits, and RSA-PSS parameters must name MGF1 and trailer 1; the expected cloud id must not be empty, only the host's case is folded, and an unknown critical or repeated extension is refused. It is tested against every case of the web app's fixture. The secret is encrypted to the SPKI of the leaf that was verified, and a certificate with text outside its one PEM block or bytes after its DER is refused. The pin is the owner server's own `partnerRootFingerprint`. It uses `crypto.subtle.digest`, `importKey('spki')` and `verify` with RSASSA-PKCS1-v1_5 and RSA-PSS, all present in the MV3 service worker and the MV2 background page.
 - **The name is checked against the required share.** The leaf's common name must name the `recipientCloudId` the `incomplete` answer gives for that share, not the cloud id the lookup echoes back.
 - **Suspend only on a verdict about the recipient.** A verifier refusal, the server's own 502 `bad_chain` (`FederatedCertificateService::parseAnswer`, a partner serving the wrong chain shape), `unknown_recipient` (404) and `not_a_partner` (403) go under `suspend` with that reason, as the web app's `PARTNER_GONE`. These reasons arrive only as the body's `message` on a plain controller (`FederationController::recipientCertificate`), so `ApiError.message` is read there; it is never shown.
 - **An unreachable partner stops the save.** A 502 `partner_unreachable` fails the save with `partner_unreachable` and the shares it couldn't reach (`{shareId, cloudId}`). The form names their cloud ids and offers Save without them, which sends `item.update` again with those share ids as `withoutUnreachable`; the background then lists them under `suspend` with `partner_unreachable`. A share that fails only on that second save, and isn't in `withoutUnreachable`, stops it again; the form keeps the earlier consent, names every partner agreed to so far and sends them all, until the password, username or fields change. Try again after a failure resends the same request, Save without them included, while the values are unchanged; the footer Save is a fresh one. Chosen to mirror the web app: otherwise one partner that is down blocks every extension save of the item.
diff --git a/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
index 11240803c..122710665 100644
--- a/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
+++ b/browser-extension/openspec/changes/ext-share-sync/specs/share-sync/spec.md
@@ -124,7 +124,7 @@ On the owner path the extension SHALL, for each partner share the `incomplete` a
 - **AND** a save MUST send the partner share the whole value as shown
 
 ### Requirement: Partner certificates are verified before anything is encrypted to them
-The extension SHALL accept a partner recipient's certificate only when each certificate is exactly one PEM block with nothing outside it and no bytes after its DER, no critical extension it does not understand and no extension twice, its chain is exactly the intermediate and the root, as a partner serves it, with an intermediate that is not self-issued, the leaf has exactly one common name, as a UTF8String, or a PrintableString, TeletexString or IA5String of printable ASCII, the SHA-256 of the chain's last certificate equals `partnerRootFingerprint`, each certificate's issuer equals the next one's subject and its signature verifies with the next one's key (RSASSA-PKCS1-v1_5 with SHA-256, or RSASSA-PSS with SHA-256 and MGF1-SHA-256), every certificate above the leaf carries basicConstraints with `cA=TRUE`, `keyCertSign` when it has `keyUsage`, and a `pathLenConstraint` the chain keeps, the leaf's common name names the share's `recipientCloudId` after scheme, trailing slash and host case are normalised, and the current time lies within the validity of every certificate, allowing 5 minutes of clock skew before `notBefore`, as the web app does. It MUST refuse with one of `malformed`, `untrusted_root`, `bad_chain`, `name_mismatch` or `not_valid_now`, the Keepiq web app's verifier's reasons, MUST run in the background with WebCrypto only, and MUST encrypt to the public key of the leaf it verified.
+The extension SHALL accept a partner recipient's certificate only when each certificate is exactly one PEM block with nothing outside it and no bytes after its DER, no critical extension it does not understand and no extension twice, its chain is exactly the intermediate and the root, as a partner serves it, with an intermediate that is not self-issued, the leaf has exactly one common name, as a UTF8String, or a PrintableString, TeletexString or IA5String of printable ASCII, the SHA-256 of the chain's last certificate equals `partnerRootFingerprint`, each certificate's issuer equals the next one's subject and its signature verifies with the next one's key (RSASSA-PKCS1-v1_5 with SHA-256, or RSASSA-PSS with SHA-256 and MGF1-SHA-256), every certificate above the leaf carries basicConstraints with `cA=TRUE`, `keyCertSign` when it has `keyUsage`, and a `pathLenConstraint` the chain keeps, the leaf does not set `cA=TRUE`, the leaf's common name names the share's `recipientCloudId` after scheme, trailing slash and host case are normalised, and the current time lies within the validity of every certificate, allowing 5 minutes of clock skew before `notBefore`, as the web app does. It MUST refuse with one of `malformed`, `untrusted_root`, `bad_chain`, `name_mismatch` or `not_valid_now`, the Keepiq web app's verifier's reasons, MUST run in the background with WebCrypto only, and MUST encrypt to the public key of the leaf it verified.
 
 #### Scenario: Verified certificate
 - **GIVEN** the Keepiq test chain for `bob@cloud.partner.example` and its pinned root
@@ -146,6 +146,11 @@ The extension SHALL accept a partner recipient's certificate only when each cert
 - **WHEN** it is verified for Bob's share
 - **THEN** it MUST be refused with `bad_chain`
 
+#### Scenario: A CA certificate as Bob's
+- **GIVEN** a leaf naming Bob that chains to the pinned root but sets `cA=TRUE` in its basicConstraints
+- **WHEN** it is verified for Bob's share
+- **THEN** it MUST be refused with `bad_chain`, whatever its `keyUsage` says
+
 #### Scenario: Another certificate in front of Bob's
 - **GIVEN** the lookup's `certificate` holds base64 of another certificate in front of Bob's PEM block
 - **WHEN** it is verified
diff --git a/browser-extension/openspec/changes/ext-share-sync/tasks.md b/browser-extension/openspec/changes/ext-share-sync/tasks.md
index 6b26afe30..c6a8bb86d 100644
--- a/browser-extension/openspec/changes/ext-share-sync/tasks.md
+++ b/browser-extension/openspec/changes/ext-share-sync/tasks.md
@@ -6,6 +6,7 @@
   - Allows 5 minutes of clock skew before `notBefore`, refuses a self-issued intermediate and a second common name, and runs every case of the web app's fixture.
   - Refuses text outside the one PEM block and bytes after the DER, here and in `importPublicKey`.
   - Requires `cA=TRUE`, `keyCertSign` when `keyUsage` is present, and the `pathLenConstraint` above the leaf, a chain of exactly the intermediate and the root, no unknown critical or repeated extension, and every certificate's validity, against `src/testing/ca-constraints-chain.json`.
+  - Refuses a leaf with `cA=TRUE` (`bad_chain`, keepiq#1257), against the fixture's `leafMarkedCa` and built chains.
   - Refuses another root (`untrusted_root`), a broken link (`bad_chain`), another name (`name_mismatch`), a time outside validity (`not_valid_now`) and garbage (`malformed`), with the same cases as `tests/vitest/federatedCertificate.spec.js`.
   - Bounds-checks every DER length, like `extractSpki` in `src/crypto/rsa.ts`.
 
diff --git a/browser-extension/src/crypto/federated-certificate.test.ts b/browser-extension/src/crypto/federated-certificate.test.ts
index 690c0ea5d..01dc0f83f 100644
--- a/browser-extension/src/crypto/federated-certificate.test.ts
+++ b/browser-extension/src/crypto/federated-certificate.test.ts
@@ -172,11 +172,6 @@ describe('verifyFederatedCertificate', () => {
 		expect(await reasonOf(verify({ cloudId: 'not a cloud id' }))).toBe('name_mismatch')
 	})
 
-	it('refuses a common name and a cloud id that are both no cloud id', async () => {
-		// The sub-CA chains to the pinned root, and its common name has no `@`, like 'garbage'.
-		expect(await reasonOf(verifyMallory({ certificate: C.subIntermediate, cloudId: 'garbage' }))).toBe('name_mismatch')
-	})
-
 	it('matches the common name without the scheme an http instance writes', async () => {
 		await expect(verify({ cloudId: 'bob@http://cloud.partner.example' })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
 		expect(await reasonOf(verify({ cloudId: 'BOB@cloud.partner.example' }))).toBe('name_mismatch')
@@ -222,8 +217,12 @@ describe("verifyFederatedCertificate on the web app's chain constraints", () =>
 		await expect(verify({ chain: [F.intermediateAPathLen0, F.rootA] })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
 	})
 
-	it('accepts a recipient certificate marked CA', async () => {
-		await expect(verify({ certificate: F.leafMarkedCa, cloudId: MALLORY })).resolves.toMatchObject({ fingerprint: FINGERPRINT })
+	it('refuses a recipient certificate marked CA, though it chains and names the recipient', async () => {
+		// OpenSSL agrees the intermediate signed it, so only the cA flag can refuse it.
+		const [leaf, intermediate] = [F.leafMarkedCa, F.intermediateA].map((pem) => new X509Certificate(pem))
+		expect(leaf!.checkIssued(intermediate!)).toBe(true)
+		expect(leaf!.verify(intermediate!.publicKey)).toBe(true)
+		expect(await reasonOf(verify({ certificate: F.leafMarkedCa, cloudId: MALLORY }))).toBe('bad_chain')
 	})
 
 	it('refuses a leaf signed with another leaf', async () => {
@@ -467,6 +466,12 @@ describe('verifyFederatedCertificate on chains built here', () => {
 		expect(await reasonOf(verifyBuilt({ intermediate: { extensions: [basicConstraints(der(0x01, [0x00]))] } }))).toBe('bad_chain')
 	})
 
+	it('refuses a leaf marked CA even when its keyUsage lacks keyCertSign', async () => {
+		// digitalSignature only.
+		const keyUsage = extension(OID.keyUsage, der(0x03, [0x07, 0x80]), true)
+		expect(await reasonOf(verifyBuilt({ leaf: { extensions: [CA, keyUsage] } }))).toBe('bad_chain')
+	})
+
 	it('refuses a keyUsage that claims more than 7 unused bits', async () => {
 		expect(await reasonOf(verifyBuilt({ intermediate: { extensions: [CA, extension(OID.keyUsage, der(0x03, [0x08, 0x04, 0x00]), true)] } }))).toBe('malformed')
 	})
@@ -500,6 +505,10 @@ describe('verifyFederatedCertificate on chains built here', () => {
 			.resolves.toMatchObject({ fingerprint: FINGERPRINT })
 	})
 
+	it('refuses a common name and a cloud id that are both no cloud id', async () => {
+		expect(await reasonOf(verifyBuilt({ leaf: { subject: name(utf8('no cloud id')) } }, 'garbage'))).toBe('name_mismatch')
+	})
+
 	it('keeps a byte order mark in the common name, so it names no one', async () => {
 		expect(await reasonOf(verifyBuilt({ leaf: { subject: name(der(0x0c, [0xef, 0xbb, 0xbf, ...ascii(MALLORY)])) } }))).toBe('name_mismatch')
 	})
diff --git a/browser-extension/src/crypto/federated-certificate.ts b/browser-extension/src/crypto/federated-certificate.ts
index 91fb35b12..10a8e0afe 100644
--- a/browser-extension/src/crypto/federated-certificate.ts
+++ b/browser-extension/src/crypto/federated-certificate.ts
@@ -46,6 +46,8 @@ interface Parsed {
 	notBefore: number
 	notAfter: number
 	spki: Uint8Array<ArrayBuffer>
+	/** basicConstraints sets cA, whatever the key usage says. */
+	ca: boolean
 	/** A CA whose key usage, if it has one, includes keyCertSign. */
 	mayIssue: boolean
 	pathLen: number | null
@@ -146,7 +148,7 @@ function time(bytes: Uint8Array, element: Element | undefined): number {
 }
 
 /** RFC 5280 § 4.2: each extension at most once, and none critical that this doesn't read. § 4.2.1.3 and § 4.2.1.9: without basicConstraints a certificate is no CA. */
-function issuing(bytes: Uint8Array, extensions: Element | undefined): Pick<Parsed, 'mayIssue' | 'pathLen'> {
+function issuing(bytes: Uint8Array, extensions: Element | undefined): Pick<Parsed, 'ca' | 'mayIssue' | 'pathLen'> {
 	let ca = false
 	let keyCertSign = true
 	let pathLen: number | null = null
@@ -178,7 +180,7 @@ function issuing(bytes: Uint8Array, extensions: Element | undefined): Pick<Parse
 			keyCertSign = (first & mask & 0x04) !== 0
 		}
 	}
-	return { mayIssue: ca && keyCertSign, pathLen: ca ? pathLen : null }
+	return { ca, mayIssue: ca && keyCertSign, pathLen: ca ? pathLen : null }
 }
 
 /** Only SHA-256, and for PSS only with MGF1-SHA-256: the PSS default is SHA-1. Parameters that don't decode are malformed. */
@@ -323,8 +325,8 @@ export async function verifyFederatedCertificate({ certificate, chain, partnerRo
 	}
 	const pinned = typeof partnerRootFingerprint === 'string' ? partnerRootFingerprint.toLowerCase() : ''
 	if (pinned === '' || await sha256Hex(certs[certs.length - 1]!.der) !== pinned) throw new FederatedCertificateError('untrusted_root')
-	// The first link must be the partner's intermediate, not its root again.
-	if (equalBytes(certs[1]!.issuer, certs[1]!.subject)) throw new FederatedCertificateError('bad_chain')
+	// The first link must be the partner's intermediate, not its root again. A CA-marked leaf is refused even where older Keepiq versions issued one (keepiq#1257).
+	if (equalBytes(certs[1]!.issuer, certs[1]!.subject) || certs[0]!.ca) throw new FederatedCertificateError('bad_chain')
 	for (let i = 1; i < certs.length; i++) {
 		const issuer = certs[i]!
 		// pathLen counts the CAs below this one, not the leaf.