Description

Fixes a null reference exception that occurs when a session expires between CreateSession and ActivateSession requests. The issue stems from a race condition where the server doesn't properly validate session existence during activation when the session has already timed out.

The fix is a minimal, targeted change in StandardServer.ActivateSessionAsync: a null-coalescing throw ensures the session exists after lookup, returning BadSessionIdInvalid if it has expired.

Example flow that previously failed:

// Session created successfully
var createResp = await client.CreateSessionAsync(...);

// Session expires before activation
await Task.Delay(sessionTimeout);

// Previously: NRE from null session
// Now: BadSessionIdInvalid returned correctly
var activateResp = await client.ActivateSessionAsync(...);

Note on scope

Earlier revisions of this port also modified SessionManager.ValidateRequestAsync (removing ActivateSession from the early-return bypass) and Session.ValidateRequest (allowing ActivateSession on non-activated sessions). These changes were reverted because they cause the secure channel id check in Session.ValidateRequest to run on reactivation, breaking valid OPC UA reconnect-on-alternate-channel scenarios — the same regression flagged in the source PR #3844. Symptoms included BadSecureChannelIdInvalid failures in tests such as ApplicationCertificateRotationRehandshakesOpenManagedChannelsAsync, ReconnectJWTAsync, and ReconnectSessionOnAlternateChannelAsync.

Related Issues

Ports the fix from PR #3844 which addressed this issue on the master378 branch.

Checklist

• I have signed the CLA and read the CONTRIBUTING doc.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added all necessary documentation.
• I have verified that my changes do not introduce (new) build or analyzer warnings.
• I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed.
• I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings.
• I have addressed all PR feedback received.