so when session timeout, it only triggered SessionDestroy Event (HttpContextLifecycle.sessionDestoryed() method), it will find the session (HttpSessionContextImpl.java destroy() method, line 53 - conversationContext.destroy(session)

And LazyHttpConversationContextImpl call AbstracctConversationContext's destroy method, in that method, it called setActive(true), which will create the ThreadLocal for ConversationContext (AbstractConversationContext.java line 367), right after that, it will check, since it's transient conversation, so it will be skiped and the remove State never got called.

This is how it will stuck. - I guess.