feat(console): the refusal now says how to GET the address it asks you to paste

[eaitbrahim]

What the operator saw

keel is running, and did not admit this browser

...the token is new every run and is never written to disk -- so if keel has been
restarted since this browser last worked, the address printed THIS time is the one
that admits it. Paste that address into the address bar here...

[ Paste the address keel printed, or just its token ]  [Reconnect]

Cause named well. Remedy named nowhere.

Two failures, and the second is the bad one

1. keel open is never mentioned. It is named in server.py:1125, in the launchd plist
("This process prints its URL... where nobody is reading. Do not grep the log for it. Run
keel's open command"), and in runtime.py's own module docstring — everywhere except the screen
the locked-out operator is looking at.

2. "never written to disk" is no longer true, and it is the sentence that closes the door.
Since #756, that holds only for a server attached to a TERMINAL. Detached — launchd, a pipe, a
container — runtime.py records the address in a 0600 file precisely so keel open can hand
it back. A reader who believes the sentence concludes the token is unrecoverable and restarts
the server, which mints a NEW one. refusedView's own docstring already warns about that move:
"sends them to restart the thing that is working… and makes the situation worse."

Evidence it fails in practice: on 2026-09-16 two people who know this codebase were locked out by
a daemon restart. One went to keel open --help; the other asked a colleague.

The change

An instruction block above the paste field — the command produces the value the field
consumes, so meeting the field first means being asked for something you do not have:

To get this run's address, from your keel deployment directory:

keel open --port 8765

It opens the console, and prints the address so you can paste it below. Attached to a terminal
keel prints the address and keeps nothing; run as a service it records the address for that
command and deletes it on shutdown.

The field's label moves from "Paste the address keel printed" — past tense about something a
daemon wrote to a log the plist says not to grep — to "Paste the address from that command".

Boxed, monospaced, user-select: all, because its whole purpose is to be copied. The detail
paragraph beside it runs five sentences; a command appended as a sixth is a command nobody sees.

Two constraints worth noting

The port comes from window.location, the same source and stated reason as
timelineExportUrl and the deployment card: a fact about where this page is, not a claim from a
payload that just refused us. Nothing else about the deployment is named — the path in
particular. The port is the one fact the reader demonstrably already has (they reached this page
on it), so naming it discloses nothing to a request that was not admitted. That begins to matter
once #648 lets this console answer beyond loopback.

openCommandNode returns a node and joins nothing. render.js may use neither template
literals nor + — test_render_contains_no_arithmetic bans the operator outright rather than
try to tell string concatenation from money, and my first attempt tripped exactly that gate.
append takes several strings, so the port is placed beside the command instead of joined to it.
A default-port URL gives location.port as the empty string and takes the bare command, which
keel open defaults correctly.

Verification

Six tests, each naming the mutation it rejects, asserted on code with comments stripped so the
prose explaining the change cannot stand in for the change. Mutation-verified:

mutant	result
drop the command	3 failed
hardcode the port	1 failed
revert the label	1 failed

tests/web                       -> 972 passed
ruff check keel tests packages  -> All checks passed!
mypy                            -> clean (467 files; pre-existing PyYAML note)
pytest                          -> 6673 passed, 3 skipped

Not changed: the server-side 403 detail text still carries the stale "never written to disk"
sentence for non-browser clients. Worth a follow-up; this PR is the HTML view only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AoGRoExgHVCsWDHT3ej8mD