v0.4.0 — the community-feedback release

Every change traces to reader feedback on the launch post.

• Client-side session detection — flags client transports built with a real sessionId / session_id and reads of transport.sessionId; sessionId: undefined / session_id=None are recognized as migrated. A client that still owns a session breaks against a stateless server even when the server scans clean.
• Aliased-import resolution — import { X as Y } (TS) and from m import X as Y (Python) now flag both the import and every usage site.
• Adversarial regression suite — caught/ and missed/ fixtures lock in both the detection wins and the documented misses so the claims can't rot.
• mcp-vet fixtures [dir] — nine protocol-level conformance fixtures + CHECKLIST.md (discover, per-request _meta, routing headers, stateless auth, task handles, duplicate/retry delivery, tools/list cache invalidation, downgrade/refusal) to pair the static scan with a runtime check.
• BENCHMARK.md — pinned corpus SHAs, 447 files / ~44k LOC, every finding hand-labeled: 104/105 true positives, 1 false positive (0.95%), with labeled negatives and a recall discussion. README updated to the measured numbers.
• Docs — July 28 is a spec release, not a remote kill switch; added a dual-version (2025-11-25 + 2026-07-28) rollout matrix and a post-scan notice.

Tests: 30 → 37, all passing.

Install: npx @booyaka/mcp-vet .