Model server sessions with explicit CREATED, ACTIVATED, and CLOSED states. Mark a session CLOSED, detach it, and remove it from lookup before callbacks can re-enter, while delaying destructive access-control and resource teardown until current jobs finish.
Reject sessions closed by service, notification, and access-control callbacks, stop multi-operation processing after closure, and preserve progress during UACP and HTTP channel teardown. Add regression coverage for callback reentrancy, shared TCP/WebSocket UACP teardown, and HTTP session cleanup.
Julius Pfrommer