Add model management and macOS integration

PLAN.md

@@ -12,10 +12,10 @@ sessions, tools, and turn orchestration.
 
 | Area | Status | Available now | Still open |
 | --- | --- | --- | --- |
-| App shell | Implemented | Native Iced window, Codex-inspired two-pane layout, dark theme, embedded SVG icons, `Command-,` Preferences panel | Functional chat content and native app packaging |
+| App shell | Implemented | Native multi-window Iced app, Codex-inspired layout, native Application/Edit/Window menus, Preferences panel, and Model Manager window | Functional chat content and native app packaging |
 | Projects and sessions | Implemented for metadata | Native folder picker, project-name dialog, create/select/delete projects and sessions | Transcripts, KV payloads, rename/archive, and model binding |
 | Persistence | Implemented for metadata and preferences | SQLite in Application Support, Diesel ORM, embedded migrations, constrained defaults and CRUD tests | Messages, downloaded-artifact metadata, and session-runtime migrations |
-| Model runtime | Download workflow implemented | Persisted model choice, DSpark toggle, idle timeout, and Rust-native background main/DSpark downloads with progress, ETA, stop, restart-resume, size checks, and SHA-256 verification | Loading, inference, idle unloading, and Metal integration |
+| Model runtime | Download workflow implemented | Persisted model choice, DSpark toggle, idle timeout, and a Model Manager for background download, validation, deletion, progress, ETA, stop, and restart-resume | Loading, inference, idle unloading, and Metal integration |
 | Local endpoint | Not started | Nothing listening | OpenAI-compatible HTTP and streaming surfaces |
 | Agent | UI shell only | Empty conversation pane and composer placeholder | Messages, generation, tools, approvals, compaction, and cancellation |
 | A2UI | Future extension | bDS2 provides the reference structured render-tool contract | Native inline surfaces for local chat after core chat and tools are stable |
@@ -23,9 +23,10 @@ sessions, tools, and turn orchestration.
 | Release | Not started | Development binary builds and tests | `.app` packaging, signing, entitlements, and notarization |
 
 The application currently manages durable project/session metadata and model
-preferences, and can download the selected model's main and optional DSpark
-GGUF into managed Application Support storage without blocking the UI. It does
-not yet load a model, serve HTTP, save chat messages, or run an agent.
+preferences. Its separate Model Manager can download, validate, and delete
+main and DSpark GGUF artifacts in managed Application Support storage without
+blocking the UI. It does not yet load a model, serve HTTP, save chat messages,
+or run an agent.
 
 ## Phase 0 — project and session shell
 
@@ -204,17 +205,23 @@ chat or HTTP code re-parsing preference fields.
 
 ### Targeted downloads and storage
 
-- The Preferences panel can download the selected model's main GGUF and the
-  DSpark support GGUF when enabled. A dedicated worker thread performs HTTP and
-  verification work so Preferences and the rest of the application stay
-  interactive.
+- Preferences only selects the model/runtime configuration. A separate Model
+  Manager window, reachable from the native Window menu, lists every managed
+  main and DSpark artifact with its on-disk size and state, and provides
+  Download/Resume, Validate, Stop, and confirmed Delete actions.
+- A dedicated worker thread performs HTTP and verification work so the Model
+  Manager and the rest of the application stay interactive.
 - Use an in-process Rust HTTP client with Rustls rather than invoking a system
   downloader. Stream response chunks directly into a `.part` file and use a
   Rust SHA-256 implementation for verification.
 - Report aggregate bytes present, total bytes, bytes missing, percentage,
   smoothed transfer rate, current artifact/verification phase, and estimated
-  time remaining. Keep the detailed display in Preferences and a persistent
+  time remaining. Keep the detailed display in Model Manager and a persistent
   status bar with a Stop action while the transfer runs.
+- During SHA-256 verification, show a dedicated progress bar based on bytes
+  read and hashed rather than the already-complete file size. Update the bytes
+  verified, verification throughput, percentage, and estimated time remaining
+  throughout the pass so large models never appear stalled at 100%.
 - Stop is non-destructive: close the active transfer and retain its `.part`
   file. Starting the download again in the same process or after quitting and
   relaunching must derive progress from that file and issue an HTTP range
@@ -228,15 +235,13 @@ chat or HTTP code re-parsing preference fields.
   `~/Library/Application Support/DS4Server.rfc1437.de/models/<model-id>/` and
   mmap/load them from there. Do not place managed models in the app bundle or a
   project directory.
-- Download only the selected model's main artifact. Download its DSpark
-  artifact only when DSpark is enabled; never prefetch other catalog models or
-  optional artifacts.
+- Download only the artifact explicitly requested in Model Manager; never
+  prefetch other catalog models or optional artifacts.
 - Remove checksum-invalid partial files without touching a valid model. Keep
   partial files after cancellation, application exit, network failure, or an
   interrupted verification so they remain restart-resumable.
-- When the selected model changes or DSpark is disabled, offer removal of the
-  now-unused artifact; do not delete large existing downloads without explicit
-  confirmation.
+- Delete model artifacts only through an explicit, confirmed Model Manager
+  action; changing Preferences must never remove files.
 
 Exit criterion: select a supported DeepSeek V4 or GLM 5.2 GGUF, load it without
 blocking the UI only when a chat begins, run a deterministic prompt, unload it