The SDK already threaded the Mcp-Session-Id header through RequestHandlerExtra.sessionId and both handler factories already extracted it for log correlation — but the value was dropped before constructing the public Context. Downstream servers that want session-scoped state, per-session tool surfaces, or per-session enumeration on top of token-addressable primitives (canvases, dataframes) had no path to do so without reaching into SDK internals.

- core: Context.sessionId (readonly, optional). Defined for HTTP in stateful / auto mode; undefined for stdio and stateless HTTP unless the server opts in. ContextDeps.sessionId plumbed through createContext.
- core/app: new public ContextOptions interface surfaced via CreateAppOptions.context. exposeStatelessSessionId: true opts ctx.sessionId into stateless HTTP using the SDK's per-request token. Fail-closed by default — handlers don't silently treat unique per-request tokens as durable session keys.
- factories: HandlerFactoryServices / ResourceHandlerFactoryServices gain optional exposeStatelessSessionId. Durability gate applied before createContext; log correlation continues to use the raw SDK sessionId for tracing the per-request token through events.
- testing: MockContextOptions.sessionId for handlers that branch on ctx.sessionId.
- skills: api-context v1.2 → v1.3 with new ## ctx.sessionId section covering the when-defined matrix across stdio / stateless / stateful × auth modes, capability-token coherence, strict / lax state-keying recipes.

Devcheck clean (13 checks); full suite 3042 passed / 9 skipped + 3 worker passed + 107 integration passed.