daemon: D3's remainder — rules.*, queue.reorder, schedule.*, limiter.*, download.update/refreshUrl

rules.list/rules.upsert: new store/rules.{hpp,cpp} (list in priority order; apply()
upserts+removes atomically, generating an id when absent, per the schema's own "never
leaves the table in a half-valid state"). Found and fixed along the way: migration
0001's rules table had no column for Rule.name at all — every rules.list/.upsert call
failed outright ("no such column: name"), unit tests included, since :memory: migrates
through the same path. Migration 0004 adds it.

queue.reorder: new store::Queues::reorder — taskIds must be an exact permutation of
the queue's current membership (compared as sorted sets) or nothing is written and
-32602 names the queue; a valid permutation rewrites every member's queue_position in
one transaction.

schedule.get/schedule.set: a thin wrapper over the queues.schedule column (already
read since D3b, never independently settable). nextRunAt is deliberately left unset —
computing it needs the same local-time, DST-aware window logic
sched/schedule_window.hpp's window_open() only has half of; called out rather than
approximated, and the field is optional.

limiter.get/limiter.set: backed by the same downloads.speedLimitEnabled/
downloads.speedLimitBps settings keys D9 already wired — one bag of truth, not two.
The new part is reaching the engine: EnginePort/TaskActionPort gain
set_global_speed_limit(bps) (0 = unlimited, TokenBucket's own convention), wired to
Engine::rate_limiter().set_global_limit(). Pushed live on every limiter.set *and* on
Scheduler::reload_config() so a limit from a previous run isn't silently unlimited
again after a restart. applyToRunning is accepted but has no lever to pull
differently — a single shared global bucket has no "next task only" variant. Also
found, not chased further: the schema's "globalBps:0 with enabled:true means 'stop
everything'" is the opposite of what TokenBucket does with rate_bps==0 (unlimited) —
a real discrepancy, but the schema says the GUI must not offer that combination.

download.update: "moving saveDir or filename moves the file on disk in the same
operation" — resolved and root-checked like download.add's destination, then the
.veloxpart/.veloxpart.meta pair (or the finished file, if complete) is moved via
rename, falling back to copy+remove across filesystems, only when the resolved
location actually differs. categoryId/queueId(appended to the new queue's run
order)/description/segments/bufferBytes/checksum apply through new
store::Tasks::apply_update.

download.refreshUrl: same async server-layer special-case as download.probe (a real
network round trip, same 30s deadline). Re-probes, flags contentChanged only when
size or validator are both known and actually differ, persists the new URL and probe
result, and swaps the URL on a live engine handle via a newly-widened
EnginePort::refresh_url (now takes headers too, matching DownloadHandle's real
signature — the seam had silently dropped them).

Found and documented, not fixed: the generated parser collapses "field absent" and
"field explicitly null" to the same nullopt for every optional<T> patch field
(DownloadUpdateParamsPatch, Settings) — both schemas document "an explicit null
clears the field" but neither handler can act on it because the wire distinction is
already gone by the time either sees the parsed struct. A generator-level gap
(PROTO's), not something to hand-route around locally.

Verified against real veloxd + tools/testserver: rules create/list, limiter.set
takes effect and reads back, schedule.set/get round-trips, queue.reorder against real
membership (and rejects a non-permutation), download.update renames+recategorizes a
task, download.refreshUrl swaps a paused task's URL and reports contentChanged
correctly. Full ctest: 55/55 (excluding the pre-existing, unrelated conformance
failure noted two commits back).

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GRDjHGgpYmMoPE2UFbe7pP

daemon/src/sched/engine_port.hpp

@@ -46,7 +46,8 @@ public:
     virtual void provide_auth(vdm::TaskId, const std::string& username,
                               const std::string& password, bool remember) = 0;
     virtual void decide(vdm::TaskId, vdm::task::Decision) = 0;
-    virtual void refresh_url(vdm::TaskId, const std::string& url) = 0;
+    virtual void refresh_url(vdm::TaskId, const std::string& url,
+                             const std::vector<vdm::net::HeaderField>& headers = {}) = 0;
 
     // The daemon is done with this task (it went terminal). Drop the handle. Idempotent.
     virtual void release(vdm::TaskId) = 0;
@@ -59,6 +60,12 @@ public:
     virtual void set_task_order(const std::vector<vdm::TaskId>& order) = 0;
     virtual void set_max_active_segments(std::uint32_t n) = 0;
     virtual void set_host_segment_cap(const std::string& host, std::uint32_t cap) = 0;
+
+    // limiter.set: 0 means unlimited (vdm::rate::TokenBucket's own convention), applied
+    // across every active transfer immediately — there is no "next task only" variant for
+    // a single shared global bucket, so `applyToRunning` on the wire has nothing to select
+    // between; it is accepted for schema compliance and always behaves as if true.
+    virtual void set_global_speed_limit(std::uint64_t bps) = 0;
 };
 
 }  // namespace velox::daemon::sched

daemon/src/sched/engine_port_core.hpp

@@ -45,8 +45,9 @@ public:
     void decide(vdm::TaskId id, vdm::task::Decision d) override {
         if (auto* h = find(id)) h->decide(d);
     }
-    void refresh_url(vdm::TaskId id, const std::string& url) override {
-        if (auto* h = find(id)) h->refresh_url(url);
+    void refresh_url(vdm::TaskId id, const std::string& url,
+                     const std::vector<vdm::net::HeaderField>& headers) override {
+        if (auto* h = find(id)) h->refresh_url(url, headers);
     }
     void release(vdm::TaskId id) override { handles_.erase(id); }
     std::optional<vdm::task::Progress> progress(vdm::TaskId id) const override {
@@ -64,6 +65,9 @@ public:
     void set_host_segment_cap(const std::string& host, std::uint32_t cap) override {
         engine_.segment_budget().set_host_segment_cap(host, cap);
     }
+    void set_global_speed_limit(std::uint64_t bps) override {
+        engine_.rate_limiter().set_global_limit(bps);
+    }
 
 private:
     vdm::task::DownloadHandle* find(vdm::TaskId id) {

daemon/src/sched/fake_engine_port.hpp

@@ -61,7 +61,16 @@ public:
     void cancel(vdm::TaskId id, bool discard) override { cancelled.emplace_back(id, discard); }
     void provide_auth(vdm::TaskId, const std::string&, const std::string&, bool) override {}
     void decide(vdm::TaskId, vdm::task::Decision) override {}
-    void refresh_url(vdm::TaskId, const std::string&) override {}
+    void refresh_url(vdm::TaskId id, const std::string& url,
+                     const std::vector<vdm::net::HeaderField>& headers) override {
+        refreshed_urls.emplace_back(id, url, headers);
+    }
+    struct RefreshCall {
+        vdm::TaskId id;
+        std::string url;
+        std::vector<vdm::net::HeaderField> headers;
+    };
+    std::vector<RefreshCall> refreshed_urls;
     void release(vdm::TaskId id) override { released.push_back(id); }
     std::optional<vdm::task::Progress> progress(vdm::TaskId id) const override {
         auto it = fake_progress.find(id.value);
@@ -75,6 +84,9 @@ public:
     void set_host_segment_cap(const std::string& h, std::uint32_t c) override {
         host_caps.emplace_back(h, c);
     }
+    void set_global_speed_limit(std::uint64_t bps) override { global_speed_limits.push_back(bps); }
+
+    std::vector<std::uint64_t> global_speed_limits;
 
     const std::vector<vdm::TaskId>& last_order() const { return orders.back(); }
 

daemon/src/sched/scheduler.cpp

@@ -183,6 +183,16 @@ store::DbResult<void> Scheduler::reload_config() {
     governor_.set_config(cfg);
     engine_.set_max_active_segments(
         static_cast<std::uint32_t>(std::max<std::int64_t>(cfg.max_active_segments, 1)));
+
+    // The global speed limit persists across a restart the same as any other setting, but
+    // (unlike connection.* above) nothing re-derives it into engine state on its own —
+    // limiter.set is the only other place that calls set_global_speed_limit, and that only
+    // fires on an explicit RPC in a running daemon. Push it here too so a limit set in a
+    // previous run is not silently unlimited again after a restart.
+    const bool limit_enabled = settings.get_bool("downloads.speedLimitEnabled");
+    const std::int64_t limit_bps = settings.get_int("downloads.speedLimitBps");
+    engine_.set_global_speed_limit(limit_enabled ? static_cast<std::uint64_t>(std::max<std::int64_t>(limit_bps, 0))
+                                                 : 0);
     return {};
 }
 
@@ -634,4 +644,77 @@ void Scheduler::probe_now(
     });
 }
 
+void Scheduler::refresh_url(
+    const std::string& wire_id, const std::string& url,
+    const std::optional<proto::Headers>& headers,
+    const std::optional<std::vector<proto::Cookie>>& cookies,
+    std::function<void(proto::HandlerResult<proto::DownloadRefreshUrlResult>)> done) {
+    auto got = store::Tasks(db_).get(wire_id);
+    if (!got || !got->has_value()) {
+        done(std::unexpected(proto::HandlerError{proto::ErrorCode::TaskNotFound, "no such task",
+                                                 nlohmann::json{{"taskId", wire_id}}}));
+        return;
+    }
+    const store::TaskRow row = **got;  // copied: read again by the async callback below
+
+    vdm::net::ProbeRequest req;
+    req.url = url;
+    if (headers)
+        for (const auto& [k, v] : *headers) req.headers.push_back({k, v});
+    if (cookies)
+        for (const auto& c : *cookies) req.cookies.push_back({c.name, c.value});
+
+    engine_.probe(req, [this, wire_id, row, url, headers, done](vdm::Result<vdm::net::ProbeResult> pr) {
+        deps_.post_to_loop([this, wire_id, row, url, headers, done, pr]() {
+            if (!pr) {
+                nlohmann::json data;
+                if (pr.error().http_status != 0) data["httpStatus"] = pr.error().http_status;
+                done(std::unexpected(proto::HandlerError{proto::ErrorCode::ProbeFailed,
+                                                         pr.error().context, data}));
+                return;
+            }
+
+            // "if they do not [match], it says so rather than silently restarting" (the
+            // schema's own words) — comparison only fires when both sides actually have a
+            // value; an unknown size/validator on either end is not itself a mismatch.
+            bool content_changed = false;
+            if (row.size_bytes && pr->total_size &&
+                *row.size_bytes != static_cast<std::int64_t>(*pr->total_size))
+                content_changed = true;
+            if (row.etag && !row.etag->empty() && !pr->etag.empty() && *row.etag != pr->etag)
+                content_changed = true;
+            if (row.last_modified && !row.last_modified->empty() && !pr->last_modified.empty() &&
+                *row.last_modified != pr->last_modified)
+                content_changed = true;
+
+            store::Tasks tasks(db_);
+            store::Tasks::ProbeFields fields;
+            if (pr->total_size) fields.size_bytes = static_cast<std::int64_t>(*pr->total_size);
+            fields.resumable = pr->resumable;
+            if (!pr->etag.empty()) fields.etag = pr->etag;
+            if (!pr->last_modified.empty()) fields.last_modified = pr->last_modified;
+            if (!pr->mime.empty()) fields.content_type = pr->mime;
+            const std::string effective = pr->effective_url.empty() ? url : pr->effective_url;
+            fields.effective_url = effective;
+            (void)tasks.set_probe_result(wire_id, fields);
+            (void)tasks.set_url(wire_id, url);
+
+            if (auto eid = engine_id_of(wire_id)) {
+                std::vector<vdm::net::HeaderField> hdrs;
+                if (headers)
+                    for (const auto& [k, v] : *headers) hdrs.push_back({k, v});
+                engine_.refresh_url(*eid, url, hdrs);
+            }
+
+            proto::DownloadRefreshUrlResult r;
+            r.ok = true;
+            r.resumable = pr->resumable;
+            r.contentChanged = content_changed;
+            if (pr->total_size) r.sizeBytes = static_cast<std::int64_t>(*pr->total_size);
+            r.effectiveUrl = effective;
+            done(r);
+        });
+    });
+}
+
 }  // namespace velox::daemon::sched

daemon/src/sched/scheduler.hpp

@@ -141,6 +141,8 @@ public:
     // port, which has no caller that wants the DbError).
     void apply_settings_reload() override { (void)reload_config(); }
 
+    void set_global_speed_limit(std::uint64_t bps) override { engine_.set_global_speed_limit(bps); }
+
     // rpc::TaskActionPort. Builds a vdm::net::ProbeRequest from `params`, runs it on the
     // engine's probe pool (outside the segment budget, ADR 0011 §5), and converts the
     // result back to proto terms — including the suggestedCategoryId/-SaveDir guess (a
@@ -153,6 +155,13 @@ public:
         std::function<void(velox::proto::HandlerResult<velox::proto::DownloadProbeResult>)>
             done) override;
 
+    void refresh_url(
+        const std::string& wire_id, const std::string& url,
+        const std::optional<velox::proto::Headers>& headers,
+        const std::optional<std::vector<velox::proto::Cookie>>& cookies,
+        std::function<void(velox::proto::HandlerResult<velox::proto::DownloadRefreshUrlResult>)>
+            done) override;
+
     // Diagnostics / tests.
     std::optional<std::string> wire_id_of(vdm::TaskId id) const;
     std::optional<vdm::TaskId> engine_id_of(const std::string& wire_id) const;