From 2b18f54d4d303d77e5acb6b0848801d902d6af24 Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 12:51:25 +0100
Subject: [PATCH 1/6] feat: add opt-in Jev incident advice with personal
 OpenRouter keys

---
 index.html                                    |   3 +-
 src/components/AICommandCenter.tsx            |  25 ++-
 .../__tests__/AICommandCenter.test.tsx        |  16 ++
 src/components/mobile/MobilePanel.test.tsx    |  73 +++++++
 src/components/mobile/MobilePanel.tsx         |  83 +++++--
 src/components/ui/JevAdvisoryPanel.test.tsx   | 130 +++++++++++
 src/components/ui/JevAdvisoryPanel.tsx        | 206 ++++++++++++++++++
 src/utils/jevClient.test.ts                   | 156 +++++++++++++
 src/utils/jevClient.ts                        | 135 ++++++++++++
 9 files changed, 801 insertions(+), 26 deletions(-)
 create mode 100644 src/components/mobile/MobilePanel.test.tsx
 create mode 100644 src/components/ui/JevAdvisoryPanel.test.tsx
 create mode 100644 src/components/ui/JevAdvisoryPanel.tsx
 create mode 100644 src/utils/jevClient.test.ts
 create mode 100644 src/utils/jevClient.ts

diff --git a/index.html b/index.html
index 83686e83..6ff1c30d 100644
--- a/index.html
+++ b/index.html
@@ -6,6 +6,7 @@
       CSP connect-src third-party domains and their runtime consumers:
       - https://0.peerjs.com                      PeerJS multiplayer signalling
       - https://generativelanguage.googleapis.com Gemini cloud AI (GeminiSettingsModal)
+      - https://openrouter.ai                     opt-in Jev advisory (jevClient.ts)
       - https://cdn.jsdelivr.net                  asset/CDN fetches
       - https://huggingface.co + https://*.hf.co  @mlc-ai/web-llm model weights
                                                   (Qwen3-4B-q4f16_1-MLC); HF LFS blobs
@@ -24,7 +25,7 @@
       style-src 'self' 'unsafe-inline';
       font-src 'self';
       img-src 'self' data: blob: https://www.millos.net;
-      connect-src 'self' blob: ws: wss: https://0.peerjs.com https://generativelanguage.googleapis.com https://cdn.jsdelivr.net https://huggingface.co https://*.huggingface.co https://*.hf.co https://raw.githubusercontent.com;
+      connect-src 'self' blob: ws: wss: https://openrouter.ai https://0.peerjs.com https://generativelanguage.googleapis.com https://cdn.jsdelivr.net https://huggingface.co https://*.huggingface.co https://*.hf.co https://raw.githubusercontent.com;
       worker-src 'self' blob:;
       object-src 'none';
       base-uri 'self';
diff --git a/src/components/AICommandCenter.tsx b/src/components/AICommandCenter.tsx
index 35d9d3d9..39664799 100644
--- a/src/components/AICommandCenter.tsx
+++ b/src/components/AICommandCenter.tsx
@@ -20,6 +20,7 @@ import { useAIConfigStore } from '../stores/aiConfigStore';
 import { useShallow } from 'zustand/react/shallow';
 import { applyDecisionEffects, reactToAlert } from '../utils/aiEngine';
 import { GeminiSettingsModal } from './GeminiSettingsModal';
+import { JevAdvisoryPanel } from './ui/JevAdvisoryPanel';
 import { ActionPlanTimeline } from './ui/ActionPlanTimeline';
 import { DecisionHistoryPanel } from './ui/DecisionHistoryPanel';
 import { StrategicPriorityCards } from './ui/StrategicPriorityCards';
@@ -51,7 +52,7 @@ export const AICommandCenter: React.FC<AICommandCenterProps> = ({
   embedded = false,
 }) => {
   const [isThinking, setIsThinking] = useState(false);
-  const [activeTab, setActiveTab] = useState<'decisions' | 'strategic'>('decisions');
+  const [activeTab, setActiveTab] = useState<'decisions' | 'strategic' | 'advisory'>('decisions');
   const [selectedDecision, setSelectedDecision] = useState<AIDecision | null>(null);
 
   const [systemStatus, setSystemStatus] = useState({
@@ -315,6 +316,20 @@ export const AICommandCenter: React.FC<AICommandCenterProps> = ({
               <Target className="w-3 h-3 inline mr-1" aria-hidden="true" />
               Strategic
             </button>
+            <button
+              role="tab"
+              id="ai-advisory-tab"
+              aria-selected={activeTab === 'advisory'}
+              aria-controls="ai-command-tabpanel"
+              onClick={() => setActiveTab('advisory')}
+              className={`flex-1 py-1.5 rounded-lg text-xs font-medium transition-all ${
+                activeTab === 'advisory'
+                  ? 'bg-cyan-500/20 text-cyan-400 border border-cyan-500/30'
+                  : 'bg-slate-800/50 text-slate-400 hover:bg-slate-800'
+              }`}
+            >
+              Advisory
+            </button>
           </div>
 
           {/* Screen-reader-only live region announcing the newest AI decision */}
@@ -326,10 +341,14 @@ export const AICommandCenter: React.FC<AICommandCenterProps> = ({
           <div
             id="ai-command-tabpanel"
             role="tabpanel"
-            aria-labelledby={activeTab === 'decisions' ? 'ai-decisions-tab' : 'ai-strategic-tab'}
+            aria-labelledby={`ai-${activeTab}-tab`}
             className="flex-1 overflow-y-auto p-3 space-y-2"
           >
-            {activeTab === 'decisions' ? (
+            {activeTab === 'advisory' ? (
+              <JevAdvisoryPanel
+                latestAlert={alerts[0] ? `${alerts[0].title}\n${alerts[0].message}` : undefined}
+              />
+            ) : activeTab === 'decisions' ? (
               <>
                 {aiDecisions.slice(0, 15).map((decision: AIDecision) => (
                   <div
diff --git a/src/components/__tests__/AICommandCenter.test.tsx b/src/components/__tests__/AICommandCenter.test.tsx
index 8332f4c7..920ff4f4 100644
--- a/src/components/__tests__/AICommandCenter.test.tsx
+++ b/src/components/__tests__/AICommandCenter.test.tsx
@@ -202,6 +202,22 @@ describe('AICommandCenter', () => {
   });
 
   describe('Rendering', () => {
+    it('opens the advisory tab and forgets its key when switching away', () => {
+      render(<AICommandCenter isOpen={true} onClose={vi.fn()} embedded />);
+      fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+      expect(screen.getByRole('tabpanel', { name: 'Advisory' })).toBeInTheDocument();
+      expect(screen.getByRole('region', { name: 'Jev advisory' })).toBeInTheDocument();
+      fireEvent.change(screen.getByLabelText('Your OpenRouter API key'), {
+        target: { value: `sk-or-v1-${'test-only-'.repeat(5)}` },
+      });
+      fireEvent.click(screen.getByRole('tab', { name: 'Strategic' }));
+      expect(screen.queryByRole('region', { name: 'Jev advisory' })).not.toBeInTheDocument();
+      fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+      expect(screen.getByLabelText('Your OpenRouter API key')).toHaveValue('');
+      expect(screen.getByRole('checkbox')).not.toBeChecked();
+      expect(aiEngineMock.applyDecisionEffects).not.toHaveBeenCalled();
+    });
+
     it('should not render when isOpen is false', () => {
       const { container } = render(<AICommandCenter isOpen={false} onClose={vi.fn()} embedded />);
 
diff --git a/src/components/mobile/MobilePanel.test.tsx b/src/components/mobile/MobilePanel.test.tsx
new file mode 100644
index 00000000..0aadf520
--- /dev/null
+++ b/src/components/mobile/MobilePanel.test.tsx
@@ -0,0 +1,73 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { MobilePanel } from './MobilePanel';
+import { requestJevAdvice } from '../../utils/jevClient';
+
+vi.mock('framer-motion', () => ({
+  AnimatePresence: ({ children }: { children: React.ReactNode }) => children,
+  motion: {
+    div: 'div',
+    aside: 'aside',
+  },
+}));
+vi.mock('../../stores/productionStore', () => ({
+  useProductionStore: (selector: (state: unknown) => unknown) => selector({ aiDecisions: [] }),
+}));
+vi.mock('../../stores/uiStore', () => ({
+  useUIStore: (selector: (state: unknown) => unknown) =>
+    selector({ alerts: [{ title: 'Bearing fault', message: 'Needs inspection.' }] }),
+}));
+vi.mock('../../stores/gameSimulationStore', () => ({ useGameSimulationStore: vi.fn() }));
+vi.mock('../../stores/safetyStore', () => ({ useSafetyStore: vi.fn() }));
+vi.mock('../../stores/operationsCampaignStore', () => ({ useOperationsCampaignStore: vi.fn() }));
+vi.mock('../ui/EmergencyStopButton', () => ({ EmergencyStopButton: () => null }));
+vi.mock('../../utils/jevClient', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../../utils/jevClient')>()),
+  requestJevAdvice: vi.fn(),
+}));
+const requestMock = vi.mocked(requestJevAdvice);
+const key = `sk-or-v1-${'test-only-'.repeat(5)}`;
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe('Mobile AI advisory wiring', () => {
+  it('keeps Decisions as the default and exposes the same reviewed-text advisory', () => {
+    render(<MobilePanel isVisible content="ai" onClose={vi.fn()} />);
+    expect(screen.getByText('No AI decisions yet')).toBeInTheDocument();
+    expect(screen.queryByRole('region', { name: 'Jev advisory' })).not.toBeInTheDocument();
+    fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+    expect(screen.getByRole('tabpanel', { name: 'Advisory' })).toBeInTheDocument();
+    fireEvent.click(screen.getByRole('button', { name: 'Review latest alert' }));
+    expect(screen.getByLabelText('Incident text')).toHaveValue('Bearing fault\nNeeds inspection.');
+    expect(requestMock).not.toHaveBeenCalled();
+  });
+
+  it('forgets the credential and consent on tab changes', () => {
+    render(<MobilePanel isVisible content="ai" onClose={vi.fn()} />);
+    fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+    fireEvent.change(screen.getByLabelText('Your OpenRouter API key'), { target: { value: key } });
+    fireEvent.click(screen.getByRole('checkbox'));
+    fireEvent.click(screen.getByRole('tab', { name: 'Decisions' }));
+    fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+    expect(screen.getByLabelText('Your OpenRouter API key')).toHaveValue('');
+    expect(screen.getByRole('checkbox')).not.toBeChecked();
+  });
+
+  it('aborts advisory work when the mobile panel closes', () => {
+    requestMock.mockImplementation(() => new Promise(() => {}));
+    const onClose = vi.fn();
+    const { rerender } = render(<MobilePanel isVisible content="ai" onClose={onClose} />);
+    fireEvent.click(screen.getByRole('tab', { name: 'Advisory' }));
+    fireEvent.change(screen.getByLabelText('Your OpenRouter API key'), { target: { value: key } });
+    fireEvent.change(screen.getByLabelText('Incident text'), {
+      target: { value: 'Bearing fault.' },
+    });
+    fireEvent.click(screen.getByRole('checkbox'));
+    fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+    const signal = requestMock.mock.calls[0][0].signal;
+    rerender(<MobilePanel isVisible={false} content="ai" onClose={onClose} />);
+    expect(signal.aborted).toBe(true);
+  });
+});
diff --git a/src/components/mobile/MobilePanel.tsx b/src/components/mobile/MobilePanel.tsx
index 89ef82d0..d67338ea 100644
--- a/src/components/mobile/MobilePanel.tsx
+++ b/src/components/mobile/MobilePanel.tsx
@@ -29,6 +29,7 @@ import { useGameSimulationStore } from '../../stores/gameSimulationStore';
 import { useSafetyStore } from '../../stores/safetyStore';
 import { useOperationsCampaignStore } from '../../stores/operationsCampaignStore';
 import { EmergencyStopButton } from '../ui/EmergencyStopButton';
+import { JevAdvisoryPanel } from '../ui/JevAdvisoryPanel';
 
 interface MobilePanelProps {
   isVisible: boolean;
@@ -453,6 +454,8 @@ const SettingsContent: React.FC = () => {
 // AI Partner panel content
 const AIContent: React.FC = () => {
   const aiDecisions = useProductionStore((s) => s.aiDecisions);
+  const latestAlert = useUIStore((s) => s.alerts[0]);
+  const [activeTab, setActiveTab] = React.useState<'decisions' | 'advisory'>('decisions');
   const recentDecisions = aiDecisions.slice(0, 5);
 
   const getStatusIcon = (status: string) => {
@@ -470,28 +473,62 @@ const AIContent: React.FC = () => {
 
   return (
     <div className="space-y-3">
-      <div className="flex items-center gap-2 text-xs text-slate-400">
-        <Brain className="w-4 h-4" />
-        <span>Recent AI Decisions</span>
+      <div role="tablist" aria-label="AI Partner views" className="flex gap-2">
+        {(['decisions', 'advisory'] as const).map((tab) => (
+          <button
+            key={tab}
+            role="tab"
+            id={`mobile-ai-${tab}-tab`}
+            aria-selected={activeTab === tab}
+            aria-controls="mobile-ai-tabpanel"
+            onClick={() => setActiveTab(tab)}
+            className={`min-h-10 flex-1 rounded-lg px-3 py-2 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-400 ${
+              activeTab === tab ? 'bg-cyan-500/20 text-cyan-300' : 'bg-slate-800 text-slate-300'
+            }`}
+          >
+            {tab === 'decisions' ? 'Decisions' : 'Advisory'}
+          </button>
+        ))}
       </div>
-      {recentDecisions.length === 0 ? (
-        <div className="text-center py-4 text-slate-500 text-sm">No AI decisions yet</div>
-      ) : (
-        <div className="space-y-2">
-          {recentDecisions.map((decision) => (
-            <div
-              key={decision.id}
-              className="bg-slate-800/50 rounded-lg p-2 flex items-start gap-2"
-            >
-              {getStatusIcon(decision.status)}
-              <div className="flex-1 min-w-0">
-                <div className="text-xs text-white truncate">{decision.action}</div>
-                <div className="text-[10px] text-slate-400 truncate">{decision.reasoning}</div>
-              </div>
+      <div
+        id="mobile-ai-tabpanel"
+        role="tabpanel"
+        aria-labelledby={`mobile-ai-${activeTab}-tab`}
+        className="space-y-3"
+      >
+        {activeTab === 'advisory' ? (
+          <JevAdvisoryPanel
+            latestAlert={latestAlert ? `${latestAlert.title}\n${latestAlert.message}` : undefined}
+          />
+        ) : (
+          <>
+            <div className="flex items-center gap-2 text-xs text-slate-400">
+              <Brain className="w-4 h-4" />
+              <span>Recent AI Decisions</span>
             </div>
-          ))}
-        </div>
-      )}
+            {recentDecisions.length === 0 ? (
+              <div className="text-center py-4 text-slate-500 text-sm">No AI decisions yet</div>
+            ) : (
+              <div className="space-y-2">
+                {recentDecisions.map((decision) => (
+                  <div
+                    key={decision.id}
+                    className="bg-slate-800/50 rounded-lg p-2 flex items-start gap-2"
+                  >
+                    {getStatusIcon(decision.status)}
+                    <div className="flex-1 min-w-0">
+                      <div className="text-xs text-white truncate">{decision.action}</div>
+                      <div className="text-[10px] text-slate-400 truncate">
+                        {decision.reasoning}
+                      </div>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            )}
+          </>
+        )}
+      </div>
     </div>
   );
 };
@@ -741,13 +778,15 @@ export const MobilePanel: React.FC<MobilePanelProps> = ({ isVisible, content, on
             className="fixed left-4 right-4 z-50 pointer-events-auto"
             style={{
               bottom: 'max(100px, calc(env(safe-area-inset-bottom) + 90px))',
-              maxHeight: '33vh',
+              maxHeight: content === 'ai' ? '70vh' : '33vh',
             }}
             aria-label={`${getPanelTitle(content)} mobile panel`}
             role="dialog"
             aria-modal="true"
           >
-            <div className="flex flex-col max-h-[33vh] bg-slate-900/95 backdrop-blur-xl border border-white/10 rounded-2xl overflow-hidden shadow-2xl">
+            <div
+              className={`flex flex-col ${content === 'ai' ? 'max-h-[70vh]' : 'max-h-[33vh]'} bg-slate-900/95 backdrop-blur-xl border border-white/10 rounded-2xl overflow-hidden shadow-2xl`}
+            >
               {/* Header */}
               <div className="flex shrink-0 items-center justify-between px-4 py-3 border-b border-slate-700/50">
                 <div className="flex items-center gap-2 text-slate-200">
diff --git a/src/components/ui/JevAdvisoryPanel.test.tsx b/src/components/ui/JevAdvisoryPanel.test.tsx
new file mode 100644
index 00000000..156119f0
--- /dev/null
+++ b/src/components/ui/JevAdvisoryPanel.test.tsx
@@ -0,0 +1,130 @@
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { JevAdvisoryPanel } from './JevAdvisoryPanel';
+import { JEV_RESULT_TTL_MS, requestJevAdvice, type JevAdvice } from '../../utils/jevClient';
+
+vi.mock('../../utils/jevClient', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../../utils/jevClient')>()),
+  requestJevAdvice: vi.fn(),
+}));
+const requestMock = vi.mocked(requestJevAdvice);
+const key = `sk-or-v1-${'test-only-'.repeat(5)}`;
+function prepare() {
+  fireEvent.change(screen.getByLabelText('Your OpenRouter API key'), { target: { value: key } });
+  fireEvent.change(screen.getByLabelText('Incident text'), {
+    target: { value: 'The pump is broken.' },
+  });
+  fireEvent.click(screen.getByRole('checkbox'));
+}
+const advice = (): JevAdvice => ({ queue: 'Equipment maintenance', receivedAt: Date.now() });
+
+describe('Jev advisory consent and lifecycle', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    requestMock.mockReset();
+  });
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+  });
+
+  it('makes no requests by default, imports alerts for review only, and requires key, text and consent', () => {
+    render(<JevAdvisoryPanel latestAlert="Review this alert" />);
+    expect(screen.getByRole('button', { name: 'Send to Jev' })).toBeDisabled();
+    fireEvent.click(screen.getByRole('button', { name: 'Review latest alert' }));
+    expect(screen.getByLabelText('Incident text')).toHaveValue('Review this alert');
+    expect(screen.getByRole('checkbox')).not.toBeChecked();
+    expect(requestMock).not.toHaveBeenCalled();
+    prepare();
+    expect(screen.getByRole('button', { name: 'Send to Jev' })).toBeEnabled();
+  });
+
+  it('renders read-only advice without action controls or confidence scores; editing invalidates it', async () => {
+    requestMock.mockResolvedValue(advice());
+    render(<JevAdvisoryPanel />);
+    prepare();
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+    });
+    expect(screen.getByRole('status')).toHaveTextContent('Equipment maintenance');
+    expect(screen.getByRole('status')).toHaveTextContent('cannot clear an incident');
+    expect(
+      screen.queryByRole('button', { name: /accept|apply|clear incident/i })
+    ).not.toBeInTheDocument();
+    expect(requestMock).toHaveBeenCalledWith(
+      expect.objectContaining({ apiKey: key, text: 'The pump is broken.', consent: true })
+    );
+    fireEvent.change(screen.getByLabelText('Incident text'), { target: { value: 'New evidence' } });
+    expect(screen.getByRole('status')).toBeEmptyDOMElement();
+  });
+
+  it('limits admission to one request and ignores a late response after cancellation', async () => {
+    let finish!: (value: JevAdvice) => void;
+    requestMock.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        })
+    );
+    render(<JevAdvisoryPanel />);
+    prepare();
+    fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+    fireEvent.click(screen.getByRole('button', { name: 'Requesting advice...' }));
+    expect(requestMock).toHaveBeenCalledTimes(1);
+    const signal = requestMock.mock.calls[0][0].signal;
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel request' }));
+    expect(signal.aborted).toBe(true);
+    await act(async () => finish(advice()));
+    expect(screen.getByRole('status')).toBeEmptyDOMElement();
+  });
+
+  it.each(['forget', 'consent', 'edit', 'unmount'])(
+    'cancels outstanding advice on %s',
+    async (action) => {
+      requestMock.mockImplementation(() => new Promise(() => {}));
+      const { unmount } = render(<JevAdvisoryPanel />);
+      prepare();
+      fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+      const signal = requestMock.mock.calls[0][0].signal;
+      if (action === 'forget') {
+        fireEvent.click(screen.getByRole('button', { name: 'Forget key' }));
+        expect(screen.getByLabelText('Your OpenRouter API key')).toHaveValue('');
+        expect(screen.getByRole('checkbox')).not.toBeChecked();
+      } else if (action === 'consent') fireEvent.click(screen.getByRole('checkbox'));
+      else if (action === 'edit')
+        fireEvent.change(screen.getByLabelText('Incident text'), { target: { value: 'Changed' } });
+      else unmount();
+      expect(signal.aborted).toBe(true);
+    }
+  );
+
+  it('expires advice and does not persist a key across remounts', async () => {
+    requestMock.mockResolvedValue(advice());
+    const { unmount } = render(<JevAdvisoryPanel />);
+    prepare();
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+    });
+    await act(async () => {
+      vi.advanceTimersByTime(JEV_RESULT_TTL_MS);
+    });
+    expect(screen.getByRole('status')).toBeEmptyDOMElement();
+    expect(Object.values(localStorage).join('')).not.toContain(key);
+    expect(Object.values(sessionStorage).join('')).not.toContain(key);
+    unmount();
+    render(<JevAdvisoryPanel />);
+    expect(screen.getByLabelText('Your OpenRouter API key')).toHaveValue('');
+    expect(screen.getByRole('checkbox')).not.toBeChecked();
+  });
+
+  it('shows failures without silently retrying', async () => {
+    requestMock.mockRejectedValue(new Error('OpenRouter requires more credit for this request.'));
+    render(<JevAdvisoryPanel />);
+    prepare();
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: 'Send to Jev' }));
+    });
+    expect(screen.getByRole('alert')).toHaveTextContent('requires more credit');
+    expect(requestMock).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/components/ui/JevAdvisoryPanel.tsx b/src/components/ui/JevAdvisoryPanel.tsx
new file mode 100644
index 00000000..64efb516
--- /dev/null
+++ b/src/components/ui/JevAdvisoryPanel.tsx
@@ -0,0 +1,206 @@
+import { useEffect, useRef, useState } from 'react';
+import { Shield } from 'lucide-react';
+import {
+  isJevKeyValid,
+  JEV_MAX_TEXT_LENGTH,
+  JEV_RESULT_TTL_MS,
+  requestJevAdvice,
+  type JevAdvice,
+} from '../../utils/jevClient';
+
+export function JevAdvisoryPanel({ latestAlert }: { latestAlert?: string }) {
+  const [apiKey, setApiKey] = useState('');
+  const [text, setText] = useState('');
+  const [consent, setConsent] = useState(false);
+  const [pending, setPending] = useState(false);
+  const [result, setResult] = useState<JevAdvice | null>(null);
+  const [error, setError] = useState('');
+  const request = useRef<AbortController | null>(null);
+
+  function cancel() {
+    request.current?.abort();
+    request.current = null;
+    setPending(false);
+    setResult(null);
+    setError('');
+  }
+  useEffect(
+    () => () => {
+      request.current?.abort();
+      request.current = null;
+    },
+    []
+  );
+  useEffect(() => {
+    if (!result) return;
+    const timer = setTimeout(
+      () => setResult(null),
+      Math.max(0, result.receivedAt + JEV_RESULT_TTL_MS - Date.now())
+    );
+    return () => clearTimeout(timer);
+  }, [result]);
+
+  async function send() {
+    if (request.current || !consent || !isJevKeyValid(apiKey) || !text.trim()) return;
+    const controller = new AbortController();
+    request.current = controller;
+    setPending(true);
+    setResult(null);
+    setError('');
+    try {
+      const advice = await requestJevAdvice({ text, apiKey, consent, signal: controller.signal });
+      if (request.current === controller) setResult(advice);
+    } catch (failure) {
+      if (request.current === controller)
+        setError(failure instanceof Error ? failure.message : 'No advisory was returned.');
+    } finally {
+      if (request.current === controller) {
+        request.current = null;
+        setPending(false);
+      }
+    }
+  }
+  const fieldClass =
+    'w-full rounded-lg border border-slate-600 bg-slate-950 p-2 text-sm text-slate-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-400';
+  const buttonClass =
+    'min-h-9 rounded-lg border border-slate-600 px-3 py-2 text-xs text-slate-200 hover:bg-slate-700 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-cyan-400 disabled:cursor-not-allowed disabled:opacity-40';
+
+  return (
+    <section aria-label="Jev advisory" className="space-y-4 text-xs text-slate-300">
+      <div className="space-y-2">
+        <h3 className="flex items-center gap-2 text-sm font-semibold text-cyan-300">
+          <Shield className="h-4 w-4" aria-hidden="true" />
+          Jev incident routing
+        </h3>
+        <p>
+          Get a suggested queue for incident text. Alerts, machine controls and your selected AI
+          backend stay unchanged.
+        </p>
+      </div>
+      <div className="space-y-2">
+        <label htmlFor="jev-api-key" className="block font-medium">
+          Your OpenRouter API key
+        </label>
+        <input
+          id="jev-api-key"
+          type="password"
+          autoComplete="off"
+          spellCheck={false}
+          maxLength={180}
+          value={apiKey}
+          className={fieldClass}
+          aria-describedby="jev-key-help"
+          onChange={(event) => {
+            cancel();
+            setApiKey(event.target.value);
+            setConsent(false);
+          }}
+        />
+        <p id="jev-key-help" className="text-slate-400">
+          Kept in memory while this tab is open. Never saved to browser storage.
+        </p>
+        {apiKey && (
+          <button
+            type="button"
+            className={buttonClass}
+            onClick={() => {
+              cancel();
+              setApiKey('');
+              setConsent(false);
+            }}
+          >
+            Forget key
+          </button>
+        )}
+      </div>
+      <div className="space-y-2">
+        <label htmlFor="jev-incident" className="block font-medium">
+          Incident text
+        </label>
+        <textarea
+          id="jev-incident"
+          rows={5}
+          maxLength={JEV_MAX_TEXT_LENGTH}
+          value={text}
+          className={fieldClass}
+          onChange={(event) => {
+            cancel();
+            setText(event.target.value);
+          }}
+        />
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <span className="text-slate-400">
+            {text.length}/{JEV_MAX_TEXT_LENGTH} characters
+          </span>
+          {latestAlert && (
+            <button
+              type="button"
+              className={buttonClass}
+              onClick={() => {
+                cancel();
+                setText(latestAlert.slice(0, JEV_MAX_TEXT_LENGTH));
+                setConsent(false);
+              }}
+            >
+              Review latest alert
+            </button>
+          )}
+        </div>
+      </div>
+      <label className="flex items-start gap-2 leading-relaxed">
+        <input
+          type="checkbox"
+          checked={consent}
+          className="mt-1 h-4 w-4 shrink-0 accent-cyan-400"
+          onChange={(event) => {
+            cancel();
+            setConsent(event.target.checked);
+          }}
+        />
+        <span>
+          Allow the text above to be sent to OpenRouter and TypeSafe when I select Send to Jev.
+          Requests use my OpenRouter balance.
+        </span>
+      </label>
+      <div className="flex flex-wrap gap-2">
+        <button
+          type="button"
+          className={`${buttonClass} border-cyan-500/50 bg-cyan-500/10 text-cyan-300`}
+          disabled={pending || !consent || !isJevKeyValid(apiKey) || !text.trim()}
+          onClick={() => void send()}
+        >
+          {pending ? 'Requesting advice...' : 'Send to Jev'}
+        </button>
+        {pending && (
+          <button type="button" className={buttonClass} onClick={cancel}>
+            Cancel request
+          </button>
+        )}
+      </div>
+      <p className="text-slate-400">
+        Only this text is sent. No automatic requests or retries. Cancellation may still be billed.
+      </p>
+      {error && (
+        <p
+          role="alert"
+          className="rounded-lg border border-amber-500/30 bg-amber-500/10 p-3 text-amber-200"
+        >
+          {error}
+        </p>
+      )}
+      <div role="status" aria-live="polite">
+        {result && (
+          <div className="space-y-2 rounded-lg border border-cyan-500/30 bg-slate-800/70 p-3">
+            <p className="text-slate-400">Suggested queue for the submitted text</p>
+            <p className="text-sm font-semibold text-slate-100">{result.queue}</p>
+            <p>
+              Review the underlying evidence. This suggestion cannot clear an incident or establish
+              that the mill is safe.
+            </p>
+            <p className="text-slate-400">Expires after one minute or when the text changes.</p>
+          </div>
+        )}
+      </div>
+    </section>
+  );
+}
diff --git a/src/utils/jevClient.test.ts b/src/utils/jevClient.test.ts
new file mode 100644
index 00000000..b757a8e6
--- /dev/null
+++ b/src/utils/jevClient.test.ts
@@ -0,0 +1,156 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  JEV_ENDPOINT,
+  JEV_MAX_TEXT_LENGTH,
+  JEV_MODEL,
+  JEV_QUEUES,
+  JEV_TIMEOUT_MS,
+  requestJevAdvice,
+} from './jevClient';
+
+const key = `sk-or-v1-${'test-only-'.repeat(5)}`;
+const payload = () => ({
+  model: `${JEV_MODEL}-20260917`,
+  answers: {
+    decision: {
+      type: 'choice',
+      choice: JEV_QUEUES[0],
+      probabilities: Object.fromEntries(JEV_QUEUES.map((queue, i) => [queue, i === 0 ? 1 : 0])),
+    },
+  },
+});
+const input = () => ({
+  apiKey: key,
+  text: 'A bearing is broken.',
+  consent: true,
+  signal: new AbortController().signal,
+});
+const fetchMock = vi.fn();
+const reply = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
+
+describe('Jev read-only request boundary', () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
+  });
+
+  it('sends only reviewed text and the frozen rubric, with a fixed destination and no provider fallback', async () => {
+    fetchMock.mockResolvedValue(reply(payload()));
+    const advice = await requestJevAdvice(input());
+    expect(advice.queue).toBe(JEV_QUEUES[0]);
+    expect(advice).not.toHaveProperty('confidence');
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, options] = fetchMock.mock.calls[0];
+    expect(url).toBe(JEV_ENDPOINT);
+    expect(options).toMatchObject({
+      method: 'POST',
+      credentials: 'omit',
+      cache: 'no-store',
+      redirect: 'error',
+      referrerPolicy: 'no-referrer',
+      headers: { Authorization: `Bearer ${key}` },
+    });
+    const body = JSON.parse(options.body);
+    expect(Object.keys(body).sort()).toEqual(['model', 'provider', 'questions', 'state']);
+    expect(body.state).toBe(input().text);
+    expect(body.provider).toEqual({ only: ['typesafe'], allow_fallbacks: false });
+    expect(body.questions.decision.criteria).toEqual(
+      Object.fromEntries(JEV_QUEUES.map((queue) => [queue, null]))
+    );
+    expect(options.body).not.toContain(key);
+  });
+
+  it.each([
+    { consent: false },
+    { apiKey: '' },
+    { apiKey: 'not-a-key' },
+    { text: '  ' },
+    { text: 'x'.repeat(JEV_MAX_TEXT_LENGTH + 1) },
+    { signal: AbortSignal.abort() },
+  ])('rejects invalid or unconsented input before any request: %j', async (patch) => {
+    await expect(requestJevAdvice({ ...input(), ...patch })).rejects.toThrow();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it.each([401, 402, 403, 429, 500])(
+    'redacts provider errors and never retries HTTP %i',
+    async (status) => {
+      fetchMock.mockResolvedValue(reply({ error: `Leaked ${key} private text` }, status));
+      await expect(requestJevAdvice(input())).rejects.not.toThrow(key);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    }
+  );
+
+  it('does not propagate network error details containing credentials', async () => {
+    fetchMock.mockRejectedValue(new Error(key));
+    await expect(requestJevAdvice(input())).rejects.toThrow('Jev could not be reached');
+  });
+
+  it.each([
+    {},
+    { model: 'other-model' },
+    { answers: { decision: { ...payload().answers.decision, choice: 'clear-all-alerts' } } },
+    { answers: { decision: { ...payload().answers.decision, probabilities: { invalid: 1 } } } },
+    {
+      answers: {
+        decision: {
+          ...payload().answers.decision,
+          probabilities: Object.fromEntries(JEV_QUEUES.map((q) => [q, 1])),
+        },
+      },
+    },
+  ])('rejects malformed or unexpected model output: %j', async (patch) => {
+    fetchMock.mockResolvedValue(reply(Object.keys(patch).length ? { ...payload(), ...patch } : {}));
+    await expect(requestJevAdvice(input())).rejects.toThrow('invalid advisory');
+  });
+
+  it('rejects invalid JSON and oversized replies', async () => {
+    fetchMock
+      .mockResolvedValueOnce(new Response('not JSON'))
+      .mockResolvedValueOnce(new Response(' '.repeat(65_537)));
+    await expect(requestJevAdvice(input())).rejects.toThrow('invalid advisory');
+    await expect(requestJevAdvice(input())).rejects.toThrow('invalid advisory');
+  });
+
+  it.each(['cancel', 'timeout'])('rejects a late response after %s', async (mode) => {
+    vi.useFakeTimers();
+    let resolveResponse!: (response: Response) => void;
+    fetchMock.mockReturnValue(new Promise<Response>((resolve) => (resolveResponse = resolve)));
+    const controller = new AbortController();
+    const result = requestJevAdvice({ ...input(), signal: controller.signal });
+    const assertion = expect(result).rejects.toThrow('cancelled or timed out');
+    if (mode === 'cancel') controller.abort();
+    else await vi.advanceTimersByTimeAsync(JEV_TIMEOUT_MS);
+    resolveResponse(reply(payload()));
+    await assertion;
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
+  it.each(['cancel', 'timeout'])('aborts a pending fetch on %s', async (mode) => {
+    vi.useFakeTimers();
+    let fetchSignal: AbortSignal | undefined;
+    fetchMock.mockImplementation(
+      (_url, init) =>
+        new Promise((_resolve, reject) => {
+          fetchSignal = init.signal;
+          fetchSignal!.addEventListener('abort', () =>
+            reject(new DOMException('Aborted', 'AbortError'))
+          );
+        })
+    );
+    const controller = new AbortController();
+    const result = requestJevAdvice({ ...input(), signal: controller.signal });
+    const assertion = expect(result).rejects.toThrow();
+    if (mode === 'cancel') controller.abort();
+    else await vi.advanceTimersByTimeAsync(JEV_TIMEOUT_MS);
+    await assertion;
+    expect(fetchSignal?.aborted).toBe(true);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(vi.getTimerCount()).toBe(0);
+  });
+});
diff --git a/src/utils/jevClient.ts b/src/utils/jevClient.ts
new file mode 100644
index 00000000..e64f4d0a
--- /dev/null
+++ b/src/utils/jevClient.ts
@@ -0,0 +1,135 @@
+/** Read-only, explicitly requested incident classification. No stores or commands. */
+export const JEV_ENDPOINT = 'https://openrouter.ai/api/alpha/decisions';
+export const JEV_MODEL = 'typesafe/jev-1.13';
+export const JEV_MAX_TEXT_LENGTH = 4000;
+export const JEV_TIMEOUT_MS = 30_000;
+export const JEV_RESULT_TTL_MS = 60_000;
+export const JEV_QUEUES = [
+  'Equipment maintenance',
+  'Product quality',
+  'Logistics coordination',
+  'No current incident',
+  'Insufficient evidence',
+] as const;
+// Same rubric as the frozen evaluation; changing it requires a new evaluation.
+const QUESTION =
+  'Which advisory incident queue best matches the CURRENT unresolved issue? Past or explicitly resolved issues do not count. If there is no current incident choose No current incident; if evidence cannot identify it choose Insufficient evidence.';
+
+export interface JevAdvice {
+  queue: (typeof JEV_QUEUES)[number];
+  receivedAt: number;
+}
+
+export function isJevKeyValid(key: string): boolean {
+  return /^sk-or-v1-[A-Za-z0-9_-]{32,160}$/.test(key.trim());
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function parseAdvice(value: unknown): JevAdvice {
+  const body = record(value);
+  const answer = record(record(body.answers).decision);
+  const probabilities = record(answer.probabilities);
+  const values = JEV_QUEUES.map((queue) => probabilities[queue]);
+  if (
+    typeof body.model !== 'string' ||
+    !/^typesafe\/jev-1\.13(?:-\d{8})?$/.test(body.model) ||
+    answer.type !== 'choice' ||
+    !JEV_QUEUES.some((queue) => queue === answer.choice) ||
+    Object.keys(probabilities).length !== JEV_QUEUES.length ||
+    !values.every((p) => typeof p === 'number' && Number.isFinite(p) && p >= 0 && p <= 1)
+  ) {
+    throw new Error('Jev returned an invalid advisory. No action was taken.');
+  }
+  const scores = values as number[];
+  const queue = answer.choice as JevAdvice['queue'];
+  // The API rounds option probabilities. Scores are validated, never presented as safety confidence.
+  if (
+    Math.abs(scores.reduce((sum, p) => sum + p, 0) - 1) > 0.025000001 ||
+    (probabilities[queue] as number) < Math.max(...scores)
+  ) {
+    throw new Error('Jev returned an invalid advisory. No action was taken.');
+  }
+  return { queue, receivedAt: Date.now() };
+}
+
+/** Credentials and notes are transient arguments, never persisted or logged. No retries/fallbacks. */
+export async function requestJevAdvice({
+  text,
+  apiKey,
+  consent,
+  signal,
+}: {
+  text: string;
+  apiKey: string;
+  consent: boolean;
+  signal: AbortSignal;
+}): Promise<JevAdvice> {
+  if (!consent) throw new Error('Consent is required before sending incident text.');
+  if (!isJevKeyValid(apiKey)) throw new Error('Enter a valid OpenRouter API key.');
+  if (!text.trim() || text.length > JEV_MAX_TEXT_LENGTH) {
+    throw new Error(`Enter 1 to ${JEV_MAX_TEXT_LENGTH} characters of incident text.`);
+  }
+  if (signal.aborted) throw new Error('Request cancelled.');
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  signal.addEventListener('abort', cancel, { once: true });
+  const timeout = setTimeout(cancel, JEV_TIMEOUT_MS);
+  try {
+    let response: Response;
+    try {
+      response = await fetch(JEV_ENDPOINT, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${apiKey.trim()}`, 'Content-Type': 'application/json' },
+        credentials: 'omit',
+        referrerPolicy: 'no-referrer',
+        redirect: 'error',
+        cache: 'no-store',
+        signal: controller.signal,
+        body: JSON.stringify({
+          model: JEV_MODEL,
+          state: text.trim(),
+          questions: {
+            decision: {
+              type: 'choice',
+              instructions: QUESTION,
+              criteria: Object.fromEntries(JEV_QUEUES.map((queue) => [queue, null])),
+            },
+          },
+          provider: { only: ['typesafe'], allow_fallbacks: false },
+        }),
+      });
+    } catch {
+      throw new Error('Jev could not be reached. Check your connection and try again manually.');
+    }
+    if (!response.ok) {
+      // Never display a provider error body: it may echo submitted text or credentials.
+      const message =
+        response.status === 401 || response.status === 403
+          ? 'OpenRouter rejected the key or its permissions.'
+          : response.status === 402
+            ? 'OpenRouter requires more credit for this request.'
+            : response.status === 429
+              ? 'OpenRouter is rate limiting requests. Try again later.'
+              : 'Jev is unavailable. Try again later.';
+      throw new Error(message);
+    }
+    let body: unknown;
+    try {
+      const raw = await response.text();
+      if (raw.length > 65_536) throw new Error();
+      body = JSON.parse(raw);
+    } catch {
+      throw new Error('Jev returned an invalid advisory. No action was taken.');
+    }
+    if (controller.signal.aborted) throw new Error('Request cancelled or timed out.');
+    return parseAdvice(body);
+  } finally {
+    clearTimeout(timeout);
+    signal.removeEventListener('abort', cancel);
+  }
+}

From 20010029279a09d04fad181012051d603deadb3c Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 13:05:10 +0100
Subject: [PATCH 2/6] test: verify Jev personal-key UI on isolated CI browser

---
 .github/workflows/ci.yml         |  15 +++
 scripts/validate-jev-browser.mjs | 154 +++++++++++++++++++++++++++++++
 2 files changed, 169 insertions(+)
 create mode 100644 scripts/validate-jev-browser.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 59405abb..9693874c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -104,6 +104,21 @@ jobs:
       - name: Validate module reachability
         run: npm run validate:reachability
 
+      - name: Install browser for Jev UI acceptance
+        run: npx playwright install --with-deps chromium
+
+      - name: Validate Jev personal-key flow in desktop and mobile layouts
+        run: node scripts/validate-jev-browser.mjs
+
+      - name: Upload Jev browser evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: jev-browser
+          path: test-results/jev-browser/
+          if-no-files-found: ignore
+          retention-days: 7
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
         with:
diff --git a/scripts/validate-jev-browser.mjs b/scripts/validate-jev-browser.mjs
new file mode 100644
index 00000000..43f3fea6
--- /dev/null
+++ b/scripts/validate-jev-browser.mjs
@@ -0,0 +1,154 @@
+// Built-assembly UI gate. Only synthetic keys/text and intercepted provider responses.
+// Working if desktop/mobile can submit manually, forget credentials, and make no unsolicited calls.
+import assert from 'node:assert/strict';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { chromium } from 'playwright';
+import { preview } from 'vite';
+import { acquireCaptureLock } from './lib/capture-lock.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const output = path.join(root, 'test-results/jev-browser');
+const endpoint = 'https://openrouter.ai/api/alpha/decisions';
+const key = `sk-or-v1-${'test-only-'.repeat(5)}`;
+const note = 'Synthetic incident: a drive belt has snapped and awaits replacement.';
+const report = {
+  passed: false,
+  requests: 0,
+  layouts: [],
+  pageErrors: [],
+  consoleErrors: [],
+  failedRequests: [],
+  csp: [],
+};
+const lock = await acquireCaptureLock('jev-browser-acceptance', { root });
+let browser, server, page;
+try {
+  await mkdir(output, { recursive: true });
+  server = await preview({ root, preview: { host: '127.0.0.1', port: 4398, strictPort: true } });
+  browser = await chromium.launch({ headless: true });
+  const context = await browser.newContext({ serviceWorkers: 'block', reducedMotion: 'reduce' });
+  await context.addInitScript(() => {
+    localStorage.setItem(
+      'millos-ui',
+      JSON.stringify({ state: { hasSeenIntro: true }, version: 1 })
+    );
+    window.jevCspViolations = [];
+    document.addEventListener('securitypolicyviolation', (event) => {
+      window.jevCspViolations.push(event.violatedDirective);
+    });
+  });
+  await context.route(endpoint, async (route) => {
+    const request = route.request();
+    const body = request.postDataJSON();
+    report.requests++;
+    assert.equal(request.headers().authorization, `Bearer ${key}`);
+    assert.equal(body.state, note);
+    assert.equal(body.model, 'typesafe/jev-1.13');
+    assert.deepEqual(Object.keys(body).sort(), ['model', 'provider', 'questions', 'state']);
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        model: 'typesafe/jev-1.13',
+        answers: {
+          decision: {
+            type: 'choice',
+            choice: 'Equipment maintenance',
+            probabilities: {
+              'Equipment maintenance': 1,
+              'Product quality': 0,
+              'Logistics coordination': 0,
+              'No current incident': 0,
+              'Insufficient evidence': 0,
+            },
+          },
+        },
+      }),
+    });
+  });
+  page = await context.newPage();
+  page.setDefaultTimeout(30_000);
+  page.on('pageerror', (error) => report.pageErrors.push(error.message));
+  page.on('console', (message) => {
+    if (message.type() === 'error') report.consoleErrors.push(message.text());
+  });
+  page.on('requestfailed', (request) => report.failedRequests.push(request.url()));
+  await page.setViewportSize({ width: 1440, height: 1000 });
+  await page.goto('http://127.0.0.1:4398/?benchmark=overview&quality=low&operations=on&pa=off', {
+    waitUntil: 'domcontentloaded',
+  });
+  await page.waitForFunction(
+    () =>
+      window.__MILLOS_RUNTIME__?.ready &&
+      document.documentElement.dataset.millosWorldReady === 'true' &&
+      !document.querySelector('[aria-label="Loading MillOS"]'),
+    null,
+    { timeout: 240_000 }
+  );
+
+  for (const width of [1440, 390]) {
+    await page.setViewportSize({ width, height: width === 390 ? 844 : 1000 });
+    await page.getByRole('button', { name: 'AI Partner', exact: true }).click();
+    await page.getByRole('tab', { name: 'Advisory', exact: true }).click();
+    const panel = page.getByRole('region', { name: 'Jev advisory' });
+    const credential = panel.getByLabel('Your OpenRouter API key');
+    const notes = panel.getByLabel('Incident text');
+    const consent = panel.getByRole('checkbox');
+    const send = panel.getByRole('button', { name: 'Send to Jev', exact: true });
+    const before = report.requests;
+    assert.equal(await credential.inputValue(), '');
+    assert.equal(await consent.isChecked(), false);
+    await credential.fill(key);
+    await notes.fill(note);
+    assert.equal(await send.isEnabled(), false);
+    await consent.check();
+    assert.equal(report.requests, before);
+    await send.click();
+    await panel.getByText('Equipment maintenance', { exact: true }).waitFor();
+    assert.equal(report.requests, before + 1);
+    assert.equal(
+      await panel.getByRole('button', { name: /accept|apply|clear incident/i }).count(),
+      0
+    );
+    assert.equal(
+      await page.evaluate(
+        (secret) =>
+          [...Object.values(localStorage), ...Object.values(sessionStorage)].some((v) =>
+            v.includes(secret)
+          ),
+        key
+      ),
+      false
+    );
+    await panel.getByText('Equipment maintenance', { exact: true }).scrollIntoViewIfNeeded();
+    await page.screenshot({ path: path.join(output, `advisory-${width}.png`) });
+    const bounds = await panel.evaluate((element) => ({
+      client: element.clientWidth,
+      scroll: element.scrollWidth,
+      right: element.getBoundingClientRect().right,
+    }));
+    assert.ok(bounds.scroll <= bounds.client + 1 && bounds.right <= width + 1);
+    await panel.getByRole('button', { name: 'Forget key', exact: true }).click();
+    assert.equal(await credential.inputValue(), '');
+    assert.equal(await consent.isChecked(), false);
+    report.layouts.push({ width, passed: true });
+  }
+  report.csp = await page.evaluate(() => window.jevCspViolations);
+  assert.equal(report.csp.length, 0);
+  assert.equal(report.pageErrors.length, 0);
+  assert.equal(report.consoleErrors.length, 0);
+  assert.equal(report.failedRequests.length, 0);
+  report.passed = true;
+} catch (error) {
+  report.error = error.message;
+  await page?.screenshot({ path: path.join(output, 'failure.png'), timeout: 5000 }).catch(() => {});
+  process.exitCode = 1;
+} finally {
+  await browser?.close();
+  if (server) await new Promise((resolve) => server.httpServer.close(resolve));
+  await lock.release();
+  await writeFile(path.join(output, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
+  console.log(JSON.stringify(report, null, 2));
+}

From acf273bfafb4126b130e1b1c59f6591dda46a3cc Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 13:06:45 +0100
Subject: [PATCH 3/6] test: exercise the versioned Pages build in browser
 acceptance

---
 .github/workflows/ci.yml         |  2 +-
 scripts/validate-jev-browser.mjs | 20 +++++++++++++++-----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9693874c..dc53245e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,7 +95,7 @@ jobs:
         run: npm ci
 
       - name: Build application
-        run: npm run build
+        run: VERSION="v$(node -p "require('./package.json').version.split('.').slice(0, 2).join('.')")" npm run build
 
       # Both read dist/ and src/ only; neither needs a GPU or a browser.
       - name: Validate bundle budget
diff --git a/scripts/validate-jev-browser.mjs b/scripts/validate-jev-browser.mjs
index 43f3fea6..a8296b49 100644
--- a/scripts/validate-jev-browser.mjs
+++ b/scripts/validate-jev-browser.mjs
@@ -1,7 +1,7 @@
 // Built-assembly UI gate. Only synthetic keys/text and intercepted provider responses.
 // Working if desktop/mobile can submit manually, forget credentials, and make no unsolicited calls.
 import assert from 'node:assert/strict';
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { chromium } from 'playwright';
@@ -26,7 +26,14 @@ const lock = await acquireCaptureLock('jev-browser-acceptance', { root });
 let browser, server, page;
 try {
   await mkdir(output, { recursive: true });
-  server = await preview({ root, preview: { host: '127.0.0.1', port: 4398, strictPort: true } });
+  const html = await readFile(path.join(root, 'dist/index.html'), 'utf8');
+  const base = html.match(/src="([^"]*\/)assets\/main-[^"]+\.js"/)?.[1];
+  assert.ok(base, 'Built application entry must identify its deployment base');
+  server = await preview({
+    root,
+    base,
+    preview: { host: '127.0.0.1', port: 4398, strictPort: true },
+  });
   browser = await chromium.launch({ headless: true });
   const context = await browser.newContext({ serviceWorkers: 'block', reducedMotion: 'reduce' });
   await context.addInitScript(() => {
@@ -76,9 +83,12 @@ try {
   });
   page.on('requestfailed', (request) => report.failedRequests.push(request.url()));
   await page.setViewportSize({ width: 1440, height: 1000 });
-  await page.goto('http://127.0.0.1:4398/?benchmark=overview&quality=low&operations=on&pa=off', {
-    waitUntil: 'domcontentloaded',
-  });
+  await page.goto(
+    `http://127.0.0.1:4398${base}?benchmark=overview&quality=low&operations=on&pa=off`,
+    {
+      waitUntil: 'domcontentloaded',
+    }
+  );
   await page.waitForFunction(
     () =>
       window.__MILLOS_RUNTIME__?.ready &&

From 5583af5f52288fb52f6f65b2fd8cadb67e8efa67 Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 13:15:48 +0100
Subject: [PATCH 4/6] test: wait for complete scene batching before Jev UI
 actions

---
 scripts/validate-jev-browser.mjs | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/scripts/validate-jev-browser.mjs b/scripts/validate-jev-browser.mjs
index a8296b49..33aea021 100644
--- a/scripts/validate-jev-browser.mjs
+++ b/scripts/validate-jev-browser.mjs
@@ -97,6 +97,32 @@ try {
     null,
     { timeout: 240_000 }
   );
+  // CompleteWorldMarker fires on mount, before incremental static batching.
+  // Use the same structural-settling criterion as run-performance-benchmark.mjs.
+  const settlingStarted = Date.now();
+  await page.waitForFunction(
+    () => {
+      const snapshot = window.__MILLOS_RUNTIME__?.snapshot();
+      if (!snapshot) return false;
+      const signature = JSON.stringify([
+        snapshot.sceneGraph.objects,
+        snapshot.sceneGraph.meshes,
+        snapshot.sceneGraph.instancedMeshes,
+      ]);
+      const now = performance.now();
+      if (
+        Number(document.documentElement.dataset.millosStaticBatchesPending ?? 0) > 0 ||
+        window.jevSceneSignature !== signature
+      ) {
+        window.jevSceneSignature = signature;
+        window.jevSceneStableSince = now;
+      }
+      return now - window.jevSceneStableSince >= 2000;
+    },
+    null,
+    { polling: 400, timeout: 240_000 }
+  );
+  report.settlingMs = Date.now() - settlingStarted;
 
   for (const width of [1440, 390]) {
     await page.setViewportSize({ width, height: width === 390 ? 844 : 1000 });

From 8b12e77410de5a8d61fa2c47b06cc56a7a135b1c Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 13:33:12 +0100
Subject: [PATCH 5/6] test: avoid expensive geometry inspection in UI readiness
 polling

---
 .github/workflows/ci.yml         |  1 +
 scripts/validate-jev-browser.mjs | 26 +++++++++++---------------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc53245e..db630769 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,6 +108,7 @@ jobs:
         run: npx playwright install --with-deps chromium
 
       - name: Validate Jev personal-key flow in desktop and mobile layouts
+        timeout-minutes: 8
         run: node scripts/validate-jev-browser.mjs
 
       - name: Upload Jev browser evidence
diff --git a/scripts/validate-jev-browser.mjs b/scripts/validate-jev-browser.mjs
index 33aea021..741df374 100644
--- a/scripts/validate-jev-browser.mjs
+++ b/scripts/validate-jev-browser.mjs
@@ -98,25 +98,19 @@ try {
     { timeout: 240_000 }
   );
   // CompleteWorldMarker fires on mount, before incremental static batching.
-  // Use the same structural-settling criterion as run-performance-benchmark.mjs.
+  // Read the batcher's readiness counter directly. Runtime snapshot() performs
+  // geometry raycasts as well as counting objects, so it is unsuitable for polling.
+  report.phase = 'scene-batching';
+  await writeFile(path.join(output, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
   const settlingStarted = Date.now();
   await page.waitForFunction(
     () => {
-      const snapshot = window.__MILLOS_RUNTIME__?.snapshot();
-      if (!snapshot) return false;
-      const signature = JSON.stringify([
-        snapshot.sceneGraph.objects,
-        snapshot.sceneGraph.meshes,
-        snapshot.sceneGraph.instancedMeshes,
-      ]);
       const now = performance.now();
-      if (
-        Number(document.documentElement.dataset.millosStaticBatchesPending ?? 0) > 0 ||
-        window.jevSceneSignature !== signature
-      ) {
-        window.jevSceneSignature = signature;
+      if (Number(document.documentElement.dataset.millosStaticBatchesPending ?? 0) > 0) {
         window.jevSceneStableSince = now;
+        return false;
       }
+      window.jevSceneStableSince ??= now;
       return now - window.jevSceneStableSince >= 2000;
     },
     null,
@@ -125,6 +119,8 @@ try {
   report.settlingMs = Date.now() - settlingStarted;
 
   for (const width of [1440, 390]) {
+    report.phase = `layout-${width}`;
+    await writeFile(path.join(output, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
     await page.setViewportSize({ width, height: width === 390 ? 844 : 1000 });
     await page.getByRole('button', { name: 'AI Partner', exact: true }).click();
     await page.getByRole('tab', { name: 'Advisory', exact: true }).click();
@@ -182,9 +178,9 @@ try {
   await page?.screenshot({ path: path.join(output, 'failure.png'), timeout: 5000 }).catch(() => {});
   process.exitCode = 1;
 } finally {
+  await writeFile(path.join(output, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
+  console.log(JSON.stringify(report, null, 2));
   await browser?.close();
   if (server) await new Promise((resolve) => server.httpServer.close(resolve));
   await lock.release();
-  await writeFile(path.join(output, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
-  console.log(JSON.stringify(report, null, 2));
 }

From a2389035b49e65af166a8cc42b9da083b8d4c0e2 Mon Sep 17 00:00:00 2001
From: NellInc <nell@nellwatson.com>
Date: Mon, 21 Sep 2026 13:53:34 +0100
Subject: [PATCH 6/6] fix: exclude React ownership metadata from material
 batching

---
 .../performance/StaticMeshBatch.test.ts       | 32 +++++++++++++++++++
 .../performance/StaticMeshBatch.tsx           | 13 +++++++-
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/src/components/performance/StaticMeshBatch.test.ts b/src/components/performance/StaticMeshBatch.test.ts
index bd823352..49478a61 100644
--- a/src/components/performance/StaticMeshBatch.test.ts
+++ b/src/components/performance/StaticMeshBatch.test.ts
@@ -17,6 +17,38 @@ const makeBox = (x: number, color: string = '#778899'): THREE.Mesh => {
 };
 
 describe('StaticMeshBatch', () => {
+  it('ignores R3F ownership graphs when comparing identical rendered materials', () => {
+    const root = new THREE.Group();
+    const left = makeBox(-2);
+    const right = makeBox(3);
+    for (const [index, mesh] of [left, right].entries()) {
+      // R3F attaches this enumerable metadata to mounted materials. Its parent
+      // and children describe the React scene, not the material's appearance.
+      Object.assign(mesh.material, {
+        __r3f: { type: 'meshStandardMaterial', parent: { key: index }, children: [] },
+      });
+    }
+    root.add(left, right);
+    const candidates = collectStaticBatchCandidates(root);
+    expect(candidates[0]?.materialSignature).toBe(candidates[1]?.materialSignature);
+    expect(candidates[0]?.materialSignature).not.toContain('__r3f');
+    expect(createStaticMeshBatches(root, candidates, 'mounted', 2)).toHaveLength(1);
+  });
+
+  it('never traverses a mounted material ownership graph', () => {
+    const root = new THREE.Group();
+    const mesh = makeBox(0);
+    Object.assign(mesh.material, {
+      __r3f: {
+        get parent() {
+          throw new Error('Material signing traversed the R3F scene graph');
+        },
+      },
+    });
+    root.add(mesh);
+    expect(() => collectStaticBatchCandidates(root)).not.toThrow();
+  });
+
   it('instances transform-stable opaque duplicates without changing their world transforms', () => {
     const root = new THREE.Group();
     const left = makeBox(-2);
diff --git a/src/components/performance/StaticMeshBatch.tsx b/src/components/performance/StaticMeshBatch.tsx
index f2adbf8c..12a01a2d 100644
--- a/src/components/performance/StaticMeshBatch.tsx
+++ b/src/components/performance/StaticMeshBatch.tsx
@@ -210,7 +210,18 @@ const geometrySignature = (geometry: THREE.BufferGeometry): string => {
 
 type MaterialSignatureOptions = { includeColor?: boolean; mergeCompatible?: boolean };
 
-const MATERIAL_IDENTITY_KEYS = new Set(['id', 'uuid', 'name', 'userData', 'version', 'type']);
+// R3F's enumerable ownership descriptor links back through the entire React
+// scene. Signing it both separates visually identical materials by parent and
+// recursively expands shared ownership paths. Only render state belongs here.
+const MATERIAL_IDENTITY_KEYS = new Set([
+  'id',
+  'uuid',
+  'name',
+  'userData',
+  'version',
+  'type',
+  '__r3f',
+]);
 const MERGE_QUANTIZED_KEYS = new Set(['roughness', 'metalness']);
 
 const materialValueSignature = (