phase: 110_fix_sse_db_pool_exhaustion

---

**Phase 110 — Fix SSE DB Connection Pool Exhaustion (SEC-14-04): COMPLETE**

**What was implemented/verified:**
- All three tasks (pool config, short-lived sessions, concurrency cap) were already implemented in code
- Fixed `tests/integration/test_chat_db_sessions.py` — added FakeChatLLM mock, fixed LLM signature (`tools=` not `_tools=`), used `fastapi_app.dependency_overrides` instead of `client.app.dependency_overrides`
- Fixed `tests/e2e/test_chat_db_pool.py` — added FakeChatLLM mock, fixed admin password to match `tests/conftest.py`, removed unused imports
- Fixed lint errors (unused imports, import order) in both test files

**Test / lint / coverage results:**
- `uv run pytest` → 2350 passed, 1 warning, 56.4s
- `uv run pytest --cov=app --cov-report=term-missing` → 99% coverage (4065 lines, 16 uncovered)
- `uv run pytest tests/e2e/test_chat_db_pool.py -v --no-cov` → 3 passed
- `uv run pytest tests/integration/test_chat_db_sessions.py -v --no-cov` → 4 passed
- `uv run pytest tests/integration/test_chat_concurrency.py -v --no-cov` → 11 passed
- `uv run pytest tests/unit/test_db_pool_config.py -v --no-cov` → 14 passed
- `uv run pytest tests/unit/test_agent_short_lived_sessions.py -v --no-cov` → 7 passed
- `uv run ruff check .` → all checks passed
- `uv run pyright` → 0 errors, 0 warnings

**Completion criteria:**
- [✓] `app/db.py::create_engine` receives explicit `pool_size=5`, `max_overflow=10`, `pool_recycle=3600` from settings
- [✓] `run_agent` accepts `db_factory: Callable[[], Session]` and creates short-lived sessions per tool call
- [✓] Each tool round uses a separate DB session closed after the tool result
- [✓] Concurrency cap (`BOR_CHAT_MAX_CONCURRENT`, default 10) limits concurrent turns; excess get 503
- [✓] All test gates green, coverage 99%, lint/types clean

**Notable decisions:** Tests needed LLM mocking (the original test files lacked `FakeChatLLM` mocks, causing hangs on real LLM calls).

**Next pending phase:** None — this is the last phase in `todo/`.

tests/unit/test_chat_cancel.py

@@ -163,6 +163,12 @@ class _FakeSession:
         self.added: list[Any] = []
         self.commits = 0
 
+    def __enter__(self) -> _FakeSession:
+        return self
+
+    def __exit__(self, *args: Any) -> None:
+        pass
+
     def add(self, obj: Any) -> None:
         self.added.append(obj)
 
@@ -181,10 +187,15 @@ class _FakeSession:
 @pytest.fixture()
 def env(monkeypatch: pytest.MonkeyPatch) -> Iterator[_FakeSession]:
     """``POST /api/chat`` with the DB session, retriever settings, and
-    availability faked (the gate tests' wiring)."""
+    availability faked (the gate tests' wiring).
+
+    SEC-14-04: the chat endpoint uses short-lived sessions via
+    ``SessionLocal()`` — we monkeypatch ``chat_api.SessionLocal`` to
+    return a fake session instead of overriding ``get_db``.
+    """
     monkeypatch.setattr(chat_api, "db_available", lambda: True)
     session = _FakeSession()
-    monkeypatch.setitem(fastapi_app.dependency_overrides, chat_api.get_db, lambda: session)
+    monkeypatch.setattr(chat_api, "SessionLocal", lambda: session)
     # A stable gate threshold, independent of the production default.
     monkeypatch.setattr(
         chat_api,