Close the register-echo divergence and reconcile the cancellation suite with main

Reconcile the branch with main's landed behaviour on top of the rebase:

- Adopt main's hosting:auth:as:register-echo entry over the branch's
  register-echo-application-type entry and its now-closed divergence, drop
  the stale pinning test that superseded it, and remove its unused imports.
- Rewrite the no-further-notifications cancellation test onto the
  doomed-call pattern: a cancelled request is no longer answered, so the
  call is parked and abandoned instead of expecting an error, tolerating
  only the legacy streamable HTTP terminator.
- Reword the no-further-notifications note to match the narrowed
  in-flight divergence.
- Assert the persisted application_type echo in the DCR pass-through
  test now that the registration echo carries it.

No-Verification-Needed: test-only diff, no runtime surface to drive

Author: maxisbey

tests/interaction/_requirements.py

@@ -908,8 +908,9 @@ def __post_init__(self) -> None:
             "The 2026-07-28 stdio page states the receiver-side rule as 'MUST NOT send any "
             "further messages for it', strengthening the cancellation page's SHOULD-shaped "
             "receiver bullets (both revisions); the response half of 'any further messages' is "
-            "the divergence recorded on protocol:cancel:in-flight (both seats answer a cancelled "
-            "request with a code-0 error response). This entry pins the notifications half: the "
+            "honoured too - a cancelled request goes unanswered - except the era-scoped legacy "
+            "streamable HTTP terminator recorded as the Divergence on protocol:cancel:in-flight. "
+            "This entry pins the notifications half: the "
             "cancellation stops the handler, so a send attempted during its unwind is itself "
             "cancelled before transmitting. Era-unbounded: the enforcement is the shared "
             "handler-scope cancellation, observable on the arms where notifications/cancelled "

tests/interaction/auth/test_as_handlers.py

@@ -16,11 +16,10 @@
 import httpx2
 import pytest
 from inline_snapshot import snapshot
-from pydantic import AnyUrl
 
 from mcp.server import Server
 from mcp.server.auth.provider import ProviderTokenVerifier
-from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata
+from mcp.shared.auth import OAuthClientInformationFull
 from tests.interaction._connect import mounted_app
 from tests.interaction._requirements import requirement
 from tests.interaction.auth._harness import REDIRECT_URI, auth_settings, oauth_client_metadata
@@ -331,25 +330,3 @@ async def test_a_non_loopback_http_redirect_uri_is_accepted_at_registration(
     info = OAuthClientInformationFull.model_validate_json(response.content)
     assert [str(u) for u in (info.redirect_uris or [])] == ["http://evil.example/callback"]
     assert info.client_id in provider.clients
-
-
-@requirement("hosting:auth:as:register-echo-application-type")
-async def test_register_echoes_native_for_a_client_that_registered_application_type_web(
-    as_app: tuple[httpx2.AsyncClient, InMemoryAuthorizationServerProvider],
-) -> None:
-    """A client registering `application_type: "web"` is told `"native"` in the registration echo.
-
-    When the passthrough fix lands: re-pin the echo to `"web"` and delete the Divergence.
-    """
-    http, _ = as_app
-    metadata = OAuthClientMetadata(
-        client_name="interaction-suite", redirect_uris=[AnyUrl(REDIRECT_URI)], application_type="web"
-    )
-
-    response = await http.post("/register", content=metadata.model_dump_json())
-
-    assert response.status_code == 201
-    body = response.json()
-    assert body["application_type"] == "native"
-    # The omission is specific to application_type, not a generally lossy echo.
-    assert body["client_name"] == "interaction-suite"

tests/interaction/auth/test_flow.py

@@ -280,10 +280,13 @@ async def test_dcr_sends_a_consumer_set_application_type_verbatim() -> None:
 
     `"web"` against a loopback redirect URI is deliberately not what redirect-URI derivation
     would produce, so pass-through stays distinguishable from any future derivation strategy.
+    The registration echo returns the same value, which the SDK adopts into the persisted
+    client info, so a web client reads back web.
     """
     requests: list[httpx2.Request] = []
     provider = InMemoryAuthorizationServerProvider()
     server = Server("guarded", on_list_tools=list_tools)
+    storage = InMemoryTokenStorage()
     client_metadata = OAuthClientMetadata(
         client_name="interaction-suite",
         redirect_uris=[AnyUrl(REDIRECT_URI)],
@@ -292,14 +295,20 @@ async def test_dcr_sends_a_consumer_set_application_type_verbatim() -> None:
 
     with anyio.fail_after(5):
         async with connect_with_oauth(
-            server, provider=provider, client_metadata=client_metadata, on_request=requests.append
+            server,
+            provider=provider,
+            storage=storage,
+            client_metadata=client_metadata,
+            on_request=requests.append,
         ) as (client, _):
             result = await client.list_tools()
 
     assert result.tools[0].name == "whoami"
 
     register = next(r for r in requests if r.url.path == "/register")
     assert json.loads(register.content)["application_type"] == "web"
+    assert storage.client_info is not None
+    assert storage.client_info.application_type == "web"
 
 
 async def test_shimmed_app_serves_overrides_404s_and_otherwise_forwards_to_the_wrapped_app() -> None:

tests/interaction/lowlevel/test_cancellation.py

@@ -117,6 +117,8 @@ async def test_no_notifications_for_a_request_arrive_after_its_cancellation(conn
     async def collect(progress: float, total: float | None, message: str | None) -> None:
         progress_updates.append((progress, total, message))
 
+    outcomes: list[object] = []
+
     async def call_tool(ctx: ServerRequestContext, params: types.CallToolRequestParams) -> CallToolResult:
         assert params.name == "block"
         assert ctx.request_id is not None
@@ -141,23 +143,28 @@ async def call_tool(ctx: ServerRequestContext, params: types.CallToolRequestPara
 
     async with connect(server) as client:
         with anyio.fail_after(5):
-            async with anyio.create_task_group() as task_group:
+            async with anyio.create_task_group() as task_group:  # pragma: no branch
 
-                async def call_and_swallow_cancellation_error() -> None:
-                    with pytest.raises(MCPError):
-                        await client.call_tool("block", {}, progress_callback=collect)
+                async def await_doomed_call() -> None:
+                    try:
+                        outcomes.append(await client.call_tool("block", {}, progress_callback=collect))
+                    except MCPError as exc:
+                        outcomes.append(exc.error)
 
-                task_group.start_soon(call_and_swallow_cancellation_error)
+                task_group.start_soon(await_doomed_call)
                 await started.wait()
                 await client.session.send_notification(
                     types.CancelledNotification(
                         params=types.CancelledNotificationParams(request_id=request_ids[0], reason="user aborted")
                     )
                 )
+                await handler_cancelled.wait()
+                # Let anything the server was going to send be delivered before checking.
+                await anyio.wait_all_tasks_blocked()
+                assert outcomes in ([], [_LEGACY_HTTP_TERMINATOR])
+                task_group.cancel_scope.cancel()  # abandon the call if it is still parked
 
-            await handler_cancelled.wait()
-
-    # Progress shares the ordered stream with the error response: a sent "too late" would already be here.
+    # The "too late" send was itself cancelled before it could be written, so it never reached the wire.
     assert progress_updates == [(1.0, 2.0, "started")]
     assert attempted == ["send-cancelled"]