The ThreadGuard of the ServiceStateMachine was recently changed so that it'd be released before entering the TransportLayer of ServiceExecutor. However, it's possible for sinkMessage to fail and switch the SSM's state to endSession before processMessage() has returned and then the SSM will be cleaned up twice.