"An offline request that never builds a remote call can't leak. That's not a promise — it's a shape."
The Rekindle Inheritance
Firekeeper's writing sibling, Rekindle, learned a hard rule about offline modes, and Firekeeper inherits it exactly: provider selection happens before a single byte leaves the process. The active connection mode is resolved into a concrete provider first; only then is a request built and sent. This sounds like a detail. It is actually the entire difference between real offline and offline theater.
Two Architectures, One Fatal Difference
Compare the two ways to structure a fallback. The fallback-on-failure design tries the remote call, and only routes locally if it fails — which means an offline-intended request has already attempted (or prepared) a network call before anyone checked. The selection-before-send design picks the provider from the chosen mode up front, so an offline request routes to the Local Mini provider and a call to the Pippa path is never constructed at all. The first hopes nothing leaked; the second makes that leak structurally impossible.
Fallback-on-failure (theater):
build remote call -> try send -> failed? -> now go local # remote was attempted!
Selection-before-send (real):
read chosen mode -> offline? -> build the Ollama call only # no Pippa call exists
Why 'Structural' Beats 'Careful'
You could try to make fallback-on-failure safe with careful checks — "only send if online, and definitely cancel before it goes out." But careful is fragile: one refactor, one race, one forgotten branch, and the remote call slips out. Selection-before-send doesn't rely on care. In offline mode the code path that builds a Pippa request simply isn't reached, so there's nothing to slip. When the safety property is a consequence of the control flow rather than a guard bolted onto it, you can't accidentally regress it.
Know exactly what the shape promises, though. Local Mini sends the text to the Ollama host set in settings, which is localhost by default, and nothing checks that the host is this Mac. What the structure guarantees is that no call to cwkPippa or office is ever built; point the Ollama host at another machine, and that machine receives your transcript.