Merge the release with the security review fixes into the data-safety review fixes

src/lib/openapi/error-codes.ts

@@ -57,6 +57,7 @@ export const ERROR_CODE_CATALOGUE: Readonly<Record<string, readonly string[]>> =
     aiRuns: [
       "aiRuns.failed",
       "aiRuns.notFound",
+      "aiRuns.readerBusy",
       "aiRuns.timedOut",
       "aiRuns.workerUnavailable",
     ],

src/lib/openapi/routes/ai-runs.ts

@@ -64,7 +64,7 @@ const aiRun = z
       })
       .nullable()
       .describe(
-        "Present once `status` is `FAILED`: the `meta.errorCode`, message and HTTP status the queuing route would have answered with, or one of the run's own codes: `aiRuns.workerUnavailable` (no worker took the run within fifteen minutes), `aiRuns.timedOut` (the read outlived the calls the AI response time allows), `aiRuns.failed` (anything else).",
+        "Present once `status` is `FAILED`: the `meta.errorCode`, message and HTTP status the queuing route would have answered with, or one of the run's own codes: `aiRuns.workerUnavailable` (no worker took the run within fifteen minutes), `aiRuns.timedOut` (the read outlived the calls the AI response time allows), `aiRuns.readerBusy` (the server's document reader was busy past the wait a read gets, or stopped before it answered; nothing was read or charged, try again in a minute), `aiRuns.failed` (anything else).",
       ),
     createdAt: z.string(),
     startedAt: z.string().nullable(),

src/lib/openapi/routes/index.ts

@@ -288,7 +288,8 @@ export const openApiComponents: NonNullable<ZodOpenApiObject["components"]> = {
       type: "apiKey",
       in: "cookie",
       name: "healthlog_session",
-      description: "Browser session cookie — set by /api/auth/login.",
+      description:
+        "Browser session cookie — set by /api/auth/login. Named `__Host-healthlog_session` wherever the cookie is `Secure` (every HTTPS install); a plain-HTTP install, which cannot hold a `__Host-` cookie, keeps `healthlog_session`.",
     },
   },
 };