daemon: wire the engine into veloxd — the vertical slice runs end to end

CORE stage 8 merged, so vdm::Engine is linkable. This closes D4a and
narrows D4b: `velox add <url>` now actually downloads.

- sched/engine_port_core.hpp — the real EnginePort: forwards to a live
  vdm::Engine, keeps the DownloadHandle per task for pause/resume/
  cancel/provide_auth/decide/refresh_url, drives set_task_order /
  set_max_active_segments / set_host_segment_cap via
  engine.segment_budget(). CORE confirmed the admission model: DAEMON
  decides when to start(); the engine's own download_task calls
  register_task/set_want internally — DAEMON never touches per-task
  budget calls. EnginePort gains release(TaskId) so the port drops a
  handle when the task goes terminal.
- rpc/event_loop — EventLoop::post(fn): thread-safe, runs fn on the
  loop thread next iteration. The marshaller for engine-thread
  callbacks.
- main.cpp — constructs vdm::Engine + EnginePortCore + Scheduler
  (post_to_loop = loop.post). At startup: reconcile_after_restart()
  (ADR 0013 §5), reload_config(), tick(). A 1 s timerfd on the loop
  re-runs tick() (schedule windows, missed nudges); download.add nudges
  via dispatcher.set_on_mutation.

End-to-end verified against tools/testserver: `velox add
http://127.0.0.1:.../file/512K` -> task queued -> scheduler admits ->
engine downloads 524288 bytes -> complete, file on disk. First
byte-path all the way through the project.

safepath-adversarial.md: re-verified per its own note — CORE landed
O_NOFOLLOW on the target open (core/src/io/sparse_file.cpp), so the
leaf-symlink TOCTOU is now closed; residual is down to one
intermediate-dir gap (documented post-M1 chase).

36 daemon/cli tests green; scheduler + uds_roundtrip TSan-clean.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/src/rpc/dispatcher.cpp

@@ -151,7 +151,7 @@ VeloxDispatcher::on_download_add(const proto::DownloadSpec& spec) {
     row.created_at = velox::daemon::now_iso();
     row.start_mode = spec.startMode ? std::string(proto::to_string(*spec.startMode)) : "auto";
     // startMode 'manual' parks the task in `new`; anything else makes it eligible for the
-    // scheduler (`queued`). The scheduler itself is not wired yet (deferrals.md D4).
+    // scheduler (`queued`); on_mutation_ nudges it.
     row.state = row.start_mode == "manual" ? "new" : "queued";
     row.category_id = spec.categoryId;
     row.queue_id = spec.queueId;
@@ -168,6 +168,8 @@ VeloxDispatcher::on_download_add(const proto::DownloadSpec& spec) {
         return std::unexpected(proto::HandlerError{proto::ErrorCode::InternalError,
                                                    "download.add: " + ins.error().message});
 
+    if (on_mutation_) on_mutation_();
+
     proto::DownloadAddResult r;
     r.taskId = row.task_id;
     if (auto st = proto::parse_TaskState(row.state)) r.state = *st;

daemon/src/rpc/dispatcher.hpp

@@ -12,6 +12,8 @@
 // "not implemented in this build" (-> -32603) until its handler and the scheduler land;
 // see daemon/docs/deferrals.md.
 
+#include <functional>
+
 #include "store/sqlite.hpp"
 #include "velox_proto.hpp"
 
@@ -21,6 +23,10 @@ class VeloxDispatcher final : public velox::proto::Dispatcher {
 public:
     explicit VeloxDispatcher(velox::daemon::store::Db& db) : db_(db) {}
 
+    // Called after a handler mutates task state (download.add for now). main.cpp wires it
+    // to nudge the scheduler; unset in tests.
+    void set_on_mutation(std::function<void()> fn) { on_mutation_ = std::move(fn); }
+
     velox::proto::HandlerResult<velox::proto::CaptureRules>
     on_capture_getRules(const velox::proto::CaptureGetRulesParams&) override;
     velox::proto::HandlerResult<velox::proto::CaptureOfferResult>
@@ -101,6 +107,7 @@ public:
 
 private:
     velox::daemon::store::Db& db_;
+    std::function<void()> on_mutation_;
 };
 
 }  // namespace velox::daemon::rpc

daemon/src/rpc/event_loop.cpp

@@ -45,6 +45,23 @@ void EventLoop::stop() noexcept {
     wake();
 }
 
+void EventLoop::post(std::function<void()> fn) {
+    {
+        std::lock_guard<std::mutex> lk(post_mu_);
+        posts_.push_back(std::move(fn));
+    }
+    wake();
+}
+
+void EventLoop::drain_posts() {
+    std::vector<std::function<void()>> batch;
+    {
+        std::lock_guard<std::mutex> lk(post_mu_);
+        batch.swap(posts_);
+    }
+    for (auto& fn : batch) fn();
+}
+
 void EventLoop::drain_wakeup() noexcept {
     std::uint64_t sink = 0;
     while (::read(wake_fd_, &sink, sizeof(sink)) > 0) {
@@ -87,6 +104,8 @@ void EventLoop::run() {
             if (p.revents != 0) fired.push_back(p.fd);
         }
 
+        drain_posts();
+
         for (const int fd : fired) {
             const auto it = fds_.find(fd);
             if (it == fds_.end()) continue;  // removed by an earlier callback this pass

daemon/src/rpc/event_loop.hpp

@@ -12,7 +12,9 @@
 #include <atomic>
 #include <cstdint>
 #include <functional>
+#include <mutex>
 #include <unordered_map>
+#include <vector>
 
 namespace velox::daemon::rpc {
 
@@ -52,6 +54,10 @@ public:
     // callback. Async-signal-safe.
     void wake() noexcept;
 
+    // Run `fn` on the loop thread at the next iteration. Thread-safe; the intended way to
+    // marshal an engine-thread callback back onto the RPC loop.
+    void post(std::function<void()> fn);
+
 private:
     struct Entry {
         unsigned interest;
@@ -59,11 +65,15 @@ private:
     };
 
     void drain_wakeup() noexcept;
+    void drain_posts();
 
     int wake_fd_;                      // eventfd, always registered
     bool running_ = false;
     std::atomic<bool> stop_requested_ = false;   // set from stop(), read by run()
     std::unordered_map<int, Entry> fds_;
+
+    std::mutex post_mu_;
+    std::vector<std::function<void()>> posts_;
 };
 
 }  // namespace velox::daemon::rpc