@boardwalk-labs/runner 0.1.21 → 0.2.0

package/dist/runtime/index.d.ts

@@ -32,7 +32,7 @@ export interface WorkerRuntime {
     vcpus: number;
     /** The in-guest identity relay, present ONLY on the snapshot-based microVM substrate (relay-mode
      *  boot). When set, the worker suspends by FREEZING — the FreezeCoordinator parks seams over this
-     *  relay's suspend/wake channel — instead of the exit-and-replay path. */
+     *  relay's suspend/wake channel — the whole VM freezes and the wake resolves seams in place. */
     freezeRelay?: IdentityRelay;
     /** The browser tier's process backend, present ONLY when the runner IMAGE ships the browser stack
      *  (Chromium + a pre-installed Playwright MCP + an X display; gated by BOARDWALK_BROWSER_TIER).

package/dist/runtime/index.js

@@ -99,10 +99,6 @@ export function assembleWorkerDeps(runtime) {
         runId: runtime.runId,
     });
     log.info("runner_control_enabled", { runId: runtime.runId });
-    // The replay frontier (the highest journaled seq at claim) drives SILENT REPLAY (the durable-suspension design):
-    // a resumed run suppresses observability for seams it already ran. Captured at claim, read by
-    // buildHost (which runs right after claim) when constructing the per-run host.
-    let replayFrontier = 0;
     // Snapshot-substrate suspension (relay-mode boot only): one coordinator for the process, wired to
     // the relay's suspend/wake channel now; its per-run hooks (token swap, meter rebase, workspace
     // persist) late-bind in buildHost/startRuntimeFlush once those objects exist. The circular
@@ -304,13 +300,6 @@ export function assembleWorkerDeps(runtime) {
                 workspaceRoot: runtime.workspaceRoot,
             })
             : undefined;
-        // Durable suspension (the durable-suspension design): the host raises a suspend OUT OF BAND (onSuspend +
-        // a never-resolving seam), so a program's own try/catch can't swallow it; the program runner
-        // races `suspendSignal` against the body. One deferred per run — the first seam to suspend wins.
-        let resolveSuspend = () => undefined;
-        const suspendSignal = new Promise((resolve) => {
-            resolveSuspend = resolve;
-        });
         // The run's identity + on-demand public-API bearer, surfaced to the program via `import { runtime }`.
         // ids come from the claimed run; the bearer is the captured (scrubbed-from-env) api token, already
         // recorded in this run's redactor above — so threading it into an MCP header keeps it out of LLM
@@ -341,13 +330,6 @@ export function assembleWorkerDeps(runtime) {
             runtime: runtimeContext,
             // workflows.call → broker /children (resolve + callable_by gate server-side), bound to THIS run.
             children: new BrokerChildDispatcher({ client: broker }),
-            // The durable-seam journal (memoization + replay) over the broker; the replay frontier drives
-            // silent replay; onSuspend resolves the deferred the program runner races.
-            journal: broker.journalSeam(),
-            replayFrontier,
-            onSuspend: (signal) => {
-                resolveSuspend(signal);
-            },
             // The program's secrets.get(name) → the run's fail-closed RECORDING resolver.
             secrets: { get: (name) => secretResolver.resolve({ name }) },
             // events.emit → broker /events (fan-out server-side).
@@ -373,19 +355,15 @@ export function assembleWorkerDeps(runtime) {
                     },
                 }
                 : {}),
-            // Snapshot-substrate suspension: seams freeze in place under the quiescence gate instead of
-            // raising onSuspend (which stays wired as the transitional/local path's fallback).
+            // Snapshot-substrate suspension: seams freeze in place under the quiescence gate. Absent
+            // (a self-hosted daemon / the Fargate break-glass), waiting seams HOLD the live process.
             ...(freeze !== undefined ? { freeze } : {}),
-            // Register-without-release for held HITL gates — only on the
-            // freeze substrate, backed by the broker's inputs endpoints.
-            ...(freeze !== undefined
-                ? {
-                    heldInput: {
-                        register: (seq, gate) => broker.registerInput(seq, gate),
-                        poll: (seq) => broker.pollInputAnswers(seq),
-                    },
-                }
-                : {}),
+            // Held HITL gates, backed by the broker's inputs endpoints: register-without-release on the
+            // freeze substrate, and the WHOLE gate mechanism (register + poll) on the hold path.
+            heldInput: {
+                register: (seq, gate) => broker.registerInput(seq, gate),
+                poll: (seq) => broker.pollInputAnswers(seq),
+            },
             // Browser tier: `computer.openBrowser()` + `agent({ session })` resolve through this manager
             // (absent ⇒ the host throws "not available on this runner image").
             ...(browserSessions !== undefined ? { browserSessions } : {}),
@@ -463,8 +441,6 @@ export function assembleWorkerDeps(runtime) {
             setProgramDir: (dir) => {
                 programDir = dir;
             },
-            // Resolves when a host seam suspends the run; the program runner races it against the body.
-            suspendSignal,
             ...(workspaceStore !== undefined ? { workspace: workspaceStore } : {}),
             // The orchestrator reaps every still-open browser session on terminal (kill Chromium + its
             // Playwright MCP) so no browser process leaks past the run.
@@ -483,8 +459,6 @@ export function assembleWorkerDeps(runtime) {
                 // Order this session's frames after a previous (crashed) session's, then announce the
                 // lifecycle transition the claim IS — the wire's `running` frame.
                 runEvents.resumeAfter(claimed.lastEventCursor);
-                // The replay frontier for a resumed run (0 on a fresh run); buildHost reads it next.
-                replayFrontier = claimed.lastJournalSeq;
                 runEvents.emit({ kind: "run_status", status: "running" });
                 return claimed.run;
             },
@@ -513,12 +487,6 @@ export function assembleWorkerDeps(runtime) {
         finalizer: {
             finalize: (_id, status, output) => broker.finalize(status, output, runtime.workerId),
         },
-        // Durable suspension (the durable-suspension design): persist the wake condition through the broker (journal
-        // entry + a HITL request row, or the wake time for a long sleep) and release the lease — no
-        // finalize. A wake (an answer or a timer) re-dispatches the run.
-        suspender: {
-            suspend: (signal, workerId) => broker.suspend(signal, workerId),
-        },
         // Runtime metering: flush runtime as periodic deltas (+ a terminal tail) through the broker,
         // idempotent per flush, so a long/perpetual run bills as it burns and the credit watcher sees it —
         // not a single charge at terminal (which a never-terminating run never reached). A fresh per-session

package/dist/runtime/program_runner.d.ts

@@ -1,5 +1,4 @@
 import type { WorkflowHost } from "@boardwalk-labs/workflow/runtime";
-import { type SuspendSignal } from "./suspension.js";
 /**
  * Link THIS runtime's `@boardwalk-labs/workflow` into the exec dir's `node_modules` so the
  * program's bare import resolves anywhere (a self-hosted daemon workspace has no ancestor
@@ -63,18 +62,11 @@ export interface ProgramRunnerDeps {
      * throw (a telemetry hiccup can't change the run's result). Absent ⇒ no output entry.
      */
     onOutput?: (value: unknown) => void;
-    /**
-     * Resolves when a host seam SUSPENDS the run (the durable-suspension design) — the worker wires it to the
-     * host's `onSuspend` so a suspend is surfaced OUT OF BAND, racing the program body. The program's
-     * own `try/catch` can't swallow a suspend this way (the suspending seam never resolves; this signal
-     * short-circuits at the runner). Absent ⇒ no suspension wired (a seam that suspends throws
-     * {@link SuspendError} instead, which is caught here just the same).
-     */
-    suspendSignal?: Promise<SuspendSignal>;
 }
-/** Terminal (or suspended) result of running a workflow program. `output` is what the program
- *  declared via `output(value)` (null when it never did); for a failure it's null and `error` is set;
- *  for a suspension the `signal` carries the wake condition (the worker persists it, no finalize). */
+/** Terminal result of running a workflow program. `output` is what the program declared via
+ *  `output(value)` (null when it never did); for a failure it's null and `error` is set. A waiting
+ *  seam (sleep / humanInput / workflows.call) never surfaces here — it freezes with the VM or
+ *  holds the process, and the body simply continues when the wait is over. */
 export type ProgramResult = {
     kind: "completed";
     output: unknown;
@@ -85,9 +77,6 @@ export type ProgramResult = {
         code: string;
         message: string;
     };
-} | {
-    kind: "suspended";
-    signal: SuspendSignal;
 };
 /**
  * Run a workflow program to completion. Installs the host + input, extracts the VERIFIED artifact +

package/dist/runtime/program_runner.js

@@ -27,7 +27,6 @@ import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import { installHost, installInput, installConfig, takeDeclaredOutput, resetRuntime, } from "@boardwalk-labs/workflow/runtime";
 import { AppError, ErrorCode, createLogger } from "./support/index.js";
-import { SuspendError } from "./suspension.js";
 const log = createLogger("ProgramRunner");
 /** Subdirectory (under the work root) that holds transient extracted program trees. */
 const RUN_DIR = ".bw-runs";
@@ -112,25 +111,11 @@ export async function runWorkflowProgram(args, deps) {
         // runner may point at an arbitrary control plane, so refuse an entry that could escape the
         // extraction dir (absolute path or `..` segment) before importing it.
         const entryPath = resolveEntryPath(dir, args.entry);
-        // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
-        // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own
-        // try/catch (the suspending seam never resolves); (b) a thrown {@link SuspendError} on the
-        // no-`onSuspend` path. Everything else is the program's natural completion / failure.
-        const body = runProgramBody(entryPath, deps);
-        const result = deps.suspendSignal === undefined
-            ? await body
-            : await Promise.race([
-                body,
-                deps.suspendSignal.then((signal) => ({ kind: "suspended", signal })),
-            ]);
-        // If the suspend won the race, the body promise is abandoned (its suspending seam never settles);
-        // swallow any late settle so it can't surface as an unhandled rejection before the process exits.
-        void body.catch(() => undefined);
-        return result;
+        // Run the program body to its natural completion / failure. A waiting seam freezes with the
+        // VM (snapshot substrate) or holds the process — either way the body's own await continues.
+        return await runProgramBody(entryPath, deps);
     }
     catch (err) {
-        if (err instanceof SuspendError)
-            return { kind: "suspended", signal: err.signal };
         const redactText = deps.redactText ?? ((s) => s);
         // Redact BEFORE both sinks: the message can carry a secret the program resolved then threw.
         const message = redactText(err instanceof Error ? err.message : String(err));
@@ -157,9 +142,9 @@ export async function runWorkflowProgram(args, deps) {
 }
 /**
  * Import (= run) the program entry and capture its declared output. Resolves to a `completed`
- * result; a program failure (or a {@link SuspendError} on the no-`onSuspend` path) THROWS and is
- * handled by the caller. A unique dir per run gives a fresh URL so the module cache never returns an
- * already-run program; `@vite-ignore` keeps vitest/vite from statically analyzing the runtime URL.
+ * result; a program failure THROWS and is handled by the caller. A unique dir per run gives a
+ * fresh URL so the module cache never returns an already-run program; `@vite-ignore` keeps
+ * vitest/vite from statically analyzing the runtime URL.
  */
 async function runProgramBody(entryPath, deps) {
     await import(/* @vite-ignore */ pathToFileURL(entryPath).href);

package/dist/runtime/program_worker.d.ts

@@ -3,7 +3,6 @@ import { type WorkflowManifest } from "./wire/manifest.js";
 import type { WorkflowHost } from "@boardwalk-labs/workflow/runtime";
 import type { SecretRedactor } from "./agent/secret_redactor.js";
 import { type LogStream } from "./program_log_capture.js";
-import type { SuspendSignal } from "./suspension.js";
 /** Default 5-minute lease (matches the engine spec). */
 export declare const DEFAULT_LEASE_MS: number;
 /** Race-safe claim surface — RunRepository satisfies it. */
@@ -44,13 +43,6 @@ export type RuntimeMeterStarter = (args: {
 export interface RunFinalizer {
     finalize(runId: string, status: "completed" | "failed", output: unknown): Promise<void>;
 }
-/** Persists a durable SUSPENSION (the durable-suspension design): the broker records the wake condition (a
- *  pending/suspended journal entry + a human-input request row for HITL, or the wake time for a long
- *  sleep), flips the run to its suspended status, and releases the lease — all transactionally. The
- *  run is NOT finalized; a wake (an answer, a child finalize, or a timer) re-dispatches it. */
-export interface RunSuspender {
-    suspend(signal: SuspendSignal, workerId: string): Promise<void>;
-}
 /** Restores/snapshots the workflow's persistent `/workspace`. Best-effort — both no-op when the
  *  run isn't eligible (not opted-in / self-hosted), and neither throws. */
 export interface WorkspaceHandle {
@@ -93,10 +85,6 @@ export type ProgramHostBuilder = (run: Run, manifest: WorkflowManifest, signal:
      *  leaf can resolve this run's bundled skill files (`<dir>/skills/<name>.md`). The orchestrator wires
      *  it to the runner's `onExtracted`. Optional — absent on paths that don't surface bundled files. */
     setProgramDir?: (dir: string) => void;
-    /** Resolves when a host seam SUSPENDS the run — wired to the host's `onSuspend`, threaded into the
-     *  program runner so a suspend short-circuits the body out of band (the durable-suspension design). Absent ⇒
-     *  no durable suspension on this path (a suspend then surfaces as a thrown SuspendError). */
-    suspendSignal?: Promise<SuspendSignal>;
     /** The run's browser-session manager (browser tier). The orchestrator reaps every still-open session
      *  on EVERY terminal path so no Chromium / Playwright MCP process leaks past the run. `closeAll` is
      *  best-effort + never throws. Absent on images without the browser stack. */
@@ -154,9 +142,6 @@ export interface ProgramWorkerDeps {
     /** Periodic runtime metering (optional — absent disables it, e.g. the local/test path). */
     startRuntimeFlush?: RuntimeMeterStarter;
     finalizer: RunFinalizer;
-    /** Persists a durable suspension (the durable-suspension design). Absent ⇒ no suspension support: a run that
-     *  reaches a suspend fails cleanly rather than stranding (the brokered worker always wires it). */
-    suspender?: RunSuspender;
     buildHost: ProgramHostBuilder;
     /** Starts mid-run credit watching for the session (optional — absent disables it). */
     startCreditWatch?: CreditWatchStarter;
@@ -183,8 +168,5 @@ export type ProgramWorkerOutcome = {
 } | {
     kind: "failed";
     reason: string;
-} | {
-    kind: "suspended";
-    reason: string;
 };
 export declare function runProgramWorker(runId: string, deps: ProgramWorkerDeps): Promise<ProgramWorkerOutcome>;

package/dist/runtime/program_worker.js

@@ -110,7 +110,7 @@ export async function runProgramWorker(runId, deps) {
         log.error("worker_host_build_failed", { runId, error: message });
         return { kind: "failed", reason: "host_build_failed" };
     }
-    const { host, redactor, workspace, phases, activity, setProgramDir, lsp, suspendSignal } = built;
+    const { host, redactor, workspace, phases, activity, setProgramDir, lsp } = built;
     const browserSessions = built.browserSessions;
     const capture = built.capture;
     // Guarantee the /workspace sandbox dir exists for EVERY run (persist or not) so a program can write
@@ -193,7 +193,6 @@ export async function runProgramWorker(runId, deps) {
             redactText: (text) => redactor.redactText(text),
             extract: deps.extractArchive,
             ...(setProgramDir !== undefined ? { onExtracted: setProgramDir } : {}),
-            ...(suspendSignal !== undefined ? { suspendSignal } : {}),
             ...(activity !== undefined
                 ? {
                     onOutput: (value) => {
@@ -268,24 +267,6 @@ export async function runProgramWorker(runId, deps) {
         log.info("worker_run_aborted", { runId, reason });
         return { kind: "failed", reason };
     }
-    // Suspended: a host seam released the task (a long `sleep`, a `humanInput()` gate, or the in-leaf
-    // `human_input` tool). Persist the wake condition through the broker — NO finalize — and exit
-    // cleanly; a wake (an answer or a timer) re-dispatches the run, which restarts from the top and
-    // replays the journal past the already-done seams. The runtime tail for THIS session was booked
-    // above, so idle time while suspended is not billed. Phases stay open (the run is non-terminal).
-    if (result.kind === "suspended") {
-        if (deps.suspender === undefined) {
-            phases?.close("failed");
-            await deps.finalizer.finalize(runId, "failed", {
-                error: { code: "SUSPEND_UNSUPPORTED", message: "This runtime cannot suspend a run." },
-            });
-            log.error("worker_suspend_unsupported", { runId });
-            return { kind: "failed", reason: "suspend_unsupported" };
-        }
-        await deps.suspender.suspend(result.signal, deps.workerId);
-        log.info("worker_suspended", { runId, reason: result.signal.reason });
-        return { kind: "suspended", reason: result.signal.reason };
-    }
     if (result.kind === "completed") {
         phases?.close("completed");
         await deps.finalizer.finalize(runId, "completed", result.output);

package/dist/runtime/runner_control_client.d.ts

@@ -1,6 +1,5 @@
 import type { McpTokenResult } from "@boardwalk-labs/engine/core";
 import type { Run } from "./wire/run.js";
-import { type JournalKind, type JournalLookup, type JournalSeam, type SuspendSignal } from "./suspension.js";
 import type { WebSearchOutput } from "./tools/web_search.js";
 import type { ArtifactCommitInput, ArtifactPresignInput, ArtifactPresignResult, ArtifactSignResult, ArtifactSummary, ArtifactWriteInput, ArtifactWriteResult } from "./tools/artifacts.js";
 import { type InferenceFrame, type InferenceProxyRequest } from "./wire/inference_proxy.js";
@@ -61,7 +60,7 @@ export declare class RunnerControlClient {
     /** Swap the bearer for a fresh run token (the wake path). Every subsequent call uses it. */
     swapRunToken(token: string): void;
     /**
-     * Every SHORT control call (claim / renew / cancel / credit / journal / …) goes through here so
+     * Every SHORT control call (claim / renew / cancel / credit / inputs / …) goes through here so
      * it carries a hard timeout. Without one, a poll frozen mid-flight on the snapshot substrate
      * hangs FOREVER on restore (the socket is dead but never reset), and since a watcher serializes
      * its ticks, one hung tick wedges that watcher — the dead-connections gotcha for the
@@ -78,7 +77,7 @@ export declare class RunnerControlClient {
      * reset/refused mid-rollover, our own per-attempt timeout on a dead socket) and the
      * load-balancer's {@link RETRYABLE_STATUSES}. Safe to re-send because every caller's body is a
      * reusable string/byte-array (the streaming inference call bypasses this entirely), and the
-     * broker's mutating endpoints are idempotent per worker/identifier (journal seq, usage
+     * broker's mutating endpoints are idempotent per worker/identifier (gate seq, usage
      * identifier, lease per workerId). Before this, ONE blip during an api-server deploy rollover
      * crashed the worker hard mid-suspend/finalize and only crash-reclaim recovered the run.
      */
@@ -88,7 +87,6 @@ export declare class RunnerControlClient {
     claim(workerId: string, leaseSeconds: number): Promise<{
         run: Run;
         lastEventCursor: number;
-        lastJournalSeq: number;
     } | null>;
     /** Heartbeat: extend our lease so a long run isn't reclaimed mid-flight. Returns the new
      *  `leaseUntil`, or null when the lease was lost (409 — another worker reclaimed the run), which
@@ -98,24 +96,6 @@ export declare class RunnerControlClient {
      *  whose lease expired and whose run was reclaimed + re-dispatched to a new owner), so a
      *  hung/partitioned worker that later recovers can't clobber the live run or revive a terminal one. */
     finalize(status: "completed" | "failed", output: unknown, workerId: string): Promise<void>;
-    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
-     *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
-    journalGet(seq: number): Promise<JournalLookup | null>;
-    /** Record a RESOLVED seam result (idempotent on the run + seq server-side; a resolved entry is
-     *  immutable). The broker writes the memoized value the next replay returns. */
-    journalPut(entry: {
-        seq: number;
-        kind: JournalKind;
-        fingerprint: string;
-        label: string;
-        result: unknown;
-    }): Promise<void>;
-    /** Persist a durable SUSPENSION: the broker records the wake condition (a pending/suspended journal
-     *  entry + a human-input request row for HITL, or the wake time for a long sleep), flips the run to
-     *  its suspended status, and releases the lease — transactionally. No finalize; a wake re-dispatches. */
-    suspend(signal: SuspendSignal, workerId: string): Promise<void>;
-    /** The {@link JournalSeam} the worker host reads/writes — a thin adapter over the broker methods. */
-    journalSeam(): JournalSeam;
     /** Fetch the run's pinned manifest + program source, or null when the version is missing (404). */
     getVersion(): Promise<BrokerVersion | null>;
     /** Book a runtime-seconds DELTA (the worker's RuntimeFlusher → broker). `identifier` makes a

package/dist/runtime/runner_control_client.js

@@ -11,7 +11,6 @@
 // failures (thrown network errors, LB 502/503/504 — a control-plane deploy rollover) are retried
 // with backoff first, so a blip heals in place instead of crashing the run.
 import { createLogger } from "./support/index.js";
-import { journalLookupSchema, } from "./suspension.js";
 import { INFERENCE_NDJSON_CONTENT_TYPE, parseInferenceFrame, serializeInferenceRequest, } from "./wire/inference_proxy.js";
 const log = createLogger("RunnerControlClient");
 /**
@@ -49,7 +48,7 @@ export class RunnerControlClient {
         this.runToken = token;
     }
     /**
-     * Every SHORT control call (claim / renew / cancel / credit / journal / …) goes through here so
+     * Every SHORT control call (claim / renew / cancel / credit / inputs / …) goes through here so
      * it carries a hard timeout. Without one, a poll frozen mid-flight on the snapshot substrate
      * hangs FOREVER on restore (the socket is dead but never reset), and since a watcher serializes
      * its ticks, one hung tick wedges that watcher — the dead-connections gotcha for the
@@ -70,7 +69,7 @@ export class RunnerControlClient {
      * reset/refused mid-rollover, our own per-attempt timeout on a dead socket) and the
      * load-balancer's {@link RETRYABLE_STATUSES}. Safe to re-send because every caller's body is a
      * reusable string/byte-array (the streaming inference call bypasses this entirely), and the
-     * broker's mutating endpoints are idempotent per worker/identifier (journal seq, usage
+     * broker's mutating endpoints are idempotent per worker/identifier (gate seq, usage
      * identifier, lease per workerId). Before this, ONE blip during an api-server deploy rollover
      * crashed the worker hard mid-suspend/finalize and only crash-reclaim recovered the run.
      */
@@ -120,9 +119,6 @@ export class RunnerControlClient {
         return {
             run: body.run,
             lastEventCursor: body.lastEventCursor ?? 0,
-            // The replay frontier for silent replay (the durable-suspension design): the highest journaled seq, so a
-            // resumed run knows which seams already ran (suppress their re-emitted observability).
-            lastJournalSeq: body.lastJournalSeq ?? 0,
         };
     }
     /** Heartbeat: extend our lease so a long run isn't reclaimed mid-flight. Returns the new
@@ -153,49 +149,6 @@ export class RunnerControlClient {
         if (res.status !== 204)
             throw await brokerError(res, "finalize");
     }
-    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
-     *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
-    async journalGet(seq) {
-        const res = await this.controlFetch(this.url(`journal/${encodeURIComponent(String(seq))}`), {
-            method: "GET",
-            headers: this.headers(false),
-        });
-        if (res.status === 404)
-            return null;
-        if (res.status !== 200)
-            throw await brokerError(res, "journal-get");
-        return journalLookupSchema.parse(await res.json());
-    }
-    /** Record a RESOLVED seam result (idempotent on the run + seq server-side; a resolved entry is
-     *  immutable). The broker writes the memoized value the next replay returns. */
-    async journalPut(entry) {
-        const res = await this.controlFetch(this.url("journal"), {
-            method: "POST",
-            headers: this.headers(true),
-            body: JSON.stringify(entry),
-        });
-        if (res.status !== 204)
-            throw await brokerError(res, "journal-put");
-    }
-    /** Persist a durable SUSPENSION: the broker records the wake condition (a pending/suspended journal
-     *  entry + a human-input request row for HITL, or the wake time for a long sleep), flips the run to
-     *  its suspended status, and releases the lease — transactionally. No finalize; a wake re-dispatches. */
-    async suspend(signal, workerId) {
-        const res = await this.controlFetch(this.url("suspend"), {
-            method: "POST",
-            headers: this.headers(true),
-            body: JSON.stringify({ ...signal, workerId }),
-        });
-        if (res.status !== 204)
-            throw await brokerError(res, "suspend");
-    }
-    /** The {@link JournalSeam} the worker host reads/writes — a thin adapter over the broker methods. */
-    journalSeam() {
-        return {
-            get: (seq) => this.journalGet(seq),
-            put: (entry) => this.journalPut(entry),
-        };
-    }
     /** Fetch the run's pinned manifest + program source, or null when the version is missing (404). */
     async getVersion() {
         const res = await this.controlFetch(this.url("version"), {

package/dist/runtime/suspension.d.ts

@@ -1,20 +1,15 @@
-import { z } from "zod";
-import type { LeafCheckpoint, LeafResume } from "@boardwalk-labs/engine/core";
-import { AppError } from "./support/index.js";
+import type { LeafCheckpoint } from "@boardwalk-labs/engine/core";
 /**
- * Sleeps at/above this hold-vs-release boundary SUSPEND (release the task; a timer re-dispatches the
- * run when due); shorter ones HOLD the process in-memory, where a release + replay round-trip costs
- * more than it saves. Mirrors the engine's `SUSPEND_THRESHOLD_MS` so the two runtimes draw the line
- * in the same place.
+ * Sleeps at/above this boundary SUSPEND on the snapshot substrate (freeze the VM; the wake fires
+ * when the sleep is due); shorter ones HOLD the process in-memory, where a snapshot round-trip
+ * costs more than it saves. Without a freeze substrate every sleep holds, whatever its length.
  */
 export declare const SUSPEND_THRESHOLD_MS = 30000;
-/** The durable-seam kinds the journal memoizes (mirrors `run_journal.kind` + the engine's IPC). */
-export type JournalKind = "agent" | "step" | "human_input" | "sleep" | "workflow_call";
 /** Why a seam suspended the run. */
 export type SuspendReason = "human_input" | "sleep" | "workflow_call";
 /** A human-in-the-loop gate carried out of a suspending seam (program-level or the in-leaf tool). */
 export interface HumanInputGate {
-    /** The stable key the responder answers by (an author/seq key, or the model's tool-call id). */
+    /** The stable key the responder answers by (an author/derived key, or the model's tool-call id). */
     key: string;
     prompt: string;
     /** The response form ({@link import("@boardwalk-labs/workflow").HumanInputSpec}); validated on submit. */
@@ -29,13 +24,14 @@ export interface HumanInputGate {
 /** Everything the broker needs to persist a suspension + the wake condition. */
 export interface SuspendSignal {
     reason: SuspendReason;
-    /** The journal seq of the suspending seam. */
+    /** The suspension's within-run key (a monotonic per-run counter): it keys the HITL gate rows the
+     *  wake joins answers from. Not a journal seq — there is no journal. */
     seq: number;
-    /** The seam's determinism fingerprint (recorded on the pending journal entry). */
-    fingerprint: string;
     /** Present for `reason: "human_input"` — the gate to register a request row for. */
     humanInput?: HumanInputGate;
-    /** A tool-level gate's leaf transcript checkpoint, stored so the leaf resumes where it paused. */
+    /** A tool-level gate's leaf transcript checkpoint. On the snapshot substrate the transcript
+     *  rides in the frozen heap — this field is informational for the control plane, not a resume
+     *  source. */
     leafCheckpoint?: LeafCheckpoint;
     /** Relative wait (ms) for `reason: "sleep"`; the broker computes the absolute wake time. */
     durationMs?: number;
@@ -43,99 +39,8 @@ export interface SuspendSignal {
      *  woken when this child finalizes (the sweep wakes a parent whose child is terminal). */
     childRunId?: string;
 }
-/**
- * The control signal a host seam raises to suspend the run. Unlike the engine (a child process the
- * supervisor kills out-of-band), the backend worker runs the program IN-PROCESS, so a suspend is
- * surfaced by the host calling `onSuspend(signal)` and returning a NEVER-resolving promise; the
- * worker races that against the program body and tears down. This class exists so a seam that has no
- * `onSuspend` wired (the local/test path) can still raise a typed, catchable signal.
- */
-export declare class SuspendError extends Error {
-    readonly signal: SuspendSignal;
-    constructor(signal: SuspendSignal);
-}
-/** Journal-entry states (mirrors `run_journal.state` + the engine's IPC). */
-export declare const JOURNAL_STATES: readonly ["pending", "suspended", "resolved"];
-export type JournalEntryState = (typeof JOURNAL_STATES)[number];
-/** A memoized journal entry, as the host reads it back on replay (mirrors the engine's IPC shape). */
-export interface JournalLookup {
-    seq: number;
-    kind: JournalKind;
-    fingerprint: string;
-    /** `resolved` ⇒ `result` is the memoized value; `suspended` ⇒ a parked agent leaf (result is the
-     *  {@link LeafResume} the host re-enters with); `pending` ⇒ awaiting an external event (re-suspend). */
-    state: JournalEntryState;
-    result: unknown;
-}
-/** Validate the broker's journal_get response (the worker's run token doesn't exempt the channel from
- *  validation). The result is genuinely heterogeneous JSON (an agent return / a LeafResume / a
- *  HumanInputResult), parsed per-kind downstream — so it stays `unknown` here, the validation seam. */
-export declare const journalLookupSchema: z.ZodObject<{
-    seq: z.ZodNumber;
-    kind: z.ZodEnum<{
-        sleep: "sleep";
-        agent: "agent";
-        step: "step";
-        human_input: "human_input";
-        workflow_call: "workflow_call";
-    }>;
-    fingerprint: z.ZodString;
-    state: z.ZodEnum<{
-        pending: "pending";
-        suspended: "suspended";
-        resolved: "resolved";
-    }>;
-    result: z.ZodUnknown;
-}, z.core.$strip>;
-/** The journal the host reads (replay lookup) + writes (resolved seam results). Backed by the broker
- *  over the run token on hosted runs; absent on the local/test path (no durable suspension). */
-export interface JournalSeam {
-    /** The memoized entry for a seam, or null on a replay miss. */
-    get(seq: number): Promise<JournalLookup | null>;
-    /** Record a RESOLVED seam result (idempotent on the run + seq; a resolved entry is immutable). */
-    put(entry: {
-        seq: number;
-        kind: JournalKind;
-        fingerprint: string;
-        label: string;
-        result: unknown;
-    }): Promise<void>;
-}
-/**
- * The synchronous, monotonic durable-seam counter. Incremented at each journaled seam's ENTRY:
- * because a program's synchronous call order is deterministic (even under `Promise.all`, whose
- * `.map(...)` runs left-to-right synchronously), the same logical call gets the same `seq` on every
- * execution — the journal key that lets a resumed run return a memoized result.
- *
- * It also drives SILENT REPLAY: a resume starts suppressed (observability — console output, phase
- * markers — was already emitted last segment) and goes `live` the moment it reaches the suspending
- * seam (the frontier = the highest journaled seq). A fresh run (frontier 0) is live immediately.
- */
-export declare class SeamSequencer {
-    private readonly replayFrontier;
+/** A monotonic per-run counter for suspension/gate keys (the `seq` on {@link SuspendSignal}). */
+export declare class SuspensionCounter {
     private count;
-    private liveFlag;
-    constructor(replayFrontier?: number);
     next(): number;
-    /** True once execution has crossed the replay frontier — output after this point is NEW. */
-    get isLive(): boolean;
-    /** True while re-running already-journaled seams on a resume (observability suppressed). */
-    isReplaying(): boolean;
 }
-/** The child run id a `workflow_call` seam journals while it waits (parsed back on resume). */
-export declare const childRunIdSchema: z.ZodString;
-/** A stable content hash of a seam's salient args — the determinism check on replay. Identical
- *  construction to the engine's `seamFingerprint` so a journal written by one runtime validates in
- *  the other (the conformance promise). */
-export declare function seamFingerprint(parts: readonly unknown[]): string;
-/** A seam reached on replay didn't match what the journal recorded at that seq — the workflow's code
- *  on the path to a suspend changed (a different prompt/model/step name, or a different seam kind).
- *  Fails the run loudly rather than returning a stale memoized result for the wrong call. */
-export declare function determinismError(seq: number, got: JournalKind, recorded: JournalKind): AppError;
-/**
- * The shape of a SUSPENDED agent leaf's journal result on resume: the transcript checkpoint plus the
- * answers the broker joined from the resolved request rows, keyed by tool-call id. `messages` is the
- * engine's own serialized transcript round-tripping through JSON — handed straight back to the leaf,
- * not re-validated field-by-field. Structurally a {@link LeafResume}.
- */
-export declare const leafResumeSchema: z.ZodType<LeafResume>;