[Schema][Server] Close the 2026-07-28 conformance gaps

[chr-hertel]

Stacked on feature/2026-07-28 (#2). Closes the gaps an audit of the branch against
schema/2026-07-28/schema.ts and the 2026-07-28 spec docs turned up.

Full findings, evidence and what is left: spec-report.md.

Bugs

	Summary
High	ClientGateway's six supports*() probes returned false for every stateless request — the session key they read is only written by InitializeHandler
High	resources/subscribe / resources/unsubscribe still dispatched and answered 200 OK
High	Mcp-Name compared without Base64-sentinel decoding, refusing any non-ASCII resource URI with -32020
High	A missing MCP-Protocol-Version header was accepted
Medium	-32002 emitted where the revision forbids it; unknown tool answered -32601
Medium	Notification POST answered with a JSON-RPC error carrying "id": "" instead of 202
Medium	Request body taken from one read(), truncating chunked transfers into -32700
Low	-32021 only reachable from tools/call

Features

• Request-scoped SSE streaming — progress and per-request logLevel work; the stream opens after the handler's first suspension so -32021/-32602 keep their required statuses.
• subscriptions/listen delivery — NotificationBusInterface with in-memory and PSR-16 implementations; PHP-FPM needs the latter, since publisher and stream are different workers.
• Tasks (SEP-2663) — schema, two stores, tasks/* surface, capability gating.
• Extensions framework (SEP-2133) — identifier validation, message-class registration, method claims.
• MRTR completion, CachePolicy, W3C trace context, x-mcp-header nesting + validation, $ref SSRF and composition-DoS bounds, SEP-2577 deprecation tags.
• docs/stateless-lifecycle.md and an examples/server/stateless-lifecycle example.

Verification

	Before	After
make conformance-draft-server	138 / 3 failed	143 / 2 failed, baseline clean
make conformance-server	39/39	39/39
Unit	1222	1421
Integration	33	43
Inspector	97	103
PHPStan	7 pre-existing	7 pre-existing

The nine tasks-* conformance scenarios run at 36/44 — every remaining failure is the runner applying the
core schema to an extension result, which has no resultType: "task".

The Inspector cannot drive a 2026-07-28 server (it opens with initialize), so the new example is covered by
tests/Integration/StatelessLifecycleTest.php over real HTTP instead. MCP Apps did get snapshots — which
surfaced that its example was broken over HTTP entirely, the only one without a session store.

Worth a look

• Two error-code fixes change codes for handshake-era clients too (prompts/get and tools/call for unknown
  names). Marked [BC Break]; the spec has said -32602 since 2025-06-18. Only resources/read is
  version-gated.
• The auth track is shaped differently from the issue list: five of the seven 2026-07-28 auth items are
  rules for an OAuth client this SDK does not have yet ([Client] Add OAuth 2.0 credential storage interface (TokenStorageInterface) modelcontextprotocol/php-sdk#315–[Client] Implement Cross-App Access (token exchange, RFC 8693) modelcontextprotocol/php-sdk#325). [Server][Auth] SEP-2207: Audit PRM to ensure offline_access is not advertised as a required scope modelcontextprotocol/php-sdk#364 had nothing to fix and is pinned
  by test. See §3.2 of the report.