@selesai/code 0.13.15 → 0.13.18

package/dist/extensions/pi-hermes-memory/src/store/sqlite-memory-store.ts

@@ -2,6 +2,7 @@ import { DatabaseManager } from './db.js';
 import {
   buildFallbackFts5Query,
   buildNaturalLanguageFallbackQuery,
+  collectLikeTerms,
   isFts5QueryError,
   normalizeFts5Query,
   normalizeNaturalLanguageFts5Query,
@@ -9,6 +10,8 @@ import {
 import { normalizeMemoryLookupText } from './memory-lookup.js';
 import type { MemoryCategory } from '../types.js';
 
+export { isFts5QueryError };
+
 const MEMORY_SELECT_COLUMNS = `
   id,
   project,
@@ -22,6 +25,13 @@ const MEMORY_SELECT_COLUMNS = `
   last_referenced
 `;
 
+// The BM25-ranked search joins memory_fts, which also has a `content` column,
+// so that one query needs the same list qualified with the `memories` alias.
+const MEMORY_SELECT_COLUMNS_M = MEMORY_SELECT_COLUMNS
+  .split(',')
+  .map((column) => `m.${column.trim()}`)
+  .join(',\n        ');
+
 const FAILURE_CATEGORY_SET = new Set<MemoryCategory>([
   'failure',
   'correction',
@@ -84,6 +94,15 @@ export interface MarkdownMemoryReconcileResult {
   inserted: number;
   existing: number;
   removed: number;
+  /**
+   * True when the scope was left un-reconciled because of a genuine FTS5
+   * search-index error. Markdown remains the source of truth and the write
+   * did not fail; search may be stale until /memory-sync-markdown rebuilds
+   * the index. Callers should surface that repair guidance to the user.
+   */
+  degraded?: boolean;
+  /** Human-readable reason for the degraded state, when degraded is true. */
+  degradedReason?: string;
 }
 
 export interface ParsedMarkdownMemoryEntry extends SqliteMemorySyncInput {}
@@ -157,6 +176,21 @@ function buildScopeConditions(params: unknown[], target?: string, project?: stri
   return conditions;
 }
 
+/** Maps memory_search target filters onto SQLite columns (search paths only). */
+function buildSearchTargetConditions(params: unknown[], target: string | undefined, tablePrefix: string): string[] {
+  const conditions: string[] = [];
+
+  if (target === 'project') {
+    conditions.push(`${tablePrefix}.target = 'memory'`);
+    conditions.push(`${tablePrefix}.project IS NOT NULL`);
+  } else if (target) {
+    conditions.push(`${tablePrefix}.target = ?`);
+    params.push(target);
+  }
+
+  return conditions;
+}
+
 function getMemoryById(dbManager: DatabaseManager, id: number): SqliteMemoryEntry | null {
   const db = dbManager.getDb();
   const row = db.prepare(`
@@ -438,12 +472,17 @@ export function reconcileMarkdownMemoryScope(
   target: 'memory' | 'user' | 'failure',
   project: string | null = null,
 ): MarkdownMemoryReconcileResult {
-  const db = dbManager.getDb();
   const normalizedProject = normalizeNullable(project);
 
+  // The full reconcile runs against the CURRENT database handle. It must fetch
+  // it via dbManager.getDb() rather than a pre-fetched handle: after corruption
+  // recovery quarantines the old file and rebuilds a fresh one, the retry has
+  // to run on the new handle.
   const reconcile = (): MarkdownMemoryReconcileResult => {
+    const db = dbManager.getDb();
     let inserted = 0;
     let existing = 0;
+    let removed = 0;
     const desiredIdentities = new Set<string>();
 
     for (const rawEntry of rawEntries) {
@@ -476,7 +515,6 @@ export function reconcileMarkdownMemoryScope(
       }
     }
 
-    let removed = 0;
     if (orphanIds.length > 0) {
       const placeholders = orphanIds.map(() => '?').join(', ');
       removed = db.prepare(`DELETE FROM memories WHERE id IN (${placeholders})`).run(...orphanIds).changes;
@@ -485,8 +523,32 @@ export function reconcileMarkdownMemoryScope(
     return { inserted, existing, removed };
   };
 
-  const transactional = db.transaction?.(reconcile);
-  return transactional ? transactional() : reconcile();
+  const run = (): MarkdownMemoryReconcileResult => {
+    const db = dbManager.getDb();
+    const transactional = db.transaction?.(reconcile);
+    return transactional ? transactional() : reconcile();
+  };
+
+  try {
+    // Corruption errors (e.g. "database disk image is malformed") are NOT
+    // search-index problems: they must stay on the recovery path so
+    // DatabaseManager quarantines the corrupt file, rebuilds a fresh one, and
+    // retries this sync (#186). Swallowing them would hide corruption and
+    // leave a corrupt database in place.
+    return dbManager.withCorruptionRecovery(run);
+  } catch (err) {
+    if (isFts5QueryError(err)) {
+      // A genuine FTS5 query/index error means the search index is stale or
+      // broken, not that the database is corrupt. Markdown is the source of
+      // truth, so the write must not fail: warn in the log and report a
+      // DEGRADED result so the caller can surface the /memory-sync-markdown
+      // repair guidance to the user.
+      const detail = err instanceof Error ? err.message : String(err);
+      console.warn(`[pi-hermes-memory] FTS5 search index error during markdown sync (search may be stale; run /memory-sync-markdown): ${detail}`);
+      return { inserted: 0, existing: 0, removed: 0, degraded: true, degradedReason: detail };
+    }
+    throw err;
+  }
 }
 
 function failureProject(rawEntry: string): string | null {
@@ -527,6 +589,12 @@ export function reconcileMarkdownFailureScopes(
     total.inserted += result.inserted;
     total.existing += result.existing;
     total.removed += result.removed;
+    if (result.degraded && !total.degraded) {
+      // Surface the first degraded scope: repair guidance applies to the whole
+      // sync run, and the first reason is the one to act on.
+      total.degraded = true;
+      total.degradedReason = result.degradedReason;
+    }
   }
 
   return total;
@@ -703,11 +771,8 @@ export function searchMemories(
   const conditions: string[] = [];
   const params: unknown[] = [];
 
-  // FTS5 match via subquery with escaped query
+  // FTS5 match via JOIN with BM25 ranking
   const normalizedQuery = normalizeFts5Query(query);
-  if (normalizedQuery.length === 0) {
-    return [];
-  }
 
   let ftsParseError = false;
 
@@ -715,7 +780,7 @@ export function searchMemories(
     const conditions: string[] = [];
     const params: unknown[] = [];
 
-    conditions.push('m.id IN (SELECT rowid FROM memory_fts WHERE memory_fts MATCH ?)');
+    conditions.push('memory_fts MATCH ?');
     params.push(matchQuery);
 
     if (project !== undefined) {
@@ -727,10 +792,7 @@ export function searchMemories(
       }
     }
 
-    if (target) {
-      conditions.push('m.target = ?');
-      params.push(target);
-    }
+    conditions.push(...buildSearchTargetConditions(params, target, 'm'));
 
     if (category) {
       conditions.push('m.category = ?');
@@ -740,10 +802,13 @@ export function searchMemories(
     const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
 
     const sql = `
-      SELECT ${MEMORY_SELECT_COLUMNS}
+      SELECT
+        ${MEMORY_SELECT_COLUMNS_M},
+        bm25(memory_fts) AS rank_score
       FROM memories m
+      JOIN memory_fts ON memory_fts.rowid = m.id
       ${whereClause}
-      ORDER BY m.last_referenced DESC
+      ORDER BY rank_score ASC, m.last_referenced DESC
       LIMIT ?
     `;
 
@@ -759,6 +824,7 @@ export function searchMemories(
         corrected_to: string | null;
         created: string;
         last_referenced: string;
+        rank_score: number;
       }>;
 
       return rows.map(mapRow);
@@ -778,6 +844,55 @@ export function searchMemories(
     const conditions: string[] = ["m.content LIKE ? ESCAPE '\\'"];
     const params: unknown[] = [`%${escapeLikePattern(query.trim())}%`];
 
+    if (project !== undefined) {
+      if (project === null) {
+        conditions.push('m.project IS NULL');
+      } else {
+        conditions.push('m.project = ?');
+        params.push(project);
+      }
+    }
+    conditions.push(...buildSearchTargetConditions(params, target, 'm'));
+
+    if (category) {
+      conditions.push('m.category = ?');
+      params.push(category);
+    }
+
+    const rows = db.prepare(`
+      SELECT ${MEMORY_SELECT_COLUMNS}
+      FROM memories m
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY m.last_referenced DESC
+      LIMIT ?
+    `).all(...params, limit) as Array<{
+      id: number;
+      project: string | null;
+      target: string;
+      category: string | null;
+      content: string;
+      failure_reason: string | null;
+      tool_state: string | null;
+      corrected_to: string | null;
+      created: string;
+      last_referenced: string;
+    }>;
+    return rows.map(mapRow);
+  };
+
+  // Every term a stop word or connector leaves FTS5 nothing to match.
+  // Degrade to a scoped literal substring search (OR over the raw terms) —
+  // the same fallback session search uses for this case — instead of a hard
+  // [].
+  const runLiteralLikeFallback = (): SqliteMemoryEntry[] => {
+    const terms = collectLikeTerms(query);
+    if (terms.length === 0) return [];
+
+    const conditions: string[] = [
+      `(${terms.map(() => "m.content LIKE ? ESCAPE '\\'").join(' OR ')})`,
+    ];
+    const params: unknown[] = terms.map((term) => `%${escapeLikePattern(term.trim())}%`);
+
     if (project !== undefined) {
       if (project === null) {
         conditions.push('m.project IS NULL');
@@ -816,6 +931,10 @@ export function searchMemories(
     return rows.map(mapRow);
   };
 
+  if (normalizedQuery.length === 0) {
+    return runLiteralLikeFallback();
+  }
+
   const exactResults = runSearch(normalizedQuery);
   if (exactResults.length > 0) {
     return exactResults;

package/dist/extensions/pi-hermes-memory/src/tools/memory-search-tool.ts

@@ -36,6 +36,8 @@ Use cases:
 - Find user preferences: "What are the user's testing preferences?"
 - Search for past failures: "memory_search('auth', category='failure')"
 
+target="project" returns only project-attributed memory entries (the ones labeled [target=project]); combine with project to search a named project.
+
 Returns matching memory entries with their mutation target, scope, and dates. The displayed target is the value required by memory_replace and memory_remove.`,
     promptSnippet: 'Search extended memory store (unlimited capacity)',
     promptGuidelines: [
@@ -47,11 +49,11 @@ Returns matching memory entries with their mutation target, scope, and dates. Th
     parameters: Type.Object({
       query: Type.String({ description: 'Search query. Use natural language or specific terms.' }),
       project: Type.Optional(Type.String({ description: 'Filter by project name. Pass null for global memories only.' })),
-      target: Type.Optional(StringEnum(['memory', 'user', 'failure'] as const, { description: 'Filter by target type (memory, user, or failure).' })),
+      target: Type.Optional(StringEnum(['memory', 'user', 'failure', 'project'] as const, { description: 'Filter by target type: memory, user, failure, or project-attributed memories.' })),
       category: Type.Optional(StringEnum(['failure', 'correction', 'insight', 'preference', 'convention', 'tool-quirk'] as const, { description: 'Filter by memory category.' })),
       limit: Type.Optional(Type.Number({ description: 'Maximum results to return (default: 10, max: 20).' })),
     }),
-    execute: async (_id: string, args: { query: string; project?: string; target?: string; category?: string; limit?: number }) => {
+    execute: async (_id: string, args: { query: string; project?: string; target?: 'memory' | 'user' | 'failure' | 'project'; category?: string; limit?: number }) => {
       const query = args.query;
       const project = args.project;
       const target = args.target;

package/dist/extensions/pi-hermes-memory/src/tools/memory-tool.ts

@@ -17,6 +17,7 @@ import {
   removeSyncedMemories,
   replaceSyncedMemories,
   syncMemoryEntry,
+  isFts5QueryError,
 } from "../store/sqlite-memory-store.js";
 import { MEMORY_TOOL_DESCRIPTION } from "../constants.js";
 import { resolveProjectName, resolveProjectStore, type ProjectNameRef, type ProjectStoreRef } from "../project-context.js";
@@ -238,22 +239,36 @@ async function reconcileStoreScope(
   if (!dbManager) return undefined;
   try {
     if (rawTarget === "failure") {
-      reconcileMarkdownFailureScopes(dbManager, entries);
-      return null;
+      return degradedRepairMessage(reconcileMarkdownFailureScopes(dbManager, entries));
     }
     const target = sqliteTargetFor(rawTarget);
-    reconcileMarkdownMemoryScope(
-      dbManager,
-      entries,
-      target,
-      sqliteProjectFor(rawTarget, projectName) ?? null,
+    return degradedRepairMessage(
+      reconcileMarkdownMemoryScope(
+        dbManager,
+        entries,
+        target,
+        sqliteProjectFor(rawTarget, projectName) ?? null,
+      ),
     );
-    return null;
   } catch (err) {
-    return `Saved to Markdown, but SQLite search reconciliation failed: ${err instanceof Error ? err.message : String(err)}`;
+    const detail = err instanceof Error ? err.message : String(err);
+    if (isFts5QueryError(err)) {
+      return degradedRepairMessage({ degraded: true, degradedReason: detail });
+    }
+    return `Saved to Markdown, but SQLite search reconciliation failed: ${detail}`;
   }
 }
 
+// A degraded reconcile result means the Markdown write succeeded but the
+// SQLite search mirror could not be updated (genuine FTS5 index error). The
+// caller must tell the user how to repair the index instead of looking like a
+// plain success.
+function degradedRepairMessage(result: { degraded?: boolean; degradedReason?: string }): string | null {
+  return result.degraded
+    ? `Saved to Markdown. Search may be temporarily unavailable (FTS5 index error: ${result.degradedReason}). Run /memory-sync-markdown to rebuild the search index.`
+    : null;
+}
+
 type MemoryAction = "add" | "replace" | "remove";
 
 type MemoryToolParams = {

package/dist/extensions/pi-hermes-memory/src/types.ts

@@ -52,8 +52,12 @@ export interface MemoryConfig {
   projectsMemoryDir?: string;
   /** Session search configuration. Default: { variant: "legacy" } */
   sessionSearch?: SessionSearchConfig;
+  /** Run a full SQLite quick_check asynchronously after opening. Default: true */
+  quickCheckOnOpen?: boolean;
   /** Override model used for child pi -p subprocess LLM calls. Default: unset */
   llmModelOverride?: string;
+  /** Fallback model chain tried in order when the primary review model fails (rate limit, 401/403, 404, 500/503, invalid response). Default: unset */
+  llmFallbackModels?: string[];
   /** Override thinking level used for child pi -p subprocess LLM calls. Default: unset */
   llmThinkingOverride?: ThinkingLevel;
   /** Trusted Pi extension sources required by child processes, such as custom providers or auth adapters. */
@@ -88,6 +92,13 @@ export interface MemoryConfig {
   autoConsolidationWarnOnFailure: boolean;
   /** Inject pinned STANDING.md instructions into every session. Default: true */
   standingInstructionsEnabled: boolean;
+  /**
+   * Session retention window in days. A positive value opts in to pruning
+   * sessions (and their messages) older than the window on startup; `0`/omitted
+   * disables pruning so no existing searchable history is silently deleted.
+   * Default: 0 (disabled).
+   */
+  sessionRetentionDays?: number;
 }
 
 export type MemoryCategory =

package/dist/extensions/pi-hermes-memory/tests/config.test.ts

@@ -41,6 +41,10 @@ describe("loadConfig", () => {
     assert.strictEqual(config.llmModelOverride, undefined);
     assert.strictEqual(config.llmThinkingOverride, undefined);
     assert.strictEqual(config.standingInstructionsEnabled, true);
+    // Retention is disabled by default so existing history is never silently
+    // deleted; a positive value opts in, 0/omitted disables.
+    assert.strictEqual(config.sessionRetentionDays, 0);
+    assert.strictEqual(config.quickCheckOnOpen, true);
   });
 
   it("honors a configured consolidationTimeoutMs, warning only when it is below the default", () => {
@@ -85,6 +89,7 @@ describe("loadConfig", () => {
       llmModelOverride: " openrouter/deepseek/deepseek-v4-flash ",
       llmThinkingOverride: "minimal",
       autoConsolidationWarnOnFailure: false,
+      quickCheckOnOpen: false,
     }));
     const config = loadConfig(TEST_CONFIG_PATH);
     assert.strictEqual(config.memoryMode, "legacy-inject");
@@ -101,11 +106,48 @@ describe("loadConfig", () => {
     assert.strictEqual(config.projectsMemoryDir, "my-memory");
     assert.strictEqual(config.llmModelOverride, "openrouter/deepseek/deepseek-v4-flash");
     assert.strictEqual(config.llmThinkingOverride, "minimal");
+    assert.strictEqual(config.quickCheckOnOpen, false);
     // Unset values use defaults
     assert.strictEqual(config.userCharLimit, 5000);
     assert.strictEqual(config.reviewEnabled, true);
   });
 
+  it("only accepts boolean quickCheckOnOpen overrides", () => {
+    fs.mkdirSync(path.dirname(TEST_CONFIG_PATH), { recursive: true });
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ quickCheckOnOpen: "false" }));
+    assert.strictEqual(loadConfig(TEST_CONFIG_PATH).quickCheckOnOpen, true);
+  });
+
+  it("merges array-form override tails with explicit llmFallbackModels", () => {
+    fs.mkdirSync(path.dirname(TEST_CONFIG_PATH), { recursive: true });
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({
+      llmModelOverride: ["p1/m1", "p2/m2"],
+      llmFallbackModels: ["p3/m3"],
+    }));
+    const config = loadConfig(TEST_CONFIG_PATH);
+    assert.strictEqual(config.llmModelOverride, "p1/m1");
+    assert.deepStrictEqual(config.llmFallbackModels, ["p2/m2", "p3/m3"]);
+  });
+
+
+  it("parses sessionRetentionDays as opt-in, accepting explicit 0 to disable", () => {
+    fs.mkdirSync(path.dirname(TEST_CONFIG_PATH), { recursive: true });
+
+    // Positive value opts in to retention pruning.
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ sessionRetentionDays: 45 }));
+    assert.strictEqual(loadConfig(TEST_CONFIG_PATH).sessionRetentionDays, 45);
+
+    // Explicit 0 disables retention (even after a prior positive value).
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ sessionRetentionDays: 0 }));
+    assert.strictEqual(loadConfig(TEST_CONFIG_PATH).sessionRetentionDays, 0);
+
+    // Negative / non-numeric values are ignored, keeping the (disabled) default.
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ sessionRetentionDays: -5 }));
+    assert.strictEqual(loadConfig(TEST_CONFIG_PATH).sessionRetentionDays, 0);
+    fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ sessionRetentionDays: "30" }));
+    assert.strictEqual(loadConfig(TEST_CONFIG_PATH).sessionRetentionDays, 0);
+  });
+
   it("handles partial config (missing keys use defaults)", () => {
     fs.mkdirSync(path.dirname(TEST_CONFIG_PATH), { recursive: true });
     fs.writeFileSync(TEST_CONFIG_PATH, JSON.stringify({ reviewEnabled: false }));

package/dist/extensions/pi-hermes-memory/tests/handlers/background-review.test.ts

@@ -771,7 +771,7 @@ describe("setupBackgroundReview", () => {
     assert.strictEqual(directCalls.length, 1, "direct review should be attempted first");
     assert.strictEqual(execCalls.length, 1, "subprocess should run as fallback");
   });
-  it("inherits the active session model and execution context for subprocess fallback", async () => {
+  it("inherits the active session model and cwd without coupling fallback to the agent run signal", async () => {
     const pi = createMockPi();
     setupWithDirectDeps(pi, { ok: false, appliedCount: 0, fallbackReason: "no_auth" }, {
       ...defaultConfig,
@@ -781,14 +781,15 @@ describe("setupBackgroundReview", () => {
     fireMessageEnd("user");
     fireMessageEnd("user");
     fireMessageEnd("user");
-    const signal = new AbortController().signal;
+    const controller = new AbortController();
     for (let i = 0; i < 10; i++) {
       fireTurnEnd(makeBranch(10), {
         cwd: "/tmp/local-session",
         model: { provider: "local-llama", id: "local-9b" },
-        signal,
+        signal: controller.signal,
       });
     }
+    controller.abort();
     await reviewSettledSignal.promise;
 
     assert.deepStrictEqual(logicalChildArgs(0).slice(0, 5), [
@@ -919,6 +920,161 @@ describe("setupBackgroundReview", () => {
     assert.ok(directPrompt.includes("monorepo layout"));
   });
 
+  it("does not forward the turn abort signal to the child review", async () => {
+    let capturedSignal: AbortSignal | undefined;
+    const childGate = Promise.withResolvers<void>();
+    const pi = createMockPi();
+    setup(pi, defaultConfig, {
+      execChildPrompt: async (_api, _prompt, _config, options) => {
+        capturedSignal = options.signal;
+        await childGate.promise;
+        return { code: 0, stdout: "Saved memory", stderr: "" };
+      },
+    });
+
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    const turnAbort = new AbortController();
+    for (let i = 0; i < 10; i++) {
+      fireTurnEnd(makeBranch(10), { signal: turnAbort.signal });
+    }
+    await settle(5);
+
+    assert.ok(capturedSignal, "child review must receive a session signal");
+    assert.notStrictEqual(capturedSignal, turnAbort.signal);
+    turnAbort.abort();
+    await settle(5);
+    assert.equal(capturedSignal.aborted, false, "turn abort must not cancel session review");
+
+    childGate.resolve();
+    await reviewSettledSignal.promise;
+  });
+
+  it("session_shutdown aborts the child signal, waits for review, and stays silent", async () => {
+    let capturedSignal: AbortSignal | undefined;
+    const childGate = Promise.withResolvers<void>();
+    let childStarted = 0;
+    const pi = createMockPi();
+    setup(pi, defaultConfig, {
+      execChildPrompt: async (_api, _prompt, _config, options) => {
+        childStarted++;
+        capturedSignal = options.signal;
+        await childGate.promise;
+        return { code: 0, stdout: "Saved memory", stderr: "" };
+      },
+    });
+
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    for (let i = 0; i < 10; i++) {
+      fireTurnEnd();
+    }
+    await settle(5);
+    assert.ok(capturedSignal);
+    assert.equal(capturedSignal.aborted, false);
+
+    const shutdownHandlers = handlers["session_shutdown"];
+    assert.ok(shutdownHandlers?.length, "session_shutdown handler must be registered");
+    const first = shutdownHandlers[0]({}, makeCtx());
+    const second = shutdownHandlers[0]({}, makeCtx());
+    assert.strictEqual(first, second, "repeated session_shutdown must reuse the same promise");
+    assert.equal(capturedSignal.aborted, true);
+
+    let shutdownDone = false;
+    void Promise.resolve(first).then(() => {
+      shutdownDone = true;
+    });
+    await settle(5);
+    assert.equal(shutdownDone, false, "shutdown must wait for the in-flight review");
+
+    childGate.resolve();
+    await first;
+    await reviewSettledSignal.promise;
+    assert.equal(shutdownDone, true);
+    assert.equal(
+      notifyCalls.some((n) => n.msg.includes("Memory auto-reviewed") || n.level === "warning"),
+      false,
+      "cancelled review must not notify success or failure",
+    );
+
+    resetReviewSettledSignal();
+    for (let i = 0; i < 10; i++) {
+      fireTurnEnd();
+    }
+    await settle(10);
+    assert.equal(childStarted, 1, "cancelled session must not start another review");
+  });
+
+  it("does not start fallback after session cancellation", async () => {
+    const directGate = Promise.withResolvers<void>();
+    let childStarted = 0;
+    const pi = createMockPi();
+    setup(pi, { ...defaultConfig, reviewTransport: "direct" } as MemoryConfig, {
+      runDirectReview: async () => {
+        await directGate.promise;
+        return { ok: true, appliedCount: 1 };
+      },
+      execChildPrompt: async () => {
+        childStarted++;
+        return { code: 0, stdout: "Saved memory", stderr: "" };
+      },
+    });
+
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    for (let i = 0; i < 10; i++) {
+      fireTurnEnd();
+    }
+    await settle(5);
+
+    const shutdown = handlers["session_shutdown"][0]({}, makeCtx());
+    directGate.resolve();
+    await shutdown;
+    await reviewSettledSignal.promise;
+
+    assert.equal(childStarted, 0, "cancelled session must not start subprocess fallback");
+    assert.equal(
+      notifyCalls.some((n) => n.msg.includes("Memory auto-reviewed") || n.level === "warning"),
+      false,
+    );
+  });
+
+  it("session_shutdown resolves after the grace bound when review ignores abort", async () => {
+    let started = false;
+    const pi = createMockPi();
+    setup(pi, { ...defaultConfig, reviewTransport: "direct" } as MemoryConfig, {
+      shutdownGraceMs: 20,
+      runDirectReview: async () => {
+        started = true;
+        await new Promise(() => {});
+        return { ok: true, appliedCount: 1 };
+      },
+    });
+
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    fireMessageEnd("user");
+    for (let i = 0; i < 10; i++) {
+      fireTurnEnd();
+    }
+    await settle(5);
+    assert.equal(started, true);
+
+    const first = handlers["session_shutdown"][0]({}, makeCtx());
+    const second = handlers["session_shutdown"][0]({}, makeCtx());
+    assert.strictEqual(first, second);
+    const startedAt = Date.now();
+    await first;
+    assert.ok(Date.now() - startedAt < 200, "shutdown must not wait for a review that ignores abort");
+    assert.equal(
+      notifyCalls.some((n) => n.msg.includes("Memory auto-reviewed") || n.level === "warning"),
+      false,
+    );
+  });
+
   it("falls back gracefully if getBranch throws", async () => {
     const config = { ...defaultConfig, nudgeToolCalls: 3 };
     const pi = createMockPi();