Gateway resurrects ended session from stale sessions.json routing key — session reset silently undone

[tsjc]

Summary

When a session is marked ended in state.db but its routing key still exists in sessions.json, the next gateway start resurrects the ended session (same session id, full history) instead of creating a fresh one. A user's explicit session reset is silently undone.

Environment

• hermes-agent 0.18.0 (v2026.7.1-368-g5b04a024a), install method: git
• macOS 26.5.1 (Apple Silicon), gateway run via hermes gateway run --replace
• Platform: Telegram DM session

Steps to reproduce

1. Have a long-lived platform DM session (ours: ~209 active messages, ~460k-token prompt, 727 API calls).
2. Ask the agent to restart/reset the session — the session gets marked ended in state.db, but the platform routing key remains in sessions.json.
3. Restart the gateway (hermes gateway restart).
4. Send a new message on the platform.

Expected

A new session id is created for the routing key (ended session stays ended).

Actual

Gateway logs:

warning #54878: session ... ended in state.db but still live in sessions.json; dropping stale entry and recovering/recreating the session

…and then "recreates" the same session id with its entire history. In our case the user tried twice over 9 hours to escape a ~460k-token session (which was suffering per-call latencies of 60–165s) and could not — the only working escape is /new from the platform chat.

Impact

• Users cannot escape oversized/expensive sessions via reset+restart; ours had accumulated an estimated $199 of API spend and 140 compression cycles.
• Combined with auto-compression thrash on huge sessions, this locks users into degraded latency/quality with no obvious way out.

Suggested fix

On recovery, if state.db says the session is ended, honor that: drop the sessions.json entry and mint a fresh session id rather than resurrecting the ended one.

[alt-glitch]

This was generated by AI during triage.

Related: OPEN fix PR #61743 (fix(session): check reset policy in self-healing recovery path (#54878)) targets exactly this — the #54878 self-heal branch drops the stale sessions.json entry but never calls _should_reset(), so it recovers/recreates the same ended session id. Also part of the #54878 session-routing family (#61220, #59580, #58486). Linking for navigation; not a duplicate.