[Server] Overwrite the answer of an abandoned request instead of forgetting it

Author: chr-hertel

src/Server/Protocol.php

@@ -822,9 +822,10 @@ private function dropAbandonedRequests(SessionInterface $session): void
                 'session_id' => $session->getId()->toRfc4122(),
             ]);
 
-            // Per entry, so saving does not write back what other streams changed in the others.
+            // Per entry, so saving does not write back what other streams changed in the others. The answer
+            // may have been stored after this session was loaded, so it is overwritten, not forgotten.
             $session->forget(self::SESSION_PENDING_REQUESTS.".{$id}");
-            $session->forget(self::SESSION_RESPONSES.".{$id}");
+            $session->set(self::SESSION_RESPONSES.".{$id}", null);
         }
     }
 

tests/Unit/Server/ProtocolTest.php

@@ -2246,6 +2246,26 @@ public function testAbandonedRequestIsDroppedWhenAnotherRequestIsSent(): void
         $this->assertNull($session->get('_mcp.responses.00000000-0000-4000-8000-000000001000'));
     }
 
+    #[TestDox('An answer to an abandoned client request is dropped even if it arrived after the session was loaded')]
+    public function testAnswerStoredAfterLoadingIsDroppedWithAbandonedRequest(): void
+    {
+        [$protocol, $sessionManager, $session] = $this->createProtocolWithPendingRequests([
+            '00000000-0000-4000-8000-000000001000' => ['request_id' => '00000000-0000-4000-8000-000000001000', 'timeout' => 5, 'timestamp' => time() - 100],
+        ]);
+
+        $snapshot = $sessionManager->createWithId($session->getId());
+        $snapshot->get('_mcp.pending_requests');
+
+        $other = $sessionManager->createWithId($session->getId());
+        $other->set('_mcp.responses.00000000-0000-4000-8000-000000001000', ['jsonrpc' => '2.0', 'id' => '00000000-0000-4000-8000-000000001000', 'result' => []]);
+        $other->save();
+
+        $protocol->sendRequest(new PingRequest(), 5, $snapshot);
+        $snapshot->save();
+
+        $this->assertNull($sessionManager->createWithId($session->getId())->get('_mcp.responses.00000000-0000-4000-8000-000000001000'));
+    }
+
     #[TestDox('A timed out client request within the grace period is left to its own stream')]
     public function testTimedOutRequestWithinGracePeriodIsKeptWhenAnotherRequestIsSent(): void
     {