docs: fix product boundary and release authority

tests/product-decisions.test.js

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+const decisionPath = new URL('../docs/PRODUCT-DECISIONS.md', import.meta.url);
+
+test('product decision record fixes the AI boundary and release authority', async () => {
+  const decision = await readFile(decisionPath, 'utf8');
+
+  assert.match(decision, /Observable AI fields[\s\S]*Bristol form[\s\S]*broad color[\s\S]*image quality/i);
+  assert.match(decision, /Prohibited inferences[\s\S]*disease[\s\S]*bleeding[\s\S]*pain[\s\S]*urgency[\s\S]*fever[\s\S]*vomiting[\s\S]*food/i);
+  assert.match(decision, /Hermes\/Timmy[\s\S]*release authority/i);
+  assert.match(decision, /Human gates[\s\S]*clinical and privacy review[\s\S]*beta consent[\s\S]*RC approval/i);
+  assert.match(decision, /\.\.\/PRODUCT\.md/);
+  assert.match(decision, /\.\.\/AI-EVIDENCE\.md/);
+  assert.match(decision, /\.\.\/research\/SELF-HOSTED-STOOL-VISION\.md/);
+});

tests/release-demo.test.js

@@ -9,5 +9,7 @@ test('release demo visibly explains the CI-protected browser path without overst
 
   assert.match(demo, /Automated checks replay this synthetic path before review/);
   assert.match(demo, /tests\/fixtures\/synthetic-type4\.jpg/);
+  assert.match(demo, /AI may suggest visible form, broad color, and image quality — never symptoms or diagnosis/);
+  assert.match(demo, /Release gates: clinical\/privacy review, beta consent, and RC approval/);
   assert.match(demo, /Visual assistance — never a diagnosis\./);
 });