For both the WebSocket and HTTP tunnels, it seems to be possible for connections to be stuck marked as "active", even though they are not actually in progress, the underlying socket is closed, and the corresponding guacd process has terminated.
The cause of this has not yet been determined, but it could be related to a lack of read operations on the underlying socket if the connection terminates at just the right time. If there are never any reads against the socket, then the closed state will never be discovered, and Guacamole will assume the connection is open.
It may be necessary to implement some sort of timeout surrounding GuacamoleTunnel which does not depend on explicit reads/writes for failure. Such a system would need to explicitly invoke close() on the tunnel, to ensure that systems depending on that call (like the database auth) are properly updated.