flow: Phase 3 suspend/resume/cancel via deterministic replay + 17 tests

Guest Scheme call/cc is escape-only (re-entry hangs), so durable resume uses
deterministic replay: suspend escapes to the driver; resume re-runs the flow and
replays resolved suspends from a (tag value) log. No live continuation is ever
serialized — persisted state is plain data, survives restart. Adds flow/start
(now state-returning, backward compatible), flow/resume, flow/cancel, store.sx.
Harness reuses one env with a per-test reset (full env rebuild 66x was too slow).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/flow-on-sx.md

@@ -16,7 +16,7 @@ federation extension via fed-sx for remote-node execution.
 
 ## Status (rolling)
 
-`bash lib/flow/conformance.sh` → **49/49** (Phases 1-2 done; Phase 3 next)
+`bash lib/flow/conformance.sh` → **66/66** (Phases 1-2 done; Phase 3 suspend/resume/cancel done, crash-recovery next)
 
 ## Ground rules
 
@@ -94,13 +94,21 @@ lib/flow/spec.sx           lib/flow/runtime.sx          lib/flow/store.sx
 
 ## Phase 3 — Suspend / resume (the showcase)
 
-- [ ] `(suspend reason)` — `call/cc` captures continuation, returns flow-id to caller
-- [ ] `lib/flow/store.sx` — serialize flow state (continuation + open vars)
-- [ ] `(flow/resume id value)` — load continuation, inject value, re-enter
-- [ ] `(flow/cancel id)` — explicit termination
+- [x] `(suspend tag)` — guest call/cc is ESCAPE-ONLY (re-entry hangs), so resume
+  uses **deterministic replay**: suspend escapes to the driver as `(flow-suspended
+  tag)`; resume re-runs the flow, replaying resolved suspends from a `(tag value)`
+  log. No live continuation is ever serialized — the log is plain data.
+- [x] `lib/flow/store.sx` — flow store: id→record `(flow input log status payload)`;
+  `flow-drive` runs a flow against a replay log.
+- [x] `(flow/resume id value)` — append `(tag value)` to the log, re-drive; raw
+  result on completion, `(flow-suspended id tag)` on a further suspend.
+- [x] `(flow/cancel id)` — mark cancelled; a later resume is rejected (stale replay
+  cannot wake a cancelled flow).
 - [ ] crash recovery — on restart, scan store for paused flows, mark resumable
-- [ ] `lib/flow/tests/suspend.sx` — pause-resume scenarios, cancellation, "restart"
-  scenarios (simulated by re-loading store)
+- [x] `lib/flow/tests/suspend.sx` — 17 cases: start/resume/cancel, multi-step,
+  replay determinism, lifecycle guards, suspend-in-branch
+- Harness: `flow-run` now reuses one env with a per-test reset (building the full
+  standard env 66× was too slow) — see `api.sx`.
 
 ## Phase 4 — Distributed nodes via fed-sx