@@ -97,6 +97,7 @@
 | `errors:clear` | notification (we consume) | ✅ yes |
 | `errors:report` | notification (we consume) | ✅ yes |
 | `engine:action` | request (we call) | ✅ yes |
+| `engine:cancel-pull` | request (we call) | ✅ yes |
 | `engine:configure-launch` | request (we call) | ⚠️ not called |
 | `engine:configured-ports` | request (we call) | ⚠️ not called |
 | `engine:describe` | request (we call) | ⚠️ not called |
@@ -109,6 +110,7 @@
 | `engine:prepare-shutdown` | request (we call) | ✅ yes |
 | `engine:preview-launch` | request (we call) | ⚠️ not called |
 | `engine:remote-apply-settings` | request (we call) | ⚠️ not called |
+| `engine:remote-cancel-pull` | request (we call) | ✅ yes |
 | `engine:remote-delete-model` | request (we call) | ✅ yes |
 | `engine:remote-get-installed` | request (we call) | ✅ yes |
 | `engine:remote-get-settings` | request (we call) | ⚠️ not called |
 
@@ -267,15 +267,116 @@ the engine simply shows as stopped and then running.
 
 A local `pull_model` streams live download progress: the engine-manager routes
 `engine:action{pull_model}` through its streaming pull path and emits
-`engine:pull-progress` (`{ engine, op, stage, percent, message }`) — the local
+`engine:pull-progress` (`{ engine, model, op, stage, percent, message }`) — the local
 counterpart of `engine:remote-progress`. Personal AI Router consumes it in
 `applyLocalEngineProgress` (`modular-supervisor.ts` → `modular-state.ts`),
-backfilling the dispatched model (the frame carries none) and advancing the
-optimistic pull entry's percent in place, so a local pull shows "Pulling · N%"
+keying the frame to its optimistic pull entry by model and advancing that
+entry's percent in place, so a local pull shows "Pulling · N%"
 to completion just like a remote pull. The awaited action response owns
-completion (clearing the entry and refreshing the model list); a CLI-driven pull
-(LM Studio) emits a single `pulling` marker and degrades to the indeterminate
-spinner.
+completion (clearing the entry and refreshing the model list). LM Studio's CLI
+progress updates the same percentage display. A pull for an engine that already
+has one running is reported as `stage:"queued"` until its turn.
+
+The pull request itself stays pending for the whole download, so it is the
+request's own response that reports the outcome — a completion or a
+cancellation — while progress arrives out of band on the notification:
+
+```mermaid
+sequenceDiagram
+    participant UI as Model Manager
+    participant Bridge as Electron bridge
+    participant Manager as Engine manager
+    participant Engine as Ollama or LM Studio
+
+    UI->>Bridge: Download model
+    Bridge->>UI: Show optimistic "Pulling…" row
+    Bridge->>Manager: Start pull (request remains pending)
+    Manager->>Manager: Record the partial files already on disk
+    Manager->>Engine: Begin download
+
+    loop While downloading
+        Engine-->>Manager: Download status
+        Manager-->>Bridge: Progress {engine, model, stage, percent}
+        Bridge-->>UI: Update the matching model row
+    end
+
+    alt Download completes
+        Engine-->>Manager: Success
+        Manager-->>Bridge: Original pull request completes
+    else User cancels
+        UI->>Bridge: Cancel download
+        Bridge->>UI: Show "Canceling…"
+        Bridge->>Manager: Cancel {engine, model}
+        Manager->>Engine: Stop transfer
+        Manager->>Manager: Remove the partial files this pull created
+        Manager-->>Bridge: Cancellation completes
+        Manager-->>Bridge: Original pull settles as canceled
+    end
+
+    Bridge->>Manager: Refresh model list
+    Manager-->>Bridge: Authoritative models
+    Bridge->>UI: Replace temporary download state
+```
+
+`engine:cancel-pull` and `engine:remote-cancel-pull` cancel the selected model
+download. The UI keeps "Canceling…" visible until the pull settles, including
+when the cancel RPC's own budget elapses first — the backend is still working,
+so the row is not dropped back to "Downloading". Ollama closes the pull request
+and removes partial blobs named by its progress digests; LM Studio receives
+Ctrl+C and a negative answer to its background-download prompt, and after
+acknowledgement the partial files carrying the requested quantization are
+removed. Completed model files, other quantizations, and unrelated downloads are
+retained, and a cancellation the CLI never confirmed deletes nothing. Only a
+cancellation someone requested removes files: a pull interrupted by app
+shutdown, a dropped remote connection, or the action timeout leaves its partial
+data resumable.
+
+Both engines funnel every client on the machine into one cache, so naming a file
+is not the same as owning it — Ollama blobs are content-addressed, and the LM
+Studio app downloads into the same repository directory. Each pull therefore
+records the partial files already present before it starts, and cancelling it
+considers only the ones that appeared afterwards. A file that is still growing
+once the transfer has stopped is shared with another client even by that
+measure, so it survives as well:
+
+```mermaid
+flowchart TD
+    Request["Model pull requested"] --> Tracked["Track by engine + model"]
+    Tracked --> Busy{"Another PAIR pull active<br/>for this engine?"}
+
+    Busy -- No --> Snapshot["Record the partial files<br/>already on disk"]
+    Busy -- Yes --> Queued["Show as queued"]
+
+    Queued --> QueueCancel{"Canceled while queued?"}
+    QueueCancel -- Yes --> NeverStarted["Remove operation<br/>without starting download"]
+    QueueCancel -- No --> Wait["Wait for active pull to settle"]
+    Wait --> Snapshot
+
+    Snapshot --> Active["Start download"]
+    Active --> Cancel{"Cancellation requested?"}
+    Cancel -- No --> Complete["Download completes normally"]
+    Cancel -- Yes --> Engine{"Which engine?"}
+
+    Engine -- Ollama --> OllamaStop["Close HTTP pull request"]
+    OllamaStop --> OllamaCandidates["Select partial blobs named<br/>by this pull's digests"]
+
+    Engine -- LM Studio --> LMSStop["Send Ctrl+C"]
+    LMSStop --> LMSPrompt["Answer no to background download"]
+    LMSPrompt --> LMSCandidates[".part files carrying the<br/>requested quantization"]
+
+    OllamaCandidates --> Owned{"Absent from<br/>the snapshot?"}
+    LMSCandidates --> Owned
+    Owned -- No --> Preserve["Preserve completed,<br/>shared, and unrelated files"]
+    Owned -- Yes --> Quiet{"Held still across<br/>repeated checks?"}
+    Quiet -- No --> Preserve
+    Quiet -- Yes --> Delete["Remove the partial file"]
+
+    Delete --> Settle["Settle pull and refresh models"]
+    Preserve --> Settle
+    Complete --> Settle
+    NeverStarted --> Settle
+    Settle --> Next["Allow next queued pull to start"]
+```
 
 `engine:models` (and the `em` `GET /v1/models` surface) returns the flat model
 union, the per-engine breakdown (`modelsByEngine`), and the per-engine set of
 
@@ -250,6 +250,11 @@ function routeEngineManagerCommand(payload: WsInvokeRequest<'engine:command'>):
                 void supervisor.pullModel(engine, payload.engineType, payload.model)
             }
             break
+        case 'cancelModelPull':
+            if (payload.model) {
+                void supervisor.cancelModelPull(engine, payload.engineType, payload.model)
+            }
+            break
         case 'deleteModel':
             if (payload.model) {
                 void supervisor.deleteModel(engine, payload.engineType, payload.model)
@@ -365,6 +370,11 @@ function routeRemoteEngineCommand(payload: WsInvokeRequest<'engine:command'>): v
                 void supervisor.pullModelRemote(nodeId, engine, payload.engineType, payload.model)
             }
             break
+        case 'cancelModelPull':
+            if (payload.model) {
+                void supervisor.cancelModelPull(engine, payload.engineType, payload.model, nodeId)
+            }
+            break
         case 'uninstall':
         case 'update':
             refuseRemote(
 
@@ -22,6 +22,13 @@ interface JsonRpcError {
 
 export class JsonRpcResponseError extends Error {}
 
+/**
+ * The request's own budget elapsed. The backend has not answered and has not
+ * failed either — it is still working — so a caller that showed optimistic
+ * state must decide whether to keep it rather than assume the operation lost.
+ */
+export class JsonRpcTimeoutError extends Error {}
+
 type JsonRpcId = number | string
 
 interface JsonRpcMessage {
@@ -148,7 +155,7 @@ export class JsonRpcSubprocess extends EventEmitter<JsonRpcSubprocessEvents> {
                     ? undefined
                     : setTimeout(() => {
                           this.pending.delete(id)
-                          reject(new Error(`${this.name} ${method} timed out`))
+                          reject(new JsonRpcTimeoutError(`${this.name} ${method} timed out`))
                       }, timeoutMs)
             this.pending.set(id, { resolve, reject, timeout })
             this.write(message).catch(err => {
 
@@ -948,6 +948,7 @@ class ModularBridgeState {
      * replay it after a UI refresh mid-download.
      */
     private activePulls = new Map<string, EngineProgress>()
+    private cancelingPulls = new Map<string, string>()
     /**
      * Authoritative remote-engine facts keyed by {@link remoteOpKey}
      * (`${nodeId}:${engineType}`). Populated by the supervisor from each
@@ -960,27 +961,6 @@ class ModularBridgeState {
      * evicted.
      */
     private remoteEngineFacts = new Map<string, RemoteEngineFacts>()
-    /**
-     * The model of an in-flight remote pull keyed by {@link remoteOpKey}. The
-     * backend's `engine:remote-progress` frames carry **no** `model` field
-     * (`nvpair-engine-manager/remote.go` `remoteProgress`), so we stamp the model
-     * we dispatched with here and backfill it onto every incoming frame — that
-     * keeps the optimistic entry, the streamed percent updates, and the terminal
-     * clear all on one {@link engineProgressKey}. Cleared by
-     * {@link finishRemoteModelPull}.
-     */
-    private remotePullModels = new Map<string, string>()
-    /**
-     * The model of an in-flight local pull keyed by `engineType`. The backend's
-     * `engine:pull-progress` frames (the local counterpart of
-     * `engine:remote-progress`) carry **no** `model` field
-     * (`nvpair-engine-manager/executor.go` `emitPullProgress`), so we stamp the
-     * model we dispatched here and backfill it onto every incoming frame — one
-     * active local pull per engine, matching the backend's engine-scoped
-     * progress hub. Set by {@link beginModelPull}, cleared by
-     * {@link finishModelPull}.
-     */
-    private localPullModels = new Map<EngineType, string>()
     /**
      * The authoritative set of live inbound invites awaiting the local user's PIN
      * entry, keyed by `inviteId`. The cluster-manager pushes `cluster:invite-received`
@@ -1492,9 +1472,6 @@ class ModularBridgeState {
             model,
             status: 'pulling'
         }
-        // Remember the model so the model-less `engine:remote-progress` frames can
-        // be re-associated with this exact entry (see remotePullModels).
-        this.remotePullModels.set(this.remoteOpKey(nodeId, engineType), model)
         this.activePulls.set(engineProgressKey(progress), progress)
         emitBridgePush('engines:progress-changed', progress)
     }
@@ -1515,8 +1492,8 @@ class ModularBridgeState {
      * is the only signal that removes the spinner.
      */
     finishRemoteModelPull(nodeId: string, engineType: EngineType, model: string): void {
-        this.remotePullModels.delete(this.remoteOpKey(nodeId, engineType))
         const key = engineProgressKey({ nodeId, engineType, operation: 'pull', model })
+        this.cancelingPulls.delete(key)
         if (!this.activePulls.delete(key)) return
         emitBridgePush('engines:progress-cleared', { key })
     }
@@ -1531,28 +1508,22 @@ class ModularBridgeState {
         const op = stringValue(obj.op)
         const operation = op === 'pull' || op === 'pull_model' ? 'pull' : 'install'
         const stage = stringValue(obj.stage) || 'working'
-        // `engine:remote-progress` carries no `model`, so for a pull we backfill
-        // the model captured at dispatch — otherwise the frame would emit under a
-        // different key than the optimistic entry and never update/clear it.
-        const model =
-            stringValue(obj.model) ||
-            (operation === 'pull'
-                ? (this.remotePullModels.get(this.remoteOpKey(nodeId, engineType)) ?? '')
-                : '')
+        // The peer stamps the model on every pull frame it relays
+        // (`nvpair-engine-manager/remote.go` `remoteProgressFn`), which is what
+        // keys a frame to its optimistic entry. An install carries none, and
+        // needs none: its progress is tracked per engine.
+        const model = stringValue(obj.model)
 
         if (stage === 'done' || stage === 'already-installed' || stage === 'failed') {
             const progressKey =
                 operation === 'pull' && model
                     ? engineProgressKey({ nodeId, engineType, operation: 'pull', model })
                     : `${nodeId}:${engineType}:${operation}`
             emitBridgePush('engines:progress-cleared', { key: progressKey })
-            if (operation === 'pull') {
-                this.remotePullModels.delete(this.remoteOpKey(nodeId, engineType))
-                if (model) {
-                    this.activePulls.delete(
-                        engineProgressKey({ nodeId, engineType, operation: 'pull', model })
-                    )
-                }
+            if (operation === 'pull' && model) {
+                this.activePulls.delete(
+                    engineProgressKey({ nodeId, engineType, operation: 'pull', model })
+                )
             }
             if (stage === 'already-installed' || stage === 'failed') {
                 this.clearRemoteEngineOp(nodeId, engineType)
@@ -1590,7 +1561,7 @@ class ModularBridgeState {
             nodeId,
             nodeName: node?.name ?? nodeId,
             operation,
-            status: stage,
+            status: this.cancelingPulls.has(pullKey) ? 'canceling' : stage,
             percent,
             model: model || undefined
         }
@@ -1820,7 +1791,6 @@ class ModularBridgeState {
     private dropRemoteEngineFacts(nodeId: string): void {
         for (const engine of PROXY_ENGINES) {
             this.remoteEngineFacts.delete(this.remoteOpKey(nodeId, engine))
-            this.remotePullModels.delete(this.remoteOpKey(nodeId, engine))
         }
     }
 
@@ -2180,9 +2150,6 @@ class ModularBridgeState {
             model,
             status: 'pulling'
         }
-        // Remember the model so the model-less `engine:pull-progress` frames can
-        // be re-associated with this exact entry (see localPullModels).
-        this.localPullModels.set(engineType, model)
         this.activePulls.set(engineProgressKey(progress), progress)
         emitBridgePush('engines:progress-changed', progress)
     }
@@ -2191,12 +2158,13 @@ class ModularBridgeState {
      * Project a `nvpair-engine-manager` `engine:pull-progress` for the local node
      * — the local counterpart of `engine:remote-progress`: live
      * download progress for a model pull driven via `engine:action`
-     * `pull_model`. The frame carries `{ engine, op, stage, percent, message }`
-     * and **no** `model`, so we backfill the model captured at dispatch and
-     * refresh the optimistic entry in place. Clearing stays with the awaited pull
-     * ({@link finishModelPull}), so this only advances percent/stage: it ignores
-     * the terminal error sentinel (`percent: -1`) and the non-download frames'
-     * `percent: 0` so the rendered bar never jumps backwards.
+     * `pull_model`. The frame carries `{ engine, model, op, stage, percent,
+     * message }` and its `model` identifies which optimistic entry to refresh —
+     * the backend queues concurrent pulls per engine, so the engine alone does
+     * not. Clearing stays with the awaited pull ({@link finishModelPull}), so
+     * this only advances percent/stage: it ignores the terminal error sentinel
+     * (`percent: -1`) and the non-download frames' `percent: 0` so the rendered
+     * bar never jumps backwards.
      */
     applyLocalEngineProgress(params: JsonValue | undefined): void {
         const nodeId = this.selfId
@@ -2206,7 +2174,7 @@ class ModularBridgeState {
         const engineType = engineTypeFromManagerName(stringValue(obj.engine))
         if (!engineType) return
 
-        const model = this.localPullModels.get(engineType)
+        const model = stringValue(obj.model)
         if (!model) return
         const key = engineProgressKey({ nodeId, engineType, operation: 'pull', model })
         const existing = this.activePulls.get(key)
@@ -2215,7 +2183,9 @@ class ModularBridgeState {
         const percent = numberValue(obj.percent)
         const progress: EngineProgress = {
             ...existing,
-            status: stringValue(obj.stage) || existing.status,
+            status: this.cancelingPulls.has(key)
+                ? 'canceling'
+                : stringValue(obj.stage) || existing.status,
             percent: mergePullProgressPercent(percent, existing.percent)
         }
         this.activePulls.set(key, progress)
@@ -2235,12 +2205,31 @@ class ModularBridgeState {
     finishModelPull(engineType: EngineType, model: string): void {
         const nodeId = this.selfId
         if (!nodeId) return
-        this.localPullModels.delete(engineType)
         const key = engineProgressKey({ nodeId, engineType, operation: 'pull', model })
+        this.cancelingPulls.delete(key)
         if (!this.activePulls.delete(key)) return
         emitBridgePush('engines:progress-cleared', { key })
     }
 
+    setModelPullCanceling(
+        engineType: EngineType,
+        model: string,
+        canceling: boolean,
+        nodeId = this.selfId
+    ): boolean {
+        if (!nodeId) return false
+        const key = engineProgressKey({ nodeId, engineType, operation: 'pull', model })
+        const existing = this.activePulls.get(key)
+        if (!existing || (canceling && this.cancelingPulls.has(key))) return false
+        const status = canceling ? 'canceling' : (this.cancelingPulls.get(key) ?? existing.status)
+        if (canceling) this.cancelingPulls.set(key, existing.status)
+        else this.cancelingPulls.delete(key)
+        const progress = { ...existing, status }
+        this.activePulls.set(key, progress)
+        emitBridgePush('engines:progress-changed', progress)
+        return true
+    }
+
     getLogs(): LogEntry[] {
         return [...this.logs]
     }