@boardwalk-labs/runner 0.1.20 → 0.1.21

package/dist/daemon/daemon.js

@@ -7,7 +7,6 @@
 // per-run workspace, then tears the workspace down (contract: cleanup "always").
 import { mkdir, rm } from "node:fs/promises";
 import * as path from "node:path";
-import * as os from "node:os";
 import { createLogger } from "../runtime/support/index.js";
 /** Assignment-lease heartbeat cadence — comfortably beats the 300s lease. */
 const HEARTBEAT_MS = 60_000;
@@ -23,7 +22,10 @@ export function runProcessEnv(claim, opts) {
         BOARDWALK_CONTROL_PLANE_URL: claim.control_plane.base_url,
         BOARDWALK_RUN_TOKEN: claim.control_plane.run_token,
         BOARDWALK_API_KEY: claim.control_plane.api_token,
-        BOARDWALK_TASK_CPU_UNITS: String(os.cpus().length * 1024),
+        // BOARDWALK_TASK_CPU_UNITS is deliberately ABSENT: self-hosted compute is Boardwalk-unbilled
+        // (SELF_HOSTED_RUNNERS.md D5), so the runtime's wall-clock fallback (1 vCPU) is the right
+        // display metric. Stamping the host's core count here billed a run at cores × the compute rate
+        // for hardware the org owns.
         // The org's BYO inference providers, as data (the runner-direct BYO design) — consumed by the runtime's direct
         // model path. Names + endpoints + secret NAMES only; never a credential value.
         BOARDWALK_BYO_PROVIDERS: JSON.stringify(claim.byo_providers),

package/dist/runtime/freeze_coordinator.d.ts

@@ -65,6 +65,11 @@ export interface FreezeCoordinatorHooks {
     /** Runs when a wake lands, before the seam resolves: swap the run/api tokens onto the
      *  broker client and rebase the runtime meter past the frozen window. */
     onAfterWake?: (wake: WakePayload) => void | Promise<void>;
+    /** Runs when a REQUESTED freeze aborts (`suspend_abort` — snapshot/store failure) before the
+     *  parked seam resolves: undo onBeforeFreeze's reversible effects (resume the paused runtime
+     *  flusher) since the run now HOLDS in-process instead of freezing. Not called for a failure
+     *  inside onBeforeFreeze itself — that hook owns its own unwind. Must not throw. */
+    onFreezeAborted?: () => void;
 }
 export interface FreezeCoordinatorDeps {
     channel: RelayChannel;

package/dist/runtime/freeze_coordinator.js

@@ -237,6 +237,9 @@ export class FreezeCoordinator {
         }
         const resolve = this.parked;
         this.parked = null;
+        // The freeze is off — the seam will hold in-process, so onBeforeFreeze's reversible prep
+        // (the paused runtime flusher) must unwind before the hold starts metering-blind.
+        this.hooks.onFreezeAborted?.();
         resolve({ kind: "aborted", reason });
     }
     awaitQuiescence(abort) {

package/dist/runtime/index.js

@@ -406,6 +406,16 @@ export function assembleWorkerDeps(runtime) {
                     // The recorder never spans a snapshot: finalize + upload the in-flight segment before the
                     // freeze (SCREEN_CAPTURE §4.3). Bounded internally, so a slow upload delays, not blocks, it.
                     await capture?.stopAndFlush();
+                    // Pause LAST (nothing after it can throw, so a failed persist never strands a paused
+                    // flusher): with the timer off, no tick can land in the post-wake sliver between the
+                    // guest clock resync and excludeIdle below — a tick there would compute its delta over
+                    // the whole frozen window and bill suspended time. Resumed on wake and on suspend_abort.
+                    activeFlusher?.pause();
+                },
+                // The freeze died (snapshot/store failure) — the seam holds in-process, which must keep
+                // metering: undo the pre-freeze pause.
+                onFreezeAborted: () => {
+                    activeFlusher?.resume();
                 },
                 // On wake: reseed the userspace CSPRNG (clause 3 — a suspend snapshot restored more than
                 // once, e.g. a re-dispatch retry, would otherwise repeat its post-wake `crypto.*` draws),
@@ -426,6 +436,8 @@ export function assembleWorkerDeps(runtime) {
                         redactor.record(wake.api_token);
                     }
                     activeFlusher?.excludeIdle(wake.wall_clock_ms - freezeWallMs);
+                    // Only now that the frozen window is excluded may the flush timer run again.
+                    activeFlusher?.resume();
                     // Resume capture in a fresh segment epoch (a suspend/resume boundary is a segment boundary).
                     void capture?.startFresh();
                 },

package/dist/runtime/runtime_flusher.d.ts

@@ -38,6 +38,17 @@ export declare class RuntimeFlusher {
     excludeIdle(ms: number): void;
     /** Begin periodic delta flushing. */
     start(): void;
+    /**
+     * Suspend the periodic timer across a VM freeze — the pre-freeze hook pauses AFTER the tail flush
+     * (as its last, non-throwing step), and the wake path resumes AFTER {@link excludeIdle}. Without
+     * this, a tick landing in the sliver between the guest clock resync and the idle rebase would
+     * compute its delta over the whole frozen window and bill suspended time. Reversible, unlike
+     * {@link stop}; a freeze that aborts (snapshot failure → the seam holds in-process) must resume so
+     * a long hold keeps metering.
+     */
+    pause(): void;
+    /** Restart periodic flushing after {@link pause} (wake, or a freeze abort). No-op once stopped. */
+    resume(): void;
     /** Stop the periodic timer and drain any in-flight flush. Does NOT book the final tail — call
      *  {@link flushFinal} for that on a clean terminal. Idempotent. */
     stop(): Promise<void>;

package/dist/runtime/runtime_flusher.js

@@ -58,6 +58,26 @@ export class RuntimeFlusher {
         // Don't keep the worker process alive solely for the flush timer.
         this.timer.unref();
     }
+    /**
+     * Suspend the periodic timer across a VM freeze — the pre-freeze hook pauses AFTER the tail flush
+     * (as its last, non-throwing step), and the wake path resumes AFTER {@link excludeIdle}. Without
+     * this, a tick landing in the sliver between the guest clock resync and the idle rebase would
+     * compute its delta over the whole frozen window and bill suspended time. Reversible, unlike
+     * {@link stop}; a freeze that aborts (snapshot failure → the seam holds in-process) must resume so
+     * a long hold keeps metering.
+     */
+    pause() {
+        if (this.timer === null)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** Restart periodic flushing after {@link pause} (wake, or a freeze abort). No-op once stopped. */
+    resume() {
+        if (this.stopped)
+            return;
+        this.start();
+    }
     /** Stop the periodic timer and drain any in-flight flush. Does NOT book the final tail — call
      *  {@link flushFinal} for that on a clean terminal. Idempotent. */
     async stop() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {