feat(llm-chain): KI-080 — sticky primary election; 1-2 LLM calls per turn instead of 5-6

Architectural refactor: the chain list is now the CANDIDATE POOL for
probe-driven election, not a per-call sequence. Pre-KI-080, NimChainLLM.chat
iterated the full chain sequentially every turn. Under NIM per-key
concurrency throttling, the first 5 NIM-hosted candidates queued together
inside ONE turn, burning the 22s budget before any cross-provider fallback
(Groq / OpenRouter) was ever reached. The 10-turn live probe at commit
078ff45 showed 7/10 fact-find turns timing out at exactly 26.6s — every
failure a timeout, never a parse error.

ELECTION
========
backend/llm_health.py:
- Probe cadence tightened 5min → 60s so election reflects pool health
fast enough that a NIM brownout rotates out within a minute.
- Each candidate carries probe_history (last 5 ok/latency pairs) and
a degraded_until_monotonic sin-bin window.
- score = (1/max(50, latency_ms)) * success_rate_last_5
- get_primary(chain_name) → highest scorer with a probe within 90s.
- get_backup(chain_name) → highest scorer with a DIFFERENT provider
(NIM vs Groq vs OpenRouter) than primary; falls back to next-best
same-provider candidate when no cross-provider option qualifies.
- report_failure(chain, model, error_class): sidelines model for 30s +
schedules an async re-probe so the next turn elects a fresh primary.
- report_success(chain, model, latency_ms): folds chat latency into
the rolling window (chat traffic is richer signal than 1-token probes).
- status_summary now publishes the current elected primary/backup per
chain for the admin UI.

STICKY-PRIMARY chat()
=====================
backend/providers/nvidia_nim_llm.py:
- _call_one(model, ...) extracted from the old chain-iteration body —
single-model HTTP call, raises on failure for the caller to handle.
- chat() rewritten:
1. Apply caller exclusion list (brain ↦ judge family independence).
2. Resolve elected_primary / elected_backup via llm_health; if
either is excluded or election is cold-start, fall back to the
first allowed chain entry (cross-provider preference for backup).
3. Call elected_primary ONCE (12s timeout). On success → return.
4. On failure → report_failure(primary) + call elected_backup ONCE.
On success → return; on failure → report_failure(backup).
5. Final safety net (rare double-failure): probe_all() + walk
filter_chain in order. Preserves pre-KI-080 graceful degradation.
- CancelledError/KeyboardInterrupt/SystemExit re-raised at every hop
(KI-078 invariant preserved).

COST REDUCTION
==============
Pre-KI-080 worst case per turn: 5-6 LLM calls (full chain iteration).
Post-KI-080 worst case per turn: 2 LLM calls (primary + one backup).
Final probe-refresh safety net adds ≤chain_length more, but only
when BOTH elected models fail in the same turn — vanishingly rare
once probe-driven election is rotating out degraded candidates
within 60s.

INTERACTION WITH OTHER KIs
==========================
- KI-079 escalation in fact_find_brain UNCHANGED. If primary+backup
both fail and chat() raises RuntimeError, drive_fact_find still
catches it + escalates one more time via BRAIN_CHAIN before
falling to the canonical reply. Total worst case: 2 fast-brain
calls + 2 brain calls + canonical fallback.
- KI-078 narrow exception catch UNCHANGED — CancelledError /
KeyboardInterrupt / SystemExit are re-raised at every hop in
the new chat() so an outer wait_for cancellation bubbles up
instead of being swallowed.
- KI-025 50/50 NIM/Groq rotation is DEPRECATED (not deleted). The
probe-driven elector now picks the actually-faster candidate
dynamically — what the static coin flip was approximating
heuristically. _balanced_brain_chain stays exported because the
regression suite pins its statistical behaviour + it remains a
useful pure function for ops scripts. The get_*_llm factories no
longer wire it into the chat hot path.
- filter_chain (KI-022) still used by the final-fallback path and
by admin endpoints; kept unchanged.

TESTING
=======
- py_compile both files: pass.
- tests/test_routing_regression.py: 15/15 pass (includes the KI-025
rotation pinning suite, confirming the deprecated function still
behaves as documented).
- Inline unit tests (7/7 pass): cold-start election returns None,
primary picks lowest-latency healthy candidate, backup prefers
cross-provider, report_failure demotes within the window,
report_success updates score, primary-succeeds path makes ONE call,
primary-fails-backup-succeeds path makes exactly TWO calls.

EXPECTED PRODUCTION IMPACT
==========================
Brain success rate (fact-find turns reaching the elected primary
in <12s): 30% (today) → 90%+ projected, since election picks the
actually-fast pool and skips degraded NIM ingresses entirely.
NIM req/min consumption: ~6× lower under degraded conditions —
one primary call per turn instead of five queued candidates.
p50 latency: ~2s (elected Nemotron Nano / Qwen primary).
p95 latency: ~12s (primary timeout + backup success).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/llm_health.py

@@ -1,29 +1,67 @@
-"""Live NIM model health monitor — OpenRouter-style availability filter.
-
-Probes every model in BRAIN_CHAIN + FAST_BRAIN_CHAIN + JUDGE_CHAIN periodically
-with a tiny ping ("reply 'ok'"). Records:
-  - status:           healthy / degraded / down
+"""Live NIM model health monitor — OpenRouter-style availability filter
++ KI-080 sticky primary/backup election.
+
+Architectural shift (KI-080, 2026-05-15):
+==========================================
+Pre-KI-080 the chain was iterated EVERY chat turn — primary, fallback 1,
+fallback 2, ... until one succeeded. Under NIM per-key concurrency throttling,
+the first 5 NIM-hosted candidates queued together inside a single turn,
+burning the 22s budget before the cross-provider fallback links (Groq /
+OpenRouter) were ever reached. The 10-turn live probe at commit 078ff45
+showed 7/10 fact-find turns timing out at exactly 26.6s.
+
+KI-080 inverts the model: the background probe loop ELECTS a primary +
+backup per chain based on real probe latencies; chat() calls the elected
+primary ONCE per turn, with at most ONE real-time fallback to the elected
+backup. Worst case per turn drops from 5-6 LLM calls to 1-2.
+
+Probes every PROBE_INTERVAL_SEC tick with a tiny ping ("Reply with exactly: ok").
+Records per model:
+  - status:           healthy / degraded / down / unknown
   - last_success_at:  timestamp of last 2xx response
   - last_failure_at:  timestamp of last failure (timeout / 5xx / parse)
   - latency_ms:       last successful response latency
   - consecutive_fail: counter (3+ => marked down)
   - tested_at:        when this row was last refreshed
+  - probe_history:    last PROBE_HISTORY_LEN (ok, latency_ms) tuples; powers
+                      the success_rate signal in the election score.
+
+Election (KI-080):
+  - For each chain (brain / fast_brain / judge), compute a score per healthy
+    candidate: score = (1 / max(50, latency_ms)) * success_rate_last_5.
+  - CURRENT_PRIMARY = highest scorer.
+  - CURRENT_BACKUP  = highest scorer among candidates with a DIFFERENT
+    provider (NIM vs Groq vs OpenRouter) than primary; falls back to next-
+    best same-provider candidate when no cross-provider option qualifies.
+  - DEGRADED window: when chat() calls report_failure(model), that model is
+    sidelined for DEGRADED_WINDOW_SEC so the same turn's failure doesn't
+    recycle to the same broken primary on the next turn. The next probe
+    tick reconsiders the model normally.
 
 Persistence: 40-data/llm_health.json (atomic write via temp+rename).
 
-Consumers:
-  - NimChainLLM.chat() filters the chain to status != 'down' before iterating.
-  - GET /api/health/llms returns the current state for the frontend.
+Public API (the surface NimChainLLM.chat consumes):
+  get_primary(chain_name)  -> Optional[str]
+  get_backup(chain_name)   -> Optional[str]
+  report_failure(chain, model, error_class)
+  report_success(chain, model, latency_ms)
+
+  Legacy:
+  filter_chain(chain)      -> chain with 'down' models removed (still used
+                              by admin / probe-refresh paths)
+  status_summary()         -> compact dict for GET /api/health/llms
 
 Operating schedule:
   - background asyncio task in main.py startup, ticks every PROBE_INTERVAL_SEC.
-  - on-demand refresh via probe_all() (e.g. when NimChainLLM exhausts the chain).
+  - on-demand refresh via probe_all() (e.g. when NimChainLLM exhausts both
+    primary + backup in a single turn).
 """
 from __future__ import annotations
 
 import asyncio
 import json
 import os
+import threading
 import time
 from dataclasses import dataclass, field, asdict
 from pathlib import Path
@@ -35,9 +73,17 @@ ROOT = Path(__file__).resolve().parent.parent
 HEALTH_FILE = ROOT / "40-data" / "llm_health.json"
 HEALTH_FILE.parent.mkdir(parents=True, exist_ok=True)
 
-PROBE_INTERVAL_SEC = 300          # ping each model every 5 min
-PROBE_TIMEOUT_SEC = 12            # per-probe HTTP timeout
+# KI-080 — probe every 60s so election reflects real-time pool health
+# fast enough that a NIM pool brownout is rotated out within a minute.
+# The 5-min cadence pre-KI-080 was fine for a "filter the dead" use case
+# but too slow when probe results drive primary election.
+PROBE_INTERVAL_SEC = 60
+PROBE_TIMEOUT_SEC = 8             # per-probe HTTP timeout
 DOWN_AFTER_CONSECUTIVE_FAILS = 3  # 3 fails in a row = mark down
+PROBE_HISTORY_LEN = 5             # rolling window for success_rate signal
+HEALTHY_PROBE_AGE_SEC = 90        # election candidates need a probe within
+                                  # the last 90s — stale data excluded
+DEGRADED_WINDOW_SEC = 30          # report_failure sidelines a model this long
 
 # Per-provider endpoints + env-var names. The chain entries embed the
 # provider via a prefix ('openrouter:<id>' / 'groq:<id>'); unprefixed entries
@@ -83,6 +129,21 @@ def _headers_for(model_id: str, api_key: str) -> dict[str, str]:
     return h
 
 
+def provider_of(model_id: str) -> str:
+    """Coarse provider bucket — used by the election routine to prefer a
+    cross-provider backup so a NIM regional outage can't take out both
+    primary + backup simultaneously. Returns one of: 'nim' | 'groq' |
+    'openrouter'. (NIM is the implicit default for unprefixed model ids
+    even though NIM hosts many model families — all of those share the
+    same NIM ingress + per-key rate quota, which is what we need to
+    diversify against.)"""
+    if model_id.startswith("openrouter:"):
+        return "openrouter"
+    if model_id.startswith("groq:"):
+        return "groq"
+    return "nim"
+
+
 @dataclass
 class ModelHealth:
     model: str
@@ -93,12 +154,30 @@ class ModelHealth:
     latency_ms: Optional[int] = None
     consecutive_failures: int = 0
     tested_at: Optional[str] = None
+    # KI-080 — rolling probe history powers the success_rate signal in
+    # the election score. Each entry: {"ok": bool, "latency_ms": int|None,
+    # "ts": iso8601}. Capped at PROBE_HISTORY_LEN.
+    probe_history: list[dict] = field(default_factory=list)
+    # KI-080 — set by report_failure(); model is excluded from election
+    # while monotonic time < degraded_until_monotonic.
+    degraded_until_monotonic: float = 0.0
 
 
 def _now_iso() -> str:
     return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
 
 
+def _iso_age_seconds(iso_ts: Optional[str]) -> Optional[float]:
+    """Seconds since an ISO timestamp; None if missing/unparseable."""
+    if not iso_ts:
+        return None
+    try:
+        t = time.strptime(iso_ts, "%Y-%m-%dT%H:%M:%SZ")
+        return time.time() - time.mktime(t) + time.timezone
+    except Exception:
+        return None
+
+
 def _all_known_models() -> list[str]:
     """Pull the union of every model name from every chain at module import."""
     from backend.providers.nvidia_nim_llm import (
@@ -112,18 +191,68 @@ def _all_known_models() -> list[str]:
     return seen
 
 
-def load() -> dict[str, ModelHealth]:
-    if not HEALTH_FILE.exists():
-        return {}
-    try:
-        raw = json.loads(HEALTH_FILE.read_text())
-        return {k: ModelHealth(**v) for k, v in raw.get("models", {}).items()}
-    except Exception:
-        return {}
+def _chain_for(chain_name: str) -> list[str]:
+    """Resolve a chain name → live chain list. Reads off the module so
+    runtime admin reorderings are respected by the elector."""
+    from backend.providers import nvidia_nim_llm as nim
+    if chain_name == "brain":
+        return list(getattr(nim, "BRAIN_CHAIN", []))
+    if chain_name == "fast_brain":
+        return list(getattr(nim, "FAST_BRAIN_CHAIN", []))
+    if chain_name == "judge":
+        return list(getattr(nim, "JUDGE_CHAIN", []))
+    return []
+
+
+# KI-080 — in-process state. Probe history + degraded windows are
+# performance-critical hot paths (read on every chat turn), so we keep
+# them in memory and only persist the long-lived signal to disk on the
+# probe tick. Concurrent NimChainLLM.chat workers + the probe loop both
+# mutate this; a coarse lock is fine — the held region is microseconds.
+_STATE_LOCK = threading.Lock()
+_STATE: dict[str, ModelHealth] = {}
+_STATE_LOADED = False
+
+
+def _load_into_memory() -> None:
+    """Hydrate _STATE from disk on first access. Idempotent."""
+    global _STATE, _STATE_LOADED
+    if _STATE_LOADED:
+        return
+    with _STATE_LOCK:
+        if _STATE_LOADED:
+            return
+        if HEALTH_FILE.exists():
+            try:
+                raw = json.loads(HEALTH_FILE.read_text())
+                for k, v in raw.get("models", {}).items():
+                    # Tolerate older schema (pre-KI-080 records missing
+                    # probe_history / degraded_until_monotonic).
+                    v.setdefault("probe_history", [])
+                    v.setdefault("degraded_until_monotonic", 0.0)
+                    _STATE[k] = ModelHealth(**v)
+            except Exception:
+                _STATE = {}
+        _STATE_LOADED = True
 
 
-def save(state: dict[str, ModelHealth]) -> None:
-    """Atomic write — temp file then rename so concurrent readers never see partial."""
+def load() -> dict[str, ModelHealth]:
+    """Legacy/back-compat: snapshot of the in-memory state. Returned dict
+    is a shallow copy so callers can't mutate _STATE directly."""
+    _load_into_memory()
+    with _STATE_LOCK:
+        return dict(_STATE)
+
+
+def save(state: Optional[dict[str, ModelHealth]] = None) -> None:
+    """Atomic write — temp file then rename so concurrent readers never see partial.
+
+    If `state` is None, persists the in-memory _STATE. The optional arg is
+    kept for backward compatibility with the pre-KI-080 call sites in admin.py."""
+    if state is None:
+        _load_into_memory()
+        with _STATE_LOCK:
+            state = dict(_STATE)
     out = {
         "updated_at": _now_iso(),
         "models": {k: asdict(v) for k, v in state.items()},
@@ -133,6 +262,180 @@ def save(state: dict[str, ModelHealth]) -> None:
     tmp.replace(HEALTH_FILE)
 
 
+# ---------------------------------------------------------------------------
+# KI-080 — public API: primary/backup election + failure/success reporting
+# ---------------------------------------------------------------------------
+
+def _success_rate(h: ModelHealth) -> float:
+    """Fraction of the last PROBE_HISTORY_LEN probes that succeeded.
+    Returns 1.0 when there's no history yet (cold-start — give every
+    healthy candidate the benefit of the doubt)."""
+    if not h.probe_history:
+        return 1.0
+    hits = sum(1 for r in h.probe_history if r.get("ok"))
+    return hits / len(h.probe_history)
+
+
+def _score(h: ModelHealth) -> float:
+    """Election score — higher is better.
+
+    score = (1 / max(50, latency_ms)) * success_rate
+    The 50ms floor stops a sub-millisecond outlier from dominating
+    election; success_rate is the rolling-window stability signal.
+    """
+    if h.latency_ms is None:
+        return 0.0
+    return (1.0 / max(50, h.latency_ms)) * _success_rate(h)
+
+
+def _is_election_eligible(h: ModelHealth, now_mono: float) -> bool:
+    """A candidate is electable when:
+      - status is healthy (or degraded with a recent success)
+      - last probe was within HEALTHY_PROBE_AGE_SEC
+      - it is NOT currently in the degraded-window sin-bin
+    """
+    if h.degraded_until_monotonic > now_mono:
+        return False
+    if h.status == "down":
+        return False
+    age = _iso_age_seconds(h.tested_at)
+    if age is None or age > HEALTHY_PROBE_AGE_SEC:
+        return False
+    if h.latency_ms is None:
+        return False
+    return True
+
+
+def _ranked_candidates(chain_name: str) -> list[ModelHealth]:
+    """Return the chain's election-eligible candidates, best-score first."""
+    _load_into_memory()
+    chain = _chain_for(chain_name)
+    now_mono = time.monotonic()
+    with _STATE_LOCK:
+        snapshot = {m: _STATE.get(m) for m in chain}
+    eligible: list[tuple[float, ModelHealth]] = []
+    for m in chain:
+        h = snapshot.get(m)
+        if h is None:
+            continue
+        if not _is_election_eligible(h, now_mono):
+            continue
+        eligible.append((_score(h), h))
+    eligible.sort(key=lambda t: t[0], reverse=True)
+    return [h for _, h in eligible]
+
+
+def get_primary(chain_name: str) -> Optional[str]:
+    """Top-scoring election-eligible candidate, or None when no probe data
+    is fresh enough. Callers cold-start by falling back to chain[0]."""
+    ranked = _ranked_candidates(chain_name)
+    return ranked[0].model if ranked else None
+
+
+def get_backup(chain_name: str) -> Optional[str]:
+    """Second-best election candidate. Prefers a DIFFERENT provider from
+    primary (NIM vs Groq vs OpenRouter) so a single provider's regional
+    outage can't take out both. Falls back to the next-best same-provider
+    candidate when no cross-provider option qualifies — better an in-
+    family backup than none."""
+    ranked = _ranked_candidates(chain_name)
+    if len(ranked) < 2:
+        # No usable backup. Either zero candidates or only one (in which
+        # case the cold-start path in NimChainLLM falls back to chain[1]).
+        return None
+    primary_provider = provider_of(ranked[0].model)
+    # Prefer cross-provider
+    for h in ranked[1:]:
+        if provider_of(h.model) != primary_provider:
+            return h.model
+    # No cross-provider candidate — accept same-provider next-best.
+    return ranked[1].model
+
+
+def report_failure(chain_name: str, model: str, error_class: str) -> None:
+    """Called by NimChainLLM.chat() when primary OR backup throws.
+
+    Effects:
+      - Sidelines `model` from election for DEGRADED_WINDOW_SEC so the
+        same turn's failure doesn't immediately re-elect the same model.
+      - Appends a synthetic 'failed' entry to probe_history so the next
+        election's success_rate reflects the live failure even before
+        the next probe tick.
+      - Schedules an async re-probe (best-effort) so the next turn gets
+        fresh data instead of waiting up to 60s for the next tick.
+    """
+    _load_into_memory()
+    with _STATE_LOCK:
+        h = _STATE.get(model) or ModelHealth(model=model)
+        h.degraded_until_monotonic = time.monotonic() + DEGRADED_WINDOW_SEC
+        h.last_failure_at = _now_iso()
+        h.last_error = f"chat_failure: {error_class}"
+        h.probe_history.append({
+            "ok": False,
+            "latency_ms": None,
+            "ts": _now_iso(),
+            "src": "chat",
+        })
+        if len(h.probe_history) > PROBE_HISTORY_LEN:
+            h.probe_history = h.probe_history[-PROBE_HISTORY_LEN:]
+        # Don't flip status to 'down' here — that's the probe's job and
+        # we don't want a single transient turn-failure to evict the
+        # candidate permanently. The degraded sin-bin is sufficient.
+        _STATE[model] = h
+
+    # Best-effort re-probe — fire and forget. We can't await inside this
+    # sync API (callers are in the hot path) so we schedule on the loop
+    # if one is running.
+    try:
+        loop = asyncio.get_event_loop()
+        if loop.is_running():
+            loop.create_task(_reprobe_one(model))
+    except RuntimeError:
+        pass  # no loop (unit tests etc.) — skip silently
+
+
+def report_success(chain_name: str, model: str, latency_ms: int) -> None:
+    """Called by NimChainLLM.chat() on a successful response. Updates
+    the rolling success/latency window — important because chat traffic
+    is dramatically richer signal than 1-token probes (real prompts,
+    real concurrency)."""
+    _load_into_memory()
+    with _STATE_LOCK:
+        h = _STATE.get(model) or ModelHealth(model=model)
+        h.last_success_at = _now_iso()
+        h.last_error = None
+        h.latency_ms = int(latency_ms)
+        h.consecutive_failures = 0
+        h.tested_at = _now_iso()
+        h.status = "healthy" if latency_ms < 5000 else "degraded"
+        h.probe_history.append({
+            "ok": True,
+            "latency_ms": int(latency_ms),
+            "ts": _now_iso(),
+            "src": "chat",
+        })
+        if len(h.probe_history) > PROBE_HISTORY_LEN:
+            h.probe_history = h.probe_history[-PROBE_HISTORY_LEN:]
+        _STATE[model] = h
+
+
+async def _reprobe_one(model: str) -> None:
+    """Async re-probe of a single model after report_failure(). Updates
+    state in place; failures here are silently swallowed so the chat
+    hot path never raises through this back-channel."""
+    try:
+        async with httpx.AsyncClient() as client:
+            ok, err, latency = await probe_one(client, model, "")
+            _absorb_probe_result(model, ok, err, latency)
+    except Exception:
+        pass
+
+
+# ---------------------------------------------------------------------------
+# Probing (mostly unchanged from pre-KI-080 — extended to record
+# probe_history + skip degraded-window models on the regular tick).
+# ---------------------------------------------------------------------------
+
 async def probe_one(client: httpx.AsyncClient, model: str, api_key: str) -> tuple[bool, str, Optional[int]]:
     """Probe a single chain entry (NIM or cross-provider).
 
@@ -187,28 +490,11 @@ async def probe_one(client: httpx.AsyncClient, model: str, api_key: str) -> tupl
         return False, f"net: {type(e).__name__}: {str(e)[:60]}", int((time.time() - t0) * 1000)
 
 
-async def probe_all() -> dict[str, ModelHealth]:
-    """One-shot probe of every known model. Updates persisted state + returns it."""
-    state = load()
-    models = _all_known_models()
-    api_key = os.environ.get("NVIDIA_NIM_API_KEY", "")
-    if not api_key:
-        return state
-
-    async with httpx.AsyncClient() as client:
-        # Probe all in parallel — they hit different NIM pools so concurrency is fine
-        results = await asyncio.gather(
-            *[probe_one(client, m, api_key) for m in models],
-            return_exceptions=True,
-        )
-
-    for model, result in zip(models, results):
-        if isinstance(result, Exception):
-            ok, err, latency = False, f"exc: {type(result).__name__}", None
-        else:
-            ok, err, latency = result
-
-        h = state.get(model, ModelHealth(model=model))
+def _absorb_probe_result(model: str, ok: bool, err: str, latency: Optional[int]) -> None:
+    """Update _STATE with one probe result. Used by both probe_all (every
+    tick) and _reprobe_one (after-failure reprobe)."""
+    with _STATE_LOCK:
+        h = _STATE.get(model) or ModelHealth(model=model)
         h.tested_at = _now_iso()
         if ok:
             h.last_success_at = _now_iso()
@@ -224,15 +510,51 @@ async def probe_all() -> dict[str, ModelHealth]:
                 h.status = "down"
             else:
                 h.status = "degraded"
-        state[model] = h
+        h.probe_history.append({
+            "ok": ok,
+            "latency_ms": latency,
+            "ts": _now_iso(),
+            "src": "probe",
+        })
+        if len(h.probe_history) > PROBE_HISTORY_LEN:
+            h.probe_history = h.probe_history[-PROBE_HISTORY_LEN:]
+        _STATE[model] = h
 
-    save(state)
-    return state
+
+async def probe_all() -> dict[str, ModelHealth]:
+    """One-shot probe of every known model. Updates persisted state + returns it."""
+    _load_into_memory()
+    models = _all_known_models()
+    # Per-provider keys are resolved inside probe_one(); we no longer
+    # gate the whole loop on the NIM key (KI-080) — cross-provider
+    # candidates must keep getting probed even when NVIDIA_NIM_API_KEY
+    # is missing.
+
+    async with httpx.AsyncClient() as client:
+        # Probe all in parallel — they hit different NIM pools so concurrency is fine
+        results = await asyncio.gather(
+            *[probe_one(client, m, "") for m in models],
+            return_exceptions=True,
+        )
+
+    for model, result in zip(models, results):
+        if isinstance(result, Exception):
+            ok, err, latency = False, f"exc: {type(result).__name__}", None
+        else:
+            ok, err, latency = result
+        _absorb_probe_result(model, ok, err, latency)
+
+    save()  # persist in-memory state
+    return load()
 
 
 def filter_chain(chain: list[str]) -> list[str]:
     """Return the chain with 'down' models removed. Always preserves order +
-    keeps at least one model so callers never get an empty chain."""
+    keeps at least one model so callers never get an empty chain.
+
+    Kept for backward compatibility — admin endpoints + the final
+    probe-refresh fallback in NimChainLLM still call this. Primary
+    election (get_primary / get_backup) is the new hot-path entry."""
     state = load()
     keep = [m for m in chain if state.get(m, ModelHealth(model=m)).status != "down"]
     if not keep:
@@ -258,6 +580,12 @@ def status_summary() -> dict:
     summary["models"].sort(key=lambda x: (x["status"] != "healthy", x["model"]))
     if summary["models"]:
         summary["updated_at"] = max((m.get("tested_at") or "") for m in summary["models"])
+    # KI-080 — surface currently-elected primary/backup per chain for the
+    # admin UI. Cheap (a couple of dict lookups + sort over <=10 entries).
+    summary["elections"] = {
+        role: {"primary": get_primary(role), "backup": get_backup(role)}
+        for role in ("brain", "fast_brain", "judge")
+    }
     return summary
 
 
@@ -280,3 +608,7 @@ if __name__ == "__main__":
     for m, h in sorted(state.items(), key=lambda kv: (kv[1].status != "healthy", kv[0])):
         latency = f"{h.latency_ms}ms" if h.latency_ms else "—"
         print(f"  {h.status:8s}  {latency:>8s}  {m:50s}  {h.last_error or 'ok'}")
+    print()
+    print("Elections:")
+    for role in ("brain", "fast_brain", "judge"):
+        print(f"  {role:10s}  primary={get_primary(role)}  backup={get_backup(role)}")

backend/providers/nvidia_nim_llm.py

@@ -270,14 +270,32 @@ JUDGE_CHAIN = [
 
 
 class NimChainLLM(LLMProvider):
-    """OpenRouter-style fallback router across multiple NIM models.
-
-    Tries each model in `chain` in order; on TimeoutException / 5xx / network
-    error, advances to the next. Surfaces the first success transparently.
-
-    `name` after a successful call reflects which model actually answered, so
-    downstream callers (orchestrator brain_used tag, eval logs) can audit
-    which model in the chain produced the output.
+    """KI-080 sticky-primary router across multiple candidate models.
+
+    Architectural shift (KI-080, 2026-05-15):
+      PRE-KI-080: chat() iterated the full chain sequentially every turn.
+        Under NIM per-key concurrency throttling, the first 5 NIM-hosted
+        candidates queued together inside ONE turn and burned the 22s
+        budget before any cross-provider fallback was ever reached. The
+        10-turn live probe at commit 078ff45 showed 7/10 fact-find turns
+        timing out at exactly 26.6s.
+
+      POST-KI-080: a background probe loop ELECTS a primary + cross-
+        provider backup per chain based on real probe latencies. chat()
+        calls the elected primary ONCE per turn (1 LLM call). On failure,
+        we demote the primary for ~30s and fall through to the elected
+        backup (still 2 LLM calls max). The chain list is now the
+        CANDIDATE POOL for election, not a per-call sequence.
+
+    Worst case per turn: 2 LLM calls (was 5-6). Plus a final filter_chain
+    refresh path is kept for the rare double-failure edge case so the
+    pre-KI-080 graceful-degradation behaviour is preserved.
+
+    `name` after a successful call reflects which model actually answered
+    so downstream callers (orchestrator brain_used tag, eval logs) can
+    audit which candidate produced the output. The KI-079 escalation in
+    fact_find_brain still applies — if primary+backup both fail inside
+    one turn, fact_find_brain gets one more bite via BRAIN_CHAIN.
     """
     def __init__(self, chain: list[str], api_key: Optional[str] = None,
                  timeout: float = 30.0, per_model_attempts: int = 1,
@@ -292,9 +310,14 @@ class NimChainLLM(LLMProvider):
         # produced the p99 58s+ tail in the 100-persona audit. Default to a
         # cumulative ceiling of ~2.5× the per-link timeout so a healthy primary
         # always completes, but a cascading-failure chain bails fast.
+        #
+        # KI-080 — with election we only do 1-2 LLM calls per turn, so the
+        # budget is rarely the binding constraint anymore. Kept for the
+        # final filter_chain-refresh fallback path + cold-start edge cases.
         self.total_budget_s = total_budget_s if total_budget_s is not None else max(timeout * 2.5, 30.0)
         self.per_model_attempts = per_model_attempts
         self.role = role  # 'brain' | 'fast_brain' | 'judge' | 'unknown' — flows into usage log
+        self._chain_name = role if role in ("brain", "fast_brain", "judge") else "unknown"
         self.model = chain[0]
         self.name = f"nim-chain::{self._short_id(chain[0])}"
 
@@ -358,6 +381,38 @@ class NimChainLLM(LLMProvider):
         if "nemotron" in m or m.startswith("nvidia/"): return "nvidia"
         return "unknown"
 
+    # KI-080 — per-call timeout used in the sticky-primary path. Each elected
+    # candidate gets at most this long; with at most 2 calls per turn this
+    # cleanly fits inside any caller's outer wait_for cap (25s for fact-find,
+    # higher for brain/judge).
+    _ELECTED_CALL_TIMEOUT_S = 12.0
+
+    async def _call_one(
+        self,
+        model: str,
+        *,
+        messages: list[ChatMessage],
+        temperature: float,
+        max_tokens: int,
+        response_format: Optional[dict],
+        timeout: float,
+    ) -> LLMResult:
+        """Single-model HTTP call. Extracted from the old chain-iteration
+        loop (KI-080) so chat() can call a SPECIFIC candidate ONCE without
+        the iterate-the-chain envelope.
+
+        Raises whatever the underlying provider raises (TimeoutException /
+        HTTPStatusError / network error). Caller is responsible for failure
+        handling (report_failure + fall through to backup).
+        """
+        worker = self._get_worker_for(model, timeout)
+        return await worker.chat(
+            messages=messages,
+            temperature=temperature,
+            max_tokens=max_tokens,
+            response_format=response_format,
+        )
+
     async def chat(
         self,
         messages: list[ChatMessage],
@@ -367,123 +422,217 @@ class NimChainLLM(LLMProvider):
         exclude_models: Optional[list[str]] = None,
         exclude_families: Optional[list[str]] = None,
     ) -> LLMResult:
+        """KI-080 — sticky primary election. Call ONE elected candidate per
+        turn, with at most ONE real-time fallback to the elected backup if
+        primary fails. The chain list is the candidate POOL for election —
+        NOT a per-call sequence.
+
+        Cold-start path (no probe data yet): use self.chain[0] / [1].
+        Brain/judge family-exclusion (e.g. brain doesn't grade own
+        homework): apply exclusions to both elected primary + backup; if
+        either is excluded, re-elect from the filtered pool by scanning
+        the chain in order.
+        Final fallback (both elected models fail): trigger a synchronous
+        probe refresh + try whatever filter_chain now offers, walking the
+        chain in order. This path is the pre-KI-080 graceful-degradation
+        safety net for the double-failure edge case.
+        """
+        from backend import llm_health
+
         # Apply caller's exclusion list FIRST (brain doesn't grade own homework).
-        # exclude_models: skip exact model IDs (handles same-model collision)
-        # exclude_families: skip everything in those families (handles weight-sharing siblings)
-        chain = self.chain
-        if exclude_models or exclude_families:
-            excl_m = set(exclude_models or [])
-            excl_f = set(exclude_families or [])
-            chain = [m for m in chain
-                     if m not in excl_m and self._family_of(m) not in excl_f]
-            if not chain:
-                # Every candidate excluded — relax family constraint, keep exact model
-                # constraint (the strict one). Better to use a same-family model than
-                # to fail the request entirely.
-                chain = [m for m in self.chain if m not in excl_m]
-
-        # Filter out models known-down (from background probe loop). If all
-        # models are down, filter_chain returns the full chain unchanged so
-        # we still try — the infrastructure may have recovered between probes.
-        # Use the post-exclusion `chain` (NOT self.chain) so brain↔judge
-        # independence is preserved even after health filtering.
-        try:
-            from backend import llm_health
-            chain_to_try = llm_health.filter_chain(chain)
-        except Exception:
-            chain_to_try = chain  # health monitor failure must never block calls
+        excl_m = set(exclude_models or [])
+        excl_f = set(exclude_families or [])
+        def _allowed(m: Optional[str]) -> bool:
+            if not m:
+                return False
+            if m in excl_m:
+                return False
+            if self._family_of(m) in excl_f:
+                return False
+            return True
+
+        # Filter the chain by exclusions (kept for the final-fallback path
+        # + cold-start primary/backup election).
+        allowed_chain = [m for m in self.chain if _allowed(m)]
+        if not allowed_chain:
+            # Every candidate excluded — relax family constraint, keep exact
+            # model constraint. Better to use a same-family model than to
+            # fail the request entirely.
+            allowed_chain = [m for m in self.chain if m not in excl_m]
+        if not allowed_chain:
+            raise RuntimeError("NimChainLLM: every chain candidate is excluded.")
 
         chain_primary = self.chain[0] if self.chain else None
         call_t0 = time.time()
 
+        # --- Election (KI-080) ----------------------------------------------
+        elected_primary: Optional[str] = None
+        elected_backup: Optional[str] = None
+        try:
+            primary_candidate = llm_health.get_primary(self._chain_name)
+            backup_candidate = llm_health.get_backup(self._chain_name)
+        except Exception:
+            primary_candidate, backup_candidate = None, None
+
+        if primary_candidate and _allowed(primary_candidate):
+            elected_primary = primary_candidate
+        else:
+            # Cold-start / excluded election → first allowed chain entry.
+            elected_primary = allowed_chain[0]
+
+        if backup_candidate and _allowed(backup_candidate) and backup_candidate != elected_primary:
+            elected_backup = backup_candidate
+        else:
+            # Cold-start / excluded election → first allowed chain entry
+            # that isn't the elected primary. Prefer a different provider.
+            for m in allowed_chain:
+                if m != elected_primary and llm_health.provider_of(m) != llm_health.provider_of(elected_primary):
+                    elected_backup = m
+                    break
+            if elected_backup is None:
+                for m in allowed_chain:
+                    if m != elected_primary:
+                        elected_backup = m
+                        break
+
+        tried: list[str] = []
         last_err: Optional[Exception] = None
-        for model in chain_to_try:
-            # KI-021 — bail out if the cumulative chain budget is gone so a single
-            # turn can never wedge for minutes through a long fallback cascade.
-            elapsed = time.time() - call_t0
-            if elapsed >= self.total_budget_s:
-                last_err = TimeoutError(
-                    f"chain budget exhausted ({elapsed:.1f}s ≥ {self.total_budget_s:.1f}s) "
-                    f"after trying {[m for m in chain_to_try if chain_to_try.index(m) < chain_to_try.index(model)]}"
-                )
-                break
+
+        async def _try(model: str) -> Optional[LLMResult]:
+            """Attempt one elected candidate. On success: stamp self.model
+            + self.name, report_success, log usage, return result. On
+            failure: report_failure, mutate last_err, return None.
+
+            CancelledError / KeyboardInterrupt / SystemExit are re-raised
+            (KI-078) so an outer wait_for cancellation bubbles up
+            instead of getting swallowed by the fallback path.
+            """
+            nonlocal last_err
+            tried.append(model)
+            attempt_t0 = time.time()
             try:
-                # Cap per-link timeout to remaining chain budget so the final
-                # link can't single-handedly blow past the ceiling.
-                per_link_timeout = min(self.timeout, max(2.0, self.total_budget_s - elapsed))
-                worker = self._get_worker_for(model, per_link_timeout)
-                result = await worker.chat(messages=messages, temperature=temperature,
-                                           max_tokens=max_tokens, response_format=response_format)
-                # Successful response — record which model answered + return.
-                # `self.name` preserves any provider prefix so audit logs make
-                # cross-provider fall-throughs (groq:/openrouter:) obvious.
-                self.model = model
-                self.name = f"nim-chain::{self._short_id(model)}"
-                latency_ms = int((time.time() - call_t0) * 1000)
-                await _append_usage({
-                    "ts": _now_iso_z(),
-                    "role": self.role,
-                    "chain_primary": chain_primary,
-                    "served_model": model,
-                    "latency_ms": latency_ms,
-                    "success": True,
-                })
-                return result
-            except (httpx.TimeoutException, httpx.HTTPStatusError,
-                    httpx.ConnectError, httpx.NetworkError, asyncio.TimeoutError) as e:
-                last_err = e
-                continue  # try next model in chain
+                result = await self._call_one(
+                    model,
+                    messages=messages,
+                    temperature=temperature,
+                    max_tokens=max_tokens,
+                    response_format=response_format,
+                    timeout=self._ELECTED_CALL_TIMEOUT_S,
+                )
             except (asyncio.CancelledError, KeyboardInterrupt, SystemExit):
-                # KI-078 (2026-05-15) — must re-raise these. The previous
-                # broad `except Exception` swallowed CancelledError, so when
-                # fact_find_brain's outer `asyncio.wait_for(_TIMEOUT_S)`
-                # fired, this loop kept consuming budget instead of bubbling
-                # the cancellation up. That cost the entire fact-find turn
-                # its fallback window.
+                # KI-078 — propagate cancellation immediately.
                 raise
             except Exception as e:
-                # Unexpected error — record + try next, but surface eventually if all fail
                 last_err = e
-                continue
-        # All models in (filtered) chain failed. Trigger one synchronous
-        # probe refresh — maybe a transient outage just recovered. If the
-        # refreshed state opens up models we previously skipped, try them.
+                try:
+                    llm_health.report_failure(
+                        self._chain_name, model, type(e).__name__
+                    )
+                except Exception:
+                    pass
+                return None
+
+            # Success — stamp + log.
+            latency_ms = int((time.time() - attempt_t0) * 1000)
+            try:
+                llm_health.report_success(self._chain_name, model, latency_ms)
+            except Exception:
+                pass
+            self.model = model
+            self.name = f"nim-chain::{self._short_id(model)}"
+            total_ms = int((time.time() - call_t0) * 1000)
+            await _append_usage({
+                "ts": _now_iso_z(),
+                "role": self.role,
+                "chain_primary": chain_primary,
+                "served_model": model,
+                "latency_ms": total_ms,
+                "success": True,
+                "elected_primary": elected_primary,
+                "elected_backup": elected_backup,
+            })
+            return result
+
+        # --- Primary attempt -------------------------------------------------
+        res = await _try(elected_primary)
+        if res is not None:
+            return res
+
+        # --- Backup attempt (KI-080 single real-time fallback) ---------------
+        if elected_backup and elected_backup != elected_primary:
+            res = await _try(elected_backup)
+            if res is not None:
+                return res
+
+        # --- Both elected failed — final safety net --------------------------
+        # Trigger ONE synchronous probe refresh; whatever the refreshed
+        # filter_chain offers, walk it in order and try anything we haven't
+        # touched this turn. This is the pre-KI-080 graceful-degradation
+        # behaviour preserved for the (rare) double-failure case.
         try:
-            from backend import llm_health
             await llm_health.probe_all()
-            refreshed = llm_health.filter_chain(self.chain)
+            refreshed = llm_health.filter_chain(allowed_chain)
             for model in refreshed:
-                if model in chain_to_try:
-                    continue  # already tried this turn
-                # KI-021 — respect chain budget here too
+                if model in tried:
+                    continue
                 elapsed = time.time() - call_t0
                 if elapsed >= self.total_budget_s:
                     break
+                attempt_t0 = time.time()
                 try:
-                    per_link_timeout = min(self.timeout, max(2.0, self.total_budget_s - elapsed))
-                    worker = self._get_worker_for(model, per_link_timeout)
-                    result = await worker.chat(messages=messages, temperature=temperature,
-                                               max_tokens=max_tokens, response_format=response_format)
-                    self.model = model
-                    self.name = f"nim-chain::{self._short_id(model)}"
-                    latency_ms = int((time.time() - call_t0) * 1000)
-                    await _append_usage({
-                        "ts": _now_iso_z(),
-                        "role": self.role,
-                        "chain_primary": chain_primary,
-                        "served_model": model,
-                        "latency_ms": latency_ms,
-                        "success": True,
-                    })
-                    return result
+                    per_link_timeout = min(
+                        self._ELECTED_CALL_TIMEOUT_S,
+                        max(2.0, self.total_budget_s - elapsed),
+                    )
+                    result = await self._call_one(
+                        model,
+                        messages=messages,
+                        temperature=temperature,
+                        max_tokens=max_tokens,
+                        response_format=response_format,
+                        timeout=per_link_timeout,
+                    )
+                except (asyncio.CancelledError, KeyboardInterrupt, SystemExit):
+                    raise
                 except Exception as e:
                     last_err = e
+                    try:
+                        llm_health.report_failure(
+                            self._chain_name, model, type(e).__name__
+                        )
+                    except Exception:
+                        pass
                     continue
+
+                try:
+                    llm_health.report_success(
+                        self._chain_name, model, int((time.time() - attempt_t0) * 1000)
+                    )
+                except Exception:
+                    pass
+                self.model = model
+                self.name = f"nim-chain::{self._short_id(model)}"
+                total_ms = int((time.time() - call_t0) * 1000)
+                await _append_usage({
+                    "ts": _now_iso_z(),
+                    "role": self.role,
+                    "chain_primary": chain_primary,
+                    "served_model": model,
+                    "latency_ms": total_ms,
+                    "success": True,
+                    "elected_primary": elected_primary,
+                    "elected_backup": elected_backup,
+                    "fallback_phase": "post_reprobe",
+                })
+                return result
+        except (asyncio.CancelledError, KeyboardInterrupt, SystemExit):
+            raise
         except Exception:
-            pass
+            pass  # probe refresh failure must never block the outer raise
 
-        # Total exhaustion — log a single failure record so the admin panel
-        # surfaces "judge has 12% failure rate over last 24h" type signal.
+        # Total exhaustion — log + raise. fact_find_brain.drive_fact_find
+        # (KI-079) catches the resulting RuntimeError + escalates one more
+        # time to BRAIN_CHAIN before falling to the canonical reply.
         latency_ms = int((time.time() - call_t0) * 1000)
         await _append_usage({
             "ts": _now_iso_z(),
@@ -492,30 +641,45 @@ class NimChainLLM(LLMProvider):
             "served_model": None,
             "latency_ms": latency_ms,
             "success": False,
+            "elected_primary": elected_primary,
+            "elected_backup": elected_backup,
+            "tried": tried,
         })
         raise RuntimeError(
-            f"NimChainLLM exhausted all {len(self.chain)} candidates. Last error: "
-            f"{type(last_err).__name__}: {str(last_err)[:120]}"
+            f"NimChainLLM ({self._chain_name}) elected primary={elected_primary} "
+            f"and backup={elected_backup} both failed; tried={tried}. "
+            f"Last error: {type(last_err).__name__ if last_err else 'None'}: "
+            f"{str(last_err)[:120] if last_err else ''}"
         ) from last_err
 
 
 # KI-025 (2026-05-14) — provider load-balancing.
-# The NIM rate cap (40 req/min) is the single biggest throughput bottleneck.
-# Groq has independent rate quota and a Llama-3.3-70B LPU primary that's
-# already in BRAIN_CHAIN as a cross-provider fallback. By rotating which
-# provider serves as the *primary* for each call (50/50 between NIM Qwen and
-# Groq Llama), we spread load across two independent quotas — effectively
-# doubling sustained brain throughput. On rotation-to-Groq, the chain still
-# falls back to NIM if Groq fails, so reliability is unchanged.
+# DEPRECATED 2026-05-15 by KI-080: primary election supersedes the 50/50
+# rotation. The probe loop now picks the actually-faster candidate
+# DYNAMICALLY (real probe latencies, not a coin flip), and the elected
+# backup is chosen with explicit cross-provider preference — both signals
+# the rotation was approximating heuristically. Kept around (not deleted)
+# because the regression suite still pins its statistical behaviour. The
+# get_*_llm factories no longer call it.
 import random as _random
 
 
 def _balanced_brain_chain(base: list[str], *, groq_first_probability: float = 0.5) -> list[str]:
-    """KI-025 — provider load-balancing. With `groq_first_probability` (default
-    50%), hoist the Groq Llama entry to the head of the chain so it serves
-    as the primary instead of the NIM Qwen entry. The remaining candidates
-    stay in their existing fallback order — Groq calls that fail (rare; LPU
-    is very reliable) still get the full NIM fallback chain.
+    """KI-025 — provider load-balancing (DEPRECATED 2026-05-15 by KI-080).
+
+    With `groq_first_probability` (default 50%), hoist the Groq Llama entry
+    to the head of the chain so it serves as the primary instead of the
+    NIM Qwen entry. The remaining candidates stay in their existing
+    fallback order — Groq calls that fail (rare; LPU is very reliable)
+    still get the full NIM fallback chain.
+
+    SUPERSESSION NOTE (KI-080): the elector in `backend.llm_health` now
+    picks the actually-faster candidate dynamically from background probe
+    data, so this static-coin-flip rotation is no longer wired into the
+    chat hot path. Kept exported because:
+      (a) regression tests still pin its statistical behaviour, and
+      (b) it remains a useful pure-function for ops / sim / overrides
+          (e.g. wanting to force a non-elected order in a debug script).
 
     Uses per-call `random.random()` so concurrent async workers (the
     100-persona audit's 4 workers, the parallel 96-Q eval's 6 workers) each
@@ -533,33 +697,48 @@ def _balanced_brain_chain(base: list[str], *, groq_first_probability: float = 0.
 
 
 def get_brain_llm() -> NimChainLLM:
-    """Heavy brain — multi-model NIM chain with automatic fallback.
-    Primary: Qwen 3-Next 80B (50% of calls) or Groq Llama-3.3-70B (50% of calls).
-    See BRAIN_CHAIN for fallback order. KI-021 — per-link 20s, total chain
-    budget 35s. KI-025 — load-balanced across NIM/Groq for 2× brain throughput."""
-    return NimChainLLM(chain=_balanced_brain_chain(BRAIN_CHAIN), timeout=20.0,
+    """Heavy brain — KI-080 sticky-primary election over BRAIN_CHAIN.
+
+    Pre-KI-080: per-call _balanced_brain_chain rotation between NIM Qwen
+    and Groq Llama (KI-025 50/50 heuristic) → 5-6 LLM calls per turn
+    under degraded conditions.
+
+    Post-KI-080: the background probe loop in backend.llm_health elects
+    the actually-fastest candidate dynamically (probe-driven, not coin-
+    flipped) and a cross-provider backup. chat() calls 1-2 candidates max
+    per turn. The rotation is preserved as a deprecated pure-function in
+    case overrides need it, but the factory no longer wires it in.
+
+    KI-021 — per-link 12s (KI-080 ELECTED_CALL_TIMEOUT_S), total chain
+    budget 35s (only binding for the final filter_chain-refresh safety net).
+    """
+    return NimChainLLM(chain=BRAIN_CHAIN, timeout=20.0,
                        role="brain", total_budget_s=35.0)
 
 
 def get_fast_brain_llm() -> NimChainLLM:
-    """Fast brain — multi-model NIM chain optimized for low TTFT.
-    Primary: Qwen 3-Next 80B (50%) or Groq Llama-3.3-70B (50%). See
-    FAST_BRAIN_CHAIN for fallback order.
-
-    KI-078 (2026-05-15) — per-link timeout tightened 12s → 6s. With a 22s
-    total chain budget and a 12s per-link, only 1 candidate could complete
-    before the budget expired — i.e. the fallback chain was effectively
-    dead. Groq LPU + NIM Nemotron Nano + NIM Qwen all hit TTFT in <2s on
-    healthy paths, so 6s catches a degraded link fast and lets the chain
-    try 3-4 candidates inside the 22s budget. The cold-start case (NIM
-    pool warm-up taking 10-15s) is still handled by the outer
-    fact_find_brain `_TIMEOUT_S=25s` wait_for + Groq's cross-provider link
-    which has no NIM cold-start exposure.
-
-    KI-025 — provider-balanced for 2× fast-brain throughput; Groq LPU's
-    sub-1s TTFT is actually faster than NIM Qwen on average, so this
-    rotation is a strict win for fact-find / QA latency."""
-    return NimChainLLM(chain=_balanced_brain_chain(FAST_BRAIN_CHAIN), timeout=6.0,
+    """Fast brain — KI-080 sticky-primary election over FAST_BRAIN_CHAIN.
+
+    Pre-KI-080 (KI-025 + KI-078 + KI-079): per-call rotation between NIM
+    Qwen and Groq Llama, 6s per-link timeout, 22s total chain budget,
+    Groq promoted to chain position #2 so a single NIM degradation could
+    fall through fast enough. Even so, the 10-turn live probe at commit
+    078ff45 showed 7/10 fact-find turns hitting the wait_for cap at 26.6s
+    because every chain-iteration burned the full budget exploring 5+
+    queued NIM candidates.
+
+    Post-KI-080: probe-driven election picks ONE primary per chain (the
+    fastest-responding healthy candidate by rolling probe data) and ONE
+    cross-provider backup. chat() invokes the primary ONCE with a 12s
+    timeout, falls to the backup ONCE on failure, and only walks the
+    filter_chain fallback as a final safety net. The KI-079 escalation in
+    fact_find_brain still runs if primary+backup both fail, providing one
+    more bite via BRAIN_CHAIN.
+
+    KI-025 supersession: the 50/50 rotation is no longer wired in — see
+    the docstring on `_balanced_brain_chain` for the reasoning.
+    """
+    return NimChainLLM(chain=FAST_BRAIN_CHAIN, timeout=6.0,
                        role="fast_brain", total_budget_s=22.0)