[jvoisin]

Serialization and unserialization contexts are stored in module globals, but their allocations belong to the current request heap. If a bailout skips the normal context cleanup, those globals can retain pointers to memory that is freed at request shutdown.

The next request can process input before module RINIT runs. In particular, multipart upload-progress handling can invoke session serialization during input parsing, before the existing RINIT reset. It may therefore observe the previous request’s stale context and lock state. Resetting only in RINIT is too late to protect this path.

Clear the serialization lock and both context structures at the beginning of request startup, before input processing. This discards the bookkeeping without following potentially invalid pointers or running destructors. Remove the redundant reset from basic-module RINIT.

Add regression coverage that abandons serialize or unserialize state via a bailout, then sends a multipart upload-progress request to the same worker. Verify the follow-up request sees cleared state for locked and unlocked cases.

Validation: the regression passes with the startup reset alone and fails when both resets are removed.