APM swallowing JSESSIONID cookie; workaround possible by copying cookie to return stream?

Putting a close to this whole question - I did successfully implement the code to copy the JSESSIONID header from the incoming response to the outgoing response, in both directions - and it didn't fix the issue. It turns out there was another device between the F5 and the real servers - and that device was occasionally caching in an incorrect way. Once that caching behavior was fixed on that proxy, the issue disappeared.

But it was an interesting effort, looking for it, and I certainly learned more about the event lifecycle - so there is that!