If this long lived session never loaded / had anything to do with the nodes created by the other sessions, it shouldn't be keeping any references (i.e. acting as a GC root). Only after a session accesses a node will that node (and whatever lies beneath) become strongly referenced by that session.

So it would help if you investigate the GC roots in your case and check where the unclean references come from. In general, once a short lived session is logged out (session.logout) it is removed from the repository Map which holds active sessions and therefore it should become eligible for GC.

Does it mean that weak references can exist too?

There are a variety of inter-object references which are stored by ModeShape, both weak and strong. From a GC perspective, only the strong ones are relevant. From the perspective of a potential memory leak, it's important that once a session is logged out all referenced objects together with that session can be GCed.

Are you using by any change a custom workspaceCache size ? (default is 10k). The workspace cache is the other place which stores in-memory data shared by sessions and which is not cleared unless a WS is deleted or the repository shut down.

Feel free to attach the heap dump and once I get the chance, I'll look at it.

If the default workspaceCache is 10k , does it mean  Modeshape still holds these in-memory references object shared shared by the sessions. Is it a memory leak inside Modeshape?