fix(llm): preserve serving retry policy

packages/llm/llm/README.md

@@ -15,7 +15,7 @@ An adapter registry plus a single streaming call surface, interceptable via a wa
 - `ctx.llm.resolveModelContext(provider: string, model: string): Promise<LlmModelContext | undefined>` Resolve authoritative context capacity for one exact route from its owning adapter.
 - `ctx.llm.stream(options: GenerateOptions): AsyncIterable<StreamChunk>` Stream one model call as raw chunks (token-level deltas). Consumers assemble the chunks into blocks/messages with `BlockAssembler`.
 
-`LlmService` preserves errors from final adapter selection, synchronous dispatch, iterator construction, and iteration, and binds their provenance to the exact stream handle returned for that model call. `isLlmAdapterFailure(stream, value)` reports only errors from that call's final adapter boundary; `llmFailureOf(stream, value)` returns the adjacent immutable `LlmFailure`. Nested model calls, `llm/stream` middleware, and downstream consumer failures remain unclassified for the outer call. Classification never replaces or mutates the adapter's original coded `Error`.
+`LlmService` preserves errors from final adapter selection, synchronous dispatch, iterator construction, and iteration, and binds their provenance to the exact stream handle returned for that model call. `isLlmAdapterFailure(stream, value)` reports only errors from that call's final adapter boundary; `llmFailureOf(stream, value)` returns the adjacent immutable `LlmFailure`; `llmRetryPolicyOf(stream)` returns the immutable policy of the exact registration selected at that boundary, even if the route is later disposed or replaced. A call that never reaches a final adapter has no serving policy. Nested model calls, `llm/stream` middleware, and downstream consumer failures remain unclassified for the outer call. Classification never replaces or mutates the adapter's original coded `Error`.
 
 Provider and model metadata is a discovery surface, not a routing whitelist. `registerAdapter()` still owns provider exclusivity and captures the adapter's retry policy for each route, while an adapter may accept model ids absent from `listModels()`; consumers must not reject a request because its model is unlisted. Returned selector metadata is detached and invalid or duplicate adapter entries fail with `INVALID_ADAPTER` or `INVALID_CATALOG`.
 

packages/llm/llm/src/adapter-failure.ts

@@ -6,9 +6,15 @@
 
 import { HarnessError } from './error.ts'
 import type { LlmFailure, StreamChunk } from './types.ts'
+import type { ResolvedRetryPolicy } from './retry-policy.ts'
 
-/** Errors and normalized facts proven to originate in one model call's final adapter boundary. */
-export type AdapterFailureScope = WeakMap<Error, LlmFailure>
+/** Call-local facts captured when one model call enters its final adapter boundary. */
+export interface AdapterFailureScope {
+  /** Errors and normalized facts proven to originate in this call's final adapter boundary. */
+  readonly failures: WeakMap<Error, LlmFailure>
+  /** Immutable policy of the exact adapter registration selected for this call. */
+  retryPolicy?: ResolvedRetryPolicy
+}
 
 /** Call-local failure scopes keyed by the exact stream handle returned to a consumer. */
 const adapterFailureScopes = new WeakMap<AsyncIterable<StreamChunk>, AdapterFailureScope>()
@@ -52,7 +58,7 @@ export function markLlmAdapterFailure(
     message: errorMessage(error),
     code: harnessErrorCode(error),
   })
-  failures.set(error, failure)
+  failures.failures.set(error, failure)
   return error
 }
 
@@ -124,7 +130,7 @@ export function isLlmAdapterFailure(
   value: unknown,
 ): value is Error & { code?: string } {
   const failures = adapterFailureScopes.get(stream)
-  return value instanceof Error && failures !== undefined && failures.has(value)
+  return value instanceof Error && failures !== undefined && failures.failures.has(value)
 }
 
 /**
@@ -139,5 +145,18 @@ export function llmFailureOf(
   value: unknown,
 ): LlmFailure | undefined {
   const failures = adapterFailureScopes.get(stream)
-  return value instanceof Error ? failures?.get(value) : undefined
+  return value instanceof Error ? failures?.failures.get(value) : undefined
+}
+
+/**
+ * Read the retry policy of the exact registration selected at this call's
+ * final adapter boundary. The policy remains available after that registration
+ * is disposed or replaced; absence means no final adapter served the call.
+ * @param stream - the exact stream returned by the model call.
+ * @returns the immutable serving-registration policy, or `undefined`.
+ */
+export function llmRetryPolicyOf(
+  stream: AsyncIterable<StreamChunk>,
+): ResolvedRetryPolicy | undefined {
+  return adapterFailureScopes.get(stream)?.retryPolicy
 }

packages/llm/llm/src/index.ts

@@ -33,7 +33,7 @@ export * from './retry-policy.ts'
 export { BlockAssembler } from './assembler.ts'
 export { callConfigEquals, deepFreeze, isAgentLoopRequest, markAgentLoopRequest } from './call-config.ts'
 export type { LlmCallConfig } from './call-config.ts'
-export { isLlmAdapterFailure, llmFailureOf } from './adapter-failure.ts'
+export { isLlmAdapterFailure, llmFailureOf, llmRetryPolicyOf } from './adapter-failure.ts'
 
 declare module 'cordis' {
   interface Context {
@@ -337,7 +337,9 @@ export class LlmService extends Service {
   ): AsyncGenerator<StreamChunk> {
     let iterator: AsyncIterator<StreamChunk>
     try {
-      const adapter = this.registration(options.provider).adapter
+      const registration = this.registration(options.provider)
+      failures.retryPolicy = registration.retryPolicy
+      const adapter = registration.adapter
       const stream = adapter.stream(this.forAdapter(options, adapter))
       iterator = stream[Symbol.asyncIterator]()
     } catch (error: unknown) {
@@ -386,7 +388,7 @@ export class LlmService extends Service {
    * @returns the chunk stream, possibly wrapped by `llm/stream` listeners.
    */
   stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
-    const failures: AdapterFailureScope = new WeakMap<Error, LlmFailure>()
+    const failures: AdapterFailureScope = { failures: new WeakMap<Error, LlmFailure>() }
     const stream = this.ctx.waterfall(this, 'llm/stream', options, () => this.adapterStream(options, failures))
     return bindAdapterFailureScope(stream, failures)
   }

packages/llm/llm/tests/service.spec.ts

@@ -10,6 +10,7 @@ import LlmService, {
   LlmAdapter,
   LlmError,
   llmFailureOf,
+  llmRetryPolicyOf,
   ProviderRequestId,
   resolveRetryPolicy,
   StreamChunk,
@@ -181,6 +182,51 @@ describe('LlmService', () => {
     )
   })
 
+  it('keeps the serving registration policy on an in-flight call after route replacement', async () => {
+    const oldPolicy = resolveRetryPolicy({ mode: 'always' }, 'old retryPolicy')
+    const newPolicy = resolveRetryPolicy({ mode: 'normal', maxRetries: 0 }, 'new retryPolicy')
+    const entered = Promise.withResolvers<undefined>()
+    const release = Promise.withResolvers<undefined>()
+    const failure = new LlmError('old route failed', 'AUTH')
+    const oldAdapter = new class extends LlmAdapter {
+      override providerRetryPolicy(): typeof oldPolicy {
+        return oldPolicy
+      }
+
+      async * stream(_options: GenerateOptions): AsyncIterable<StreamChunk> {
+        entered.resolve(undefined)
+        await release.promise
+        throw failure
+      }
+    }()
+    const newAdapter = new class extends ScriptedAdapter {
+      override providerRetryPolicy(): typeof newPolicy {
+        return newPolicy
+      }
+    }(SCRIPT)
+    const ctx = new Context()
+    await ctx.plugin(LlmService)
+    const disposeOld = ctx.llm.registerAdapter(['route'], oldAdapter)
+    const stream = ctx.llm.stream({ provider: 'route', model: 'model', messages: [] })
+    const outcome = (async (): Promise<unknown> => {
+      try {
+        for await (const _chunk of stream) { /* drain */ }
+      } catch (error: unknown) {
+        return error
+      }
+      return undefined
+    })()
+    await entered.promise
+
+    disposeOld()
+    ctx.llm.registerAdapter(['route'], newAdapter)
+    release.resolve(undefined)
+
+    expect(await outcome).toBe(failure)
+    expect(llmRetryPolicyOf(stream)).toBe(oldPolicy)
+    expect(ctx.llm.providerRetryPolicy('route')).toBe(newPolicy)
+  })
+
   it('throws NO_ADAPTER for unregistered providers', async () => {
     const ctx = new Context()
     await ctx.plugin(LlmService)
@@ -195,6 +241,7 @@ describe('LlmService', () => {
     expect((caught as LlmError).code).toBe('NO_ADAPTER')
     expect((caught as LlmError).message).toContain('no adapter registered')
     expect(isLlmAdapterFailure(stream, caught)).toBe(true)
+    expect(llmRetryPolicyOf(stream)).toBeUndefined()
   })
 
   it.each(['done', 'value'] as const)('tags a throwing IteratorResult.%s getter without replacing its Error', async (field) => {