There is a potential deadlock when manipulating TrustLists via the File-API: Consider clients A and B:
According to the specification they are both allowed to open distinct TrustLists objects concurrently for writing. Eventually Client A has finished writing and calls "CloseAndUpdate()". This will create a new transaction - so far so good.
But now there is the following situation: if Client A calls "ApplyChanges()" it will get an "Bad_InvalidState" according to https://reference.opcfoundation.org/GDS/v105/docs/7.10.6 ("ApplyChanges returns Bad_InvalidState if any TrustLIst is still open for writing."). And also Client B cannot do anything meaningful, because calling "CloseAndUpdate()" should give it "Bad_TransactionPending" in this case (even if not mentioned at https://reference.opcfoundation.org/GDS/v105/docs/7.8.2.3).
The only resolution here is that either Client A calls "CancelChanges()" or closes its session; or Client B calls "Close()" or closes its session; or the ActivityTimeout" triggers (which eventually closes the trust list for client B).

Is this behaviour really desired? Would it make sense to just drop the any-trust-list-is-open-for-writing restriction in "ApplyChanges()" so that Client A can finish its change?

This issue is still present in the 1.05.04 RC1.