fix: enforce urgent chat override server-side

scripts/record_release_demo.mjs

@@ -50,11 +50,15 @@ await page.route('**/api/agent/status', route => route.fulfill({
   contentType: 'application/json',
   body: JSON.stringify({ enabled: true, configured: true, authenticated: true, mode: 'hermes-agent' }),
 }));
-await page.route('**/api/agent/chat', route => route.fulfill({
-  status: 200,
-  contentType: 'application/json',
-  body: JSON.stringify({ connected: true, reply: 'Your confirmed logs are mostly Type 4. I can explain that pattern, but I cannot diagnose a cause.' }),
-}));
+let hermesCalls = 0;
+await page.route('**/api/agent/chat', route => {
+  hermesCalls += 1;
+  return route.fulfill({
+    status: 200,
+    contentType: 'application/json',
+    body: JSON.stringify({ connected: true, reply: 'Your confirmed logs are mostly Type 4. I can explain that pattern, but I cannot diagnose a cause.' }),
+  });
+});
 
 await page.goto('http://127.0.0.1:4173', { waitUntil: 'networkidle' });
 await page.evaluate(() => localStorage.clear());
@@ -117,8 +121,13 @@ await caption('Hermes Agent connected — free-text, contextual, and server-side
 await page.locator('#chat-message').fill('What pattern do you see?');
 await tap('#send-chat', 500);
 await page.getByText(/mostly Type 4/i).waitFor();
-await caption('Hermes keeps credentials, tools, and session continuity server-side. Photos stay out of chat.', 1800);
-await sleep(500);
+await caption('Hermes keeps credentials, tools, and session continuity server-side. Photos stay out of chat.', 1600);
+await page.locator('#chat-message').fill('I have rectal bleeding');
+await tap('#send-chat', 450);
+await page.getByText(/Pause and get medical help/i).waitFor();
+if (hermesCalls !== 1) throw new Error('Urgent chat must be intercepted before Hermes');
+await caption('Urgent language is intercepted deterministically before Hermes', 1800);
+await sleep(400);
 await page.evaluate(() => {
   document.querySelector('#demo-caption')?.remove();
   const outro = document.createElement('div');

tests/release-demo.test.js

@@ -14,6 +14,8 @@ test('release demo visibly explains the CI-protected browser path without overst
   assert.match(demo, /AI may suggest visible form, broad color, and image quality — never symptoms or diagnosis/);
   assert.match(demo, /Hermes Agent connected/);
   assert.match(demo, /Photos stay out of chat/);
+  assert.match(demo, /I have rectal bleeding/);
+  assert.match(demo, /Urgent language is intercepted deterministically before Hermes/);
   assert.match(demo, /SLEEK\. SIMPLE\.<br>HERMES-POWERED\./);
 });