V8: Return 409 with Retry-After from /chat when the session is busy

[LinuxDevil]

Fixes audit finding SWE-2 (Vercel competitor audit, 2026-10-19).

What was wrong

When another replica/process held a session's run lease, POST /chat answered 200 and streamed an in-band error event (LOUSHO_SESSION_BUSY); channels (V7) already answered 409 + Retry-After. The in-process Idempotency-Key duplicate 409 had no Retry-After.

What changed

• turnResponse() in src/server/fetchRoutes.ts: reads the turn's first event (or failure) before responding; a LOUSHO_SESSION_BUSY refusal becomes 409 {error, code} + Retry-After: 2. Anything else streams as before; later failures stay in-band coded events. Used for plain turns and Idempotency-Key turns (new and resumed).
• The Idempotency-Key in-process duplicate 409 now carries Retry-After too.
• Exported SESSION_BUSY_RETRY_AFTER_S from channelCore.ts (export only) so channels and /chat share the value.
• Docs: deployment.md (status + resend table), errors.md; llms regenerated.

Tests

New src/server/chatBusy.test.ts (two file-store replicas, one holding the lease): 409 + Retry-After: 2 + coded JSON body; Idempotency-Key resend while the original runs elsewhere gets 409, then replays (Idempotent-Replayed) after it finishes; same-process duplicate has Retry-After. Fails without the fix (200 instead of 409). tsc, typecheck:tests, lint, api:check, docs:llms, fallow (exit 0) pass; src suite passes except packages/create-lousho-agent tests (need a packed SDK/install; environment-only on Windows).

Behavior change: a busy session over POST /chat is now an HTTP 409 rather than a 200 stream with an error event; the response starts after the turn's first event rather than immediately.

Changelog: POST /chat answers 409 with Retry-After and code: LOUSHO_SESSION_BUSY when another process or replica is running the session.

🤖 Generated with Claude Code