diff --git a/install.sh b/install.sh
index 0384a8e..1d30d67 100644
--- a/install.sh
+++ b/install.sh
@@ -231,8 +231,8 @@ say "Smoke test"
 
 say "ghost installed -- run:  ghost"
 case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) echo "   (add ~/.local/bin to your PATH first)";; esac
-echo "   Hosted default = nous/hermes-4-405b via og-veil -> the OpenGradient TEE gateway (OHTTP-private)."
-echo "   Inside ghost, /model switches between hosted models and the local 32B (true incognito)."
+echo "   Hosted default = deepseek/deepseek-v4-pro via og-veil -> the OpenGradient TEE gateway (OHTTP-private)."
+echo "   Inside ghost, /model switches between hosted models and the local model (true incognito)."
 echo "   Personalize $PRIV/pii_denylist.txt with your name/email/handles for the hosted-path scrubber."
 [ -n "$USE_PROXY" ] || echo "   Direct mode (default). For IP-masking from the relay, reinstall with GHOST_PROXY=1."
 echo "   Not connected yet? Run:  ghost-login"
diff --git a/profile/config.yaml b/profile/config.yaml
index 613945c..ffd3773 100644
--- a/profile/config.yaml
+++ b/profile/config.yaml
@@ -666,23 +666,9 @@ known_plugin_toolsets:
   - spotify
 
 # ── Fallback Model ────────────────────────────────────────────────────
-# Automatic provider failover when primary is unavailable.
-# Uncomment and configure to enable. Triggers on rate limits (429),
-# overload (529), service errors (503), or connection failures.
-#
-# Supported providers:
-#   openrouter   (OPENROUTER_API_KEY)  — routes to any model
-#   openai-codex (OAuth — hermes auth) — OpenAI Codex
-#   nous         (OAuth — hermes auth) — Nous Portal
-#   zai          (ZAI_API_KEY)         — Z.AI / GLM
-#   kimi-coding  (KIMI_API_KEY)        — Kimi / Moonshot
-#   kimi-coding-cn (KIMI_CN_API_KEY)   — Kimi / Moonshot (China)
-#   minimax      (MINIMAX_API_KEY)     — MiniMax
-#   minimax-cn   (MINIMAX_CN_API_KEY)  — MiniMax (China)
-#   bedrock      (AWS IAM / boto3)     — AWS Bedrock (Converse API)
-#
-# For custom OpenAI-compatible endpoints, add base_url and key_env.
-#
-# fallback_model:
-#   provider: openrouter
-#   model: anthropic/claude-sonnet-4
+# ghost routes ALL inference through ONE path: the local scrubber -> og-veil -> the
+# OpenGradient TEE gateway. It deliberately does NOT use any external provider --
+# no Nous Portal, no OpenRouter, no direct Claude/GPT/Gemini -- because that would
+# bypass the privacy guarantee (OHTTP + TEE) and the unrestricted-only policy.
+# The fallback is set in `fallback_model` at the top of this file: a hosted
+# unrestricted model via og-veil by default, or a local model with GHOST_LOCAL=1.