MCP 2026-07-28: Stateless Does Not Mean State-Free

Revision 2026-07-28 removes MCP protocol sessions and, in the same document, forbids treating possession of a state handle as authentication. An executable conformance test for that MUST NOT: three key strategies compared under identical tokens and UUIDs, 13/13 tests, fully in-process lab. The composite key the specification recommends turns out to be bypassable when the principal id contains the…