Endpoint Protection Engine

// Bounded, lock-free dispatch between the driver and analysis workers
class DispatchQueue {
public:
  explicit DispatchQueue(std::size_t capacity)
      : queue_(capacity) {}

  // Called from the interception path. Never blocks.
  bool tryEnqueue(FileEvent&& event) {
    return queue_.try_enqueue(std::move(event));
  }

  // Analysis workers drain in batches, applying back-pressure by
  // dropping into sampled mode instead of stalling the caller.
  std::size_t drain(std::vector<FileEvent>& out, std::size_t max) {
    return queue_.try_dequeue_bulk(out.begin(), max);
  }

private:
  moodycamel::ConcurrentQueue<FileEvent> queue_;
};