Description

Fixes #720. Supersedes #721 (see "Why this instead of #721").

max_connections is a startup GUC — it cannot change without a Postgres restart — yet PgConfiguration::max_connections() (configuration/pg_configuration.rs) re-reads it on every dynamic-config refresh and silently substitutes 25 on a bad/missing read. Because max_connections is part of the PgPoolSettings pool-cache key, that fabricated 25 flips the key mid-run with no real change behind it; get_data_pool then permanently hard-fails every request for that user ("Connection pool missing for user.") — the pool is healthy but orphaned. Full root cause and log evidence: #720.

This fixes the root cause: on a bad read, max_connections() returns the last successfully-read value instead of fabricating a divergent one, so the pool key stays stable and the spurious miss never happens.

Why this instead of #721

#721 made get_data_pool fall back to reusing the user's existing pool on a settings-key miss. As @AndrewKhoma noted in review, that is unsafe: if max_connections had genuinely dropped to 25, the reused (100-sized) pool would let requests use connections Postgres no longer has (over-subscription); and the user-pool hard-fail is intentional precisely because max_connections is a startup GUC. This PR takes that feedback directly — it does not reuse pools and leaves the intentional hard-fail guard in get_data_pool untouched. It only removes the spurious key flip at its source (the bad read). A genuine max_connections change (via restart → fresh read) still updates the value and flips the key as designed, so the intended rebuild path is preserved.

What changed

max_connections() caches the last valid read in an AtomicUsize (stored on every valid read); on a bad read it returns that last-known-good value, falling back to 25 only on the first-read edge case. Scope: one field on PgConfiguration + the getter.

Testing

• cargo test -p documentdb_gateway_core → 434 passed, 0 failed, including two new tests (last-known-good on bad read; falls back to 25 with no prior good value) and the existing validate_max_conn_change (a real change still flips the key → pool rebuild preserved).
• rustfmt and clippy --workspace --all-targets --all-features -- -D warnings clean on the repo's pinned toolchain (Rust 1.95).

Type of Change

• Bug fix

AI Disclosure

• AI tools were used. Tool: Claude (Anthropic). Root-cause tracing, the fix, and the tests were prepared with substantial AI assistance, then reviewed and verified against the source by the author.

Checklist

• I can explain every change if asked
• Tested locally (cargo test — 434 passed)
• Tests added/updated
• Commits signed off (DCO)
• Read CONTRIBUTING.md

Signed-off-by: Morchid Chellali mc@wetransform.to