A held reply with status pending_approval is not treated as waiting, and Approve all skips it #734

What happens

Two places decide "this message is still waiting for a decision" and they disagree on the status set:

• core/src/client/held-reply.js:37 — const waiting = held?.status === 'pending', so a held reply with any other status is drawn as not waiting: it loses the approve/reject card and falls through to the note line (line 49-52).
• the plugin side that decides what may be approved accepts both spellings — plugins/social/src/social.js filters on pending and pending_approval.

Today the live data uses pending only, so nothing is visibly broken. The moment an approval arrives as pending_approval — the spelling the plugin side already allows — the card silently becomes a "Not sent" note with no way to approve or reject it, and Approve-all skips it. This is the non-blocking point raised in the #713 review.

What should happen

One predicate for "an approval still waiting for a decision", accepting pending and pending_approval, and both call sites use it:

• the held-reply card (core/src/client/held-reply.js), and
• the dock's approve-all path (core/src/client/flybot-slots.js, the bt-flybot-approvals region).

Anything else (approved, auto, failed, missing) is not waiting; failed keeps its existing "Not sent: delivery failed" + Retry treatment.

Acceptance

• the predicate is exported (or otherwise reachable from a test), and core/test/ covers: pending → waiting, pending_approval → waiting, approved → not, auto → not, failed → not, undefined → not.
• a case asserting the approve-all path asks the same predicate rather than comparing a literal string of its own.
• Red without the source change: restore status === 'pending' → the pending_approval case fails; give the approve-all path its own literal → its case fails.
• node --test core/test/*.test.js green for the touched suites, build-client --check passes, changelog fragment added.

Out of scope

No change to how a hold is created, to core/src/host/hooks.js's decide(), or to the Bot Social dock's layout; no new status value.

Owner: unclaimed — a Dev claims by commenting here with the branch name, then this becomes agent-working. One issue, one pull request.

Written-by: Triage