diff --git a/gui/src/store.svelte.ts b/gui/src/store.svelte.ts
index 65f72a0..b2cc447 100644
--- a/gui/src/store.svelte.ts
+++ b/gui/src/store.svelte.ts
@@ -561,6 +561,10 @@ class AppStore {
    *  CEC tab renders it as a live "Dialing…" row so a connect attempt is
    *  visible from the first click (discovery alone can take up to ~45s). */
   cecDialingNumber = $state<string | null>(null);
+  /** The NODE currently being dialed (Answer / Open / Chat go by node, which
+   *  never sets `cecDialingNumber`) — what lets the help sidebar pin its
+   *  inline "Connecting…" status to the row that was actually clicked. */
+  cecDialingNode = $state<string | null>(null);
   /** Live CEC sessions this app is party to, newest first. */
   cecSessions = $state<{ sessionId: string; state: string; node?: string }[]>([]);
   /** The customer's live consent grants (populated when hosting). */
@@ -4280,11 +4284,24 @@ class AppStore {
    *  raised-hand row offer the KVM's web Site (and anything else the graph
    *  knows) alongside the remote-control console. Undefined for an ordinary
    *  customer, a KVM outside our graph, or one whose KVM affordances aren't
-   *  ours to use. */
-  kvmTwin(cecNode: string | undefined): MeshNode | undefined {
+   *  ours to use.
+   *
+   *  Authorization is EITHER side of the tech/owner divide: `kvmAllowed`
+   *  (ours / co-fleet / shared) for a KVM in our own fleet, or — mirroring
+   *  `capabilitiesFor`'s `isCec` arm — a dialed CEC customer. A help
+   *  technician is neither owner nor co-fleet of the customer's appliance,
+   *  yet the KVM's whole point on the help queue is that the tech can open
+   *  its manufacturer web UI; the KVM itself authorizes that tunnel by its
+   *  mesh roster, so the gate here only decides whether the button shows.
+   *  `raisedHand` (queue rows) skips the ACL entirely: the hand-raise IS the
+   *  ask — a beacon this customer deliberately lit — so the Site door shows
+   *  the moment the graph knows the machine is a KVM, even before Answer. */
+  kvmTwin(cecNode: string | undefined, opts?: { raisedHand?: boolean }): MeshNode | undefined {
     if (!cecNode) return undefined;
     const node = this.nodeByCanonical(cecNode);
-    return this.isKvm(node) && this.kvmAllowed(node) ? node : undefined;
+    if (!this.isKvm(node)) return undefined;
+    if (opts?.raisedHand) return node;
+    return this.kvmAllowed(node) || this.isCecCustomer(cecNode) ? node : undefined;
   }
 
   /** Open a KVM's own web UI through the mesh — map its web site to a local
@@ -7223,6 +7240,10 @@ class AppStore {
     const byNode = "node" in target;
     this.cecDialing = true;
     this.cecDialingNumber = byNode ? null : target.number;
+    // Which ROW is being dialed, for the help sidebar's inline status — a
+    // by-node dial (Answer / Open / Chat) never sets `cecDialingNumber`, so
+    // without this the sidebar had nothing to pin its "Connecting…" line to.
+    this.cecDialingNode = byNode ? target.node : null;
     clientLog(`[cec] dialing ${display}…`);
     try {
       // Hard cap the wait so a wedged socket request can't leave cecDialing
@@ -7258,6 +7279,7 @@ class AppStore {
     } finally {
       this.cecDialing = false;
       this.cecDialingNumber = null;
+      this.cecDialingNode = null;
       void this.loadCec();
     }
   }
@@ -7270,6 +7292,22 @@ class AppStore {
     await cecCancelDial();
   }
 
+  /** The inline wait status a CEC row should show for `node`: "dialing" while
+   *  the connect RPC is in flight to that machine, "approval" once the dial
+   *  landed and the ball is in the customer's court (their approve prompt is
+   *  up), null when nothing is pending. The help sidebar renders this in the
+   *  row itself — it has no status strip like the settings console panel. */
+  cecWaitPhase(node: string | undefined): "dialing" | "approval" | null {
+    if (!node) return null;
+    if (this.cecAutoOpenNode && this.isSameMachine(this.cecAutoOpenNode, node)) {
+      return "approval";
+    }
+    if (this.cecDialing && this.cecDialingNode && this.isSameMachine(this.cecDialingNode, node)) {
+      return "dialing";
+    }
+    return null;
+  }
+
   /** Flip the "Watch the help queue" opt-in, then re-read the node's status —
    *  membership is the saved state, so the toggle shows what actually took
    *  (and keeps showing it after a restart, no local flag needed). A failure
diff --git a/gui/src/ui/HelpTab.svelte b/gui/src/ui/HelpTab.svelte
index 6ef9fad..4cb806f 100644
--- a/gui/src/ui/HelpTab.svelte
+++ b/gui/src/ui/HelpTab.svelte
@@ -119,46 +119,72 @@
     <ul class="rows">
       {#each app.cecHelpWaiting as w (w.node)}
         {@const shownName = app.cecAliases[w.number]?.trim() || w.label?.trim() || "Customer"}
-        {@const kvm = app.kvmTwin(w.node)}
+        {@const kvm = app.kvmTwin(w.node, { raisedHand: true })}
+        {@const phase = app.cecWaitPhase(w.node)}
         <li class="row">
-          <span class="dot" aria-hidden="true"></span>
-          <div class="who">
-            <b class="name">{shownName}<span class="host">{hostTail(shownName, w.hostname)}</span></b>
-            <span class="sub">
-              <span class="num" title={`Number ${w.number}`}>CEC {groupNumber(w.number)}</span>
-              <span class="meta">· {waitingLabel(w.asked_at)}</span>
-            </span>
+          <div class="row-head">
+            <span class="dot" aria-hidden="true"></span>
+            <div class="who">
+              <b class="name">{shownName}<span class="host">{hostTail(shownName, w.hostname)}</span></b>
+              <span class="sub">
+                <span class="num" title={`Number ${w.number}`}>CEC {groupNumber(w.number)}</span>
+                <span class="meta">· {waitingLabel(w.asked_at)}</span>
+              </span>
+            </div>
+          </div>
+          <!-- The card's action row. Every door this row offers lives down
+               here (and new ones join here), instead of icons squeezed
+               beside the name. While a connect to THIS row is in flight the
+               buttons give way to an inline status - the sidebar has no
+               status strip like the settings console panel, so the card
+               itself says what's happening. -->
+          <div class="row-actions">
+            {#if phase}
+              <span class="wait-line">
+                <span class="wait-dot" aria-hidden="true"></span>
+                {phase === "approval" ? "Waiting for them to approve…" : "Connecting…"}
+              </span>
+              <button
+                class="stop-btn"
+                title={phase === "approval" ? "Stop waiting for their approval" : "Stop this connection attempt"}
+                onclick={() => void (phase === "approval" ? app.stopCecWait() : app.cancelCecDial())}
+              >
+                Stop
+              </button>
+            {:else}
+              <button
+                class="answer"
+                disabled={app.cecDialing}
+                title="Answer — connect and open their screen once they approve"
+                onclick={() => void app.answerHelp(w.node, shownName)}
+              >
+                Answer
+              </button>
+              {#if kvm}
+                <!-- A raised hand from a KVM: the console (Answer) is only half
+                     the story — its manufacturer web Site rides the graph, one
+                     tap away. -->
+                <button
+                  class="site-btn"
+                  title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
+                  onclick={() => void app.openKVM(kvm.id)}
+                >
+                  🌐 Site
+                </button>
+              {:else}
+                <!-- A person's machine gets the chat door; a KVM appliance is
+                     not someone to chat with, so its row doesn't. -->
+                <button
+                  class="chat-btn"
+                  disabled={app.cecDialing}
+                  title="Chat — connect and message this customer (without taking their screen)"
+                  onclick={() => void app.chatWithCustomer(w.node)}
+                >
+                  💬 Chat{#if app.chatUnread[w.node]}<span class="chat-badge">{app.chatUnread[w.node]}</span>{/if}
+                </button>
+              {/if}
+            {/if}
           </div>
-          <button
-            class="answer"
-            disabled={app.cecDialing}
-            title="Answer — connect and open their screen once they approve"
-            onclick={() => void app.answerHelp(w.node, shownName)}
-          >
-            Answer
-          </button>
-          {#if kvm}
-            <!-- A raised hand from one of our KVMs: the console (Answer) is
-                 only half the story — its normal web Site rides the graph,
-                 one tap away. -->
-            <button
-              class="site-btn"
-              title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
-              aria-label="Open this KVM's web Site"
-              onclick={() => void app.openKVM(kvm.id)}
-            >
-              🌐
-            </button>
-          {/if}
-          <button
-            class="chat-btn"
-            disabled={app.cecDialing}
-            title="Chat — connect and message this customer (without taking their screen)"
-            aria-label="Chat with this customer"
-            onclick={() => void app.chatWithCustomer(w.node)}
-          >
-            💬{#if app.chatUnread[w.node]}<span class="chat-badge">{app.chatUnread[w.node]}</span>{/if}
-          </button>
         </li>
       {/each}
     </ul>
@@ -169,65 +195,86 @@
       {@const name = app.cecCustomerName(c)}
       {@const kvm = app.kvmTwin(c.node)}
       <li class="row known">
-        <span class="dot" class:on={c.online} aria-hidden="true"></span>
-        <div class="who">
-          {#if editingKey === c.number}
-            <!-- svelte-ignore a11y_autofocus -->
-            <input
-              class="rename"
-              type="text"
-              autofocus
-              placeholder={c.label || "Customer name"}
-              bind:value={aliasDraft}
-              onblur={() => saveRename(c.number)}
-              onkeydown={(e) => {
-                if (e.key === "Enter") saveRename(c.number);
-                else if (e.key === "Escape") cancelRename();
-              }}
-            />
-          {:else}
-            <button
-              class="name-btn"
-              title="Click to rename"
-              onclick={() => startRename(c.number)}
-            >
-              <b class="name">{name}<span class="host">{hostTail(name, c.hostname)}</span></b>
-            </button>
-            <span class="sub">
-              <span class="num" title={`Support number ${groupNumber(c.number)}`}>#{groupNumber(c.number)}</span>
-              <span class="meta">· {lastUsedLabel(c.last_used)}</span>
-            </span>
-          {/if}
+        <div class="row-head">
+          <span class="dot" class:on={c.online} aria-hidden="true"></span>
+          <div class="who">
+            {#if editingKey === c.number}
+              <!-- svelte-ignore a11y_autofocus -->
+              <input
+                class="rename"
+                type="text"
+                autofocus
+                placeholder={c.label || "Customer name"}
+                bind:value={aliasDraft}
+                onblur={() => saveRename(c.number)}
+                onkeydown={(e) => {
+                  if (e.key === "Enter") saveRename(c.number);
+                  else if (e.key === "Escape") cancelRename();
+                }}
+              />
+            {:else}
+              <button
+                class="name-btn"
+                title="Click to rename"
+                onclick={() => startRename(c.number)}
+              >
+                <b class="name">{name}<span class="host">{hostTail(name, c.hostname)}</span></b>
+              </button>
+              <span class="sub">
+                <span class="num" title={`Support number ${groupNumber(c.number)}`}>#{groupNumber(c.number)}</span>
+                <span class="meta">· {lastUsedLabel(c.last_used)}</span>
+              </span>
+            {/if}
+          </div>
         </div>
         {#if editingKey !== c.number}
-          <button
-            class="reopen"
-            class:on={c.online}
-            disabled={app.cecDialing}
-            title={c.online ? "Reconnect and open their screen" : "Try to reconnect — they must be online and approve"}
-            onclick={() => void app.reconnectCec(c.node)}
-          >
-            {c.online ? "Open" : "Reconnect"}
-          </button>
-          {#if kvm}
-            <button
-              class="site-btn"
-              title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
-              aria-label="Open this KVM's web Site"
-              onclick={() => void app.openKVM(kvm.id)}
-            >
-              🌐
-            </button>
-          {/if}
-          <button
-            class="chat-btn"
-            disabled={app.cecDialing}
-            title="Chat — connect and message this customer (without taking their screen)"
-            aria-label="Chat with this customer"
-            onclick={() => void app.chatWithCustomer(c.node)}
-          >
-            💬{#if app.chatUnread[c.node]}<span class="chat-badge">{app.chatUnread[c.node]}</span>{/if}
-          </button>
+          <!-- Bottom action row, same layout as the queue cards - and the
+               same inline status while a connect to this row is pending. -->
+          {@const phase = app.cecWaitPhase(c.node)}
+          <div class="row-actions">
+            {#if phase}
+              <span class="wait-line">
+                <span class="wait-dot" aria-hidden="true"></span>
+                {phase === "approval" ? "Waiting for them to approve…" : "Connecting…"}
+              </span>
+              <button
+                class="stop-btn"
+                title={phase === "approval" ? "Stop waiting for their approval" : "Stop this connection attempt"}
+                onclick={() => void (phase === "approval" ? app.stopCecWait() : app.cancelCecDial())}
+              >
+                Stop
+              </button>
+            {:else}
+              <button
+                class="reopen"
+                class:on={c.online}
+                disabled={app.cecDialing}
+                title={c.online ? "Reconnect and open their screen" : "Try to reconnect — they must be online and approve"}
+                onclick={() => void app.reconnectCec(c.node)}
+              >
+                {c.online ? "Open" : "Reconnect"}
+              </button>
+              {#if kvm}
+                <button
+                  class="site-btn"
+                  title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
+                  onclick={() => void app.openKVM(kvm.id)}
+                >
+                  🌐 Site
+                </button>
+              {:else}
+                <!-- Chat is for people; a KVM row offers its Site instead. -->
+                <button
+                  class="chat-btn"
+                  disabled={app.cecDialing}
+                  title="Chat — connect and message this customer (without taking their screen)"
+                  onclick={() => void app.chatWithCustomer(c.node)}
+                >
+                  💬 Chat{#if app.chatUnread[c.node]}<span class="chat-badge">{app.chatUnread[c.node]}</span>{/if}
+                </button>
+              {/if}
+            {/if}
+          </div>
         {/if}
       </li>
     {/snippet}
@@ -316,14 +363,61 @@
     flex-direction: column;
     gap: 0.4rem;
   }
+  /* Each entry is a small card: identity on top, its action buttons in a
+     row along the bottom (with room for more as they earn a spot). */
   .row {
     display: flex;
-    align-items: center;
+    flex-direction: column;
     gap: 0.5rem;
     padding: 0.5rem 0.55rem;
     background: var(--surface-2);
     border-radius: var(--r-sm);
   }
+  .row-head {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+  .row-actions {
+    display: flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: 0.4rem;
+  }
+  /* Inline connect status - takes the action row's place while a dial to
+     this row is in flight or the customer's approve prompt is up. */
+  .wait-line {
+    flex: 1;
+    min-width: 0;
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    font-size: 0.74rem;
+    font-weight: 600;
+    color: var(--ok);
+  }
+  .wait-dot {
+    width: 0.5rem;
+    height: 0.5rem;
+    border-radius: 50%;
+    background: var(--ok);
+    animation: pulse 1.8s ease-out infinite;
+  }
+  .stop-btn {
+    flex-shrink: 0;
+    border: 1px solid var(--danger);
+    background: transparent;
+    color: var(--danger);
+    font: inherit;
+    font-size: 0.74rem;
+    font-weight: 700;
+    padding: 0.28rem 0.6rem;
+    border-radius: var(--r-sm);
+    cursor: pointer;
+  }
+  .stop-btn:hover {
+    background: var(--danger-soft);
+  }
   .dot {
     flex-shrink: 0;
     width: 0.55rem;
@@ -398,25 +492,27 @@
     opacity: 0.5;
     cursor: default;
   }
-  /* The KVM's web-Site door — same compact icon-button shape as the chat
-     companion, shown only when the row's machine is one of our KVMs. */
+  /* The KVM's manufacturer web-Site door — a labeled button on the card's
+     action row, shown only when the row's machine is a KVM. */
   .site-btn {
     flex-shrink: 0;
     border: 1px solid var(--line-strong);
     background: transparent;
     color: var(--ink-soft);
     font: inherit;
-    font-size: 0.82rem;
+    font-size: 0.74rem;
+    font-weight: 700;
     line-height: 1;
-    padding: 0.28rem 0.4rem;
+    padding: 0.3rem 0.6rem;
     border-radius: var(--r-sm);
     cursor: pointer;
   }
   .site-btn:hover {
     background: var(--surface);
   }
-  /* The compact chat companion to Answer / Open — an icon button so the narrow
-     sidebar row stays readable, with an unread badge riding its corner. */
+  /* The chat companion to Answer / Open — a labeled button on the action row
+     (people only; a KVM row shows its Site instead), with an unread badge
+     riding its corner. */
   .chat-btn {
     position: relative;
     flex-shrink: 0;
@@ -424,9 +520,10 @@
     background: transparent;
     color: var(--ink-soft);
     font: inherit;
-    font-size: 0.82rem;
+    font-size: 0.74rem;
+    font-weight: 700;
     line-height: 1;
-    padding: 0.28rem 0.4rem;
+    padding: 0.3rem 0.6rem;
     border-radius: var(--r-sm);
     cursor: pointer;
   }
diff --git a/gui/src/ui/settings/CecSection.svelte b/gui/src/ui/settings/CecSection.svelte
index 8d203f3..6cfdc24 100644
--- a/gui/src/ui/settings/CecSection.svelte
+++ b/gui/src/ui/settings/CecSection.svelte
@@ -225,7 +225,7 @@
       <ul class="rows">
         {#each app.cecHelpWaiting as w (w.node)}
           {@const shownName = app.cecAliases[w.number]?.trim() || w.label?.trim() || "Customer"}
-          {@const kvm = app.kvmTwin(w.node)}
+          {@const kvm = app.kvmTwin(w.node, { raisedHand: true })}
           <li class="row col asking">
             <div class="row-top">
               <span class="dot busy"></span>
@@ -247,8 +247,9 @@
                 Control
               </button>
               {#if kvm}
-                <!-- A raised hand from one of our KVMs: alongside the console,
-                     its normal web Site is one tap away via the graph. -->
+                <!-- A raised hand from a KVM: alongside the console, its
+                     manufacturer web Site is one tap away via the graph. No
+                     chat door - a KVM appliance isn't someone to chat with. -->
                 <button
                   class="btn small"
                   title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
@@ -256,15 +257,16 @@
                 >
                   🌐 Site
                 </button>
+              {:else}
+                <button
+                  class="btn small"
+                  disabled={app.cecDialing}
+                  title="Chat — connect and message them without taking their screen"
+                  onclick={() => void app.chatWithCustomer(w.node)}
+                >
+                  💬 Chat{#if app.chatUnread[w.node]}<span class="chat-badge">{app.chatUnread[w.node]}</span>{/if}
+                </button>
               {/if}
-              <button
-                class="btn small"
-                disabled={app.cecDialing}
-                title="Chat — connect and message them without taking their screen"
-                onclick={() => void app.chatWithCustomer(w.node)}
-              >
-                💬 Chat{#if app.chatUnread[w.node]}<span class="chat-badge">{app.chatUnread[w.node]}</span>{/if}
-              </button>
             </div>
           </li>
         {/each}
@@ -372,6 +374,8 @@
                   </button>
                 {/if}
                 {#if kvm}
+                  <!-- A KVM's row: its Site instead of a chat door (a KVM
+                       appliance isn't someone to chat with). -->
                   <button
                     class="btn small"
                     title={`Open ${kvm.label || "this KVM"}'s web Site over the mesh`}
@@ -379,15 +383,16 @@
                   >
                     🌐 Site
                   </button>
+                {:else}
+                  <button
+                    class="btn small"
+                    disabled={app.cecDialing}
+                    title="Chat — connect and message them without taking their screen"
+                    onclick={() => void app.chatWithCustomer(c.node)}
+                  >
+                    💬 Chat{#if app.chatUnread[c.node]}<span class="chat-badge">{app.chatUnread[c.node]}</span>{/if}
+                  </button>
                 {/if}
-                <button
-                  class="btn small"
-                  disabled={app.cecDialing}
-                  title="Chat — connect and message them without taking their screen"
-                  onclick={() => void app.chatWithCustomer(c.node)}
-                >
-                  💬 Chat{#if app.chatUnread[c.node]}<span class="chat-badge">{app.chatUnread[c.node]}</span>{/if}
-                </button>
                 <button class="btn small" onclick={() => startRename(c.number)}>Rename</button>
                 <button
                   class="btn small danger"
diff --git a/node/src/mesh.rs b/node/src/mesh.rs
index bfc0670..e67fbee 100644
--- a/node/src/mesh.rs
+++ b/node/src/mesh.rs
@@ -1148,14 +1148,21 @@ impl Mesh {
         const SWEEP: std::time::Duration = std::time::Duration::from_secs(2);
         let mesh = Arc::downgrade(self);
         crate::spawn(async move {
+            // The last `cec://viewing` map this sweep emitted — technician
+            // canonical id → (screen live, control live). `None` until the
+            // first pass so a fresh node always emits once (even an empty
+            // map), giving a GUI that hydrated before us a baseline.
+            let mut last_viewing: Option<std::collections::BTreeMap<String, (bool, bool)>> = None;
             loop {
                 tokio::time::sleep(SWEEP).await;
                 let Some(mesh) = mesh.upgrade() else { break };
-                // A technician node enforces no consent (it isn't the host of
-                // the gated screen/input) — skip the whole pass.
-                if mesh.cec.is_technician() {
-                    continue;
-                }
+                // NOTE: no `is_technician` skip here. That early-out assumed a
+                // technician node hosts nothing consent-gated — but the role
+                // flips permanently on the first dial, and a DUAL-ROLE node
+                // (dialed someone once, yet also reachable as a customer) very
+                // much still hosts a consent-gated screen. On a pure technician
+                // node the body no-ops anyway: its routes point at customers,
+                // and `knows_technician` is false for those peers.
                 // Snapshot every live route (peer, id, is-screen, drive-plane)
                 // under the state lock, then drop it before touching the CEC
                 // store or tearing anything down (`disconnect` re-locks state).
@@ -1179,6 +1186,16 @@ impl Mesh {
                 let mut stale_routes: Vec<String> = Vec::new();
                 let mut lapsed_techs: std::collections::BTreeSet<String> =
                     std::collections::BTreeSet::new();
+                // What each technician is ACTUALLY doing right now, from the
+                // routes themselves: screen = a live display route, control = a
+                // live input route. This — not session state — is what the
+                // customer's "Viewing/Controlling your screen" chip keys on:
+                // a technician closing their console tears the routes down but
+                // sends no session event, and chat keeps the session itself
+                // alive, so session state over-claims. A route this very pass
+                // is tearing down for lapsed consent doesn't count.
+                let mut viewing: std::collections::BTreeMap<String, (bool, bool)> =
+                    std::collections::BTreeMap::new();
                 for (peer, route_id, is_screen, plane) in routes {
                     // Only CEC technicians are consent-gated; an owner/fleet or
                     // ordinary peer's routes are none of this sweep's business.
@@ -1190,35 +1207,76 @@ impl Mesh {
                     if screen_lapsed || drive_lapsed {
                         stale_routes.push(route_id);
                         lapsed_techs.insert(crate::cec::pubkey_part(&peer).to_string());
+                        continue;
                     }
-                }
-                if stale_routes.is_empty() {
-                    continue;
-                }
-                for id in &stale_routes {
-                    tracing::info!(
-                        "CEC consent lapsed — tearing down route {id} (approval revoked or expired)"
-                    );
-                    let _ = mesh.disconnect(id.clone()).await;
-                }
-                // End the lapsed technicians' sessions so the customer's
-                // "connected" banner clears — a route teardown alone emits no
-                // session event — and retire any leftover "Approve Once" grant.
-                for tech in lapsed_techs {
-                    for sid in mesh.cec.end_sessions_for(&tech) {
-                        mesh.sink.emit(
-                            "cec://session",
-                            json!({ "session_id": sid, "state": "ended" }),
+                    let entry = viewing
+                        .entry(crate::cec::pubkey_part(&peer).to_string())
+                        .or_insert((false, false));
+                    entry.0 |= is_screen;
+                    entry.1 |= plane == Some(DrivePlane::Input);
+                }
+                if !stale_routes.is_empty() {
+                    for id in &stale_routes {
+                        tracing::info!(
+                            "CEC consent lapsed — tearing down route {id} (approval revoked or expired)"
                         );
+                        let _ = mesh.disconnect(id.clone()).await;
                     }
-                    mesh.cec.retire_once(&tech);
+                    // End the lapsed technicians' sessions so the customer's
+                    // "connected" banner clears — a route teardown alone emits no
+                    // session event — and retire any leftover "Approve Once" grant.
+                    for tech in lapsed_techs {
+                        for sid in mesh.cec.end_sessions_for(&tech) {
+                            mesh.sink.emit(
+                                "cec://session",
+                                json!({ "session_id": sid, "state": "ended" }),
+                            );
+                        }
+                        mesh.cec.retire_once(&tech);
+                    }
+                    mesh.cec_emit_grants();
+                    mesh.emit_snapshot();
+                }
+                // Tell the GUI what's live whenever the picture changes (and
+                // once at startup, so a GUI that hydrated before this sweep
+                // gets its baseline). The event carries the whole map, so a
+                // missed frame self-heals on the next change.
+                if last_viewing.as_ref() != Some(&viewing) {
+                    mesh.sink.emit("cec://viewing", cec_viewing_value(&viewing));
+                    last_viewing = Some(viewing);
                 }
-                mesh.cec_emit_grants();
-                mesh.emit_snapshot();
             }
         });
     }
 
+    /// `cec_viewing` (customer): what each connected technician is actually
+    /// doing right now — `{ techs: { <canonical tech>: { screen, control } } }`
+    /// — derived from the LIVE routes, not session state. The event twin
+    /// (`cec://viewing`) is pushed by the consent sweep on every change; this
+    /// command is the pull for GUI hydrate, so an app that starts mid-session
+    /// paints the chip without waiting for a transition.
+    pub async fn cec_viewing(self: &Arc<Self>) -> Result<Value, String> {
+        let mut viewing: std::collections::BTreeMap<String, (bool, bool)> =
+            std::collections::BTreeMap::new();
+        {
+            let st = self.state.lock();
+            if let Some(session) = st.session.as_ref() {
+                for r in session.routes() {
+                    let peer = r.peer.as_str();
+                    if !self.cec.knows_technician(peer) {
+                        continue;
+                    }
+                    let entry = viewing
+                        .entry(crate::cec::pubkey_part(peer).to_string())
+                        .or_insert((false, false));
+                    entry.0 |= matches!(r.route.media, MediaKind::Display | MediaKind::Video);
+                    entry.1 |= route_drive_plane(&r.route) == Some(DrivePlane::Input);
+                }
+            }
+        }
+        Ok(cec_viewing_value(&viewing))
+    }
+
     /// Re-scan this machine's inventory every [`INVENTORY_RESCAN`] and
     /// refresh the live presence profile when the device picture changed,
     /// so a display that woke (or detached), a camera that appeared, or a
@@ -10870,6 +10928,21 @@ fn fresh_share_token() -> String {
 /// session so the receiver can dedupe and the sender can recognise the echo of
 /// its own message. Mirrors [`fresh_share_token`]; the `msg_` prefix only tells
 /// the two apart in a trace.
+/// The `cec://viewing` event / `cec_viewing` command payload: technician
+/// canonical id → what their live routes actually carry right now.
+fn cec_viewing_value(viewing: &std::collections::BTreeMap<String, (bool, bool)>) -> Value {
+    let techs: serde_json::Map<String, Value> = viewing
+        .iter()
+        .map(|(tech, (screen, control))| {
+            (
+                tech.clone(),
+                json!({ "screen": screen, "control": control }),
+            )
+        })
+        .collect();
+    json!({ "techs": techs })
+}
+
 fn fresh_chat_id() -> String {
     let mut bytes = [0u8; 16];
     if getrandom::getrandom(&mut bytes).is_err() {
diff --git a/node/src/node_control.rs b/node/src/node_control.rs
index 3f058a2..64a10f4 100644
--- a/node/src/node_control.rs
+++ b/node/src/node_control.rs
@@ -1473,6 +1473,7 @@ pub async fn dispatch(
             json_result(mesh.cec_revoke(tech).await)
         }
         "cec_grants" => json_result(mesh.cec_grants().await),
+        "cec_viewing" => json_result(mesh.cec_viewing().await),
         "cec_dialed" => json_result(mesh.cec_dialed().await),
         "cec_cancel_dial" => json_result(mesh.cec_cancel_dial().await),
         "cec_ask_help" => {