Merge the llm_router flag and the kill-maven fix

internal/config/config.go

@@ -257,6 +257,20 @@ type VoiceConfig struct {
 	// Default 0.35 if unset.
 	RouterThreshold float64 `json:"router_threshold,omitempty"`
 
+	// LLMRouter — route with the resident model instead of the embedding
+	// classifier. Measured on the held-out fixture (ROUTING-EVAL-31-07-2026.md)
+	// the model gets 50.0% of intents right against the classifier's 36.8%, but
+	// it costs about 800ms per turn instead of 30ms.
+	//
+	// TODO: the default stays false until two things land.
+	//   1. The LLM router cannot refuse. LLMRouter.Route hardcodes
+	//      Confidence: 1.0, so the stage-3 clarify gate never fires and an
+	//      unclear utterance becomes a confident wrong action (Vikunja #359).
+	//   2. Extractor.Extract never runs on an LLM decision, so acts arrive with
+	//      no Fn and reminders with no Time.
+	// Turning this on today makes routing more accurate and less safe.
+	LLMRouter bool `json:"llm_router,omitempty"`
+
 	// QueryMinScore — the note-recall confidence gate. Top cosine below this
 	// ⇒ "I don't know" instead of a guess. Tuned for the ONNX embedder (0.55);
 	// the HashEmbedder floor scores lexically and may never clear it. 0.55

internal/config/config_test.go

@@ -171,6 +171,28 @@ func TestWeatherConfigNilOK(t *testing.T) {
 	}
 }
 
+func TestLLMRouterDefaultsOff(t *testing.T) {
+	p := writeConfig(t, `{"voice":{"enabled":true,"bind":"127.0.0.1:9100"}}`)
+	c, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.Voice.LLMRouter {
+		t.Error("voice.llm_router absent should mean false")
+	}
+}
+
+func TestLLMRouterRead(t *testing.T) {
+	p := writeConfig(t, `{"voice":{"enabled":true,"bind":"127.0.0.1:9100","llm_router":true}}`)
+	c, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if !c.Voice.LLMRouter {
+		t.Error("voice.llm_router true was not read")
+	}
+}
+
 func TestDurationRoundTrip(t *testing.T) {
 	d := Duration(15 * time.Minute)
 	b, err := d.MarshalJSON()