fix(server): reject changed duplicate initialize

[ychampion]

Summary

• Keep same-parameter duplicate initialize requests idempotent for already initialized stateful sessions.
• Reject changed duplicate initialize requests so stored client_params are not rewritten.

Why

Fixes #2605. A later initialize on the same session could overwrite ServerSession.client_params after negotiation. Existing connected-session fixtures also send an idempotent duplicate initialize, so the rejection only applies when the duplicate request changes the original parameters.

Validation

• uv run pytest -n0 tests/server/test_session.py::test_duplicate_initialize_after_initialized_preserves_negotiated_params -q - passed
• uv run pytest -n0 tests/server/test_session.py tests/server/fastmcp/test_elicitation.py tests/server/fastmcp/test_url_elicitation.py tests/server/fastmcp/test_url_elicitation_error_throw.py tests/server/fastmcp/test_title.py tests/issues/test_141_resource_templates.py -q - passed, 34 tests
• uv run ruff format --check src/mcp/server/session.py tests/server/test_session.py - passed
• uv run ruff check src/mcp/server/session.py tests/server/test_session.py - passed
• uv run pyright src/mcp/server/session.py tests/server/test_session.py - passed
• git diff --check - passed

AI assistance: Codex.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[ychampion]

Good catch. Updated in 394ed98:

• same-parameter duplicate initialize requests stay idempotent
• changed duplicate initialize requests now return INVALID_REQUEST
• the regression test receive calls are wrapped in anyio.fail_after(5)

Validation:

• uv run pytest -n0 tests/server/test_session.py::test_duplicate_initialize_after_initialized_preserves_negotiated_params -q
• uv run pytest -n0 tests/server/test_session.py tests/server/fastmcp/test_elicitation.py tests/server/fastmcp/test_url_elicitation.py tests/server/fastmcp/test_url_elicitation_error_throw.py tests/server/fastmcp/test_title.py tests/issues/test_141_resource_templates.py -q
• uv run ruff format --check src/mcp/server/session.py tests/server/test_session.py
• uv run ruff check src/mcp/server/session.py tests/server/test_session.py
• uv run pyright src/mcp/server/session.py tests/server/test_session.py
• git diff --check

[maxisbey]

Thanks for the PR, and sorry it sat here without a proper review.

We're closing most of the open PR backlog. v2 is out and changed a lot of the SDK, so many older PRs no longer apply as written, and we're a small team that realistically doesn't have the capacity to work through the rest.

If this still matters to you on v2, the most useful thing you can do is open an issue (or comment on the existing one) with your use case and a repro. Hearing why it matters to you is what we use to decide what to prioritise.

_{AI Disclaimer}