Lock model switcher while running, rework Settings Server section (#29)

* feat: lock model switching while running and rework Settings' Server group

- The popup variant picker locks while ds4-server is starting/ready; switching
  models takes Stop first.
- Settings: the V4 Flash/V4.1 variant pickers move into the Server group just
  above Apply & Restart, cleanup folds into Downloads, and the App/Server/picker
  prose is gone.
- Apply & Restart enables only while the live Server-group controls differ from
  the running server's published launch config (LaunchConfig), and Start clears
  the dirty state too.
- "Concurrent sessions" becomes a fits-bounded "Parallel chats & agents"
  stepper with a live per-slot memory/fit caption.
- V4.1 Flash: shorter 41-q2/41-q4 labels (prefixes kept) and a 1,048,576 default
  when the 1M window fits fully resident, else upstream's 32,768.
- The Settings window matches the wired-limit help pane's 600-wide frame, with
  content height capped at 820.

* fix: report zero fitting sessions when none pass the wired-limit gate

The sessions caption claimed one slot fit whenever even a single session needed
the Start-anyway override. maxFittingSessions now returns 0 when nothing
passes, Settings renders a distinct no-slot-fits caption, and the stepper
range keeps its one-slot minimum.

* fix: clear active config when server launch fails

* fix: terminate the timed-out server before publishing the startup failure

* fix: clear active config on every runtime error transition

* fix: stop failed server before allowing retry

* fix: stop the stderr reader when a server launch fails

* test: pin the refused-launch path in the stderr reader source guard

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: notatestuser

README.md

@@ -61,7 +61,7 @@ make -C external/ds4 -j ds4-server          # build the ds4-server binary
 DS4_DIR="$PWD/external/ds4" swift run        # build + run the dev app against the submodule
 ```
 
-`DS4_DIR` points the app at that ds4 checkout so **Start** can spawn `ds4-server` — without it the dev build looks for a bundled `ds4/` next to the binary and won't find the server. It's a menu-bar app (no dock icon): after launch, click the bolt icon in the macOS menu bar, pick **Pro**, **V4.1 Flash**, or **Flash (0731)** (preselected by your RAM), then **Download** (if the model isn't present) and **Start**.
+`DS4_DIR` points the app at that ds4 checkout so **Start** can spawn `ds4-server` — without it the dev build looks for a bundled `ds4/` next to the binary and won't find the server. It's a menu-bar app (no dock icon): after launch, click the bolt icon in the macOS menu bar, pick **Pro**, **V4.1 Flash**, or **Flash (0731)** (preselected by your RAM), then **Download** (if the model isn't present) and **Start**. The popup's picker locks while the server is loading or running, so switching models later takes **Stop** first; the per-generation weight choice lives in Settings next to **Apply & Restart Server**.
 
 ## Requirements
 
@@ -90,7 +90,7 @@ sudo sysctl iogpu.wired_limit_mb=<value shown in the popup>
 
 and a "Metal wired limit help…" window walks through it step by step — including making it survive reboots (the sysctl resets on every restart, which is why a setup that worked before can hang after one). A confirmed "Start anyway" override remains if you know your setup works. This applies most often to 96–127 GiB machines running Flash q2, but also to V4 Pro on 512 GiB and Flash q2-q4 at 1M context on 128 GiB when their default cap is below the working set.
 
-**Default context** is `1,000,000` for Pro and for Flash on ≥ 128 GiB; Flash on 96–127 GiB defaults to `256,000`; **V4.1 Flash defaults to `32,768`** (upstream's documented SSD-streaming configuration — raise it in Settings when memory allows, up to its 1,048,576 ceiling). Max Think is unavailable below 128 GiB, including in the built-in chat and coding-agent launcher. For V4.1 Flash, `--ssd-streaming` is passed automatically when full residency doesn't fit and full GPU power is always used; Engram rows stream from the SSD in every mode, so keep the GGUF on a fast local disk. You can otherwise override the context in Settings, subject to the physical-memory and wired-limit checks above.
+**Default context** is `1,000,000` for Pro and for Flash on ≥ 128 GiB; Flash on 96–127 GiB defaults to `256,000`; **V4.1 Flash defaults to `1,048,576` when the 1M window fits fully resident at your RAM tier (41-q2 from 256 GiB, 41-q4 from 384 GiB), else to `32,768`** (upstream's documented SSD-streaming configuration — raise it in Settings when memory allows, up to its 1,048,576 ceiling). Max Think is unavailable below 128 GiB, including in the built-in chat and coding-agent launcher. For V4.1 Flash, `--ssd-streaming` is passed automatically when full residency doesn't fit and full GPU power is always used; Engram rows stream from the SSD in every mode, so keep the GGUF on a fast local disk. You can otherwise override the context in Settings, subject to the physical-memory and wired-limit checks above.
 
 ## Thinking
 

Sources/DS4Control/Model/Feasibility.swift

@@ -671,13 +671,22 @@ func defaultFlash41Quant(ramGiB: Double) -> Flash41Quant {
 
 /// Default context, tiered by model generation and machine memory. V4 Pro and ≥128 GiB
 /// Flash (q2-q4 quant) run the full 1M window all-resident; 96–127 GiB Flash (q2) is
-/// capped at 256K. V4.1 Flash defaults to 32,768 — upstream's documented SSD-streaming
-/// configuration (docs/MODELS.md@bd66c40); raise it from Settings when memory allows.
+/// capped at 256K. V4.1 Flash defaults to the 1,048,576 ceiling when the machine holds that
+/// window fully resident (the auto `--ssd-streaming` heuristic says no streaming is needed
+/// at this RAM tier — 41-q2 from 256 GiB, 41-q4 from 384 GiB), else to upstream's documented
+/// 32,768 SSD-streaming configuration (docs/MODELS.md@bd66c40); both are adjustable from
+/// Settings.
 func defaultCtx(ramGiB: Double, selection: QuantSelection) -> Int {
-    switch selection.variant {
+    switch selection {
     case .pro: return Variant.pro.ctxCeiling
     case .flash: return ramGiB >= 128 ? Variant.flash.ctxCeiling : 256_000
-    case .flash41: return 32_768
+    case .flash41(let q):
+        guard ramGiB >= flash41MinRamGiB(q) else { return 32_768 }
+        let ceiling = Variant.flash41.ctxCeiling
+        let streaming = flash41UsesSSDStreaming(
+            ramGiB: ramGiB, wiredLimitMB: wiredLimitAdvisoryMB(ramGiB: ramGiB),
+            quant: q.quant, ctx: ceiling, sessions: 1)
+        return streaming ? 32_768 : ceiling
     }
 }
 
@@ -743,3 +752,22 @@ func feasibility(
         ramGiB: ramGiB, selection: variant == .pro ? .pro : .flash(flashQuant),
         ctx: ctx, wiredLimitMB: wiredLimitMB, sessions: sessions)
 }
+
+/// Largest resident-session count whose launch config passes the wired-limit gate at the
+/// live limit without the "Start anyway" override, capped at `maxConcurrentSessions`.
+/// Returns 0 when even one session fails the gate — the config needs the override (or is
+/// blocked outright), which the Start/Restart gate reports; callers keep the stepper's
+/// minimum at one.
+func maxFittingSessions(
+    ramGiB: Double, selection: QuantSelection, ctx: Int, wiredLimitMB: Int
+) -> Int {
+    for sessions in stride(from: maxConcurrentSessions, through: 1, by: -1) {
+        if case .standard = feasibility(
+            ramGiB: ramGiB, selection: selection, ctx: ctx, wiredLimitMB: wiredLimitMB,
+            sessions: sessions)
+        {
+            return sessions
+        }
+    }
+    return 0
+}

Sources/DS4Control/Model/ServerState.swift

@@ -22,6 +22,10 @@ enum ServerState: Equatable {
     case ready
     case stopping
     case error(ServerError)
+
+    /// A ds4-server process is loading or serving. The popup locks its model picker then:
+    /// it has no Apply & Restart affordance, so switching models means Stop first.
+    var isServerActive: Bool { self == .starting || self == .ready }
 }
 
 struct DownloadProgress: Equatable {

Sources/DS4Control/Model/Variant.swift

@@ -212,12 +212,12 @@ enum Flash41Quant: String, CaseIterable, Identifiable, Codable {
         case .q4: return .q41Q4
         }
     }
-    /// Picker label: generation + internal key + resident size, e.g.
-    /// "41-q2 · ~152 GiB resident (341 GiB on disk)".
+    /// Picker label: weights key + resident main weights + file size on disk (the file also
+    /// carries ~189 GiB of disk-only Engram tables), e.g. "41-q2 · ~152 GiB (341 GiB on disk)".
     var label: String {
         switch self {
-        case .q2: return "41-q2 · ~152 GiB resident (341 GiB on disk)"
-        case .q4: return "41-q4 · ~294 GiB resident (483 GiB on disk)"
+        case .q2: return "41-q2 · ~152 GiB (341 GiB on disk)"
+        case .q4: return "41-q4 · ~294 GiB (483 GiB on disk)"
         }
     }
 }

Sources/DS4Control/Services/ProcessRunner.swift

@@ -61,6 +61,10 @@ protocol ProcessRunner: AnyObject {
     var isRunning: Bool { get }
 }
 
+enum ProcessRunnerError: Error, Equatable {
+    case alreadyRunning
+}
+
 /// Buffers a process's stderr into newline-delimited lines. `FileHandle` invokes the
 /// readability handler serially on its own private queue, so the mutable buffer is never
 /// accessed concurrently — hence the `@unchecked Sendable` conformance (Swift 6 mode).
@@ -90,9 +94,10 @@ private final class StderrLineReader: @unchecked Sendable {
 
 final class RealProcessRunner: ProcessRunner {
     private var process: Process?
+    private let processLock = NSLock()
     private let queue = DispatchQueue(label: "ds4.process")
 
-    var isRunning: Bool { process?.isRunning ?? false }
+    var isRunning: Bool { processLock.withLock { process?.isRunning ?? false } }
 
     func launch(
         executable: URL, args: [String], cwd: URL, env: [String: String],
@@ -118,8 +123,20 @@ final class RealProcessRunner: ProcessRunner {
             reader.stop()
             onExit(proc.terminationStatus)
         }
-        try p.run()
-        self.process = p
+        do {
+            try processLock.withLock {
+                guard process?.isRunning != true else { throw ProcessRunnerError.alreadyRunning }
+                try p.run()
+                process = p
+            }
+        } catch {
+            // Neither a refused launch nor a failed `Process.run()` reaches
+            // `terminationHandler` — the only other reader stop — so clear the handler or it
+            // leaks with the pipe's descriptors (reader → FileHandle → readabilityHandler
+            // keeps the cycle alive).
+            reader.stop()
+            throw error
+        }
     }
 
     static func childEnvironment(
@@ -132,7 +149,7 @@ final class RealProcessRunner: ProcessRunner {
     }
 
     func terminate(graceSeconds: Double) {
-        guard let p = process else { return }
+        guard let p = processLock.withLock({ process }) else { return }
         // download_model.sh spawns `hf` as a child; SIGTERM to the shell alone orphans
         // hf, which keeps holding the hf download lock and blocks the next attempt.
         // Capture descendants *before* killing (they reparent to launchd once the shell