adr: +0009 spend-gate rescope +0010 spearhead 4.5 benchmark/sim; amend 0004

Maintainer-ratified from the 2026-07-03 review (R1-R3):
- ADR-0009: retire "structurally impossible for a 3-vendor stack" post-0007;
  restate the gate's true guarantees (credential isolation, unskippable
  mediation, media-plane enforcement, audit co-location). Propagated to
  README pillar 3, ARCHITECTURE, PORT_PLAN s10; amendment note on ADR-0002.
- ADR-0010: insert step 4.5 (benchmark + simulation harness, rutster-sim
  seed, CI-regressed p50/p99 + kill-time) after barge-in; pull rung-2
  escalation ahead of steps 5-6. Spearhead lists updated.
- ADR-0004: delete the legally-broken AGPL escape hatch; GPL-3.0-or-later
  permanent, no CLA; tap protocol/SDKs intended permissive (future ADR).
- README: add brain-vendor-direct competitor row (review D2).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018vNe64BBDkgo5oQVkBa3XF

README.md

@@ -84,6 +84,7 @@ The white space no incumbent fills:
 | **LiveKit** | Horizontal real-time media infra (Go) | rutster owns the **contact-center domain** (ACD, IVR, queues, recording, CDR, dialer, supervisor) LiveKit will never ship |
 | **Cloud CCaaS** (Five9, Genesys, NICE, Amazon Connect, Twilio Flex) | Proprietary, AI bolted on | Self-hostable, AI-**native**, no per-seat/minute lock-in |
 | **Cloud AI-voice** (Vapi, Retell, Bland) | Cheap managed voice bots | You own your **calls and training data**; it's a *contact center* (escalation, queues), not a single bot |
+| **The brain vendor direct** (OpenAI Realtime SIP, Gemini Live) | Point a SIP trunk straight at the model API | Everything *around* the call: queues/ACD, human takeover, recording/CDR you own, containment analytics, multi-vendor brains — and the phone still answers when the vendor is down |
 | **Dated OSS** (Vicidial, FreePBX) | Self-hostable, Asterisk-era | Modern, AI-native, memory-safe Rust |
 
 The wedge is a **coherent combination, not a silver bullet**:
@@ -132,8 +133,11 @@ exactly as integrators did on top of Asterisk.
    deny-by-default routing, built-in toll-fraud controls, mTLS gRPC admin (no plaintext AMI), hard
    multi-tenancy. Compliance is a buying criterion, not a row.
 3. **In-boundary spend / abuse control** — spend caps and abuse/pacing control live **inside the
-   trust boundary**, co-located with trunk termination. A runaway brain can't exceed pacing or
-   spend because it doesn't hold the wire — structurally impossible for a 3-vendor stack.
+   trust boundary**, co-located with the tap and the provider call-control client. The brain
+   never holds provider credentials, and the gate is unskippable for everything rutster mediates
+   — which is everything the brain can do
+   ([ADR-0009](docs/adr/0009-spend-gate-honest-rescope.md); pair with provider-side caps for
+   defense in depth).
 4. **Data ownership** — calls and training data never leave the operator's infra. The self-host
    wedge *and* the fuel for the ML self-improvement loop.
 5. **Degradation, deterministic, observable** — no-GC real-time loop; OpenTelemetry traces that
@@ -153,6 +157,8 @@ exactly as integrators did on top of Asterisk.
   - [0004](docs/adr/0004-license.md) — GPL-3.0-or-later
   - [0005](docs/adr/0005-event-bus.md) — Valkey (bus + state store)
   - [0006](docs/adr/0006-ingress-posture.md) — WebRTC-first ingress; SIP endpoint deferred
+  - [0009](docs/adr/0009-spend-gate-honest-rescope.md) — spend-gate guarantees re-scoped post-0007 (amends 0002)
+  - [0010](docs/adr/0010-spearhead-benchmark-sim-harness.md) — spearhead step 4½: benchmark + simulation harness; escalation pulled forward
 
 ## Status
 
@@ -172,13 +178,19 @@ The full thin slice, sequenced so each step is its own proof — never a big ban
 3. **Swap echo for the brain** (ideally a single speech-to-speech API, e.g. OpenAI Realtime, to
    collapse STT+LLM+TTS into one integration) — proves agent integration
 4. **Add barge-in** (VAD-driven playout kill) — proves the reflex
+   - **4½ — Benchmark + simulation harness** ([ADR-0010](docs/adr/0010-spearhead-benchmark-sim-harness.md)):
+     synthetic callers drive p50/p99 mouth-to-ear latency + barge-in kill-time under concurrent
+     load, in CI — proves the reflex *measurably*; seeds `rutster-sim`
 5. **Add a real phone number via rented transport** (a CPaaS raw-media fork, e.g. Twilio Media
    Streams) — proves a PSTN call reaches the reflex loop, no first-party SIP ([ADR-0007](docs/adr/0007-trunk-rented-transport.md))
 6. **Add the spend cap** (hard-stop at threshold) — proves the boundary
 
 Steps 1–4 *are* the reflex loop — the hard, most-differentiating part proves itself before trunk
 integration piles on. "I called my Rust box and an AI answered the phone" is the momentum fuel a
-solo multi-year build needs.
+solo multi-year build needs. Post-review re-sequencing
+([ADR-0010](docs/adr/0010-spearhead-benchmark-sim-harness.md)): after step 4½, **rung-2
+escalation (human takeover) is pulled forward ahead of steps 5–6** — it is the white space no
+competitor ships (see the [2026-07-03 reviews](docs/reviews/)).
 
 ## Capability ladder (the grand vision, incrementally)