@getmarrow/install 0.1.66 → 0.1.68

package/src/governed-runner.js

@@ -14,6 +14,7 @@ const {
   verifyActionPermit,
 } = require('./enforcement-client');
 const { startGovernanceSidecar } = require('./governance-sidecar');
+const { readOwnerApiKey } = require('./owner-env');
 const {
   controllerStatus,
   ensureCurrentGovernanceController,
@@ -28,6 +29,8 @@ const {
   detectEnvironment,
   detectedClient,
   localControllerAgentId,
+  maintenanceMcpRuntime,
+  argumentLabel,
 } = require('./installer');
 const { createHostUsageCapture } = require('./usage-telemetry');
 const { readLocalControlState, recordGovernedBypass } = require('./control-state');
@@ -129,14 +132,22 @@ Commands:
 Options:
   --agent <id>            Registered agent id. Defaults to MARROW_FLEET_AGENT_ID or MARROW_AGENT_ID.
                           When unset, Marrow uses the API key's bound agent or the plan's agent seat.
-  --session <id>          Session id. Defaults to marrow-run-<timestamp>
+  --session <id>          Session id. Default: one per agent, project directory, user, Marrow
+                          service and UTC day (marrow-run-<hash>), so reruns share it
   --type <type>           Action type. Inferred from action/command when omitted
   --action <text>         Human-readable action. Defaults to the redacted command
   --profile <name>        Policy profile label, such as dev, staging, or production
-  --policy <mode>         enforce, warn, or audit. Default: enforce
+  --policy <mode>         enforce, warn, or audit. Default: enforce. Reported to Marrow; a gate
+                          Marrow enforces (a block or a hold) stops the command under every mode
   --fail-open             For non-protected, low-risk actions only, run if Marrow is unreachable
   --fail-closed           If Marrow is unreachable, block the command
-  --owner-approved <ref>  Owner approval reference for review-required gates
+  --owner-approved <ref>  No longer used and has no effect: approvals happen in the host's own
+                          prompt, at this runner's terminal prompt, or by the account owner's link
+  --request-owner-link    When the account owner declined this action earlier, ask the owner again
+                          with a one-tap approval link (only the owner can reverse the decline)
+  --approval-wait <sec>   How long run waits for an approval before it holds (0 to 3600).
+                          Default: at an interactive terminal, until the owner's link
+                          expires; otherwise 0, and a later run picks up the answer
   --permit <token>        Short-lived action permit. Prefer MARROW_ACTION_PERMIT
   --target <text>         Protected target binding, such as repository/environment
   --sidecar-port <port>   Loopback sidecar port. Default: ephemeral
@@ -147,21 +158,594 @@ Options:
   --key <key>             Marrow API key. Prefer MARROW_API_KEY
   --json                  Print machine-readable result after completion
   --interactive           Force interactive govern TUI when possible
-  --no-interactive        Print govern/fleet panel instead of opening the TUI
+  --no-interactive        run: never prompt (a hold waits for a person elsewhere);
+                          govern/fleet: print the panel instead of opening the TUI
 `;
 }
 
-function nowId(prefix) {
-  return `${prefix}-${new Date().toISOString().replace(/[^0-9TZ]/g, '')}-${crypto.randomBytes(4).toString('hex')}`;
+// Redaction replaces a secret VALUE and nothing else. Everything around it stays visible,
+// because the redacted text is what Marrow sees, what the owner approves and what an action
+// permit is bound to: two actions that differ anywhere outside a secret must stay different.
+//
+// Three kinds of text:
+// - 'text': free text (--action, --target, displayed lines). A value is one shell word:
+//   adjacent quoted and unquoted pieces belong to it, and it ends at unquoted whitespace.
+// - 'script': a shell script (the word after `sh -c`, `bash -lc`, ...). As 'text', and an
+//   unquoted ; | & always ends the value, because the shell splits there.
+// - 'word': one argv word that is not a script. The shell already removed its quoting, so
+//   quotes and spaces are part of the value; it ends only before another `name=`, or at a
+//   new line.
+const REDACTED = '[redacted]';
+// Marrow's own marker for a hidden value that may also hide command text: a value holding a
+// blank, a quote, a shell operator or a separator (; & | < > ( ) ` # , ? $( ...). Marrow never binds
+// an action that carries it to an approval (no learned, task or fleet reuse), so two actions that
+// differ only inside such a value can never share one. The text must match Marrow's exactly.
+const AMBIGUOUS = '[REDACTED_AMBIGUOUS]';
+const AMBIGUOUS_SPAN_RE = /[\s'"`;&|<>()#,?]|\$[({A-Za-z_]/;
+const MARKERS = new Set([REDACTED, AMBIGUOUS]);
+const hiddenAs = (span) => (AMBIGUOUS_SPAN_RE.test(String(span)) ? AMBIGUOUS : REDACTED);
+// A shell variable reference ($NAME in capitals, ${name}) names a secret; it is not one, and stays
+// visible in shell text and free text (Marrow's own rule). In an argv word the shell has already
+// expanded variables, so `$ecret1`-shaped text there is literal data and stays hidden.
+const REFERENCE_RE = /^\$(?:[A-Z_][A-Z0-9_]*|\{[A-Za-z_][A-Za-z0-9_]*\})$/;
+
+// A credential name CONTAINS one of these words in one of its segments (split at _ . - and
+// camelCase): TF_TOKEN, PGPASSWORD, SECRET_KEY_BASE, GITHUB_TOKEN_V2, X_API_KEY_ID, apiKey,
+// client_secret, basic_auth, Authorization, SLACK_WEBHOOK. `pass` and `pwd` count only as a
+// whole segment (DB_PASS, MYSQL_PWD; not bypass or compass).
+const CREDENTIAL_WORD_RE = /token|secret|password|passwd|passphrase|key|credential|auth|webhook/;
+const CREDENTIAL_SEGMENTS = new Set(['pass', 'pwd']);
+// Segments that contain such a word but name no secret.
+const NON_SECRET_WORDS = new Set([
+  'keyspace', 'keyspaces', 'keyboard', 'keyboards', 'keyword', 'keywords', 'keymap', 'keymaps', 'keyframe', 'keyframes',
+  'keystroke', 'keystrokes', 'keynote', 'keyless', 'hotkey', 'hotkeys', 'monkey', 'monkeypatch', 'donkey', 'turkey', 'hockey',
+  'jockey', 'whiskey', 'tokenizer', 'tokenizers', 'tokenize', 'tokenization', 'detokenize', 'author', 'authors', 'authored',
+  'authorship', 'authority', 'authorities', 'oauth', 'oauth2', 'passwordless', 'secretary',
+]);
+// Whole names (normalized: lower case, _ for . and -, camelCase split) that name no secret.
+const NON_SECRET_NAMES = new Set([
+  'max_tokens', 'max_new_tokens', 'max_output_tokens', 'max_completion_tokens', 'max_input_tokens', 'num_tokens',
+  'token_count', 'token_limit', 'token_budget', 'token_type', 'token_usage', 'tokens_used',
+  'auth_type', 'auth_method', 'auth_mode', 'auth_provider', 'auth_scheme',
+  'key_type', 'key_size', 'key_length', 'key_algorithm', 'public_key', 'primary_key', 'foreign_key', 'sort_key',
+  'partition_key', 'hash_key', 'range_key', 'cache_key', 'idempotency_key', 'pwd',
+]);
+// A name whose last segment says what kind of thing the value is (a file, a name, a region)
+// names where a secret is, not the secret: --key-file, KEY_VAULT_NAME. A URL, URI, endpoint,
+// domain or host under a credential name (SECRET_URL, TOKEN_URL, a webhook) is the secret itself.
+const NON_SECRET_LAST_SEGMENTS = new Set([
+  'file', 'files', 'path', 'paths', 'dir', 'arn', 'alias', 'name',
+  'region', 'sock', 'socket', 'type', 'mode', 'method', 'version', 'count', 'limit', 'ttl', 'size', 'length', 'format',
+]);
+
+function nameSegments(name) {
+  return String(name || '').replace(/^-+/, '').replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().replace(/[.-]/g, '_')
+    .split('_').filter(Boolean);
+}
+
+function credentialName(name) {
+  const segments = nameSegments(name);
+  if (!segments.length || NON_SECRET_NAMES.has(segments.join('_'))) return false;
+  if (segments.length > 1 && NON_SECRET_LAST_SEGMENTS.has(segments[segments.length - 1])) return false;
+  return segments.some((segment) => CREDENTIAL_SEGMENTS.has(segment)
+    || (CREDENTIAL_WORD_RE.test(segment) && !NON_SECRET_WORDS.has(segment)));
+}
+
+// A flag whose next word is a secret: its last segment is a credential word (--token,
+// --github-token, --db-password, --secret-key, --api-key, --key). `--skip-auth` is not.
+const FLAG_SECRET_LAST = new Set(['token', 'password', 'passwd', 'passphrase', 'pass', 'pwd', 'secret', 'key', 'apikey', 'credential', 'credentials']);
+function secretFlag(flag) {
+  const text = String(flag || '');
+  if (!/^--[A-Za-z][A-Za-z0-9_-]*$/.test(text)) return false;
+  const segments = nameSegments(text);
+  return FLAG_SECRET_LAST.has(segments[segments.length - 1]) && credentialName(text);
+}
+
+const NAME_ASSIGNMENT_AHEAD = /(?:[A-Za-z_][A-Za-z0-9_.-]*=|"[A-Za-z_][A-Za-z0-9_.-]*"\s*:)/y;
+const COMMAND_START = /[A-Za-z_./$({`~!]/;
+const aheadAt = (pattern, text, index) => {
+  pattern.lastIndex = index;
+  return pattern.test(text);
+};
+
+// Shell quoting in 'text' and 'script' modes: each closed quoted region, as [open, close]
+// (close is the index of the closing quote). As in the shell, a region may span lines; an
+// unclosed quote is a literal.
+function quoteRegions(text, mode) {
+  const regions = [];
+  if (mode === 'word') return regions;
+  let index = 0;
+  while (index < text.length) {
+    const char = text[index];
+    if (char === '\\') {
+      index += 2;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      let at = index + 1;
+      while (at < text.length && text[at] !== char) at += char === '"' && text[at] === '\\' ? 2 : 1;
+      if (at < text.length && text[at] === char) {
+        regions.push([index, at]);
+        index = at + 1;
+        continue;
+      }
+    }
+    index += 1;
+  }
+  return regions;
+}
+
+// Finds the quoted region that opens at, or contains, a position (binary search), and where
+// the simple command around a position starts (after the last unquoted ; | & ( or line break).
+function regionFinder(regions, text = '') {
+  let separators = null;
+  const last = (position) => {
+    let low = 0;
+    let high = regions.length - 1;
+    let found = -1;
+    while (low <= high) {
+      const middle = (low + high) >> 1;
+      if (regions[middle][0] <= position) {
+        found = middle;
+        low = middle + 1;
+      } else high = middle - 1;
+    }
+    return found === -1 ? null : regions[found];
+  };
+  return {
+    opening(position) {
+      const region = last(position);
+      return region && region[0] === position ? region : null;
+    },
+    around(position) {
+      const region = last(position - 1);
+      return region && region[0] < position && position <= region[1] ? region : null;
+    },
+    commandStart(position) {
+      if (!separators) {
+        separators = [];
+        let next = 0;
+        for (let index = 0; index < text.length; index += 1) {
+          while (next < regions.length && regions[next][1] < index) next += 1;
+          if (next < regions.length && regions[next][0] <= index && index <= regions[next][1]) {
+            index = regions[next][1];
+            continue;
+          }
+          if (/[;|&\n(]/.test(text[index])) separators.push(index);
+        }
+      }
+      let low = 0;
+      let high = separators.length;
+      while (low < high) {
+        const middle = (low + high) >> 1;
+        if (separators[middle] < position) low = middle + 1;
+        else high = middle;
+      }
+      return low === 0 ? 0 : separators[low - 1] + 1;
+    },
+  };
 }
 
-function redact(value) {
-  let text = String(value || '');
-  text = text.replace(/\b[A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD)[A-Z0-9_]*=([^\s]+)/gi, (match, captured) => match.replace(captured, '[redacted]'));
-  text = text.replace(/\bmrw_(?:live|test)_[A-Za-z0-9._-]+/g, '[redacted]');
-  text = text.replace(/\bnpm_[A-Za-z0-9._-]+/g, '[redacted]');
-  text = text.replace(/\bgh(?:p|o|u|s|r)_[A-Za-z0-9._-]+/g, '[redacted]');
-  text = text.replace(/\bsk-[A-Za-z0-9._-]+/g, '[redacted]');
+// A PEM block is one value from its BEGIN line through its END line, when it is shaped like
+// one: BEGIN ends its line and every line up to END is base64, blank, or a Proc-Type/DEK-Info
+// header. Anything else between the markers (commands) is not swallowed.
+const PEM_BEGIN_RE = /-----BEGIN [A-Z0-9 ]{1,64}-----[ \t]*\r?\n/y;
+const PEM_BODY_LINE_RE = /^(?:[A-Za-z0-9+/=]{0,128}|(?:Proc-Type|DEK-Info):[ -~]{0,128})[ \t]*\r?$/;
+const PEM_END_LINE_RE = /^-----END [A-Z0-9 ]{1,64}-----/;
+function pemEnd(text, start, limit) {
+  if (!aheadAt(PEM_BEGIN_RE, text, start)) return -1;
+  let lineStart = PEM_BEGIN_RE.lastIndex;
+  // Key data lines are long (64 base64 characters); only the last may be short, so a command
+  // word between two markers is not taken for key data.
+  let longLines = 0;
+  let shortLines = 0;
+  while (lineStart < limit) {
+    const newline = text.indexOf('\n', lineStart);
+    const lineEnd = newline === -1 || newline > limit ? limit : newline;
+    const line = text.slice(lineStart, Math.min(lineEnd, lineStart + 200));
+    const end = PEM_END_LINE_RE.exec(line);
+    if (end) return longLines > 0 && shortLines <= 1 ? lineStart + end[0].length : -1;
+    if (lineEnd - lineStart > 200 || !PEM_BODY_LINE_RE.test(line)) return -1;
+    const data = /^[A-Za-z0-9+/=]+/.exec(line.trim());
+    if (data && !/^(?:Proc-Type|DEK-Info):/.test(line)) {
+      if (shortLines > 0) return -1;
+      if (data[0].length >= 40) longLines += 1;
+      else shortLines += 1;
+    }
+    lineStart = lineEnd + 1;
+  }
+  return -1;
+}
+
+// In an argv word, a value continues on the next line only when that line is key data (16 to
+// 128 base64 characters, = padding included) and does not start a new setting (`name: ...`,
+// `- name: ...`, `name=value`). A line that holds a command or a sentence ends it.
+const NEXT_LINE_SETTING_RE = /[ \t]*(?:-[ \t]+)?(?:[A-Za-z_][A-Za-z0-9_.-]*[ \t]*:(?=[ \t\r\n]|$)|[A-Za-z_][A-Za-z0-9_.-]*=(?=[^=\r\n]))/y;
+const NEXT_LINE_CONTINUES_RE = /[A-Za-z0-9+/=]{16,128}[ \t]*(?:\r?\n|$)/y;
+
+// Where a value starting at `start` ends, scanning no further than `limit` (the closing quote
+// when the value starts inside quotes).
+// `field` is true where a value is one field of a list (a URL query, an HTTP client's form or
+// header argument, a field inside a longer word): there it also ends before another `name=` after
+// & , #. In a whole-word NAME=value it does not, so a secret holding `&x=` stays hidden.
+function valueEnd(text, start, mode, regions, limit = text.length, field = true) {
+  // In a script, a key block counts only inside quotes (limit is then the closing quote).
+  const pem = mode === 'script' && limit === text.length ? -1 : pemEnd(text, start, limit);
+  if (pem !== -1) return pem;
+  let index = start;
+  while (index < limit) {
+    const char = text[index];
+    const next = index + 1;
+    if (mode === 'word') {
+      if (char === '\n' || char === '\r') {
+        if (char === '\r' && text[next] === '\n') {
+          index = next;
+          continue;
+        }
+        if (next >= limit || aheadAt(NEXT_LINE_SETTING_RE, text, next) || !aheadAt(NEXT_LINE_CONTINUES_RE, text, next)) break;
+        index = next;
+        continue;
+      }
+      if (field && /[\s&,#;|]/.test(char) && aheadAt(NAME_ASSIGNMENT_AHEAD, text, next)) break;
+      // A JSON string list of commands (["export TOKEN=...","rm -rf x"]): the secret ends with its string.
+      if ((char === '"' || char === "'") && /[,\]}]/.test(text[next] || '')) break;
+      index = next;
+      continue;
+    }
+    if (/\s/.test(char)) break;
+    if (char === "'" || char === '"') {
+      const region = regions.opening(index);
+      index = region && region[1] < limit ? region[1] + 1 : next;
+      continue;
+    }
+    if (char === '\\' && next < limit && text[next] !== '\n') {
+      index = next + 1;
+      continue;
+    }
+    // Command substitution is never part of a literal secret.
+    if (char === '`' || (char === '$' && text[next] === '(')) break;
+    if (char === ';' || char === '|' || char === '&') {
+      if (mode === 'script') break;
+      if (char !== ';' && text[next] === char) break;
+      if (next >= limit || /\s/.test(text[next])) break;
+      if ((char !== '&' || field) && aheadAt(NAME_ASSIGNMENT_AHEAD, text, next)) break;
+      if (char !== '&' && COMMAND_START.test(text[next])) break;
+    }
+    if (field && (char === '#' || char === ',') && aheadAt(NAME_ASSIGNMENT_AHEAD, text, next)) break;
+    index = next;
+  }
+  return index;
+}
+
+// Whether the value at `start` is one field of a list: inside a URL (a ? or :// earlier in the
+// same word), or the unquoted form or header argument of an HTTP client.
+function fieldValue(text, start, regions) {
+  let wordStart = start;
+  const floor = Math.max(0, start - 512);
+  while (wordStart > floor && !/[\s'"]/.test(text[wordStart - 1])) wordStart -= 1;
+  const before = text.slice(wordStart, start);
+  if (/[?]|:\/\//.test(before)) return true;
+  if (!FIELD_ARGUMENT_RE.test(text.slice(Math.max(0, wordStart - 24), wordStart))) return false;
+  const commandStart = regions.commandStart(wordStart);
+  return HTTP_CLIENT_COMMAND_RE.test(text.slice(commandStart, Math.min(wordStart, commandStart + 256)));
+}
+
+// A value that starts inside a quoted region follows the same rules inside the quotes (a quoted
+// script `ssh host 'TOKEN=S; rm -rf /data'` keeps its commands visible); reaching the closing
+// quote, it runs on through anything glued after it.
+const FIELD_ARGUMENT_RE = /(?:^|\s)(?:-d|-H|-F|--data(?:-raw|-binary|-urlencode|-ascii)?|--json|--form(?:-string)?|--header)(?:\s+|=)$/;
+const HTTP_CLIENT_COMMAND_RE = /^\s*(?:(?:sudo|env|command|exec|time|nice|nohup)(?:\s+-[A-Za-z-]+)*\s+|[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:\S*\/)?(?:curl|wget|http|https|xh)\s/;
+// Whether the quoted region at `open` is a field or header argument of an HTTP client: the
+// simple command it belongs to (back to the last unquoted ; | & ( or line break) starts with
+// curl, wget, http, https or xh. `watch -d` or `tmux new -d` run their payload instead.
+function httpFieldArgument(text, open, regions) {
+  if (!FIELD_ARGUMENT_RE.test(text.slice(Math.max(0, open - 24), open))) return false;
+  const start = regions.commandStart(open);
+  return HTTP_CLIENT_COMMAND_RE.test(text.slice(start, Math.min(open, start + 256)));
+}
+const HEADER_LIST_AHEAD = /,\s*[A-Za-z_][A-Za-z0-9_.-]*\s*:/y;
+function quotedValueEnd(text, start, region, mode, regions) {
+  // The quoted argument of -d/--data/--json/-F/--form/-H/--header is one field or header: its
+  // value runs to the closing quote (spaces included), or to the next field or header in it.
+  let end = region[1];
+  if (httpFieldArgument(text, region[0], regions)) {
+    for (let index = start; index < region[1]; index += 1) {
+      if ((/[\s&,#;|]/.test(text[index]) && aheadAt(NAME_ASSIGNMENT_AHEAD, text, index + 1))
+        || (text[index] === ',' && aheadAt(HEADER_LIST_AHEAD, text, index))) {
+        end = index;
+        break;
+      }
+    }
+  } else end = valueEnd(text, start, mode, regions, region[1], true);
+  if (end < region[1]) return end;
+  const after = region[1] + 1;
+  if (after < text.length && !/[\s;|&)]/.test(text[after])) return valueEnd(text, after, mode, regions);
+  return region[1];
+}
+
+// A YAML block scalar (`password: |` or `>`): the more-indented lines after it are the value.
+const YAML_BLOCK_RE = /[|>][-+0-9]{0,3}[ \t]*(?=\r?\n)/y;
+function yamlBlockEnd(text, keyIndex, start) {
+  if (!aheadAt(YAML_BLOCK_RE, text, start)) return -1;
+  const lineStart = text.lastIndexOf('\n', keyIndex) + 1;
+  const keyIndent = /^[ \t]*/.exec(text.slice(lineStart, lineStart + 256))[0].length;
+  let end = text.indexOf('\n', start);
+  while (end !== -1 && end < text.length) {
+    const lineEnd = text.indexOf('\n', end + 1) === -1 ? text.length : text.indexOf('\n', end + 1);
+    const line = text.slice(end + 1, lineEnd);
+    const indent = /^[ \t]*/.exec(line)[0].length;
+    if (line.trim() && indent <= keyIndent) break;
+    end = lineEnd === text.length ? text.length : lineEnd;
+    if (lineEnd === text.length) break;
+  }
+  return end === -1 ? -1 : end;
+}
+
+// A JSON value after a quoted name: a string, or an object or array (all of it), or a bare
+// literal.
+function jsonValueEnd(text, start) {
+  const open = text[start];
+  if (open === '{' || open === '[') {
+    let depth = 0;
+    let index = start;
+    while (index < text.length) {
+      const char = text[index];
+      if (char === '"') {
+        index += 1;
+        while (index < text.length && text[index] !== '"') index += text[index] === '\\' ? 2 : 1;
+      } else if (char === '{' || char === '[') depth += 1;
+      else if (char === '}' || char === ']') {
+        depth -= 1;
+        if (depth === 0) return index + 1;
+      }
+      index += 1;
+    }
+    return text.length;
+  }
+  let index = start;
+  while (index < text.length && !/[\s,}\]]/.test(text[index])) index += 1;
+  return index;
+}
+
+// The value at `start`: its end and its redacted form, or null when there is nothing to redact.
+const ESCAPED_QUOTED_RE = /\\"((?:[^"\\]|\\[^"])*)\\"/y;
+const DOUBLE_QUOTED_RE = /"((?:[^"\\]|\\.)*)"/y;
+const SINGLE_QUOTED_RE = /'([^']*)'/y;
+function secretValueAt(text, start, mode, regions, jsonName = false, wholeWord = false) {
+  if (start >= text.length) return null;
+  const sticky = (pattern, open) => {
+    pattern.lastIndex = start;
+    const match = pattern.exec(text);
+    return match ? { end: start + match[0].length, value: match[1], replacement: `${open}${hiddenAs(match[1])}${open}` } : null;
+  };
+  let found = null;
+  if (text.startsWith('\\"', start)) found = sticky(ESCAPED_QUOTED_RE, '\\"');
+  else if (jsonName && text[start] === '"') found = sticky(DOUBLE_QUOTED_RE, '"');
+  else if (jsonName && text[start] === "'") found = sticky(SINGLE_QUOTED_RE, "'");
+  else if (jsonName) {
+    const end = jsonValueEnd(text, start);
+    found = { end, value: text.slice(start, end), replacement: hiddenAs(text.slice(start, end)) };
+  }
+  if (!found) {
+    const around = mode === 'word' ? null : regions.around(start);
+    let end;
+    if (around) end = quotedValueEnd(text, start, around, mode, regions);
+    else if (mode === 'word' && wholeWord) end = text.length;
+    else end = valueEnd(text, start, mode, regions, text.length, mode === 'word' ? true : !wholeWord || fieldValue(text, start, regions));
+    const value = text.slice(start, end);
+    // One quoted piece keeps its quotes; anything else is replaced whole. A value that may also
+    // hide command text or a separator becomes the ambiguous marker.
+    const piece = !around && mode !== 'word' ? regions.opening(start) : null;
+    const single = Boolean(piece) && piece[1] + 1 === end;
+    const inner = single ? value.slice(1, -1) : value;
+    found = { end, value: inner, replacement: single ? `${value[0]}${hiddenAs(inner)}${value[0]}` : hiddenAs(value) };
+  }
+  if (!found.value || MARKERS.has(found.value) || (mode !== 'word' && REFERENCE_RE.test(found.value))) return null;
+  return found;
+}
+
+// `name: value` with a plain word mid-sentence ("rotate the key: production first") is prose;
+// a `host:port` or `name:/path` is not a credential. JSON, headers ("apikey: ..."), YAML lines
+// (indented too) and env-style names are credentials.
+function credentialColon(text, index, lead, quote, name, valueStart, lineIsBlankBefore) {
+  if (text[valueStart] === '/' || (lead === '/' && text[index - 1] === '/')) return false;
+  if (name.includes('.') && /^\d+(?:[/?#]|$)/.test(text.slice(valueStart, valueStart + 12))) return false;
+  if (quote || lead === '' || /[\n{[,"'=]/.test(lead)) return true;
+  if (/[ \t]/.test(lead) && lineIsBlankBefore(index + 1)) return true;
+  return !/^(?:[a-z]+|[A-Z][a-z]+)$/.test(name);
+}
+
+// Whether only blanks (and a YAML list dash) come before a position on its line. Positions are
+// asked in increasing order, so the scan is linear.
+function blankLineTracker(text) {
+  let at = 0;
+  let blank = true;
+  return (position) => {
+    for (; at < position; at += 1) {
+      const char = text[at];
+      if (char === '\n') blank = true;
+      else if (char !== ' ' && char !== '\t' && char !== '-') blank = false;
+    }
+    return blank;
+  };
+}
+
+const AUTH_SCHEME_RE = /^(?:bearer|basic|token|digest|bot|apikey|negotiate)$/i;
+const ASSIGNMENT_PREFIX_SOURCE = '(^|[^A-Za-z0-9_.-])(\\\\?["\']?)([A-Za-z0-9_.-]+)\\2(\\s*[:=]\\s*)';
+// A whole-word NAME=value (the name starts its word, or follows --env= or --build-arg=) whose
+// value runs to the end of the word, unless the word is a field list (`field`).
+const WHOLE_WORD_PREFIX_RE = /^(?:-{1,2}(?:env|build-arg|e)=)?$/;
+function redactAssignments(text, mode, field = false) {
+  const pattern = new RegExp(ASSIGNMENT_PREFIX_SOURCE, 'g');
+  const regions = regionFinder(quoteRegions(text, mode), text);
+  const lineIsBlankBefore = blankLineTracker(text);
+  let out = '';
+  let last = 0;
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    const [whole, lead, quote, name, separator] = match;
+    const valueStart = match.index + whole.length;
+    const colon = !separator.includes('=');
+    let value = null;
+    if (credentialName(name)
+      && !(colon && !quote && /authorization$/i.test(name)) // the header pass did these
+      && !(colon && !credentialColon(text, match.index, lead, quote, name, valueStart, lineIsBlankBefore))) {
+      const block = colon && (mode !== 'script' || regions.around(valueStart)) ? yamlBlockEnd(text, match.index, valueStart) : -1;
+      const nameStart = match.index + lead.length + quote.length;
+      let wholeWord = false;
+      if (!colon && !quote && !field) {
+        if (mode === 'word') wholeWord = WHOLE_WORD_PREFIX_RE.test(text.slice(0, nameStart));
+        else {
+          // In free text and scripts: the name starts its word.
+          wholeWord = nameStart === 0 || /[\s'"]/.test(text[nameStart - 1]);
+        }
+      }
+      value = block !== -1
+        ? { end: block, value: text.slice(valueStart, block), replacement: `${text[valueStart]} ${AMBIGUOUS}` }
+        : secretValueAt(text, valueStart, mode, regions, Boolean(quote) && colon, wholeWord);
+      // `X-Token: Bearer [redacted]`: the scheme pass did this one.
+      if (value && AUTH_SCHEME_RE.test(value.value) && /^ \[(?:redacted|REDACTED_AMBIGUOUS)\]/.test(text.slice(value.end, value.end + 24))) value = null;
+    }
+    if (!value) {
+      // Scan again from the next character: a rejected match must not hide a secret inside it.
+      pattern.lastIndex = match.index + 1;
+      continue;
+    }
+    out += `${text.slice(last, valueStart)}${value.replacement}`;
+    last = value.end;
+    pattern.lastIndex = value.end;
+  }
+  return out + text.slice(last);
+}
+
+// A prefix (a header, a flag, `config set NAME`) followed by a secret value.
+function redactAfter(text, pattern, mode, accept = () => true) {
+  const regions = regionFinder(quoteRegions(text, mode), text);
+  let out = '';
+  let last = 0;
+  let match;
+  pattern.lastIndex = 0;
+  while ((match = pattern.exec(text)) !== null) {
+    const valueStart = match.index + match[0].length;
+    const value = accept(match, valueStart, text) ? secretValueAt(text, valueStart, mode, regions) : null;
+    if (!value) {
+      // Scan again from the next character: a rejected match must not hide the next one.
+      pattern.lastIndex = match.index + 1;
+      continue;
+    }
+    out += `${text.slice(last, valueStart)}${value.replacement}`;
+    last = value.end;
+    pattern.lastIndex = value.end;
+  }
+  return out + text.slice(last);
+}
+
+const AUTH_HEADER_RE = /\b(?:proxy-)?authorization\s*:(?!\s*digest\s)\s*(?:(?:bearer|basic|token|bot|apikey|negotiate)\s+)?/gi;
+// Digest credentials (username, nonce, response...) are one value, to the end of the header.
+const DIGEST_HEADER_RE = /\b(?:proxy-)?authorization\s*:\s*digest\s+/gi;
+const SECRET_FLAG_TEXT_RE = /(?<!\S)(--[A-Za-z][A-Za-z0-9_-]*)\s+/g;
+const CONFIG_SET_RE = /\b(?:config|configure)\s+set\s+(\S+)\s+/g;
+const OPENSSL_PASS_RE = /(?<!\S)-pass(?:in|out)?\s+pass:/g;
+// -u user:password for HTTP clients (docker run -u 1000:0 is a user and group, not a secret).
+const USER_FLAG_RE = /(?<![^\s;|&(])(?:curl|wget|http|https|xh|ab)(?=\s)[^\n;|&]{0,240}?\s(?:-u|--user)\s+[^\s:'"]+:/g;
+const HTTP_CLIENTS = ['curl', 'wget', 'http', 'https', 'xh', 'ab'];
+// A plain switch (true, off) under a credential-looking name is not a secret; a number may be.
+const PLAIN_SETTING_RE = /(?:true|false|yes|no|on|off)(?=\s|$)/iy;
+// A word after a secret flag that starts with a dash is a secret only when it looks like one.
+const WORD_AT_RE = /\S{1,512}/y;
+const wordAt = (text, index) => {
+  WORD_AT_RE.lastIndex = index;
+  const match = WORD_AT_RE.exec(text);
+  return match ? match[0] : '';
+};
+const looksSecret = (word) => word.length >= 16 && /[0-9]/.test(word) && /[A-Za-z]/.test(word) && !/^--?[a-z][a-z0-9-]*(?:=|$)/.test(word);
+// Short flags that take a secret in particular tools: docker/podman login -p, redis-cli -a,
+// sshpass -p, gh secret set --body/-b, and mysql's glued -pPASSWORD.
+const TOOL_SECRET_FLAGS = [
+  [['docker', 'podman', 'nerdctl'], 'login', '-p'],
+  [['redis-cli'], null, '-a'],
+  [['sshpass'], null, '-p'],
+  [['gh'], 'secret', '--body'],
+  [['gh'], 'secret', '-b'],
+];
+const MYSQL_CLIENTS = ['mysql', 'mysqladmin', 'mysqldump'];
+const TOOL_FLAG_TEXT_RE = /\b(?:(?:docker|podman|nerdctl)\s+login\b[^\n;|&]{0,240}?\s-p|redis-cli\b[^\n;|&]{0,240}?\s-a|sshpass\b[^\n;|&]{0,240}?\s-p|gh\s+secret\s+set\b[^\n;|&]{0,240}?\s(?:--body|-b))\s+/g;
+const MYSQL_GLUED_RE = /\b(?:mysql|mysqladmin|mysqldump)\b[^\n;|&]{0,240}?\s-p(?=[^\s-])/g;
+const BARE_SCHEME_RE = /\b(bearer|basic)(\s+)([^\s'"]{8,})/gi;
+// Linear: the scheme cannot start inside a longer run of scheme characters.
+const URL_USERINFO_RE = /(?<![A-Za-z0-9+.-])([A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/)([^\s'"/?#@:]+)(?::([^\s'"/?#]*))?@/g;
+const TOKEN_SHAPES = [
+  /\bmrw_(?:live|test)_[A-Za-z0-9._-]+/g,
+  /\bnpm_[A-Za-z0-9._-]+/g,
+  /\bgh(?:p|o|u|s|r)_[A-Za-z0-9._-]+/g,
+  /\bgithub_pat_[A-Za-z0-9._-]+/g,
+  /\bglpat-[A-Za-z0-9._-]+/g,
+  /\bsk-[A-Za-z0-9._-]+/g,
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]+/g,
+  /\bwhsec_[A-Za-z0-9]+/g,
+  /\bxox[abposr]-[A-Za-z0-9._-]+/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g,
+];
+
+function redactDigest(text, mode) {
+  const regions = regionFinder(quoteRegions(text, mode), text);
+  let out = '';
+  let last = 0;
+  let match;
+  DIGEST_HEADER_RE.lastIndex = 0;
+  while ((match = DIGEST_HEADER_RE.exec(text)) !== null) {
+    const valueStart = match.index + match[0].length;
+    const around = mode === 'word' ? null : regions.around(valueStart);
+    const newline = text.indexOf('\n', valueStart);
+    const lineEnd = newline === -1 ? text.length : newline;
+    let end = around ? Math.min(around[1], lineEnd) : lineEnd;
+    if (!around && mode !== 'word') {
+      // Unquoted: up to a shell operator outside the header's own quoted parameters.
+      let quoted = false;
+      for (let index = valueStart; index < end; index += 1) {
+        const char = text[index];
+        if (char === '"') quoted = !quoted;
+        else if (!quoted && (char === ';' || char === '|' || (char === '&' && text[index + 1] === '&'))) {
+          end = index;
+          while (end > valueStart && /\s/.test(text[end - 1])) end -= 1;
+          break;
+        }
+      }
+    }
+    if (end <= valueStart || MARKERS.has(text.slice(valueStart, end))) continue;
+    out += `${text.slice(last, valueStart)}${hiddenAs(text.slice(valueStart, end))}`;
+    last = end;
+    DIGEST_HEADER_RE.lastIndex = end;
+  }
+  return out + text.slice(last);
+}
+
+function redact(value, mode = 'text', { field = false } = {}) {
+  // No control sequence may hide a credential name (TO<ESC>[0mKEN=...), and none is sent.
+  let text = stripControls(String(value || ''));
+  text = redactDigest(text, mode);
+  text = redactAfter(text, AUTH_HEADER_RE, mode);
+  // Basic credentials are base64 with a digit, + / or = in practice; a plain word is prose.
+  text = text.replace(BARE_SCHEME_RE, (match, scheme, space, credential) => {
+    const prose = /^basic$/i.test(scheme) && !(/^[A-Za-z0-9+/]+={0,2}$/.test(credential) && /[0-9+/=]/.test(credential));
+    return MARKERS.has(credential) || prose ? match : `${scheme}${space}${hiddenAs(credential)}`;
+  });
+  text = text.replace(URL_USERINFO_RE, (match, scheme, user, password) => {
+    if (password !== undefined) return password && !MARKERS.has(password) ? `${scheme}${user}:${hiddenAs(password)}@` : match;
+    // A user with no password is a name (git@, deploy@) unless it is token-like.
+    return user.length >= 20 && /[0-9]/.test(user) && !MARKERS.has(user) ? `${scheme}${hiddenAs(user)}@` : match;
+  });
+  text = redactAfter(text, SECRET_FLAG_TEXT_RE, mode, (match, at, source) => secretFlag(match[1])
+    && (source[at] !== '-' || looksSecret(wordAt(source, at))));
+  text = redactAfter(text, CONFIG_SET_RE, mode, (match, at, source) => credentialName(String(match[1]).split(/[:/]/).pop())
+    && !aheadAt(PLAIN_SETTING_RE, source, at));
+  text = redactAfter(text, OPENSSL_PASS_RE, mode);
+  text = redactAfter(text, USER_FLAG_RE, mode);
+  text = redactAfter(text, TOOL_FLAG_TEXT_RE, mode);
+  text = redactAfter(text, MYSQL_GLUED_RE, mode);
+  text = redactAssignments(text, mode, field);
+  for (const shape of TOKEN_SHAPES) text = text.replace(shape, REDACTED);
   return text;
 }
 
@@ -171,8 +755,136 @@ function shellQuote(value) {
   return /^[A-Za-z0-9_./:@%+=,-]+$/.test(text) ? text : `'${text.replace(/'/g, "'\\''")}'`;
 }
 
+// Which argv words are shell scripts: the word after a -c flag (-c, -lc, -ec) of a shell or
+// su, the words after eval or watch, a remote command after ssh, and any word that holds a
+// command line (a space and a shell operator or substitution; a line break alone is a value's).
+const SHELL_NAMES = new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'ash', 'mksh', 'fish', 'su', 'runuser']);
+const COMMAND_LINE_RE = /\s/;
+const SHELL_SYNTAX_RE = /[;|`]|&&|\$\(/;
+const ASSIGNMENT_WORD_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const ENV_FLAG_WORDS = new Set(['-e', '--env', '--build-arg', '--set-env-vars']);
+function argvModes(words, names) {
+  let sawSsh = false;
+  let envAssignments = false;
+  return words.map((word, index) => {
+    // An environment setting (after env, -e, --env, --build-arg) is one value, whatever it holds.
+    const setting = ASSIGNMENT_WORD_RE.test(word) && (envAssignments || (index > 0 && ENV_FLAG_WORDS.has(words[index - 1])));
+    if (names[index] === 'env') envAssignments = true;
+    else if (!ASSIGNMENT_WORD_RE.test(word) && !word.startsWith('-')) envAssignments = false;
+    if (setting) return 'word';
+    let mode = 'word';
+    if (index >= 2 && /^-[A-Za-z]*c[A-Za-z]*$/.test(words[index - 1])) {
+      // Back over the shell's own flags (at most 16) to the shell.
+      for (let at = index - 2, steps = 0; at >= 0 && steps < 16; at -= 1, steps += 1) {
+        if (SHELL_NAMES.has(names[at])) {
+          mode = 'script';
+          break;
+        }
+        if (!words[at].startsWith('-')) break;
+      }
+    }
+    if (index >= 1 && (names[index - 1] === 'eval' || names[index - 1] === 'watch')) mode = 'script';
+    if (COMMAND_LINE_RE.test(word) && (sawSsh || SHELL_SYNTAX_RE.test(word))) mode = 'script';
+    if (names[index] === 'ssh') sawSsh = true;
+    return mode;
+  });
+}
+
+// One argv word, redacted, given the words before it (`seen` holds the names of the words
+// before the previous one).
+function redactArgvWord(words, names, index, seen, mode) {
+  const previous = index > 0 ? words[index - 1] : '';
+  const word = words[index];
+  if (secretFlag(previous) && (!word.startsWith('-') || looksSecret(word))) return hiddenAs(word);
+  // -u user:password for HTTP clients: the name stays.
+  if ((previous === '-u' || previous === '--user') && HTTP_CLIENTS.some((name) => seen.has(name)) && /^[^:]+:./.test(word)) {
+    return shellQuote(`${word.split(':')[0]}:${hiddenAs(word.slice(word.indexOf(':') + 1))}`);
+  }
+  if ((previous === '-passin' || previous === '-passout' || previous === '-pass') && word.startsWith('pass:')) return shellQuote(`pass:${hiddenAs(word.slice(5))}`);
+  if (TOOL_SECRET_FLAGS.some(([tools, verb, flag]) => previous === flag && tools.some((name) => seen.has(name)) && (!verb || seen.has(verb)))) return hiddenAs(word);
+  if (/^-p[^\s-]/.test(word) && MYSQL_CLIENTS.some((name) => seen.has(name) || names[index - 1] === name)) return `-p${hiddenAs(word.slice(2))}`;
+  if (index >= 3 && words[index - 2] === 'set' && /^(?:config|configure)$/.test(words[index - 3])
+    && credentialName(previous.split(/[:/]/).pop()) && !aheadAt(PLAIN_SETTING_RE, word, 0)) return hiddenAs(word);
+  // The form or header argument of an HTTP client is a field list: its fields stay apart.
+  const field = mode === 'word' && FIELD_ARGUMENT_RE.test(` ${previous} `) && HTTP_CLIENTS.some((name) => seen.has(name));
+  return shellQuote(redact(word, mode, { field }));
+}
+
 function redactedCommand(command) {
-  return command.map((part) => shellQuote(redact(part))).join(' ');
+  const words = command.map((part) => String(part ?? ''));
+  const names = words.map((word) => word.split('/').pop());
+  const modes = argvModes(words, names);
+  const seen = new Set();
+  const out = [];
+  for (let index = 0; index < words.length; index += 1) {
+    if (index >= 2) seen.add(names[index - 2]);
+    out.push(redactArgvWord(words, names, index, seen, modes[index]));
+  }
+  return out.join(' ');
+}
+
+// --action, --target and --type exactly as typed stay in this process: for local risk
+// classification and the local hold key. Every request and every printed line uses the
+// redacted values that replace them on the options.
+const RAW_INPUTS = Symbol('marrow raw inputs');
+function withRedactedInputs(options) {
+  const raw = {
+    action: typeof options.action === 'string' ? options.action : '',
+    target: typeof options.target === 'string' ? options.target : '',
+    type: typeof options.type === 'string' ? options.type : '',
+  };
+  const secured = {
+    ...options,
+    action: raw.action ? redact(raw.action) : options.action,
+    target: raw.target ? redact(raw.target) : options.target,
+    type: raw.type ? redact(raw.type) : options.type,
+  };
+  Object.defineProperty(secured, RAW_INPUTS, { value: raw, enumerable: false });
+  return secured;
+}
+
+function rawInputs(options) {
+  if (options && options[RAW_INPUTS]) return options[RAW_INPUTS];
+  return { action: String(options?.action || ''), target: String(options?.target || ''), type: String(options?.type || '') };
+}
+
+// Of two inferred types, the one that is protected; if both or neither are, the first (the type
+// of the command as typed, so a DROP behind a secret stays migration, not security).
+function stricterType(first, second) {
+  if (PROTECTED_ACTION_TYPES.has(first) || !PROTECTED_ACTION_TYPES.has(second)) return first;
+  return second;
+}
+
+// One governed action: the redacted text that may leave this machine, and a risk verdict that
+// is never looser than the command as typed. `surfacesFrom` keeps each command's surface
+// source: run uses the command, permit and verify-permit the target, gate the action.
+function governedInputs(options, childCommand = null, surfacesFrom = 'command') {
+  const raw = rawInputs(options);
+  const rawCommand = Array.isArray(childCommand) ? childCommand.map(String).join(' ') : '';
+  const commandText = Array.isArray(childCommand) ? redactedCommand(childCommand) : '';
+  // Redacted again in case options did not come through parseArgs (redaction is idempotent).
+  const action = options.action ? redact(options.action) : commandText;
+  const sentTarget = options.target ? redact(options.target) : '';
+  const target = sentTarget || commandText || action;
+  const rawAction = raw.action || rawCommand;
+  const rawRisk = `${rawAction} ${rawCommand} ${raw.target}`;
+  const redactedRisk = `${action} ${commandText} ${sentTarget}`;
+  const type = options.type ? redact(options.type) : stricterType(inferType(rawRisk), inferType(redactedRisk));
+  const risky = isRisky(redactedRisk, type) || isRisky(rawRisk, type);
+  let surfaceText = [commandText || action, rawCommand || rawAction];
+  if (surfacesFrom === 'target') surfaceText = [sentTarget || action, raw.target || rawAction];
+  else if (surfacesFrom === 'action') surfaceText = [action, rawAction];
+  // Surfaces are fixed labels, so the raw text can add some without anything raw leaving.
+  const surfaces = inferSurfaces(surfaceText.join(' '));
+  // Marrow decides whether an approval may be reused from the action text alone: an ambiguous
+  // hidden value in the target or the type is carried into the action, so it is never bound.
+  const sentAction = (target.includes(AMBIGUOUS) || String(type).includes(AMBIGUOUS)) && !action.includes(AMBIGUOUS)
+    ? `${action} ${AMBIGUOUS}` : action;
+  return {
+    commandText, action: sentAction, target, type, risky, surfaces,
+    // Local only, for the hold key: the command and inputs exactly as typed.
+    holdMaterial: { argv: Array.isArray(childCommand) ? childCommand.map(String) : [], action: raw.action, target: raw.target, type: raw.type },
+  };
 }
 
 function isProtectedCommand(text) {
@@ -218,13 +930,18 @@ function sourceClient(value) {
 }
 
 function displayText(value, maxLength = 120) {
-  const text = redact(String(value || ''))
-    .replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, '')
-    .replace(/\u009d[^\u0007\u009c]*(?:\u0007|\u009c|\u001b\\)/g, '')
+  // redact() drops control sequences first, so one cannot split a credential name.
+  const text = redact(String(value || '')).replace(/[\t\r\n]+/g, ' ');
+  return text.length > maxLength ? `${text.slice(0, maxLength - 3)}...` : text;
+}
+
+// Terminal control sequences and control characters (tabs and line breaks stay).
+function stripControls(value) {
+  return value
+    .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, '')
+    .replace(/\u009d[^\u0007\u009c\u009d\u001b]*(?:\u0007|\u009c|\u001b\\)/g, '')
     .replace(/[\u001b\u009b][[\]()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g, '')
-    .replace(/[\t\r\n]+/g, ' ')
     .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g, '');
-  return text.length > maxLength ? `${text.slice(0, maxLength - 3)}...` : text;
 }
 
 function shellQuoteDisplay(value) {
@@ -354,7 +1071,9 @@ function isRisky(text, type) {
 
 function parseBaseOptions(argv, startIndex = 0) {
   const options = {
-    apiKey: process.env.MARROW_API_KEY || process.env.MARROW_KEY || '',
+    // The key from this terminal, or the owner-only ~/.marrow/env the installer stores, so a run
+    // started from an agent opened outside the install terminal still finds it.
+    apiKey: process.env.MARROW_API_KEY || process.env.MARROW_KEY || ownerEnvApiKey(),
     baseUrl: process.env.MARROW_BASE_URL || DEFAULT_BASE_URL,
     // A local username is never a registered agent. With no configured id, the server
     // resolves the key-bound agent or the plan seat instead.
@@ -365,7 +1084,11 @@ function parseBaseOptions(argv, startIndex = 0) {
     failOpen: process.env.MARROW_FAIL_OPEN === 'true',
     failClosed: process.env.MARROW_FAIL_CLOSED === 'true',
     json: false,
-    ownerApproval: '',
+    // --owner-approved is accepted and ignored: an approval is what Marrow records, never a
+    // reference the caller supplies.
+    ownerApprovedFlagIgnored: false,
+    requestOwnerLink: false,
+    approvalWaitSeconds: null,
     proofFile: '',
     type: '',
     action: '',
@@ -395,7 +1118,16 @@ function parseBaseOptions(argv, startIndex = 0) {
     } else if (arg === '--fail-closed') {
       options.failClosed = true;
       options.failOpen = false;
-    } else if (arg === '--owner-approved') options.ownerApproval = argv[++i] || options.ownerApproval;
+    } else if (arg === '--owner-approved') {
+      // Its value is read and dropped; it never reaches Marrow, proof or a permit.
+      if (argv[i + 1] !== undefined && !String(argv[i + 1]).startsWith('--')) i += 1;
+      options.ownerApprovedFlagIgnored = true;
+    } else if (arg === '--request-owner-link') options.requestOwnerLink = true;
+    else if (arg === '--approval-wait') {
+      const value = Number(argv[++i]);
+      if (!Number.isInteger(value) || value < 0 || value > 3600) throw new Error('--approval-wait must be a whole number of seconds from 0 to 3600');
+      options.approvalWaitSeconds = value;
+    }
     else if (arg === '--permit') options.permit = argv[++i] || options.permit;
     else if (arg === '--target') options.target = argv[++i] || options.target;
     else if (arg === '--sidecar-port') options.sidecarPort = argv[++i] || options.sidecarPort;
@@ -412,13 +1144,16 @@ function parseBaseOptions(argv, startIndex = 0) {
     else if (arg === '--interactive') options.interactive = true;
     else if (arg === '--no-interactive') options.interactive = false;
     else if (arg === '--help' || arg === '-h') options.help = true;
-    else if (arg.startsWith('--')) throw new Error(`Unknown option: ${arg}`);
+    else if (arg.startsWith('--')) throw new Error(`Unknown option: ${argumentLabel(arg)}`);
     else break;
   }
   if (!['enforce', 'warn', 'audit'].includes(options.policy)) {
     throw new Error('--policy must be enforce, warn, or audit');
   }
-  if (!options.sessionId) options.sessionId = nowId('marrow-run');
+  if (!options.sessionId) {
+    options.sessionId = defaultRunnerSession(options);
+    options.sessionDefaulted = true;
+  }
   return { options, index: i };
 }
 
@@ -435,7 +1170,7 @@ function parseArgs(argv) {
     if (childCommand[0] === '--') childCommand = childCommand.slice(1);
     if (parsed.options.help) return { command: 'help' };
     if (childCommand.length === 0) throw new Error('marrow run requires a command after --');
-    return { command, options: parsed.options, childCommand };
+    return { command, options: withRedactedInputs(parsed.options), childCommand };
   }
 
   if (command === 'gate') {
@@ -443,7 +1178,7 @@ function parseArgs(argv) {
     const action = parsed.options.action || argv.slice(parsed.index).join(' ');
     if (parsed.options.help) return { command: 'help' };
     if (!action) throw new Error('marrow gate requires an action string');
-    return { command, options: { ...parsed.options, action } };
+    return { command, options: withRedactedInputs({ ...parsed.options, action }) };
   }
 
   if (command === 'permit' || command === 'verify-permit') {
@@ -454,7 +1189,7 @@ function parseArgs(argv) {
     if (command === 'verify-permit' && !parsed.options.permit) {
       throw new Error('verify-permit requires MARROW_ACTION_PERMIT or --permit');
     }
-    return { command, options: { ...parsed.options, action } };
+    return { command, options: withRedactedInputs({ ...parsed.options, action }) };
   }
 
   if (command === 'proof') {
@@ -474,7 +1209,7 @@ function parseArgs(argv) {
     }
     const parsed = parseBaseOptions(baseArgv, 1);
     if (parsed.options.help) return { command: 'help' };
-    if (parsed.index < baseArgv.length) throw new Error(`Unknown proof option: ${baseArgv[parsed.index]}`);
+    if (parsed.index < baseArgv.length) throw new Error(`Unknown proof option: ${argumentLabel(baseArgv[parsed.index])}`);
     const options = { ...parsed.options, ...proofOptions };
     if (!options.decisionId) throw new Error('marrow proof requires --decision-id');
     return { command, options };
@@ -496,7 +1231,7 @@ function parseArgs(argv) {
     return { command, options: parsed.options };
   }
 
-  throw new Error(`Unknown command: ${command}`);
+  throw new Error(`Unknown command: ${argumentLabel(command)}`);
 }
 
 function headers(options) {
@@ -536,13 +1271,14 @@ function dataOf(json) {
   return json && typeof json === 'object' && json.data && typeof json.data === 'object' ? json.data : json;
 }
 
-async function rawRequest(options, method, route, body, extraHeaders = {}, { timeoutMs } = {}) {
-  if (!options.apiKey) throw new Error('MARROW_API_KEY is required. Use --fail-open only for non-production local commands.');
+async function rawRequest(options, method, route, body, extraHeaders = {}, { timeoutMs, signal } = {}) {
+  if (!options.apiKey) throw new Error(NO_KEY_TEXT);
+  const requestSignal = requestAbortSignal(timeoutMs, signal);
   const response = await fetch(new URL(route, options.baseUrl.replace(/\/$/, '/')), {
     method,
     headers: { ...headers(options), ...extraHeaders },
     body: body === undefined ? undefined : JSON.stringify(body),
-    ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
+    ...(requestSignal ? { signal: requestSignal } : {}),
   });
   const text = await response.text();
   let json = {};
@@ -550,6 +1286,17 @@ async function rawRequest(options, method, route, body, extraHeaders = {}, { tim
   return { response, json };
 }
 
+// The request's abort signal: its timeout, and an outside signal (a wait the operator stopped).
+function requestAbortSignal(timeoutMs, external) {
+  if (!external) return timeoutMs ? AbortSignal.timeout(timeoutMs) : undefined;
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  if (external.aborted) abort();
+  else external.addEventListener('abort', abort, { once: true });
+  if (timeoutMs) setTimeout(abort, timeoutMs).unref?.();
+  return controller.signal;
+}
+
 function responseError(route, response, json) {
   const error = new Error(json.error || json.message || `Marrow ${route} returned HTTP ${response.status}`);
   error.status = response.status;
@@ -683,14 +1430,23 @@ function defaultProof(input) {
     runner: '@getmarrow/install run',
     profile: input.options.profile,
     source_meta: sourceMeta(input.options, 'proof', { action: input.action }),
-    ...(input.options.ownerApproval ? { owner_approval: { approved_by: 'owner', reference: input.options.ownerApproval } } : {}),
-    ...proof,
+    ...withoutCallerApproval(proof),
   };
 }
 
-async function preflightRuntime(options, action, type, commandText) {
-  const target = options.target || commandText || action;
-  const surfaces = inferSurfaces(commandText || action);
+// A caller-written approval is not an approval: Marrow reads the approval it recorded for the
+// gate receipt. The runner never writes proof.owner_approval and drops one a proof file carries.
+function withoutCallerApproval(proof) {
+  if (!proof || typeof proof !== 'object' || Array.isArray(proof)) return {};
+  const { owner_approval: _ignored, ...rest } = proof;
+  return rest;
+}
+
+async function preflightRuntime(options, action, type, commandText, surfaceList = null) {
+  // Only redacted text is sent: action and commandText are redacted by the caller, and the
+  // target is redacted again here in case a caller passed options that were not.
+  const target = redact(options.target || '') || commandText || action;
+  const surfaces = Array.isArray(surfaceList) ? surfaceList : inferSurfaces(commandText || action);
   const meta = sourceMeta(options, 'runtime', { action, command: commandText, action_type: type });
   const project = detectProjectSignals(options.root || process.cwd());
   const body = {
@@ -829,27 +1585,1038 @@ function gateDecision(runtime) {
   };
 }
 
-function shouldBlock(decision, options) {
+function shouldBlock(decision, _options = {}) {
   // Marrow withheld authorization (allow:false, or an observation-only answer): blocked under
   // every plan mode and local policy.
   if (decision.observationOnly || decision.allow === false) return true;
-  if (options.policy === 'audit') return false;
-  // An advisory plan (enforced:false) never blocks locally; the runner shows the warning.
+  // Only Marrow makes a gate advisory (enforced:false); the runner then shows the warning and
+  // runs. A local --policy warn|audit (or MARROW_GOVERN_POLICY) never loosens a gate Marrow
+  // enforces: a block or a hold stops the command under every local policy, even when the
+  // gate reports allow:true for a hold.
   if (decision.enforced === false) return false;
   if (decision.decision === 'block') return true;
-  if (options.policy === 'warn') return false;
   const approvalRequired = decision.ownerApprovalRequired
     || decision.decision === 'review_required'
     || decision.decision === 'owner_approval_required'
     || decision.enforcementDecision === 'owner_approval_required';
-  return Boolean(approvalRequired && !options.ownerApproval);
+  return Boolean(approvalRequired);
 }
 
-function blockMessage(decision) {
+// The gate as the runner shows it: a hold's served next step (written for agents, with endpoint
+// paths, and for arbitration a dashboard receipt) is replaced by the runner's own text.
+function runnerGateDecision(runtime) {
+  const decision = gateDecision(runtime);
+  const hold = heldApproval(runtime, decision);
+  return hold ? { ...decision, exactNextAction: holdNextText(hold) } : decision;
+}
+
+function blockMessage(decision, hold = null) {
   if (decision.observationOnly) return 'Marrow answered in observation-only mode, which cannot authorize this action. Retry for a fresh gate.';
+  if (hold) return holdNextText(hold);
   return decision.exactNextAction || 'Marrow blocked this action before execution.';
 }
 
+// ---------------------------------------------------------------------------
+// Held actions (review_required): who can approve is Marrow's decision, read from the runtime.
+// Approvals keep people in flow: with a person at an interactive terminal the runner asks once;
+// with nobody there (CI, scripts, pipes, an agent's own shell) the action holds quietly and the
+// command does not run. The account owner's one-tap link is requested only when Marrow says it
+// would be sent (approval_link_available: an owner-locked category, arbitration, the owner's own
+// decline the operator asked to reverse, or an owner who turned on unattended pings). A later
+// run of the same command picks the hold up on the same gate receipt.
+// The runner never relays the server's agent-directed text for a hold, never prints a link,
+// a token or an address, and never names the dashboard as a step.
+// ---------------------------------------------------------------------------
+
+const GATE_RECEIPT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{2,199}$/;
+const HOST_SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+const DECISION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{2,199}$/;
+const APPROVAL_LINK_CHANNELS = new Set(['email', 'telegram', 'slack']);
+const APPROVAL_LINK_MAX_REQUESTS = 3;
+const APPROVAL_PROMPT_TIMEOUT_MS = 5 * 60_000;
+const APPROVAL_STATUS_MIN_POLL_MS = 1_000;
+const APPROVAL_STATUS_MAX_POLL_MS = 15_000;
+const APPROVAL_REQUEST_RETRY_MS = 2_000;
+// The backend lets a decline stand for this long (same decision, or the same action in the
+// receipt's session); the local record keeps it for the same time across reruns.
+const DECLINE_STANDS_MS = 30 * 60_000;
+const HOLD_RECORD_MAX_AGE_MS = 24 * 60 * 60_000;
+const RUNNER_HOOK_EVENT = 'governed_runner_prompt';
+const OWNER_APPROVAL_NOTICE = 'Approvals happen in the host\'s own prompt, at this runner\'s terminal prompt, or through the one-tap link Marrow sends the account owner.';
+
+function isoTime(value) {
+  if (typeof value !== 'string' || value.length > 40) return null;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+
+const safeId = (value, pattern = DECISION_ID_RE) => (typeof value === 'string' && pattern.test(value) ? value : '');
+
+// The hold from the runtime's completion contract. Endpoints are built from the receipt id here,
+// never taken from response text. `legacy`: a Marrow service from before terminal approvals.
+function heldApproval(runtime, decision) {
+  const value = recordOf(runtime);
+  const completion = recordOf(value.completion_contract);
+  const guidance = recordOf(completion.owner_approval);
+  if (!decision || decision.observationOnly || decision.decision === 'block') return null;
+  const receiptId = String(decision.receiptId || '');
+  const expiresAt = isoTime(recordOf(value.gate_receipt).expires_at) || isoTime(completion.gate_receipt_expires_at);
+  const poll = Number(guidance.approval_status_poll_after_ms);
+  const pollAfterMs = Number.isFinite(poll) && poll > 0 ? poll : 3_000;
+  const announcesLinks = typeof guidance.approval_link_available === 'boolean';
+  if (guidance.mode === 'arbitration_review_required') {
+    const arbitration = recordOf(value.arbitration);
+    const arbitrationReceiptId = safeId(arbitration.receipt_id) || safeId(completion.arbitration_receipt_id);
+    const linkAvailable = announcesLinks ? guidance.approval_link_available === true : typeof guidance.approval_link_endpoint === 'string';
+    if (!GATE_RECEIPT_ID_RE.test(receiptId) || !arbitrationReceiptId || !linkAvailable) {
+      return { kind: 'legacy', arbitration: true, gateReceiptId: receiptId };
+    }
+    return {
+      kind: 'arbitration',
+      gateReceiptId: receiptId,
+      arbitrationReceiptId,
+      arbitrationDecisionId: safeId(arbitration.decision_id),
+      linkAvailable: true,
+      linkReason: 'owner_locked',
+      // Marrow sends an arbitration link only when a person at this session asks for it
+      // (person_present: true) or the owner turned on unattended pings.
+      personPresentLinks: guidance.approval_link_person_present === true,
+      expiresAt,
+      pollAfterMs,
+    };
+  }
+  if (guidance.mode !== 'ordinary_non_arbitrated' || !GATE_RECEIPT_ID_RE.test(receiptId)) return null;
+  // Before terminal approvals the service has no host-approval route to record an answer.
+  if (guidance.host_approval_endpoint === undefined && guidance.host_approval_accepted === undefined) {
+    return { kind: 'legacy', arbitration: false, gateReceiptId: receiptId };
+  }
+  const refusal = ['owner_decline_stands', 'verified_approval_required', 'approval_state_unavailable']
+    .includes(guidance.host_approval_refusal_reason) ? guidance.host_approval_refusal_reason : null;
+  // A service that does not announce links (before round 4) sends one for an owner-locked hold
+  // or the owner's decline; the runner asks for nothing else there.
+  const linkAvailable = announcesLinks
+    ? guidance.approval_link_available === true
+    : typeof guidance.approval_link_endpoint === 'string' && (refusal === 'verified_approval_required' || refusal === 'owner_decline_stands');
+  const linkReason = ['owner_locked', 'owner_decline_stands', 'unattended_owner_ping'].includes(guidance.approval_link_reason)
+    ? guidance.approval_link_reason
+    : refusal === 'verified_approval_required' ? 'owner_locked' : refusal === 'owner_decline_stands' ? 'owner_decline_stands' : null;
+  return {
+    kind: 'ordinary',
+    gateReceiptId: receiptId,
+    accepted: guidance.host_approval_accepted === true && !refusal,
+    refusal,
+    operatorOnly: guidance.host_approval_operator_only === true,
+    ownerDeclinedAt: isoTime(guidance.owner_declined_at),
+    earlierDeclineAt: isoTime(guidance.earlier_decline_at),
+    operatorNotice: typeof guidance.operator_notice === 'string' ? displayText(guidance.operator_notice, 160) : '',
+    linkAvailable,
+    linkReason: linkAvailable ? linkReason : null,
+    expiresAt,
+    pollAfterMs,
+  };
+}
+
+// Answers that refuse for good: the request itself or its scope is wrong, the permit or the
+// approval ran out, or the target is gone. Anything else (no answer, 5xx) may pass on a rerun.
+const PERMIT_REFUSAL_STATUSES = new Set([400, 403, 404, 409]);
+
+function permitErrorCode(error) {
+  const code = error?.details?.code || error?.details?.details?.code;
+  if (typeof code === 'string' && /^[A-Z][A-Z0-9_]{1,79}$/.test(code)) return code;
+  return error?.status ? `HTTP ${error.status}` : 'no answer';
+}
+
+function holdNextText(hold) {
+  if (hold.kind === 'legacy') {
+    return `Marrow holds this action for approval (gate receipt ${hold.gateReceiptId}). This Marrow service does not take approvals from a terminal yet, so it stays held and nothing ran.`;
+  }
+  if (hold.kind === 'arbitration') {
+    return `Marrow holds this action for arbitration review (gate receipt ${hold.gateReceiptId}). The account owner picks one proposal; run it with npx @getmarrow/install run, which asks Marrow to send the owner a one-tap link and runs it once the owner approves this one.`;
+  }
+  if (hold.refusal === 'owner_decline_stands') {
+    return `The account owner declined this action${hold.ownerDeclinedAt ? ` at ${hold.ownerDeclinedAt}` : ''}, and only the owner can reverse that. To ask the owner with a one-tap approval link, rerun with --request-owner-link.`;
+  }
+  if (hold.refusal === 'approval_state_unavailable') {
+    return 'Marrow could not read the approval state for this action, so it did not run. Retry in a moment.';
+  }
+  if (hold.refusal === 'verified_approval_required') {
+    return `Marrow holds this action until the account owner approves it (gate receipt ${hold.gateReceiptId}). Run it with npx @getmarrow/install run, which asks Marrow to send the owner a one-tap link.`;
+  }
+  return `Marrow holds this action until a person approves it (gate receipt ${hold.gateReceiptId}). Run it with npx @getmarrow/install run in an interactive terminal to approve it there.`;
+}
+
+function gateReceiptRoute(gateReceiptId, suffix) {
+  return `/v1/agent/gate-receipts/${encodeURIComponent(gateReceiptId)}/${suffix}`;
+}
+
+function errorCode(json) {
+  const details = recordOf(json?.details);
+  const code = typeof details.code === 'string' ? details.code : typeof json?.code === 'string' ? json.code : '';
+  return /^[A-Z0-9_]{1,80}$/.test(code) ? code : '';
+}
+
+
+// Where a run that has no key points the person: one command, in a terminal on this machine.
+const NO_KEY_TEXT = 'Marrow can\'t find your key: run `npx @getmarrow/install` once in this machine\'s terminal.';
+
+function ownerEnvApiKey() {
+  try {
+    return readOwnerApiKey(process.env.HOME || process.env.USERPROFILE || os.homedir()).apiKey || '';
+  } catch {
+    return '';
+  }
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// ---------------------------------------------------------------------------
+// Who is at this terminal. An agent driving a pseudo-terminal must not answer the prompt.
+// ---------------------------------------------------------------------------
+
+// Environment set by agent hosts for the commands they run (Claude Code, Gemini CLI, Codex,
+// Cursor's agent, OpenCode).
+const AGENT_HOST_ENV = Object.freeze([
+  'CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_CHILD_SESSION', 'GEMINI_CLI',
+  'CODEX_SANDBOX', 'CODEX_SANDBOX_NETWORK_DISABLED', 'CODEX_MANAGED_BY_NPM', 'CODEX_THREAD_ID',
+  'CURSOR_AGENT', 'OPENCODE',
+]);
+const AGENT_HOST_PROGRAM_RE = /^(?:claude|codex|gemini|cursor-agent|opencode|aider|goose)(?:\.exe|\.js|\.mjs|\.cjs)?$/i;
+const AGENT_HOST_PATH_RE = /(?:^|[\\/])(?:@anthropic-ai[\\/]claude-code|@openai[\\/]codex|@google[\\/]gemini-cli)(?:[\\/]|$)/i;
+
+function linuxProcessArgs(pid) {
+  try {
+    const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+    const ppid = Number(stat.slice(stat.lastIndexOf(')') + 2).split(' ')[1]);
+    const args = fs.readFileSync(`/proc/${pid}/cmdline`).toString('utf8').split('\0').filter(Boolean).slice(0, 8);
+    return Number.isSafeInteger(ppid) ? { ppid, args } : null;
+  } catch {
+    return null;
+  }
+}
+
+// An agent host among this process's ancestors (Linux /proc; elsewhere the environment decides).
+function agentHostAncestor(reader = process.platform === 'linux' ? linuxProcessArgs : () => null, startPid = process.ppid) {
+  let pid = startPid;
+  for (let depth = 0; depth < 8 && pid > 1; depth += 1) {
+    const info = reader(pid);
+    if (!info) return false;
+    const programs = info.args.slice(0, 2);
+    if (programs.some((arg) => AGENT_HOST_PROGRAM_RE.test(path.basename(String(arg))) || AGENT_HOST_PATH_RE.test(String(arg)))) return true;
+    pid = info.ppid;
+  }
+  return false;
+}
+
+function agentHostDetected(env = process.env, reader) {
+  if (AGENT_HOST_ENV.some((name) => typeof env[name] === 'string' && env[name] !== '' && env[name] !== '0' && env[name].toLowerCase() !== 'false')) return true;
+  return agentHostAncestor(reader);
+}
+
+// One terminal line, read only from a person at an interactive terminal: stdin and stderr are
+// terminals, not CI, not --no-interactive, and no agent host runs this process.
+function approvalPromptAvailable(options, io = {}) {
+  const env = io.env || process.env;
+  if (agentHostDetected(env, io.processReader)) return false;
+  if (options.interactive === false) return false;
+  const ci = String(env.CI || '').toLowerCase();
+  if (ci && ci !== 'false' && ci !== '0') return false;
+  if (typeof io.approvalPrompt === 'function') return true;
+  const input = io.stdin || process.stdin;
+  const output = io.stderr || process.stderr;
+  return Boolean(input?.isTTY && output?.isTTY);
+}
+
+function askLine(question, io = {}) {
+  if (typeof io.approvalPrompt === 'function') return Promise.resolve(io.approvalPrompt(question));
+  const input = io.stdin || process.stdin;
+  const output = io.stderr || process.stderr;
+  const timeoutMs = Number.isFinite(io.promptTimeoutMs) ? io.promptTimeoutMs : APPROVAL_PROMPT_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input, output, terminal: true });
+    let done = false;
+    let timer = null;
+    const finish = (value) => {
+      if (done) return;
+      done = true;
+      if (timer) clearTimeout(timer);
+      rl.close();
+      if (input.pause) input.pause();
+      resolve(value);
+    };
+    // No answer is never a yes.
+    timer = setTimeout(() => {
+      output.write('\n');
+      finish(null);
+    }, timeoutMs);
+    rl.on('SIGINT', () => {
+      output.write('\n');
+      finish(null);
+    });
+    rl.on('close', () => finish(null));
+    rl.question(question, (answer) => finish(answer));
+  });
+}
+
+function parseAnswer(value) {
+  if (typeof value !== 'string') return null;
+  if (/^\s*y(?:es)?\s*$/i.test(value)) return 'yes';
+  if (/^\s*n(?:o)?\s*$/i.test(value)) return 'no';
+  return null;
+}
+
+function runnerHostSessionId(sessionId) {
+  const session = String(sessionId || '');
+  return HOST_SESSION_ID_RE.test(session)
+    ? session
+    : `runner-${crypto.createHash('sha256').update(session).digest('hex').slice(0, 32)}`;
+}
+
+// ---------------------------------------------------------------------------
+// The default session and the local record of a command's hold.
+// ---------------------------------------------------------------------------
+
+function baseUrlOrigin(value) {
+  try {
+    const url = new URL(String(value || DEFAULT_BASE_URL));
+    return `${url.protocol}//${url.host}`;
+  } catch {
+    return 'invalid-base-url';
+  }
+}
+
+function realCwd() {
+  try {
+    return fs.realpathSync(process.cwd());
+  } catch {
+    return path.resolve(process.cwd());
+  }
+}
+
+// One session per agent, project directory, OS user and Marrow service, per UTC day, so the
+// backend sees reruns of a command as the same session (an owner's decline stands across
+// them). The local hold record carries the session a hold was made in, so picking a hold up
+// later, from another terminal or the next day, uses that session.
+function defaultRunnerSession(options, now = new Date()) {
+  const uid = typeof process.getuid === 'function' ? String(process.getuid()) : os.userInfo().username;
+  const day = now.toISOString().slice(0, 10).replace(/-/g, '');
+  const digest = crypto.createHash('sha256')
+    .update(['runner-session-v1', uid, realCwd(), String(options.agentId || ''), baseUrlOrigin(options.baseUrl), day].join('\0'))
+    .digest('hex');
+  return `marrow-run-${digest.slice(0, 24)}`;
+}
+
+// The record key: an HMAC, under a private random salt kept in the hold directory, of the
+// command exactly as typed (every argv word), the raw --action, --target and --type, and this
+// agent, project, user and service. Any difference in the command, including text after a
+// secret, is a different key. The key never leaves this machine; the record stores only the
+// key (as its binding), ids, states and times, never the command.
+function runnerHoldKey(options, material, salt) {
+  const uid = typeof process.getuid === 'function' ? String(process.getuid()) : os.userInfo().username;
+  const key = salt || crypto.randomBytes(32);
+  // Which API key runs it (as its own HMAC, never the key) and the profile and policy it runs
+  // under: an approval under one is never picked up under another.
+  const apiKeyMark = options.apiKey ? crypto.createHmac('sha256', key).update(`api-key\0${options.apiKey}`).digest('hex') : '';
+  return crypto.createHmac('sha256', key).update(JSON.stringify([
+    'runner-hold-v2', baseUrlOrigin(options.baseUrl), String(options.agentId || ''), apiKeyMark,
+    String(options.profile || ''), String(options.policy || ''), realCwd(), uid,
+    Array.isArray(material?.argv) ? material.argv.map(String) : [],
+    String(material?.action || ''), String(material?.target || ''), String(material?.type || ''),
+  ])).digest('hex');
+}
+
+const HOLD_KEY_RE = /^[0-9a-f]{64}$/;
+
+const HOLD_RECORD_VERSION = 2;
+const HOLD_RECORD_KEYS = new Set([
+  'version', 'binding', 'kind', 'state', 'gate_receipt_id', 'decision_id', 'runtime_decision_id', 'arbitration_receipt_id',
+  'session_id', 'declined_by', 'declined_at', 'receipt_expires_at', 'approvable_here', 'link_reason',
+  'link_sent_at', 'link_expires_at', 'link_person_present', 'denial_committed', 'created_at', 'updated_at',
+]);
+
+function holdRecordStore(io = {}) {
+  const home = io.home || os.homedir();
+  const directory = path.join(home, '.marrow', 'runner-holds');
+  const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+  const file = (key) => path.join(directory, `${key}.json`);
+  const ensureDirectory = () => {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (uid !== null && stat.uid !== uid)) throw new Error('unsafe runner hold directory');
+    if ((stat.mode & 0o077) !== 0) fs.chmodSync(directory, 0o700);
+  };
+  const valid = (record) => {
+    if (!record || typeof record !== 'object' || Array.isArray(record) || record.version !== HOLD_RECORD_VERSION) return false;
+    if (!HOLD_KEY_RE.test(String(record.binding || ''))) return false;
+    if (Object.keys(record).some((key) => !HOLD_RECORD_KEYS.has(key))) return false;
+    if (!['ordinary', 'arbitration'].includes(record.kind) || !['waiting', 'declined'].includes(record.state)) return false;
+    if (!GATE_RECEIPT_ID_RE.test(String(record.gate_receipt_id || '')) || !HOST_SESSION_ID_RE.test(String(record.session_id || ''))) return false;
+    if (record.decision_id && !DECISION_ID_RE.test(record.decision_id)) return false;
+    if (record.runtime_decision_id && !DECISION_ID_RE.test(record.runtime_decision_id)) return false;
+    if (record.arbitration_receipt_id && !DECISION_ID_RE.test(record.arbitration_receipt_id)) return false;
+    return Number.isFinite(Date.parse(record.created_at));
+  };
+  let saltValue = null;
+  let saltStored = false;
+  const saltFile = path.join(directory, '.salt');
+  const ownedPrivateFile = (stat) => stat.isFile() && !stat.isSymbolicLink() && (uid === null || stat.uid === uid) && (stat.mode & 0o077) === 0;
+  const readSalt = () => {
+    try {
+      const stat = fs.lstatSync(saltFile);
+      if (!ownedPrivateFile(stat) || stat.size > 128) return null;
+      const stored = fs.readFileSync(saltFile, 'utf8').trim();
+      return HOLD_KEY_RE.test(stored) ? Buffer.from(stored, 'hex') : null;
+    } catch {
+      return null;
+    }
+  };
+  // Saves this run's salt before the first record is written under a key made with it. A salt
+  // file that is not a private regular file of this user is replaced (the directory is this
+  // user's and owner-only, checked by ensureDirectory). If another run saved a different salt
+  // first, nothing is written: the next run starts a new hold rather than miss this one.
+  const storeSalt = () => {
+    if (!saltValue || saltStored) return true;
+    const current = readSalt();
+    if (!current) {
+      try {
+        const stat = fs.lstatSync(saltFile);
+        if (!stat.isDirectory()) fs.unlinkSync(saltFile);
+      } catch { /* none yet */ }
+      const temp = path.join(directory, `.salt.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+      fs.writeFileSync(temp, `${saltValue.toString('hex')}\n`, { flag: 'wx', mode: 0o600 });
+      try { fs.linkSync(temp, saltFile); } catch { /* another run saved one first */ }
+      fs.unlinkSync(temp);
+    }
+    const saved = readSalt();
+    saltStored = Boolean(saved && crypto.timingSafeEqual(saved, saltValue));
+    return saltStored;
+  };
+  return {
+    // The private salt for hold keys: 32 random bytes in an owner-only file. Reading it creates
+    // nothing; a run with no saved salt uses a new one, saved when its first record is written.
+    salt() {
+      if (saltValue) return saltValue;
+      saltValue = readSalt();
+      saltStored = Boolean(saltValue);
+      if (!saltValue) saltValue = crypto.randomBytes(32);
+      return saltValue;
+    },
+    read(key) {
+      try {
+        if (!HOLD_KEY_RE.test(String(key || ''))) return null;
+        const target = file(key);
+        const stat = fs.lstatSync(target);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8192 || (uid !== null && stat.uid !== uid) || (stat.mode & 0o077) !== 0) return null;
+        const record = JSON.parse(fs.readFileSync(target, 'utf8'));
+        if (!valid(record) || Date.now() - Date.parse(record.created_at) > HOLD_RECORD_MAX_AGE_MS) return null;
+        // Picked up only by exactly the command it was made for.
+        if (!crypto.timingSafeEqual(Buffer.from(record.binding, 'hex'), Buffer.from(key, 'hex'))) return null;
+        return record;
+      } catch {
+        return null;
+      }
+    },
+    write(key, record) {
+      try {
+        if (!HOLD_KEY_RE.test(String(key || ''))) return false;
+        ensureDirectory();
+        if (!storeSalt()) return false;
+        const now = new Date().toISOString();
+        const value = Object.fromEntries(Object.entries({ created_at: now, ...record, version: HOLD_RECORD_VERSION, binding: key, updated_at: now })
+          .filter(([name, entry]) => HOLD_RECORD_KEYS.has(name) && entry !== undefined && entry !== null && entry !== ''));
+        const temp = path.join(directory, `.${key}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+        fs.writeFileSync(temp, `${JSON.stringify(value)}\n`, { flag: 'wx', mode: 0o600 });
+        fs.renameSync(temp, file(key));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    remove(key) {
+      try { fs.unlinkSync(file(key)); } catch { /* already gone */ }
+      try { fs.unlinkSync(path.join(directory, `${key}.claim`)); } catch { /* no claim */ }
+    },
+    // Gives the approval back (the run stopped before the command started, on a failure a
+    // later run may not meet); the record stays, so the next run picks the approval up again.
+    release(key) {
+      try { fs.unlinkSync(path.join(directory, `${key}.claim`)); } catch { /* no claim */ }
+    },
+    // One run per approval: the first run to claim an approved receipt runs it; an identical
+    // run started at the same time does not. A claim older than the receipt's life is stale.
+    claim(key, gateReceiptId) {
+      try {
+        if (!HOLD_KEY_RE.test(String(key || ''))) return false;
+        ensureDirectory();
+        const target = path.join(directory, `${key}.claim`);
+        try {
+          const stat = fs.lstatSync(target);
+          if (stat.isFile() && Date.now() - stat.mtimeMs > 60 * 60_000) fs.unlinkSync(target);
+        } catch { /* no claim yet */ }
+        fs.writeFileSync(target, `${gateReceiptId}\n`, { flag: 'wx', mode: 0o600 });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Marrow calls for a hold.
+// ---------------------------------------------------------------------------
+
+// POSTs that answer a hold are resent unchanged on a retryable answer (the host route and the
+// link route record nothing on those), at most three attempts.
+async function holdPost(options, route, body, io = {}) {
+  const retryMs = Number.isFinite(io.approvalRetryMs) ? io.approvalRetryMs : APPROVAL_REQUEST_RETRY_MS;
+  let last = { ok: false, status: 0, code: 'request_failed', json: {} };
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    try {
+      const { response, json } = await rawRequest(options, 'POST', route, body, {}, { timeoutMs: 15_000 });
+      const code = errorCode(json);
+      last = { ok: response.ok, status: response.status, code, json, data: response.ok ? dataOf(json) : null };
+      if (response.ok) return last;
+      const retryable = response.status >= 500
+        || (response.status === 429 && recordOf(json?.details).retryable === true)
+        || ['MARROW_OWNER_APPROVAL_STATE_UNAVAILABLE', 'MARROW_APPROVAL_LINK_UNDELIVERED'].includes(code);
+      if (!retryable) return last;
+    } catch (error) {
+      last = { ok: false, status: 0, code: isTimeout(error) ? 'timed_out' : 'request_failed', json: {} };
+    }
+    if (attempt < 3) await sleep(retryMs);
+  }
+  return last;
+}
+
+async function holdPostOnce(options, route, body) {
+  try {
+    const { response, json } = await rawRequest(options, 'POST', route, body, {}, { timeoutMs: 15_000 });
+    return { ok: response.ok, status: response.status, code: errorCode(json), json, data: response.ok ? dataOf(json) : null };
+  } catch (error) {
+    return { ok: false, status: 0, code: isTimeout(error) ? 'timed_out' : 'request_failed', json: {} };
+  }
+}
+
+async function reportRunnerVerdict(options, gateReceiptId, verdict, times, decisionIds, io) {
+  const decisionId = verdict === 'approved' ? decisionIds.decisionId : decisionIds.runtimeDecisionId;
+  const body = {
+    verdict,
+    host: 'other',
+    host_session_id: runnerHostSessionId(options.sessionId),
+    hook_event: RUNNER_HOOK_EVENT,
+    asked_at: times.askedAt,
+    answered_at: times.answeredAt,
+    ...(decisionId && DECISION_ID_RE.test(decisionId) ? { decision_id: decisionId } : {}),
+  };
+  const result = await holdPost(options, gateReceiptRoute(gateReceiptId, 'host-approval'), body, io);
+  if (result.ok) {
+    const recorded = recordOf(recordOf(result.data).host_approval);
+    return { recorded: recorded.verdict === verdict, verdict: recorded.verdict === 'declined' ? 'declined' : recorded.verdict === 'approved' ? 'approved' : null, answeredBy: typeof recorded.answered_by === 'string' ? recorded.answered_by : null };
+  }
+  if (result.code === 'MARROW_OWNER_APPROVAL_ALREADY_DECIDED') {
+    const existing = recordOf(result.json?.details).existing_verdict;
+    return { recorded: false, verdict: existing === 'approved' ? 'approved' : existing === 'declined' ? 'declined' : null, code: result.code };
+  }
+  if (result.code === 'MARROW_OWNER_APPROVAL_DECLINED') return { recorded: false, verdict: 'declined', code: result.code };
+  return { recorded: false, verdict: null, code: result.code || `HTTP_${result.status}` };
+}
+
+// Asks Marrow to send the owner a one-tap link. A 200 answer that says it was not sent (the owner
+// has not turned on unattended pings) is a quiet hold, not an error. Keeps only the channel and
+// expiry: the response never contains the link, and its recipient hint is dropped here.
+// `personPresent` is sent (as true) only for a hold whose service asks for it, and only when a
+// person at this terminal runs the command; never for an unattended or agent-terminal run.
+async function requestOwnerLink(options, gateReceiptId, decisionId, state, io, { personPresent = false } = {}) {
+  while (state.linkRequests < APPROVAL_LINK_MAX_REQUESTS) {
+    state.linkRequests += 1;
+    const body = decisionId && DECISION_ID_RE.test(decisionId) ? { decision_id: decisionId } : {};
+    if (personPresent === true) body.person_present = true;
+    const result = await holdPostOnce(options, gateReceiptRoute(gateReceiptId, 'approval-link'), body);
+    if (result.ok) {
+      const data = recordOf(result.data);
+      const link = recordOf(data.approval_link);
+      // The owner already has a live link for this hold: no new email; wait on its answer.
+      if (data.state === 'already_sent' || data.reason === 'link_live') {
+        if (!Object.keys(link).length) return { sent: false, code: 'MARROW_APPROVAL_LINK_ANSWER_INVALID' };
+        state.channel = APPROVAL_LINK_CHANNELS.has(link.channel) ? link.channel : 'owner channel';
+        state.expiresAt = isoTime(link.expires_at);
+        return { sent: true, alreadyLive: true };
+      }
+      if (data.sent === false || data.state === 'not_sent') {
+        return { sent: false, quiet: true, reason: typeof data.reason === 'string' ? data.reason.slice(0, 40) : 'not_sent' };
+      }
+      if (!Object.keys(link).length) return { sent: false, code: 'MARROW_APPROVAL_LINK_ANSWER_INVALID' };
+      state.channel = APPROVAL_LINK_CHANNELS.has(link.channel) ? link.channel : 'owner channel';
+      state.expiresAt = isoTime(link.expires_at);
+      return { sent: true };
+    }
+    const retryable = result.status >= 500 || result.status === 0
+      || (result.status === 429 && recordOf(result.json?.details).retryable === true)
+      || ['MARROW_OWNER_APPROVAL_STATE_UNAVAILABLE', 'MARROW_APPROVAL_LINK_UNDELIVERED'].includes(result.code);
+    if (!retryable) return { sent: false, code: result.code || `HTTP_${result.status}` };
+    if (state.linkRequests < APPROVAL_LINK_MAX_REQUESTS) {
+      await sleep(Number.isFinite(io.approvalRetryMs) ? io.approvalRetryMs : APPROVAL_REQUEST_RETRY_MS);
+    }
+  }
+  return { sent: false, code: 'MARROW_APPROVAL_LINK_REQUESTS_EXHAUSTED' };
+}
+
+function linkSentText(state, alreadyLive) {
+  const until = state.expiresAt ? `, until ${state.expiresAt}` : '';
+  return alreadyLive
+    ? `The account owner already has a one-tap approval link for this action (${state.channel})${until}; no new link was sent.`
+    : `An approval link was sent to the account owner (${state.channel}). It works once${until}.`;
+}
+
+const LINK_FAILURE_TEXT = {
+  MARROW_APPROVAL_CHANNEL_UNAVAILABLE: 'the account has no approval channel Marrow can send it to',
+  MARROW_APPROVAL_LINK_LIMITED: 'enough approval links were already sent for this action or this hour',
+  MARROW_OWNER_APPROVAL_ALREADY_DECIDED: 'this hold already has an answer',
+  MARROW_ARBITRATION_OWNER_APPROVAL_REQUIRED: 'this action is governed by arbitration review',
+  MARROW_PRE_ACTION_GATE_USED: 'its gate receipt was already used',
+  MARROW_PRE_ACTION_GATE_EXPIRED: 'its gate receipt expired',
+  MARROW_APPROVAL_LINK_NOT_HELD: 'Marrow no longer holds this action',
+  MARROW_APPROVAL_LINK_REQUESTS_EXHAUSTED: `Marrow could not deliver it after ${APPROVAL_LINK_MAX_REQUESTS} requests`,
+};
+
+// One status read: the state, plus the approval fields the runner keeps.
+async function readHoldStatus(options, gateReceiptId, signal = undefined) {
+  try {
+    const { response, json } = await rawRequest(options, 'GET', gateReceiptRoute(gateReceiptId, 'owner-approval'), undefined, {}, { timeoutMs: 15_000, signal });
+    if (response.status === 404) return { state: 'unknown' };
+    if (!response.ok) return { state: 'unavailable' };
+    const view = recordOf(dataOf(json));
+    const stateValue = typeof view.state === 'string' ? view.state : 'unavailable';
+    return {
+      state: stateValue,
+      source: typeof view.approval_source === 'string' ? view.approval_source.slice(0, 40) : null,
+      answeredBy: typeof view.approval_answered_by === 'string' ? view.approval_answered_by.slice(0, 40) : null,
+      ownerApprovalReceiptId: safeId(view.owner_approval_receipt_id),
+      pollAfterMs: Number(view.poll_after_ms),
+    };
+  } catch {
+    return { state: 'unavailable' };
+  }
+}
+
+const WAITING_STATES = new Set(['pending', 'arbitration_review', 'unavailable']);
+
+// Waits on the status endpoint until the hold is answered, expires, or the deadline passes.
+// Ctrl+C (SIGINT) or SIGTERM (an agent host's tool timeout, for example) stops the wait. The
+// hold is recorded before any wait starts, so the run then exits held and a later run of the
+// command picks up the answer on the same receipt.
+async function waitForOwnerAnswer(options, gateReceiptId, pollAfterMs, deadline, io) {
+  const minPoll = Number.isFinite(io.approvalPollMs) ? io.approvalPollMs : APPROVAL_STATUS_MIN_POLL_MS;
+  let pollMs = Math.max(minPoll, Math.min(pollAfterMs, APPROVAL_STATUS_MAX_POLL_MS));
+  const stop = waitInterruption(io);
+  try {
+    for (;;) {
+      const status = await readHoldStatus(options, gateReceiptId, stop.signal);
+      if (stop.signal.aborted) return { state: 'interrupted', signal: stop.reason };
+      if (!WAITING_STATES.has(status.state)) return status;
+      if (Number.isFinite(status.pollAfterMs) && status.pollAfterMs > 0) pollMs = Math.max(minPoll, Math.min(status.pollAfterMs, APPROVAL_STATUS_MAX_POLL_MS));
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) return { state: 'timeout' };
+      // A stop during the sleep aborts the next status read at once; the check above returns.
+      await abortableSleep(Math.min(pollMs, remaining), stop.signal);
+    }
+  } finally {
+    stop.release();
+  }
+}
+
+// SIGINT and SIGTERM while a run waits: they stop the wait instead of killing the process.
+function waitInterruption(io = {}) {
+  const target = io.signals || process;
+  const controller = new AbortController();
+  const stop = { signal: controller.signal, reason: null, release: () => {} };
+  const handlers = ['SIGINT', 'SIGTERM'].map((name) => {
+    const handler = () => {
+      if (!stop.reason) stop.reason = name;
+      controller.abort();
+    };
+    target.on(name, handler);
+    return [name, handler];
+  });
+  stop.release = () => {
+    for (const [name, handler] of handlers) target.removeListener(name, handler);
+  };
+  return stop;
+}
+
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    let timer = null;
+    const done = () => {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', done);
+      resolve();
+    };
+    timer = setTimeout(done, ms);
+    signal.addEventListener('abort', done, { once: true });
+  });
+}
+
+// A gate denial report closes trusted only with its receipt and no proof: there is no
+// completion to prove, and the receipt is what makes the denial verifiable.
+// An arbitration hold's denial carries its arbitration receipt with the gate receipt, as Marrow
+// closes an arbitrated decision only with both.
+async function commitHoldDenial(options, decisionIds, gateReceiptId, outcome, arbitrationReceiptId = '') {
+  const decisionId = decisionIds.runtimeDecisionId || decisionIds.decisionId;
+  if (!decisionId) return 'not_recorded';
+  try {
+    const receipt = decisionIds.runtimeDecisionId ? gateReceiptId : '';
+    const commit = await commitOutcome(options, decisionId, false, outcome, undefined, receipt, null,
+      { extras: receipt && arbitrationReceiptId ? { arbitration_receipt_id: arbitrationReceiptId } : {} });
+    return commit?.committed === true ? 'committed' : 'not_committed';
+  } catch {
+    return 'failed';
+  }
+}
+
+function heldText(hold, interactive) {
+  if (hold.kind === 'arbitration') return `Marrow holds this action for arbitration review (gate receipt ${hold.gateReceiptId}): the account owner picks one proposal.`;
+  return `Marrow holds this action until ${hold.accepted && !hold.operatorOnly && interactive ? 'you approve it' : hold.refusal ? 'the account owner approves it' : 'a person approves it'} (gate receipt ${hold.gateReceiptId}).`;
+}
+
+function quietHoldText(hold, interactive) {
+  if (hold.kind === 'ordinary' && hold.operatorOnly && hold.accepted) {
+    return `You declined this action${hold.earlierDeclineAt ? ` at ${hold.earlierDeclineAt}` : ' earlier'}, so it stays held and nothing ran.`;
+  }
+  if (hold.kind === 'ordinary' && hold.accepted && !interactive) {
+    return 'It is held until a person approves it, and nothing ran. Rerun this command in an interactive terminal to approve it there; that run picks up this hold.';
+  }
+  if (hold.kind === 'arbitration' && hold.personPresentLinks && !interactive) {
+    return 'It is held for the account owner\'s review, and nothing ran. Rerun this command in an interactive terminal to send the owner a one-tap link; that run picks up this hold.';
+  }
+  return 'It stays held until the account owner approves it, and nothing ran. Rerun this command to check; a later run picks up this hold.';
+}
+
+// Resolves one hold in this run. Returns { approved: true, ... } only when Marrow recorded an
+// approval: the operator's typed "y" at an interactive terminal (reported as the operator's
+// answer, client-attested), or the account owner's approval. Otherwise the command does not
+// run, and the hold is remembered so the next run of this command picks it up.
+async function resolveHold(options, hold, context) {
+  const io = context.io || {};
+  const err = io.stderr || process.stderr;
+  const say = (text) => err.write(`${text}\n`);
+  const records = context.records;
+  const state = { linkRequests: 0, channel: null, expiresAt: null, source: null };
+  const decisionIds = context.decisionIds;
+  const summary = (extra = {}) => ({
+    gate_receipt_id: hold.gateReceiptId,
+    link_requests: state.linkRequests,
+    ...(state.channel ? { channel: state.channel, expires_at: state.expiresAt } : {}),
+    ...(state.source ? { source: state.source } : {}),
+    ...extra,
+  });
+  const recordBase = () => ({
+    kind: hold.kind,
+    gate_receipt_id: hold.gateReceiptId,
+    decision_id: decisionIds.decisionId,
+    runtime_decision_id: decisionIds.runtimeDecisionId,
+    arbitration_receipt_id: hold.arbitrationReceiptId,
+    session_id: options.sessionId,
+    receipt_expires_at: hold.expiresAt,
+    approvable_here: hold.kind === 'ordinary' && hold.accepted && !hold.operatorOnly,
+    link_reason: hold.linkReason,
+    link_person_present: hold.personPresentLinks === true ? true : undefined,
+  });
+  const remember = (extra = {}) => records?.write(context.holdKey, { ...recordBase(), state: 'waiting', ...extra });
+  const refused = (message, extra = {}) => ({ approved: false, exitCode: 12, message, approval: summary(extra) });
+  const linkFields = () => (state.channel ? { link_sent_at: state.linkSentAt || new Date().toISOString(), link_expires_at: state.expiresAt } : {});
+  const held = (message, extra = {}) => {
+    remember(linkFields());
+    return refused(message, { state: 'held', ...extra });
+  };
+  const denial = async (message, outcome, declinedBy, extra) => {
+    const commitState = await commitHoldDenial(options, decisionIds, hold.gateReceiptId, outcome, hold.kind === 'arbitration' ? hold.arbitrationReceiptId : '');
+    records?.write(context.holdKey, { ...recordBase(), state: 'declined', declined_by: declinedBy, declined_at: new Date().toISOString(), denial_committed: commitState === 'committed' ? 'yes' : undefined });
+    return refused(message, { ...extra, denial_commit: commitState });
+  };
+
+  if (hold.refusal === 'approval_state_unavailable') return refused(holdNextText(hold), { state: 'state_unavailable' });
+  const interactive = approvalPromptAvailable(options, io);
+  say(heldText(hold, interactive));
+
+  let asked = Boolean(options.requestOwnerLink);
+  let ownerOnly = hold.kind === 'arbitration' || !hold.accepted || hold.operatorOnly;
+  let linkAvailable = hold.linkAvailable;
+
+  // 1. The operator answers here, at an interactive terminal, when Marrow lets the operator
+  // approve: not after an earlier operator decline (Marrow then accepts only a marked answer in
+  // a host's own dialog, which this prompt is not), and not for owner-only holds.
+  if (hold.kind === 'ordinary' && !ownerOnly && interactive) {
+    const askedAt = new Date().toISOString();
+    const raw = await askLine(`${hold.operatorNotice ? `${hold.operatorNotice} ` : ''}Approve and run it now? [y/N] `, io);
+    const answer = parseAnswer(raw);
+    const times = { askedAt, answeredAt: new Date().toISOString() };
+    state.source = 'operator_prompt';
+    if (answer === null) {
+      remember();
+      return refused('No answer was given, so nothing ran and nothing was recorded. Rerun this command to answer; it picks up this hold.', { state: 'no_answer' });
+    }
+    const report = await reportRunnerVerdict(options, hold.gateReceiptId, answer === 'yes' ? 'approved' : 'declined', times, decisionIds, io);
+    if (answer === 'no') {
+      if (report.verdict !== 'declined') {
+        remember();
+        return refused(`Marrow could not record the decline (${report.code || 'not recorded'}). Nothing ran.`, { state: 'declined_unrecorded' });
+      }
+      return denial('Declined. The action did not run.', 'Denied by Marrow pre-action gate: the operator declined in the governed runner.', 'operator', { state: 'declined' });
+    }
+    if (report.verdict === 'declined') {
+      return denial('This action was already declined. It did not run.', 'Denied by Marrow pre-action gate: the approval was declined.', 'account_owner', { state: 'declined' });
+    }
+    if (report.verdict === 'approved') {
+      say('Marrow recorded your approval (client-attested).');
+      // Remembered before the run starts: if Marrow is unavailable before the command starts,
+      // the next run picks this approval up instead of asking again.
+      remember();
+      return { approved: true, approval: summary({ state: 'approved', answered_by: report.answeredBy }) };
+    }
+    if (report.code === 'MARROW_VERIFIED_OWNER_APPROVAL_REQUIRED') {
+      ownerOnly = true;
+      linkAvailable = true;
+      hold = { ...hold, linkReason: 'owner_locked' };
+      say('Only the account owner can approve this action.');
+    } else if (report.code === 'MARROW_OWNER_DECLINE_STANDS') {
+      ownerOnly = true;
+      linkAvailable = true;
+      asked = true;
+      hold = { ...hold, refusal: 'owner_decline_stands', linkReason: 'owner_decline_stands' };
+      say('The account owner declined this action; only the owner can reverse that.');
+    } else {
+      remember();
+      return refused(`Marrow could not record your approval (${report.code || 'not recorded'}). Nothing ran.`, { state: 'not_recorded' });
+    }
+  }
+
+  // 2. Only the owner reverses the owner's own decline, and Marrow asks them only on request.
+  if (hold.kind === 'ordinary' && hold.refusal === 'owner_decline_stands' && !asked) {
+    asked = interactive
+      ? parseAnswer(await askLine(`The account owner declined this action${hold.ownerDeclinedAt ? ` at ${hold.ownerDeclinedAt}` : ''}; only the owner can reverse that. Ask the owner now with a one-tap approval link? [y/N] `, io)) === 'yes'
+      : false;
+    if (!asked) {
+      records?.write(context.holdKey, { ...recordBase(), state: 'declined', declined_by: 'account_owner', declined_at: hold.ownerDeclinedAt || new Date().toISOString() });
+      return refused(holdNextText(hold), { state: 'owner_decline_stands' });
+    }
+  }
+
+  // 3. The owner's one-tap link, only where Marrow says it would be sent.
+  let linkSent = false;
+  if (linkAvailable) {
+    state.source = 'owner_link';
+    const link = await requestOwnerLink(options, hold.gateReceiptId, decisionIds.decisionId, state, io,
+      { personPresent: Boolean(hold.personPresentLinks && interactive) });
+    if (link.sent) {
+      linkSent = true;
+      state.linkSentAt = new Date().toISOString();
+      say(linkSentText(state, link.alreadyLive));
+    } else if (!link.quiet) {
+      remember();
+      return refused(`No approval link was sent: ${LINK_FAILURE_TEXT[link.code] || `Marrow answered ${link.code}`}. Nothing ran.`, { state: 'link_not_sent', code: link.code });
+    }
+  }
+
+  // 4. Wait while a person is here for the owner's link, or when asked to (--approval-wait);
+  // otherwise hold quietly. A later run of this command picks the answer up on this receipt.
+  const waitSeconds = options.approvalWaitSeconds;
+  const linkDeadline = linkSent && state.expiresAt ? Date.parse(state.expiresAt) : linkSent ? Date.now() + 10 * 60_000 : null;
+  const wait = waitSeconds == null
+    ? (interactive && linkSent ? linkDeadline - Date.now() : 0)
+    : linkSent ? Math.min(waitSeconds * 1000, linkDeadline - Date.now()) : waitSeconds * 1000;
+  if (wait <= 0) {
+    return held(linkSent
+      ? 'It is held until the owner approves it, and nothing ran. Rerun this command after they answer; it picks up this hold.'
+      : quietHoldText(hold, interactive), linkAvailable && !linkSent ? { link: 'not_sent' } : {});
+  }
+  // Recorded before the wait: Ctrl+C, or a kill such as an agent host's tool timeout, leaves the
+  // hold for the next run, which reuses this receipt and this link (no new email).
+  remember(linkFields());
+  say(linkSent
+    ? 'Waiting for the owner\'s answer. Ctrl+C stops waiting; a later run of this command picks up the answer.'
+    : 'Waiting for a person to approve it. Ctrl+C stops waiting; a later run of this command picks up the answer.');
+  const answer = await waitForOwnerAnswer(options, hold.gateReceiptId, hold.pollAfterMs, Date.now() + wait, io);
+  // The hold was recorded before the wait, so an approval found here is already on record for
+  // the next run if this one stops before the command starts.
+  return finishOwnerAnswer(answer, { hold, say, summary, refused, held, denial, records, holdKey: context.holdKey, linkDeadline });
+}
+
+// What the runner does with the owner's answer (in this run, or picked up by a later run).
+async function finishOwnerAnswer(answer, ctx) {
+  const { hold, say, summary, refused, held, denial, records, holdKey } = ctx;
+  if (answer.state === 'approved') {
+    if (hold.kind === 'arbitration' && !answer.ownerApprovalReceiptId) {
+      return refused('Marrow reported the arbitration as approved without an owner approval receipt, so nothing ran.', { state: 'approval_incomplete' });
+    }
+    say(hold.kind === 'arbitration' ? 'The account owner approved a proposal. Checking that it is this one.' : 'The action was approved. Running it.');
+    return {
+      approved: true,
+      approval: summary({ state: 'approved', approved_via: answer.source, answered_by: answer.answeredBy }),
+      commitExtras: hold.kind === 'arbitration'
+        ? { arbitration_receipt_id: hold.arbitrationReceiptId, owner_approval_receipt_id: answer.ownerApprovalReceiptId }
+        : {},
+    };
+  }
+  if (answer.state === 'declined') {
+    return denial(hold.kind === 'arbitration' ? 'The account owner approved none of the proposals. The action did not run.' : 'The approval was declined. The action did not run.',
+      hold.kind === 'arbitration' ? 'Denied by Marrow pre-action gate: the account owner approved none of the proposals.' : 'Denied by Marrow pre-action gate: the account owner declined.',
+      answer.answeredBy === 'account_owner' || hold.kind === 'arbitration' ? 'account_owner' : 'operator', { state: 'declined' });
+  }
+  if (answer.state === 'interrupted') {
+    return held('Stopped waiting. Nothing ran; it stays held, and a later run of this command picks up the answer on the same receipt.', { state: 'interrupted' });
+  }
+  if (answer.state === 'timeout') {
+    return held(ctx.linkDeadline && Date.now() >= ctx.linkDeadline - 1000
+      ? 'The approval link expired before anyone answered. Nothing ran; rerun the command to check or ask again.'
+      : 'Stopped waiting before the owner answered. Nothing ran; a later run of this command picks up their answer.', { state: 'timeout' });
+  }
+  records?.remove(holdKey);
+  return refused(answer.state === 'expired'
+    ? 'The gate receipt expired before it was approved. Nothing ran; rerun the command for a fresh gate.'
+    : `Marrow reports this hold as ${answer.state}. Nothing ran.`, { state: answer.state });
+}
+
+// A hold an earlier run of this exact command left behind. Its answer decides, on the same gate
+// receipt: no new receipt and no new email. Returns { state: 'none' } when there is nothing to
+// pick up (or it ran out), { state: 'blocked', ... } when the command must not run, or
+// { state: 'approved', ... } to run it on that receipt.
+async function resumeRecordedHold(options, records, holdKey, io = {}) {
+  const record = records.read(holdKey);
+  if (!record) return { state: 'none' };
+  const err = io.stderr || process.stderr;
+  const say = (text) => err.write(`${text}\n`);
+  const now = Date.now();
+  const hold = {
+    kind: record.kind,
+    gateReceiptId: record.gate_receipt_id,
+    arbitrationReceiptId: record.arbitration_receipt_id || '',
+    accepted: record.approvable_here === true,
+    operatorOnly: false,
+    refusal: null,
+    linkAvailable: Boolean(record.link_reason),
+    linkReason: record.link_reason || null,
+    personPresentLinks: record.link_person_present === true,
+    expiresAt: record.receipt_expires_at || null,
+    pollAfterMs: 3_000,
+  };
+  const decisionIds = { decisionId: record.decision_id || '', runtimeDecisionId: record.runtime_decision_id || '' };
+  const holdOptions = { ...options, sessionId: record.session_id };
+  const base = { gateReceiptId: record.gate_receipt_id, decisionId: decisionIds.decisionId || decisionIds.runtimeDecisionId };
+  const blocked = (message, approval = {}) => ({ state: 'blocked', exitCode: 12, message, ...base, approval: { gate_receipt_id: record.gate_receipt_id, resumed: true, ...approval } });
+
+  if (record.state === 'declined') {
+    const declinedAt = Date.parse(record.declined_at);
+    if (!Number.isFinite(declinedAt) || now - declinedAt > DECLINE_STANDS_MS) {
+      records.remove(holdKey);
+      return { state: 'none' };
+    }
+    if (record.declined_by === 'account_owner') {
+      if (options.requestOwnerLink) {
+        // A new hold in the decline's own session, where Marrow sees the decline and sends the
+        // owner the link to reverse it.
+        records.remove(holdKey);
+        return { state: 'none', sessionId: record.session_id };
+      }
+      return blocked(`The account owner declined this action at ${new Date(declinedAt).toISOString()}, and only the owner can reverse that. Nothing ran. To ask the owner with a one-tap approval link, rerun with --request-owner-link.`, { state: 'owner_decline_stands' });
+    }
+    return blocked(`You declined this action at ${new Date(declinedAt).toISOString()}. That answer stands until ${new Date(declinedAt + DECLINE_STANDS_MS).toISOString()}, and nothing ran.`, { state: 'declined' });
+  }
+
+  if (hold.expiresAt && Date.parse(hold.expiresAt) <= now) {
+    records.remove(holdKey);
+    return { state: 'none' };
+  }
+  const status = await readHoldStatus(holdOptions, record.gate_receipt_id);
+  if (status.state === 'unavailable') {
+    return blocked(`Marrow holds this action (gate receipt ${record.gate_receipt_id}) and its approval state could not be read, so nothing ran. Retry in a moment.`, { state: 'state_unavailable' });
+  }
+  if (['unknown', 'expired', 'used', 'not_held'].includes(status.state)) {
+    records.remove(holdKey);
+    return { state: 'none' };
+  }
+  const state = { linkRequests: 0, channel: null, expiresAt: record.link_expires_at || null, source: null };
+  const summary = (extra = {}) => ({ gate_receipt_id: record.gate_receipt_id, resumed: true, link_requests: state.linkRequests, ...(state.channel ? { channel: state.channel, expires_at: state.expiresAt } : {}), ...extra });
+  const refusedHere = (message, extra = {}) => ({ approved: false, exitCode: 12, message, approval: summary(extra) });
+  const keep = (extra = {}) => records.write(holdKey, { ...record, ...extra });
+  const linkFieldsHere = () => (state.channel ? { link_sent_at: state.linkSentAt || new Date().toISOString(), link_expires_at: state.expiresAt } : {});
+  const heldHere = (message, extra = {}) => {
+    keep(linkFieldsHere());
+    return refusedHere(message, { state: 'held', ...extra });
+  };
+  const denialHere = async (message, outcome, declinedBy, extra) => {
+    const commitState = record.denial_committed === 'yes' ? 'committed' : await commitHoldDenial(holdOptions, decisionIds, record.gate_receipt_id, outcome, record.kind === 'arbitration' ? record.arbitration_receipt_id || '' : '');
+    records.write(holdKey, { ...record, state: 'declined', declined_by: declinedBy, declined_at: new Date().toISOString(), denial_committed: commitState === 'committed' ? 'yes' : undefined });
+    return refusedHere(message, { ...extra, denial_commit: commitState });
+  };
+  const toResult = (resolved) => (resolved.approved
+    ? { state: 'approved', hold, ...base, options: holdOptions, approval: resolved.approval, commitExtras: resolved.commitExtras || {} }
+    : { state: 'blocked', exitCode: resolved.exitCode, message: resolved.message, ...base, approval: resolved.approval });
+  const ctx = { hold, say, summary, refused: refusedHere, held: heldHere, denial: denialHere, records, holdKey, linkDeadline: state.expiresAt ? Date.parse(state.expiresAt) : null };
+
+  if (status.state === 'approved' || status.state === 'declined') {
+    say(`Picking up the earlier hold of this command (gate receipt ${record.gate_receipt_id}).`);
+    return toResult(await finishOwnerAnswer(status, ctx));
+  }
+
+  // Still waiting.
+  const interactive = approvalPromptAvailable(holdOptions, io);
+  say(`This command is still held (gate receipt ${record.gate_receipt_id}).`);
+  if (hold.kind === 'ordinary' && hold.accepted && interactive) {
+    const askedAt = new Date().toISOString();
+    const raw = await askLine('Approve and run it now? [y/N] ', io);
+    const answer = parseAnswer(raw);
+    const times = { askedAt, answeredAt: new Date().toISOString() };
+    state.source = 'operator_prompt';
+    if (answer === null) return toResult(refusedHere('No answer was given, so nothing ran and nothing was recorded.', { state: 'no_answer' }));
+    const report = await reportRunnerVerdict(holdOptions, record.gate_receipt_id, answer === 'yes' ? 'approved' : 'declined', times, decisionIds, io);
+    if (answer === 'no') {
+      if (report.verdict !== 'declined') return toResult(refusedHere(`Marrow could not record the decline (${report.code || 'not recorded'}). Nothing ran.`, { state: 'declined_unrecorded' }));
+      return toResult(await denialHere('Declined. The action did not run.', 'Denied by Marrow pre-action gate: the operator declined in the governed runner.', 'operator', { state: 'declined' }));
+    }
+    if (report.verdict === 'approved') {
+      say('Marrow recorded your approval (client-attested).');
+      return toResult({ approved: true, approval: summary({ state: 'approved', source: 'operator_prompt', answered_by: report.answeredBy }) });
+    }
+    if (report.verdict === 'declined') return toResult(await denialHere('This action was already declined. It did not run.', 'Denied by Marrow pre-action gate: the approval was declined.', 'account_owner', { state: 'declined' }));
+    return toResult(refusedHere(`Marrow could not record your approval (${report.code || 'not recorded'}). Nothing ran.`, { state: 'not_recorded' }));
+  }
+
+  // Waiting on the owner. A link that expired is asked for again only where Marrow sends one.
+  const linkExpired = !record.link_expires_at || Date.parse(record.link_expires_at) <= now;
+  if (hold.linkAvailable && hold.linkReason !== 'unattended_owner_ping' && linkExpired) {
+    state.source = 'owner_link';
+    const link = await requestOwnerLink(holdOptions, record.gate_receipt_id, decisionIds.decisionId, state, io,
+      { personPresent: Boolean(hold.personPresentLinks && interactive) });
+    if (link.sent) {
+      state.linkSentAt = new Date().toISOString();
+      say(linkSentText(state, link.alreadyLive));
+    }
+  }
+  const deadlineAt = state.expiresAt ? Date.parse(state.expiresAt) : record.link_expires_at ? Date.parse(record.link_expires_at) : null;
+  const waitSeconds = options.approvalWaitSeconds;
+  const wait = waitSeconds == null
+    ? (interactive && deadlineAt ? deadlineAt - Date.now() : 0)
+    : Math.min(waitSeconds * 1000, deadlineAt ? deadlineAt - Date.now() : waitSeconds * 1000);
+  if (wait <= 0) {
+    // "After they answer" only when the owner has a live link; otherwise the quiet-hold text,
+    // which says where a link can be sent from.
+    const linkLive = Boolean(state.channel) || (Boolean(record.link_expires_at) && Date.parse(record.link_expires_at) > now);
+    return toResult(heldHere(hold.kind === 'ordinary' && hold.accepted
+      ? 'It is held until a person approves it, and nothing ran. Rerun this command in an interactive terminal to approve it there.'
+      : linkLive ? 'It stays held until the account owner approves it, and nothing ran. Rerun this command after they answer.' : quietHoldText(hold, interactive)));
+  }
+  // A new link is recorded before the wait, so a stopped or killed run leaves it for the next.
+  if (state.channel) keep(linkFieldsHere());
+  say('Waiting for the owner\'s answer. Ctrl+C stops waiting; a later run of this command picks up the answer.');
+  const answer = await waitForOwnerAnswer(holdOptions, record.gate_receipt_id, 3_000, Date.now() + wait, io);
+  ctx.linkDeadline = deadlineAt;
+  return toResult(await finishOwnerAnswer(answer, ctx));
+}
+
 function gateModeText(decision) {
   const parts = [decision.enforced === true
     ? 'enforced'
@@ -862,10 +2629,15 @@ function gateModeText(decision) {
   return parts.join('; ');
 }
 
-function printGate(decision, runtime, stream = process.stdout) {
+function printGate(decision, runtime, stream = process.stdout, { resolvesHolds = false } = {}) {
   stream.write(`Marrow gate: ${decision.decision} (${gateModeText(decision)})\n`);
   if (decision.beforeYouAct) stream.write(`Before you act: ${decision.beforeYouAct}\n`);
-  if (decision.exactNextAction) stream.write(`Next: ${decision.exactNextAction}\n`);
+  // A hold's served text is written for agents; the runner states its own next step instead,
+  // and `run` explains the hold itself while it resolves it.
+  const hold = shouldBlock(decision, { policy: 'enforce' }) ? heldApproval(runtime, decision) : null;
+  if (hold) {
+    if (!resolvesHolds) stream.write(`Next: ${holdNextText(hold)}\n`);
+  } else if (decision.exactNextAction) stream.write(`Next: ${decision.exactNextAction}\n`);
   if (decision.proofPack?.required) {
     const missing = decision.proofPack.missing?.length ? ` missing: ${decision.proofPack.missing.join(', ')}` : '';
     stream.write(`Proof pack: required${missing}\n`);
@@ -959,7 +2731,7 @@ function commitIdempotencyKey(options, decisionId, { perInvocation = true } = {}
   return `marrow-run-${crypto.createHash('sha256').update(parts.join('\u0000')).digest('hex')}`;
 }
 
-async function commitOutcome(options, decisionId, success, outcome, proof, gateReceiptId, modelUsage = null, { perInvocation = true } = {}) {
+async function commitOutcome(options, decisionId, success, outcome, proof, gateReceiptId, modelUsage = null, { perInvocation = true, extras = {} } = {}) {
   const body = {
     decision_id: decisionId,
     success,
@@ -968,6 +2740,9 @@ async function commitOutcome(options, decisionId, success, outcome, proof, gateR
     source_meta: sourceMeta(options, 'commit', { action: outcome }),
   };
   if (gateReceiptId) body.gate_receipt_id = gateReceiptId;
+  // An arbitration hold closes with its arbitration receipt and the owner's approval receipt.
+  if (extras.arbitration_receipt_id) body.arbitration_receipt_id = extras.arbitration_receipt_id;
+  if (extras.owner_approval_receipt_id) body.owner_approval_receipt_id = extras.owner_approval_receipt_id;
   if (modelUsage) body.model_usage = modelUsage;
   return durableRequestJson(options, '/v1/agent/commit', body, commitIdempotencyKey(options, decisionId, { perInvocation }));
 }
@@ -980,12 +2755,10 @@ async function decisionForAction(options, decision, action, type, target, surfac
 }
 
 async function runGoverned(parsed, execution = {}) {
-  const { options, childCommand } = parsed;
-  const commandText = redactedCommand(childCommand);
-  const action = options.action ? redact(options.action) : commandText;
-  const riskText = `${action} ${commandText} ${options.target || ''}`;
-  const type = options.type || inferType(riskText);
-  const risky = isRisky(riskText, type);
+  const { childCommand } = parsed;
+  let options = parsed.options;
+  const inputs = governedInputs(options, childCommand);
+  const { commandText, action, type, risky, surfaces, target } = inputs;
   let runtime = null;
   let decision = null;
   let decisionId = '';
@@ -995,7 +2768,16 @@ async function runGoverned(parsed, execution = {}) {
   let degraded = false;
   let advisory = false;
   let protectedAction = risky;
-  const surfaces = inferSurfaces(commandText || action);
+  let hold = null;
+  let holdApproval = null;
+  let approvedHold = false;
+  let gateReceiptId = '';
+  let commitExtras = {};
+  let decisionResolved = false;
+  let claimed = false;
+  const records = holdRecordStore(execution);
+  const holdKey = runnerHoldKey(options, inputs.holdMaterial, records.salt());
+  const blocked = (exitCode, message, extra = {}) => ({ ok: false, blocked: true, exitCode, action, type, risky, ...extra, message });
 
   let localControl;
   try { localControl = readLocalControlState(execution.controlStateOptions || {}); }
@@ -1010,51 +2792,109 @@ async function runGoverned(parsed, execution = {}) {
   }
 
   try {
-    runtime = await preflightRuntime(options, action, type, commandText);
-    decision = gateDecision(runtime);
-    protectedAction = risky
-      || decision.required === true
-      || decision.riskLevel === 'high'
-      || decision.riskLevel === 'critical';
-    if (!decision.recognized) {
-      if (protectedAction) throw new Error('Marrow runtime returned no gate decision, so this protected action cannot be checked.');
-      process.stderr.write('Marrow gate: no decision returned; continuing because this action is not protected.\n');
+    // 0. An earlier run of this exact command left a hold: its answer decides, on the same gate
+    // receipt (no new receipt, no new email). Once a hold exists nothing may run it unapproved.
+    const resumed = await resumeRecordedHold(options, records, holdKey, execution);
+    if (resumed.state !== 'none') protectedAction = true;
+    if (resumed.state === 'blocked') {
+      return blocked(resumed.exitCode, resumed.message, { decision_id: resumed.decisionId || '', gate_receipt_id: resumed.gateReceiptId, approval: resumed.approval });
+    }
+    // Asking the owner to reverse their decline starts a new hold in the decline's session.
+    if (resumed.state === 'none' && resumed.sessionId) options = { ...options, sessionId: resumed.sessionId };
+    if (resumed.state === 'approved') {
+      hold = resumed.hold;
+      approvedHold = true;
+      options = resumed.options;
+      holdApproval = resumed.approval;
+      gateReceiptId = resumed.gateReceiptId;
+      decisionId = resumed.decisionId;
+      decisionSource = 'earlier_hold';
+      decisionResolved = true;
+      commitExtras = resumed.commitExtras || {};
     } else {
-      printGate(decision, runtime);
+      runtime = await preflightRuntime(options, action, type, commandText, surfaces);
+      decision = runnerGateDecision(runtime);
+      protectedAction = risky
+        || decision.required === true
+        || decision.riskLevel === 'high'
+        || decision.riskLevel === 'critical';
+      if (!decision.recognized) {
+        if (protectedAction) throw new Error('Marrow runtime returned no gate decision, so this protected action cannot be checked.');
+        process.stderr.write('Marrow gate: no decision returned; continuing because this action is not protected.\n');
+      } else {
+        printGate(decision, runtime, execution.gateOutput || process.stdout, { resolvesHolds: true });
+      }
+      gateReceiptId = decision.receiptId || '';
+      if (shouldBlock(decision, options)) {
+        // Held or blocked: from here every failure blocks; nothing degrades into running it.
+        protectedAction = true;
+        hold = heldApproval(runtime, decision);
+        if (!hold || hold.kind === 'legacy') {
+          return blocked(12, blockMessage(decision, hold), { decision, gate_receipt_id: gateReceiptId || null });
+        }
+        // The decision is resolved first so the operator's answer and the owner's link name it.
+        ({ decisionId, source: decisionSource } = await decisionForAction(options, decision, action, type, target, surfaces));
+        decisionResolved = true;
+        const resolved = await resolveHold(options, hold, {
+          io: execution,
+          records,
+          holdKey,
+          decisionIds: { decisionId, runtimeDecisionId: decision.runtimeDecisionId || hold.arbitrationDecisionId || '' },
+        });
+        holdApproval = resolved.approval;
+        if (!resolved.approved) {
+          return blocked(resolved.exitCode, resolved.message, { decision, decision_id: decisionId, gate_receipt_id: hold.gateReceiptId, approval: holdApproval });
+        }
+        approvedHold = true;
+        commitExtras = resolved.commitExtras || {};
+      }
     }
-    if (shouldBlock(decision, options)) {
-      return {
-        ok: false,
-        blocked: true,
-        exitCode: 12,
-        action,
-        type,
-        risky,
-        decision,
-        message: blockMessage(decision),
-      };
+    if (approvedHold) {
+      // One run per approval: an identical run already using it keeps this one from running.
+      if (!records.claim(holdKey, gateReceiptId)) {
+        return blocked(12, `An identical run is already using the approval of gate receipt ${gateReceiptId}, so this one did not run.`, { decision_id: decisionId, gate_receipt_id: gateReceiptId, approval: holdApproval });
+      }
+      claimed = true;
     }
-    const target = options.target || commandText;
-    ({ decisionId, source: decisionSource } = await decisionForAction(options, decision, action, type, target, surfaces));
+    if (!decisionResolved) ({ decisionId, source: decisionSource } = await decisionForAction(options, decision, action, type, target, surfaces));
     // Permits exist only where the plan enforces the gate. An advisory plan shows its warning,
     // runs the command and still records the outcome; it never asks for a permit it cannot get.
-    const permitRequired = protectedAction && decision.enforced !== false;
-    if (protectedAction && !permitRequired) {
+    // An approved ordinary hold runs on its gate receipt, as the MCP hooks do, and the commit
+    // closes that receipt. An approved arbitration hold needs the permit: Marrow issues it only
+    // when the proposal the owner approved is this exact action.
+    const arbitrationApproved = approvedHold && hold?.kind === 'arbitration';
+    const permitRequired = arbitrationApproved || (protectedAction && !approvedHold && decision?.enforced !== false);
+    if (protectedAction && !approvedHold && !permitRequired) {
       advisory = true;
-      process.stderr.write(`Marrow advisory: this ${type} action is not enforced on this plan (gate ${decision.decision}). Running it and recording the outcome.\n`);
+      process.stderr.write(`Marrow advisory: this ${type} action is not enforced on this plan (gate ${decision?.decision}). Running it and recording the outcome.\n`);
     }
     if (permitRequired) {
-      if (!decision.receiptId) throw new Error('Marrow runtime returned no gate receipt, so no action permit can be issued.');
-      actionPermit = await issueActionPermit(requestJson, options, {
-        action,
-        type,
-        target,
-        surfaces,
-        decisionId,
-        gateReceiptId: decision.receiptId,
-        ownerApproval: options.ownerApproval,
-        proofRequirements: decision.proofPack?.required_fields || decision.proofPack?.missing || [],
-      });
+      if (!gateReceiptId) throw new Error('Marrow runtime returned no gate receipt, so no action permit can be issued.');
+      try {
+        actionPermit = await issueActionPermit(requestJson, options, {
+          action,
+          type,
+          target,
+          surfaces,
+          decisionId,
+          gateReceiptId,
+          ...(arbitrationApproved ? { ownerApproval: commitExtras.owner_approval_receipt_id } : {}),
+          proofRequirements: decision?.proofPack?.required_fields || decision?.proofPack?.missing || [],
+        });
+      } catch (error) {
+        if (arbitrationApproved) {
+          const code = permitErrorCode(error);
+          if (PERMIT_REFUSAL_STATUSES.has(error.status)) {
+            const refused = new Error(`Marrow refused the permit for this command on the owner's arbitration approval (${code}), so it did not run. Marrow issues it only when the proposal the owner approved is this exact action.`);
+            refused.status = error.status;
+            throw refused;
+          }
+          const unavailable = new Error(`Marrow could not issue the permit for the owner's arbitration approval right now (${code}), so it did not run. Rerun the command; it picks up the approval.`);
+          unavailable.status = error.status;
+          throw unavailable;
+        }
+        throw error;
+      }
       if (!actionPermit?.permit || !actionPermit?.permit_id) {
         throw new Error('Marrow did not issue a valid action permit.');
       }
@@ -1078,6 +2918,12 @@ async function runGoverned(parsed, execution = {}) {
       degraded = true;
       process.stderr.write(`Marrow degraded: ${error.message}. Continuing because this action is not protected${decisionId ? '' : '; its outcome will not be recorded'}.\n`);
     } else {
+      // A refusal spends the hold (a fresh gate is needed); a failure a later run may not meet
+      // (Marrow unreachable or unavailable) keeps it, so the next run picks the approval up.
+      if (claimed) {
+        if (PERMIT_REFUSAL_STATUSES.has(error.status)) records.remove(holdKey);
+        else records.release(holdKey);
+      }
       return {
         ok: false,
         blocked: true,
@@ -1086,6 +2932,7 @@ async function runGoverned(parsed, execution = {}) {
         action,
         type,
         risky,
+        ...(hold ? { gate_receipt_id: gateReceiptId || null, approval: holdApproval } : {}),
         message: error.message,
       };
     }
@@ -1109,8 +2956,9 @@ async function runGoverned(parsed, execution = {}) {
         success,
         outcome,
         proof,
-        decision?.receiptId || '',
+        gateReceiptId,
         child.modelUsage,
+        { extras: commitExtras },
       );
       commitState = commit?.committed === true ? 'committed' : 'not_committed';
       if (commitState === 'not_committed') {
@@ -1122,6 +2970,8 @@ async function runGoverned(parsed, execution = {}) {
   } else if (!degraded) {
     process.stderr.write('Marrow outcome not recorded: no decision id was returned before the command ran.\n');
   }
+  // The approval is spent: this command's hold is done.
+  if (approvedHold) records.remove(holdKey);
 
   let permitClosed = null;
   if (actionPermit?.permit) {
@@ -1151,7 +3001,8 @@ async function runGoverned(parsed, execution = {}) {
     decision,
     decision_id: decisionId,
     decision_source: decisionSource,
-    gate_receipt_id: decision?.receiptId || null,
+    gate_receipt_id: gateReceiptId || null,
+    ...(holdApproval ? { approval: holdApproval } : {}),
     outcome_committed: commitState === 'committed',
     outcome_commit_state: commitState,
     permit_id: actionPermit?.permit_id || null,
@@ -1172,17 +3023,14 @@ async function runGoverned(parsed, execution = {}) {
 
 async function permitOnly(parsed) {
   const { options } = parsed;
-  const action = redact(options.action);
-  const type = options.type || inferType(action);
-  const target = options.target || action;
-  const surfaces = inferSurfaces(target);
-  const runtime = await preflightRuntime(options, action, type, target);
-  const decision = gateDecision(runtime);
+  const { action, type, target, surfaces } = governedInputs(options, null, 'target');
+  const runtime = await preflightRuntime(options, action, type, target, surfaces);
+  const decision = runnerGateDecision(runtime);
   if (!decision.recognized) {
     return { ok: false, blocked: true, exitCode: 13, decision, message: 'Marrow runtime returned no gate decision, so no permit was issued.' };
   }
   if (shouldBlock(decision, options)) {
-    return { ok: false, blocked: true, exitCode: 12, decision, message: blockMessage(decision) };
+    return { ok: false, blocked: true, exitCode: 12, decision, message: blockMessage(decision, heldApproval(runtime, decision)) };
   }
   const { decisionId } = await decisionForAction(options, decision, action, type, target, surfaces);
   if (decision.enforced === false) {
@@ -1207,7 +3055,6 @@ async function permitOnly(parsed) {
     surfaces,
     decisionId,
     gateReceiptId: decision.receiptId,
-    ownerApproval: options.ownerApproval,
     proofRequirements: decision.proofPack?.required_fields || decision.proofPack?.missing || [],
   });
   return { ok: true, decision_id: decisionId, gate_receipt_id: decision.receiptId, ...result };
@@ -1215,13 +3062,11 @@ async function permitOnly(parsed) {
 
 async function verifyPermitOnly(parsed) {
   const { options } = parsed;
-  const action = redact(options.action);
-  const type = options.type || inferType(action);
-  const surfaces = inferSurfaces(options.target || action);
+  const { action, type, target, surfaces } = governedInputs(options, null, 'target');
   const result = await verifyActionPermit(requestJson, options, {
     action,
     type,
-    target: options.target || action,
+    target,
     surfaces,
     permit: options.permit,
   });
@@ -1244,13 +3089,16 @@ async function sidecarOnly(parsed) {
     const detection = detectEnvironment(root, process.env);
     // Maintenance re-applies the controller's own configured agent id and base URL. A different
     // value found in managed MCP config is replaced unless the owner allowlisted it, and the
-    // divergence is reported. It never edits the owner's Hermes config.
+    // divergence is reported. It never edits the owner's Hermes config. Hooks stay on the
+    // verified local MCP runtime when there is one (checked, never installed, here).
+    const mcpRuntime = maintenanceMcpRuntime(detection, { mcpLocalRuntime: process.env.MARROW_LOCAL_RUNTIME !== '0' });
     const plan = buildPlan(detection, {
       mode: managedMode,
       agentId: options.agentId,
       baseUrl: options.baseUrl,
       client: options.client,
       maintenance: true,
+      mcpRuntime,
     });
     const changes = applyPlan(plan, { yes: true, dryRun: false, doctor: false });
     const repaired = changes.filter((change) => change.applied).map((change) => change.label);
@@ -1310,20 +3158,18 @@ async function controllerOnly(parsed) {
 
 async function gateOnly(parsed) {
   const { options } = parsed;
-  const action = redact(options.action);
-  const type = options.type || inferType(action);
-  const protectedAction = isRisky(action, type);
+  const { action, type, risky: protectedAction, surfaces } = governedInputs(options, null, 'action');
   let localControl;
   try { localControl = readLocalControlState(); } catch (error) {
     if (protectedAction) return { ok: false, allowed: false, blocked: true, exitCode: 13, action, type, decision: null, message: error.message };
     localControl = { enabled: true };
   }
   if (!localControl.enabled) {
-    const bypass = protectedAction ? await recordGovernedBypass({ harness: options.client, agentId: options.agentId, surfaces: inferSurfaces(action), risk: 'high' }, options) : { bypass_recorded: false, remote_delivered: false };
+    const bypass = protectedAction ? await recordGovernedBypass({ harness: options.client, agentId: options.agentId, surfaces, risk: 'high' }, options) : { bypass_recorded: false, remote_delivered: false };
     return { ok: true, allowed: true, state: 'owner_disabled', action, type, bypass_recorded: bypass.bypass_recorded, bypass_remote_delivered: bypass.remote_delivered, decision: null, permit: null };
   }
-  const runtime = await preflightRuntime(options, action, type, action);
-  const decision = gateDecision(runtime);
+  const runtime = await preflightRuntime(options, action, type, action, surfaces);
+  const decision = runnerGateDecision(runtime);
   if (!decision.recognized) {
     return {
       ok: false,
@@ -1357,7 +3203,9 @@ async function gateOnly(parsed) {
     ...(blocked ? {
       message: decision.observationOnly
         ? blockMessage(decision)
-        : decision.exactNextAction || `Marrow gate ${decision.decision}: this action needs owner approval or a policy change before it runs.`,
+        : heldApproval(runtime, decision)
+        ? blockMessage(decision, heldApproval(runtime, decision))
+        : decision.exactNextAction || `Marrow gate ${decision.decision}: this action needs approval or a policy change before it runs.`,
     } : {}),
   };
 }
@@ -2440,7 +4288,7 @@ async function runStatusCheck(options) {
 async function runGateCheck(options) {
   if (!options.apiKey) return 'MARROW_API_KEY is missing. Gate check skipped.';
   const runtime = await preflightRuntime(options, 'deploy production worker after tests pass', 'deploy', 'wrangler deploy');
-  const decision = gateDecision(runtime);
+  const decision = runnerGateDecision(runtime);
   const proof = decision.proofPack?.required
     ? ` Proof required${decision.proofPack.missing?.length ? `; missing ${decision.proofPack.missing.join(', ')}` : ''}.`
     : '';
@@ -2645,7 +4493,7 @@ async function runFleetInteractive(options, input = process.stdin, output = proc
           } else if (state.cursor === 2) {
             const receipts = state.snapshot.arbitrations.receipts;
             state.lastResult = receipts.length
-              ? receipts.map((receipt, index) => `${index + 1}. ${receipt.id}: ${receipt.resolution}${receipt.decision_id ? `; decision=${receipt.decision_id}` : ''}${receipt.selected_proposal_id ? `; selected=${receipt.selected_proposal_id}` : ''}; ${receipt.exact_next_action || receipt.conflict_type}${receipt.owner_approval_required ? ' Owner approval must be issued from an authenticated Marrow dashboard session.' : ''}`).join('  ')
+              ? receipts.map((receipt, index) => `${index + 1}. ${receipt.id}: ${receipt.resolution}${receipt.decision_id ? `; decision=${receipt.decision_id}` : ''}${receipt.selected_proposal_id ? `; selected=${receipt.selected_proposal_id}` : ''}; ${receipt.exact_next_action || receipt.conflict_type}${receipt.owner_approval_required ? ' Needs the account owner\'s approval; an agent cannot approve it.' : ''}`).join('  ')
               : 'No agent disagreements or arbitration receipts returned yet.';
           } else if (state.cursor === 6) {
             state.lastResult = state.snapshot.recent_decisions.length
@@ -2684,6 +4532,9 @@ async function runCli(argv) {
   if (parsed.options?.keyFromArg) {
     process.stderr.write('Warning: prefer MARROW_API_KEY instead of --key because command-line args can be visible in process listings.\n');
   }
+  if (parsed.options?.ownerApprovedFlagIgnored) {
+    process.stderr.write(`Note: --owner-approved no longer does anything. ${OWNER_APPROVAL_NOTICE}\n`);
+  }
 
   let result;
   if (parsed.command === 'run') result = await runGoverned(parsed);
@@ -2740,6 +4591,19 @@ module.exports = {
   recordGovernanceModeSelection,
   gateDecision,
   shouldBlock,
+  heldApproval,
+  holdNextText,
+  resolveHold,
+  resumeRecordedHold,
+  holdRecordStore,
+  runnerHoldKey,
+  governedInputs,
+  withRedactedInputs,
+  defaultRunnerSession,
+  agentHostDetected,
+  agentHostAncestor,
+  approvalPromptAvailable,
+  withoutCallerApproval,
   governPanel,
   renderGovernTui,
   canUseInteractive,