@hicaru/pi-rlm 0.3.6 → 0.3.9

package/src/prompts/glossary.ts

@@ -39,6 +39,16 @@ export const RETRIEVAL_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "  Orient in ~200 chars instead of printing 20K. Matches exact path, then suffix, then glob.",
 ]);
 
+/** v5 delegation doctrine (audit C5): children have NO retrieval tools — their world is the
+ *  sliced `context` they were handed. This REPLACES the retrieval lines in child prompts so
+ *  the prompt and the runtime sandbox agree (a child taught to `search` burns turns on NameError). */
+export const DELEGATION_SURFACE_LINES: readonly string[] = Object.freeze([
+  "- **No `search` / `grep_context` / `outline` / `add_context` in this REPL** (delegation",
+  "  surface, v5 doctrine): your task arrived WITH its world in `context`. Explore it with",
+  "  Python (list comprehensions, string matching, slicing) and delegate slices to sub-LLMs —",
+  "  never re-ask the parent for retrieval.",
+]);
+
 /** One-line delegation helpers — orchestrating must be cheaper than solving. */
 export const DELEGATION_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "- `map_files(files, prompt) -> Task`: always spawn. `await_task(t)` → dict[path, answer].",
@@ -57,12 +67,21 @@ export const CHUNKED_GLOSSARY_LINES: readonly string[] = Object.freeze([
 
 /** Non-blocking fan-out: spawn now, collect later (headless glossary). */
 export const SPAWN_GLOSSARY_LINES: readonly string[] = Object.freeze([
-  "- **ALWAYS SPAWN (Task + ↯bg):** `llm_query` / `llm_batch` / `rlm_query` / `rlm_batch` /",
+  "- **ALWAYS SPAWN (Task + ↗bg):** `llm_query` / `llm_batch` / `rlm_query` / `rlm_batch` /",
   "  `map_files` / `llm_query_chunked`. Never treat the return as the answer.",
-  "  Collect with `await_task(t)` or `await_task([t1,t2,…])`. Fire independent Tasks first, free work, then await.",
+  "  Collect with `await_task(t)`, `await_task([t1,t2,…])`, or `await_task()` (every still-running Task).",
+  "  If `await_task` returns `Error: sub-call still running`, call it again — do not respawn.",
+  "  `list_tasks()` → [{kind, label, done, var}]. Fire independent Tasks first, free work, then await.",
   "  Do NOT await after every independent spawn (serializes wall time). `task.done` when settled.",
+  "- `[ledger]` global state: the blackboard in your prompt lists inflight/done agent claims.",
+  "  NEVER `rlm_query` a task already on `[ledger]` (await it / reuse the result); ancestor",
+  "  echo is rejected with a stub. `list_claims()` shows the live table anytime.",
   "- `spawn(fn, *args) -> Task`: same as calling the always-spawn tools (not `llm_map_reduce`).",
   "- Only `llm_map_reduce` still blocks until done.",
+]);
+
+/** v5 (audit C5): the spawn worked example, retrieval flavor — root surface only. */
+export const SPAWN_EXAMPLE_RETRIEVAL: readonly string[] = Object.freeze([
   "",
   "  ```python",
   "  # Multi-area study: one rlm_batch (parallel workers), free locate, then await",
@@ -76,11 +95,20 @@ export const SPAWN_GLOSSARY_LINES: readonly string[] = Object.freeze([
   "  ```",
 ]);
 
-/**
- * What a parent must know about the child it is about to spawn. Without this the model writes
- * referential prompts ("read lib/x/src/…") on the assumption the child can go fetch them, which
- * is what made a missing child context degrade silently instead of failing (issue #4).
- */
+/** v5 (audit C5): the spawn worked example, delegation flavor — no retrieval, slice instead. */
+export const SPAWN_EXAMPLE_DELEGATION: readonly string[] = Object.freeze([
+  "",
+  "  ```python",
+  "  # Multi-area study: one rlm_batch (parallel workers), slice your world while they run",
+  "  t = rlm_batch([",
+  "      \"Answer from the FIRST half of the context only: paths + symbols for X.\",",
+  "      \"Answer from the SECOND half only: report how Y is configured.\",",
+  "  ])",
+  "  half = [f['path'] for f in context[:len(context)//2]]  # free work while Tasks run",
+  "  reports = await_task(t)",
+  "  # One-shot extracts: map_files / llm_batch also return Task → await_task",
+  "  ```",
+]);
 export const RECURSION_CONTEXT_LINES: readonly string[] = Object.freeze([
   "",
   "  **What a child sees:** it inherits YOUR `context` — every file you have loaded, including",
@@ -95,6 +123,19 @@ export const RECURSION_CONTEXT_LINES: readonly string[] = Object.freeze([
   "  this section disappears at the last recursive depth.",
 ]);
 
+/** v5 recursion section, delegation variant (audit C5): describes what a delegation child
+ *  receives — the narrowed pack as text, no retrieval of its own. */
+export const RECURSION_DELEGATION_LINES: readonly string[] = Object.freeze([
+  "",
+  "  **What a child sees:** it inherits YOUR `context` (narrowed by `paths=` when given) and works",
+  "  on it as text — it has NO retrieval tools, so put what matters in your prompt and `paths`,",
+  "  never file bodies you already share (that costs tokens twice and buys nothing).",
+  "  Inheritance is one-way: sources the child loads, and its whole REPL, die with it — only its",
+  "  final answer string returns. The child cannot write to your `answers` or `plan`.",
+  "  At the depth cap `rlm_query` degrades to a plain sub-LLM call with NO context, which is why",
+  "  this section disappears at the last recursive depth.",
+]);
+
 /**
  * Sub-RLM orientation. Emitted only at depth > 0, where `context` is the parent's world rather
  * than a repository the run packed for itself.
@@ -146,38 +187,52 @@ export const LARGE_FILE_RULE_NATIVE =
  * The paper is explicit (App. B) that one prompt does not port across models and that both
  * guardrails are needed; keep them both.
  */
-export const ENV_TIPS = [
-  "## Decomposition doctrine",
-  "",
-  "**Orchestrate; don't solve.** A single chain of thought over a large repository drifts —",
-  "you lose partials and compound mistakes. Sub-workers are competent: trust them; don't read for them.",
-  "",
-  "Your job: (1) free locate with `search` / `grep_context` / `outline`,",
-  "(2) fan out: **multi-step areas → `rlm_batch` / `rlm_query`**; one-shot extracts →",
-  "  `map_files` / `llm_batch` (all return Task — `await_task` for content),",
-  "(3) memoize into `answers`, (4) sanity-check before dependents, (5) assemble from `answers`.",
-  "Your own compute is: pointers, dict lookups, string formatting, and decisions.",
-  "",
-  "### The only state that matters",
-  "`answers` and `plan` are dicts that persist across every turn.",
-  "**If a value isn't in `answers`, it doesn't exist.** Do not trust truncated stdout. Memoize.",
-  "",
-  "### Shape of a run",
-  "1. Probe: `print(len(context))`, `search(<question>)`. Do not print file bodies.",
-  "2. Plan: sub-questions into `plan` (each from a named slice / module).",
-  "3. Fan out **in parallel**: one `rlm_batch` for independent multi-step studies, or",
-  "   `map_files` / `llm_batch` for one-shot reads — not one serial call per file.",
-  "4. Assemble from `answers`.",
-  "",
-  "### Red flags — you are off track",
-  "- Printing file bodies / native bulk read → stop; use map_files or rlm_*.",
-  "- `llm_query(\"Read src/foo.ts…\")` with only a path — sub-LLM has **no disk**; use map_files/rlm_*.",
-  "- Multi-module task with zero `rlm_batch`/`rlm_query`/`map_files` → under-delegating.",
-  "- Await after every independent spawn → serializes wall time; fire-all-then-await.",
-  "- Treating Task as the answer without `await_task`.",
-  "- Regex used to *infer meaning* → sub-LLM job. Regex is for exact needles only.",
-  "- Two turns with zero sub-LLM calls on analysis → solving it yourself.",
-].join("\n");
+/** Decomposition doctrine. `delegation` drops retrieval names (audit R3) — children
+ *  have no `search` and must not be told to locate with it. */
+export function envTips(delegation = false): string {
+  const locate = delegation
+    ? "Your job: (1) slice `context` with Python (indexing, string matching, comprehensions),"
+    : "Your job: (1) free locate with `search` / `grep_context` / `outline`,";
+  const probe = delegation
+    ? "1. Probe: `print(len(context))`; locate targets with Python slicing / string matching. Do not print file bodies."
+    : "1. Probe: `print(len(context))`; locate targets with `search` when your surface has it, else\n   Python slicing / string matching. Do not print file bodies.";
+  return [
+    "## Decomposition doctrine",
+    "",
+    "**Orchestrate; don't solve.** A single chain of thought over a large repository drifts —",
+    "you lose partials and compound mistakes. Sub-workers are competent: trust them; don't read for them.",
+    "",
+    locate,
+    "(2) fan out: **multi-step areas → `rlm_batch` / `rlm_query`**; one-shot extracts →",
+    "  `map_files` / `llm_batch` (all return Task — `await_task` for content),",
+    "(3) memoize into `answers`, (4) sanity-check before dependents, (5) assemble from `answers`.",
+    "Your own compute is: pointers, dict lookups, string formatting, and decisions.",
+    "",
+    "### The only state that matters",
+    "`answers` and `plan` are dicts that persist across every turn.",
+    "**If a result isn't in `answers`, you have not memoized it.** Task handles are REPL vars —",
+    "`list_tasks()` / `SHOW_VARS()` find them. Do not trust truncated stdout. Memoize after await_task.",
+    "",
+    "### Shape of a run",
+    probe,
+    "2. Plan: sub-questions into `plan` (each from a named slice / module).",
+    "3. Fan out **in parallel**: one `rlm_batch` for independent multi-step studies, or",
+    "   `map_files` / `llm_batch` for one-shot reads — not one serial call per file.",
+    "4. Assemble from `answers`.",
+    "",
+    "### Red flags — you are off track",
+    "- Printing file bodies / native bulk read → stop; use map_files or rlm_*.",
+    "- `llm_query(\"Read src/foo.ts…\")` with only a path — sub-LLM has **no disk**; use map_files/rlm_*.",
+    "- Multi-module task with zero `rlm_batch`/`rlm_query`/`map_files` → under-delegating.",
+    "- Await after every independent spawn → serializes wall time; fire-all-then-await.",
+    "- Treating Task as the answer without `await_task`.",
+    "- Regex used to *infer meaning* → sub-LLM job. Regex is for exact needles only.",
+    "- Two turns with zero sub-LLM calls on analysis → solving it yourself.",
+  ].join("\n");
+}
+
+/** Root-surface doctrine (back-compat alias of `envTips(false)`). */
+export const ENV_TIPS = envTips(false);
 
 /** Native-mode variant of the doctrine — same rules, sized for the native prompt budget. */
 export const ENV_TIPS_CONDENSED = [
@@ -185,7 +240,7 @@ export const ENV_TIPS_CONDENSED = [
   "Orchestrate; don't solve. Free locate → fan-out Tasks → await_task → memoize in `answers`.",
   "Multi-module / multi-step areas: **`rlm_batch` (or rlm_query)** — not serial native read.",
   "One-shot extracts: `map_files` / `llm_batch`. Always Task → await_task; fire-all then await.",
-  "`answers`/`plan` persist: **if it isn't in `answers`, it doesn't exist.**",
+  "`answers`/`plan` persist collected results. Task handles are REPL vars (`list_tasks()` / `SHOW_VARS()`).",
   "Red flags: bulk file dumps; llm_query with path-only (no content — no disk!); zero rlm_*/map_files",
   "on multi-area tasks; await after each spawn; Task treated as answer.",
   "AUTHORING: you write every edit body yourself.",
@@ -204,6 +259,7 @@ export function replGlossary(
   recursion: boolean,
   contextLoader: boolean,
   child: boolean,
+  delegation = false,
 ): string {
   const lines = ["Available in the REPL:"];
   if (kind === "text") {
@@ -221,19 +277,36 @@ export function replGlossary(
       CONTEXT_EXCLUSION_NOTE,
     );
     if (child) lines.push(...CHILD_CONTEXT_LINES);
-    lines.push(
-      "",
-      "  Worked example — find the slice, then delegate it (Task + await):",
-      "  ```python",
-      '  hits = search("where is the retry/backoff policy configured?", k=8)',
-      "  paths = sorted({h['path'] for h in hits})",
-      '  t = map_files(paths, "Describe any retry/backoff policy in this file, with line numbers. Say NONE if absent.")',
-      "  answers.update(await_task(t))",
-      "  print({p: a[:80] for p, a in answers.items()})",
-      "  ```",
-    );
+    if (delegation) {
+      lines.push(
+        "",
+        "  Worked example — slice the world you were handed, then delegate it (Task + await):",
+        "  ```python",
+        "  slice = [f for f in context if f['path'].startswith('src/auth/')][:6]",
+        "  prompts = [f\"Answer from this file only.\\n\\n{f['content'][:4000]}\" for f in slice]",
+        "  t = llm_batch(prompts)",
+        "  answers.update(dict(zip([f['path'] for f in slice], await_task(t))))",
+        "  ```",
+      );
+    } else {
+      lines.push(
+        "",
+        "  Worked example — find the slice, then delegate it (Task + await):",
+        "  ```python",
+        '  hits = search("where is the retry/backoff policy configured?", k=8)',
+        "  paths = sorted({h['path'] for h in hits})",
+        '  t = map_files(paths, "Describe any retry/backoff policy in this file, with line numbers. Say NONE if absent.")',
+        "  answers.update(await_task(t))",
+        "  print({p: a[:80] for p, a in answers.items()})",
+        "  ```",
+      );
+    }
+  }
+  if (delegation) {
+    lines.push(...DELEGATION_SURFACE_LINES);
+  } else {
+    lines.push(...RETRIEVAL_GLOSSARY_LINES);
   }
-  lines.push(...RETRIEVAL_GLOSSARY_LINES);
   lines.push(
     "- `llm_query(prompt: str) -> Task`: spawn one sub-LLM (await_task for str). The prompt must",
     "  **contain the text** to analyze — this call has no filesystem and no `context`.",
@@ -241,9 +314,10 @@ export function replGlossary(
     "  await_task → ordered list[str]. NEVER pass bare file paths as if the worker can open them.",
     ...CHUNKED_GLOSSARY_LINES,
     ...SPAWN_GLOSSARY_LINES,
+    ...(delegation ? SPAWN_EXAMPLE_DELEGATION : SPAWN_EXAMPLE_RETRIEVAL),
     ...DELEGATION_GLOSSARY_LINES,
   );
-  if (contextLoader) {
+  if (contextLoader && !delegation) {
     lines.push(
       "- `add_context(source: str) -> dict`: load a dir, file, document, or git URL and **APPEND its",
       "  files into `context`** (same shape: path/content/tokens). Documents (PDF, DOCX, XLSX, PPTX,",
@@ -264,21 +338,37 @@ export function replGlossary(
   }
   if (recursion) {
     lines.push(
-      "- `rlm_query(task, paths=None) -> Task` / `rlm_batch(tasks, paths=None) -> Task`:",
+      "- `rlm_query(task|prompt, paths=None) -> Task` / `rlm_batch(tasks|prompts, paths=None) -> Task`:",
       "  always spawn + ↯bg. await_task for the report string(s). Child REPL is private.",
+      "  Both spellings accepted; prefer `task`/`tasks`.",
       "",
       "  **Routing (api_v5):**",
       "  - `llm_query` / `llm_batch` / `map_files` — one-shot facts/extracts (fast).",
-      "  - `rlm_query` — one multi-step study (own search/outline loop).",
+      delegation
+        ? "  - `rlm_query` — one multi-step study (its own delegation loop; it cannot search either)."
+        : "  - `rlm_query` — one multi-step study (own search/outline loop).",
       "  - `rlm_batch` — ≥2 independent multi-step studies in **parallel** (prefer over N× rlm_query).",
       "  Always Task → await_task. Fire independent work first; never serial-await between peers.",
-      ...RECURSION_CONTEXT_LINES,
+      ...(delegation ? RECURSION_DELEGATION_LINES : RECURSION_CONTEXT_LINES),
     );
   }
   lines.push(
     "- `answers` / `plan`: two dicts that persist across turns. Memoize every",
     "  verified result in `answers` — see the decomposition doctrine below.",
-    "- `SHOW_VARS() -> str`: list every variable currently in the REPL.",
+    "- `SHOW_VARS() -> str`: list every variable currently in the REPL (Task handles show as `<Task …>`).",
+    "- `list_tasks()`: every Task this REPL created — [{kind, label, done, var}].",
+    ...(delegation
+      ? [
+          "- `memory.query(q) -> str`: durable notes under `.rlm/` that survive across sessions.",
+          "  **READ-ONLY here** — `memory.add` is root-only. Query before re-studying a known area;",
+          "  your own final answer is recorded as an episode automatically.",
+        ]
+      : [
+          "- `memory.query(q) -> str` / `memory.add(text, paths=…, tags=…)`: durable notes under `.rlm/`",
+          "  that survive across sessions. Query before re-studying a known area; add concise findings",
+          "  (facts, locations, decisions) — never secrets or API keys (notes persist on disk).",
+        ]),
+    "- `list_claims()`: the live `[ledger]` table of inflight/done agent work.",
     '- `answer`: a dict initialized to {"content": "", "ready": False}. To submit your final answer,',
     '  set `answer["content"]` to the answer text and `answer["ready"] = True`.',
     '  **You MUST flip `answer["ready"] = True` — runs that never finalize are discarded.**',

package/src/prompts/native.ts

@@ -32,19 +32,23 @@ function nativeReplGlossary(): string {
     "| `llm_batch(prompts)` | list[str] | many cheap facts in **parallel** | multi-step research |",
     "| `map_files(files, prompt)` | dict[path,str] | same question over many files | multi-step per file |",
     "| `llm_query_chunked(text, prompt)` | list[str] | one huge text, auto-chunked | structured data |",
-    "| `rlm_query(task, paths=None)` | str | **one** multi-step study | ≥2 independent studies |",
-    "| `rlm_batch(tasks, paths=None)` | list[str] | **≥2 independent studies in parallel** | trivia / one-shots |",
+    "| `rlm_query(task|prompt, paths=None)` | str | **one** multi-step study | ≥2 independent studies |",
+    "| `rlm_batch(tasks|prompts, paths=None)` | list[str] | **≥2 independent studies in parallel** | trivia / one-shots |",
     "",
-    "Collect: `await_task(t)` or `await_task([t1,t2,…])`. `task.done` when settled.",
+    "Collect: `await_task(t)` / `await_task([…])` / `await_task()` (all running). `list_tasks()` finds lost handles. `task.done` when settled.",
+    "If a spawn call raises, the assignment did NOT run — the variable is undefined in later cells. Re-spawn with the corrected signature from the error message.",
     "The child inherits your `context`; send instructions + optional `paths=['src/auth/']` prefixes — never paste file bodies. **Children are sandboxed — they cannot mutate your `answers`, `plan`, or REPL variables.**",
     CHUNKED_GLOSSARY_LINE_NATIVE,
     "- `llm_map_reduce(...)` **blocks** (map then reduce) — prefer Tasks when you can interleave free work.",
     "- `spawn(fn, *args) -> Task` optional alias for always-spawn tools (not llm_map_reduce).",
     "",
     "### Memo / finalize",
-    "- `answers` / `plan` — persistent dicts. **If a value isn't in `answers`, it doesn't exist.**",
+    "- `answers` / `plan` — persistent dicts for **collected** results. Task handles are REPL vars (`t`), not `answers` keys.",
     "- `add_context(source) -> dict` — append external dir/file/doc/git under `ctx/<id>/…` (metadata only).",
-    "- `SHOW_VARS()` — list REPL vars. `answer[\"ready\"]=True` only for headless finalize (native: write a normal message).",
+    "- `memory.query(q)` / `memory.add(text, paths=…, tags=…)` — durable notes under `.rlm/` that survive",
+    "  sessions. Query before re-studying a known area; add concise findings — never secrets or API",
+    "  keys (notes persist on disk). `list_claims()` — the live `[ledger]` table of agent work.",
+    "- `SHOW_VARS()` — list REPL vars (Tasks as `<Task …>`). `list_tasks()` finds Task handles. `answer[\"ready\"]=True` only for headless finalize (native: write a normal message).",
     "",
     ENV_TIPS_CONDENSED,
     "",
@@ -87,8 +91,9 @@ export function buildNativeSystemPrompt(): string {
     "<contract>",
     "Inside `repl({code})`, EVERY heavy call returns a Task immediately (not the answer):",
     "  llm_query | llm_batch | map_files | llm_query_chunked | rlm_query | rlm_batch  →  Task",
-    "ONLY `await_task(t)` / `await_task([…])` returns content. Fan-out runs detached (↯bg) and outlives the cell.",
-    "If you printed a Task and did not await_task, you do **not** know the answer yet.",
+    "ONLY `await_task(t)` / `await_task([…])` / `await_task()` returns content. Fan-out runs detached (↯bg) and outlives the cell.",
+    "If `await_task` returns `Error: sub-call still running`, call it again — do not respawn.",
+    "If you printed a Task and did not await_task, you do **not** know the answer yet. A Task handle is a REPL variable, not an `answers[]` key.",
     "Fire independent Tasks first → free `search`/`grep_context`/`outline` → then await_task.",
     "Do NOT await after every independent spawn (that serializes wall time).",
     "</contract>",

package/src/prompts/system.ts

@@ -8,7 +8,7 @@ import type { ContextSizeStats } from "../text/tokens.ts";
 import {
   contextKindOf,
   DEFAULT_PROMPT_CAP,
-  ENV_TIPS,
+  envTips,
   howToRunCode,
   LARGE_FILE_RULE_LINES,
   promptCapTokensK,
@@ -33,23 +33,29 @@ export interface SystemPromptOptions {
   readonly child?: boolean;
   /** The recursion depth of this run (0 = root, 1 = first child, etc.). */
   readonly depth?: number;
+  /** v5 doctrine: the child sandbox has the delegation-only surface (no retrieval tools). */
+  readonly delegation?: boolean;
 }
 
-function orchestratorAddendum(maxPromptChars: number): string {
+function orchestratorAddendum(maxPromptChars: number, delegation: boolean): string {
   return [
     "As an RLM you are an **orchestrator, not a solver**. Probe `context`, plan decomposition, then",
     "fan out — do not solve multi-step module work yourself in a long chain of thought.",
     "",
     "<contract> llm_query / llm_batch / map_files / rlm_query / rlm_batch return Task (not the answer).",
-    "Only await_task returns content. Fire independent Tasks first, free search, then await_task.",
+    delegation
+      ? "Only await_task returns content. Fire independent Tasks first, slice your `context` meanwhile, then await_task."
+      : "Only await_task returns content. Fire independent Tasks first, free search, then await_task.",
     "Do not await after every independent spawn.</contract>",
     "",
     "<routing> one-shot facts → llm_query/llm_batch/map_files; one multi-step study → rlm_query;",
     "≥2 independent multi-step areas → rlm_batch (prefer over serial rlm_query). NEVER print file",
     "bodies into your own stream when a Task tool can read them.</routing>",
     "",
-    "Your own context window is small. Push long-context work into sub-calls. If free search/grep",
-    "already pins a tiny fact, use that. Aggregate small results in Python / `answers`.",
+    "Your own context window is small. Push long-context work into sub-calls.",
+    delegation
+      ? "If a slice of your `context` already pins a tiny fact, quote it — do not re-ask."
+      : "If free search/grep already pins a tiny fact, use that. Aggregate small results in Python / `answers`.",
     "",
     `Sub-call budget: (1) per-prompt < ${maxPromptChars.toLocaleString()} chars (≈${promptCapTokensK(maxPromptChars)}K tok);`,
     "(2) ~20 prompts per llm_batch. Fat prompts in small batches beat thousands of tiny prompts.",
@@ -78,13 +84,22 @@ export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions
       `**Recursion depth: ${opts.depth}.** You are a sub-RLM — focus narrowly on your assigned`,
       "task. Delegate (rlm_query/rlm_batch) only if the task itself must decompose further.",
     );
+    if (opts.delegation ?? false) {
+      parts.push(
+        "",
+        "**REPL API (ONLY these):** llm_query / llm_batch / llm_query_chunked / map_files /",
+        "llm_map_reduce / rlm_query / rlm_batch / spawn / await_task / list_tasks / memory.* /",
+        "list_claims. There is no search/grep_context/outline here — your task arrived WITH its",
+        "world in `context`; slice it into llm prompts. rlm_query only for a disjoint path set.",
+      );
+    }
   }
   parts.push(
     "",
     howToRunCode(),
     "",
     replGlossary(
-      kind, recursion, opts.contextLoader ?? false, opts.child ?? false,
+      kind, recursion, opts.contextLoader ?? false, opts.child ?? false, opts.delegation ?? false,
     ),
     "",
     "REPL stdout over ~800 characters is truncated to a short excerpt — large results stay in your",
@@ -96,7 +111,7 @@ export function buildRlmSystemPrompt(meta: PromptMeta, opts: SystemPromptOptions
   if (opts.orchestrator ?? true) {
     // Two counterweights, both required (paper App. B): the addendum bounds OVER-recursion
     // (batching/cost), ENV_TIPS bounds UNDER-recursion (solving it yourself).
-    parts.push("", orchestratorAddendum(maxPromptChars), "", ENV_TIPS);
+    parts.push("", orchestratorAddendum(maxPromptChars, opts.delegation ?? false), "", envTips(opts.delegation ?? false));
   }
   if (kind === "files") {
     parts.push("", LARGE_FILE_RULE_LINES.join("\n"));

package/src/prompts/user.ts

@@ -19,7 +19,10 @@ export function buildTurnPrompt(
   return `${prefix}${body}`;
 }
 
-/** Asked once when the engine runs out of turns without a submitted answer. */
+/** Asked once when the engine runs out of turns without a submitted answer. Same finalize
+ *  dialect as the budget wrap-up note (audit M6): answer-ready first, plain text only as an
+ *  explicit fallback the engine still accepts. */
 export const FINALIZE_PROMPT =
-  "You are out of turns. Provide your best final answer now based on everything you have gathered, " +
-  'by setting `answer["content"]` and `answer["ready"] = True` (fenced ```repl```), or as plain text.';
+  "You are out of turns. Finalize NOW: set `answer[\"content\"]` and `answer[\"ready\"] = True` " +
+    "(fenced ```repl```) with your best final answer from everything you have gathered. " +
+    "Only if the REPL is unavailable, answer as plain text.";

package/src/sandbox/interrupts.ts

@@ -51,6 +51,14 @@ export interface SubLlmHandlers {
   ): Promise<unknown>;
   finishTask(summary: string, depth: number, opts: SubcallOpts): Promise<unknown>;
   addContext(source: string, depth: number): Promise<AddContextResult>;
+  /** v5: the `[ledger]` claims table for the sandbox's `list_claims()` REPL call. */
+  ledgerClaims(): Promise<string>;
+  /** v5: durable memory surface for the sandbox's `memory.query/add/stats` object. */
+  memoryOp(
+    op: "query" | "add" | "stats",
+    args: { readonly query?: string; readonly k?: number; readonly content?: string; readonly paths?: readonly string[]; readonly tags?: readonly string[] },
+    depth: number,
+  ): Promise<string>;
 }
 
 function toStringArray(value: unknown): readonly string[] | undefined {
@@ -80,6 +88,8 @@ export const REJECT: SubLlmHandlers = Object.freeze({
   addContext: async () => {
     throw new Error("add_context not configured");
   },
+  ledgerClaims: async () => UNCONFIGURED,
+  memoryOp: async () => UNCONFIGURED,
 });
 
 export interface ReplyBody {
@@ -337,6 +347,20 @@ export async function serviceInterrupt(
         });
         return;
       }
+      case "ledger_claims": {
+        const table = await h.ledgerClaims();
+        reply(msg.rid, { response: table });
+        return;
+      }
+      case "memory": {
+        const out = await h.memoryOp(
+          msg.op,
+          { query: msg.query, k: msg.k, content: msg.content, paths: msg.paths, tags: msg.tags },
+          d,
+        );
+        reply(msg.rid, { response: out });
+        return;
+      }
       default: {
         const _exhaustive: never = msg;
         reply((_exhaustive as WorkerInterrupt).rid, {

package/src/sandbox/protocol.ts

@@ -2,7 +2,7 @@
  * Wire protocol for the RLM Python sandbox.
  *
  * Newline-delimited JSON over the worker's stdin/stdout — no sockets, no HTTP.
- * Parent -> worker: requests (exec/load_context/shutdown) and llm replies.
+ * Parent -> worker: requests (exec/load_context/shutdown), llm replies, and heartbeats.
  * Worker -> parent: request responses and mid-exec sub-LLM interrupts.
  *
  * Canonical api_v5 kinds only — no legacy `*_query_batched` wire names.
@@ -44,7 +44,12 @@ export interface LlmReply {
   readonly error?: string;
 }
 
-export type ParentMessage = WorkerRequest | LlmReply;
+/** Keep-alive while the host is working and has nothing else to write. */
+export interface Heartbeat {
+  readonly type: "heartbeat";
+}
+
+export type ParentMessage = WorkerRequest | LlmReply | Heartbeat;
 
 /** A normal response to a request (keyed by the request `id`). */
 export interface WorkerResponse {
@@ -60,11 +65,13 @@ export interface WorkerResponse {
   readonly execution_time?: number;
   // user-created variable names after this exec
   readonly var_names?: readonly string[];
+  /** Unsettled Task handles still in the worker (native pending-line / await-all). */
+  readonly pending_tasks?: readonly PendingTaskInfo[];
   // load_context:
   readonly index?: number;
 }
 
-/** Canonical interrupt kinds (api_v5). */
+/** Canonical interrupt kinds (api_v5 + v5 ledger + memory). */
 export type InterruptKind =
   | "llm_query"
   | "rlm_query"
@@ -72,7 +79,9 @@ export type InterruptKind =
   | "rlm_batch"
   | "await"
   | "finish"
-  | "add_context";
+  | "add_context"
+  | "ledger_claims"
+  | "memory";
 
 interface InterruptBase {
   readonly rid: string;
@@ -114,13 +123,31 @@ export interface AddContextInterrupt extends InterruptBase {
   readonly source?: string;
 }
 
+/** v5: sandbox asks the host for the TaskLedger claims table (`list_claims()`). */
+export interface LedgerClaimsInterrupt extends InterruptBase {
+  readonly type: "ledger_claims";
+}
+
+/** v5: sandbox reaches the durable MemoryStore (`memory.query/add/stats`). */
+export interface MemoryInterrupt extends InterruptBase {
+  readonly type: "memory";
+  readonly op: "query" | "add" | "stats";
+  readonly query?: string;
+  readonly k?: number;
+  readonly content?: string;
+  readonly paths?: readonly string[];
+  readonly tags?: readonly string[];
+}
+
 /** A mid-exec sub-LLM/tool request from the worker. */
 export type WorkerInterrupt =
   | PromptInterrupt
   | BatchInterrupt
   | AwaitInterrupt
   | FinishInterrupt
-  | AddContextInterrupt;
+  | AddContextInterrupt
+  | LedgerClaimsInterrupt
+  | MemoryInterrupt;
 
 export type WorkerMessage = WorkerResponse | WorkerInterrupt;
 
@@ -133,6 +160,8 @@ export const INTERRUPT_KINDS = Object.freeze(
     "await",
     "finish",
     "add_context",
+    "ledger_claims",
+    "memory",
   ]),
 );
 
@@ -158,6 +187,39 @@ export function isWorkerMessage(msg: unknown): msg is WorkerMessage {
   return isWorkerResponse(msg) || isInterrupt(msg);
 }
 
+/** Unsettled Task still in the worker, optionally bound to a REPL variable. */
+export interface PendingTaskInfo {
+  readonly var: string | null;
+  readonly kind: string;
+  readonly label: string;
+}
+
+const EMPTY_PENDING: readonly PendingTaskInfo[] = Object.freeze([]);
+
+function isPendingTaskInfo(value: unknown): value is PendingTaskInfo {
+  if (!isRecord(value)) return false;
+  const bound = value["var"];
+  return (typeof bound === "string" || bound === null)
+    && typeof value["kind"] === "string"
+    && typeof value["label"] === "string";
+}
+
+/** Narrow a worker `pending_tasks` payload; drop malformed entries. */
+export function parsePendingTasks(value: unknown): readonly PendingTaskInfo[] {
+  if (!Array.isArray(value)) return EMPTY_PENDING;
+  const out = new Array<PendingTaskInfo>(value.length);
+  let n = 0;
+  for (let i = 0; i < value.length; i++) {
+    const item: unknown = value[i];
+    if (isPendingTaskInfo(item)) {
+      out[n] = item;
+      n += 1;
+    }
+  }
+  out.length = n;
+  return n === 0 ? EMPTY_PENDING : Object.freeze(out);
+}
+
 /** Result of a single `repl` block execution, surfaced to the engine/tool. */
 export interface ReplResult {
   readonly stdout: string;
@@ -168,4 +230,6 @@ export interface ReplResult {
   readonly executionTimeMs: number;
   /** User-created variable names after this exec (builtins/context filtered out). */
   readonly varNames: readonly string[];
+  /** Unsettled Task handles still in the worker after this exec. */
+  readonly pendingTasks: readonly PendingTaskInfo[];
 }