There is only one handler instance per Connector. Remoting could (and probably would) make calls on the handler concurrently. It is up to the handler implementation to be thread safe. I don't want to impose single thread model on handlers. Same goes for MBean handlers.
That should be documented somewhere - probably in the javadocs for the ServerInvocationHandler interface. I was under the assumption that a handler object was created for each request and hence did not need to be thread-safe. Perhaps say something like
each server invocation handler is instantiated and cached within the connector to which it belongs. Multiple requests may get dispatched to the invocation handler's invoke call; therefore, each server invocation handler implementation must ensure thread safety.
Have added it to wiki and javadocs.