[mutianf]

Approach 2 of 2 — Java-shape single ownership + single-flight loading

Second of two alternative fixes for the cold-start burst bug where a session pool is Close()d and never reopens, leaving every op for the run returning ErrPoolClosed. (Approach 1, the localized opened()-gate + refcount patch, is #20366.)

The bug

A pool was keyed only by (resource, permission), so every sessionTable for the same resource shared one entry in sessionPools. Two independent races then closed a pool a live sibling still referenced:

• Burst / loser-discard: TableCache.GetOrOpen runs openFn for all concurrent missers and discards the losers via api.Close(). The loser's release closed the shared pool the winner had already memoized in its lazyPool.
• Evict-then-reopen: a TTL-evicted handle's self-heal resolves a fresh sessionTable that picks up the still-mapped pool during the delete-then-close window; the old handle's release then closes it out from under the new one.

Either way lazyPool memoizes the closed Invoker forever and there is no path to reopen → ErrPoolClosed for the rest of the run.

The fix

Mirror the java-bigtable shape faithfully: the cache value solely owns its pool, and loads are single-flight. Two structural changes replace the shared-key registry.

1. Single ownership. Each buildLazyOpener invocation mints its OWN pool (no keyed dedup) and hands the pool's teardown to a per-owner poolCloser. sessionTable.closeRead/closeWrite are that owner's single-shot Close, so a table only ever closes the pool ITS opener created — by captured identity — never a sibling sessionTable's pool that happens to share a (resource, permission).

• getOrCreateSessionPool/releaseSessionPool/buildLazyReleaser are gone; createSessionPool always creates and returns an id-scoped releaser, and releasePoolByID tears down by id.
• sessionPools becomes an id-keyed observational index (sessionz snapshots, config-listener fanout, Client.Close close-all) rather than the ownership/dedup key. poolKey loses its nonce and survives only to label the OTel session_name metric and order snapshots.
• poolCloser also handles the Close-straddles-open race: if the table is torn down before the opener finishes wiring, set() closes the fresh pool on the spot instead of leaking it.

2. Single-flight loading. TableCache.GetOrOpen is now single-flight per key via a loading map + ready channel, matching Guava LoadingCache's atomic single-load contract. A post-eviction RPC storm collapses onto one openFn call and installs exactly one successor pool instead of dialing N and discarding N-1. The closed-gate still releases a handle whose open straddled cache.Close (the interleaving that previously deadlocked a naive single-flight is handled by keeping the loadState separate from the always-complete TableHandle).

Notes

• Supersedes the earlier nonce bolt-on, which kept the shared-key registry and left a dead dedup lookup — @mutianf flagged that it wasn't the Java shape originally proposed.
• Test changes are in scope for this refactor: releaseSessionPool tests → id-based releasePoolByID tests; buildLazyOpener test gains the owner arg; the eviction-storm test's assertions are unchanged (they already tolerated single-flight) but its stale "NOT single-flight" / "loser-close" comments are corrected.
• newSessionTable / lazyPool signatures are unchanged. Full session suite passes under -race.

[gemini-code-assist]

Code Review

This pull request introduces a nonce field to poolKey to ensure each Open* call owns a private pair of pools, preventing a shared-pool race. The sessionClient now uses an atomic counter to generate unique nonces for tables, authorized views, and materialized views. Feedback suggests adding a test case with a non-zero nonce to verify that displayName ignores the nonce field, preventing potential OTel metric cardinality issues.