Stage 4: honest health, explicit error policy, event-bus integrity

Engine mode is now explicit: USE_MOCK_SIP=true is the only way to get
the mock engine; an unconfigured trunk fails startup with guidance
instead of silently degrading. Root-caused why the engine always ran
mock: nested pydantic-settings never read .env (no env_file on the
sub-settings classes) — all 8 now declare it.

/health stops lying: reports engine mode (sippy|mock), a live DB
SELECT 1, trunk registration state with reason, and TTS/STT
availability from their last real request; "healthy" now requires
ready + db + sippy + registered trunk.

Error policy: leaf services (tts/transcription/llm_client) raise and
track availability; call-loop callers catch, publish EventType.ERROR
naming the failed service, and apply an explicit fallback. Persistence
writes get one bounded 3x exponential retry, then an ERROR log — no
more silent data loss.

Event bus: a full subscriber queue drops its oldest event (counted)
instead of silently evicting the subscription; subscribe(replay_last=N)
delivers the advertised history replay, used by /ws/events (25).

Receptionist correctness: a matched TAKE_MESSAGE rule beats the LLM;
voicemail polls for early hangup and stops/transcribes/hangs up in
finally; RecordingSession finally keeps its leg_ids so taps detach.

Dead code removed: models/contact.py + Contact table, dtmf_buffer,
transcribe_stream stub, SMS stub in notification.py.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/tts.py

@@ -22,6 +22,8 @@ class TTSService:
     def __init__(self, settings: TTSSettings):
         self.settings = settings
         self._client: Optional[httpx.AsyncClient] = None
+        # Last-known reachability, surfaced by /health (None = no requests yet)
+        self.available: Optional[bool] = None
 
     async def _get_client(self) -> httpx.AsyncClient:
         if self._client is None or self._client.is_closed:
@@ -54,19 +56,17 @@ class TTSService:
             "sample_rate": self.settings.sample_rate,
         }
 
+        # Raises on failure — callers decide the per-call fallback and
+        # publish a service-error event; swallowing here made a down
+        # Rhema look like "the AI went quiet".
         try:
             response = await client.post("/v1/audio/speech", json=body)
             response.raise_for_status()
-            return response.content
-        except httpx.HTTPStatusError as e:
-            logger.error(f"Rhema TTS error: {e.response.status_code} {e.response.text}")
-            return b""
-        except httpx.ConnectError:
-            logger.error(f"Cannot connect to Rhema at {self.settings.base_url}")
-            return b""
-        except Exception as e:
-            logger.error(f"TTS synthesis failed: {e}")
-            return b""
+        except Exception:
+            self.available = False
+            raise
+        self.available = True
+        return response.content
 
     async def synthesize_to_file(
         self,