An automatic merge is gated by what it can undo

[WaylandYang]

Closes #357. Stacked on #473 (0026); rebases onto dev once that merges.

Record: new 0027 · An automatic merge is gated by what it can undo.

What changes

• execution_gate in the store. impact_of(pool, kb, a, b) reads what a merge would touch; hold(&impact) is the pure judgement. Three things, in order, and any one holds the pair for a person whatever the confidence:
  • a contradiction: the two sides each hold a fact under the same functional predicate pointing at different entities (inverse_functional symmetrically) — merged, that is the functional violation the consistency check would open; same yardstick as too_many in the reasoning crate (entity-object edges, no time, no literals);
  • a derivation that still stands with either side as subject or object;
  • an answer that recognised either side (conversation_messages.resolved, assistant turns).
• Both deciders ask it. The batch adjudicator before auto_merged, the governor before governed (after the survivor check, before merge_direction). A held pair is escalated as escalate_impact|<kind> <value> (contradiction CEO of, derived 12, answered 3); the governor also records its look as a proposal whose reason begins held for a person: …, with the model's own reason after it.
• Keeps are not gated — the next merge is the undo.
• UI: the card reads "Held for a person; the merge would not stay in the graph — it would put two "CEO of" facts on one entity" (per-kind wording in en/zh) so nobody reads a hold as doubt.
• Out on purpose, with reasons in the record: exports as a hold (an export is of the base, not the pair — that is a switch), size as impact, a higher bar instead of a hold.

Verified

• an_automatic_merge_is_gated_by_what_it_can_undo (new) on the real database: nothing touched → no hold; a functional clash → Contradiction("CEO of") both ways; an invalidated or same-valued fact → none; a standing derivation → Derived(1), invalidated → none; an assistant turn that resolved one side → Answered(1) (user turns and other entities not counted). Three unit tests on hold ordering and rendering. clippy and fmt clean.
• tsc and the style guard clean.

🤖 Generated with Claude Code