v0.4.3

Brand

• The project wears the mascot: a periwinkle planet with a cream face, a ring and
  a terminal prompt on its brow. It replaces the mark cut out of the logo sheet,
  and it is used as drawn rather than recoloured per surface — which is why the
  app icon, the README's logo and the browser favicon are now the same picture on
  the shell's ink. The mascot's face is cream: on a white tile, or on the
  transparent ground a README has on GitHub's light theme, it would run into the
  page. resources/brand/make-assets.py rebuilds all three from the master, and
  takes a new render as its argument when the art changes again.

Desktop app

• The ring around a shell being driven from elsewhere is quieter: a thinner line,
  a slower flow and a dimmer bloom than the chat-glow example's composer ring,
  which is drawn to be looked at. (The artist's own reference for this state is
  still pending — this is the window's own reading of "a signal, not a show".)

• A machine taking its shell back ends the connection, on the machine that was
  driving it: the tabs it had open there close, the link to that machine is
  dropped, the panels return to this machine, and the status bar says who took
  the shell back. Before this, the driving window was simply left read-only, with
  a tab on screen that could not type and no word about why.

• The panel under the glow — who holds a shell, and 保持只读 / 拿回控制权 — has a
  width of its own and shorter words. It hangs from the top of a pane, and a pane
  can be narrower than a sentence: it used to run past the terminal it was about.

• The 机器 panel is a list you switch between rather than a nest of shells. This
  machine comes first and is picked by default; picking another machine makes it
  the subject of the 会话 panel below and of that panel's 新建标签页, which now
  starts a shell on that machine over the relay and opens it here. The relay
  itself has no row any more — it is the pipe, not a machine — and its state
  moved to the line the header and status bar already carry.

• Reaching the other machines no longer needs a secret typed anywhere. 设置 → 远程
  lost the 客户端令牌 field: a window asks its relay for a short-lived control
  token, proving itself with the device credential it already joins the fleet
  with, and that is what its client link presents. Picking a machine the window
  cannot reach yet asks first, in a dialog, so "this window is about to ask the
  relay for reach" is something a person sees and can decline. The fleet's shared
  token is unchanged and is now only what a browser or a phone is given:
  tfrelay -control-token-ttl (default 15m) bounds what a machine gets, revoking
  a machine at the relay takes its credentials away at once, and the machine's own
  允许被控制 switch is unchanged.