InMemorySessionService.appendEvent recreates a deleted session #1697

🔴 Required Information

Describe the Bug:

InMemorySessionService.appendEvent can bring a deleted session back. If code keeps a reference to a Session, deletes it through the service, and then appends an event using the old reference, appendEvent inserts that session into the internal map again.

Steps to Reproduce:

1. Create an InMemorySessionService and a session.
2. Delete the session.
3. Call appendEvent with the retained Session object.
4. Fetch the deleted session again.

Expected Behavior:

The append should fail because the session no longer exists, and the session should remain deleted. SessionNotFoundException seems like the natural error here.

Observed Behavior:

The append succeeds, and getSession returns the previously deleted session again.

appendEvent currently ends with:

sessions
    .computeIfAbsent(appName, unused -> new ConcurrentHashMap<>())
    .computeIfAbsent(userId, unused -> new ConcurrentHashMap<>())
    .put(sessionId, session);

so all three missing levels are recreated.

Environment Details:

• ADK Library Version: current main at 84bae34a9ae4c133c7e6294faff5cb50f64a3474
• OS: Ubuntu 24.04
• Java Version: OpenJDK 21.0.12.1

Model Information:

• Which model is being used: N/A

🟡 Optional Information

Regression:

Unknown.

Logs:

I added the focused test below and ran:

./mvnw -pl core -Dtest=InMemorySessionServiceTest#appendEvent_afterDelete_doesNotRecreateSession test

It fails with:

expected com.google.adk.sessions.SessionNotFoundException to be thrown, but nothing was thrown
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0

Screenshots / Video:

N/A

Additional Context:

The Python ADK InMemorySessionService.append_event checks that the session ID is present and raises SessionNotFoundError before applying the event. Matching that behavior would also prevent a stale session reference from undoing a successful deletion.

Minimal Reproduction Code:

@Test
public void appendEvent_afterDelete_doesNotRecreateSession() {
  InMemorySessionService sessionService = new InMemorySessionService();
  Session session = sessionService.createSession("app", "user").blockingGet();
  sessionService.deleteSession("app", "user", session.id()).blockingAwait();

  assertThrows(
      SessionNotFoundException.class,
      () -> sessionService.appendEvent(session, Event.builder().build()).blockingGet());

  assertThat(
          sessionService.getSession("app", "user", session.id(), Optional.empty()).blockingGet())
      .isNull();
}

How often has this issue occurred?:

• Always (100%)