create-pmos 0.164.0 → 0.165.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@2f861db
+kernel-source: pmos@574eff4
 assembled: 2026-10-12
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-12T12:54:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T13:19:10Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-12T12:54:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T13:19:10Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-12T12:54:32Z"}
+generated: {by: process:create-pmos, at: "2026-10-12T13:19:10Z"}
 status: stable
 ---
 

package/workspace/guide/settings.md

@@ -33,7 +33,7 @@ Settings is not a tab. While it is open, no tab is selected. Press a tab to go b
 | Sharing | How a dashboard is shared: off, a link, or sent by the sender. The audiences of the workspace. |
 | Access and devices | Use from a phone or another computer: the host, the tunnel and the people who may open it. |
 | Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags. The session limits. Validate consent for this workspace. |
-| Privacy and data | A list of what leaves this computer and when. Whether a TypeSafe key is saved, and the data folder. |
+| Privacy and data | A list of what leaves this computer and when. Whether a TypeSafe key is saved, the local model that answers when there is no key (Off, Winnow or Laya), and the data folder. |
 | Appearance | The theme (Same as system, Light or Dark) and the page that opens first. |
 | Updates | The version of the app and of each workspace's kit. Check for updates, and how updates are found and applied. |
 

package/workspace/guide/validate-with-typesafe.md

@@ -2,7 +2,7 @@
 type: Guide
 title: "Guide: validate a repository"
 description: "How the validate item checks that a repository agrees with itself, and the optional second check with TypeSafe."
-timestamp: 2026-10-04
+timestamp: 2026-10-12
 ---
 
 # Guide: validate a repository
@@ -107,6 +107,19 @@ The workspace reads the TypeSafe key only on this machine. After you save the ke
 3. Under **this repository**, press **turn on**. This choice applies to the selected repository only.
 4. Enter the paths that the workspace must never send, one for each line. A path ends with `/` for a folder. A `*` matches any characters. Press **save excluded paths**.
 
+## Use a model on this computer when there is no TypeSafe key
+
+If you have no TypeSafe key, a model on your computer can answer the same questions. Two models are supported. Both use the same interface as Jev.
+
+- **Winnow**: in a `winnow-inference` folder, run `python3 scripts/serve.py`. It uses port 8091. Winnow-12B needs about 16 GB of memory.
+- **Laya**: run `pip install "laya[serve]"`, then `laya-serve`. It uses port 8000. Laya is small and runs on a laptop.
+
+1. Start the model.
+2. Open Settings, then **Privacy and data**. Under **Local model if Jev is missing**, press **Winnow** or **Laya**.
+3. Press **Test**. The row says whether the model answered.
+
+If no key is saved, every Jev question goes to the local model. If a key is saved, TypeSafe answers first. If TypeSafe cannot be reached, rejects the key or is busy, the local model answers. The workspace sends these questions only to `127.0.0.1`, so nothing leaves your computer. It sends no key. The answers of a local model are suggestions, as the answers of Jev are. Press **Off** to stop using the local model.
+
 ## Run a validation
 
 1. Press **show what would be sent**. The workspace shows the number of requests, the number of characters, and the documents it withholds. It sends nothing at this step.

package/workspace/lib/typesafe-settings.js

@@ -9,10 +9,16 @@
  * returns the key. `getKey()` is for the server's validation path only; no route returns its value.
  * `TYPESAFE_API_KEY` in the environment is read as a fallback, ONCE, at server start (`adoptEnv`), which
  * then deletes the variable from the process environment. Nothing the server spawns afterwards can see it.
+ *
+ * LOCAL FALLBACK (D95). The same file keeps `local: { backend, port }`: the System One server the PM runs on this
+ * machine (Winnow or Laya). Every read hands it to lib/typesafe.js (`configureLocal`). With no key saved, `getKey`
+ * returns `typesafe.LOCAL_KEY` so the bridges' key gate opens and their questions go to loopback; `status` says
+ * `source: 'local'`. With a key saved, the local server is only asked when TypeSafe fails.
  */
 const fs = require('fs');
 const path = require('path');
-const { validKey } = require('./typesafe');
+const typesafe = require('./typesafe');
+const { validKey } = typesafe;
 
 const FILE = 'typesafe.json';
 const ENV_NAME = 'TYPESAFE_API_KEY';
@@ -23,13 +29,20 @@ function file(stateDir) { return path.join(stateDir, FILE); }
 function read(stateDir) {
   try {
     const st = fs.lstatSync(file(stateDir));
-    if (!st.isFile()) return { key: null, repos: {} };
+    if (!st.isFile()) return { key: null, repos: {}, local: localFrom(null) };
     const o = JSON.parse(fs.readFileSync(file(stateDir), 'utf8'));
     return {
       key: typeof o.key === 'string' ? o.key : null,
       repos: o && typeof o.repos === 'object' && o.repos && !Array.isArray(o.repos) ? o.repos : {},
+      local: localFrom(o && o.local),
     };
-  } catch { return { key: null, repos: {} }; }
+  } catch { return { key: null, repos: {}, local: localFrom(null) }; }
+}
+
+/* The saved local server, checked, and handed to the TypeSafe module so the process follows the file. */
+function localFrom(l) {
+  const t = typesafe.configureLocal(l && typeof l === 'object' ? { backend: l.backend, port: l.port } : null);
+  return t ? { backend: t.backend, port: t.port } : null;
 }
 
 function write(stateDir, data) {
@@ -59,30 +72,50 @@ function adoptEnv(env) {
 }
 function envKey(env) { return adopted || (env && validKey(env[ENV_NAME]) ? env[ENV_NAME] : null); }
 
-/** The key for the server's own use, or null. File first, then the environment. */
+/** The key for the server's own use, or null. File first, then the environment, then the local server's handle. */
 function getKey(stateDir, env = null) {
-  const f = read(stateDir).key;
-  if (validKey(f)) return f;
-  return envKey(env);
+  const cur = read(stateDir);
+  if (validKey(cur.key)) return cur.key;
+  return envKey(env) || (cur.local ? typesafe.LOCAL_KEY : null);
 }
 
-/** What the browser may know: present or not, and from where. Never the value, never its length. */
+/** What the browser may know: present or not, and from where. Never the value, never its length.
+ *  `local` is the fallback server (backend and port; neither is a secret). */
 function status(stateDir, env = null) {
-  if (validKey(read(stateDir).key)) return { present: true, source: 'settings' };
-  if (envKey(env)) return { present: true, source: 'environment' };
-  return { present: false, source: null };
+  const cur = read(stateDir);
+  const local = cur.local ? { backend: cur.local.backend, name: typesafe.BACKENDS[cur.local.backend].name, port: cur.local.port } : null;
+  if (validKey(cur.key)) return { present: true, source: 'settings', local };
+  if (envKey(env)) return { present: true, source: 'environment', local };
+  if (local) return { present: true, source: 'local', local };
+  return { present: false, source: null, local: null };
+}
+
+/** Save or clear the local fallback server. `backend` is 'winnow' or 'laya'; `port` defaults to that server's own. */
+function setLocal(stateDir, { backend, port } = {}) {
+  const cur = read(stateDir);
+  if (backend == null || backend === '' || backend === 'off') {
+    const out = write(stateDir, { key: cur.key, repos: cur.repos, local: null });
+    if (out.ok) typesafe.configureLocal(null);
+    return out;
+  }
+  if (!typesafe.validBackend(backend)) return { ok: false, error: 'choose Winnow or Laya' };
+  const p = port == null || port === '' ? typesafe.BACKENDS[backend].port : Number(port);
+  if (!typesafe.validPort(p)) return { ok: false, error: 'the port must be a whole number from 1024 to 65535' };
+  const out = write(stateDir, { key: cur.key, repos: cur.repos, local: { backend, port: p } });
+  if (out.ok) typesafe.configureLocal({ backend, port: p });
+  return out;
 }
 
 function setKey(stateDir, key) {
   const k = typeof key === 'string' ? key.trim() : '';
   if (!validKey(k)) return { ok: false, error: 'that does not look like a key — it must be 8 to 512 characters with no spaces' };
   const cur = read(stateDir);
-  return write(stateDir, { key: k, repos: cur.repos });
+  return write(stateDir, { key: k, repos: cur.repos, local: cur.local });
 }
 
 function clearKey(stateDir) {
   const cur = read(stateDir);
-  return write(stateDir, { key: null, repos: cur.repos });
+  return write(stateDir, { key: null, repos: cur.repos, local: cur.local });
 }
 
 /** Consent and exclusions for one repository root. Consent defaults to off. */
@@ -115,7 +148,7 @@ function setRepo(stateDir, root, { consent, exclude, watch, jev, categorize, rou
     ? exclude.map((x) => String(x).trim().replace(/^\/+/, '')).filter((x) => x && !x.includes('..') && x.length <= 200).slice(0, MAX_EXCLUDES)
     : prev.exclude;
   const repos = { ...cur.repos, [root]: { consent: typeof consent === 'boolean' ? consent : prev.consent, exclude: ex, watch: typeof watch === 'boolean' ? watch : prev.watch, jev: typeof jev === 'boolean' ? jev : prev.jev, categorize: typeof categorize === 'boolean' ? categorize : prev.categorize, route: typeof route === 'boolean' ? route : prev.route, status_read: typeof statusRead === 'boolean' ? statusRead : prev.status_read } };
-  return write(stateDir, { key: cur.key, repos });
+  return write(stateDir, { key: cur.key, repos, local: cur.local });
 }
 
 /** Does `rel` fall under an exclusion? An entry is a path prefix, or a `*` pattern matched on the path. */
@@ -130,4 +163,4 @@ function isExcluded(exclude, rel) {
   });
 }
 
-module.exports = { adoptEnv, status, getKey, setKey, clearKey, getRepo, setRepo, isExcluded, ENV_NAME, FILE };
+module.exports = { adoptEnv, status, getKey, setKey, clearKey, setLocal, getRepo, setRepo, isExcluded, ENV_NAME, FILE };

package/workspace/lib/typesafe.js

@@ -17,6 +17,17 @@
  *   Noul    "high means yes"; the single `noul` number is P(yes). There is no separate confidence.
  *   Score   levels 0..N-1; `score` is the probability-weighted mean; `confidence` is reported.
  *   Choice  one option plus a distribution.
+ *
+ * LOCAL FALLBACK (D95). When the PM has no TypeSafe key, or Jev cannot answer, the same questions may go to a
+ * System One server the PM runs on this machine: Winnow (winnow-inference, port 8091) or Laya (laya-serve, port
+ * 8000). Both speak Jev's `POST /v1/systemone`. The host is LOOPBACK, fixed in source like the TypeSafe host; only
+ * the port is a setting. A local request carries no key and no model name, and nothing leaves the machine.
+ *   - `configureLocal({ backend, port })` turns the fallback on for this process; `configureLocal(null)` turns it off.
+ *     lib/typesafe-settings.js calls it from what the PM saved.
+ *   - `LOCAL_KEY` is the handle the key store returns when only the local server is set. It is not a secret and
+ *     it is never sent to TypeSafe: `ask` routes it to loopback before the TypeSafe branch.
+ *   - With a real key, a TypeSafe failure (unreachable, 401, 429, 5xx) is asked again locally when the fallback is
+ *     on. The result says `fallback: true` and names the local backend.
  */
 const https = require('https');
 const http = require('http');
@@ -28,6 +39,14 @@ const MAX_STATE_CHARS = 60000;       // a conservative cap; the documentation st
 const MAX_RESPONSE_BYTES = 1 << 20;  // 1 MiB — an answer set is small; anything larger is not one
 const MAX_QUESTIONS = 16;
 
+const LOCAL_HOST = '127.0.0.1';      // loopback only — the local fallback never reaches another machine (D95)
+const LOCAL_KEY = 'local-systemone';  // the key store's handle for "no TypeSafe key, the local server answers"
+const BACKENDS = {
+  winnow: { name: 'Winnow', port: 8091, start: 'python3 scripts/serve.py   (in a winnow-inference checkout)' },
+  laya: { name: 'Laya', port: 8000, start: 'pip install "laya[serve]" && laya-serve' },
+};
+const LOCAL_ASK = { timeoutMs: 15000, retries: 1, backoffMs: 400 };  // a floor: a laptop model can be slower than the hosted one
+
 /* A seam for tests, gated like the sink's. It lets a suite point this module at a loopback stub; it
  * is unreachable in a production process, so no setting can redirect the key to another host. */
 let endpointForTests = null;
@@ -42,6 +61,19 @@ function endpoint() {
   return endpointForTests || { protocol: 'https:', hostname: HOST, port: 443 };
 }
 
+function validPort(p) { const n = Number(p); return Number.isInteger(n) && n >= 1024 && n <= 65535; }
+function validBackend(b) { return typeof b === 'string' && Object.prototype.hasOwnProperty.call(BACKENDS, b); }
+
+/* The local fallback for this process, or null. Set from the PM's saved choice; never from a request body. */
+let local = null;
+function configureLocal(cfg) {
+  if (!cfg || !validBackend(cfg.backend)) { local = null; return null; }
+  const port = cfg.port == null || cfg.port === '' ? BACKENDS[cfg.backend].port : Number(cfg.port);
+  local = validPort(port) ? { backend: cfg.backend, port } : null;
+  return local;
+}
+function localTarget() { return local ? { ...local, name: BACKENDS[local.backend].name } : null; }
+
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const retryable = (status) => status === 429 || status === 529 || (status >= 500 && status < 600);
 
@@ -49,8 +81,7 @@ function validKey(key) {
   return typeof key === 'string' && key.length >= 8 && key.length <= 512 && !/[\s\u0000-\u001f\u007f]/.test(key);
 }
 
-function once({ key, body, timeoutMs }) {
-  const ep = endpoint();
+function once({ key, body, timeoutMs, ep = endpoint() }) {
   const mod = ep.protocol === 'http:' ? http : https;
   const payload = Buffer.from(body, 'utf8');
   return new Promise((resolve) => {
@@ -60,7 +91,7 @@ function once({ key, body, timeoutMs }) {
       protocol: ep.protocol, hostname: ep.hostname, port: ep.port, path: PATH, method: 'POST',
       headers: {
         'Content-Type': 'application/json', 'Content-Length': payload.length,
-        Authorization: 'Bearer ' + key, 'User-Agent': 'pmos-workspace',
+        ...(key ? { Authorization: 'Bearer ' + key } : {}), 'User-Agent': 'pmos-workspace',
       },
       timeout: timeoutMs,
     }, (res) => {
@@ -104,16 +135,10 @@ function once({ key, body, timeoutMs }) {
  * @returns {Promise<{ok:true, model, answers, usage}|{ok:false, reason, status?, requested:boolean}>}
  *   `requested` says whether a request left this process, so a caller can tell a refusal from a failure.
  */
-async function ask({ key, state, questions, model = DEFAULT_MODEL, timeoutMs = 30000, retries = 2, backoffMs = 600 } = {}) {
-  if (!validKey(key)) return { ok: false, requested: false, reason: 'no TypeSafe key is set' };
-  if (typeof state !== 'string' || !state.trim()) return { ok: false, requested: false, reason: 'there is no text to judge' };
-  if (state.length > MAX_STATE_CHARS) return { ok: false, requested: false, reason: `the text is longer than ${MAX_STATE_CHARS} characters` };
-  const names = questions && typeof questions === 'object' ? Object.keys(questions) : [];
-  if (!names.length || names.length > MAX_QUESTIONS) return { ok: false, requested: false, reason: `between 1 and ${MAX_QUESTIONS} questions are required` };
-  const body = JSON.stringify({ state, model, questions });
+async function send({ key, body, ep, timeoutMs, retries, backoffMs }) {
   let last = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
-    last = await once({ key, body, timeoutMs });
+    last = await once({ key, body, timeoutMs, ep });
     if (last.ok) return { ...last, requested: true };
     if (!(last.status === 0 || retryable(last.status)) || attempt === retries) break;
     await sleep(backoffMs * Math.pow(2, attempt));
@@ -121,4 +146,40 @@ async function ask({ key, state, questions, model = DEFAULT_MODEL, timeoutMs = 3
   return { ok: false, requested: true, status: last.status, reason: last.reason };
 }
 
-module.exports = { ask, validKey, HOST, PATH, DEFAULT_MODEL, MAX_STATE_CHARS, MAX_QUESTIONS, __setEndpointForTests };
+/* A local server may leave out an answer's `type`; the bridges read it, so it is filled from the question. */
+function withTypes(answers, questions) {
+  const out = {};
+  for (const [n, a] of Object.entries(answers || {})) {
+    out[n] = a && typeof a === 'object' && a.type == null && questions[n] ? { ...a, type: questions[n].type } : a;
+  }
+  return out;
+}
+
+/* Ask the PM's local System One server. No key and no model name go with it: each server answers with its own model. */
+async function askLocal({ state, questions, timeoutMs, retries, backoffMs }) {
+  const t = localTarget();
+  if (!t) return { ok: false, requested: false, reason: 'no local model is set' };
+  const r = await send({ key: null, body: JSON.stringify({ state, questions }), ep: { protocol: 'http:', hostname: LOCAL_HOST, port: t.port },
+    timeoutMs: Math.max(timeoutMs || 0, LOCAL_ASK.timeoutMs), retries: Math.min(retries == null ? LOCAL_ASK.retries : retries, LOCAL_ASK.retries), backoffMs: backoffMs || LOCAL_ASK.backoffMs });
+  if (!r.ok) return { ...r, local: t.backend, reason: `${t.name} on this machine: ` + r.reason.replace(/^the service/, 'the server') };
+  return { ...r, answers: withTypes(r.answers, questions), model: r.model || t.backend, local: t.backend };
+}
+
+/* When the hosted answer fails this way, the local server is asked instead (D95). A malformed request (422) is not. */
+const failsOver = (r) => r.requested && (r.status === 0 || r.status === 401 || retryable(r.status));
+
+async function ask({ key, state, questions, model = DEFAULT_MODEL, timeoutMs = 30000, retries = 2, backoffMs = 600 } = {}) {
+  if (!validKey(key)) return { ok: false, requested: false, reason: 'no TypeSafe key is set' };
+  if (typeof state !== 'string' || !state.trim()) return { ok: false, requested: false, reason: 'there is no text to judge' };
+  if (state.length > MAX_STATE_CHARS) return { ok: false, requested: false, reason: `the text is longer than ${MAX_STATE_CHARS} characters` };
+  const names = questions && typeof questions === 'object' ? Object.keys(questions) : [];
+  if (!names.length || names.length > MAX_QUESTIONS) return { ok: false, requested: false, reason: `between 1 and ${MAX_QUESTIONS} questions are required` };
+  // The local handle never reaches TypeSafe: it is routed to loopback here, before the hosted branch.
+  if (key === LOCAL_KEY) return askLocal({ state, questions, timeoutMs, retries, backoffMs });
+  const r = await send({ key, body: JSON.stringify({ state, model, questions }), ep: endpoint(), timeoutMs, retries, backoffMs });
+  if (r.ok || !local || !failsOver(r)) return r;
+  const l = await askLocal({ state, questions, timeoutMs, retries, backoffMs });
+  return l.ok ? { ...l, fallback: true, hosted_reason: r.reason } : { ...r, reason: r.reason + '; ' + l.reason };
+}
+
+module.exports = { ask, validKey, configureLocal, localTarget, validPort, validBackend, HOST, PATH, DEFAULT_MODEL, MAX_STATE_CHARS, MAX_QUESTIONS, LOCAL_HOST, LOCAL_KEY, BACKENDS, __setEndpointForTests };

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.164.0",
+      "version": "0.165.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/c3-settings.js

@@ -587,19 +587,47 @@ export function mountSettings(host, ctx = {}) {
       ['Update check', 'Asks the npm registry for the latest version.', val('upd.check') === 'daily' ? 'Once a day' : 'Only when you press Check', val('upd.check') === 'daily' ? 'warn' : ''],
       ['Online tunnel', 'Cloudflare carries your pages to your other devices (D89).', o && o.on ? 'On' : 'Off', o && o.on ? 'warn' : ''],
       ['Jev (TypeSafe)', 'Note lines and matching passages. Never audio, names or private notes (D79).', M.ws ? (jevOn ? 'On in ' : 'Off in ') + wsName(M.ws) : 'Pick a workspace', jevOn ? 'warn' : ''],
+      ['Local model', 'Winnow or Laya on 127.0.0.1 answers Jev questions when there is no TypeSafe key or TypeSafe fails (D95).', M.typesafe && M.typesafe.local ? M.typesafe.local.name + ', stays here' : 'Off', 'ok'],
       ['Your connected tools', 'Calendar, Jira, Wispr Flow and the sender are reached by your Claude session, not by PMOS.', 'Through profile ' + (profileNow().id || 'none'), ''],
     ];
     const leave = L.map(([t, h, s, tone]) => el('li', { class: 'nrow' }, el('span', { class: cx('ki', tone === 'ok' ? 'hot' : tone === 'warn' ? 't-warn' : '') }, c3ic(tone === 'ok' ? 'lock' : 'out')),
       el('div', { class: 'nb' }, el('span', { class: 'tt' }, t), help(h)), el('div', { class: 'acts' }, tag(s, tone))));
     return [sect('What leaves this computer', [list(leave)], { ic: 'shield', attrs: { 'data-c3set-leaves': '' } }),
       sect('Keys and files', [list([
-        frame({ key: 'typesafe', label: 'TypeSafe key', help: 'Kept on this computer only. It is never shown, here or anywhere.', scope: 'computer', control: M.typesafe ? tag(M.typesafe.present ? 'Saved' : 'None', M.typesafe.present ? 'ok' : '') : tag('Reading') }),
+        frame({ key: 'typesafe', label: 'TypeSafe key', help: 'Kept on this computer only. It is never shown, here or anywhere.', scope: 'computer', control: M.typesafe ? tag(M.typesafe.source === 'settings' || M.typesafe.source === 'environment' ? 'Saved' : 'None', M.typesafe.source === 'settings' || M.typesafe.source === 'environment' ? 'ok' : '') : tag('Reading') }),
+        localModelRow(),
         frame({ key: 'state', label: 'Data folder', help: 'Notes, audio, settings and caches. Outside every repository, so no commit can carry them.', scope: 'computer', control: chip((M.data && M.data.state_dir) || '', 'mono st-wrap-text') }),
         lockedRow('priv.cards', 'Send card text to Jev for icons', 'Card kinds and icons are chosen by code rules on this computer (D7).', 'Off', 'computer'),
         notYet('priv.export', 'Export or reset every setting', 'Save every setting to a file, or put them all back to their defaults. Your workspaces, notes and audio stay.', 'Export and reset all come later. Reset one setting or one section with its Reset button.', 'computer')]),
       el('div', { class: 'iacts' }, btn('Export settings', { ic: 'out', disabled: true }), btn('Reset all settings', { variant: 'ghost', disabled: true }), w && w.keep_audio !== false ? btn('Recording settings', { variant: 'ghost', ic: 'next', onclick: () => goSec('recording') }) : null)], { ic: 'lock' })];
   }
 
+  /* D95 — a model on this computer answers Jev's questions when there is no TypeSafe key, or when TypeSafe fails.
+   * Winnow and Laya both speak Jev's interface; PMOS only calls 127.0.0.1 on the port shown. */
+  function localModelRow() {
+    const t = M.typesafe; const loc = t && t.local; const cur = loc ? loc.backend : 'off';
+    const pick = async (v) => {
+      const r = await pmPost('/api/typesafe/local', { backend: v });
+      if (r && r.ok !== false) { M.typesafe = r.key; delete M.err['typesafe.local']; M.localTest = null; toast(v === 'off' ? 'Saved: no local model' : 'Saved: local model'); }
+      else M.err['typesafe.local'] = (r && r.error) || 'Not saved.';
+      draw();
+    };
+    const test = async () => {
+      M.localTest = { busy: true }; draw();
+      const r = await pmPost('/api/typesafe/local/test', {});
+      M.localTest = r && r.ok ? { ok: true, text: 'Answered (' + (r.model || r.local) + ').' } : { ok: false, text: (r && r.error) || 'No answer.' };
+      draw();
+    };
+    const lt = M.localTest;
+    const note = !loc ? 'Off. With no TypeSafe key, Jev features stay off.'
+      : (t.source === 'local' ? 'No TypeSafe key, so ' + loc.name + ' answers every Jev question.' : 'TypeSafe answers first; ' + loc.name + ' answers when it fails.')
+        + ' PMOS calls 127.0.0.1:' + loc.port + ' only. Nothing leaves this computer.' + (lt && !lt.busy ? ' ' + lt.text : '');
+    return frame({ key: 'typesafe.local', label: 'Local model if Jev is missing', help: 'Start Winnow (winnow-inference, port 8091) or Laya (laya-serve, port 8000) on this computer, then pick it here.', scope: 'computer',
+      err: M.err['typesafe.local'], note,
+      control: t ? el('div', { class: 'iacts' }, seg('Local model', [['off', 'Off'], ['winnow', 'Winnow'], ['laya', 'Laya']], cur, pick),
+        loc ? btn(lt && lt.busy ? 'Testing' : 'Test', { variant: 'ghost', disabled: !!(lt && lt.busy), onclick: test }) : null) : tag('Reading') });
+  }
+
   function appearanceSec() {
     const pref = ctx.themePref || ctx.theme;
     return [group('Look', [extRow('look.theme', seg('Theme', [['system', 'Same as system'], ['light', 'Light'], ['dark', 'Dark']], pref, (v) => { const before = ctx.themePref || ctx.theme; if (ctx.setTheme) ctx.setTheme(v); ctx.themePref = v; ctx.theme = v; toast('Saved: theme', () => { if (ctx.setTheme) ctx.setTheme(before); ctx.themePref = before; ctx.theme = before; draw(); }); draw(); }), { scope: 'computer', note: 'Kept in this browser.' }),

package/workspace/replaced-tests.json

@@ -162,6 +162,17 @@
       "names": [
         "(d) the Tree pane shows at most ${TREE_BUDGET} controls on first paint (specimen A's own Tree view)"
       ]
+    },
+    {
+      "id": "STD-LOCAL",
+      "file": "workspace/typesafe-validation.test.js",
+      "run": "jev-local-fallback",
+      "ref": "DECISIONS.md D95 and planning/initiatives/jev-local-fallback.md (PM wawan, 2026-10-12)",
+      "reason": "D95 adds the local fallback server to the key store's status, so status() gains a `local` field (null when none is set). B1 and B5 compared the exact JSON; they keep their intent (absent, then present from settings, never the key) with `\"local\":null` in the expected text.",
+      "names": [
+        "B1 with nothing stored, status says absent",
+        "B5 status never carries the key or its length"
+      ]
     }
   ],
   "entries": [

package/workspace/server.js

@@ -238,6 +238,7 @@ const STATE_RESOLVED = stateRoot.resolveStateRoot({
   legacy: REQUIRED_AS_LIBRARY ? null : LEGACY_STATE,
 });
 const STATE = STATE_RESOLVED.root;
+tsSettings.status(STATE);           // D95 — load the saved local fallback (Winnow or Laya) into the TypeSafe module
 // ── AN UNSETTLED STATE ROOT MUST NOT DEGRADE INTO "YOU HAVE NOTHING". ─────────────────────────
 // When both directories hold state nothing is moved (only a human can decide which sixteen
 // sessions are the real sixteen) — but the stores the per-user root does NOT hold used to resolve
@@ -7965,6 +7966,22 @@ async function handleRequest(req, res) {
     applyOnline();
     return json(res, onlineView(req));
   }
+  /* D95 — the local fallback: a System One server on this machine (Winnow or Laya) answers when there is no TypeSafe key,
+   * or when TypeSafe fails. Loopback only; the port is the one setting. `test` asks it one question about a fixed sentence. */
+  if (p === '/api/typesafe/local' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const out = tsSettings.setLocal(STATE, { backend: body.backend, port: body.port });   // backend 'off' clears it
+    if (!out.ok) return json(res, { ok: false, error: out.error }, /choose|port/.test(out.error) ? 400 : 500);
+    return json(res, { ok: true, key: tsSettings.status(STATE) });
+  }
+  if (p === '/api/typesafe/local/test' && req.method === 'POST') {
+    if (!tsSettings.status(STATE).local) return json(res, { ok: false, error: 'No local model is set.' }, 409);
+    const r = await tsClient.ask({ key: tsClient.LOCAL_KEY, state: 'PMOS is checking that the local model answers.', retries: 0,
+      questions: { check: { type: 'noul', instructions: 'Is this sentence a connection check?' } } });
+    return json(res, r.ok ? { ok: true, model: r.model, local: r.local } : { ok: false, error: r.reason }, r.ok ? 200 : 502);
+  }
   if (p === '/api/typesafe/key' && (req.method === 'PUT' || req.method === 'DELETE')) {
     let body = {};
     if (req.method === 'PUT') {

package/workspace/test-files.json

@@ -22,6 +22,7 @@
     "story-artifacts.test.js",
     "no-network.test.js",
     "typesafe-validation.test.js",
+    "typesafe-local.test.js",
     "claims.test.js",
     "pm-items.test.js",
     "jobs-to-be-done.test.js",
@@ -156,6 +157,7 @@
     "story-artifacts.test.js": 1,
     "no-network.test.js": 1,
     "typesafe-validation.test.js": 1,
+    "typesafe-local.test.js": 1,
     "claims.test.js": 1,
     "pm-items.test.js": 1,
     "jobs-to-be-done.test.js": 1,