Keep the phone's nav under Connections when nothing is running

The chrome stands down for a shell, and it was standing down for the whole
terminal surface. Those parted company when that surface gained a connect page:
with no tabs open it draws a box, a CONNECT button and the machines connected to
before, which is a page in everything but which enum it is in. A third of the
display is worth giving to a shell and is not worth giving to that. Worse, it is
the one screen somebody arrives at by closing their last tab — so the state the
collapsed bar was most likely to be seen in was the state where it left the
system back gesture as the only route to Hosts or Settings.

So RefreshChrome reads one more question. IsTerminalSurface with no tabs joins
the pages in both flags, which keeps the rail and the bar in step: above 600dp
the rail is the bar, and fixing only the narrow layout would leave an unfolded
device on the same screen with the same nothing. The vault header is deliberately
not part of it. The surface draws its own bar with back and the +, and a header
above that is the second row of chrome this head exists to avoid.

The Connections entry lights for the first time, on IsTerminalSurface. It was
left unbound on the argument that the bar was never drawn while that surface was
up, so a lit state was unreachable — that argument is now false, and the flag is
unambiguous on a control that is only drawn in two situations: false on every
page, true on the connect page, and never read while a shell is showing. A bar
sitting under a screen it does not point at is the entry looking broken instead.

Nothing here is testable on this head — the phone's rectangles have no coverage,
for the reasons Phase 8 of manual-checks records — so 11.7 gains the check that
the bar is there with Connections lit, and 11.1 keeps the one that it is gone
with a shell up, which is the half that pays for the arrangement.

docs/android-port.md

@@ -568,9 +568,16 @@ go at 360dp:
    believing they typed an `l`.
 
    **The surface has since taken the whole screen.** `PhoneShell` collapses the header, the session strip
-   and the bottom bar while a terminal is showing — one binding on `IsShowingPages` each — and the screen
+   and the bottom bar while a shell is showing, and the screen draws a 35-pixel bar in their place: back,
-   draws a 35-pixel bar in their place: back, the session pills, and a `+` raising a sheet with the three
+   the session pills, and a `+` raising a sheet with the three connections there are.
-   connections there are. That sheet is the head's first control that could be drawn over the renderer, so
+
+   *A shell rather than the surface, and the two parted company once that surface gained a connect page.*
+   With nothing running, Connections is a box, a CONNECT button and the machines connected to before — a
+   page in everything but which enum it is in — so `RefreshChrome` keeps the bar (and, wide, the rail) under
+   it and the Connections entry lights for the first time. It is the one screen reachable by closing your
+   last tab, and collapsing the nav there left the system back gesture as the only route to Hosts or
+   Settings. The header is not part of that: the surface draws its own bar, and a vault header above it is
+   the second row of chrome this head exists to avoid. That sheet is the head's first control that could be drawn over the renderer, so
    it collapses it rather than covering it, exactly as the desktop's palette does; whether Android's
    WebView actually composites above Avalonia content is still the unverified question recorded below, and
    collapsing is correct under either answer.

docs/manual-checks.md

@@ -1277,12 +1277,13 @@ headless surface has a native view to answer with. `docs/android-port.md` still
 
 Open a shell from HOSTS.
 
-**Pass:** the vault header, the session strip and the four-entry bottom bar are all gone. What is left is
+**Pass:** the vault header, the session strip and the three-entry bottom bar are all gone. What is left is
 one bar — a back arrow, the session pills, a `+` — and then the terminal down to the accessory keys. Press
 back: all three come back, the tab is still in the strip and its dot is still green.
 
-**Failure means:** one of the three rows is not bound on `IsShowingPages`, or the terminal is being reached
+**Failure means:** the strip is not bound on `IsShowingPages`, `RefreshChrome` is not reading `HasTabs`, or
-by a route that leaves `Surface` on `Page`.
+the terminal is being reached by a route that leaves `Surface` on `Page`. A bar still there **with a shell
+showing** is the one that matters: that is the third of the screen this arrangement exists to give back.
 
 ### 11.2 The connect menu is not drawn over the renderer · **the important one**
 
@@ -1348,6 +1349,14 @@ Close every tab, then press Connections in the bottom bar.
 keychain has ever connected to anything — a RECENT list underneath. The whole thing scrolls with the
 keyboard up, and the password box shows dots with **no suggestion strip** above the keyboard.
 
+**And the bottom bar is still there, with Connections lit.** Press Hosts: it goes straight there, without
+the back gesture. Then open a shell — the bar goes, which is 11.1. Wide, the same holds for the rail.
+
+**Failure means:** for the bar, `RefreshChrome` is back to collapsing the nav for the whole terminal
+surface rather than for a shell — which strands anybody who reaches this screen by closing their last tab.
+For an unlit Connections entry, `IsCurrent` lost its binding: on this screen it is the only true thing the
+bar could say about where you are.
+
 Type a machine you can reach and press CONNECT: a tab appears in the bar and the shell opens. Type
 something malformed — no `user@`, or `:70000` — and the refusal appears under the boxes, in the warning
 colour, with no tab and nothing dialled.

src/DodoSSH.Client.Android/Views/PhoneRail.axaml

@@ -134,15 +134,17 @@
 
           <!--
             The terminal is a surface rather than a page, so it goes through its own command — the same
-            reason the bottom bar's middle entry does. It is never lit, and deliberately: this rail is
+            reason the bottom bar's middle entry does. It lights on IsTerminalSurface, which on this control
-            collapsed while a shell is showing, so IsCurrent could only ever read false. What marks that
+            can only mean one thing: the rail stands down for a shell, so the one moment it is drawn beside
-            destination as current is the surface filling the screen.
+            this surface is Connections with nothing running. That screen is a page in everything but which
+            enum it is in, and a rail sitting beside it with no entry lit would be pointing nowhere.
 
             No count, unlike the two above it. The shells strip sits above the bottom of every page on this
             surface and is that count, drawn as the sessions themselves — a number beside this word would be
             the same fact said twice, three inches apart.
           -->
-          <Button Classes="railentry" Command="{Binding ShowTerminalCommand}">
+          <Button Classes="railentry" Classes.active="{Binding IsTerminalSurface}"
+                  Command="{Binding ShowTerminalCommand}">
             <Grid ColumnDefinitions="Auto,*,Auto">
               <TextBlock Grid.Column="0" Classes="railglyph" Text="⌗" />
               <TextBlock Grid.Column="1" Classes="raillabel" Text="Connections" />

src/DodoSSH.Client.Android/Views/PhoneShell.axaml

@@ -25,8 +25,9 @@
 
     ── a terminal gets the screen ─────────────────────────────────────────────────────────────────────────
     Three of the four rows below stand down while a shell is showing: the header, the shells strip and the
-    bottom bar itself. All three are bound on IsShowingPages, which is the same question asked once — the
+    bottom bar itself. The strip asks IsShowingPages directly; the other two go through flags the control
-    surface is either a page or a terminal, and these are the chrome a page has.
+    computes, and the bar's is the one that differs — it stays up on Connections with nothing running, which
+    is the terminal surface drawing a page rather than a shell. See PhoneShell.RefreshChrome.
 
     The arithmetic is why. Header 56, strip 46, bar 64, and the terminal's own two rows on top of that: at
     360dp the shell was framed by about a third of the display, all of it about somewhere the user was not.
@@ -308,10 +309,15 @@
 
       <!-- ============ navigation ============ -->
       <!--
-        Gone while a terminal is showing, which is the whole of that surface's arrangement: the bar's three
+        Gone while a shell is showing, which is the whole of that surface's arrangement: the bar's three
         destinations are replaced by a back arrow and a + that leads to all of them, both in the terminal's
         own bar. See TerminalScreen.axaml.
 
+        ◆ A shell rather than the surface, which are not the same question — Connections with nothing running
+        is that surface drawing a page, and the bar stays under it. The screen it stands down for is the one
+        that pays for the room; a box asking which machine to connect to does not, and taking the nav away
+        from somebody who has just closed their last tab left them with only the back gesture.
+
         ◆ It is no longer a single question — a wide surface takes the rail instead — so it reads one flag
         the control computes rather than a condition here. See PhoneShell.ShowsBottomBar.
 
@@ -340,12 +346,15 @@
             rather than the door. The enum member stays ShellSurface.Terminal, for the reason the keychain's
             tab is not called Vault: the surface is a terminal, and the word a user reads is the product's.
 
-            The only entry here that never lights, and deliberately no longer tries: this bar is collapsed
+            ◆ It lights again, and IsTerminalSurface is the right question rather than a near miss. This bar
-            while the terminal is showing, so IsCurrent could only ever be read as false. Binding it anyway
+            is drawn in exactly two situations — a page, and Connections with nothing running — and that flag
-            would be a rule about a state this control cannot be in. What marks it as current is the surface
+            separates them: false for every page, true for the one screen where this is where you are. With a
-            filling the screen.
+            shell up the bar is gone and nothing here is read at all. It was left unbound while the bar was
+            collapsed for the whole of the terminal surface, which made a lit state unreachable; a screen the
+            bar can now sit under and not point at is the entry looking broken instead.
           -->
           <views:NavButton Grid.Column="1" Label="Connections" Glyph="⌗"
+                           IsCurrent="{Binding IsTerminalSurface}"
                            Command="{Binding ShowTerminalCommand}" />
 
           <!--

src/DodoSSH.Client.Android/Views/PhoneShell.axaml.cs

@@ -104,10 +104,19 @@ internal sealed partial class PhoneShell : UserControl
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(IsWide));
 
     /// <summary>Whether the rail down the left edge is drawn.</summary>
+    /// <remarks>
+    /// The wide surface's answer to <see cref="ShowsBottomBarProperty"/> and asks the same question about
+    /// which screen is up, so the two move together — including over Connections with nothing running. See
+    /// <see cref="RefreshChrome"/>.
+    /// </remarks>
     public static readonly StyledProperty<bool> ShowsRailProperty =
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(ShowsRail));
 
     /// <summary>Whether the three-entry bar across the bottom is drawn.</summary>
+    /// <remarks>
+    /// Not simply the pages: it also stays up on Connections with nothing running, which is the terminal
+    /// surface drawing a page. See <see cref="RefreshChrome"/>.
+    /// </remarks>
     public static readonly StyledProperty<bool> ShowsBottomBarProperty =
         AvaloniaProperty.Register<PhoneShell, bool>(nameof(ShowsBottomBar));
 
@@ -154,6 +163,15 @@ internal sealed partial class PhoneShell : UserControl
     /// have to be an "or", which a wrapper cannot express at all.
     /// </para>
     /// <para>
+    /// ◆ <b>The nav stands down for a shell rather than for the terminal surface, and those parted company
+    /// when that surface gained a page.</b> Connections with nothing running is a box, a CONNECT button and
+    /// the machines connected to before — see TerminalScreen.axaml — and none of that is worth the screen a
+    /// shell is worth it for. It is also the one screen somebody can arrive at by closing their last tab,
+    /// which made the collapsed bar a way to end up with no route to Hosts or Settings but the system back
+    /// gesture. The header is deliberately not part of this: the surface draws its own bar with the back
+    /// arrow and the +, and the vault header above that is the second row this head exists to avoid.
+    /// </para>
+    /// <para>
     /// <b>The header is the one worth reading twice.</b> Narrow, it stands down behind SETTINGS, because the
     /// screens under that hub draw their own header with a back arrow and two rows of chrome is what this
     /// surface exists to avoid. Wide, there is no hub to be behind and no back arrow to duplicate — the rail
@@ -172,6 +190,14 @@ internal sealed partial class PhoneShell : UserControl
         var wide = body.Bounds.Width >= WideAt;
         var pages = shell?.IsShowingPages == true;
 
+        // ◆ Connections with nothing running, which is the terminal surface drawing a page: a box, a CONNECT
+        // button and the machines connected to before. The nav stands down for a shell — the whole of the
+        // arrangement below — and there is no shell here to stand down for, so it stays. Taking it away on
+        // this one screen was worst where it was least affordable: somebody who has just closed their last
+        // tab, or who pressed Connections to see what was open and found nothing, was left on a screen whose
+        // only way to Hosts or Settings was the system back gesture.
+        var connectPage = shell is { IsTerminalSurface: true, HasTabs: false };
+
         // Before the flags, because it changes what one of them reads. Nothing else on this head navigates
         // in response to a resize, and this is not navigation for its own sake: the hub is a list of the
         // destinations the rail now carries, so an unfolded device would otherwise sit on a menu of things
@@ -183,8 +209,8 @@ internal sealed partial class PhoneShell : UserControl
         }
 
         IsWide = wide;
-        ShowsRail = wide && pages;
+        ShowsRail = wide && (pages || connectPage);
-        ShowsBottomBar = !wide && pages;
+        ShowsBottomBar = !wide && (pages || connectPage);
         ShowsVaultHeader = pages && (wide || shell?.IsMoreSurface != true);
     }
 

src/DodoSSH.Client.Android/Views/TerminalScreen.axaml

@@ -19,9 +19,13 @@
 
     ── the screen a shell gets ───────────────────────────────────────────────────────────────────────────
     A connected phone shows one bar and then the terminal. The vault header, the shells strip and the
-    four-entry bottom bar are all collapsed by PhoneShell while this surface is up, and what replaces them
+    three-entry bottom bar are all collapsed by PhoneShell while a shell is showing, and what replaces them
     is the row below: back, the sessions, and the way to open another one.
 
+    With nothing running it is only the header and the strip. This surface is then the connect page below —
+    a box and the machines connected to before — which is not what the screen was being cleared for, and is
+    the one screen reachable by closing your last tab, so the nav stays. See PhoneShell.RefreshChrome.
+
     That is a trade, and the thing bought is the only one a terminal really wants. At 360dp the chrome this
     screen used to sit inside came to 254 pixels of a roughly 780-pixel display — a third of it — and every
     one of those rows was about somewhere the user was not. What is given up is the bottom bar's one-tap
@@ -389,9 +393,10 @@
       of them.
 
       It lives here rather than in PhoneShell for the reason the add sheet lives in its own screen: nothing
-      but this surface raises it. The scrim reaching only the screen area is not a compromise here the way
+      but this surface raises it. The scrim reaching only the screen area is the full display while a shell
-      it was there — the bottom bar is collapsed while a terminal is showing, so the screen area is the
+      is showing, because the bottom bar is collapsed for it. Raised from the connect page it is not, and
-      display.
+      that lands on the add sheet's own answer: the three destinations under the scrim stay tappable, and for
+      a menu of places to connect from, navigating away is a perfectly good way to decide not to.
 
       Every row navigates away from the terminal. That is not a side effect of the menu, it is the menu:
       each of the three destinations is a picker, and the shell they open lands back on this surface as a