[Huang-404-Q]

closeSession() set SESSION_FLAGS_DESTROYED and then called session.setTimeout(0). setStreamTimeout() returns early when the session is destroyed, so the idle timer stayed armed and retained the session until the server timeout fired.

Clear the timeout and remove its listeners before setting the destroyed flag.

Fixes: #66885

Test: test/parallel/test-http2-session-timeout-cleared-on-close.js asserts session.timeout === 0 after close. It fails on current main (actual: 30000, expected: 0) and passes with the reorder.

I verified the behavior against the installed Node v24.14.0 with an emulated patch (the repo's lib/ needs a full build to run in-tree); the test itself was run with that patch.

[nodejs-github-bot]

Review requested:

• @nodejs/http2
• @nodejs/net

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.