Makefile, doc.go, IRP.md: VENDORFLAGS for debug builds; name every refusal

.claude/

/.vendor-preflight.json

/vendor

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

 - 2026-09-15 v1.59.1:

     - `make vendor` now writes `vendor.json`: the `modernc.org/libsqlite3` and `modernc.org/libsqlite_vec` commits and the Go toolchain `lib/` and `vec/` were vendored with, so `git show vX.Y.Z:vendor.json` says which revisions a release carries. It refuses a dirty sibling checkout, and a new test fails when `lib/` or `vec/` no longer match the stamp. Tooling only; the vendored code is unchanged. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).

     - `make vendor` now writes `vendor.json`: the `modernc.org/libsqlite3` and `modernc.org/libsqlite_vec` commits and the Go toolchain `lib/` and `vec/` were vendored with, so `git show vX.Y.Z:vendor.json` says which revisions a release carries. It refuses a dirty sibling checkout, siblings on different `modernc.org/libc` versions, or a `libsqlite_vec` built against another `libsqlite3`. The suite fails when `lib/`, `vec/` or the libc in `go.mod` no longer match the stamp, so a libc bump goes in the same push as `make vendor`. Tooling only; the vendored code is unchanged. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).

     - **`vfs.FS.Close` now refuses while a database opened through it is still open**, returning an error that wraps the new `vfs.ErrInUse` and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the `FS`.

     - Fix handle reuse in `modernc.org/sqlite/vfs` on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.

     - **The pluggable page cache now panics when a `Cache` breaks its contract** by returning nil, or a different `Page`, from `Fetch` for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a `Cache` implementation with that bug is affected; `modernc.org/sqlite/pcache` is not.

3. `modernc.org/libsqlite_vec`, bumped to both, re-transpiled, tagged.

4. Here: both sibling checkouts at those tags, `go.mod` on the new libc, `make vendor`,

   the builders green on all 20 targets, then the tag. `make vendor` refuses a dirty

   checkout and two checkouts on different libc versions, and records what it used in

   `vendor.json`.

   checkout, two checkouts on different libc versions, and a `libsqlite_vec` that

   requires another `libsqlite3` commit than `../libsqlite3` is at, and records what it

   used in `vendor.json`. The test suite fails when the libc in `go.mod` differs from

   the one in `vendor.json`, so the `go.mod` bump goes in the same push as

   `make vendor`, or every builder is red until it does.

`lib/` and `vec/` must come from the same libc. Do not re-vendor one while the other

stays on the old version.

# keeping each tag's module download under Go's 500MB cap. Bump deliberately.

UNDUP = modernc.org/undup@v0.0.5

# Extra flags for the vendor tool's -preflight and -stamp steps. The one there

# is: make vendor VENDORFLAGS=-allow-dirty vendors from a sibling checkout with

# uncommitted changes, such as a debug build of libsqlite3 (see doc.go), and

# records that in vendor.json. The recipe's last step then fails, as does

# TestVendorStamp, so such a tree is never committed or released.

VENDORFLAGS =

all: editor

	golint 2>&1

	staticcheck 2>&1

	# Before anything is touched: refuse a dirty checkout, two checkouts on

	# different libc versions, or a libsqlite_vec built against another

	# libsqlite3 than ../libsqlite3, and remember what was seen. See stamp.go.

	./vendor -preflight -undup=$(UNDUP)

	./vendor -preflight -undup=$(UNDUP) $(VENDORFLAGS)

	# Reconstruct full per-target files (a no-op the first time), so the freshly

	# vendored transpiles overwrite a clean tree with no stale shared files.

	go run $(UNDUP) -expand -dir lib

	make build_all_targets

	# Last, once everything above has succeeded: record the sources, the

	# toolchain and a digest of the output in vendor.json, then check it.

	./vendor -stamp -undup=$(UNDUP)

	./vendor -stamp -undup=$(UNDUP) $(VENDORFLAGS)

	rm -f vendor

	go test ./internal/vendorstamp/

// which reads them from checkouts of those two repositories placed next to

// this one. To build a debug or otherwise modified version, adjust the

// compile-time options in modernc.org/libsqlite3, regenerate there with 'make

// generate', and vendor the result here.

// generate', and vendor the result here with

//

//	$ make vendor VENDORFLAGS=-allow-dirty

//

// since plain 'make vendor' refuses a checkout with uncommitted changes. The

// vendor.json it writes records the checkout as dirty, so the last step of

// make vendor and TestVendorStamp both fail, by design: such a tree is for

// local use and must not be committed or released.

//

// # Hacking

//