p2: digest with in-sift FIFO, SQLite caches, Honcho context, recover

Dixie is capped (max_inflight 2, queue_depth 8, queue_wait 20s) and
never queued on llama-server. Streaming chat, thinking off, 45s
fallback to clean. Digest and chunk-embedding caches are
content-addressed SQLite (Honcho context is not cached). Recover
uses the guarded Fetcher. guardian-star is refused in code.

vendor/modernc.org/sqlite/lib/sqlite_g_000000000001c154.go

@@ -0,0 +1,33 @@
+// Code generated by modernc.org/undup from the per-target sqlite_*.go files; DO NOT EDIT.
+
+//go:build (freebsd && 386) || (freebsd && arm) || (linux && 386) || (linux && arm) || (netbsd && amd64) || (openbsd && amd64) || (openbsd && arm64)
+
+package sqlite3
+
+import (
+	"unsafe"
+
+	"modernc.org/libc"
+)
+
+// C documentation
+//
+//	/*
+//	** If pFd->sectorSize is non-zero when this function is called, it is a
+//	** no-op. Otherwise, the values of pFd->sectorSize and
+//	** pFd->deviceCharacteristics are set according to the file-system
+//	** characteristics.
+//	**
+//	** There are two versions of this function. One for QNX and one for all
+//	** other systems.
+//	*/
+func _setDeviceCharacteristics(tls *libc.TLS, pFd uintptr) {
+	if (*TunixFile)(unsafe.Pointer(pFd)).FsectorSize == 0 {
+		/* Set the POWERSAFE_OVERWRITE flag if requested. */
+		if libc.Int32FromUint16((*TunixFile)(unsafe.Pointer(pFd)).FctrlFlags)&int32(UNIXFILE_PSOW) != 0 {
+			**(**int32)(__ccgo_up(pFd + 80)) |= int32(SQLITE_IOCAP_POWERSAFE_OVERWRITE)
+		}
+		**(**int32)(__ccgo_up(pFd + 80)) |= int32(SQLITE_IOCAP_SUBPAGE_READ)
+		(*TunixFile)(unsafe.Pointer(pFd)).FsectorSize = int32(SQLITE_DEFAULT_SECTOR_SIZE)
+	}
+}