COAZ-MCP defines no mapping for `initialize`, so Unknown Methods denies it

Unknown Methods says:

A request whose method has neither a default mapping defined by this binding nor an applicable declared mapping, and that is not in the pass-through set above, MUST be denied.

initialize does not appear anywhere in the document. It has no default mapping, and the pass-through set is ping and all notifications, so it is not there either. It is a client-to-server request carrying an id, so the Server-initiated Requests carve-out does not reach it. A conforming PEP therefore MUST deny initialize, and no session can be established through it.

notifications/initialized does pass through under notifications/*, so the notification half of the handshake is allowed while the request half is denied.

Either add initialize to the pass-through set, or give it a default mapping. The mapping form also lets a PDP refuse a session by protocol version or agent:

// initialize
{ "evaluation": {
    "subject": { "type": "identity", "id": "$token.sub" },
    "context": { "agent": "$token.?client_id", "protocol_version": "$params.protocolVersion" },
    "action": { "name": "initialize" },
    "resource": { "type": "mcp_server", "id": "$token.aud" } } }

Start with the COAZ-MCP document's Unknown Methods section and review how the pass-through set, default mappings, and Server-initiated Requests carve-out handle the handshake. Decide how initialize should be permitted, update the specification so the request and notifications/initialized are consistent, and verify that the resulting text allows a conforming session to begin.