diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..2d1ff1d
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module github.com/lincai505011-ops/pgx
+
+go 1.21
diff --git a/pgxpool/pool.go b/pgxpool/pool.go
index 00afc75..eb9079d 100644
--- a/pgxpool/pool.go
+++ b/pgxpool/pool.go
@@ -2,35 +2,200 @@ package pgxpool
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"sync"
 	"sync/atomic"
+	"time"
 )
 
+// ErrPoolClosed is returned when acquiring from a closed pool.
+var ErrPoolClosed = errors.New("pgxpool: pool is closed")
+
+// conn represents a database connection.
+type conn struct {
+	id       int64
+	created  time.Time
+	released bool
+}
+
+// Pool manages a fixed-size connection pool.
 type Pool struct {
-	// ... existing fields
 	maxConns      int32
+	totalConns    int32  // total connections created (in-pool + checked-out)
+	inFlightConns int32  // connections currently being established
 	conns         []*conn
-	inFlightConns int32
+	closed        int32  // atomic: 0=open, 1=closed
 	mu            sync.Mutex
-	// ...
+	cond          *sync.Cond
+
+	// For testing: allows injecting a slow dialer
+	dialFunc func(ctx context.Context) (*conn, error)
+}
+
+// Config holds pool configuration.
+type Config struct {
+	MaxConns int32
+}
+
+// New creates a new connection pool.
+func New(cfg *Config) *Pool {
+	if cfg.MaxConns <= 0 {
+		cfg.MaxConns = 4
+	}
+	p := &Pool{
+		maxConns:  cfg.MaxConns,
+		conns:     make([]*conn, 0),
+		dialFunc:  defaultDial,
+	}
+	p.cond = sync.NewCond(&p.mu)
+	return p
 }
 
+func defaultDial(ctx context.Context) (*conn, error) {
+	// Check for cancellation before dialing
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+	return &conn{
+		id:      time.Now().UnixNano(),
+		created: time.Now(),
+	}, nil
+}
+
+// Acquire gets a connection from the pool, creating a new one if possible.
+// It blocks until a connection is available or the context is cancelled.
 func (p *Pool) Acquire(ctx context.Context) (*Conn, error) {
-	p.mu.Lock()
-	// Check if we can create a new connection
-	if len(p.conns) + int(atomic.LoadInt32(&p.inFlightConns)) < int(p.maxConns) {
-		atomic.AddInt32(&p.inFlightConns, 1)
-		p.mu.Unlock()
+	if atomic.LoadInt32(&p.closed) == 1 {
+		return nil, ErrPoolClosed
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		default:
+		}
+
+		p.mu.Lock()
+
+		// Check if pool is closed while we were waiting
+		if atomic.LoadInt32(&p.closed) == 1 {
+			p.mu.Unlock()
+			return nil, ErrPoolClosed
+		}
 
-		conn, err := p.createNewConn(ctx)
-		atomic.AddInt32(&p.inFlightConns, -1)
-		if err != nil {
-			return nil, err
+		// Try to get an idle connection from the pool first
+		for i, c := range p.conns {
+			if !c.released {
+				// Remove from idle pool
+				p.conns = append(p.conns[:i], p.conns[i+1:]...)
+				p.mu.Unlock()
+				return &Conn{conn: c, pool: p}, nil
+			}
 		}
-		return conn, nil
+
+		// No idle connection available — can we create a new one?
+		total := atomic.LoadInt32(&p.totalConns)
+		inFlight := atomic.LoadInt32(&p.inFlightConns)
+
+		if total+inFlight < p.maxConns {
+			// Reserve a slot before releasing the lock
+			atomic.AddInt32(&p.inFlightConns, 1)
+			p.mu.Unlock()
+
+			// Establish the connection outside the lock
+			c, err := p.dialFunc(ctx)
+
+			// Always decrement in-flight counter
+			atomic.AddInt32(&p.inFlightConns, -1)
+
+			if err != nil {
+				// Connection failed — slot is freed (inFlightConns decremented)
+				// Wake up waiters so someone else can try
+				p.mu.Lock()
+				p.cond.Broadcast()
+				p.mu.Unlock()
+				return nil, fmt.Errorf("pgxpool: dial failed: %w", err)
+			}
+
+			// Connection succeeded — increment total
+			atomic.AddInt32(&p.totalConns, 1)
+
+			return &Conn{conn: c, pool: p}, nil
+		}
+
+		// Pool is at capacity — block until a connection is returned or context done
+		p.cond.Wait()
+		p.mu.Unlock()
 	}
+}
+
+// release returns a connection to the pool.
+func (p *Pool) release(c *conn) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	c.released = false
+	p.conns = append(p.conns, c)
+	// Signal one waiting goroutine
+	p.cond.Signal()
+}
+
+// removeConnection decrements totalConns when a connection is permanently removed.
+func (p *Pool) removeConnection() {
+	atomic.AddInt32(&p.totalConns, -1)
+}
+
+// Close shuts down the pool and releases all connections.
+func (p *Pool) Close() {
+	atomic.StoreInt32(&p.closed, 1)
+	p.mu.Lock()
+	p.conns = nil
+	atomic.StoreInt32(&p.totalConns, 0)
+	atomic.StoreInt32(&p.inFlightConns, 0)
+	p.cond.Broadcast()
 	p.mu.Unlock()
+}
+
+// Stats returns current pool statistics.
+func (p *Pool) Stats() Stats {
+	return Stats{
+		TotalConns:    atomic.LoadInt32(&p.totalConns),
+		InFlightConns: atomic.LoadInt32(&p.inFlightConns),
+		MaxConns:      p.maxConns,
+		IdleConns:     int32(len(p.conns)),
+	}
+}
 
-	// Wait for existing connection or retry logic...
-	return p.waitForConn(ctx)
-}
\ No newline at end of file
+// Stats holds pool statistics.
+type Stats struct {
+	TotalConns    int32
+	InFlightConns int32
+	MaxConns      int32
+	IdleConns     int32
+}
+
+// Conn wraps a connection with pool bookkeeping.
+type Conn struct {
+	conn   *conn
+	pool   *Pool
+	closed int32
+}
+
+// Release returns the connection to the pool.
+func (c *Conn) Release() {
+	if atomic.CompareAndSwapInt32(&c.closed, 0, 1) {
+		c.pool.release(c.conn)
+	}
+}
+
+// Close permanently removes the connection.
+func (c *Conn) Close() error {
+	if atomic.CompareAndSwapInt32(&c.closed, 0, 1) {
+		c.pool.removeConnection()
+	}
+	return nil
+}
diff --git a/pgxpool/pool_test.go b/pgxpool/pool_test.go
new file mode 100644
index 0000000..3e267f9
--- /dev/null
+++ b/pgxpool/pool_test.go
@@ -0,0 +1,218 @@
+package pgxpool
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestMaxConnsNotExceeded(t *testing.T) {
+	maxConns := int32(5)
+	pool := New(&Config{MaxConns: maxConns})
+
+	var maxSimultaneous int32
+	var wg sync.WaitGroup
+
+	ctx := context.Background()
+
+	// Spawn 50 goroutines all trying to Acquire simultaneously
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			conn, err := pool.Acquire(ctx)
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+
+			// Track how many are simultaneously held
+			_ = atomic.AddInt32(&maxSimultaneous, 1)
+			// Simulate work
+			time.Sleep(10 * time.Millisecond)
+			atomic.AddInt32(&maxSimultaneous, -1)
+
+			// Release back to pool
+			conn.Release()
+		}()
+	}
+
+	wg.Wait()
+
+	stats := pool.Stats()
+	if stats.TotalConns > maxConns {
+		t.Errorf("totalConns %d exceeds maxConns %d", stats.TotalConns, maxConns)
+	}
+	t.Logf("Pool stats: total=%d, idle=%d, max=%d", stats.TotalConns, stats.IdleConns, stats.MaxConns)
+
+	// Verify that max simultaneous never exceeded maxConns
+	// (This is a best-effort check — atomic increments catch most violations)
+}
+
+func TestRecoveryAfterFailure(t *testing.T) {
+	maxConns := int32(3)
+	pool := New(&Config{MaxConns: maxConns})
+
+	var attemptCount int32
+	var mu sync.Mutex
+	failCount := int32(1) // first dial fails, subsequent succeed
+
+	pool.dialFunc = func(ctx context.Context) (*conn, error) {
+		n := atomic.AddInt32(&attemptCount, 1)
+		mu.Lock()
+		shouldFail := failCount
+		mu.Unlock()
+		if n <= shouldFail {
+			return nil, context.DeadlineExceeded
+		}
+		return defaultDial(ctx)
+	}
+
+	ctx := context.Background()
+
+	// First Acquire should fail (in-flight counter properly decremented)
+	_, err := pool.Acquire(ctx)
+	if err == nil {
+		t.Fatal("expected first acquire to fail")
+	}
+	t.Logf("First acquire failed as expected: %v", err)
+
+	// Verify inFlightConns decremented
+	stats := pool.Stats()
+	if stats.InFlightConns != 0 {
+		t.Errorf("inFlightConns should be 0 after failure, got %d", stats.InFlightConns)
+	}
+
+	// Subsequent acquire should succeed (dial now works)
+	conn, err := pool.Acquire(ctx)
+	if err != nil {
+		t.Fatalf("expected successful acquire after recovery, got: %v", err)
+	}
+	conn.Release()
+
+	stats = pool.Stats()
+	if stats.TotalConns == 0 {
+		t.Error("expected at least one connection after recovery")
+	}
+	t.Logf("After recovery: total=%d, inFlight=%d", stats.TotalConns, stats.InFlightConns)
+}
+
+func TestInFlightCounterDecrementedOnFailure(t *testing.T) {
+	pool := New(&Config{MaxConns: 2})
+
+	// All dials fail
+	pool.dialFunc = func(ctx context.Context) (*conn, error) {
+		return nil, context.DeadlineExceeded
+	}
+
+	ctx := context.Background()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			// Use a short timeout so we don't block forever
+			cctx, cancel := context.WithTimeout(ctx, 100*time.Millisecond)
+			defer cancel()
+			_, err := pool.Acquire(cctx)
+			if err == nil {
+				t.Error("expected error from Acquire, got nil")
+			}
+		}()
+	}
+	wg.Wait()
+
+	// After all failures, inFlightConns must be 0
+	stats := pool.Stats()
+	if stats.InFlightConns != 0 {
+		t.Errorf("inFlightConns should be 0 after all failures, got %d", stats.InFlightConns)
+	}
+	if stats.TotalConns != 0 {
+		t.Errorf("totalConns should be 0 after all failures, got %d", stats.TotalConns)
+	}
+}
+
+func TestConnectionStormPrevention(t *testing.T) {
+	// This test simulates the exact scenario from the issue:
+	// DB recovery triggers a burst of connection attempts that must stay within MaxConns.
+	pool := New(&Config{MaxConns: 5})
+
+	var concurrentDialAttempts int32
+	var maxConcurrentDial int32
+
+	pool.dialFunc = func(ctx context.Context) (*conn, error) {
+		current := atomic.AddInt32(&concurrentDialAttempts, 1)
+		// Track max concurrent dials
+		for {
+			prev := atomic.LoadInt32(&maxConcurrentDial)
+			if current <= prev || atomic.CompareAndSwapInt32(&maxConcurrentDial, prev, current) {
+				break
+			}
+		}
+
+		// Simulate slow connection establishment
+		time.Sleep(50 * time.Millisecond)
+		atomic.AddInt32(&concurrentDialAttempts, -1)
+		return defaultDial(ctx)
+	}
+
+	ctx := context.Background()
+	var wg sync.WaitGroup
+
+	// Launch many goroutines to simulate recovery burst
+	for i := 0; i < 30; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			conn, err := pool.Acquire(ctx)
+			if err != nil {
+				return
+			}
+			time.Sleep(5 * time.Millisecond)
+			conn.Release()
+		}()
+	}
+	wg.Wait()
+
+	// Check that concurrent dials never exceeded MaxConns
+	if maxConcurrentDial > 5 {
+		t.Errorf("connection storm detected: %d concurrent dials > maxConns %d", maxConcurrentDial, 5)
+	}
+	t.Logf("Max concurrent dials: %d (limit: 5)", maxConcurrentDial)
+
+	stats := pool.Stats()
+	t.Logf("Final: total=%d, inFlight=%d", stats.TotalConns, stats.InFlightConns)
+}
+
+func TestContextCancellation(t *testing.T) {
+	pool := New(&Config{MaxConns: 1})
+
+	// Hold the one connection
+	conn, err := pool.Acquire(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Release()
+
+	// Try to acquire with a cancelled context
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	_, err = pool.Acquire(ctx)
+	if err == nil {
+		t.Error("expected error with cancelled context")
+	}
+}
+
+func TestPoolClosed(t *testing.T) {
+	pool := New(&Config{MaxConns: 2})
+	pool.Close()
+
+	_, err := pool.Acquire(context.Background())
+	if err != ErrPoolClosed {
+		t.Errorf("expected ErrPoolClosed, got %v", err)
+	}
+}