libdb 2026.09.4

A quality and hygiene release that closes out the remaining items from the Sleepycat-engineer-voice review: the versioning covenant, the disclosed #137 accounting item, and a benchmark that can now demonstrate the isolation-level difference.

#137 SSI committed-reader locker accounting — characterized and tuned

The #137 item disclosed in v2026.09.3 was investigated empirically and found to be a bounded sawtooth, not an unbounded leak: the SSI committed-reader locker count converges to a ceiling that is a function of the lock-region size (not the transaction count) and stays there across 10k–200k sequential transactions with no exhaustion. The reclamation path was already correct.

This release still improves it:

• The committed-reader marker-GC trigger was lowered (fires at st_objects / 8 rather than st_objects / 2), giving roughly 5× lower steady-state footprint and ~17% faster throughput over a long sequential-snapshot run (a shorter marker list is cheaper to walk and sweep). This is a tuning change only — no format, ABI, or locking-order change.
• The #137 regression test now asserts the true bounded-sawtooth invariant (peak independent of transaction count) instead of a sampling-window-dependent comparison, and is proven to fail if a real per-transaction locker leak is reintroduced.

ssi_abort_bench now distinguishes SI from SSI

The serializable-abort probe previously could not tell plain snapshot isolation from SSI: its read-then-write schedule was lock-conflict-dominated, so the deadlock detector resolved conflicts before the SSI commit-pivot check fired. It has been reworked to a write-skew ring — the canonical anomaly that SSI prevents and plain SI permits — with write keys spread far enough apart (≥ 8 records) to land on disjoint leaf pages, eliminating page-granularity write-write conflicts. An ISO_LEVEL knob runs either level from the same binary. The result cleanly separates the two:

level	ssi_abort	deadlock
snapshot	~0	0
serializable	large (hundreds of k)	0

Zero deadlocks under serializable confirm the aborts come from the SSI rw-antidependency pivot, not the deadlock detector. A deterministic --selfcheck verifies the two-transaction write skew directly.

Versioning covenant

The README now states the fork's CalVer scheme and two standing promises: published tags are immutable going forward, and on-disk/log/region formats and the libdb-2026.0 soname change only through an announced, ABI-gated break — never silently.

Compatibility

On-disk, log, region, and public-ABI formats unchanged; existing environments upgrade in place. soname unchanged (libdb-2026.0). Qualified on EC2 and from a pristine clone (builds, isolation both levels, #137 bounded + teeth, #138 soak still bounded, ASan/db_verify clean, ABI identical).