fix: reject events for deleted in-memory sessions

core/src/main/java/com/google/adk/sessions/InMemorySessionService.java

@@ -306,6 +306,13 @@ public Single<Event> appendEvent(Session session, Event event) {
     String userId = session.userId();
     String sessionId = session.id();
 
+    ConcurrentMap<String, ConcurrentMap<String, Session>> appSessions = sessions.get(appName);
+    ConcurrentMap<String, Session> userSessions =
+        appSessions == null ? null : appSessions.get(userId);
+    if (userSessions == null || !userSessions.containsKey(sessionId)) {
+      return Single.error(new SessionNotFoundException("Session not found: " + sessionId));
+    }
+
     // --- Update User/App State (Same as before) ---
     EventActions actions = event.actions();
     if (actions != null) {

core/src/test/java/com/google/adk/sessions/InMemorySessionServiceTest.java

@@ -149,6 +149,20 @@ public void lifecycle_deleteSession() {
         .isNull();
   }
 
+  @Test
+  public void appendEvent_rejectsDeletedSession() {
+    InMemorySessionService sessionService = new InMemorySessionService();
+    Session session =
+        sessionService.createSession("app", "user", new HashMap<>(), "session1").blockingGet();
+    sessionService.deleteSession("app", "user", "session1").blockingAwait();
+
+    sessionService
+        .appendEvent(session, Event.builder().build())
+        .test()
+        .assertError(SessionNotFoundException.class);
+    assertThat(sessionService.listSessions("app", "user").blockingGet().sessions()).isEmpty();
+  }
+
   @Test
   public void appendEvent_updatesSessionState() {
     InMemorySessionService sessionService = new InMemorySessionService();