@@ -1,4 +1,5 @@
 ### documentdb v0.117-0 (Unreleased) ###
+* Fix gateway data connection pools being reaped while still in active use once the gateway process had been up for ~2 hours, after which every request for an already-authenticated user failed with an internal error and `Connection pool missing for user.` in the logs. The pool's last-used timestamp was written as seconds since the UNIX epoch but read back as nanoseconds since the process epoch, so it no longer tracked actual usage and the pool reaper compared its idle threshold against process uptime instead. Regression introduced in v0.114-0. *[Bugfix]*
 * Default the RUM index library (`documentdb.rum_library_load_option`) to `require_documentdb_extended_rum` on all supported PostgreSQL versions, instead of only on PG 18+. The option can still be set to `none` to opt out. *[Refactor]*
 
 ### documentdb v0.116-0 (Unreleased) ###
 
@@ -42,7 +42,7 @@ use crate::{
         QueryCatalog,
     },
     telemetry::TracingConfig,
-    time::{self, EpochClock},
+    time,
 };
 
 fn pg_configuration(
@@ -147,7 +147,13 @@ pub struct ConnectionPool {
     /// `RecyclingMethod::Clean` to reset all session state when a
     /// connection is returned
     timeout_pool: DeadpoolPool<InstrumentedManager>,
-    /// Nanosecond offset from `EPOCH` of the last `acquire_connection` call.
+    /// Nanosecond offset from the process epoch of the last
+    /// `acquire_connection` call. Only ever written through
+    /// [`ConnectionPool::touch_last_used`] and read through
+    /// [`ConnectionPool::last_used`], which own that encoding — writing a
+    /// timestamp in any other unit or base here silently corrupts every
+    /// idleness decision made about this pool.
+    ///
     /// Uses `AtomicU64` instead of `RwLock<Instant>` to avoid async lock
     /// overhead on the hot acquire path.
     last_used_nanos: AtomicU64,
@@ -278,8 +284,7 @@ impl ConnectionPool {
     pub async fn acquire_connection(
         &self,
     ) -> std::result::Result<PoolConnection, deadpool_postgres::PoolError> {
-        self.last_used_nanos
-            .store(EpochClock::almost_now_timestamp(), Ordering::Relaxed);
+        self.touch_last_used();
 
         self.pool.get().await.inspect_err(|error| {
             self.metrics.record_timeout_if_pool_timeout(error);
@@ -306,8 +311,7 @@ impl ConnectionPool {
     pub async fn acquire_timeout_connection(
         &self,
     ) -> std::result::Result<PoolConnection, deadpool_postgres::PoolError> {
-        self.last_used_nanos
-            .store(EpochClock::almost_now_timestamp(), Ordering::Relaxed);
+        self.touch_last_used();
 
         self.timeout_pool.get().await.inspect_err(|error| {
             self.metrics.record_timeout_if_pool_timeout(error);
@@ -333,6 +337,26 @@ impl ConnectionPool {
         self.metrics.record_connection_timeout();
     }
 
+    /// Marks the pool as used as of now.
+    ///
+    /// Deliberately uses the precise `Instant::now()` rather than either of the
+    /// `EpochClock` coarse readings. This stamp is the sole input to the pool
+    /// reaper, so it must not depend on the coarse clock's updater task still
+    /// being alive on the runtime that happened to initialise it, and it must
+    /// stay in the encoding [`Self::last_used`] decodes: nanoseconds since the
+    /// process epoch. `EpochClock::almost_now_timestamp()` in particular looks
+    /// interchangeable here and is not — it returns *seconds since the UNIX
+    /// epoch*, which decodes as a point roughly two seconds after process start
+    /// that then advances by a nanosecond per second, making every pool look
+    /// idle for as long as the process has been up.
+    ///
+    /// The `Instant::now()` syscall costs ~20ns against a call that goes on to
+    /// check out a pooled connection, so the coarse clock buys nothing here.
+    fn touch_last_used(&self) {
+        self.last_used_nanos
+            .store(time::instant_to_u64(Instant::now()), Ordering::Relaxed);
+    }
+
     pub fn last_used(&self) -> Instant {
         time::u64_to_instant(self.last_used_nanos.load(Ordering::Relaxed))
     }
@@ -391,9 +415,14 @@ mod tests {
 
     use crate::{
         postgres::create_query_catalog,
-        testing::{test_connection_pool, test_setup_configuration},
+        testing::{test_connection_pool, test_setup_configuration, wait_for_epoch_uptime},
     };
 
+    /// Long enough that a stamp written in the wrong unit or base cannot look
+    /// recent: such a stamp decodes to roughly two seconds past the epoch and
+    /// then stays effectively frozen there.
+    const EPOCH_UPTIME_FOR_IDLENESS_ASSERTS: Duration = Duration::from_secs(5);
+
     #[tokio::test]
     async fn test_new_with_user_with_valid_config_creates_pool() {
         let setup_config = test_setup_configuration();
@@ -525,6 +554,46 @@ mod tests {
         assert!(pool.last_used().elapsed() < Duration::from_secs(5));
     }
 
+    #[tokio::test]
+    async fn test_last_used_after_acquire_connection_reports_pool_as_recently_used() {
+        let setup_config = test_setup_configuration();
+        let pool =
+            test_connection_pool(&setup_config, &setup_config.postgres_system_user.clone(), 2)
+                .await;
+
+        wait_for_epoch_uptime(EPOCH_UPTIME_FOR_IDLENESS_ASSERTS).await;
+
+        // The last-used stamp is written before the pool is touched, so whether
+        // a local Postgres is reachable does not affect what is asserted here.
+        let _ = pool.acquire_connection().await;
+
+        let idle_for = pool.last_used().elapsed();
+        assert!(
+            idle_for < Duration::from_secs(1),
+            "a just-acquired pool must not look idle, but last_used() reports {idle_for:?} of \
+             idleness"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_last_used_after_acquire_timeout_connection_reports_pool_as_recently_used() {
+        let setup_config = test_setup_configuration();
+        let pool =
+            test_connection_pool(&setup_config, &setup_config.postgres_system_user.clone(), 2)
+                .await;
+
+        wait_for_epoch_uptime(EPOCH_UPTIME_FOR_IDLENESS_ASSERTS).await;
+
+        let _ = pool.acquire_timeout_connection().await;
+
+        let idle_for = pool.last_used().elapsed();
+        assert!(
+            idle_for < Duration::from_secs(1),
+            "a just-acquired pool must not look idle, but last_used() reports {idle_for:?} of \
+             idleness"
+        );
+    }
+
     #[test]
     fn test_pg_configuration_with_password_sets_password() {
         let setup_config = test_setup_configuration();
 
@@ -342,6 +342,7 @@ mod tests {
         configuration::{CertInputType, CertificateOptions, DocumentDBSetupConfiguration},
         error::{ErrorCode, ErrorKind},
         postgres::create_query_catalog,
+        testing::wait_for_epoch_uptime,
     };
 
     #[derive(Debug)]
@@ -749,6 +750,44 @@ mod tests {
         assert_eq!(2, pool_manager.report_pool_stats().len());
     }
 
+    #[tokio::test]
+    async fn test_clean_unused_pools_with_actively_used_pool_keeps_pool_reachable() {
+        yield_now().await;
+
+        let dynamic_configuration = MaxConnectionConfig {
+            max_conn: 100.into(),
+        };
+        let pool_manager = test_pool_manager();
+
+        pool_manager
+            .allocate_data_pool("user", "password", &dynamic_configuration)
+            .unwrap();
+
+        wait_for_epoch_uptime(Duration::from_secs(5)).await;
+
+        // Drive the pool the way a live request does. The acquisition itself may
+        // fail without a local Postgres, but the last-used stamp is written
+        // before the pool is touched, which is what the reaper reads.
+        let _ = pool_manager
+            .get_data_pool("user", &dynamic_configuration)
+            .unwrap()
+            .acquire_connection()
+            .await;
+
+        pool_manager.clean_unused_pools(Duration::from_secs(1));
+
+        // The reaper has to key off how long a pool has been idle, not off how
+        // long the process has been running. Evicting a pool that is still in
+        // active use makes every subsequent request for that user fail with
+        // "Connection pool missing for user." until the client re-authenticates.
+        assert!(
+            pool_manager
+                .get_data_pool("user", &dynamic_configuration)
+                .is_ok(),
+            "a data pool that was just used was reaped as unused"
+        );
+    }
+
     #[tokio::test]
     async fn test_report_pool_stats_flushes_interval_metrics_from_system_pools() {
         yield_now().await;
 
@@ -24,7 +24,7 @@ pub use op_msg::{
     build_document_sequence_section, build_op_msg_parts, build_op_msg_parts_with_sections,
     build_op_msg_request, build_raw_document, decode_op_msg_response, decode_op_msg_responses,
 };
-pub use pool::{test_connection_pool, test_setup_configuration};
+pub use pool::{test_connection_pool, test_setup_configuration, wait_for_epoch_uptime};
 pub use request_documents::{
     invalid_transaction_find_document, logout_document, malformed_sasl_start_document,
     ping_document,
 
@@ -9,14 +9,18 @@
  *-------------------------------------------------------------------------
  */
 
-use tokio::task::yield_now;
+use tokio::{
+    task::yield_now,
+    time::{sleep, Duration},
+};
 
 use crate::{
     configuration::{CertInputType, CertificateOptions, DocumentDBSetupConfiguration},
     postgres::{
         conn_mgmt::{ConnectionPool, PgPoolSettings},
         create_query_catalog,
     },
+    time::EpochClock,
 };
 
 /// Returns a baseline `DocumentDBSetupConfiguration` suitable for connection
@@ -68,3 +72,18 @@ pub async fn test_connection_pool(
     )
     .expect("Failed to create connection pool")
 }
+
+/// Waits until the process-wide [`EpochClock`] epoch is at least `uptime` old.
+///
+/// `ConnectionPool::last_used` decodes its stored stamp as a nanosecond offset
+/// from that epoch. A stamp accidentally written in a different unit or base
+/// still decodes to *some* instant close to the epoch, so it only becomes
+/// distinguishable from a correct stamp once the process has been running for
+/// longer than the offset the bogus stamp decodes to. Tests that assert on pool
+/// idleness use this to get a deterministic result instead of one that depends
+/// on how far into the test binary's lifetime they happen to run.
+pub async fn wait_for_epoch_uptime(uptime: Duration) {
+    if let Some(remaining) = uptime.checked_sub(EpochClock::epoch().elapsed()) {
+        sleep(remaining).await;
+    }
+}
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`### documentdb v0.117-0 (Unreleased) ###`
	`2`	+* Fix gateway data connection pools being reaped while still in active use once the gateway process had been up for ~2 hours, after which every request for an already-authenticated user failed with an internal error and `Connection pool missing for user.` in the logs. The pool's last-used timestamp was written as seconds since the UNIX epoch but read back as nanoseconds since the process epoch, so it no longer tracked actual usage and the pool reaper compared its idle threshold against process uptime instead. Regression introduced in v0.114-0. [Bugfix]
`2`	`3`	* Default the RUM index library (`documentdb.rum_library_load_option`) to `require_documentdb_extended_rum` on all supported PostgreSQL versions, instead of only on PG 18+. The option can still be set to `none` to opt out. [Refactor]
`3`	`4`
`4`	`5`	`### documentdb v0.116-0 (Unreleased) ###`