Two reverts in a week turn the agent off (0025, fourth cut)

[WaylandYang]

Fourth and last cut of #431, on top of #434, #437 and #438. Implements decision 9 of record 0025 (Governance reads the ledger before it decides); the status line, the new decision and the README row are updated.

What this adds

• The fuse. Two reverts of the agent's own merges within seven days, counted from the moment the switch was last turned on, turn the switch off. The base gets a governance.tripped alert (warning, editors) and a kb.updated row with the machine as the actor and via: fuse, so the switch-off is in the ledger like every other decision. The running job stops at its next cluster boundary as for any switch-off; proposals already made stay for people to answer.
• Both revert paths count. Revert in the Agent queue, and Revert on the Merges page for a merge the agent made. The Merges path now also marks the agent's row reverted, so the queue and the history agree. Overriding a proposal or merging over an applied keep does not count: those correct a suggestion, not a change to the graph.
• A restart forgets the old reverts. Migration 0037 adds knowledge_bases.governance_since, set when the switch goes from off to on. The fuse counts only reverts after that moment, so the two that tripped it do not trip it again on the first mistake after a restart.
• Alert copy for governance.tripped in both languages; governance_since on the base in the API.

Verified

• Store test on a real database: reverts are counted from a given moment, marking by merge id touches only the agent's applied merge, tripping flips the switch once and reports nothing the second time.
• End to end on the bench with the real model (every earlier check still passes): the first revert leaves the switch on with no alert; the second, done from the Merges page, marks the agent's row reverted, turns the switch off, raises exactly one alert and writes the fuse row to the ledger; turning the switch back on records governance_since; one more revert after that does not trip it again.

🤖 Generated with Claude Code