docs(positioning): align README + ADRs + specs to Pindrop red lines (#28)

Co-authored-by: Aaron D. Lee <himself@adlee.work>
Co-committed-by: Aaron D. Lee <himself@adlee.work>

docs/ARCHITECTURE.md

@@ -8,7 +8,7 @@ the goal, not the PBX**. Where Asterisk matched composability through a 1.2M-LOC
 modules, rutster matches it through:
 
 - a **small hardened core** owning the per-call vertical end-to-end (media + signaling + call model
-  + reflexes + spend gate) as one deterministic, auditable trust domain,
+  + reflexes + spend guardrails) as one deterministic, auditable trust domain,
 - a **clean audio tap** as the external brain's extension point (safely extensible by people you
   don't fully trust, because the brain is out-of-process and the core authoritatively controls
   playout),
@@ -28,7 +28,7 @@ carrier SIP trunk ─► media termination (RTP/SRTP + local real-time reflexes)
                         │
                         ├─► clean audio tap ──► external agent brain (STT/LLM/TTS)
                         │
-                        └─► in-boundary spend / abuse gate
+                         └─► in-boundary spend guardrails
 ```
 
 **Horizontal platform** concerns are services *around* the core, independently scaled: number
@@ -42,7 +42,7 @@ This **replaces the founding three-plane framing**:
   determinism + security + simplicity.
 - The **spend gate** and the **agent tap** — which founding docs externalized — are pulled **into**
   the boundary, because they are **constitutive** of the wedge (a runtime can't structurally enforce
-  spend/abuse control or barge-in if the media is elsewhere).
+  spend guardrails or barge-in if the media is elsewhere).
 - Neither monolith nor pure microservices: **fused where fusion buys the wedge; composable where
   independent scaling matters.** ([ADR-0002](adr/0002-north-star-and-fused-core.md))
 
@@ -55,8 +55,8 @@ the not-invented-here death-march (a from-scratch SIP stack was exactly that). T
 mechanical test an agent applies live in [ADR-0008](adr/0008-fob-and-green-zone.md).
 
 - **FOB** — memory-safe Rust, owned, fuzzed, inside the trust boundary; a capability is admitted *only*
-  if it is hot-path, security-constitutive, or genuinely differentiating: media termination, the
-  real-time reflexes, the call model, the agent tap, the spend/abuse gate, the control API + the
+  if it is hot-path, boundary-constitutive, or genuinely differentiating: media termination, the
+  real-time reflexes, the call model, the agent tap, the spend gate, the control API + the
   state/bus trait. (It may *link* mature OSS for internals — libopus, `str0m` — as trusted vendored
   deps; the capability is still owned, the wire parser still Rust.)
 - **Green zone** — trusted, *actively-maintained* OSS/services reused **at arm's length** (own process /
@@ -84,12 +84,19 @@ trusted, battle-tested OSS kept outside the boundary** — not an over-claim tha
   primitives (transfer/park/pickup, answer/originate); the ARI-modeled resource API surfaced as
   REST/gRPC + a WebSocket/SSE event stream. "The dialplan" disappears — replaced by declarative
   routing + external services reacting to call events (the ARI/Stasis model).
-- **In-boundary spend / abuse gate** — spend caps, pacing caps, deny-by-default routing,
-  rate-limits, toll-fraud pattern detection. **Co-located with the tap + the provider
+- **In-boundary spend guardrails** — spend caps, pacing caps, deny-by-default routing,
+  rate-limits, carrier-cost abuse prevention (unauthorized outbound calls, dialer pacing —
+  **not** caller-side fraud detection; see below). **Co-located with the tap + the provider
   call-control client**: the brain never holds provider credentials, so every brain-initiated
   action passes the gate; pacing/half-duplex/playout are enforced over media the core terminates
   ([ADR-0009](adr/0009-spend-gate-honest-rescope.md) — pair with provider-side caps for defense
   in depth).
+
+  **Voice-security scope boundary:** caller authentication, fraud detection, voice biometrics,
+  and spoof / liveness / deepfake detection are **deliberately out of scope** — rutster is
+  routing + orchestration infrastructure, designed to integrate with dedicated voice-security
+  vendors via the agent tap (they sit alongside as a tap consumer) rather than compete with them.
+  See README "What it is / isn't."
 - **Audiohook primitive** — tap/inject/volume behind recording, ChanSpy/whisper/barge, and
   human-agent escalation (rung 2: an agent takes over a call via WebRTC + audiohook handoff).