daemon: fix startMode 'later' -32603 and isolate the single-instance lock by runtime dir

Two bugs blocking PROTO's live-veloxd conformance check.

1. tasks.start_mode's CHECK was ('auto','now','queue','manual') — not the
   contract's StartMode enum (['now','later','queue']) at all. 'later', a real
   documented value (the File Info dialog's Download Later button), hit the CHECK
   on every insert and surfaced as an unhandled -32603; 'auto'/'manual' were
   never contract values to begin with.

   Migration 0003 rebuilds tasks (SQLite can't ALTER a CHECK) with the contract's
   values, remapping existing rows by what they actually meant: 'auto' -> 'now'
   (eligible for the scheduler immediately), 'manual' -> 'later' (parked, matching
   StartMode's own "lands the task in paused" description). store_migrations_test
   covers the remap and that 'later' inserts clean while the retired spellings
   are rejected.

   dispatcher.cpp's on_download_add matched: default (absent startMode) is now
   'now' instead of the invented 'auto'; 'later' actually lands the task in
   `paused` (pause_reason 'user') instead of a dead 'manual' -> `new` branch that
   spec.startMode (typed as the 3-value enum) could never even reach.
   TaskRow::start_mode's in-memory default followed suit ('now').

2. main.cpp's single-instance guard bound an abstract socket named
   "velox-daemon-<euid>" — one name per user, system-wide. XDG_RUNTIME_DIR
   isolation never reached it: a leaked test veloxd held the lock for 4h40m and
   locked out every other isolated instance with the same euid (PROTO, EXT, the
   orchestrator), real daemon included.

   Extracted rpc/single_instance.{hpp,cpp} (was a static in main.cpp, untestable)
   and derived the abstract-socket name from a hash of the resolved runtime dir
   path instead of euid alone. The real per-user daemon is still unique (its
   runtime dir is unique to it); isolated instances pointed at their own runtime
   dirs now coexist. main() resolves the runtime dir before acquiring the lock
   (was the other way around). New single_instance_test covers same-dir refusal,
   different-dir coexistence, and release-on-close.

Verified against real veloxd binaries, not just unit tests: startMode: "later"
via a live download.add lands in `paused`; two veloxd with different runtime
dirs run concurrently, two with the same one and the second refuses with the
runtime dir named in the error. Full ctest: 39/39.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GRDjHGgpYmMoPE2UFbe7pP

daemon/src/main.cpp

@@ -24,6 +24,7 @@
 #include "rpc/event_loop.hpp"
 #include "rpc/pairing.hpp"
 #include "rpc/runtime_dir.hpp"
+#include "rpc/single_instance.hpp"
 #include "rpc/uds_server.hpp"
 #include "rpc/ws_server.hpp"
 #include "sched/engine_port_core.hpp"
@@ -43,48 +44,25 @@ void on_signal(int) {
     if (g_loop != nullptr) g_loop->stop();  // stop() is async-signal-safe (writes an eventfd)
 }
 
-// Single-instance guard: bind an abstract-namespace Unix socket whose name is unique to
-// this user. A second daemon gets EADDRINUSE and exits. The kernel reclaims an
-// abstract-namespace address when the holding process dies, so a crash never wedges it
-// (docs/01 §2). Returns the held fd (kept open for the process lifetime) or -1.
-int acquire_single_instance_lock() {
-    const int fd = ::socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
-    if (fd < 0) return -1;
-
-    const std::string name = std::string("velox-daemon-") + std::to_string(::geteuid());
-    sockaddr_un addr{};
-    addr.sun_family = AF_UNIX;
-    // Leading NUL selects the abstract namespace; the name follows, not NUL-terminated.
-    addr.sun_path[0] = '\0';
-    std::memcpy(addr.sun_path + 1, name.c_str(), name.size());
-    const socklen_t len =
-        static_cast<socklen_t>(offsetof(sockaddr_un, sun_path) + 1 + name.size());
-
-    if (::bind(fd, reinterpret_cast<sockaddr*>(&addr), len) != 0) {
-        ::close(fd);
-        return -1;
-    }
-    return fd;
-}
-
 }  // namespace
 
 int main() {
     std::cout << "veloxd " << velox::daemon::kDaemonVersion << " (protocol "
               << velox::proto::kProtocolVersion << ")\n";
 
-    const int lock_fd = acquire_single_instance_lock();
-    if (lock_fd < 0) {
-        std::cerr << "veloxd: another instance is already running for this user\n";
-        return 1;
-    }
-
     velox::daemon::rpc::RuntimeDir rt;
     if (const auto ec = velox::daemon::rpc::resolve_runtime_dir(rt)) {
         std::cerr << "veloxd: cannot prepare runtime directory: " << ec.message() << "\n";
         return 1;
     }
 
+    const int lock_fd = velox::daemon::rpc::acquire_single_instance_lock(rt.path);
+    if (lock_fd < 0) {
+        std::cerr << "veloxd: another instance is already running for this runtime "
+                     "directory (" << rt.path << ")\n";
+        return 1;
+    }
+
     velox::daemon::rpc::EventLoop loop;
     g_loop = &loop;