- X-Oikos-Session-Id header → context fallback for _session_id - sessionIDFromArgsOrContext() reads from args, then header - AssentWindowActive falls back to session-ID-only LIKE lookup - windowActiveLike() for LIKE-pattern autonomy_settings queries - mcpBearerToken: package-level resolved token replaces os.Getenv() in decide_approval - Bump 0.36.0 → 0.37.0