Move session_id validation to the top of _handle_session_close() in
A2aLocalFacade so that empty or missing session IDs are rejected with
ValueError('session_id is required') regardless of whether SessionService
is wired. Previously, callers could bypass the guard by omitting
session_service and passing an empty/null session ID through to
_cleanup_session_devcontainers().

Also close out issue #9094.

ISSUES CLOSED: #11053

@@ -40,3 +40,3 @@
 * HAL 9000 has contributed the Strategize phase full context snapshot fix (issue #9056): added `_build_strategize_context_snapshot()` helper to `PlanLifecycleService`, updated `_try_record_decision()` to accept and forward a `ContextSnapshot` parameter, and added BDD test coverage verifying all four `ContextSnapshot` fields (`hot_context_hash`, `hot_context_ref`, `actor_state_ref`, `relevant_resources`) are populated during the Strategize phase.
 * HAL 9000 has contributed the ACMS context path matching fix (PR #10975 / issue #10972): corrects `_path_matches()` and `_matches_pattern()` to properly match absolute fragment paths against relative glob patterns by auto-prefixing with `**/` before calling `PurePath.full_match()`, preventing silent inefficacy of include/exclude filters for absolute paths in fragment metadata.
-* HAL 9000 has contributed database resource types (PostgreSQL, SQLite) with transaction-based sandbox strategy: implemented ``DatabaseResourceHandler`` providing full CRUD operations (`read`, `write`, `delete`, `list_children`) and connection validation with automatic credential masking for PostgreSQL and SQLite backends. Includes ``TransactionSandbox`` infrastructure wired into ``SandboxFactory``, BDD test coverage in ``features/database_resources.feature``, and Robot Framework integration tests in ``robot/database_resources.robot`` (PR #10591 / issue #8608, Epic #8568).
+* HAL 9000 has contributed the a2a session_id validation fix (PR #11053 / issue #9094): moved the session_id validation guard to the top of `_handle_session_close()` in `A2aLocalFacade`, closing the validation bypass path where empty or null session IDs could slip through to devcontainer cleanup when `SessionService` was not wired.

@@ -27,0 +31,4 @@
+  Scenario: Session close with missing session_id key and no service raises ValueError error
+    Given a facade-cov facade with no services
+    When I dispatch facade-cov operation "session.close" with params {}
+    Then the facade-cov response status should be "error"

@@ -297,6 +298,14 @@ def step_fc_data_no_key(context: Context, key: str) -> None:
     )
 
 
+@then(r"the facade-cov response error should contain 'session_id is required'")