As a privacy-focused user, I am hesitant to use voice input because of the 'whenever possible' clause. I need a mandatory 'On-Device Only' toggle in settings. If the on-device model cannot transcribe a phrase, the app should fail locally rather than routing to the server. Without this hard constraint, I cannot trust the voice feature for sensitive conversations