docs(cloud): document governance rollout

tests/test_host_agent_internal_api.py

@@ -253,6 +253,49 @@ def test_heartbeat_and_self_submission_preserve_host_isolation(tmp_path) -> None
     assert foreign.status_code == 403
 
 
+def test_host_policy_converges_and_disables_self_submission(tmp_path) -> None:
+    client, pool = _build_client(tmp_path)
+    headers = {"Authorization": "Bearer token-a"}
+    client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers=headers,
+        json=_heartbeat_payload("host-a", "device-a"),
+    )
+    pool.store.upsert_host_governance_policy(
+        host_id="host-a",
+        self_submission_enabled=False,
+        max_active_tasks=2,
+        daily_token_budget=1000,
+        updated_at=datetime.now(UTC),
+    )
+
+    stale = client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers=headers,
+        json={**_heartbeat_payload("host-a", "device-a"), "policy_revision": 0},
+    )
+    assert stale.status_code == 200
+    assert stale.json()["policy"] == {
+        "revision": 1,
+        "self_submission_enabled": False,
+        "max_active_tasks": 2,
+        "daily_token_budget": 1000,
+    }
+    current = client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers=headers,
+        json={**_heartbeat_payload("host-a", "device-a"), "policy_revision": 1},
+    )
+    assert current.status_code == 200
+    assert current.json()["policy"] is None
+    disabled = client.post(
+        "/internal/v1/hosts/host-a/tasks",
+        headers=headers,
+        json={"host_id": "host-a", "goal": "should be rejected"},
+    )
+    assert disabled.status_code == 403
+
+
 def test_planner_proxy_reserves_and_enforces_host_daily_token_budget(tmp_path) -> None:
     class FakePlannerClient:
         calls = 0