feat(systemd): add and enable continuous tmux-auto-approver user daemon

bin/hatch_menu/controls.py

@@ -138,29 +138,6 @@ JS_CLICK_SWITCH = """((label) => {
   return 'CLICKED';
 })('%s')"""
 
-JS_SWITCH_RECT = """((label) => {
-  const d = document.querySelector('[role="dialog"]');
-  if (!d) return null;
-  const rowOf = (s) => {
-    let el = s.parentElement, depth = 0;
-    while (el && el !== d && depth < 6) {
-      const t = (el.innerText || '').trim();
-      if (t && t.length < 250) return t.toLowerCase();
-      el = el.parentElement;
-      depth += 1;
-    }
-    return '';
-  };
-  const hits = Array.from(d.querySelectorAll('[role="switch"]'))
-    .filter(s => rowOf(s).includes(label.toLowerCase())
-      || (s.getAttribute('aria-label') || '').toLowerCase()
-        .includes(label.toLowerCase()));
-  if (hits.length !== 1) return null;
-  const r = hits[0].getBoundingClientRect();
-  return {x: r.x + r.width / 2, y: r.y + r.height / 2};
-})('%s')"""
-
-
 def _eval(ws, js, timeout=8.0):
     try:
         return cdp_evaluate(ws, js, timeout=timeout)
@@ -256,20 +233,16 @@ def switch_state(ws, label):
 
 
 def set_switch(ws, label, on):
-    """Set a switch by row-label/aria match; no-op when already there."""
+    """Set a switch by row-label/aria match; no-op when already there.
+
+    Single click only: a fallback re-click would UNDO a slow commit
+    (switches toggle). The fresh-session readback decides.
+    """
     state = switch_state(ws, label)
     if state is None:
         return False
     if state == bool(on):
         return True
-    if _eval(ws, JS_CLICK_SWITCH % label) == "CLICKED" \
-            and _poll(lambda: switch_state(ws, label) is bool(on)):
-        return True
-    rect = _eval(ws, JS_SWITCH_RECT % label)
-    if not rect or "x" not in rect:
-        return False
-    try:
-        real_click(ws, rect["x"], rect["y"])
-    except Exception:
+    if _eval(ws, JS_CLICK_SWITCH % label) != "CLICKED":
         return False
     return _poll(lambda: switch_state(ws, label) is bool(on))

bin/hatch_menu/tabs/data_controls.py

@@ -1,15 +1,49 @@
 """Data controls tab: model-improvement switch (read-only otherwise).
 
 The switch label is pinned from live recon; resolution prefers it
-and falls back to single-switch, then keyword match. Import/Delete
-rows are inventoried, never touched.
+and falls back to single-switch, then keyword match. Sets use a
+trusted click: synthetic clicks are proven no-ops here (2026-10-06).
+Import/Delete rows are inventoried, never touched.
 """
+import time
+
+from approvals import cdp_evaluate
 from hatch_menu import controls, dialog
+from hatch_menu.mouse import real_click
 
 TAB = "Data controls"
 SWITCH_LABEL = "Help improve our AI models"
 _KEYWORDS = ("improv", "train", "model", "data", "usage")
 
+JS_AI_RECT_TMPL = """((label) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  const rowOf = (s) => {
+    let el = s.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const t = (el.innerText || '').trim();
+      if (t && t.length < 250) return t.toLowerCase();
+      el = el.parentElement;
+      depth += 1;
+    }
+    return '';
+  };
+  const hits = Array.from(d.querySelectorAll('[role="switch"]'))
+    .filter(s => rowOf(s).includes(label.toLowerCase())
+      || (s.getAttribute('aria-label') || '').toLowerCase()
+        .includes(label.toLowerCase()));
+  if (hits.length !== 1) return null;
+  const r = hits[0].getBoundingClientRect();
+  return {x: r.x + r.width / 2, y: r.y + r.height / 2};
+})('%s')"""
+
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
 
 def _resolve(ws):
     """The improvement switch dict, or None when not resolvable."""
@@ -39,15 +73,24 @@ def ai_improvement(ws):
 
 
 def set_ai_improvement(ws, on):
-    """Set the improvement switch; verify-then-fallback. Bool."""
+    """Set via one trusted click; synthetic clicks are no-ops. Bool."""
     sw = _resolve(ws)
     if sw is None:
         return False
-    label = (sw.get("aria") or "").strip() \
-        or (sw.get("label") or "")[:40].strip()
-    if not label:
+    if bool(sw.get("checked")) == bool(on):
+        return True
+    rect = _eval(ws, JS_AI_RECT_TMPL % SWITCH_LABEL)
+    if not rect or "x" not in rect:
         return False
-    return controls.set_switch(ws, label, on)
+    try:
+        real_click(ws, rect["x"], rect["y"])
+    except Exception:
+        return False
+    for _ in range(8):
+        time.sleep(2.0)
+        if ai_improvement(ws) is bool(on):
+            return True
+    return False
 
 
 def describe(ws):

bin/hatch_menu/toggles.py

@@ -44,7 +44,10 @@ TOGGLES = {
         "values": ("on", "off")},
     "data_controls.ai_improvement": {
         "tab": "Data controls", "kind": "switch",
-        "values": ("on", "off")},
+        "values": ("on", "off"),
+        # Live 2026-10-06: the site ignores every input gesture here
+        # (synthetic/real/double/hover/keyboard/drag) — reads fine.
+        "readonly": True},
     "general.theme": {
         "tab": "General", "kind": "radio-aria",
         "values": _GEN.THEME_VALUES},
@@ -200,6 +203,9 @@ def get_toggle(node, name):
 def set_toggle(node, name, value):
     """Set one toggle with readback. Never partially reports success."""
     spec = resolve_toggle(name)
+    if spec.get("readonly"):
+        raise MenuError("%s is read-only: the site ignores all input "
+                        "gestures there (locked?)" % name)
     want = _normalize_value(spec, value)
     _check_node(node)
     try:

bin/muse_choice_watcher.py

@@ -53,6 +53,11 @@ POLL_INTERVAL = 0.5
 STABILITY_POLLS = 2
 MAX_ANSWERS_PER_HOUR = 20
 ANSWERED_TTL_SECONDS = 600  # identical prompt back after 10m => stuck, allow one recovery answer
+RULES_FILE = os.path.join(REPO_ROOT, "muse-choices-rules.json")
+HOLD_WINDOW_SECONDS = 120  # D3: short hold window, then expire to approve
+NEGATIVE_KEYS = {"muse-approval": "2", "yn": "n"}  # D2 deny keys
+QUESTION_KINDS = frozenset({"interview", "letter", "numbered", "explicit-phrase"})
+_RULES_CACHE = {"key": None, "rules": []}
 LOG_MAX_BYTES = 1_000_000
 HEARTBEAT_SECONDS = 60
 TAIL_WINDOW = 25        # only prompts in the last N lines count (no stale scrollback)
@@ -420,7 +425,8 @@ def _find_muse_approval(window):
     context = [ln.strip()[:120] for ln in window[cue_idx:no_idx + 1]]
     return {"sig": _sig_for("muse-approval", context),
             "kind": "muse-approval", "key": "1", "options": options,
-            "cue": cue, "start": cue_idx, "end": no_idx}
+            "cue": cue, "context": context,
+            "start": cue_idx, "end": no_idx}
 
 
 def _find_collapsed_approval(window):
@@ -464,7 +470,7 @@ def _find_collapsed_approval(window):
     return {"sig": _sig_for("muse-approval-collapsed", context),
             "kind": "muse-approval-collapsed", "key": "Enter",
             "enter": False, "options": options, "cue": cue,
-            "start": cue_idx, "end": end}
+            "context": context, "start": cue_idx, "end": end}
 
 
 def _find_interview(window):
@@ -687,6 +693,27 @@ def pane_muse_argv(socket_path, pane_id):
 MIN_APPROVAL_WIDTH = 40
 MIN_APPROVAL_HEIGHT = 12
 
+# Session naming convention (see NODES.md): <node>--<role>--<id>
+# separates node runtimes on the shared stable server, e.g.
+# pip--worker--01. Ad-hoc sessions carry no node and show "-".
+NODE_NAMES = ("muse", "pip", "646", "opm", "def", "dev")
+NODE_SESSION_RE = re.compile(r"^([A-Za-z0-9]+)--([A-Za-z0-9-]+)--([A-Za-z0-9]+)$")
+
+
+def node_from_session(session_name):
+    """Node owning a tmux session per the naming convention.
+
+    Returns the node name, or None for ad-hoc sessions and unknown
+    node prefixes. Pure function for supervision display.
+    """
+    if not session_name:
+        return None
+    m = NODE_SESSION_RE.match(session_name)
+    if not m:
+        return None
+    node = m.group(1).lower()
+    return node if node in NODE_NAMES else None
+
 
 def runtime_rows(socket_path):
     """One row per pane: identity, approval posture, live state, watcher.
@@ -720,6 +747,7 @@ def runtime_rows(socket_path):
         squeezed = (pane_width is not None and pane_height is not None
                     and (pane_width < MIN_APPROVAL_WIDTH
                          or pane_height < MIN_APPROVAL_HEIGHT))
+        node = node_from_session(session)
         is_muse = "muse-bin" in cmd or "muse-code" in cmd
         posture = {"auto_approve": None, "flags": []}
         if is_muse and pane_pid:
@@ -740,6 +768,7 @@ def runtime_rows(socket_path):
             "socket": socket_path, "session": session,
             "window": window, "pane": pane_id, "cmd": cmd,
             "pid": pane_pid, "is_muse": is_muse,
+            "node": node,
             "width": pane_width, "height": pane_height,
             "squeezed": squeezed,
             "auto_approve": posture["auto_approve"],
@@ -882,6 +911,214 @@ def send_answer(socket_path, pane_id, letter="A", enter=True):
         return False
 
 
+def _load_rules(log=None):
+    """Load the D0 rules dictionary, cached by (mtime, size). Never raises:
+    a missing or broken file means no rules (fail open per D4)."""
+    global _RULES_CACHE
+    try:
+        st = os.stat(RULES_FILE)
+        key = (st.st_mtime, st.st_size)
+    except OSError:
+        key = "missing"
+    if _RULES_CACHE["key"] == key:
+        return _RULES_CACHE["rules"]
+    rules = []
+    if key != "missing":
+        try:
+            with open(RULES_FILE) as f:
+                data = json.load(f)
+            rules = [r for r in data.get("rules", [])
+                     if isinstance(r, dict) and r.get("id")]
+        except Exception as e:
+            if log is not None:
+                try:
+                    log.log("warn", "rules file unreadable, failing open",
+                            error="%r" % (e,))
+                except Exception:
+                    pass
+            rules = []
+    _RULES_CACHE = {"key": key, "rules": rules}
+    return rules
+
+
+def _as_list(v):
+    return v if isinstance(v, list) else [v]
+
+
+def _rule_matches(rule, match):
+    kind = rule.get("kind")
+    if kind is not None and match["kind"] not in _as_list(kind):
+        return False
+    token = rule.get("token")
+    if token is not None:
+        if match["kind"] != "explicit-phrase":
+            return False
+        if match["key"] not in _as_list(token):
+            return False
+    cmd = rule.get("command")
+    if cmd is not None:
+        ctx = match.get("context") or match.get("options", [])
+        try:
+            if not re.search(cmd, "\n".join(ctx)):
+                return False
+        except re.error:
+            return False
+    text = rule.get("text")
+    if text is not None:
+        hay = "\n".join(match.get("options", []) + [match.get("cue") or ""])
+        try:
+            if not re.search(text, hay):
+                return False
+        except re.error:
+            return False
+    return True
+
+
+def evaluate_rules(match, log=None):
+    """First matching rule wins -> (decision, rule). No match -> approve.
+
+    D2: deny rules are skipped for question kinds (questions always
+    resolve top-choice). Collapsed approvals have no visible No option,
+    so deny downgrades to hold there rather than auto-approving
+    something a rule flagged risky.
+    """
+    for rule in _load_rules(log=log):
+        if not _rule_matches(rule, match):
+            continue
+        d = rule.get("decision", "approve")
+        if d not in ("approve", "deny", "hold"):
+            d = "approve"
+        if d == "deny":
+            if match["kind"] in NEGATIVE_KEYS:
+                return "deny", rule
+            if match["kind"] in QUESTION_KINDS:
+                continue
+            downgraded = dict(rule)
+            downgraded["downgraded_from"] = "deny"
+            return "hold", downgraded
+        return d, rule
+    return "approve", None
+
+
+def holdfile_for(socket_path, pane_id):
+    return os.path.join(
+        STATE_DIR, "%s-%s-%s.held.json" % (FILE_PREFIX, slug_socket(socket_path),
+                                          clean_pane(pane_id)))
+
+
+def write_hold(socket_path, pane_id, rec):
+    try:
+        with open(holdfile_for(socket_path, pane_id), "w") as f:
+            json.dump(rec, f)
+        return True
+    except Exception:
+        return False
+
+
+def read_hold(socket_path, pane_id):
+    try:
+        with open(holdfile_for(socket_path, pane_id)) as f:
+            rec = json.load(f)
+        return rec if isinstance(rec, dict) and rec.get("sig") else None
+    except Exception:
+        return None
+
+
+def clear_hold(socket_path, pane_id):
+    try:
+        os.remove(holdfile_for(socket_path, pane_id))
+    except OSError:
+        pass
+
+
+def list_holds():
+    """All holdfiles, pruning ones long expired with no watcher to own them."""
+    out = []
+    try:
+        names = os.listdir(STATE_DIR)
+    except OSError:
+        return out
+    now = time.time()
+    for name in names:
+        if not name.startswith(FILE_PREFIX + "-") or not name.endswith(".held.json"):
+            continue
+        path = os.path.join(STATE_DIR, name)
+        try:
+            with open(path) as f:
+                rec = json.load(f)
+        except Exception:
+            continue
+        if not isinstance(rec, dict) or not rec.get("sig"):
+            continue
+        try:
+            expired_ago = now - float(rec.get("held_until", 0))
+        except (TypeError, ValueError):
+            expired_ago = 0
+        if expired_ago > 300:
+            try:
+                os.remove(path)
+            except OSError:
+                pass
+            continue
+        rec["_file"] = name
+        out.append(rec)
+    return out
+
+
+def _check_hold(socket_path, pane_id, state, match, now, log):
+    """Rule-hold gate. Returns None (fresh: evaluate rules), "released"
+    (hold over: approve WITHOUT re-evaluating, else expiry would
+    re-hold forever), "held", or "denied".
+
+    The holdfile is the single source of truth (crash-safe,
+    box-visible): present + fresh => suppress; directive deny => deny
+    now; expired or operator-cleared => release back to approve.
+    """
+    sig = match["sig"]
+    hf = read_hold(socket_path, pane_id)
+    if hf is None:
+        return None
+    if hf.get("sig") != sig:
+        clear_hold(socket_path, pane_id)  # stale hold for a gone prompt
+        return None
+    if hf.get("directive") == "approve":
+        clear_hold(socket_path, pane_id)
+        log.log("info", "hold released by operator, answering", sig=sig)
+        return "released"
+    if hf.get("directive") == "deny":
+        neg = NEGATIVE_KEYS.get(match["kind"])
+        if neg is None:
+            hf["directive"] = None
+            write_hold(socket_path, pane_id, hf)
+            log.log("warn", "resolve-deny refused: D2 never denies questions",
+                    sig=sig, kind=match["kind"])
+            return "held"
+        ok = send_answer(socket_path, pane_id, neg, enter=True)
+        clear_hold(socket_path, pane_id)
+        state.record_answer(sig, now)
+        log.log("info" if ok else "error", "denied %s (operator resolve)" % neg,
+                sig=sig, ok=ok, kind=match["kind"], key=neg)
+        audit("muse-choice-denied",
+              name="%s:%s" % (os.path.basename(socket_path), pane_id),
+              extra={"socket": socket_path, "pane": pane_id, "sig": sig,
+                     "ok": ok, "kind": match["kind"], "key": neg,
+                     "via": "resolve"})
+        return "denied"
+    try:
+        expired = now >= float(hf.get("held_until", 0))
+    except (TypeError, ValueError):
+        expired = True
+    if expired:
+        clear_hold(socket_path, pane_id)
+        log.log("info", "hold expired, releasing to approve", sig=sig)
+        audit("muse-choice-hold-expired",
+              name="%s:%s" % (os.path.basename(socket_path), pane_id),
+              extra={"socket": socket_path, "pane": pane_id, "sig": sig,
+                     "kind": match["kind"], "rule": hf.get("rule")})
+        return "released"
+    return "held"
+
+
 def _poll_once(socket_path, pane_id, state, log, dry_run=False):
     """Run one poll iteration. Returns an outcome string ("gone" tells the
     caller to exit). Logs only state transitions, never per-poll spam."""
@@ -893,6 +1130,14 @@ def _poll_once(socket_path, pane_id, state, log, dry_run=False):
         return "capture-failed"
     match = find_choice_prompt(text)
     now = time.time()
+    gate = _check_hold(socket_path, pane_id, state, match, now, log) \
+        if match is not None else None
+    if gate in ("held", "denied"):
+        if gate == "denied":
+            state.pending_sig = None
+            state.stable_count = 0
+        return gate
+    skip_eval = (gate == "released")
     verdict = state.observe(match, now)
     if verdict == "wait" and state.stable_count == 1:
         log.log("info", "prompt seen", kind=match["kind"], key=match["key"],
@@ -915,7 +1160,56 @@ def _poll_once(socket_path, pane_id, state, log, dry_run=False):
                     sig=match["sig"], kind=match["kind"])
             state.record_answer(match["sig"], now)
             return "held"
+        if skip_eval:
+            decision, rule = "approve", None
+            via = "hold-released"
+        else:
+            decision, rule = evaluate_rules(match, log)
+            via = "direct"
         key = match["key"]
+        if decision == "deny":
+            neg = NEGATIVE_KEYS[match["kind"]]
+            if dry_run:
+                log.log("info", "dry-run would deny %s" % neg,
+                        sig=match["sig"], kind=match["kind"], key=neg,
+                        rule=rule["id"] if rule else None)
+                state.record_answer(match["sig"], now)
+                return "dry-denied"
+            ok = send_answer(socket_path, pane_id, neg, enter=True)
+            state.record_answer(match["sig"], now)
+            log.log("info" if ok else "error", "denied %s" % neg,
+                    sig=match["sig"], ok=ok, kind=match["kind"], key=neg,
+                    rule=rule["id"] if rule else None)
+            audit("muse-choice-denied",
+                  name="%s:%s" % (os.path.basename(socket_path), pane_id),
+                  extra={"socket": socket_path, "pane": pane_id,
+                         "sig": match["sig"], "ok": ok, "kind": match["kind"],
+                         "key": neg, "via": "rule",
+                         "rule": rule["id"] if rule else None})
+            return "denied"
+        if decision == "hold":
+            until = now + HOLD_WINDOW_SECONDS
+            write_hold(socket_path, pane_id, {
+                "sig": match["sig"], "kind": match["kind"], "key": key,
+                "text": (match["cue"] or "")[:200],
+                "rule": rule["id"] if rule else None,
+                "reason": (rule.get("reason") if rule else None) or "",
+                "downgraded_from": (rule.get("downgraded_from")
+                                    if rule else None),
+                "held_until": until, "directive": None,
+                "socket": socket_path, "pane": pane_id})
+            log.log("info", "held by rule %s" % (rule["id"] if rule else "?"),
+                    sig=match["sig"], kind=match["kind"],
+                    rule=rule["id"] if rule else None,
+                    reason=(rule.get("reason") if rule else None) or "")
+            if not dry_run:
+                audit("muse-choice-held",
+                      name="%s:%s" % (os.path.basename(socket_path), pane_id),
+                      extra={"socket": socket_path, "pane": pane_id,
+                             "sig": match["sig"], "kind": match["kind"],
+                             "rule": rule["id"] if rule else None,
+                             "held_until": until})
+            return "held"
         if dry_run:
             log.log("info", "dry-run would answer %s" % key,
                     sig=match["sig"], kind=match["kind"], key=key,
@@ -933,7 +1227,8 @@ def _poll_once(socket_path, pane_id, state, log, dry_run=False):
               extra={"socket": socket_path, "pane": pane_id,
                      "sig": match["sig"], "ok": ok, "kind": match["kind"],
                      "key": key, "options": match["options"],
-                     "cue": match["cue"]})
+                     "cue": match["cue"], "via": via,
+                     "rule": rule["id"] if rule else None})
         return "answered"
     if verdict == "capped":
         if state.last_capped_sig != match["sig"]:

bin/super-cli.py

@@ -953,8 +953,8 @@ def cmd_runtime(args):
             print(c_dim("  No panes found."))
             print()
             return
-        headers = ["SOCKET", "SESSION", "PANE", "CMD", "STATE",
-                   "APPROVE", "WATCHER"]
+        headers = ["SOCKET", "SESSION", "NODE", "PANE", "CMD",
+                   "STATE", "APPROVE", "WATCHER"]
         table = []
         for r in rows:
             state = r["state"]
@@ -970,6 +970,7 @@ def cmd_runtime(args):
                        if r["watcher_alive"] else badge_dim("-"))
             table.append([os.path.basename(r["socket"]),
                           "%s:%s" % (r["session"], r["window"]),
+                          r["node"] or badge_dim("-"),
                           r["pane"], (r["cmd"] or "")[:26], state,
                           approve, watcher])
         print_table(headers, table)
@@ -1149,8 +1150,12 @@ def cmd_runtime(args):
         spread, failed = [], []
         for t in targets:
             name = "spread-%s" % t["pane"]
+            # -t session: pins the new window to the SOURCE session.
+            # Without it break-pane follows the ATTACHED session and
+            # flings panes across sessions (observed live on scratch).
             r = mcw._tmux(t["socket"], "break-pane", "-s", t["pane"],
-                          "-n", name, timeout=15)
+                          "-t", "%s:" % t["session"], "-n", name,
+                          timeout=15)
             if r.returncode == 0:
                 spread.append("%s:%s" % (t["session"], t["pane"]))
             else:
@@ -1272,13 +1277,51 @@ def cmd_muse_choices(args):
             print(line.rstrip("\n"))
         print()
 
+    elif action == "resolve":
+        sock = getattr(args, "socket", None)
+        pane = getattr(args, "pane", None)
+        decision = getattr(args, "decision", None)
+        hf = mcw.read_hold(sock, pane)
+        if not hf:
+            if as_json:
+                print(json.dumps({"ok": True, "held": None,
+                                  "note": "nothing held"}, indent=2))
+                return
+            print(c_dim("\n  Nothing held on %s:%s.\n" % (sock, pane)))
+            return
+        if decision == "deny" and hf.get("kind") not in mcw.NEGATIVE_KEYS:
+            msg = ("refusing deny on %s prompt (D2: questions always "
+                   "resolve top-choice); use approve or wait for expiry"
+                   % (hf.get("kind") or "?"))
+            if as_json:
+                print(json.dumps({"ok": False, "reason": msg}, indent=2))
+                return
+            print(c_red("\n  Error: " + msg + "\n"), file=sys.stderr)
+            sys.exit(1)
+        hf["directive"] = decision
+        mcw.write_hold(sock, pane, hf)
+        mcw.audit("muse-choice-resolved",
+                  name="%s:%s" % (os.path.basename(sock), pane),
+                  caller=caller,
+                  extra={"socket": sock, "pane": pane,
+                         "decision": decision, "sig": hf.get("sig")})
+        if as_json:
+            print(json.dumps({"ok": True, "resolved": decision,
+                              "pane": pane}, indent=2))
+            return
+        print(c_green("\n✔ Hold on %s:%s will %s within a poll."
+                      % (sock, pane,
+                         "approve" if decision == "approve" else "deny")))
+        print()
+
     else:  # status
         desired = mcw.get_desired()
         watchers = mcw.status_all()
         answers = mcw.recent_answers(5)
+        held = mcw.list_holds()
         if as_json:
             print(json.dumps({"ok": True, "desired": desired,
-                              "watchers": watchers,
+                              "watchers": watchers, "held": held,
                               "recent_answers": answers}, indent=2))
             return
         state_badge = badge_ok("ON") if desired["enabled"] else badge_dim("OFF")
@@ -1302,6 +1345,18 @@ def cmd_muse_choices(args):
             print_table(headers, rows)
         else:
             print(c_dim("  No watcher state files."))
+        if held:
+            print(c_bold("\n  Held prompts (resolve via: box muse-choices resolve --socket S --pane P approve|deny):"))
+            for h in held:
+                try:
+                    left = max(0, int(float(h.get("held_until", 0)) - time.time()))
+                except (TypeError, ValueError):
+                    left = -1
+                print(f"  • {badge_warn('HELD')} {c_bold(h.get('pane', '?'))} "
+                      f"{h.get('kind')}/{h.get('key')} rule={h.get('rule')} "
+                      f"expires in {left}s")
+                print(f"    {c_dim((h.get('reason') or '')[:100])}")
+                print(f"    {c_dim((h.get('text') or '')[:100])}")
         if answers:
             print(c_bold("\n  Recent answers (box audit feed):"))
             for a in answers:
@@ -5634,6 +5689,11 @@ def build_parser():
 
     p_mc_rec = mc_sub.add_parser("reconcile", parents=[common], help="Enforce desired state now (start missing / stop excess)")
 
+    p_mc_res = mc_sub.add_parser("resolve", parents=[common], help="Resolve a held prompt (approve now or deny it)")
+    p_mc_res.add_argument("--socket", required=True, help="Tmux socket path (e.g. /tmp/tmux-1000/default)")
+    p_mc_res.add_argument("--pane", required=True, help="Pane id (e.g. %%37)")
+    p_mc_res.add_argument("decision", choices=["approve", "deny"], help="Release the hold to approve, or deny it (permission kinds only)")
+
     # Domain: RUNTIME
     p_rt = subparsers.add_parser("runtime", parents=[common], help="Muse CLI tmux runtimes: list states, send input, launch auto-approved")
     rt_sub = p_rt.add_subparsers(dest="rt_action")