From 79b091d2b9678b075bee73d3572a3e5ae50e716d Mon Sep 17 00:00:00 2001
From: Elmehdi Aitbrahim <eaitbrahim@gmail.com>
Date: Thu, 24 Sep 2026 19:30:21 -0400
Subject: [PATCH] fix(web): the console switcher carries no token and sits
 beside the chip (#815 review)

#815 put every running console's `http://.../?token=` into /api/config
and into <option value>: the paper console's page held the live
console's session token, and its own, which security.py says must never
be written into the page. It also rendered an empty select
(`el()` has no children form), named a different console as this one
when this console had no record, showed a start-up mode that goes
stale, and made the session chip a dropdown, which #704 forbids.

- The page gets {label, href} per OTHER console; href is a token-free
  /switch/<port> on this console. server._switch reads the peer's
  record when followed and 303s into the peer's own ?token= hand-off,
  so only the browser's navigation carries the token (as `keel open`
  does). Local only: security.local_deployment, shared with
  gated_action_permitted, plus a loopback peer.
- sw.js declines /switch/ navigations to the network; answered from the
  cached shell they would silently do nothing.
- The switcher is its own control, #console-switcher, beside the chip.
  sessionChip is back to its pre-#815 code and still passes #704's
  no-interactive-node rule; the new control has a matching rule.
- This console is never read from a record; no mode in labels; the
  record no longer stores one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 keel/web/api.py                    |  16 +-
 keel/web/payload.py                |  50 +++-
 keel/web/runtime.py                |  56 ++--
 keel/web/security.py               |  19 +-
 keel/web/server.py                 |  64 +++-
 keel/web/static/css/keel.css       |  14 +-
 keel/web/static/index.html         |   7 +
 keel/web/static/js/main.js         |  18 +-
 keel/web/static/js/render.js       |  80 +++--
 keel/web/static/sw.js              |   7 +
 tests/web/test_profile_switcher.py | 462 ++++++++++++++++++++---------
 11 files changed, 574 insertions(+), 219 deletions(-)

diff --git a/keel/web/api.py b/keel/web/api.py
index aa288a50..fb3bc805 100644
--- a/keel/web/api.py
+++ b/keel/web/api.py
@@ -42,7 +42,7 @@
 from typing import TYPE_CHECKING, Any
 
 from keel.web import payload, runtime
-from keel.web.security import csrf_token
+from keel.web.security import csrf_token, local_deployment
 
 if TYPE_CHECKING:  # pragma: no cover - typing only
     from keel.web.server import ServeConfig
@@ -198,13 +198,21 @@ def read_config(cfg: ServeConfig, _query: Query, _state: Any, now_ts: int) -> di
     edit gone wrong) must cost the page its badge, not its boot. `payload.config_payload`
     records the read-only boundary: nothing in this package writes `auto_trade.mode`.
     """
-    peers = runtime.live_peers(current_port=cfg.port)
+    profile = _profile_name(cfg.db_path)
     return payload.config_payload(
         cfg.build_info,
         describe=cfg.build,
         mode=_auto_trade_mode(cfg.config_path),
-        profile=_profile_name(cfg.db_path),
-        peers=peers,
+        profile=profile,
+        # The other consoles in this deployment root (#814), as names and token-free hrefs only;
+        # `payload.profile_switcher` says why. Read per request like the mode, so a console
+        # started after this one appears on the next load.
+        switcher=payload.profile_switcher(
+            profile,
+            cfg.port,
+            runtime.live_peers(exclude_port=cfg.port),
+            local_deployment(external_hosts=cfg.external_hosts, bound_host=cfg.host),
+        ),
         **_session_state(cfg.db_path, now_ts),
         db_path=cfg.db_path,
         config_path=cfg.config_path,
diff --git a/keel/web/payload.py b/keel/web/payload.py
index caddffe7..43aeedeb 100644
--- a/keel/web/payload.py
+++ b/keel/web/payload.py
@@ -3275,7 +3275,7 @@ def config_payload(
     autonomous: bool = False,
     db_path: str = "",
     config_path: str = "",
-    peers: Sequence[Mapping[str, Any]] = (),
+    switcher: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     """The running build and the deployment it serves, for the consumers that need either by
     name.
@@ -3309,6 +3309,10 @@ def config_payload(
     `keel.commands._common._require_interactive_confirmation` exists for), and the browser can
     display that decision and cannot make it. An absent `mode` (`""`) means the config could
     not be read -- the first-run state -- and the badge hides rather than guessing.
+
+    `switcher` (#814) is the one thing here about OTHER consoles: `profile_switcher`'s answer
+    for the ones serving beside this one. It names them and carries a token-free href to each;
+    see that function for why nothing more.
     """
     return {
         "version": str(getattr(build, "version", "") or ""),
@@ -3351,7 +3355,49 @@ def config_payload(
             on_state=GOOD,
             off_state=WARN,
         ),
-        "peers": list(peers),
+        "switcher": dict(switcher) if switcher is not None else profile_switcher("", 0, [], False),
+    }
+
+
+def profile_switcher(
+    profile: str, port: int, peers: Sequence[Mapping[str, Any]], local: bool
+) -> dict[str, Any]:
+    """The console switcher (#814): the other consoles serving from this deployment root.
+
+    `choices` are the consoles to go TO -- never this one, which the session chip names in plain
+    text. `display` names all of them, this one marked, for the deployment card.
+
+    **Names and token-free hrefs, and nothing else.** #815 put each console's
+    `http://.../?token=...` here, so every page held every console's session token -- the paper
+    console's page held the live one's -- against `security.py`'s "must never be written into the
+    page". A `href` is `/switch/<port>` on THIS console; `server._switch` reads the peer's record
+    when it is followed and hands the token to the browser's navigation, never to the page.
+
+    **This console comes from its own arguments**, never from a record: a console started at a
+    terminal writes none, and #815's list, built from records alone, then had no current entry --
+    the browser selected the first option, and the header named a deployment that was not the
+    one on screen. `peers` may or may not include this console; it is dropped either way.
+
+    **No mode in a label.** A peer's mode would be one recorded at its start-up and stale after
+    any config edit; the badge on the console you arrive at reads it live.
+
+    Rule 2: `label` and `display` arrive composed, so the client places strings. Rule 3:
+    `switchable` is stated, never inferred from a list length. Not `local` -- a declared remote
+    origin, or a bind off loopback -- offers nothing: the peers' loopback addresses cannot be
+    opened from the viewer's device, and `/switch/` refuses there anyway.
+    """
+    others = sorted(
+        (int(peer["port"]), str(peer.get("profile") or "") or f"port {int(peer['port'])}")
+        for peer in peers
+        if int(peer["port"]) != port
+    )
+    if not local or not others:
+        return {"switchable": False, "choices": [], "display": ""}
+    here = (port, f"{profile or f'port {port}'} (this console)")
+    return {
+        "switchable": True,
+        "choices": [{"label": label, "href": f"/switch/{number}"} for number, label in others],
+        "display": ", ".join(label for _number, label in sorted([here, *others])),
     }
 
 
diff --git a/keel/web/runtime.py b/keel/web/runtime.py
index 17d7694c..0c962c66 100644
--- a/keel/web/runtime.py
+++ b/keel/web/runtime.py
@@ -110,7 +110,6 @@ def record_serving(
     token: str,
     interactive: bool,
     profile: str = "",
-    mode: str = "",
 ) -> Path | None:
     """Record how to reach this server, unless a human is watching stdout.
 
@@ -119,6 +118,11 @@ def record_serving(
     is also printed, and so a test can exercise both sides without touching the process's own
     streams.
 
+    `profile` names this console in the other consoles' switchers (#814). No mode rides along:
+    it would be read once here and shown until the process died, and `api._auto_trade_mode`
+    re-reads the config on every request precisely so a badge never states a mode the config no
+    longer declares. Each console's own badge reports its mode, live, once you arrive.
+
     Returns the path written, or `None` when the rule above says to write nothing.
     """
     if interactive:
@@ -140,8 +144,6 @@ def record_serving(
     }
     if profile:
         data["profile"] = str(profile)
-    if mode:
-        data["mode"] = str(mode)
     body = json.dumps(data)
     # CREATED at `0600`, not corrected to it (#759 review). `Path.write_text` creates at the
     # process umask -- measured `0644` under the usual `022` -- and the `chmod` that followed left
@@ -305,50 +307,40 @@ def stdout_is_interactive() -> bool:
         return False
 
 
-def live_peers(current_port: int | None = None) -> list[dict[str, Any]]:
-    """All active peer console servers discovered in the runtime directory (#814).
+def live_peers(*, exclude_port: int) -> list[dict[str, Any]]:
+    """The OTHER consoles serving from this deployment root, as `{port, profile}` (#814).
+
+    Port and profile and nothing else. A record holds a bearer token, and #815 returned it here
+    inside a URL that `/api/config` carried into every console's page -- the paper console's page
+    held the live console's token. What a switcher needs to OFFER a console is its name and its
+    port; what it needs to ENTER one, `server._switch` reads from the record at click time and
+    hands only to the browser's navigation, never to the page.
 
-    Scans `run_dir()` for all `serve-*.json` records, verifying each against `live_record` (live
-    process and responding loopback port). Returns structured peer metadata sorted by port, with
-    wire-safe types (port as string, current as boolean).
+    Same deployment root only, by construction: `run_dir` is under `state_root()`, so another
+    deployment's consoles are never read (the rule `RUN_DIR_NAME`'s note states). Each record is
+    offered only if `live_record` says its process is still there, and `exclude_port` drops this
+    console's own -- the caller lists itself from its own arguments, because a console started
+    at a terminal writes no record at all.
     """
     directory = run_dir()
     if directory is None or not directory.is_dir():
         return []
-
-    peers: list[dict[str, Any]] = []
     try:
         entries = sorted(directory.glob("serve-*.json"))
     except OSError:
         return []
 
+    peers: list[dict[str, Any]] = []
     for entry in entries:
-        name = entry.stem
-        parts = name.split("-")
-        if len(parts) != 2:
-            continue
         try:
-            port = int(parts[1])
+            port = int(entry.stem.removeprefix("serve-"))
         except ValueError:
             continue
-
+        if port == exclude_port:
+            continue
         record = live_record(port)
         if record is None:
             continue
-
-        profile = str(record.get("profile", "") or "")
-        mode = str(record.get("mode", "") or "")
-        is_current = bool(current_port is not None and port == int(current_port))
-
-        peers.append(
-            {
-                "port": str(port),
-                "profile": profile,
-                "mode": mode,
-                "url": url_for(record),
-                "current": is_current,
-            }
-        )
-
-    peers.sort(key=lambda p: int(p["port"]))
+        peers.append({"port": port, "profile": str(record.get("profile") or "")})
+    peers.sort(key=lambda peer: peer["port"])
     return peers
diff --git a/keel/web/security.py b/keel/web/security.py
index 013a521c..d5bb8f23 100644
--- a/keel/web/security.py
+++ b/keel/web/security.py
@@ -293,14 +293,27 @@ def gated_action_permitted(
     in a quiet edit here. Until then a tunnelled deployment serves the read surface and refuses
     every gated action, which is the posture that fails safe.
     """
+    return local_deployment(external_hosts=external_hosts, bound_host=bound_host) and (
+        _is_loopback_peer(peer)
+    )
+
+
+def local_deployment(*, external_hosts: frozenset[str], bound_host: str) -> bool:
+    """No declared remote origin and a loopback bind: the half of `gated_action_permitted` that
+    holds for the whole process rather than per request.
+
+    Split out for the profile switcher (#814), which asks it at two moments: when `/api/config`
+    decides whether to OFFER a switch (no request peer to ask about -- the answer is the
+    deployment's posture), and when `/switch/<port>` decides whether to PERFORM one, where the
+    peer check is added exactly as it is for a release. One definition, so the offer and the
+    route cannot disagree about what "local" means.
+    """
     if external_hosts:
         return False
     # The bind, by the same rule as the peer, so `127.0.0.53` and `::1` are loopback here too and
     # a name that is not an address ("example.internal") is refused -- this decides a security
     # question, and "I could not tell" is not "yes".
-    if bound_host not in _LOOPBACK_NAMES and not _is_loopback_peer((bound_host, 0)):
-        return False
-    return _is_loopback_peer(peer)
+    return bound_host in _LOOPBACK_NAMES or _is_loopback_peer((bound_host, 0))
 
 
 def tokens_match(presented: str | None, expected: str) -> bool:
diff --git a/keel/web/server.py b/keel/web/server.py
index e2f2dba5..fee850fb 100644
--- a/keel/web/server.py
+++ b/keel/web/server.py
@@ -192,6 +192,13 @@ def ensure_schema(db_path: str) -> None:
 #: `API_SETUP_PREFIX`.
 EVENTS_PATH = "/api/events"
 
+#: The profile switcher's one route (#814): `/switch/<port>` moves the browser to another console
+#: serving from this deployment root. A GET that redirects and changes nothing -- navigation, the
+#: one thing the session chip's docstring allows it -- and the reason the page never needs a
+#: peer's token: see `_switch`. `sw.js` declines these navigations by the same prefix, or it
+#: would answer them from its cached shell and the server would never see one.
+SWITCH_PREFIX = "/switch/"
+
 #: The write surface, in full, today. A path here maps to one `keel.commands.setup.Action`; there
 #: is no other POST this server answers, and `keel/web/__init__.py` is the file to read before
 #: adding one.
@@ -913,6 +920,54 @@ def _read_json_object(self) -> dict[str, str] | None:
             values[str(name)] = "" if value is None else str(value)
         return values
 
+    def _switch(self, target: str) -> None:
+        """Send the browser into another console serving from this deployment root (#814).
+
+        **The token travels the way `keel open` already sends it, and no other way.** The page
+        offers `/switch/<port>` and nothing more; this reads the peer's record NOW -- so a peer
+        restarted since the page loaded, with a new token, is still reached -- and answers with a
+        `303` to that peer's `?token=` address. The peer exchanges the token for its own cookie
+        and strips it from the URL (`do_GET`'s hand-off). Only the browser's navigation carries
+        it: no page script can read a redirect's `Location`, so the page never holds a session
+        token, its own or anyone's, which #815's `<option value>` did.
+
+        **Local only, by the floor `gated_action_permitted` holds for a release.** Entering the
+        live console from the paper one hands over the live console's session, so this requires
+        what reading the `0600` record directly would: this machine. A declared remote origin or
+        an off-loopback bind refuses, and so does a peer that is not loopback -- a tunnel presents
+        as loopback, which is why the deployment's posture is checked as well.
+
+        Behind `_admitted` (the caller's), so without this console's own session nothing about
+        any other is revealed, not even whether it is running. An unknown or dead port is a 404
+        and names no console.
+        """
+        if not gated_action_permitted(
+            self.client_address,
+            external_hosts=self.cfg.external_hosts,
+            bound_host=self.cfg.host,
+        ):
+            self._refuse(
+                403,
+                "Refused",
+                "Switching consoles is restricted to a loopback session on a loopback bind. Use "
+                "`keel open` at the terminal of the machine running keel.",
+            )
+            return
+        port = int(target) if target.isdigit() else None
+        if port == self.cfg.port:
+            self._send(303, "", extra=(("Location", "/"),))
+            return
+        record = runtime.live_record(port) if port is not None else None
+        if record is None:
+            self._refuse(
+                404,
+                "No such console",
+                "No keel console is running on that port now. Reload this page for the current "
+                "list.",
+            )
+            return
+        self._send(303, "", extra=(("Location", runtime.url_for(record)),))
+
     def do_GET(self) -> None:  # noqa: N802 - stdlib's naming, not ours
         self.body_consumed = False
         parsed = urlsplit(self.path)
@@ -947,6 +1002,10 @@ def do_GET(self) -> None:  # noqa: N802 - stdlib's naming, not ours
         if not self._admitted():
             return
 
+        if parsed.path.startswith(SWITCH_PREFIX):
+            self._switch(parsed.path.removeprefix(SWITCH_PREFIX))
+            return
+
         if parsed.path == EVENTS_PATH:
             # Live updates (#537). Checked BEFORE the `API_PREFIX` branch below, because that
             # branch ends in `api.respond`, which would answer this path with the 404 it gives
@@ -1113,15 +1172,12 @@ def serve(cfg: ServeConfig, *, echo: Callable[[str], None] = print) -> int:
     # printing the wrong one would be a false safety assurance about a live credential -- the
     # class of thing `payload._session_banner` refuses to do about mode.
     interactive = runtime.stdout_is_interactive()
-    profile = Path(running.db_path).stem if running.db_path else ""
-    mode = api._auto_trade_mode(running.config_path)
     recorded = runtime.record_serving(
         host=running.host,
         port=running.port,
         token=running.token,
         interactive=interactive,
-        profile=profile,
-        mode=mode,
+        profile=api._profile_name(running.db_path),
     )
     if recorded is None:
         echo("Stopping keel revokes it: the token is new every run and is never written to disk.")
diff --git a/keel/web/static/css/keel.css b/keel/web/static/css/keel.css
index dc1b90e4..b372671d 100644
--- a/keel/web/static/css/keel.css
+++ b/keel/web/static/css/keel.css
@@ -390,7 +390,12 @@ header .sessionpart {
   text-overflow: ellipsis;
   white-space: nowrap;
 }
-header .profile-select {
+/* THE CONSOLE SWITCHER (#814), beside the chip. As quiet as the chip's text halves -- it is a way
+ * to another console, not a fact about this one -- and bounded the same way, since its options
+ * are operators' own filenames. */
+header #console-switcher { align-self: center; }
+header #console-switcher:empty { display: none; }
+header .console-select {
   background: var(--bg);
   color: var(--muted);
   border: 1px solid var(--control-line);
@@ -398,12 +403,11 @@ header .profile-select {
   font-size: 0.85em;
   font-family: inherit;
   padding: 0.1rem 0.3rem;
-  max-width: 14ch;
+  max-width: 20ch;
   cursor: pointer;
-  outline: none;
 }
-header .profile-select:hover,
-header .profile-select:focus-visible {
+header .console-select:hover,
+header .console-select:focus-visible {
   color: var(--fg);
   border-color: var(--accent);
 }
diff --git a/keel/web/static/index.html b/keel/web/static/index.html
index 5f791a34..fb1778ac 100644
--- a/keel/web/static/index.html
+++ b/keel/web/static/index.html
@@ -219,6 +219,13 @@
       </details>
       <span id="session-equity" class="sessionpart"></span>
     </div>
+    <!--
+      THE CONSOLE SWITCHER (#814): BESIDE the chip, never inside it. The chip names this console in
+      plain text and may not be a control (#704); this is the one control, and all it does is
+      navigate to `/switch/<port>`, which hands the browser to another RUNNING console. Empty in
+      the markup and hidden while empty -- a deployment with one console has nothing to offer.
+    -->
+    <span id="console-switcher"></span>
   
     <!--
       THE THEME TOGGLE (#597): two states, and the stylesheet is the state machine.
diff --git a/keel/web/static/js/main.js b/keel/web/static/js/main.js
index 3b71e18c..6b3bb636 100644
--- a/keel/web/static/js/main.js
+++ b/keel/web/static/js/main.js
@@ -48,6 +48,7 @@ import {
   deploymentCard,
   modeBadge,
   paperBanner,
+  consoleSwitcher,
   sessionChip,
   ordersView,
   balancesView,
@@ -160,6 +161,8 @@ const deploymentCardNode = must("deployment-card");
 /** The session chip's equity-state half (#704). Genuinely absent on a deployment that has never
  * flipped modes, which is why it is a `Field` and not a bare word. */
 const sessionEquityNode = must("session-equity");
+/** The console switcher (#814), beside the chip and never inside it. Empty with one console. */
+const consoleSwitcherNode = must("console-switcher");
 /** The persistent mode banner (#704). No buttons live in here, by design and by test. */
 const modeBannerNode = must("mode-banner");
 const attestBannerNode = must("attest-banner");
@@ -889,12 +892,12 @@ themeNode.addEventListener("click", () => {
   }
 });
 
-//: In-app profile switcher navigation (#814).
-sessionProfileNode.addEventListener("change", (event) => {
-  const target = /** @type {HTMLSelectElement} */ (event.target);
-  if (target && target.value && target.value !== window.location.href) {
-    window.location.href = target.value;
-  }
+//: The console switcher (#814). An option's value is `/switch/<port>` on this console -- never a
+//: token; the server redirects into the chosen console's own hand-off. The placeholder's value is
+//: empty and it is disabled, so every `change` is a real choice.
+consoleSwitcherNode.addEventListener("change", (event) => {
+  const select = /** @type {HTMLSelectElement} */ (event.target);
+  if (select.value) window.location.assign(select.value);
 });
 
 /** Catch up immediately when a hidden tab is looked at again -- see the poll comment in `show`. */
@@ -1696,6 +1699,9 @@ void read("config").then((reading) => {
   // process serves cannot change without a restart, and filling the chip here is what puts it on
   // every view rather than only where a status report happens to load.
   sessionChip(sessionProfileNode, sessionEquityNode, config);
+  // #814: the other consoles in this deployment root. From the boot read like the chip; a console
+  // started later appears on the next load, and `/switch/` resolves its address when followed.
+  consoleSwitcher(consoleSwitcherNode, config);
   // #755: the same boot read, for the same reason -- and the card must be filled even
   // though it is closed, because a `<details>` opens with no JavaScript involved and
   // there is no event to fill it on.
diff --git a/keel/web/static/js/render.js b/keel/web/static/js/render.js
index 3dc69696..91634f2d 100644
--- a/keel/web/static/js/render.js
+++ b/keel/web/static/js/render.js
@@ -3686,6 +3686,10 @@ export function modeBadge(node, config) {
 //: sentence arrives from Python because that function CHOOSES between sentences on the basis of a
 //: config, which is a judgement. This one is the same words on every deployment, so it is UI copy
 //: in the class of `plansView`'s subtitle, and Rule 2 has nothing to say about it.
+//: The switcher's closed state: an instruction, never a console's name, so the header names this
+//: console in exactly one place -- the chip.
+const SWITCHER_PLACEHOLDER = "switch console\u2026";
+
 const SWITCHING_NOTE = "Mode and profile switching are terminal ceremonies with a runbook. ".concat(
   "This console reports the deployment it was pointed at and cannot change it.",
 );
@@ -3721,7 +3725,6 @@ export function deploymentCard(node, config) {
     node.replaceChildren();
     return;
   }
-  const peers = config && Array.isArray(config.peers) ? config.peers : [];
   const rows = [
     kv("deployment", config.profile || "\u2014"),
     kv("mode", mode),
@@ -3729,12 +3732,10 @@ export function deploymentCard(node, config) {
     kv("database", config.db_path || "\u2014"),
     kv("origin", window.location.origin),
   ];
-  if (peers.length !== 0 && peers.length !== 1) {
-    const peerLabels = peers.map((p) => {
-      const name = p.profile || String(p.port);
-      return p.current ? name.concat(" (current)") : name;
-    });
-    rows.push(kv("active profiles", peerLabels.join(", ")));
+  // The consoles running beside this one (#814), composed by `payload.profile_switcher`; empty,
+  // and so absent, when there are none.
+  if (config.switcher && config.switcher.display) {
+    rows.push(kv("running consoles", config.switcher.display));
   }
   node.replaceChildren(
     gridCard(rows),
@@ -3756,9 +3757,6 @@ export function deploymentCard(node, config) {
  * replacing it, so the badge keeps owning the mode word and its db/config tooltip -- three facts
  * reading `profile · mode · equity state`, each written by the one function that knows it.
  *
- * When multiple peer console daemons are running, the profile node renders an accessible
- * selector allowing instant browser navigation between running sessions (#814).
- *
  * The two halves are filled separately because they are separately absent: a profile is always
  * knowable (it is the database's filename), while the equity state can be genuinely unrecorded
  * on a deployment that has never flipped modes. `equity_state` is a `Field` carrying that
@@ -3771,25 +3769,7 @@ export function deploymentCard(node, config) {
  */
 export function sessionChip(profileNode, equityNode, config) {
   const profile = config && typeof config.profile === "string" ? config.profile : "";
-  const peers = config && Array.isArray(config.peers) ? config.peers : [];
-
-  if (peers.length !== 0 && peers.length !== 1) {
-    const options = peers.map((peer) => {
-      const name = peer.profile || "port ".concat(String(peer.port));
-      const modeStr = peer.mode ? " (".concat(peer.mode, ")") : "";
-      const opt = el("option", "", name.concat(modeStr));
-      if (peer.url) {
-        opt.setAttribute("value", String(peer.url));
-      }
-      if (peer.current) {
-        opt.setAttribute("selected", "selected");
-      }
-      return opt;
-    });
-    const select = el("select", "profile-select", ...options);
-    select.setAttribute("aria-label", "Switch running profile");
-    profileNode.replaceChildren(select);
-  } else if (profile) {
+  if (profile) {
     profileNode.replaceChildren(document.createTextNode(profile));
   } else {
     // Empty rather than a placeholder, and `keel.css` hides it while empty -- the same rule the
@@ -3803,6 +3783,48 @@ export function sessionChip(profileNode, equityNode, config) {
   }
 }
 
+/**
+ * The console switcher (#814): the OTHER keel consoles serving from this deployment root, as a
+ * `<select>` beside the session chip -- never inside it.
+ *
+ * **Beside, because the chip may not be a control.** #704 refused the retail pattern of a chip
+ * that is also a dropdown (`test_neither_the_chip_nor_the_banner_builds_anything_clickable`), and
+ * #815 put one there anyway. The chip keeps naming THIS console in plain text; nothing here can
+ * make it name another.
+ *
+ * **Navigation only.** Each choice's `href` is `/switch/<port>` on this console, which redirects
+ * into that console's own session hand-off. It starts, stops and changes nothing -- switching a
+ * deployment's profile or mode is still the terminal ceremony it was -- and it never holds a
+ * token (see `payload.profile_switcher`). The first option is a disabled placeholder, so no
+ * console is ever shown as selected and choosing any real one is a `change`.
+ *
+ * `switchable` decides whether it appears at all, and is stated by the payload rather than read
+ * off a list's length. Built, then filled: `el` has no children form, and #815's
+ * `el("select", ..., ...options)` rendered an empty select.
+ *
+ * @param {HTMLElement} node
+ * @param {any} config  `/api/config`'s `data`, or `null`.
+ */
+export function consoleSwitcher(node, config) {
+  if (!(config && config.switcher && config.switcher.switchable)) {
+    node.replaceChildren();
+    return;
+  }
+  const select = el("select", "console-select");
+  select.setAttribute("aria-label", "Open another running keel console");
+  const placeholder = el("option", undefined, SWITCHER_PLACEHOLDER);
+  placeholder.setAttribute("value", "");
+  placeholder.setAttribute("disabled", "disabled");
+  placeholder.setAttribute("selected", "selected");
+  select.append(placeholder);
+  for (const choice of config.switcher.choices) {
+    const option = el("option", undefined, plain(choice.label));
+    option.setAttribute("value", plain(choice.href));
+    select.append(option);
+  }
+  node.replaceChildren(select);
+}
+
 /**
  * The persistent mode banner (#704).
  *
diff --git a/keel/web/static/sw.js b/keel/web/static/sw.js
index d490f948..0867acac 100644
--- a/keel/web/static/sw.js
+++ b/keel/web/static/sw.js
@@ -73,6 +73,12 @@ const API_PREFIX = "/api/";
 //: The worker ends up holding the door shut against the only key.
 const SESSION_TOKEN_PARAM = "token";
 
+//: The profile switcher's route (#814), `server.SWITCH_PREFIX`. Like the token hand-off it is a
+//: navigation the SERVER must answer -- it redirects into another console -- so it is declined
+//: to the network the same way. Answered from the cache, it would load this console's shell again
+//: and the switch would silently do nothing.
+const SWITCH_PREFIX = "/switch/";
+
 /** The document every in-scope navigation resolves to -- `staticfiles.CLIENT_ENTRY`. */
 const SHELL = `${BASE}index.html`;
 
@@ -212,6 +218,7 @@ self.addEventListener("fetch", (event) => {
     // like it had worked and then refuse every read, which is the failure this whole exception
     // exists to prevent.
     if (url.searchParams.has(SESSION_TOKEN_PARAM)) return;
+    if (url.pathname.startsWith(SWITCH_PREFIX)) return;
 
     event.respondWith(
       caches.match(SHELL, { cacheName: CACHE }).then((hit) => hit || fetch(request)),
diff --git a/tests/web/test_profile_switcher.py b/tests/web/test_profile_switcher.py
index 3543c4d6..0168f44c 100644
--- a/tests/web/test_profile_switcher.py
+++ b/tests/web/test_profile_switcher.py
@@ -1,157 +1,351 @@
-"""Unit and integration tests for in-app profile switcher discovery (#814)."""
+"""The in-app profile switcher (#814), and the review of #815 that rebuilt it.
+
+#815 shipped every running console's `http://.../?token=...` inside `/api/config` and wrote it
+into `<option value>`: the paper console's page carried the live console's session token, and
+its own, which `security.py` says "must never be written into the page". These tests pin the
+shape that replaced it:
+
+* The page learns `{label, href, current}` per console and nothing else. `href` is a
+  token-free `/switch/<port>` on the CURRENT console.
+* `/switch/<port>` resolves the peer's record server-side, at click time, and redirects into the
+  peer's own `?token=` hand-off -- the one path a token already travels (`keel open`). The page's
+  JavaScript never sees it.
+* The current console is always listed, from its own arguments, whether or not it wrote a record
+  (a terminal `keel serve` writes none).
+* No mode in the label: a mode recorded at start-up goes stale, and the peer's own badge reads
+  it live the moment you arrive.
+"""
 
 from __future__ import annotations
 
 import json
+import re
+from collections.abc import Iterator
 from pathlib import Path
 from unittest.mock import patch
 
-from keel.web import payload, runtime
-from tests.web.test_client_assets import _source
+import pytest
 
+from keel.web import api, payload, runtime, security
+from keel.web import server as web_server
+from tests.web.test_client_assets import _code_only, _source
+from tests.web.test_server import _request, _serving, _session
+
+PEER_TOKEN = "peer-session-token-that-must-never-reach-a-page"
 
-def test_record_serving_includes_profile_and_mode(tmp_path: Path) -> None:
-    """record_serving writes profile and mode into serve-<port>.json when provided."""
-    with patch("keel.web.runtime.state_root", return_value=tmp_path):
-        record_path = runtime.record_serving(
-            host="127.0.0.1",
-            port=8765,
-            token="test-token",
-            interactive=False,
-            profile="keel-live",
-            mode="confirm",
-        )
-        assert record_path is not None
-        assert record_path.exists()
-        data = json.loads(record_path.read_text())
-        assert data["profile"] == "keel-live"
-        assert data["mode"] == "confirm"
-        assert data["port"] == 8765
-        assert data["token"] == "test-token"
-
-
-def test_live_peers_discovers_active_daemons(tmp_path: Path) -> None:
-    """live_peers discovers all responsive peer records and sets current flag."""
-    run_dir = tmp_path / "run"
-    run_dir.mkdir(parents=True)
-
-    # Write two records
-    (run_dir / "serve-8765.json").write_text(
-        json.dumps(
-            {
-                "pid": 12345,
-                "host": "127.0.0.1",
-                "port": 8765,
-                "token": "tok-1",
-                "profile": "keel-live",
-                "mode": "confirm",
-            }
-        )
-    )
-    (run_dir / "serve-8766.json").write_text(
-        json.dumps(
-            {
-                "pid": 12346,
-                "host": "127.0.0.1",
-                "port": 8766,
-                "token": "tok-2",
-                "profile": "keel",
-                "mode": "paper",
-            }
-        )
-    )
 
+def _write_record(run: Path, port: int, **extra: object) -> None:
+    body = {"pid": 4242, "host": "127.0.0.1", "port": port, "token": PEER_TOKEN, **extra}
+    (run / f"serve-{port}.json").write_text(json.dumps(body))
+
+
+@pytest.fixture
+def run_dir(tmp_path: Path) -> Iterator[Path]:
+    """A deployment root whose run directory holds records, every one of them reading as live."""
+    root = tmp_path / "root"
+    run = root / runtime.RUN_DIR_NAME
+    run.mkdir(parents=True)
     with (
-        patch("keel.web.runtime.state_root", return_value=tmp_path),
+        patch("keel.web.runtime.state_root", return_value=root),
         patch("keel.web.runtime.process_alive", return_value=True),
         patch("keel.web.runtime._port_answers", return_value=True),
     ):
-        peers = runtime.live_peers(current_port=8765)
-        assert len(peers) == 2
-        assert peers[0]["port"] == "8765"
-        assert peers[0]["profile"] == "keel-live"
-        assert peers[0]["mode"] == "confirm"
-        assert peers[0]["current"] is True
-        assert "tok-1" in peers[0]["url"]
-
-        assert peers[1]["port"] == "8766"
-        assert peers[1]["profile"] == "keel"
-        assert peers[1]["mode"] == "paper"
-        assert peers[1]["current"] is False
-        assert "tok-2" in peers[1]["url"]
-
-
-def test_live_peers_filters_unresponsive_or_dead_records(tmp_path: Path) -> None:
-    """Dead processes or unreachable ports are excluded from peer discovery."""
-    run_dir = tmp_path / "run"
-    run_dir.mkdir(parents=True)
-
-    (run_dir / "serve-8765.json").write_text(
-        json.dumps(
-            {
-                "pid": 12345,
-                "host": "127.0.0.1",
-                "port": 8765,
-                "token": "tok-1",
-                "profile": "keel-live",
-            }
+        yield run
+
+
+# -- runtime ---------------------------------------------------------------------------------------
+
+
+def test_record_serving_writes_the_profile_and_no_mode(tmp_path: Path) -> None:
+    """The profile names the record's console in a peer's list. A mode is NOT recorded: it would
+    be read once at start-up and shown until the process died, while `_auto_trade_mode` re-reads
+    the config per request precisely so a badge never shows a mode the config no longer says."""
+    with patch("keel.web.runtime.state_root", return_value=tmp_path):
+        named = runtime.record_serving(
+            host="127.0.0.1", port=8765, token="t", interactive=False, profile="keel-live"
         )
+        unnamed = runtime.record_serving(host="127.0.0.1", port=8766, token="t", interactive=False)
+
+    assert named is not None
+    assert unnamed is not None
+    assert set(json.loads(named.read_text())) == {
+        "pid",
+        "host",
+        "port",
+        "token",
+        "started_ts",
+        "profile",
+    }
+    assert json.loads(named.read_text())["profile"] == "keel-live"
+    assert "profile" not in json.loads(unnamed.read_text())
+
+
+def test_live_peers_names_the_other_consoles_by_port_and_profile_only(run_dir: Path) -> None:
+    """Port and profile, nothing else -- no token, no URL -- and never the caller's own record."""
+    _write_record(run_dir, 8766, profile="keel")
+    _write_record(run_dir, 8765, profile="keel-live")
+    _write_record(run_dir, 8767)
+
+    assert runtime.live_peers(exclude_port=8765) == [
+        {"port": 8766, "profile": "keel"},
+        {"port": 8767, "profile": ""},
+    ]
+
+
+def test_live_peers_skips_a_record_whose_process_is_gone(run_dir: Path) -> None:
+    _write_record(run_dir, 8766, profile="keel", pid=1)
+    _write_record(run_dir, 8767, profile="keel-paperhourly", pid=2)
+
+    with patch("keel.web.runtime.process_alive", side_effect=lambda pid: pid == 2):
+        assert runtime.live_peers(exclude_port=8765) == [
+            {"port": 8767, "profile": "keel-paperhourly"}
+        ]
+
+
+# -- payload ---------------------------------------------------------------------------------------
+
+
+def test_the_switcher_offers_the_other_consoles_by_token_free_href() -> None:
+    """Choices are where to GO, so never this console; the card's `display` names everyone, this
+    one marked -- from its own arguments, since a terminal `keel serve` writes no record and #815,
+    built from records alone, then named a different console as this one."""
+    peers = [{"port": 8766, "profile": "keel"}, {"port": 8764, "profile": ""}]
+
+    assert payload.profile_switcher("keel-live", 8765, peers, local=True) == {
+        "switchable": True,
+        "choices": [
+            {"label": "port 8764", "href": "/switch/8764"},
+            {"label": "keel", "href": "/switch/8766"},
+        ],
+        "display": "port 8764, keel-live (this console), keel",
+    }
+
+
+def test_the_switcher_drops_this_consoles_own_record() -> None:
+    peers = [{"port": 8765, "profile": "keel-live"}, {"port": 8766, "profile": "keel"}]
+
+    switcher = payload.profile_switcher("keel-live", 8765, peers, local=True)
+
+    assert switcher["choices"] == [{"label": "keel", "href": "/switch/8766"}]
+    assert switcher["display"] == "keel-live (this console), keel"
+
+
+@pytest.mark.parametrize(
+    ("peers", "local"),
+    [([], True), ([{"port": 8765, "profile": "keel-live"}], True), ([{"port": 8766}], False)],
+    ids=["alone", "only-itself", "remote"],
+)
+def test_the_switcher_offers_nothing_when_there_is_nowhere_to_go(
+    peers: list[dict[str, object]], local: bool
+) -> None:
+    """Alone, there is nothing to switch to. Remote, the peers' loopback addresses cannot be
+    opened from the viewer's device, and `/switch/` refuses there anyway."""
+    assert payload.profile_switcher("keel-live", 8765, peers, local=local) == {
+        "switchable": False,
+        "choices": [],
+        "display": "",
+    }
+
+
+# -- the wire --------------------------------------------------------------------------------------
+
+
+def test_api_config_carries_no_session_token(deployment: tuple[str, str], run_dir: Path) -> None:
+    """The #815 defect, end to end: a peer's token, and this console's own, reach no page."""
+    _write_record(run_dir, 8766, profile="keel-live")
+
+    with _serving(deployment) as cfg:
+        status, _headers, body = _request(cfg, "/api/config", cookie=_session(cfg))
+
+    assert status == 200
+    assert PEER_TOKEN not in body
+    assert cfg.token not in body
+    data = json.loads(body)["data"]
+    assert "peers" not in data
+    assert data["switcher"]["choices"] == [{"label": "keel-live", "href": "/switch/8766"}]
+
+
+def test_read_config_offers_no_switch_on_a_remote_deployment(
+    deployment: tuple[str, str], run_dir: Path
+) -> None:
+    _write_record(run_dir, 8766, profile="keel-live")
+    db_path, config_path = deployment
+    cfg = web_server.ServeConfig(
+        host="127.0.0.1",
+        port=8765,
+        token="t",
+        db_path=db_path,
+        config_path=config_path,
+        external_hosts=frozenset({"keel.example.com"}),
     )
-    (run_dir / "serve-8766.json").write_text(
-        json.dumps(
-            {
-                "pid": 99999,
-                "host": "127.0.0.1",
-                "port": 8766,
-                "token": "tok-2",
-                "profile": "keel-dead",
-            }
-        )
+
+    assert api.read_config(cfg, {}, None, 0)["switcher"]["switchable"] is False
+
+
+# -- /switch/<port> --------------------------------------------------------------------------------
+
+
+def test_switch_redirects_into_the_peers_own_hand_off(
+    deployment: tuple[str, str], run_dir: Path
+) -> None:
+    """The token travels in a `Location` header, to the peer, which exchanges it for its cookie
+    and strips it from the URL -- exactly the hand-off `keel open` performs. No cookie is set
+    here: this console's session is not the peer's."""
+    _write_record(run_dir, 8766, profile="keel-live")
+
+    with _serving(deployment) as cfg:
+        status, headers, _body = _request(cfg, "/switch/8766", cookie=_session(cfg))
+
+    assert status == 303
+    assert headers["Location"] == f"http://127.0.0.1:8766/?token={PEER_TOKEN}"
+    assert "Set-Cookie" not in headers
+
+
+def test_switch_to_this_console_goes_home(deployment: tuple[str, str], run_dir: Path) -> None:
+    with _serving(deployment) as cfg:
+        status, headers, _body = _request(cfg, f"/switch/{cfg.port}", cookie=_session(cfg))
+
+    assert (status, headers["Location"]) == (303, "/")
+
+
+@pytest.mark.parametrize("path", ["/switch/8799", "/switch/abc", "/switch/", "/switch/8766/x"])
+def test_switch_to_no_running_console_is_a_404(
+    deployment: tuple[str, str], run_dir: Path, path: str
+) -> None:
+    _write_record(run_dir, 8766, profile="keel-live")
+
+    with _serving(deployment) as cfg:
+        status, headers, body = _request(cfg, path, cookie=_session(cfg))
+
+    assert status == 404
+    assert "Location" not in headers
+    assert PEER_TOKEN not in body
+
+
+def test_switch_without_a_session_is_refused(deployment: tuple[str, str], run_dir: Path) -> None:
+    """Admission first: without this console's cookie, nothing about any other is revealed."""
+    _write_record(run_dir, 8766, profile="keel-live")
+
+    with _serving(deployment) as cfg:
+        status, headers, body = _request(cfg, "/switch/8766")
+
+    assert status == 403
+    assert "Location" not in headers
+    assert PEER_TOKEN not in body
+
+
+def test_switch_is_refused_on_a_remote_deployment(
+    deployment: tuple[str, str], run_dir: Path
+) -> None:
+    """A tunnel forwards to loopback, so the peer check alone would pass; the declared remote
+    origin is what refuses -- the same floor `gated_action_permitted` holds for a release."""
+    _write_record(run_dir, 8766, profile="keel-live")
+    remote = frozenset({"keel.example.com"})
+
+    with _serving(deployment, external_hosts=remote) as cfg:
+        status, headers, body = _request(cfg, "/switch/8766", cookie=_session(cfg))
+
+    assert status == 403
+    assert "Location" not in headers
+    assert PEER_TOKEN not in body
+
+
+def test_local_deployment_is_the_first_two_conditions_of_a_gated_action() -> None:
+    """One definition of "this deployment is local", shared by the release gate and the
+    switcher, so the two cannot drift into different answers."""
+    assert security.local_deployment(external_hosts=frozenset(), bound_host="127.0.0.1")
+    assert not security.local_deployment(
+        external_hosts=frozenset({"keel.example.com"}), bound_host="127.0.0.1"
     )
+    assert not security.local_deployment(external_hosts=frozenset(), bound_host="192.168.1.5")
 
-    def mock_alive(pid: int) -> bool:
-        return pid == 12345
 
-    with (
-        patch("keel.web.runtime.state_root", return_value=tmp_path),
-        patch("keel.web.runtime.process_alive", side_effect=mock_alive),
-        patch("keel.web.runtime._port_answers", return_value=True),
-    ):
-        peers = runtime.live_peers(current_port=8765)
-        assert len(peers) == 1
-        assert peers[0]["port"] == "8765"
-        assert peers[0]["profile"] == "keel-live"
-
-
-def test_config_payload_serializes_peers_strictly() -> None:
-    """Rule 1 and Rule 3 hold on peers list: no json numbers, pure strings and bools."""
-    peers = [
-        {
-            "port": "8765",
-            "profile": "keel-live",
-            "mode": "confirm",
-            "url": "http://127.0.0.1:8765/?token=abc",
-            "current": True,
-        }
-    ]
-    data = payload.config_payload(
-        None,
-        describe="test",
-        mode="confirm",
-        profile="keel-live",
-        peers=peers,
+# -- the service worker ----------------------------------------------------------------------------
+
+
+def test_the_worker_sends_a_switch_navigation_to_the_network() -> None:
+    """The worker answers every navigation from its cached shell. A `/switch/` answered that way
+    never reaches the server, and the select would appear to do nothing."""
+    source = (Path(web_server.__file__).parent / "static" / "sw.js").read_text(encoding="utf-8")
+    branch = re.search(r'if \(request\.mode === "navigate"\) \{(.*?)\n  \}', source, re.DOTALL)
+    assert branch is not None
+    body = branch.group(1)
+
+    guard = re.search(
+        r"^\s*if \(url\.pathname\.startsWith\(SWITCH_PREFIX\)\) return;\s*$", body, re.MULTILINE
     )
-    assert data["peers"] == peers
-    assert isinstance(data["peers"][0]["port"], str)
-    assert isinstance(data["peers"][0]["current"], bool)
+    assert guard is not None
+    assert guard.start() < body.index("caches.match(")
+    assert f'const SWITCH_PREFIX = "{web_server.SWITCH_PREFIX}";' in source
+
+
+# -- the client ------------------------------------------------------------------------------------
+
+
+def _function(source: str, name: str) -> str:
+    match = re.search(r"export function " + name + r"\(.*?\n\}\n", source, re.DOTALL)
+    assert match is not None, f"{name} is not in the shape this test understands"
+    return _code_only(match.group(0))
+
+
+def test_no_element_is_built_with_spread_children() -> None:
+    """`el(tag, className, text)` has no children form. #815's `el("select", "...", ...options)`
+    set the select's text to "[object HTMLOptionElement]" and dropped every option."""
+    code = _code_only(_source("render.js"))
+    assert re.search(r"\bel\([^;]*\.\.\.", code) is None
+
+
+def test_the_switcher_builds_a_select_of_the_choices_behind_a_placeholder() -> None:
+    code = _function(_source("render.js"), "consoleSwitcher")
 
+    assert "config.switcher.switchable" in code
+    # `el("select", "console-select")` -- tag and class, and no text argument to swallow a child.
+    assert re.search(r"= el\( ,  \);", code) is not None
+    assert "for (const choice of config.switcher.choices)" in code
+    assert code.count(".append(") == 2  # the placeholder, then each choice
+    assert "choice.href" in code
+    assert "choice.label" in code
 
-def test_render_js_contains_profile_select_wiring() -> None:
-    """render.js generates select.profile-select when peers > 1 and main.js listens to change."""
-    render_src = _source("render.js")
-    assert "profile-select" in render_src
-    assert "config.peers" in render_src
 
-    main_src = _source("main.js")
-    assert "sessionProfileNode.addEventListener" in main_src
-    assert '"change"' in main_src
+def test_the_switcher_can_only_navigate() -> None:
+    """The #704 rule's counterpart for the one control #814 adds: it may offer a way to another
+    running console and nothing else -- no button, link, form or input, and no handler of its own
+    (`main.js` binds the one `change`, which only follows an option's value)."""
+    code = _function(_source("render.js"), "consoleSwitcher")
+    for forbidden in ("button", "addEventListener", "onclick", '"a"', "form", "input"):
+        assert forbidden not in code, f"consoleSwitcher builds something interactive: {forbidden}"
+
+
+def test_the_chip_does_not_hold_the_switcher() -> None:
+    """Beside the chip, never inside it: #704 forbids the chip being a control, and #815's
+    dropdown lived in `sessionChip` and got past that test only because `select` is not on its
+    list. The chip neither reads the switcher nor builds a select."""
+    chip = _function(_source("render.js"), "sessionChip")
+    assert "switcher" not in chip
+    assert "select" not in chip
+
+
+def test_the_switcher_node_sits_in_the_header_beside_the_chip_and_ships_empty() -> None:
+    from tests.web.test_client_assets import _INDEX, _markup_only
+
+    html = _markup_only(_INDEX.read_text(encoding="utf-8"))
+    assert '<span id="console-switcher"></span>' in html
+    chip_end = html.index("</div>", html.index('<div id="session-chip">'))
+    assert chip_end < html.index('id="console-switcher"') < html.index('id="view"')
+
+
+def test_the_deployment_card_places_the_switchers_display() -> None:
+    card = _function(_source("render.js"), "deploymentCard")
+
+    assert "config.switcher.display" in card
+    assert "peers" not in card
+
+
+def test_choosing_a_console_navigates_to_its_href() -> None:
+    main = _code_only(_source("main.js"))
+    handler = re.search(
+        r"consoleSwitcherNode\.addEventListener\( , \(event\) => \{(.*?)\n\}\);", main, re.DOTALL
+    )
+    assert handler is not None
+    assert "window.location.assign(" in handler.group(1)
+    assert "sessionProfileNode.addEventListener" not in main