feat: re-download outdated model weights as a cancellable batch

[smb]

Closes #29

Summary

The bulk Re-download outdated removed before #24 landed comes back with the four things it was missing. Three commits: a behaviour-neutral package split, the session API change, the feature.

• Confirmation. Names the count and the size in the units the manager already prints (worst case "13 model weight(s) (6.3 GiB)"), says each old copy is deleted only once its replacement verifies, and says the other files in the obsolete directory stay until Delete outdated.
• Cancel. fetch() gains an optional cancellation check; the batch owns a CancellationState that reaches the downloader, so Cancel, Esc and the title-bar X stop it within one chunk (or the transport's 60 s stall bound). The dialog stays open and reports what it managed instead of hiding with work still running.
• Shutdown. ModelManagerController.close() cancels before it waits, so quitting no longer blocks behind a running fetch on the manager lock.
• Batch progress. The status line carries the model, its position and the rate.

Two decisions deviate from the issue's wish list and are recorded in its thread:

• Delete after verify, per model rather than clearing the namespace up front. remove_obsolete_versions() takes an optional model id. Transient double disk is one weight, not the set, and the old weights stay valid for the previous build until replaced.
• Stop at the first failure rather than continuing. Because deletion is per model, a stopped batch leaves the notice, the rows and the button truthful and one click resumes; continuing would work through up to nine further 60 s timeouts on a dead network and needs failure aggregation.

Lock discipline. While a worker thread lives, the GUI thread reads nothing that takes the manager lock; rows refresh once at the end. The test fake enforces this by raising if its active id is read during a fetch, so every test in the file checks the rule rather than one test asserting it.

jobs/models/session.py grows 432 to 439 lines, agreed with the maintainer before the baseline was updated. ui/model_manager.py became a package first (largest unit 464 lines) because the module stood at 753 against the 800-line budget.

Review

Design by Fable against the analysis in the #24 thread, implementation by the Codex model from that design, then reviewed.

Test plan

• uv run ruff check . && uv run mypy src && QT_QPA_PLATFORM=offscreen uv run pytest -q: 1618 passed, 4 skipped; 1604 before this branch.
• New: the confirmation text and size, per-model fetch-then-delete order, batch position in the status line, cancel stopping the batch and keeping the rest outdated, Esc cancelling instead of hiding, dismissal ignored during a removal, stop at the first failure, close() cancelling before waiting, a single download cancelled without a warning box, refusal while a job runs, and the fake's lock-rule assertion across all of them.

🤖 Generated with Claude Code

[smb]

Reviewed by Fable against the design and the guardrails, with the three commits in hand. It found no lock-rule violation in the code, no repeat of the #27 thread-lifetime shape, no path that escapes the cache root, and no vacuous test. Five things were worth acting on and are in the branch now (the two feature commits were amended, so the branch was force-pushed with lease):

• A guardrail violation in a commit body. The split commit stated a test pass count, which G1a forbids outright. Reworded to state what was actually verified about the move instead.
• close() did not close the dialog. It called dialog.close() while the dialog was still busy, so the new reject() override turned that into a cancel request on a controller whose state had just been cleared, and the dialog stayed visible. It now releases the busy state after joining, then closes.
• The lock guard was weaker than the commit claimed. The fake raises when its active id is read during a fetch, but every blocking test blocked the first model, so the slots that run between models raced past the guard. The successful-batch test now blocks on its second model, which puts those slots inside a held lock. The commit body no longer overstates the coverage.
• Two missing pieces from the design's test list: the close-cancels test now covers the single-download path as well as the batch, and the full-batch test asserts the notice still shows the untouched non-V1 file's size.

Three findings are deliberately left, and two of them are the design being wrong rather than the code:

• Cancel during a stalled connection is reported as a failure. download.py checks cancellation before the read, so a transport timeout surfaces first; on the single path that means the warning box the user was told Cancel avoids. Rare, and the fix belongs in the cancellation check order, not here.
• A delete that fails after a verified download is reported as that model's download failure, so the count and the message understate what is on disk; the rows are truthful after the refresh. The design accepted this to avoid a special case.
• The per-model deletion checks the leaf for a symlink, not the version directory. A user-planted symlink at cache_root/2.0.72 would be followed where the whole-directory call skipped it. No observed trigger, so G1 says leave it.