The session injected in the request is a factory. When the request iscloned (ie sub-request) while the session is not yet used in the master request (the session is still a factory), both Master and Sub request will have a factory.
If both requests attempt to read the session afterward, they both triggers the factory, and both initialize the session.

It's not a dead end for theSessionListener because the session come from the container and is shared, but:

• the session is initialized ($storage->setOptions(['cookie_secure' => true])) twice
• if we replace the sesssion from container to a factory, it could be an issue