Menu-bound restaurant voice agent, not a generic template bot.

Any one of these fails a small percent of calls. Together, they compound: a bot that occasionally invents prices and confirms non-existent orders is a chargeback pipeline, not an ordering system.

Fire It is not a prompt sitting on top of a general voice API. The menu is structured. Pricing is server-side. Confirmation is a deterministic state transition. Modifier caps are enforced. Callers can transfer to a human at any point. Those are architectural properties, not model behaviors.

Ask for a live call. Order a splittable pizza with two required modifier groups and one 86'd topping. Try to change the address mid-call. Ask for a human. If any of those breaks silently, the bot is not restaurant-safe.

Ask any voice bot vendor for a live call and run three tests. Order a splittable pizza with two required modifier groups. Try to add an item you know isn't on the menu. Ask for a human. A restaurant-specific agent handles the first cleanly, refuses the second with a coherent message, and transfers the third to a real number. A generic bot handles the first with a plausible-sounding paragraph that doesn't map to a ticket, invents the second because the model doesn't know the menu, and drops the third because transfer semantics weren't in the prompt template.

The difference isn't in the model — most vendors use similar underlying voice and LLM providers. The difference is in the layer between the model and the outcome. A restaurant-specific agent validates every capture against a live menu, prices on a server the model can't influence, and transitions through explicit states before saying anything is confirmed. A generic bot leaves each of those to a function call the model can bypass. Both look identical in a five-minute happy-path demo; they diverge on the tenth complicated order.

A generic bot that says 'your order is confirmed' before a ticket exists creates a chargeback vector. The customer has audio proof of confirmation. The kitchen has no record. The card was charged. That story ends at your payment processor, and it ends badly. Restaurant-specific systems refuse to send that language until the state supports it, precisely to close that vector. If a vendor won't demonstrate that behavior on a live call, treat the omission as diagnostic.