docs(ssi): restore the serializability guarantee now that #136–#140 are fixed and gated

[gburd]

Completes the arc opened by #141. That PR retracted the SSI serializability claims before any fix landed, deliberately, so the project stopped shipping a guarantee the code did not honor. All five externally reported defects are now fixed and each has a regression test running in CI, so RFC 0003's own condition for retiring its limitations block — "removed only when each item is fixed and covered by a test" — is satisfied.

RFC 0003

• Limitations block → a table of issue / defect / fix / gating tier: libdb 5.3.34: DB_TXN_SNAPSHOT commits a write skew when the second write starts during the first commit #136 → test/isolation, libdb 5.3.34: sequential read-only DB_TXN_SNAPSHOT transactions eventually cause DB_ENV->txn_begin to return ENOMEM #137 + libdb 5.3.34: __txn_reap_si_details leaks MVCC mutex slots during snapshot cleanup #138 → test/soak, libdb 5.3.34: incomplete replication commit lock lists can violate client transaction isolation #140 → test/lockmatrix. Also records the third leak (si_ref not decremented on a SIREAD→WRITE upgrade in __lock_get_internal) that validation surfaced and no external report mentioned.
• Records the root-cause class and its permanent guard: libdb 5.3.34: incomplete replication commit lock lists can violate client transaction isolation #140 existed because SSI added a lock mode without auditing exhaustive pre-existing enumerations; a new DB_LOCK_* now fails CI unless dist/cocci/lockmode_inventory.sh is updated.
• Records that the different-pages-of-one-B-tree symptom was not a second defect — two independent constructions (one with 33 verified leaf pages) show the control timing returns DB_SNAPSHOT_CONFLICT correctly, so it was the same commit-window race.
• "SIREAD markers are reclaimed incrementally" now also states reclamation is bounded, naming test/soak as the evidence rather than asserting it.

txnbegin.md

The user-facing caveat becomes "Fixed after 5.3.34" with an explicit upgrade recommendation, instead of a standing limitation.

Gates

build.py ok · --selfcheck ok · man coverage GATE PASS · spelling GATE PASS (no new typos) · lychee 17043 links, 0 errors.

Docs-only; no code.

[github-actions]

Coccinelle convention checks

No new violations. ✅

Resolved since baseline (2) -- update dist/cocci/baseline.txt to lock these in.

rule_mutex_unbalanced|MUTEX_UNBALANCED|src/crypto/mersenne/mt19937db.c|return (ret);
rule_mutex_unbalanced|MUTEX_UNBALANCED|src/mp/mp_register.c|return (ret);

[github-actions]

ABI diff vs v5.3.34 (libabigail — authoritative)

Functions changes summary: 0 Removed, 0 Changed, 2 Added functions
Variables changes summary: 0 Removed, 0 Changed, 0 Added variable

2 Added functions:

  [A] 'function int __lock_sireap_lockers(ENV*)'    {__lock_sireap_lockers}
  [A] 'function int __os_csprng(ENV*, void*, size_t)'    {__os_csprng}

Removed exported symbols (nm -D, _NNNN version suffix normalized)

None.

---

Advisory: libabigail/nm is the authoritative binary-ABI check; Coccinelle is complementary source-level early warning. See dist/cocci/README.md.