fix(session): drop unknown-ID responses instead of crashing session

When a response arrives for a request ID that has no pending waiter
(e.g. the request timed out and was removed from _response_streams),
the previous code called _handle_incoming(RuntimeError(...)), which
routed through _default_message_handler, which now re-raises on any
Exception — killing the session and sending CONNECTION_CLOSED to all
remaining in-flight requests.

The unknown-ID case is non-fatal: the late response simply has nowhere
to go. Log a warning and drop it; don't propagate through the message
handler. This matches the intention of the existing warning log in
_normalize_request_id and keeps the session alive for subsequent work.

Also updated the #1401 test module docstring to clarify that
protocol-level non-fatal errors are handled inline, not via
_default_message_handler.

Fixes regressions in:
  - test_notification_validation_error (test_88_random_error.py)
  - test_response_id_non_numeric_string_no_match (test_session.py)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rudi193-cmd

src/mcp/shared/session.py

@@ -516,7 +516,7 @@ async def _handle_response(self, message: SessionMessage) -> None:
         if stream:
             await stream.send(message.message)
         else:
-            await self._handle_incoming(RuntimeError(f"Received response with an unknown request ID: {message}"))
+            logging.warning("Received response with unknown request ID %r — dropping (request may have timed out)", response_id)
 
     async def _received_request(self, responder: RequestResponder[ReceiveRequestT, SendResultT]) -> None:
         """Can be overridden by subclasses to handle a request without needing to

tests/issues/test_1401_client_session_error_handling.py

@@ -5,9 +5,14 @@
 `continue`, waiting for the next message that never came — hanging all pending
 requests indefinitely.
 
-Fix: raise when message is an Exception so _receive_loop's except-handler runs,
-triggering the finally block that closes pending response streams with
-CONNECTION_CLOSED.
+Fix: _default_message_handler re-raises when the message is an Exception
+(transport errors from the stream). This propagates out of _receive_loop's
+async-for, triggering the finally block that closes all pending response streams
+with CONNECTION_CLOSED — unblocking any in-flight callers.
+
+Protocol-level non-fatal errors (e.g. responses with unknown request IDs from
+timed-out requests) are handled inline in _handle_response with a warning log,
+so they do not reach _default_message_handler and cannot kill the session.
 """
 
 import anyio