docs(netvm): document watchdog, swarm-worker, and alert relay in README; track approvals CLI

bin/fleet-alert-check.sh

@@ -185,6 +185,43 @@ HEALTHY_AGENTS=""
     esac
 done
 
+# --- Agent approval blockage detection (catches agents held up on approvals) ---
+"$BIN/netvm-registry.py" 2>/dev/null | while IFS=: read -r node port; do
+    [ -n "$node" ] || continue
+    cond="approval:$node"
+    pending_info=$(python3 -c "
+import sys
+sys.path.insert(0, '$BIN')
+import approvals
+info = approvals.inspect_node_approvals('$node')
+if info.get('has_pending'):
+    print(f\"{info.get('ip') or 'unknown'}|{info.get('title') or ''}\")
+" 2>/dev/null || true)
+
+    if [ -n "$pending_info" ]; then
+        failing=1
+        target="${pending_info%%|*}"
+        detail="Agent $node held up on browser approval for $target"
+    else
+        failing=0
+        detail="Agent $node approvals clear"
+    fi
+    injected "$cond" && failing=1
+    read -r action fails < <(state_machine "$cond" "$failing")
+    case "$action" in
+        ALERT_FIRST|ALERT_REALERT)
+            emit_record "ALERT" "$cond" "$detail" "$fails"
+            echo "$cond" >> "$STATE_DIR/.alerts.tmp"
+            ;;
+        RECOVERY)
+            emit_record "RECOVERY" "$cond" "$detail" "$fails"
+            ;;
+        SUPPRESSED)
+            log "$cond still critical x$fails — re-page suppressed"
+            ;;
+    esac
+done
+
 # --- Warp partition detection (2026-10-04) ---
 # A partitioned node has a live browser + CDP but no internet egress: the
 # chromebox watchdog sees a healthy browser while all automation fails.