Seeking Confirmation about Server Sessions

Seeking confirmation: Server.session variables can only be set and fetched from a callable server function, not in the client code, correct?

That is completely correct. See the docs here for all the details!