diff --git a/keel/web/api.py b/keel/web/api.py
index d772ef7..ea37d17 100644
--- a/keel/web/api.py
+++ b/keel/web/api.py
@@ -120,7 +120,20 @@ def deployment_state(cfg: ServeConfig) -> Any:
 
 
 def close_repo(repo: Any) -> None:
-    conn = getattr(repo, "conn", None)
+    """Close the connection `open_repo` opened. Every reader in this package runs this in a
+    `finally`, and until #704 none of them closed anything.
+
+    It reached for `repo.conn`. `Repository.__init__` stores `self._conn` and exposes no `conn`,
+    so the `getattr` returned `None`, the guard fell through, and the function was a no-op --
+    every page load left an unclosed sqlite3 connection, reclaimed only by CPython's refcounting
+    when the local went out of scope. Harmless in practice on CPython and wrong in the way that
+    matters here: the `finally` READ as the cleanup, so nothing looked missing.
+
+    `_conn` first, `conn` second, so this keeps working against anything duck-typed as a
+    repository (the MCP tools hand around objects that are not `Repository`), and both are
+    checked rather than one being inferred from the other.
+    """
+    conn = getattr(repo, "_conn", None) or getattr(repo, "conn", None)
     if conn is not None:
         try:
             conn.close()
@@ -164,14 +177,20 @@ def _status_report(cfg: ServeConfig, now_ts: int) -> Any:
         close_repo(repo)
 
 
-def read_config(cfg: ServeConfig, _query: Query, _state: Any, _now_ts: int) -> dict[str, Any]:
-    """The running build, and the deployment that build is serving (#597).
+def read_config(cfg: ServeConfig, _query: Query, _state: Any, now_ts: int) -> dict[str, Any]:
+    """The running build, and the deployment that build is serving (#597, #704).
+
+    **It answers on a machine with nothing set up, which is why its route is
+    `needs_database=False` -- and #704 added one OPTIONAL database read without changing that.**
+    The chip needs `equity_state_mode`, which lives in `agent_state`, and this is the only
+    endpoint every view reads. `_equity_state_mode` therefore checks the file exists before
+    connecting (`sqlite3.connect` CREATES what it cannot find) and degrades to unknown on any
+    failure, so a first run still boots the shell -- it just boots it without the equity half of
+    the chip, which is the honest thing for a deployment that has never run.
 
-    Still reads NO database -- it answers on a machine with nothing set up, which is why its
-    route is `needs_database=False`. The deployment half arrives as this process's own
-    arguments (`cfg.db_path`, `cfg.config_path`) plus one read of the config FILE, which opens
-    no database and forks no subprocess, unlike the `inspect` probe the envelope has already run
-    for `engine` by the time this returns.
+    The rest of the deployment half arrives as this process's own arguments (`cfg.db_path`,
+    `cfg.config_path`) plus one read of the config FILE, which forks no subprocess, unlike the
+    `inspect` probe the envelope has already run for `engine` by the time this returns.
 
     **`_mode` degrades rather than raising, and the whole shell depends on that.** The client
     boots from this one endpoint -- worker registration, docs links, the footer build line and
@@ -183,11 +202,75 @@ def read_config(cfg: ServeConfig, _query: Query, _state: Any, _now_ts: int) -> d
         cfg.build_info,
         describe=cfg.build,
         mode=_auto_trade_mode(cfg.config_path),
+        profile=_profile_name(cfg.db_path),
+        **_session_state(cfg.db_path, now_ts),
         db_path=cfg.db_path,
         config_path=cfg.config_path,
     )
 
 
+def _profile_name(db_path: str) -> str:
+    """The deployment profile's name: the database file's stem (#704).
+
+    ADR 0002 settles what a profile IS -- "the database is already one-per-profile", which is
+    also why `equity_points` has a `mode` column and no `profile` one. So there is nothing
+    STORED to read: the profile is the file, and this names the file.
+
+    The stem and not a prettier word, because anything prettier would be inferred. `keel.db` and
+    `keel-live.db` are the operator's own names for their deployments; a mapping from those to
+    "paper"/"live" would be this console guessing which is which from a filename, on the one
+    surface built to stop paper and live being confused. The full paths stay in the mode badge's
+    tooltip, so the short name is checkable rather than trusted.
+    """
+    return Path(db_path).stem if db_path else ""
+
+
+def _session_state(db_path: str, now_ts: int) -> dict[str, Any]:
+    """`equity_state_mode` and `autonomous` -- the two deployment facts the chip and banner need.
+
+    **Both from ONE connection.** They are read together because they are shown together, and two
+    opens on the boot path of every page would be two chances to leak and two answers that could
+    describe different instants.
+
+    `autonomous` is `Profile.is_autonomous(now_ts)`, which honours the expiry the operator set --
+    so a lapsed `keel autonomy on --until` stops being claimed by the banner at the moment it
+    stops applying, rather than at the next restart. `get_profile` FAILS CLOSED (an absent row, a
+    damaged database -> not autonomous), which is the direction that makes the banner's mistake,
+    if it makes one, the one that over-promises supervision rather than under-promising it.
+
+    **This is the one database read on an endpoint whose route is `needs_database=False`, and the
+    exemption is load-bearing.** The client boots from this endpoint alone, so a database that is
+    missing (a first run) or unreadable must cost the chip its halves, never the page its boot.
+    Every failure is one answer here for the same reason `_auto_trade_mode` treats a missing file,
+    malformed YAML and a refused value alike: naming the narrow ones would leave this reader
+    deciding which failure is which, and the caller's response is the same.
+
+    **Existence is checked before connecting, and that is not a micro-optimisation.**
+    `sqlite3.connect` CREATES the file it cannot find, so connecting unconditionally would have a
+    read-only view bring a deployment into existence merely by being polled -- and every page
+    would then report a healthy empty install rather than offering to set one up.
+    `server.ensure_schema` carries the same guard and the same reasoning, found the same way.
+
+    No migration, like every other read in this package: a view must not take a schema write lock
+    on a database the agent may be mid-cycle on.
+    """
+    unknown = {"equity_state_mode": "", "autonomous": False}
+    if not db_path or not Path(db_path).exists():
+        return unknown
+    repo = None
+    try:
+        repo = open_repo(db_path)
+        return {
+            "equity_state_mode": str(repo.get_state("equity_state_mode") or ""),
+            "autonomous": bool(repo.get_profile().is_autonomous(now_ts)),
+        }
+    except Exception:  # a database that cannot answer is one that has not answered
+        return unknown
+    finally:
+        if repo is not None:
+            close_repo(repo)
+
+
 def _auto_trade_mode(config_path: str) -> str:
     """The served config's own word for `auto_trade.mode`, or `""` when it cannot be read.
 
diff --git a/keel/web/payload.py b/keel/web/payload.py
index 639b788..4016018 100644
--- a/keel/web/payload.py
+++ b/keel/web/payload.py
@@ -2570,11 +2570,82 @@ def order_rows(
 # -- config (#534) -------------------------------------------------------------------------------
 
 
+#: The banner's exact words per `auto_trade.mode` (#704).
+#:
+#: PAPER is fixed wording, and it is the sentence that stands between an operator and mistaking a
+#: simulation for their account -- so it is asserted verbatim by a test rather than left to a
+#: renderer's phrasing. CONFIRM is not a warning: it restates the configuration the operator is
+#: about to verify against the venue's own UI, which is why it names the equity state too.
+#:
+#: **Nothing here ever offers a way to go live.** Alpaca's paper banner carries an "Open Live
+#: Account" button -- radical clarity used as a growth funnel wrapped around real money. Going
+#: live in keel is a config edit plus a typed terminal ceremony with a runbook; this surface may
+#: EXPLAIN that and must never funnel toward it. Pinned by a test that sweeps every mode and
+#: equity-state pairing for the vocabulary of a funnel.
+_BANNER_PAPER = "PAPER — no real money is involved"
+
+#: What the chip says where `equity_state_mode` has never been written -- a deployment that has
+#: not yet flipped modes. NOT `paper`: that would be the console inventing the safer of the two
+#: answers about which account drove the shared drawdown scalars.
+_EQUITY_STATE_UNRECORDED = "not recorded"
+
+
+def _session_banner(mode: str, equity_state_mode: str, autonomous: bool) -> str:
+    """The banner sentence for one session, or `""` for a config that could not be read.
+
+    Chosen HERE and not in the renderer (Rule 2): picking between sentences on the basis of what a
+    deployment says is a judgement, and judgements are made in Python. The renderer places this
+    string and decides nothing.
+
+    ── AUTONOMY IS THE HALF THIS BANNER SHIPPED WITHOUT, AND IT INVERTED THE CLAIM ──────────────
+
+    The first cut said "CONFIRM — every order is previewed and waits for your approval" whenever
+    the config mode was `confirm`. That is FALSE on a deployment running `keel autonomy on`, which
+    is a supported and deliberate configuration: `agent._effective_mode` returns `"autonomous"`
+    when the config is `confirm` AND `Profile.is_autonomous(now)`, and an autonomous cycle places
+    without asking anyone. So the one persistent, full-bleed statement on every page was
+    promising supervision that had been switched off -- a false safety assurance about real money,
+    on the surface built to stop exactly that kind of confusion, and worse than the growth funnel
+    this issue exists to refuse.
+
+    Autonomy and the config mode are two independent switches, and `_effective_mode`'s docstring
+    says why they are deliberately not one enum. This function states the same pairing for
+    display; `agent._effective_mode` remains the authority for execution, and
+    `test_the_banner_and_the_engine_agree_about_who_is_asked` sweeps both over the same inputs so
+    the two statements of one rule cannot drift apart.
+
+    An unknown mode gets NO banner, the same refusal `modeBadge` already makes for the badge
+    itself: an absent answer is not `paper`, and a banner is a claim about whether real money is
+    involved with no safe default.
+    """
+    if mode == "paper":
+        return _BANNER_PAPER
+    if not mode:
+        return ""
+    # Both halves of the pairing, always. Mode and equity state are separately settable, and a
+    # MISMATCH between them -- `confirm` against paper equity, or the reverse -- is precisely what
+    # an operator is being asked to check against the venue UI. Printing the mode alone would drop
+    # the half that makes the check possible.
+    state = equity_state_mode or _EQUITY_STATE_UNRECORDED
+    if autonomous and mode == "confirm":
+        return (
+            f"{mode.upper()} · AUTONOMOUS — orders place without asking you; "
+            f"equity state {state}"
+        )
+    return (
+        f"{mode.upper()} — every order is previewed and waits for your approval; "
+        f"equity state {state}"
+    )
+
+
 def config_payload(
     build: Any,
     *,
     describe: str = "",
     mode: str = "",
+    profile: str = "",
+    equity_state_mode: str = "",
+    autonomous: bool = False,
     db_path: str = "",
     config_path: str = "",
 ) -> dict[str, Any]:
@@ -2621,6 +2692,25 @@ def config_payload(
         # paths that answer "where am I" for a process serving one --db/--config pair. See the
         # module note above for why these are bare strings and why mode is read-only.
         "mode": mode,
+        # The session chip (#704). `profile` is a bare string like `mode` -- it NAMES the
+        # database, which ADR 0002 says is the profile ("the database is already one-per-profile"),
+        # and there is nothing to grade about a name.
+        "profile": profile,
+        # A `label` and not bare, because unlike `mode` this one has an UNKNOWN reading that
+        # matters: `equity_state_mode` is written on the first mode flip, so a deployment that has
+        # never run has none, and "which account drove the drawdown scalars" being unanswered is a
+        # different fact from either answer. Rule 3 keeps that distinction here rather than letting
+        # a client infer it from an empty string.
+        # `""` and not `None` for the absent case, deliberately. `label(None)` is `absent()`,
+        # whose display is the em-dash -- right in a table cell, wrong here: a chip reading
+        # "keel · confirm · —" drops the very half the banner asks the operator to verify. The
+        # empty `value` still says absent to anything reading the field programmatically.
+        "equity_state": label(
+            equity_state_mode,
+            display=equity_state_mode or _EQUITY_STATE_UNRECORDED,
+            state=NEUTRAL if equity_state_mode else UNKNOWN,
+        ),
+        "banner": _session_banner(mode, equity_state_mode, autonomous),
         "db_path": db_path,
         "config_path": config_path,
         # keel's central honesty signal, and the one judgement this payload carries: `False` means
diff --git a/keel/web/static/css/keel.css b/keel/web/static/css/keel.css
index 8b36427..71efd29 100644
--- a/keel/web/static/css/keel.css
+++ b/keel/web/static/css/keel.css
@@ -256,6 +256,69 @@ header .mode-paper { color: var(--muted); }
 header .mode-confirm,
 header .mode-live { color: var(--accent); border-color: var(--accent); }
 
+/* THE SESSION CHIP (#704): profile · mode · equity state, as one group.
+ *
+ * A group and not three loose items, because the three are one answer: "which deployment is this
+ * browser looking at, and which account drove the numbers on it". `inline-flex` so the badge in
+ * the middle keeps its own pill shape while the two text halves sit level with it.
+ *
+ * Both halves are muted. The mode badge carries the emphasis for all three -- it is the fact that
+ * decides whether orders can be placed -- and giving a profile name the same weight would make
+ * the header compete with itself. */
+header #session-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  align-self: center;
+}
+header .sessionpart {
+  color: var(--muted);
+  font-size: 0.85em;
+  /* A long profile name is an operator's own filename and can be any length. Bounded here so a
+   * `keel-paper-hourly-experiment.db` cannot push the theme toggle off the header. */
+  max-width: 12ch;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* THE SEPARATORS. Generated rather than written into the markup, because each one belongs to the
+ * part beside it: `display: none` takes a hidden part's pseudo-element with it, so a name that
+ * never arrived cannot leave a lone middot behind. That is the pairing the `:empty` rule below
+ * exists to make -- the first cut of this file described these separators in three comments and
+ * shipped none, and the chip read "keel paper not recorded".
+ *
+ * `aria-hidden` is not available to a pseudo-element, so these are punctuation a screen reader
+ * may or may not announce -- which is why they are middots and not words: an announced "middot"
+ * is noise, an announced "or" would be a claim. */
+header #session-profile:not(:empty)::after { content: "\00B7"; margin-left: 0.4rem; }
+header #session-equity:not(:empty)::before { content: "\00B7"; margin-right: 0.4rem; }
+/* Hidden while empty, the same pairing the badge above uses and for the same reason: a lone
+ * separator beside a name that never arrived is a stray mark. */
+header .sessionpart:empty { display: none; }
+
+/* THE MODE BANNER (#704).
+ *
+ * Full-bleed and calm. It is a statement, not an alert: no `--bad`, no `--warn`, no icon, and
+ * nothing inside it that can be clicked. `MODE_CLASS` supplies the same emphasis the badge uses,
+ * so the banner and the badge cannot disagree about which mode is the quiet one -- paper reads
+ * muted on a muted ground, confirm carries the accent.
+ *
+ * Hidden while empty: an unreadable config costs the banner, because a banner is a claim about
+ * whether real money is involved and there is no safe default for that claim. */
+.modebanner {
+  margin: 0;
+  padding: 0.45rem 1rem;
+  border-bottom: 1px solid var(--line);
+  background: var(--surface);
+  font-size: 0.85rem;
+  letter-spacing: 0.01em;
+  text-align: center;
+}
+.modebanner:empty { display: none; }
+.modebanner.mode-paper { color: var(--muted); }
+.modebanner.mode-confirm,
+.modebanner.mode-live { color: var(--accent); }
+
 /* The toggle. It deliberately does NOT inherit the filled `button` rule: that one is for an
  * action that changes something on the server, and a filled teal disc beside the nav would be
  * the loudest thing in the header. `--control-line` for the border, not `--line`, for the
diff --git a/keel/web/static/index.html b/keel/web/static/index.html
index 4d0ca4c..90074c8 100644
--- a/keel/web/static/index.html
+++ b/keel/web/static/index.html
@@ -72,7 +72,14 @@
 </head>
 <body>
 
-<a class="skip" href="#view">Skip to content</a>
+<!--
+  The skip link targets `#session`, not `#view`. `#session` opens above the mode banner (#704),
+  so a keyboard user taking skip-to-content meets the one persistent statement about whether real
+  money is involved rather than landing past it -- skipping the NAV is what this link is for, and
+  the banner is not nav. `tabindex="-1"` on the target because a `div` is not focusable
+  otherwise, the same reason `#view` carries one.
+-->
+<a class="skip" href="#session">Skip to content</a>
 
 <header>
   <!--
@@ -164,7 +171,27 @@
     should cost the badge rather than guess a mode.
   -->
 <span class="right">
-    <span id="mode-badge" class="pill mode"></span>
+    <!--
+      THE SESSION CHIP (#704): profile · mode · equity state, on every view.
+
+      Three facts that together answer "which deployment is this browser looking at, and which
+      account drove the numbers on it". The mode badge above keeps its own node and its own
+      tooltip; this markup only puts a name in front of it and an equity state after it, so each
+      fact stays owned by the one function that knows it.
+
+      DISPLAY AND NAVIGATION ONLY. There is no control in here and no route behind one:
+      switching profile or mode is a config-file edit plus a typed terminal ceremony, and the
+      runbook documents it. A retail console would make this a dropdown; that dropdown is the
+      thing being refused, not the thing being copied.
+
+      Both halves empty in the markup and hidden while empty (`:empty` in `keel.css`), like
+      `#mode-badge` and `#build`: a deployment with no readable name is not one called "unknown".
+    -->
+    <span id="session-chip">
+      <span id="session-profile" class="sessionpart"></span>
+      <span id="mode-badge" class="pill mode"></span>
+      <span id="session-equity" class="sessionpart"></span>
+    </span>
   
     <!--
       THE THEME TOGGLE (#597): two states, and the stylesheet is the state machine.
@@ -204,6 +231,35 @@
   </span>
 </header>
 
+<!--
+  THE MODE BANNER (#704): a calm, permanent statement of what this session is.
+
+  Outside `#view`, so it survives every navigation rather than being repainted per screen -- the
+  point of a persistent banner is that it is never the thing that scrolled away.
+
+  ZERO BUTTONS, ZERO LINKS, and that is the whole design decision. A retail console puts an
+  "Open Live Account" button on its paper banner: radical clarity used as a growth funnel wrapped
+  around real money. Going live in keel is a config edit plus a typed terminal ceremony with a
+  runbook, and this surface may explain that and must never funnel toward it. A test sweeps every
+  mode and equity-state pairing for the vocabulary of a funnel, so the refusal cannot be undone
+  quietly.
+
+  The SENTENCE is written by `payload._session_banner` and placed here unread. Empty in the
+  markup and hidden while empty: an unreadable config costs the banner, because a banner is a
+  claim about whether real money is involved and there is no safe default for that claim.
+
+  No `aria-live`: it changes once, at boot, and this page keeps exactly one live region.
+-->
+<div id="session" tabindex="-1">
+
+<p id="mode-banner" class="modebanner"></p>
+
+<!--
+  `#view` is where `main.js` paints, and `#content` is what the skip link targets (see the note
+  beside it): a keyboard user taking skip-to-content lands ABOVE the mode banner rather than past
+  it, so the one persistent statement about whether real money is involved is not the thing that
+  skipping the nav skips.
+-->
 <main id="view" tabindex="-1">
 
   <noscript>
@@ -248,6 +304,8 @@ <h1>This page needs JavaScript</h1>
 
 </main>
 
+</div><!-- #session -->
+
 <footer>
   <span>keel &middot; served from this machine only</span>
   <!--
diff --git a/keel/web/static/js/main.js b/keel/web/static/js/main.js
index 2a18ac1..afcd537 100644
--- a/keel/web/static/js/main.js
+++ b/keel/web/static/js/main.js
@@ -44,6 +44,8 @@ import {
   gatesView,
   insightsView,
   modeBadge,
+  paperBanner,
+  sessionChip,
   ordersView,
   balancesView,
   timelineView,
@@ -147,6 +149,13 @@ const docsNode = /** @type {HTMLAnchorElement} */ (must("docs-link"));
 const updateNode = must("update");
 /** The header's mode badge (#597). Filled once, from the boot config read. */
 const modeNode = must("mode-badge");
+/** The session chip's profile half (#704) -- the database's own name, filled from the boot read. */
+const sessionProfileNode = must("session-profile");
+/** The session chip's equity-state half (#704). Genuinely absent on a deployment that has never
+ * flipped modes, which is why it is a `Field` and not a bare word. */
+const sessionEquityNode = must("session-equity");
+/** The persistent mode banner (#704). No buttons live in here, by design and by test. */
+const modeBannerNode = must("mode-banner");
 /** The header's theme toggle (#597). Clicked, it flips and stores the choice `theme.js` restores. */
 const themeNode = /** @type {HTMLButtonElement} */ (must("theme-toggle"));
 
@@ -1519,6 +1528,11 @@ void read("config").then((reading) => {
   docsNode.href = indexUrl();
   buildLine(buildNode, config);
   modeBadge(modeNode, config);
+  // #704, hydrated from the SAME boot read for the same reason the badge is: the deployment this
+  // process serves cannot change without a restart, and filling the chip here is what puts it on
+  // every view rather than only where a status report happens to load.
+  sessionChip(sessionProfileNode, sessionEquityNode, config);
+  paperBanner(modeBannerNode, config);
   registerWorker(config);
   show(booted, false);
 });
diff --git a/keel/web/static/js/render.js b/keel/web/static/js/render.js
index 7b5fd29..8c7e0af 100644
--- a/keel/web/static/js/render.js
+++ b/keel/web/static/js/render.js
@@ -2976,6 +2976,79 @@ export function modeBadge(node, config) {
   node.title = (config.db_path || "").concat(" · config ", config.config_path || "");
 }
 
+/**
+ * The session chip's two halves, from `/api/config` (#704).
+ *
+ * **The spine, without what usually rides on it.** Making paper-vs-live visible on every page
+ * rather than buried in settings is the one organizing idea worth taking from a retail broker
+ * console. What their version attaches -- an "Open Live Account" button on the paper banner --
+ * is a growth funnel wrapped around real money, and is refused here and in `paperBanner` below.
+ *
+ * **Display and navigation only. It never mutates.** Switching profile or mode is a config-file
+ * edit plus a typed terminal ceremony with a runbook; there is no control here, no route behind
+ * one, and no capability added. The chip surrounds the existing `modeBadge` node rather than
+ * replacing it, so the badge keeps owning the mode word and its db/config tooltip -- three facts
+ * reading `profile · mode · equity state`, each written by the one function that knows it.
+ *
+ * The two halves are filled separately because they are separately absent: a profile is always
+ * knowable (it is the database's filename), while the equity state can be genuinely unrecorded
+ * on a deployment that has never flipped modes. `equity_state` is a `Field` carrying that
+ * distinction as a state, so `field()` places the unknown reading without this function deciding
+ * anything about it.
+ *
+ * @param {HTMLElement} profileNode
+ * @param {HTMLElement} equityNode
+ * @param {any} config  `/api/config`'s `data`, or `null`.
+ */
+export function sessionChip(profileNode, equityNode, config) {
+  const profile = config && typeof config.profile === "string" ? config.profile : "";
+  if (profile) {
+    profileNode.replaceChildren(document.createTextNode(profile));
+  } else {
+    // Empty rather than a placeholder, and `keel.css` hides it while empty -- the same rule the
+    // mode badge follows. A deployment with no name is not a deployment called "unknown".
+    profileNode.replaceChildren();
+  }
+  if (config && config.equity_state) {
+    equityNode.replaceChildren(field(config.equity_state));
+  } else {
+    equityNode.replaceChildren();
+  }
+}
+
+/**
+ * The persistent mode banner (#704).
+ *
+ * **Zero buttons, zero links, forever.** In paper it states that no real money is involved; in
+ * confirm it restates the mode/equity-state pairing the operator is about to verify against the
+ * venue's own UI. It never offers a way to go live, because going live is a ceremony with a
+ * runbook that this console may explain and must never funnel toward.
+ *
+ * The SENTENCE comes from the payload (`payload._session_banner`) and is placed here unread:
+ * choosing between two sentences on the basis of what a config says is a judgement, and Rule 2
+ * keeps judgements in Python. This function decides only the emphasis, from the same
+ * `MODE_CLASS` table the badge uses -- so the banner and the badge cannot disagree about which
+ * mode is the quiet one.
+ *
+ * An empty banner means the config could not be read, and the node empties: an absent answer is
+ * not `paper`, and a banner is a claim about whether real money is involved, which has no safe
+ * default.
+ *
+ * @param {HTMLElement} node
+ * @param {any} config  `/api/config`'s `data`, or `null`.
+ */
+export function paperBanner(node, config) {
+  const text = config && typeof config.banner === "string" ? config.banner : "";
+  const mode = config && typeof config.mode === "string" ? config.mode : "";
+  if (!text) {
+    node.className = "modebanner";
+    node.replaceChildren();
+    return;
+  }
+  node.className = "modebanner ".concat(MODE_CLASS[mode] || "");
+  node.replaceChildren(document.createTextNode(text));
+}
+
 /**
  * The footer's build line, from `/api/config`.
  *
diff --git a/tests/web/test_api.py b/tests/web/test_api.py
index de075f4..b0fa4c0 100644
--- a/tests/web/test_api.py
+++ b/tests/web/test_api.py
@@ -1105,3 +1105,162 @@ def _is_format_call(node: ast.AST) -> bool:
         and isinstance(node.func, ast.Name)
         and node.func.id == "format"
     )
+
+
+def _serve_config(db_path: str, config_path: str):
+    """A `ServeConfig` with only the two fields `read_config` reads from the deployment."""
+    from keel.web.server import ServeConfig
+
+    return ServeConfig(
+        host="127.0.0.1", port=0, token="t", db_path=db_path, config_path=config_path
+    )
+
+
+# -- the session chip's database read (#704) -----------------------------------------------------
+#
+# `/api/config` is `needs_database=False` because the client boots from it alone. #704 gave it one
+# optional read; these pin that the exemption survived.
+
+
+def test_config_answers_with_no_database_at_all(tmp_path: Path) -> None:
+    """A first run. The shell must still boot -- without the equity half of the chip, which is the
+    honest answer for a deployment that has never run."""
+    from keel.web.api import read_config
+
+    missing = tmp_path / "nothing" / "keel.db"
+    cfg = _serve_config(str(missing), str(tmp_path / "nope.yaml"))
+    body = read_config(cfg, {}, None, 0)
+
+    assert body["profile"] == "keel"
+    assert body["equity_state"]["value"] == ""
+    assert body["banner"] == ""
+
+
+def test_reading_the_config_never_brings_a_database_into_existence(tmp_path: Path) -> None:
+    """`sqlite3.connect` CREATES the file it cannot find, so an unguarded read would have a
+    read-only view conjure a deployment merely by being polled every 15 seconds -- and every page
+    would then report a healthy empty install rather than offering to set one up.
+    `server.ensure_schema` carries the same guard, found the same way."""
+    from keel.web.api import read_config
+
+    missing = tmp_path / "keel.db"
+    cfg = _serve_config(str(missing), str(tmp_path / "nope.yaml"))
+    read_config(cfg, {}, None, 0)
+
+    assert not missing.exists(), "polling /api/config created the deployment database"
+
+
+def test_config_reports_the_recorded_equity_state(tmp_path: Path) -> None:
+    from keel.data.db import connect, migrate
+    from keel.data.repository import Repository
+    from keel.web.api import read_config
+
+    db_path = tmp_path / "keel-live.db"
+    conn = connect(str(db_path))
+    migrate(conn)
+    Repository(conn).set_state("equity_state_mode", "live")
+    conn.close()
+
+    cfg = _serve_config(str(db_path), str(tmp_path / "nope.yaml"))
+    body = read_config(cfg, {}, None, 0)
+
+    assert body["profile"] == "keel-live"
+    assert body["equity_state"]["value"] == "live"
+
+
+def test_an_unreadable_database_costs_the_chip_not_the_boot(tmp_path: Path) -> None:
+    """Every failure is one answer here -- unknown -- for the same reason `_auto_trade_mode`
+    treats a missing file, malformed YAML and a refused value alike."""
+    from keel.web.api import read_config
+
+    db_path = tmp_path / "keel.db"
+    db_path.write_bytes(b"this is not a database, not even close")
+    cfg = _serve_config(str(db_path), str(tmp_path / "nope.yaml"))
+
+    body = read_config(cfg, {}, None, 0)
+    assert body["equity_state"]["value"] == ""
+    # `autonomous` is an INPUT to `config_payload`, not a key on the wire: the banner is the one
+    # surface that states it, and a second rendering of the same fact is a second thing to drift.
+    assert "autonomous" not in body
+    # The boot survives: the keys the shell needs before it can paint anything are all present.
+    # The first version of this line was `body["build"] == "" or isinstance(body["build"], str)`,
+    # which is true of every string and so asserted only that a str is a str.
+    for key in ("version", "build", "mode", "profile", "banner", "db_path", "config_path"):
+        assert key in body, f"an unreadable database cost /api/config its {key}"
+
+
+def test_the_banner_reads_autonomy_from_the_deployment_not_from_the_config_alone(
+    tmp_path: Path,
+) -> None:
+    """End to end through `read_config`, because the payload tests exercise `_session_banner`
+    directly and would not notice the endpoint never asking.
+
+    `keel autonomy on` is a profile row, not a config value: `agent._effective_mode` returns
+    `"autonomous"` only when the config is `confirm` AND the profile says so, and under that
+    pairing orders place unattended. A banner that read the config alone would permanently promise
+    supervision that had been switched off.
+    """
+    import time
+
+    from keel.data.db import connect, migrate
+    from keel.data.repository import Repository
+    from keel.web.api import read_config
+
+    db_path = tmp_path / "keel-live.db"
+    conn = connect(str(db_path))
+    migrate(conn)
+    repo = Repository(conn)
+    repo.set_state("equity_state_mode", "live")
+    repo.set_autonomous(True, now_ts=0)
+    conn.close()
+
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text(VALID_CONFIG_YAML + "\nauto_trade:\n  mode: confirm\n")
+    cfg = _serve_config(str(db_path), str(config_path))
+
+    body = read_config(cfg, {}, None, int(time.time()))
+    assert "AUTONOMOUS" in body["banner"], body["banner"]
+    assert "waits for your approval" not in body["banner"]
+
+
+def test_a_lapsed_autonomy_window_stops_being_claimed_by_the_banner(tmp_path: Path) -> None:
+    """`Profile.is_autonomous` honours the expiry the operator set, and the banner is read at
+    request time -- so an `--until` that has passed reverts the sentence on the next page load
+    rather than at the next restart."""
+    from keel.data.db import connect, migrate
+    from keel.data.repository import Repository
+    from keel.web.api import read_config
+
+    db_path = tmp_path / "keel-live.db"
+    conn = connect(str(db_path))
+    migrate(conn)
+    Repository(conn).set_autonomous(True, now_ts=0, expires_ts=1_000)
+    conn.close()
+
+    config_path = tmp_path / "config.yaml"
+    config_path.write_text(VALID_CONFIG_YAML + "\nauto_trade:\n  mode: confirm\n")
+    cfg = _serve_config(str(db_path), str(config_path))
+
+    assert "AUTONOMOUS" in read_config(cfg, {}, None, 999)["banner"]
+    assert "AUTONOMOUS" not in read_config(cfg, {}, None, 1_000)["banner"]
+
+
+def test_close_repo_actually_closes_the_connection(tmp_path: Path) -> None:
+    """It reached for `repo.conn`; `Repository` stores `_conn` and exposes no `conn`, so the
+    `getattr` returned `None` and the function was a no-op -- every reader in this package ran it
+    in a `finally` that closed nothing, and the `finally` READ as the cleanup so nothing looked
+    missing."""
+    import sqlite3
+
+    from keel.data.db import connect, migrate
+    from keel.data.repository import Repository
+    from keel.web.api import close_repo
+
+    db_path = tmp_path / "keel.db"
+    conn = connect(str(db_path))
+    migrate(conn)
+    repo = Repository(conn)
+
+    close_repo(repo)
+    with pytest.raises(sqlite3.ProgrammingError):
+        conn.execute("SELECT 1")
diff --git a/tests/web/test_client_assets.py b/tests/web/test_client_assets.py
index a9588ca..f45e5dc 100644
--- a/tests/web/test_client_assets.py
+++ b/tests/web/test_client_assets.py
@@ -789,7 +789,12 @@ def test_the_shell_carries_its_accessibility_affordances() -> None:
     # And ONLY one: a live region around the data would re-announce every table twice a minute.
     assert html.count("aria-live") == 1, "exactly one live region -- see index.html's note"
 
-    assert '<a class="skip" href="#view">' in html, "keyboard users need a way past the nav"
+    # The TARGET moved in #704 (`#view` -> `#session`, the wrapper that opens above the mode
+    # banner) because skipping the nav must not also skip the statement about whether real money
+    # is involved. What this line pins is that the affordance EXISTS; which element it lands on,
+    # and that the element can take focus, are pinned by
+    # `test_skipping_the_nav_does_not_skip_the_mode_banner` and its sibling below.
+    assert '<a class="skip" href="#' in html, "keyboard users need a way past the nav"
     assert '<main id="view" tabindex="-1">' in html, (
         "main must be focusable-by-script so a route change can move focus to it"
     )
@@ -921,6 +926,13 @@ def test_the_theme_choice_is_spelled_where_it_is_stored() -> None:
 _CONFIG_READERS: tuple[tuple[str, str], ...] = (
     ("buildLine", "data"),
     ("modeBadge", "config"),
+    # #704's two, registered WITH them rather than after a review found them missing. The rule
+    # this table states is "a new consumer arrives with the check that covers it", and the first
+    # cut of #704 added two consumers and left this tuple alone -- so renaming `config.profile`
+    # on the client would have passed the whole suite while the chip's profile half rendered
+    # empty forever, which is precisely the failure named below.
+    ("sessionChip", "config"),
+    ("paperBanner", "config"),
 )
 
 
@@ -1236,7 +1248,15 @@ def _view_keys(view: str, root: str) -> list[str]:
     # The negative lookahead drops METHOD calls: `data.data_freshness.map(` must contribute
     # `data_freshness`, not `data_freshness.map`. Backtracking does that -- the two-segment
     # alternative fails the lookahead on `(` and the one-segment one succeeds on `.`.
-    found = re.findall(rf"\b{root}\.([a-z_]+(?:\.[a-z_0-9]+)?)\b(?!\s*\()", source[start:end])
+    # `[a-zA-Z_]`, not `[a-z_]`. Payload keys are snake_case by convention, so the lowercase
+    # class looked sufficient -- and it silently made the scan blind to exactly the rename it
+    # exists to catch. `config.profileName` matched as `config.profile`, a key the endpoint DOES
+    # send, so renaming a client read to camelCase passed this check while the element rendered
+    # empty forever. Found by mutating #704's `sessionChip`; the class now covers any identifier
+    # JavaScript allows, and a key the payload does not send fails whatever its casing.
+    found = re.findall(
+        rf"\b{root}\.([a-zA-Z_]+(?:\.[a-zA-Z_0-9]+)?)\b(?!\s*\()", source[start:end]
+    )
     # Neither `.length` nor `.display` is a payload key: the first is a list length in JavaScript,
     # the second is half of a `Field` whose presence is already checked one level up. Two names
     # rather than a general rule, because a THIRD non-payload member appearing here should be
@@ -1870,3 +1890,195 @@ def test_every_mapped_collection_is_either_checked_or_named() -> None:
     # has outlived its subject, and would quietly excuse a future collection of the same name.
     stale = set(_ROW_ENDPOINTS_UNCOVERED) - mapped
     assert not stale, f"exemptions for collections nothing maps: {sorted(stale)}"
+
+
+# -- the session chip and the mode banner (#704) -------------------------------------------------
+#
+# The refusal this issue is built around is a NEGATIVE: no way to go live sits on either surface.
+# A negative is exactly what rots silently, so it is pinned structurally -- against the parsed
+# function bodies and the parsed markup, not against a substring that a rename would slip past.
+
+
+def _comments_stripped(source: str) -> str:
+    """`source` with comments removed and STRING LITERALS KEPT.
+
+    Deliberately not `_code_only`, and the difference is the whole test below. `_code_only` also
+    collapses every string, which is right for the scans looking for arithmetic and wrong here:
+    the thing being forbidden is `el("button", ...)`, and `button` is a string literal. Scanning
+    the stripped form for it finds nothing, always -- a test that passes against the very mutation
+    it exists to catch. (Confirmed: adding a "Go live" button to `paperBanner` survived the first
+    version of this test.)
+
+    Comments still go, because a docstring is not what a function does -- `paperBanner`'s explains
+    at length what it refuses to build, using the exact words this scan looks for.
+    """
+    out: list[str] = []
+    i, n = 0, len(source)
+    while i < n:
+        if source.startswith("//", i):
+            while i < n and source[i] != "\n":
+                i += 1
+            continue
+        if source.startswith("/*", i):
+            end = source.find("*/", i + 2)
+            i = n if end == -1 else end + 2
+            continue
+        # Strings are stepped THROUGH rather than skipped, so a `//` inside one is not mistaken
+        # for a comment and does not eat the rest of the line.
+        if source[i] in "'\"":
+            quote = source[i]
+            out.append(source[i])
+            i += 1
+            while i < n:
+                if source[i] == "\\":
+                    out.append(source[i : i + 2])
+                    i += 2
+                    continue
+                out.append(source[i])
+                if source[i] == quote:
+                    i += 1
+                    break
+                i += 1
+            continue
+        out.append(source[i])
+        i += 1
+    return "".join(out)
+
+
+def _function_body(source: str, name: str) -> str:
+    """One exported function's body, comments stripped and string literals kept."""
+    code = _comments_stripped(source)
+    start = code.index("export function " + name + "(")
+    rest = code[start + 1 :]
+    end = rest.find("\nexport function ")
+    return rest if end == -1 else rest[:end]
+
+
+def test_the_clickable_scan_can_actually_see_a_string_literal() -> None:
+    """The scan's own smoke test, because the first version of it could not.
+
+    A source-text check that strips the very tokens it searches for passes against every input,
+    including the mutation it was written to catch. This asserts the lexer keeps what the test
+    below depends on before that test is allowed to mean anything.
+    """
+    kept = _comments_stripped('const go = el("button", undefined, "Go live"); // el("form")')
+    assert '"button"' in kept
+    assert "form" not in kept, "comments must still be stripped"
+
+
+def test_neither_the_chip_nor_the_banner_builds_anything_clickable() -> None:
+    """Display and navigation only, by construction rather than by intent.
+
+    A retail console makes the chip a dropdown and hangs an "Open Live Account" button off the
+    paper banner. Switching profile or mode in keel is a config-file edit plus a typed terminal
+    ceremony, and going live is a runbook -- this console may explain both and may not offer
+    either. So neither function may create an interactive node or bind a handler.
+    """
+    source = _source("render.js")
+    for name in ("sessionChip", "paperBanner"):
+        body = _function_body(source, name)
+        for forbidden in ("button", "addEventListener", "onclick", '"a"', "href", "form", "input"):
+            assert forbidden not in body, f"{name} builds something interactive: {forbidden}"
+
+
+def test_the_banner_sentence_is_placed_and_never_written_here() -> None:
+    """Rule 2. Choosing between two sentences on the basis of what a config says is a judgement,
+    and judgements are made in Python -- so the words must arrive on the payload. A renderer that
+    composed the sentence could drift from the one the tests assert verbatim."""
+    body = _function_body(_source("render.js"), "paperBanner")
+    assert "config.banner" in body
+    assert "PAPER" not in body, "the banner's words belong to payload._session_banner"
+
+
+def test_the_chip_and_the_banner_live_outside_the_view_so_they_survive_navigation() -> None:
+    """"Present on all views" is a property of WHERE they are, not of every view remembering to
+    draw them. `#view` is replaced wholesale on each navigation; these sit outside it."""
+    html = _INDEX.read_text(encoding="utf-8")
+    view_at = html.index('id="view"')
+    for element in ('id="session-chip"', 'id="mode-banner"'):
+        assert element in html, f"{element} is missing from the shell"
+        assert html.index(element) < view_at, f"{element} is inside #view and would be repainted"
+
+
+def test_the_banner_element_ships_empty_and_carries_no_children() -> None:
+    """Empty in the markup, like `#build` and `#mode-badge`: an unreadable config costs the
+    banner rather than showing a guessed one. And nothing is smuggled in as static markup -- the
+    node's whole content comes from the payload or it has none."""
+    html = _markup_only(_INDEX.read_text(encoding="utf-8"))
+    assert '<p id="mode-banner" class="modebanner"></p>' in html
+
+
+def test_every_id_main_js_demands_exists_in_the_shell() -> None:
+    """`must()` throws on a missing id, which is the right behaviour and a terrible way to find
+    out: the two files ship together, so a missing id is a bug in the commit that made it."""
+    import re
+
+    html = _INDEX.read_text(encoding="utf-8")
+    # The RAW source, not `_code_only`: the ids being looked for ARE string literals, which is
+    # exactly what that lexer strips. Over-matching an id mentioned in a comment would fail this
+    # test rather than pass it silently, so the raw scan errs in the safe direction.
+    demanded = set(re.findall(r'must\("([a-z0-9-]+)"\)', _source("main.js")))
+    assert demanded, "the scan found no must() calls -- it would pass against any shell"
+    for element_id in sorted(demanded):
+        assert f'id="{element_id}"' in html, f"main.js demands #{element_id}; index.html has none"
+
+
+def test_the_shell_actually_calls_the_chip_and_the_banner() -> None:
+    """A renderer nothing invokes is a renderer that ships doing nothing.
+
+    Every other pin on these two functions asks what they WOULD draw. None asked whether anything
+    draws them -- so deleting both call sites in `main.js` left the whole suite green while the
+    header lost its chip and the banner never appeared. The parity scan above cannot catch that
+    either: an uncalled function still reads the keys it reads.
+    """
+    source = _comments_stripped(_source("main.js"))
+    for name in ("sessionChip", "paperBanner"):
+        assert name + "(" in source, f"main.js never calls {name}"
+
+
+def test_the_chip_and_the_banner_hydrate_from_the_boot_read() -> None:
+    """From the SAME `/api/config` read the badge and the docs links use, which is what puts them
+    on every view rather than only where a status report happens to load. A second read would be a
+    second round trip on the boot path and a second answer that could describe another instant."""
+    source = _comments_stripped(_source("main.js"))
+    boot = source[source.index('read("config")') :]
+    for name in ("modeBadge", "sessionChip", "paperBanner"):
+        assert name + "(" in boot, f"{name} is not hydrated from the boot config read"
+
+
+def test_skipping_the_nav_does_not_skip_the_mode_banner() -> None:
+    """Skip-to-content exists to skip the NAV. The banner is not nav, and it is the one persistent
+    statement about whether real money is involved -- so the link's target opens above it rather
+    than past it. It targeted `#view`, which sits below the banner."""
+    html = _INDEX.read_text(encoding="utf-8")
+    target = re.search(r'<a class="skip" href="#([a-z0-9-]+)"', html)
+    assert target is not None, "the shell has no skip link"
+    anchor = f'id="{target.group(1)}"'
+    assert anchor in html, f"the skip link points at {target.group(1)}, which the shell lacks"
+    assert html.index(anchor) < html.index('id="mode-banner"'), (
+        "skip-to-content lands below the mode banner"
+    )
+
+
+def test_the_skip_target_can_actually_take_focus() -> None:
+    """A `div` is not focusable without it, so the link would move the viewport and leave the
+    keyboard where it was. `#view` carries one for the same reason."""
+    html = _INDEX.read_text(encoding="utf-8")
+    target = re.search(r'<a class="skip" href="#([a-z0-9-]+)"', html)
+    assert target is not None
+    element = re.search(rf"<[a-z]+ id=\"{target.group(1)}\"[^>]*>", html)
+    assert element is not None
+    assert 'tabindex="-1"' in element.group(0)
+
+
+def test_the_chip_separators_the_comments_describe_actually_ship() -> None:
+    """Three comments and an issue describe `profile · mode · equity state`. The first cut shipped
+    no separator anywhere and the chip read "keel paper not recorded" -- and the CSS `:empty` rule
+    reasoned at length about "a lone separator beside a name that never arrived", a separator that
+    did not exist.
+
+    Generated on the parts, so a hidden part takes its own separator with it.
+    """
+    css = (_STATIC / "css" / "keel.css").read_text(encoding="utf-8")
+    for selector in ("#session-profile:not(:empty)::after", "#session-equity:not(:empty)::before"):
+        assert selector in css, f"no separator rule for {selector}"
diff --git a/tests/web/test_payload.py b/tests/web/test_payload.py
index 8f9cef0..7592fa8 100644
--- a/tests/web/test_payload.py
+++ b/tests/web/test_payload.py
@@ -1646,3 +1646,179 @@ def test_a_verified_chain_over_recorded_events_is_the_only_green() -> None:
     broken = payload.timeline_payload(_timeline_report(chain_errors=("row 3: broken",)))
     assert broken["chain"]["state"] == "bad"
     assert broken["chain_errors"] == ["row 3: broken"]
+
+
+# -- session identity (#704) --------------------------------------------------------------------
+#
+# Alpaca's one genuinely good organizing idea: paper-vs-live is visible on every page rather than
+# buried in settings. Take the spine, refuse what rides on it -- their paper banner carries an
+# "Open Live Account" CTA, which is a growth funnel wrapped around real money.
+
+
+def _config(**overrides: object) -> dict[str, object]:
+    fields: dict[str, object] = {
+        "describe": "",
+        "mode": "paper",
+        "profile": "keel",
+        "equity_state_mode": "paper",
+        "autonomous": False,
+        "db_path": "/x/keel.db",
+        "config_path": "/x/config.yaml",
+    }
+    fields.update(overrides)
+    return payload.config_payload(None, **fields)  # type: ignore[arg-type]
+
+
+def test_the_chip_carries_the_profile_and_both_modes() -> None:
+    """The three facts that answer "which deployment is this browser looking at", on the one
+    endpoint every view reads."""
+    body = _config()
+    assert body["profile"] == "keel"
+    assert body["mode"] == "paper"
+    assert body["equity_state"]["value"] == "paper"
+
+
+def test_an_unrecorded_equity_state_is_unknown_not_paper() -> None:
+    """`equity_state_mode` is set on the first mode flip, so a deployment that has never run has
+    none. Rendering that as `paper` would be the console inventing the safer of the two answers
+    about which account drove the drawdown scalars."""
+    body = _config(equity_state_mode="")
+    assert body["equity_state"] == {
+        "value": "",
+        "display": "not recorded",
+        "state": "unknown",
+    }, "an em-dash here drops the half the banner asks the operator to verify"
+
+
+def test_paper_mode_gets_the_exact_banner_sentence() -> None:
+    """Fixed wording, asserted verbatim. This is the sentence that stands between an operator and
+    mistaking a simulation for their account."""
+    assert _config(mode="paper")["banner"] == "PAPER — no real money is involved"
+
+
+def test_confirm_mode_states_the_pairing_it_is_about_to_be_verified_against() -> None:
+    """Not a warning -- the configuration the operator is about to check against the venue's own
+    UI. Both halves, because the mode and the equity state are separately settable and a mismatch
+    between them is exactly what this banner exists to make visible."""
+    banner = _config(mode="confirm", equity_state_mode="live")["banner"]
+    assert "CONFIRM" in banner
+    assert "live" in banner
+
+
+def test_a_confirm_banner_says_so_when_the_equity_state_is_unrecorded() -> None:
+    """The pairing has two halves and one of them can be missing. Printing the mode alone would
+    quietly drop the half the operator is being asked to verify."""
+    banner = _config(mode="confirm", equity_state_mode="")["banner"]
+    assert "CONFIRM" in banner
+    assert "not recorded" in banner
+
+
+def test_an_unreadable_config_gets_no_banner_at_all() -> None:
+    """The same refusal `modeBadge` already makes: an absent answer is not `paper`, and guessing
+    a mode on a trading console is the one thing this surface must never do."""
+    assert _config(mode="")["banner"] == ""
+
+
+def test_an_autonomous_session_never_claims_orders_wait_for_you() -> None:
+    """The finding that made this banner dangerous rather than merely incomplete.
+
+    `keel autonomy on` is a supported, deliberate configuration, and under it orders place
+    unattended. A permanent full-bleed statement saying they wait for the operator's approval is
+    a false safety assurance about real money -- on the surface built to stop exactly that
+    confusion, and worse than the growth funnel this issue refuses.
+    """
+    banner = _config(mode="confirm", equity_state_mode="live", autonomous=True)["banner"]
+    assert "AUTONOMOUS" in banner
+    assert "waits for your approval" not in banner
+    assert "without asking" in banner
+
+
+def test_the_banner_and_the_engine_agree_about_who_is_asked() -> None:
+    """Two statements of ONE rule, pinned together rather than hoped about.
+
+    `agent._effective_mode` is the authority for EXECUTION -- `"autonomous"` only when the config
+    is `confirm` and the profile says so. This banner states the same pairing for DISPLAY. They
+    live in different modules for good reasons (Rule 2 keeps the sentence in the payload), which
+    is exactly the shape that drifts, so the sweep covers every reachable combination.
+    """
+    from keel.web.payload import _session_banner
+
+    for mode in ("paper", "confirm"):
+        for autonomous in (False, True):
+            # `_effective_mode`'s rule, restated as the predicate rather than re-derived: an
+            # autonomous cycle happens only when BOTH switches are thrown.
+            engine_asks = not (mode == "confirm" and autonomous)
+            banner = _session_banner(mode, "live", autonomous)
+            if mode == "paper":
+                continue  # paper reaches no executor mode at all; its banner says so instead
+            claims_you_are_asked = "waits for your approval" in banner
+            assert claims_you_are_asked == engine_asks, (
+                f"mode={mode} autonomous={autonomous}: banner says "
+                f"{'asked' if claims_you_are_asked else 'not asked'}, engine says "
+                f"{'asked' if engine_asks else 'not asked'}"
+            )
+
+
+def test_the_engines_own_rule_still_matches_the_predicate_this_pins_against() -> None:
+    """The sweep above restates `_effective_mode`'s rule as a predicate, so it is only worth
+    anything while that restatement is true. Driven through the REAL function."""
+    from keel.agent import _effective_mode
+
+    class _Cfg:
+        class auto_trade:  # noqa: N801 - mirrors the config object's attribute shape
+            mode = "confirm"
+
+    class _Profile:
+        def __init__(self, autonomous: bool) -> None:
+            self._autonomous = autonomous
+
+        def is_autonomous(self, _now: int) -> bool:
+            return self._autonomous
+
+    class _Repo:
+        def __init__(self, autonomous: bool) -> None:
+            self._autonomous = autonomous
+
+        def get_profile(self) -> _Profile:
+            return _Profile(self._autonomous)
+
+    assert _effective_mode(_Cfg(), _Repo(True), 0) == "autonomous"  # type: ignore[arg-type]
+    assert _effective_mode(_Cfg(), _Repo(False), 0) == "confirm"  # type: ignore[arg-type]
+
+
+def test_the_complete_set_of_banner_sentences_is_pinned() -> None:
+    """EXHAUSTIVE, and deliberately not a blocklist of funnel words.
+
+    The first version of this refusal listed forbidden phrases -- "open live", "go live",
+    "upgrade" -- and claimed a later edit could not add a call to action quietly. It could:
+    "Start real trading", "Enable live trading", "Switch to your real account" and four other
+    realistic sentences all passed it. A blocklist can only refuse the wordings someone thought
+    of.
+
+    `_session_banner` is a pure function of three values with a small finite domain, so the honest
+    pin is the whole output set. Any new sentence -- a call to action among them -- fails this
+    test and has to be added here deliberately, in a diff a reviewer reads.
+    """
+    from keel.web.payload import _session_banner
+
+    produced = {
+        _session_banner(mode, state, autonomous)
+        for mode in ("paper", "confirm", "live", "")
+        for state in ("paper", "live", "")
+        for autonomous in (False, True)
+    }
+    assert produced == {
+        "",
+        "PAPER — no real money is involved",
+        "CONFIRM — every order is previewed and waits for your approval; equity state paper",
+        "CONFIRM — every order is previewed and waits for your approval; equity state live",
+        "CONFIRM — every order is previewed and waits for your approval; equity state not recorded",
+        "CONFIRM · AUTONOMOUS — orders place without asking you; equity state paper",
+        "CONFIRM · AUTONOMOUS — orders place without asking you; equity state live",
+        "CONFIRM · AUTONOMOUS — orders place without asking you; equity state not recorded",
+        # `live` is not a config mode today (`_VALID_AUTO_TRADE_MODES` is paper/confirm) and is
+        # carried the way `MODE_CLASS` carries it: forward-compatibly, ungraded, still rendering.
+        "LIVE — every order is previewed and waits for your approval; equity state paper",
+        "LIVE — every order is previewed and waits for your approval; equity state live",
+        "LIVE — every order is previewed and waits for your approval; equity state not recorded",
+    }