Production smoke test on 2026-05-15: POST /mcp initialize succeeds and returns mcp-session-id, but later same-session tools/list or tools/call can return 404 Session not found. Root / stateless POST works. User impact: MCP clients using sessionful Streamable HTTP are unreliable. Acceptance: sessionful /mcp requests survive initialize -> initialized -> tools/list -> tools/call, or docs/spec route clients to the supported stateless endpoint with tests.