feat(protocol-2026): re-pin DRAFT-2026-v1 schema to 6e4cba2d, fix wire defects

Re-vendors schema.ts (1bf94a60 -> 6e4cba2d) and the upstream fixture pin
(1304c8fe -> 60dc69e9) to close the drift between the 2026-06-10 pin and
the live draft. Applies every wire-breaking and binding change carried
by the diff:

- MCP error codes renumbered into the schema's now-partitioned ranges
  (-32000..-32019 implementation-defined, -32020..-32099 spec-reserved):
  HeaderMismatch/MissingRequiredClientCapability/UnsupportedProtocolVersion
  move to -32020/-32021/-32022; framework-internal McpError codes that
  squatted those numbers renumbered into -32000..-32019. New
  mcp_error_code_partition test pins both invariants; six turul-mcp-server
  test files with hardcoded old codes migrated.
- CancelledNotificationParams.requestId reverted to required (was Option),
  client->server only.
- ElicitationCompleteNotification/Params and ElicitRequestURLParams
  .elicitationId removed entirely.
- New NotificationMetaObject / SubscriptionsListenResult(+Meta) types for
  subscription-stream metadata; subscriptionId stamping was already
  implemented server-side ahead of the spec formalizing it.
- ListRootsRequest.params reverted to a bespoke inline shape.

Also fixes two defects found during re-audit, not schema-diff-driven:
- ContentBlock::ResourceLink emitted duplicate annotations/_meta keys on
  the wire (variant fields alongside the flattened ResourceReference,
  both carrying the same fields) - removed the variant-level fields.
- PrimitiveSchemaDefinition's untagged enum didn't enforce the schema's
  `type` discriminator (bare {"type":"integer"} silently parsed as
  StringSchema) - added a hand-written Deserialize that dispatches on
  type/enum/oneOf before trying variants.
- SubscriptionsListenResultMeta's caller-writable `extra` map could shadow
  the typed subscriptionId field with a colliding key - hand-written
  Serialize now drops any colliding extra entry.

All new/changed contracts covered by regression tests confirmed failing
before the fix and passing after. The ResourceLink and
SubscriptionsListenResultMeta duplicate-key tests assert against raw
serialized text rather than serde_json::Value, since Value cannot
represent duplicate keys and would silently pass either way.

376 tests pass under --features compliance (185 lib + 187 integration +
3 fixture + 1 doctest), 366 default. clippy -D warnings clean.

ADR-027 revision log records the full diff and fix rationale.
COMPLIANCE.md documents the two disclosed-not-fixed gaps: no
shutdown-signal path exists yet to emit SubscriptionsListenResult, and
RequestMetaObject.extra carries the same reserved-key-collision risk
just fixed on SubscriptionsListenResultMeta.

Author: hortovanyi

crates/turul-http-mcp-server/src/server.rs

@@ -519,7 +519,7 @@ async fn handle_request(
 
         // The 2026 stateless build serves a single spec: every request goes to the
         // streamable handler, whose Server Validation rejects unsupported
-        // MCP-Protocol-Version values with 400 + -32004. Routing legacy version
+        // MCP-Protocol-Version values with 400 + -32022. Routing legacy version
         // headers to the 2025-era session handler would bypass that contract.
         #[cfg(feature = "protocol-2026-07-28")]
         let route_streamable = true;

crates/turul-http-mcp-server/src/streamable_http.rs

@@ -1394,7 +1394,7 @@ impl StreamableHttpHandler {
         // pre-2025-06-18 clients, so an absent header is rejected) and Mcp-Method
         // matching the body method; tools/call, resources/read, and prompts/get
         // additionally require Mcp-Name matching params.name / params.uri.
-        // Failures → HTTP 400 + JSON-RPC -32001 HeaderMismatch (id-less when the
+        // Failures → HTTP 400 + JSON-RPC -32020 HeaderMismatch (id-less when the
         // body is a notification). Header names compare case-insensitively
         // (hyper lowercases them in `context.headers`); values are case-sensitive.
         #[cfg(feature = "protocol-2026-07-28")]
@@ -1408,7 +1408,7 @@ impl StreamableHttpHandler {
 
             // Version negotiation: a requested version this build does not
             // implement (unknown or known-but-unsupported) → 400 +
-            // UnsupportedProtocolVersionError (-32004) listing the supported set.
+            // UnsupportedProtocolVersionError (-32022) listing the supported set.
             if let Some(requested) = header("mcp-protocol-version")
                 && requested != turul_mcp_protocol::MCP_VERSION
             {
@@ -1656,7 +1656,7 @@ impl StreamableHttpHandler {
         // with protocolVersion/clientInfo/clientCapabilities (schema: RequestParams._meta
         // is required). Missing/incomplete `_meta` → -32602 (HTTP 400); a `_meta`
         // protocolVersion that disagrees with the (already validated) header is a
-        // header-validation failure → -32001 HeaderMismatch (HTTP 400).
+        // header-validation failure → -32020 HeaderMismatch (HTTP 400).
         #[cfg(feature = "protocol-2026-07-28")]
         if let JsonRpcMessage::Request(req) = &message {
             let v = serde_json::to_value(req).unwrap_or(serde_json::Value::Null);
@@ -1912,7 +1912,11 @@ impl StreamableHttpHandler {
     /// - Every delivered notification carries
     ///   `io.modelcontextprotocol/subscriptionId` in `_meta`, set to the JSON-RPC
     ///   id of the listen request.
-    /// - The client cancels by closing the stream; there is no JSON-RPC result.
+    /// - Client-initiated cancellation (closing the stream) carries no JSON-RPC
+    ///   result. Schema also defines `SubscriptionsListenResult` for a
+    ///   server-initiated graceful teardown (e.g. shutdown) — this handler has
+    ///   no such teardown path yet, so that result is never emitted; see
+    ///   `turul_mcp_protocol::subscriptions::SubscriptionsListenResult`.
     #[cfg(feature = "protocol-2026-07-28")]
     async fn handle_subscriptions_listen(
         &self,
@@ -2216,7 +2220,7 @@ impl StreamableHttpHandler {
         let connection_id = format!("post-{}", uuid::Uuid::now_v7().as_simple());
 
         // 2026 + JSON framing: dispatch inline so the HTTP status can reflect
-        // the JSON-RPC outcome. MissingRequiredClientCapabilityError (-32003)
+        // the JSON-RPC outcome. MissingRequiredClientCapabilityError (-32021)
         // MUST ride HTTP 400 per its schema; the chunked-channel path below
         // commits 200 before dispatch completes and cannot retro-status.
         // (SSE-framed responses inherently stay 200 — errors ride the stream.)
@@ -2231,10 +2235,13 @@ impl StreamableHttpHandler {
                 )
                 .await;
             let status = match &response {
-                // -32003 MissingRequiredClientCapability and -32001
+                // -32021 MissingRequiredClientCapability and -32020
                 // HeaderMismatch both mandate HTTP 400.
                 turul_rpc::JsonRpcResponse::Error(err)
-                    if matches!(err.error.code, -32001 | -32003) =>
+                    if matches!(
+                        err.error.code,
+                        turul_mcp_protocol::headers::ERROR_CODE_HEADER_MISMATCH | -32021
+                    ) =>
                 {
                     StatusCode::BAD_REQUEST
                 }

crates/turul-mcp-builders/src/notification.rs

@@ -498,12 +498,10 @@ mod tests {
             .build();
 
         assert_eq!(notification.method, "notifications/cancelled");
-        // CancelledNotificationParams.request_id is a bare RequestId under 2025-11-25
-        // and Option<RequestId> under 2026-07-28.
-        #[cfg(feature = "protocol-2025-11-25")]
+        // CancelledNotificationParams.request_id is a required bare RequestId
+        // on both lanes (the 2026-07-02 re-pin reverted the 2026-05-31
+        // Option<RequestId> relaxation on the 2026-07-28 lane).
         assert_eq!(notification.params.request_id, RequestId::Number(123));
-        #[cfg(feature = "protocol-2026-07-28")]
-        assert_eq!(notification.params.request_id, Some(RequestId::Number(123)));
         assert_eq!(
             notification.params.reason,
             Some("User cancelled operation".to_string())