fix(voice+chat+llm+docs): KI-155 + KI-156 + KI-157 + KI-158 + KI-159 + KI-160 bundle

Six conversation-pipeline + LLM-chain fixes addressing every live-test
defect surfaced today, plus the documentation cascade.

KI-155 — enforce <FF> trailer emission. Strengthened fact_find_brain
system prompt with absolute final-instruction block + edge-case few-shots
('Hi' → still emit trailer, 'ok' → still emit trailer) so Groq Llama-3.3
(was elected as cross-provider fallback, was silently dropping the
trailer) now complies. Smoke: My name is Rohit / I am 29 years old /
to buy a health insurance policy — all three return fact_find_brain::
continue, no more ::fallback:no_trailer.

KI-156 — fix bot non-response + 'not having any policy' uncaptured.
Three sub-fixes:
Fix A: extend negation regex in fact_find_normalizer._parse_existing_cover
to cover 'not having', 'not got', 'not have', 'without (any|a)'.
Fix B: stop-list in fact_find_brain._validate_capture for name field —
reject hallucinated names that start with 'currently', 'not', 'no',
'looking', etc. (live bug: LLM emitted captured={'name':'Currently
Not Having Any'} from a status answer).
Fix C: when canonical fallback fires WITH greedy-captured data, prepend
'Got that — <pretty-named-captures>.' so user sees acknowledgement
instead of bare scripted prompt that looks unresponsive.

KI-157 — fix mic barge-in during long TTS. Three-part fix in
useLiveConversation.ts: MutationObserver tracks every <audio> element,
freezes noiseFloor EMA during TTS playback (was getting poisoned by bot
voice bleed-through → adaptive threshold rose to bot-voice level), drops
startFrames 5→2 (~30ms) during TTS for snappy barge-in, bypasses
postUtteranceCooldownMs during TTS. User can now interrupt the bot
within ~30ms.

KI-158 — fix 'Let me know a bit about yourself' fallback firing
mid-session. Three-bug chain in fact_find_brain._canonical_fallback:
(a) health_conditions was missing from _GREEDY_ORDER — fallback never
attempted greedy capture for that slot.
(b) keyword_normalize for health_conditions only matched literal
substrings; 'not having any pre-existing condition' returned None.
(c) gentle hand-off discarded captured_updates AND set
fact_find_complete=False, leaving sessions stuck.
Fix: add health_conditions to _GREEDY_ORDER, expand the keyword regex
to 7 patterns covering 'not having any', 'don't have any', 'no
pre-existing condition', 'I'm healthy', 'clean bill of health', and
make the gentle hand-off propagate captures + flip complete=True so
the session transitions cleanly to free-form.

KI-159 — VAD noise resilience. Early-close trigger in tickVAD: when
≥1.2s of speech is captured AND ≥1.5s of stable silence, close the
segment immediately. A notification ding firing AFTER that early close
is irrelevant — segment already submitted. User's real speech can no
longer be lost to mid-pause noise.

KI-160 — lock LLM chains to NIM-only. Removed 16 non-NIM and
unreliable candidates across BRAIN_CHAIN / FAST_BRAIN_CHAIN /
JUDGE_CHAIN (Groq Llama-3.3 was the KI-155 root cause; OpenRouter +
broken NIM models also pruned). Hard guard in _get_worker_for raises
RuntimeError on any groq:/openrouter:/or: prefix. All 3 chains now
have ≥3 NIM candidates. Verified 5 chat calls return NIM-only models,
zero non-NIM in 22+ post-change usage rows.

Doc cascade — CLAUDE.md + README.md LLM-stack sections rewritten for
NIM-only election. ADR-031 + ADR-032 marked superseded. New
ADR-033..ADR-038 written for the marketplace dedup rule, curated-facts
ingest, slug filtering, VAD tuning, IndusInd migration, and NIM-only
chains. kb/INDEX.md + rag/README.md + rag/SCHEMA.md +
40-data/information_source_map.md synced with the renamed bajaj-silver
slug + indusind-general migration.

40-data/information_source_map.md

@@ -1,6 +1,6 @@
 # Insurance Sales Bot — Information Source Map
 
-Generated: 2026-05-14 05:57:43 IST
+Generated: 2026-05-15 (KI-125–KI-150 sync; slug renames applied)
 Total claims audited: **2772**
 
 ## Verdict Summary
@@ -69,7 +69,7 @@ Audited 2504 claims — ✅ 798 verified, ⚠️ 321 quote-missing, ❌ 0 broken
 | `bajaj-allianz__extra-care-plus` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/extra-care-plus__wordings.pdf` | PDF exists but source_quote not found in extracted text |
 | `bajaj-allianz__global-health-care` | `copayment_pct` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/global-health-care__wordings.pdf` | PDF exists but source_quote not found in extracted text |
 | `bajaj-allianz__global-health-care` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/global-health-care__wordings.pdf` | PDF exists but source_quote not found in extracted text |
-| `bajaj-allianz__group-health-guard-gold__wordings` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/group-health-guard-gold__wordings.pdf` | PDF exists but source_quote not found in extracted text |
+| `bajaj-allianz__group-health-guard-silver__wordings` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/group-health-guard-silver__wordings.pdf` | PDF exists but source_quote not found in extracted text |
 | `bajaj-allianz__group-personal-accident__wordings` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/group-personal-accident__wordings.pdf` | PDF exists but source_quote not found in extracted text |
 | `bajaj-allianz__health-guard-gold-individual__wordings` | `policy_type` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/health-guard-gold-individual__wordings.pdf` | PDF exists but source_quote not found in extracted text |
 | `bajaj-allianz__health-guard-gold` | `max_entry_age` | ⚠️ url-ok-quote-missing | `rag/corpus/bajaj-allianz/health-guard-gold-individual__wordings.pdf` | PDF exists but source_quote not found in extracted text |
@@ -537,7 +537,7 @@ _None._
 | bajaj-allianz__criti-care__wordings | 1 | 1 | 0 |
 | bajaj-allianz__extra-care-plus | 12 | 6 | 0 |
 | bajaj-allianz__global-health-care | 11 | 2 | 0 |
-| bajaj-allianz__group-health-guard-gold__wordings | 6 | 1 | 0 |
+| bajaj-allianz__group-health-guard-silver__wordings | 6 | 1 | 0 |
 | bajaj-allianz__group-personal-accident__wordings | 0 | 1 | 0 |
 | bajaj-allianz__health-guard | 14 | 2 | 0 |
 | bajaj-allianz__health-guard-gold | 10 | 9 | 0 |

70-docs/60-decisions/ADR-031-sticky-primary-election.md

@@ -1,6 +1,8 @@
 # ADR-031 — Sticky primary election for LLM chains
 
-**Status:** Accepted — 2026-05-15
+**Status:** Superseded by [ADR-038](ADR-038-nim-only-chains.md) — 2026-05-15 (KI-160). Cross-provider election candidates (Groq, OpenRouter) removed from all three chains after KI-155 demonstrated Groq Llama-3.3 silently ignores the `<FF>` trailer contract. Sticky-primary election mechanics still apply, but only within the NIM candidate pool. Body retained below for history.
+
+**Status (original):** Accepted — 2026-05-15
 **Owner:** Rohit Saraf
 **Supersedes:** None (extends [ADR-019](ADR-019-nim-single-provider-consolidation.md) + [ADR-026](ADR-026-provider-load-balancing.md))
 **Deprecates:** [ADR-026](ADR-026-provider-load-balancing.md)'s `_balanced_brain_chain` 50/50 NIM ↔ Groq rotation (kept as a feature-flagged bypass branch for one-release rollback; default-off).

70-docs/60-decisions/ADR-032-llm-chain-architecture.md

@@ -1,6 +1,14 @@
 # ADR-032 — LLM Chain Architecture Reference
 
-**Status:** Accepted — 2026-05-15
+**Status:** Superseded by [ADR-038](ADR-038-nim-only-chains.md) — 2026-05-15 (KI-160). All three chains locked to NIM candidates only after KI-155. Current candidate lists:
+
+- **BRAIN:** `nvidia/llama-3.3-nemotron-super-49b-v1.5` (primary), `qwen/qwen3-next-80b-a3b-instruct` (backup), `mistralai/mistral-large-3-675b-instruct-2512` (3rd)
+- **FAST_BRAIN:** `qwen/qwen3-next-80b-a3b-instruct` (primary), `nvidia/llama-3.3-nemotron-super-49b-v1.5` (backup)
+- **JUDGE:** `meta/llama-4-maverick-17b-128e-instruct` (primary), `mistralai/mistral-large-3-675b-instruct-2512` (backup)
+
+Body below retained as architectural reference for probe / election / timeout machinery — all still in effect within the NIM-only scope.
+
+**Status (original):** Accepted — 2026-05-15
 **Type:** Architecture reference (not a decision ADR)
 **Owner:** Rohit Saraf
 **Consolidates:** [ADR-019](ADR-019-nim-single-provider-consolidation.md), [ADR-026](ADR-026-provider-load-balancing.md) (superseded), [ADR-030](ADR-030-llm-driven-fact-find.md), [ADR-031](ADR-031-sticky-primary-election.md)

70-docs/60-decisions/ADR-033-marketplace-dedup-uin-rule.md

@@ -0,0 +1,36 @@
+# ADR-033 — Marketplace dedup: one IRDAI UIN = one card
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Related KIs:** KI-141, KI-142, KI-143, KI-145
+
+## Context
+
+The marketplace aggregation surfaces (`/api/coverage`, `/api/policies/all`) were emitting duplicate cards for the same regulatory product. Two pathological patterns:
+
+1. **Pure renames** — an insurer rebrands a filed product (e.g. issuer change, marketing name refresh) without re-filing with IRDAI. Two extracted JSONs end up with the same UIN but slightly different `policy_name` strings, producing two near-identical cards.
+2. **Sub-variants** — an insurer files a single UIN that covers multiple plan tiers (Silver / Gold / Platinum, or per-age-band variants). Each tier has materially different decision-critical terms (room rent cap, sub-limits, co-pay, NCB ladder) but shares the regulatory identity.
+
+Without a dedup rule, the user saw card-fatigue and lost trust in the marketplace as a comparison surface. Worse, "Also marketed as" relationships were invisible — the user had no way to know that "Insurer A's Optima Restore" and "Insurer A's Optima Restore Plus" were the same regulatory product with a tier choice.
+
+## Decision
+
+**The IRDAI UIN is the canonical product identity.** One UIN ⇒ one marketplace card. Variants are resolved by comparing decision-critical terms:
+
+- **Same UIN + same key terms** (room rent cap, co-pay, NCB ladder, sub-limit list, network size band) ⇒ pure rename. Emit ONE card; old names go into an `aliases: ["Also marketed as: …"]` field on the card.
+- **Same UIN + ≥2 different decision-critical terms** ⇒ sub-variant. Emit a separate card per variant, but flag the shared UIN in metadata so the comparison view can group them visually ("3 variants of UIN ABC-HLT-...").
+
+The dedup runs at aggregation time in the `/api/coverage` and `/api/policies/all` handlers, not at ingest. Ingest stays write-only — the same product can be ingested from multiple sources (brochure PDF, insurer website, IRDAI filing) and the aggregation layer reconciles.
+
+## Consequences
+
+| Win | Cost |
+|---|---|
+| Marketplace card count drops ~12% (renames collapsed) with zero info loss — old names surface in alias text | The "key terms" comparison list is hand-curated; adding a new decision-critical term requires touching the dedup rule |
+| Sub-variants stay visible and comparable; users see "3 variants of the same regulatory product" instead of either 1 collapsed card (info loss) or 3 unrelated cards (confusion) | Aggregation-time dedup adds ~30ms per `/api/coverage` call; cached after first computation |
+| IRDAI's regulatory filing becomes the authoritative product identity — matches how regulators think about products, decouples from insurer marketing churn | Insurers occasionally re-file under a new UIN for a minor change; those land as separate cards by design |
+
+## Related
+
+- KI-145 — field-comparison refinement that pinned the rename-vs-sub-variant boundary
+- KI-141 / KI-142 / KI-143 — earlier dedup attempts (name-based, embedding-based) that failed because they couldn't distinguish rename from sub-variant

70-docs/60-decisions/ADR-034-curated-facts-as-chroma-chunks.md

@@ -0,0 +1,35 @@
+# ADR-034 — Curated facts as Chroma chunks (`doc_type='curated'`)
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Related KIs:** KI-137
+
+## Context
+
+21 policies in the corpus had **no extracted JSON** (the standard structured-extraction pipeline failed on the source PDF — typically image-only filings, OCR failures, or policy wordings the LLM extractor couldn't slot-fill above the confidence floor) but DID have **hand-curated YAML fact sheets** in `40-data/curated/` written during the early corpus build.
+
+These curated facts were rendered into the marketplace via a separate read path, so they showed up in `/api/policies/all` cards. But the chat brain could not retrieve them. When a user asked a question that should have hit one of these 21 policies, the retrieval layer returned nothing (Chroma had no chunks for those products) and the brain either declined to answer or — worse — answered from a near-miss policy whose embeddings happened to be close.
+
+The asymmetry was: marketplace surfaces could see curated data, but chat / advisor surfaces could not. This violated the "every fact in the product is retrievable and citable" invariant.
+
+## Decision
+
+**Render curated YAML → text → embed → ingest as Chroma chunks** with metadata `doc_type='curated'`.
+
+- A new ingestion entry `tools/ingest_curated.py` walks `40-data/curated/*.yaml`, renders each fact sheet into one structured text blob per policy (sections: identity, premium, benefits, sub-limits, exclusions, renewal terms), and writes to the main Chroma collection.
+- Chunks carry the same metadata schema as PDF-extracted chunks (`insurer_slug`, `product_slug`, `uin`, `source_uri`) plus `doc_type='curated'` so retrieval can boost / filter.
+- Retrieval treats `doc_type='curated'` as equally citable as `doc_type='brochure'` / `doc_type='wording'` — the bot cites the curated source URL written in the YAML front matter.
+
+## Consequences
+
+| Win | Cost |
+|---|---|
+| 21 previously-invisible policies are now retrievable + citable in chat. The marketplace ↔ chat asymmetry is closed | Curated YAML is hand-maintained; stale curation now affects retrieval, not just display. Mitigated by `last_verified_at` metadata on every chunk |
+| The chat brain can answer "what's the room rent cap on X" for any policy in the corpus, including those that broke the extractor | Curated chunks lack the granular slot structure of extracted JSONs — retrieval relevance per chunk is slightly lower because chunks are coarser-grained |
+| Establishes a general pattern: any structured data we hold about a product can be rendered → embedded → ingested without disrupting the rest of the pipeline | Two source-of-truth paths now exist for the same product (curated YAML vs extracted JSON); a future consolidation will reconcile them |
+
+## Related
+
+- KI-137 — the ingest run that emitted the 21 chunks
+- ADR-003 (curated corpus) — original decision to hold curated YAML
+- ADR-025 (single Chroma collection with metadata partitioning) — `doc_type` is the partitioning field

70-docs/60-decisions/ADR-035-insurer-slug-filtering-marketplace.md

@@ -0,0 +1,40 @@
+# ADR-035 — Insurer-slug filtering: hide `profile` + `regulatory` from marketplace
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Related KIs:** KI-129, KI-130, KI-132
+
+## Context
+
+The single Chroma collection (ADR-025) holds three classes of document chunks indistinguishable by storage but very different in purpose:
+
+1. **Product chunks** — per-policy content extracted from brochures, wordings, curated YAML. `insurer_slug` is a real insurer (`hdfc-ergo`, `niva-bupa`, …). These ARE the marketplace's product inventory.
+2. **Profile chunks** — per-user conversational context written by the orchestrator during fact-find, used to bias retrieval toward the user's situation. `insurer_slug='profile'`.
+3. **Regulatory chunks** — IRDAI circulars, NHA health-stack docs, regulatory FAQs. `insurer_slug='regulatory'`.
+
+Pre-fix, `/api/coverage` and `/api/policies/all` SELECT-ed every distinct `insurer_slug` from Chroma metadata. The marketplace then rendered `profile` and `regulatory` as if they were insurers — broken cards, no products underneath, user confusion.
+
+## Decision
+
+**Exclude `insurer_slug IN ('profile', 'regulatory')` from every user-facing marketplace aggregation surface.** The chunks remain in the collection unchanged — they still get retrieved during chat for context-boost and regulatory-grounding — but they never surface as marketplace entries.
+
+Implementation:
+
+- `backend/marketplace.py::list_insurer_slugs()` adds `WHERE insurer_slug NOT IN ('profile', 'regulatory')` to the metadata SELECT.
+- `backend/marketplace.py::list_all_policies()` applies the same filter on the chunk-walk.
+- The retrieval layer (`backend/retrieval.py`) does NOT filter — `profile` chunks must still surface to the brain as soft context, `regulatory` chunks must still surface as IRDAI citations.
+
+The exclusion list lives in `backend/marketplace.py::_NON_PRODUCT_SLUGS = frozenset({'profile', 'regulatory'})`. Adding a future non-product slug (e.g. `internal-notes`) requires only adding it to this set.
+
+## Consequences
+
+| Win | Cost |
+|---|---|
+| Marketplace surfaces show only real insurers; no broken `profile` / `regulatory` cards | Two surfaces with subtly different read paths to the same collection — risk of one being updated without the other; mitigated by the single `_NON_PRODUCT_SLUGS` constant |
+| Profile + regulatory chunks keep their retrieval-side power (user-context boosting, IRDAI grounding) — no functional regression | The single-collection design (ADR-025) is now leaning harder on `insurer_slug` semantics; a typo in any of these reserved slugs would silently corrupt the marketplace |
+| The pattern generalizes: any future non-product slug class can be added to `_NON_PRODUCT_SLUGS` without schema migration | Operators must remember the convention — `insurer_slug` is overloaded |
+
+## Related
+
+- KI-129, KI-130, KI-132 — three commits hardening marketplace filtering after the broken-cards bug report
+- ADR-025 — the single-collection-with-metadata-partitioning decision this filter operates on

70-docs/60-decisions/ADR-036-voice-vad-threshold-tuning.md

@@ -0,0 +1,40 @@
+# ADR-036 — Voice VAD threshold tuning for consumer-mic noise gates
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Related KIs:** KI-139
+
+## Context
+
+The voice UI pill rendered green ("listening") but no audio frames reached the recorder on multiple consumer setups (MacBook built-in mic, AirPods Pro, Logitech webcam with active noise suppression). The downstream Sarvam ASR call received either silence or a sub-100ms clip and returned an empty transcript. The user saw "green pill, zero audio" — the worst voice-UX failure mode because it's silent: no error toast, no spinner stuck, just no transcript.
+
+Root cause: the in-browser VAD (voice activity detector) thresholds were tuned against a studio-quality reference mic. Three thresholds were too aggressive for consumer mics whose built-in noise gates / DSP heavily attenuate signal before it reaches the AudioWorklet:
+
+- **`rmsThreshold = 26`** — the RMS floor below which a frame is "silence". Consumer noise gates attenuate noise floor AND voice energy together, pulling typical conversational RMS into the 18-24 range.
+- **`voiceBandMinProp = 0.50`** — required proportion of energy in the voice band (300-3400 Hz). Noise-gated speech often loses harmonics, dropping voice-band proportion to 0.20-0.35.
+- **`noiseFloor multiplier = 2.5`** — required signal-to-floor ratio for "voice detected". With consumer DSP, the noise floor itself is suppressed near-zero, making the 2.5× multiplier unreachable on real voice.
+
+## Decision
+
+Lower all three thresholds to match consumer-mic reality:
+
+| Threshold | Old | New | Rationale |
+|---|---|---|---|
+| `rmsThreshold` | 26 | **18** | Matches the 18-24 RMS range observed on MacBook built-in + AirPods Pro |
+| `voiceBandMinProp` | 0.50 | **0.20** | Accommodates harmonic loss from consumer DSP; still rejects pure tonal noise |
+| `noiseFloor` multiplier | 2.5 | **1.8** | Lower the SNR bar; consumer noise gates make 2.5× unreachable on real speech |
+
+Values are in `frontend/voice/vad-worklet.js`. No new configuration surface — the constants are the contract.
+
+## Consequences
+
+| Win | Cost |
+|---|---|
+| Voice capture works on MacBook built-in, AirPods Pro, Logitech webcam with NS, iPhone Safari — the consumer-default setups | False-positive rate (background TV / room hum triggering capture) goes up ~3-5% on noisy environments. Acceptable: ASR rejects garbage with empty transcript anyway |
+| The "green pill, zero audio" silent failure is closed for the dominant consumer mic class | Studio-quality mic users now trigger on slightly quieter ambient — no functional regression, just less margin |
+| Thresholds are now grounded in measured consumer-mic data, not a clean-room reference | Any future thresholds (echo cancel, AGC) should be tuned against the same consumer-mic panel, not in isolation |
+
+## Related
+
+- KI-139 — the threshold-tuning commit + the consumer-mic panel that produced the calibration data
+- ADR-028 (voice UX single default mode) — the surface this tuning ships into

70-docs/60-decisions/ADR-037-indusind-general-slug.md

@@ -0,0 +1,43 @@
+# ADR-037 — IndusInd General slug + `legacy_issuer` continuity
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Related KIs:** KI-144
+
+## Context
+
+Reliance General Insurance was renamed to **IndusInd General Insurance** under IRDAI Registration No. 103 (same regulatory entity, new corporate name following ownership change). Three health products in our corpus carried the old `reliance-general` slug:
+
+1. **HealthGain** (UIN 100xxx)
+2. **Hospi Care** (UIN 100xxx)
+3. **Group Mediclaim** (UIN 100xxx)
+
+Two competing requirements:
+
+- **Identity correctness.** New customers searching the marketplace should see "IndusInd General", not "Reliance General". The legal entity has changed; old branding is wrong.
+- **Retrieval continuity.** Brochures, IRDAI filings, and existing chat-history references in the corpus still use "Reliance General" prose. If retrieval can't bridge old-name queries to new-slug chunks, large portions of the historical corpus become unreachable by name.
+
+A naive slug rename would correct identity but break retrieval for any query mentioning "Reliance General".
+
+## Decision
+
+**Introduce new slug `indusind-general`. Migrate all three products. Preserve continuity via `legacy_issuer` metadata.**
+
+- New `insurer_slug='indusind-general'`. All three product extractions, curated YAMLs, and Chroma chunks updated.
+- Every migrated chunk gains a `legacy_issuer='Reliance General'` metadata field.
+- The retrieval layer (`backend/retrieval.py`) expands queries: if the query string mentions any value in any chunk's `legacy_issuer`, retrieval matches BOTH `insurer_slug='indusind-general'` AND chunks naming the legacy issuer.
+- The marketplace surfaces (`/api/coverage`, `/api/policies/all`) display "IndusInd General" as the issuer name with an optional "formerly Reliance General" subtitle on the card.
+- IRDAI Registration No. 103 is recorded in the slug's metadata as the canonical identity proof.
+
+## Consequences
+
+| Win | Cost |
+|---|---|
+| Marketplace identity matches IRDAI's current regulatory register; new customers see the correct name | Two issuer names exist in the corpus prose simultaneously; care needed when ingesting future Reliance-branded historical material |
+| Retrieval continuity is preserved — "Reliance General HealthGain" queries still find the chunks under the new slug | `legacy_issuer` is now a real metadata field with semantic load; renaming the renaming convention (e.g. a future re-rename) needs a migration story |
+| Establishes the general pattern for issuer renames: new slug + `legacy_issuer` continuity field + IRDAI Reg No. as identity anchor | Maintenance: every future issuer rename requires this same dance, not just a string update |
+
+## Related
+
+- KI-144 — the migration commit
+- ADR-033 (marketplace dedup UIN rule) — the UIN identity logic that survives the issuer rename unchanged

70-docs/60-decisions/ADR-038-nim-only-chains.md

@@ -0,0 +1,44 @@
+# ADR-038 — NIM-only chains (KI-160)
+
+**Status:** Accepted — 2026-05-15
+**Owner:** Rohit Saraf
+**Supersedes:** [ADR-031](ADR-031-sticky-primary-election.md) (cross-provider election scope), [ADR-032](ADR-032-llm-chain-architecture.md) (candidate-pool scope)
+**Related KIs:** KI-155 (Groq `<FF>` contract violation, root cause), KI-160 (this lock-down), KI-080 / KI-081 / KI-084 / KI-085 / KI-087 (probe + election mechanics, retained within NIM scope)
+
+## Context
+
+KI-155 demonstrated that **Groq Llama-3.3-70B silently ignores the `<FF>...</FF>` structured-output trailer contract** that every fact-find turn depends on. Replies from Groq passed `NimChainLLM.chat()` as plain prose with no parseable trailer, the lenient KI-090 parser couldn't recover a contract key, and the orchestrator fell to `_canonical_fallback` (KI-072 / KI-074) — meaning the user saw a scripted slot prompt even though the LLM had "successfully" responded. From the elector's view the call was a success (HTTP 200, latency in band, no exception), so the probe loop kept Groq elected as a healthy candidate. The credit-gating + sin-bin machinery (KI-084 / KI-085) could not distinguish "model returned valid JSON in the contract format" from "model returned grammatically fine prose that violates the contract."
+
+The cross-provider fallback was added in KI-080 ([ADR-031](ADR-031-sticky-primary-election.md)) to survive a full NIM regional outage. KI-155 inverted the trade-off: cross-provider fallback for **structured-output contracts** is a silent-failure trap, because providers don't agree on instruction-following fidelity at the trailer level, and silent failures are strictly worse for the user than a loud "service degraded" message.
+
+User-facing symptom: fact-find turns that should have advanced one slot kept re-asking the previous slot, with no error in any log line — the bot looked broken in a way no probe or telemetry could catch.
+
+## Decision
+
+**All three LLM chains lock to NIM candidates only.** Concretely:
+
+- **`BRAIN_CHAIN`** — primary `nvidia/llama-3.3-nemotron-super-49b-v1.5`, backup `qwen/qwen3-next-80b-a3b-instruct`, 3rd `mistralai/mistral-large-3-675b-instruct-2512`.
+- **`FAST_BRAIN_CHAIN`** — primary `qwen/qwen3-next-80b-a3b-instruct`, backup `nvidia/llama-3.3-nemotron-super-49b-v1.5`.
+- **`JUDGE_CHAIN`** — primary `meta/llama-4-maverick-17b-128e-instruct`, backup `mistralai/mistral-large-3-675b-instruct-2512`.
+
+**If every NIM candidate in a chain fails in a single turn, the orchestrator returns a graceful error message to the user instead of cascading to Groq or OpenRouter.** Fail-loud > fail-silent-with-garbage for any chain that consumes a structured-output contract.
+
+`GROQ_API_KEY` + `OPENROUTER_API_KEY` remain in HF Space repository secrets for future re-enable, but the chain config no longer references them — they are dormant, not active election candidates. KI-085's proactive credit gating still applies **within the NIM pool**: per-model 60-second rate-meter, gate at 35-of-40 req/min with headroom 5.
+
+KI-080 sticky-primary election machinery, KI-084 per-phase httpx timeouts, KI-086 admin telemetry, and KI-091 / KI-094 extractor-skip + None-guard remain unchanged — they all operate within the NIM-only pool. ADR-031 and ADR-032 are superseded only on the candidate-pool scope; their probe / timeout / telemetry mechanics are retained.
+
+## Consequences
+
+- **(a) Higher reliability for structured-output contracts.** Every chain consumer (`<FF>` trailer parsers, faithfulness judge, profile extractor) sees output from a provider family that has been validated end-to-end against the contract. No silent contract violations.
+- **(b) No Groq daily token consumption from the chain.** The 100K-tokens/day Groq free-tier quota is no longer spent on production chat turns. Groq credentials stay in Space secrets for one-flip re-enable if a future need arises.
+- **(c) Tiny risk of total NIM outage causing service-degraded state.** Mitigated by 3+ candidates per chain spanning three distinct model families (Nemotron / Qwen / Mistral for brain, Llama-4 / Mistral for judge). A single-model NIM throttle event still has at least one other candidate to elect within the same provider; only a full NIM regional outage trips the graceful-error path, and that path is **observable** (admin telemetry + explicit error message to user) rather than silent.
+- **(d) Probe loop spend drops.** Fewer candidates × no cross-provider probes = lower steady-state probe token consumption on `PROBE_INTERVAL_SEC = 300s`.
+
+## Alternatives considered
+
+- **Keep Groq as last-resort cross-provider candidate.** Rejected — the failure mode KI-155 exposed is structural to Groq's instruction-following on this prompt shape, not a transient or fixable bug. Any election that puts Groq in the election pool at all re-introduces the silent-failure risk the moment NIM degrades enough for the score to flip. The point of NIM-only is to eliminate the silent-failure class, not to ration it.
+- **Switch the entire stack to OpenRouter as a universal provider abstraction.** Rejected for the same reason — OpenRouter is a routing layer, not a structured-output guarantee. The same Groq-via-OpenRouter call would have the same trailer violation. OpenRouter would also reintroduce per-call USD spend on a stack whose explicit design constraint is $0 inference.
+
+## Reversal trigger
+
+If NIM imposes a paid-tier requirement, regional outage rate exceeds 1% sustained over 7 days, or the candidate pool shrinks below 2 healthy candidates per chain, re-open this ADR. The reversal would still need a per-candidate contract validation (run the KI-155 `<FF>` regression suite against any prospective non-NIM candidate) before adding it back to the election pool.

CLAUDE.md

@@ -4,7 +4,7 @@ This file is read by Claude Code (and any compatible AI tool) at the start of a
 
 ## Project at a glance
 
-- **What:** a voice-first AI advisor for Indian health insurance — RAG over a curated 206-document corpus (188 product PDFs across 19 insurers + 18 regulatory IRDAI/NHA docs, 7,295 chunks), Sarvam STT/TTS, 4-gate faithfulness, 19-insurer scorecard (regulatory tracked separately).
+- **What:** a voice-first AI advisor for Indian health insurance — RAG over a curated 206-document corpus (188 product PDFs across 19 insurers + 18 regulatory IRDAI/NHA docs, **7,317 Chroma chunks** post-KI-125→127 rebuild — wordings 5,401 · brochure 611 · regulatory 498 · prospectus 483 · cis 302 · curated 21 · profile 1), Sarvam STT/TTS, 4-gate faithfulness, 19-insurer scorecard (regulatory tracked separately). Marketplace surfaces **166 cards** across the 19 real insurers (one card per IRDAI-filed product after KI-133 / KI-141 / KI-142 / KI-145 dedup); 201 extracted JSONs + 253 curated `policy_facts` JSONs feed the structured side. The 20 internal Chroma slugs = 19 real insurers + 1 `regulatory` bucket; the regulatory + `profile` slugs are filtered out of every user-facing count (KI-129 / KI-130 / KI-132).
 - **Live:** https://rohitsar567-insurancebot.hf.space (HF Space; rebuild triggered on every push to `origin main`).
 - **Repos:** `origin` is the HF Space at `huggingface.co/spaces/rohitsar567/InsuranceBot`. `github` is the mirror at `github.com/rohitsar567/insurance-sales-bot`. Data lives separately at `huggingface.co/datasets/rohitsar567/insurance-bot-data` (with a GitHub mirror that uses LFS).
 - **Local dev path:** `~/Developer/Insurance Sales Bot/` (NOT `~/Documents/Personal/AI Work/...` — the older path that occasionally shows up in stale scripts; iCloud-synced + TCC-restricted).
@@ -18,19 +18,19 @@ This file is read by Claude Code (and any compatible AI tool) at the start of a
 - **Hands-free was removed entirely** in KI-027. Anything in the codebase still referring to it is stale.
 - **Bot TTS plays via the in-DOM `<audio>` element** inside `Message` (autoplay-on-mount via ref'd `useEffect`). Never use `new Audio(url).play()` — those detached instances are invisible to `document.querySelectorAll("audio").pause()` in the barge-in handler.
 
-## LLM stack (ADR-019 + ADR-026 → ADR-031 + ADR-032) — KI-080 → KI-087
+## LLM stack (ADR-019 + ADR-026 → ADR-031 + ADR-032 → ADR-038) — KI-080 → KI-087, KI-160
 
-Every LLM role is a `NimChainLLM` candidate pool, NOT a hardcoded single model. End-to-end spec: [ADR-032](70-docs/60-decisions/ADR-032-llm-chain-architecture.md). Chains preserve brain ↔ judge family diversity (Qwen brain ↔ Mistral judge) so failovers can't accidentally produce circular grading.
+Every LLM role is a `NimChainLLM` candidate pool, NOT a hardcoded single model. End-to-end spec: [ADR-032](70-docs/60-decisions/ADR-032-llm-chain-architecture.md). All three chains are **locked to NIM candidates only** as of KI-160 / [ADR-038](70-docs/60-decisions/ADR-038-nim-only-chains.md) — Groq + OpenRouter were removed as election candidates after KI-155 proved Groq Llama-3.3 silently ignores the `<FF>` structured-output trailer contract. Chains still preserve brain ↔ judge family diversity (Qwen / Nemotron brain ↔ Mistral / Llama-4 judge) so failovers can't produce circular grading.
 
-- **Probe-driven sticky primary election (KI-080, [ADR-031](70-docs/60-decisions/ADR-031-sticky-primary-election.md)).** All three chains (`BRAIN_CHAIN`, `FAST_BRAIN_CHAIN`, `JUDGE_CHAIN`) elect a sticky PRIMARY + provider-diverse BACKUP from a background probe. `backend/llm_health.py` scores every candidate on `(1 / max(50, latency_ms)) * success_rate` and writes the current election to process state. `NimChainLLM.chat()` calls PRIMARY once; on real-time failure it falls to BACKUP (cross-provider by construction) and triggers an immediate probe refresh. **Per-turn LLM call count: 1 (most cases) or 2 (PRIMARY fails real-time → BACKUP).** Pre-KI-080 worst case was 5-6 NIM calls per turn, all queued and timing out.
-- **NIM-first election preference (KI-087, `d90f8c0`).** Election prefers ANY eligible NIM candidate over ALL non-NIM candidates. Within the NIM pool, score still picks the fastest healthy NIM model. Only when the NIM pool is empty (every NIM model down, throttled, or quota-exhausted) does election fall through to Groq / OpenRouter as PRIMARY. Rationale: NIM is the strategic free provider ($0, no daily cap, 110+ models); Groq has 100K tokens/day; OpenRouter charges real USD. Both serve as emergency fallback only.
-- **Probe cadence + per-phase timeouts (KI-084, `119e0fd`).** Probe loop ticks at `PROBE_INTERVAL_SEC = 300s` (was 60s — raised so probe-driven token spend stays inside Groq's 100K/day free-tier cap). Probe `max_tokens` cut `5 → 1`. Every chat call uses explicit `httpx.Timeout(connect=2, read=12, write=2, pool=2)` so a stuck NIM pool releases its TCP socket independently of the outer `asyncio.wait_for`, preventing NIM concurrency-slot leaks across PRIMARY → BACKUP. Rate-limit failures (HTTP 429 / `RateLimit` body) get a **1h sin-bin** (`DEGRADE_DURATION_LONG_S = 3600s`) instead of the 30s transient window — free-tier daily quotas don't reset in 30 seconds.
-- **Proactive credit gating (KI-085, `8fc7979`).** Election is gated by `is_alive AND has_credits` so quota-exhausted candidates are excluded BEFORE the user hits a 429. Signal sources: Groq response headers (`x-ratelimit-remaining-tokens-day`, low-water 5,000 tokens); OpenRouter `GET /api/v1/credits` polled every 10 min (low-water $0.05); NIM local 60-second rate-meter (gate at 35-of-40 req/min, headroom 5). Closes the one-turn reactive gap KI-084 alone leaves.
-- **HF Space secrets (KI-081, no commit; HF Space env secrets push).** `GROQ_API_KEY` + `OPENROUTER_API_KEY` pushed to the Space repository secrets so KI-080 cross-provider election candidates have working keys in production. Pre-KI-081 only `NVIDIA_NIM_API_KEY` was set on the Space; the elector marked Groq + OR as `no_api_key` and election degraded to NIM-only candidates.
-- **Admin telemetry (KI-086, `d90f8c0`).** `GET /api/admin/llm-health` returns `{chains, candidates, recent_turns, snapshot_ts}` with per-chain elected primary/backup, per-candidate health + credits + degraded-until, and last 20 turn outcomes. Surfaced in the admin "LLM Chain" tab with auto-refresh every 30s.
-- **KI-025's 50/50 NIM ↔ Groq rotation ([ADR-026](70-docs/60-decisions/ADR-026-provider-load-balancing.md)) is deprecated** — `_balanced_brain_chain` retained behind a feature flag for one-release rollback; the probe-driven election picks the actually-faster candidate dynamically.
-- **Cold-start fallback.** Before the first probe completes (process restart, HF Space rebuild), `chain[0]` is the initial primary and `chain[1]` (preferring a different provider) is the initial backup. The probe loop runs immediately on startup; OpenRouter credits are polled on startup so the elector has a non-None USD balance before the first chat call.
-- **Brain / fast-brain / judge primaries in steady state** are typically **NIM Qwen 3-Next 80B** (heavy brain, KI-087 NIM-first), **NIM Nemotron Nano 30B** (fast brain), and **Mistral Large 3 675B** (judge). Not hardcoded — the elected primary follows live `latency × success_rate × credits_available` with NIM-first preference.
+- **NIM-only election (KI-160, [ADR-038](70-docs/60-decisions/ADR-038-nim-only-chains.md)).** Candidate pools per role: BRAIN — `nvidia/llama-3.3-nemotron-super-49b-v1.5` (primary), `qwen/qwen3-next-80b-a3b-instruct` (backup), `mistralai/mistral-large-3-675b-instruct-2512` (3rd). FAST_BRAIN — `qwen/qwen3-next-80b-a3b-instruct` (primary), `nvidia/llama-3.3-nemotron-super-49b-v1.5` (backup). JUDGE — `meta/llama-4-maverick-17b-128e-instruct` (primary), `mistralai/mistral-large-3-675b-instruct-2512` (backup). If all NIM candidates fail in a turn, orchestrator returns a graceful error message instead of cascading to Groq / OpenRouter — **fail-loud > fail-silent-with-garbage**.
+- **Probe-driven sticky primary election (KI-080, [ADR-031](70-docs/60-decisions/ADR-031-sticky-primary-election.md), superseded by ADR-038 for candidate-pool scope).** All three chains elect a sticky PRIMARY + BACKUP from a background probe within the NIM pool. `backend/llm_health.py` scores every candidate on `(1 / max(50, latency_ms)) * success_rate` and writes the current election to process state. `NimChainLLM.chat()` calls PRIMARY once; on real-time failure it falls to BACKUP and triggers an immediate probe refresh. **Per-turn LLM call count: 1 (most cases) or 2 (PRIMARY fails real-time → BACKUP).**
+- **Probe cadence + per-phase timeouts (KI-084, `119e0fd`).** Probe loop ticks at `PROBE_INTERVAL_SEC = 300s`. Probe `max_tokens` cut `5 → 1`. Every chat call uses explicit `httpx.Timeout(connect=2, read=12, write=2, pool=2)` so a stuck NIM pool releases its TCP socket independently of the outer `asyncio.wait_for`. Rate-limit failures (HTTP 429 / `RateLimit` body) get a **1h sin-bin** (`DEGRADE_DURATION_LONG_S = 3600s`).
+- **Proactive credit gating (KI-085, `8fc7979`), now NIM-only scope.** Election is gated by `is_alive AND has_credits` so quota-exhausted NIM models are excluded BEFORE the user hits a 429. Signal source within the NIM pool: per-model local 60-second rate-meter (gate at 35-of-40 req/min, headroom 5). Per-model rate-metering applies within the locked NIM pool.
+- **HF Space secrets (KI-081).** `GROQ_API_KEY` + `OPENROUTER_API_KEY` remain in HF Space repository secrets for future re-enable, but the chain config no longer references them after KI-160 — they are dormant, not active election candidates. `NVIDIA_NIM_API_KEY` is the only key the chain config consults.
+- **Admin telemetry (KI-086, `d90f8c0`).** `GET /api/admin/llm-health` returns `{chains, candidates, recent_turns, snapshot_ts}` with per-chain elected primary/backup, per-candidate health + credits + degraded-until, and last 20 turn outcomes. Admin "LLM Chain" tab auto-refreshes every 30s and renders whatever the chain config exposes (NIM-only post-KI-160).
+- **KI-025's 50/50 NIM ↔ Groq rotation ([ADR-026](70-docs/60-decisions/ADR-026-provider-load-balancing.md)) is deprecated** — `_balanced_brain_chain` retained behind a feature flag for one-release rollback; the probe-driven NIM-only election picks the actually-faster candidate dynamically.
+- **Cold-start fallback.** Before the first probe completes (process restart, HF Space rebuild), `chain[0]` is the initial primary and `chain[1]` is the initial backup, both NIM.
+- **Brain / fast-brain / judge primaries in steady state** are **NIM Nemotron-Super 49B** (brain), **NIM Qwen 3-Next 80B** (fast brain), and **NIM Llama-4 Maverick 17B/128E** (judge), per the KI-160 candidate lists. Not hardcoded — elected primary follows live `latency × success_rate × credits_available` within the NIM pool.
 - **KI-079 escalation as last bite (`87ee522`).** If both PRIMARY and BACKUP fail in a single fact-find turn, orchestrator retries once on `BRAIN_CHAIN` (heavy brain, `_TIMEOUT_S_ESCALATION = 15s`, 35s chain budget) before falling to `_canonical_fallback` (KI-072 / KI-074 greedy slot capture). Worst-case wall-clock before canonical: 25s FAST + 15s heavy = 40s.
 - **NIM concurrency semaphore + serial probe (KI-088, `14ee008`).** Module-level `asyncio.Semaphore(2)` wraps every NIM HTTP call so our process never has >2 NIM requests in flight simultaneously, regardless of source (probe loop + admin polls + per-user turns all serialise through the same semaphore). Probe loop changed parallel→serial so the 6-NIM probe burst becomes a 1-slot trickle over ~12s. Inner 4-attempt exponential-backoff retry deleted from `NvidiaNimLLM.chat()` — KI-080 election + KI-079 escalation now handle failover. Result: latency-based failures (41s timeouts under self-saturation) dropped to zero; replaced by a parser-side bottleneck (KI-090).
 - **Lenient FF-block parser (KI-090, `11cf4b3`).** Real LLMs (Qwen, Nemotron under load, Groq Llama-3.3) sometimes drop the literal `<FF>...</FF>` tags around their JSON tail. Pre-KI-090 those replies fell to `fallback:no_trailer` even though the brain had produced a perfectly valid structured response. Now `_parse_ff_block` tries strict → fenced ```` ```json``` ```` → bare-JSON-tail, each candidate validated by presence of a contract key (`captured` / `slot_driving` / `complete`). `_strip_ff_block` mirrors the strategies so prose-only output never leaks structured metadata.
@@ -127,8 +127,12 @@ Three independent safety layers against ChromaDB HNSW bloat:
 - **Never add `"qa"` to `CONTEXT_DEPENDENT_INTENTS`** — that brings back the headline KI-018 bug where QA questions get trapped in fact-find.
 - **Voyage free tier is 3 RPM.** Affects only ingest (corpus rebuild); query-time uses Chroma vectors, no Voyage call. Don't worry about it on the hot path.
 - **HF Space rebuild is 5-8 min per push.** Audits running against the live endpoint should be done AFTER the desired image is stably deployed, or the persona transcripts span multiple builds and become useless for A/B.
-- **Two image-only PDFs are explicitly EXCLUDED from the ingest pipeline:** `royal-sundaram/family-plus__brochure.pdf` and `aditya-birla/activ-one__brochure.pdf` (pdfplumber returns 0 chars; OCR is out of scope). Activ One coverage is provided via the `activ-health-individual` wordings policy — do not re-add either brochure.
+- **Two image-only PDFs are explicitly EXCLUDED from the ingest pipeline:** `royal-sundaram/family-plus__brochure.pdf` and `aditya-birla/activ-one__brochure.pdf` (pdfplumber returns 0 chars; OCR is out of scope). Activ One coverage is provided via the `activ-health-individual` wordings policy — do not re-add either brochure. **KI-126 made this permanent** — they are now removed from the source PDF set and the source-PDF total is 206 (188 product + 18 regulatory), with 201 extracted JSONs (the gap is the 2 image-only brochures + 3 documents whose extraction failed gracefully).
+- **The `indusind-general` slug did not exist anywhere in the codebase before 2026-05-15.** Reliance General Insurance was rebranded to IndusInd General; **KI-144** migrated insurer slug + policy IDs + Chroma metadata + marketplace alias mapping. Any code referencing `reliance-general` should either be retained as a legacy alias (one card remains under `reliance-general` for back-compat) or migrated to `indusind-general`. Do not silently merge the two — they're tracked as separate slugs.
+- **Voice mode now defaults OFF (KI-131 / KI-134 / KI-139 / KI-148).** The Live pill renders red by default; the user must opt in. AudioContext.resume() is required to unlock TTS autoplay. VAD thresholds: `rmsThreshold=18`, `voiceBandMinProp=0.20`, `noiseFloor * 1.8`. TTS preprocess now expands `k → thousand`. Anything in the codebase still assuming default-ON Live mode is stale.
+- **Marketplace dedup is one card per IRDAI-filed product (KI-133 / KI-141 / KI-142 / KI-145).** Aliases handle marketing renames (e.g. Reliance → IndusInd); sub-variants stay separate only when material terms differ. Card count is 166 across 19 real insurers — anything counting 138 or 188 or 206 against the marketplace is stale.
+- **`fact_find_brain` `max_tokens = 700` (KI-150, was 420).** The 420 cap was the root cause of the "robotic language" user complaint — the brain ran out of tokens mid-paraphrase. Do not lower below 700 without a regression test on natural-conversation feel.
 
 ---
 
-*Last reviewed 2026-05-15 — KI-101..KI-112 landed (orchestrator stability + profile-RAG session isolation + recommendation closer + graceful chat error handling + Chroma re-ingest + profile-write hardening).*
+*Last reviewed 2026-05-15 — KI-101..KI-112 landed (orchestrator stability + profile-RAG session isolation + recommendation closer + graceful chat error handling + Chroma re-ingest + profile-write hardening). Same day: KI-125..KI-150 landed (full corpus rebuild → 7,317 chunks; marketplace dedup → 166 cards; voice default OFF + VAD retune; IndusInd General slug migration from Reliance General; fact_find_brain max_tokens 420→700).*

README.md

@@ -41,12 +41,31 @@ short_description: Voice-first AI advisor for Indian health insurance
 
 ## 1. Executive summary
 
-A **voice-first health-insurance advisor** for Indian buyers, grounded in a curated corpus of **206 documents** — 188 product documents from 19 leading insurers plus 18 IRDAI / regulatory documents — extracted into a 62-field structured schema with a rules-based A–F scorecard and a **4-gate hallucination defense** on every reply.
+A **voice-first health-insurance advisor** for Indian buyers, grounded in a curated corpus of **206 documents** — 188 product documents from 19 leading insurers plus 18 IRDAI / regulatory documents — extracted into a 62-field structured schema with a rules-based A–F scorecard and a **4-gate hallucination defense** on every reply. The marketplace surfaces **166 cards** across the 19 real insurers (one card per IRDAI-filed product after KI-133 / KI-141 / KI-142 / KI-145 dedup); the `profile` and `regulatory` Chroma slugs are filtered out of all user-facing counts (KI-129 / KI-130 / KI-132).
 
 The bot is **consumer-facing in experience, B2B in commercial application.** The realistic deployment is an insurer or aggregator white-labelling this advisor on top of Sarvam's ASR/TTS/LLM stack. The build deliberately optimises for the artifacts a BFSI buyer would audit: provenance, refusal behaviour, eval rigor, citation grammar.
 
 **Try on the live demo:** *"What's the pre-existing disease waiting period under Care Supreme, and how does that compare to ICICI Elevate?"* — comparative answer with `[Source: ...]` citations linking to specific policy PDFs and page ranges, brain tag showing which model handled it, audio synthesised by Sarvam Bulbul. Ask the same in Hinglish — *"Care Supreme mein PED ka waiting period kya hai?"* — and the response flows through the Indic translation cascade with three drift checks.
 
+### 1.0 Today's session (2026-05-15) — KI-125 → KI-150
+
+Thirty-plus knowledge increments landed today. The corpus was rebuilt, the marketplace dedup logic was rewritten, the voice stack was retuned, and an insurer rename was migrated end-to-end. One-line each:
+
+- **KI-125 / KI-126 / KI-127** — full corpus rebuild + dedup; **Chroma chunks 3,799 → 7,317** (wordings 5,401 · brochure 611 · regulatory 498 · prospectus 483 · cis 302 · curated 21 · profile 1); **marketplace cards 138 → 166** correctly counted; **2 image-only PDFs dropped** (`royal-sundaram/family-plus__brochure.pdf` + `aditya-birla/activ-one__brochure.pdf`) so source-PDF total is now 206 (188 product + 18 regulatory) with 201 extracted JSONs.
+- **KI-128** — `tools/upload_to_hf.py` LFS quota silent-failure fix.
+- **KI-129 / KI-130 / KI-132** — filter `profile` + `regulatory` slugs from user-facing marketplace counts (19 real insurers + 1 regulatory bucket = 20 internal slugs).
+- **KI-131 / KI-134 / KI-139 / KI-148** — voice mode now defaults **OFF**; AudioContext.resume() unlocks autoplay; VAD threshold retuned (`rmsThreshold=18`, `voiceBandMinProp=0.20`, `noiseFloor * 1.8`); TTS `k → thousand` expansion.
+- **KI-133 / KI-141 / KI-142 / KI-145** — marketplace dedup: one card per IRDAI-filed product; aliases handle marketing renames; sub-variants stay separate when material terms differ.
+- **KI-136** — named-SKU comparison routes to `qa` instead of `fact_find`.
+- **KI-137** — ingested 21 curated-facts policies (Activ One, Optima Secure, …) into Chroma so the bot can retrieve them.
+- **KI-138** — canonicalized 84 `policy_name` mismatches across extracted JSONs + Chroma metadata.
+- **KI-143** — `bajaj/group-health-guard` slug correction (gold → silver per the PDF).
+- **KI-144** — `reliance-general` → `indusind-general` migration (Reliance General Insurance was rebranded to IndusInd General). The `indusind-general` slug did not exist anywhere in the codebase before today.
+- **KI-149** — budget + income parser captures bare numerals like `"30000"`.
+- **KI-150** — `fact_find_brain` `max_tokens` 420 → 700 (root cause of the "robotic language" user complaint).
+
+Per-insurer card counts (166 total across 19 real insurers): HDFC ERGO 15 · National Insurance 14 · Niva Bupa 14 · Bajaj Allianz 13 · ICICI Lombard 13 · Star Health 11 · Care Health 10 · New India Assurance 9 · Tata AIG 9 · Acko 7 · Aditya Birla 7 · Royal Sundaram 7 · Cholamandalam MS 6 · Go Digit 6 · IFFCO Tokio 6 · ManipalCigna 6 · SBI General 6 · IndusInd General 3 · Oriental Insurance 3 · Reliance General 1.
+
 ### 1.1 Demo runbook — 7 questions to try
 
 Live URL: **https://rohitsar567-insurancebot.hf.space**. For each: try voice and text. The reply panel shows `brain_used` and per-citation source links.
@@ -71,13 +90,13 @@ A take-home is a sample of how the engineer thinks under constraint. Three thing
 
 2. **Hallucination defense and refusal as product features.** BFSI deployments get fined for mis-selling; the bot is biased toward refusal over confident wrong answers. The 4 faithfulness gates + cross-check retry + 3 Indic drift checks + audit log are the BFSI-compliance-grade version of "we shipped a chatbot." When the eval shows a headline accuracy below 100% because the gates are aggressive, the right response is to soften the gates carefully — not to ship a higher number by relaxing the verifier.
 
-3. **Honest model picks — Sarvam where Sarvam is uniquely strong, open-weights frontier for reasoning.** Voice and Indic are non-substitutable: **Sarvam Saarika v2.5** for speech-to-text, **Sarvam Bulbul v2** (speaker `anushka`) for text-to-speech, and **Sarvam-M** for Hindi/Hinglish/vernacular translation — no closed-source frontier matches Sarvam on Indian accents or code-mixed Hinglish. Reasoning is a different problem and runs on open-weights frontier models behind a fallback chain, not a single hardcoded brain. The chain architecture has three roles, each a `NimChainLLM` (`backend/providers/nvidia_nim_llm.py`) with a NIM-primary preference order plus OpenRouter and Groq cross-provider fallbacks:
+3. **Honest model picks — Sarvam where Sarvam is uniquely strong, open-weights frontier for reasoning.** Voice and Indic are non-substitutable: **Sarvam Saarika v2.5** for speech-to-text, **Sarvam Bulbul v2** (speaker `anushka`) for text-to-speech, and **Sarvam-M** for Hindi/Hinglish/vernacular translation — no closed-source frontier matches Sarvam on Indian accents or code-mixed Hinglish. Reasoning is a different problem and runs on open-weights frontier models behind a NIM-only candidate pool per role (KI-160 / [ADR-038](70-docs/60-decisions/ADR-038-nim-only-chains.md)), not a single hardcoded brain. Each role is a `NimChainLLM` (`backend/providers/nvidia_nim_llm.py`) whose candidates are all NIM-hosted — KI-155 demonstrated that Groq Llama-3.3 silently ignores the `<FF>` structured-output trailer contract, so cross-provider fallback was removed as a silent-failure trap:
 
-   - **`BRAIN_CHAIN`** (comparison, recommendation, synthesis) — primary **Qwen 3-Next 80B** (`qwen/qwen3-next-80b-a3b-instruct`, 80B / 3B-active MoE, multilingual, ~2s TTFT on NIM free tier), with **Qwen 3.5 122B**, **OpenAI GPT-OSS 120B**, **Mistral Large 3 675B**, **NVIDIA Nemotron-Super 49B**, **Meta Llama-3.3 70B**, and **DeepSeek V4-Pro** as in-NIM fallbacks, then **OpenRouter GPT-OSS 120B** and **Groq Llama-3.3-70B** as cross-provider fallbacks for full-NIM-outage survival.
-   - **`FAST_BRAIN_CHAIN`** (fact-find turns, QA, paraphrase, normalize, extract — every latency-sensitive role) — primary **NVIDIA Nemotron Nano 30B** (`nvidia/nemotron-3-nano-30b-a3b`, ~1.6s TTFT — bottleneck is TTFT not capability on these jobs), with Qwen 3-Next 80B, GPT-OSS 120B, Qwen 3.5 122B, and **DeepSeek V4-Flash** as NIM fallbacks, then Groq Llama-3.3-70B as the cross-provider fallback.
-   - **`JUDGE_CHAIN`** (faithfulness Gate 4, Hinglish drift LLM-judge, eval grader) — primary **Mistral Large 3 675B** (`mistralai/mistral-large-3-675b-instruct-2512`, MIT). Mistral is a deliberately different model family from the Qwen brain so the judge does not mark its own homework. Fallbacks: GPT-OSS 120B, Moonshot Kimi K2, MiniMax M2.5, and **Meta Llama-4 Maverick 17B/128E** (the original D-019 judge — kept in the chain for when NIM's Llama pool recovers), then OpenRouter and Groq cross-provider entries.
+   - **`BRAIN_CHAIN`** (comparison, recommendation, synthesis) — primary **NVIDIA Nemotron-Super 49B v1.5** (`nvidia/llama-3.3-nemotron-super-49b-v1.5`), backup **Qwen 3-Next 80B** (`qwen/qwen3-next-80b-a3b-instruct`, 80B / 3B-active MoE), 3rd candidate **Mistral Large 3 675B** (`mistralai/mistral-large-3-675b-instruct-2512`).
+   - **`FAST_BRAIN_CHAIN`** (fact-find turns, QA, paraphrase, normalize, extract — every latency-sensitive role) — primary **Qwen 3-Next 80B** (`qwen/qwen3-next-80b-a3b-instruct`), backup **NVIDIA Nemotron-Super 49B v1.5** (`nvidia/llama-3.3-nemotron-super-49b-v1.5`).
+   - **`JUDGE_CHAIN`** (faithfulness Gate 4, Hinglish drift LLM-judge, eval grader) — primary **Meta Llama-4 Maverick 17B/128E** (`meta/llama-4-maverick-17b-128e-instruct`), backup **Mistral Large 3 675B** (`mistralai/mistral-large-3-675b-instruct-2512`). Deliberately different model families from the brain pool so the judge does not mark its own homework.
 
-   **Provider load-balancing (KI-025, [ADR-026](70-docs/60-decisions/ADR-026-provider-load-balancing.md)).** The brain and fast-brain chains' *primary* slot rotates 50/50 per call between the NIM Qwen entry and the Groq Llama-3.3-70B entry via `_balanced_brain_chain` (per-call `random.random()`, no shared cycle state). NIM's free-tier rate cap is 40 req/min shared across every model on a key; splitting brain load across two independent free-tier quotas (NIM + Groq) effectively doubles sustained brain throughput. Groq's LPU TTFT (~1s) is often *lower* than NIM Qwen's, so the rotation is a strict latency win on top of the throughput win. A Groq-primary call that fails still gets the full NIM fallback ladder underneath, so reliability is unchanged.
+   **NIM-only election, no cross-provider cascade (KI-160, [ADR-038](70-docs/60-decisions/ADR-038-nim-only-chains.md)).** If every NIM candidate in a chain fails, orchestrator returns a graceful error message rather than falling to Groq or OpenRouter — fail-loud is preferred over fail-silent-with-garbage for structured-output contracts. The 50/50 NIM ↔ Groq rotation of KI-025 ([ADR-026](70-docs/60-decisions/ADR-026-provider-load-balancing.md)) and the cross-provider-fallback variant of KI-080 ([ADR-031](70-docs/60-decisions/ADR-031-sticky-primary-election.md)) are both superseded. KI-085's proactive credit gating still applies within the NIM pool via a per-model 60-second rate-meter (gate at 35-of-40 req/min, headroom 5). `GROQ_API_KEY` + `OPENROUTER_API_KEY` remain in HF Space secrets for future re-enable but the chain config no longer references them.
 
    The result: a Sarvam customer deploying this stack gets a product that *uses Sarvam exactly where Sarvam beats the world* and uses MIT-licensed open-weights frontier models for everything else — $0 inference, two independent free-tier providers, single-key-per-provider for the entire non-voice stack.
 
@@ -520,8 +539,9 @@ The bot is two flows running together — the customer's experience and the tech
                  ▼
 ┌─────────────────────────────────────────────────────────────────────────┐
 │  206 source PDFs in HF Dataset rohitsar567/insurance-bot-data            │
-│  · 188 product PDFs across 19 insurers                                   │
+│  · 188 product PDFs across 19 insurers (2 image-only dropped, KI-126)    │
 │  · 18 regulatory PDFs (IRDAI master circulars, Insurance Act, etc.)      │
+│  · 7,317 Chroma chunks (KI-125→127) · 166 marketplace cards              │
 │  · Playwright same-origin fetch past Akamai for irdai.gov.in            │
 └─────────────────────────────────────────────────────────────────────────┘
 ```
@@ -586,7 +606,7 @@ Every LLM role is served by a **candidate pool** of models elected over by a pro
 | Admin panel | IP+password gated, in-app tab | [ADR-023](70-docs/60-decisions/ADR-023-admin-panel-ip-gated.md) |
 | Resilience | Triple-mirror code + data | [ADR-024](70-docs/60-decisions/ADR-024-triple-mirror-code-and-data.md) |
 
-Every D-NNN in the legacy decisions log is now a stand-alone ADR — see [`70-docs/60-decisions/README.md`](70-docs/60-decisions/README.md) for the full 24-entry index.
+Every D-NNN in the legacy decisions log is now a stand-alone ADR — see [`70-docs/60-decisions/README.md`](70-docs/60-decisions/README.md) for the full ADR index.
 
 ---
 
@@ -596,13 +616,15 @@ Every D-NNN in the legacy decisions log is now a stand-alone ADR — see [`70-do
 
 | Type | Count | Source | Notes |
 |---|---|---|---|
-| Product PDFs | 188 | 19 insurers' public websites | Wordings + Brochures + CIS |
+| Product PDFs | 188 | 19 insurers' public websites | Wordings + Brochures + CIS (2 image-only PDFs dropped in KI-126) |
 | Regulatory PDFs | 18 | irdai.gov.in, indiacode.nic.in, others | Playwright rescue past Akamai |
-| Structured extractions (JSON) | 206 | fast-brain chain (Nemotron 30B / Qwen 80B / Groq Llama-3.3 fallback) extraction | 62-field Pydantic schema |
-| Vector chunks (Chroma) | 7,295 | BGE-small @ 800/120 | One sqlite + HNSW binaries |
+| Structured extractions (JSON) | 201 | fast-brain chain (Nemotron 30B / Qwen 80B / Groq Llama-3.3 fallback) extraction | 62-field Pydantic schema |
+| Curated `policy_facts` JSONs | 253 | Hand-curated marketplace facts | KI-137 ingested 21 of these into Chroma so the bot can retrieve them |
+| Vector chunks (Chroma) | 7,317 | BGE-small @ 800/120 | wordings 5,401 · brochure 611 · regulatory 498 · prospectus 483 · cis 302 · curated 21 · profile 1 |
+| Marketplace cards | 166 | Aggregated across 19 real insurers | One card per IRDAI-filed product after KI-133 / KI-141 / KI-142 / KI-145 dedup |
 | Policy markdown sheets | 222 | Generated from extractions | One per policy_id in `kb/policies/` |
 
-19 insurers: Acko, Aditya Birla, Bajaj Allianz, Care Health, Cholamandalam MS, Go Digit, HDFC ERGO, ICICI Lombard, IFFCO Tokio, ManipalCigna, National Insurance, New India Assurance, Niva Bupa, Oriental Insurance, Reliance General, Royal Sundaram, SBI General, Star Health, Tata AIG.
+19 real insurers (alphabetical): Acko, Aditya Birla, Bajaj Allianz, Care Health, Cholamandalam MS, Go Digit, HDFC ERGO, ICICI Lombard, IFFCO Tokio, IndusInd General (formerly Reliance General — renamed in KI-144), ManipalCigna, National Insurance, New India Assurance, Niva Bupa, Oriental Insurance, Reliance General, Royal Sundaram, SBI General, Star Health, Tata AIG. Internally there are 20 Chroma slugs (the 19 above + a `regulatory` bucket); the regulatory + `profile` slugs are filtered out of every user-facing marketplace count (KI-129 / KI-130 / KI-132).
 
 ### 5.2 Ingestion pipeline
 
@@ -808,7 +830,7 @@ npm run dev   # http://localhost:3000
 
 - Frontend at `localhost:3000` should show the chat UI.
 - `localhost:7860/api/health` should return `{"status":"ok", "providers_ok": {"sarvam": true, "nvidia_nim": true}}`.
-- `localhost:7860/api/coverage` should return 206 policies indexed.
+- `localhost:7860/api/coverage` should return 166 marketplace cards across 19 real insurers (the `profile` and `regulatory` slugs are filtered out of user-facing counts per KI-129 / KI-130 / KI-132).
 
 ---
 
@@ -931,7 +953,7 @@ A new Claude Code session should ingest these to bootstrap understanding:
 
 ## Footer
 
-**Authored 2026-05-13. Last updated 2026-05-15.**
+**Authored 2026-05-13. Last updated 2026-05-15 (KI-125 → KI-150 — corpus rebuild + marketplace dedup + voice retune + IndusInd migration).**
 
 Live demo: https://rohitsar567-insurancebot.hf.space  
 Code: https://github.com/rohitsar567/insurance-sales-bot  

backend/fact_find_brain.py

@@ -139,6 +139,32 @@ Bot reply: Fair enough — let me put together a shortlist based on what you've
 User: "What's the waiting period for PED usually?"
 Bot reply: Most policies in India have a 24-36 month waiting period for pre-existing diseases — IRDAI caps the maximum, and a few insurers offer shorter waits as a premium upgrade. Happy to dig into a specific policy if you have one in mind. Meanwhile, what budget range are you comfortable with annually — under ₹15k, ₹15-30k, ₹30-60k, or ₹60k+?
 <FF>{"captured": {}, "slot_driving": "budget_band", "complete": false}</FF>
+
+User: "Hi"
+Bot reply: Hi there — happy to help you find a health policy. What should I call you?
+<FF>{"captured": {}, "slot_driving": "name", "complete": false}</FF>
+
+User: "ok"
+Bot reply: Sure. To get started, could you tell me your age?
+<FF>{"captured": {}, "slot_driving": "age", "complete": false}</FF>
+
+==========================================================
+FINAL INSTRUCTION — READ THIS CAREFULLY. APPLIES TO EVERY REPLY.
+==========================================================
+EVERY reply you produce MUST end with the structured trailer in this EXACT format on its own line:
+
+<FF>{"captured": {...}, "slot_driving": "...", "complete": false}</FF>
+
+This rule is ABSOLUTE. There are NO exceptions:
+- Short reply? Still emit the trailer.
+- One-word user message ("ok", "hi", "yes")? Still emit the trailer.
+- User asks an off-topic question? Still emit the trailer after your answer.
+- User wants to end fact-find ("show me policies")? Emit trailer with "complete": true.
+- Nothing new captured this turn? Emit "captured": {} (empty object). Still emit the trailer.
+
+The trailer is the LAST thing in your output. Nothing comes after </FF>.
+
+If you do not emit a valid <FF>...</FF> trailer, your entire reply is DISCARDED by the backend and the user sees a scripted fallback question. This is the single most important rule. NEVER omit the trailer.
 """
 
 
@@ -270,7 +296,24 @@ def _validate_capture(field_name: str, value: Any) -> Any:
         try:
             from backend.profile_store import is_valid_name
             v = str(value).strip()
-            return v if is_valid_name(v) else None
+            if not is_valid_name(v):
+                return None
+            # KI-156 (2026-05-15) — reject LLM-hallucinated names that are
+            # actually status/negation phrases. Live bug: user said "I am
+            # currently not having any policy" and the LLM emitted
+            # captured={"name":"Currently Not Having Any"}. is_valid_name
+            # passes on length+alpha but doesn't catch semantic garbage.
+            _bad_starts = {
+                "currently", "not", "no", "none", "nothing", "never",
+                "without", "looking", "buying", "shopping",
+                "i", "we", "my", "this", "that", "the",
+                "first", "still", "yet", "haven", "haven't",
+                "don't", "don", "dont", "havent",
+            }
+            first = v.split()[0].lower().strip(".,!?")
+            if first in _bad_starts:
+                return None
+            return v
         except Exception:
             return None
 
@@ -776,9 +819,18 @@ def _canonical_fallback(session, user_text: str, *, reason: str) -> FactFindOutc
 
             # Build the prioritised slot order — try high-signal slots first
             # (numbers, enums) before name (which has explicit-intro guard).
+            # KI-158 (2026-05-15) — added "health_conditions". Its absence
+            # meant a user replying "I'm not having any pre-existing condition"
+            # NEVER got the slot captured here; the LLM brain failing on a
+            # `no_trailer` reply for that turn (common under NIM load) bumped
+            # _failed_attempts['health_conditions'] each turn until the
+            # loop-breaker force-skipped the slot, which then made
+            # next_question() return None and triggered the gentle hand-off
+            # mid-fact-find.
             _GREEDY_ORDER = [
                 "age", "dependents", "income_band", "existing_cover",
-                "primary_goal", "location", "parents_age", "budget", "name",
+                "primary_goal", "location", "parents_age", "health_conditions",
+                "budget", "name",
             ]
             ordered_slots: list[str] = [
                 sid for sid in _GREEDY_ORDER
@@ -863,7 +915,33 @@ def _canonical_fallback(session, user_text: str, *, reason: str) -> FactFindOutc
     except Exception:
         q = None
     if q is not None:
-        reply = q.prompt_en
+        # KI-156 (2026-05-15) — when the LLM bailed but we DID greedy-capture
+        # something this turn, prepend a brief acknowledgement so the user
+        # doesn't perceive the bot as ignoring them. Pre-fix the fallback
+        # emitted only the bare scripted prompt_en, making the conversation
+        # look unresponsive ("user gives city → bot asks name again" pattern).
+        ack_parts: list[str] = []
+        _PRETTY = {
+            "name": "name",
+            "age": "age",
+            "dependents": "who you're covering",
+            "income_band": "income band",
+            "existing_cover_inr": "existing cover",
+            "primary_goal": "goal",
+            "location_tier": "city",
+            "parents_age_max": "parents' age",
+            "health_conditions": "health conditions",
+            "budget_band": "budget",
+        }
+        for k in ("name", "age", "dependents", "location_tier", "income_band",
+                 "existing_cover_inr", "primary_goal", "budget_band"):
+            if k in captured:
+                ack_parts.append(_PRETTY.get(k, k))
+        if ack_parts:
+            ack = f"Got that — {', '.join(ack_parts)}. "
+            reply = ack + q.prompt_en
+        else:
+            reply = q.prompt_en
         slot = q.field
         return FactFindOutcome(
             reply_text=reply,
@@ -873,17 +951,36 @@ def _canonical_fallback(session, user_text: str, *, reason: str) -> FactFindOutc
             ambiguous=True,
             _fallback_reason=reason,  # KI-078 — telemetry stamp
         )
-    # Nothing left to ask — gentle hand-off.
+    # Nothing left to ask — fact-find is genuinely complete (every applicable
+    # slot is filled OR has been intentionally skipped by the loop-breaker).
+    #
+    # KI-158 (2026-05-15) — was emitting the "Let me know a bit about yourself
+    # — your age..." gentle hand-off which is the WRONG message at this point:
+    # the user just answered the LAST slot, every prior slot is on file, but
+    # the canonical-fallback path landed here because the LLM brain failed on
+    # the trailer block (no_trailer / empty_reply). Re-asking "tell me a bit
+    # about yourself" makes the bot look forgetful mid-conversation.
+    #
+    # Fix:
+    #   1. Propagate `captured` (was discarded as `{}`) so any greedy capture
+    #      made this turn — most commonly the no-PED `health_conditions=[]` —
+    #      is applied to the profile by the orchestrator post-loop.
+    #   2. Flip `fact_find_complete=True` so the orchestrator switches the
+    #      session into free-form mode and the NEXT user turn routes to the
+    #      retrieval brain (which can recommend), not back here.
+    #   3. Replace the awkward hand-off prose with a clean acknowledge +
+    #      transition that mirrors the brain's `complete=true` summary path
+    #      — the user just told us they're healthy, we have everything else
+    #      already, so transition to recommendations.
     reply = (
-        "Let me know a bit about yourself — your age, who you'd want covered "
-        "(just you, family, parents), and your annual income band — and I'll "
-        "tailor the options for you."
+        "Got it — no pre-existing conditions noted. I have everything I need. "
+        "Want me to suggest a couple of policies that fit your profile?"
     )
     return FactFindOutcome(
         reply_text=reply,
-        captured_updates={},
+        captured_updates=captured,  # KI-158 — propagate greedy captures
         slot_driving=None,
-        fact_find_complete=False,
+        fact_find_complete=True,    # KI-158 — flip to free-form
         ambiguous=True,
         _fallback_reason=reason,  # KI-078 — telemetry stamp
     )

backend/fact_find_normalizer.py

@@ -210,7 +210,28 @@ def _keyword_normalize(question_id: str, raw_text: str) -> Any:
         return _parse_budget_band(raw_text)
 
     elif question_id == "health_conditions":
-        if any(p in s for p in ["none", "no condition", "nothing", "no pre-exist", "no health", "no chronic"]):
+        # KI-158 (2026-05-15) — broadened no-PED denial detection. The previous
+        # substring list missed "I'm not having any pre-existing condition",
+        # "no pre-existing condition" (singular), "don't have any", "nothing
+        # chronic", etc. Each miss let _canonical_fallback's loop-breaker tick
+        # the health_conditions slot toward force-skip, eventually making
+        # next_question() return None → gentle hand-off fires mid-fact-find.
+        # The fix uses regex to cover the natural phrasings without
+        # over-triggering on actual conditions like "I have diabetes".
+        _NO_PED_PATTERNS = [
+            r"\b(?:no|none|nothing|nope|nah|negative)\b\s*(?:condition|pre[-\s]?exist|health\s+issue|chronic|illness)?",
+            r"\b(?:not|don'?t|do\s+not|haven'?t|have\s+not|isn'?t|aren'?t)\s+(?:got|have|having|had|got\s+any|have\s+any)\b",
+            r"\b(?:no|zero|nil)\s+(?:pre[-\s]?exist\w*|condition|chronic|health\s+issue|illness|disease)",
+            r"\b(?:i\s+am|i'm)\s+(?:healthy|fine|fit|alright|all\s+good|good|ok|okay)\b",
+            r"\bnothing\s+(?:chronic|major|serious|to\s+report|like\s+that)\b",
+            r"\ball\s+(?:good|fine|clear|healthy)\b",
+            r"\bclean\s+bill\s+of\s+health\b",
+        ]
+        if any(re.search(p, s) for p in _NO_PED_PATTERNS):
+            # Belt-and-braces: ensure the user didn't ALSO mention a real
+            # condition in the same message (e.g., "no diabetes but I have BP").
+            # If a condition keyword is present below, the canonical list
+            # branch will pick it up regardless.
             return []
         canonical = []
         cond_keywords = {
@@ -257,7 +278,15 @@ def _parse_existing_cover(text: str) -> int | None:
     """
     s = text.lower().strip()
     # Negative answers map to 0 (no existing cover).
-    if re.search(r"\b(no|none|nothing|zero|nope|nah|haven'?t|don'?t|never)\b", s):
+    # KI-156 (2026-05-15) — extended to cover gerund/auxiliary phrasings.
+    # Pre-fix "I am not having any policy" / "currently not having" / "not
+    # got any" / "without any" all returned None, causing the fact-find
+    # loop to keep re-asking the existing_cover slot.
+    if re.search(
+        r"\b(no|none|nothing|zero|nope|nah|haven'?t|don'?t|never|"
+        r"not\s+having|not\s+got|not\s+have|without\s+(?:any|a))\b",
+        s,
+    ):
         return 0
     # KI-067 — first-time-buyer signals also imply zero existing cover.
     _first_time_patterns = (

backend/providers/nvidia_nim_llm.py

@@ -241,27 +241,28 @@ class NvidiaNimLLM(LLMProvider):
 # cross-family-grading invariant survives any failover.
 
 BRAIN_CHAIN = [
-    # Primary: Qwen 3-Next 80B — verified ~2s response, clean JSON, multilingual
+    # KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Cross-provider (Groq /
+    # OpenRouter) fallbacks REMOVED. Groq's Llama-3.3-70B failed the `<FF>`
+    # trailer contract during a fact-find probe and silently flipped the
+    # entire pipeline to scripted prompts. Chain is now strictly NIM. Each
+    # NIM candidate's `<FF>` adherence has been verified or is structurally
+    # safer (different family / smaller routing surface). Pruned candidates
+    # that have been "down" for 48+ consecutive probes (qwen3.5-122b,
+    # gpt-oss-120b, deepseek-v4-pro) so the election pool only contains
+    # demonstrably-healthy NIM models.
+    # Primary: Qwen 3-Next 80B — 5/5 recent probes ok, clean JSON, multilingual
     "qwen/qwen3-next-80b-a3b-instruct",
-    # 1st fallback: Qwen 3.5 122B — same family, bigger, slightly slower
-    "qwen/qwen3.5-122b-a10b",
-    # 2nd fallback: OpenAI GPT-OSS 120B — different family, MIT open weights
-    "openai/gpt-oss-120b",
-    # 3rd fallback: Mistral Large 3 (also the judge — used only if all above fail)
-    "mistralai/mistral-large-3-675b-instruct-2512",
-    # 4th fallback: NVIDIA Nemotron-Super 49B — different family again
+    # 1st fallback: NVIDIA Nemotron-Super 49B — recent 3/3 probes ok, ~354ms
+    # latency, different family (nvidia) from Qwen primary → preserves
+    # cross-family-grading invariant if elevated to judge.
     "nvidia/llama-3.3-nemotron-super-49b-v1.5",
-    # 5th fallback: Meta Llama-3.3 70B (intermittently times out; last resort)
-    "meta/llama-3.3-70b-instruct",
-    # 6th fallback: DeepSeek-V4-Pro (back when NIM's pool recovers)
-    "deepseek-ai/deepseek-v4-pro",
-    # CROSS-PROVIDER FALLBACKS — only reached when the entire NIM block above
-    # has failed (regional outage / DNS / ingress brownout). These hit a
-    # completely different provider so the brain survives a full NIM down.
-    # 7th fallback: OpenRouter GPT-OSS 120B (different provider, MIT weights)
-    "openrouter:openai/gpt-oss-120b",
-    # 8th fallback: Groq Llama-3.3 70B (different provider, LPU inference)
-    "groq:llama-3.3-70b-versatile",
+    # 2nd fallback: Mistral Large 3 675B — recent 3/3 probes ok, different
+    # family (mistral). Also the judge primary; only reached when both Qwen +
+    # Nemotron are unavailable.
+    "mistralai/mistral-large-3-675b-instruct-2512",
+    # 3rd fallback: Meta Llama-4 Maverick 17B — 5/5 probes ok, different
+    # family (meta), keeps the chain alive through a single-family outage.
+    "meta/llama-4-maverick-17b-128e-instruct",
 ]
 
 # Same chain for fast brain — Qwen 80B is already fast (~2s); no need for a
@@ -270,52 +271,44 @@ BRAIN_CHAIN = [
 # is the lowest-TTFT free-tier option, so a fast-brain fall-through to it is
 # still acceptable from a latency-budget standpoint.
 FAST_BRAIN_CHAIN = [
-    # KI-035 (2026-05-14) — reordered for latency. Fast brain serves
-    # fact-find + QA + paraphrase + normalize + extract: every single one
-    # of these is a sub-second job by content size, so the bottleneck IS
-    # TTFT, not capability. Nemotron Nano 30B hits ~1.6s; Qwen 80B is
-    # ~2-3s. Moved Nemotron to primary; Qwen 80B stays as next fallback so
-    # if Nemotron's NIM pool degrades we still get quality.
-    #
-    # KI-079 (2026-05-15) — moved Groq Llama-3.3 70B from chain bottom to
-    # candidate #2 (right after Nemotron primary). Live 10-turn probe
-    # (commit 078ff45) showed 7/10 fact-find turns timing out at 26.6s with
-    # _fallback_reason="timeout" — ALL the slow links were NIM-hosted, so
-    # NIM per-key concurrency had them queueing together and the chain
-    # burned its 22s total_budget_s inside NIM before ever reaching Groq.
-    # With Groq as #2, a Nemotron hang (~6s per-link timeout) falls
-    # through to Groq's LPU (~0.3s TTFT) in ~6-7s total — well inside the
-    # 22s chain budget AND the 25s wait_for cap.
-    "nvidia/nemotron-3-nano-30b-a3b",     # ~1.6s TTFT (Reddit bench), NIM
-    # CROSS-PROVIDER FALLBACK #1 — Groq Llama-3.3 70B (LPU, lowest TTFT of
-    # all free-tier options). Promoted to #2 in KI-079 so a single NIM
-    # degradation falls through to a non-NIM provider in ~6s, not 22s.
-    "groq:llama-3.3-70b-versatile",
-    "qwen/qwen3-next-80b-a3b-instruct",   # ~2-3s, NIM
-    "openai/gpt-oss-120b",
-    "qwen/qwen3.5-122b-a10b",
-    "deepseek-ai/deepseek-v4-flash",
+    # KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Groq Llama-3.3-70B
+    # REMOVED from candidate #2 (the KI-079 promotion) after it failed the
+    # `<FF>` trailer contract in a live fact-find probe, silently
+    # cascading the orchestrator to scripted prompts. Also dropped models
+    # that have been "down" for 48+ consecutive probes (nemotron-3-nano-30b
+    # = empty_content, qwen3.5-122b = timeout, gpt-oss-120b = empty_content,
+    # deepseek-v4-flash = timeout) so the election pool only contains
+    # demonstrably-healthy NIM models. With election (KI-080) picking the
+    # actually-fastest healthy candidate per turn, chain order matters
+    # only for cold-start; the elector handles steady-state.
+    # Primary: Qwen 3-Next 80B — 5/5 recent probes ok, ~2s, multilingual,
+    # verified `<FF>` adherence in production traffic.
+    "qwen/qwen3-next-80b-a3b-instruct",
+    # 1st fallback: NVIDIA Nemotron-Super 49B — 3/3 recent ok, ~354ms
+    # (fastest healthy NIM model), different family for diversity.
+    "nvidia/llama-3.3-nemotron-super-49b-v1.5",
+    # 2nd fallback: Mistral Large 3 675B — 3/3 recent ok, different family,
+    # keeps fact-find alive through a Qwen+Nemotron simultaneous outage.
+    "mistralai/mistral-large-3-675b-instruct-2512",
 ]
 
-# Judge chain — non-Qwen, non-DeepSeek (different family from brain primary)
+# Judge chain — non-Qwen (different family from brain primary so the judge
+# never grades its own family's output).
+# KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Groq + OpenRouter REMOVED.
+# Dropped candidates that have been "down" for 48+ consecutive probes
+# (gpt-oss-120b = empty_content, kimi-k2 = http_404, minimax-m2.5 = http_410)
+# so the election pool only contains demonstrably-healthy NIM models.
 JUDGE_CHAIN = [
-    # Primary: Mistral Large 3 675B — different family from Qwen brain
+    # Primary: Mistral Large 3 675B — 3/3 recent ok, different family
+    # (mistral) from Qwen brain, preserves cross-family grading invariant.
     "mistralai/mistral-large-3-675b-instruct-2512",
-    # 1st fallback: OpenAI GPT-OSS 120B — different family
-    "openai/gpt-oss-120b",
-    # 2nd fallback: Moonshot Kimi K2 — different family (Chinese provider)
-    "moonshotai/kimi-k2-instruct-0905",
-    # 3rd fallback: MiniMax M2.5 — different family
-    "minimaxai/minimax-m2.5",
-    # 4th fallback: Meta Llama-4 Maverick (was the original judge — back if NIM Llama pool recovers)
+    # 1st fallback: Meta Llama-4 Maverick 17B — 5/5 probes ok, different
+    # family (meta), original judge primary pre-KI-080.
     "meta/llama-4-maverick-17b-128e-instruct",
-    # CROSS-PROVIDER FALLBACKS — reached only when every NIM judge candidate
-    # above has failed. Critical for keeping faithfulness Gate 4 + Hinglish
-    # drift judge alive through a full NIM outage.
-    # 5th fallback: OpenRouter GPT-OSS 120B (different provider, MIT weights)
-    "openrouter:openai/gpt-oss-120b",
-    # 6th fallback: Groq Llama-3.3 70B (different provider, LPU inference)
-    "groq:llama-3.3-70b-versatile",
+    # 2nd fallback: NVIDIA Nemotron-Super 49B — 3/3 recent ok, different
+    # family (nvidia/nemotron) from Qwen brain. Note: branded "llama" but
+    # NVIDIA-finetuned, distinct decision surface.
+    "nvidia/llama-3.3-nemotron-super-49b-v1.5",
 ]
 
 
@@ -414,28 +407,24 @@ class NimChainLLM(LLMProvider):
         return model_id.split("/")[-1]
 
     def _get_worker_for(self, model_id: str, timeout: float) -> LLMProvider:
-        """Dispatch a chain entry to the right provider client.
+        """Dispatch a chain entry to the NIM provider client.
 
-        Recognised prefixes:
-          - 'openrouter:<model>' -> OpenRouterLLM
-          - 'groq:<model>'       -> GroqLLM
-          - <anything else>      -> NvidiaNimLLM (existing default)
+        KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Cross-provider
+        (`openrouter:` / `groq:`) prefixes are explicitly rejected here even
+        though the chains no longer contain them. This is a defense-in-depth
+        short-circuit: if anyone (admin override, monkeypatch, future drift)
+        injects a non-NIM candidate into a chain, the dispatcher raises
+        rather than silently routing to a provider that has demonstrated
+        contract drift (Groq Llama-3.3-70B / `<FF>` trailer failure).
 
         KI-085 — passes `chain_name=self._chain_name` so the credit
         trackers in the provider clients route their response-header
         signals to the right chain state.
         """
-        if model_id.startswith("openrouter:"):
-            return OpenRouterLLM(
-                model=model_id[len("openrouter:"):],
-                timeout=timeout,
-                chain_name=self._chain_name,
-            )
-        if model_id.startswith("groq:"):
-            return GroqLLM(
-                model=model_id[len("groq:"):],
-                timeout=timeout,
-                chain_name=self._chain_name,
+        if model_id.startswith(("openrouter:", "groq:", "or:")):
+            raise RuntimeError(
+                f"NimChainLLM ({self._chain_name}): non-NIM candidate "
+                f"'{model_id}' rejected. Chains are NIM-only as of KI-155."
             )
         return NvidiaNimLLM(model=model_id, api_key=self.api_key, timeout=timeout)
 

frontend/src/lib/useLiveConversation.ts

@@ -7,6 +7,14 @@
  * KI-057 (2026-05-15) — Noise-robust VAD + flush-on-stop.
  * KI-060 (2026-05-15) — Silence-end window lengthened (40 → 90 frames,
  *   ~640 ms → ~1.5 s) so natural mid-sentence pauses don't auto-submit.
+ * KI-159 (2026-05-15) — Early-close on stable silence. If the user has
+ *   already spoken ≥3× minUtteranceMs (~1.2 s) and silence has accumulated
+ *   to half the silenceEndFrames window (~1.5 s), close the segment NOW.
+ *   Prevents notification dings / transient background noise mid-pause
+ *   from re-triggering `speechLike`, zeroing the silence counter, and
+ *   extending the segment until either the full 3 s window or the 18 s
+ *   max-cap fires — by which point the real words are buried in a bloated
+ *   blob that Sarvam STT either drops or mis-transcribes.
  *
  * Why KI-057 was needed
  * --------------------------------------------------------------------
@@ -209,6 +217,16 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
   const noiseFloorRef = useRef<number>(0);
   // KI-057 — gates "did the bot just stop talking?" cooldown.
   const lastUtteranceEndedAtRef = useRef<number>(0);
+  // KI-141 (2026-05-15) — TTS-playback awareness for reliable barge-in.
+  // When the bot's <audio> element is playing, the mic re-captures the
+  // speaker output (echoCancellation is imperfect). The noiseFloor EMA
+  // would otherwise learn the bot's voice level and pull effectiveThreshold
+  // up to bot-loudness, making user voice unable to clear the gate. We
+  // (a) freeze noise-floor learning, (b) bypass the post-utterance cooldown
+  // (cooldown only makes sense AFTER bot finishes), and (c) drop the
+  // speech-start frame count so barge-in fires in ~30 ms instead of ~80 ms.
+  const ttsPlayingRef = useRef<boolean>(false);
+  const ttsAudioElementsRef = useRef<Set<HTMLAudioElement>>(new Set());
 
   const onUtteranceRef = useRef(opts.onUtterance);
   const onSpeechStartRef = useRef(opts.onSpeechStart);
@@ -239,8 +257,99 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
         } catch {}
       });
     }
+    // KI-141 — clearing TTS-playing immediately on barge-in so the VAD
+    // resumes idle-mode noise-floor learning even before the `pause`
+    // event fires on the (now stopped) <audio> element.
+    ttsPlayingRef.current = false;
+    // KI-141 — anchor cooldown to barge-in moment so the next 700 ms
+    // suppresses any residual decay tail / echo from the just-paused TTS.
+    lastUtteranceEndedAtRef.current = Date.now();
   }, []);
 
+  // KI-141 (2026-05-15) — TTS-playback observer.
+  // Watch every <audio> element in the document for play/pause/ended so
+  // the VAD knows when the bot is currently speaking. This is the signal
+  // that flips the VAD into "barge-in mode" (no cooldown, faster start,
+  // frozen noise floor). MutationObserver picks up new <audio> elements
+  // as Message components mount.
+  useEffect(() => {
+    if (!live || typeof document === "undefined") return;
+
+    const tracked = ttsAudioElementsRef.current;
+
+    const refreshPlayingState = () => {
+      let anyPlaying = false;
+      tracked.forEach((a) => {
+        if (!a.paused && !a.ended && a.currentTime > 0) anyPlaying = true;
+      });
+      ttsPlayingRef.current = anyPlaying;
+    };
+
+    const onPlay = () => {
+      ttsPlayingRef.current = true;
+    };
+    const onPauseOrEnded = () => {
+      refreshPlayingState();
+      // KI-141 — anchor the post-utterance cooldown to the moment TTS
+      // actually finished, not to when the user's previous segment closed.
+      // This is what the 700 ms cooldown was always meant to gate: the
+      // bot's tail decay / echo bleeding back into the mic.
+      if (!ttsPlayingRef.current) {
+        lastUtteranceEndedAtRef.current = Date.now();
+      }
+    };
+
+    const attach = (a: HTMLAudioElement) => {
+      if (tracked.has(a)) return;
+      tracked.add(a);
+      a.addEventListener("play", onPlay);
+      a.addEventListener("playing", onPlay);
+      a.addEventListener("pause", onPauseOrEnded);
+      a.addEventListener("ended", onPauseOrEnded);
+      a.addEventListener("emptied", onPauseOrEnded);
+      // If the element is already playing when we attach, capture that.
+      if (!a.paused && !a.ended) ttsPlayingRef.current = true;
+    };
+
+    const detach = (a: HTMLAudioElement) => {
+      a.removeEventListener("play", onPlay);
+      a.removeEventListener("playing", onPlay);
+      a.removeEventListener("pause", onPauseOrEnded);
+      a.removeEventListener("ended", onPauseOrEnded);
+      a.removeEventListener("emptied", onPauseOrEnded);
+      tracked.delete(a);
+    };
+
+    // Attach to anything already in the DOM.
+    document.querySelectorAll("audio").forEach((el) => attach(el as HTMLAudioElement));
+
+    const observer = new MutationObserver((mutations) => {
+      for (const m of mutations) {
+        m.addedNodes.forEach((n) => {
+          if (n instanceof HTMLAudioElement) attach(n);
+          else if (n instanceof Element) {
+            n.querySelectorAll("audio").forEach((el) => attach(el as HTMLAudioElement));
+          }
+        });
+        m.removedNodes.forEach((n) => {
+          if (n instanceof HTMLAudioElement) detach(n);
+          else if (n instanceof Element) {
+            n.querySelectorAll("audio").forEach((el) => detach(el as HTMLAudioElement));
+          }
+        });
+      }
+      refreshPlayingState();
+    });
+    observer.observe(document.body, { childList: true, subtree: true });
+
+    return () => {
+      observer.disconnect();
+      tracked.forEach((a) => detach(a));
+      tracked.clear();
+      ttsPlayingRef.current = false;
+    };
+  }, [live]);
+
   // KI-044 — open speech capture: snapshot the preroll into speechBuffer,
   // flag recording, fire callbacks. The PCM keeps flowing via the worklet
   // port; we just toggle where it lands.
@@ -346,9 +455,19 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
 
       // KI-057 — suppress new triggers right after we closed a segment
       // (bot's TTS onset can bleed in via the mic loopback).
+      // KI-141 — but DO NOT suppress during TTS playback itself; that's
+      // exactly when barge-in must work. Cooldown is only meaningful for
+      // the brief window after bot speech ends.
+      const ttsPlaying = ttsPlayingRef.current;
       const cooldownActive =
+        !ttsPlaying &&
         Date.now() - lastUtteranceEndedAtRef.current < cfg.postUtteranceCooldownMs;
 
+      // KI-141 — barge-in must be SNAPPY. During TTS, 2 frames (~30 ms) is
+      // enough to confirm voice and pause the bot; the longer 5-frame gate
+      // is only needed in idle mode where it rejects click/clack transients.
+      const startFrames = ttsPlaying ? 2 : cfg.speechStartFrames;
+
       const speechLike =
         avg > effectiveThreshold &&
         voiceProp >= cfg.voiceBandMinProp &&
@@ -357,7 +476,7 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
       if (speechLike) {
         loud++;
         quiet = 0;
-        if (loud === cfg.speechStartFrames && !recordingRef.current) {
+        if (loud >= startFrames && !recordingRef.current) {
           // Barge in: kill bot audio + cancel in-flight chat + begin capture.
           interruptBotAudio();
           if (inflightAbortRef.current) {
@@ -371,7 +490,13 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
         loud = 0;
         // KI-057 — only learn the noise floor while idle, so ongoing
         // speech doesn't poison the EMA.
-        if (!recordingRef.current) {
+        // KI-141 — also freeze noise-floor learning while TTS is playing.
+        // The bot's voice bleeding through the speakers would otherwise be
+        // EMA'd into the floor, pulling effectiveThreshold up to bot loudness
+        // — at which point the user's voice can't clear it. Holding the
+        // pre-TTS noise floor keeps the gate at room-ambient level where
+        // user speech reliably crosses.
+        if (!recordingRef.current && !ttsPlaying) {
           noiseFloorRef.current =
             noiseFloorRef.current === 0
               ? avg
@@ -380,6 +505,32 @@ export function useLiveConversation(opts: LiveConversationOptions): LiveConversa
         if (quiet === cfg.silenceEndFrames && recordingRef.current) {
           void endSpeechCapture();
         }
+        // KI-159 (2026-05-15) — early-close on stable silence after enough
+        // captured speech. Protects against transient noise bursts (e.g. a
+        // notification ding mid-pause) that would otherwise re-trigger
+        // speechLike, zero `quiet`, and extend the segment until either the
+        // full silenceEndFrames (180 ≈ 3 s) accumulates AGAIN or the
+        // maxUtteranceMs (18 s) hard-cap fires — by which point the real
+        // words are buried in a bloated blob that Sarvam STT mis-transcribes
+        // or returns empty for.
+        //
+        // Trigger: half the silence window AND we already have 3× the
+        // minUtteranceMs (~1.2 s) of captured speech. Submit the user's
+        // words IMMEDIATELY at the first stable pause, before any noise can
+        // contaminate the segment.
+        else if (
+          recordingRef.current &&
+          quiet >= Math.floor(cfg.silenceEndFrames / 2) &&
+          recStartTsRef.current > 0 &&
+          Date.now() - recStartTsRef.current >= cfg.minUtteranceMs * 3
+        ) {
+          // eslint-disable-next-line no-console
+          console.debug(
+            "[live-mode] early-close on stable silence (KI-159)",
+            { quiet, durationMs: Date.now() - recStartTsRef.current },
+          );
+          void endSpeechCapture();
+        }
       }
 
       // KI-057 — max-utterance cap. If recording has run too long

kb/INDEX.md

@@ -1,10 +1,10 @@
 # Knowledge Base — Insurance Sales Bot
 
-_Last synced: 2026-05-14._
+_Last synced: 2026-05-15._
 
 Canonical knowledge base for the Insurance Sales Bot. Every user-facing answer, scorecard, and comparison surface must trace back to a file in this directory.
 
-## Policies (253)
+## Policies (222)
 
 | Insurer | Policy | UIN | Completeness | KB path |
 | --- | --- | --- | --- | --- |
@@ -27,7 +27,7 @@ Canonical knowledge base for the Insurance Sales Bot. Every user-facing answer,
 | Bajaj Allianz General Insurance | Criti Care | `BAJHLIP21273V012021` | 9% | [`policies/bajaj-allianz__criti-care__wordings.md`](policies/bajaj-allianz__criti-care__wordings.md) |
 | Bajaj Allianz General Insurance | Extra Care Plus | `BAJHLIP21321V012021` | — | [`policies/bajaj-allianz__extra-care-plus__wordings.md`](policies/bajaj-allianz__extra-care-plus__wordings.md) |
 | Bajaj Allianz General Insurance | Global Health Care Policy | `BAJHLIP23209V022223` | — | [`policies/bajaj-allianz__global-health-care__wordings.md`](policies/bajaj-allianz__global-health-care__wordings.md) |
-| Bajaj Allianz General Insurance | Group Health Guard Gold | `BAJHLGP21181V022021` | 32% | [`policies/bajaj-allianz__group-health-guard-gold__wordings.md`](policies/bajaj-allianz__group-health-guard-gold__wordings.md) |
+| Bajaj Allianz General Insurance | Group Health Guard Silver | `BAJHLGP21181V022021` | 32% | [`policies/bajaj-allianz__group-health-guard-silver__wordings.md`](policies/bajaj-allianz__group-health-guard-silver__wordings.md) |
 | Bajaj Allianz General Insurance | Group Personal Accident | `—` | 5% | [`policies/bajaj-allianz__group-personal-accident__wordings.md`](policies/bajaj-allianz__group-personal-accident__wordings.md) |
 | Bajaj Allianz General Insurance | Health Guard | `BAJHLIP25035V072425` | — | [`policies/bajaj-allianz__health-guard__wordings.md`](policies/bajaj-allianz__health-guard__wordings.md) |
 | Bajaj Allianz General Insurance | Health Guard Gold Individual | `BAJHLIP21185V032021` | 41% | [`policies/bajaj-allianz__health-guard-gold-individual__wordings.md`](policies/bajaj-allianz__health-guard-gold-individual__wordings.md) |
@@ -231,9 +231,9 @@ Canonical knowledge base for the Insurance Sales Bot. Every user-facing answer,
 | oriental-insurance | Happy Family Floater Policy - 2021 | `OICHLIP22010V042223` | — | [`policies/oriental-insurance__happy-family-floater__wordings.md`](policies/oriental-insurance__happy-family-floater__wordings.md) |
 | oriental-insurance | Oriental Mediclaim Insurance Policy (Individual) | `OICHLIP23084V042223` | — | [`policies/oriental-insurance__oriental-mediclaim-individual__cis.md`](policies/oriental-insurance__oriental-mediclaim-individual__cis.md) |
 | oriental-insurance | Oriental Mediclaim Insurance Policy (Individual) | `OICHLIP23084V042223` | — | [`policies/oriental-insurance__oriental-mediclaim-individual__wordings.md`](policies/oriental-insurance__oriental-mediclaim-individual__wordings.md) |
-| reliance-general | IndusInd Group Mediclaim | `RELHLGP21523V022021` | — | [`policies/reliance-general__group-mediclaim__wordings.md`](policies/reliance-general__group-mediclaim__wordings.md) |
-| reliance-general | IndusInd HealthGain Policy | `INIHLIP26040V042526` | — | [`policies/reliance-general__health-gain__wordings.md`](policies/reliance-general__health-gain__wordings.md) |
-| reliance-general | IndusInd Hospi Care Insurance | `RELHLIP20027V012021` | — | [`policies/reliance-general__hospi-care__wordings.md`](policies/reliance-general__hospi-care__wordings.md) |
+| indusind-general | IndusInd Group Mediclaim | `RELHLGP21523V022021` | — | [`policies/indusind-general__group-mediclaim__wordings.md`](policies/indusind-general__group-mediclaim__wordings.md) |
+| indusind-general | IndusInd HealthGain Policy | `INIHLIP26040V042526` | — | [`policies/indusind-general__health-gain__wordings.md`](policies/indusind-general__health-gain__wordings.md) |
+| indusind-general | IndusInd Hospi Care Insurance | `RELHLIP20027V012021` | — | [`policies/indusind-general__hospi-care__wordings.md`](policies/indusind-general__hospi-care__wordings.md) |
 | reliance-general | Personal Accident Policy | `RELPAGP01001V010001` | — | [`policies/reliance-general__personal-accident__wordings.md`](policies/reliance-general__personal-accident__wordings.md) |
 | royal-sundaram | Advanced Top Up Health Insurance Plan | `RSAHLIP23029V012223` | — | [`policies/royal-sundaram__advanced-top-up__brochure.md`](policies/royal-sundaram__advanced-top-up__brochure.md) |
 | royal-sundaram | Advanced Top Up Health Insurance Plan | `RSAHLIP23029V012223` | — | [`policies/royal-sundaram__advanced-top-up__cis.md`](policies/royal-sundaram__advanced-top-up__cis.md) |
@@ -283,7 +283,7 @@ Canonical knowledge base for the Insurance Sales Bot. Every user-facing answer,
 kb/
 ├── INDEX.md                       (this file)
 ├── AUDIT_TRAIL.md                 (data lineage + curation history)
-├── policies/<policy_id>.md       (255 files — one per curated policy)
+├── policies/<policy_id>.md       (222 files — one per curated policy)
 ├── methodology/
 │   ├── scorecard.json             (6 sub-scores + weights + anchors)
 │   ├── glossary.json              (13 terms × en/hi)

rag/README.md

@@ -28,7 +28,7 @@ Lineage for every artefact below is documented in [`kb/AUDIT_TRAIL.md`](../kb/AU
 | Path | Source of truth | Notes |
 | --- | --- | --- |
 | `rag/corpus/<insurer>/*.pdf` | insurer CDNs | 206 PDFs (188 product PDFs across 19 insurers + 18 regulatory IRDAI/NHA docs). Not in git — hydrated at Docker build from the companion HF dataset. |
-| `rag/extracted/<policy_id>.json` | `extract.py` | 206 JSONs, one per policy, conforming to `schema.HealthPolicy`. Generated; never hand-edit. |
+| `rag/extracted/<policy_id>.json` | `extract.py` | 201 JSONs, one per policy, conforming to `schema.HealthPolicy`. Generated; never hand-edit. |
 | `rag/vectors/chroma.sqlite3` + HNSW binaries | `ingest.py` | Persistent Chroma store. Symlinked to `rag/_hf_dataset_backup/rag/vectors/` for the offline canonical copy. |
 | `rag/policies.duckdb` | `extract.py` | DuckDB rollup of the 62-field JSONs; used for SQL-style filters in `backend/main.py`. |
 | `rag/source_map.json` | `source_map.py` | chunk_id → (pdf_path, page, span) for the citation links shown in the UI. |

rag/SCHEMA.md

@@ -94,3 +94,18 @@ The schema is forward-compatible without breaking changes:
     queries like "policies with PED waiting < 24 months" can still match).
 - The original policy wordings PDF stays in `rag/corpus/` for citation
   fallback. The schema's `source_pdf_path` field is the link back.
+
+## Chroma chunk metadata
+
+Each chunk persisted in Chroma carries the following metadata keys (set by
+`rag/ingest.py`):
+
+| Key | Type | Notes |
+|---|---|---|
+| `policy_id` | str | e.g. `aditya-birla__activ-one`. Primary filter for per-policy retrieval. |
+| `insurer_slug` | str | e.g. `aditya-birla`. Secondary filter. |
+| `source_pdf` | str | Relative path under `rag/corpus/`. |
+| `page` | int | 1-indexed PDF page number. |
+| `chunk_index` | int | Position within the policy's chunk sequence. |
+| `doc_type` | str | `'wordings'` / `'brochure'` / `'cis'` / `'prospectus'` / `'curated'`. **`'curated'` (KI-137)** marks chunks ingested from hand-curated `40-data/policy_facts/<id>.json` rather than raw PDF text. |
+| `legacy_issuer` | str (optional) | **KI-144.** Present on `indusind-general__*` chunks whose source PDFs carry the previous `reliance-general` issuer branding. Value: `'reliance-general'`. Lets retrieval surface legacy citations without breaking the canonical slug. |