fix(compression): serialize session rotation with durable leases

[yingliang-zhang]

Summary

• prevent stale/concurrent agents from rotating one completed parent session into sibling continuation sessions
• keep compression rotation admission in the existing SQLite transaction and durable per-session lease
• preserve rollback/reopen and legacy lightweight SessionDB compatibility

Problem

Two agent instances can hold the same parent session. After one finishes compression rotation, a late caller could reacquire the now-free lease and rotate the completed parent again, creating a sibling continuation.

Changes

• reject compression-lock acquisition atomically when the parent already has end_reason="compression"
• keep expiry reclamation, holder-qualified refresh/release, and rollback/reopen behavior intact
• make lock rejection messaging cover held, unavailable, and already-rotated states
• add deterministic concurrent coverage proving the winner released its lease and completed the parent before the stale caller attempts acquisition

Verification

• focused compression suites: 37 passed
• gateway concurrent-session tests: 2 passed
• lock refresh/reclaimability test: 1 passed
• independent final review: ACCEPT, no P0–P2 findings
• py_compile: passed
• ruff check: passed
• git diff --check: passed

Residual behavior

The exact legacy hot-reload compatibility path still proceeds unlocked when the live SessionDB class structurally lacks the lock API. This preserves the existing compatibility contract until process restart.

[teknium1]

Thanks for isolating the late-acquirer race and adding deterministic concurrent coverage.

Problems

• Blocking — hermes_state.py:2427: the new marker check treats any end_reason='compression' row as a completed rotation. Rotation is not atomic on current main: agent/conversation_compression.py:868 ends the parent, while create_session() follows at agent/conversation_compression.py:896-902. If the process dies in that interval, the lease eventually expires but this check rejects every recovery attempt despite there being no continuation child.

Suggested changes

• Gate the durable rejection on a verified valid continuation child, using the existing child exclusions in hermes_state.py:3265-3272, or make completion atomic.
• Add a test for a compression-ended parent with no child after lease expiry; it should remain recoverable. Keep the new stale-caller test for the completed-child case.

Automated hermes-sweeper review.