[origin-review] anomalyco/opencode#44517 — LIMITED

[kvnloo]

Why this matters

Providers and transports fail intermittently; a tunable retry surface must classify the right errors without looping forever on overflow or client 4xx.

Evidence

Tip fca21c174dc5a015f4530c84b95da186149210ac (base dev):

• Live: cd packages/opencode && bun test test/session/retry.test.ts → 70 pass / 3 fail (timeouts on policy updates, policy stops after five, one ECONNRESET conversion)
• Core session.retry.retryable and most message-v2.fromError cases passed
• Evidence class: BEHAVIORAL (LIMITED — flaky wall-clock under CI-like caps)

Invariant: matching API/transport capacity and 5xx text retries; context overflow and non-retryable 4xx do not.

Ask (design, light) — prospective; non-blocking

1. Should delay/policy tests use fake timers so wall-clock flakes cannot gate merge?
2. Is five retries the right hard stop for free-tier vs paid, or should that stay config-only?

---

---

Fork mirror of a sealed OSS review draft. Not posted upstream.

• origin: feat: make the session retry policy configurable anomalyco/opencode#44517
• tip: fca21c174dc5a015f4530c84b95da186149210ac
• evidence: BEHAVIORAL — tip packages/opencode bun test test/session/retry.test.ts → 70/73 (3 timeout flakes on delay/fromError; retryable/message-v2 core green)
• pack: 03 draft 021
• dedupe_key: anomalyco/opencode#44517
• github_writes_origin: 0

[kvnloo]

QA found a stronger current blocker than the wall-clock test flake.

The live origin thread shows the author already fixed the earlier overflow / invalid-config findings and explicitly called out one unresolved semantic hazard:

maxRetries = -1 + a zero delay (including server retry-after: 0) can produce an unbounded zero-delay retry loop.

That should be the next acceptance target before treating this as merely LIMITED/flaky:

1. add a regression for unlimited retries + retry-after: 0;
2. decide the contract: minimum delay floor vs disallow -1 vs another bounded-yield mechanism;
3. prove no tight CPU/network loop;
4. then convert the remaining timing-policy tests to fake timers if they are still flaky.

The existing 70-pass/3-timeout result is useful, but it currently underweights this semantic failure mode. Keep origin writes untouched; return the candidate/evidence here.

[kvnloo]

Factory closeout: origin now owns this exact finding.

The PR author already documented the unresolved unlimited-retry + zero-delay hazard upstream; the downstream mirror adds no unposted blocker.

No duplicate upstream post and no duplicate fork repair. Reopen a new downstream leaf only for a materially new origin head/finding.