Blog · behind the scenes

Probe, download, offline — how setup actually works

20 July 2026

The homepage promises "one download, then it's just yours" in three tidy steps. That is true, but a promise isn't an explanation. Here is what actually happens in each step, why it's built that way, and — because a small local model is a set of trade-offs, not magic — where each one can bite you. No marketing. Every piece below maps to code you can read.

1 · Probe — guessing what your device can run, and admitting it's a guess

On first launch Quenderin reads your hardware: total RAM, the chip, and on a phone the app's jetsam memory budget — the amount iOS will let one app hold before it kills it. It then picks the largest model that clears a memory-fitness gate: past 85% of the budget is a hard "no", past 65% is a "this will be tight" warning, and a size-dependent overhead factor is added on top for the KV cache that inference needs at runtime. The picker shows every model in the catalog as Fits, Tight, or Too big with the real numbers, and it will not offer you one that would run out of memory.

The catch. Total RAM is not free RAM. This is a heuristic: a laptop with forty browser tabs open has far less headroom than the probe assumes, and the jetsam budget on phones is deliberately pessimistic, so on mobile it tends to under-pick rather than risk a crash. Treat the recommendation as a sensible default, not a guarantee — you can always override it and pick a bigger (or smaller) model yourself, with the same honest fitness label next to each.

2 · Download — one multi-gigabyte pull, verified before it's trusted

The model is a single GGUF file streamed from a pinned URL to disk in the OS's native chunks. Three things happen that you don't see: the downloader checks the HTTP status before it writes a byte (a server error page is never mistaken for a model); the finished file is gated on its GGUF magic header and, when the catalog pins one, its exact SHA-256, before it is ever handed to the parser; and a disk-space preflight refuses to start a download that can't finish. It's resumable — lose Wi-Fi at 80% and it picks up where it left off — and it honors a Wi-Fi-only policy by default so a multi-GB pull never surprises your cellular bill.

Why the ceremony: a torn, truncated, or substituted model file is a native-parser attack surface, so nothing loads until it verifies. The catch. It is genuinely large and it is the slow part of first-run — from 0.4 GB for the ultra-light build to ~13 GB for the big mixture-of-experts one. The mirror can rate-limit you, and a pinned URL rots the day a repository is renamed. We shipped a dead one once; Apple's reviewer hit it before we did, and the fix (plus a CI check so it can't recur) is in the changelog. After this one time, it never happens again — the model is a file on your disk.

3 · Go offline — the model on your CPU, and the ceiling that comes with it

From then on, inference runs entirely through llama.cpp — Metal on Apple silicon, and CPU with memory-mapped weights when a model is too big for the GPU budget. There are zero network calls after setup; an offline-readiness check confirms it before you leave signal. This is the whole point: nothing you type leaves the machine. No account, no telemetry, works in a tunnel, on a plane, in a tent.

The honest trade-off — and it is a real one. A model that fits on your device is smaller than a frontier model in a datacenter, and it will sometimes be confidently wrong. We don't hide that: every model carries a plain-language quality grade, the empty state warns you before you start, and the router can suggest a larger model you've installed for a hard task. Sustained generation warms the chip and uses battery; the context window is smaller than a server's. You are trading a slice of raw capability for the network never being in the loop. For anyone offline, private-by-necessity, or simply done being metered, that trade is the entire reason to be here — and if it isn't your trade, we'd rather you know that up front than find out later.

None of this is a claim you have to take on faith

The probe (the memory-fitness math and the model picker), the download integrity gate, and the engine are all open source — read them, or read the measured numbers instead of our adjectives on the real-numbers page. Where it's all going, stage by stage: the roadmap. Or just get it.