Give a shell the whole phone, and one bar to leave it by

A connected phone was drawing five rows of chrome around the thing the user
opened it for. The vault header at 56, the terminal's own tab strip at 52, a
connection line at 36, the shells strip at 46 and the four-entry bottom bar at
64: at 360dp that is about a third of the display, and every row of it was
about somewhere the user was not. What replaces them is one 52-pixel bar drawn
by the surface itself — back on the left, the session pills, and a `+` across
from them — and then the terminal.

Three of those rows belong to `PhoneShell` and each is now bound on
`IsShowingPages`. That is the same question asked once rather than three
conditions that could drift: the surface is either a page or a terminal, and
these are the chrome a page has. The header needed a wrapper because Avalonia's
bindings have no "and" and it already had a condition of its own; the strip
needed one for the same reason. The bottom bar had none and is bound directly.

The back arrow goes to the page the terminal was opened over rather than to
Hosts by name, because the system back gesture already picks that and an arrow
landing somewhere else would be the second of two answers to one question. The
bar's `+` raises a sheet offering the three connections this application can
make — a shell, a host's files over SFTP, a bucket — since SFTP and S3 used to
be two taps through the bottom bar's MORE and the bar is not on screen here. A
control that replaced it and led to one of the three would have quietly removed
the other two.

Two things moved rather than being dropped. The text-size buttons are pinned at
the right-hand end of the accessory key row, outside its scroller: the
connection line existed to keep them from scrolling out of reach, and being
outside the scroller answers that argument rather than abandoning it. The
dialled address moved onto the connecting card, which is the moment it is worth
reading — what is being connected to, before anything has answered — and after
that the shell's own prompt says it more accurately than a header derived from
the keychain ever did.

The sheet collapses the renderer rather than covering it. Whether Android's
`WebView` composites above Avalonia content the way Win32's child window does is
still unverified — `docs/android-port.md` has said so since the port — so this
follows the desktop's palette and gives up the rectangle outright, which is
correct under either answer. It collapses `IsTerminalShowing` and not
`IsTerminalSurface`, because the bar the sheet was raised from is part of that
surface and dropping it would take the bar, the tabs and the whole arrangement
with it, leaving the sheet floating over the page underneath.

`OnSurfaceChanged` is the one place the flag is lowered, and that is the load-
bearing half. Every way out of a terminal ends there — a destination, the files
screen, the palette connecting to a host, closing the last tab, a lock — and
each of them would otherwise leave a sheet set over a page. Not merely untidy:
the flag holds the renderer blank, so the next return to the terminal would
draw the menu again over a rectangle kept blank by it. Opening is refused off
the terminal surface for the same reason from the other direction.

The back gesture gains a guard above the switch, in the shape of the editor
guard that arrived with the phone's `+`. It is nearer than any of them: with no
header and no bottom bar, while the menu is up that gesture is the only way off
it other than the scrim and CANCEL.

The bottom bar's Terminal entry lost its `IsCurrent` binding. The bar is
collapsed on that surface, so the binding could only ever be read as false, and
a rule about a state the control cannot be in is a claim that it can.

Three tests in `ShellFlowTests`, which is where shared state-machine behaviour
for this head goes: the collapse and its recovery, the refusal to open over a
page, and the sheet lowering both by a menu entry and by a route it was never
wired to. Everything visual needs a device, so it is phase 11 of
`docs/manual-checks.md` — and 11.2 is the check that would finally settle the
compositing question this head has carried as unverified since the port.

docs/manual-checks.md

@@ -889,3 +889,66 @@ Focus a passphrase box, then turn the phone sideways.
 
 **Pass:** the box is still visible and still focused, and the shell is intact — the activity handles the
 rotation rather than being recreated, and live shells survive it.
+
+---
+
+## Phase 11 — The phone's terminal surface
+
+Every check here needs a real device for the reason Phase 10's do, plus one of its own: the interesting
+question on this screen is whether a native `WebView` composites above what Avalonia draws over it, and no
+headless surface has a native view to answer with. `docs/android-port.md` still records that as unverified;
+11.2 is the check that settles it.
+
+### 11.1 A shell gets the screen · **the important one for chrome**
+
+Open a shell from HOSTS.
+
+**Pass:** the vault header, the session strip and the four-entry bottom bar are all gone. What is left is
+one bar — a back arrow, the session pills, a `+` — and then the terminal down to the accessory keys. Press
+back: all three come back, the tab is still in the strip and its dot is still green.
+
+**Failure means:** one of the three rows is not bound on `IsShowingPages`, or the terminal is being reached
+by a route that leaves `Surface` on `Page`.
+
+### 11.2 The connect menu is not drawn over the renderer · **the important one**
+
+With a shell showing output, press `+`.
+
+**Pass:** the terminal's rectangle goes to the canvas colour and the sheet sits over it whole — scrim, three
+rows and CANCEL, every one of them tappable, none of them sliced down the left edge. Tap the scrim: the
+terminal comes back with its scrollback intact and the shell still running.
+
+**Failure means:** `IsTerminalShowing` is not being cleared by `IsConnectSheetOpen` — or, if the sheet is
+sliced *despite* the rectangle going blank, something else in that Panel is still showing. A sheet that
+draws over live terminal output is the Android answer to the compositing question, and it means every
+future sheet on this surface has to collapse the renderer too.
+
+### 11.3 Back lowers the menu before it leaves the terminal
+
+With the connect menu open, use the system back gesture.
+
+**Pass:** the menu closes and the terminal is still showing. A second back leaves the terminal for the
+screen it was opened over.
+
+**Failure means:** the guard in `PhoneShell.axaml.cs` is below the surface check rather than above it, and
+one gesture is spending two levels.
+
+### 11.4 The two end buttons cannot be pushed off the bar
+
+Open six or more shells.
+
+**Pass:** the pills scroll under a fixed back arrow and a fixed `+`; neither ever leaves the screen, and
+scrolling the pills to either end does not move them.
+
+**Failure means:** a control was put inside the `ScrollViewer` rather than beside it.
+
+### 11.5 The text-size buttons are always reachable
+
+With a shell open, scroll the accessory key row to the far left and the far right.
+
+**Pass:** `A−` and `A+` stay pinned at the right-hand end throughout, separated from the keys by the
+hairline, and both are at least 38 tall. At the smallest and largest sizes the one that can do nothing is
+visibly disabled rather than silently inert.
+
+**Failure means:** they have been folded into the scrolling row — which is the arrangement the connection
+line existed to avoid, and the reason it could be removed at all.