@hicaru/pi-rlm 0.3.16 → 0.3.17

package/src/prompts/glossary.ts

@@ -27,7 +27,7 @@ export function promptCapTokensK(maxPromptChars: number): number {
  * well, small ones guess keywords badly, and the first decomposition disproportionately decides
  * the outcome (§5, Fig. 4a). These cost no tokens and no sub-calls.
  */
-export const RETRIEVAL_GLOSSARY_LINES: readonly string[] = Object.freeze([
+const RETRIEVAL_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "- `search(query: str, k=10, path_glob=None)`: BM25 ranking over `context`. Returns",
   "  [{path, line, score, snippet, text}] — POINTERS, not bodies (`text` aliases `snippet`).",
   "  **Start here.** Free: no sub-LLM call. Use before guessing filenames.",
@@ -42,15 +42,44 @@ export const RETRIEVAL_GLOSSARY_LINES: readonly string[] = Object.freeze([
 /** v5 delegation doctrine (audit C5): children have NO retrieval tools — their world is the
  *  sliced `context` they were handed. This REPLACES the retrieval lines in child prompts so
  *  the prompt and the runtime sandbox agree (a child taught to `search` burns turns on NameError). */
-export const DELEGATION_SURFACE_LINES: readonly string[] = Object.freeze([
+const DELEGATION_SURFACE_LINES: readonly string[] = Object.freeze([
   "- **No `search` / `grep_context` / `outline` / `add_context` in this REPL** (delegation",
   "  surface, v5 doctrine): your task arrived WITH its world in `context`. Explore it with",
   "  Python (list comprehensions, string matching, slicing) and delegate slices to sub-LLMs —",
   "  never re-ask the parent for retrieval.",
 ]);
 
+/** Workstream E: the one new sandbox function (prime-agent rule — surface grows by one). */
+const SKILL_SEARCH_GLOSSARY_LINES: readonly string[] = Object.freeze([
+  "- `skill_search(query, k=8) -> [{id, text, tags, score}]`: BM25 over distilled project facts",
+  "  from PRIOR sessions (SkillState). Free: no sub-LLM call. Use when a config/gotcha/symbol",
+  "  smells like something already learned — do not re-discover it.",
+]);
+
+/** Single source of wording for the injected SkillState block (headless + native, Workstream C).
+ *  Takes the dynamic body as an argument — the glossary itself stays static-only. */
+/** One wording source for the skill_search recall hint (Ξ block + root Σ snapshot). */
+export const SKILL_RECALL_LINE =
+  "Recall more anytime inside repl: `skill_search(query, k=8)` → [{id, text, tags, score}].";
+
+export function skillStateLines(noteCount: number, body: string): string {
+  return [
+    `[Project facts — SkillState, ${noteCount} note${noteCount === 1 ? "" : "s"}, distilled from prior sessions]`,
+    body,
+    SKILL_RECALL_LINE,
+  ].join("\n");
+}
+
+/** Root Σ WS-2 digest wording — the single source for the header and section labels. */
+export const ROOT_DIGEST_HEADER =
+  "[Root digest — deterministic structural compaction (no model call). Older turns are " +
+  "superseded by this digest plus the verbatim tail that follows; fresh tool results " +
+  "outrank the digest when they disagree.]";
+export const ROOT_DIGEST_SECTIONS: Readonly<Record<"task" | "findings" | "state" | "next" | "facts", string>> =
+  Object.freeze({ task: "Task", findings: "Findings", state: "State", next: "Next", facts: "Project facts" });
+
 /** One-line delegation helpers — orchestrating must be cheaper than solving. */
-export const DELEGATION_GLOSSARY_LINES: readonly string[] = Object.freeze([
+const DELEGATION_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "- `map_files(files, prompt) -> Task`: always spawn. `await_task(t)` → dict[path, answer].",
   "  Accepts context entries or paths; packs into cap-sized batches; splits oversized files.",
   "  **Default way to read many files** — fire independent `map_files` Tasks, free work, then await.",
@@ -59,14 +88,14 @@ export const DELEGATION_GLOSSARY_LINES: readonly string[] = Object.freeze([
 ]);
 
 /** Shared glossary entry for the chunked-query helper (headless + native). */
-export const CHUNKED_GLOSSARY_LINES: readonly string[] = Object.freeze([
+const CHUNKED_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "- `llm_query_chunked(text: str, prompt: str) -> Task`: always spawn. `await_task(t)` → list[str]",
   "  (one answer per chunk, order preserved). Auto-splits text to the sub-LLM prompt cap.",
   "  Use for ANY text too large for a single `llm_query` — open()ed files, oversized sub-results.",
 ]);
 
 /** Non-blocking fan-out: spawn now, collect later (headless glossary). */
-export const SPAWN_GLOSSARY_LINES: readonly string[] = Object.freeze([
+const SPAWN_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "- **ALWAYS SPAWN (Task + ↗bg):** `llm_query` / `llm_batch` / `rlm_query` / `rlm_batch` /",
   "  `map_files` / `llm_query_chunked`. Never treat the return as the answer.",
   "  Collect with `await_task(t)`, `await_task([t1,t2,…])`, or `await_task()` (every still-running Task).",
@@ -81,7 +110,7 @@ export const SPAWN_GLOSSARY_LINES: readonly string[] = Object.freeze([
 ]);
 
 /** v5 (audit C5): the spawn worked example, retrieval flavor — root surface only. */
-export const SPAWN_EXAMPLE_RETRIEVAL: readonly string[] = Object.freeze([
+const SPAWN_EXAMPLE_RETRIEVAL: readonly string[] = Object.freeze([
   "",
   "  ```python",
   "  # Multi-area study: one rlm_batch (parallel workers), free locate, then await",
@@ -96,7 +125,7 @@ export const SPAWN_EXAMPLE_RETRIEVAL: readonly string[] = Object.freeze([
 ]);
 
 /** v5 (audit C5): the spawn worked example, delegation flavor — no retrieval, slice instead. */
-export const SPAWN_EXAMPLE_DELEGATION: readonly string[] = Object.freeze([
+const SPAWN_EXAMPLE_DELEGATION: readonly string[] = Object.freeze([
   "",
   "  ```python",
   "  # Multi-area study: one rlm_batch (parallel workers), slice your world while they run",
@@ -109,7 +138,7 @@ export const SPAWN_EXAMPLE_DELEGATION: readonly string[] = Object.freeze([
   "  # One-shot extracts: map_files / llm_batch also return Task → await_task",
   "  ```",
 ]);
-export const RECURSION_CONTEXT_LINES: readonly string[] = Object.freeze([
+const RECURSION_CONTEXT_LINES: readonly string[] = Object.freeze([
   "",
   "  **What a child sees:** it inherits YOUR `context` — every file you have loaded, including",
   "  sources under `ctx/<id>/…` — and runs `search` / `grep_context` / `outline` / `map_files`",
@@ -125,7 +154,7 @@ export const RECURSION_CONTEXT_LINES: readonly string[] = Object.freeze([
 
 /** v5 recursion section, delegation variant (audit C5): describes what a delegation child
  *  receives — the narrowed pack as text, no retrieval of its own. */
-export const RECURSION_DELEGATION_LINES: readonly string[] = Object.freeze([
+const RECURSION_DELEGATION_LINES: readonly string[] = Object.freeze([
   "",
   "  **What a child sees:** it inherits YOUR `context` (narrowed by `paths=` when given) and works",
   "  on it as text — it has NO retrieval tools, so put what matters in your prompt and `paths`,",
@@ -140,14 +169,14 @@ export const RECURSION_DELEGATION_LINES: readonly string[] = Object.freeze([
  * Sub-RLM orientation. Emitted only at depth > 0, where `context` is the parent's world rather
  * than a repository the run packed for itself.
  */
-export const CHILD_CONTEXT_LINES: readonly string[] = Object.freeze([
+const CHILD_CONTEXT_LINES: readonly string[] = Object.freeze([
   "  You are a sub-RLM. This `context` is your parent's world — every file it has loaded (cwd",
   "  paths un-prefixed; external sources under `ctx/<id>/…`). Answer only the question above;",
   "  your REPL and anything you load die with you, and only your final answer string returns.",
 ]);
 
 /** Why a file the user mentioned may be missing from `context`. */
-export const CONTEXT_EXCLUSION_NOTE = [
+const CONTEXT_EXCLUSION_NOTE = [
   "  NOTE: `context` holds only the files you have loaded (starts empty; cwd seeds on first use).",
   "  Gitignored files and files larger than 1MB of plain text are skipped. Binary documents",
   "  (PDF, DOCX, XLSX, PPTX, CSV, …) ARE included — converted to Markdown on the way in.",
@@ -231,9 +260,6 @@ export function envTips(delegation = false): string {
   ].join("\n");
 }
 
-/** Root-surface doctrine (back-compat alias of `envTips(false)`). */
-export const ENV_TIPS = envTips(false);
-
 /** Native-mode variant of the doctrine — same rules, sized for the native prompt budget. */
 export const ENV_TIPS_CONDENSED = [
   "### Decomposition doctrine",
@@ -314,6 +340,7 @@ export function replGlossary(
     "  await_task → ordered list[str]. NEVER pass bare file paths as if the worker can open them.",
     ...CHUNKED_GLOSSARY_LINES,
     ...SPAWN_GLOSSARY_LINES,
+    ...SKILL_SEARCH_GLOSSARY_LINES,
     ...(delegation ? SPAWN_EXAMPLE_DELEGATION : SPAWN_EXAMPLE_RETRIEVAL),
     ...DELEGATION_GLOSSARY_LINES,
   );
@@ -357,17 +384,6 @@ export function replGlossary(
     "  verified result in `answers` — see the decomposition doctrine below.",
     "- `SHOW_VARS() -> str`: list every variable currently in the REPL (Task handles show as `<Task …>`).",
     "- `list_tasks()`: every Task this REPL created — [{kind, label, done, var}].",
-    ...(delegation
-      ? [
-          "- `memory.query(q) -> str`: durable notes under `.rlm/` that survive across sessions.",
-          "  **READ-ONLY here** — `memory.add` is root-only. Query before re-studying a known area;",
-          "  your own final answer is recorded as an episode automatically.",
-        ]
-      : [
-          "- `memory.query(q) -> str` / `memory.add(text, paths=…, tags=…)`: durable notes under `.rlm/`",
-          "  that survive across sessions. Query before re-studying a known area; add concise findings",
-          "  (facts, locations, decisions) — never secrets or API keys (notes persist on disk).",
-        ]),
     "- `list_claims()`: the live `[ledger]` table of inflight/done agent work.",
     '- `answer`: a dict initialized to {"content": "", "ready": False}. To submit your final answer,',
     '  set `answer["content"]` to the answer text and `answer["ready"] = True`.',

package/src/prompts/native.ts

@@ -45,9 +45,7 @@ function nativeReplGlossary(): string {
     "### Memo / finalize",
     "- `answers` / `plan` — persistent dicts for **collected** results. Task handles are REPL vars (`t`), not `answers` keys.",
     "- `add_context(source) -> dict` — append external dir/file/doc/git under `ctx/<id>/…` (metadata only).",
-    "- `memory.query(q)` / `memory.add(text, paths=…, tags=…)` — durable notes under `.rlm/` that survive",
-    "  sessions. Query before re-studying a known area; add concise findings — never secrets or API",
-    "  keys (notes persist on disk). `list_claims()` — the live `[ledger]` table of agent work.",
+    "- `list_claims()` — the live `[ledger]` table of agent work.",
     "- `SHOW_VARS()` — list REPL vars (Tasks as `<Task …>`). `list_tasks()` finds Task handles. `answer[\"ready\"]=True` only for headless finalize (native: write a normal message).",
     "",
     ENV_TIPS_CONDENSED,

package/src/prompts/system.ts

@@ -17,14 +17,17 @@ import {
 
 export { contextKindOf, type ContextKind } from "./glossary.ts";
 
-export interface PromptMeta {
+interface PromptMeta {
   readonly contextType: string;
   readonly contextChars: number;
   readonly contextStats?: ContextSizeStats;
   readonly rootPrompt?: string;
+  /** SKILL.state Ξ (Workstream C): verified project facts from prior sessions. Per-run
+   *  argument only — never baked into any module-load snapshot. */
+  readonly skillBlock?: string;
 }
 
-export interface SystemPromptOptions {
+interface SystemPromptOptions {
   readonly orchestrator?: boolean;
   readonly recursion?: boolean;
   readonly maxPromptChars?: number;
@@ -88,7 +91,7 @@ export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions
       parts.push(
         "",
         "**REPL API (ONLY these):** llm_query / llm_batch / llm_query_chunked / map_files /",
-        "llm_map_reduce / rlm_query / rlm_batch / spawn / await_task / list_tasks / memory.* /",
+        "llm_map_reduce / rlm_query / rlm_batch / spawn / await_task / list_tasks /",
         "list_claims. There is no search/grep_context/outline here — your task arrived WITH its",
         "world in `context`; slice it into llm prompts. rlm_query only for a disjoint path set.",
       );
@@ -110,12 +113,17 @@ export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions
   );
   if (opts.orchestrator ?? true) {
     // Two counterweights, both required (paper App. B): the addendum bounds OVER-recursion
-    // (batching/cost), ENV_TIPS bounds UNDER-recursion (solving it yourself).
+    // (batching/cost), envTips() bounds UNDER-recursion (solving it yourself).
     parts.push("", orchestratorAddendum(maxPromptChars, opts.delegation ?? false), "", envTips(opts.delegation ?? false));
   }
   if (kind === "files") {
     parts.push("", LARGE_FILE_RULE_LINES.join("\n"));
   }
+  // Ξ (Workstream C): lands BEFORE the metadata line so the task header stays last — the model
+  // reads it freshest. Verified-fact grounding precedes the fresh task statement.
+  if (meta.skillBlock !== undefined && meta.skillBlock !== "") {
+    parts.push("", meta.skillBlock);
+  }
   parts.push("", buildMetadataLine(meta, maxPromptChars));
   return parts.join("\n");
 }

package/src/sandbox/context-file.ts

@@ -23,7 +23,7 @@ import { join } from "node:path";
 const SERIALIZE_CHUNK = 64;
 
 /** A temp file on disk holding a serialized context payload. */
-export interface ContextTempFile {
+interface ContextTempFile {
   readonly path: string;
   /** True when the file holds JSON; false when the payload was a raw string. */
   readonly json: boolean;

package/src/sandbox/interrupts.ts

@@ -53,12 +53,8 @@ export interface SubLlmHandlers {
   addContext(source: string, depth: number): Promise<AddContextResult>;
   /** v5: the `[ledger]` claims table for the sandbox's `list_claims()` REPL call. */
   ledgerClaims(): Promise<string>;
-  /** v5: durable memory surface for the sandbox's `memory.query/add/stats` object. */
-  memoryOp(
-    op: "query" | "add" | "stats",
-    args: { readonly query?: string; readonly k?: number; readonly content?: string; readonly paths?: readonly string[]; readonly tags?: readonly string[] },
-    depth: number,
-  ): Promise<string>;
+  /** SKILL.state (Workstream E): BM25 over the session SkillState store; JSON hits reply. */
+  skillSearch(query: string, k: number, depth: number): Promise<unknown>;
 }
 
 function toStringArray(value: unknown): readonly string[] | undefined {
@@ -89,23 +85,23 @@ export const REJECT: SubLlmHandlers = Object.freeze({
     throw new Error("add_context not configured");
   },
   ledgerClaims: async () => UNCONFIGURED,
-  memoryOp: async () => UNCONFIGURED,
+  skillSearch: async () => UNCONFIGURED,
 });
 
 export interface ReplyBody {
-  response?: string;
-  responses?: string[];
-  path?: string;
-  json?: boolean;
-  files?: number;
-  chars?: number;
-  source_id?: string;
-  path_prefix?: string;
-  already_loaded?: boolean;
-  documents?: number;
-  converted?: number;
-  skipped?: readonly { readonly path: string; readonly reason: string }[];
-  error?: string;
+  readonly response?: string;
+  readonly responses?: readonly string[];
+  readonly path?: string;
+  readonly json?: boolean;
+  readonly files?: number;
+  readonly chars?: number;
+  readonly source_id?: string;
+  readonly path_prefix?: string;
+  readonly already_loaded?: boolean;
+  readonly documents?: number;
+  readonly converted?: number;
+  readonly skipped?: readonly { readonly path: string; readonly reason: string }[];
+  readonly error?: string;
 }
 
 const RLM_PATH_TYPES = new Set(["rlm_query", "rlm_batch"]);
@@ -171,10 +167,10 @@ async function resolveSingle(
       }
       return { response: collected.result ?? "" };
     }
-    return { response: String(collected ?? "") };
+    return { response: typeof collected === "string" ? collected : "" };
   }
   // Unexpected shape — surface as text rather than crash the worker.
-  return { response: String(raw ?? "") };
+  return { response: typeof raw === "string" ? raw : "" };
 }
 
 /**
@@ -304,7 +300,7 @@ export async function serviceInterrupt(
           });
           return;
         }
-        reply(msg.rid, { response: String(result ?? "") });
+        reply(msg.rid, { response: typeof result === "string" ? result : "" });
         return;
       }
       case "finish": {
@@ -352,13 +348,11 @@ export async function serviceInterrupt(
         reply(msg.rid, { response: table });
         return;
       }
-      case "memory": {
-        const out = await h.memoryOp(
-          msg.op,
-          { query: msg.query, k: msg.k, content: msg.content, paths: msg.paths, tags: msg.tags },
-          d,
-        );
-        reply(msg.rid, { response: out });
+      case "skill_search": {
+        // SKILL.state (Workstream E): the store serializes its own hits; plain strings
+        // (tests/stubs) pass through. Errors are replied, never thrown.
+        const raw = await h.skillSearch(msg.query ?? "", msg.k ?? 8, d);
+        reply(msg.rid, { response: typeof raw === "string" ? raw : JSON.stringify(raw) });
         return;
       }
       default: {
@@ -369,6 +363,6 @@ export async function serviceInterrupt(
       }
     }
   } catch (err: unknown) {
-    reply(msg.rid, { error: errorMessage(err) });
+    reply(msg.rid, { error: formatError(errorMessage(err)) });
   }
 }

package/src/sandbox/protocol.ts

@@ -21,7 +21,7 @@ export type WorkerRequest =
   | { readonly id: string; readonly type: "shutdown" };
 
 /** Reply the parent sends to satisfy a sub-LLM interrupt. */
-export interface LlmReply {
+interface LlmReply {
   readonly type: "llm_reply";
   readonly rid: string;
   readonly response?: string;
@@ -45,7 +45,7 @@ export interface LlmReply {
 }
 
 /** Keep-alive while the host is working and has nothing else to write. */
-export interface Heartbeat {
+interface Heartbeat {
   readonly type: "heartbeat";
 }
 
@@ -71,8 +71,8 @@ export interface WorkerResponse {
   readonly index?: number;
 }
 
-/** Canonical interrupt kinds (api_v5 + v5 ledger + memory). */
-export type InterruptKind =
+/** Canonical interrupt kinds (api_v5 + v5 ledger + SKILL.state). */
+type InterruptKind =
   | "llm_query"
   | "rlm_query"
   | "llm_batch"
@@ -81,7 +81,7 @@ export type InterruptKind =
   | "finish"
   | "add_context"
   | "ledger_claims"
-  | "memory";
+  | "skill_search";
 
 interface InterruptBase {
   readonly rid: string;
@@ -118,25 +118,21 @@ interface FinishInterrupt extends InterruptBase {
   readonly summary?: string;
 }
 
-export interface AddContextInterrupt extends InterruptBase {
+interface AddContextInterrupt extends InterruptBase {
   readonly type: "add_context";
   readonly source?: string;
 }
 
 /** v5: sandbox asks the host for the TaskLedger claims table (`list_claims()`). */
-export interface LedgerClaimsInterrupt extends InterruptBase {
+interface LedgerClaimsInterrupt extends InterruptBase {
   readonly type: "ledger_claims";
 }
 
-/** v5: sandbox reaches the durable MemoryStore (`memory.query/add/stats`). */
-export interface MemoryInterrupt extends InterruptBase {
-  readonly type: "memory";
-  readonly op: "query" | "add" | "stats";
+/** SKILL.state (Workstream E): BM25 recall over the session SkillState store. */
+interface SkillSearchInterrupt extends InterruptBase {
+  readonly type: "skill_search";
   readonly query?: string;
   readonly k?: number;
-  readonly content?: string;
-  readonly paths?: readonly string[];
-  readonly tags?: readonly string[];
 }
 
 /** A mid-exec sub-LLM/tool request from the worker. */
@@ -147,11 +143,11 @@ export type WorkerInterrupt =
   | FinishInterrupt
   | AddContextInterrupt
   | LedgerClaimsInterrupt
-  | MemoryInterrupt;
+  | SkillSearchInterrupt;
 
 export type WorkerMessage = WorkerResponse | WorkerInterrupt;
 
-export const INTERRUPT_KINDS = Object.freeze(
+const INTERRUPT_KINDS = Object.freeze(
   new Set<InterruptKind>([
     "llm_query",
     "rlm_query",
@@ -161,13 +157,11 @@ export const INTERRUPT_KINDS = Object.freeze(
     "finish",
     "add_context",
     "ledger_claims",
-    "memory",
+    "skill_search",
   ]),
 );
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
-}
+import { isRecord } from "../util/type-guards.ts";
 
 function isWorkerResponse(value: unknown): value is WorkerResponse {
   return isRecord(value) && typeof value.id === "string" && typeof value.ok === "boolean";

package/src/sandbox/py/guards.py

@@ -96,7 +96,7 @@ RESERVED = frozenset(
         # Helpers (not the old *_query_batched API)
         "llm_query_chunked", "map_files", "llm_map_reduce",
         "search", "grep_context", "outline",
-        "add_context", "list_claims", "memory",
+        "add_context", "list_claims", "skill_search",
         "SHOW_VARS", "answer", "context",
     }
 )

package/src/sandbox/py/scaffold.py

@@ -10,6 +10,7 @@ without any packaging step (same mechanism as guards.py / retrieval.py / tasks.p
 """
 from __future__ import annotations
 
+import json
 import os
 from typing import Any
 
@@ -37,28 +38,6 @@ from tasks import (
 )
 
 
-class _MemoryApi:
-    """v5 durable memory surface — thin shims over the `memory` interrupt.
-
-    memory.query(q, k=8) → retrieved notes; memory.add(text, paths=…, tags=…) → status;
-    memory.stats() → store counters. All calls block on the host RPC like add_context does.
-    """
-
-    def __init__(self, worker: "WorkerScaffold"):
-        self._w = worker
-
-    def query(self, q, k: int = 8) -> str:
-        return self._w._memory_rpc("query", {"query": str(q), "k": int(k)})
-
-    def add(self, text, paths=None, tags=None) -> str:
-        p = [str(x) for x in (paths or [])]
-        t = [str(x) for x in (tags or [])]
-        return self._w._memory_rpc("add", {"content": str(text), "paths": p, "tags": t})
-
-    def stats(self) -> str:
-        return self._w._memory_rpc("stats", {})
-
-
 class WorkerScaffold:
     """Mixin: the model-facing REPL API. Requires the host methods from Worker
     (`_post`, `_rpc`, `_drain_until`, `_take`, `self.inbox`, `self.ns`, `self._handles`)."""
@@ -596,6 +575,29 @@ class WorkerScaffold:
             )
         return self._start_rlm_batch(list(p), paths)
 
+    def _skill_search(self, query: str, k: int = 8) -> list[dict[str, Any]]:
+        """SkillState recall: BM25 over distilled facts from PRIOR sessions (host-side store).
+
+        Free: no sub-LLM call. Returns [{id, text, tags, score}] — "symbol"/"config" notes
+        about this exact project learned in earlier runs. Errors surface as a text hit, never
+        a raise: a missing store must not crash a cell.
+        """
+        if not isinstance(query, str) or not query.strip():
+            raise TypeError("skill_search() needs a non-empty query string")
+        r = self._rpc("skill_search", {"query": query, "k": max(1, min(32, int(k)))})
+        if r.get("error"):
+            return [{"id": "", "text": f"Error: {r['error']}", "tags": [], "score": 0.0}]
+        raw = r.get("response")
+        if isinstance(raw, str) and raw:
+            if raw.startswith("Error:"):
+                return [{"id": "", "text": raw, "tags": [], "score": 0.0}]
+            try:
+                parsed = json.loads(raw)
+            except ValueError:
+                return [{"id": "", "text": "Error: malformed skill_search reply", "tags": [], "score": 0.0}]
+            return parsed if isinstance(parsed, list) else []
+        return []
+
     def _list_claims(self) -> str:
         """v5 blackboard: the host TaskLedger's claims table (inflight + done work)."""
         r = self._rpc("ledger_claims", {})
@@ -603,13 +605,4 @@ class WorkerScaffold:
             return f"Error: {r['error']}"
         return str(r.get("response") or "ledger: no claims")
 
-    def _memory_rpc(self, op: str, payload: dict[str, Any]) -> str:
-        r = self._rpc("memory", {"op": op, **payload})
-        if r.get("error"):
-            return f"Error: {r['error']}"
-        return str(r.get("response") or "")
-
-    def _memory_api(self) -> "_MemoryApi":
-        return _MemoryApi(self)
-
     # ---- context + execution --------------------------------------------------------------

package/src/sandbox/py/worker.py

@@ -139,6 +139,9 @@ class Worker(WorkerScaffold):
         ns["list_tasks"] = self._list_tasks
         ns["map_files"] = self._map_files
         ns["llm_map_reduce"] = self._llm_map_reduce
+        # SKILL.state recall (Workstream E): distilled facts are NOT repo retrieval — they are
+        # project knowledge, so delegation children keep them too (unconditional binding).
+        ns["skill_search"] = self._skill_search
         if self.surface != "child":
             ns["search"] = self._search
             ns["grep_context"] = self._grep_context
@@ -152,7 +155,6 @@ class Worker(WorkerScaffold):
         if self.surface != "child":
             ns["add_context"] = self._add_context
         ns["list_claims"] = self._list_claims
-        ns["memory"] = self._memory_api()
         ns["SHOW_VARS"] = self._show_vars
         if not isinstance(ns.get("answer"), _AnswerDict):
             cur = ns.get("answer")

package/src/sandbox/sandbox-manager.ts

@@ -13,7 +13,7 @@ import {
 } from "../context/refresh.ts";
 
 /** Static configuration for sandbox creation — set once, reused across getOrCreate calls. */
-export interface SandboxManagerConfig {
+interface SandboxManagerConfig {
   readonly execTimeoutS: number;
   readonly requestTimeoutMs: number;
   readonly python: string;
@@ -127,7 +127,7 @@ export class SandboxManager {
       this.sandbox = s;
       this.initPromise = null;
       return s;
-    }).catch((err) => {
+    }).catch((err: unknown) => {
       this.contextLoaded = false;
       this.initPromise = null;
       throw err;

package/src/sandbox/sandbox.ts

@@ -27,6 +27,10 @@ import { trace, traceEnabled } from "../util/trace.ts";
 
 export type { AddContextResult, SubcallOpts, SubLlmHandlers } from "./interrupts.ts";
 
+/** Event-loop guard: frames are model/summary-sized by construction; payloads travel via temp
+ *  files, never the wire. Anything near this cap is a runaway producer — drop it. */
+const MAX_FRAME_CHARS = 8_000_000;
+
 export interface SandboxOptions {
   /** Sandbox recursion depth label (passed to the worker, used in interrupt routing). */
   readonly depth?: number;
@@ -139,7 +143,7 @@ export class PythonSandbox {
       // windowsHide: without it each sandbox flashes a console window on Windows (pi sets
       // this on every spawn — bash.ts / shell.ts). Same Windows surface as issue #7.
       { stdio: ["pipe", "pipe", "pipe"], env: sanitizedEnv(), windowsHide: true },
-    ) as ChildProcessWithoutNullStreams;
+    );
 
     this.proc.stdout.setEncoding("utf8");
     this.proc.stdout.on("data", (chunk: string) => this.onData(chunk));
@@ -262,7 +266,8 @@ export class PythonSandbox {
       this.pending.set("_init", {
         resolve: (res) => {
           clearTimeout(timer);
-          res.ok ? resolve() : reject(new Error(res.error ?? "worker init failed"));
+          if (res.ok) resolve();
+          else reject(new Error(res.error ?? "worker init failed"));
         },
         reject,
         timer,
@@ -299,7 +304,7 @@ export class PythonSandbox {
         settle(value);
       };
       this.pending.set(id, { resolve: once(resolve), reject: once(reject), timer, requestType: payload.type });
-      this.send({ id, ...payload } as ParentMessage);
+      this.send({ id, ...payload });
     });
   }
 
@@ -356,7 +361,12 @@ export class PythonSandbox {
       this.appendStderr(`[rlm] dropped '${msg.type}' frame: worker ${this.exitDescription()}\n`);
       return;
     }
-    this.proc.stdin.write(`${JSON.stringify(msg)}\n`);
+    const frame = JSON.stringify(msg);
+    if (frame.length > MAX_FRAME_CHARS) {
+      this.appendStderr(`[rlm] dropped '${msg.type}' frame: ${frame.length} chars exceed the frame cap\n`);
+      return;
+    }
+    this.proc.stdin.write(`${frame}\n`);
   }
 
   /**
@@ -391,6 +401,13 @@ export class PythonSandbox {
 
   private onData(chunk: string): void {
     this.buf += chunk;
+    // Untrusted-stream guard: a worker that stops emitting newlines would otherwise balloon
+    // this buffer without bound and stall the pump. Reset (both cursors) and keep draining.
+    if (this.buf.length > MAX_FRAME_CHARS) {
+      this.appendStderr(`\n[protocol] stdout buffer exceeded ${MAX_FRAME_CHARS} chars without a newline — truncated\n`);
+      this.buf = "";
+      this.scanOffset = 0;
+    }
     let nl: number;
     while ((nl = this.buf.indexOf("\n", this.scanOffset)) >= 0) {
       const line = this.buf.slice(this.scanOffset, nl).trim();