Reviewing the DeltaSession code I noticed that, for a newly created DeltaSession, that a DeltaRequest is not created until the request is completed. That means any changes made to a newly created session in the request where the session is created cannot be replicated as there is no DeltaRequest to record the changes. I have confirmed this behaviour on my local test cluster. The fix should not be too tricky and should tie in with the changes planned to address bug 62841.
Just a note that the problem statement is correct but the analysis is not. I'm still digging into what is going wrong.
I've been able to identify the root cause. The session update message is being processed before the session create message. The chances of this issue were reduced in a previous fix: https://github.com/apache/tomcat/commit/ddfb17efe0a05618195c1182c9d8d7c75b175209#diff-5d32282a96cace5f4cc1c9aa0d3cd03d I plan to look to see if there is more that can be done.
Fixed in: - master for 9.0.21 onwards - 8.5.x for 8.5.42 onwards - 7.0.x for 7.0.95 onwards