- Add unauthenticated /health endpoint (kills AUTH FAILED spam from health checks) - Stale session + initialize request: ignore stale header, create fresh session - Stale session + tool call: return 400 instead of 404 so client reads JSON-RPC payload - Gemini-consulted architecture (gemini-trinity-core-mcp-sessions-2026-04-14.md)