Return HTTP 404 for stale Streamable HTTP sessions

[quinnj]

Summary

• return HTTP 404 Not Found when a legacy Streamable HTTP request carries an unknown MCP-Session-Id
• preserve the existing JSON-RPC -32001 error body for protocol diagnostics
• cover the exact stale-session resources/read flow with a transport regression test

Root cause

The server classified an unknown session correctly as JSON-RPC -32001, but jsonrpc_error always forced HTTP 200. The MCP 2025-11-25 Streamable HTTP session contract requires HTTP 404 after a session terminates. That status tells the client to initialize a new session. A client that relies on the required HTTP recovery signal can otherwise keep reusing the stale session and fail the request.

The GET event-stream path already returns HTTP 404 for an unknown session. This change makes the POST JSON-RPC path consistent.

Specification: https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management

Scope

The runtime change is transport-only. It does not alter session storage, session lifetime, JSON-RPC error codes, tools, resources, or application behavior. Other JSON-RPC errors keep HTTP 200.

The branch also reuses the test-only deterministic listener waits already present in PR #4. Main used fixed 200 ms sleeps, which failed before this regression on Linux and Windows. This adds no runtime change.

Validation

• regression test failed before the fix with 200 == 404
• full package suite passes locally: 141 tests
• verified the response keeps JSON-RPC -32001 and the Unknown MCP session message
• replaced the pre-existing listener sleeps with bounded condition waits from PR 2025-11-25 spec compliance fixes + JuliaC trim-compile harness #4

Co-authored by Codex