fix(#60+#62): bulk-scorecard curated fallback + stop internal scoring jargon leaking

#60 REGRESSION: /api/scorecard/bulk hard-required rag/extracted/<pid>.json
and emitted the N/A 'No extraction available' / 'Data not indexed'
sentinel for curated-only catalogued products (star-health__star-
comprehensive, UIN SHAHLIP26044V092526) — the broken-card defect the
user re-reported. Mirrored the curated fallback the marketplace +
single /api/scorecard endpoint already use (policies_all Pass-2). Star
Comprehensive now grades A 76 instead of N/A.

#62: scorecard.py hardcoded the user-facing signal as
'lifelong renewable (IRDAI norm — not scored)' — internal scoring
scaffolding leaking into the card UI. Now 'Lifelong renewability
guaranteed'. Test updated to assert clean copy + no jargon leak.

Full pytest gate green (rc=0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/main.py

@@ -3850,7 +3850,43 @@ async def scorecard_bulk(req: BulkScorecardRequest):
 
     for pid in req.policy_ids:
         extracted_path = settings.EXTRACTED_DIR / f"{pid}.json"
-        if not extracted_path.exists():
+        policy = None
+        if extracted_path.exists():
+            try:
+                policy = _json.loads(extracted_path.read_text())
+            except Exception as e:
+                out[pid] = BulkScorecardEntry(
+                    policy_id=pid, policy_name=pid, insurer_slug="?",
+                    overall_grade="N/A", overall_score=0, sub_scores={},
+                    profile_rationale=[f"Data unreadable: {e}"],
+                    data_completeness_pct=0.0,
+                    one_liner="Extraction file is corrupted.",
+                    signals={},
+                )
+                continue
+            policy = _merge_curated(
+                policy, _curated.get(policy.get("policy_id", pid)) or _curated.get(pid)
+            )
+        else:
+            # ROOT-CAUSE FIX #60 (2026-05-18): curated-only catalogued
+            # products (e.g. star-health__star-comprehensive, UIN
+            # SHAHLIP26044V092526) have NO rag/extracted/<pid>.json — only
+            # doctype-suffixed extractions. The marketplace + the single
+            # /api/scorecard endpoint already resolve these from the curated
+            # layer (policies_all Pass-2 / lines ~3617). The BULK endpoint
+            # did not, so it emitted the N/A "No extraction available" /
+            # "Data not indexed" sentinel — the broken-card defect the user
+            # saw for Star Comprehensive. Mirror that curated fallback here;
+            # the curated dict also carries doctype-suffixed alias keys.
+            policy = (
+                _curated.get(pid)
+                or _curated.get(f"{pid}__wordings")
+                or _curated.get(f"{pid}__cis")
+                or _curated.get(f"{pid}__brochure")
+                or _curated.get(f"{pid}__prospectus")
+            )
+        if not policy:
+            # Genuinely absent from BOTH layers ⇒ not a catalogued product.
             out[pid] = BulkScorecardEntry(
                 policy_id=pid,
                 policy_name=pid,
@@ -3864,19 +3900,6 @@ async def scorecard_bulk(req: BulkScorecardRequest):
                 signals={},
             )
             continue
-        try:
-            policy = _json.loads(extracted_path.read_text())
-        except Exception as e:
-            out[pid] = BulkScorecardEntry(
-                policy_id=pid, policy_name=pid, insurer_slug="?",
-                overall_grade="N/A", overall_score=0, sub_scores={},
-                profile_rationale=[f"Data unreadable: {e}"],
-                data_completeness_pct=0.0,
-                one_liner="Extraction file is corrupted.",
-                signals={},
-            )
-            continue
-        policy = _merge_curated(policy, _curated.get(policy.get("policy_id", pid)) or _curated.get(pid))
 
         slug = policy.get("insurer_slug") or "?"
         if slug not in insurer_cache:

backend/scorecard.py

@@ -378,7 +378,7 @@ def score_renewal_protection(p: dict) -> SubScore:
     maximum *entry* age — how late a first-time buyer can take the policy —
     so that is the sole driver of this sub-score.
     """
-    signals: list[str] = ["lifelong renewable (IRDAI norm — not scored)"]
+    signals: list[str] = ["Lifelong renewability guaranteed"]
     s = 50  # true-neutral base (was 60 — recalibrated for real spread)
 
     maxe = _int(p, "max_entry_age")

tests/test_scorecard_lifelong.py

@@ -50,7 +50,13 @@ def test_entry_age_is_the_sole_driver():
 def test_lifelong_shown_as_informational_signal_not_scored():
     sc = score_renewal_protection({})
     assert sc.name == "Renewal Protection"
-    assert any("lifelong" in s.lower() and "not scored" in s.lower() for s in sc.signals)
+    # The signal must surface lifelong renewability as an informational
+    # bullet — but in CLEAN user-facing copy. The internal "(IRDAI norm —
+    # not scored)" scaffolding must NOT leak to the UI (#62). That it is
+    # genuinely not scored is enforced by the score-invariance tests above.
+    assert any("lifelong renewab" in s.lower() for s in sc.signals)
+    assert not any("not scored" in s.lower() or "irdai norm" in s.lower()
+                   for s in sc.signals), "internal scoring jargon leaked into UI signal"
 
 
 def test_completeness_ignores_max_renewal_age():