fix: don't overclaim cause in error message, test the _in_flight fix, cite precedent

Addresses review feedback on the session-not-initialized error fix:

- The error message asserted a specific cause ("this session_id's
  stream was reconnected or lost") that _initialization_state has no
  way to actually verify -- a session that was never initialized at
  all (e.g. a client bug) hits the same branch and would get told a
  story that's simply false in that case. Reworded to state the fact
  (an initialize handshake is required) without asserting why this
  particular session never completed one.
- Cited the existing INVALID_REQUEST precedent in
  streamable_http_manager.py's "Session not found" responses (same
  class of session-validity condition) in the inline comment, rather
  than relying on JSON-RPC semantics alone.
- This fix has an untested, unmentioned side effect: answering via
  responder.respond() means RequestResponder.__exit__ now sees
  _completed=True and fires on_complete, popping the request out of
  _in_flight. The old bare RuntimeError bypassed the responder's
  context-manager cleanup entirely, so every rejected pre-init request
  leaked an _in_flight entry for the life of the session -- a client
  hammering an uninitialized session could grow it unboundedly. Added
  an assertion pinning this (len(session._in_flight) == 0 after the
  rejected request), so a future refactor can't silently reintroduce
  the leak.
- Also assert on error.data ("session_not_initialized"), the
  machine-readable discriminator this fix introduces -- message text
  isn't meant to be programmatically parsed, this is.

Verified: tests/server/test_session.py (7/7) and the broader
tests/server/ + tests/shared/test_session.py suite (521 passed, same
pre-existing unrelated websockets-extra collection error as before)
both pass. ruff check / ruff format --check / pyright clean on both
changed files.

Author: oliver

src/mcp/server/session.py

@@ -211,16 +211,27 @@ async def _received_request(self, responder: RequestResponder[types.ClientReques
                     # parameters") -- indistinguishable from an actually
                     # malformed request. INVALID_REQUEST (not INVALID_PARAMS)
                     # is used because the request's parameters aren't the
-                    # problem; the session's state is.
+                    # problem; the session's state is -- matching the existing
+                    # "Session not found" usage in streamable_http_manager.py
+                    # for the same class of session-validity condition.
+                    #
+                    # The message states the fact (an initialize handshake is
+                    # required) without asserting *why* this particular
+                    # session never completed one -- this branch can't tell a
+                    # genuinely uninitialized session (e.g. a client bug) from
+                    # a stream that reconnected without reinitializing, so it
+                    # doesn't claim either.
                     with responder:
                         await responder.respond(
                             types.ErrorData(
                                 code=types.INVALID_REQUEST,
                                 message=(
-                                    "MCP session not initialized: this session_id's "
-                                    "stream was reconnected or lost without a fresh "
-                                    "'initialize' handshake. Reconnect and initialize "
-                                    "a new session."
+                                    "MCP session not initialized: an 'initialize' "
+                                    "request must complete successfully before "
+                                    "other requests are handled. If this session "
+                                    "was previously initialized, its stream may "
+                                    "have been reconnected without a fresh "
+                                    "handshake."
                                 ),
                                 data="session_not_initialized",
                             )

tests/server/test_session.py

@@ -473,6 +473,8 @@ async def test_other_requests_blocked_before_initialization():
     error_response_received = False
     error_code = None
     error_message_text = None
+    error_data = None
+    session_ref: list[ServerSession] = []
 
     async def run_server():
         async with ServerSession(
@@ -483,13 +485,14 @@ async def run_server():
                 server_version="0.1.0",
                 capabilities=ServerCapabilities(),
             ),
-        ):
+        ) as session:
+            session_ref.append(session)
             # Server should handle the request and send an error response
             # No need to process incoming_messages since the error is handled automatically
             await anyio.sleep(0.1)  # Give time for the request to be processed
 
     async def mock_client():
-        nonlocal error_response_received, error_code, error_message_text
+        nonlocal error_response_received, error_code, error_message_text, error_data
 
         # Try to send a non-ping request before initialization
         await client_to_server_send.send(
@@ -510,6 +513,7 @@ async def mock_client():
             error_response_received = True
             error_code = error_message.message.root.error.code
             error_message_text = error_message.message.root.error.message
+            error_data = error_message.message.root.error.data
 
     async with (
         client_to_server_send,
@@ -530,3 +534,14 @@ async def mock_client():
     # from a genuinely malformed request.
     assert error_code == types.INVALID_REQUEST
     assert error_message_text is not None and "session not initialized" in error_message_text.lower()
+    # data is the machine-readable discriminator -- message text isn't meant
+    # to be programmatically parsed, this is.
+    assert error_data == "session_not_initialized"
+    # Answering via responder.respond() (rather than raising, as before this
+    # fix) means RequestResponder.__exit__ sees _completed=True and fires
+    # on_complete, which pops the request out of _in_flight. Before this fix,
+    # the bare RuntimeError bypassed the responder's context-manager cleanup
+    # entirely, so every rejected pre-init request leaked an _in_flight
+    # entry for the life of the session.
+    assert session_ref and len(session_ref[0]._in_flight) == 0
+    assert error_message_text is not None and "session not initialized" in error_message_text.lower()