McpException (internalError) when the host OS CSPRNG is unavailable. This is fail-closed (see generateSessionId/fillSecureRandom), so callers on the request path (e.g. streamable_http.handlePost's initialize branch) must be prepared for it to throw rather than always returning an id. vibe.d converts an escaping McpException to an HTTP 500; handlePost additionally maps it to a JSON-RPC error response so the wire shape matches every other error path.
Generate a new cryptographically-secure session id, create and store the per-session ConnectionState it owns, record it as active, and return the id. The id is a 256-bit value rendered as lowercase hex, which satisfies the spec requirement that the id "MUST only contain visible ASCII characters (ranging from 0x21 to 0x7E)".
Before minting the new session the idle TTL sweep runs lazily and, if the active-session cap would be exceeded, the least-recently-active session is evicted — so a client that connects, initializes, and walks away without DELETE cannot grow the table without bound.