hmmm, as I suspected, it is really our application context object(which has no injection). Our issue only happens when two different users (ie. that means two different conversations) are going on. and we have this really big report object that does reports and is thread safe and need it to be in application context for everyone to use but seems seam is doing synchronization on that one too when we don't want that since it is thread safe AND has no injection into it.
shoot, that was wrong. tricked myself. looks like two users is fine. I slept to long on the first user and skipped sleeping on second user and second user worked but first user failed with ConcurrentRequestTimeoutException...odd so this timeout has to be longer than the longest method call which is very odd I think.
Is there any way to change the timeout on a per method basis as most methods, 20 seconds is probably more than enough but on this one, I probably need about 2 minutes or so.