In my opinion, the State management for the java client depends on how the java client is connecting to the business tier. if the client connects directly to the business tier, I will prefer to have the sesion managed locally on the client and not on the server. But if the client connects to the business tier through a common web front, then I would prefer manage using the SFSB on the business tier.
Again there is no hard and fast rule, but need document clearly, your choice and why.
I remeber showing DTO's on both component and SD.