ROADMAP-13 — P1 — TTL-expired history silently returns [] while corrupt history fails closed #105

Series: ROADMAP — filed from the 2026-10-27 whole-project assessment · Backlog task: M15-T06 · Priority: P1 · Effort: small

Problem

Two different paths reach the same data-loss outcome, and only one of them is guarded:

• Corrupt history payload → SessionHistoryError (503), run marked failed, history never overwritten — correct.
• Expired Redis key (default TTL 3660s) → get_messages returns [] → the run answers with no context and then overwrites the key with the truncated conversation. Silent conversation loss, the exact failure mode the corrupt-history fix exists to prevent.

History also lives only in Redis (PostgresMemoryStore has no session methods; TieredMemoryStore delegates exclusively to Redis).

Evidence

• agentkit/memory/redis_store.py:112–123 — corrupt → SessionHistoryError
• agentkit/memory/redis_store.py:59–94 — save path truncation
• agentkit/core/agent.py:290–298 → :202 — empty-history answer then overwrite

Suggested fix / acceptance criteria

• Distinguish "key absent/expired" (treat as a fresh conversation — arguably OK, but distinguishable) from "payload present but corrupt" (still 503)
• At minimum: log at WARNING with session id when answering an expired-key session, and document the intended semantics in the ADR for ADR-013's successor
• Stretch: persist a compact session checkpointer in PG so TTL expiry degrades instead of erasing
• Unit tests for both paths

Suggested branch / commit

fix/session-ttl-expiry-distinction · fix(memory): distinguish expired sessions from corrupt history