The old colocated KES HTTP host in svc-tenders has been retired, so there is no longer a temporary fallback KES HTTP runtime to flip back to.

Cutoff Condition Satisfied

The cutoff condition was satisfied because:

1. svc-kes was already the live primary target through KES_ORCHESTRATOR_SERVICE_URL=http://localhost:4025
2. root dev/startup flow already treated svc-kes as the normal primary KES host
3. KES read parity, authenticated mutation parity, and the first live env-only cutover window had already passed

Rollback Implications

Operational rollback no longer means redirecting KES traffic back into svc-tenders.

Instead it means:

1. keep the unchanged gateway seam pointed at svc-kes
2. restart or repair svc-kes if needed
3. preserve the shared auth and event-backbone wiring around it

The API gateway seam still contains TENDERS_SERVICE_URL fallback logic because that shared contract was not rewritten here, but that path is no longer a supported KES rollback target after host retirement.

Notes

• gateway route shape remains /api/v1/kes/orchestrator/*
• auth behavior and /auth/me expectations remain unchanged
• KYC/signature semantics remain unchanged
• shared event-backbone ownership remains shared on purpose and was not part of rollback-window closure