p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

Dixie is capped (max_inflight 2, queue_depth 8, queue_wait 20s) and
never queued on llama-server. Streaming chat, thinking off, 45s
fallback to clean. Digest and chunk-embedding caches are
content-addressed SQLite (Honcho context is not cached). Recover
uses the guarded Fetcher. guardian-star is refused in code.

vendor/modernc.org/sqlite/lib/sqlite_g_00000000000028c0.go

@@ -0,0 +1,124 @@
+// Code generated by modernc.org/undup from the per-target sqlite_*.go files; DO NOT EDIT.
+
+//go:build (linux && 386) || (linux && amd64) || (linux && ppc64le) || (linux && s390x)
+
+package sqlite3
+
+import (
+	"unsafe"
+
+	"modernc.org/libc"
+)
+
+// C documentation
+//
+//	/*
+//	** Find the mode, uid and gid of file zFile.
+//	*/
+func _getFileMode(tls *libc.TLS, zFile uintptr, pMode uintptr, pUid uintptr, pGid uintptr) (r int32) {
+	bp := tls.Alloc(144)
+	defer tls.Free(144)
+	var rc int32
+	var _ /* sStat at bp+0 */ Tstat
+	_ = rc /* Output of stat() on database file */
+	rc = SQLITE_OK
+	if 0 == (*(*func(*libc.TLS, uintptr, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(4)].FpCurrent})))(tls, zFile, bp) {
+		**(**Tmode_t)(__ccgo_up(pMode)) = (**(**Tstat)(__ccgo_up(bp))).Fst_mode & uint32(0777)
+		**(**Tuid_t)(__ccgo_up(pUid)) = (**(**Tstat)(__ccgo_up(bp))).Fst_uid
+		**(**Tgid_t)(__ccgo_up(pGid)) = (**(**Tstat)(__ccgo_up(bp))).Fst_gid
+	} else {
+		rc = libc.Int32FromInt32(SQLITE_IOERR) | libc.Int32FromInt32(7)<<libc.Int32FromInt32(8)
+	}
+	return rc
+}
+
+// C documentation
+//
+//	/*
+//	** Invoke open().  Do so multiple times, until it either succeeds or
+//	** fails for some reason other than EINTR.
+//	**
+//	** If the file creation mode "m" is 0 then set it to the default for
+//	** SQLite.  The default is SQLITE_DEFAULT_FILE_PERMISSIONS (normally
+//	** 0644) as modified by the system umask.  If m is not 0, then
+//	** make the file creation mode be exactly m ignoring the umask.
+//	**
+//	** The m parameter will be non-zero only when creating -wal, -journal,
+//	** and -shm files.  We want those files to have *exactly* the same
+//	** permissions as their original database, unadulterated by the umask.
+//	** In that way, if a database file is -rw-rw-rw or -rw-rw-r-, and a
+//	** transaction crashes and leaves behind hot journals, then any
+//	** process that is able to write to the database will also be able to
+//	** recover the hot journals.
+//	*/
+func _robust_open(tls *libc.TLS, z uintptr, f int32, m Tmode_t) (r int32) {
+	bp := tls.Alloc(176)
+	defer tls.Free(176)
+	var fd int32
+	var m2 Tmode_t
+	var v1 uint32
+	var _ /* statbuf at bp+0 */ Tstat
+	_, _, _ = fd, m2, v1
+	if m != 0 {
+		v1 = m
+	} else {
+		v1 = uint32(SQLITE_DEFAULT_FILE_PERMISSIONS)
+	}
+	m2 = v1
+	for int32(1) != 0 {
+		fd = (*(*func(*libc.TLS, uintptr, int32, int32) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[0].FpCurrent})))(tls, z, f|int32(O_CLOEXEC), libc.Int32FromUint32(m2))
+		if fd < 0 {
+			if **(**int32)(__ccgo_up(libc.X__errno_location(tls))) == int32(EINTR) {
+				continue
+			}
+			break
+		}
+		if fd >= int32(SQLITE_MINIMUM_FILE_DESCRIPTOR) {
+			break
+		}
+		if f&(libc.Int32FromInt32(O_EXCL)|libc.Int32FromInt32(O_CREAT)) == libc.Int32FromInt32(O_EXCL)|libc.Int32FromInt32(O_CREAT) {
+			(*(*func(*libc.TLS, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(16)].FpCurrent})))(tls, z)
+		}
+		(*(*func(*libc.TLS, int32) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(1)].FpCurrent})))(tls, fd)
+		Xsqlite3_log(tls, int32(SQLITE_WARNING), __ccgo_ts+3752, libc.VaList(bp+152, z, fd))
+		fd = -int32(1)
+		if (*(*func(*libc.TLS, uintptr, int32, int32) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[0].FpCurrent})))(tls, __ccgo_ts+3795, O_RDONLY, libc.Int32FromUint32(m)) < 0 {
+			break
+		}
+	}
+	if fd >= 0 {
+		if m != uint32(0) {
+			if (*(*func(*libc.TLS, int32, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(5)].FpCurrent})))(tls, fd, bp) == 0 && (**(**Tstat)(__ccgo_up(bp))).Fst_size == 0 && (**(**Tstat)(__ccgo_up(bp))).Fst_mode&uint32(0777) != m {
+				(*(*func(*libc.TLS, int32, Tmode_t) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(14)].FpCurrent})))(tls, fd, m)
+			}
+		}
+	}
+	return fd
+}
+
+// C documentation
+//
+//	/*
+//	** Test the existence of or access permissions of file zPath. The
+//	** test performed depends on the value of flags:
+//	**
+//	**     SQLITE_ACCESS_EXISTS: Return 1 if the file exists
+//	**     SQLITE_ACCESS_READWRITE: Return 1 if the file is read and writable.
+//	**     SQLITE_ACCESS_READONLY: Return 1 if the file is readable.
+//	**
+//	** Otherwise return 0.
+//	*/
+func _unixAccess(tls *libc.TLS, NotUsed uintptr, zPath uintptr, flags int32, pResOut uintptr) (r int32) {
+	bp := tls.Alloc(144)
+	defer tls.Free(144)
+	var _ /* buf at bp+0 */ Tstat
+	_ = NotUsed
+	/* The spec says there are three possible values for flags.  But only
+	 ** two of them are actually used */
+	if flags == SQLITE_ACCESS_EXISTS {
+		**(**int32)(__ccgo_up(pResOut)) = libc.BoolInt32(0 == (*(*func(*libc.TLS, uintptr, uintptr) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(4)].FpCurrent})))(tls, zPath, bp) && (!((**(**Tstat)(__ccgo_up(bp))).Fst_mode&libc.Uint32FromInt32(S_IFMT) == libc.Uint32FromInt32(S_IFREG)) || (**(**Tstat)(__ccgo_up(bp))).Fst_size > 0))
+	} else {
+		**(**int32)(__ccgo_up(pResOut)) = libc.BoolInt32((*(*func(*libc.TLS, uintptr, int32) int32)(unsafe.Pointer(&struct{ uintptr }{_aSyscall[int32(2)].FpCurrent})))(tls, zPath, libc.Int32FromInt32(W_OK)|libc.Int32FromInt32(R_OK)) == 0)
+	}
+	return SQLITE_OK
+}