daemon: wire the engine into veloxd — the vertical slice runs end to end

CORE stage 8 merged, so vdm::Engine is linkable. This closes D4a and
narrows D4b: `velox add <url>` now actually downloads.

- sched/engine_port_core.hpp — the real EnginePort: forwards to a live
  vdm::Engine, keeps the DownloadHandle per task for pause/resume/
  cancel/provide_auth/decide/refresh_url, drives set_task_order /
  set_max_active_segments / set_host_segment_cap via
  engine.segment_budget(). CORE confirmed the admission model: DAEMON
  decides when to start(); the engine's own download_task calls
  register_task/set_want internally — DAEMON never touches per-task
  budget calls. EnginePort gains release(TaskId) so the port drops a
  handle when the task goes terminal.
- rpc/event_loop — EventLoop::post(fn): thread-safe, runs fn on the
  loop thread next iteration. The marshaller for engine-thread
  callbacks.
- main.cpp — constructs vdm::Engine + EnginePortCore + Scheduler
  (post_to_loop = loop.post). At startup: reconcile_after_restart()
  (ADR 0013 §5), reload_config(), tick(). A 1 s timerfd on the loop
  re-runs tick() (schedule windows, missed nudges); download.add nudges
  via dispatcher.set_on_mutation.

End-to-end verified against tools/testserver: `velox add
http://127.0.0.1:.../file/512K` -> task queued -> scheduler admits ->
engine downloads 524288 bytes -> complete, file on disk. First
byte-path all the way through the project.

safepath-adversarial.md: re-verified per its own note — CORE landed
O_NOFOLLOW on the target open (core/src/io/sparse_file.cpp), so the
leaf-symlink TOCTOU is now closed; residual is down to one
intermediate-dir gap (documented post-M1 chase).

36 daemon/cli tests green; scheduler + uds_roundtrip TSan-clean.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/src/sched/engine_port.hpp

@@ -37,6 +37,9 @@ public:
     virtual void decide(vdm::TaskId, vdm::task::Decision) = 0;
     virtual void refresh_url(vdm::TaskId, const std::string& url) = 0;
 
+    // The daemon is done with this task (it went terminal). Drop the handle. Idempotent.
+    virtual void release(vdm::TaskId) = 0;
+
     // ADR 0011 admission surface. Values are DAEMON's; enforcement is the engine's.
     virtual void set_task_order(const std::vector<vdm::TaskId>& order) = 0;
     virtual void set_max_active_segments(std::uint32_t n) = 0;

daemon/src/sched/engine_port_core.hpp

@@ -0,0 +1,68 @@
+#pragma once
+
+// The real EnginePort: forwards to a live vdm::Engine and keeps the DownloadHandle per
+// task so pause/resume/cancel/… have something to call. All methods run on the RPC loop
+// thread (the Scheduler's thread); the handles map is only touched there.
+
+#include <unordered_map>
+
+#include "sched/engine_port.hpp"
+#include "vdm/engine.hpp"
+#include "vdm/task/download.hpp"
+
+namespace velox::daemon::sched {
+
+class EnginePortCore final : public EnginePort {
+public:
+    explicit EnginePortCore(vdm::Engine& engine) : engine_(engine) {}
+
+    vdm::TaskId start(const vdm::task::DownloadSpec& spec,
+                      vdm::task::DownloadCallbacks callbacks) override {
+        vdm::task::DownloadHandle h = engine_.start(spec, std::move(callbacks));
+        const vdm::TaskId id = h.id();
+        handles_.insert_or_assign(id, std::move(h));
+        return id;
+    }
+
+    void pause(vdm::TaskId id) override {
+        if (auto* h = find(id)) h->pause();
+    }
+    void resume(vdm::TaskId id) override {
+        if (auto* h = find(id)) h->resume();
+    }
+    void cancel(vdm::TaskId id, bool discard_partial) override {
+        if (auto* h = find(id)) h->cancel(discard_partial);
+    }
+    void provide_auth(vdm::TaskId id, const std::string& u, const std::string& p,
+                      bool remember) override {
+        if (auto* h = find(id)) h->provide_auth(u, p, remember);
+    }
+    void decide(vdm::TaskId id, vdm::task::Decision d) override {
+        if (auto* h = find(id)) h->decide(d);
+    }
+    void refresh_url(vdm::TaskId id, const std::string& url) override {
+        if (auto* h = find(id)) h->refresh_url(url);
+    }
+    void release(vdm::TaskId id) override { handles_.erase(id); }
+
+    void set_task_order(const std::vector<vdm::TaskId>& order) override {
+        engine_.segment_budget().set_task_order(order);
+    }
+    void set_max_active_segments(std::uint32_t n) override {
+        engine_.segment_budget().set_max_active_segments(n);
+    }
+    void set_host_segment_cap(const std::string& host, std::uint32_t cap) override {
+        engine_.segment_budget().set_host_segment_cap(host, cap);
+    }
+
+private:
+    vdm::task::DownloadHandle* find(vdm::TaskId id) {
+        auto it = handles_.find(id);
+        return it == handles_.end() ? nullptr : &it->second;
+    }
+
+    vdm::Engine& engine_;
+    std::unordered_map<vdm::TaskId, vdm::task::DownloadHandle> handles_;
+};
+
+}  // namespace velox::daemon::sched

daemon/src/sched/fake_engine_port.hpp

@@ -24,6 +24,7 @@ public:
     std::vector<vdm::TaskId> paused;
     std::vector<vdm::TaskId> resumed;
     std::vector<std::pair<vdm::TaskId, bool>> cancelled;
+    std::vector<vdm::TaskId> released;
     std::vector<std::vector<vdm::TaskId>> orders;
     std::vector<std::uint32_t> max_active_segments;
     std::vector<std::pair<std::string, std::uint32_t>> host_caps;
@@ -40,6 +41,7 @@ public:
     void provide_auth(vdm::TaskId, const std::string&, const std::string&, bool) override {}
     void decide(vdm::TaskId, vdm::task::Decision) override {}
     void refresh_url(vdm::TaskId, const std::string&) override {}
+    void release(vdm::TaskId id) override { released.push_back(id); }
     void set_task_order(const std::vector<vdm::TaskId>& order) override { orders.push_back(order); }
     void set_max_active_segments(std::uint32_t n) override { max_active_segments.push_back(n); }
     void set_host_segment_cap(const std::string& h, std::uint32_t c) override {

daemon/src/sched/scheduler.cpp

@@ -307,7 +307,10 @@ void Scheduler::on_engine_state(const std::string& wire_id, std::string_view eng
     }
 
     if (engine_state == "complete" || engine_state == "failed" || engine_state == "cancelled") {
-        if (auto eid = engine_id_of(wire_id)) unmap_engine(*eid);
+        if (auto eid = engine_id_of(wire_id)) {
+            engine_.release(*eid);
+            unmap_engine(*eid);
+        }
     }
 }