[nbullorini]

On initialize the body is authoritative: the MCP-Protocol-Version header plays no part in negotiation and is not compared with params.protocolVersion. This corrects the "Protocol Version Validation" section in docs/run/http.md and adds transport tests for both mismatch directions and a missing header, with and without sessions.

Closes #309

Motivation and Context

As agreed in #309: the docs said the header check happens after the handshake, and nothing pinned down that the header has no effect on initialize, so it could quietly regress to the originally reported behaviour.

How Has This Been Tested?

New transport-level test in StreamableHttpTransportTest covering an older header, a newer header and no header, each with and without sessions, asserting the negotiated version in both the response and the stored session.

Breaking Changes

None. No runtime behaviour changes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

The ProtocolVersionMiddleware docblock repeated the same inaccurate claim that initialize doesn't carry the header, so it's corrected too.