Once a model overflowed VRAM and Studio later died in a way that bypasses the
graceful path (SIGHUP from a closed terminal, SIGKILL/OOM, or a direct-uvicorn
launch), the llama-server child was orphaned and kept holding GPU memory. GPU
placement is recomputed every load from a live free-VRAM probe, so the leftover
process made every subsequent load (even a tiny model, even after a restart)
spill to system RAM until it was killed by hand.
The main llama-server spawn now records its PID to a pidfile under the active
studio root, removed on _kill_process. The startup reaper kills that exact PID
first (path-independent, so it catches an orphan the install-root match misses),
verifying it is still a llama-server to guard against PID reuse; the pidfile
only ever names a Studio-spawned server, so unrelated user processes (vllm,
games) are never touched. The existing root-gated enumeration stays as a
fallback. A belt-and-suspenders kill is also wired into the FastAPI lifespan
shutdown (before hardware/cache teardown) to cover the direct-uvicorn path that
run.py's signal handler does not.
PR_SET_PDEATHSIG is intentionally not used on the main spawn: llama-server is
launched on a pooled asyncio.to_thread worker, and a thread-scoped death signal
could prematurely kill a healthy server. The reaper runs before any model loads
on the next start, so it fully covers the user-visible problem.
Adds tests for the pidfile reap (kills a recorded live server, skips a reused
non-llama PID, cleans a stale/missing pidfile, clears on kill) and for the
lifespan kill (runs first, errors swallowed).
d97777e74a