Agent kill switch with hysteresis

An agent that edits customer records has a kill switch driven by its bad-action rate: every minute, the monitor reports how many of the agent's last 1,000 actions a human had to revert. A single threshold would flap, because a rate hovering around the line would switch the agent off and on every minute. So the switch uses hysteresis: one threshold to trip it, a lower one to count as calm, and a calm period before it comes back.

Write kill_switch(readings, trip_at, reset_at, calm_needed). readings holds the per-minute readings, oldest first, as non-negative integers. The switch starts "on" and takes the readings in order:

• While on, a reading at or above trip_at turns the switch "off" at that minute. Anything lower leaves it on.
• While off, a reading at or below reset_at is a calm minute. When calm_needed calm minutes in a row have been seen, the switch turns back "on" at the minute that completes the run. A reading above reset_at while off breaks the run, and counting starts again from zero.
• Every time the switch turns off, the calm count starts from zero.

Return the state after each reading. You can rely on reset_at < trip_at and calm_needed >= 1.

Examples:

• kill_switch([2, 9, 4, 1, 1, 1, 7], 8, 2, 3) returns ["on", "off", "off", "off", "off", "on", "on"]: 9 trips it, 4 is not calm, three calm minutes bring it back, and 7 is under 8 so it stays on.
• kill_switch([8, 3, 1, 3, 2, 2], 8, 2, 2) returns ["off", "off", "off", "off", "off", "on"]: the second 3 breaks the first calm run.