I think the md5 whitelist feature is in master. Other than that, not much you can do.

Is it possible that on startup for some reason the database is not updated before it starts alerting? so in some cases, there's a race?

I'm not sure what you mean. If an entry in the database gets updated, there should generally be an alert.
If you stop OSSEC, update packages, and stat OSSEC; a syscheck scan should run. Any changes it detects should probably be alerted on, including those from the package updates.

So what i need to happen is this. stop ossec, update some rpms, start ossec, but don't have it alert on the rpm update. normally this works fine, but sometimes, we get an alert. i'm not sure why.

If the MD5 whitelisting is in MASTER, you can populate the sqlite3 database with the correct hashes and file names. You can also clear the database before running the updates so everything that gets added is new.

is there a way to stop osec, make the rpm updates, then tell ossec update the db with all (the full OS fs) changes before starting realtime monitoring alerting?

Not out of the box. If you can figure out how to get the hashes of the files, scripting a solution wouldn't be the worst.

The part that i still don't understand is why does it alert sometimes in syscheck realtime and other times it doesn't?

in this example: stop ossec, update rpms, start ossec.

If you have not turned off auto_ignore, that could affect things. Other than that, I don't know.

I have auto_ignore set to no.