Why one toggle only. pii_llm_pass and pii_custom_names exist in config.py but are inert (they emit runtime warnings and do nothing), so they are deliberately not surfaced. pii_score_threshold stays a tuned default — no threshold UI, per house rule.

Why the switch goes on immediately rather than after the download. Per decision D2 redaction applies to the next analysis, onward — so the switch states an intention about future runs, and the download has until the next run to finish. A switch that snapped back, or sat disabled behind a spinner, would be worse and would also be wrong: nothing about the setting is untrue while the bytes are still arriving. The system owns the transfer — resume, background, storage accounting — so quitting the app does not lose it.

Turning it back off does not delete anything, and we offer no “remove model” button. Purging is the system’s call: Background Assets accounts the storage to the app and reclaims it under pressure — exactly what a Mac user already expects from on-demand dictation and translation languages. Our own delete button would duplicate a system affordance and invite the user to manage storage we do not own.

What a run does if it starts before the download finishes. Open decision, and the only one this screen does not settle. Two candidates: wait (the run blocks on the pack, showing the existing progress subtitle) or fail cleanly (the normal .failed row with MISSING_DEP, Retry). Failing is nearly free — §2 below already builds that path — but waiting is kinder and matches “the appliance copes”. Decide before the Swift lands, not after.

Visible and disabled, not hidden. A researcher who has read that Bristlenose can redact needs to find out why they cannot, and a control that is simply absent answers nothing — they conclude the feature was dropped, or that they are looking in the wrong place. The row states the requirement in the position where the setting will appear once they upgrade.

Why gate the feature rather than raise the floor. The managed Background Assets API is macOS 26+, and it is the one whose downloader extension is a few lines rather than a hand-written one. Raising the app's floor to 26 would cost every user on 15–15.x the whole product to give some of them redaction; gating costs only the feature, only to them, and the gate deletes itself when the floor moves.

⚠ For this to work, PII must be wired into that mechanism — today it isn't. The stage-7 block in pipeline.py has no try/except and never calls mark_stage_failed, unlike transcribe / topics / quotes / clusters. A remove_pii() raise today propagates as an unclassified crash that can't reach the .failed subtitle at all. The fix is to wrap the stage and route to CauseCategoryEnum.MISSING_DEP / NETWORK like every other stage — no new UI, just the missing wiring. See the apparatus review below.

$ bristlenose run interviews/ --redact-pii
  ✓ Merged transcript          [2.1s]
    Downloading language model… ✓ [6s]
  ✓ Redacted PII (47 entities)  [3.4s]
  ✓ Topic segmentation          [11s]

# on failure — same fail-stop, classified:
  ✗ Redact PII — language model not installed
    Run python -m spacy download en_core_web_sm or reinstall.

Sequence. Phase 0 (reconcile the model name across stage guard · Presidio NlpEngine · spec, prove it in a real bundle) → wrap stage 7 in try/except routing to typed Cause + mark_stage_failed (this is what makes the .failed status line reachable) → native Privacy tab + piiEnabled UserDefaults key + one env line in BristlenoseShared.swift → copy & i18n. The toggle is the small part; the failure apparatus is the real work.