Implement: freeze 2026-07-28 release references and retire stale draft sync

[squarepots]

Tracks the implementation of #1.

Goal

Finish the 2026-07-28 draft-to-release cutover as one focused maintenance change.

In scope

1. Point 2026-07-28 reference generation at schema/2026-07-28.
2. Pin the released source commit.
3. Regenerate the 2026 reference artifacts atomically:
   • spec.types.2026-07-28.ts
   • 2026 schema.json twin
   • 2026 example corpus and manifest
   • inventory/parity/conformance pins
4. Carry the final released schema delta required by those regenerated artifacts:
   • SubscriptionsListenResultMetaObject
   • SubscriptionsListenResultResponse
   • canonical response fixture
5. Remove the obsolete nightly workflow that still tracks 2026 from schema/draft.
6. Update lifecycle documentation and direct spec-name comments.
7. Update REVIEW.md so reviewers no longer use schema/draft/schema.ts as the authority for released revisions. Implemented on the fix(spec): freeze 2026-07-28 release references modelcontextprotocol/typescript-sdk#2858 branch at 9b24218c07643ba780669e430358239dda5fbb76.

Out of scope

• 2025 anchor provenance cleanup (Cleanup: make the 2025 spec anchor reproducible from its release pin #5);
• server-legacy;
• codec architecture;
• protocol negotiation;
• v1/v2 documentation structure;
• Changesets release grouping;
• unrelated transport/runtime bugs.

Why these files belong together

The repo treats the anchor, schema twin, examples, manifests, and parity/conformance tests as one reference system. Splitting the generated artifacts from the source cutover would temporarily create the drift the tests are designed to prevent.

File count is therefore not the right unit for deciding whether this should be split. The semantic unit is the 2026 release cutover.

Local PR

Fork PR #3 is the validation branch.

Validation completed successfully for:

• check:all;
• build:all;
• distribution type smoke test;
• Node 20/22/24 tests and e2e;
• Bun and Deno runtime suites;
• client/server conformance;
• examples build/e2e and guide examples.

The fork-only Publish Any Commit failure was caused by the missing pkg-pr-new GitHub App; the same workflow succeeds on upstream PR modelcontextprotocol#2858.

Upstream strategy

Current upstream items:

• issue: Freeze 2026-07-28 spec references at the released revision modelcontextprotocol/typescript-sdk#2857
• PR: fix(spec): freeze 2026-07-28 release references modelcontextprotocol/typescript-sdk#2858

The PR is now Ready for review and all upstream CI workflows are green.

The repository requires one approval and CODEOWNER review before merge. That is a repository protection rule, not a reason to expand the implementation.

Issue vs direct PR rule

Do not automatically open an upstream issue for every finding.

Use a direct PR when the change is:

• a straightforward maintenance or cleanup fix;
• narrowly scoped;
• locally validated;
• easy to review from the diff and tests.

Open an issue first when the change:

• changes a maintained design or CLI contract;
• needs maintainer choice between valid approaches;
• adds a new mechanism;
• has public API/product trade-offs;
• is otherwise genuinely significant.

Applied here:

• 2026 release cutover: direct PR would have been sufficient; Freeze 2026-07-28 spec references at the released revision modelcontextprotocol/typescript-sdk#2857 is already open, so leave it and let the PR close it.
• per-revision twin provenance (Decision: keep per-revision schema-twin provenance for the 2026 cutover #4): required inside the cutover; no separate upstream PR.
• 2025 anchor cleanup (Cleanup: make the 2025 spec anchor reproducible from its release pin #5): direct PR; no upstream issue needed.

Scope correction after implementation review

The 2025 anchor-header cleanup was removed from modelcontextprotocol#2858.

Per-revision schema-twin provenance stays because it is required to preserve the frozen 2025 oracle while moving 2026 to the final release commit. At 271ecc9a..., the upstream 2025 schema.json differs from the currently frozen 2025 twin (NumberSchema uses number instead of integer). A single shared source commit would therefore move the 2025 oracle as a side effect of freezing 2026.

The CLI redesign was removed. pnpm fetch:schema-twins [sha] remains the public script shape; with no SHA, each twin regenerates from its recorded source commit.

Current upstream head: 8abfbf5f80d2f4a02bf9488f63d01900e71ff50c.