Move HTTP/2 stream events cleanup inside _state_lock

[mbeijen]

Summary

In AsyncHTTP2Connection._response_closed, the del self._events[stream_id] happens outside the _state_lock, but the not self._events check that decides whether to transition the connection to IDLE happens inside the lock. With multiplexed HTTP/2 requests this creates a race:

1. Request A is the last active stream. _response_closed runs: releases the semaphore, deletes its events entry, then yields before acquiring the lock.
2. Request B enters handle_async_request, acquires _state_lock, sets state=ACTIVE, releases the lock.
3. Request B acquires the semaphore and a new stream ID — but has not yet written self._events[stream_id] = [].
4. Request A resumes, acquires _state_lock, observes not self._events is True (B's entry isn't there yet), and marks the connection IDLE with an expiry timer — while Request B is actively using it.

The pool may then see the connection as expired and close it mid-request, or evict it as an excess idle connection.

Moving del self._events[stream_id] inside _state_lock makes the events-dict mutation and the IDLE-transition check atomic.

Ports encode/httpcore#1062 (bysiber, currently open upstream), via codeberg.org/httpxyz/httpcorexyz@e88f30b. The fork bundled this with encode/httpcore#1061; I'm splitting them into two httpx2 PRs to mirror the upstream split. Sibling PR for #1061 is #1012.

Notes

• Only _async/http2.py was edited by hand; _sync/http2.py was regenerated by scripts/unasync.py.
• No new test: reproducing this race deterministically needs careful coroutine scheduling and isn't currently feasible against the public AsyncConnectionPool API. The upstream PR doesn't ship a test either. 100% coverage preserved; existing HTTP/2 tests continue to pass.

---

Note: this change was prepared with AI assistance (Claude Code).

[codspeed-hq]

Merging this PR will not alter performance

✅ 15 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing mbeijen:fix/h2-stream-events-race (62d8310) with main (fe3da36)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}