fix(closure+hydration+voice+admin): KI-248..KI-251 — V1-V4 bundle from Playwright smoke

V1 — recommendation closure ("I lost my train of thought"):
ROOT CAUSE was a coercer/null-guard collision, NOT MAX_ITERATIONS or prompt
length. Z6 prompt told Gemini → save_profile_field(health_conditions, "none"),
_coerce_health_conditions stripped "none" → [], save_profile_field's KI-091
null-overwrite guard rejected [] as normalized_empty, profile stayed
incomplete forever, retrieve looped, MAX_ITERATIONS=5 exhausted, defensive
"lost my train of thought" fired.
Three-angle fix:
- (D primary) brain_tools._coerce_health_conditions: pure-negation tokens
("none", "no", "healthy", "n/a") now collapse to sentinel ["none"]
(non-empty list) instead of []. Mixed input ("diabetes, none") still
drops the negation noise. Downstream consumers verified safe.
- (C) brain_tools.retrieve_policies profile_incomplete return now includes
action_required="ask_user_for" + field=<first_missing> + exact_question
so Gemini relays the question verbatim instead of looping.
- (A) single_brain MAX_ITERATIONS 5→8 (headroom for chained save+retrieve)
+ new _synthesise_fallback(profile) helper replaces the generic "lost
my train of thought" with a profile-aware question for the first missing
slot, or a confirmation prompt if all 7 captured.

V2 — turn_idx admin column showing "—":
Backend wiring was correct end-to-end (session.turn_idx increments,
record_policy_event persists turn_idx in JSON). The break was at the API
boundary: GET /api/admin/recommendation-history projection dict in
admin.py omitted turn_idx entirely. Plus latent field-name mismatch:
frontend reads e.conversation_turn, backend wrote turn_idx. Fix: one line
added to the projection — "conversation_turn": entry.get("turn_idx") —
bridges both at once. Pre-Y2 events keep showing "—" (correct, no
stamping at write time); new events render the turn number.

V3 — React #418 hydration mismatch on home page:
useStreamingVoice.ts:316 isSupported defaulted false during SSR (no window
to read SpeechRecognition constructor) but true on Chrome/Safari CSR.
Different boolean drove a different pill element (<span> "Mic blocked" vs
<button> "Voice off") between SSR and CSR. Fix in page.tsx: mounted flag
(false on SSR + first CSR render, true after useEffect) gates
micPermissionDenied. SSR HTML now contains the same "Voice off" pill that
CSR renders, eliminating mismatch.

V4 — voice "green pill, zero audio" silent failure:
When getUserMedia fails (permission denied, no mic, OverconstrainedError,
etc.) the pill still said "Voice on" with zero capture — matched the
documented [[feedback_voice_silent_failure_modes]] pattern.
Fix: useStreamingVoice ensureAudioCapture catch block now emits
onVoiceError("mic_permission_denied"), flips wantRunningRef=false, halts
SR auto-restart. start() awaits ensureAudioCapture and skips safeStart on
denial. page.tsx onVoiceError handler also calls setVoicePermDenied(true)
+ setVoiceEnabled(false) to revert the pill; 4th banner case renders red
"Microphone access denied — click the lock icon and allow, then reload".
DOMException mapping: NotAllowedError / SecurityError / NotFoundError /
OverconstrainedError / NotReadableError / AbortError / unknown all
collapse to mic_permission_denied (same remediation).

Verification: py_compile clean (admin/brain_tools/single_brain), tsc
clean, next build succeeds. Playwright headless smoke with shimmed
NotAllowedError confirmed banner renders within 8s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/brain_tools.py

@@ -207,15 +207,51 @@ async def retrieve_policies(
             if getattr(profile, slot, None) in (None, "", [])
         ]
         if missing:
+            # KI-Z6-NONE follow-up (2026-05-15): make the response
+            # extremely directive so Gemini doesn't burn an iteration
+            # re-trying retrieve_policies on the same incomplete profile.
+            # Provide an exact_question string the model can literally
+            # relay to the user for the first missing slot.
+            _SLOT_QUESTIONS = {
+                "name": "What's your name?",
+                "age": "How old are you?",
+                "dependents": (
+                    "Who would you like the cover to include — just you, "
+                    "or spouse / kids / parents?"
+                ),
+                "location_tier": "Which city do you live in?",
+                "income_band": (
+                    "Roughly what's your annual household income — "
+                    "under 10 lakh, 10-25 lakh, or above 25 lakh?"
+                ),
+                "primary_goal": (
+                    "Is this your first health policy, an upgrade, for "
+                    "tax planning, or to find a cheaper option?"
+                ),
+                "health_conditions": (
+                    "Do you or your family have any pre-existing health "
+                    "conditions like diabetes, BP, or thyroid? If none, "
+                    "just say no."
+                ),
+            }
+            first = missing[0]
             return {
                 "chunks": [],
                 "count": 0,
                 "error": "profile_incomplete",
                 "missing_slots": missing,
+                "action_required": "ask_user_for",
+                "field": first,
+                "exact_question": _SLOT_QUESTIONS.get(
+                    first,
+                    f"Could you share your {first.replace('_', ' ')}?",
+                ),
                 "instruction": (
                     f"Profile is incomplete — missing: {', '.join(missing)}. "
-                    "Do NOT make a recommendation. Ask the user for the "
-                    "missing slot(s) before calling retrieve_policies again."
+                    "Do NOT call retrieve_policies again this turn. Do NOT "
+                    "retry save_profile_field for the same field. Emit a "
+                    "TEXT reply that asks the user the `exact_question` "
+                    "above verbatim."
                 ),
             }
 
@@ -490,7 +526,21 @@ def _coerce_existing_cover(value: Any) -> Optional[int]:
 
 
 def _coerce_health_conditions(value: Any) -> Optional[list[str]]:
-    """Always return list[str] lowercase, stripped, empties dropped."""
+    """Always return list[str] lowercase, stripped, empties dropped.
+
+    KI-Z6-NONE (2026-05-15): "none" / "no" / "n/a" — used to be stripped to
+    `[]`, but downstream `save_profile_field` then hits the KI-091 null-
+    overwrite guard (`normalized in (None, "", [])`) and refuses to persist
+    the slot. Result: profile.health_conditions stays empty forever,
+    `_profile_complete` returns False, retrieve_policies returns
+    profile_incomplete, the brain loops, MAX_ITERATIONS exhausts, the bot
+    emits "Sorry — I lost my train of thought" (W1 Turn 3 live blocker).
+
+    Fix: keep the explicit-negation sentinel `["none"]` so:
+      • the slot is non-empty → _profile_complete=True → retrieve fires
+      • downstream consumers can still detect "no PED" via the literal
+        token `"none"` in the list (callers already lowercase-compare).
+    """
     if value is None:
         return None
     if isinstance(value, str):
@@ -501,9 +551,15 @@ def _coerce_health_conditions(value: Any) -> Optional[list[str]]:
     else:
         items = [str(value).strip()]
     cleaned = [t.lower() for t in items if t]
-    # "none" / "no" → empty list (user explicitly said no conditions).
-    cleaned = [t for t in cleaned if t not in {"none", "no", "n/a", "na", "nil"}]
-    return cleaned
+    # Explicit-negation tokens — collapse to the canonical sentinel
+    # `["none"]` rather than `[]` so the slot is captured, not blanked.
+    _NEGATION = {"none", "no", "n/a", "na", "nil", "nothing", "healthy"}
+    if cleaned and all(t in _NEGATION for t in cleaned):
+        return ["none"]
+    # Mixed input ("diabetes, none") — drop the negation noise, keep real
+    # conditions.
+    real = [t for t in cleaned if t not in _NEGATION]
+    return real
 
 
 __all__ = [

backend/single_brain.py

@@ -54,7 +54,13 @@ PER_CALL_TIMEOUT_SEC = 25.0
 
 # Max iterations of the tool-call loop. Prevents runaway tool-call cycles
 # where the LLM keeps calling save_profile_field on the same value.
-MAX_ITERATIONS = 5
+# KI-Z6-NONE (2026-05-15): bumped 5 → 8 after W1 Turn 3 live blocker.
+# The Z6 "no medical issues" path used to need: save(health=none) +
+# retrieve → profile_incomplete → save(health=none) + retrieve → loop
+# exhaust. Coercer fix in brain_tools resolves the primary cause; the
+# extra headroom protects against the next variant where Gemini chains
+# 3-4 saves + 2 retrieves on a long pre-recommendation user turn.
+MAX_ITERATIONS = 8
 
 # Transient-error retry policy (2026-05-15 / KI-singlebrain-503).
 # Live HF Space logs (rohitsar567/InsuranceBot, 2026-05-15 08:15Z) show
@@ -457,6 +463,61 @@ def _detect_language(user_text: str) -> str:
     return "en"
 
 
+_FALLBACK_SLOT_QUESTIONS = {
+    "name": "What's your name?",
+    "age": "How old are you?",
+    "dependents": (
+        "Who would you like the cover to include — just you, "
+        "or spouse / kids / parents?"
+    ),
+    "location_tier": "Which city do you live in?",
+    "income_band": (
+        "Roughly what's your annual household income — under 10 lakh, "
+        "10-25 lakh, or above 25 lakh?"
+    ),
+    "primary_goal": (
+        "Is this your first health policy, an upgrade, for tax planning, "
+        "or to find a cheaper option?"
+    ),
+    "health_conditions": (
+        "Do you or your family have any pre-existing health conditions "
+        "like diabetes, BP, or thyroid? If none, just say no."
+    ),
+}
+
+_FALLBACK_REQUIRED_SLOTS = (
+    "name", "age", "dependents", "location_tier",
+    "income_band", "primary_goal", "health_conditions",
+)
+
+
+def _synthesise_fallback(profile) -> str:
+    """KI-Z6-NONE (2026-05-15): replace the legacy 'I lost my train of
+    thought' reply with a useful next-question synthesised from the
+    profile snapshot. If a slot is still missing, ask for the first
+    missing one verbatim. If everything's captured, ask for a recap
+    confirmation. Never empty-string — always returns user-visible text.
+    """
+    try:
+        for slot in _FALLBACK_REQUIRED_SLOTS:
+            v = getattr(profile, slot, None)
+            if v in (None, "", []):
+                return _FALLBACK_SLOT_QUESTIONS.get(
+                    slot,
+                    f"Could you share your {slot.replace('_', ' ')}?",
+                )
+        # All slots present — ask the user to confirm before recommending.
+        return (
+            "Let me confirm what I have before pulling up options — "
+            "does this look right, or anything to update?"
+        )
+    except Exception:  # noqa: BLE001 — never fail the fallback
+        return (
+            "Could you tell me a bit more about what you're looking for "
+            "so I can pull up the right options?"
+        )
+
+
 def _classify_intent(user_text: str, tool_calls_made: list[str]) -> str:
     """Best-effort intent label for logging only. Single-brain doesn't
     route on intent — but the legacy `TurnResult.intent` field is logged
@@ -933,16 +994,10 @@ async def handle_turn(
             "single_brain hit MAX_ITERATIONS=%d (tool_calls=%s)",
             MAX_ITERATIONS, tool_calls_made,
         )
-        last_text = (
-            last_text
-            or "Let me pause for a second — could you tell me a bit more about "
-               "what you're looking for, so I can give you a clean recommendation?"
-        )
+        last_text = last_text or _synthesise_fallback(session.profile)
 
     # Build TurnResult.
-    reply_text = last_text or (
-        "Sorry — I lost my train of thought there. Could you say that again?"
-    )
+    reply_text = last_text or _synthesise_fallback(session.profile)
 
     # Bug C secondary defense — log a WARNING if the reply name-drops an
     # insurer/product brand even though no retrieve_policies result was

frontend/src/app/page.tsx

@@ -220,6 +220,16 @@ export default function Page() {
   const [voiceEnabled, setVoiceEnabled] = useState(false);
   const [voiceListening, setVoiceListening] = useState(false);
   const [voicePermDenied, setVoicePermDenied] = useState(false);
+  // Hydration guard — `streamingVoice.isSupported` resolves via `typeof
+  // window` inside `useStreamingVoice`, so it's `false` on the SSR pass and
+  // (typically) `true` on the client. Rendering JSX that branches on it
+  // before hydration completes triggers React error #418 (text content
+  // mismatch / hydration failure). We pin the SSR + first-client-render
+  // output to the same shape, then flip on a post-mount effect.
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => {
+    setMounted(true);
+  }, []);
   // KI-223 (2026-05-15) — V1.1 / V1.2. Structured voice-error banner state.
   // Populated by useStreamingVoice's onVoiceError callback when the hook hits
   // a recoverable failure mode that the user can act on (tap to unlock audio,
@@ -288,11 +298,21 @@ export default function Page() {
     },
     onListening: setVoiceListening,
     // KI-223 (2026-05-15) — V1.1 / V1.2. Surface recoverable voice failures
-    // as a top-right banner. The hook emits one of three error strings; the
+    // as a top-right banner. The hook emits one of four error strings; the
     // banner state stamps a fresh `ts` so the auto-dismiss timer restarts on
     // every new emission (useful when the same error fires twice in a row).
+    // W1 (2026-05-15) — added "mic_permission_denied". When the hook reports
+    // a getUserMedia DOMException (NotAllowedError / NotFoundError / etc.)
+    // we also revert the pill back to grey + set the legacy permDenied flag
+    // so the "🔇 Mic blocked" branch fires. Without these flips the pill
+    // stayed green over a dead mic ("green pill, zero audio") until the user
+    // manually toggled off — the exact silent-failure mode this fix targets.
     onVoiceError: (error) => {
       setVoiceErrorBanner({ type: error, ts: Date.now() });
+      if (error === "mic_permission_denied") {
+        setVoicePermDenied(true);
+        setVoiceEnabled(false);
+      }
     },
   });
 
@@ -334,7 +354,13 @@ export default function Page() {
   const live = {
     live: voiceEnabled,
     recording: voiceListening,
-    micPermissionDenied: voicePermDenied || !streamingVoice.isSupported,
+    // Hydration-safe: until the post-mount effect runs, force this to false
+    // so the SSR pass and the first client render emit identical JSX (the
+    // Voice toggle pill, not the "Mic blocked" badge). After mount we trust
+    // the hook's `isSupported` flag (which reads `window.SpeechRecognition`).
+    micPermissionDenied: mounted
+      ? (voicePermDenied || !streamingVoice.isSupported)
+      : false,
     setLive: setVoiceEnabled,
   };
 
@@ -1066,6 +1092,17 @@ export default function Page() {
             {voiceErrorBanner.type === "worklet_failed" && (
               <span>Audio capture failed — please reload the page.</span>
             )}
+            {/* W1 (2026-05-15) — silent getUserMedia denial. The default
+                non-yellow branch above already renders a red background;
+                we just supply the human-readable copy here. Triggered when
+                the user (or browser policy / OS / another app holding the
+                mic) rejects the permission prompt. */}
+            {voiceErrorBanner.type === "mic_permission_denied" && (
+              <span>
+                Microphone access denied. Click the lock icon next to the URL
+                bar and allow microphone, then reload.
+              </span>
+            )}
           </div>
           <button
             type="button"

frontend/src/lib/useStreamingVoice.ts

@@ -46,9 +46,19 @@ import {
   retryPostTranscribe,
   scaleSpeechZcrBand,
   AdaptiveNoiseFloor,
-  type VoiceError,
+  type VoiceError as VoiceErrorBase,
 } from "./voice_resilience";
 
+// W1 (2026-05-15) — additive 4th voice-error code. Surfaces a silent
+// `getUserMedia` permission/denial failure (NotAllowedError /
+// NotFoundError / SecurityError / generic DOMException) so page.tsx can
+// render an actionable banner and revert the "Voice on" pill. Kept as a
+// local widening of the base `VoiceError` union from voice_resilience.ts
+// (which we don't touch per scope) — callers see the same
+// `onVoiceError(err: VoiceError) => void` shape, just with one more legal
+// string value.
+export type VoiceError = VoiceErrorBase | "mic_permission_denied";
+
 // KI-189 (2026-05-15) — live-speak barge-in tuning constants.
 // The MediaRecorder mic stream IS echo-cancelled by the browser (KI-185
 // `getUserMedia` AEC constraints), so the bot's TTS bleed lands at a
@@ -453,8 +463,47 @@ export function useStreamingVoice(
       console.debug("[useStreamingVoice] MediaRecorder started", { mime: recorderMimeRef.current });
       return true;
     } catch (err) {
-      console.debug("[useStreamingVoice] MediaRecorder init failed — falling back to Web Speech only", err);
+      // W1 (2026-05-15) — DOMException name → VoiceError mapping.
+      //   NotAllowedError / SecurityError → user denied or browser-blocked
+      //   NotFoundError / OverconstrainedError → no usable input device
+      //   NotReadableError / AbortError → OS-level mic owned by another app
+      //   anything else (incl. plain Error) → treat as denial so the UI still
+      //                                       surfaces an actionable banner
+      // ALL of these map to "mic_permission_denied" because the user-visible
+      // remediation is the same: open site permissions, allow mic, reload.
+      // Returning `false` alone was insufficient — `start()` calls this via
+      // `void ensureAudioCapture()` and never sees the rejection, so the pill
+      // stayed at "Voice on" with zero mic. Emitting onVoiceError + flipping
+      // wantRunningRef false + onListening(false) is the recovery contract.
+      const name = (err as { name?: string } | null)?.name ?? "Error";
+      console.debug(
+        "[useStreamingVoice] getUserMedia / MediaRecorder init failed",
+        { name, err },
+      );
       recorderActiveRef.current = false;
+      // `getUserMedia` rejection happens BEFORE we assign mediaStreamRef /
+      // mediaRecorderRef, so there's nothing to tear down here. The
+      // `wantRunningRef = false` + `onListening(false)` below is enough to
+      // halt the SR auto-restart loop. The parent's `enabled = false` flip
+      // (driven by the banner code) will run stop() which idempotently
+      // re-runs full cleanup.
+      // Surface to the page-level banner. Cast through the local widened
+      // VoiceError union (W1) so TS accepts the new string code.
+      try {
+        onVoiceErrorRef.current("mic_permission_denied" as VoiceError);
+      } catch {
+        /* never let a user-supplied callback crash the hook */
+      }
+      // Stop the recognition restart loop and reset listening state so the
+      // pill doesn't stay green over a dead mic. The parent (page.tsx) is
+      // expected to also flip `enabled` back to false on the banner code,
+      // which calls our `stop()` and idempotently cleans up.
+      wantRunningRef.current = false;
+      try {
+        onListeningRef.current(false);
+      } catch {
+        /* ignore */
+      }
       return false;
     }
   }, [pickRecorderMime]);
@@ -837,10 +886,27 @@ export function useStreamingVoice(
     }
     finalsRef.current = [];
     finalsConsumedRef.current = 0;
-    // Kick off audio capture in parallel with recognition. If it fails we
-    // degrade to Web Speech-only — onend handles the fallback path.
-    void ensureAudioCapture();
-    safeStart();
+    // W1 (2026-05-15) — gate the SR start on a successful `getUserMedia`.
+    // Previously this was `void ensureAudioCapture(); safeStart();` which
+    // raced the two in parallel: on a Chromium / iOS Safari permission
+    // denial, the recognition started, the pill flipped to "Voice on —
+    // just speak", but the mic was dead (zero audio, no banner, no log).
+    // By awaiting the capture result and skipping safeStart() on a hard
+    // denial, the pill-flip (driven by page.tsx's
+    // `onVoiceError("mic_permission_denied")` handler) lands BEFORE
+    // recognition kicks off. The ensureAudioCapture catch already sets
+    // wantRunningRef=false and emits onVoiceError on its way out.
+    void (async () => {
+      const ok = await ensureAudioCapture();
+      // Hard denial path: capture failed AND ensureAudioCapture reset
+      // wantRunningRef. Skip recognition.start — page.tsx will flip
+      // `enabled` to false on the banner code, which triggers stop().
+      if (!ok && !wantRunningRef.current) return;
+      // Soft-degraded path: capture failed but wantRunning is still true
+      // (e.g. MediaRecorder mime mismatch on a niche browser). Fall back
+      // to Web-Speech-only — onend's restart loop handles the fallback.
+      safeStart();
+    })();
   }, [isSupported, buildRecognition, safeStart, ensureAudioCapture]);
 
   const stop = useCallback(() => {