Spec ver 1.03 Part 4 Section 5.6.4.1 on CloseSession does state:
"When the CloseSession Service is called before the Session is successfully activated, the Server
shall reject the request if the SecureChannel is not the same as the one associated with the
CreateSession request."

It however does not mention what should happen if the channel is same. I would assume it works and receives StatusCode Good as otherwise the resources would be reserved by the server until the session times out. For example the following could be added to the above quote in the spec "If the SecureChannel is the same, then the server shall close the Session.".

The reason I'm asking this is because it would be best if this is specified clearly so I don't have to make assumptions, e.g. Bad_SessionNotActivated could be another way of thinking, but it would not make any sense in my opinion. Also I run into a CTT issue that seems to assume Bad_SessionNotActivated would be the correct one https://opcfoundation-onlineapplications.org/mantis/view.php?id=3592.