phase: 110_fix_sse_db_pool_exhaustion

---

**Phase 110 — Fix SSE DB Connection Pool Exhaustion (SEC-14-04): COMPLETE**

**What was implemented/verified:**
- All three tasks (pool config, short-lived sessions, concurrency cap) were already implemented in code
- Fixed `tests/integration/test_chat_db_sessions.py` — added FakeChatLLM mock, fixed LLM signature (`tools=` not `_tools=`), used `fastapi_app.dependency_overrides` instead of `client.app.dependency_overrides`
- Fixed `tests/e2e/test_chat_db_pool.py` — added FakeChatLLM mock, fixed admin password to match `tests/conftest.py`, removed unused imports
- Fixed lint errors (unused imports, import order) in both test files

**Test / lint / coverage results:**
- `uv run pytest` → 2350 passed, 1 warning, 56.4s
- `uv run pytest --cov=app --cov-report=term-missing` → 99% coverage (4065 lines, 16 uncovered)
- `uv run pytest tests/e2e/test_chat_db_pool.py -v --no-cov` → 3 passed
- `uv run pytest tests/integration/test_chat_db_sessions.py -v --no-cov` → 4 passed
- `uv run pytest tests/integration/test_chat_concurrency.py -v --no-cov` → 11 passed
- `uv run pytest tests/unit/test_db_pool_config.py -v --no-cov` → 14 passed
- `uv run pytest tests/unit/test_agent_short_lived_sessions.py -v --no-cov` → 7 passed
- `uv run ruff check .` → all checks passed
- `uv run pyright` → 0 errors, 0 warnings

**Completion criteria:**
- [✓] `app/db.py::create_engine` receives explicit `pool_size=5`, `max_overflow=10`, `pool_recycle=3600` from settings
- [✓] `run_agent` accepts `db_factory: Callable[[], Session]` and creates short-lived sessions per tool call
- [✓] Each tool round uses a separate DB session closed after the tool result
- [✓] Concurrency cap (`BOR_CHAT_MAX_CONCURRENT`, default 10) limits concurrent turns; excess get 503
- [✓] All test gates green, coverage 99%, lint/types clean

**Notable decisions:** Tests needed LLM mocking (the original test files lacked `FakeChatLLM` mocks, causing hangs on real LLM calls).

**Next pending phase:** None — this is the last phase in `todo/`.

tests/integration/test_agent_tools_dates.py

@@ -26,6 +26,7 @@ from sqlalchemy import delete, text
 from sqlalchemy.orm import Session
 
 from app.config import Settings
+from app.db import SessionLocal
 from app.models import Document, GitSource
 from app.rag.agent import AgentHolder, run_agent
 from app.rag.llm import LLMClient, RetryPiece, StreamPiece, ToolCallPiece, ToolResultPiece
@@ -128,10 +129,11 @@ def _run_call(
 async def _consume(
     llm: LLMClient, db: Session, holder: AgentHolder
 ) -> list[StreamPiece | ToolCallPiece | RetryPiece | ToolResultPiece]:
+    """SEC-14-04: uses a short-lived session per tool call."""
     out: list[StreamPiece | ToolCallPiece | RetryPiece | ToolResultPiece] = []
     async for piece in run_agent(
         llm,
-        db,
+        lambda: SessionLocal(),  # SEC-14-04: session factory (short-lived sessions)
         system_prompt="SYSTEM_PROMPT",
         user_message="QUESTION",
         seed_docs=[],
@@ -163,7 +165,8 @@ def test_read_result_second_line_is_stored_date(kb, db) -> None:
     assert lines[0] == "Document Alpha/deep/nested/doc.md:"  # byte-identical header
     assert lines[1] == f"date: {D2_STR}"  # the STORED date (row's UTC date part)
     assert lines[2:] == ["FULL-TEXT"]
-    assert holder.read_docs == [created]
+    # SEC-14-04: short-lived session loads fresh copies
+    assert [d.id for d in holder.read_docs] == [created.id]
     assert holder.tool_calls == 1
 
 
@@ -182,7 +185,9 @@ def test_read_result_date_is_the_row_date_not_a_constant(kb, db) -> None:
     assert llm_b.requests[1][0][3]["content"] == (
         f"Document Alpha/b.md:\ndate: {D3_STR}\nB-TEXT"
     )
-    assert holder_a.read_docs == [a] and holder_b.read_docs == [b]
+    # SEC-14-04: short-lived sessions
+    assert [d.id for d in holder_a.read_docs] == [a.id]
+    assert [d.id for d in holder_b.read_docs] == [b.id]
 
 
 # --------------------------------------------------------------------