The console frame
Chairs and the bar. The head of the sidebar is one dropdown of chairs: Server management, Terminals only, Overview, Actions, Snippets, Flows and NOC, then, under a rule, Themis and Files. The chair decides what the sidebar holds — the tree of servers under Server management, Terminals only and NOC, its own rail under the others — and what the pane shows. Startup is a button in the sidebar's title row. ⌘B (Ctrl+Shift+B elsewhere) folds the sidebar; a thin edge with a chevron brings it back. The bar at the top carries the server count, the account's name (click it to close this session and go back to the accounts), Lock Vigia, Find a server (⌘P / Ctrl+Shift+P — by name, address, note or group; a pick opens and connects it), Setup and the version; on the Mac the menu bar adds Features and Setup. Vigia always opens on the map; the chair is session-only.
The map. The landing is the map itself: every group as a card with its servers as rows — the dot, the name and state, the address, what it runs, what it is waiting on (updates, a restart). Named groups, servers in no group under "My Servers", and a search box by name, address or note. A whole group has Connect, Check for updates and Update all on its head; the map's head has New Group, New Server, Connect All and Export — a JSON file of the map or part of it, never a password or a passphrase.
The tree. Groups and servers with drag to reorder within a group and to refile between groups; a double click opens a server's Edit; right-click menus with the verbs (on a server open, connect or disconnect, Terminal, Overview, Browse files, colour, edit, remove; on a group open, connect all, a new server in it, rename, remove); the whole map or a group draggable onto a NOC diagram or a Startup board. Its head is the Servers row — the map, the plus that adds a server, Show by IP — and a search. The foot carries "Connect Directly when I Click a Server" (a saved login goes straight in, no form).
Colour bands. Five swatches and none, set on the row or on Edit: a quiet mark on everything that shows this server — a line beside its name in the tree and on the map, a line under its tab, a badge in its head — so nobody types the wrong command into the wrong box. Red is what people give production.
Bastion / jump hosts. A server can be reached THROUGH another server on the map. Vigia opens the bastion with its own saved login and carries the target's connection over it; the target's host key and login stay its own. One exposed box lets the rest close port 22 to the world.
As another user. Under Terminals only, As another user… arms one click on the tree: that server opens on its login form with nobody filled in. Nothing about that login is saved, the server's own login is not touched, and no tool works through that shell.
Adding several servers at once. Add a server takes several addresses separated by commas, one server each, with the same port, login and group; the name becomes a stem (web 1, web 2, …) or, left blank, each address. A login typed on the form is saved for every server made there, sealed like any saved login.
Connect all / Connect on start. Connect All opens a shell to every server on the map, the bolt on a group to every server in it, the shells dialling in parallel — under Terminals only, four to a page, group by group. Startup says what happens at unlock: "Connect to every server when Vigia starts", or a board of groups and servers dragged from the tree (a group is one card and means whatever is in it later), with a second board for the tunnels that open with them. "Connect automatically when I open Vigia" on a login form puts that server on the board too. A saved login goes straight in; a server without one opens on its login form and waits.
Sessions, tabs and split panes. A server's sessions are pages in a strip; a page is one shell or up to four split across the pane (1 2 / 3 4), dragged there from the strip or opened straight into a split with a key. Splitting, moving or resizing a pane never reconnects the shell underneath — the session is the same one, only its place on screen changes. Tabs scroll, close, and remember where the operator was per server for the session — the screen you left is the screen you return to.
Per-server state. Every rail tool stays mounted, one instance per server: A→B→C→A lands exactly where it was left. Only Monitor is not kept.
Keyboard shortcuts. One table shared by the terminal and the console, so a shortcut is never announced in one place and swallowed in another. ⌘ on the Mac, Ctrl+Shift elsewhere because plain Control letters are the shell's. New/close session, next/previous, session 1–9, add pane / split below, find, clear, read again, hide sidebar, find a server. A help card shows the list for the section on screen.
Jobs lightbox and the working card. A job that must not be left halfway (restore, upgrade, engine install, data folder on the move) stands in front of the whole chair while it runs, with the job's own steps, its log following the last line, copy-to-clipboard, and Stop. A synchronous change over ~1.5 s shows an unstoppable "working" card only for a guarded list of operator-pressed verbs, never for anything Vigia does by itself. Past eight boxes the job's member cards go compact.
The ledger. Every change Vigia makes on a box as root writes its line to Vigia's ledger on this computer — one file a day, carried by the encrypted backup — read back on the box's System Setup › Audit, beside the box's own Vigia journal (/var/lib/lens/journal.log), where flows, deployments and Themis's reports leave a line. When Vigia says "there is none" it says what it checked.
Notifications from boxes. One SMTP server described once in Setup › Notifications, sealed like a login; any box gets /usr/local/lib/lens/notify.sh and a root-only /etc/lens/notify.env so a backup plan that fails at 3 am, or Vigia Uptime, can mail the operator with curl (TLS, a login) and fall back to the box's own sendmail. Send a Test… sends one from a connected server you pick and says what happened.
Toasts, the working badge and traces. A pill at the foot of the window says what Vigia is doing ("Vigia is …") and shows only for work on a server, never at a login form. A background MongoDB metrics trace keeps sampling after the operator leaves the tab and blinks a pill beside it until they are back; a click goes there.
Window. The system's own title bar on both computers, Vigia's bar a row under it. The window opens maximised from the first frame, the door drawn in it as a centred card, and Vigia never resizes it. A resizable sidebar (double-click to reset).