Stage 4: honest health, explicit error policy, event-bus integrity

Engine mode is now explicit: USE_MOCK_SIP=true is the only way to get
the mock engine; an unconfigured trunk fails startup with guidance
instead of silently degrading. Root-caused why the engine always ran
mock: nested pydantic-settings never read .env (no env_file on the
sub-settings classes) — all 8 now declare it.

/health stops lying: reports engine mode (sippy|mock), a live DB
SELECT 1, trunk registration state with reason, and TTS/STT
availability from their last real request; "healthy" now requires
ready + db + sippy + registered trunk.

Error policy: leaf services (tts/transcription/llm_client) raise and
track availability; call-loop callers catch, publish EventType.ERROR
naming the failed service, and apply an explicit fallback. Persistence
writes get one bounded 3x exponential retry, then an ERROR log — no
more silent data loss.

Event bus: a full subscriber queue drops its oldest event (counted)
instead of silently evicting the subscription; subscribe(replay_last=N)
delivers the advertised history replay, used by /ws/events (25).

Receptionist correctness: a matched TAKE_MESSAGE rule beats the LLM;
voicemail polls for early hangup and stops/transcribes/hangs up in
finally; RecordingSession finally keeps its leg_ids so taps detach.

Dead code removed: models/contact.py + Contact table, dtmf_buffer,
transcribe_stream stub, SMS stub in notification.py.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/gateway.py

@@ -33,32 +33,43 @@ def build_sip_engine(
     on_device_registered: Callable,
     on_incoming_call: Callable,
 ) -> SIPEngine:
-    """Build the appropriate SIP engine from config."""
+    """
+    Build the SIP engine from config.
+
+    The mock engine must be requested explicitly (USE_MOCK_SIP=true).
+    An unconfigured trunk or a failed SippyEngine construction raises —
+    the caller fails startup rather than running a gateway that can't
+    place real calls while reporting healthy.
+    """
+    if settings.use_mock_sip:
+        logger.warning("🧪 USE_MOCK_SIP=true — SIP engine is a mock, no real calls")
+        return MockSIPEngine()
+
     trunk = settings.sip_trunk
     gw_sip = settings.gateway_sip
 
-    if trunk.host and trunk.host != "sip.provider.com":
-        # Real trunk configured — use Sippy B2BUA
-        try:
-            return SippyEngine(
-                sip_address=gw_sip.host,
-                sip_port=gw_sip.port,
-                trunk_host=trunk.host,
-                trunk_port=trunk.port,
-                trunk_username=trunk.username,
-                trunk_password=trunk.password.get_secret_value(),
-                trunk_transport=trunk.transport,
-                domain=gw_sip.domain,
-                did=trunk.did,
-                media_pipeline=media_pipeline,
-                on_leg_state_change=on_leg_state_change,
-                on_device_registered=on_device_registered,
-                on_incoming_call=on_incoming_call,
-            )
-        except Exception as e:
-            logger.warning(f"Could not create SippyEngine: {e} — using mock")
+    if not trunk.host or trunk.host in ("sip.provider.com", "sip.yourprovider.com"):
+        raise RuntimeError(
+            "SIP trunk is not configured (SIP_TRUNK_HOST is unset or a "
+            "placeholder). Set SIP_TRUNK_* in .env, or set USE_MOCK_SIP=true "
+            "for development without a trunk."
+        )
 
-    return MockSIPEngine()
+    return SippyEngine(
+        sip_address=gw_sip.host,
+        sip_port=gw_sip.port,
+        trunk_host=trunk.host,
+        trunk_port=trunk.port,
+        trunk_username=trunk.username,
+        trunk_password=trunk.password.get_secret_value(),
+        trunk_transport=trunk.transport,
+        domain=gw_sip.domain,
+        did=trunk.did,
+        media_pipeline=media_pipeline,
+        on_leg_state_change=on_leg_state_change,
+        on_device_registered=on_device_registered,
+        on_incoming_call=on_incoming_call,
+    )
 
 
 class AIPSTNGateway: