fix: isolate stateless HTTP request exchanges

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.

[jstar0]

Summary

Fixes#254.

StatelessHTTPServerTransport currently keys response waiters by the client's
raw JSON-RPC id. Because ids are scoped to each client, concurrent POSTs can
legally reuse the same id; the later request then overwrites the earlier
continuation, leaving one HTTP exchange suspended indefinitely. String and
integer ids also collide after stringification.

Changes

This change assigns a private UUID to each in-flight HTTP exchange before the
request is yielded to Server. Responses route by that private id, then restore
the client's original string or integer id before returning over HTTP.

The same exchange identity now scopes HTTP request context, while typed raw-id
aliases preserve existing direct lookups. A package-only mapping keeps
Server.currentHandlerContext.id and cancellation lookup on the original client
id without changing public transport or handler APIs. Cancellation fails closed
when multiple active exchanges make a reused wire id ambiguous.

Verification

• Added a deterministic regression that waits for two same-id requests to be in
  flight before sending either response.
• Added string/integer id, HTTP context, handler context, disconnect cleanup, and
  cancellation compatibility coverage.

swift test -v

Result: 555 tests in 40 suites passed.

Scope

• No public API or HTTP response contract changes.
• Notifications, validation, status codes, and stateless no-streaming behavior
  are unchanged.
• This does not add a waiter deadline or implement StatelessHTTPServerTransport: notifications/cancelled leaves the original POST hanging (HTTP exchange never completed) #255's cancelled-request HTTP
  completion. PR fix: StatelessHTTPServerTransport leaves the original POST hanging after notifications/cancelled (#255) #260 covers that separate path and currently lists StatelessHTTPServerTransport: concurrent requests sharing a JSON-RPC id overwrite each other's response waiter (hang + continuation leak) #254 as a
  non-goal; if it lands first, its raw-id waiter lookup will need to resolve the
  active exchange instead.