test(coverage): XA (0→57%) + on-disk upgrade (0→14%); document db_repsite gap

[gburd]

Summary

Closes coverage gaps in two cold subsystems and documents a third:

subsystem	file	before	after (line)	after (func)
XA	src/xa/xa.c	0%	56.6%	93.3%
XA	src/xa/xa_map.c	0%	77.5%	80.0%
upgrade	src/db/db_upg.c	0%	13.9%	40.0%
upgrade	src/db/db_upg_opd.c	0%	0% (no fixture)	—

All numbers measured with CC=gcc --coverage, captured from .libs via lcov 2.4
(and cross-checked with gcov), and reproduced end-to-end through
run_coverage.sh. No engine code was changed.

1. XA (surest win)

The existing test/xa harness (chk.xa + src1..src5) needs an Oracle Tuxedo
transaction manager (atmi.h, tmboot, buildserver, …), which is unavailable —
so xa/xa.c + xa_map.c were at 0%.

test/xa/xa_direct.c is a Tuxedo-free transaction manager that drives the
exported db_xa_switch entry points directly
(xa_open/start/end/prepare/commit/rollback/recover/forget), does data-plane work
through DB_XA_CREATE handles, exercises the internal two-phase-commit path
(DB_TXN->prepare → commit/abort), and resolves an in-doubt prepared txn via
the XA recovery scan (__txn_get_prepared, DB_FIRST/DB_NEXT) — plus the
protocol/argument error paths (XAER_NOTA/INVAL/PROTO/ASYNC).

Runs entirely in one process, fully resolves every txn before exit, and has a hard
SIGALRM self-timeout, so it cannot leave a prepared txn holding locks and cannot
hang. run_xa_direct.sh builds + runs it under a timeout, self-cleaning its home.

2. On-disk upgrade

db_upg.c was 0% (no group runs db_upgrade; the full Tcl upgrade group needs a
per-version fixture tree, test/tcl/upgrade/databases/, absent from this fork).

test/db/run_upgrade.sh runs db_upgrade + db_verify over the one committed
old-format fixture (test/csharp/bdb4.7.db, btree meta version-9), exercising the
utility open + version-check + no-op-when-current path. db_upg_opd.c stays 0%: the
off-page-duplicate conversion needs a genuinely pre-v9 db with off-page dups, which
the fork lacks (noted in the README).

3. db_repsite (deliberately deferred, documented)

db_repsite (the repmgr 100-series enabler) is absent from this fork — only the
Windows .vcxproj stub survives, and it is not in git history as a .cpp.
Reconstructing a multi-process repmgr CLI and making the 100-series pass reliably
without hanging is materially larger/riskier than the XA + upgrade wins.
test/coverage/DB-REPSITE-TODO.md captures the full reverse-engineered stdin
command protocol, the DB_ENV->repmgr_site/repmgr_start API surface, and a
step-by-step reconstruction plan so the follow-up is mechanical.

Wiring

run_coverage.sh gains a COV_XA_UPG block (default on) that runs both drivers
after the Tcl subset (mirroring the COV_REP block); README documents it.

Real bug found

None. The one anomaly observed — forcing the fixture's meta version 9→8 to reach the
case 8 conversion produced a last_pgno mismatch on verify — is a synthetic-fixture
artifact (a v9-layout file mislabeled v8), not an engine bug; that experiment is not
committed.

Validation

Every added test was run under timeout and confirmed PASS (repeatedly, no hang).
Full run_coverage.sh verified end-to-end in the nix dev shell.

[github-actions]

Coccinelle convention checks

No new violations. ✅

Resolved since baseline (2) -- update dist/cocci/baseline.txt to lock these in.

rule_mutex_unbalanced|MUTEX_UNBALANCED|src/crypto/mersenne/mt19937db.c|return (ret);
rule_mutex_unbalanced|MUTEX_UNBALANCED|src/mp/mp_register.c|return (ret);

[github-actions]

ABI diff vs v5.3.31 (libabigail — authoritative)

Removed exported symbols (nm -D, _NNNN version suffix normalized)

None.

---

Advisory: libabigail/nm is the authoritative binary-ABI check; Coccinelle is complementary source-level early warning. See dist/cocci/README.md.