diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 590c2c97..47d4ccdb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,8 @@ jobs:
         run: |
           poetry run pip-audit || echo "::warning::pip-audit found vulnerabilities"
         shell: bash
+      - name: TUI v2 check smoke
+        run: poetry run seedpass tui2 --check
       - name: Run deterministic regression tests
         run: poetry run pytest -q src/tests/test_deterministic_artifact_regression.py
       - name: Run tests with coverage
diff --git a/docs/README.md b/docs/README.md
index 38b31c9b..d5963afd 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -25,6 +25,7 @@ This directory contains SeedPass project documentation.
 - `entry_graph.md`
 - `tui_v2_plan.md`
 - `tui_v2_parity_checklist.md`
+- `tui_v2_parity_backlog.md`
 - `tui_v2_cutover_decision.md`
 - `tui_v2_large_vault_validation.md`
 - `security.md`
diff --git a/docs/tui_v2_parity_backlog.md b/docs/tui_v2_parity_backlog.md
new file mode 100644
index 00000000..01a886d1
--- /dev/null
+++ b/docs/tui_v2_parity_backlog.md
@@ -0,0 +1,87 @@
+# TUI v2 Parity Backlog
+
+Status: Active tracking on `beta` (updated 2026-03-01).
+
+This document captures parity learnings and the remaining implementation queue
+for Textual TUI v2 versus legacy interactive TUI.
+
+Linked plans:
+- `docs/tui_v2_plan.md`
+- `docs/tui_v2_parity_checklist.md`
+- `docs/tui_v2_cutover_decision.md`
+
+## What We Learned
+
+1. Core shell workflows are stable in TUI v2:
+- list/search/filter/detail
+- archive/restore
+- document edit save/cancel
+- graph links + relation filtering + neighbor traversal
+- retry/error-recovery flows
+
+2. Security-sensitive parity has improved:
+- reveal/QR for `password`, `totp`, `seed`, `managed_account`, `ssh`, `pgp`, `nostr`
+- high-risk confirm gates (`reveal confirm`, `qr private confirm`)
+- secret-mode clipboard-aware reveal behavior
+
+3. Scale validation now exists for KB-like workloads:
+- core sort/tag/search + high-degree graph link stress
+- TUI large-index navigation stress
+
+4. Remaining parity is mostly feature-surface breadth, not stability:
+- add-entry creation flows in v2
+- legacy retrieve/action micro-workflows
+- dedicated 2FA board
+- settings/profile/nostr operational menus
+
+## Active Build Queue
+
+### Phase A: Add Entry in TUI v2
+- [x] Add password creation flow
+- [x] Add TOTP creation flow
+- [x] Add key/value creation flow
+- [x] Add document creation flow
+- [x] Add SSH/PGP/Nostr/Seed/Managed Account creation flows
+- [x] Add validation and post-create focus/selection behavior
+
+### Phase B: Retrieve/Action Parity
+- [x] Add note from selected entry
+- [x] Add custom field / hidden field actions
+- [x] Edit tags action parity
+- [x] Field-level edit parity for non-document kinds
+- [x] Document export action
+- [x] Nostr QR submenu parity (public/private explicit flows)
+
+### Phase C: 2FA Board Parity
+- [x] Dedicated 2FA list board view
+- [x] rolling code refresh + remaining timer UI
+- [x] secret-mode clipboard behavior in board view
+- [x] deterministic/imported split parity and display semantics
+
+### Phase D: Settings/Profile/Nostr Parity
+- [x] profile switch/add/remove/list/rename
+- [x] secret mode / quick unlock / offline toggles
+- [x] inactivity timeout + KDF settings
+- [x] relay view/add/remove/reset + sync controls
+- [x] checksum verify/generate, import/export db, export totp, parent seed backup/reveal
+
+### Phase E: Release/CI Closure
+- [x] Add CI smoke step for `seedpass tui2 --check`
+- [x] Extend docs/help parity after each feature landing
+- [x] Keep `legacy` fallback path until parity checklist has no high-severity gaps
+
+Release note:
+- CI now runs a dedicated `tui2 --check` smoke gate via `scripts/tui2_check_smoke.sh`
+  (invoked by `scripts/run_ci_tests.sh`) and in Poetry workflow (`tests.yml`).
+- Legacy fallback command/flag paths remain available (`seedpass legacy`,
+  `seedpass --legacy-tui`, and `tui2` fallback toggle) while cutover hardening
+  continues.
+
+## Execution Notes
+
+- Implement in small vertical slices and check boxes as each slice lands with
+  tests.
+- Each parity slice must include:
+  1) command/keybind discoverability,
+  2) service-layer coverage,
+  3) Textual interaction tests.
diff --git a/docs/tui_v2_parity_checklist.md b/docs/tui_v2_parity_checklist.md
index 92393d83..69000105 100644
--- a/docs/tui_v2_parity_checklist.md
+++ b/docs/tui_v2_parity_checklist.md
@@ -54,3 +54,18 @@ This checklist tracks readiness to switch default interactive mode from legacy T
   - standard: `10,000` rows, stress: `50,000` rows (`--stress`)
 - [x] Confirm help text and docs match shipped keybindings and palette commands.
   - Updated `seedpass tui2 --help`, capabilities hints, and docs discoverability commands.
+
+## Ongoing Tracking
+
+- Active parity continuation and checkoff queue:
+  - `docs/tui_v2_parity_backlog.md`
+
+## Phase E Closure Notes
+
+- CI smoke now explicitly validates `seedpass tui2 --check` output shape:
+  - `scripts/tui2_check_smoke.sh` (called from `scripts/run_ci_tests.sh`)
+  - `.github/workflows/tests.yml` (`poetry run seedpass tui2 --check`)
+- Legacy fallback paths remain intentionally available during hardening:
+  - `seedpass --legacy-tui`
+  - `seedpass legacy`
+  - `seedpass tui2 --fallback-legacy`
diff --git a/docs/tui_v2_plan.md b/docs/tui_v2_plan.md
index 1a7b70cc..014d9ae0 100644
--- a/docs/tui_v2_plan.md
+++ b/docs/tui_v2_plan.md
@@ -38,7 +38,7 @@ Goal: Introduce a modern, modular TUI (`seedpass tui2`) without rewriting core l
 - [x] Add plan doc.
 - [x] Add `seedpass tui2` command.
 - [x] Add runtime check utility and placeholder launcher.
-- [ ] Add CI smoke command for `seedpass tui2 --check`.
+- [x] Add CI smoke command for `seedpass tui2 --check`.
 
 ### Phase 1: Read-only shell
 - [x] Textual app skeleton with 3-pane layout:
@@ -94,3 +94,4 @@ Goal: Introduce a modern, modular TUI (`seedpass tui2`) without rewriting core l
   - `seedpass/tui_v2/`
 - Docs updates:
   - this file listed in docs index and discoverability nav.
+  - parity continuation tracker: `docs/tui_v2_parity_backlog.md`
diff --git a/memory-update.md b/memory-update.md
index ba10d5d2..edc86fc6 100644
--- a/memory-update.md
+++ b/memory-update.md
@@ -300,3 +300,231 @@
 - Added docs `docs/kb_scale_validation.md` with exact commands for standard and `--stress` runs.
 - Updated launch documentation to clearly show all interactive launch modes:
   - default (`seedpass`), explicit v2 (`seedpass tui2`), and legacy (`seedpass legacy` / `seedpass --legacy-tui`).
+
+## 2026-03-01 TUI v2 parity backlog prioritization
+- TORCH latest daily/weekly memory snapshots are mostly scheduler metadata; TUI parity priorities should continue to be driven by `docs/tui_v2_plan.md`, `docs/tui_v2_parity_checklist.md`, and direct legacy-vs-v2 code diff.
+- Highest-impact remaining parity gaps identified:
+  1) Add-entry workflows for all kinds in TUI v2
+  2) Retrieve/action parity (notes/custom fields/tags/edit field-level variants/document export/QR submenus)
+  3) 2FA codes live board parity with timer + secret-mode clipboard behavior
+  4) Settings/profile/nostr operational parity in TUI v2
+  5) CI smoke gate for `seedpass tui2 --check` still marked open in plan
+
+## 2026-03-01 TUI v2 parity tracking + Phase A add-entry slice
+- Added a dedicated continuation tracker `docs/tui_v2_parity_backlog.md` and linked it from:
+  - `docs/tui_v2_plan.md`
+  - `docs/tui_v2_parity_checklist.md`
+  - `docs/README.md`
+- Landed TUI v2 command-palette add-entry flows in `src/seedpass/tui_v2/app.py`:
+  - `add-password <label> <length> [username] [url]`
+  - `add-totp <label> [period] [digits] [secret]`
+  - `add-key-value <label> <key> <value>`
+  - `add-document <label> <file_type> <content>`
+- Added usage validation and post-create behavior:
+  - strict argument/typing checks with status feedback
+  - refresh + selection focus to created entry (or nearest match for TOTP)
+  - retry wiring through existing `x` recovery path on service failures
+- Extended Textual tests:
+  - `src/tests/test_tui_v2_textual_interactions.py` now includes add-command success and validation-error scenarios.
+  - `src/tests/test_tui_v2_action_matrix.py` test service now implements add methods and exercises add-command guards/success paths.
+- Validation run:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py`
+  - Result: `24 passed`.
+- Updated backlog checkoffs (Phase A): password/TOTP/key-value/document creation + validation/post-create focus are now marked complete; remaining work is SSH/PGP/Nostr/Seed/Managed Account creation flows and downstream parity phases.
+
+## 2026-03-01 TUI v2 parity Phase A completion (remaining add kinds)
+- Extended TUI v2 command palette add workflows in `src/seedpass/tui_v2/app.py` for remaining entry kinds:
+  - `add-ssh <label> [index]`
+  - `add-pgp <label> [index] [key_type] [user_id]`
+  - `add-nostr <label> [index]`
+  - `add-seed <label> [words] [index]`
+  - `add-managed-account <label> [index]`
+- Added argument validation and status hints for all new commands, including integer checks for index/words arguments and retry integration on service failures.
+- Updated discoverability text in palette/help/filter hints to include the new add command set.
+- Expanded test doubles and coverage:
+  - `src/tests/test_tui_v2_textual_interactions.py`: success + validation coverage for all add commands (existing and new).
+  - `src/tests/test_tui_v2_action_matrix.py`: guard paths and success paths for new add commands.
+- Validation run repeated after formatting:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py`
+  - Result: `24 passed`.
+- Backlog update:
+  - `docs/tui_v2_parity_backlog.md` Phase A is now fully checked off.
+  - Next priority to start: Phase B retrieve/action parity (notes/custom fields/tags/field-level edits/document export/nostr QR submenu behaviors).
+
+## 2026-03-01 TUI v2 parity Phase B slice: notes/tags/custom fields/document export
+- Added retrieve/action parity commands to TUI v2 palette in `src/seedpass/tui_v2/app.py`:
+  - `notes-set <text>` / `notes-clear`
+  - `tag-add <tag>` / `tag-rm <tag>` / `tags-set <comma-list>` / `tags-clear`
+  - `field-add <label> <value> [hidden-token]` / `field-rm <label>`
+  - `doc-export [output_path]` (selected document only)
+- Introduced helper paths for selected-entry mutation:
+  - `_selected_entry_payload()` for reliable selected entry fetch/guarding
+  - `_apply_selected_modify(...)` to centralize modify->reload->reselect->retry behavior
+- Added/extended tests:
+  - `src/tests/test_tui_v2_textual_interactions.py` adds success + validation coverage for notes/tags/custom fields/doc export.
+  - `src/tests/test_tui_v2_action_matrix.py` now exercises new command guards and paths.
+  - Fake services in both test files now implement `export_document_file(...)`.
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py`
+  - Result: `26 passed`.
+- UI-status formatting note for Textual markup:
+  - Bracketed usage strings like `[hidden]`/`[output_path]` get treated as markup and partially disappear in status rendering.
+  - Switched those usage strings to plain text `(optional: ...)` format.
+- Backlog updates in `docs/tui_v2_parity_backlog.md`:
+  - Checked off Phase B items for notes, tags, custom fields, document export, and Nostr public/private QR submenu parity.
+  - Remaining Phase B gap: field-level edit parity for non-document kinds.
+
+## 2026-03-01 TUI v2 parity Phase B slice: field-level edits for non-document kinds
+- Added palette commands in `src/seedpass/tui_v2/app.py`:
+  - `set-field <name> <value>` (alias `field-set`)
+  - `clear-field <name>` (alias `field-clear`)
+- Implemented kind-aware field edit allowlists and validation:
+  - password: `label/notes/username/url/length`
+  - totp: `label/notes/period/digits`
+  - key_value: `label/notes/key/value`
+  - document: `label/notes/file_type/content`
+  - other kinds: `label/notes`
+- Integer coercion/validation added for `length/period/digits` with explicit status errors.
+- Added shared selected-entry modify helpers to keep behavior deterministic and consistent:
+  - `_selected_entry_payload()`
+  - `_apply_selected_modify(...)`
+- Expanded tests:
+  - `src/tests/test_tui_v2_textual_interactions.py` adds success + validation tests for set/clear field workflows across password/totp/key_value.
+  - `src/tests/test_tui_v2_action_matrix.py` includes command guard and action-path coverage for new commands.
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py`
+  - Result: `28 passed`.
+- Backlog update:
+  - `docs/tui_v2_parity_backlog.md` now marks Phase B field-level edit parity complete.
+  - Phase B is effectively complete in tracker and next focus should move to Phase C (dedicated 2FA board parity).
+
+## 2026-03-01 TUI v2 parity Phase C: dedicated 2FA board
+- Added dedicated 2FA board mode in `src/seedpass/tui_v2/app.py`:
+  - keybind: `6` (`action_toggle_totp_board`)
+  - palette commands: `2fa-board`, `2fa-hide`, `2fa-refresh`, `2fa-copy <entry_id>`
+- Added right-pane board widget `#totp-board` and visibility switching helpers.
+- Added live refresh/timer behavior:
+  - app interval tick (`set_interval(1.0, _tick_totp_board)`) updates board while visible
+  - per-row remaining seconds (`rem`) based on each TOTP period
+- Added board display semantics for deterministic/imported split:
+  - source column (`det` / `imp`) from `deterministic` flag fallback to secret presence
+- Added secret-mode behavior for board:
+  - board masks visible codes as `******` when secret mode is enabled
+  - `2fa-copy` copies actual code to clipboard and reports clear-delay status
+- Updated help/filter/palette discoverability text with new 2FA board commands.
+- Test coverage added/expanded:
+  - `src/tests/test_tui_v2_textual_interactions.py`:
+    - `test_tui2_textual_2fa_board_view_timer_and_copy`
+    - `test_tui2_textual_2fa_board_secret_mode_and_validation`
+  - `src/tests/test_tui_v2_action_matrix.py` command matrix includes 2FA command guards/actions
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py`
+  - Result: `30 passed`.
+- Backlog update: all Phase C checkbox items now marked complete in `docs/tui_v2_parity_backlog.md`.
+
+## 2026-03-01 TUI v2 parity Phase D slice: profile + settings palette plumbing
+- Extended `launch_tui2(...)` to accept optional `profile_service_factory` and `config_service_factory`, in addition to entry service factory.
+- Updated CLI preflight wiring (`src/seedpass/cli/__init__.py`) so TUI v2 receives entry/profile/config services from a single initialized manager when available, while preserving existing monkeypatch compatibility in CLI tests.
+- Added new TUI v2 palette commands in `src/seedpass/tui_v2/app.py`:
+  - `profiles-list`
+  - `profile-switch <fingerprint> [password]`
+  - `setting-secret <on|off> [delay]`
+  - `setting-offline <on|off>`
+  - `setting-quick-unlock <on|off>`
+- Added toggle parsing helper for robust boolean token handling (`on/off/true/false/...`).
+- Added Textual interaction test fakes for profile/config services and new command coverage:
+  - `test_tui2_textual_profiles_and_settings_palette_commands`
+  - `test_tui2_textual_profiles_and_settings_palette_validation`
+- Expanded action-matrix command coverage to include new profile/settings command guard paths.
+- Validation run:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py src/tests/test_typer_cli.py`
+  - Result: `86 passed`.
+- Backlog update (`docs/tui_v2_parity_backlog.md`):
+  - marked `secret mode / quick unlock / offline toggles` complete.
+  - profile switch/add/remove/list/rename remains open because only list/switch command-path parity is currently implemented; add/remove/rename UX flows still pending.
+
+## 2026-03-01 TUI v2 parity Phase D slice: profile lifecycle + relay/sync command paths
+- Extended TUI launch wiring to accept optional `nostr_service_factory` and `sync_service_factory` in `launch_tui2(...)`.
+- Updated CLI preflight service bundle (`src/seedpass/cli/__init__.py`) to pass entry/profile/config/nostr/sync services from a shared manager when available, while preserving monkeypatch compatibility in CLI tests.
+- Added new palette commands in `src/seedpass/tui_v2/app.py`:
+  - profile lifecycle: `profile-add`, `profile-remove <fingerprint>` (plus existing `profiles-list`, `profile-switch`)
+  - relays/sync: `relay-list`, `relay-add <url>`, `relay-rm <index>`, `sync-now`, `sync-bg`
+- Added Textual interaction fakes + coverage for new service surfaces:
+  - fake profile service now supports add/remove
+  - new fake nostr service for relay list/add/remove
+  - new fake sync service for sync-now/bg paths
+- Expanded command matrix coverage to include new profile/relay/sync guard-path commands.
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py src/tests/test_typer_cli.py`
+  - Result: `86 passed`.
+- Backlog status update:
+  - Phase D rows for profile and relay/sync remain open because profile rename and relay reset parity are still missing.
+  - Added explicit progress note in `docs/tui_v2_parity_backlog.md` documenting currently landed command coverage.
+
+## 2026-03-01 TUI v2 parity Phase D completion slice: profile rename + relay reset
+- Service-layer additions in `src/seedpass/core/api.py`:
+  - `ProfileService.rename_profile(fingerprint, name)` using fingerprint manager naming support.
+  - `NostrService.reset_relays()` to restore default relays, persist config/state, and update active Nostr client relay list.
+- TUI palette additions in `src/seedpass/tui_v2/app.py`:
+  - `profile-rename <fingerprint> <name>`
+  - `relay-reset`
+- Existing profile/relay command set now covers:
+  - profiles: list/switch/add/remove/rename
+  - relays/sync: list/add/remove/reset + sync-now/sync-bg
+- Test updates:
+  - `src/tests/test_tui_v2_textual_interactions.py` fakes now implement `rename_profile` and `reset_relays`; success/validation tests assert both command paths.
+  - `src/tests/test_tui_v2_action_matrix.py` matrix guard coverage includes `profile-rename` and `relay-reset`.
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py src/tests/test_typer_cli.py`
+  - Result: `86 passed`.
+- Backlog update:
+  - `docs/tui_v2_parity_backlog.md` now marks both `profile switch/add/remove/list/rename` and `relay view/add/remove/reset + sync controls` complete.
+  - Remaining Phase D open items are `inactivity timeout + KDF settings` and checksum/import-export utility actions.
+
+## 2026-03-01 TUI v2 parity Phase D completion slice: inactivity/KDF + checksum/export utilities
+- Extended TUI launch dependency injection to include optional `utility_service_factory` and `vault_service_factory`.
+- CLI preflight bundle (`src/seedpass/cli/__init__.py`) now provides utility/vault services to TUI v2 when manager-backed services are available.
+- Added new settings commands in `src/seedpass/tui_v2/app.py`:
+  - `setting-timeout <seconds>`
+  - `setting-kdf-iterations <n>`
+  - `setting-kdf-mode <mode>`
+- Added utility/export commands:
+  - `checksum-verify`
+  - `checksum-update`
+  - `db-export <path>`
+  - `db-import <path>`
+  - `totp-export <path>`
+  - `parent-seed-backup [path] [password]`
+- Added support commands to existing profile/relay set:
+  - `profile-rename <fingerprint> <name>` and `relay-reset` (wired to new service methods).
+- Service-layer additions in `src/seedpass/core/api.py`:
+  - `ProfileService.rename_profile(...)`
+  - `NostrService.reset_relays()`
+- Test coverage updates:
+  - `src/tests/test_tui_v2_textual_interactions.py` now has fakes and assertions for all new settings/checksum/export/profile-rename/relay-reset commands.
+  - `src/tests/test_tui_v2_action_matrix.py` command matrix includes guard path invocations for the new commands.
+- Validation:
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py src/tests/test_typer_cli.py`
+  - Result: `86 passed`.
+- Backlog update:
+  - `docs/tui_v2_parity_backlog.md` now marks all Phase D items complete.
+  - Remaining backlog focus shifts to Phase E release/CI closure work.
+
+## 2026-03-01 TUI v2 parity Phase E: CI smoke + docs/help closure
+- Added dedicated CI smoke script for TUI v2 runtime diagnostics:
+  - `scripts/tui2_check_smoke.sh`
+  - Executes `seedpass tui2 --check` when CLI binary is available, otherwise falls back to Typer `CliRunner` invocation.
+  - Validates JSON output keys (`status`, `backend`, `textual_available`, `message`) and backend value (`textual`).
+  - Includes `python`/`python3` fallback handling for portability.
+- Wired CI smoke gate into default CI test runner:
+  - `scripts/run_ci_tests.sh` now runs `./scripts/tui2_check_smoke.sh` before determinism/full test suite.
+- Added explicit workflow smoke step for Poetry matrix:
+  - `.github/workflows/tests.yml` includes `poetry run seedpass tui2 --check`.
+- Phase E docs/status updates:
+  - `docs/tui_v2_parity_backlog.md` marks all Phase E closure items complete and includes release notes.
+  - `docs/tui_v2_plan.md` marks the CI smoke command item complete in Phase 0.
+  - `docs/tui_v2_parity_checklist.md` adds closure notes for CI smoke and retained legacy fallback paths.
+- Validation run:
+  - `scripts/tui2_check_smoke.sh` => `tui2 --check smoke: ok`
+  - `bash -n scripts/tui2_check_smoke.sh scripts/run_ci_tests.sh` => clean
+  - `.venv/bin/pytest -q src/tests/test_tui_v2_textual_interactions.py src/tests/test_tui_v2_action_matrix.py src/tests/test_tui_v2_helpers.py src/tests/test_typer_cli.py` => `86 passed`.
diff --git a/scripts/run_ci_tests.sh b/scripts/run_ci_tests.sh
index e6f292d9..0682861a 100755
--- a/scripts/run_ci_tests.sh
+++ b/scripts/run_ci_tests.sh
@@ -3,6 +3,8 @@ set -eo pipefail
 
 mkdir -p artifacts/coverage
 
+./scripts/tui2_check_smoke.sh
+
 if [[ "${DETERMINISM_GATE:-1}" == "1" ]]; then
     ./scripts/run_determinism_tests.sh
 fi
diff --git a/scripts/tui2_check_smoke.sh b/scripts/tui2_check_smoke.sh
new file mode 100755
index 00000000..e2fcfd95
--- /dev/null
+++ b/scripts/tui2_check_smoke.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# CI smoke gate for TUI v2 runtime diagnostics.
+# Prefer the real CLI command when available; fall back to Typer CliRunner.
+
+if command -v seedpass >/dev/null 2>&1; then
+    raw_output="$(seedpass tui2 --check)"
+else
+    py_bin="python"
+    if ! command -v "$py_bin" >/dev/null 2>&1; then
+        py_bin="python3"
+    fi
+    raw_output="$("$py_bin" - <<'PY'
+import json
+from typer.testing import CliRunner
+from seedpass.cli import app
+
+runner = CliRunner()
+result = runner.invoke(app, ["tui2", "--check"])
+if result.exit_code != 0:
+    raise SystemExit(result.exit_code)
+print(result.stdout.strip())
+PY
+)"
+fi
+
+py_bin="python"
+if ! command -v "$py_bin" >/dev/null 2>&1; then
+    py_bin="python3"
+fi
+
+"$py_bin" - <<'PY' "$raw_output"
+import json
+import sys
+
+text = sys.argv[1].strip()
+data = json.loads(text)
+required = {"status", "backend", "textual_available", "message"}
+missing = sorted(required - set(data))
+if missing:
+    raise SystemExit(f"tui2 --check missing keys: {', '.join(missing)}")
+if data.get("backend") != "textual":
+    raise SystemExit("tui2 --check backend mismatch")
+print("tui2 --check smoke: ok")
+PY
diff --git a/src/seedpass/cli/__init__.py b/src/seedpass/cli/__init__.py
index 24b5e35b..a84be8cf 100644
--- a/src/seedpass/cli/__init__.py
+++ b/src/seedpass/cli/__init__.py
@@ -84,14 +84,33 @@ def _gui_backend_available() -> bool:
 
 def _prime_tui2_service(
     ctx: typer.Context,
-) -> tuple[Optional[object], Optional[Exception]]:
+) -> tuple[Optional[dict[str, object]], Optional[Exception]]:
     """Initialize entry service before Textual mounts.
 
     PasswordManager initialization may prompt for credentials. Doing that before
     entering Textual prevents hidden prompt stalls that appear as a blank screen.
     """
     try:
-        return _get_entry_service(ctx), None
+        from seedpass.core.api import (
+            ProfileService,
+            ConfigService,
+            NostrService,
+            SyncService,
+            UtilityService,
+            VaultService,
+        )
+
+        entry_service = _get_entry_service(ctx)
+        pm = getattr(entry_service, "_manager", None)
+        return {
+            "entry": entry_service,
+            "profile": ProfileService(pm) if pm is not None else None,
+            "config": ConfigService(pm) if pm is not None else None,
+            "nostr": NostrService(pm) if pm is not None else None,
+            "sync": SyncService(pm) if pm is not None else None,
+            "utility": UtilityService(pm) if pm is not None else None,
+            "vault": VaultService(pm) if pm is not None else None,
+        }, None
     except Exception as exc:  # pragma: no cover - defensive runtime path
         return None, exc
 
@@ -126,7 +145,7 @@ def main(
         if legacy_tui:
             raise _launch_legacy_tui(fingerprint=fingerprint)
 
-        service, preflight_error = _prime_tui2_service(ctx)
+        services, preflight_error = _prime_tui2_service(ctx)
         if preflight_error is not None:
             typer.echo(
                 "TUI v2 preflight failed; falling back to legacy TUI. "
@@ -136,7 +155,13 @@ def main(
 
         launched = launch_tui2(
             fingerprint=fingerprint,
-            entry_service_factory=lambda: service,
+            entry_service_factory=lambda: services["entry"],
+            profile_service_factory=lambda: services["profile"],
+            config_service_factory=lambda: services["config"],
+            nostr_service_factory=lambda: services["nostr"],
+            sync_service_factory=lambda: services["sync"],
+            utility_service_factory=lambda: services["utility"],
+            vault_service_factory=lambda: services["vault"],
         )
         if launched:
             return
@@ -176,7 +201,7 @@ def tui2(
         return
 
     fingerprint = (ctx.obj or {}).get("fingerprint")
-    service, preflight_error = _prime_tui2_service(ctx)
+    services, preflight_error = _prime_tui2_service(ctx)
     if preflight_error is not None:
         if fallback_legacy:
             typer.echo(
@@ -192,7 +217,13 @@ def tui2(
 
     launched = launch_tui2(
         fingerprint=fingerprint,
-        entry_service_factory=lambda: service,
+        entry_service_factory=lambda: services["entry"],
+        profile_service_factory=lambda: services["profile"],
+        config_service_factory=lambda: services["config"],
+        nostr_service_factory=lambda: services["nostr"],
+        sync_service_factory=lambda: services["sync"],
+        utility_service_factory=lambda: services["utility"],
+        vault_service_factory=lambda: services["vault"],
     )
     if launched:
         return
diff --git a/src/seedpass/core/api.py b/src/seedpass/core/api.py
index 3827fdaa..dd47115a 100644
--- a/src/seedpass/core/api.py
+++ b/src/seedpass/core/api.py
@@ -224,6 +224,14 @@ class ProfileService:
         with self._lock:
             self._manager.select_fingerprint(req.fingerprint, password=req.password)
 
+    def rename_profile(self, fingerprint: str, name: str | None) -> None:
+        """Set or clear a display name for ``fingerprint``."""
+
+        with self._lock:
+            ok = self._manager.fingerprint_manager.set_name(fingerprint, name)
+            if not ok:
+                raise ValueError("profile not found")
+
 
 class SyncService:
     """Thread-safe wrapper around vault synchronization."""
@@ -889,3 +897,15 @@ class NostrService:
             self._manager.nostr_client.relays = (
                 self._manager.state_manager.list_relays()
             )
+
+    def reset_relays(self) -> list[str]:
+        with self._lock:
+            from nostr.client import DEFAULT_RELAYS
+
+            relays = list(DEFAULT_RELAYS)
+            self._manager.config_manager.set_relays(relays, require_pin=False)
+            state = self._manager.state_manager._load()
+            state["relays"] = relays
+            self._manager.state_manager._save(state)
+            self._manager.nostr_client.relays = list(relays)
+            return relays
diff --git a/src/seedpass/tui_v2/app.py b/src/seedpass/tui_v2/app.py
index bdb08638..44bc860c 100644
--- a/src/seedpass/tui_v2/app.py
+++ b/src/seedpass/tui_v2/app.py
@@ -3,6 +3,8 @@ from __future__ import annotations
 import importlib.util
 import json
 import shlex
+import time
+from pathlib import Path
 from typing import Any
 
 
@@ -87,6 +89,12 @@ def launch_tui2(
     *,
     fingerprint: str | None = None,
     entry_service_factory: Any | None = None,
+    profile_service_factory: Any | None = None,
+    config_service_factory: Any | None = None,
+    nostr_service_factory: Any | None = None,
+    sync_service_factory: Any | None = None,
+    utility_service_factory: Any | None = None,
+    vault_service_factory: Any | None = None,
     app_hook: Any | None = None,
 ) -> bool:
     """Launch TUI v2 when runtime dependencies are available.
@@ -196,6 +204,12 @@ def launch_tui2(
             padding: 1;
             margin-top: 1;
         }
+        #totp-board {
+            height: 1fr;
+            overflow: auto;
+            border: solid #2abf75;
+            padding: 1;
+        }
         #right-view { height: 1fr; }
         #right-editor { height: 1fr; }
         #doc-edit-label { margin-bottom: 1; }
@@ -242,6 +256,7 @@ def launch_tui2(
             ("o", "open_link_target", "Open Link"),
             ("v", "reveal_selected", "Reveal"),
             ("g", "show_qr", "QR"),
+            ("6", "toggle_totp_board", "2FA Board"),
             ("a", "toggle_archive", "Archive/Restore"),
             ("e", "edit_document", "Edit Document"),
             ("ctrl+s", "save_document", "Save"),
@@ -254,6 +269,7 @@ def launch_tui2(
         editing_document: reactive[bool] = reactive(False)
         palette_open: reactive[bool] = reactive(False)
         help_open: reactive[bool] = reactive(False)
+        totp_board_open: reactive[bool] = reactive(False)
 
         def compose(self) -> ComposeResult:
             yield Header(show_clock=True)
@@ -261,6 +277,27 @@ def launch_tui2(
                 placeholder=(
                     "Command palette: help | open <id> | search <q> | "
                     "filter <kind> | archive | restore | "
+                    "add-password <label> <length> [username] [url] | "
+                    "add-totp <label> [period] [digits] [secret] | "
+                    "add-key-value <label> <key> <value> | "
+                    "add-document <label> <file_type> <content> | "
+                    "add-ssh <label> [index] | add-pgp <label> [index] [key_type] [user_id] | "
+                    "add-nostr <label> [index] | add-seed <label> [words] [index] | "
+                    "add-managed-account <label> [index] | "
+                    "notes-set <text> | notes-clear | tag-add <tag> | tag-rm <tag> | "
+                    "tags-set <comma-list> | tags-clear | field-add <label> <value> [hidden] | "
+                    "field-rm <label> | set-field <name> <value> | clear-field <name> | "
+                    "2fa-board | 2fa-hide | 2fa-refresh | 2fa-copy <entry_id> | "
+                    "profiles-list | profile-switch <fp> [password] | profile-add | "
+                    "profile-remove <fp> | profile-rename <fp> <name> | "
+                    "setting-secret <on|off> [delay] | setting-offline <on|off> | "
+                    "setting-quick-unlock <on|off> | setting-timeout <seconds> | "
+                    "setting-kdf-iterations <n> | setting-kdf-mode <mode> | "
+                    "relay-list | relay-add <url> | relay-rm <index> | "
+                    "relay-reset | sync-now | sync-bg | "
+                    "checksum-verify | checksum-update | db-export <path> | db-import <path> | "
+                    "totp-export <path> | parent-seed-backup [path] [password] | "
+                    "doc-export [output_path] | "
                     "link-add <target> [relation] [note] | "
                     "link-rm <target> [relation] | "
                     "reveal [confirm] | qr [public|private] [confirm] | "
@@ -286,6 +323,7 @@ def launch_tui2(
                         yield Static("", id="entry-detail")
                         yield Static("", id="link-detail")
                         yield Static("", id="secret-detail")
+                        yield Static("", id="totp-board", classes="hidden")
                     with Vertical(id="right-editor", classes="hidden"):
                         yield Input(placeholder="Document title", id="doc-edit-label")
                         yield Input(
@@ -311,6 +349,12 @@ def launch_tui2(
 
         def on_mount(self) -> None:
             self._service = None
+            self._profile_service = None
+            self._config_service = None
+            self._nostr_service = None
+            self._sync_service = None
+            self._utility_service = None
+            self._vault_service = None
             self._selected_entry_id: int | None = None
             self._selected_entry: dict[str, Any] | None = None
             self._last_query = ""
@@ -326,6 +370,9 @@ def launch_tui2(
             self._doc_dirty = False
             self._doc_snapshot: dict[str, Any] = {}
             self._last_status_message = ""
+            self._time_now = time.time
+            self._totp_rows: list[dict[str, Any]] = []
+            self._totp_tick = self.set_interval(1.0, self._tick_totp_board)
             try:
                 self._service = (
                     entry_service_factory() if callable(entry_service_factory) else None
@@ -341,6 +388,54 @@ def launch_tui2(
                 self.query_one("#entry-detail", Static).update(
                     f"Unable to initialize entry service: {exc}"
                 )
+            try:
+                self._profile_service = (
+                    profile_service_factory()
+                    if callable(profile_service_factory)
+                    else None
+                )
+            except Exception as exc:
+                self._profile_service = None
+                self._log_activity(f"Profile service unavailable: {exc}")
+            try:
+                self._config_service = (
+                    config_service_factory()
+                    if callable(config_service_factory)
+                    else None
+                )
+            except Exception as exc:
+                self._config_service = None
+                self._log_activity(f"Config service unavailable: {exc}")
+            try:
+                self._nostr_service = (
+                    nostr_service_factory() if callable(nostr_service_factory) else None
+                )
+            except Exception as exc:
+                self._nostr_service = None
+                self._log_activity(f"Nostr service unavailable: {exc}")
+            try:
+                self._sync_service = (
+                    sync_service_factory() if callable(sync_service_factory) else None
+                )
+            except Exception as exc:
+                self._sync_service = None
+                self._log_activity(f"Sync service unavailable: {exc}")
+            try:
+                self._utility_service = (
+                    utility_service_factory()
+                    if callable(utility_service_factory)
+                    else None
+                )
+            except Exception as exc:
+                self._utility_service = None
+                self._log_activity(f"Utility service unavailable: {exc}")
+            try:
+                self._vault_service = (
+                    vault_service_factory() if callable(vault_service_factory) else None
+                )
+            except Exception as exc:
+                self._vault_service = None
+                self._log_activity(f"Vault service unavailable: {exc}")
             self._update_filters_panel()
             self._update_help_overlay()
             self._update_activity_panel()
@@ -403,7 +498,10 @@ def launch_tui2(
                     "Pane Focus: 1 left   2 center   3 right",
                     "",
                     "Palette examples",
-                    "help | filter document | open 12 | reveal confirm | qr private confirm",
+                    (
+                        'help | 2fa-board | 2fa-copy 12 | add-password "Site" 20 '
+                        "user https://x | profiles-list | checksum-verify | db-export backup.enc"
+                    ),
                 ]
             )
             box.update(text)
@@ -509,6 +607,13 @@ def launch_tui2(
                     "- e edit document",
                     "- Ctrl+S save doc",
                     "- Ctrl+P command palette",
+                    "- add-* create entries",
+                    "- add-seed/add-ssh/add-pgp/add-nostr/add-managed-account",
+                    "- notes-set/notes-clear, tag-add/tag-rm/tags-set/tags-clear",
+                    "- field-add/field-rm, set-field/clear-field, doc-export",
+                    "- 6 toggle dedicated 2FA board",
+                    "- profile/relay/sync + setting-* commands",
+                    "- checksum/db/totp export + parent seed backup commands",
                     "- l cycle link relation",
                     "- [ / ] select link",
                     "- o open link target",
@@ -1058,6 +1163,118 @@ def launch_tui2(
             self.palette_open = visible
             self._update_help_overlay()
 
+        def _set_totp_board_visible(self, visible: bool) -> None:
+            board = self.query_one("#totp-board", Static)
+            entry_detail = self.query_one("#entry-detail", Static)
+            link_detail = self.query_one("#link-detail", Static)
+            secret_detail = self.query_one("#secret-detail", Static)
+            if visible:
+                entry_detail.add_class("hidden")
+                link_detail.add_class("hidden")
+                secret_detail.add_class("hidden")
+                board.remove_class("hidden")
+                self.totp_board_open = True
+                self._refresh_totp_board(force_reload=True)
+            else:
+                board.add_class("hidden")
+                entry_detail.remove_class("hidden")
+                link_detail.remove_class("hidden")
+                secret_detail.remove_class("hidden")
+                self.totp_board_open = False
+
+        @staticmethod
+        def _totp_source(entry: dict[str, Any]) -> str:
+            deterministic = entry.get("deterministic")
+            if isinstance(deterministic, bool):
+                return "det" if deterministic else "imp"
+            secret = str(entry.get("secret", "")).strip()
+            return "imp" if secret else "det"
+
+        def _load_totp_rows(self) -> None:
+            if self._service is None:
+                self._totp_rows = []
+                return
+            rows: list[dict[str, Any]] = []
+            results = self._service.search_entries("", kinds=["totp"])
+            for row in results:
+                entry_id = int(row[0])
+                label = str(row[1])
+                entry = self._service.retrieve_entry(entry_id)
+                if not isinstance(entry, dict):
+                    continue
+                period = int(entry.get("period", 30))
+                digits = int(entry.get("digits", 6))
+                rows.append(
+                    {
+                        "id": entry_id,
+                        "label": label,
+                        "period": period,
+                        "digits": digits,
+                        "source": self._totp_source(entry),
+                    }
+                )
+            self._totp_rows = rows
+
+        def _refresh_totp_board(self, *, force_reload: bool = False) -> None:
+            if not self.totp_board_open:
+                return
+            if self._service is None:
+                self.query_one("#totp-board", Static).update(
+                    "2FA Board\n\nEntry service unavailable."
+                )
+                return
+            try:
+                if force_reload or not self._totp_rows:
+                    self._load_totp_rows()
+            except Exception as exc:
+                self._record_failure(
+                    "Failed to load 2FA board",
+                    exc,
+                    retry=lambda: self._refresh_totp_board(force_reload=True),
+                    hint="Press 'x' to retry.",
+                )
+                return
+
+            now = int(self._time_now())
+            secret_mode = self._is_secret_mode_enabled()
+            lines = [
+                "2FA Board",
+                "",
+                "id  src  rem  code      label",
+                "--  ---  ---  --------  -----",
+            ]
+            if not self._totp_rows:
+                lines.extend(
+                    ["", "No TOTP entries found.", "Use add-totp to create one."]
+                )
+            else:
+                for row in self._totp_rows:
+                    period = max(1, int(row["period"]))
+                    rem = period - (now % period)
+                    if rem <= 0:
+                        rem = period
+                    code = (
+                        "******"
+                        if secret_mode
+                        else self._service.get_totp_code(int(row["id"]))
+                    )
+                    lines.append(
+                        f"{row['id']:>2}  {row['source']:<3}  {rem:>3}  {str(code):<8}  {row['label']}"
+                    )
+                lines.extend(
+                    [
+                        "",
+                        "source: det=deterministic, imp=imported",
+                        "Commands: 2fa-copy <entry_id>, 2fa-refresh, 2fa-hide",
+                    ]
+                )
+            self.query_one("#totp-board", Static).update("\n".join(lines))
+            self._clear_failure()
+
+        def _tick_totp_board(self) -> None:
+            if self.totp_board_open:
+                self._refresh_totp_board(force_reload=False)
+
         def _get_document_editor_text(self) -> str:
             if TextArea is not None:
                 area = self.query_one("#doc-edit-content")
@@ -1082,6 +1299,55 @@ def launch_tui2(
             self._doc_dirty = dirty
             self._refresh_doc_edit_help()
 
+        def _selected_entry_payload(self) -> dict[str, Any]:
+            if self._service is None:
+                raise ValueError("Entry service unavailable")
+            if self._selected_entry_id is None:
+                raise ValueError("No entry selected")
+            entry = self._selected_entry or self._service.retrieve_entry(
+                self._selected_entry_id
+            )
+            if not isinstance(entry, dict) or not entry:
+                raise ValueError("Selected entry not found")
+            return dict(entry)
+
+        def _apply_selected_modify(
+            self,
+            *,
+            raw_command: str,
+            success_message: str,
+            failure_context: str,
+            hint: str = "Press 'x' to retry.",
+            **kwargs: Any,
+        ) -> None:
+            if self._service is None or self._selected_entry_id is None:
+                self._set_status("No entry selected")
+                return
+            try:
+                self._service.modify_entry(self._selected_entry_id, **kwargs)
+                current_id = self._selected_entry_id
+                self._load_entries(self._last_query, reset_page=False)
+                if current_id in self._entry_ids_in_view:
+                    self._show_entry(current_id)
+                self._clear_failure()
+                self._set_status(success_message)
+            except Exception as exc:
+                self._record_failure(
+                    failure_context,
+                    exc,
+                    retry=lambda: self._run_palette_command(raw_command),
+                    hint=hint,
+                )
+
+        @staticmethod
+        def _parse_toggle_token(token: str) -> bool:
+            value = token.strip().lower()
+            if value in {"1", "true", "yes", "y", "on", "enable", "enabled"}:
+                return True
+            if value in {"0", "false", "no", "n", "off", "disable", "disabled"}:
+                return False
+            raise ValueError(f"invalid toggle value '{token}'")
+
         def _run_palette_command(self, command: str) -> None:
             raw = command.strip()
             try:
@@ -1094,6 +1360,17 @@ def launch_tui2(
                 self._set_status(
                     "Palette commands: help, open, search, filter, archive, "
                     "restore, edit-doc, save-doc, cancel-edit, link-add, link-rm, "
+                    "add-password, add-totp, add-key-value, add-document, add-ssh, "
+                    "add-pgp, add-nostr, add-seed, add-managed-account, "
+                    "notes-set, notes-clear, tag-add, tag-rm, tags-set, tags-clear, "
+                    "field-add, field-rm, set-field, clear-field, doc-export, "
+                    "2fa-board, 2fa-hide, 2fa-refresh, 2fa-copy, "
+                    "profiles-list, profile-switch, profile-add, profile-remove, profile-rename, "
+                    "setting-secret, setting-offline, setting-quick-unlock, setting-timeout, "
+                    "setting-kdf-iterations, setting-kdf-mode, "
+                    "relay-list, relay-add, relay-rm, relay-reset, sync-now, sync-bg, "
+                    "checksum-verify, checksum-update, db-export, db-import, "
+                    "totp-export, parent-seed-backup, "
                     "reveal [confirm], qr [public|private] [confirm], link-filter, "
                     "link-next, link-prev, link-open, page-next, page-prev, page <n>, "
                     "retry, jump <id>"
@@ -1143,6 +1420,1353 @@ def launch_tui2(
                 self._set_status(f"Applied filter: {self.filter_kind}")
                 return
 
+            if cmd == "add-password":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 2 or len(args) > 4:
+                    self._set_status(
+                        "Usage: add-password <label> <length> [username] [url]"
+                    )
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-password label is required")
+                    return
+                try:
+                    length = int(args[1])
+                except ValueError:
+                    self._set_status("add-password length must be an integer")
+                    return
+                username = args[2] if len(args) >= 3 else None
+                url = args[3] if len(args) >= 4 else None
+                try:
+                    new_id = self._service.add_entry(
+                        label,
+                        length,
+                        username=username,
+                        url=url,
+                    )
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added password entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-password failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-totp":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 4:
+                    self._set_status(
+                        "Usage: add-totp <label> [period] [digits] [secret]"
+                    )
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-totp label is required")
+                    return
+                period = 30
+                digits = 6
+                secret: str | None = None
+                if len(args) >= 2:
+                    try:
+                        period = int(args[1])
+                    except ValueError:
+                        self._set_status("add-totp period must be an integer")
+                        return
+                if len(args) >= 3:
+                    try:
+                        digits = int(args[2])
+                    except ValueError:
+                        self._set_status("add-totp digits must be an integer")
+                        return
+                if len(args) >= 4:
+                    secret = args[3].strip() or None
+                deterministic = secret is None
+                try:
+                    self._service.add_totp(
+                        label,
+                        period=period,
+                        digits=digits,
+                        deterministic=deterministic,
+                        secret=secret,
+                    )
+                    self._load_entries(self._last_query, reset_page=False)
+                    try:
+                        matches = self._service.search_entries(label, kinds=["totp"])
+                    except Exception:
+                        matches = []
+                    selected = None
+                    for row in matches:
+                        idx, entry_label, _u, _url, _arch, _etype = row
+                        if str(entry_label) == label:
+                            selected = int(idx)
+                    if selected is None and matches:
+                        selected = int(matches[-1][0])
+                    if selected is not None:
+                        self._show_entry(selected)
+                        self._set_status(f"Added TOTP entry #{selected}")
+                    else:
+                        self._set_status("Added TOTP entry")
+                    self._clear_failure()
+                except Exception as exc:
+                    self._record_failure(
+                        "add-totp failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-key-value":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) != 3:
+                    self._set_status("Usage: add-key-value <label> <key> <value>")
+                    return
+                label = args[0].strip()
+                key = args[1]
+                value = args[2]
+                if not label:
+                    self._set_status("add-key-value label is required")
+                    return
+                try:
+                    new_id = self._service.add_key_value(label, key, value)
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added key/value entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-key-value failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-document":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) != 3:
+                    self._set_status(
+                        "Usage: add-document <label> <file_type> <content>"
+                    )
+                    return
+                label = args[0].strip()
+                file_type = args[1].strip().lstrip(".") or "txt"
+                content = args[2]
+                if not label:
+                    self._set_status("add-document label is required")
+                    return
+                try:
+                    new_id = self._service.add_document(
+                        label,
+                        content,
+                        file_type=file_type,
+                    )
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added document entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-document failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-ssh":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 2:
+                    self._set_status("Usage: add-ssh <label> [index]")
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-ssh label is required")
+                    return
+                index = None
+                if len(args) == 2:
+                    try:
+                        index = int(args[1])
+                    except ValueError:
+                        self._set_status("add-ssh index must be an integer")
+                        return
+                try:
+                    new_id = self._service.add_ssh_key(label, index=index)
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added SSH entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-ssh failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-pgp":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 4:
+                    self._set_status(
+                        "Usage: add-pgp <label> [index] [key_type] [user_id]"
+                    )
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-pgp label is required")
+                    return
+                index = None
+                key_type = "ed25519"
+                user_id = ""
+                if len(args) >= 2:
+                    try:
+                        index = int(args[1])
+                    except ValueError:
+                        self._set_status("add-pgp index must be an integer")
+                        return
+                if len(args) >= 3:
+                    key_type = args[2].strip() or "ed25519"
+                if len(args) >= 4:
+                    user_id = args[3]
+                try:
+                    new_id = self._service.add_pgp_key(
+                        label,
+                        index=index,
+                        key_type=key_type,
+                        user_id=user_id,
+                    )
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added PGP entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-pgp failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-nostr":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 2:
+                    self._set_status("Usage: add-nostr <label> [index]")
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-nostr label is required")
+                    return
+                index = None
+                if len(args) == 2:
+                    try:
+                        index = int(args[1])
+                    except ValueError:
+                        self._set_status("add-nostr index must be an integer")
+                        return
+                try:
+                    new_id = self._service.add_nostr_key(label, index=index)
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added Nostr entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-nostr failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "add-seed":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 3:
+                    self._set_status("Usage: add-seed <label> [words] [index]")
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-seed label is required")
+                    return
+                words = 24
+                index = None
+                if len(args) >= 2:
+                    try:
+                        words = int(args[1])
+                    except ValueError:
+                        self._set_status("add-seed words must be an integer")
+                        return
+                if len(args) == 3:
+                    try:
+                        index = int(args[2])
+                    except ValueError:
+                        self._set_status("add-seed index must be an integer")
+                        return
+                try:
+                    new_id = self._service.add_seed(
+                        label,
+                        words=words,
+                        index=index,
+                    )
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added seed entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-seed failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd in ("add-managed-account", "add-managed"):
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 2:
+                    self._set_status("Usage: add-managed-account <label> [index]")
+                    return
+                label = args[0].strip()
+                if not label:
+                    self._set_status("add-managed-account label is required")
+                    return
+                index = None
+                if len(args) == 2:
+                    try:
+                        index = int(args[1])
+                    except ValueError:
+                        self._set_status("add-managed-account index must be an integer")
+                        return
+                try:
+                    new_id = self._service.add_managed_account(label, index=index)
+                    self._load_entries(self._last_query, reset_page=False)
+                    self._show_entry(int(new_id))
+                    self._clear_failure()
+                    self._set_status(f"Added managed account entry #{int(new_id)}")
+                except Exception as exc:
+                    self._record_failure(
+                        "add-managed-account failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "notes-set":
+                if not args:
+                    self._set_status("Usage: notes-set <text>")
+                    return
+                notes_text = " ".join(args).strip()
+                if not notes_text:
+                    self._set_status("notes-set text is required")
+                    return
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message="Updated notes for selected entry",
+                    failure_context="notes-set failed",
+                    notes=notes_text,
+                )
+                return
+
+            if cmd == "notes-clear":
+                if args:
+                    self._set_status("Usage: notes-clear")
+                    return
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message="Cleared notes for selected entry",
+                    failure_context="notes-clear failed",
+                    notes="",
+                )
+                return
+
+            if cmd == "tag-add":
+                if len(args) != 1:
+                    self._set_status("Usage: tag-add <tag>")
+                    return
+                tag = args[0].strip()
+                if not tag:
+                    self._set_status("tag-add tag is required")
+                    return
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                current_tags = entry.get("tags")
+                tags = (
+                    [str(item).strip() for item in current_tags if str(item).strip()]
+                    if isinstance(current_tags, list)
+                    else []
+                )
+                if tag not in tags:
+                    tags.append(tag)
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Added tag '{tag}'",
+                    failure_context="tag-add failed",
+                    tags=tags,
+                )
+                return
+
+            if cmd == "tag-rm":
+                if len(args) != 1:
+                    self._set_status("Usage: tag-rm <tag>")
+                    return
+                tag = args[0].strip()
+                if not tag:
+                    self._set_status("tag-rm tag is required")
+                    return
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                current_tags = entry.get("tags")
+                tags = (
+                    [str(item).strip() for item in current_tags if str(item).strip()]
+                    if isinstance(current_tags, list)
+                    else []
+                )
+                next_tags = [item for item in tags if item != tag]
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Removed tag '{tag}'",
+                    failure_context="tag-rm failed",
+                    tags=next_tags,
+                )
+                return
+
+            if cmd == "tags-set":
+                if not args:
+                    self._set_status("Usage: tags-set <comma-separated tags>")
+                    return
+                raw_tags = " ".join(args).strip()
+                tags = [item.strip() for item in raw_tags.split(",") if item.strip()]
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message="Updated tags for selected entry",
+                    failure_context="tags-set failed",
+                    tags=tags,
+                )
+                return
+
+            if cmd == "tags-clear":
+                if args:
+                    self._set_status("Usage: tags-clear")
+                    return
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message="Cleared tags for selected entry",
+                    failure_context="tags-clear failed",
+                    tags=[],
+                )
+                return
+
+            if cmd == "field-add":
+                if len(args) < 2 or len(args) > 3:
+                    self._set_status(
+                        "Usage: field-add <label> <value> (optional: hidden)"
+                    )
+                    return
+                field_label = args[0].strip()
+                field_value = args[1]
+                if not field_label:
+                    self._set_status("field-add label is required")
+                    return
+                hidden = False
+                if len(args) == 3:
+                    token = args[2].strip().lower()
+                    hidden = token in {"hidden", "1", "true", "yes", "y"}
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                current_fields = entry.get("custom_fields")
+                fields = (
+                    [dict(item) for item in current_fields if isinstance(item, dict)]
+                    if isinstance(current_fields, list)
+                    else []
+                )
+                fields.append(
+                    {"label": field_label, "value": field_value, "is_hidden": hidden}
+                )
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Added custom field '{field_label}'",
+                    failure_context="field-add failed",
+                    custom_fields=fields,
+                )
+                return
+
+            if cmd == "field-rm":
+                if len(args) != 1:
+                    self._set_status("Usage: field-rm <label>")
+                    return
+                field_label = args[0].strip()
+                if not field_label:
+                    self._set_status("field-rm label is required")
+                    return
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                current_fields = entry.get("custom_fields")
+                fields = (
+                    [dict(item) for item in current_fields if isinstance(item, dict)]
+                    if isinstance(current_fields, list)
+                    else []
+                )
+                normalized = field_label.lower()
+                next_fields = [
+                    item
+                    for item in fields
+                    if str(item.get("label", "")).strip().lower() != normalized
+                ]
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Removed custom field '{field_label}'",
+                    failure_context="field-rm failed",
+                    custom_fields=next_fields,
+                )
+                return
+
+            if cmd in {"set-field", "field-set"}:
+                if len(args) < 2:
+                    self._set_status("Usage: set-field <name> <value>")
+                    return
+                field_raw = args[0].strip().lower()
+                field = field_raw.replace("-", "_")
+                value_raw = " ".join(args[1:]).strip()
+                if not field:
+                    self._set_status("set-field name is required")
+                    return
+                if not value_raw:
+                    self._set_status("set-field value is required")
+                    return
+                alias = {
+                    "name": "label",
+                    "user": "username",
+                    "pass_length": "length",
+                    "filetype": "file_type",
+                }
+                field = alias.get(field, field)
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                kind = str(entry.get("kind") or entry.get("type") or "").lower()
+                allowed_fields = {
+                    "password": {"label", "notes", "username", "url", "length"},
+                    "totp": {"label", "notes", "period", "digits"},
+                    "key_value": {"label", "notes", "key", "value"},
+                    "document": {"label", "notes", "file_type", "content"},
+                    "ssh": {"label", "notes"},
+                    "pgp": {"label", "notes"},
+                    "nostr": {"label", "notes"},
+                    "seed": {"label", "notes"},
+                    "managed_account": {"label", "notes"},
+                }
+                allowed = allowed_fields.get(kind, {"label", "notes"})
+                if field not in allowed:
+                    self._set_status(
+                        f"set-field '{field}' not supported for kind '{kind or 'unknown'}'"
+                    )
+                    return
+                value: Any = value_raw
+                if field in {"length", "period", "digits"}:
+                    try:
+                        value = int(value_raw)
+                    except ValueError:
+                        self._set_status(f"set-field {field} must be an integer")
+                        return
+                if field == "file_type":
+                    value = str(value).strip().lstrip(".") or "txt"
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Updated {field} for selected entry",
+                    failure_context="set-field failed",
+                    **{field: value},
+                )
+                return
+
+            if cmd in {"clear-field", "field-clear"}:
+                if len(args) != 1:
+                    self._set_status("Usage: clear-field <name>")
+                    return
+                field_raw = args[0].strip().lower()
+                field = field_raw.replace("-", "_")
+                if not field:
+                    self._set_status("clear-field name is required")
+                    return
+                alias = {
+                    "user": "username",
+                    "filetype": "file_type",
+                }
+                field = alias.get(field, field)
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                kind = str(entry.get("kind") or entry.get("type") or "").lower()
+                clearable = {
+                    "password": {"username", "url", "notes"},
+                    "totp": {"notes"},
+                    "key_value": {"notes", "key", "value"},
+                    "document": {"notes", "content"},
+                    "ssh": {"notes"},
+                    "pgp": {"notes"},
+                    "nostr": {"notes"},
+                    "seed": {"notes"},
+                    "managed_account": {"notes"},
+                }
+                allowed = clearable.get(kind, {"notes"})
+                if field not in allowed:
+                    self._set_status(
+                        f"clear-field '{field}' not supported for kind '{kind or 'unknown'}'"
+                    )
+                    return
+                self._apply_selected_modify(
+                    raw_command=raw,
+                    success_message=f"Cleared {field} for selected entry",
+                    failure_context="clear-field failed",
+                    **{field: ""},
+                )
+                return
+
+            if cmd == "2fa-board":
+                if args:
+                    self._set_status("Usage: 2fa-board")
+                    return
+                self._set_totp_board_visible(True)
+                self._set_status("2FA board opened")
+                return
+
+            if cmd == "2fa-hide":
+                if args:
+                    self._set_status("Usage: 2fa-hide")
+                    return
+                self._set_totp_board_visible(False)
+                self._set_status("2FA board closed")
+                return
+
+            if cmd == "2fa-refresh":
+                if args:
+                    self._set_status("Usage: 2fa-refresh")
+                    return
+                self._refresh_totp_board(force_reload=True)
+                self._set_status("2FA board refreshed")
+                return
+
+            if cmd == "2fa-copy":
+                if len(args) != 1:
+                    self._set_status("Usage: 2fa-copy <entry_id>")
+                    return
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                try:
+                    entry_id = int(args[0])
+                except ValueError:
+                    self._set_status("2fa-copy entry_id must be an integer")
+                    return
+                try:
+                    code = self._service.get_totp_code(entry_id)
+                except Exception as exc:
+                    self._record_failure(
+                        "2fa-copy failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                    return
+                if not self._copy_to_clipboard(code):
+                    self._set_status("Clipboard copy unavailable")
+                    return
+                delay = self._clipboard_clear_delay()
+                if self.totp_board_open:
+                    self._refresh_totp_board(force_reload=False)
+                self._set_status(
+                    f"Copied TOTP code for entry {entry_id} to clipboard ({delay}s clear)"
+                )
+                self._clear_failure()
+                return
+
+            if cmd == "profiles-list":
+                if args:
+                    self._set_status("Usage: profiles-list")
+                    return
+                if self._profile_service is None:
+                    self._set_status("Profile service unavailable")
+                    return
+                try:
+                    rows = self._profile_service.list_profiles()
+                    profiles = [str(item) for item in rows]
+                    if profiles:
+                        self._set_status(
+                            f"Profiles ({len(profiles)}): " + ", ".join(profiles[:4])
+                        )
+                    else:
+                        self._set_status("No profiles found")
+                    self._clear_failure()
+                except Exception as exc:
+                    self._record_failure(
+                        "profiles-list failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "profile-switch":
+                if self._profile_service is None:
+                    self._set_status("Profile service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 2:
+                    self._set_status(
+                        "Usage: profile-switch <fingerprint> (optional: password)"
+                    )
+                    return
+                fp = args[0].strip()
+                if not fp:
+                    self._set_status("profile-switch fingerprint is required")
+                    return
+                password = args[1] if len(args) == 2 else None
+                try:
+                    from seedpass.core.api import ProfileSwitchRequest
+
+                    self._profile_service.switch_profile(
+                        ProfileSwitchRequest(fingerprint=fp, password=password)
+                    )
+                    self._clear_failure()
+                    self._load_entries(self._last_query, reset_page=True)
+                    self._set_status(f"Switched profile to {fp}")
+                except Exception as exc:
+                    self._record_failure(
+                        "profile-switch failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "profile-add":
+                if self._profile_service is None:
+                    self._set_status("Profile service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: profile-add")
+                    return
+                try:
+                    fp = self._profile_service.add_profile()
+                    self._clear_failure()
+                    if fp:
+                        self._set_status(f"Created profile {fp}")
+                    else:
+                        self._set_status("Created profile")
+                except Exception as exc:
+                    self._record_failure(
+                        "profile-add failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "profile-remove":
+                if self._profile_service is None:
+                    self._set_status("Profile service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: profile-remove <fingerprint>")
+                    return
+                fp = args[0].strip()
+                if not fp:
+                    self._set_status("profile-remove fingerprint is required")
+                    return
+                try:
+                    from seedpass.core.api import ProfileRemoveRequest
+
+                    self._profile_service.remove_profile(
+                        ProfileRemoveRequest(fingerprint=fp)
+                    )
+                    self._clear_failure()
+                    self._set_status(f"Removed profile {fp}")
+                except Exception as exc:
+                    self._record_failure(
+                        "profile-remove failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "profile-rename":
+                if self._profile_service is None:
+                    self._set_status("Profile service unavailable")
+                    return
+                if len(args) < 2:
+                    self._set_status("Usage: profile-rename <fingerprint> <name>")
+                    return
+                fp = args[0].strip()
+                name = " ".join(args[1:]).strip()
+                if not fp:
+                    self._set_status("profile-rename fingerprint is required")
+                    return
+                if not name:
+                    self._set_status("profile-rename name is required")
+                    return
+                try:
+                    self._profile_service.rename_profile(fp, name)
+                    self._clear_failure()
+                    self._set_status(f"Renamed profile {fp} to '{name}'")
+                except Exception as exc:
+                    self._record_failure(
+                        "profile-rename failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-secret":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) < 1 or len(args) > 2:
+                    self._set_status("Usage: setting-secret <on|off> [delay]")
+                    return
+                try:
+                    enabled = self._parse_toggle_token(args[0])
+                except ValueError as exc:
+                    self._set_status(str(exc))
+                    return
+                delay = self._clipboard_clear_delay()
+                if len(args) == 2:
+                    try:
+                        delay = int(args[1])
+                    except ValueError:
+                        self._set_status("setting-secret delay must be an integer")
+                        return
+                setter = getattr(self._config_service, "set_secret_mode", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support secret mode")
+                    return
+                try:
+                    setter(enabled, int(delay))
+                    self._clear_failure()
+                    state = "on" if enabled else "off"
+                    self._set_status(f"Secret mode {state} (delay {int(delay)}s)")
+                    if self.totp_board_open:
+                        self._refresh_totp_board(force_reload=False)
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-secret failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-offline":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: setting-offline <on|off>")
+                    return
+                try:
+                    enabled = self._parse_toggle_token(args[0])
+                except ValueError as exc:
+                    self._set_status(str(exc))
+                    return
+                setter = getattr(self._config_service, "set_offline_mode", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support offline mode")
+                    return
+                try:
+                    setter(enabled)
+                    self._clear_failure()
+                    self._set_status(f"Offline mode {'on' if enabled else 'off'}")
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-offline failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-quick-unlock":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: setting-quick-unlock <on|off>")
+                    return
+                try:
+                    enabled = self._parse_toggle_token(args[0])
+                except ValueError as exc:
+                    self._set_status(str(exc))
+                    return
+                setter = getattr(self._config_service, "set", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support quick unlock")
+                    return
+                try:
+                    setter("quick_unlock", "true" if enabled else "false")
+                    self._clear_failure()
+                    self._set_status(f"Quick unlock {'on' if enabled else 'off'}")
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-quick-unlock failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-timeout":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: setting-timeout <seconds>")
+                    return
+                try:
+                    value = float(args[0])
+                except ValueError:
+                    self._set_status("setting-timeout requires numeric seconds")
+                    return
+                setter = getattr(self._config_service, "set", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support timeout setting")
+                    return
+                try:
+                    setter("inactivity_timeout", str(value))
+                    self._clear_failure()
+                    self._set_status(f"Inactivity timeout set to {value}s")
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-timeout failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-kdf-iterations":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: setting-kdf-iterations <n>")
+                    return
+                try:
+                    value = int(args[0])
+                except ValueError:
+                    self._set_status("setting-kdf-iterations requires integer value")
+                    return
+                setter = getattr(self._config_service, "set", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support KDF settings")
+                    return
+                try:
+                    setter("kdf_iterations", str(value))
+                    self._clear_failure()
+                    self._set_status(f"KDF iterations set to {value}")
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-kdf-iterations failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "setting-kdf-mode":
+                if self._config_service is None:
+                    self._set_status("Config service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: setting-kdf-mode <mode>")
+                    return
+                mode = args[0].strip()
+                if not mode:
+                    self._set_status("setting-kdf-mode mode is required")
+                    return
+                setter = getattr(self._config_service, "set", None)
+                if not callable(setter):
+                    self._set_status("Config service does not support KDF settings")
+                    return
+                try:
+                    setter("kdf_mode", mode)
+                    self._clear_failure()
+                    self._set_status(f"KDF mode set to {mode}")
+                except Exception as exc:
+                    self._record_failure(
+                        "setting-kdf-mode failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "relay-list":
+                if self._nostr_service is None:
+                    self._set_status("Nostr service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: relay-list")
+                    return
+                try:
+                    relays = [str(item) for item in self._nostr_service.list_relays()]
+                    self._clear_failure()
+                    if relays:
+                        self._set_status(
+                            f"Relays ({len(relays)}): " + ", ".join(relays[:3])
+                        )
+                    else:
+                        self._set_status("No relays configured")
+                except Exception as exc:
+                    self._record_failure(
+                        "relay-list failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "relay-add":
+                if self._nostr_service is None:
+                    self._set_status("Nostr service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: relay-add <url>")
+                    return
+                url = args[0].strip()
+                if not url:
+                    self._set_status("relay-add url is required")
+                    return
+                try:
+                    self._nostr_service.add_relay(url)
+                    self._clear_failure()
+                    self._set_status(f"Added relay {url}")
+                except Exception as exc:
+                    self._record_failure(
+                        "relay-add failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd in {"relay-rm", "relay-remove"}:
+                if self._nostr_service is None:
+                    self._set_status("Nostr service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: relay-rm <index>")
+                    return
+                try:
+                    idx = int(args[0])
+                except ValueError:
+                    self._set_status("relay-rm index must be an integer")
+                    return
+                try:
+                    self._nostr_service.remove_relay(idx)
+                    self._clear_failure()
+                    self._set_status(f"Removed relay #{idx}")
+                except Exception as exc:
+                    self._record_failure(
+                        "relay-rm failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "relay-reset":
+                if self._nostr_service is None:
+                    self._set_status("Nostr service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: relay-reset")
+                    return
+                resetter = getattr(self._nostr_service, "reset_relays", None)
+                if not callable(resetter):
+                    self._set_status("Nostr service does not support relay reset")
+                    return
+                try:
+                    relays = list(resetter())
+                    self._clear_failure()
+                    self._set_status(f"Relays reset ({len(relays)})")
+                except Exception as exc:
+                    self._record_failure(
+                        "relay-reset failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "sync-now":
+                if self._sync_service is None:
+                    self._set_status("Sync service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: sync-now")
+                    return
+                try:
+                    result = self._sync_service.sync()
+                    self._clear_failure()
+                    if result is None:
+                        self._set_status("Sync completed (no publish result)")
+                    else:
+                        manifest = getattr(result, "manifest_id", "unknown")
+                        self._set_status(f"Sync completed manifest {manifest}")
+                except Exception as exc:
+                    self._record_failure(
+                        "sync-now failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "sync-bg":
+                if self._sync_service is None:
+                    self._set_status("Sync service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: sync-bg")
+                    return
+                try:
+                    self._sync_service.start_background_vault_sync()
+                    self._clear_failure()
+                    self._set_status("Background sync started")
+                except Exception as exc:
+                    self._record_failure(
+                        "sync-bg failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "checksum-verify":
+                if self._utility_service is None:
+                    self._set_status("Utility service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: checksum-verify")
+                    return
+                verifier = getattr(self._utility_service, "verify_checksum", None)
+                if not callable(verifier):
+                    self._set_status("Utility service does not support checksum verify")
+                    return
+                try:
+                    verifier()
+                    self._clear_failure()
+                    self._set_status("Checksum verification complete")
+                except Exception as exc:
+                    self._record_failure(
+                        "checksum-verify failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "checksum-update":
+                if self._utility_service is None:
+                    self._set_status("Utility service unavailable")
+                    return
+                if args:
+                    self._set_status("Usage: checksum-update")
+                    return
+                updater = getattr(self._utility_service, "update_checksum", None)
+                if not callable(updater):
+                    self._set_status("Utility service does not support checksum update")
+                    return
+                try:
+                    updater()
+                    self._clear_failure()
+                    self._set_status("Checksum updated")
+                except Exception as exc:
+                    self._record_failure(
+                        "checksum-update failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "db-export":
+                if self._vault_service is None:
+                    self._set_status("Vault service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: db-export <path>")
+                    return
+                try:
+                    from seedpass.core.api import VaultExportRequest
+
+                    path = Path(args[0]).expanduser()
+                    self._vault_service.export_vault(VaultExportRequest(path=path))
+                    self._clear_failure()
+                    self._set_status(f"Database exported to {path}")
+                except Exception as exc:
+                    self._record_failure(
+                        "db-export failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "db-import":
+                if self._vault_service is None:
+                    self._set_status("Vault service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: db-import <path>")
+                    return
+                try:
+                    from seedpass.core.api import VaultImportRequest
+
+                    path = Path(args[0]).expanduser()
+                    self._vault_service.import_vault(VaultImportRequest(path=path))
+                    self._clear_failure()
+                    self._load_entries(self._last_query, reset_page=True)
+                    self._set_status(f"Database imported from {path}")
+                except Exception as exc:
+                    self._record_failure(
+                        "db-import failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "totp-export":
+                if self._service is None:
+                    self._set_status("Entry service unavailable")
+                    return
+                if len(args) != 1:
+                    self._set_status("Usage: totp-export <path>")
+                    return
+                path = Path(args[0]).expanduser()
+                try:
+                    payload = self._service.export_totp_entries()
+                    path.parent.mkdir(parents=True, exist_ok=True)
+                    path.write_text(
+                        json.dumps(payload, indent=2, sort_keys=True),
+                        encoding="utf-8",
+                    )
+                    self._clear_failure()
+                    self._set_status(f"Exported TOTP entries to {path}")
+                except Exception as exc:
+                    self._record_failure(
+                        "totp-export failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "parent-seed-backup":
+                if self._vault_service is None:
+                    self._set_status("Vault service unavailable")
+                    return
+                if len(args) > 2:
+                    self._set_status(
+                        "Usage: parent-seed-backup (optional: path) (optional: password)"
+                    )
+                    return
+                path = Path(args[0]).expanduser() if len(args) >= 1 else None
+                password = args[1] if len(args) >= 2 else None
+                try:
+                    from seedpass.core.api import BackupParentSeedRequest
+
+                    self._vault_service.backup_parent_seed(
+                        BackupParentSeedRequest(path=path, password=password)
+                    )
+                    self._clear_failure()
+                    if path is not None:
+                        self._set_status(f"Parent seed backup written to {path}")
+                    else:
+                        self._set_status("Parent seed backup/reveal completed")
+                except Exception as exc:
+                    self._record_failure(
+                        "parent-seed-backup failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
+            if cmd == "doc-export":
+                if self._service is None or self._selected_entry_id is None:
+                    self._set_status("No entry selected")
+                    return
+                if len(args) > 1:
+                    self._set_status("Usage: doc-export (optional: output_path)")
+                    return
+                try:
+                    entry = self._selected_entry_payload()
+                except Exception as exc:
+                    self._set_status(str(exc))
+                    return
+                kind = str(entry.get("kind") or entry.get("type") or "").strip().lower()
+                if kind != "document":
+                    self._set_status("doc-export requires selected document entry")
+                    return
+                output_path = args[0] if args else None
+                try:
+                    dest = self._service.export_document_file(
+                        self._selected_entry_id, output_path=output_path
+                    )
+                    self._clear_failure()
+                    self._set_status(f"Exported document to {dest}")
+                except Exception as exc:
+                    self._record_failure(
+                        "doc-export failed",
+                        exc,
+                        retry=lambda: self._run_palette_command(raw),
+                        hint="Press 'x' to retry.",
+                    )
+                return
+
             if cmd in ("archive", "restore"):
                 if self._service is None or self._selected_entry_id is None:
                     self._set_status("No entry selected")
@@ -1326,6 +2950,8 @@ def launch_tui2(
             search = self.query_one("#search", Input).value
             self._update_filters_panel()
             self._load_entries(query=search, reset_page=False)
+            if self.totp_board_open:
+                self._refresh_totp_board(force_reload=True)
 
         def action_toggle_help(self) -> None:
             if self.palette_open:
@@ -1510,6 +3136,19 @@ def launch_tui2(
         def action_show_qr(self, mode: str = "default", confirm: bool = False) -> None:
             self._show_sensitive_panel(include_qr=True, qr_mode=mode, confirm=confirm)
 
+        def action_toggle_totp_board(self) -> None:
+            if self.editing_document:
+                self._set_status("Finish document edit before opening 2FA board")
+                return
+            target = not self.totp_board_open
+            self._set_totp_board_visible(target)
+            self._focus_pane = "right"
+            self._apply_focus_style()
+            if target:
+                self._set_status("2FA board opened")
+            else:
+                self._set_status("2FA board closed")
+
         def action_toggle_archive(self) -> None:
             if self._service is None or self._selected_entry_id is None:
                 self._set_status("No entry selected")
@@ -1641,6 +3280,10 @@ def launch_tui2(
                 self._update_help_overlay()
                 self._set_status("Help closed")
                 return
+            if self.totp_board_open:
+                self._set_totp_board_visible(False)
+                self._set_status("2FA board closed")
+                return
             if not self.editing_document:
                 return
             self._set_document_editor_visible(False)
diff --git a/src/tests/test_tui_v2_action_matrix.py b/src/tests/test_tui_v2_action_matrix.py
index 597d42ce..26a274e2 100644
--- a/src/tests/test_tui_v2_action_matrix.py
+++ b/src/tests/test_tui_v2_action_matrix.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from pathlib import Path
 from types import SimpleNamespace
 
 import pytest
@@ -39,6 +40,9 @@ class MatrixEntryService:
         self.clipboard_delay = 30
         self.clipboard_values: list[str] = []
 
+    def _next_id(self) -> int:
+        return (max(self._entries.keys()) + 1) if self._entries else 1
+
     def search_entries(self, query: str, kinds: list[str] | None = None):
         if self.fail_search:
             raise RuntimeError("search failed")
@@ -69,6 +73,198 @@ class MatrixEntryService:
             return {}
         return dict(self._entries[int(entry_id)])
 
+    def add_entry(
+        self,
+        label: str,
+        length: int,
+        username: str | None = None,
+        url: str | None = None,
+    ) -> int:
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "password",
+            "label": label,
+            "length": int(length),
+            "username": username,
+            "url": url,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_totp(
+        self,
+        label: str,
+        *,
+        index: int | None = None,
+        secret: str | None = None,
+        period: int = 30,
+        digits: int = 6,
+        deterministic: bool = False,
+    ) -> str:
+        _ = (index, deterministic)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "totp",
+            "label": label,
+            "secret": secret or "JBSWY3DPEHPK3PXP",
+            "period": int(period),
+            "digits": int(digits),
+            "archived": False,
+        }
+        return f"otpauth://totp/{label}"
+
+    def add_key_value(
+        self, label: str, key: str, value: str, *, notes: str = ""
+    ) -> int:
+        _ = notes
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "key_value",
+            "label": label,
+            "key": key,
+            "value": value,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_document(
+        self,
+        label: str,
+        content: str,
+        *,
+        file_type: str = "txt",
+        notes: str = "",
+        tags: list[str] | None = None,
+        archived: bool = False,
+    ) -> int:
+        _ = notes
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "document",
+            "label": label,
+            "content": content,
+            "file_type": file_type,
+            "tags": tags or [],
+            "archived": bool(archived),
+        }
+        return entry_id
+
+    def add_ssh_key(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "ssh",
+            "label": label,
+            "private_key": f"SSH_PRIVATE_{entry_id}",
+            "public_key": f"ssh-ed25519 AAAA-{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_pgp_key(
+        self,
+        label: str,
+        *,
+        index: int | None = None,
+        key_type: str = "ed25519",
+        user_id: str = "",
+        notes: str = "",
+    ) -> int:
+        _ = (index, key_type, user_id, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "pgp",
+            "label": label,
+            "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----",
+            "fingerprint": f"FPR-{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_nostr_key(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "nostr",
+            "label": label,
+            "npub": f"npub{entry_id}",
+            "nsec": f"nsec{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_seed(
+        self,
+        label: str,
+        *,
+        index: int | None = None,
+        words: int = 24,
+        notes: str = "",
+    ) -> int:
+        _ = (index, notes)
+        word_count = max(12, int(words))
+        phrase = " ".join(["abandon"] * (word_count - 1) + ["about"])
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "seed",
+            "label": label,
+            "seed_phrase": phrase,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_managed_account(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "managed_account",
+            "label": label,
+            "seed_phrase": "legal winner thank year wave sausage worth useful legal winner thank yellow",
+            "archived": False,
+        }
+        return entry_id
+
+    def export_document_file(
+        self,
+        entry_id: int,
+        output_path: str | Path | None = None,
+        *,
+        overwrite: bool = False,
+    ) -> Path:
+        _ = overwrite
+        entry = self._entries[int(entry_id)]
+        kind = str(entry.get("kind", ""))
+        if kind != "document":
+            raise ValueError("Entry is not a document entry")
+        name = str(entry.get("label", f"document-{entry_id}")).replace(" ", "_")
+        ext = str(entry.get("file_type", "txt")).lstrip(".") or "txt"
+        if output_path is None:
+            dest = Path.cwd() / f"{name}.{ext}"
+        else:
+            raw = Path(output_path)
+            if raw.suffix:
+                dest = raw
+            else:
+                dest = raw / f"{name}.{ext}"
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_text(str(entry.get("content", "")), encoding="utf-8")
+        return dest
+
     def modify_entry(self, entry_id: int, **kwargs) -> None:
         if self.fail_modify:
             raise RuntimeError("modify failed")
@@ -289,6 +485,61 @@ async def test_tui2_matrix_actions_palette_events_and_guards() -> None:
         app._run_palette_command("link-add no")
         app._run_palette_command("link-rm")
         app._run_palette_command("link-rm no")
+        app._run_palette_command("add-password")
+        app._run_palette_command("add-password Site nope")
+        app._run_palette_command("add-totp")
+        app._run_palette_command("add-totp Auth bad")
+        app._run_palette_command("add-key-value")
+        app._run_palette_command("add-document")
+        app._run_palette_command("add-ssh")
+        app._run_palette_command("add-ssh Host nope")
+        app._run_palette_command("add-pgp")
+        app._run_palette_command("add-pgp Pgp nope")
+        app._run_palette_command("add-nostr")
+        app._run_palette_command("add-nostr Nostr nope")
+        app._run_palette_command("add-seed")
+        app._run_palette_command("add-seed Seed nope")
+        app._run_palette_command("add-managed-account")
+        app._run_palette_command("add-managed-account Managed nope")
+        app._run_palette_command("notes-set")
+        app._run_palette_command("notes-clear nope")
+        app._run_palette_command("tag-add")
+        app._run_palette_command("tag-rm")
+        app._run_palette_command("tags-set")
+        app._run_palette_command("tags-clear nope")
+        app._run_palette_command("field-add")
+        app._run_palette_command("field-rm")
+        app._run_palette_command("set-field")
+        app._run_palette_command("clear-field")
+        app._run_palette_command("2fa-board nope")
+        app._run_palette_command("2fa-hide nope")
+        app._run_palette_command("2fa-refresh nope")
+        app._run_palette_command("2fa-copy")
+        app._run_palette_command("2fa-copy nope")
+        app._run_palette_command("profiles-list")
+        app._run_palette_command("profile-switch")
+        app._run_palette_command("profile-add")
+        app._run_palette_command("profile-remove")
+        app._run_palette_command("profile-rename")
+        app._run_palette_command("setting-secret on")
+        app._run_palette_command("setting-offline on")
+        app._run_palette_command("setting-quick-unlock on")
+        app._run_palette_command("setting-timeout 300")
+        app._run_palette_command("setting-kdf-iterations 100000")
+        app._run_palette_command("setting-kdf-mode pbkdf2")
+        app._run_palette_command("relay-list")
+        app._run_palette_command("relay-add wss://relay.example")
+        app._run_palette_command("relay-rm 1")
+        app._run_palette_command("relay-reset")
+        app._run_palette_command("sync-now")
+        app._run_palette_command("sync-bg")
+        app._run_palette_command("checksum-verify")
+        app._run_palette_command("checksum-update")
+        app._run_palette_command("db-export /tmp/seedpass-db.enc")
+        app._run_palette_command("db-import /tmp/seedpass-db.enc")
+        app._run_palette_command("totp-export /tmp/seedpass-totp.json")
+        app._run_palette_command("parent-seed-backup")
+        app._run_palette_command("doc-export one two")
         app._run_palette_command("filter")
         app._run_palette_command("unknown-cmd")
         await pilot.pause()
@@ -301,6 +552,29 @@ async def test_tui2_matrix_actions_palette_events_and_guards() -> None:
         app._run_palette_command("page 2")
         app._run_palette_command("open 1")
         app._run_palette_command("jump 2")
+        app._run_palette_command("add-password NewLogin 18 user https://seedpass.dev")
+        app._run_palette_command("add-totp NewAuth 30 6 JBSWY3DPEHPK3PXP")
+        app._run_palette_command("add-key-value Env API_KEY value")
+        app._run_palette_command("add-document Runbook md body")
+        app._run_palette_command("add-ssh Host 10")
+        app._run_palette_command("add-pgp Pgp 11 ed25519 user@example.com")
+        app._run_palette_command("add-nostr Nostr 12")
+        app._run_palette_command("add-seed Seed 24 13")
+        app._run_palette_command("add-managed-account Managed 14")
+        app._run_palette_command('notes-set "matrix note"')
+        app._run_palette_command("tag-add matrix")
+        app._run_palette_command("tag-rm matrix")
+        app._run_palette_command("tags-set m1, m2")
+        app._run_palette_command("tags-clear")
+        app._run_palette_command("field-add scope admin hidden")
+        app._run_palette_command("field-rm scope")
+        app._run_palette_command("set-field notes matrix-updated")
+        app._run_palette_command("clear-field notes")
+        app._run_palette_command("2fa-board")
+        app._run_palette_command("2fa-copy 2")
+        app._run_palette_command("2fa-refresh")
+        app._run_palette_command("2fa-hide")
+        app._run_palette_command("doc-export /tmp/seedpass-matrix-export")
         await pilot.pause()
 
         app._run_palette_command("open 2")
diff --git a/src/tests/test_tui_v2_textual_interactions.py b/src/tests/test_tui_v2_textual_interactions.py
index 9d6cb387..11444715 100644
--- a/src/tests/test_tui_v2_textual_interactions.py
+++ b/src/tests/test_tui_v2_textual_interactions.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from pathlib import Path
 from types import SimpleNamespace
 
 import pytest
@@ -22,6 +23,9 @@ class FakeEntryService:
         self.clipboard_delay = 30
         self.clipboard_values: list[str] = []
 
+    def _next_id(self) -> int:
+        return (max(self._entries.keys()) + 1) if self._entries else 1
+
     def search_entries(self, query: str, kinds: list[str] | None = None):
         if self.fail_search_times > 0:
             self.fail_search_times -= 1
@@ -52,6 +56,183 @@ class FakeEntryService:
     def retrieve_entry(self, entry_id: int):
         return dict(self._entries.get(int(entry_id), {}))
 
+    def add_entry(
+        self,
+        label: str,
+        length: int,
+        username: str | None = None,
+        url: str | None = None,
+    ) -> int:
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "password",
+            "label": label,
+            "length": int(length),
+            "username": username,
+            "url": url,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_totp(
+        self,
+        label: str,
+        *,
+        secret: str | None = None,
+        period: int = 30,
+        digits: int = 6,
+        deterministic: bool = False,
+    ) -> str:
+        _ = deterministic
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "totp",
+            "label": label,
+            "secret": secret or "JBSWY3DPEHPK3PXP",
+            "period": int(period),
+            "digits": int(digits),
+            "archived": False,
+        }
+        return f"otpauth://totp/{label}"
+
+    def add_key_value(self, label: str, key: str, value: str) -> int:
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "key_value",
+            "label": label,
+            "key": key,
+            "value": value,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_document(self, label: str, content: str, *, file_type: str = "txt") -> int:
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "document",
+            "label": label,
+            "content": content,
+            "file_type": file_type,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_ssh_key(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "ssh",
+            "label": label,
+            "private_key": f"SSH_PRIVATE_{entry_id}",
+            "public_key": f"ssh-ed25519 AAAA-{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_pgp_key(
+        self,
+        label: str,
+        *,
+        index: int | None = None,
+        key_type: str = "ed25519",
+        user_id: str = "",
+        notes: str = "",
+    ) -> int:
+        _ = (index, key_type, user_id, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "pgp",
+            "label": label,
+            "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----",
+            "fingerprint": f"FPR-{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_nostr_key(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "nostr",
+            "label": label,
+            "npub": f"npub{entry_id}",
+            "nsec": f"nsec{entry_id}",
+            "archived": False,
+        }
+        return entry_id
+
+    def add_seed(
+        self,
+        label: str,
+        *,
+        index: int | None = None,
+        words: int = 24,
+        notes: str = "",
+    ) -> int:
+        _ = (index, notes)
+        word_count = max(12, int(words))
+        phrase = " ".join(["abandon"] * (word_count - 1) + ["about"])
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "seed",
+            "label": label,
+            "seed_phrase": phrase,
+            "archived": False,
+        }
+        return entry_id
+
+    def add_managed_account(
+        self, label: str, *, index: int | None = None, notes: str = ""
+    ) -> int:
+        _ = (index, notes)
+        entry_id = self._next_id()
+        self._entries[entry_id] = {
+            "id": entry_id,
+            "kind": "managed_account",
+            "label": label,
+            "seed_phrase": "legal winner thank year wave sausage worth useful legal winner thank yellow",
+            "archived": False,
+        }
+        return entry_id
+
+    def export_document_file(
+        self,
+        entry_id: int,
+        output_path: str | Path | None = None,
+        *,
+        overwrite: bool = False,
+    ) -> Path:
+        _ = overwrite
+        entry = self._entries[int(entry_id)]
+        kind = str(entry.get("kind", ""))
+        if kind != "document":
+            raise ValueError("Entry is not a document entry")
+        name = str(entry.get("label", f"document-{entry_id}")).replace(" ", "_")
+        ext = str(entry.get("file_type", "txt")).lstrip(".") or "txt"
+        if output_path is None:
+            dest = Path.cwd() / f"{name}.{ext}"
+        else:
+            raw = Path(output_path)
+            if raw.suffix:
+                dest = raw
+            else:
+                dest = raw / f"{name}.{ext}"
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_text(str(entry.get("content", "")), encoding="utf-8")
+        return dest
+
     def modify_entry(self, entry_id: int, **kwargs) -> None:
         entry = self._entries[int(entry_id)]
         for key, value in kwargs.items():
@@ -83,6 +264,19 @@ class FakeEntryService:
         _ = entry_id
         return "123456"
 
+    def export_totp_entries(self) -> dict:
+        payload: dict[str, dict[str, object]] = {}
+        for entry_id, entry in self._entries.items():
+            if str(entry.get("kind")) != "totp":
+                continue
+            payload[str(entry_id)] = {
+                "label": str(entry.get("label", f"totp-{entry_id}")),
+                "period": int(entry.get("period", 30)),
+                "digits": int(entry.get("digits", 6)),
+                "secret": str(entry.get("secret", "JBSWY3DPEHPK3PXP")),
+            }
+        return payload
+
     def get_ssh_key_pair(self, entry_id: int):
         entry = self._entries[int(entry_id)]
         return (
@@ -156,13 +350,200 @@ class FakeEntryService:
         return [dict(link) for link in kept]
 
 
-def _build_app(service: FakeEntryService):
+class FakeProfileService:
+    def __init__(self, profiles: list[str]) -> None:
+        self.profiles = list(profiles)
+        self.last_switch: tuple[str, str | None] | None = None
+        self.add_count = 0
+        self.removed: list[str] = []
+        self.renamed: dict[str, str] = {}
+
+    def list_profiles(self) -> list[str]:
+        return list(self.profiles)
+
+    def switch_profile(self, req) -> None:
+        fp = str(getattr(req, "fingerprint", ""))
+        pw = getattr(req, "password", None)
+        if fp not in self.profiles:
+            raise ValueError("profile not found")
+        self.last_switch = (fp, pw)
+
+    def add_profile(self) -> str:
+        self.add_count += 1
+        fp = f"fp-new-{self.add_count}"
+        self.profiles.append(fp)
+        return fp
+
+    def remove_profile(self, req) -> None:
+        fp = str(getattr(req, "fingerprint", ""))
+        if fp not in self.profiles:
+            raise ValueError("profile not found")
+        self.profiles = [item for item in self.profiles if item != fp]
+        self.removed.append(fp)
+
+    def rename_profile(self, fingerprint: str, name: str | None) -> None:
+        fp = str(fingerprint)
+        if fp not in self.profiles:
+            raise ValueError("profile not found")
+        if not name:
+            raise ValueError("name required")
+        self.renamed[fp] = str(name)
+
+
+class FakeConfigService:
+    def __init__(self) -> None:
+        self.secret_mode_enabled = False
+        self.clipboard_delay = 30
+        self.offline_mode = True
+        self.quick_unlock = False
+        self.inactivity_timeout = 300.0
+        self.kdf_iterations = 100000
+        self.kdf_mode = "pbkdf2"
+
+    def set_secret_mode(self, enabled: bool, delay: int) -> None:
+        self.secret_mode_enabled = bool(enabled)
+        self.clipboard_delay = int(delay)
+
+    def set_offline_mode(self, enabled: bool) -> None:
+        self.offline_mode = bool(enabled)
+
+    def set(self, key: str, value: str) -> None:
+        if key == "quick_unlock":
+            self.quick_unlock = value.strip().lower() in {
+                "1",
+                "true",
+                "yes",
+                "y",
+                "on",
+            }
+            return
+        if key == "inactivity_timeout":
+            self.inactivity_timeout = float(value)
+            return
+        if key == "kdf_iterations":
+            self.kdf_iterations = int(value)
+            return
+        if key == "kdf_mode":
+            self.kdf_mode = str(value)
+            return
+        raise KeyError(key)
+
+
+class FakeNostrService:
+    def __init__(self, relays: list[str]) -> None:
+        self.relays = list(relays)
+
+    def list_relays(self) -> list[str]:
+        return list(self.relays)
+
+    def add_relay(self, url: str) -> None:
+        if url in self.relays:
+            return
+        self.relays.append(url)
+
+    def remove_relay(self, idx: int) -> None:
+        if not 1 <= int(idx) <= len(self.relays):
+            raise ValueError("invalid relay index")
+        self.relays.pop(int(idx) - 1)
+
+    def reset_relays(self) -> list[str]:
+        self.relays = ["wss://default-1", "wss://default-2"]
+        return list(self.relays)
+
+
+class FakeSyncResult:
+    def __init__(self, manifest_id: str) -> None:
+        self.manifest_id = manifest_id
+
+
+class FakeSyncService:
+    def __init__(self) -> None:
+        self.sync_calls = 0
+        self.bg_calls = 0
+
+    def sync(self):
+        self.sync_calls += 1
+        return FakeSyncResult(f"manifest-{self.sync_calls}")
+
+    def start_background_vault_sync(self) -> None:
+        self.bg_calls += 1
+
+
+class FakeUtilityService:
+    def __init__(self) -> None:
+        self.verify_calls = 0
+        self.update_calls = 0
+
+    def verify_checksum(self) -> None:
+        self.verify_calls += 1
+
+    def update_checksum(self) -> None:
+        self.update_calls += 1
+
+
+class FakeVaultService:
+    def __init__(self) -> None:
+        self.exported: list[Path] = []
+        self.imported: list[Path] = []
+        self.parent_seed_backups: list[tuple[Path | None, str | None]] = []
+
+    def export_vault(self, req) -> None:
+        path = Path(getattr(req, "path"))
+        self.exported.append(path)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("vault-export", encoding="utf-8")
+
+    def import_vault(self, req) -> None:
+        path = Path(getattr(req, "path"))
+        self.imported.append(path)
+
+    def backup_parent_seed(self, req) -> None:
+        path = getattr(req, "path", None)
+        password = getattr(req, "password", None)
+        if path is not None:
+            path = Path(path)
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text("seed-backup", encoding="utf-8")
+        self.parent_seed_backups.append((path, password))
+
+
+def _build_app(
+    service: FakeEntryService,
+    *,
+    profile_service=None,
+    config_service=None,
+    nostr_service=None,
+    sync_service=None,
+    utility_service=None,
+    vault_service=None,
+):
     holder: dict[str, object] = {}
 
     def _hook(app):
         holder["app"] = app
 
-    launched = launch_tui2(entry_service_factory=lambda: service, app_hook=_hook)
+    launched = launch_tui2(
+        entry_service_factory=lambda: service,
+        profile_service_factory=(
+            (lambda: profile_service) if profile_service is not None else None
+        ),
+        config_service_factory=(
+            (lambda: config_service) if config_service is not None else None
+        ),
+        nostr_service_factory=(
+            (lambda: nostr_service) if nostr_service is not None else None
+        ),
+        sync_service_factory=(
+            (lambda: sync_service) if sync_service is not None else None
+        ),
+        utility_service_factory=(
+            (lambda: utility_service) if utility_service is not None else None
+        ),
+        vault_service_factory=(
+            (lambda: vault_service) if vault_service is not None else None
+        ),
+        app_hook=_hook,
+    )
     assert launched is True
     app = holder.get("app")
     assert app is not None
@@ -396,3 +777,697 @@ async def test_tui2_textual_retry_after_search_failure() -> None:
         list_view = app.query_one("#entry-list", ListView)
         assert len(list_view.children) == 1
         assert "retry" not in _status_text(app).lower()
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_add_commands() -> None:
+    service = FakeEntryService([{"id": 1, "kind": "document", "label": "Start"}])
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+
+        app._run_palette_command("add-password Login 20 alice https://example.com")
+        await pilot.pause()
+        assert "Added password entry #2" in _status_text(app)
+        assert service.retrieve_entry(2)["kind"] == "password"
+
+        app._run_palette_command("add-totp Auth 45 8 JBSWY3DPEHPK3PXP")
+        await pilot.pause()
+        assert "Added TOTP entry #3" in _status_text(app)
+        assert service.retrieve_entry(3)["period"] == 45
+        assert service.retrieve_entry(3)["digits"] == 8
+
+        app._run_palette_command("add-key-value Env API_KEY abc123")
+        await pilot.pause()
+        assert "Added key/value entry #4" in _status_text(app)
+        assert service.retrieve_entry(4)["value"] == "abc123"
+
+        app._run_palette_command("add-document Notes md body")
+        await pilot.pause()
+        assert "Added document entry #5" in _status_text(app)
+        assert service.retrieve_entry(5)["file_type"] == "md"
+
+        app._run_palette_command("add-ssh HostKey 7")
+        await pilot.pause()
+        assert "Added SSH entry #6" in _status_text(app)
+        assert service.retrieve_entry(6)["kind"] == "ssh"
+
+        app._run_palette_command("add-pgp PgpKey 8 ed25519 user@example.com")
+        await pilot.pause()
+        assert "Added PGP entry #7" in _status_text(app)
+        assert service.retrieve_entry(7)["kind"] == "pgp"
+
+        app._run_palette_command("add-nostr NostrKey 9")
+        await pilot.pause()
+        assert "Added Nostr entry #8" in _status_text(app)
+        assert service.retrieve_entry(8)["kind"] == "nostr"
+
+        app._run_palette_command("add-seed TravelSeed 12 10")
+        await pilot.pause()
+        assert "Added seed entry #9" in _status_text(app)
+        assert service.retrieve_entry(9)["kind"] == "seed"
+
+        app._run_palette_command("add-managed-account Managed 11")
+        await pilot.pause()
+        assert "Added managed account entry #10" in _status_text(app)
+        assert service.retrieve_entry(10)["kind"] == "managed_account"
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_add_commands_validation_errors() -> None:
+    service = FakeEntryService([{"id": 1, "kind": "document", "label": "Start"}])
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+
+        app._run_palette_command("add-password Login not-a-number")
+        await pilot.pause()
+        assert "length must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-totp Auth bad 8")
+        await pilot.pause()
+        assert "period must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-key-value only-two-args key")
+        await pilot.pause()
+        assert "Usage: add-key-value <label> <key> <value>" in _status_text(app)
+
+        app._run_palette_command("add-document too few")
+        await pilot.pause()
+        assert "Usage: add-document <label> <file_type> <content>" in _status_text(app)
+
+        app._run_palette_command("add-ssh Host abc")
+        await pilot.pause()
+        assert "add-ssh index must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-pgp Pgp nope")
+        await pilot.pause()
+        assert "add-pgp index must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-nostr Nostr nope")
+        await pilot.pause()
+        assert "add-nostr index must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-seed Seed nope")
+        await pilot.pause()
+        assert "add-seed words must be an integer" in _status_text(app)
+
+        app._run_palette_command("add-managed-account Managed nope")
+        await pilot.pause()
+        assert "add-managed-account index must be an integer" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_notes_tags_fields_and_doc_export(
+    tmp_path: Path,
+) -> None:
+    service = FakeEntryService(
+        [
+            {
+                "id": 1,
+                "kind": "document",
+                "label": "Runbook",
+                "content": "line-1\nline-2",
+                "file_type": "md",
+                "notes": "old",
+                "tags": ["alpha"],
+                "custom_fields": [
+                    {"label": "token", "value": "abc", "is_hidden": False}
+                ],
+            },
+            {"id": 2, "kind": "password", "label": "Login"},
+        ]
+    )
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._run_palette_command("open 1")
+        await pilot.pause()
+
+        app._run_palette_command('notes-set "updated note"')
+        await pilot.pause()
+        assert service.retrieve_entry(1)["notes"] == "updated note"
+
+        app._run_palette_command("tag-add beta")
+        await pilot.pause()
+        assert "beta" in service.retrieve_entry(1).get("tags", [])
+
+        app._run_palette_command("tag-rm alpha")
+        await pilot.pause()
+        assert "alpha" not in service.retrieve_entry(1).get("tags", [])
+
+        app._run_palette_command("tags-set gamma, delta")
+        await pilot.pause()
+        assert service.retrieve_entry(1).get("tags", []) == ["gamma", "delta"]
+
+        app._run_palette_command("field-add api_key secret hidden")
+        await pilot.pause()
+        fields = service.retrieve_entry(1).get("custom_fields", [])
+        assert any(
+            f.get("label") == "api_key" and f.get("is_hidden") is True for f in fields
+        )
+
+        app._run_palette_command("field-rm api_key")
+        await pilot.pause()
+        fields = service.retrieve_entry(1).get("custom_fields", [])
+        assert all(f.get("label") != "api_key" for f in fields)
+
+        out_dir = tmp_path / "exports"
+        app._run_palette_command(f"doc-export {out_dir}")
+        await pilot.pause()
+        exported = out_dir / "Runbook.md"
+        assert exported.exists()
+        assert exported.read_text(encoding="utf-8") == "line-1\nline-2"
+        assert "Exported document to" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_notes_tags_fields_and_doc_export_validation() -> (
+    None
+):
+    service = FakeEntryService(
+        [
+            {"id": 1, "kind": "document", "label": "Doc", "content": "x"},
+            {"id": 2, "kind": "password", "label": "Pw"},
+        ]
+    )
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._run_palette_command("notes-set")
+        await pilot.pause()
+        assert "Usage: notes-set <text>" in _status_text(app)
+
+        app._run_palette_command("notes-clear nope")
+        await pilot.pause()
+        assert "Usage: notes-clear" in _status_text(app)
+
+        app._run_palette_command("tag-add")
+        await pilot.pause()
+        assert "Usage: tag-add <tag>" in _status_text(app)
+
+        app._run_palette_command("tag-rm")
+        await pilot.pause()
+        assert "Usage: tag-rm <tag>" in _status_text(app)
+
+        app._run_palette_command("tags-set")
+        await pilot.pause()
+        assert "Usage: tags-set <comma-separated tags>" in _status_text(app)
+
+        app._run_palette_command("tags-clear nope")
+        await pilot.pause()
+        assert "Usage: tags-clear" in _status_text(app)
+
+        app._run_palette_command("field-add one")
+        await pilot.pause()
+        assert "Usage: field-add <label> <value> (optional: hidden)" in _status_text(
+            app
+        )
+
+        app._run_palette_command("field-rm")
+        await pilot.pause()
+        assert "Usage: field-rm <label>" in _status_text(app)
+
+        app._run_palette_command("doc-export one two")
+        await pilot.pause()
+        assert "Usage: doc-export (optional: output_path)" in _status_text(app)
+
+        app._run_palette_command("open 2")
+        await pilot.pause()
+        app._run_palette_command("doc-export")
+        await pilot.pause()
+        assert "doc-export requires selected document entry" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_set_clear_field_non_document_kinds() -> None:
+    service = FakeEntryService(
+        [
+            {
+                "id": 1,
+                "kind": "password",
+                "label": "Login",
+                "username": "alice",
+                "url": "https://old",
+                "length": 16,
+                "notes": "old",
+            },
+            {
+                "id": 2,
+                "kind": "totp",
+                "label": "Auth",
+                "period": 30,
+                "digits": 6,
+                "notes": "old",
+            },
+            {
+                "id": 3,
+                "kind": "key_value",
+                "label": "Env",
+                "key": "API_KEY",
+                "value": "v1",
+                "notes": "old",
+            },
+        ]
+    )
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+
+        app._run_palette_command("open 1")
+        await pilot.pause()
+        app._run_palette_command("set-field username bob")
+        app._run_palette_command("set-field url https://new")
+        app._run_palette_command("set-field length 24")
+        await pilot.pause()
+        pw = service.retrieve_entry(1)
+        assert pw["username"] == "bob"
+        assert pw["url"] == "https://new"
+        assert pw["length"] == 24
+        app._run_palette_command("clear-field username")
+        await pilot.pause()
+        assert service.retrieve_entry(1)["username"] == ""
+
+        app._run_palette_command("open 2")
+        await pilot.pause()
+        app._run_palette_command("set-field period 45")
+        app._run_palette_command("set-field digits 8")
+        await pilot.pause()
+        totp = service.retrieve_entry(2)
+        assert totp["period"] == 45
+        assert totp["digits"] == 8
+
+        app._run_palette_command("open 3")
+        await pilot.pause()
+        app._run_palette_command("set-field key TOKEN")
+        app._run_palette_command("set-field value v2")
+        app._run_palette_command("clear-field value")
+        await pilot.pause()
+        kv = service.retrieve_entry(3)
+        assert kv["key"] == "TOKEN"
+        assert kv["value"] == ""
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_palette_set_clear_field_validation() -> None:
+    service = FakeEntryService(
+        [
+            {"id": 1, "kind": "password", "label": "Login", "length": 16},
+            {"id": 2, "kind": "totp", "label": "Auth"},
+        ]
+    )
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._run_palette_command("set-field")
+        await pilot.pause()
+        assert "Usage: set-field <name> <value>" in _status_text(app)
+
+        app._run_palette_command("clear-field")
+        await pilot.pause()
+        assert "Usage: clear-field <name>" in _status_text(app)
+
+        app._run_palette_command("open 1")
+        await pilot.pause()
+        app._run_palette_command("set-field length nope")
+        await pilot.pause()
+        assert "set-field length must be an integer" in _status_text(app)
+
+        app._run_palette_command("set-field period 30")
+        await pilot.pause()
+        assert "not supported for kind 'password'" in _status_text(app)
+
+        app._run_palette_command("clear-field period")
+        await pilot.pause()
+        assert "not supported for kind 'password'" in _status_text(app)
+
+        app._run_palette_command("open 2")
+        await pilot.pause()
+        app._run_palette_command("set-field digits nope")
+        await pilot.pause()
+        assert "set-field digits must be an integer" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_2fa_board_view_timer_and_copy() -> None:
+    service = FakeEntryService(
+        [
+            {
+                "id": 1,
+                "kind": "totp",
+                "label": "Det Auth",
+                "period": 30,
+                "digits": 6,
+                "deterministic": True,
+            },
+            {
+                "id": 2,
+                "kind": "totp",
+                "label": "Imported Auth",
+                "period": 45,
+                "digits": 6,
+                "secret": "JBSWY3DPEHPK3PXP",
+                "deterministic": False,
+            },
+        ]
+    )
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._time_now = lambda: 91
+        app._run_palette_command("2fa-board")
+        await pilot.pause()
+        board_text = _widget_text(app, "#totp-board")
+        assert "2FA Board" in board_text
+        assert "Det Auth" in board_text
+        assert "Imported Auth" in board_text
+        assert "det=deterministic, imp=imported" in board_text
+        assert "29" in board_text or "14" in board_text
+
+        app._run_palette_command("2fa-copy 1")
+        await pilot.pause()
+        assert service.clipboard_values[-1] == "123456"
+        assert "Copied TOTP code for entry 1" in _status_text(app)
+
+        app._run_palette_command("2fa-refresh")
+        await pilot.pause()
+        assert "2FA board refreshed" in _status_text(app)
+
+        app.action_toggle_totp_board()
+        await pilot.pause()
+        assert "2FA board closed" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_2fa_board_secret_mode_and_validation() -> None:
+    service = FakeEntryService(
+        [
+            {
+                "id": 1,
+                "kind": "totp",
+                "label": "Auth",
+                "period": 30,
+                "digits": 6,
+                "secret": "JBSWY3DPEHPK3PXP",
+            }
+        ]
+    )
+    service.secret_mode_enabled = True
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._time_now = lambda: 100
+        app._run_palette_command("2fa-copy")
+        await pilot.pause()
+        assert "Usage: 2fa-copy <entry_id>" in _status_text(app)
+
+        app._run_palette_command("2fa-copy nope")
+        await pilot.pause()
+        assert "2fa-copy entry_id must be an integer" in _status_text(app)
+
+        app._run_palette_command("2fa-board")
+        await pilot.pause()
+        board_text = _widget_text(app, "#totp-board")
+        assert "******" in board_text
+        assert "123456" not in board_text
+
+        app._run_palette_command("2fa-hide")
+        await pilot.pause()
+        assert "2FA board closed" in _status_text(app)
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_profiles_and_settings_palette_commands() -> None:
+    service = FakeEntryService([{"id": 1, "kind": "document", "label": "Doc"}])
+    profiles = FakeProfileService(["fp-a", "fp-b"])
+    config = FakeConfigService()
+    nostr = FakeNostrService(["wss://r1", "wss://r2"])
+    sync = FakeSyncService()
+    utility = FakeUtilityService()
+    vault = FakeVaultService()
+    app = _build_app(
+        service,
+        profile_service=profiles,
+        config_service=config,
+        nostr_service=nostr,
+        sync_service=sync,
+        utility_service=utility,
+        vault_service=vault,
+    )
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+
+        app._run_palette_command("profiles-list")
+        await pilot.pause()
+        assert "Profiles (2): fp-a, fp-b" in _status_text(app)
+
+        app._run_palette_command("profile-switch fp-b")
+        await pilot.pause()
+        assert profiles.last_switch == ("fp-b", None)
+        assert "Switched profile to fp-b" in _status_text(app)
+
+        app._run_palette_command("setting-secret on 42")
+        await pilot.pause()
+        assert config.secret_mode_enabled is True
+        assert config.clipboard_delay == 42
+        assert "Secret mode on (delay 42s)" in _status_text(app)
+
+        app._run_palette_command("setting-offline off")
+        await pilot.pause()
+        assert config.offline_mode is False
+        assert "Offline mode off" in _status_text(app)
+
+        app._run_palette_command("setting-quick-unlock on")
+        await pilot.pause()
+        assert config.quick_unlock is True
+        assert "Quick unlock on" in _status_text(app)
+
+        app._run_palette_command("setting-timeout 600")
+        await pilot.pause()
+        assert config.inactivity_timeout == 600.0
+        assert "Inactivity timeout set to 600.0s" in _status_text(app)
+
+        app._run_palette_command("setting-kdf-iterations 200000")
+        await pilot.pause()
+        assert config.kdf_iterations == 200000
+        assert "KDF iterations set to 200000" in _status_text(app)
+
+        app._run_palette_command("setting-kdf-mode argon2")
+        await pilot.pause()
+        assert config.kdf_mode == "argon2"
+        assert "KDF mode set to argon2" in _status_text(app)
+
+        app._run_palette_command("profile-add")
+        await pilot.pause()
+        assert "Created profile fp-new-1" in _status_text(app)
+
+        app._run_palette_command("profile-remove fp-a")
+        await pilot.pause()
+        assert "Removed profile fp-a" in _status_text(app)
+        assert "fp-a" not in profiles.profiles
+
+        app._run_palette_command("profile-rename fp-b Team Profile")
+        await pilot.pause()
+        assert "Renamed profile fp-b to 'Team Profile'" in _status_text(app)
+        assert profiles.renamed["fp-b"] == "Team Profile"
+
+        app._run_palette_command("relay-list")
+        await pilot.pause()
+        assert "Relays (2): wss://r1, wss://r2" in _status_text(app)
+
+        app._run_palette_command("relay-add wss://r3")
+        await pilot.pause()
+        assert "Added relay wss://r3" in _status_text(app)
+        assert "wss://r3" in nostr.relays
+
+        app._run_palette_command("relay-rm 3")
+        await pilot.pause()
+        assert "Removed relay #3" in _status_text(app)
+
+        app._run_palette_command("relay-reset")
+        await pilot.pause()
+        assert "Relays reset (2)" in _status_text(app)
+        assert nostr.relays == ["wss://default-1", "wss://default-2"]
+
+        app._run_palette_command("sync-now")
+        await pilot.pause()
+        assert "Sync completed manifest manifest-1" in _status_text(app)
+        assert sync.sync_calls == 1
+
+        app._run_palette_command("sync-bg")
+        await pilot.pause()
+        assert "Background sync started" in _status_text(app)
+        assert sync.bg_calls == 1
+
+        app._run_palette_command("checksum-verify")
+        await pilot.pause()
+        assert utility.verify_calls == 1
+        assert "Checksum verification complete" in _status_text(app)
+
+        app._run_palette_command("checksum-update")
+        await pilot.pause()
+        assert utility.update_calls == 1
+        assert "Checksum updated" in _status_text(app)
+
+        app._run_palette_command("totp-export /tmp/seedpass-totp-export.json")
+        await pilot.pause()
+        assert "Exported TOTP entries to" in _status_text(app)
+
+        app._run_palette_command("db-export /tmp/seedpass-db-export.enc")
+        await pilot.pause()
+        assert Path("/tmp/seedpass-db-export.enc") in vault.exported
+        assert "Database exported to /tmp/seedpass-db-export.enc" in _status_text(app)
+
+        app._run_palette_command("db-import /tmp/seedpass-db-export.enc")
+        await pilot.pause()
+        assert Path("/tmp/seedpass-db-export.enc") in vault.imported
+        assert "Database imported from /tmp/seedpass-db-export.enc" in _status_text(app)
+
+        app._run_palette_command(
+            "parent-seed-backup /tmp/seedpass-parent-backup.enc pass123"
+        )
+        await pilot.pause()
+        assert vault.parent_seed_backups[-1] == (
+            Path("/tmp/seedpass-parent-backup.enc"),
+            "pass123",
+        )
+        assert (
+            "Parent seed backup written to /tmp/seedpass-parent-backup.enc"
+            in _status_text(app)
+        )
+
+
+@pytest.mark.anyio
+async def test_tui2_textual_profiles_and_settings_palette_validation() -> None:
+    service = FakeEntryService([{"id": 1, "kind": "document", "label": "Doc"}])
+    app = _build_app(service)
+
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._run_palette_command("profiles-list")
+        await pilot.pause()
+        assert "Profile service unavailable" in _status_text(app)
+
+        app._run_palette_command("profile-switch")
+        await pilot.pause()
+        assert "Profile service unavailable" in _status_text(app)
+
+        app._run_palette_command("setting-secret on")
+        await pilot.pause()
+        assert "Config service unavailable" in _status_text(app)
+
+        app._run_palette_command("checksum-verify")
+        await pilot.pause()
+        assert "Utility service unavailable" in _status_text(app)
+
+        app._run_palette_command("db-export /tmp/x")
+        await pilot.pause()
+        assert "Vault service unavailable" in _status_text(app)
+
+        app._run_palette_command("totp-export")
+        await pilot.pause()
+        assert "Usage: totp-export <path>" in _status_text(app)
+
+    profiles = FakeProfileService(["fp-a"])
+    config = FakeConfigService()
+    app = _build_app(service, profile_service=profiles, config_service=config)
+    async with app.run_test() as pilot:
+        await pilot.pause()
+        app._run_palette_command("profile-switch")
+        await pilot.pause()
+        assert (
+            "Usage: profile-switch <fingerprint> (optional: password)"
+            in _status_text(app)
+        )
+
+        app._run_palette_command("setting-offline maybe")
+        await pilot.pause()
+        assert "invalid toggle value 'maybe'" in _status_text(app)
+
+        app._run_palette_command("setting-secret on nope")
+        await pilot.pause()
+        assert "setting-secret delay must be an integer" in _status_text(app)
+
+        app._run_palette_command("setting-quick-unlock")
+        await pilot.pause()
+        assert "Usage: setting-quick-unlock <on|off>" in _status_text(app)
+
+        app._run_palette_command("profile-add nope")
+        await pilot.pause()
+        assert "Usage: profile-add" in _status_text(app)
+
+        app._run_palette_command("profile-remove")
+        await pilot.pause()
+        assert "Usage: profile-remove <fingerprint>" in _status_text(app)
+
+        app._run_palette_command("profile-rename fp-a")
+        await pilot.pause()
+        assert "Usage: profile-rename <fingerprint> <name>" in _status_text(app)
+
+        app._run_palette_command("relay-list")
+        await pilot.pause()
+        assert "Nostr service unavailable" in _status_text(app)
+
+        app._run_palette_command("relay-reset")
+        await pilot.pause()
+        assert "Nostr service unavailable" in _status_text(app)
+
+        app._run_palette_command("sync-now")
+        await pilot.pause()
+        assert "Sync service unavailable" in _status_text(app)
+
+    utility = FakeUtilityService()
+    vault = FakeVaultService()
+    nostr = FakeNostrService(["wss://r1"])
+    sync = FakeSyncService()
+    app = _build_app(
+        service,
+        profile_service=profiles,
+        config_service=config,
+        utility_service=utility,
+        vault_service=vault,
+        nostr_service=nostr,
+        sync_service=sync,
+    )
+    async with app.run_test() as pilot:
+        await pilot.pause()
+
+        app._run_palette_command("setting-timeout nope")
+        await pilot.pause()
+        assert "setting-timeout requires numeric seconds" in _status_text(app)
+
+        app._run_palette_command("setting-kdf-iterations nope")
+        await pilot.pause()
+        assert "setting-kdf-iterations requires integer value" in _status_text(app)
+
+        app._run_palette_command("setting-kdf-mode")
+        await pilot.pause()
+        assert "Usage: setting-kdf-mode <mode>" in _status_text(app)
+
+        app._run_palette_command("checksum-update nope")
+        await pilot.pause()
+        assert "Usage: checksum-update" in _status_text(app)
+
+        app._run_palette_command("db-export")
+        await pilot.pause()
+        assert "Usage: db-export <path>" in _status_text(app)
+
+        app._run_palette_command("db-import")
+        await pilot.pause()
+        assert "Usage: db-import <path>" in _status_text(app)
+
+        app._run_palette_command("parent-seed-backup a b c")
+        await pilot.pause()
+        assert (
+            "Usage: parent-seed-backup (optional: path) (optional: password)"
+            in _status_text(app)
+        )