#25/#26: returning-user recall any-turn + mid-conversation state recovery

#25 — returning user never recognised. Recall probe was gated to
_current_turn==1, but fact-find asks the name in the bot's FIRST reply
so the name lands on turn >=2; compounded by extract_potential_name
needing an "I'm X" preamble and a two-token name slugging past the
stored first-name file. Fix: probe whenever the LLM-captured
session.profile.name is first known (any turn) + first-name slug
fallback in rehydrate_by_name; one-shot guarded (recall_probe_done),
declined recall never re-offered. Privacy design (stage + explicit
confirm, no auto-merge) preserved.

#26 — profile lost mid-conversation. In-memory sessions (1h TTL, KI-118
removed disk persistence) evict on HF container restart/idle ->
get_session returns blank -> bot says "I seem to have lost ... What's
your name?". Fix (chosen design): when the live profile is blank but
the client still carries chat_history, inject STATE-RECOVERY MODE so
the model silently re-captures facts from history and continues —
never re-asking the name / never admitting a loss.

Regression tests replay both exact live flows; red-green verified;
full suite green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/session_state.py

@@ -88,6 +88,13 @@ class SessionState:
     #     explicitly declines the pricing inputs; bypasses the re-ask.
     pricing_bundle_reasked: bool = False
     pricing_bundle_skipped: bool = False
+    # Bug #25 (2026-05-19) — one-shot guard for returning-user recall.
+    # The old wiring only probed on turn 1, but the fact-find asks the
+    # name in the bot's FIRST reply, so the name lands on turn >=2 and
+    # recall never fired. The probe now runs whenever the name is first
+    # known (any turn); this flag stops it re-staging every subsequent
+    # turn and stops a declined recall from being re-offered.
+    recall_probe_done: bool = False
 
     def _flush(self) -> None:
         """No-op. Session state lives only in the in-memory dict; the
@@ -180,7 +187,17 @@ def rehydrate_by_name(session: SessionState, name: str) -> bool:
         from backend.profile_store import load_profile
         stored = load_profile(name)
         if stored is None:
-            return False
+            # Bug #25 (2026-05-19): a multi-token capture ("Rohit Sar")
+            # slugs to "rohit-sar" and misses the stored first-name file
+            # ("rohit.json"). Fall back to the first name token. Still
+            # privacy-safe — this only STAGES a match; the user must
+            # explicitly confirm the identity summary before any merge.
+            _stripped = (name or "").strip()
+            _first = _stripped.split()[0] if _stripped else ""
+            if _first and _first.lower() != _stripped.lower():
+                stored = load_profile(_first)
+            if stored is None:
+                return False
 
         # Build a non-PII-leaking identity summary so the brain can ask
         # "are you <name>?" without putting anything on the live profile.
@@ -238,6 +255,9 @@ def apply_pending_recall(session: SessionState, *, confirmed: bool) -> bool:
         return False
     # Resolve the staging regardless of outcome.
     session.pending_profile_recall = None
+    # Bug #25 (2026-05-19) — a confirmed OR denied recall is final for
+    # this session; never auto-re-stage / re-offer it on a later turn.
+    session.recall_probe_done = True
     if not confirmed:
         return False
     stored_fields = pending.get("stored_fields") or {}

backend/single_brain.py

@@ -775,6 +775,7 @@ def _affirm_or_deny(text: str):
 def _system_instruction(
     profile, is_returning_user: bool = False, shortlist_block: str = "",
     pending_recall: "Optional[dict]" = None, recall_applied: bool = False,
+    reconstruct_from_history: bool = False,
 ) -> dict:
     """Bake the profile snapshot into the system prompt so each turn the
     LLM knows what's already captured. Returned in Gemini's expected
@@ -864,9 +865,31 @@ def _system_instruction(
             "straight to retrieve_policies + recommendations. Ask ONLY for "
             "a slot that is genuinely ABSENT above — never one present."
         )
+    reconstruct_block = ""
+    if reconstruct_from_history:
+        reconstruct_block = (
+            "\n\n══════════ STATE-RECOVERY MODE ══════════\n"
+            "Your in-memory session was reset (server restart / idle "
+            "timeout), so the profile snapshot above is empty — BUT the "
+            "CONVERSATION HISTORY in this request still contains every "
+            "fact this user already gave you. This is NOT a new user.\n"
+            "ABSOLUTE RULES this turn:\n"
+            "  1. Do NOT say you 'lost' / 'don't have' their information, "
+            "do NOT apologise for losing it, do NOT say 'let's re-confirm'.\n"
+            "  2. Do NOT re-ask the user's name, age, or ANY fact already "
+            "stated anywhere in the conversation history.\n"
+            "  3. SILENTLY re-capture every profile fact present in the "
+            "history by calling save_profile_field once per fact (name, "
+            "age, dependents, location, income, primary_goal, "
+            "health_conditions, and any pricing slots already given).\n"
+            "  4. THEN continue exactly where the conversation left off — "
+            "answer the user's latest message; if all 7 required slots are "
+            "now captured, proceed straight to retrieve_policies and "
+            "recommendations. The user must never perceive any loss."
+        )
     text = (
-        SYSTEM_PROMPT + extra + recall_block + restored_block
-        + (shortlist_block or "")
+        SYSTEM_PROMPT + extra + recall_block + reconstruct_block
+        + restored_block + (shortlist_block or "")
     )
     return {"parts": [{"text": text}]}
 
@@ -1887,12 +1910,29 @@ async def handle_turn(
                 _pending_recall = None
             # ambiguous → leave staged; the confirm block is re-injected
             # below and the LLM re-asks the "are you <name>?" question.
-        elif _current_turn == 1:
-            _nm = extract_potential_name(user_text or "")
+        elif not getattr(session, "recall_probe_done", False):
+            # Bug #25 (2026-05-19) — recall must fire whenever the user's
+            # NAME first becomes known, NOT only on turn 1. The fact-find
+            # asks for the name in the bot's FIRST reply, so the user
+            # supplies it on turn >=2; the old `_current_turn == 1` gate
+            # skipped recall for the normal flow entirely, so a returning
+            # user was never recognised. The LLM reliably persists the
+            # name via save_profile_field, so `session.profile.name`
+            # (captured on a prior turn) is the robust trigger; we ALSO
+            # keep the free-text sniff for an explicit "I'm X" stated on
+            # the very first message (before save_profile_field has run).
+            _nm = (
+                (getattr(session.profile, "name", None) or "").strip()
+                or (extract_potential_name(user_text or "") or "")
+            )
             if _nm:
+                # One-shot: never re-probe (the captured name won't
+                # change) and never re-stage every subsequent turn.
+                session.recall_probe_done = True
                 # Stages session.pending_profile_recall iff a stored
                 # profile for this name exists (no match ⇒ no-op, normal
                 # fresh-user flow continues — no false confirm prompt).
+                # Still privacy-safe: STAGE only; explicit confirm merges.
                 try_recall_by_name(session, _nm)
                 _pending_recall = getattr(
                     session, "pending_profile_recall", None
@@ -1913,6 +1953,27 @@ async def handle_turn(
     )
     is_returning_user = (_current_turn == 1) and _has_prior_profile
 
+    # Bug #26 (2026-05-19) — mid-conversation profile loss. Sessions are
+    # in-memory only (session_state._TTL_SECONDS = 1h; KI-118 removed disk
+    # persistence) so an HF container restart / >1h idle between turns
+    # makes get_session() return a BLANK SessionState. next_question then
+    # returns the hardcoded "What's your name?" and the LLM narrates "I
+    # seem to have lost some of your profile information." Recovery
+    # (user's chosen design): when the live profile is blank BUT the
+    # client still carries the conversation, silently re-capture the
+    # already-stated facts from chat_history instead of resetting. Guard:
+    # >=2 history messages ⇒ this is NOT the genuine first turn, so a
+    # blank profile means state was lost, not "fresh user".
+    _reconstruct_from_history = (
+        (not _has_prior_profile)
+        and not is_returning_user
+        and not _pending_recall
+        and bool(chat_history)
+        and len([m for m in (chat_history or [])
+                 if (m or {}).get("role") == "user"]) >= 1
+        and len(chat_history) >= 2
+    )
+
     # GOOGLE_API_KEY gate — asserted just before anything that talks to
     # Gemini.
     api_key = os.environ.get("GOOGLE_API_KEY", "").strip()
@@ -1958,6 +2019,7 @@ async def handle_turn(
         shortlist_block=_shortlist_block,
         pending_recall=_pending_recall,
         recall_applied=_did_recall_this_turn,
+        reconstruct_from_history=_reconstruct_from_history,
     )
 
     # Bug #108 + #110 — if the user explicitly declines the pricing /

tests/test_bug2526_recall_and_reconstruct.py

@@ -0,0 +1,216 @@
+"""Regression tests for the live bugs #25 and #26 (2026-05-19).
+
+#25 — returning user NEVER recognised: the recall probe was gated to
+`_current_turn == 1`, but the fact-find asks for the name in the bot's
+FIRST reply, so the name lands on turn >=2 and the probe was skipped
+entirely. Compounded by (b) `extract_potential_name` only matching an
+"I'm X / my name is X" preamble (a bare "rohit sar" → None) and (c) a
+multi-token name slugging to "rohit-sar", missing the stored
+"rohit.json". The fix: probe whenever the LLM-captured
+`session.profile.name` is first known (any turn), with a first-name
+slug fallback, one-shot guarded — STILL privacy-safe (STAGE + explicit
+confirm; no auto-merge).
+
+#26 — profile lost mid-conversation: in-memory sessions
+(_TTL_SECONDS=1h, KI-118 removed disk persistence) get evicted on an HF
+container restart / idle, so get_session() returns a BLANK session and
+the bot says "I seem to have lost some of your profile information.
+What's your name?". Fix (user-chosen): when the live profile is blank
+but the client still carries chat_history, inject STATE-RECOVERY MODE so
+the model silently re-captures the facts from history and continues —
+never re-asking the name / never admitting a loss.
+
+Each test is written so it FAILS on the pre-fix code (the exact gap
+that let the bug ship) and passes only with the fix.
+"""
+import asyncio
+import os
+import random
+import string
+import unittest
+import uuid
+from unittest import mock
+
+from backend import single_brain
+from backend.session_state import SessionState, apply_pending_recall
+from backend.profile_persistence import try_recall_by_name  # noqa: F401
+from backend.profile_store import save_profile, _normalise_name, _PROFILES_DIR
+from backend.needs_finder import Profile
+
+
+def _run(coro):
+    return asyncio.new_event_loop().run_until_complete(coro)
+
+
+def _text_payload(text):
+    return {"candidates": [{"content": {"parts": [{"text": text}]}}]}
+
+
+class _FirstNameStoredFixture(unittest.TestCase):
+    """Stores a profile under a SINGLE-token name (like the real
+    40-data/profiles/rohit.json) so a later two-token capture
+    ("Rohit Sar") must use the first-name slug fallback to resolve it."""
+
+    def setUp(self):
+        self.first = "Firstonly" + "".join(
+            random.choices(string.ascii_lowercase, k=7))
+        self.full = f"{self.first} Lastname"           # what the user types
+        self.slug = _normalise_name(self.first)
+        p = Profile()
+        p.name = self.first
+        p.age = 41
+        p.dependents = "self+spouse+1 kid"
+        p.location_tier = "metro"
+        p.income_band = "10L-25L"
+        p.primary_goal = "first_buy"
+        p.health_conditions = ["none"]
+        self.assertTrue(save_profile(self.first, p),
+                        "fixture save_profile failed")
+        self._env = mock.patch.dict(
+            os.environ, {"GOOGLE_API_KEY": "test-key"})
+        self._env.start()
+        self.sys_prompts = []
+        self.si_kwargs = []
+
+        async def _fake_gemini(*_a, **_k):
+            self.sys_prompts.append(
+                (_k.get("system_instruction") or {})
+                .get("parts", [{}])[0].get("text", ""))
+            return _text_payload("ok")
+
+        self._gp = mock.patch.object(
+            single_brain, "_gemini_call", _fake_gemini)
+        self._gp.start()
+
+        # Spy on _system_instruction WITHOUT changing behaviour, to assert
+        # the #26 reconstruct flag wiring end-to-end.
+        _real_si = single_brain._system_instruction
+
+        def _spy_si(*a, **k):
+            self.si_kwargs.append(k)
+            return _real_si(*a, **k)
+
+        self._sp = mock.patch.object(
+            single_brain, "_system_instruction", _spy_si)
+        self._sp.start()
+
+    def tearDown(self):
+        self._sp.stop()
+        self._gp.stop()
+        self._env.stop()
+        try:
+            import json
+            for fp in _PROFILES_DIR.glob("*.json"):
+                try:
+                    d = json.loads(fp.read_text())
+                except Exception:
+                    continue
+                if d.get("name_slug") == self.slug or \
+                   (d.get("profile") or {}).get("name") == self.first:
+                    fp.unlink(missing_ok=True)
+        except Exception:
+            pass
+
+
+class TestBug25RecallAfterTurn1(_FirstNameStoredFixture):
+    def test_name_captured_on_later_turn_stages_recall(self):
+        """The exact #25 flow: turn 1 has no name; the LLM captures the
+        name (save_profile_field) so by a later turn session.profile.name
+        is a TWO-token string. Old code: `elif _current_turn == 1`
+        skipped the probe AND the slug missed the stored file → recall
+        NEVER fired. Fixed: staged + confirm prompt injected."""
+        sess = SessionState(session_id=f"b25_{uuid.uuid4().hex[:8]}")
+        # Turn 1 — user states intent only, NO name.
+        _run(single_brain.handle_turn(sess, "I want a health policy"))
+        self.assertIsNone(getattr(sess, "pending_profile_recall", None),
+                           "no name yet → must not stage on turn 1")
+        # The LLM captured the name via save_profile_field on turn 2;
+        # replicate that exact server state (two-token name).
+        sess.profile.name = self.full
+        # A normal later fact-find turn (turn 3) — bare answer, NOT a
+        # name preamble, NOT turn 1: the precise pre-fix dead zone.
+        _run(single_brain.handle_turn(sess, "no pre-existing conditions"))
+        pr = getattr(sess, "pending_profile_recall", None)
+        self.assertTrue(
+            pr, "#25: recall not staged when name known after turn 1")
+        self.assertEqual(pr["name"], self.first,
+                         "#25: first-name slug fallback did not resolve "
+                         "the stored profile")
+        self.assertIn("RETURNING-USER CHECK", self.sys_prompts[-1],
+                      "#25: confirm block not injected")
+        self.assertTrue(getattr(sess, "recall_probe_done", False),
+                        "#25: one-shot guard not set")
+
+    def test_explicit_yes_then_merges(self):
+        sess = SessionState(session_id=f"b25y_{uuid.uuid4().hex[:8]}")
+        sess.profile.name = self.full
+        _run(single_brain.handle_turn(sess, "just me"))
+        self.assertTrue(sess.pending_profile_recall)
+        r2 = _run(single_brain.handle_turn(sess, "yes, that's me"))
+        self.assertTrue(r2.returning_user_recalled)
+        self.assertEqual(sess.profile.age, 41,
+                         "stored profile not merged on explicit yes")
+
+    def test_declined_recall_not_reoffered(self):
+        sess = SessionState(session_id=f"b25n_{uuid.uuid4().hex[:8]}")
+        sess.profile.name = self.full
+        _run(single_brain.handle_turn(sess, "just me"))
+        self.assertTrue(sess.pending_profile_recall)
+        apply_pending_recall(sess, confirmed=False)
+        self.assertTrue(sess.recall_probe_done)
+        # A later turn must NOT re-stage the declined recall.
+        _run(single_brain.handle_turn(sess, "income 25L+"))
+        self.assertIsNone(getattr(sess, "pending_profile_recall", None),
+                          "#25: declined recall was re-offered")
+
+    def test_unknown_name_no_false_recall_later_turn(self):
+        sess = SessionState(session_id=f"b25u_{uuid.uuid4().hex[:8]}")
+        sess.profile.name = "Zzqxnobodyhasthis Lastname"
+        _run(single_brain.handle_turn(sess, "no pre-existing conditions"))
+        self.assertIsNone(getattr(sess, "pending_profile_recall", None))
+        self.assertNotIn("RETURNING-USER CHECK", self.sys_prompts[-1])
+
+
+class TestBug26ReconstructFromHistory(_FirstNameStoredFixture):
+    def _hist(self):
+        return [
+            {"role": "user", "content": "I want a health policy"},
+            {"role": "assistant", "content": "Sure — your name and age?"},
+            {"role": "user", "content": "Rohit, 29, Bangalore"},
+            {"role": "assistant", "content": "Thanks Rohit. Income band?"},
+        ]
+
+    def test_blank_session_with_history_triggers_reconstruction(self):
+        """Evicted/blank session BUT the client still carries the
+        conversation → STATE-RECOVERY MODE, not "What's your name?"."""
+        sess = SessionState(session_id=f"b26_{uuid.uuid4().hex[:8]}")
+        _run(single_brain.handle_turn(
+            sess, "income 25L+", chat_history=self._hist()))
+        self.assertTrue(
+            self.si_kwargs[-1].get("reconstruct_from_history"),
+            "#26: reconstruction not triggered for blank+history")
+        self.assertIn("STATE-RECOVERY MODE", self.sys_prompts[-1])
+        self.assertNotIn("lost some of your profile",
+                         self.sys_prompts[-1].lower())
+
+    def test_genuine_first_turn_no_reconstruction(self):
+        sess = SessionState(session_id=f"b26f_{uuid.uuid4().hex[:8]}")
+        _run(single_brain.handle_turn(sess, "I want a health policy"))
+        self.assertFalse(
+            self.si_kwargs[-1].get("reconstruct_from_history"),
+            "#26: false recovery on a genuine first turn")
+        self.assertNotIn("STATE-RECOVERY MODE", self.sys_prompts[-1])
+
+    def test_populated_session_no_reconstruction(self):
+        sess = SessionState(session_id=f"b26p_{uuid.uuid4().hex[:8]}")
+        sess.profile.name = "Asha"
+        sess.profile.age = 30
+        _run(single_brain.handle_turn(
+            sess, "income 25L+", chat_history=self._hist()))
+        self.assertFalse(
+            self.si_kwargs[-1].get("reconstruct_from_history"),
+            "#26: reconstruction wrongly fired on a populated session")
+
+
+if __name__ == "__main__":
+    unittest.main()