The state you're describing (`started === true` and `closed === true`), was effective when saving the session before applying #9246. this behavour was solved, but this method would then return an empty id, thus deleting the session cookie... Which is why I extended this condition to return an empty session id only if the session was *never* started, not even once.

So that's the point of having the `closed` flag : to tell the difference for the `started` flag whether it means the session was already at least started once or never started. If it is true, then that means that the session was started at least once.