@boardwalk-labs/runner 0.1.20 → 0.2.0

package/dist/daemon/daemon.js

@@ -7,7 +7,6 @@
 // per-run workspace, then tears the workspace down (contract: cleanup "always").
 import { mkdir, rm } from "node:fs/promises";
 import * as path from "node:path";
-import * as os from "node:os";
 import { createLogger } from "../runtime/support/index.js";
 /** Assignment-lease heartbeat cadence — comfortably beats the 300s lease. */
 const HEARTBEAT_MS = 60_000;
@@ -23,7 +22,10 @@ export function runProcessEnv(claim, opts) {
         BOARDWALK_CONTROL_PLANE_URL: claim.control_plane.base_url,
         BOARDWALK_RUN_TOKEN: claim.control_plane.run_token,
         BOARDWALK_API_KEY: claim.control_plane.api_token,
-        BOARDWALK_TASK_CPU_UNITS: String(os.cpus().length * 1024),
+        // BOARDWALK_TASK_CPU_UNITS is deliberately ABSENT: self-hosted compute is Boardwalk-unbilled
+        // (SELF_HOSTED_RUNNERS.md D5), so the runtime's wall-clock fallback (1 vCPU) is the right
+        // display metric. Stamping the host's core count here billed a run at cores × the compute rate
+        // for hardware the org owns.
         // The org's BYO inference providers, as data (the runner-direct BYO design) — consumed by the runtime's direct
         // model path. Names + endpoints + secret NAMES only; never a credential value.
         BOARDWALK_BYO_PROVIDERS: JSON.stringify(claim.byo_providers),

package/dist/runtime/freeze_coordinator.d.ts

@@ -65,6 +65,11 @@ export interface FreezeCoordinatorHooks {
     /** Runs when a wake lands, before the seam resolves: swap the run/api tokens onto the
      *  broker client and rebase the runtime meter past the frozen window. */
     onAfterWake?: (wake: WakePayload) => void | Promise<void>;
+    /** Runs when a REQUESTED freeze aborts (`suspend_abort` — snapshot/store failure) before the
+     *  parked seam resolves: undo onBeforeFreeze's reversible effects (resume the paused runtime
+     *  flusher) since the run now HOLDS in-process instead of freezing. Not called for a failure
+     *  inside onBeforeFreeze itself — that hook owns its own unwind. Must not throw. */
+    onFreezeAborted?: () => void;
 }
 export interface FreezeCoordinatorDeps {
     channel: RelayChannel;

package/dist/runtime/freeze_coordinator.js

@@ -237,6 +237,9 @@ export class FreezeCoordinator {
         }
         const resolve = this.parked;
         this.parked = null;
+        // The freeze is off — the seam will hold in-process, so onBeforeFreeze's reversible prep
+        // (the paused runtime flusher) must unwind before the hold starts metering-blind.
+        this.hooks.onFreezeAborted?.();
         resolve({ kind: "aborted", reason });
     }
     awaitQuiescence(abort) {

package/dist/runtime/index.d.ts

@@ -32,7 +32,7 @@ export interface WorkerRuntime {
     vcpus: number;
     /** The in-guest identity relay, present ONLY on the snapshot-based microVM substrate (relay-mode
      *  boot). When set, the worker suspends by FREEZING — the FreezeCoordinator parks seams over this
-     *  relay's suspend/wake channel — instead of the exit-and-replay path. */
+     *  relay's suspend/wake channel — the whole VM freezes and the wake resolves seams in place. */
     freezeRelay?: IdentityRelay;
     /** The browser tier's process backend, present ONLY when the runner IMAGE ships the browser stack
      *  (Chromium + a pre-installed Playwright MCP + an X display; gated by BOARDWALK_BROWSER_TIER).

package/dist/runtime/index.js

@@ -99,10 +99,6 @@ export function assembleWorkerDeps(runtime) {
         runId: runtime.runId,
     });
     log.info("runner_control_enabled", { runId: runtime.runId });
-    // The replay frontier (the highest journaled seq at claim) drives SILENT REPLAY (the durable-suspension design):
-    // a resumed run suppresses observability for seams it already ran. Captured at claim, read by
-    // buildHost (which runs right after claim) when constructing the per-run host.
-    let replayFrontier = 0;
     // Snapshot-substrate suspension (relay-mode boot only): one coordinator for the process, wired to
     // the relay's suspend/wake channel now; its per-run hooks (token swap, meter rebase, workspace
     // persist) late-bind in buildHost/startRuntimeFlush once those objects exist. The circular
@@ -304,13 +300,6 @@ export function assembleWorkerDeps(runtime) {
                 workspaceRoot: runtime.workspaceRoot,
             })
             : undefined;
-        // Durable suspension (the durable-suspension design): the host raises a suspend OUT OF BAND (onSuspend +
-        // a never-resolving seam), so a program's own try/catch can't swallow it; the program runner
-        // races `suspendSignal` against the body. One deferred per run — the first seam to suspend wins.
-        let resolveSuspend = () => undefined;
-        const suspendSignal = new Promise((resolve) => {
-            resolveSuspend = resolve;
-        });
         // The run's identity + on-demand public-API bearer, surfaced to the program via `import { runtime }`.
         // ids come from the claimed run; the bearer is the captured (scrubbed-from-env) api token, already
         // recorded in this run's redactor above — so threading it into an MCP header keeps it out of LLM
@@ -341,13 +330,6 @@ export function assembleWorkerDeps(runtime) {
             runtime: runtimeContext,
             // workflows.call → broker /children (resolve + callable_by gate server-side), bound to THIS run.
             children: new BrokerChildDispatcher({ client: broker }),
-            // The durable-seam journal (memoization + replay) over the broker; the replay frontier drives
-            // silent replay; onSuspend resolves the deferred the program runner races.
-            journal: broker.journalSeam(),
-            replayFrontier,
-            onSuspend: (signal) => {
-                resolveSuspend(signal);
-            },
             // The program's secrets.get(name) → the run's fail-closed RECORDING resolver.
             secrets: { get: (name) => secretResolver.resolve({ name }) },
             // events.emit → broker /events (fan-out server-side).
@@ -373,19 +355,15 @@ export function assembleWorkerDeps(runtime) {
                     },
                 }
                 : {}),
-            // Snapshot-substrate suspension: seams freeze in place under the quiescence gate instead of
-            // raising onSuspend (which stays wired as the transitional/local path's fallback).
+            // Snapshot-substrate suspension: seams freeze in place under the quiescence gate. Absent
+            // (a self-hosted daemon / the Fargate break-glass), waiting seams HOLD the live process.
             ...(freeze !== undefined ? { freeze } : {}),
-            // Register-without-release for held HITL gates — only on the
-            // freeze substrate, backed by the broker's inputs endpoints.
-            ...(freeze !== undefined
-                ? {
-                    heldInput: {
-                        register: (seq, gate) => broker.registerInput(seq, gate),
-                        poll: (seq) => broker.pollInputAnswers(seq),
-                    },
-                }
-                : {}),
+            // Held HITL gates, backed by the broker's inputs endpoints: register-without-release on the
+            // freeze substrate, and the WHOLE gate mechanism (register + poll) on the hold path.
+            heldInput: {
+                register: (seq, gate) => broker.registerInput(seq, gate),
+                poll: (seq) => broker.pollInputAnswers(seq),
+            },
             // Browser tier: `computer.openBrowser()` + `agent({ session })` resolve through this manager
             // (absent ⇒ the host throws "not available on this runner image").
             ...(browserSessions !== undefined ? { browserSessions } : {}),
@@ -406,6 +384,16 @@ export function assembleWorkerDeps(runtime) {
                     // The recorder never spans a snapshot: finalize + upload the in-flight segment before the
                     // freeze (SCREEN_CAPTURE §4.3). Bounded internally, so a slow upload delays, not blocks, it.
                     await capture?.stopAndFlush();
+                    // Pause LAST (nothing after it can throw, so a failed persist never strands a paused
+                    // flusher): with the timer off, no tick can land in the post-wake sliver between the
+                    // guest clock resync and excludeIdle below — a tick there would compute its delta over
+                    // the whole frozen window and bill suspended time. Resumed on wake and on suspend_abort.
+                    activeFlusher?.pause();
+                },
+                // The freeze died (snapshot/store failure) — the seam holds in-process, which must keep
+                // metering: undo the pre-freeze pause.
+                onFreezeAborted: () => {
+                    activeFlusher?.resume();
                 },
                 // On wake: reseed the userspace CSPRNG (clause 3 — a suspend snapshot restored more than
                 // once, e.g. a re-dispatch retry, would otherwise repeat its post-wake `crypto.*` draws),
@@ -426,6 +414,8 @@ export function assembleWorkerDeps(runtime) {
                         redactor.record(wake.api_token);
                     }
                     activeFlusher?.excludeIdle(wake.wall_clock_ms - freezeWallMs);
+                    // Only now that the frozen window is excluded may the flush timer run again.
+                    activeFlusher?.resume();
                     // Resume capture in a fresh segment epoch (a suspend/resume boundary is a segment boundary).
                     void capture?.startFresh();
                 },
@@ -451,8 +441,6 @@ export function assembleWorkerDeps(runtime) {
             setProgramDir: (dir) => {
                 programDir = dir;
             },
-            // Resolves when a host seam suspends the run; the program runner races it against the body.
-            suspendSignal,
             ...(workspaceStore !== undefined ? { workspace: workspaceStore } : {}),
             // The orchestrator reaps every still-open browser session on terminal (kill Chromium + its
             // Playwright MCP) so no browser process leaks past the run.
@@ -471,8 +459,6 @@ export function assembleWorkerDeps(runtime) {
                 // Order this session's frames after a previous (crashed) session's, then announce the
                 // lifecycle transition the claim IS — the wire's `running` frame.
                 runEvents.resumeAfter(claimed.lastEventCursor);
-                // The replay frontier for a resumed run (0 on a fresh run); buildHost reads it next.
-                replayFrontier = claimed.lastJournalSeq;
                 runEvents.emit({ kind: "run_status", status: "running" });
                 return claimed.run;
             },
@@ -501,12 +487,6 @@ export function assembleWorkerDeps(runtime) {
         finalizer: {
             finalize: (_id, status, output) => broker.finalize(status, output, runtime.workerId),
         },
-        // Durable suspension (the durable-suspension design): persist the wake condition through the broker (journal
-        // entry + a HITL request row, or the wake time for a long sleep) and release the lease — no
-        // finalize. A wake (an answer or a timer) re-dispatches the run.
-        suspender: {
-            suspend: (signal, workerId) => broker.suspend(signal, workerId),
-        },
         // Runtime metering: flush runtime as periodic deltas (+ a terminal tail) through the broker,
         // idempotent per flush, so a long/perpetual run bills as it burns and the credit watcher sees it —
         // not a single charge at terminal (which a never-terminating run never reached). A fresh per-session

package/dist/runtime/program_runner.d.ts

@@ -1,5 +1,4 @@
 import type { WorkflowHost } from "@boardwalk-labs/workflow/runtime";
-import { type SuspendSignal } from "./suspension.js";
 /**
  * Link THIS runtime's `@boardwalk-labs/workflow` into the exec dir's `node_modules` so the
  * program's bare import resolves anywhere (a self-hosted daemon workspace has no ancestor
@@ -63,18 +62,11 @@ export interface ProgramRunnerDeps {
      * throw (a telemetry hiccup can't change the run's result). Absent ⇒ no output entry.
      */
     onOutput?: (value: unknown) => void;
-    /**
-     * Resolves when a host seam SUSPENDS the run (the durable-suspension design) — the worker wires it to the
-     * host's `onSuspend` so a suspend is surfaced OUT OF BAND, racing the program body. The program's
-     * own `try/catch` can't swallow a suspend this way (the suspending seam never resolves; this signal
-     * short-circuits at the runner). Absent ⇒ no suspension wired (a seam that suspends throws
-     * {@link SuspendError} instead, which is caught here just the same).
-     */
-    suspendSignal?: Promise<SuspendSignal>;
 }
-/** Terminal (or suspended) result of running a workflow program. `output` is what the program
- *  declared via `output(value)` (null when it never did); for a failure it's null and `error` is set;
- *  for a suspension the `signal` carries the wake condition (the worker persists it, no finalize). */
+/** Terminal result of running a workflow program. `output` is what the program declared via
+ *  `output(value)` (null when it never did); for a failure it's null and `error` is set. A waiting
+ *  seam (sleep / humanInput / workflows.call) never surfaces here — it freezes with the VM or
+ *  holds the process, and the body simply continues when the wait is over. */
 export type ProgramResult = {
     kind: "completed";
     output: unknown;
@@ -85,9 +77,6 @@ export type ProgramResult = {
         code: string;
         message: string;
     };
-} | {
-    kind: "suspended";
-    signal: SuspendSignal;
 };
 /**
  * Run a workflow program to completion. Installs the host + input, extracts the VERIFIED artifact +

package/dist/runtime/program_runner.js

@@ -27,7 +27,6 @@ import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import { installHost, installInput, installConfig, takeDeclaredOutput, resetRuntime, } from "@boardwalk-labs/workflow/runtime";
 import { AppError, ErrorCode, createLogger } from "./support/index.js";
-import { SuspendError } from "./suspension.js";
 const log = createLogger("ProgramRunner");
 /** Subdirectory (under the work root) that holds transient extracted program trees. */
 const RUN_DIR = ".bw-runs";
@@ -112,25 +111,11 @@ export async function runWorkflowProgram(args, deps) {
         // runner may point at an arbitrary control plane, so refuse an entry that could escape the
         // extraction dir (absolute path or `..` segment) before importing it.
         const entryPath = resolveEntryPath(dir, args.entry);
-        // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
-        // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own
-        // try/catch (the suspending seam never resolves); (b) a thrown {@link SuspendError} on the
-        // no-`onSuspend` path. Everything else is the program's natural completion / failure.
-        const body = runProgramBody(entryPath, deps);
-        const result = deps.suspendSignal === undefined
-            ? await body
-            : await Promise.race([
-                body,
-                deps.suspendSignal.then((signal) => ({ kind: "suspended", signal })),
-            ]);
-        // If the suspend won the race, the body promise is abandoned (its suspending seam never settles);
-        // swallow any late settle so it can't surface as an unhandled rejection before the process exits.
-        void body.catch(() => undefined);
-        return result;
+        // Run the program body to its natural completion / failure. A waiting seam freezes with the
+        // VM (snapshot substrate) or holds the process — either way the body's own await continues.
+        return await runProgramBody(entryPath, deps);
     }
     catch (err) {
-        if (err instanceof SuspendError)
-            return { kind: "suspended", signal: err.signal };
         const redactText = deps.redactText ?? ((s) => s);
         // Redact BEFORE both sinks: the message can carry a secret the program resolved then threw.
         const message = redactText(err instanceof Error ? err.message : String(err));
@@ -157,9 +142,9 @@ export async function runWorkflowProgram(args, deps) {
 }
 /**
  * Import (= run) the program entry and capture its declared output. Resolves to a `completed`
- * result; a program failure (or a {@link SuspendError} on the no-`onSuspend` path) THROWS and is
- * handled by the caller. A unique dir per run gives a fresh URL so the module cache never returns an
- * already-run program; `@vite-ignore` keeps vitest/vite from statically analyzing the runtime URL.
+ * result; a program failure THROWS and is handled by the caller. A unique dir per run gives a
+ * fresh URL so the module cache never returns an already-run program; `@vite-ignore` keeps
+ * vitest/vite from statically analyzing the runtime URL.
  */
 async function runProgramBody(entryPath, deps) {
     await import(/* @vite-ignore */ pathToFileURL(entryPath).href);

package/dist/runtime/program_worker.d.ts

@@ -3,7 +3,6 @@ import { type WorkflowManifest } from "./wire/manifest.js";
 import type { WorkflowHost } from "@boardwalk-labs/workflow/runtime";
 import type { SecretRedactor } from "./agent/secret_redactor.js";
 import { type LogStream } from "./program_log_capture.js";
-import type { SuspendSignal } from "./suspension.js";
 /** Default 5-minute lease (matches the engine spec). */
 export declare const DEFAULT_LEASE_MS: number;
 /** Race-safe claim surface — RunRepository satisfies it. */
@@ -44,13 +43,6 @@ export type RuntimeMeterStarter = (args: {
 export interface RunFinalizer {
     finalize(runId: string, status: "completed" | "failed", output: unknown): Promise<void>;
 }
-/** Persists a durable SUSPENSION (the durable-suspension design): the broker records the wake condition (a
- *  pending/suspended journal entry + a human-input request row for HITL, or the wake time for a long
- *  sleep), flips the run to its suspended status, and releases the lease — all transactionally. The
- *  run is NOT finalized; a wake (an answer, a child finalize, or a timer) re-dispatches it. */
-export interface RunSuspender {
-    suspend(signal: SuspendSignal, workerId: string): Promise<void>;
-}
 /** Restores/snapshots the workflow's persistent `/workspace`. Best-effort — both no-op when the
  *  run isn't eligible (not opted-in / self-hosted), and neither throws. */
 export interface WorkspaceHandle {
@@ -93,10 +85,6 @@ export type ProgramHostBuilder = (run: Run, manifest: WorkflowManifest, signal:
      *  leaf can resolve this run's bundled skill files (`<dir>/skills/<name>.md`). The orchestrator wires
      *  it to the runner's `onExtracted`. Optional — absent on paths that don't surface bundled files. */
     setProgramDir?: (dir: string) => void;
-    /** Resolves when a host seam SUSPENDS the run — wired to the host's `onSuspend`, threaded into the
-     *  program runner so a suspend short-circuits the body out of band (the durable-suspension design). Absent ⇒
-     *  no durable suspension on this path (a suspend then surfaces as a thrown SuspendError). */
-    suspendSignal?: Promise<SuspendSignal>;
     /** The run's browser-session manager (browser tier). The orchestrator reaps every still-open session
      *  on EVERY terminal path so no Chromium / Playwright MCP process leaks past the run. `closeAll` is
      *  best-effort + never throws. Absent on images without the browser stack. */
@@ -154,9 +142,6 @@ export interface ProgramWorkerDeps {
     /** Periodic runtime metering (optional — absent disables it, e.g. the local/test path). */
     startRuntimeFlush?: RuntimeMeterStarter;
     finalizer: RunFinalizer;
-    /** Persists a durable suspension (the durable-suspension design). Absent ⇒ no suspension support: a run that
-     *  reaches a suspend fails cleanly rather than stranding (the brokered worker always wires it). */
-    suspender?: RunSuspender;
     buildHost: ProgramHostBuilder;
     /** Starts mid-run credit watching for the session (optional — absent disables it). */
     startCreditWatch?: CreditWatchStarter;
@@ -183,8 +168,5 @@ export type ProgramWorkerOutcome = {
 } | {
     kind: "failed";
     reason: string;
-} | {
-    kind: "suspended";
-    reason: string;
 };
 export declare function runProgramWorker(runId: string, deps: ProgramWorkerDeps): Promise<ProgramWorkerOutcome>;

package/dist/runtime/program_worker.js

@@ -110,7 +110,7 @@ export async function runProgramWorker(runId, deps) {
         log.error("worker_host_build_failed", { runId, error: message });
         return { kind: "failed", reason: "host_build_failed" };
     }
-    const { host, redactor, workspace, phases, activity, setProgramDir, lsp, suspendSignal } = built;
+    const { host, redactor, workspace, phases, activity, setProgramDir, lsp } = built;
     const browserSessions = built.browserSessions;
     const capture = built.capture;
     // Guarantee the /workspace sandbox dir exists for EVERY run (persist or not) so a program can write
@@ -193,7 +193,6 @@ export async function runProgramWorker(runId, deps) {
             redactText: (text) => redactor.redactText(text),
             extract: deps.extractArchive,
             ...(setProgramDir !== undefined ? { onExtracted: setProgramDir } : {}),
-            ...(suspendSignal !== undefined ? { suspendSignal } : {}),
             ...(activity !== undefined
                 ? {
                     onOutput: (value) => {
@@ -268,24 +267,6 @@ export async function runProgramWorker(runId, deps) {
         log.info("worker_run_aborted", { runId, reason });
         return { kind: "failed", reason };
     }
-    // Suspended: a host seam released the task (a long `sleep`, a `humanInput()` gate, or the in-leaf
-    // `human_input` tool). Persist the wake condition through the broker — NO finalize — and exit
-    // cleanly; a wake (an answer or a timer) re-dispatches the run, which restarts from the top and
-    // replays the journal past the already-done seams. The runtime tail for THIS session was booked
-    // above, so idle time while suspended is not billed. Phases stay open (the run is non-terminal).
-    if (result.kind === "suspended") {
-        if (deps.suspender === undefined) {
-            phases?.close("failed");
-            await deps.finalizer.finalize(runId, "failed", {
-                error: { code: "SUSPEND_UNSUPPORTED", message: "This runtime cannot suspend a run." },
-            });
-            log.error("worker_suspend_unsupported", { runId });
-            return { kind: "failed", reason: "suspend_unsupported" };
-        }
-        await deps.suspender.suspend(result.signal, deps.workerId);
-        log.info("worker_suspended", { runId, reason: result.signal.reason });
-        return { kind: "suspended", reason: result.signal.reason };
-    }
     if (result.kind === "completed") {
         phases?.close("completed");
         await deps.finalizer.finalize(runId, "completed", result.output);

package/dist/runtime/runner_control_client.d.ts

@@ -1,6 +1,5 @@
 import type { McpTokenResult } from "@boardwalk-labs/engine/core";
 import type { Run } from "./wire/run.js";
-import { type JournalKind, type JournalLookup, type JournalSeam, type SuspendSignal } from "./suspension.js";
 import type { WebSearchOutput } from "./tools/web_search.js";
 import type { ArtifactCommitInput, ArtifactPresignInput, ArtifactPresignResult, ArtifactSignResult, ArtifactSummary, ArtifactWriteInput, ArtifactWriteResult } from "./tools/artifacts.js";
 import { type InferenceFrame, type InferenceProxyRequest } from "./wire/inference_proxy.js";
@@ -61,7 +60,7 @@ export declare class RunnerControlClient {
     /** Swap the bearer for a fresh run token (the wake path). Every subsequent call uses it. */
     swapRunToken(token: string): void;
     /**
-     * Every SHORT control call (claim / renew / cancel / credit / journal / …) goes through here so
+     * Every SHORT control call (claim / renew / cancel / credit / inputs / …) goes through here so
      * it carries a hard timeout. Without one, a poll frozen mid-flight on the snapshot substrate
      * hangs FOREVER on restore (the socket is dead but never reset), and since a watcher serializes
      * its ticks, one hung tick wedges that watcher — the dead-connections gotcha for the
@@ -78,7 +77,7 @@ export declare class RunnerControlClient {
      * reset/refused mid-rollover, our own per-attempt timeout on a dead socket) and the
      * load-balancer's {@link RETRYABLE_STATUSES}. Safe to re-send because every caller's body is a
      * reusable string/byte-array (the streaming inference call bypasses this entirely), and the
-     * broker's mutating endpoints are idempotent per worker/identifier (journal seq, usage
+     * broker's mutating endpoints are idempotent per worker/identifier (gate seq, usage
      * identifier, lease per workerId). Before this, ONE blip during an api-server deploy rollover
      * crashed the worker hard mid-suspend/finalize and only crash-reclaim recovered the run.
      */
@@ -88,7 +87,6 @@ export declare class RunnerControlClient {
     claim(workerId: string, leaseSeconds: number): Promise<{
         run: Run;
         lastEventCursor: number;
-        lastJournalSeq: number;
     } | null>;
     /** Heartbeat: extend our lease so a long run isn't reclaimed mid-flight. Returns the new
      *  `leaseUntil`, or null when the lease was lost (409 — another worker reclaimed the run), which
@@ -98,24 +96,6 @@ export declare class RunnerControlClient {
      *  whose lease expired and whose run was reclaimed + re-dispatched to a new owner), so a
      *  hung/partitioned worker that later recovers can't clobber the live run or revive a terminal one. */
     finalize(status: "completed" | "failed", output: unknown, workerId: string): Promise<void>;
-    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
-     *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
-    journalGet(seq: number): Promise<JournalLookup | null>;
-    /** Record a RESOLVED seam result (idempotent on the run + seq server-side; a resolved entry is
-     *  immutable). The broker writes the memoized value the next replay returns. */
-    journalPut(entry: {
-        seq: number;
-        kind: JournalKind;
-        fingerprint: string;
-        label: string;
-        result: unknown;
-    }): Promise<void>;
-    /** Persist a durable SUSPENSION: the broker records the wake condition (a pending/suspended journal
-     *  entry + a human-input request row for HITL, or the wake time for a long sleep), flips the run to
-     *  its suspended status, and releases the lease — transactionally. No finalize; a wake re-dispatches. */
-    suspend(signal: SuspendSignal, workerId: string): Promise<void>;
-    /** The {@link JournalSeam} the worker host reads/writes — a thin adapter over the broker methods. */
-    journalSeam(): JournalSeam;
     /** Fetch the run's pinned manifest + program source, or null when the version is missing (404). */
     getVersion(): Promise<BrokerVersion | null>;
     /** Book a runtime-seconds DELTA (the worker's RuntimeFlusher → broker). `identifier` makes a

package/dist/runtime/runner_control_client.js

@@ -11,7 +11,6 @@
 // failures (thrown network errors, LB 502/503/504 — a control-plane deploy rollover) are retried
 // with backoff first, so a blip heals in place instead of crashing the run.
 import { createLogger } from "./support/index.js";
-import { journalLookupSchema, } from "./suspension.js";
 import { INFERENCE_NDJSON_CONTENT_TYPE, parseInferenceFrame, serializeInferenceRequest, } from "./wire/inference_proxy.js";
 const log = createLogger("RunnerControlClient");
 /**
@@ -49,7 +48,7 @@ export class RunnerControlClient {
         this.runToken = token;
     }
     /**
-     * Every SHORT control call (claim / renew / cancel / credit / journal / …) goes through here so
+     * Every SHORT control call (claim / renew / cancel / credit / inputs / …) goes through here so
      * it carries a hard timeout. Without one, a poll frozen mid-flight on the snapshot substrate
      * hangs FOREVER on restore (the socket is dead but never reset), and since a watcher serializes
      * its ticks, one hung tick wedges that watcher — the dead-connections gotcha for the
@@ -70,7 +69,7 @@ export class RunnerControlClient {
      * reset/refused mid-rollover, our own per-attempt timeout on a dead socket) and the
      * load-balancer's {@link RETRYABLE_STATUSES}. Safe to re-send because every caller's body is a
      * reusable string/byte-array (the streaming inference call bypasses this entirely), and the
-     * broker's mutating endpoints are idempotent per worker/identifier (journal seq, usage
+     * broker's mutating endpoints are idempotent per worker/identifier (gate seq, usage
      * identifier, lease per workerId). Before this, ONE blip during an api-server deploy rollover
      * crashed the worker hard mid-suspend/finalize and only crash-reclaim recovered the run.
      */
@@ -120,9 +119,6 @@ export class RunnerControlClient {
         return {
             run: body.run,
             lastEventCursor: body.lastEventCursor ?? 0,
-            // The replay frontier for silent replay (the durable-suspension design): the highest journaled seq, so a
-            // resumed run knows which seams already ran (suppress their re-emitted observability).
-            lastJournalSeq: body.lastJournalSeq ?? 0,
         };
     }
     /** Heartbeat: extend our lease so a long run isn't reclaimed mid-flight. Returns the new
@@ -153,49 +149,6 @@ export class RunnerControlClient {
         if (res.status !== 204)
             throw await brokerError(res, "finalize");
     }
-    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
-     *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
-    async journalGet(seq) {
-        const res = await this.controlFetch(this.url(`journal/${encodeURIComponent(String(seq))}`), {
-            method: "GET",
-            headers: this.headers(false),
-        });
-        if (res.status === 404)
-            return null;
-        if (res.status !== 200)
-            throw await brokerError(res, "journal-get");
-        return journalLookupSchema.parse(await res.json());
-    }
-    /** Record a RESOLVED seam result (idempotent on the run + seq server-side; a resolved entry is
-     *  immutable). The broker writes the memoized value the next replay returns. */
-    async journalPut(entry) {
-        const res = await this.controlFetch(this.url("journal"), {
-            method: "POST",
-            headers: this.headers(true),
-            body: JSON.stringify(entry),
-        });
-        if (res.status !== 204)
-            throw await brokerError(res, "journal-put");
-    }
-    /** Persist a durable SUSPENSION: the broker records the wake condition (a pending/suspended journal
-     *  entry + a human-input request row for HITL, or the wake time for a long sleep), flips the run to
-     *  its suspended status, and releases the lease — transactionally. No finalize; a wake re-dispatches. */
-    async suspend(signal, workerId) {
-        const res = await this.controlFetch(this.url("suspend"), {
-            method: "POST",
-            headers: this.headers(true),
-            body: JSON.stringify({ ...signal, workerId }),
-        });
-        if (res.status !== 204)
-            throw await brokerError(res, "suspend");
-    }
-    /** The {@link JournalSeam} the worker host reads/writes — a thin adapter over the broker methods. */
-    journalSeam() {
-        return {
-            get: (seq) => this.journalGet(seq),
-            put: (entry) => this.journalPut(entry),
-        };
-    }
     /** Fetch the run's pinned manifest + program source, or null when the version is missing (404). */
     async getVersion() {
         const res = await this.controlFetch(this.url("version"), {

package/dist/runtime/runtime_flusher.d.ts

@@ -38,6 +38,17 @@ export declare class RuntimeFlusher {
     excludeIdle(ms: number): void;
     /** Begin periodic delta flushing. */
     start(): void;
+    /**
+     * Suspend the periodic timer across a VM freeze — the pre-freeze hook pauses AFTER the tail flush
+     * (as its last, non-throwing step), and the wake path resumes AFTER {@link excludeIdle}. Without
+     * this, a tick landing in the sliver between the guest clock resync and the idle rebase would
+     * compute its delta over the whole frozen window and bill suspended time. Reversible, unlike
+     * {@link stop}; a freeze that aborts (snapshot failure → the seam holds in-process) must resume so
+     * a long hold keeps metering.
+     */
+    pause(): void;
+    /** Restart periodic flushing after {@link pause} (wake, or a freeze abort). No-op once stopped. */
+    resume(): void;
     /** Stop the periodic timer and drain any in-flight flush. Does NOT book the final tail — call
      *  {@link flushFinal} for that on a clean terminal. Idempotent. */
     stop(): Promise<void>;

package/dist/runtime/runtime_flusher.js

@@ -58,6 +58,26 @@ export class RuntimeFlusher {
         // Don't keep the worker process alive solely for the flush timer.
         this.timer.unref();
     }
+    /**
+     * Suspend the periodic timer across a VM freeze — the pre-freeze hook pauses AFTER the tail flush
+     * (as its last, non-throwing step), and the wake path resumes AFTER {@link excludeIdle}. Without
+     * this, a tick landing in the sliver between the guest clock resync and the idle rebase would
+     * compute its delta over the whole frozen window and bill suspended time. Reversible, unlike
+     * {@link stop}; a freeze that aborts (snapshot failure → the seam holds in-process) must resume so
+     * a long hold keeps metering.
+     */
+    pause() {
+        if (this.timer === null)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** Restart periodic flushing after {@link pause} (wake, or a freeze abort). No-op once stopped. */
+    resume() {
+        if (this.stopped)
+            return;
+        this.start();
+    }
     /** Stop the periodic timer and drain any in-flight flush. Does NOT book the final tail — call
      *  {@link flushFinal} for that on a clean terminal. Idempotent. */
     async stop() {