[octobroker]

Staging PR for the owner's review. Base is fix/facade-stateless (the head of openabdev#1578); once approved, fix/facade-stateless is fast-forwarded to this commit, which updates openabdev#1578. Do not merge here.

Addresses round 1 of the openabdev#1578 review (F1–F4) plus two of the earlier non-blocking notes:

• F1 — native/gmail.rs: the serve_http doc no longer claims to mirror the facade transport; it says gmail is still stateful (same idle/restart 404 exposure) and that the reqwest::Client and refresh lock must be shared outside the per-session factory before it can go stateless. GmailNative doc: one instance per stdio serve process, or per MCP session over HTTP.
• F2 — the 2026-07-28 claim is scoped to the removal of protocol-level sessions (the facade still speaks the 2025 initialize handshake), in both the build_router doc and docs/oab-mcp-facade.md.
• F3 — ADR §6.2 gains a "Stateless transport" bullet (gmail remains stateful pending unification); the operator guide states that a stale Mcp-Session-Id is ignored rather than rejected; the Trust model section now says "agent session" for the bearer-backed session, with a one-line note that it is unrelated to the MCP protocol session; the e2e test doc says "session-token (bearer) mechanism".
• F4 — the regression test checks the initialize body (result + protocolVersion, no error) and asserts DELETE /mcp → 405 alongside GET, both with Allow: POST.
• Earlier non-blocking notes: the constraint that future facade tools must not rely on server→client requests or the GET SSE stream is documented (doc comment + operator guide), and a comment explains why NeverSessionManager is intentionally redundant with with_stateful_mode(false).

Not in this round (reviewer marked them follow-ups / non-blocking): gmail stateless switch, idempotency keys, cancellation-token propagation, json_response, bearer-miss debug logging, cargo audit, tense alignment in the two "is being removed" docs.

🤖 Generated with Claude Code