Streamable HTTP server answers a session-less non-initialize POST with 422, spec says 400 #1376

🤖 AI-generated issue, prepared with Claude Code and reviewed by the submitter.

In legacy session mode, StreamableHttpService answers a POST that has no Mcp-Session-Id header and is not initialize with 422 Unprocessable Entity (Unexpected message, expect initialize request). GET and DELETE in the same situation already return 400 Bad Request (Bad Request: Session ID is required).

The Streamable HTTP transport's Session Management section (2025-11-25, same wording in 2025-06-18) says:

Servers that require a session ID SHOULD respond to requests without an MCP-Session-Id header (other than initialization) with HTTP 400 Bad Request.

How it showed up: a client reconnecting after the server reaped an idle session got 404 for its stale session id, as expected, then 422 for its next session-less request before re-initializing.

Where: crates/rmcp/src/transport/streamable_http_server/tower.rs, the two session-less POST branches that return unexpected_message_response("initialize request") from transport/common/server_side_http.rs.

I have a small fix ready that returns the same 400 response GET and DELETE use, with a regression test, and will open it as a PR linked to this issue.