diff --git a/bin/muse-auth.py b/bin/muse-auth.py
index 0db21f5..7c70ee4 100755
--- a/bin/muse-auth.py
+++ b/bin/muse-auth.py
@@ -110,3 +110,31 @@ if __name__ == "__main__":
     state, details = get_state(cdp)
     print(f"State: {state}")
     print(f"Details: {details}")
+
+# Holdings logging: record what the Chromebox holds for each node
+# Logs to ~/Projects/NetVM/logs/auth-holdings.log
+# Format: timestamp | node | state | email_hint | account_name | notes
+# This lets us know which Proton address was used without asking the user again.
+
+import os
+from datetime import datetime
+
+def log_holdings(node, state, email_hint="", account_name="", notes=""):
+    """Log the Chromebox holdings for a node. Call after auth state detection."""
+    log_dir = os.path.expanduser("~/Projects/NetVM/logs")
+    os.makedirs(log_dir, exist_ok=True)
+    log_file = os.path.join(log_dir, "auth-holdings.log")
+    ts = datetime.now().isoformat()
+    # Never log full email or secrets — use hint (e.g., domain or first char)
+    line = f"{ts} | {node} | {state} | {email_hint} | {account_name} | {notes}\n"
+    with open(log_file, "a") as f:
+        f.write(line)
+
+def get_holdings(node):
+    """Get last known holdings for a node."""
+    log_file = os.path.expanduser("~/Projects/NetVM/logs/auth-holdings.log")
+    if not os.path.exists(log_file):
+        return None
+    with open(log_file) as f:
+        lines = [l.strip() for l in f if l.strip() and f"| {node} |" in l]
+    return lines[-1] if lines else None