PYTHON-6136 Make pool checkout accounting transactional

[blink1073]

PYTHON-6136

Changes in this PR

An interrupted checkout could permanently stick the pool; the pool's accounting is now fully restored on failure.

Test Plan

Covered by the gevent killall race test and new deterministic regression tests. Repro: AMPLIFY_RACE=1 python -m pytest test/test_client.py::TestExhaustCursor::test_gevent_kill_churn_deadlock

Checklist

Checklist for Author

• Did you update the changelog (if necessary)? (Not necessary — internal accounting fix.)
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s). (None needed.)

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[Copilot]

Copilot review overview

🟡 Changes recommended

Pending-slot rollback fails to wake maxConnecting waiters, allowing the pool to remain blocked.

Review effort: Balanced
Findings: 1

Open (1)

• Notify max-connecting waiters when rolling back pending connections · New

What changed in this PR

Makes pool checkout accounting transactional so interrupted checkouts restore all counters.

Changes:

• Tracks applied accounting with rollback flags.
• Adds deterministic interruption regression tests.
• Strengthens gevent race coverage and counter assertions.

File	Description
pymongo/​asynchronous/​pool.py	Implements transactional checkout rollback.
pymongo/​synchronous/​pool.py	Generated synchronous equivalent.
test/​asynchronous/​test_pooling.py	Adds async accounting regression tests.
test/​test_pooling.py	Generated synchronous tests.
test/​asynchronous/​test_client.py	Expands gevent race coverage.
test/​test_client.py	Generated synchronous race test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 94.35484% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pymongo/synchronous/pool.py	93.54%	2 Missing and 2 partials ⚠️
pymongo/asynchronous/pool.py	95.16%	1 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Copilot review overview

🟡 Changes recommended

An interrupted notification can restore counters without waking blocked waiters, preserving a deadlock path.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Retry interrupted notifications to prevent checkout deadlock · New
• Regenerate synchronous files to fix waiter typo divergence · New

Resolved since last review (1)

• Notify max-connecting waiters when rolling back pending connections

[Copilot]

Copilot review overview

🟡 Changes recommended

An interrupted max-connecting notification can still leave an existing checkout blocked indefinitely.

Review effort: Balanced
Findings: 2

Open (2)

• Clear _UNDO_PENDING only after successful notification · New
• Clear _UNDO_PENDING only after successful notification · New

Resolved since last review (2)

• Retry interrupted notifications to prevent checkout deadlock
• Regenerate synchronous files to fix waiter typo divergence

[Copilot]

Copilot review overview

🔵 Needs a closer look

Make maxConnecting notification cleanup retryable after interruption in both pool implementations.

Review effort: Lite
Findings: None

Resolved since last review (2)

• Clear _UNDO_PENDING only after successful notification
• Clear _UNDO_PENDING only after successful notification

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical rollback-safety issues and missing operation_count regression assertions remain.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Prevent double-decrement during interrupted restoration · New
• Prevent double-decrement during interrupted restoration · New
• Correct typo: witer to waiter · New

Previously missed (2)

In code that hasn't changed since last review

Assert operation_count drains in stress test

test/​asynchronous/​test_client.py:2873

The stress test now verifies that requests, _pending, and active_sockets drain, but it never checks operation_count, which is the counter this PR also makes transactional. A checkout can therefore leak the load metric while this regression test still passes; add an operation_count == 0 assertion to the post-settle checks.

Assert operation_count drains in stress test

test/​test_client.py:2824

The stress test now verifies that requests, _pending, and active_sockets drain, but it never checks operation_count, which is the counter this PR also makes transactional. A checkout can therefore leak the load metric while this regression test still passes; add an operation_count == 0 assertion to the post-settle checks.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Interruption-sensitive accounting changes across sync and async pools warrant final human validation.

Review effort: Lite
Findings: None

Resolved since last review (3)

• Prevent double-decrement during interrupted restoration
• Prevent double-decrement during interrupted restoration
• Correct typo: witer to waiter

[aclark4life]

Looks like this locks whether it needs to or not, how about something like this instead:

      finally:
          # Both conditions below read only local variables, so the lock
          # is not needed to evaluate them; skip the acquire when there
          # is no leftover work.
          if not accounted or applied & ~notified:
              async with self.size_cond:
                  if not accounted:
                      self._restore_applied(applied)
                  missing = applied & ~notified
                  if missing & _UNDO_REQUESTS:
                      self.size_cond.notify()
                  if missing & _UNDO_PENDING:
                      self._max_connecting_cond.notify()

[blink1073]

I verified that the current structure is correct and added a comment.

[aclark4life]

LGTM