chore(cleanup): purge stale narrative/tombstones/dead code — codebase reads as the current standard

Comprehensive stale-content purge so code/docs read as if written correctly
from the start; history of record stays only in ADRs (70-docs/60-decisions),
KIs (80-audit), and the README.

Code (.py): removed mistake/removal/incident narration and tombstone
comments ("REMOVED/VESTIGIAL", dated fix-narration, "Z2 fix/W1 Turn/Priya/
Vikram", "the bug was", "used to ... → loop", "do NOT reintroduce"),
rewrote them as clean current-behavior comments; deleted the dead
SessionState._recall_sniff_done field (zero readers; in-memory-only,
verified safe); cleaned stale references to removed systems
(sales_brain/qa_brain/orchestrator) in comments, docstrings and a log
string. NO logic changed: 29/31 modified .py are AST-equal modulo
docstrings (provably comment-only); the other 2 are the verified-safe
field deletion + log/docstring string text only.

Docs: 70-docs/** + ARCHITECTURE.md rewritten to the current
single-LLM-with-tools standard (gemini-2.5-flash + save_profile_field/
retrieve_policies/mark_recommendation + small nim_fallback); removed
systems no longer described as live; historical eval/known-issues logs
carry accurate "superseded" banners. ADRs and KIs left verbatim.

Verified: full pytest gate green (rc=0, 0 failures) AFTER the purge;
AST-equivalence proves the code sweep is logic-preserving. Not pushed in
this commit's own step — guarded deploy follows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

70-docs/00-overview/roadmap.md

@@ -16,29 +16,36 @@
 
 v1 is a **vertical slice**: 10 insurers × Health × ~80 policies × voice-first advisor. The architecture is built so v2 is a **data/config change, not a rebuild**. This document maps the path.
 
-## 0.1 Recently shipped (2026-05-15)
-
-- **KI-167 / [ADR-039](../60-decisions/ADR-039-llm-driven-sales-brain.md)** — Ripped out `backend/fact_find_brain.py` + canonical_fallback + the `<FF>` trailer convention. Replaced with `backend/sales_brain.py` — one LLM call per turn using native provider JSON mode. No scripted prompts, multi-fact capture per turn, ~500 LOC deleted.
-- **KI-168** — Hybrid voice capture: Web Speech API streams interim transcripts for live UX feel while MediaRecorder runs in parallel; Sarvam STT is the authoritative transcript posted on browser silence-detect.
-- **KI-171** — Skip faithfulness judge on `fact_find` + `recommendation` intents (the judge has no retrieved context to grade against on those turns).
-- **KI-173 / KI-174** — Voice heartbeat + `visibilitychange` / `focus` revival hooks keep the mic alive across tab and app switches.
-- **KI-175 / KI-176** — NIM chain reorder (Nemotron 49B demoted to last resort), OpenRouter re-added as cross-provider diversity via `models: [...]` server-side fallback.
-- **KI-178 / KI-179 / [ADR-040](../60-decisions/ADR-040-google-gemini-primary.md)** — OpenRouter free-tier `response_format` audit; added Google AI Studio (Gemini 2.0 / 2.5 Flash, 1500 req/day free) as Tier 0 primary on Brain Fast + Brain Main.
+## 0.1 Architecture history (pointers only)
+
+> The 2026-05-15 work below (KI-167…KI-179, ADR-039/040) was an
+> intermediate step that was itself **subsequently superseded** by the
+> single-LLM-with-tools rewrite (one Gemini 2.5-flash call per turn with
+> `save_profile_field` / `retrieve_policies` / `mark_recommendation`,
+> structured+vector retrieval, small `nim_fallback`). KI/ADR pointers are
+> kept as history-of-record. Present-state authority:
+> [`README.md`](../../README.md) §4.
+
+- **KI-167 / [ADR-039](../60-decisions/ADR-039-llm-driven-sales-brain.md)** — Removed the scripted fact-find renderer + `<FF>` trailer convention (history; the later single-LLM-with-tools handler is the present design).
+- **KI-168** — Hybrid voice capture: Web Speech API streams interim transcripts for live UX feel while MediaRecorder runs in parallel; Sarvam STT is the authoritative transcript posted on browser silence-detect. (Still current.)
+- **KI-171** — Skipping the separate faithfulness judge on no-context turns (the separate judge LLM was later removed entirely; faithfulness is now structural).
+- **KI-173 / KI-174** — Voice heartbeat + `visibilitychange` / `focus` revival hooks keep the mic alive across tab and app switches. (Still current.)
+- **KI-175 / KI-176 / KI-178 / KI-179 / [ADR-040](../60-decisions/ADR-040-google-gemini-primary.md)** — Provider/chain work from the multi-model era (history; the present brain is a single Gemini 2.5-flash call per turn with a small NIM fallback for transient errors).
 
 ## 1. What v1 ships
 
 **Working product:**
-- Voice-first chat advisor over a curated corpus of Indian health insurance policies (~76 PDFs from 10 insurers, ingested into Chroma + DuckDB)
+- Voice-first chat advisor over a curated corpus of Indian health insurance policies (~76 PDFs from 10 insurers, ingested into Chroma)
 - Multi-language: English + Hindi/Hinglish via Sarvam Saarika STT + Sarvam Bulbul TTS
-- 3-tier brain chain (ADR-040, KI-179): Brain Fast (`backend/sales_brain.py`, fact-find) leads with **Gemini 2.0 Flash** (Google AI Studio, 1500 req/day free, native JSON mode) → NIM Qwen 80B / Mistral Large 3 675B / Llama-4 Maverick → OpenRouter `:free` (Nemotron-3-Super 120B, Qwen 80B) → NIM Nemotron 49B last resort. Brain Main (synthesis / comparison / recommendation) leads with **Gemini 2.5 Flash** → NIM Mistral 675B / Maverick / Qwen 80B → OR Nemotron-3-Super → NIM Nemotron 49B. Judge primary stays on **NIM Mistral Large 3 675B** (different family from the Gemini brain — preserves the cross-family invariant). Sticky-primary election (KI-080) per chain. Sarvam scoped to Indic translation + voice only.
-- 4-gate hallucination defense + auditable refusal log
+- **Single-LLM-with-tools brain:** one **Gemini 2.5-flash** call per turn with function-calling tools (`save_profile_field` / `retrieve_policies` / `mark_recommendation`) handling fact-find, retrieval, QA, and recommendation. Small `backend/nim_fallback.py` (NVIDIA NIM) covers transient Gemini errors so the turn completes; fail-loud otherwise. Sarvam scoped to Indic translation + voice only.
+- Structural faithfulness (the LLM can only cite what `retrieve_policies` returned; recommendation fit gated in `scorecard.py` / `retrieval_filters.py`) + auditable refusal log
 - 62-field structured extraction per policy
 - Clean Next.js + Tailwind frontend
-- FastAPI backend deployed on Render; frontend on Vercel
+- FastAPI backend deployed as a Hugging Face Space (Docker, `uvicorn`)
 - 8 design / decision documents totaling ~30 pages
 
 **Eval signal:**
-- Gold Q&A harness (~300 pairs targeted) + automated grader (the JUDGE_CHAIN with NIM Mistral Large 3 675B primary — different family from the Gemini brain so grading stays non-circular)
+- Gold Q&A harness (~300 pairs targeted) + automated offline grader using a judge model from a different family than the runtime Gemini brain (non-circular grading; eval-only, not a runtime gate)
 - `eval/results.md` versioned table per run
 - Live audit log `logs/hallucinations.jsonl` for every blocked claim
 
@@ -133,10 +140,10 @@ v1 is a **vertical slice**: 10 insurers × Health × ~80 policies × voice-first
 The point of disciplined v1 architecture is that these things are **stable** across the transition:
 
 1. **62-field structured schema** (`rag/schema.py`) — data-only change to add v2 categories
-2. **Provider abstraction** (`backend/providers/base.py`) — swap STT/TTS/LLM via config
-3. **Faithfulness verifier** (`backend/faithfulness.py`) — same 4 gates, possibly more
-4. **Persona prompt + citation grammar** — same, refined
-5. **Eval methodology** (`70-docs/03-eval-plan.md`) — same harness, more gold data
+2. **Provider abstraction** — swap STT/TTS/LLM via config
+3. **Structural faithfulness** — the brain can only cite what `retrieve_policies` returned; recommendation fit gated in `scorecard.py` / `retrieval_filters.py`
+4. **System prompt + citation grammar** — same, refined
+5. **Eval methodology** (`70-docs/40-evaluation/eval-methodology.md`) — same harness, more gold data
 
 The "c-readiness commitments" in Doc 02 §7 are the contract. Every v2 feature is a commitment honored.
 
@@ -146,7 +153,7 @@ The "c-readiness commitments" in Doc 02 §7 are the contract. Every v2 feature i
 | --- | --- | --- |
 | Streamlit → Next.js mid-build | Production polish for a BFSI reviewer | 2 extra hours of scaffolding |
 | Voyage embeddings → BGE local | Voyage 3 RPM rate limit blocked ingestion | Slightly lower retrieval quality (~3pp) for full corpus access |
-| IRDAI corpus deferred | Akamai bot protection; 4-gate faithfulness already refuses regulatory questions cleanly | Bot can't ground answers in IRDAI text — refuses instead of citing |
+| IRDAI corpus deferred | Akamai bot protection; structural faithfulness already refuses regulatory questions cleanly (the brain can only cite what `retrieve_policies` returned, and there are no IRDAI chunks) | Bot can't ground answers in IRDAI text — refuses instead of citing |
 | Push-to-talk over streaming | Risk of broken realtime > demo latency | 2-3s perceived latency vs <1s |
 | No auth | Out of scope per Doc 01 | Single-user demo only |
 | Hand-curated 5-node fact-find | Auditable + testable | Less natural than LLM-driven |

70-docs/10-architecture/safety-architecture.md

@@ -15,14 +15,20 @@
 > consolidation.
 >
 > **Current safety model (authoritative: [`README.md`](../../README.md) §6):**
-> faithfulness is now **structural** — the single Gemini brain can only state
-> what `retrieve_policies` returned and must cite; recommendation fit is gated
-> in `backend/scorecard.py` / `retrieval_filters.py`. The hardened surface is
-> the **8-gate uploaded-PDF defence in `backend/security.py`** (file
-> mechanics, content quality, prompt-injection, per-session + per-IP rate
-> limits, encrypted-PDF, page-ceiling, hash-dedupe) plus per-session
-> quarantine isolation with a 24 h TTL. Retained below only as the historical
-> failure-modes analysis that informed today's design.
+> faithfulness is now **structural** — the single Gemini 2.5-flash brain
+> (one call/turn with `save_profile_field` / `retrieve_policies` /
+> `mark_recommendation`) can only state what `retrieve_policies` returned
+> and must cite it; recommendation fit is gated in `backend/scorecard.py` /
+> `retrieval_filters.py`. There is **no separate faithfulness-judge LLM**,
+> no `orchestrator`, and no Brain-Fast/Brain-Main split. The hardened
+> surface is the **8-gate uploaded-PDF defence in `backend/security.py`**
+> (file mechanics, content quality, prompt-injection, per-session + per-IP
+> rate limits, encrypted-PDF, page-ceiling, hash-dedupe) plus per-session
+> quarantine isolation with a 24 h TTL. A small `backend/nim_fallback.py`
+> (NVIDIA NIM) only covers transient Gemini errors so the turn still
+> completes. **Everything below this banner is the historical failure-modes
+> analysis that informed today's design — the per-mode "Status: Live"
+> lines describe the pre-rewrite system, not the present one.**
 
 ## 0. Purpose
 
@@ -207,5 +213,5 @@ Run-time. Auditable. Tested.
 | M-07 | Nightly synthetic eval cron | Infra | v2 |
 | M-08 | Live-traffic spot grading | Eval | v2 |
 | M-09 | 3-judge consensus for grader | Eval | v2 |
-| M-10 | Sarvam-M no longer brain — Gemini 2.0 / 2.5 Flash primary on Brain Fast / Brain Main, NIM fallback | Orchestrator (ADR-040) | Live ✅ |
-| M-11 | Faithfulness 4-gate verifier | Orchestrator | Live ✅ |
+| M-10 | Sarvam-M scoped to Indic translation only; brain is one Gemini 2.5-flash call/turn with tools, small `nim_fallback` for transient errors | single_brain | Live ✅ |
+| M-11 | Structural faithfulness (LLM can only cite what `retrieve_policies` returned; recommendation fit gated in `scorecard.py` / `retrieval_filters.py`) — the separate 4-gate judge was removed | single_brain | Live ✅ (superseded the 4-gate judge) |

70-docs/10-architecture/scoring-methodology.md

@@ -1,10 +1,11 @@
 # Scorecard Methodology — From 62 Schema Fields to a Single A-F Grade
 
-> ⚠️ **Predates the single-brain rewrite — not the present-state map.** Some
-> implementation references here (orchestrator / `sales_brain` / 3-tier chain
-> / `faithfulness.py` judge) describe code that was removed. Present-state
-> authority: [`README.md`](../../README.md) §4. Retained for design intent /
-> historical record.
+> ℹ️ **Methodology is current.** The scorecard is rules-based and
+> LLM-free; the grading logic below (`backend/scorecard.py`) is the
+> present-state design, including the profile-tuned weights used by the
+> single-LLM-with-tools handler when it recommends policies. The only
+> historical pointer is the one-off extraction pipeline noted in §1.
+> Present-state authority: [`README.md`](../../README.md) §4.
 
 | Field | Value |
 | --- | --- |
@@ -64,7 +65,7 @@ A small number of fields exist because they materially affect buyer outcomes eve
 
 ### How we did it (the actual code path)
 
-`rag/extract.py` calls the fast-brain chain (Nemotron Nano 30B primary, Qwen 80B / GPT-OSS / Groq fallbacks) with the full policy PDF text and the 62-field Pydantic schema as a structured-output target. The LLM extracts each field; if a field is not explicitly stated in the document, it is set to `null`. A self-critique pass scores per-field confidence (the `extraction_confidence_pct` field).
+`rag/extract.py` runs a one-time offline extraction: an LLM is given the full policy PDF text and the 62-field Pydantic schema as a structured-output target. The LLM extracts each field; if a field is not explicitly stated in the document, it is set to `null`. A self-critique pass scores per-field confidence (the `extraction_confidence_pct` field). This is a build-time pipeline, separate from the runtime single-LLM-with-tools handler.
 
 The full schema lives in `rag/schema.py` (see also `rag/SCHEMA.md` for groupings and gotchas).
 

70-docs/10-architecture/stack-rationale.md

@@ -25,11 +25,15 @@ place so it cannot drift again:
 
 - **Frontend:** Next.js 16 (App Router), React 19, Tailwind v4, static export.
 - **Backend:** FastAPI + Pydantic; `uvicorn`, port 7860 on the HF Space.
-- **Brain:** Google **Gemini `gemini-2.5-flash-lite`** + function calling
-  (one call/turn) → **NVIDIA NIM** open-model fallback chain (health-elected,
-  fail-loud). No separate judge model (retired in the single-brain
-  consolidation).
-- **Retrieval:** Chroma + BGE-small-en-v1.5 (local CPU, 384-d).
+- **Brain:** Google **Gemini `gemini-2.5-flash`** + function-calling tools
+  (`save_profile_field` / `retrieve_policies` / `mark_recommendation`), one
+  call/turn handling fact-find, retrieval, QA, and recommendation. On a
+  transient Gemini error → small **NVIDIA NIM** fallback
+  (`backend/nim_fallback.py`) so the turn completes; fail-loud otherwise. No
+  separate judge model, no orchestrator, no sales/QA-brain split (all
+  retired in the single-LLM-with-tools consolidation).
+- **Retrieval:** structured + vector over Chroma + BGE-small-en-v1.5 (local
+  CPU, 384-d) with a profile-tuned scorecard.
 - **Voice:** Sarvam Saarika (STT) + Bulbul (TTS) + Sarvam-M (Indic).
 - **Hosting:** Hugging Face Space (Docker) + companion HF dataset for
   corpus/vectors; **not** Vercel/Render (that was the old plan).

70-docs/10-architecture/system-overview.md

@@ -12,10 +12,12 @@
 ## This document has been superseded
 
 The earlier version of this file described the **pre-rewrite** architecture
-(an `orchestrator.py`, a `sales_brain`/`QA-brain` split, a 4-gate
-`faithfulness.py` judge, a 3-tier Gemini/NIM/OpenRouter chain, a DuckDB
-62-field hot path, Next.js 14, Vercel/Render hosting). **None of that exists
-in the codebase anymore** — it was replaced by the single-brain rewrite.
+(an `orchestrator.py`, a `sales_brain`/`QA-brain` split, a 3-brain design,
+a separate `faithfulness.py` judge LLM, a `profile_extractor`, a tiered
+brain, a translation-check pass, a 3-tier Gemini/NIM/OpenRouter chain, a
+DuckDB 62-field hot path, Next.js 14, Vercel/Render hosting). **None of
+that exists in the codebase anymore** — it was replaced by the
+single-LLM-with-tools rewrite.
 
 To prevent two documents drifting apart again, there is now exactly **one**
 authoritative architecture description:
@@ -28,12 +30,16 @@ authoritative architecture description:
 
 ## Current architecture in three lines
 
-- One LLM call per turn: **Gemini `gemini-2.5-flash-lite` + function-calling
-  tools** (`backend/single_brain.py`, `brain_tools.py`); on Gemini failure →
-  `backend/nim_fallback.py` (NVIDIA NIM chain, health-elected, fail-loud).
-- Retrieval: **Chroma + BGE-small local 384-d** (`rag/retrieve.py`); shared
-  policies collection + per-session 24h quarantine for user-uploaded PDFs
-  (8 security gates in `backend/security.py`).
+- One LLM call per turn: **Gemini `gemini-2.5-flash` + function-calling
+  tools** (`save_profile_field` / `retrieve_policies` /
+  `mark_recommendation`) in `backend/single_brain.py` / `brain_tools.py`.
+  A single call drives fact-find, retrieval, QA, and recommendation. On a
+  transient Gemini error → small `backend/nim_fallback.py` (NVIDIA NIM) so
+  the turn completes. Fail-loud.
+- Retrieval: **structured + vector over Chroma + BGE-small local 384-d**
+  (`rag/retrieve.py`) with a profile-tuned scorecard; shared policies
+  collection + per-session 24h quarantine for user-uploaded PDFs (8
+  security gates in `backend/security.py`).
 - **Next.js 16 / FastAPI**, deployed as an HF Space (Docker, `uvicorn`,
   port 7860); heavy data pulled at build from the `insurance-bot-data` HF
   dataset; curated facts in `40-data/`.

70-docs/30-engineering/discovery-script.md

@@ -1,10 +1,12 @@
 # Discovery Conversation Script
 
-> ⚠️ **Predates the single-brain rewrite — not the present-state map.** Some
-> implementation references here (orchestrator / `sales_brain` / 3-tier chain
-> / `faithfulness.py` judge) describe code that was removed. Present-state
-> authority: [`README.md`](../../README.md) §4. Retained for design intent /
-> historical record.
+> ⚠️ **Design intent, not the present-state map.** The turn-by-turn script
+> and adaptive rules below capture the discovery *intent*; the implementation
+> is now a single Gemini 2.5-flash call per turn with function-calling tools
+> (`backend/single_brain.py` / `brain_tools.py`) — there is no scripted
+> question renderer, no `orchestrator`, no `sales_brain` / `qa_brain` split,
+> and no separate faithfulness judge. Present-state authority:
+> [`README.md`](../../README.md) §4.
 
 The 10-turn fact-find that turns a stranger into a profiled buyer.
 
@@ -135,13 +137,13 @@ This is the customer-protection framing. It tells the user honesty is **self-pro
 
 ## Implementation notes
 
-The 9-slot fact-find SCHEMA still lives in `backend/needs_finder.py::GRAPH` — used now as the schema source for the `sales_brain` LLM system prompt rather than as a scripted question list. Each entry's `id`, `field`, `is_core`, and `condition` are consumed by the LLM as a structured contract; the `prompt_en` / `prompt_hi` strings are no longer rendered to the user post-[ADR-039](../60-decisions/ADR-039-llm-driven-sales-brain.md) / KI-167 (the LLM owns voice + cadence end-to-end via its system prompt + the conversation so far).
+The 9-slot fact-find SCHEMA still lives in `backend/needs_finder.py::GRAPH` — used now as the schema source embedded in the single-LLM system prompt rather than as a scripted question list. Each entry's `id`, `field`, `is_core`, and `condition` are consumed by the LLM as a structured contract; the `prompt_en` / `prompt_hi` strings are no longer rendered to the user (the LLM owns voice + cadence end-to-end via its system prompt + the conversation so far, and records facts through the `save_profile_field` tool).
 
 To add a new question:
 
 1. Add a `Question(...)` entry with `id`, `field` (which Profile attribute it sets), `is_core` (boolean — counts toward completeness), optional `condition` callable, optional `parser`.
-2. Surface the new slot in the `sales_brain` system prompt's 9-slot schema (alongside accepted value shapes + examples) so the LLM knows to capture it. See `backend/sales_brain.py::_SYSTEM_PROMPT`.
-3. Wire any post-capture validation into `backend/sales_brain_normalizer.py` (enum coercion, INR parsing, bounds).
+2. Surface the new slot in the single-brain system prompt's 9-slot schema (alongside accepted value shapes + examples) so the LLM knows to capture it. See the system prompt in `backend/single_brain.py`.
+3. Wire any post-capture validation into the `save_profile_field` handler in `backend/brain_tools.py` (enum coercion, INR parsing, bounds).
 4. Add a row in `70-docs/scorecard-knowledge-graph.md` Part B showing how the new input shifts weights.
 5. Wire the shift into `_profile_tuned_weights()` in `backend/scorecard.py`.
 

70-docs/30-engineering/needs-analysis-flow.md

@@ -1,35 +1,38 @@
-# 05 — Needs Analysis Flow (LLM-driven sales brain)
+# 05 — Needs Analysis Flow (single-LLM-with-tools)
 
 | Field | Value |
 | --- | --- |
 | Project | Insurance Sales Portfolio Expert |
-| Version | 0.2 |
+| Version | 0.3 |
 | Date | 2026-05-17 |
-| Implementation | `backend/single_brain.py` (single-brain rewrite — replaced the removed `backend/sales_brain.py`). The slot schema still lives in `backend/needs_finder.py::GRAPH`. |
+| Implementation | `backend/single_brain.py` + `backend/brain_tools.py`. The slot schema still lives in `backend/needs_finder.py::GRAPH`. |
 
-> ℹ️ **Still conceptually accurate, one pointer updated.** The core design
-> below — *one LLM call per turn owns the entire fact-find surface* — is
-> exactly what `backend/single_brain.py` does today; only the module name
-> changed (`sales_brain.py` → `single_brain.py`, which also subsumes QA +
-> recommendation). Present-state authority: [`README.md`](../../README.md) §4.
+> ℹ️ **Design intent below is still accurate; implementation pointers
+> updated.** The core idea — *one LLM call per turn owns the entire
+> fact-find surface* — is what the single-LLM-with-tools handler does
+> today. Fact-find, retrieval, QA, and recommendation are all handled in
+> that one call via function-calling tools; the separate `sales_brain` /
+> `qa_brain` split, the orchestrator, the profile_extractor, and the
+> separate faithfulness judge were removed. Present-state authority:
+> [`README.md`](../../README.md) §4.
 
 ## 0. Why one LLM call per turn (not "scripted question graph + paraphraser")
 
 A good Independent Financial Advisor opens with a stable, repeatable set of slots to fill — and adapts which slot to drive next based on what the buyer just said, what they've already told us, and what's still missing. We replicate this with **one LLM call per turn** that owns the entire fact-find surface (voice, cadence, slot-selection, multi-fact capture in a single turn), not a hardcoded state machine with a paraphraser glued on top.
 
-The original v0.1 of this doc was an explicit `GRAPH` of canonical questions with `prompt_en` / `prompt_hi` strings. That design shipped with ADR-027 (LLM paraphraser on top of the graph) and ADR-030 (one-call brain with `<FF>` trailer + canonical fallback). Both architectures hit a hard wall: scripted prompts leaked into every fallback turn ("Got that — {slot}.") and produced robotic cadence even when the brain succeeded. KI-167 / [ADR-039](../60-decisions/ADR-039-llm-driven-sales-brain.md) ripped it all out: no canonical_fallback, no scripted prompts, no `<FF>` trailer. Native provider JSON mode (`response_mime_type=application/json` on Gemini, `response_format={"type":"json_object"}` on NIM) provides server-side parseable output.
+The original v0.1 of this doc was an explicit `GRAPH` of canonical questions with `prompt_en` / `prompt_hi` strings, rendered by a scripted state machine. That scripted approach (and a later one-call-brain variant with a structured trailer + canonical fallback) produced robotic cadence: scripted prompts leaked into fallback turns. The current design removes all of that. There are no scripted prompts and no canonical fallback. One **Gemini 2.5-flash call per turn with function-calling** owns voice, cadence, and slot selection; the `GRAPH` is consulted only as the slot *schema*.
 
 What we kept and what we changed:
 
-| Concern | v0.1 (scripted graph) | Current (LLM-driven sales_brain) |
+| Concern | v0.1 (scripted graph) | Current (single LLM + tools) |
 |---|---|---|
 | **Slot schema** | `GRAPH` of 9 `Question(id, prompt_en, prompt_hi, field, is_core, condition, parser)` entries | `GRAPH` data structure retained as the schema source; `prompt_en` / `prompt_hi` are dead strings now |
 | **Question text** | Hardcoded `prompt_en` rendered to user | LLM generates natural prose in the advisor's voice per turn (no template) |
-| **Slot selection** | `next_question(profile)` walked the graph in order | LLM picks `slot_driving` in its JSON response (constrained by the schema to required slots first) |
-| **Multi-fact capture** | One slot per turn (a user saying "I'm 32, just myself, in Mumbai" only filled `age`) | LLM emits a `captures` map per turn — one utterance can fill 2-4 slots |
-| **Auditable behavior** | Graph order was the trace | Per-turn LLM response is logged (intent, brain_used, captures, slot_driving, complete) in `40-data/llm_usage.jsonl` + `logs/turns.jsonl` |
-| **Fail-soft** | Graph survived LLM degradation | Outer 25s `asyncio.wait_for` on the brain call; on total NIM + Google exhaustion the orchestrator returns the [ADR-038](../60-decisions/ADR-038-nim-only-chains.md) graceful error message to the user — no scripted reply |
-| **Bilingual** | Hand-authored `prompt_en` + `prompt_hi` | Sarvam-M translation cascade on the LLM's output (English authoring + Indic translation), same UX, fewer hand-authored strings |
+| **Slot selection** | `next_question(profile)` walked the graph in order | The single LLM decides which slot to drive next from the schema + conversation so far (required slots first) |
+| **Multi-fact capture** | One slot per turn (a user saying "I'm 32, just myself, in Mumbai" only filled `age`) | One utterance can fill 2-4 slots; the LLM calls `save_profile_field` per captured fact |
+| **Auditable behavior** | Graph order was the trace | Per-turn LLM call + tool calls are logged (`save_profile_field` / `retrieve_policies` / `mark_recommendation`) in `40-data/llm_usage.jsonl` + `logs/turns.jsonl` |
+| **Fail-soft** | Graph survived LLM degradation | On a transient Gemini error the small `backend/nim_fallback.py` (NVIDIA NIM) completes the turn; fail-loud otherwise — no scripted reply |
+| **Bilingual** | Hand-authored `prompt_en` + `prompt_hi` | Sarvam-M translation on the LLM's output (English authoring + Indic translation), same UX, fewer hand-authored strings |
 
 ## 1. The 9-slot schema (data-only — the LLM consults this through its system prompt)
 
@@ -87,53 +90,35 @@ What we kept and what we changed:
 
 ## 2. Termination criteria
 
-The LLM sets `complete: true` in its JSON response when all required slots are filled. `backend/sales_brain_normalizer.py` double-checks: if `complete == true` while any required slot is empty, the normalizer overrides to `complete = false` — the LLM cannot prematurely declare fact-find done.
+Fact-find is "done" when all required slots are filled. Because the single LLM owns the whole turn, it stops asking discovery questions and moves to retrieval/recommendation once the profile is sufficiently complete; required-slot checks against the `GRAPH` schema keep it from declaring done prematurely.
 
-Or when the user opts out — if the user immediately asks "compare Star and HDFC ERGO" or "show me the top 3 policies for me" (KI-105 closer phrases), the intent classifier forces intent to `comparison` / `recommendation` BEFORE the fact-find branch is even reached, and the orchestrator routes straight to retrieval + Brain Main.
+The user can also opt out — if the user immediately asks "compare Star and HDFC ERGO" or "show me the top 3 policies for me", the same LLM call can skip remaining discovery and go straight to `retrieve_policies` / `mark_recommendation` within that turn.
 
 ## 3. Bilingual handling
 
 The LLM authors in English; Sarvam-M translates Hinglish ↔ English at the cascade boundary. The "Indic-native, not translated" principle (problem-statement §5.3) is preserved by the LLM's native-quality output rather than by hand-authored Hindi strings — the cascade itself is the bilingual surface.
 
-## 4. Parsing user answers
+## 4. Capturing user answers
 
-The LLM produces a `captures` map per turn (e.g. `{"age": 34, "dependents": "self", "location_tier": "metro"}`). `backend/sales_brain_normalizer.py` is a pure-function post-processor that:
+When the user states a fact, the LLM calls the `save_profile_field` tool (e.g. `save_profile_field(field="age", value=34)`). The tool implementation in `backend/brain_tools.py` is a pure-function handler that:
 
 - Resolves field-name aliases (`location` → `location_tier`)
 - Coerces enums (`Bangalore` → `metro`)
 - Parses INR amounts (`"32 lakh"` → `3200000`)
-- Drops null / empty values (KI-094 None-guard — a `None` capture never overwrites a filled field)
+- Drops null / empty values (a `None`/empty value never overwrites a filled field)
 - Validates types and bounds (rejects `age: 250`)
 
-No LLM calls in the normalizer — pure rules. The orchestrator applies the normalized map via `session.update_profile_field()` exactly as before. Profile persistence remains unchanged (`backend/profile_store.save_profile()` + `backend/profile_rag.upsert_profile_chunk()` with session-scoped metadata per KI-102).
-
-## 5. How the orchestrator uses this
-
-```python
-profile = Profile.from_session(session_id)
-
-if intent == "fact_find":
-    # KI-167: one LLM call per turn against FAST_BRAIN_CHAIN
-    outcome = await sales_brain.drive_sales_turn(
-        profile=profile,
-        history=session.chat_history[-N:],
-        user_text=user_text,
-    )
-    # outcome.reply, outcome.captures, outcome.slot_driving, outcome.complete
-    apply_normalized_captures(session, outcome.captures)
-    if outcome.complete:
-        session.free_form_session = True
-    reply = outcome.reply
-else:
-    # QA / comparison / recommendation → Brain Main
-    chunks = retrieve(user_query, top_k=10)
-    reply = await BRAIN_CHAIN.chat(persona_prompt + history + chunks + user_text)
-    if intent not in {"fact_find", "recommendation"}:
-        # KI-171: judge skipped on fact-find + recommendation intents
-        verdict = await faithfulness.check(reply, chunks)
-        if not verdict.supported:
-            reply = SAFE_REFUSAL
-```
+The handler is pure rules — no nested LLM call. Captured fields are persisted to the session profile.
+
+## 5. How the single LLM uses this
+
+There is no separate orchestrator / intent-classifier / sales-brain split. One `single_brain` call per turn receives the system prompt (which embeds the slot schema), the recent history, and the user's text, and uses function-calling tools to do everything in that one turn:
+
+- `save_profile_field` — record a captured fact (fact-find).
+- `retrieve_policies` — structured + vector retrieval over the corpus when the turn needs policy evidence (QA / comparison / recommendation).
+- `mark_recommendation` — record the policies the LLM recommends, surfaced with the profile-tuned scorecard.
+
+Because the LLM can only answer from what `retrieve_policies` returned and must cite it, grounding is structural — there is no separate faithfulness-judge LLM in the loop. On a transient Gemini error, `backend/nim_fallback.py` completes the turn.
 
 ## 6. What the user sees
 
@@ -159,14 +144,13 @@ Bot: "Great — that's everything I need. Based on your profile, three policies
       stand out: [...]"
 ```
 
-Note: the LLM captured `{name, age, dependents, location_tier}` in a single turn from the user's opener. Pre-KI-167 each fact required its own turn. The exact turn count varies — some sessions finish in 3-4 turns, others in 6-7 depending on what the user volunteers.
+Note: the LLM captured `{name, age, dependents, location_tier}` in a single turn from the user's opener via `save_profile_field` calls. The exact turn count varies — some sessions finish in 3-4 turns, others in 6-7 depending on what the user volunteers.
 
 ## 7. v2 enhancements
 
 | # | Enhancement | Why |
 | --- | --- | --- |
-| 1 | Stream the prose token-by-token to the frontend | The JSON tail is parsed server-side after stream completion — would cut perceived latency below the canonical-fallback path |
-| 2 | Promote the same single-call pattern to the QA path | Orchestrator's QA + fact-find branches collapse into one brain call with a richer schema (intent in the JSON block instead of out-of-band classification) |
-| 3 | Skip-confirm flow ("you can skip this — say 'skip'") | Buyer autonomy |
-| 4 | Save profile across sessions ✅ shipped KI-040 | Returning user picks up where they left off |
-| 5 | Tone-match the user's energy (formal vs casual) | The LLM already does this implicitly via the system prompt; could be explicit per-session signal |
+| 1 | Stream the prose token-by-token to the frontend | Cuts perceived latency on longer replies |
+| 2 | Skip-confirm flow ("you can skip this — say 'skip'") | Buyer autonomy |
+| 3 | Save profile across sessions ✅ shipped KI-040 | Returning user picks up where they left off |
+| 4 | Tone-match the user's energy (formal vs casual) | The LLM already does this implicitly via the system prompt; could be explicit per-session signal |

70-docs/40-evaluation/eval-methodology.md

@@ -1,17 +1,21 @@
 # 03 — Evaluation Plan
 
-> ⚠️ **Predates the single-brain rewrite — not the present-state map.** Some
-> implementation references here (orchestrator / `sales_brain` / 3-tier chain
-> / `faithfulness.py` judge) describe code that was removed. Present-state
-> authority: [`README.md`](../../README.md) §4. Retained for design intent /
-> historical record.
+> ⚠️ **Methodology is current; some implementation pointers are historical.**
+> The gold-set construction, grader signals, and metrics below still
+> describe how we evaluate the bot. But the *system under test* is now the
+> single-LLM-with-tools handler (`backend/single_brain.py` — one Gemini
+> 2.5-flash call per turn with `save_profile_field` / `retrieve_policies` /
+> `mark_recommendation`, structured+vector retrieval, small
+> `nim_fallback.py` for transient errors). There is no `orchestrator`, no
+> `sales_brain`/`qa_brain` split, no separate faithfulness-judge LLM, and no
+> DuckDB hot path. Present-state authority: [`README.md`](../../README.md) §4.
 
 | Field | Value |
 | --- | --- |
 | Project | Insurance Sales Portfolio Expert |
 | Version | 0.1 |
 | Date | 2026-05-13 |
-| Depends on | `01-requirements.md` §6 (success criteria), `02-architecture.md` (system under test) |
+| Depends on | `01-requirements.md` §6 (success criteria); README §4 (system under test) |
 | Status | Pipeline implemented; full run pending corpus completion |
 
 ## 0. Purpose
@@ -28,7 +32,7 @@ These directly back the success criteria in Doc 01 §6: C2 (≥95% factual), C3
 
 ### Pipeline A — auto-generated from structured extraction (the bulk)
 
-For every successfully extracted policy in DuckDB, generate templated Q&A where the answer comes directly from the 62-field schema. Per `eval/generate_gold.py`:
+For every successfully extracted policy, generate templated Q&A where the answer comes directly from the 62-field structured extraction. Per `eval/generate_gold.py`:
 
 - ~15 question templates × ~80 policies = ~1,100 candidate pairs
 - Each pair is **fully reproducible** — the answer traces to a specific field which traces to a specific clause
@@ -38,7 +42,7 @@ For every successfully extracted policy in DuckDB, generate templated Q&A where
 
 ### Pipeline B — LLM-drafted nuanced questions (curated)
 
-For top-priority policies (top 10–20), run `NimChainLLM(BRAIN_CHAIN)` on the policy text with prompt: *"generate 5 buyer-style questions whose answers are explicitly in this document; include the source clause."* Each generated pair is **human spot-checked** before commit.
+For top-priority policies (top 10–20), run an LLM on the policy text with prompt: *"generate 5 buyer-style questions whose answers are explicitly in this document; include the source clause."* Each generated pair is **human spot-checked** before commit.
 
 Target: 5 × 20 = 100 questions covering multi-clause and edge-case reasoning that Pipeline A can't generate.
 
@@ -56,15 +60,15 @@ Each pair marked with `expected_refusal: bool`. Refusal cases test that the bot
 
 ## 2. Grader design
 
-**Single grading endpoint:** `eval/run.py` calls `backend.orchestrator.handle_turn` in-process, takes the reply, scores against gold with three signals:
+**Single grading endpoint:** `eval/run.py` calls the single-LLM-with-tools turn handler (`backend/single_brain.py`) in-process, takes the reply, scores against gold with three signals:
 
 ### Signal 1 — Regex hard-checks (deterministic)
 
 Numbers, dates, currency, durations, percentages are extracted via regex from both gold and bot reply. Exact match (after normalization) is the strongest signal. Catches "the premium is ₹15,000" hallucinations without an LLM.
 
-### Signal 2 — LLM-judge faithfulness (JUDGE_CHAIN: NIM Mistral Large 3 675B primary)
+### Signal 2 — LLM-judge faithfulness (offline eval grader only)
 
-Different model family from the Gemini-led Brain Fast / Brain Main → **non-circular evaluation**. Falls through NIM Llama-4 Maverick → OR Qwen 80B `:free` → NIM Nemotron 49B as last resort. Judge prompt:
+The eval grader uses a **different model family** from the runtime Gemini 2.5-flash brain → **non-circular evaluation**. This judge is part of the *offline eval harness only* — it is not a runtime gate in the bot (runtime grounding is structural: the single LLM can only state what `retrieve_policies` returned and must cite it). Judge prompt:
 
 > Given GOLD and BOT answers, output strict JSON: `{factual_match: bool, citation_present: bool, score: 0-1, reason: str}`. Be strict on partial matches.
 
@@ -82,11 +86,11 @@ Different model family from the Gemini-led Brain Fast / Brain Main → **non-cir
 | Citation accuracy | C3 ≥ 95% | n_correct_citations / n_non_refusal |
 | Refusal precision | C4 ≥ 90% | n_correct_refusals / n_expected_refusals |
 | Hindi parity | C8 within 5pp | factual_acc(hi) vs factual_acc(en) |
-| Brain winners | (router config) | factual_acc grouped by `brain_used` — emitted values include `sales_brain::continue`, `sales_brain::complete`, `brain_main::<elected_model>`, `brain_main::graceful_error` |
+| Path winners | (config) | factual_acc grouped by which path produced the turn — `gemini` (primary single-LLM call) vs `nim_fallback` (transient-error fallback) |
 
 ## 4. Output artifacts per run
 
-- `eval/results.md` — human-readable summary with per-type, per-brain accuracy + sample misses
+- `eval/results.md` — human-readable summary with per-type, per-path accuracy + sample misses
 - `eval/results.json` — machine-readable full per-question record
 - `logs/hallucinations.jsonl` — every blocked reply with its reason (audit log)
 
@@ -96,8 +100,8 @@ Different model family from the Gemini-led Brain Fast / Brain Main → **non-cir
 | --- | --- | --- |
 | Development | Manual, after meaningful changes | `python -m eval.run` |
 | Pre-deploy | Every PR | GitHub Actions runs eval, blocks merge if accuracy regresses |
-| Production | Nightly synthetic + spot-grading | Cron via Render scheduled job; live-traffic sampling via Playwright |
-| Post-deploy verification | Per deploy | `tests/live_verify.py` runs full eval against live Vercel URL |
+| Production | Nightly synthetic + spot-grading | Scheduled job; live-traffic sampling via Playwright |
+| Post-deploy verification | Per deploy | `tests/live_verify.py` runs full eval against the live HF Space URL |
 
 ## 6. Bilingual eval
 
@@ -106,6 +110,6 @@ Bilingual sub-set: 20 questions translated to Hindi + Hinglish via Sarvam-M with
 ## 7. Known limitations (transparent)
 
 - **Sample bias:** Pipeline A questions are templated, so accuracy on Pipeline A is upper-bound real-world performance. Pipeline B + C provide the harder signal.
-- **Single judge model:** NIM Mistral Large 3 675B is the elected judge primary; the fallback ladder includes Llama-4 Maverick + OR Qwen 80B + NIM Nemotron 49B for resilience but every grade run uses a single judge per question. Risk of judge-specific bias. v2: 3-judge consensus.
+- **Single judge model:** the offline eval grader uses one judge model (a different family from the runtime Gemini brain) per question. Risk of judge-specific bias. v2: 3-judge consensus.
 - **No human evaluation:** Cost-prohibitive for 1,100 questions. We rely on the grader; manual spot-check 5%.
 - **No latency budget enforcement in eval:** Latency is captured per record but doesn't gate the score. Doc 01 C1 (p50 ≤ 4s) is monitored separately.

70-docs/40-evaluation/known-issues.md

@@ -1,5 +1,16 @@
 # Known Issues + Quality Sprint Log
 
+> ⚠️ **Historical defect log — not the present-state map.** Entries below
+> are dated incidents; many reference subsystems (`orchestrator`,
+> `faithfulness.py` judge, `fact_find_brain` / `sales_brain`,
+> `fact_find_normalizer`, the 3-tier Gemini/NIM/OpenRouter chain,
+> sticky-primary election) that were **subsequently removed** by the
+> single-LLM-with-tools rewrite (one Gemini 2.5-flash call per turn with
+> `save_profile_field` / `retrieve_policies` / `mark_recommendation`,
+> structured+vector retrieval, small `nim_fallback`). The log is retained
+> as the quality trajectory of record; KI/ADR cross-references stay valid as
+> history. Present-state authority: [`README.md`](../../README.md) §4.
+
 Living document. Every defect we find — whether via code review, eval audit,
 or production observation — lands here with severity, root cause, and the
 plan to fix it. Closed issues stay in the log with a `**FIXED in <sha>**`

70-docs/40-evaluation/quality-sprint-2026-05-14.md

@@ -1,5 +1,15 @@
 # Quality Sprint — 2026-05-14
 
+> ⚠️ **Historical sprint log — not the present-state map.** This records
+> dated quality work; the architecture described mid-log (`sales_brain` /
+> `fact_find_brain` / orchestrator / separate faithfulness judge / 3-tier
+> Gemini-2.0/2.5 + NIM/OpenRouter chain / sticky-primary election) was
+> subsequently superseded by the single-LLM-with-tools rewrite (one Gemini
+> 2.5-flash call per turn with `save_profile_field` / `retrieve_policies` /
+> `mark_recommendation`, structured+vector retrieval, small `nim_fallback`).
+> KI/ADR pointers below remain valid as history-of-record. Present-state
+> authority: [`README.md`](../../README.md) §4.
+
 One-day sprint focused on hardening the non-speech parts of the bot via
 code review, large-scale audit simulation, and real user-testing
 feedback. Every defect found in the same day shipped a fix in the same

ARCHITECTURE.md

@@ -19,13 +19,15 @@ authority.
   `/api/coverage`, `/api/profile*`, `/api/scorecard`, `/api/session*`,
   `/api/admin/*`.
 - **Brain** — one LLM call per turn: Google Gemini
-  (`gemini-2.5-flash-lite`) + function-calling tools
-  (`backend/single_brain.py`, `backend/brain_tools.py`). On Gemini
-  failure / cold-start 503 → `backend/nim_fallback.py` (NVIDIA NIM chain,
-  health-probed sticky-primary election in `backend/llm_health.py`).
-  Fail-loud, never silently wrong. The legacy multi-pass design
-  (orchestrator / sales-brain / QA-brain / faithfulness-judge) was removed —
-  it does not exist in the codebase.
+  (`gemini-2.5-flash`) + function-calling tools
+  (`save_profile_field`, `retrieve_policies`, `mark_recommendation`) in
+  `backend/single_brain.py` / `backend/brain_tools.py`. A single call owns
+  the whole turn: fact-find, retrieval, QA, and recommendation. On a
+  transient Gemini error / cold-start 503 → small `backend/nim_fallback.py`
+  (NVIDIA NIM) so the turn still completes. Fail-loud, never silently wrong.
+  The legacy multi-pass design (orchestrator / sales-brain / QA-brain /
+  separate faithfulness judge / profile_extractor / tiered brain) was
+  removed — it does not exist in the codebase.
 - **Retrieval** — Chroma vector store, BGE-small-en-v1.5 local 384-d
   embeddings (`rag/retrieve.py`). Shared "policies" collection (~150 plans,
   ~7.3k chunks, 20 insurers) + a per-session "quarantine" collection for

backend/admin.py

@@ -13,10 +13,10 @@ Setup:
   Add to Space secrets (Settings → Variables and secrets):
     ADMIN_PASSWORD = your-strong-password-here
 
-Returns 401 Unauthorized on bad/missing password. The earlier IP allowlist
-gate (ADMIN_IP_ALLOWLIST + 404-to-hide-existence) was removed in KI-097
-because it added operational complexity (changing networks → locked out)
-without meaningful additional security beyond a strong password.
+Returns 401 Unauthorized on bad/missing password. Access is gated by a
+strong password only; there is no IP allowlist (it would add operational
+complexity — changing networks would lock the operator out — without
+meaningful additional security).
 """
 from __future__ import annotations
 
@@ -67,18 +67,15 @@ def _password_ok(supplied: Optional[str]) -> bool:
 
 
 def _check_admin(request: Request, password: Optional[str]) -> None:
-    """KI-097 — password-only gate. Raises 401 on bad/missing password.
+    """Password-only gate. Raises 401 on bad/missing password.
 
-    `request` is kept in the signature so callsites don't churn, but the
-    function no longer inspects the client IP. Earlier dual-gate behavior
-    (IP allowlist + 404-to-hide-existence) was removed in KI-097.
+    `request` is kept in the signature so callsites don't churn; the
+    function does not inspect the client IP.
     """
-    # TODO: enforce IP allowlist for hardening — verified 2026-05-15 that
-    # ADMIN_IP_ALLOWLIST is not configured on the HF Space (rohitsar567/
-    # InsuranceBot). Gate is password-only, which is acceptable for the
-    # current threat model per KI-097, but a future hardening pass should
-    # re-introduce an IP allowlist as a second factor (with a documented
-    # break-glass procedure so a network change doesn't lock ops out).
+    # TODO: enforce an IP allowlist as a second factor for hardening (with
+    # a documented break-glass procedure so a network change doesn't lock
+    # ops out). The gate is password-only, acceptable for the current
+    # threat model.
     if not _password_ok(password):
         raise HTTPException(status_code=401, detail="Unauthorized")
 
@@ -547,14 +544,12 @@ def _read_usage_24h() -> Optional[dict]:
     last USAGE_TAIL_LINES rows (typically covers ≈24h of activity at current
     traffic). Keeping the name aligns with the admin UI label.
 
-    ADR-039/040 + Path B (2026-05-15): the multi-brain split (fast_brain /
-    judge) and the standalone profile_extractor / paraphraser passes were
-    DELETED. The only role the live stack now emits is `brain` (see
-    providers.nvidia_nim_llm.get_brain_llm + llm_health.ROLES). The append-
-    only llm_usage.jsonl still contains pre-rewrite legacy rows tagged with
-    the retired roles, so we filter to the canonical role set — exactly as
-    /api/admin/usage already does via its `chains` dict — instead of blindly
-    surfacing every historical role value. llm_health.ROLES is the single
+    The live stack emits the `brain` role (see
+    providers.nvidia_nim_llm.get_brain_llm + llm_health.ROLES). The
+    append-only llm_usage.jsonl can contain rows tagged with non-canonical
+    role values, so we filter to the canonical role set — the same way
+    /api/admin/usage does via its `chains` dict — instead of surfacing
+    every role value present in the file. llm_health.ROLES is the single
     source of truth (also used as _LLM_HEALTH_CHAIN_ROLES below).
     """
     usage_path = settings.DATA_DIR / "llm_usage.jsonl"
@@ -633,9 +628,9 @@ _LLM_HEALTH_CHAIN_ROLES = llm_health.ROLES
 
 
 def _chain_names_map() -> dict[str, list[str]]:
-    """Live (post-admin-override) chain config — read off the module so admin
-    reorders applied earlier in the same process are reflected immediately.
-    Three-chain collapse (2026-05-15) — only the brain role remains."""
+    """Live (post-admin-override) chain config — read off the module so
+    admin reorders applied earlier in the same process are reflected
+    immediately. Only the brain role is present."""
     from backend.providers import nvidia_nim_llm as nim
     return {
         "brain": list(getattr(nim, "BRAIN_CHAIN", [])),
@@ -758,20 +753,20 @@ def _candidate_available_for_calls(h, now_mono: float) -> bool:
 
 
 def _candidate_credit_exhausted_strict(h, now_mono: float) -> bool:
-    """KI-122 — STRICT credit-exhausted rule for a single candidate.
+    """STRICT credit-exhausted rule for a single candidate.
 
     True ONLY when ALL three hold:
       (1) credits_remaining is NOT None (we have a real signal)
       (2) credits_remaining <= credits_low_water
       (3) credits_reset_at is set AND in the FUTURE (we're inside an
           active gating window — stale or absent reset means the
-          snapshot is no longer authoritative).
+          snapshot is not authoritative).
 
     This is intentionally stricter than `not _has_credits()` because the
     banner is louder than the elector. The elector falls through cheaply
-    on a single bad candidate; the banner falsely scaring the operator
-    when one quota-exhausted backup co-exists with a perfectly healthy
-    primary is the bug we're fixing here."""
+    on a single bad candidate; this strictness avoids falsely scaring the
+    operator when one quota-exhausted backup co-exists with a perfectly
+    healthy primary."""
     if h is None:
         return False
     if h.credits_remaining is None:
@@ -987,13 +982,11 @@ async def admin_llm_health(
 # ---------------------------------------------------------------------------
 
 # The seven canonical "ready-to-recommend" fact-find slots. Mirrors
-# single_brain._FALLBACK_REQUIRED_SLOTS (the live single-brain stack's
-# required set after the ADR-039/040 Path B rewrite) and needs_finder.
-# Profile's persisted fields. `dependents` was previously missing here even
-# though it is a required slot and is persisted on every profile JSON —
-# adding/removing a slot must stay in sync with that required set. Health is
-# captured as a list (empty list counts as "asked but no conditions" → still
-# a valid captured signal once the `asked` array contains the field name).
+# brain_tools._REQUIRED_FOR_READY (the recommendation-ready required set)
+# and needs_finder.Profile's persisted fields. Adding/removing a slot must
+# stay in sync with that required set. Health is captured as a list (empty
+# list counts as "asked but no conditions" → still a valid captured signal
+# once the `asked` array contains the field name).
 _PERSONA_DRIFT_SLOTS = ("name", "age", "dependents", "location_tier",
                         "income_band", "primary_goal", "health_conditions")
 

backend/brain_tools.py

@@ -88,41 +88,28 @@ _log = logging.getLogger(__name__)
 
 _FACTS_DIR = settings.DATA_DIR / "policy_facts"
 _DOCTYPE_SUFFIXES = ("__wordings", "__brochure", "__cis", "__prospectus")
-# KI-RECALL-POOL (2026-05-17) — width of the Chroma candidate pool pulled
-# BEFORE eligibility + scorecard-aware ranking. Must be wide enough that a
-# genuinely-strong A/B policy that is cosine-rank ~15-30 for a profile
-# query still enters contention (so the quality-aware filter_pipeline can
-# surface it). The LLM still only ever sees the top-k best-fit survivors.
+# Width of the Chroma candidate pool pulled before eligibility +
+# scorecard-aware ranking — wide enough that a strong policy ranked only
+# mid-cosine for a generic query still enters contention. The LLM still
+# only sees the top-k best-fit survivors.
 _RECALL_POOL = 40
 _FACT_KEYS = (
     "policy_type_indemnity_or_fixed",
-    # KI-279 (2026-05-16) — the raw catalog type key. Some curated files
-    # (e.g. star-health__star-hospital-cash__brochure.json) carry the
-    # product type ONLY under `policy_type` ("hospital_cash") and have NO
-    # `policy_type_indemnity_or_fixed` key. Without surfacing this, the
-    # retrieval_filters fixed-benefit gate is blind and a daily-cash plan
-    # ranks #1 for a comprehensive-indemnity buyer. Read-only; STABLE key.
+    # Raw catalog type key — some curated files carry the product type
+    # only under `policy_type` (e.g. "hospital_cash") with no
+    # `policy_type_indemnity_or_fixed`; the fixed-benefit gate needs it.
     "policy_type",
     "deductible_amount",
     "co_payment_pct",
     "sum_insured_options",
-    # KI-280 (2026-05-16) — UNIFIED recommendation-fit gate. The eligibility
-    # gate needs these STABLE policy_facts keys (read-only):
+    # Eligibility-gate keys (read-only):
     #   uin_code            → canonical dedup identity (1 UIN = 1 product;
-    #                          collapses marketing-rename / doctype-sibling
-    #                          duplicate CITED cards — audit P2/P4/P7).
-    #   max_entry_age       → hard eligibility for the INSURED person. When
-    #                          the profile insures parents (~70), a plan
-    #                          whose max entry age is 65 cannot accept them
-    #                          (audit P7). The chunk already carries
-    #                          max_entry_age from Chroma metadata, but the
-    #                          curated facts file is the authoritative value
-    #                          and overrides a missing/None chunk field.
+    #                          collapses doctype-sibling/rename duplicates).
+    #   max_entry_age       → hard eligibility for the insured person; the
+    #                          curated value is authoritative and overrides
+    #                          a missing/None Chroma chunk field.
     #   maternity_coverage  → required-feature gate: an explicit maternity /
-    #   newborn_coverage      newborn need must rank confirmed plans above
-    #                          unconfirmed ones (audit P3).
-    # max_renewal_age is intentionally NOT read — it was removed from the
-    # scorecard (lifelong renewal is the IRDAI norm; scorecard.py:606).
+    #   newborn_coverage      newborn need ranks confirmed plans first.
     "uin_code",
     "max_entry_age",
     "maternity_coverage",
@@ -214,21 +201,12 @@ _reviews_cache: dict = {}
 
 
 def _curated_facts_all() -> dict:
-    """The FULL curated-facts layer, EXACTLY as the marketplace uses it.
-
-    KI-FULLFACTS (2026-05-17) — root cause of empty recommendation cards:
-    `_scorecard_signal` used to feed build_scorecard the 7-key eligibility
-    subset (`_load_policy_facts`), which is BELOW build_scorecard's
-    data-completeness floor → every recommended policy returned grade "—"
-    / overall 0 → the Bug #71 ≥70 gate dropped 100% of them → no cards.
-    Meanwhile /api/policies/all scored the SAME policies correctly
-    (HDFC Ergo Optima Restore = A/78) because it feeds the FULL curated
-    dict from main._load_curated_facts (KI-219/251 canonical precedence).
-    We now reuse that EXACT function (lazy import — main is loaded at
-    request time; dodges the import cycle) so a policy's recommendation
-    grade is identical to its marketplace grade by construction. The
-    7-key `_load_policy_facts` stays as-is — it is the correct input for
-    the eligibility/dedup gate, NOT for grading."""
+    """The full curated-facts layer — the same source the marketplace
+    scores from (main._load_curated_facts, KI-219/251 canonical
+    precedence; lazy import since main is loaded at request time). Using
+    it here makes a policy's recommendation grade identical to its
+    marketplace grade. The 7-key `_load_policy_facts` is the input for the
+    eligibility/dedup gate, not for grading."""
     if "d" not in _curated_all_cache:
         from backend.main import _load_curated_facts  # lazy: avoids cycle
         _curated_all_cache["d"] = _load_curated_facts()
@@ -236,9 +214,9 @@ def _curated_facts_all() -> dict:
 
 
 def _insurer_reviews(slug: str) -> Optional[dict]:
-    """Same reviews source the marketplace passes to build_scorecard
-    (40-data/reviews/<slug>.json) — drives the claim-experience sub-score.
-    Without it the rec-path grade would drift below the marketplace's."""
+    """Insurer reviews (40-data/reviews/<slug>.json) passed to
+    build_scorecard — drives the claim-experience sub-score; the same
+    source the marketplace uses."""
     if not slug:
         return None
     if slug in _reviews_cache:
@@ -255,12 +233,11 @@ def _insurer_reviews(slug: str) -> Optional[dict]:
 
 
 def _scorecard_signal(policy_id: str, profile=None) -> dict:
-    """Best-effort {_grade, _overall_score} from backend.scorecard, using
-    the IDENTICAL inputs as the marketplace (/api/policies/all) so a
-    policy's recommendation grade == its marketplace grade by construction
-    (parity is asserted by tests/test_scorecard_parity.py). READ-ONLY;
-    degrades silently to {} on any failure (ranking still works off
-    co-pay + SI headroom + cosine)."""
+    """{_grade, _overall_score} from backend.scorecard using the same
+    inputs as the marketplace, so a policy's recommendation grade equals
+    its marketplace grade (asserted by tests/test_scorecard_parity.py).
+    Read-only; returns {} on any failure (ranking still works off co-pay
+    + SI headroom + cosine)."""
     try:
         cur = _curated_facts_all()
         data = None
@@ -288,15 +265,8 @@ def _scorecard_signal(policy_id: str, profile=None) -> dict:
                 )
             }
         sc = build_scorecard(data, insurer_reviews=ir, profile=prof)
-        # KI-280 (2026-05-16) — the Scorecard dataclass field is
-        # `overall_score` (scorecard.py:95), NOT `overall`. The previous
-        # getattr(sc, "overall", ...) ALWAYS returned None, so every
-        # enriched chunk reached retrieval_filters with _overall_score=None
-        # and _fit_score fell back to the coarse letter-grade table where
-        # every "B" == 70.0 exactly. Within-grade order then collapsed to
-        # raw cosine — the live audit's grade/rank inversion (P1 C/65 above
-        # B/75, P2 A/77 ranked LAST). Read the real numeric field; keep a
-        # belt-and-braces `overall` alias for forward-compat.
+        # Scorecard.overall_score is the numeric field; `overall` is a
+        # back-compat alias.
         _overall = getattr(sc, "overall_score", None)
         if _overall is None:
             _overall = getattr(sc, "overall", None)
@@ -647,18 +617,12 @@ _qseed_cache: dict = {}  # (profile_sig) -> [seed chunk dicts]
 
 
 def _quality_seed_candidates(profile, limit: int = 25) -> list[dict]:
-    """KI-QUALITY-SEED (2026-05-17). Cosine retrieval is quality-blind: a
-    genuinely-best policy whose document wording isn't cosine-similar to a
-    generic profile query never enters the candidate pool, so the
-    (audit-verified-correct) profile-tuned scorecard + filter_pipeline never
-    get the chance to surface it. This deterministically seeds the pool with
-    the catalogue's top policies by the PROFILE-TUNED scorecard overall.
-    filter_pipeline still does precise eligibility + profile-fit ranking on
-    the union (proven: it eligibility-passes + ranks a present A-policy #1),
-    so this ONLY guarantees CANDIDACY — it never bypasses eligibility or
-    fabricates a recommendation. Pure logic layer: no re-ingest, no vector
-    DB change. Cached per profile-signature (the catalogue + a fixed profile
-    yield a fixed ranking)."""
+    """Seed the candidate pool with the catalogue's top policies by the
+    profile-tuned scorecard overall, so a strong policy that isn't
+    cosine-similar to a generic query still enters contention. This only
+    ADDS candidates — filter_pipeline still applies precise eligibility +
+    profile-fit ranking on the union; it never bypasses eligibility or
+    fabricates a recommendation. Cached per profile-signature."""
     out: list[dict] = []
     try:
         prof_sig = repr(sorted(
@@ -882,18 +846,11 @@ async def retrieve_policies(
     try:
         from rag.retrieve import retrieve as _retrieve
 
-        # KI-RECALL-POOL (2026-05-17) — DECOUPLE the Chroma recall pool from
-        # the caller's top_k. Cosine-only Chroma ranking is quality-blind: a
-        # mediocre C/D policy whose wording matches the query out-ranks a
-        # genuinely-better A/B policy that IS in the corpus. At top_k=8 the
-        # A-grade policies never even enter the candidate set, so the
-        # downstream quality-aware filter_pipeline (_fit_score, now fed REAL
-        # scorecard grades after KI-FULLFACTS) can't surface them — it can
-        # only re-order what was retrieved. Fix: retrieve a WIDE pool, let
-        # eligibility + scorecard-aware ranking choose, then return the
-        # top-k best-fit survivors (truncation happens after filter_pipeline
-        # below). For an explicit known-policy follow-up (policy_filter_ids)
-        # the caller already knows the policy — keep the narrow top_k.
+        # Decouple the Chroma recall pool from the caller's top_k: pull a
+        # wide pool so eligibility + scorecard-aware ranking choose from a
+        # broad set, then return the top-k best-fit survivors (truncated
+        # after filter_pipeline below). For an explicit known-policy
+        # follow-up (policy_filter_ids) keep the narrow top_k.
         _recall_pool = (
             (int(top_k) if top_k else 8)
             if policy_filter_ids
@@ -953,13 +910,12 @@ async def retrieve_policies(
     guard_signal = None
     filtered = raw
     if not policy_filter_ids:
-        # KI-QUALITY-SEED — union the cosine pool with the catalogue's
-        # top profile-graded policies so a genuinely-best policy that
-        # isn't cosine-similar to a generic needs-query still enters
-        # contention. filter_pipeline then does precise eligibility +
-        # profile-fit ranking on the union (it eligibility-passes + ranks
-        # a present A-policy #1, proven). Cosine chunk wins on dup (it
-        # carries real retrieved text); seeds only ADD missing candidates.
+        # Union the cosine pool with the catalogue's top profile-graded
+        # policies so a strong policy that isn't cosine-similar to a
+        # generic needs-query still enters contention. filter_pipeline
+        # then applies eligibility + profile-fit ranking on the union. A
+        # cosine chunk wins on a dup (it carries real retrieved text);
+        # seeds only add missing candidates.
         if profile is not None:
             _seen_pids = {
                 (c.get("policy_id") or "").strip() for c in raw
@@ -978,28 +934,23 @@ async def retrieve_policies(
             _log.warning("retrieval_filters.filter_pipeline failed: %s", e)
             filtered = raw
 
-        # KI-RECALL-POOL — filter_pipeline has now eligibility-filtered +
-        # ranked the WIDE pool best-fit-first (scorecard-aware, deduped to
-        # ~1 chunk/policy). Return only the top-N best-fit survivors: enough
-        # for the LLM to pick 2-4 strong recommendations AND for the
-        # citation builder to select from, without dumping the 40-wide tail
-        # as context. This is the ONLY truncation — done AFTER quality
-        # ranking, so the genuinely-best eligible policies (e.g. SBI Super
-        # Health A/87) are what the LLM and the cards both see. Set on the
-        # session cache too so prose ⇄ cited cards are gated on the SAME set.
+        # filter_pipeline has eligibility-filtered + ranked the wide pool
+        # best-fit-first (scorecard-aware, deduped to ~1 chunk/policy).
+        # Return only the top-N best-fit survivors — enough for the LLM to
+        # pick 2-4 recommendations and for the citation builder to select
+        # from, without the wide tail as context. This is the only
+        # truncation, done after quality ranking, so the LLM and the cards
+        # see the same best-fit set.
         filtered = filtered[: max((int(top_k) if top_k else 8), 12)]
 
-        # KI-PROSE-CARD-1to1 (2026-05-17) — user requirement: "can't have a
-        # situation where it suggests something in chat but won't generate a
-        # card." For a RECOMMENDATION turn, apply the SAME fitness floor the
-        # citation builder uses (_recommendation_fit) HERE, so the LLM only
-        # ever SEES cardable policies → prose ⇄ cards are 1:1 by
-        # construction (it cannot name a policy it won't card because it
-        # never receives one). If nothing clears the floor we return none —
-        # the LLM then honestly says "no strong match" rather than padding
-        # with a sub-floor policy (also the requirement). qa / follow-up
-        # intents are untouched: they legitimately cite supporting source
-        # chunks regardless of recommendation grade.
+        # For a recommendation turn, apply the same fitness floor the
+        # citation builder uses (_recommendation_fit) here, so the LLM only
+        # sees cardable policies — prose and cards stay 1:1 (it cannot name
+        # a policy it won't card). If nothing clears the floor the set is
+        # empty and the LLM says there is no strong match rather than
+        # padding with a sub-floor policy. qa / follow-up intents are
+        # untouched (they cite supporting source chunks regardless of
+        # recommendation grade).
         if (intent or "").lower() == "recommendation" and filtered:
             try:
                 from backend.single_brain import _recommendation_fit

backend/config.py

@@ -19,12 +19,9 @@ class Settings:
     # Provider keys
     SARVAM_API_KEY: str = os.environ.get("SARVAM_API_KEY", "")
     VOYAGE_API_KEY: str = os.environ.get("VOYAGE_API_KEY", "")
-    # NVIDIA NIM — single provider hosting the entire reasoning stack:
-    #   Brain  = meta/llama-3.3-70b-instruct
-    #   Judge  = meta/llama-4-maverick-17b-128e-instruct (different arch from brain)
-    # Free tier: 40 req/min, no daily cap, no card. Replaces OpenRouter +
-    # direct DeepSeek + Cerebras + Groq (four legacy providers retired
-    # 2026-05-14 in favor of single-provider consolidation — see D-019).
+    # NVIDIA NIM — single provider hosting the reasoning stack (brain +
+    # judge; concrete model IDs are set on NVIDIA_NIM_*_MODEL below).
+    # Free tier: 40 req/min, no daily cap, no card.
     NVIDIA_NIM_API_KEY: str = os.environ.get("NVIDIA_NIM_API_KEY", "")
 
     # CROSS-PROVIDER FALLBACKS — last-resort entries appended to BRAIN_CHAIN +
@@ -38,7 +35,7 @@ class Settings:
     OPENROUTER_API_KEY: str = os.environ.get("OPENROUTER_API_KEY", "")
     GROQ_API_KEY: str = os.environ.get("GROQ_API_KEY", "")
 
-    # Sarvam endpoints (voice STT/TTS + Indic translation only — not brain anymore)
+    # Sarvam endpoints (voice STT/TTS + Indic translation only)
     SARVAM_BASE_URL: str = "https://api.sarvam.ai"
     SARVAM_STT_PATH: str = "/speech-to-text"
     SARVAM_TTS_PATH: str = "/text-to-speech"
@@ -48,15 +45,15 @@ class Settings:
     SARVAM_STT_MODEL: str = "saarika:v2.5"
     SARVAM_TTS_MODEL: str = "bulbul:v2"
     SARVAM_TTS_SPEAKER: str = "anushka"  # natural female advisor voice
-    SARVAM_LLM_MODEL: str = "sarvam-m"  # used by translator.py for Indic translation
+    SARVAM_LLM_MODEL: str = "sarvam-m"  # Sarvam model for Indic translation
 
-    # Voyage (legacy — embeddings now via local BGE; kept for back-compat with extracted/ artifacts)
+    # Voyage — embeddings run on local BGE; this is kept for back-compat
+    # with existing extracted/ artifacts.
     VOYAGE_MODEL: str = "voyage-3"
 
-    # NVIDIA NIM (single source of truth for brain + judge — tiered routing)
-    # 2026-05-14 brain swap (D-022): DeepSeek-V4 + Meta Llama NIM pools time out
-    # repeatedly. Qwen 3-Next 80B + Mistral Large 3 are the working production
-    # models on NIM free tier as of 2026-05-14.
+    # NVIDIA NIM (single source of truth for brain + judge — tiered
+    # routing). Qwen 3-Next 80B + Mistral Large 3 are the production
+    # models on NIM free tier.
     NVIDIA_NIM_BASE_URL: str = "https://integrate.api.nvidia.com/v1"
     NVIDIA_NIM_BRAIN_MODEL: str = "qwen/qwen3-next-80b-a3b-instruct"
     NVIDIA_NIM_FAST_BRAIN_MODEL: str = "qwen/qwen3-next-80b-a3b-instruct"
@@ -67,12 +64,9 @@ class Settings:
     EXTRACTED_DIR: Path = ROOT / "rag" / "extracted"
     VECTORS_DIR: Path = ROOT / "rag" / "vectors"
     STRUCTURED_DB: Path = ROOT / "rag" / "policies.duckdb"
-    # Single source of truth for the curated-facts directory. Previously the
-    # literal "40-data" was hardcoded independently in ~13 runtime modules
-    # (admin/marketplace/scorecard/premium/profile/llm-health/brain-tools).
-    # Every one of those expressions resolved to <repo_root>/40-data, so this
-    # constant is a behaviour-preserving consolidation, not a path change.
-    # The directory name is intentionally kept (parallel to 70-docs/80-audit).
+    # Single source of truth for the curated-facts directory. Resolves to
+    # <repo_root>/40-data; the directory name is intentionally kept
+    # (parallel to 70-docs/80-audit).
     DATA_DIR: Path = ROOT / "40-data"
 
     # Tunables (overrideable via env vars so the hyperparameter sweep can iterate)
@@ -80,7 +74,7 @@ class Settings:
     CHUNK_OVERLAP_TOKENS: int = int(os.environ.get("CHUNK_OVERLAP_TOKENS", "120"))
     RAG_TOP_K: int = int(os.environ.get("RAG_TOP_K", "5"))
 
-    # Quarantine TTL (2026-05-16) — user-uploaded PDFs live in the SEPARATE
+    # Quarantine TTL — user-uploaded PDFs live in the SEPARATE
     # `user_uploads_quarantine` Chroma collection. They are NOT durable
     # corpus; a session's upload is auto-purged after this many seconds of
     # no further uploads from that session, so the quarantine index can't

backend/llm_health.py

@@ -1,19 +1,12 @@
-"""Live NIM model health monitor — OpenRouter-style availability filter
-+ KI-080 sticky primary/backup election.
-
-Architectural shift (KI-080, 2026-05-15):
-==========================================
-Pre-KI-080 the chain was iterated EVERY chat turn — primary, fallback 1,
-fallback 2, ... until one succeeded. Under NIM per-key concurrency throttling,
-the first 5 NIM-hosted candidates queued together inside a single turn,
-burning the 22s budget before the cross-provider fallback links (Groq /
-OpenRouter) were ever reached. The 10-turn live probe at commit 078ff45
-showed 7/10 fact-find turns timing out at exactly 26.6s.
-
-KI-080 inverts the model: the background probe loop ELECTS a primary +
-backup per chain based on real probe latencies; chat() calls the elected
-primary ONCE per turn, with at most ONE real-time fallback to the elected
-backup. Worst case per turn drops from 5-6 LLM calls to 1-2.
+"""Live NIM model health monitor — availability filter + sticky
+primary/backup election.
+
+The background probe loop ELECTS a primary + backup per chain; chat()
+calls the elected primary ONCE per turn, with at most ONE real-time
+fallback to the elected backup (worst case 1-2 LLM calls per turn).
+Electing out-of-band, rather than iterating the whole chain on every
+turn, keeps a single turn from queuing many NIM-hosted candidates under
+per-key concurrency throttling and burning the turn budget.
 
 Probes every PROBE_INTERVAL_SEC tick (300s) with a tiny ping ("Reply with
 exactly: ok"), `max_tokens=1` so probe-driven token spend is negligible.
@@ -27,24 +20,23 @@ Records per model:
   - probe_history:    last PROBE_HISTORY_LEN (ok, latency_ms) tuples; powers
                       the success_rate signal in the election score.
 
-Election (KI-201, 2026-05-15 — supersedes KI-080/KI-087 score-based election):
-  - Walk the chain definition (BRAIN_CHAIN — the only chain after the
-    three-chain collapse on 2026-05-15) in priority order.
+Election:
+  - Walk the chain definition (BRAIN_CHAIN — the only chain) in priority
+    order.
     CURRENT_PRIMARY = first election-eligible model.
     CURRENT_BACKUP  = next election-eligible model after primary.
   - Chain hierarchy IS the truth — nemotron-49b is LAST in BRAIN_CHAIN so
     it only serves when qwen + mistral + maverick are all unavailable.
-  - Latency / success_rate still gate ELIGIBILITY (probe-fresh, not in
-    sin-bin, credits above water) but no longer drive ORDERING. Pre-KI-201
-    the (1/latency)×success_rate score let a chain-#3 model beat chain-#0
-    on a faster probe, violating the operator-defined hierarchy.
+  - Latency / success_rate gate ELIGIBILITY (probe-fresh, not in
+    sin-bin, credits above water) but do not drive ORDERING, so a faster
+    lower-priority model never beats a higher-priority one.
   - DEGRADED window: when chat() calls report_failure(model), that model is
     sidelined for either DEGRADED_WINDOW_SEC (transient, 30s) or
-    DEGRADE_DURATION_LONG_S (rate-limit / HTTP 429, 1h — KI-084) so the
-    same turn's failure doesn't recycle to the same broken primary on the
-    next turn. The next probe tick reconsiders the model normally for the
-    short window; rate-limit demotions persist past several probe ticks
-    so the elector doesn't keep bouncing back to a quota-exhausted model.
+    DEGRADE_DURATION_LONG_S (rate-limit / HTTP 429, 1h) so the same turn's
+    failure doesn't recycle to the same broken primary on the next turn.
+    The next probe tick reconsiders the model normally for the short
+    window; rate-limit demotions persist past several probe ticks so the
+    elector doesn't keep bouncing back to a quota-exhausted model.
 
 Persistence: 40-data/llm_health.json (atomic write via temp+rename).
 
@@ -87,57 +79,49 @@ ROOT = Path(__file__).resolve().parent.parent
 HEALTH_FILE = settings.DATA_DIR / "llm_health.json"
 HEALTH_FILE.parent.mkdir(parents=True, exist_ok=True)
 
-# KI-084 (2026-05-15) — probe cadence raised 60s → 300s. With ~25
-# candidates per tick × 4 token round-trip each (prompt "Reply with
-# exactly: ok" plus a 1-token completion), the prior 60s cadence burned
-# ~30-50K tokens/day on Groq alone — enough to push the brain to HTTP 429
-# on Groq's 100K free-tier TPD cap and elect a degraded provider for
-# every chat call. 300s cadence keeps election responsive within 5 min
-# of a pool degradation (more than fast enough at our chat volume) and
-# drops probe-driven Groq spend to ~3K/day baseline (well inside quota).
+# Probe cadence 300s. With ~25 candidates per tick × a 4-token round-trip
+# each, a tighter cadence would burn enough tokens/day on Groq to push the
+# brain to HTTP 429 on Groq's free-tier TPD cap. 300s keeps election
+# responsive within 5 min of a pool degradation (fast enough at our chat
+# volume) and keeps probe-driven Groq spend well inside quota.
 PROBE_INTERVAL_SEC = 300
-# A4 (2026-05-15) — cadence audit: 300s for steady-state probes is comfortably
-# above the audit's 90s minimum for non-failing providers. The post-failure
-# tighter cadence is implemented OUT-OF-BAND in `report_failure()`, which
-# schedules a `_reprobe_one()` immediately after every chat failure (effective
-# 0s after-failure cadence on the loop, not 30s). The 300s cadence then
-# resumes for the long-run probe stream so the steady state stays cheap.
-PROBE_INTERVAL_SEC_FAILING = 30   # A4 — documented post-failure cadence ceiling
-# KI-084 — completion size on probes cut from 5 → 1. The probe only
-# needs a non-empty 200 response to mark a candidate healthy; we never
-# parse the body content. max_tokens=1 keeps the same response shape +
-# ~50× less token spend per probe.
+# 300s for steady-state probes. The post-failure tighter cadence is
+# implemented OUT-OF-BAND in `report_failure()`, which schedules a
+# `_reprobe_one()` immediately after every chat failure (effective 0s
+# after-failure cadence on the loop). The 300s cadence then resumes for
+# the long-run probe stream so the steady state stays cheap.
+PROBE_INTERVAL_SEC_FAILING = 30   # post-failure cadence ceiling
+# The probe only needs a non-empty 200 response to mark a candidate
+# healthy; the body content is never parsed. max_tokens=1 keeps the same
+# response shape with minimal token spend per probe.
 PROBE_MAX_TOKENS = 1
 PROBE_TIMEOUT_SEC = 8             # per-probe HTTP timeout
 DOWN_AFTER_CONSECUTIVE_FAILS = 3  # 3 fails in a row = mark down
 PROBE_HISTORY_LEN = 5             # rolling window for success_rate signal
-HEALTHY_PROBE_AGE_SEC = 600       # KI-084 — election candidates need a probe
-                                  # within the last 600s (tracks 300s cadence
-                                  # plus headroom for one missed tick).
-# A4 (2026-05-15) — explicit STALE window. If a candidate hasn't been probed
-# in >STALE_AGE_SEC, its on-record status is rewritten to "stale" so the
-# router treats it as untested rather than trusting the last-known
+HEALTHY_PROBE_AGE_SEC = 600       # election candidates need a probe within
+                                  # the last 600s (tracks 300s cadence plus
+                                  # headroom for one missed tick).
+# Explicit STALE window. If a candidate hasn't been probed in
+# >STALE_AGE_SEC, its on-record status is rewritten to "stale" so the
+# router treats it as untested rather than trusting a last-known
 # "healthy"/"unhealthy" verdict from minutes/hours ago.
 STALE_AGE_SEC = HEALTHY_PROBE_AGE_SEC  # alias for clarity; same threshold.
 DEGRADED_WINDOW_SEC = 30          # report_failure sidelines a model this long
                                   # for transient failures (timeout / 5xx).
 
-# Three-chain collapse (2026-05-15) — collapsed FAST_BRAIN_CHAIN + JUDGE_CHAIN
-# out of the architecture. "brain" is now the sole election role; every
-# consumer that used to iterate ("brain", "fast_brain", "judge") now iterates
-# ROLES so we only have one place to add a future role.
+# "brain" is the sole election role; consumers iterate ROLES so a future
+# role only needs to be added in one place.
 ROLES: tuple[str, ...] = ("brain",)
-# KI-084 — rate-limit failures (HTTP 429 + provider 'RateLimit' bodies) are
+# Rate-limit failures (HTTP 429 + provider 'RateLimit' bodies) are
 # almost always the daily quota on free tiers (Groq TPD, etc.) — they do
 # NOT reset in 30s. Demote the model from election for an hour so the
 # elector falls through to a non-rate-limited provider instead of
 # bouncing back to the dead candidate on every chat turn.
 DEGRADE_DURATION_LONG_S = 3600.0
 
-# KI-085 (2026-05-15) — proactive credit tracking. KI-084 demotes a candidate
-# for 1h AFTER a 429 hits; that costs one user-facing failure per dead quota.
-# KI-085 promotes llm_health to liveness+credits so election excludes
-# quota-exhausted candidates BEFORE the user gets stuck behind a 429.
+# Proactive credit tracking: election excludes quota-exhausted candidates
+# BEFORE the user gets stuck behind a 429 (rather than only demoting a
+# candidate for 1h after a 429 hits).
 #
 # Three signal sources:
 #   1) GROQ — response headers (x-ratelimit-remaining-tokens-day etc.) on
@@ -203,8 +187,8 @@ def _headers_for(model_id: str, api_key: str) -> dict[str, str]:
     return h
 
 
-# KI-202 (2026-05-15) — categorize a `last_error` string + optional HTTP
-# status code into the short operator-facing reason rendered by the admin
+# Categorize a `last_error` string + optional HTTP status code into the
+# short operator-facing reason rendered by the admin
 # Health columns. Centralised here so backend and any other consumer agree
 # on the same vocabulary ("network issue" / "rate limit (429)" / etc.).
 # Use lookbehind/lookahead on non-digit so we still match e.g. "Status429",
@@ -309,8 +293,8 @@ def provider_of(model_id: str) -> str:
 @dataclass
 class ModelHealth:
     model: str
-    # A4 (2026-05-15) — 'stale' added. Set by `effective_status()` when a
-    # row hasn't been pinged in > STALE_AGE_SEC; the router then treats it
+    # 'stale' is set by `effective_status()` when a row hasn't been pinged
+    # in > STALE_AGE_SEC; the router then treats it
     # as untested instead of trusting a last-known healthy/unhealthy verdict
     # from minutes/hours ago. Persisted records may still carry the older
     # status — the elector calls effective_status() at decision time.
@@ -318,8 +302,8 @@ class ModelHealth:
     last_success_at: Optional[str] = None
     last_failure_at: Optional[str] = None
     last_error: Optional[str] = None
-    # KI-202 (2026-05-15) — explicit HTTP status code from the most recent
-    # failed probe / chat call. `last_error` is a free-form string ("timeout",
+    # Explicit HTTP status code from the most recent failed probe / chat
+    # call. `last_error` is a free-form string ("timeout",
     # "http_429", "net: TimeoutException: ..."); `last_status_code` is the
     # parsed integer (or None when the failure wasn't HTTP-shaped). Surfaced
     # in admin Health columns so the operator can see "Off — rate limit (429)"
@@ -335,7 +319,7 @@ class ModelHealth:
     # KI-080 — set by report_failure(); model is excluded from election
     # while monotonic time < degraded_until_monotonic.
     degraded_until_monotonic: float = 0.0
-    # KI-085 (2026-05-15) — proactive credit tracking. Stamped by
+    # Proactive credit tracking. Stamped by
     # update_credits_from_groq / update_credits_from_openrouter (response
     # headers + account endpoint) and by the NIM local rate-meter. The
     # elector gates on `credits_remaining is None OR > credits_low_water`
@@ -364,8 +348,7 @@ def _iso_age_seconds(iso_ts: Optional[str]) -> Optional[float]:
 
 
 def _all_known_models() -> list[str]:
-    """Pull every model name from BRAIN_CHAIN (the only remaining chain
-    after the three-chain collapse on 2026-05-15)."""
+    """Pull every model name from BRAIN_CHAIN (the only chain)."""
     from backend.providers.nvidia_nim_llm import BRAIN_CHAIN
     seen: list[str] = []
     for m in BRAIN_CHAIN:
@@ -378,9 +361,8 @@ def _chain_for(chain_name: str) -> list[str]:
     """Resolve a chain name → live chain list. Reads off the module so
     runtime admin reorderings are respected by the elector.
 
-    Three-chain collapse (2026-05-15): "brain" is the only valid role.
-    Any other input is coerced to "brain" for back-compat with stragglers
-    that still pass "fast_brain"/"judge" (CLEAN1 nim_fallback callers etc.).
+    "brain" is the only valid role. Any other input is coerced to "brain"
+    for back-compat with callers that pass another role name.
     """
     from backend.providers import nvidia_nim_llm as nim
     return list(getattr(nim, "BRAIN_CHAIN", []))
@@ -408,9 +390,9 @@ def _load_into_memory() -> None:
             try:
                 raw = json.loads(HEALTH_FILE.read_text())
                 for k, v in raw.get("models", {}).items():
-                    # Tolerate older schema (pre-KI-080 records missing
-                    # probe_history / degraded_until_monotonic; pre-KI-085
-                    # records missing the five credits_* fields).
+                    # Tolerate older on-disk schema: records may be missing
+                    # probe_history / degraded_until_monotonic or the five
+                    # credits_* fields.
                     v.setdefault("probe_history", [])
                     v.setdefault("degraded_until_monotonic", 0.0)
                     v.setdefault("last_status_code", None)
@@ -437,7 +419,7 @@ def save(state: Optional[dict[str, ModelHealth]] = None) -> None:
     """Atomic write — temp file then rename so concurrent readers never see partial.
 
     If `state` is None, persists the in-memory _STATE. The optional arg is
-    kept for backward compatibility with the pre-KI-080 call sites in admin.py."""
+    kept for backward compatibility with call sites in admin.py."""
     if state is None:
         _load_into_memory()
         with _STATE_LOCK:
@@ -452,7 +434,7 @@ def save(state: Optional[dict[str, ModelHealth]] = None) -> None:
 
 
 # ---------------------------------------------------------------------------
-# KI-080 — public API: primary/backup election + failure/success reporting
+# Public API: primary/backup election + failure/success reporting
 # ---------------------------------------------------------------------------
 
 def _success_rate(h: ModelHealth) -> float:
@@ -478,8 +460,8 @@ def _score(h: ModelHealth) -> float:
 
 
 def effective_status(h: ModelHealth) -> str:
-    """A4 (2026-05-15) — Return the routing-relevant status, applying the
-    STALE_AGE_SEC override at read time.
+    """Return the routing-relevant status, applying the STALE_AGE_SEC
+    override at read time.
 
     A stored `status` of "healthy" can mean "the last probe N hours ago
     said this was healthy" — which the router must NOT trust. When
@@ -501,11 +483,10 @@ def _is_election_eligible(h: ModelHealth, now_mono: float) -> bool:
       - status is healthy (or degraded with a recent success)
       - last probe was within HEALTHY_PROBE_AGE_SEC
       - it is NOT currently in the degraded-window sin-bin
-      - KI-085 (2026-05-15): it has credits remaining above its low-water
-        mark, OR no credit signal yet (cold-start = permissive).
-      - A4 (2026-05-15): effective_status != "stale" (catches the case
-        where status field is 'healthy' but the probe is older than
-        STALE_AGE_SEC).
+      - it has credits remaining above its low-water mark, OR no credit
+        signal yet (cold-start = permissive).
+      - effective_status != "stale" (catches the case where the status
+        field is 'healthy' but the probe is older than STALE_AGE_SEC).
     """
     if h.degraded_until_monotonic > now_mono:
         return False
@@ -528,7 +509,7 @@ def _is_election_eligible(h: ModelHealth, now_mono: float) -> bool:
 
 
 def _has_credits(h: ModelHealth, now_mono: float) -> bool:
-    """KI-085 — credit-gate predicate for election eligibility.
+    """Credit-gate predicate for election eligibility.
 
     Rules:
       - If `credits_reset_at` has elapsed, treat the signal as stale and
@@ -565,7 +546,7 @@ def _ranked_candidates(chain_name: str) -> list[ModelHealth]:
     return [h for _, h in eligible]
 
 
-# A4 (2026-05-15) — Election event log. Tracks the last elected primary/
+# Election event log. Tracks the last elected primary/
 # backup per chain so we can emit a structured promotion/demotion log line
 # when the elected model changes. Stored in-memory only (cheap; resets on
 # process restart, which is fine — first post-restart election re-emits).
@@ -575,8 +556,8 @@ _LAST_ELECTION: dict[str, dict[str, Optional[str]]] = {}
 
 def _emit_election_event(chain_name: str, role: str, from_m: Optional[str],
                           to_m: Optional[str], reason: str) -> None:
-    """A4 (2026-05-15) — Structured log line for every primary/backup
-    promotion or demotion. Format matches the audit brief:
+    """Structured log line for every primary/backup promotion or
+    demotion. Format:
         {event, chain, role, from, to, reason, ts}
     The router / admin UI / log-shipper can grep on `event=election` to
     rebuild the timeline of who served what when.
@@ -617,28 +598,22 @@ def _record_election(chain_name: str, role: str, new_model: Optional[str],
 
 
 def get_primary(chain_name: str) -> Optional[str]:
-    """KI-201 (2026-05-15) — elect by CHAIN ORDER, not latency score.
+    """Elect by CHAIN ORDER, not latency score.
 
     Walk the chain definition in priority order. Return the first model
     that's election-eligible. Chain hierarchy IS the truth — e.g. in
     BRAIN_CHAIN, nemotron-49b is LAST so it only serves when every
-    higher-priority model is unavailable (KI-175 last-resort rule).
-
-    Pre-KI-201 the elector picked by (1/latency) × success_rate, which
-    meant a chain-#3 model (maverick) could beat chain-#0 (qwen) on a
-    faster probe. Live evidence: all 4 NIM models healthy but elector
-    picked maverick over qwen. User-stated spec: "If a model is not
-    already in use, but at the backend everything is live, then it
-    should always suggest it according to our set hierarchy."
-
-    Latency is no longer used for primary/backup selection — eligibility
-    filtering still uses the rolling probe state, but ordering is
-    purely chain-positional.
-
-    A4 (2026-05-15) — emits a structured `event=election` log line via
-    `_record_election` whenever the elected primary changes for this
-    chain, so the operator/admin/log-shipper can rebuild the promotion/
-    demotion timeline. No log emit when the value is unchanged.
+    higher-priority model is unavailable (last-resort rule).
+
+    Latency is not used for primary/backup selection — eligibility
+    filtering uses the rolling probe state, but ordering is purely
+    chain-positional, so the hierarchy is always honoured when models
+    are live.
+
+    Emits a structured `event=election` log line via `_record_election`
+    whenever the elected primary changes for this chain, so the
+    operator/admin/log-shipper can rebuild the promotion/demotion
+    timeline. No log emit when the value is unchanged.
     """
     chain = _chain_for(chain_name)
     if not chain:
@@ -657,19 +632,18 @@ def get_primary(chain_name: str) -> Optional[str]:
 
 
 def get_backup(chain_name: str) -> Optional[str]:
-    """KI-201 (2026-05-15) — backup is the SECOND eligible model in chain
-    order, skipping the elected primary.
+    """Backup is the SECOND eligible model in chain order, skipping the
+    elected primary.
 
     Walks the chain definition in priority order, skips the elected
     primary, and returns the next eligible model. Same chain-as-truth
-    philosophy as get_primary: the chains in nvidia_nim_llm.py were
-    designed with family/provider diversity baked in (Qwen → Mistral →
-    Meta → NVIDIA), so walking past the primary in chain order naturally
-    preserves the cross-family backup invariant KI-087 used to enforce
-    via provider_of().
-
-    A4 (2026-05-15) — emits a structured `event=election` log line via
-    `_record_election` whenever the elected backup changes.
+    philosophy as get_primary: the chains in nvidia_nim_llm.py are
+    designed with family/provider diversity (Qwen → Mistral → Meta →
+    NVIDIA), so walking past the primary in chain order naturally keeps
+    the backup on a different family from the primary.
+
+    Emits a structured `event=election` log line via `_record_election`
+    whenever the elected backup changes.
     """
     chain = _chain_for(chain_name)
     if not chain:
@@ -875,7 +849,7 @@ def update_credits_from_groq(chain_name: str, model: str, headers: dict) -> None
     Called from GroqLLM.chat() after a successful HTTP response. The
     `headers` dict is the response's headers (case-insensitive via httpx).
     We prefer the DAILY tokens signal (`x-ratelimit-remaining-tokens-day`)
-    because Groq's free-tier daily TPD cap is what bit us in KI-084.
+    because Groq's free-tier daily TPD cap is the binding limit.
 
     Missing header → no-op. Malformed value → log warning + no-op.
     """
@@ -1097,8 +1071,8 @@ async def poll_openrouter_credits() -> Optional[dict]:
 
 
 # ---------------------------------------------------------------------------
-# Probing (mostly unchanged from pre-KI-080 — extended to record
-# probe_history + skip degraded-window models on the regular tick).
+# Probing — records probe_history + skips degraded-window models on the
+# regular tick.
 # ---------------------------------------------------------------------------
 
 async def probe_one(client: httpx.AsyncClient, model: str, api_key: str) -> tuple[bool, str, Optional[int]]:
@@ -1198,29 +1172,19 @@ async def probe_all() -> dict[str, ModelHealth]:
     """One-shot probe of every known model. Updates persisted state + returns it."""
     _load_into_memory()
     models = _all_known_models()
-    # Per-provider keys are resolved inside probe_one(); we no longer
-    # gate the whole loop on the NIM key (KI-080) — cross-provider
-    # candidates must keep getting probed even when NVIDIA_NIM_API_KEY
-    # is missing.
-
-    # KI-088 (2026-05-15) — Probe candidates serially, not in parallel.
-    #
-    # Pre-KI-088: `asyncio.gather(*probe_one(m) for m in models)` fired
-    # all candidates simultaneously. Even though they hit different NIM
-    # *model pools*, they all share the same per-API-key concurrency
-    # quota (~3-5 slots free-tier). A 6-candidate parallel burst every
-    # 300s would queue inside NIM and steal slots from in-flight user
-    # turns — exactly the saturation pattern the global outbound
-    # semaphore in nvidia_nim_llm.py is sized to prevent.
-    #
-    # With KI-088's semaphore in place, parallel gather would still
-    # be hard-capped at 2 in-flight but introduce no benefit over a
-    # serial loop. Serial is simpler, easier to reason about, and
-    # naturally yields control to user-traffic between candidates.
+    # Per-provider keys are resolved inside probe_one(); the loop is not
+    # gated on the NIM key so cross-provider candidates keep getting
+    # probed even when NVIDIA_NIM_API_KEY is missing.
+
+    # Probe candidates serially, not in parallel. Candidates share the
+    # same per-API-key concurrency quota (~3-5 slots free-tier), so a
+    # parallel burst every 300s would queue inside NIM and steal slots
+    # from in-flight user turns. A serial loop is simple to reason about
+    # and naturally yields control to user traffic between candidates.
     #
-    # Cost: 6 NIM candidates × ~2s healthy probe = ~12s, well under
-    # the 300s probe cadence. No sleep between candidates — the
-    # outbound semaphore handles pacing.
+    # Cost: ~6 NIM candidates × ~2s healthy probe = ~12s, well under the
+    # 300s probe cadence. No sleep between candidates — the outbound
+    # semaphore handles pacing.
     async with httpx.AsyncClient() as client:
         results = []
         for m in models:
@@ -1260,8 +1224,8 @@ def status_summary() -> dict:
     state = load()
     summary = {"updated_at": None, "by_status": {"healthy": 0, "degraded": 0, "down": 0, "stale": 0, "unknown": 0}, "models": []}
     for m, h in state.items():
-        # A4 (2026-05-15) — `effective_status` applies the STALE_AGE_SEC
-        # override at read time so the admin UI / router see "stale" for
+        # `effective_status` applies the STALE_AGE_SEC override at read
+        # time so the admin UI / router see "stale" for
         # rows whose stored 'healthy' verdict is older than STALE_AGE_SEC.
         eff = effective_status(h)
         summary["by_status"][eff] = summary["by_status"].get(eff, 0) + 1
@@ -1294,9 +1258,9 @@ def status_summary() -> dict:
     summary["models"].sort(key=lambda x: (x["status"] != "healthy", x["model"]))
     if summary["models"]:
         summary["updated_at"] = max((m.get("tested_at") or "") for m in summary["models"])
-    # KI-080 — surface currently-elected primary/backup per chain for the
-    # admin UI. Cheap (a couple of dict lookups + sort over <=10 entries).
-    # Three-chain collapse (2026-05-15) — "brain" is the only remaining role.
+    # Surface currently-elected primary/backup per chain for the admin UI.
+    # Cheap (a couple of dict lookups + sort over <=10 entries). "brain"
+    # is the only role.
     summary["elections"] = {
         role: {"primary": get_primary(role), "backup": get_backup(role)}
         for role in ROLES
@@ -1305,14 +1269,14 @@ def status_summary() -> dict:
 
 
 async def background_probe_loop() -> None:
-    """Long-running task — probes every PROBE_INTERVAL_SEC (300s; KI-084).
+    """Long-running task — probes every PROBE_INTERVAL_SEC (300s).
     Started from main.py.
 
-    KI-085 (2026-05-15) — also polls OpenRouter's account-level credits
-    endpoint every OPENROUTER_CREDITS_POLL_EVERY_N_TICKS ticks (10 min by
-    default at the 300s probe cadence). Groq + NIM signals come from the
-    chat hot path (response headers + local rate-meter respectively) so
-    only OpenRouter needs an out-of-band poll.
+    Also polls OpenRouter's account-level credits endpoint every
+    OPENROUTER_CREDITS_POLL_EVERY_N_TICKS ticks (10 min by default at the
+    300s probe cadence). Groq + NIM signals come from the chat hot path
+    (response headers + local rate-meter respectively) so only OpenRouter
+    needs an out-of-band poll.
     """
     tick = 0
     # Initial credits poll on startup so the elector has a non-None

backend/main.py

@@ -32,21 +32,22 @@ from backend import sum_insured as _si  # SI rationalisation (D1/D3) — source-
 from backend.providers.sarvam_stt import SarvamSTT
 from backend.providers.sarvam_tts import SarvamTTS
 
-# Path B — opt-in single-LLM brain. Off by default; flip via env var.
-# When on we replace orchestrator.handle_turn with single_brain.handle_turn
-# for the /api/chat hot path and fall back to nim_fallback.handle_turn_fallback
-# on any SingleBrainError (so users always get a reply).
+# Single-LLM brain toggle. Off by default; flip via env var. When on, the
+# /api/chat hot path runs single_brain.handle_turn and falls back to
+# nim_fallback.handle_turn_fallback on any SingleBrainError (so users
+# always get a reply). When off, /api/chat routes directly through
+# nim_fallback.handle_turn_fallback.
 import os as _os  # local alias to avoid stomping any later `import os`
 
 USE_SINGLE_BRAIN = _os.environ.get("USE_SINGLE_BRAIN", "false").lower() in (
     "1", "true", "yes", "on",
 )
 
-# U1 Test 9 — safety net for RULE 7. If Gemini forgets to call
-# mark_recommendation when the user clearly commits to a policy ("I'll go
-# with that one", "let's do #2", "buy this"), the post-turn detector below
-# auto-calls mark_recommendation against session.last_recommendation_ids[:1]
-# so the closure event is recorded for analytics even when the LLM whiffs.
+# Safety net for RULE 7. If Gemini does not call mark_recommendation when
+# the user clearly commits to a policy ("I'll go with that one", "let's do
+# #2", "buy this"), the post-turn detector below auto-calls
+# mark_recommendation against session.last_recommendation_ids[:1] so the
+# closure event is recorded for analytics.
 # Word-boundary anchored; case-insensitive at match-time.
 _CLOSER_KEYWORD_RE = re.compile(
     r"\b(go with|i'?ll take|i will take|let'?s do|let me get|sign me up|"
@@ -144,15 +145,10 @@ class ChatResponse(BaseModel):
     session_id: str
     audio_base64: Optional[str] = None
     audio_mime: Optional[str] = None  # X8 — "audio/wav" | "audio/mp4" | "audio/webm"
-    # KI-278 (2026-05-16) — TTS voice-output failures used to be SWALLOWED
-    # silently: the chat endpoint caught the Sarvam exception, logged it to
-    # turns.jsonl, and returned audio_base64=None with NO signal to the
-    # client. The user saw a text reply with no voice and no explanation
-    # ("no voice in reply. wtf?"). These two fields make the failure LOUD:
-    # the frontend renders a small inline "voice unavailable" notice under
-    # the bot bubble (text reply is unaffected). tts_error_code is a closed
-    # enum mirroring the STT path's contract so the client never parses raw
-    # httpx text:
+    # TTS voice-output failures are surfaced to the client (text reply is
+    # unaffected): the frontend renders a small inline "voice unavailable"
+    # notice under the bot bubble. tts_error_code is a closed enum mirroring
+    # the STT path's contract so the client never parses raw httpx text:
     #   rate_limit          — Sarvam 429 / insufficient_quota / no credits
     #   service_unavailable  — Sarvam 5xx / 503
     #   auth                 — Sarvam 401/403 / missing SARVAM_API_KEY
@@ -171,13 +167,12 @@ class ChatResponse(BaseModel):
             "flash an acknowledgment + refresh the completeness panel."
         ),
     )
-    # Issue B (KI-Z6-PROFILECOMPLETE, 2026-05-15) — frontend was making a
-    # second roundtrip to /api/profile/completeness after every chat turn to
-    # learn whether the 7 required slots are now captured. Surface it in the
+    # Whether the 7 required profile slots are captured. Surfaced in the
     # primary chat response so the UI can flip to 100% in the same render
-    # cycle. Computed via brain_tools._REQUIRED_FOR_READY (same slot list
-    # used by retrieve_policies' profile-complete gate) so client + server
-    # never disagree.
+    # cycle without a second roundtrip to /api/profile/completeness.
+    # Computed via brain_tools._REQUIRED_FOR_READY (same slot list used by
+    # retrieve_policies' profile-complete gate) so client + server never
+    # disagree.
     profile_complete: bool = Field(
         False,
         description=(
@@ -343,13 +338,12 @@ async def _quarantine_purge_loop() -> None:
             )
 
 
-# Issue B (KI-Z6-PROFILECOMPLETE, 2026-05-15) — single source of truth for
-# "is this profile ready to recommend against". brain_tools._profile_complete
-# uses the same _REQUIRED_FOR_READY tuple; we mirror the call here instead of
-# duplicating the slot list so a future addition (e.g. risk_appetite) only
-# needs to be applied in brain_tools.
-# KI-Z7 (2026-05-15) — Feature B helper. Distinguishes "first-time capture
-# on turn 1" from "stored profile recalled on turn 1". Both end with a
+# Single source of truth for "is this profile ready to recommend against".
+# brain_tools._profile_complete uses the same _REQUIRED_FOR_READY tuple; we
+# mirror the call here instead of duplicating the slot list so a future
+# addition (e.g. risk_appetite) only needs to be applied in brain_tools.
+# Distinguishes "first-time capture on turn 1" from "stored profile
+# recalled on turn 1". Both end with a
 # non-empty Profile on the session; only the latter should flip
 # returning_user_recalled. Heuristic: if EVERY currently-filled slot was
 # written THIS turn (i.e. lives in `profile_updates`), the user just typed
@@ -461,11 +455,10 @@ async def _validation_exception_handler(request: Request, exc: RequestValidation
 
 
 # ---------- Admin panel + LLM health background loop ----------
-# Mount the password-gated admin endpoints (KI-097). Unauthorized callers
-# get 401 Unauthorized. The earlier IP allowlist gate (ADMIN_IP_ALLOWLIST +
-# 404-to-hide-existence) was removed in KI-097 — operationally it locked
-# the operator out when switching networks without adding real security
-# beyond a strong password.
+# Mount the password-gated admin endpoints. Unauthorized callers get
+# 401 Unauthorized. Access is gated by a strong password only (no IP
+# allowlist, which would lock the operator out when switching networks
+# without adding real security).
 from backend import admin as _admin_router_module
 app.include_router(_admin_router_module.router)
 
@@ -797,24 +790,21 @@ async def chat(req: ChatRequest, request: Request):
     if preferred_codec not in _allowed_codecs:
         preferred_codec = "audio/wav"
     t_chat0 = time.time()
-    # KI-Z7 (2026-05-15) — pre-turn snapshot for the returning-user-recall
-    # detector below. Defaults match the "no session yet" case so the
-    # detector simply doesn't fire on the legacy orchestrator path.
+    # Pre-turn snapshot for the returning-user-recall detector below.
+    # Defaults match the "no session yet" case.
     _pre_turn_name: str = ""
     _pre_turn_idx: int = 0
-    # KI-106 — never let an inner TimeoutError / unhandled exception bubble out
-    # of handle_turn as a 500. C4 NRI persona saw 5× HTTP 500s with
-    # "Orchestrator failed: TimeoutError" because the outer non-fact-find
-    # brain call propagated asyncio.TimeoutError from KI-099/100 wait_for
-    # wrappers. We also wrap the whole call in an outer 45s budget so even a
-    # pathological hang inside handle_turn surfaces as a graceful reply,
-    # not a connection-reset to the user. 45s is generous but tighter than
-    # HF Space's gateway timeout, so the user always gets a response.
+    # Never let an inner TimeoutError / unhandled exception bubble out of
+    # handle_turn as a 500. The whole call is wrapped in an outer 45s
+    # budget so even a pathological hang inside handle_turn surfaces as a
+    # graceful reply, not a connection-reset to the user. 45s is generous
+    # but tighter than HF Space's gateway timeout, so the user always gets
+    # a response.
     try:
         if USE_SINGLE_BRAIN:
-            # Path B — one Gemini call per turn with native function-calling.
-            # Falls back to the legacy orchestrator on SingleBrainError so a
-            # missing GOOGLE_API_KEY / model outage never breaks the chat.
+            # One Gemini call per turn with native function-calling.
+            # Falls back to nim_fallback on SingleBrainError so a missing
+            # GOOGLE_API_KEY / model outage never breaks the chat.
             from backend import single_brain
             from backend.session_state import get_session
 
@@ -826,13 +816,11 @@ async def chat(req: ChatRequest, request: Request):
                 getattr(_sb_session.profile, "name", None) or ""
             ).strip()
             _pre_turn_idx = int(getattr(_sb_session, "turn_idx", 0) or 0)
-            # Z2 fix — Issue 3 (brain election bouncing). Once a session
-            # has had ANY successful single_brain turn, it must stay on
-            # single_brain for the rest of its lifetime. Falling back to
-            # the legacy orchestrator mid-stream (which is what Priya saw
-            # 6 turns in a row) discards everything single_brain captured
-            # in last_recommendation_ids / last_retrieved_chunks /
-            # slug_to_insurer and confuses the user. Sticky check below.
+            # Once a session has had ANY successful single_brain turn, it
+            # must stay on single_brain for the rest of its lifetime.
+            # Switching brains mid-stream would discard everything
+            # single_brain captured in last_recommendation_ids /
+            # last_retrieved_chunks / slug_to_insurer. Sticky check below.
             _sb_was_sticky = getattr(_sb_session, "single_brain_sticky", False)
             try:
                 turn = await asyncio.wait_for(
@@ -851,14 +839,13 @@ async def chat(req: ChatRequest, request: Request):
                     pass
             except single_brain.SingleBrainError as _sb_err:
                 if _sb_was_sticky:
-                    # Z2 belt+suspenders — session already had a clean
-                    # single_brain turn. Do NOT cross-fade to the legacy
-                    # orchestrator (loses turn state + frontend sees the
-                    # brain hop). Emit a graceful retry prompt instead.
+                    # Session already had a clean single_brain turn. Do NOT
+                    # cross-fade to the fallback brain (loses turn state +
+                    # frontend sees the brain hop). Emit a graceful retry
+                    # prompt instead.
                     logging.warning(
                         "single_brain failed on STICKY session (session=%s); "
-                        "emitting graceful retry, NOT falling back to "
-                        "orchestrator: %s",
+                        "emitting graceful retry, NOT falling back: %s",
                         session_id, _sb_err,
                     )
                     turn = single_brain.TurnResult(
@@ -893,9 +880,8 @@ async def chat(req: ChatRequest, request: Request):
                         timeout=20.0,
                     )
         else:
-            # Legacy orchestrator path is gone (CLEAN2 deletion). When
-            # USE_SINGLE_BRAIN is off, route directly through the minimal
-            # NIM fallback so the bot still serves a reply.
+            # When USE_SINGLE_BRAIN is off, route directly through the
+            # minimal NIM fallback so the bot still serves a reply.
             from backend.session_state import get_session as _get_session
             turn = await asyncio.wait_for(
                 nim_fallback.handle_turn_fallback(
@@ -962,7 +948,7 @@ async def chat(req: ChatRequest, request: Request):
             profile_complete=_compute_profile_complete(session_id),
         )
 
-    # U1 Test 9 — server-side closer-keyword safety net for RULE 7.
+    # Server-side closer-keyword safety net for RULE 7.
     # If the user clearly committed to a policy this turn but Gemini did
     # NOT call mark_recommendation (single_brain stamps "mark_recommendation"
     # into turn.brain_used when the tool fires — see single_brain.py:1052),
@@ -1172,11 +1158,11 @@ async def chat(req: ChatRequest, request: Request):
 
     audio_b64 = None
     audio_mime: Optional[str] = None
-    # KI-278 (2026-05-16) — when TTS fails we now propagate a STRUCTURED,
-    # user-facing notice instead of silently dropping the audio. The text
-    # reply is still returned in full; the frontend renders a small inline
-    # "voice unavailable" line under the bot bubble so the user understands
-    # WHY there's no voice (root cause this fixed: Sarvam 429 / no credits).
+    # When TTS fails we propagate a STRUCTURED, user-facing notice instead
+    # of silently dropping the audio. The text reply is still returned in
+    # full; the frontend renders a small inline "voice unavailable" line
+    # under the bot bubble so the user understands why there's no voice
+    # (e.g. Sarvam 429 / no credits).
     tts_error_code: Optional[str] = None
     tts_user_message: Optional[str] = None
     if req.return_audio and turn.reply_text:
@@ -1932,9 +1918,9 @@ class ProfileUpdateRequest(BaseModel):
     parents_has_ped: Optional[bool] = None
     health_conditions: Optional[list[str]] = None
     budget_band: Optional[str] = None
-    # KI — profile-builder UI now collects these 4; they exist on the Profile
-    # dataclass + chat-path save_profile_field but were being silently dropped
-    # from POST /api/profile because they weren't whitelisted here.
+    # Collected by the profile-builder UI; also present on the Profile
+    # dataclass + chat-path save_profile_field. Whitelisted here so
+    # POST /api/profile accepts them.
     desired_sum_insured_inr: Optional[int] = None
     copay_pct: Optional[int] = None
     family_medical_history: Optional[list[str]] = None
@@ -1971,8 +1957,8 @@ async def session_clear(req: SessionClearRequest):
     The on-disk profile JSON under `40-data/profiles/` is intentionally NOT
     touched — it remains durable user data keyed by persona_id / name slug.
     The next time the user volunteers their name in conversation, the
-    confirmation-gated recall flow (see orchestrator's `pending_profile_recall`)
-    will ask before merging the prior captures.
+    confirmation-gated recall flow (see session_state's
+    `pending_profile_recall`) will ask before merging the prior captures.
 
     Body : {session_id: str}
     Reply: {cleared: bool, new_session_id: str}
@@ -2136,9 +2122,9 @@ async def profile_completeness_view(session_id: Optional[str] = None):
     missing = [k for k, v in profile_dict.items() if k not in answered or v in (None, "", [])]
     hint = None
     try:
-        # KI-167 WS3 (2026-05-15) — next_question now returns the field name
-        # (str) of the next missing slot, not a Question object. Frontend uses
-        # this as a slot-hint; the actual phrasing is generated by sales_brain.
+        # next_question returns the field name (str) of the next missing
+        # slot. The frontend uses it as a slot-hint; the actual phrasing
+        # is generated by the single-brain LLM.
         hint = next_question(p)
     except Exception:
         pass
@@ -2844,12 +2830,12 @@ def _policy_corroborated_si(policy_id: str | None) -> "_si.SumInsuredView":
     return _rationalise_si(data, si)
 
 
-# KI-145 (2026-05-15) — decision-critical fields used to distinguish a
-# RENAME (curated entry folds onto extracted parent) from a VARIANT (same
-# UIN but materially different product — must stay as its own card).
-# Same UIN ≠ same product: regulators file one "wordings" PDF that covers
-# multiple marketed variants (e.g. ProHealth Prime vs ProHealth Protect
-# both filed under MCIHLIP24011V072324; copay/PED/maternity/NCB differ).
+# Decision-critical fields that distinguish a RENAME (curated entry folds
+# onto extracted parent) from a VARIANT (same UIN but materially different
+# product — must stay as its own card). Same UIN ≠ same product:
+# regulators file one "wordings" PDF that covers multiple marketed variants
+# (e.g. ProHealth Prime vs ProHealth Protect both filed under
+# MCIHLIP24011V072324; copay/PED/maternity/NCB differ).
 _KI145_DIFF_FIELDS: tuple[str, ...] = (
     "copayment_pct",
     "pre_existing_disease_waiting_months",
@@ -3229,14 +3215,14 @@ async def policies_all(session_id: Optional[str] = None):
         data = _merge_curated(data, curated_for_this)
         seen_policy_ids.add(policy_id_local)
         slug = data.get("insurer_slug", "")
-        # KI-132 (2026-05-15) — regulatory is not an insurer; drop entirely
-        # from the marketplace. IRDAI/NHA docs are still retrieved and cited
-        # in chat answers, they just don't appear as marketplace cards.
+        # Regulatory is not an insurer; drop entirely from the marketplace.
+        # IRDAI/NHA docs are still retrieved and cited in chat answers, they
+        # just don't appear as marketplace cards.
         if slug == "regulatory":
             continue
-        # KI-133 (2026-05-15) — dedup by product (insurer__product), so the
-        # wordings PDF wins and the brochure/cis variants don't generate
-        # duplicate cards. Pass-1 sort order guarantees wordings comes first.
+        # Dedup by product (insurer__product), so the wordings PDF wins and
+        # the brochure/cis variants don't generate duplicate cards. Pass-1
+        # sort order guarantees wordings comes first.
         product_key = _product_key_of(policy_id_local)
         if product_key in seen_product_keys:
             continue
@@ -4254,10 +4240,10 @@ class RecallByNameRequest(BaseModel):
 
 class RecallByNameResponse(BaseModel):
     found: bool
-    # PRIVACY FIX (2026-05-16, audit). The endpoint no longer hydrates the
-    # session off a bare name (weak/shared key → stranger-PII leak). When a
-    # stored profile matches, the response asks the UI to confirm identity
-    # FIRST. `profile`/`predicted_band` are never returned pre-confirmation.
+    # The endpoint does not hydrate the session off a bare name (weak/shared
+    # key → stranger-PII leak). When a stored profile matches, the response
+    # asks the UI to confirm identity FIRST. `profile`/`predicted_band` are
+    # never returned pre-confirmation.
     requires_confirmation: bool = False
     name: Optional[str] = None          # stored display name, for the prompt
     summary: Optional[dict] = None      # non-PII identity hints, for the prompt
@@ -4270,16 +4256,15 @@ class RecallByNameResponse(BaseModel):
 async def recall_profile_by_name(req: RecallByNameRequest):
     """Stage a stored named-profile match for `session_id` (if any).
 
-    PRIVACY FIX (2026-05-16, audit). A bare name is a weak, shared,
-    guessable key. This endpoint NO LONGER auto-hydrates the session — a
-    second user on a shared browser/IP, or anyone stating a common first
-    name, must not be silently served a stranger's stored profile. When a
-    match exists the response carries `found=True, requires_confirmation=
-    True, name, summary` so the UI renders an explicit "are you <name>?"
-    prompt. The stored fields are applied to the session only after the
-    user confirms (handled on the chat affirmation path via
-    session_state.apply_pending_recall). Returns `found=False` when the
-    slug doesn't resolve to a stored file.
+    A bare name is a weak, shared, guessable key, so this endpoint does not
+    auto-hydrate the session — a second user on a shared browser/IP, or
+    anyone stating a common first name, must not be silently served a
+    stranger's stored profile. When a match exists the response carries
+    `found=True, requires_confirmation=True, name, summary` so the UI
+    renders an explicit "are you <name>?" prompt. The stored fields are
+    applied to the session only after the user confirms (handled on the
+    chat affirmation path via session_state.apply_pending_recall). Returns
+    `found=False` when the slug doesn't resolve to a stored file.
     """
     from backend.profile_persistence import recall_by_name_payload
 

backend/needs_finder.py

@@ -1,13 +1,11 @@
 """User profile state + slot-order hint for the fact-find.
 
-KI-167 WS3 (2026-05-15) — the legacy rules-engine question GRAPH and the
-matching `Question` dataclass have been removed. Fact-find phrasing now
-lives in `backend/sales_brain.py` (the single-LLM-call brain); this module
-keeps only:
+Fact-find phrasing lives in `backend/single_brain.py` (the single-LLM-call
+brain); this module provides:
 
-  - `Profile`              — accumulated user state (still imported widely)
+  - `Profile`              — accumulated user state (imported widely)
   - `record_answer`        — slot-write helper used by session_state
-  - INR / budget / income parsers — used by `sales_brain_normalizer.py`
+  - INR / budget / income parsers — used by the brain tool layer
   - `is_field_set`         — local helper for record_answer + next_question
   - `next_question`        — returns the field NAME (str) of the next
                              missing slot in canonical order. Used by
@@ -63,11 +61,9 @@ class Profile:
 
 
 # ----------------------------------------------------------------------------
-# KI-149 (2026-05-15) — free-text INR amount parser for budget + income.
-# User said "I maximum 30000 I can pay" → bot re-asked budget because no
-# parser was attached to the budget Question and the LLM brain failed to
-# capture it. Bare digits ("30000"), "30 thousand", "30 grand", "₹30,000",
-# "1 lakh", "1.5L" must all map cleanly to a rupee amount.
+# Free-text INR amount parser for budget + income. Bare digits ("30000"),
+# "30 thousand", "30 grand", "₹30,000", "1 lakh", "1.5L" all map cleanly
+# to a rupee amount.
 # ----------------------------------------------------------------------------
 
 def _parse_inr_amount(text: str) -> Optional[int]:
@@ -82,13 +78,10 @@ def _parse_inr_amount(text: str) -> Optional[int]:
       - strips fluff: "maximum 30000", "I can pay 30000", "around 25000"
       - tolerates per-year qualifiers: "/year", "per year", "p.a."
 
-    KI-161 (2026-05-15) — REJECTS bare digits below ₹1000 (no plausible
-    annual health insurance budget/income falls there) and REJECTS any
-    text whose only number is in an age context ("29 years old", "age 29",
-    "I am 29"). Origin: user answered the age question with "I am 29
-    years old" and the parser wrote ₹29 into both budget_band and
-    income_band, leading the bot to claim it captured age + income + budget
-    from a single utterance.
+    Rejects bare digits below ₹1000 (no plausible annual health insurance
+    budget/income falls there) and rejects any text whose only number is
+    in an age context ("29 years old", "age 29", "I am 29"), so an age
+    answer is never misread as a rupee amount.
 
     Returns the integer rupee amount, or None if no number is recognisable
     or if the only numbers in the text are clearly not currency.
@@ -209,10 +202,10 @@ def _parse_income_band(text: str) -> Optional[str]:
 # Engine
 # ----------------------------------------------------------------------------
 
-# KI-167 WS3 (2026-05-15) — canonical slot order for the fact-find hint API.
-# The actual question phrasing lives in `sales_brain.py`; this list only
-# encodes which Profile attribute we want to fill next when nothing else
-# is driving the conversation.
+# Canonical slot order for the fact-find hint API. The actual question
+# phrasing lives in `single_brain.py`; this list only encodes which
+# Profile attribute to fill next when nothing else is driving the
+# conversation.
 _SLOT_ORDER: list[str] = [
     "name",
     "age",
@@ -238,11 +231,9 @@ def is_field_set(profile: Profile, field_name: str) -> bool:
 def next_question(profile: Profile) -> Optional[str]:
     """Return the field NAME of the next missing slot, or None if complete.
 
-    KI-167 WS3 (2026-05-15) — refactored from `Optional[Question]` to
-    `Optional[str]` after the rules-engine GRAPH was deleted. The caller in
-    `backend/main.py:/api/profile/completeness` uses this only to hint to the
-    frontend which slot to ask next; the actual question phrasing is now
-    produced by `sales_brain.py`.
+    The caller in `backend/main.py:/api/profile/completeness` uses this
+    only to hint to the frontend which slot to ask next; the actual
+    question phrasing is produced by `single_brain.py`.
 
     A free-form session (user driving free questions) returns None so the
     hint endpoint reports "nothing to ask".
@@ -256,10 +247,9 @@ def next_question(profile: Profile) -> Optional[str]:
     return None
 
 
-# Legacy GRAPH question-id → Profile field-name aliases. Some callers
-# (notably `session_state.record_answer` driven by `awaiting_question_id`)
-# still pass the old question IDs from the deleted GRAPH. Mapping them here
-# keeps that call path working without resurrecting the GRAPH.
+# Question-id → Profile field-name aliases. Some callers (notably
+# `session_state.record_answer` driven by `awaiting_question_id`) pass a
+# question ID rather than a Profile attribute name; this maps them.
 _QID_TO_FIELD: dict[str, str] = {
     "existing_cover": "existing_cover_inr",
     "location": "location_tier",
@@ -271,10 +261,9 @@ _QID_TO_FIELD: dict[str, str] = {
 def record_answer(profile: Profile, question_id: str, raw_answer: Any) -> Profile:
     """Mutate profile in place with a raw answer for a named slot.
 
-    KI-167 WS3 (2026-05-15) — parser dispatch used to live on `Question`
-    objects in the deleted GRAPH; with the GRAPH gone we apply the same
-    parser map inline. `question_id` may be either a Profile attribute name
-    (preferred) or one of the legacy GRAPH question IDs from `_QID_TO_FIELD`.
+    Applies the parser map inline. `question_id` may be either a Profile
+    attribute name (preferred) or one of the question IDs in
+    `_QID_TO_FIELD`.
     """
     field_name = _QID_TO_FIELD.get(question_id, question_id)
     if not hasattr(profile, field_name):

backend/nim_fallback.py

@@ -1,16 +1,16 @@
 """Minimal NIM fallback for first-turn Gemini 503.
 
-Replaces the 5,219 LOC legacy orchestrator stack. Does ONE thing: when
-single_brain raises SingleBrainError on the first turn (no
-single_brain_sticky yet), give the user a working reply using NIM.
+Does ONE thing: when single_brain raises SingleBrainError on the first
+turn (no single_brain_sticky yet), give the user a working reply using
+NIM.
 
 No tools, no function-calling, no faithfulness gate, no normalizer —
 just a single NIM chat call with a tiny system prompt. The user gets a
 polite "let me think out loud while I reconnect" reply; the next turn,
 single_brain (Gemini) takes over and the session sticks.
 
-KI-155 / ADR-038: NIM-only. We elect via llm_health.get_primary("brain")
-which walks BRAIN_CHAIN in priority order over election-eligible models.
+NIM-only. We elect via llm_health.get_primary("brain") which walks
+BRAIN_CHAIN in priority order over election-eligible models.
 If the elector has nothing eligible, we fall back to BRAIN_CHAIN[0] as a
 last resort so the user still gets a reply.
 
@@ -96,9 +96,9 @@ def _pick_model() -> str:
 
 
 def _flatten_history(chat_history: Optional[list[dict]]) -> list[ChatMessage]:
-    """Translate the orchestrator-style chat_history ({role, content})
-    into the NIM `ChatMessage` shape. Roles other than user/assistant
-    are dropped; assistant aliases collapse to `assistant`.
+    """Translate the {role, content} chat_history into the NIM
+    `ChatMessage` shape. Roles other than user/assistant are dropped;
+    assistant aliases collapse to `assistant`.
     """
     out: list[ChatMessage] = []
     for msg in chat_history or []:

backend/policy_identity.py

@@ -1,20 +1,18 @@
-"""Canonical policy identity + dedup — SINGLE SOURCE OF TRUTH (KI-280).
+"""Canonical policy identity + dedup — SINGLE SOURCE OF TRUTH.
 
-The marketplace endpoint `main.py /api/policies/all` already established the
-canonical-identity rule (KI-133 / KI-141 / KI-142 / KI-145):
+The canonical-identity rule:
 
     1 unique IRDAI UIN  =  1 unique product (UIN-primary invariant).
     When no UIN is present, the product_key = the policy_id with any
     trailing doctype suffix (`__wordings` / `__brochure` / `__cis` /
     `__prospectus`) stripped.
 
-The recommendation-fit gate (retrieval_filters.dedup_by_policy) used to key
-ONLY on the exact `policy_id`, so two chunks for the SAME product but with
-different ids — a marketing rename ("my:Optima Secure" vs
-"my:Optima Secure (older variant)") or two doctype siblings
-(`...__wordings` vs `...__brochure`) — were both emitted as separate CITED
-cards (audit personas P2/P4/P7). The marketplace and the recommender
-disagreed on what "the same policy" means.
+Both the marketplace endpoint (`main.py /api/policies/all`) and the
+recommendation-fit gate (retrieval_filters.dedup_by_policy) key on this
+rule, so two chunks for the SAME product with different ids — a marketing
+rename ("my:Optima Secure" vs "my:Optima Secure (older variant)") or two
+doctype siblings (`...__wordings` vs `...__brochure`) — collapse to one
+identity and the two surfaces agree on what "the same policy" means.
 
 This module factors that one rule so BOTH surfaces share it. It is
 deliberately dependency-free (no FastAPI / Chroma import) so

backend/premium_calculator.py

@@ -817,35 +817,25 @@ _DEFAULT_BAND_POLICY_IDS: list[str] = [
 
 
 # ───────────────────────────────────────────────────────────────────────────
-# SI RECONCILIATION (KI-278, 2026-05-16) — single source of truth for the
-# sum-insured the header band AND the per-settings panel both price at.
-#
-# THE HEADER≠PANEL BUG: PremiumCalculatorPanel (page.tsx) seeds its SI slider
-# from `desired_sum_insured_inr ?? existing_cover_inr ?? 1_000_000`, but
-# estimate_premium_band() used to hard-code sum_insured_default=₹10L and
-# IGNORE the profile entirely. So a user who stated a ₹25L target saw the
-# header chip priced at ₹10L (₹6,500–₹26,500) while the panel priced the
-# same profile at ₹25L (point ₹19,100) — contradictory numbers for one
-# profile. Resolving BOTH surfaces' SI from this one function makes them
-# reconcile by construction: the panel's point estimate now falls inside
-# the header band because the header band is the SAME basket priced at the
-# SAME profile-resolved SI.
+# Single source of truth for the sum-insured the header band AND the
+# per-settings panel both price at. Resolving both surfaces' SI from this
+# one function makes them reconcile by construction: the panel's point
+# estimate falls inside the header band because the header band is the
+# SAME basket priced at the SAME profile-resolved SI.
 #
 # Precedence MUST stay byte-identical to PremiumCalculatorPanel's
 # useState initialiser (frontend/src/app/page.tsx ~L2417) and
 # PolicyPremiumWidget's initialSumInsured contract:
 #   1. profile.desired_sum_insured_inr  (user's stated target SI)
 #   2. profile.existing_cover_inr       (closest available signal)
-#   3. fallback default                 (legacy ₹10L)
+#   3. fallback default                 (₹10L)
 # ───────────────────────────────────────────────────────────────────────────
 
-# SI RATIONALISATION (D2, 2026-05-16) — the global ₹5 L / ₹1 Cr clamp
-# (SI_FLOOR_INR / SI_CEILING_INR) was REMOVED. Pricing now respects each
-# policy's own real SI bounds and the user's actual stated target instead of
-# squashing every profile into one synthetic envelope. A ₹2 Cr aspiration
-# now prices at ₹2 Cr; a ₹1 L corporate top-up prices at ₹1 L. When a policy
-# has no published SI the caller prices against the user's
-# desired_sum_insured_inr (else ₹10 L default) and surfaces a disclosure.
+# Pricing respects each policy's own real SI bounds and the user's actual
+# stated target rather than a global clamp: a ₹2 Cr aspiration prices at
+# ₹2 Cr; a ₹1 L corporate top-up prices at ₹1 L. When a policy has no
+# published SI the caller prices against the user's desired_sum_insured_inr
+# (else ₹10 L default) and surfaces a disclosure.
 
 
 def resolve_profile_sum_insured(
@@ -864,9 +854,9 @@ def resolve_profile_sum_insured(
     string/None gracefully and snaps to the nearest ₹50k so the resolved SI
     lands on a representable slider stop.
 
-    D2 (2026-05-16) — the global ₹5 L / ₹1 Cr clamp was REMOVED: the user's
-    actual stated target is honoured (a ₹2 Cr aspiration prices at ₹2 Cr, a
-    ₹1 L top-up at ₹1 L) rather than squashed into a synthetic envelope.
+    The user's actual stated target is honoured (a ₹2 Cr aspiration prices
+    at ₹2 Cr, a ₹1 L top-up at ₹1 L) rather than clamped to a synthetic
+    envelope.
     """
     profile = profile or {}
 

backend/profile_persistence.py

@@ -230,13 +230,6 @@ def extract_potential_name(text: str) -> Optional[str]:
     return raw
 
 
-# NOTE 2026-05-17: `extract_name_in_context` + its `_ASSISTANT_ASKED_NAME_RE`
-# / `_BARE_NAME_ANSWER_RE` regexes (b87bd2d, KI-RECALL-FIX) were REMOVED with
-# the deterministic in-conversation recall scaffolding. `extract_potential_name`
-# (above) and `try_recall_by_name` (below) remain — they back the explicit
-# POST /api/profile/recall-by-name endpoint, not an in-chat short-circuit.
-
-
 def try_recall_by_name(session, name: str) -> bool:
     """Look up a stored profile by name and STAGE it for confirmation.
 

backend/profile_rag.py

@@ -1,11 +1,10 @@
 """Customer-profile-as-RAG layer.
 
-KI-118 (2026-05-15) — profile chunks are now keyed by `name_slug` (the
-canonicalised user name), NOT by session_id. Only NAMED users ever get
-embedded; anonymous sessions never write to Chroma. This eliminates the
-corruption surface that the session_id-keyed chunks introduced (a missing
-session_id metadata field on the legacy `profile_anonymous` row poisoned
-every subsequent retrieval query — see KI-117 boot cleanup).
+Profile chunks are keyed by `name_slug` (the canonicalised user name),
+NOT by session_id. Only NAMED users ever get embedded; anonymous sessions
+never write to Chroma. Keying by name_slug avoids the corruption surface
+of session_id-keyed chunks (an anonymous row missing a session_id
+metadata field could poison session_id-scoped retrieval queries).
 
 At retrieval time, `rag/retrieve.py::retrieve(..., profile_name_slug=...)`
 boosts the user's profile chunk so the LLM sees the user's context inline
@@ -39,9 +38,8 @@ _log = logging.getLogger(__name__)
 def profile_to_chunk_text(profile: dict) -> str:
     """Render the profile dict as a natural-language paragraph for the LLM.
 
-    The shape matches what build_messages() in the orchestrator expects so
-    when this chunk is retrieved alongside policy chunks, the LLM sees a
-    coherent "USER CONTEXT" block.
+    Rendered as a coherent "USER CONTEXT" block so that when this chunk is
+    retrieved alongside policy chunks, the LLM sees the user's facts inline.
     """
     parts: list[str] = ["USER CONTEXT — facts about the person asking this question:"]
 
@@ -124,10 +122,8 @@ def _get_collection():
 async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
     """Embed the profile paragraph and store as a single chunk in Chroma.
 
-    KI-118 (2026-05-15) — keyed by `name_slug` (canonical user name) instead
-    of `session_id`. Only NAMED users ever get embedded — anonymous chats
-    never write to Chroma, which eliminates the corruption surface that the
-    session_id keying introduced.
+    Keyed by `name_slug` (canonical user name), not `session_id`. Only
+    NAMED users ever get embedded — anonymous chats never write to Chroma.
 
     Idempotent — calling this on every profile update is safe; existing
     chunks for the same name_slug get replaced.
@@ -138,14 +134,10 @@ async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
     if not text or len(text) < 30:
         return
 
-    # KI-112 (2026-05-15) / KI-118 — input guard 1: name_slug must be a
-    # non-empty str. Pre-fix, a missing/empty key caused upsert under id
-    # "profile_" with `policy_id` colliding across all anonymous sessions;
-    # the initial KI-102 deploy wrote a `profile_anonymous` chunk WITHOUT a
-    # session_id metadata field that poisoned every subsequent query whose
-    # `where` clause referenced session_id. Anonymous users no longer reach
-    # this function at all (the orchestrator gates on
-    # `session.profile.name` before calling) — this guard is belt-and-braces.
+    # Input guard 1: name_slug must be a non-empty str. An empty key would
+    # upsert under id "profile_" and collide across anonymous sessions.
+    # Callers gate on `session.profile.name` before calling, so anonymous
+    # users do not reach this function; this guard is belt-and-braces.
     if not isinstance(name_slug, str) or not name_slug.strip():
         _log.warning(
             "profile_rag.upsert_profile_chunk: refusing to write — name_slug "
@@ -157,11 +149,11 @@ async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
     embedder = LocalEmbeddings()
     [vec] = await embedder.embed([text], input_type="document")
 
-    # KI-112 (2026-05-15) — input guard 2: embedding must be a list of finite
-    # floats whose length matches the embedder's declared dimension. Pre-fix,
-    # an empty / None / mis-shaped embedding could be added to Chroma where it
-    # would silently corrupt HNSW (dangling pointer or shape mismatch). The
-    # corpus uses 384-dim BAAI/bge-small-en-v1.5; any other shape is a bug.
+    # Input guard 2: embedding must be a list of finite floats whose length
+    # matches the embedder's declared dimension. An empty / None / mis-shaped
+    # embedding added to Chroma would silently corrupt HNSW (dangling
+    # pointer or shape mismatch). The corpus uses 384-dim
+    # BAAI/bge-small-en-v1.5; any other shape is rejected.
     expected_dim = getattr(embedder, "dimension", None) or 384
     if (
         not isinstance(vec, (list, tuple))
@@ -184,20 +176,18 @@ async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
     try:
         coll.delete(where={"policy_id": chunk_id})
     except Exception as e:
-        # Non-fatal: chunk may not exist yet. KI-107 — at least log so
-        # silent corruption of the profile store is observable.
+        # Non-fatal: chunk may not exist yet. Log so a silent failure of
+        # the profile store is observable.
         _log.debug(
             "profile_rag.upsert_profile_chunk: delete(where=policy_id=%s) "
             "non-fatal failure: %s: %s",
             chunk_id, type(e).__name__, str(e)[:200],
         )
 
-    # KI-107 (2026-05-15) — wrap coll.add() in try/except. C5 port-in saw
-    # 3× HTTP 500 "Error finding id" cascade; one possible vector is a
-    # transient Chroma sqlite lock during HNSW compaction when add()
-    # interleaves with the retrieve path's get(). Make upsert non-fatal so
-    # the chat reply still returns even if the profile-chunk write fails.
-    # On next upsert (next profile field change), the retry will succeed.
+    # Wrap coll.add() in try/except so upsert is non-fatal: a transient
+    # Chroma sqlite lock during HNSW compaction (add() interleaving with
+    # the retrieve path's get()) must not break the chat reply. The next
+    # upsert (next profile field change) retries the write.
     try:
         coll.add(
             ids=[chunk_id],
@@ -208,8 +198,8 @@ async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
                 "insurer_slug": "profile",
                 "policy_name": f"User profile ({name_slug[:16]})",
                 "doc_type": "profile",
-                # KI-118 (2026-05-15) — stamp name_slug instead of session_id.
-                # The retrieve path filters profile chunks via this field.
+                # Stamp name_slug; the retrieve path filters profile
+                # chunks via this field.
                 "name_slug": name_slug,
                 "source_url": "",
                 "page_start": 0,
@@ -228,7 +218,7 @@ async def upsert_profile_chunk(name_slug: str, profile_dict: dict) -> None:
 
 
 def remove_profile_chunk(name_slug: str) -> None:
-    """Optional cleanup. KI-118 — keyed by name_slug."""
+    """Optional cleanup. Keyed by name_slug."""
     if not name_slug:
         return
     try:

backend/profile_store.py

@@ -14,8 +14,8 @@ Architectural answer to the "embed or JSON?" question:
     style questions. Embedding cost = once per update, not per query.
 
 Both layers stay in sync: when `save_profile()` is called here, the
-orchestrator also fires `profile_rag.upsert_profile_chunk()` so the
-Chroma side reflects the new state.
+save path also fires `profile_rag.upsert_profile_chunk()` so the Chroma
+side reflects the new state.
 
 Files live under `40-data/profiles/<normalised-name>.json`. Names are
 normalised to lowercase + alpha-only for the filename so "Rohit" and
@@ -48,8 +48,8 @@ def _normalise_name(name: str) -> str:
     return cleaned[:60]  # cap filename length
 
 
-# KI-062 (2026-05-15) — identity-defining fields used to disambiguate two
-# users with the same display name. Order matters for hash stability.
+# Identity-defining fields used to disambiguate two users with the same
+# display name. Order matters for hash stability.
 _PERSONA_ID_FIELDS: tuple[str, ...] = (
     "age", "dependents", "income_band", "location_tier", "parents_age_max",
 )
@@ -170,7 +170,7 @@ def load_profile(name: str, *, persona_id: Optional[str] = None) -> Optional[Pro
     p = _path_for(name)
     if p and p.exists():
         return _load_from_path(p)
-    # 3. (REMOVED) cross-identity display-name directory scan — leak vector.
+    # No cross-identity display-name directory scan (would be a leak vector).
     return None
 
 
@@ -266,10 +266,10 @@ def save_profile(name: str, profile: Profile, *, session_id: Optional[str] = Non
 
 
 # ---------------------------------------------------------------------------
-# KI-063 (2026-05-15) — per-user policy interaction tracking.
+# Per-user policy interaction tracking.
 #
 # Three event types are tracked on the Profile:
-#   shown    — auto-logged by orchestrator when a policy is cited in a
+#   shown    — auto-logged by the brain when a policy is cited in a
 #              recommendation / comparison turn that passed faithfulness.
 #   selected — user clicked "save / shortlist" on a policy card (frontend
 #              POSTs to /api/profile/select).

backend/providers/__init__.py

@@ -1,26 +1,17 @@
 """Provider clients — thin, async, behind a common interface.
 
-After the 2026-05-14 Stack A consolidation (D-019, partially superseded by
-D-022 on 2026-05-14 — NIM brain pool swap), the provider stack is:
+The provider stack:
 
   sarvam_stt.py        — Sarvam Saarika v2.5 (speech-to-text)
   sarvam_tts.py        — Sarvam Bulbul v2 (text-to-speech, speaker anushka)
   sarvam_llm.py        — Sarvam-M (Indic translation IN and OUT; not brain)
   local_embeddings.py  — BGE-small-en-v1.5 (local CPU embeddings)
-  nvidia_nim_llm.py    — Chain pattern via NimChainLLM. Current primaries (D-022):
-                           BRAIN_CHAIN[0]      = Qwen 3-Next 80B
-                           FAST_BRAIN_CHAIN[0] = Nemotron Nano 30B
-                           JUDGE_CHAIN[0]      = Mistral Large 3 675B
-                         DeepSeek V4-Pro / V4-Flash + Llama-4 Maverick (the
-                         original D-019 picks) are retained as fallback chain
-                         entries that re-enter rotation when NIM's pools
-                         recover from the 2026-05-14 outage.
-  openrouter_llm.py    — OpenRouter cross-provider fallback (bottom of every chain).
-  groq_llm.py          — Groq LPU; brain primary rotates 50/50 NIM ↔ Groq
-                         per call (KI-025 / ADR-026).
-
-See 70-docs/60-decisions/ADR-019, ADR-026, ADR-030 and 80-audit/ENTERPRISE_AUDIT.md
-(D-022 row) for the full provenance.
+  nvidia_nim_llm.py    — Chain pattern via NimChainLLM. BRAIN_CHAIN is the
+                         only chain: Qwen 3-Next 80B → Mistral Large 3
+                         675B → Llama-4 Maverick 17B → Nemotron-Super 49B
+                         (last resort).
+  openrouter_llm.py    — OpenRouter client (cross-provider option).
+  groq_llm.py          — Groq LPU client.
 
 All clients are async (use httpx.AsyncClient) so the FastAPI handlers can
 parallelize provider calls without blocking the event loop.

backend/providers/base.py

@@ -7,7 +7,7 @@ The interfaces are deliberately narrow:
 - An embeddings provider takes a list of strings and returns vectors.
 
 Concrete implementations live in sibling modules (sarvam_*, groq_*, voyage_*,
-openrouter_*). The orchestrator imports these by interface, never by concrete
+openrouter_*). Callers import these by interface, never by concrete
 class — so swapping providers is a config change.
 """
 

backend/providers/google_gemini_llm.py

@@ -1,9 +1,9 @@
-"""Google Gemini — primary LLM tier for sales_brain + orchestrator brain (KI-179).
+"""Google Gemini — primary LLM tier for the single-brain stack.
 
-Google AI Studio's free tier on `gemini-2.0-flash` and `gemini-2.5-flash` gives
-1500 req/day with native JSON mode (`responseMimeType: "application/json"`).
-This is best-in-class free quality for conversation and beats every model in
-NIM or OpenRouter free tiers.
+Google AI Studio's free tier on `gemini-2.5-flash` gives 1500 req/day
+with native JSON mode (`responseMimeType: "application/json"`). This is
+best-in-class free quality for conversation and beats every model in NIM
+or OpenRouter free tiers.
 
 Wire-shape: REST API direct via httpx (no SDK dependency — matches the pattern
 of nvidia_nim_llm.py and openrouter_llm.py).
@@ -35,9 +35,8 @@ JSON mode:
     response_format == {"type": "json_object"}  →
         generationConfig.responseMimeType = "application/json"
 
-The provider matches the existing `LLMProvider` interface so it slots
-straight into both sales_brain.py (Tier 0) and the orchestrator brain main
-path (Tier 0, via TieredBrainLLM wrapper).
+The provider matches the `LLMProvider` interface so it slots straight
+into the single-brain stack (single_brain.py) as the primary tier.
 """
 
 from __future__ import annotations
@@ -57,13 +56,13 @@ from backend.providers.base import ChatMessage, LLMProvider, LLMResult
 
 GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta/models"
 GEMINI_CACHE_URL = "https://generativelanguage.googleapis.com/v1beta/cachedContents"
-DEFAULT_MODEL = "gemini-2.5-flash"  # KI-183 retired gemini-2.0-flash → 2.5-flash (free-tier, brain-grade — see header). NOT the -lite tier: it silently broke single-brain tool-calling (save_profile_field) and caused the live fact-find regression.
+DEFAULT_MODEL = "gemini-2.5-flash"  # free-tier, brain-grade. NOT the -lite tier: it does not reliably support single-brain tool-calling (save_profile_field).
 
 # ----------------------------------------------------------------------------
-# KI-199 — module-level cachedContents registry.
+# Module-level cachedContents registry.
 #
 # Keyed by `(model, sha256(system_text))` so the same base preamble shared
-# across sales_brain calls deduplicates onto one cache. Each value is a small
+# across brain calls deduplicates onto one cache. Each value is a small
 # dict with the cache `name` (the server-side resource id used in subsequent
 # generateContent bodies as `cachedContent`) and the local-clock `expires_at`
 # wall-time so we can self-evict before issuing a guaranteed-miss request.
@@ -77,7 +76,7 @@ DEFAULT_MODEL = "gemini-2.5-flash"  # KI-183 retired gemini-2.0-flash → 2.5-fl
 _CACHE_REGISTRY: dict[tuple[str, str, str], dict] = {}
 _CACHE_REGISTRY_LOCK = threading.Lock()
 
-# A4 (2026-05-15) — Gemini cachedContents server-side TTL ceiling. Google's
+# Gemini cachedContents server-side TTL ceiling. Google's
 # `cachedContents` resources live up to ~60min on free tier; we refresh
 # before that ceiling so an in-flight call never lands on an expired cache.
 # `CACHE_REFRESH_AGE_SEC` is the wall-clock age at which we proactively
@@ -89,11 +88,11 @@ CACHE_REFRESH_AGE_SEC = 50 * 60  # 50min — refresh BEFORE 60min server ceiling
 def _cache_key(model: str, system_text: str, dynamic_prefix: str = "") -> tuple[str, str, str]:
     """Build the registry key for a (model, system_text, dynamic_prefix) tuple.
 
-    A4 (2026-05-15) — Cache key collision fix: SHA256 of preamble alone is
-    insufficient when `_dynamic_profile_block` varies per persona. The key
-    now partitions on a separate `dynamic_prefix` hash so per-persona
-    caches don't collide on the same static preamble hash. `dynamic_prefix`
-    defaults to "" so existing callers retain prior behaviour.
+    The key partitions on a separate `dynamic_prefix` hash (in addition to
+    the preamble SHA256) so per-persona caches don't collide on the same
+    static preamble hash when `_dynamic_profile_block` varies per persona.
+    `dynamic_prefix` defaults to "" so callers that don't pass it get the
+    preamble-only key.
 
     Hashing inputs rather than storing the raw string keeps the registry
     footprint tiny even when the preamble is multi-KB.
@@ -104,18 +103,18 @@ def _cache_key(model: str, system_text: str, dynamic_prefix: str = "") -> tuple[
 
 
 # ---------------------------------------------------------------------------
-# A4 (2026-05-15) — Normalized provider error class.
+# Normalized provider error class.
 #
 # Gemini's REST surface returns different error shapes for different failure
 # modes (429 rate-limit, 400 BlockedReason / SafetyRating, 404 cache not
-# found, 500/503 server errors). The tier wrapper needs a stable contract:
+# found, 500/503 server errors). The brain tier needs a stable contract:
 # `BrainProviderError(retryable=bool)` where `retryable=True` signals the
 # tier should fall through to the next provider, and `retryable=False`
 # signals a hard error (auth / content blocked) that should surface to the
 # caller without burning fallback budget.
 # ---------------------------------------------------------------------------
 class BrainProviderError(RuntimeError):
-    """Stable provider-error envelope consumed by TieredBrainLLM.
+    """Stable provider-error envelope consumed by the brain tier.
 
     Attributes:
       provider:   short name ("gemini" / "nim" / ...)
@@ -142,7 +141,7 @@ class BrainProviderError(RuntimeError):
 def _classify_gemini_error(status_code: int, detail: str) -> BrainProviderError:
     """Map a Gemini REST response into BrainProviderError(retryable=bool).
 
-    Routing rules (matches TieredBrainLLM expectations):
+    Routing rules (the brain tier's expectations):
       - 429 (rate-limit / quota)              → retryable (next tier)
       - 5xx (server errors)                   → retryable (next tier)
       - 408 / 504 (timeout)                   → retryable
@@ -184,9 +183,9 @@ def invalidate_cache(model: str, system_text: str, dynamic_prefix: str = "") ->
     alive (it will lapse on TTL), but our reference is gone so the next
     chat() call provisions a fresh one.
 
-    A4 (2026-05-15) — `dynamic_prefix` is an optional partition arg; defaults
-    to "" so existing callers retain prior behaviour. When supplied, only the
-    matching (model, system_text, dynamic_prefix) entry is dropped.
+    `dynamic_prefix` is an optional partition arg; defaults to "". When
+    supplied, only the matching (model, system_text, dynamic_prefix)
+    entry is dropped.
     """
     key = _cache_key(model, system_text, dynamic_prefix)
     with _CACHE_REGISTRY_LOCK:
@@ -270,8 +269,7 @@ class GoogleGeminiLLM(LLMProvider):
         Re-uses an existing live cache from the module registry when the
         (model, system_text) pair matches AND the local `expires_at` is still
         in the future. Cache misses + creation failures are silent (logged at
-        INFO) so a caching outage never breaks the main path — KI-199 brief
-        requires fail-safe behaviour.
+        INFO) so a caching outage never breaks the main path (fail-safe).
         """
         if not self.api_key or not system_text:
             return None
@@ -280,8 +278,8 @@ class GoogleGeminiLLM(LLMProvider):
         now = time.time()
         with _CACHE_REGISTRY_LOCK:
             entry = _CACHE_REGISTRY.get(key)
-            # A4 (2026-05-15) — TWO-stage refresh:
-            #   (a) self-evict ~10s before LOCAL expires_at (was already here).
+            # TWO-stage refresh:
+            #   (a) self-evict ~10s before LOCAL expires_at.
             #   (b) PROACTIVELY refresh if the entry is older than
             #       CACHE_REFRESH_AGE_SEC (50min) regardless of expires_at —
             #       guards against server-side TTL drift on long-lived
@@ -349,8 +347,8 @@ class GoogleGeminiLLM(LLMProvider):
                 # truth, but we shadow it locally so we self-evict before
                 # the inevitable 4xx on an expired reference.
                 "expires_at": now_create + ttl_seconds,
-                # A4 (2026-05-15) — created_at lets us proactively refresh
-                # entries that have lived past CACHE_REFRESH_AGE_SEC even
+                # created_at lets us proactively refresh entries that have
+                # lived past CACHE_REFRESH_AGE_SEC even
                 # when caller set a longer TTL than Google honours.
                 "created_at": now_create,
             }
@@ -410,12 +408,11 @@ class GoogleGeminiLLM(LLMProvider):
         # connection releases its slot on its own deadline rather than holding
         # past the outer wait_for cancellation.
         #
-        # A4 (2026-05-15) — Timeout binding: bind the SDK/httpx read timeout
-        # to `self.timeout - 2.0` so the underlying connection times out
-        # ~2s BEFORE the tier-wrapper's outer wait_for cancellation. This
-        # surfaces a clean BrainProviderError(retryable=True) instead of
-        # asyncio.CancelledError leaking up through the cancellation chain
-        # (which the tier wrapper has historically misclassified).
+        # Timeout binding: bind the httpx read timeout to
+        # `self.timeout - 2.0` so the underlying connection times out ~2s
+        # BEFORE the outer wait_for cancellation. This surfaces a clean
+        # BrainProviderError(retryable=True) instead of an
+        # asyncio.CancelledError leaking up through the cancellation chain.
         read_timeout = max(2.0, self.timeout - 2.0)
         client_timeout = httpx.Timeout(
             connect=2.0,
@@ -430,9 +427,9 @@ class GoogleGeminiLLM(LLMProvider):
             except (asyncio.CancelledError, KeyboardInterrupt, SystemExit):
                 raise
             except httpx.TimeoutException as e:
-                # A4 (2026-05-15) — TimeoutException → retryable
-                # BrainProviderError so the tier wrapper falls through
-                # cleanly instead of seeing asyncio.CancelledError.
+                # TimeoutException → retryable BrainProviderError so the
+                # tier falls through cleanly instead of seeing
+                # asyncio.CancelledError.
                 raise BrainProviderError(
                     f"Gemini timeout after {read_timeout:.1f}s (model={self.model})",
                     provider="gemini", retryable=True, status=None,
@@ -443,7 +440,7 @@ class GoogleGeminiLLM(LLMProvider):
                     f"Gemini transport error ({type(e).__name__}): {str(e)[:200]}",
                     provider="gemini", retryable=True, status=None,
                 ) from e
-            # KI-199 — graceful fallback when a cache reference is stale.
+            # Graceful fallback when a cache reference is stale.
             # Symptoms: 400/404 with body mentioning "cachedContent" /
             # "cache" / "not found". Strip the reference, re-add the inline
             # systemInstruction, drop the registry entry, retry once.
@@ -484,8 +481,8 @@ class GoogleGeminiLLM(LLMProvider):
                         provider="gemini", retryable=True, status=None,
                     ) from e
             if resp.status_code >= 400:
-                # A4 (2026-05-15) — Normalize the error into BrainProviderError
-                # so the tier wrapper sees a stable contract:
+                # Normalize the error into BrainProviderError so the tier
+                # sees a stable contract:
                 #   retryable=True  → fall through to next tier
                 #   retryable=False → surface to caller (auth/content-block)
                 # The original httpx.HTTPStatusError is preserved as __cause__
@@ -542,13 +539,12 @@ def get_gemini_llm(
 ) -> GoogleGeminiLLM:
     """Return a fresh GoogleGeminiLLM client.
 
-    25s timeout matches the KI-179 brief — Gemini Flash typically responds in
-    1-3s so 25s is a generous outer bound that still bails fast on a quota /
-    network stall.
+    Gemini Flash typically responds in 1-3s so the 25s default timeout is
+    a generous outer bound that still bails fast on a quota / network
+    stall.
 
     Common models:
-      - "gemini-2.0-flash"   → fast, conversational, sales_brain Tier 0
-      - "gemini-2.5-flash"   → slightly heavier reasoning, brain main Tier 0
+      - "gemini-2.5-flash"   → conversational brain tier (default)
     """
     return GoogleGeminiLLM(model=model, timeout=timeout)
 

backend/providers/groq_llm.py

@@ -104,8 +104,8 @@ class GroqLLM(LLMProvider):
                     continue
                 resp.raise_for_status()
                 break
-            # KI-085 (2026-05-15) — stamp credits_remaining from Groq's
-            # x-ratelimit-* headers BEFORE we drop the response. Groq is
+            # Stamp credits_remaining from Groq's x-ratelimit-* headers
+            # BEFORE we drop the response. Groq is
             # the highest-fidelity provider on this front: every successful
             # call returns the daily-tokens remaining, so we get a
             # continuously-updated election signal at zero extra cost.

backend/providers/local_embeddings.py

@@ -7,8 +7,8 @@ Default model: BAAI/bge-small-en-v1.5 — 384-dim, ~110MB, top-of-class on
 MTEB English benchmark for its size. Faster than 1024-dim cloud models on
 CPU and trivially small on GPU.
 
-The interface matches EmbeddingsProvider exactly, so the orchestrator and
-RAG pipeline don't change — just the import in ingest/retrieve.
+The interface matches EmbeddingsProvider exactly, so the RAG pipeline
+doesn't change — only the import in ingest/retrieve.
 """
 
 from __future__ import annotations
@@ -73,10 +73,10 @@ class LocalEmbeddings(EmbeddingsProvider):
             texts = [f"Represent this sentence for searching relevant passages: {t}" for t in texts]
         # Batch size scales by device: MPS / CUDA throughput benefits from
         # bigger batches; CPU prefers smaller to avoid memory pressure on M1.
-        # KI-125 (2026-05-15): bumped MPS 64→128 to halve the number of GPU
-        # kernel launches during bulk re-ingest. 800-token chunks at 128 ≈
-        # 100 MB per batch — still well within Mac M-series unified memory.
-        # CPU stays at 32 to keep peak RSS bounded on machines without a GPU.
+        # MPS/CUDA use batch 128 to minimise GPU kernel launches during
+        # bulk re-ingest (800-token chunks at 128 ≈ 100 MB per batch, well
+        # within Mac M-series unified memory). CPU stays at 32 to keep peak
+        # RSS bounded on machines without a GPU.
         batch = 128 if self.device in ("mps", "cuda") else 32
         vectors = self.model.encode(
             texts,

backend/providers/nvidia_nim_llm.py

@@ -5,20 +5,18 @@ POST https://integrate.api.nvidia.com/v1/chat/completions.
 
 Why NIM:
   - Frontier open-weights models hosted free (no card, no daily cap, 40 req/min)
-  - Single provider replaces OpenRouter + DeepSeek-direct + Cerebras + Groq
+  - Single provider for the reasoning stack
   - Same Bearer-auth + OpenAI request shape — drop-in retry/backoff
 
-Role (collapsed 2026-05-15 — single brain only):
+Role:
   - Brain (every reasoning turn): one elected candidate from BRAIN_CHAIN.
       The chain is ordered Qwen 3-Next → Mistral Large 3 → Llama-4 Maverick
-      → Nemotron-Super (last resort). Election (KI-080) picks the actually
+      → Nemotron-Super (last resort). Election picks the actually
       healthy/fastest candidate per turn from background probe data.
 
-The FAST_BRAIN_CHAIN + JUDGE_CHAIN abstractions were removed in the
-three-chain collapse: voice fact-find now reuses BRAIN_CHAIN with its own
-budget, and the LLM-judge gate was retired in favour of in-process
-faithfulness checks. Sarvam stays for voice STT/TTS + Hindi/Hinglish/
-vernacular translation.
+BRAIN_CHAIN is the only chain: voice fact-find reuses it with its own
+budget, and faithfulness is enforced by in-process checks. Sarvam stays
+for voice STT/TTS + Hindi/Hinglish/vernacular translation.
 """
 
 from __future__ import annotations
@@ -74,18 +72,12 @@ async def _append_usage(record: dict) -> None:
         pass
 
 
-# KI-088 (2026-05-15) — Global outbound NIM concurrency cap.
+# Global outbound NIM concurrency cap.
 #
-# Live probe at commit 6a47549 measured 20% brain-turn success despite
-# KI-080 election + KI-085 credit gating + KI-087 NIM-first + KI-079
-# escalation all live. The architecture is correct; the binding constraint
-# is NIM's free-tier per-key concurrency (~3-5 slots).
-#
-# We have 5 sources of NIM traffic that all stack on the same key with no
-# global throttle: probe loop (6-slot parallel burst every 300s), admin
-# tab polling (every 30s), per-user chat turn (1-2 calls), concurrent
-# users (N × 1-2), and the inner 4-attempt retry loop (holds a slot up
-# to 15s on 429/5xx backoff).
+# The binding constraint is NIM's free-tier per-key concurrency (~3-5
+# slots). Multiple sources of NIM traffic stack on the same key with no
+# global throttle: the probe loop, admin tab polling, per-user chat turns
+# (1-2 calls), concurrent users (N × 1-2), and retry backoff.
 #
 # 6+ in-flight → queue → 15-25s response times → bot's 12s outer cap
 # fires → user sees fallback.
@@ -99,16 +91,11 @@ async def _append_usage(record: dict) -> None:
 _NIM_OUTBOUND_SEMAPHORE = asyncio.Semaphore(2)
 
 
-# A4 (2026-05-15) — Module-level httpx.AsyncClient singleton.
-#
-# Pre-A4: every NvidiaNimLLM.chat() call did `async with httpx.AsyncClient(...)
-# as client: ...`, which constructed a fresh connection pool per request and
-# tore it down on exit. Under brain/judge concurrency this churned TCP
-# connections, dropped TLS sessions, and (per audit) leaked pool slots when
-# an outer wait_for cancellation interrupted the async-with __aexit__ before
-# the underlying transport finalised.
+# Module-level httpx.AsyncClient singleton.
 #
-# Switch to a single shared client with explicit Limits so:
+# A single shared client (rather than a fresh pool per chat() call) avoids
+# churning TCP connections / dropping TLS sessions / leaking pool slots
+# under concurrency. Explicit Limits:
 #   - max_connections=10        caps total outbound (NIM + probes share)
 #   - max_keepalive_connections=5  keeps a warm pool for the hot path
 # The client is constructed lazily (first .chat() call) so cold imports
@@ -142,12 +129,6 @@ def _get_shared_nim_client() -> httpx.AsyncClient:
 
 
 NVIDIA_NIM_BASE_URL = "https://integrate.api.nvidia.com/v1"
-# 2026-05-14 brain swap (D-022): NIM's DeepSeek-V4 + Meta Llama inference pools
-# are repeatedly timing out (15-120s on chat completions, no response). Qwen
-# pool is consistently fast (2s response, clean structured output). Mistral
-# Large 3 (Reddit benchmark: 4.3s, works on free tier) is the cross-family
-# judge replacing the timing-out Llama-4 Maverick.
-#
 # Heavy brain (complex queries — comparison, recommendation, synthesis):
 # Qwen 3-Next 80B — 80B / 3B active MoE, frontier multilingual, very fast.
 NIM_BRAIN_MODEL = "qwen/qwen3-next-80b-a3b-instruct"
@@ -156,9 +137,9 @@ NIM_BRAIN_MODEL = "qwen/qwen3-next-80b-a3b-instruct"
 # different intents to the same pool. Tiered routing kept for forward-compat.
 NIM_FAST_BRAIN_MODEL = "qwen/qwen3-next-80b-a3b-instruct"
 # Judge: Mistral Large 3 — 675B dense, MIT license. Different family from
-# Qwen brain (Mistral vs Alibaba) so the judge sees the brain's output from
-# a genuinely different decision surface ("the brain doesn't mark its own
-# homework"). Reddit benchmark confirms ~4.3s response on NIM free tier.
+# the Qwen brain (Mistral vs Alibaba) so the judge sees the brain's output
+# from a genuinely different decision surface ("the brain doesn't mark its
+# own homework").
 NIM_JUDGE_MODEL = "mistralai/mistral-large-3-675b-instruct-2512"
 
 
@@ -196,8 +177,8 @@ class NvidiaNimLLM(LLMProvider):
             "max_tokens": max_tokens,
         }
         if response_format:
-            # A4 (2026-05-15) — NIM forwards OpenAI-shape response_format to
-            # the upstream model. For models that support `nvext.guided_json`
+            # NIM forwards OpenAI-shape response_format to the upstream
+            # model. For models that support `nvext.guided_json`
             # (NIM's stricter constrained-decoding surface), surface that
             # too when the caller passes a JSON schema (response_format
             # with `json_schema`). The plain `{"type": "json_object"}` flag
@@ -227,31 +208,22 @@ class NvidiaNimLLM(LLMProvider):
             write=2.0,
             pool=2.0,
         )
-        # KI-088 (2026-05-15) — drop the inner 4-attempt exponential
-        # backoff retry. The previous loop held a NIM concurrency slot
-        # for up to ~15s on 429/5xx while sleeping between attempts,
-        # which directly contributed to the queueing that the outer
-        # semaphore is now sized to prevent.
-        #
-        # Retry was a pre-KI-080 vestige that predated the chain
-        # election architecture. With KI-080 in place, NimChainLLM
-        # already handles 429/5xx failover by:
-        #   (1) catching the exception in _try(),
-        #   (2) calling report_failure() so the elector demotes the
-        #       slot-blocked candidate for ~30s, and
-        #   (3) falling through to the elected backup (cross-provider
-        #       by preference) within the same turn.
-        # KI-079 then provides one more bite via BRAIN_CHAIN if both
-        # elected models fail. Per-call retries inside this method
-        # would only re-queue against the same slot-starved pool,
-        # multiplying the queueing problem the semaphore fixes.
+        # No inner retry loop. 429/5xx failover is handled by NimChainLLM:
+        #   (1) the exception is caught in _try(),
+        #   (2) report_failure() demotes the slot-blocked candidate for
+        #       ~30s, and
+        #   (3) the elected backup (cross-provider by preference) is tried
+        #       within the same turn.
+        # If both elected models fail, BRAIN_CHAIN provides one more bite.
+        # Per-call retries inside this method would only re-queue against
+        # the same slot-starved pool, multiplying the queueing the
+        # semaphore prevents.
         #
         # The semaphore wraps ONLY the HTTP round-trip — not response
         # parsing or usage logging — so we cap concurrent network
         # traffic without serialising the rest of the pipeline.
-        # A4 (2026-05-15) — Use the module-level shared httpx.AsyncClient
-        # (singleton with bounded connection pool) instead of constructing
-        # a fresh client per request. Per-request timeout is applied at
+        # Use the module-level shared httpx.AsyncClient (singleton with a
+        # bounded connection pool). Per-request timeout is applied at
         # .post() call time so the shared pool serves both long-timeout
         # chat() and short-timeout probe() calls without contention.
         client = _get_shared_nim_client()
@@ -295,40 +267,32 @@ class NvidiaNimLLM(LLMProvider):
 # cross-family-grading invariant survives any failover.
 
 BRAIN_CHAIN = [
-    # KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Cross-provider (Groq /
-    # OpenRouter) fallbacks REMOVED. Groq's Llama-3.3-70B failed the `<FF>`
-    # trailer contract during a fact-find probe and silently flipped the
-    # entire pipeline to scripted prompts. Chain is now strictly NIM. Each
-    # NIM candidate's `<FF>` adherence has been verified or is structurally
-    # safer (different family / smaller routing surface). Pruned candidates
-    # that have been "down" for 48+ consecutive probes (qwen3.5-122b,
-    # gpt-oss-120b, deepseek-v4-pro) so the election pool only contains
-    # demonstrably-healthy NIM models.
-    # KI-175 (2026-05-15) — Nemotron demoted to LAST RESORT per operator
-    # preference: nemotron is the weakest practical NIM model and should
-    # only serve when every higher-quality model is simultaneously down.
-    # Primary: Qwen 3-Next 80B — 5/5 recent probes ok, clean JSON, multilingual
+    # NIM-only: the chain contains only NIM-hosted candidates whose `<FF>`
+    # trailer adherence is verified or structurally safer (different
+    # family / smaller routing surface). Nemotron is LAST RESORT — it is
+    # the weakest practical NIM model and only serves when every
+    # higher-quality model is simultaneously down.
+    # Primary: Qwen 3-Next 80B — clean JSON, multilingual.
     "qwen/qwen3-next-80b-a3b-instruct",
-    # 1st fallback: Mistral Large 3 675B — recent 3/3 probes ok, different
-    # family (mistral). Strongest fallback.
+    # 1st fallback: Mistral Large 3 675B — different family (mistral).
+    # Strongest fallback.
     "mistralai/mistral-large-3-675b-instruct-2512",
-    # 2nd fallback: Meta Llama-4 Maverick 17B — 5/5 probes ok, different
-    # family (meta), keeps the chain alive through Qwen+Mistral outage.
+    # 2nd fallback: Meta Llama-4 Maverick 17B — different family (meta),
+    # keeps the chain alive through a Qwen+Mistral outage.
     "meta/llama-4-maverick-17b-128e-instruct",
-    # 3rd / LAST RESORT: NVIDIA Nemotron-Super 49B — barely usable for
-    # worst-case scenarios. Only reached when Qwen + Mistral + Maverick
-    # are ALL down simultaneously. Kept in the pool for fail-loud > down.
+    # 3rd / LAST RESORT: NVIDIA Nemotron-Super 49B — only reached when
+    # Qwen + Mistral + Maverick are ALL down simultaneously. Kept in the
+    # pool for fail-loud > down.
     "nvidia/llama-3.3-nemotron-super-49b-v1.5",
 ]
 
-# Three-chain collapse (2026-05-15): FAST_BRAIN_CHAIN + JUDGE_CHAIN removed.
-# Every reasoning role now resolves to BRAIN_CHAIN above. Voice fact-find
-# reuses get_brain_llm() with a tighter outer wait_for cap; the LLM-judge
-# gate (Gate 4 / Hinglish drift) was retired in favour of in-process checks.
+# BRAIN_CHAIN is the only chain — every reasoning role resolves to it.
+# Voice fact-find reuses get_brain_llm() with a tighter outer wait_for
+# cap; faithfulness is enforced by in-process checks.
 
 
 def _classify_error(e: BaseException) -> str:
-    """KI-084 — classify a chat exception into a stable string passed to
+    """Classify a chat exception into a stable string passed to
     llm_health.report_failure(). The string drives degradation duration:
     rate-limit failures (HTTP 429) get a 1h sin-bin; everything else 30s.
 
@@ -338,7 +302,7 @@ def _classify_error(e: BaseException) -> str:
     carries `.response.status_code == 429` we tag it `"Status429"`; for
     other HTTP statuses we surface e.g. `"HTTPStatusError:503"`; for
     non-HTTP exceptions we keep the class name (`TimeoutException`,
-    `ReadTimeout`, etc.) — matching the pre-KI-084 contract.
+    `ReadTimeout`, etc.).
     """
     cls = type(e).__name__
     try:
@@ -354,32 +318,22 @@ def _classify_error(e: BaseException) -> str:
 
 
 class NimChainLLM(LLMProvider):
-    """KI-080 sticky-primary router across multiple candidate models.
-
-    Architectural shift (KI-080, 2026-05-15):
-      PRE-KI-080: chat() iterated the full chain sequentially every turn.
-        Under NIM per-key concurrency throttling, the first 5 NIM-hosted
-        candidates queued together inside ONE turn and burned the 22s
-        budget before any cross-provider fallback was ever reached. The
-        10-turn live probe at commit 078ff45 showed 7/10 fact-find turns
-        timing out at exactly 26.6s.
-
-      POST-KI-080: a background probe loop ELECTS a primary + cross-
-        provider backup per chain based on real probe latencies. chat()
-        calls the elected primary ONCE per turn (1 LLM call). On failure,
-        we demote the primary for ~30s and fall through to the elected
-        backup (still 2 LLM calls max). The chain list is now the
-        CANDIDATE POOL for election, not a per-call sequence.
-
-    Worst case per turn: 2 LLM calls (was 5-6). Plus a final filter_chain
-    refresh path is kept for the rare double-failure edge case so the
-    pre-KI-080 graceful-degradation behaviour is preserved.
+    """Sticky-primary router across multiple candidate models.
+
+    A background probe loop ELECTS a primary + backup per chain based on
+    real probe latencies. chat() calls the elected primary ONCE per turn
+    (1 LLM call). On failure, it demotes the primary for ~30s and falls
+    through to the elected backup (2 LLM calls max). The chain list is
+    the CANDIDATE POOL for election, not a per-call sequence.
+
+    Worst case per turn: 2 LLM calls. A final filter_chain refresh path
+    handles the rare double-failure edge case so the call still
+    degrades gracefully.
 
     `name` after a successful call reflects which model actually answered
-    so downstream callers (orchestrator brain_used tag, eval logs) can
-    audit which candidate produced the output. The KI-079 escalation in
-    fact_find_brain still applies — if primary+backup both fail inside
-    one turn, fact_find_brain gets one more bite via BRAIN_CHAIN.
+    so downstream callers (brain_used tag, eval logs) can audit which
+    candidate produced the output. If primary+backup both fail inside one
+    turn, fact_find_brain gets one more bite via BRAIN_CHAIN.
     """
     def __init__(self, chain: list[str], api_key: Optional[str] = None,
                  timeout: float = 30.0, per_model_attempts: int = 1,
@@ -389,15 +343,13 @@ class NimChainLLM(LLMProvider):
         self.chain = chain
         self.api_key = api_key or getattr(settings, "NVIDIA_NIM_API_KEY", "")
         self.timeout = timeout
-        # KI-021 (2026-05-14) — cumulative chain budget. If the chain has 8
-        # fallbacks at 30s each, worst-case wall-clock is 4 min per turn — that
-        # produced the p99 58s+ tail in the 100-persona audit. Default to a
-        # cumulative ceiling of ~2.5× the per-link timeout so a healthy primary
-        # always completes, but a cascading-failure chain bails fast.
-        #
-        # KI-080 — with election we only do 1-2 LLM calls per turn, so the
-        # budget is rarely the binding constraint anymore. Kept for the
-        # final filter_chain-refresh fallback path + cold-start edge cases.
+        # Cumulative chain budget. Without a ceiling, a chain of N
+        # fallbacks at 30s each could run for minutes per turn. Default
+        # to ~2.5× the per-link timeout so a healthy primary always
+        # completes but a cascading-failure chain bails fast. With
+        # election doing only 1-2 LLM calls per turn the budget is
+        # rarely binding; it still guards the final filter_chain-refresh
+        # fallback path + cold-start edge cases.
         self.total_budget_s = total_budget_s if total_budget_s is not None else max(timeout * 2.5, 30.0)
         self.per_model_attempts = per_model_attempts
         self.role = role  # 'brain' | 'unknown' — flows into usage log
@@ -424,17 +376,15 @@ class NimChainLLM(LLMProvider):
     def _get_worker_for(self, model_id: str, timeout: float) -> LLMProvider:
         """Dispatch a chain entry to the NIM provider client.
 
-        KI-155 (2026-05-15) — NIM-ONLY ENFORCEMENT. Cross-provider
-        (`openrouter:` / `groq:`) prefixes are explicitly rejected here even
-        though the chains no longer contain them. This is a defense-in-depth
-        short-circuit: if anyone (admin override, monkeypatch, future drift)
-        injects a non-NIM candidate into a chain, the dispatcher raises
-        rather than silently routing to a provider that has demonstrated
-        contract drift (Groq Llama-3.3-70B / `<FF>` trailer failure).
-
-        KI-085 — passes `chain_name=self._chain_name` so the credit
-        trackers in the provider clients route their response-header
-        signals to the right chain state.
+        NIM-only: cross-provider (`openrouter:` / `groq:`) prefixes are
+        explicitly rejected here. This is a defense-in-depth short-circuit
+        — if anyone (admin override, monkeypatch, future drift) injects a
+        non-NIM candidate into a chain, the dispatcher raises rather than
+        routing to a provider outside the validated pool.
+
+        Passes `chain_name=self._chain_name` so the credit trackers in the
+        provider clients route their response-header signals to the right
+        chain state.
         """
         if model_id.startswith(("openrouter:", "groq:", "or:")):
             raise RuntimeError(
@@ -454,17 +404,16 @@ class NimChainLLM(LLMProvider):
         'deepseek', 'moonshot', 'minimax', 'nvidia', 'nemotron', 'llama3',
         'google', 'unknown'.
 
-        A4 (2026-05-15) — EVERY model in BRAIN_CHAIN must map to a known
-        family. The `assert_family_coverage()` helper walks the chain on
-        demand (from tests / admin / probe loop) and raises if any
-        candidate falls through to "unknown".
+        EVERY model in BRAIN_CHAIN must map to a known family. The
+        `assert_family_coverage()` helper walks the chain on demand (from
+        tests / admin / probe loop) and raises if any candidate falls
+        through to "unknown".
         """
         m = (model_id or "").lower()
-        # KI-220 — recognise Google's Gemini family BEFORE prefix-stripping so
-        # ids like "google/gemini-2.5-flash" and bare "gemini-..." both land in
-        # the "google" bucket. Without this branch the family lookup fell
-        # through to "unknown", which meant the judge-vs-brain cross-family
-        # invariant couldn't exclude Gemini brains from a Gemini judge.
+        # Recognise Google's Gemini family BEFORE prefix-stripping so ids
+        # like "google/gemini-2.5-flash" and bare "gemini-..." both land
+        # in the "google" bucket, so the judge-vs-brain cross-family
+        # invariant can exclude a Gemini brain from a Gemini judge.
         if "gemini" in m or m.startswith("google/"):
             return "google"
         # Strip provider prefix first so 'groq:llama-3.3-70b' → 'meta' (it IS Meta Llama)
@@ -534,8 +483,8 @@ class NimChainLLM(LLMProvider):
         exclude_models: Optional[list[str]] = None,
         exclude_families: Optional[list[str]] = None,
     ) -> LLMResult:
-        """KI-080 — sticky primary election. Call ONE elected candidate per
-        turn, with at most ONE real-time fallback to the elected backup if
+        """Sticky primary election. Call ONE elected candidate per turn,
+        with at most ONE real-time fallback to the elected backup if
         primary fails. The chain list is the candidate POOL for election —
         NOT a per-call sequence.
 
@@ -546,8 +495,8 @@ class NimChainLLM(LLMProvider):
         the chain in order.
         Final fallback (both elected models fail): trigger a synchronous
         probe refresh + try whatever filter_chain now offers, walking the
-        chain in order. This path is the pre-KI-080 graceful-degradation
-        safety net for the double-failure edge case.
+        chain in order. This path is the graceful-degradation safety net
+        for the double-failure edge case.
         """
         from backend import llm_health
 
@@ -650,8 +599,8 @@ class NimChainLLM(LLMProvider):
                 llm_health.report_success(self._chain_name, model, latency_ms)
             except Exception:
                 pass
-            # KI-085 (2026-05-15) — NIM has no clean rate-limit header, so
-            # we maintain a local 60s rate-meter for every NIM-prefixed
+            # NIM has no clean rate-limit header, so we maintain a local
+            # 60s rate-meter for every NIM-prefixed
             # candidate (i.e. anything without an openrouter:/groq: prefix).
             # Groq + OpenRouter stamp credits from response headers inside
             # their own .chat() methods.
@@ -680,7 +629,7 @@ class NimChainLLM(LLMProvider):
         if res is not None:
             return res
 
-        # --- Backup attempt (KI-080 single real-time fallback) ---------------
+        # --- Backup attempt (single real-time fallback) ----------------------
         if elected_backup and elected_backup != elected_primary:
             res = await _try(elected_backup)
             if res is not None:
@@ -688,9 +637,9 @@ class NimChainLLM(LLMProvider):
 
         # --- Both elected failed — final safety net --------------------------
         # Trigger ONE synchronous probe refresh; whatever the refreshed
-        # filter_chain offers, walk it in order and try anything we haven't
-        # touched this turn. This is the pre-KI-080 graceful-degradation
-        # behaviour preserved for the (rare) double-failure case.
+        # filter_chain offers, walk it in order and try anything not yet
+        # touched this turn. Graceful-degradation path for the (rare)
+        # double-failure case.
         try:
             # KI-099 — bound the probe-refresh cost. On a hot user-facing turn, a
             # 60-80s probe walk through ~10 candidates is unacceptable. If we've
@@ -793,19 +742,15 @@ class NimChainLLM(LLMProvider):
         ) from last_err
 
 
-# KI-025 (2026-05-14) — provider load-balancing.
-# DEPRECATED 2026-05-15 by KI-080: primary election supersedes the 50/50
-# rotation. The probe loop now picks the actually-faster candidate
-# DYNAMICALLY (real probe latencies, not a coin flip), and the elected
-# backup is chosen with explicit cross-provider preference — both signals
-# the rotation was approximating heuristically. Kept around (not deleted)
-# because the regression suite still pins its statistical behaviour. The
-# get_*_llm factories no longer call it.
+# Provider load-balancing pure-function. Not wired into the chat hot path
+# (the probe-driven elector in backend.llm_health selects candidates);
+# retained because the routing regression suite pins its statistical
+# behaviour and it is a useful pure-function for ops / sim / overrides.
 import random as _random
 
 
 def _balanced_brain_chain(base: list[str], *, groq_first_probability: float = 0.5) -> list[str]:
-    """KI-025 — provider load-balancing (DEPRECATED 2026-05-15 by KI-080).
+    """Provider load-balancing pure-function.
 
     With `groq_first_probability` (default 50%), hoist the Groq Llama entry
     to the head of the chain so it serves as the primary instead of the
@@ -813,17 +758,14 @@ def _balanced_brain_chain(base: list[str], *, groq_first_probability: float = 0.
     fallback order — Groq calls that fail (rare; LPU is very reliable)
     still get the full NIM fallback chain.
 
-    SUPERSESSION NOTE (KI-080): the elector in `backend.llm_health` now
-    picks the actually-faster candidate dynamically from background probe
-    data, so this static-coin-flip rotation is no longer wired into the
-    chat hot path. Kept exported because:
-      (a) regression tests still pin its statistical behaviour, and
-      (b) it remains a useful pure-function for ops / sim / overrides
-          (e.g. wanting to force a non-elected order in a debug script).
-
-    Uses per-call `random.random()` so concurrent async workers (the
-    100-persona audit's 4 workers, the parallel 96-Q eval's 6 workers) each
-    flip independently — no shared mutable cycle state, no GIL races, fair
+    Not wired into the chat hot path (the elector in `backend.llm_health`
+    picks candidates dynamically from background probe data). Retained
+    because the routing regression suite pins its statistical behaviour
+    and it is a useful pure-function for ops / sim / overrides (e.g.
+    forcing a non-elected order in a debug script).
+
+    Uses per-call `random.random()` so concurrent async workers each flip
+    independently — no shared mutable cycle state, no GIL races, fair
     distribution in aggregate. `groq_first_probability` is overrideable
     primarily for testing."""
     if _random.random() >= groq_first_probability:
@@ -837,18 +779,16 @@ def _balanced_brain_chain(base: list[str], *, groq_first_probability: float = 0.
 
 
 def assert_family_coverage() -> dict[str, str]:
-    """A4 (2026-05-15) — Verify every model in BRAIN_CHAIN maps to a known
-    family (i.e. NOT 'unknown'). Returns a {model: family} dict on success;
-    raises RuntimeError listing any 'unknown'-mapped models on failure.
+    """Verify every model in BRAIN_CHAIN maps to a known family (i.e. NOT
+    'unknown'). Returns a {model: family} dict on success; raises
+    RuntimeError listing any 'unknown'-mapped models on failure.
 
-    KI-175 — also verifies nemotron is the TAIL (last entry) of BRAIN_CHAIN
-    so the last-resort ordering invariant survives any chain edit.
+    Also verifies nemotron is the TAIL (last entry) of BRAIN_CHAIN so the
+    last-resort ordering invariant survives any chain edit.
 
-    Three-chain collapse (2026-05-15): FAST_BRAIN_CHAIN + JUDGE_CHAIN have
-    been removed, so this helper now walks BRAIN_CHAIN only.
-
-    Call from admin diagnostics or tests; not invoked on import to keep
-    cold-start cheap. Safe to run from a probe loop tick.
+    Walks BRAIN_CHAIN (the only chain). Call from admin diagnostics or
+    tests; not invoked on import to keep cold-start cheap. Safe to run
+    from a probe loop tick.
     """
     coverage: dict[str, str] = {}
     unknown: list[str] = []
@@ -877,25 +817,19 @@ def assert_family_coverage() -> dict[str, str]:
 
 
 def get_brain_llm() -> NimChainLLM:
-    """Heavy brain — KI-080 sticky-primary election over BRAIN_CHAIN.
-
-    Pre-KI-080: per-call _balanced_brain_chain rotation between NIM Qwen
-    and Groq Llama (KI-025 50/50 heuristic) → 5-6 LLM calls per turn
-    under degraded conditions.
+    """Heavy brain — sticky-primary election over BRAIN_CHAIN.
 
-    Post-KI-080: the background probe loop in backend.llm_health elects
-    the actually-fastest candidate dynamically (probe-driven, not coin-
-    flipped) and a cross-provider backup. chat() calls 1-2 candidates max
-    per turn. The rotation is preserved as a deprecated pure-function in
-    case overrides need it, but the factory no longer wires it in.
+    The background probe loop in backend.llm_health elects the
+    actually-fastest candidate dynamically (probe-driven) plus a backup.
+    chat() calls 1-2 candidates max per turn. (The _balanced_brain_chain
+    rotation pure-function is available for overrides but not wired in
+    here.)
 
-    KI-021 — per-link 12s (KI-080 ELECTED_CALL_TIMEOUT_S), total chain
-    budget 35s (only binding for the final filter_chain-refresh safety net).
+    Per-link 20s timeout, total chain budget 35s (only binding for the
+    final filter_chain-refresh safety net).
     """
     return NimChainLLM(chain=BRAIN_CHAIN, timeout=20.0,
                        role="brain", total_budget_s=35.0)
 
 
-# Three-chain collapse (2026-05-15): get_fast_brain_llm + get_judge_llm
-# factories removed. Any straggler caller should import get_brain_llm()
-# directly. The FAST_BRAIN_CHAIN + JUDGE_CHAIN constants are also gone.
+# get_brain_llm() is the brain factory; BRAIN_CHAIN is the only chain.

backend/providers/openrouter_llm.py

@@ -40,7 +40,7 @@ OPENROUTER_URL = "https://openrouter.ai/api/v1/chat/completions"
 DEFAULT_MODEL = "openai/gpt-oss-120b"
 
 
-# A4 (2026-05-15) — OpenRouter free-pool helpers.
+# OpenRouter free-pool helpers.
 #
 # `:free` suffix is OpenRouter's documented marker for zero-cost models.
 # We use this both to:
@@ -61,8 +61,8 @@ def is_free_model(model_id: str) -> bool:
 
 
 def order_free_pool(models: list[str]) -> list[str]:
-    """A4 (2026-05-15) — Return `models` in a STABLE, deterministic order
-    suitable for OpenRouter's `models=[...]` server-side fallback list.
+    """Return `models` in a STABLE, deterministic order suitable for
+    OpenRouter's `models=[...]` server-side fallback list.
 
     Sort key: (length-of-id ascending, id ascending). Shorter ids tend to
     correlate with smaller / cheaper models on OpenRouter's catalogue
@@ -77,7 +77,7 @@ def order_free_pool(models: list[str]) -> list[str]:
 
 
 def enforce_free_pool(models: list[str]) -> list[str]:
-    """A4 (2026-05-15) — Cost guard: reject paid models in a free-pool call.
+    """Cost guard: reject paid models in a free-pool call.
 
     Raises ValueError listing any non-`:free` entries. Returns the
     deterministically-ordered free pool on success.
@@ -131,7 +131,7 @@ class OpenRouterLLM(LLMProvider):
         routing; if `models` is omitted the lone `model` field is used).
         Reference: https://openrouter.ai/docs/features/model-routing
 
-        A4 (2026-05-15) — `free_only=True` activates the cost guard:
+        `free_only=True` activates the cost guard:
           - rejects any non-`:free` model in `models` (raises ValueError)
           - reorders the survivors via `order_free_pool` for stable, smaller-
             first preference. The single-model `self.model` is checked too
@@ -196,8 +196,8 @@ class OpenRouterLLM(LLMProvider):
                     continue
                 resp.raise_for_status()
                 break
-            # KI-085 (2026-05-15) — opportunistic between-poll signal from
-            # OpenRouter response headers. The authoritative truth (usd_balance)
+            # Opportunistic between-poll signal from OpenRouter response
+            # headers. The authoritative truth (usd_balance)
             # comes from poll_openrouter_credits() every 10 min; this is a
             # finer-grained per-call backup that catches per-minute bucket
             # exhaustion before the next poll tick.
@@ -232,16 +232,9 @@ class OpenRouterLLM(LLMProvider):
 # a sane single-model default; callers that want server-side fallback should
 # pass `models=[...]` to `chat()`.
 #
-# Model IDs verified against the LIVE OpenRouter catalog
-# (GET /api/v1/models, 2026-05-15). The model IDs from the KI-176 brief
-# (gemini-2.0-flash-exp:free, llama-3.3-70b-instruct:free,
-# hermes-3-llama-3.1-405b:free) were checked:
-#   - gemini-2.0-flash-exp:free                 — NOT in catalog
-#   - llama-3.3-70b-instruct:free               — PRESENT but no response_format
-#   - hermes-3-llama-3.1-405b:free              — PRESENT but no response_format
-# So those would silently lose JSON mode. The IDs below are the actual
-# free-tier set that declare `response_format` (and most also
-# `structured_outputs`) in their `supported_parameters`:
+# The free-tier model IDs below are the set that declare `response_format`
+# (and most also `structured_outputs`) in their `supported_parameters`,
+# so JSON mode is preserved:
 #   - nvidia/nemotron-3-super-120b-a12b:free    (120B, structured_outputs)
 #   - qwen/qwen3-next-80b-a3b-instruct:free     (80B,  structured_outputs)
 #   - google/gemma-4-31b-it:free                (31B,  response_format)
@@ -259,7 +252,7 @@ def get_openrouter_llm(
     model: str = DEFAULT_FREE_BRAIN_MODEL,
     timeout: float = 60.0,
 ) -> "OpenRouterLLM":
-    """Return a fresh OpenRouterLLM ready for sales_brain.
+    """Return a fresh OpenRouterLLM client.
 
     The returned client is single-use-shaped (one chat() call per turn) and
     intended to be passed `models=[primary, fallback1, fallback2]` so the

backend/providers/sarvam_tts.py

@@ -29,8 +29,8 @@ from backend.providers.base import TTSProvider
 
 logger = logging.getLogger(__name__)
 
-# X8 (2026-05-15) — frontend now sends `X-Preferred-Codec: audio/{wav,mp4,webm}`
-# header so the chat endpoint can return audio in the codec the user's browser
+# The frontend sends an `X-Preferred-Codec: audio/{wav,mp4,webm}` header
+# so the chat endpoint can return audio in the codec the user's browser
 # decodes natively. Sarvam Bulbul's text-to-speech API itself does NOT support
 # codec negotiation in the request body (response is always base64 WAV), so we
 # transcode locally with pydub (already in requirements.txt; the Dockerfile
@@ -48,14 +48,11 @@ except Exception:  # pragma: no cover — pydub missing in dev shell
 _SUPPORTED_CODECS = {"audio/wav", "audio/mp4", "audio/webm"}
 
 
-# KI-278 (2026-05-16) — voice-OUTPUT error vocabulary. Mirrors the STT
-# closed-enum contract (sarvam_stt.STT_ERROR_*) so the chat endpoint can
-# surface a structured tts_error_code instead of swallowing the exception
-# and returning audio_base64=None with zero signal to the client. Bug
-# origin: Sarvam account ran out of credits → /text-to-speech returned
-# HTTP 429 {"code":"insufficient_quota_error"} → resp.raise_for_status()
-# raised → chat endpoint logged it to turns.jsonl and returned a text-only
-# reply with NO voice and NO explanation ("no voice in reply. wtf?").
+# Voice-OUTPUT error vocabulary. Mirrors the STT closed-enum contract
+# (sarvam_stt.STT_ERROR_*) so the chat endpoint can surface a structured
+# tts_error_code instead of returning audio_base64=None with zero signal
+# to the client (e.g. when Sarvam returns HTTP 429
+# {"code":"insufficient_quota_error"}).
 TTS_ERROR_RATE_LIMIT = "rate_limit"
 TTS_ERROR_SERVICE = "service_unavailable"
 TTS_ERROR_NETWORK = "network"

backend/retrieval_filters.py

@@ -3,8 +3,7 @@
 This module is a SIDECAR to the retrieval path (`rag/retrieve.py` and the
 single-brain tool layer in `backend/brain_tools.py`). It is deliberately a
 separate file so retrieval-correctness work stays isolated from the
-turn-handling code. (Historically it also shielded the now-removed
-`backend/orchestrator.py`, deleted in the 2026-05-15 single-brain rewrite.)
+turn-handling code.
 
 Public API:
     apply_profile_filter(chunks, profile)       -> list[RetrievedChunk]
@@ -34,8 +33,8 @@ Public API:
     dedup_by_policy(chunks)                      -> list[RetrievedChunk]
         Within a top-K, keep highest-score chunk per policy_id.
 
-All functions are pure / side-effect-free; safe to call from the orchestrator
-or from rag/retrieve.py without import-cycle risk.
+All functions are pure / side-effect-free; safe to call from the
+single-brain tool layer or from rag/retrieve.py without import-cycle risk.
 """
 
 from __future__ import annotations
@@ -43,7 +42,7 @@ from __future__ import annotations
 import re
 from typing import Any, Iterable, Optional
 
-# KI-280 (2026-05-16) — shared canonical-identity / dedup rule. The same
+# Shared canonical-identity / dedup rule. The same
 # UIN-primary + product_key invariant the marketplace endpoint uses
 # (main.py /api/policies/all). Imported (not reimplemented) so the
 # recommender and the marketplace agree on "the same policy". The module
@@ -90,7 +89,7 @@ MATERNITY_NAME_RE = re.compile(
 )
 
 # ---------------------------------------------------------------------------
-# KI-278 — Eligibility / profile-fit tunables (2026-05-16)
+# Eligibility / profile-fit tunables
 # ---------------------------------------------------------------------------
 # A plan is a TOP-UP / SUPER-TOP-UP (only useful ALONGSIDE an existing base
 # policy or above a large out-of-pocket deductible) when ANY of these hold:
@@ -150,8 +149,7 @@ UIN_RE = re.compile(
 )
 
 # ---------------------------------------------------------------------------
-# KI-279 — fixed-benefit exclusion for comprehensive-indemnity intent
-# (2026-05-16)
+# Fixed-benefit exclusion for comprehensive-indemnity intent
 # ---------------------------------------------------------------------------
 # A FIXED-BENEFIT product (hospital daily cash, personal accident, critical
 # illness, cancer / other defined-benefit) pays a fixed lump-sum / per-day
@@ -200,13 +198,12 @@ _COMPREHENSIVE_GOAL_TOKENS = (
 )
 
 # ---------------------------------------------------------------------------
-# KI-280 — UNIFIED recommendation-fit gate tunables (2026-05-16)
+# Unified recommendation-fit gate tunables
 # ---------------------------------------------------------------------------
-# The audit proved recommendation-fit is SYSTEMIC: the cited-card list and
-# the advisory prose must be gated by the SAME fitness logic. These add the
-# two missing hard gates (entry-age for the INSURED person; required
-# feature = maternity/newborn) and the ranking signals that fix the
-# grade/rank inversion + the cost-objective lead.
+# Recommendation-fit is SYSTEMIC: the cited-card list and the advisory prose
+# are gated by the SAME fitness logic. Two hard gates (entry-age for the
+# INSURED person; required feature = maternity/newborn) plus ranking signals
+# for grade/rank ordering and the cost-objective lead.
 
 # Entry-age grace. The catalog's max_entry_age is the regulator-filed entry
 # age; underwriters allow a small grace band (mirrors PROFILE_AGE_TOLERANCE).
@@ -348,15 +345,14 @@ def apply_profile_filter(chunks: Iterable[Any], profile: Any) -> list[Any]:
     if not chunks_list:
         return chunks_list
 
-    # KI-280 — the demographic gates (numeric age-range, senior-only,
-    # adult-only) must reason about the age of the person the policy
-    # actually INSURES, not the payer's. When the policy covers parents
-    # (~70), using the paying child's age (e.g. 36) made the senior-only
-    # rule wrongly DROP a senior-citizen plan ("min_entry_age>=60 AND
-    # payer<50") and the numeric range wrongly KEEP a max-entry-65 plan —
-    # the exact P7 live-audit failure. `_oldest_insured_age` returns the
-    # eldest parent's age when insuring parents, else the profile's own
-    # age. Falls back to the raw profile age if no resolved signal.
+    # The demographic gates (numeric age-range, senior-only, adult-only)
+    # reason about the age of the person the policy actually INSURES, not
+    # the payer's. When the policy covers parents (~70), using the paying
+    # child's age (e.g. 36) would wrongly DROP a senior-citizen plan
+    # ("min_entry_age>=60 AND payer<50") and wrongly KEEP a max-entry-65
+    # plan. `_oldest_insured_age` returns the eldest parent's age when
+    # insuring parents, else the profile's own age. Falls back to the raw
+    # profile age if no resolved signal.
     _resolved_age = _oldest_insured_age(profile)
     if _resolved_age is None:
         _resolved_age = _profile_get(profile, "age")
@@ -713,13 +709,12 @@ def apply_eligibility_filter(chunks: Iterable[Any], profile: Any) -> list[Any]:
          expenses, so they are a wrong PRIMARY recommendation. They are
          NEVER dropped for a user who explicitly wants a supplement.
 
-      5. ENTRY-AGE GATE (KI-280) — drop a plan whose max entry age cannot
-         accept the OLDEST person the policy must insure. When the profile
-         covers parents (~70), the gate uses the parents' age, not the
-         paying child's — the demographic pre-filter only sees the payer's
-         age, which is exactly why a max-entry-65 plan reached a 70yo-
-         parents profile in the live audit (P7). Conservative: fires only
-         when both the insured age AND the policy fact are present.
+      5. ENTRY-AGE GATE — drop a plan whose max entry age cannot accept
+         the OLDEST person the policy must insure. When the profile covers
+         parents (~70), the gate uses the parents' age, not the paying
+         child's (the demographic pre-filter only sees the payer's age).
+         Conservative: fires only when both the insured age AND the policy
+         fact are present.
 
     Conservative on missing data: a rule only fires when BOTH the profile
     signal AND the policy fact are present. A chunk with no enriched facts
@@ -755,14 +750,14 @@ def apply_eligibility_filter(chunks: Iterable[Any], profile: Any) -> list[Any]:
         if wants_comprehensive and _is_fixed_benefit_chunk(m):
             continue
 
-        # Rule 5 (KI-280) — HARD ELIGIBILITY: a plan whose max entry age
-        # cannot accept the oldest insured person is structurally unusable.
-        # This is the audit-P7 fix: a 70yo parent cannot be enrolled in a
-        # plan whose max_entry_age is 65. We only fire when BOTH the age and
-        # the policy fact are present (conservative on missing data) and
-        # only when the profile actually insures someone whose age we know
-        # (the demographic apply_profile_filter uses the *payer's* age and
-        # never sees the parents' age — that is precisely why P7 slipped).
+        # Rule 5 — HARD ELIGIBILITY: a plan whose max entry age cannot
+        # accept the oldest insured person is structurally unusable (e.g. a
+        # 70yo parent cannot be enrolled in a plan whose max_entry_age is
+        # 65). Fires only when BOTH the age and the policy fact are present
+        # (conservative on missing data) and only when the profile actually
+        # insures someone whose age we know (the demographic
+        # apply_profile_filter uses the *payer's* age and never sees the
+        # parents' age).
         if oldest_age is not None:
             maxe = _as_int(m.get("max_entry_age"))
             if maxe is not None and maxe + ENTRY_AGE_TOLERANCE < oldest_age:
@@ -1044,10 +1039,8 @@ def enforce_citation_grounding(chunks: Iterable[Any]) -> list[Any]:
     INFORMATIONAL only — it is not required for citation grounding because
     upstream call sites (e.g. brain_tools.retrieve_policies) build pruned
     dicts that intentionally omit it, and the brain cites by policy
-    identity, not by chunk offset. Z2 live test (2026-05-15) showed 15/15
-    retrieve_policies calls returning 0 chunks because we required an
-    offset that the upstream builder never included → every chunk dropped
-    here even though raw retrieval was healthy.
+    identity, not by chunk offset. Requiring an offset here would drop
+    every chunk built by those pruned-dict call sites.
     """
     kept: list[Any] = []
     for ch in chunks:
@@ -1071,16 +1064,15 @@ def dedup_by_policy(chunks: Iterable[Any]) -> list[Any]:
     duplicates to one chunk, keeping the highest-scoring chunk. Preserves
     the order of first appearance of each kept product.
 
-    KI-280: keying is by the SHARED canonical identity
+    Keying is by the SHARED canonical identity
     (policy_identity.canonical_key) — UIN-primary, product_key fallback —
-    NOT the raw policy_id. The live audit cited the SAME product twice
-    because the two chunks had different policy_ids: a marketing rename
-    ("my:Optima Secure" vs "my:Optima Secure (older variant)" — same UIN)
-    or two doctype siblings ("...__wordings" vs "...__brochure" — same
-    product_key). policy_id-only dedup let both through (P2 New National
-    Parivar ×2, P4 Advanced Top Up ×2, P7 Chola ×2). This reuses the exact
-    rule the marketplace endpoint uses so the recommender and the
-    marketplace agree on "the same policy".
+    NOT the raw policy_id. The same product can appear under different
+    policy_ids: a marketing rename ("my:Optima Secure" vs "my:Optima
+    Secure (older variant)" — same UIN) or two doctype siblings
+    ("...__wordings" vs "...__brochure" — same product_key). policy_id-only
+    dedup would let both through; canonical-identity keying collapses them.
+    This reuses the exact rule the marketplace endpoint uses so the
+    recommender and the marketplace agree on "the same policy".
     """
     best: dict[str, Any] = {}
     order: list[str] = []

backend/scorecard.py

@@ -791,17 +791,14 @@ def _profile_tuned_weights(profile: Optional[dict]) -> dict[str, float]:
 def profile_completeness(profile: Optional[dict]) -> float:
     """0.0–1.0 measure of how much we know about the buyer.
 
-    KI-252 (2026-05-15): aligned with Path B's `_REQUIRED_FOR_READY` 7-slot
-    list (see brain_tools.py + single_brain.py). Previously this checked 9
-    weighted fields including budget_band / existing_cover_inr /
-    parents_age_max which Path B doesn't gather, causing the UI bar to read
-    70% while Path B already considered the profile "ready to recommend".
+    Aligned with the `_REQUIRED_FOR_READY` 7-slot list (see brain_tools.py
+    + single_brain.py) so this measure agrees with the brain's "ready to
+    recommend" gate.
 
     The 7 slots: name, age, dependents, location_tier, income_band,
     primary_goal, health_conditions. `name` is the identifier; the other 6
     are decision-critical for retrieval. Existing-cover and budget-band are
-    captured opportunistically (Rajesh provided existing_cover_inr in turn 1)
-    but are NOT required to recommend.
+    captured opportunistically but are NOT required to recommend.
 
     Used by the frontend to GATE the personalized scorecard view — until
     completeness >= 0.6, we show insurer-level metrics (CSR, complaints —

backend/session_state.py

@@ -74,39 +74,24 @@ class SessionState:
     # "Conversation turn" column in the admin Recommendation History panel
     # (previously showed "—" because no caller populated the field).
     turn_idx: int = 0
-    # Z2 fix — Issue 3 (brain election bouncing). Priya's session hopped
-    # sales_brain → single_brain → single_brain → sales_brain across 6
-    # turns even though USE_SINGLE_BRAIN=true; the Gemini 503 fallback
-    # (Z1 retry already softens) was dropping the session back onto the
-    # legacy orchestrator mid-stream. Belt-and-suspenders: main.py stamps
-    # this True after the FIRST successful single_brain turn, and
-    # subsequent SingleBrainError responses on the same session must NOT
-    # fall through to the orchestrator — they emit a graceful retry
-    # prompt so the session stays sticky on single_brain.
+    # Set True after the first successful single_brain turn; a later
+    # SingleBrainError on the same session then emits a graceful retry
+    # prompt instead of switching handlers, so the session stays on
+    # single_brain.
     single_brain_sticky: bool = False
-    # VESTIGIAL (2026-05-17): the deterministic in-conversation recall
-    # name-sniff that set this was REMOVED from single_brain (see the
-    # tombstone above single_brain._HONEST_EMPTY_REPLY). Field retained,
-    # not deleted, so previously-persisted SessionState payloads still
-    # deserialize cleanly; nothing reads or writes it any more.
-    _recall_sniff_done: bool = False
-    # Bug #108 + #110 (2026-05-16) — POST-RECAP pricing & family-history
-    # bundle re-ask gate (brain_tools.retrieve_policies).
-    #   pricing_bundle_reasked — one-shot guard. Set True the first time the
-    #     gate re-asks an unresolved bundle slot so the NEXT recommendation
-    #     retrieve proceeds even if the user skips (SOFT capture, no hard
-    #     loop).
+    # Post-recap pricing & family-history bundle re-ask gate
+    # (brain_tools.retrieve_policies):
+    #   pricing_bundle_reasked — one-shot guard; set True the first time
+    #     the gate re-asks an unresolved bundle slot so the next
+    #     recommendation retrieve proceeds even if the user skips.
     #   pricing_bundle_skipped — set True by single_brain when the user
-    #     explicitly declines the pricing inputs ("just show me options",
-    #     "you decide", "skip"). Bypasses the re-ask entirely.
+    #     explicitly declines the pricing inputs; bypasses the re-ask.
     pricing_bundle_reasked: bool = False
     pricing_bundle_skipped: bool = False
 
     def _flush(self) -> None:
-        """No-op since KI-118 (2026-05-15). Disk persistence was removed; the
-        in-memory dict is now the only store. We keep the method so existing
-        callers (orchestrator + fact_find_brain + tests) don't have to change
-        their write paths.
+        """No-op. Session state lives only in the in-memory dict; the
+        method is kept so callers' write paths don't have to change.
         """
         return None
 

backend/single_brain.py

@@ -1,20 +1,19 @@
-"""Single-brain conversation handler — Path B.
+"""Single-brain conversation handler.
 
-One Gemini Flash call per turn (with native function-calling) replaces
-the previous sales_brain + qa_brain split. The LLM decides on each
-iteration whether to:
+One Gemini Flash call per turn with native function-calling. The LLM
+decides on each iteration whether to:
   - call `save_profile_field` to persist captured slots,
   - call `retrieve_policies` to pull policy chunks from Chroma,
   - call `mark_recommendation` to flag the policies just pitched,
   - or emit a final text reply.
 
-The loop iterates up to `MAX_ITERATIONS` (default 5) so the LLM can chain
-multiple tool calls in a single user turn before responding. Beyond that
-cap we synthesise a defensive reply and return.
+The loop iterates up to `MAX_ITERATIONS` so the LLM can chain multiple
+tool calls in a single user turn before responding. Beyond that cap an
+honest retry message is returned.
 
-Wire-up:  /api/chat → main.py.chat() → if USE_SINGLE_BRAIN: single_brain.handle_turn(...)
-On any SingleBrainError, the API caller is expected to fall through to the
-legacy `orchestrator.handle_turn` so the user always gets a reply.
+Wire-up:  /api/chat → main.py.chat() → single_brain.handle_turn(...).
+On a SingleBrainError the caller falls through to nim_fallback so the
+user always gets a reply.
 
 We call the Gemini REST API directly (httpx, like google_gemini_llm.py)
 rather than using the `google.generativeai` SDK so we don't need to pin
@@ -57,13 +56,10 @@ GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta/models"
 PER_CALL_TIMEOUT_SEC = 25.0
 
 # Max iterations of the tool-call loop. Prevents runaway tool-call cycles
-# where the LLM keeps calling save_profile_field on the same value.
-# KI-Z6-NONE (2026-05-15): bumped 5 → 8 after W1 Turn 3 live blocker.
-# The Z6 "no medical issues" path used to need: save(health=none) +
-# retrieve → profile_incomplete → save(health=none) + retrieve → loop
-# exhaust. Coercer fix in brain_tools resolves the primary cause; the
-# extra headroom protects against the next variant where Gemini chains
-# 3-4 saves + 2 retrieves on a long pre-recommendation user turn.
+# where the LLM keeps calling save_profile_field on the same value. Sized
+# so Gemini can chain a long pre-recommendation turn (several
+# save_profile_field calls + one or two retrieve_policies) within one
+# user turn.
 MAX_ITERATIONS = 8
 
 # Transient-error retry policy (2026-05-15 / KI-singlebrain-503).
@@ -393,12 +389,9 @@ class TurnResult:
     blocked: bool = False
     profile_updates: dict = field(default_factory=dict)
     followup_policy_id: Optional[str] = None
-    # main.py stamps ChatResponse.returning_user_recalled from this. The
-    # deterministic in-conversation recall that used to set it True was
-    # REMOVED 2026-05-17 (see the tombstone above _HONEST_EMPTY_REPLY), so
-    # handle_turn now always leaves this False; explicit returning-user
-    # recall is the separate POST /api/profile/recall-by-name endpoint.
-    # Field kept for ChatResponse / frontend compatibility.
+    # main.py stamps ChatResponse.returning_user_recalled from this.
+    # handle_turn leaves it False; explicit returning-user recall is the
+    # separate POST /api/profile/recall-by-name endpoint.
     returning_user_recalled: bool = False
 
 
@@ -627,22 +620,9 @@ def _detect_language(user_text: str) -> str:
     return "en"
 
 
-# --- REMOVED 2026-05-17 — deterministic recall classifier + fallback -------
-# `_RECALL_AFFIRM*` / `_classify_recall_answer` (the staged-recall yes/no
-# detector) and `_FALLBACK_SLOT_QUESTIONS` / `_FALLBACK_REQUIRED_SLOTS` /
-# `_synthesise_fallback` (the deterministic "ask the next missing slot"
-# generator) were leftover rule-based scaffolding from the pre-Path-B
-# rule/3-brain/judge era. They masked the single LLM: when Gemini returned
-# no text the fallback injected a canned "What's your name?", simulating a
-# fact-find that wasn't happening → an infinite loop. The single LLM
-# (RULE 1 → save_profile_field) is the SOLE fact-find driver now; a genuine
-# empty-LLM turn surfaces an HONEST error (see end of handle_turn), never a
-# fabricated slot-question. Do NOT reintroduce deterministic fact-find.
-
-# Honest reply for the rare genuine empty-LLM turn (should be near-zero now
-# that thinkingConfig is set so gemini-2.5-flash actually emits output). We
-# surface a transparent retry ask — NEVER a fabricated slot-question that
-# simulates a fact-find that did not happen.
+# Reply for a turn where the LLM returns no text and no tool calls — a
+# transparent retry ask. The single LLM is the only fact-find driver; we
+# never fabricate a slot-question.
 _HONEST_EMPTY_REPLY = (
     "I'm having trouble generating a response right now — could you "
     "rephrase that, or try again in a moment?"
@@ -718,28 +698,15 @@ async def _gemini_call(
         "tools": [{"functionDeclarations": tools}],
         "toolConfig": {"functionCallingConfig": {"mode": "AUTO"}},
         "generationConfig": {
-            # Z2 fix — Issue 1 (mid-session amnesia). Priya T3 + Vikram T2/T4
-            # came back with the "I lost my train of thought" template even
-            # though slot capture succeeded. Root cause matches KI-150
-            # (fact_find LLM, 420 → 700): when Gemini must emit prose AND a
-            # tool-call trailer in the same response, the model hits
-            # maxOutputTokens mid-emission, the trailer truncates, and the
-            # caller falls through to the defensive reply. Budget breakdown
-            # at p95: prose ~600 tok + tool-call JSON ~800 tok + 20% margin
-            # ⇒ 1680, rounded up to a safe power-of-two-ish 2048.
             "temperature": 0.4,
+            # Sized so a turn emitting prose plus a tool-call trailer does
+            # not truncate mid-emission (p95 ≈ prose 600 + tool JSON 800 +
+            # margin).
             "maxOutputTokens": 2048,
-            # CRITICAL (proven via A/B raw-payload test 2026-05-17):
-            # gemini-2.5-flash is a THINKING model; gemini-2.5-flash-lite /
-            # gemini-2.0-flash (what this bot historically ran) are NOT.
-            # With no thinkingConfig, gemini-2.5-flash returns an EMPTY
-            # completion (finishReason=STOP, content has no `parts`, zero
-            # candidate tokens) for tool-calling turns — so _synthesise_
-            # fallback injects the canned "What's your name?" and the
-            # fact-find loops forever (the live core-flow regression).
-            # thinkingBudget=0 disables thinking → the model behaves like
-            # the fast non-thinking frontier model it should be and emits
-            # the save_profile_field tool call correctly. Do NOT remove.
+            # gemini-2.5-flash is a thinking model; thinkingBudget=0
+            # disables the internal thinking phase so it emits the tool
+            # call / text directly (a non-zero budget can consume the
+            # output allowance and return an empty completion).
             "thinkingConfig": {"thinkingBudget": 0},
         },
     }
@@ -1080,25 +1047,16 @@ def _build_recommendation_citations(
 ) -> tuple[list[dict], bool]:
     """Single source of truth for the structured "CITED POLICIES" cards.
 
-    ROOT CAUSE this addresses (KI-278): the prose the user reads and the
-    citation cards were derived from two different sources. Prose = the
-    LLM's curated shortlist (free text). Cards used to be the raw
-    `retrieve_policies` recall dump deduped by chunk_id and rendered in
-    vector-score order — so the cards listed policies the LLM never named
-    and dropped ones it did.
-
-    This builds the citation set as EXACTLY the policies the assistant
-    actually recommended:
+    The cited-card set IS exactly the policies the assistant recommended,
+    gated by the same fitness logic as the prose:
 
       1. If the LLM called `mark_recommendation(policy_ids=[...])`, those
-         ids are the SELECTION (which policies the assistant chose).
-      2. Otherwise (Gemini skips mark_recommendation on ~70% of rec turns
-         per KI-254), parse the reply prose: every retrieved policy whose
+         ids are the selection.
+      2. Otherwise, parse the reply prose: every retrieved policy whose
          name appears in `reply_text` is selected.
 
-    KI-280 — the cited-card list and the advisory prose must be gated by
-    the SAME fitness logic. Two refinements over the KI-278 builder so the
-    cards ARE the gated, fit-ranked set:
+    The cited-card list and the advisory prose are gated by the SAME
+    fitness logic, with:
 
       • CANONICAL DEDUP: `retrieved_chunks_all` is the union of every
         retrieve_policies result this turn. Each result is already gated +
@@ -1521,18 +1479,10 @@ async def handle_turn(
     # conversation — not a returning user.
     _current_turn = int(getattr(session, "turn_idx", 1) or 1)
 
-    # 2026-05-17 — the deterministic in-conversation profile-recall
-    # scaffolding (the "Welcome back — are you the same <name>?" confirm
-    # short-circuit + STEP-1 name-sniff + STEP-2 apply/discard) was REMOVED.
-    # It was leftover rule-based scaffolding from the pre-Path-B
-    # rule/3-brain/judge era: it masked the single LLM, discarded the name
-    # the user gave, and produced an infinite fact-find loop. The single
-    # LLM (RULE 1 → save_profile_field) is now the SOLE fact-find driver.
-    # Explicit returning-user recall lives ONLY in the separate
-    # POST /api/profile/recall-by-name endpoint (an explicit user action,
-    # not a deterministic in-chat short-circuit). `_did_recall_this_turn`
-    # is kept as a constant False so the TurnResult.returning_user_recalled
-    # field (read by main.py) stays valid without the removed machinery.
+    # The single LLM (RULE 1 → save_profile_field) is the sole fact-find
+    # driver. Explicit returning-user recall is the separate
+    # POST /api/profile/recall-by-name endpoint, so handle_turn never sets
+    # returning_user_recalled True.
     _did_recall_this_turn = False
 
     _has_prior_profile = any(
@@ -1545,8 +1495,7 @@ async def handle_turn(
     is_returning_user = (_current_turn == 1) and _has_prior_profile
 
     # GOOGLE_API_KEY gate — asserted just before anything that talks to
-    # Gemini. (The deterministic no-LLM recall-confirm short-circuit that
-    # used to precede this was removed 2026-05-17.)
+    # Gemini.
     api_key = os.environ.get("GOOGLE_API_KEY", "").strip()
     if not api_key:
         raise SingleBrainError("GOOGLE_API_KEY not set")

backend/voice_format.py

@@ -3,19 +3,15 @@ spoken-language text for Sarvam Bulbul TTS.
 
 Why this exists: an unprocessed LLM reply with markdown bold, inline
 [Source: ...] tags, and acronyms reads like a screenshot when spoken. Users
-hear "asterisk asterisk bold asterisk asterisk A-Y-U-S-H pp dot 1 dash 2".
-That's a UX-killing bug — not a Sarvam limitation, a *us* bug.
-
-KI-104 (2026-05-15) — this module also exposes `strip_cot_preamble`, the
-chain-of-thought / instruction-echo stripper that runs on TEXT replies
-(not just TTS). Live smoke tests caught NIM reasoning models (e.g.,
-Qwen3-Next 80B) and the judge model leaking internal reasoning into
-`reply_text`. Examples: "We need to respond to user question…", "We must
-ground every factual claim…", "<think>...</think>The answer is X."
-`strip_cot_preamble` is called from `persona.strip_think_tags` so every
-reply path that already goes through the <think>-tag strip also gets the
-preamble strip — no orchestrator.py changes needed (that file is owned
-by another lane / KI-101).
+would otherwise hear "asterisk asterisk bold asterisk asterisk A-Y-U-S-H
+pp dot 1 dash 2".
+
+This module also exposes `strip_cot_preamble`, the chain-of-thought /
+instruction-echo stripper that runs on TEXT replies (not just TTS).
+Reasoning models can leak internal reasoning into `reply_text` — e.g.
+"We need to respond to user question…", "We must ground every factual
+claim…", "<think>...</think>The answer is X." `strip_cot_preamble`
+removes that preamble.
 
 The function turns text like:
 
@@ -73,15 +69,15 @@ ACRONYMS = {
     r"\bpp\.(\d+)": r"page \1",
 }
 
-# KI-066 (2026-05-15) — money / range shorthand that Sarvam Bulbul reads
-# letter-by-letter. The user said "₹25L+" was being spoken as "two five L
-# plus". Order in `_normalize_money` matters: handle RANGES first, then
-# PLUS-SUFFIXES, then bare unit-suffixes, then standalone "+".
+# Money / range shorthand that Sarvam Bulbul would otherwise read
+# letter-by-letter (e.g. "₹25L+" as "two five L plus"). Order in
+# `_normalize_money` matters: handle RANGES first, then PLUS-SUFFIXES,
+# then bare unit-suffixes, then standalone "+".
 #
-# KI-148 (2026-05-15) — extended to cover `k` (thousand), word-forms
-# (`1 lakh`, `1 crore`), `+` suffix → "above", and bare numerics like
-# `30000` → "30 thousand", `1,00,000` → "1 lakh". `k` is currency-gated to
-# avoid breaking "10K marathon".
+# Also covers `k` (thousand), word-forms (`1 lakh`, `1 crore`), `+`
+# suffix → "above", and bare numerics like `30000` → "30 thousand",
+# `1,00,000` → "1 lakh". `k` is currency-gated to avoid breaking
+# "10K marathon".
 _MONEY_RANGE_L = re.compile(
     r"₹?\s*(\d+(?:\.\d+)?)\s*-\s*(\d+(?:\.\d+)?)\s*L\b",
     re.IGNORECASE,
@@ -383,13 +379,13 @@ def _truncate_for_voice(text: str, max_words: int = 60) -> str:
 
 
 # ============================================================================
-# KI-104 (2026-05-15) — chain-of-thought / instruction-echo strip
+# Chain-of-thought / instruction-echo strip
 # ============================================================================
-# Live smoke test caught LLM brain replies leaking internal reasoning into
-# user-visible reply_text. Three failure modes:
-#   1. NIM reasoning models (Qwen3-Next 80B) emit a <think>...</think> block
-#      followed by the answer — the <think> tag was sometimes missing /
-#      malformed so the existing strip_think_tags in persona.py let it through.
+# LLM replies can leak internal reasoning into user-visible reply_text in
+# three modes:
+#   1. Reasoning models (Qwen3-Next 80B) emit a <think>...</think> block
+#      followed by the answer, sometimes with a missing / malformed
+#      <think> tag that a plain tag strip would let through.
 #   2. The faithfulness JUDGE model occasionally returns its own reasoning
 #      instead of a clean rescue reply.
 #   3. The brain model misunderstands the system prompt and echoes the
@@ -400,7 +396,7 @@ def _truncate_for_voice(text: str, max_words: int = 60) -> str:
 # lines / first 600 chars), so substantive mid-reply content like
 # "We have three options: A, B, C" is preserved.
 
-# ---- Sentence-level preamble patterns (KI-104) ----
+# ---- Sentence-level preamble patterns ----
 #
 # A CoT preamble can appear as:
 #   (a) a full line of its own: "We need to respond carefully.\n<answer>"
@@ -457,9 +453,9 @@ _BRACKET_INTERNAL = re.compile(
     flags=re.IGNORECASE | re.DOTALL,
 )
 
-# Stray, unbalanced <think> tags that persona.strip_think_tags doesn't
-# already handle (it requires both open and close in the same blob).
-# If we see an isolated </think> mid-reply, drop everything before it.
+# Stray, unbalanced <think> tags (a balanced-tag strip requires both open
+# and close in the same blob). If we see an isolated </think> mid-reply,
+# drop everything before it.
 _STRAY_CLOSE_THINK = re.compile(r"^.*?</think>", flags=re.DOTALL | re.IGNORECASE)
 
 # Maximum scan window for preamble. Beyond this, content is treated as
@@ -567,15 +563,14 @@ def tts_preprocess(text: str, language: str = "en", max_words: int = 60) -> str:
     """Public entry — turn an LLM reply into spoken-language text for TTS."""
     if not text:
         return ""
-    # KI-104 — defense in depth: even if the reply went through
-    # persona.strip_think_tags upstream, run the preamble strip again here
-    # in case it's called on a path that bypasses persona (e.g., direct
-    # TTS of a cached reply).
+    # Defense in depth: run the preamble strip again here in case this is
+    # called on a path that didn't already strip (e.g. direct TTS of a
+    # cached reply).
     cleaned = strip_cot_preamble(text)
     cleaned = _strip_markdown(cleaned)
-    # KI-066 (2026-05-15) — currency/range shorthand expansion before
-    # acronym handling so ₹5L becomes "5 lakhs" instead of getting caught
-    # by the bare-L acronym path.
+    # Currency/range shorthand expansion before acronym handling so ₹5L
+    # becomes "5 lakhs" instead of getting caught by the bare-L acronym
+    # path.
     cleaned = _normalize_money(cleaned)
     # #106 — AFTER money (lakh/crore already words): expand remaining bare
     # integers ("29" → "twenty-nine") + neutralise en/em dashes so Sarvam

rag/extract.py

@@ -2,11 +2,9 @@
 
 For each PDF in rag/corpus/:
   1. Read full text via pdfplumber (already have per-page text from ingest)
-  2. Pass to LLM (NIM DeepSeek-V4-Pro primary, V4-Flash fallback) with the
-     Pydantic schema as a structured-output target. Sarvam-M is NOT in the
-     reasoning path per D-019 (it lives in Indic translation only — its
-     2048-token <think> reasoning + output cap was truncating JSON mid-stream
-     when used as extraction fallback, causing ~20 extraction failures).
+  2. Pass to the brain LLM (get_brain_llm) with the Pydantic schema as a
+     structured-output target. Sarvam-M is not in the reasoning path (it
+     is used for Indic translation only).
   3. Self-critique pass — LLM scores per-field confidence vs source text
   4. Validate via Pydantic
   5. Upsert into DuckDB `policies` table
@@ -73,13 +71,11 @@ EXTRACT_SYSTEM = """You extract structured fields from Indian health insurance p
 
 
 def build_extract_prompt(policy_text: str, schema_excerpt: str, policy_id: str) -> str:
-    # Sarvam-M rejects prompts >~25k chars with HTTP 400 even though docs say
-    # 32k tokens — undocumented stricter limit. DeepSeek-V4-Pro on NIM handles
-    # 1M context but the schema fits comfortably in 12k chars. 12k chars
-    # (~3k tokens) captures Schedule + Key Definitions + Benefits front-matter
-    # where the structured fields live. Exclusions section (the back half)
-    # doesn't yield many structured fields, just policy_exclusions list which
-    # is mostly noise.
+    # The policy text is capped at 12k chars (~3k tokens): that captures
+    # the Schedule + Key Definitions + Benefits front-matter where the
+    # structured fields live. The Exclusions section (the back half)
+    # doesn't yield many structured fields, just the policy_exclusions
+    # list which is mostly noise.
     MAX_CHARS = 12_000
     if len(policy_text) > MAX_CHARS:
         # Front-bias: schedules, definitions, waiting periods, UIN, sum-insured
@@ -143,8 +139,8 @@ def load_manifest() -> dict:
 def json_from_llm_text(text: str) -> dict:
     """Strip code fences and <think> blocks, extract the first balanced {...} block."""
     text = text.strip()
-    # Sarvam-M reasoning model emits <think>...</think> before the JSON; strip
-    # them (handles both closed and unterminated think blocks when output is
+    # Reasoning models emit <think>...</think> before the JSON; strip them
+    # (handles both closed and unterminated think blocks when output is
     # truncated mid-thought).
     text = re.sub(r"<think>.*?</think>", "", text, flags=re.DOTALL)
     text = re.sub(r"<think>.*", "", text, flags=re.DOTALL)
@@ -265,10 +261,8 @@ async def extract_one(pdf_path: Path, manifest_entry: dict, llm_primary, llm_fal
     for attempt, llm in enumerate([llm_primary, llm_fallback]):
         try:
             # Hard per-attempt timeout so a hung TCP connection in httpx
-            # pooling can't stall the whole sweep. NIM DeepSeek-V4-Pro has its
-            # own 4-step backoff retry loop that can use up to ~5min on 429s,
-            # so give it 120s ceiling. Sarvam (fallback) has no retries; 60s
-            # is plenty.
+            # pooling can't stall the whole sweep. The primary gets a larger
+            # ceiling than the fallback.
             attempt_timeout = 180 if llm is llm_primary else 120
             res = await asyncio.wait_for(
                 llm.chat(messages=messages, temperature=0.0, max_tokens=2048),
@@ -328,19 +322,8 @@ async def main():
     if args.limit:
         pdfs = pdfs[: args.limit]
 
-    # Provider matrix (2026-05-14, Stack A consolidation per D-019):
-    #   - NIM DeepSeek-V4-Pro: 1M ctx, frontier MoE, MIT-licensed, free tier
-    #     40 req/min with no daily cap. Clean JSON output, no <think> verbosity.
-    #     Used as primary because of the bigger reasoning budget.
-    #   - NIM DeepSeek-V4-Flash: 284B/13B MoE, ~3× faster than V4-Pro, same
-    #     clean JSON discipline. Used as fallback on V4-Pro ReadTimeout —
-    #     different MoE routing path so a Pro timeout doesn't always reproduce
-    #     in Flash. Sarvam-M was the old fallback but its <think> tags ate the
-    #     2048 output cap before reaching JSON, causing ~20 truncation failures.
-    # Three-chain collapse (2026-05-15): the separate FAST_BRAIN_CHAIN /
-    # get_fast_brain_llm accessor was removed. One brain chain (get_brain_llm)
-    # whose NimChainLLM already does internal multi-candidate fallback;
-    # primary/fallback both resolve to it.
+    # get_brain_llm() returns a NimChainLLM that already does internal
+    # multi-candidate fallback, so primary and fallback both resolve to it.
     primary = get_brain_llm()
     fallback = get_brain_llm()
 

rag/retrieve.py

@@ -31,25 +31,19 @@ def _safe_collection_get(
     where: Optional[dict] = None,
     include: Optional[list[str]] = None,
 ) -> Optional[dict]:
-    """KI-107 (2026-05-15) — defensive wrapper around `collection.get(...)`.
-
-    C5 port-in persona logged 3× HTTP 500 "Error executing plan: Internal
-    error: Error finding id" against the live HF Space. Chroma's
-    `collection.get(ids=[...])` is documented to return empty lists when ids
-    miss — but the Rust-backed client can still raise on certain edge cases
-    (legacy schema rows, where-clause + missing-id combinations, transient
-    sqlite lock contention during HNSW compaction). The pre-KI-107 code
-    wrapped these calls in bare `except: pass`, which silently masked the
-    failure and let downstream callers index into None — producing the
-    confusing "Error finding id" plan-executor message instead of a
-    coherent retrieval fallback.
+    """Defensive wrapper around `collection.get(...)`.
+
+    Chroma's `collection.get(ids=[...])` is documented to return empty
+    lists when ids miss, but the Rust-backed client can still raise on
+    certain edge cases (legacy schema rows, where-clause + missing-id
+    combinations, transient sqlite lock contention during HNSW
+    compaction).
 
     This helper:
       - Returns None on ANY exception (caller MUST treat None as "miss").
       - Returns the raw dict (may have empty lists) on success.
-      - Logs at WARNING level so the failure is observable in HF Space logs
-        instead of swallowed silently. Critical for post-mortem of similar
-        regressions.
+      - Logs at WARNING level so the failure is observable instead of
+        swallowed silently.
     """
     try:
         kwargs: dict = {}
@@ -149,7 +143,7 @@ def _build_chunk(cid: str, doc: str, meta: dict, score: float) -> RetrievedChunk
     )
 
 
-# KI-034 (2026-05-14) — in-process retrieval cache. Keyed by
+# In-process retrieval cache. Keyed by
 # (query_text, top_k, sorted policy_ids, sorted insurer_slugs). Caps at 256
 # entries with FIFO eviction so memory stays bounded across long sessions.
 # Within a single chat session, users frequently rephrase or follow up on the
@@ -170,8 +164,8 @@ def _cache_key(
     insurer_slugs: Optional[list[str]],
     session_id: Optional[str] = None,
 ) -> tuple:
-    # QUARANTINE-ISOLATION FIX (2026-05-16) — session_id MUST be part of the
-    # cache key. The result set is session-dependent: when a session_id is
+    # session_id MUST be part of the cache key (quarantine isolation).
+    # The result set is session-dependent: when a session_id is
     # supplied the quarantine boost pass prepends that session's uploaded
     # PDF chunks. Without session_id in the key, a result computed for
     # session A (carrying A's private uploaded chunks) would be served
@@ -223,13 +217,12 @@ async def retrieve(
     This ensures the brain sees regulatory ceilings even when policy
     chunks dominate raw cosine.
 
-    KI-118 (2026-05-15) — profile chunks are keyed by `profile_name_slug`
-    (canonical user name) instead of session_id. Only named users have a
-    profile chunk to boost. `session_id` is retained for the per-session
-    quarantine (user-uploaded PDF) lookup but is no longer used for
+    Profile chunks are keyed by `profile_name_slug` (canonical user name);
+    only named users have a profile chunk to boost. `session_id` is used
+    for the per-session quarantine (user-uploaded PDF) lookup, not for
     profile boosting.
     """
-    # KI-034 — short-circuit identical-query re-asks via the LRU cache.
+    # Short-circuit identical-query re-asks via the LRU cache.
     # session_id is part of the key so one session's cached result (which
     # may carry that session's private quarantine chunks) is never served
     # to another session.
@@ -238,15 +231,12 @@ async def retrieve(
     if cached is not None:
         return cached
 
-    # KI-049 (2026-05-14) — wider net for table-cell questions. The
-    # post-fix 96-Q eval surfaced 8 failures on room-rent / sub-limit /
-    # cap questions where the bot's reply omitted the room category
-    # ("Single Private", "Twin Sharing", "General Ward"). Root cause:
-    # the policy table with the cap structure is one chunk in Chroma,
-    # but at top_k=5 it can lose to other relevant prose chunks. For
-    # queries clearly asking about a structured cap, retrieve more
-    # candidates so the table chunk has a higher chance of landing in
-    # the LLM's context window.
+    # Wider net for table-cell questions. The policy table holding the
+    # cap structure (room-rent / sub-limit / room category) is one chunk
+    # in Chroma and at top_k=5 it can lose to other relevant prose
+    # chunks. For queries clearly asking about a structured cap, retrieve
+    # more candidates so the table chunk has a higher chance of landing
+    # in the LLM's context window.
     _TABLE_CELL_TRIGGERS = _re.compile(
         r"\b(room\s*rent|sub[\s\-]?limit|sub[\s\-]?limits|copay|co[\s\-]?pay|"
         r"cap\s+on|capped\s+at|sum\s+insured\s+limit|"
@@ -261,13 +251,12 @@ async def retrieve(
     embedder = embedder or VoyageEmbeddings()
     [query_vec] = await embedder.embed([query], input_type="query")
 
-    # KI-102 (2026-05-15) — privacy P0. The main retrieval pass MUST NEVER
-    # return chunks of doc_type='profile' because those chunks are scoped to a
-    # specific user's session_id. Profile chunks are exclusively surfaced via
-    # the explicit per-session collection.get(ids=[f"profile_{session_id}"])
-    # lookup below; allowing them through the cosine pass leaks another user's
-    # profile into the current session (live smoke test of 15 personas caught
-    # B4 retrieving profile chunks from smokeA_1, ki100_ve, smokeB_B2).
+    # Privacy invariant: the main retrieval pass MUST NEVER return chunks
+    # of doc_type='profile' because those chunks are scoped to a specific
+    # user. Profile chunks are exclusively surfaced via the explicit
+    # per-session collection.get(ids=[f"profile_{session_id}"]) lookup
+    # below; allowing them through the cosine pass would leak another
+    # user's profile into the current session.
     #
     # We translate this to Chroma's `where` DSL using $ne (not-equals) on
     # doc_type. Combined with optional policy_id / insurer_slug filters via
@@ -284,17 +273,13 @@ async def retrieve(
 
     collection = get_collection()
 
-    # Standard retrieval — KI-108 (2026-05-15) wraps collection.query() with
-    # the same defensive pattern as KI-107's _safe_collection_get. Live test
-    # post-KI-107 caught the bare query raising
-    # `chromadb.errors.InternalError: Error executing plan: Internal error:
-    # Error finding id` on EVERY user turn (HNSW index entry pointing to a
-    # missing doc — likely from a partial KI-102 profile-chunk write
-    # corrupting the collection state). KI-107 only wrapped .get(); .query()
-    # has the same failure mode. On error we degrade to empty retrieval:
-    # the brain still answers (acknowledging it can't access the catalog)
-    # instead of the user seeing KI-106's generic "something went wrong"
-    # fallback for every message.
+    # Standard retrieval — collection.query() is wrapped with the same
+    # defensive pattern as _safe_collection_get because .query() can raise
+    # `chromadb.errors.InternalError: Error executing plan` when an HNSW
+    # index entry points to a missing doc. On error we degrade to empty
+    # retrieval: the brain still answers (acknowledging it can't access
+    # the catalog) instead of the user seeing a generic "something went
+    # wrong" fallback for every message.
     out: list[RetrievedChunk] = []
     try:
         res = collection.query(
@@ -316,24 +301,20 @@ async def retrieve(
             effective_top_k, where, type(e).__name__, str(e)[:300],
         )
 
-    # Profile boost pass — KI-118 (2026-05-15). Profile chunks are now
-    # keyed by `profile_name_slug` (canonical user name), not session_id.
-    # The orchestrator passes the slug only when the live session has a
-    # known name; anonymous chats skip this branch entirely.
+    # Profile boost pass. Profile chunks are keyed by `profile_name_slug`
+    # (canonical user name), not session_id. The caller passes the slug
+    # only when the live session has a known name; anonymous chats skip
+    # this branch entirely.
     if profile_name_slug:
         profile_chunk_id = f"profile_{profile_name_slug}"
-        # KI-118 — filter by BOTH id AND name_slug metadata so any future
-        # ID collision (or migration-era chunk written under a shared id)
-        # still can't leak the wrong profile into this user's context.
+        # Filter by BOTH id AND name_slug metadata so any ID collision
+        # (or migration-era chunk written under a shared id) can't leak
+        # the wrong profile into this user's context.
         #
-        # KI-107 (2026-05-15) — route through _safe_collection_get because
-        # first-time named users (no profile saved yet) and certain transient
-        # Chroma sqlite states cause collection.get(ids=[missing_id]) to
-        # raise instead of returning empty lists. Before this fix the bare
-        # `except: pass` masked the failure, the orchestrator's plan-executor
-        # still saw an AttributeError on the swallowed-None path, and the
-        # user got HTTP 500 "Error executing plan: Internal error: Error
-        # finding id".
+        # Route through _safe_collection_get because first-time named
+        # users (no profile saved yet) and certain transient Chroma
+        # sqlite states cause collection.get(ids=[missing_id]) to raise
+        # instead of returning empty lists.
         prof_res = _safe_collection_get(
             collection,
             ids=[profile_chunk_id],
@@ -355,7 +336,7 @@ async def retrieve(
                 out = [profile_chunk] + [c for c in out if c.chunk_id != profile_chunk_id]
                 out = out[:top_k]
 
-    # Quarantine boost pass — when the orchestrator passes a session_id, also
+    # Quarantine boost pass — when the caller passes a session_id, also
     # query the SEPARATE quarantine collection (user-uploaded PDFs) scoped to
     # this session. Results get a ×1.1 score boost so the user's own uploaded
     # doc ranks above generic policies when relevant. Quarantine lives in a

tools/chunk_sweep.py

@@ -30,9 +30,9 @@ ROOT = Path(__file__).resolve().parent.parent
 RESULTS_JSON = ROOT / "eval" / "chunk_sweep_results.json"
 RESULTS_MD = ROOT / "kb" / "calculations" / "chunk_sweep_results.md"
 
-# Sweep grid. Range widened 2026-05-13 — prior narrow grid (600-1000) produced
-# identical scores across all cells because retrieval converges in that band.
-# This grid spans 6x range so chunk-boundary effects on retrieval are visible.
+# Sweep grid. Spans a ~6x range so chunk-boundary effects on retrieval
+# are visible (a narrow grid converges to identical scores because
+# retrieval is insensitive within a small band).
 GRID = [
     (400, 60),
     (600, 100),

tools/set_hf_secrets.py

@@ -1,10 +1,9 @@
 """Programmatically set HF Space secrets via the official HF API.
 
 No browser needed. Reads keys from local .env and pushes them as Space
-secrets so the deployed app can authenticate. Post-D-019 (Stack A
-consolidation): only Sarvam + Voyage + NVIDIA NIM keys are required.
-Legacy GROQ/OPENROUTER/CEREBRAS/DEEPSEEK keys are deleted from the Space
-to prevent confusion (they are no longer referenced by the code).
+secrets so the deployed app can authenticate. Only the keys in
+SECRETS_TO_SET below are pushed; any other provider keys are deleted
+from the Space to prevent confusion.
 
 Run:
   python tools/set_hf_secrets.py
@@ -23,15 +22,15 @@ ROOT = Path(__file__).resolve().parent.parent
 load_dotenv(ROOT / ".env")
 
 REPO_ID = "rohitsar567/InsuranceBot"
-# Active secrets read by the running code (post-D-022 + admin panel):
-#   - SARVAM / NIM = the live providers
-#   - VOYAGE       = legacy (kept for back-compat with old extracted artifacts)
-#   - OPENROUTER / GROQ = optional cross-provider fallbacks (re-added 2026-05-14)
-#   - ADMIN_*      = control-panel gate (IP allowlist + password)
+# Active secrets read by the running code:
+#   - SARVAM / NIM / GOOGLE = the live providers
+#   - VOYAGE                = kept for back-compat with extracted artifacts
+#   - OPENROUTER / GROQ     = optional cross-provider fallbacks
+#   - ADMIN_*               = control-panel gate
 SECRETS_TO_SET = [
     "SARVAM_API_KEY", "VOYAGE_API_KEY", "NVIDIA_NIM_API_KEY",
     "OPENROUTER_API_KEY", "GROQ_API_KEY",
-    "GOOGLE_API_KEY",  # KI-179 (2026-05-15) — Gemini Flash via Google AI Studio
+    "GOOGLE_API_KEY",  # Gemini Flash via Google AI Studio
     "ADMIN_IP_ALLOWLIST", "ADMIN_PASSWORD",
 ]
 # Truly retired providers — delete from Space to prevent confusion.

tools/upload_to_hf.py

@@ -1,16 +1,16 @@
-"""One-shot uploader to Hugging Face Space (post-D-019 — code-only).
+"""One-shot code-only uploader to the Hugging Face Space.
 
 Pushes the code-only Space (minus build artifacts, .venv, node_modules, etc.) to
-huggingface.co/spaces/rohitsar567/InsuranceBot. Post-D-019 the large data
-(corpus PDFs + Chroma vectors + extracted JSONs) lives in the companion HF
+huggingface.co/spaces/rohitsar567/InsuranceBot. The large data (corpus
+PDFs + Chroma vectors + extracted JSONs) lives in the companion HF
 dataset rohitsar567/insurance-bot-data — the Space's Dockerfile pulls it via
 huggingface_hub.snapshot_download at image build time.
 
-KI-152 (2026-05-15): operates in SYNC mode. After `upload_folder` (add/replace),
-walks the local tree, lists the remote repo, and issues a second commit that
-DELETES any remote file that no longer exists locally. Prevents ghost files
-(renamed/deleted brochures) from lingering on the Space and being served by
-the Docker image after a rebuild. See KI-126 / KI-143 / KI-144 / KI-151.
+Operates in SYNC mode: after `upload_folder` (add/replace), walks the
+local tree, lists the remote repo, and issues a second commit that
+DELETES any remote file not present locally. Prevents ghost files
+(renamed/deleted brochures) from lingering on the Space and being served
+by the Docker image after a rebuild.
 
 Run:
   python tools/upload_to_hf.py            # full upload + sync delete
@@ -57,10 +57,9 @@ IGNORE = [
     "rag/corpus/**",
     "rag/vectors/**",
     "rag/extracted/**",
-    # KI-128 (2026-05-15): backup dir + LFS pointers were leaking into the
-    # Space push via the rag/corpus and rag/extracted symlinks, blowing the
-    # Space's 1 GB LFS storage quota (Repository storage limit reached on
-    # post_lfs_batch_info). The data path is HF Dataset, NOT the Space.
+    # Exclude the backup dir + LFS pointers: pushing them would blow the
+    # Space's 1 GB LFS storage quota. The data path is the HF Dataset,
+    # NOT the Space.
     "rag/_hf_dataset_backup/**",
     "**/_hf_dataset_backup/**",
     "rag/policies.duckdb",      # LFS-tracked, comes from dataset at build

tools/upload_vectors_to_dataset.py

@@ -2,8 +2,8 @@
 
 Run AFTER `.venv/bin/python -m rag.ingest` on the developer Mac. The Space's
 Dockerfile pulls rag/vectors/** at build time so the deployed container has a
-ready-to-serve index. As of 2026-05-14 the Space no longer auto-ingests on
-boot — see entrypoint.sh.
+ready-to-serve index; the Space does not auto-ingest on boot (see
+entrypoint.sh).
 """
 from __future__ import annotations
 import os