It is not clear if CloseSession might succeed if the session is not activated.

Quote from 1.02:
"The Session created with this Service shall not be used until the Client calls the ActivateSession Service ... "

This lead to servers returning BadSessionNotActivated in the CloseSession response. However, this status code is not listed in table 16 (CloseSession Service Result Codes).

Either this is the error or the CloseSession Service is an exception to the quote above. If so, this exception should be explicit mentioned.

CTT expects/accepts BadSessionNotActivated in the response if ActivateSession fails.

Technically the client should be allowed to close the session even if it is not activated (i.e. invalid credentials). This would allow the server to release the resources immediately instead of waiting for the timeout or using another resource gather strategy and it should also be part of a graceful shutdown sequence in case of an error (as well as closing the secure channel instead of a direct disconnect).