also worth mentioning -- a HttpSessionAttributeListener on webapp2 shows that the attribute setter is causing the attributeReplaced() method to be called, so these events are firing.
However, the VERSION of webapp2's session shown in the JMX console under TomcatClusteringCache printDetails() remains unchanged... Does that mean no replication of the update happened?
Yes, sessions other than the initial on a cross-context request aren't getting replicated. This is a bug; I'll open a JIRA for it.
I am also interested in following this issue.
Can you post the JIRA key?