Retire three redundant interaction-manifest entries; era-bound a fourth

client-transport:http:protocol-version-stored and
transport:streamable-http:origin-validation were second labels on assertions
their tests already pin under client-transport:http:protocol-version-header
and hosting:http:dns-rebinding respectively (decorators removed, tests kept).
lifecycle:stateless:no-initialize described a pin API that no longer exists,
deferred against coverage that does not exist, and bound no tests.

transport:streamable-http:server-to-client is NOT deleted: the underlying
behaviour is real 2025-era wire truth that 2026 forbids (SEP-2322), so it
gets removed_in="2026-07-28" with the supersession note; the MRTR successor
link lands with the era pass. Cells unchanged (830 before and after).

Author: maxisbey

tests/interaction/_requirements.py

@@ -359,15 +359,6 @@ def __post_init__(self) -> None:
         ),
         added_in="2026-07-28",
     ),
-    "lifecycle:stateless:no-initialize": Requirement(
-        source=f"{SPEC_2026_BASE_URL}/basic/lifecycle#stateless-operation",
-        behavior=(
-            "A ClientSession pinned to 2026-07-28 is born initialized: initialize() is idempotent "
-            "and returns the synthesized result without any frame sent."
-        ),
-        added_in="2026-07-28",
-        deferred="covered by a tests/client/ unit test; not observable as an interaction",
-    ),
     "lifecycle:stateless:caller-meta-preserved": Requirement(
         source=f"{SPEC_2026_BASE_URL}/basic#_meta",
         behavior=(
@@ -2635,7 +2626,11 @@ def __post_init__(self) -> None:
             "A server-initiated request nested inside an in-flight call round-trips over stateful streamable HTTP."
         ),
         transports=("streamable-http",),
-        note="Only observable over streamable HTTP: exercises stateful HTTP session callbacks.",
+        removed_in="2026-07-28",
+        note=(
+            "removed in 2026-07-28 (SEP-2322); server-initiated requests are forbidden on streamable HTTP, "
+            "replaced by MRTR input requests embedded in InputRequiredResult."
+        ),
     ),
     "transport:streamable-http:resumability": Requirement(
         source=f"{SPEC_BASE_URL}/basic/transports#streamable-http",
@@ -2644,12 +2639,6 @@ def __post_init__(self) -> None:
         removed_in="2026-07-28",
         note="removed in 2026-07-28 (SEP-2575); Last-Event-ID resumability/redelivery dropped, no replacement.",
     ),
-    "transport:streamable-http:origin-validation": Requirement(
-        source=f"{SPEC_BASE_URL}/basic/transports#security-warning",
-        behavior="Requests with an invalid Origin header are rejected with 403 before reaching the session.",
-        transports=("streamable-http",),
-        note="Only observable over streamable HTTP: Origin is an HTTP header.",
-    ),
     "transport:sse": Requirement(
         source=f"{SPEC_BASE_URL}/basic/transports#backwards-compatibility",
         behavior=(
@@ -3468,14 +3457,6 @@ def __post_init__(self) -> None:
         transports=("streamable-http",),
         note="Only observable over HTTP: MCP-Protocol-Version is an HTTP header.",
     ),
-    "client-transport:http:protocol-version-stored": Requirement(
-        source="sdk",
-        behavior=(
-            "The client transport stores the negotiated protocol version and sends it on every subsequent request."
-        ),
-        transports=("streamable-http",),
-        note="Only observable over HTTP: MCP-Protocol-Version is an HTTP header.",
-    ),
     "client-transport:http:reconnect-get": Requirement(
         source=f"{SPEC_BASE_URL}/basic/transports#resumability-and-redelivery",
         behavior=(

tests/interaction/transports/test_client_transport_http.py

@@ -96,7 +96,6 @@ async def test_every_request_after_initialize_carries_the_issued_session_id(reco
     assert session_id
 
 
-@requirement("client-transport:http:protocol-version-stored")
 @requirement("client-transport:http:protocol-version-header")
 async def test_every_request_after_initialize_carries_the_negotiated_protocol_version(
     recorded: list[httpx2.Request],

tests/interaction/transports/test_hosting_http.py

@@ -344,7 +344,6 @@ async def read_standalone_stream() -> None:
 
 
 @requirement("hosting:http:dns-rebinding")
-@requirement("transport:streamable-http:origin-validation")
 async def test_origin_validation_rejects_disallowed_origins_when_enabled() -> None:
     """A disallowed Origin returns 403 (and Host 421) with protection enabled; disabled lets both through.