[Server] Fix parallel elicitations on one session getting each other's answers

[chr-hertel]

Two tool calls on one session that both elicit got the same request id (1000), so one call resumed with the other one's answer. On top, an elicitation could go out on another call's SSE stream, since all streams drained one session-wide queue.

• requests to the client get a UUID as id instead of a counter read-modify-written in the session - the spec allows string ids, and clients echo them as is
• [BC Break] Protocol::sendRequest(), checkResponse() and handleFiberYield() take and return a Uuid instead of an int, as does a transport's response finder
• what a suspended fiber sends is queued per transport in Protocol, so it goes out on the stream of its own call - the session-wide queue stays for messages not tied to a call, like ResourceUpdatedNotification

Fixes chr-hertel#56

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Concurrent session writes can still discard pending requests, and the request-ID bound fails on supported 32-bit PHP builds.

2 open findings

• Avoid random_int upper bounds exceeding 32-bit PHP_INT_MAX · New
• Prevent lost pending requests from stale concurrent session writes · New

What changed in this PR

Fixes parallel session calls sharing request IDs and sending messages over the wrong stream.

Changes:

• Generates random JavaScript-safe request IDs.
• Queues fiber messages per transport.
• Adds concurrency regression tests and documentation.

File	Description
src/​Server/​Protocol.php	Adds random IDs and transport-specific queues.
tests/​Unit/​Server/​ProtocolTest.php	Tests concurrent streams and workers.
tests/​Unit/​Fixtures/​PollingLoopTransport.php	Exposes outgoing messages for tests.
CHANGELOG.md	Documents the concurrency fix.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

A concurrency test sends a UUID through an integer formatter, and the documented request-ID contract conflicts with the implementation.

2 open findings

• UUID request ID is cast to integer, breaking response correlation · New
• UUID string IDs conflict with the documented numeric ID contract · New

2 resolved since last review

• Prevent lost pending requests from stale concurrent session writes
• Avoid random_int upper bounds exceeding 32-bit PHP_INT_MAX

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

A failed session save can still send an untracked transport-local request and incorrectly resume its fiber.

1 open finding

• Queue request only after successful session save · New

2 resolved since last review

• UUID request ID is cast to integer, breaking response correlation
• UUID string IDs conflict with the documented numeric ID contract

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The implementation addresses both reported concurrency causes with focused regression and race-condition coverage.

0 open findings

1 resolved since last review

• Queue request only after successful session save

🧠 Review effort: Balanced