(possible) 2026-07-28 spec violation: mcp-session-id used in client requests with 2026-07-28

Describe the bug
Requests using 2026-07-28 should never set mcp-session-id.

However, the go SDK is sending this when the server also violates the spec by setting it

TCP dump: First message is the server returning an invalid session id and then client sends it

2026-06-26T17:35:12.920442Z TCP 127.0.0.1:3000 --> 127.0.0.1:51940 (len:4243) (PSH,ACK)
HTTP/1.1 200 OK
content-type: text/event-stream
cache-control: no-cache
mcp-session-id: 8a392688-8526-4abb-bb21-65b140a9528b
transfer-encoding: chunked
date: Fri, 26 Jun 2026 17:35:12 GMT

F7F
data: {"jsonrpc":"2.0","id":1,"result":{"supportedVersions":["2026-07-28","2025-11-25","2025-06-18","2025-03-26","2024-11-05"],"capabilities":{"logging":{},"completions":{},"prompts":{"listChanged":true},"resources":{"listChanged":true},"tools":{"listChanged":true}},"serverInfo":{"name":"everything","version":"","icons":[{"src":"data:image/png;base64,iVBAAElFTkSuQmCC","mimeType":"image/png","sizes":["48x48"],"theme":"light"}],"websiteUrl":"https://example.com"},"instructions":"Use this server!","ttlMs":0,"cacheScope":"public"}}


0


2026-06-26T17:35:12.920451Z TCP 127.0.0.1:51940 --> 127.0.0.1:3000 (len:68) (ACK)

2026-06-26T17:35:12.920738Z TCP 127.0.0.1:51940 --> 127.0.0.1:3000 (len:650) (PSH,ACK)
POST / HTTP/1.1
Host: localhost:3000
User-Agent: Go-http-client/1.1
Content-Length: 276
Accept: application/json, text/event-stream
Content-Type: application/json
Mcp-Method: tools/list
Mcp-Protocol-Version: 2026-07-28
Mcp-Session-Id: 8a392688-8526-4abb-bb21-65b140a9528b
Accept-Encoding: gzip

{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/clientCapabilities":{"roots":{"listChanged":true}},"io.modelcontextprotocol/clientInfo":{"name":"mcp-client","version":"v1.0.0"},"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}


**To Reproduce**
Steps to reproduce the behavior:
1. Run the `listfeatures` client example against an invalid server

Start with the listfeatures client example and reproduce the request sequence against an invalid server that returns mcp-session-id with version 2026-07-28. Trace the client request path it exercises and add coverage for the reproduced behavior. Done means subsequent requests for that version omit the session header.