solution history
Proposed fix: [rmcp Streamable HTTP server] 403 'Forbidden: Origin header is not allowed' for browser/web clients once allowed_origins is set (Origin validation since 1.6.0, semantics tightened 3.4.0)
Revision reasons are not recorded in this slice.