feat: MRTR for resources/read + prompts/get; subscribe truthfulness; completion e2e; P2 hygiene

Release-prep sweep, part 1 (functional + hygiene):

- MRTR (SEP-2322) now covers all three permitted methods. Shared
  handlers::input_required_to_result (capability gate -32003/400 +
  InputRequiredResult construction) adopted by tools/call and wired into
  resources/read and prompts/get. Resources surface retry
  inputResponses/requestState via session extensions; prompts receive them
  in render args under reserved io.modelcontextprotocol/* keys —
  McpPrompt::render has no session parameter and changing it is a breaking
  public trait change (stop condition respected; convention documented on
  the trait; wire prompt arguments are plain strings so reserved keys cannot
  collide). Tests: two-leg round trips for both methods + a resources/read
  capability-gate case, all real-HTTP. Revert-and-fail: without the handler
  conversion the sentinel escapes as -32603 (the pre-slice behavior).
- resources.subscribe advertises true on the 2026 lane at BOTH capability
  construction sites (subscriptions/listen serves per-URI resources/updated);
  2025 stays false (no resources/subscribe handler). Wire test on
  server/discover; first run caught the second, unfixed site.
- completion/complete e2e: sessionless dispatch, CompleteResult wire shape,
  capability advertisement (last zero-e2e core method on the 2026 path).
- Hygiene: 41 stale "0.3" dependency snippets across 15 non-frozen crate
  docs -> "0.4" (frozen snapshots + terminal shim correctly keep 0.3);
  legacy session/SSE prose in default-lane READMEs labeled 2025-11-25
  opt-in; internal-phase tags and fix-history comment phrasing replaced
  with present-tense spec-anchored descriptions.

Author: hortovanyi

CHANGELOG.md

@@ -35,6 +35,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **SEP-2577 deprecation annotations** on Roots / Sampling / Logging types and traits (`#[deprecated(since = "0.4.0", note = "...")]` with migration-path guidance and 2027-07-28+ earliest-removal date). Annotation-only this revision; types remain fully functional during the 12-month migration window. `LoggingLevel` (the value type for the non-deprecated `RequestMetaObject.log_level` replacement) is intentionally NOT deprecated.
 - **ADR-028** — *Extensions strategy* (SEP-2133 / SEP-2663). Documents how the framework will host out-of-tree extensions including `turul-mcp-ext-tasks-2026-07-28` and `turul-mcp-ext-apps-2026-07-28`.
 
+### Added (2026-06-10, release-prep sweep)
+
+- **MRTR on `resources/read` and `prompts/get`** — completes the SEP-2322 triple (the only methods permitted to return `input_required`). The conversion + client-capability gate is now one shared helper (`handlers::input_required_to_result`, also adopted by `tools/call`). Resources surface the retry's `inputResponses`/`requestState` via the session extensions (same as tools); prompts receive them in the render args under reserved `io.modelcontextprotocol/*` keys, because `McpPrompt::render` has no session parameter and changing it would break the public trait (documented on the trait; reserved-namespace keys cannot collide with wire prompt arguments, which are plain strings). Tests: two-leg round trips for both methods + a `-32003`/400 capability-gate case on `resources/read` (all real-HTTP; the handlers previously leaked the sentinel to `-32603`).
+- **`resources.subscribe` capability truthfulness** — with `subscriptions/listen` serving per-URI `resources/updated`, both capability-construction sites now advertise `subscribe: true` on the 2026 lane (still `false` on 2025, which has no `resources/subscribe` handler). Wire test asserts the `server/discover` advertisement.
+- **`completion/complete` e2e coverage** — sessionless dispatch + `CompleteResult` wire shape (`completion.values`) + capability advertisement, closing the last zero-e2e core method on the 2026 path.
+
+### Fixed (2026-06-10, release-prep sweep)
+
+- **Stale crate-doc versions**: 41 dependency-snippet strings across 15 non-frozen crate READMEs/lib-docs said `"0.3"`; all now `"0.4"` (the frozen 2025 protocol snapshots and the terminal-0.3.x shim correctly keep `"0.3"`).
+- **Legacy prose labeled in default-lane docs**: `turul-http-mcp-server` README's session/SSE-resumability features and curl examples, and `turul-mcp-server` README's strict-lifecycle note, are now explicitly marked *2025-11-25 opt-in lane* (the 2026 default is POST-only, non-resumable, handshake-free).
+- **Comment hygiene in touched 2026 paths**: internal-phase tags, fix-history phrasing, and the `subscriptions.rs` module narrative replaced with present-tense, spec-anchored descriptions.
+
 ### Fixed (2026-06-10)
 
 - **`turul-mcp-oauth` CIMD/DCR posture dispositioned (docs/tests-only by design).** Audited against the live draft authorization spec: Client ID Metadata Documents are a SHOULD for *authorization servers and MCP clients*; Dynamic Client Registration is deprecated upstream (MAY, AS back-compat; not removed — earliest removal 2027-07-28). This crate implements the resource-server role only — RFC 9728 Protected Resource Metadata and OAuth 2.1 §5.2/RFC 8707 token validation, both unchanged — so no CIMD or DCR surface belongs in it and none was invented. The role posture is now documented in the crate header, and a wire-shape test pins that the published RFC 9728 document carries no client-registration keys (`registration_endpoint`, `client_id*`, `redirect_uris`, …). Client-side CIMD belongs to a future full MCP OAuth client flow.

crates/turul-http-mcp-server/README.md

@@ -70,8 +70,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 ## Features
 
 - ✅ **MCP 2026-07-28 Streamable HTTP (default)** - Stateless core (`server/discover`, per-request `_meta`, no `Mcp-Session-Id`) with SSE streaming; 2025-11-25 sessionful handshake is opt-in
-- ✅ **Session Management** - UUID v7 session IDs with automatic cleanup
-- ✅ **SSE Resumability** - Last-Event-ID support with event replay
+- ✅ **Session Management** *(2025-11-25 opt-in lane)* - UUID v7 session IDs with automatic cleanup
+- ✅ **SSE Resumability** *(2025-11-25 opt-in lane)* - `Last-Event-ID` event replay on GET SSE; the 2026 default is POST-only and not resumable
 - ✅ **CORS Support** - Browser client compatibility with configurable origins
 - ✅ **Protocol Version Detection** - Automatic feature flags based on client capabilities
 - ✅ **JSON-RPC Dispatch** - Efficient method routing and error handling
@@ -334,7 +334,10 @@ let progress_notification = ProgressNotification {
 broadcaster.send_progress_notification("session-123", progress_notification).await?;
 ```
 
-### Event Replay and Resumability
+### Event Replay and Resumability (2025-11-25 opt-in lane)
+
+The 2026-07-28 default endpoint is POST-only and streams are not resumable;
+this machinery serves the sessionful 2025-11-25 opt-in lane.
 
 ```rust
 use turul_http_mcp_server::{extract_last_event_id, StreamManager};
@@ -434,12 +437,12 @@ curl -X POST http://localhost:3000/mcp \
   -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' \
   -v  # Note the Mcp-Session-Id header in response
 
-# Test SSE streaming
+# Test GET SSE streaming — 2025-11-25 opt-in lane (the 2026 default answers GET with 405)
 curl -N -H "Accept: text/event-stream" \
   -H "Mcp-Session-Id: <session-id>" \
   http://localhost:3000/mcp
 
-# Test event resumability
+# Test event resumability — 2025-11-25 opt-in lane
 curl -N -H "Accept: text/event-stream" \
   -H "Last-Event-ID: event-123" \
   -H "Mcp-Session-Id: <session-id>" \
@@ -505,7 +508,7 @@ let transport = HttpMcpServerBuilder::new()
 
 ```toml
 [dependencies]
-turul-http-mcp-server = { version = "0.3", features = ["sse"] }
+turul-http-mcp-server = { version = "0.4", features = ["sse"] }
 ```
 
 Available features:

crates/turul-http-mcp-server/src/lib.rs

@@ -12,8 +12,8 @@
 //!
 //! ```toml
 //! [dependencies]
-//! turul-http-mcp-server = "0.3"
-//! turul-mcp-server = "0.3"
+//! turul-http-mcp-server = "0.4"
+//! turul-mcp-server = "0.4"
 //! ```
 //!
 //! ## Supported Transports

crates/turul-http-mcp-server/src/middleware/builtins/mod.rs

@@ -18,5 +18,5 @@
 //!     .build()?;
 //! ```
 
-// Built-in middleware will be implemented in Phase 4
+// Placeholder module: no built-in middleware ships yet.
 // For now, this module serves as a placeholder

crates/turul-mcp-aws-lambda/README.md

@@ -27,8 +27,8 @@ Add this to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-turul-mcp-aws-lambda = "0.3"
-turul-mcp-derive = "0.3"
+turul-mcp-aws-lambda = "0.4"
+turul-mcp-derive = "0.4"
 lambda_http = "0.17"
 tokio = { version = "1.0", features = ["macros"] }
 ```
@@ -95,7 +95,7 @@ For real-time SSE streaming, enable the `streaming` feature and use `run_streami
 
 ```toml
 [dependencies]
-turul-mcp-aws-lambda = { version = "0.3", features = ["streaming"] }
+turul-mcp-aws-lambda = { version = "0.4", features = ["streaming"] }
 ```
 
 ```rust
@@ -499,7 +499,7 @@ let server = LambdaMcpServerBuilder::new()
 
 ```toml
 [dependencies]
-turul-mcp-aws-lambda = { version = "0.3", features = ["cors", "sse", "dynamodb"] }
+turul-mcp-aws-lambda = { version = "0.4", features = ["cors", "sse", "dynamodb"] }
 ```
 
 - `default` - Includes `cors` and `sse`

crates/turul-mcp-builders/README.md

@@ -24,8 +24,8 @@ Add this to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-turul-mcp-builders = "0.3"
-turul-mcp-server = "0.3"
+turul-mcp-builders = "0.4"
+turul-mcp-server = "0.4"
 serde_json = "1.0"
 ```
 

crates/turul-mcp-client/README.md

@@ -24,7 +24,7 @@ Add this to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-turul-mcp-client = "0.3"
+turul-mcp-client = "0.4"
 tokio = { version = "1.0", features = ["full"] }
 ```
 
@@ -479,7 +479,7 @@ fn compare_transports() -> Result<(), Box<dyn std::error::Error>> {
 
 ```toml
 [dependencies]
-turul-mcp-client = { version = "0.3", features = ["sse"] }
+turul-mcp-client = { version = "0.4", features = ["sse"] }
 ```
 
 Available features:

crates/turul-mcp-client/src/lib.rs

@@ -25,7 +25,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! turul-mcp-client = "0.3"
+//! turul-mcp-client = "0.4"
 //! tokio = { version = "1.0", features = ["full"] }
 //! ```
 //!

crates/turul-mcp-derive/src/lib.rs

@@ -22,8 +22,8 @@
 //!
 //! ```toml
 //! [dependencies]
-//! turul-mcp-derive = "0.3"
-//! turul-mcp-server = "0.3"  # For server-side usage
+//! turul-mcp-derive = "0.4"
+//! turul-mcp-server = "0.4"  # For server-side usage
 //! ```
 //!
 //! ## Quick Start

crates/turul-mcp-oauth/README.md

@@ -22,8 +22,8 @@ Add to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-turul-mcp-server = "0.3"
-turul-mcp-oauth = "0.3"
+turul-mcp-server = "0.4"
+turul-mcp-oauth = "0.4"
 ```
 
 Use the convenience function for single-AS deployments: