Stage 4: honest health, explicit error policy, event-bus integrity

Engine mode is now explicit: USE_MOCK_SIP=true is the only way to get
the mock engine; an unconfigured trunk fails startup with guidance
instead of silently degrading. Root-caused why the engine always ran
mock: nested pydantic-settings never read .env (no env_file on the
sub-settings classes) — all 8 now declare it.

/health stops lying: reports engine mode (sippy|mock), a live DB
SELECT 1, trunk registration state with reason, and TTS/STT
availability from their last real request; "healthy" now requires
ready + db + sippy + registered trunk.

Error policy: leaf services (tts/transcription/llm_client) raise and
track availability; call-loop callers catch, publish EventType.ERROR
naming the failed service, and apply an explicit fallback. Persistence
writes get one bounded 3x exponential retry, then an ERROR log — no
more silent data loss.

Event bus: a full subscriber queue drops its oldest event (counted)
instead of silently evicting the subscription; subscribe(replay_last=N)
delivers the advertised history replay, used by /ws/events (25).

Receptionist correctness: a matched TAKE_MESSAGE rule beats the LLM;
voicemail polls for early hangup and stops/transcribes/hangs up in
finally; RecordingSession finally keeps its leg_ids so taps detach.

Dead code removed: models/contact.py + Contact table, dtmf_buffer,
transcribe_stream stub, SMS stub in notification.py.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/hold_slayer.py

@@ -56,6 +56,29 @@ class HoldSlayerService:
         self.settings = settings
         self.tts = tts
 
+    async def _service_error(self, call_id: str, service: str, error: Exception) -> None:
+        """Surface a failed dependency as a typed event, not silence."""
+        logger.error(f"⚠️ {service} failed for {call_id}: {error}")
+        try:
+            await self.gateway.event_bus.publish(GatewayEvent(
+                type=EventType.ERROR,
+                call_id=call_id,
+                data={"service": service, "error": str(error)},
+                message=f"⚠️ {service} failed: {error}",
+            ))
+        except Exception:
+            pass
+
+    async def _transcribe(
+        self, call_id: str, audio: bytes, prompt: Optional[str] = None
+    ) -> str:
+        """Transcribe with an explicit empty-string fallback on failure."""
+        try:
+            return await self.transcription.transcribe(audio, prompt=prompt)
+        except Exception as e:
+            await self._service_error(call_id, "transcription", e)
+            return ""
+
     async def run(
         self,
         call: ActiveCall,
@@ -309,9 +332,10 @@ class HoldSlayerService:
                 AudioClassification.IVR_PROMPT,
                 AudioClassification.LIVE_HUMAN,
             ):
-                transcript = await self.transcription.transcribe(
+                transcript = await self._transcribe(
+                    call.id,
                     audio_chunk,
-                    prompt="Phone IVR menu, customer service, press 1 for..."
+                    prompt="Phone IVR menu, customer service, press 1 for...",
                 )
                 if transcript:
                     await self.call_manager.add_transcript(call.id, transcript)
@@ -429,7 +453,7 @@ class HoldSlayerService:
             # Check for human
             if result.audio_type == AudioClassification.LIVE_HUMAN:
                 # Verify with transcription
-                transcript = await self.transcription.transcribe(audio_chunk)
+                transcript = await self._transcribe(call.id, audio_chunk)
                 if transcript:
                     await self.call_manager.add_transcript(call.id, transcript)
                     # If we got meaningful speech, it's probably a real person
@@ -491,7 +515,7 @@ class HoldSlayerService:
                 continue
 
             # Transcribe
-            transcript = await self.transcription.transcribe(audio_chunk)
+            transcript = await self._transcribe(call.id, audio_chunk)
             if not transcript:
                 continue
 
@@ -545,7 +569,7 @@ class HoldSlayerService:
                 AudioClassification.IVR_PROMPT,
                 AudioClassification.LIVE_HUMAN,
             ):
-                text = await self.transcription.transcribe(audio_chunk)
+                text = await self._transcribe(call.id, audio_chunk)
                 if text:
                     transcript_parts.append(text)
 
@@ -713,7 +737,11 @@ class HoldSlayerService:
         os.close(fd)
 
         try:
-            ok = await self.tts.synthesize_to_file(text, tmp_path)
+            try:
+                ok = await self.tts.synthesize_to_file(text, tmp_path)
+            except Exception as e:
+                await self._service_error(call.id, "tts", e)
+                return False
             if not ok:
                 logger.warning(f"🗣️ TTS synthesis returned no audio for: '{text[:60]}'")
                 return False