diff --git a/docker/setup/app.js b/docker/setup/app.js
index ea8dcfd..0dced3e 100644
--- a/docker/setup/app.js
+++ b/docker/setup/app.js
@@ -564,11 +564,10 @@
     const variant = opts.plain ? null : a.variant === 'primary' && opts.primary === false ? null : a.variant;
     return html`<button class="${btnClass(variant)}" type="button" data-cmd="${a.cmd}" data-target="${row.target}" data-id="${row.id}" data-key="act-${row.key}">${a.icon ? icon(a.icon) : ''}${a.label}</button>`;
   };
-  // A row without a menu keeps its place, so every row's one action lines up.
-  const menuSlot = () => html`<span class="tc-row-menu-slot" aria-hidden="true"></span>`;
+  // Only real controls occupy the action group; its last control uses the row inset.
   const menuButton = (row) => row.menu.length
     ? html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for ${row.name}" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-' + row.key))}" data-cmd="row.menu" data-target="${row.target}" data-id="${row.id}" data-key="menu-${row.key}">${icon('ellipsis')}</button>`
-    : menuSlot();
+    : '';
 
   /** An agent or toolchain row: tile, name and version, one status line, one verb, a menu. */
   const resourceRow = (row, opts = {}) => {
@@ -584,7 +583,7 @@
         ${noticeError ? html`<span class="tc-status" role="alert">${dot('danger')}<span class="tc-status-text">${noticeError.text}${detail('notice')}</span></span>` : noticeLine(row.notice)}
         ${row.state === 'running' ? opLine(row) : ''}
       </div>
-      <div class="${cx('tc-row-actions', opts.wrap && 'tc-row-actions--wrap')}">${actionButton(row, opts)}${opts.menu === false ? menuSlot() : menuButton(row)}</div>
+      <div class="${cx('tc-row-actions', opts.wrap && 'tc-row-actions--wrap')}">${actionButton(row, opts)}${opts.menu === false ? '' : menuButton(row)}</div>
     </div>`;
   };
 
@@ -744,7 +743,7 @@
     <div class="tc-row tc-row--compact" data-key="needs-${item.key}">
       <span class="tc-tile tc-tile--icon" data-tone="${item.tone}" aria-hidden="true">${icon(item.icon)}</span>
       <div class="tc-row-main"><span class="tc-row-name">${item.name}</span><span class="tc-status"><span class="tc-status-text">${item.text}</span></span></div>
-      <div class="tc-row-actions tc-row-actions--wrap">${itemAction(item.action)}${menuSlot()}</div>
+      <div class="tc-row-actions tc-row-actions--wrap">${itemAction(item.action)}</div>
     </div>`;
   // On a phone each item's one action goes under its words, so they read whole.
   const attentionRow = (item) => (item.icon ? itemRow(item) : resourceRow(item, { plain: true, menu: false, wrap: true }));
@@ -1020,7 +1019,7 @@
           ${url ? html`<span class="tc-status tc-url-line"><span class="tc-mono tc-truncate">${url}</span>${copyButton(url, 'Copy public URL', { iconOnly: true })}${source && source !== 'set here' ? html`<span class="tc-url-source">${source === 'T3_PUBLIC_URL' ? 'from T3_PUBLIC_URL' : source}</span>` : ''}</span>`
             : html`<span class="tc-status">${dot('warn')}<span class="tc-status-text">Not set. Pairing links point at it, so they need one${here && !here.local ? html`: this page is open at ${M.hostOf(here.url)}, and T3 Code answers there too` : ''}.</span></span>`}
         </div>
-        <div class="tc-row-actions tc-row-actions--wrap">${action}${!url && here && !here.local ? html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for the public URL" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-url'))}" data-cmd="url.menu" data-key="menu-url">${icon('ellipsis')}</button>` : menuSlot()}</div>
+        <div class="tc-row-actions tc-row-actions--wrap">${action}${!url && here && !here.local ? html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for the public URL" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-url'))}" data-cmd="url.menu" data-key="menu-url">${icon('ellipsis')}</button>` : ''}</div>
       </div>
       ${connectRow(s)}
     </div></div>`;
@@ -1069,7 +1068,7 @@
     return html`<div class="tc-row tc-row--compact" data-key="connect">
       <span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('globe')}</span>
       <div class="tc-row-main"><div class="tc-row-title"><span class="tc-row-name">T3 Connect</span>${badge(view.badge)}</div><span class="tc-status tc-status--prose">${view.text}</span></div>
-      <div class="tc-row-actions tc-row-actions--wrap">${view.action ? html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="${view.action.cmd}">${view.action.icon ? icon(view.action.icon) : ''}${view.action.label}</button>` : ''}${menu.length ? html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for T3 Connect" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-connect'))}" data-cmd="connect.menu" data-key="menu-connect">${icon('ellipsis')}</button>` : menuSlot()}</div>
+      <div class="tc-row-actions tc-row-actions--wrap">${view.action ? html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="${view.action.cmd}">${view.action.icon ? icon(view.action.icon) : ''}${view.action.label}</button>` : ''}${menu.length ? html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for T3 Connect" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-connect'))}" data-cmd="connect.menu" data-key="menu-connect">${icon('ellipsis')}</button>` : ''}</div>
     </div>`;
   };
 
@@ -1243,16 +1242,16 @@
     } else if (p.state === 'starting') {
       title = html`${title}<span class="tc-badge tc-badge--info"><span class="tc-spinner" aria-hidden="true"></span>Publishing</span>`;
       status = html`<span class="tc-status"><span class="tc-status-text">${joinParts([proc, 'waiting for a public hostname…'])}</span></span>${progressBar(null)}`;
-      actions = html`<button class="tc-btn tc-btn--ghost tc-btn--sm" type="button" data-cmd="port.stop" data-id="${p.port}" data-key="stop-${p.port}">Cancel</button>${menuSlot()}`;
+      actions = html`<button class="tc-btn tc-btn--ghost tc-btn--sm" type="button" data-cmd="port.stop" data-id="${p.port}" data-key="stop-${p.port}">Cancel</button>`;
     } else if (p.state === 'failed') {
       title = html`${title}<span class="tc-badge tc-badge--danger">Failed</span>`;
       status = statusLine({ dot: 'danger', text: p.error || 'The tunnel failed' });
-      actions = html`<button class="tc-btn tc-btn--warning tc-btn--sm" type="button" data-cmd="port.publish" data-id="${p.port}" data-key="pub-${p.port}">${icon('refresh-cw')}Retry</button>${menuSlot()}`;
+      actions = html`<button class="tc-btn tc-btn--warning tc-btn--sm" type="button" data-cmd="port.publish" data-id="${p.port}" data-key="pub-${p.port}">${icon('refresh-cw')}Retry</button>`;
     } else {
       status = p.db
         ? html`<span class="tc-status">${dot('warn')}<span class="tc-status-text">${joinParts([proc, 'looks like a database, so Publish asks first'])}</span></span>`
         : html`<span class="tc-status"><span class="tc-status-text">${proc || where ? joinParts([proc, where]) : p.listening ? 'Listening in the container' : 'Not listening right now'}</span></span>`;
-      actions = html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="port.publish" data-id="${p.port}" data-key="pub-${p.port}">${p.db ? 'Publish…' : 'Publish'}</button>${menuSlot()}`;
+      actions = html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="port.publish" data-id="${p.port}" data-key="pub-${p.port}">${p.db ? 'Publish…' : 'Publish'}</button>`;
     }
     return html`
       <div class="${cx('tc-row tc-row--compact', p.expanded && 'tc-row--expanded')}" data-key="port-${p.port}">
@@ -1341,7 +1340,7 @@
         ${keyView.value
           ? html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="key.hide" data-key="key-toggle">${icon('eye-off')}Hide</button>`
           : html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="key.show" data-key="key-toggle">${icon('eye')}Show</button>`}
-        ${source === 'env' ? menuSlot() : html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for the setup key" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-key'))}" data-cmd="key.menu" data-key="menu-key">${icon('ellipsis')}</button>`}
+        ${source === 'env' ? '' : html`<button class="tc-btn tc-btn--ghost tc-btn--icon tc-btn--sm" type="button" aria-label="More for the setup key" aria-haspopup="menu" aria-expanded="${String(Kit.menuOpenFor('menu-key'))}" data-cmd="key.menu" data-key="menu-key">${icon('ellipsis')}</button>`}
       </div>
     </div>`;
   };
@@ -1437,8 +1436,8 @@
         ${s.setupKeySource ? keyRow(s.setupKeySource) : ''}
         ${viaT3(s)
           ? html`<div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('shield-check')}</span><div class="tc-row-main"><span class="tc-row-name">Signed in through T3 Code</span><span class="tc-status tc-status--prose">This browser is paired with T3 Code, which already gives it a terminal here, so the console didn’t ask for the key. Revoking it under Access ends both.</span></div></div>`
-          : html`<div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('lock')}</span><div class="tc-row-main"><span class="tc-row-name">Lock this browser</span><span class="tc-status">Ends this browser’s session here. Coming back takes the setup key.</span></div><div class="tc-row-actions tc-row-actions--wrap"><button class="tc-btn tc-btn--sm" type="button" data-cmd="lock">Lock</button>${menuSlot()}</div></div>`}
-        <div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('circle-stop')}</span><div class="tc-row-main"><span class="tc-row-name">Turn the console off</span><span class="tc-status tc-status--prose">Set <code>T3_SETUP_ENABLED=0</code> once you’re set up. Pairing then takes <code class="tc-nowrap">t3-pair</code> in a shell.</span></div><div class="tc-row-actions tc-row-actions--wrap">${copyButton('T3_SETUP_ENABLED=0', 'Copy setting', { ghost: false, size: 'tc-btn--sm' })}${menuSlot()}</div></div>
+          : html`<div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('lock')}</span><div class="tc-row-main"><span class="tc-row-name">Lock this browser</span><span class="tc-status">Ends this browser’s session here. Coming back takes the setup key.</span></div><div class="tc-row-actions tc-row-actions--wrap"><button class="tc-btn tc-btn--sm" type="button" data-cmd="lock">Lock</button></div></div>`}
+        <div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon('circle-stop')}</span><div class="tc-row-main"><span class="tc-row-name">Turn the console off</span><span class="tc-status tc-status--prose">Set <code>T3_SETUP_ENABLED=0</code> once you’re set up. Pairing then takes <code class="tc-nowrap">t3-pair</code> in a shell.</span></div><div class="tc-row-actions tc-row-actions--wrap">${copyButton('T3_SETUP_ENABLED=0', 'Copy setting', { ghost: false, size: 'tc-btn--sm' })}</div></div>
       </div></div>`)}`;
   };
 
@@ -1466,11 +1465,11 @@
           <div class="tc-row-title"><span class="tc-row-name">T3 Code</span><span class="tc-version">${view.version || 'unknown version'}${targetVersion ? html` <span class="tc-version-arrow" aria-label="to">→</span> ${targetVersion}` : ''}</span>${busy ? html`<span class="tc-badge tc-badge--info"><span class="tc-spinner" aria-hidden="true"></span>${view.busy ? 'Updating' : 'Checking'}</span>` : ''}</div>
           <span class="tc-status">${view.available || view.busy ? '' : view.checkError ? dot('warn') : ''}<span class="tc-status-text"><span>${state}</span>${view.checkedAt && !busy ? ' · checked ' + M.relTime(view.checkedAt, now()) : ''}</span></span>
         </div>
-        <div class="tc-row-actions">${view.available || view.error ? html`<button class="tc-btn tc-btn--primary tc-btn--sm" type="button" data-cmd="t3.update" data-channel="${view.error ? view.operation.channel : view.channel}"${busy || !view.supported || !view.latest ? raw(' disabled') : ''}>${view.error ? 'Retry update' : 'Update and restart'}</button>` : ''}${menuSlot()}</div>
+        <div class="tc-row-actions">${view.available || view.error ? html`<button class="tc-btn tc-btn--primary tc-btn--sm" type="button" data-cmd="t3.update" data-channel="${view.error ? view.operation.channel : view.channel}"${busy || !view.supported || !view.latest ? raw(' disabled') : ''}>${view.error ? 'Retry update' : 'Update and restart'}</button>` : ''}</div>
       </div>
       <div class="tc-row tc-row--compact tc-runtime-channel">
         <div class="tc-row-main"><span class="tc-row-name">Release channel</span><span class="tc-status">${view.channel === 'nightly' ? 'New features first. Nightly builds can be less reliable.' : 'Published releases, for everyday work.'}</span></div>
-        <div class="tc-row-actions tc-runtime-channel-actions"><div class="tc-seg" role="group" aria-label="T3 Code release channel">${['stable', 'nightly'].map((channel) => html`<button type="button" data-cmd="t3.channel" data-channel="${channel}" aria-pressed="${view.channel === channel}" ${busy || !view.supported ? 'disabled' : ''}>${channel === 'stable' ? icon('shield-check') : icon('moon')}${channel === 'stable' ? 'Stable' : 'Nightly'}</button>`)}</div>${menuSlot()}</div>
+        <div class="tc-row-actions tc-runtime-channel-actions"><div class="tc-seg" role="group" aria-label="T3 Code release channel">${['stable', 'nightly'].map((channel) => html`<button type="button" data-cmd="t3.channel" data-channel="${channel}" aria-pressed="${view.channel === channel}" ${busy || !view.supported ? 'disabled' : ''}>${channel === 'stable' ? icon('shield-check') : icon('moon')}${channel === 'stable' ? 'Stable' : 'Nightly'}</button>`)}</div></div>
       </div>
       ${view.error || view.checkError ? html`<div class="tc-runtime-notes">
         ${view.error ? notice('danger', 'circle-alert', 'The last T3 Code update didn’t finish', view.error) : ''}
@@ -1499,7 +1498,7 @@
       <div class="tc-row-main"><span class="tc-row-name" id="auto-${kind}-name">${label}</span><span class="tc-status" id="auto-${kind}-desc">${auto.schedule[kind]}${on && auto.lastChecked[kind] ? ' ' + auto.lastChecked[kind] : ''}</span></div>
       <div class="tc-row-actions">
         ${on ? html`<button class="tc-btn tc-btn--ghost tc-btn--sm" type="button" data-cmd="auto.schedule" data-id="${kind}" data-key="auto-schedule-${kind}" aria-label="Change the ${label} schedule">Schedule</button>` : ''}
-        <label class="tc-switch-hit" for="auto-toggle-${kind}"><button class="tc-switch" id="auto-toggle-${kind}" type="button" role="switch" aria-checked="${String(on)}" aria-labelledby="auto-${kind}-name" aria-describedby="auto-${kind}-desc" data-cmd="auto.toggle" data-id="${kind}" data-key="auto-toggle-${kind}"${busy ? raw(' disabled aria-busy="true"') : ''}></button></label>${menuSlot()}
+        <label class="tc-switch-hit" for="auto-toggle-${kind}"><button class="tc-switch" id="auto-toggle-${kind}" type="button" role="switch" aria-checked="${String(on)}" aria-labelledby="auto-${kind}-name" aria-describedby="auto-${kind}-desc" data-cmd="auto.toggle" data-id="${kind}" data-key="auto-toggle-${kind}"${busy ? raw(' disabled aria-busy="true"') : ''}></button></label>
       </div>
     </div>`;
   };
@@ -1584,7 +1583,7 @@
       </div>
       <div class="tc-row-actions tc-row-actions--wrap">
         ${row.mode && !row.error ? html`<button class="tc-btn tc-btn--sm" type="button" data-cmd="context.provider.edit" data-id="${row.id}" aria-label="Edit what ${row.name} reads"${busy ? raw(' disabled') : ''}>${icon('pencil')}Edit</button>` : ''}
-        <select class="tc-select tc-select--sm tc-context-mode" data-context-mode="${row.id}" aria-label="What ${row.name} reads"${busy || row.error ? raw(' disabled') : ''}>${options.map(([mode, label, off]) => html`<option value="${mode}"${(row.mode || 'none') === mode ? raw(' selected') : ''}${off ? raw(' disabled') : ''}>${label}${off ? ' (write it first)' : ''}</option>`)}</select>${menuSlot()}
+        <select class="tc-select tc-select--sm tc-context-mode" data-context-mode="${row.id}" aria-label="What ${row.name} reads"${busy || row.error ? raw(' disabled') : ''}>${options.map(([mode, label, off]) => html`<option value="${mode}"${(row.mode || 'none') === mode ? raw(' selected') : ''}${off ? raw(' disabled') : ''}>${label}${off ? ' (write it first)' : ''}</option>`)}</select>
       </div>
     </div>`;
   };
diff --git a/docker/setup/console.css b/docker/setup/console.css
index 9579950..489c4fa 100644
--- a/docker/setup/console.css
+++ b/docker/setup/console.css
@@ -121,9 +121,6 @@ html.tc-locked { overflow: hidden; }
 /* Names and values that must not part at a hyphen. */
 .tc-nowrap { white-space: nowrap; }
 
-/* A row without a menu keeps the menu's place, so actions line up down a list. */
-.tc-row-menu-slot { display: block; width: var(--control-sm); height: 1px; flex: none; }
-.tc-root[data-density="touch"] .tc-row-menu-slot { width: 32px; }
 /* A port's tile says whether it is out on the internet. */
 .tc-tile--port-state[data-live] { color: var(--info-text); }
 
@@ -157,7 +154,6 @@ html.tc-locked { overflow: hidden; }
 @media (max-width: 639.98px) {
   .tc-row:has(> .tc-row-actions--wrap) { grid-template-columns: auto minmax(0, 1fr); }
   .tc-row > .tc-row-actions--wrap { grid-column: 2 / -1; justify-content: flex-start; }
-  .tc-row-actions--wrap > .tc-row-menu-slot { display: none; }
   /* Only rows without a leading tile put actions under the whole main block.
      A stale plain modifier must not move an icon row into a single column. */
   .tc-row--plain:not(:has(> .tc-tile, > .tc-row-lead)):has(> .tc-row-actions--wrap) { grid-template-columns: minmax(0, 1fr); }
@@ -590,7 +586,6 @@ html.tc-locked { overflow: hidden; }
 @media (max-width: 639.98px) {
   .tc-runtime-channel { grid-template-columns: minmax(0, 1fr); }
   .tc-runtime-channel-actions { width: 100%; }
-  .tc-runtime-channel-actions > .tc-row-menu-slot { display: none; }
   .tc-runtime-channel .tc-seg { display: flex; flex: 1 1 auto; }
   .tc-runtime-channel .tc-seg button { flex: 1; min-height: 32px; justify-content: center; }
 }
diff --git a/docker/setup/design/README.md b/docker/setup/design/README.md
index ac362a7..1671992 100644
--- a/docker/setup/design/README.md
+++ b/docker/setup/design/README.md
@@ -48,6 +48,10 @@ Each of these is a bug in the handoff, not a restyle. Keep them when syncing.
    The dark input rule sets `background-color` so it preserves `.tc-select`'s
    chevron. In forced colours, selects use their native indicator and a system
    focus outline, since that mode removes gradients and shadows.
+6. **The enabled switch thumb touched its track's right edge.** Its travel
+   omitted the 2px end inset. Translating by `--_t - 4px` keeps the same 2px
+   clearance above, below, and at the resting end in both states and sizes.
+   `scripts/row-ui-audit.js` measures the rendered thumb in each variant.
 
 ## Local additions
 
diff --git a/docker/setup/design/components.css b/docker/setup/design/components.css
index 51ad5e4..0ddbf6e 100644
--- a/docker/setup/design/components.css
+++ b/docker/setup/design/components.css
@@ -207,7 +207,7 @@
 .tc-switch::after { content: ""; position: absolute; top: 2px; left: 2px; width: calc(var(--_t) - 2px); height: calc(var(--_t) - 2px); border-radius: 50%; background: #fff;
   box-shadow: 0 1px 2px rgb(0 0 0 / 0.1); transition: translate 150ms; }
 .tc-switch[aria-checked="true"] { background: var(--accent); }
-.tc-switch[aria-checked="true"]::after { translate: calc(var(--_t) - 2px) 0; }
+.tc-switch[aria-checked="true"]::after { translate: calc(var(--_t) - 4px) 0; }
 
 /* listbox */
 .tc-listbox { list-style: none; margin: 0; padding: 4px var(--space-2); display: flex; flex-direction: column; gap: 1px; max-height: 280px; overflow: auto; }
diff --git a/docs/media/ports-panel.png b/docs/media/ports-panel.png
index 9014d60..e9bc755 100644
Binary files a/docs/media/ports-panel.png and b/docs/media/ports-panel.png differ
diff --git a/docs/media/setup-dark.png b/docs/media/setup-dark.png
index f68d9af..a3f7161 100644
Binary files a/docs/media/setup-dark.png and b/docs/media/setup-dark.png differ
diff --git a/docs/media/setup-light.png b/docs/media/setup-light.png
index 84997b6..c145f50 100644
Binary files a/docs/media/setup-light.png and b/docs/media/setup-light.png differ
diff --git a/scripts/row-ui-audit.js b/scripts/row-ui-audit.js
index 0162014..f928b16 100644
--- a/scripts/row-ui-audit.js
+++ b/scripts/row-ui-audit.js
@@ -17,6 +17,10 @@ const actions = (update) => `<div class="tc-row-actions tc-row-actions--wrap">${
 const main = (title, text) => `<div class="tc-row-main"><div class="tc-row-title"><span class="tc-row-name">${title}</span></div><span class="tc-status tc-status--prose">${text}</span></div>`;
 const section = (id, title, row) => `<section class="tc-section" id="${id}"><div class="tc-section-head"><h2 class="tc-section-title">${title}</h2></div><div class="tc-group"><div class="tc-list">${row}</div></div></section>`;
 const provider = (update) => `<div class="tc-row tc-row--compact tc-row--plain"><span class="tc-tile tc-tile--icon" aria-hidden="true">${icon}</span><div class="tc-row-main"><div class="tc-row-title"><span class="tc-row-name">Provider updates</span><span class="tc-badge tc-badge--ok">Auto</span><span class="tc-badge">${update ? "3 available" : "Up to date"}</span></div><span class="tc-status tc-status--prose">Providers not checked yet · On · check every 3h · update after 30m idle</span></div>${actions(update)}</div>`;
+const switches = (disabled) => [false, true].map((large) => [false, true].map((on) => {
+  const control = `<button class="tc-switch" type="button" role="switch" aria-label="${large ? "Large" : "Small"} ${on ? "on" : "off"} ${disabled ? "disabled" : "enabled"}" aria-checked="${on}"${disabled ? " disabled" : ""}></button>`;
+  return large ? `<label class="tc-switch-hit">${control}</label>` : control;
+}).join("")).join("");
 const fixtures = [
   section("reported-row", "Updates", provider(false)),
   section("available-row", "Updates available", provider(true)),
@@ -25,6 +29,7 @@ const fixtures = [
   section("connect-row", "With an icon", `<div class="tc-row tc-row--compact"><span class="tc-tile tc-tile--icon">${icon}</span>${main("T3 Connect", "Connect this server to reach it from your other devices.")}<div class="tc-row-actions tc-row-actions--wrap">${button("Connect")}</div></div>`),
   section("plain-single", "Single action", `<div class="tc-row tc-row--compact tc-row--plain">${main("Lock console", "Ends this browser’s session. You will need the setup key to come back.")}${button("Lock")}</div>`),
   section("plain-empty", "Without an action", `<div class="tc-row tc-row--compact tc-row--plain">${main("Signed in through T3 Code", "This browser is paired with T3 Code.")}</div>`),
+  ...[false, true].map((disabled) => section(`switches-${disabled}`, "Switches", `<div class="tc-row tc-row--compact tc-row--plain">${main(disabled ? "Disabled" : "Enabled", "Both sizes and states.")}<div class="tc-row-actions">${switches(disabled)}</div></div>`)),
 ].join("");
 
 const geometry = () => {
@@ -53,6 +58,19 @@ const geometry = () => {
       if (r.left < parent.left || r.right > parent.right || r.bottom > parent.bottom) issues.push(`${id}: content outside row`);
     }
   }
+  for (const control of document.querySelectorAll(".tc-switch")) {
+    const track = control.getBoundingClientRect(), thumb = getComputedStyle(control, "::after");
+    const [x, y = 0] = thumb.translate === "none" ? [0, 0] : thumb.translate.split(/\s+/).map(parseFloat);
+    const width = parseFloat(thumb.width), height = parseFloat(thumb.height);
+    const left = parseFloat(thumb.left) + x, top = parseFloat(thumb.top) + y;
+    const right = track.width - left - width, bottom = track.height - top - height;
+    const end = control.getAttribute("aria-checked") === "true" ? right : left;
+    if (![width, height, left, top, right, bottom].every(Number.isFinite)
+      || Math.min(left, top, right, bottom) < 0
+      || Math.abs(width - height) > 0.5 || Math.abs(top - bottom) > 0.5 || Math.abs(end - top) > 0.5) {
+      issues.push(`${control.getAttribute("aria-label")}: switch thumb insets must balance (left ${left}, right ${right}, top ${top}, bottom ${bottom})`);
+    }
+  }
   return issues;
 };
 
@@ -81,7 +99,7 @@ const geometry = () => {
       await frame.evaluate(() => document.fonts.ready);
       const issues = await frame.evaluate(geometry);
       if (issues.length) failures.push({ tag, issues });
-      else console.log(`PASS ${tag}: icon/text alignment, action placement, containment (7 row variants)`);
+      else console.log(`PASS ${tag}: icon/text alignment, action placement, containment (9 row variants), balanced switch thumbs (8 variants)`);
       await context.close();
     }
   } finally { await browser.close(); }
diff --git a/scripts/ui-audit.js b/scripts/ui-audit.js
index 71411d2..ab79308 100755
--- a/scripts/ui-audit.js
+++ b/scripts/ui-audit.js
@@ -286,6 +286,18 @@ const audit = () => {
     if (Math.abs(box(main).left - left) > 1) {
       add("detached-row-text", "text does not follow the leading icon or row padding", main);
     }
+    // The final control ends at the row's normal inset. Reserving a menu's
+    // width when there is no menu leaves an unexplained blank strip beside it.
+    // Phone rows that put actions below the text are intentionally left aligned.
+    const actions = row.querySelector(":scope > .tc-row-actions");
+    if (!actions || !visible(actions) || getComputedStyle(actions).justifyContent !== "flex-end") continue;
+    const controls = [...actions.children].filter((el) => visible(el) && el.matches("button, a, input, select, label, [role=group]"));
+    if (!controls.length) continue;
+    const right = Math.max(...controls.map((el) => box(el).right));
+    const inset = box(row).right - parseFloat(style.borderRightWidth) - parseFloat(style.paddingRight);
+    if (Math.abs(right - inset) > 1) {
+      add("trailing-row-space", `final control is ${(inset - right).toFixed(2)}px from the row's right inset`, actions);
+    }
   }
 
   return findings;