fix(invariants): harden runtime contracts and gates

packages/llm/llm-retry/README.md

@@ -6,7 +6,7 @@ The default policy permits two retries for `RATE_LIMIT`, `SERVER`, `TIMEOUT`, an
 
 Before waiting, the plugin appends a non-surface `llm/retry` event with the failure and scheduled delay. Cancellation and plugin disposal abort the wait; disposal drains the plugin's active backoffs, and a callback captured before disposal fails closed if invoked afterward.
 
-The separately published `./invariant` companion checks that every retry record names the current open turn and its latest closed step, has a unique step record and increasing retry number, and carries a positive bounded retry budget and timer delay.
+The separately published `./invariant` companion checks that every retry record names the current open turn and its latest closed step, has a unique step record and increasing retry number, and carries a positive bounded retry budget and non-negative bounded timer delay. Full jitter may schedule zero milliseconds at its lower boundary.
 
 ```yaml
 - name: '@deepseek-ai/dsh-llm-retry'

packages/llm/llm-retry/src/invariant.ts

@@ -26,8 +26,8 @@ function validateRetry(
   if (!Number.isSafeInteger(maxRetries) || maxRetries < 1 || retry > maxRetries) {
     fail(`llm/retry retry ${retry} must not exceed a positive safe maxRetries ${maxRetries}`)
   }
-  if (!(delayMs > 0 && delayMs <= MAX_TIMER_DELAY_MS)) {
-    fail(`llm/retry delayMs must be within 1..${MAX_TIMER_DELAY_MS}`)
+  if (!(delayMs >= 0 && delayMs <= MAX_TIMER_DELAY_MS)) {
+    fail(`llm/retry delayMs must be within 0..${MAX_TIMER_DELAY_MS}`)
   }
 
   const currentTurnEvents: SessionEvent[] = []

packages/llm/llm-retry/tests/invariant.spec.ts

@@ -36,6 +36,10 @@ describe('llm-retry invariants', () => {
       session.append('llm/retry', {
         turn: 1, step: 2, retry: 2, maxRetries: 2, delayMs: 1_000, failure,
       })
+      const zeroDelay = closeStep(ctx, 'retry-invariant-zero-delay')
+      zeroDelay.append('llm/retry', {
+        turn: 1, step: 1, retry: 1, maxRetries: 1, delayMs: 0, failure,
+      })
     }).not.toThrow()
     expect(() => { ctx.emit('tools/change') }).not.toThrow()
   })
@@ -46,7 +50,7 @@ describe('llm-retry invariants', () => {
     [{ retry: 1, maxRetries: 0, delayMs: 1 }, /positive safe maxRetries/],
     [{ retry: 1, maxRetries: 1.5, delayMs: 1 }, /positive safe maxRetries/],
     [{ retry: 3, maxRetries: 2, delayMs: 1 }, /must not exceed/],
-    [{ retry: 1, maxRetries: 2, delayMs: 0 }, /delayMs/],
+    [{ retry: 1, maxRetries: 2, delayMs: -1 }, /delayMs/],
     [{ retry: 1, maxRetries: 2, delayMs: MAX_TIMER_DELAY_MS + 1 }, /delayMs/],
   ])('rejects invalid retry bounds %#', async (data, message) => {
     const ctx = await setup()

packages/llm/llm-retry/tests/retry.spec.ts

@@ -232,6 +232,29 @@ describe('bounded transient retry policy', () => {
     })
   })
 
+  it('accepts the zero-delay lower jitter bound', async () => {
+    vi.useFakeTimers()
+    const adapter = new ScriptedAdapter([
+      new LlmError('busy', 'SERVER'),
+      textResponse('done'),
+    ])
+    ;({ ctx: context } = await harness(adapter, {
+      initialDelayMs: 1,
+      maxDelayMs: 1,
+      jitterRatio: 1,
+    }, undefined, { random: () => 0 }))
+    const agent = context.agentLoop.create(SessionId('retry-zero-delay'), { provider: 'mock', model: 'mock' })
+    const scheduled = waitForRetry(context, agent, 1)
+
+    agent.send([{ type: 'text', text: 'go' }])
+    expect((await scheduled).data.delayMs).toBe(0)
+
+    const idle = waitForIdle(context, agent)
+    await vi.runAllTimersAsync()
+    await idle
+    expect(adapter.requests).toHaveLength(2)
+  })
+
   it('uses a bounded provider Retry-After verbatim and delegates an over-cap instruction', async () => {
     vi.useFakeTimers()
     const accepted = new ScriptedAdapter([