The "approve all" setting: while on, the host's UI activates each candidate generation as it arrives instead of asking for approval (the same activation, so probation and revert-on-crash still apply). Only Dyn activations: reverting still asks.

Kept in the credential store (Rho.CredentialStore, the phone's secure store), not a settings file, so the agent's file tools can't flip it. Off by default (and whenever the store can't be read). Turning it on takes the human's screen lock: enable/0 needs a fresh confirmation of subject/0 from the configured approval (in the app, Rho.Dyn.Approval.Biometric, fed only by the approve control's pass). Turning it off needs nothing. The static check rejects Dyn code that calls this module (Rho.Dyn.Check, best effort), and no tool calls enable/0.