Enforce subscription notification filters

[leehack]

Summary

• enforce subscriptions/listen acknowledgment-before-events ordering in request-handler notification paths
• reject subscription notifications outside the acknowledged filter, including resource URI and task id filters
• tag direct extra.sendNotification(...) events on subscription streams with io.modelcontextprotocol/subscriptionId

Validation

• dart format .
• dart analyze
• dart test test/types/subscriptions_test.dart test/mcp_2026_07_28_test.dart test/server/streamable_mcp_server_test.dart
• dart test
• dart pub global run coverage:test_with_coverage
• dart run bin/mcp_dart.dart conformance --suite all --json (from packages/mcp_dart_cli)
• git diff --check

Notes

• This is stacked on Reject stateless server requests on clients #204 and remains draft-only while the 2026-07-28 spec is still RC.
• Spec context: https://modelcontextprotocol.io/specification/draft/basic/utilities/subscriptions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.62%. Comparing base (52ebbe2) to head (09a98d0).

Additional details and impacted files

@@                                   Coverage Diff                                   @@
##           spec/2026-client-stateless-server-request-rejection     #205      +/-   ##
=======================================================================================
+ Coverage                                                87.54%   87.62%   +0.08%     
=======================================================================================
  Files                                                       47       47              
  Lines                                                     8757     8803      +46     
=======================================================================================
+ Hits                                                      7666     7714      +48     
+ Misses                                                    1091     1089       -2     

Flag	Coverage Δ
unittests	87.62% <100.00%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leehack]

Closing this draft micro PR because the RC spec work has been consolidated into a smaller reviewable stack. This change is preserved in #268 (MCP 2026 transport enforcement); the consolidated tip is tree-identical to the previous micro-stack tip.