Good catch on the priming race, that was a real gap: the guard ran before the awaited store_event, so a same-id POST could slip in during event-store persistence. Fixed by reserving the routing slot synchronously with the guard and minting the priming event afterwards, with the reservation released if the event store raises so the 500 path leaves nothing in flight. Added a regression test that suspends a gated event store mid-priming and asserts the concurrent duplicate is still rejected; it fails by timeout on the previous commit and passes now. Full transport module is green (68 tests).

Nice — the slot reservation before priming closes the resumable-SSE race cleanly. Two mechanical CI things are what's currently red, both in the newly added test code rather than the fix itself:

1. Coverage gate (the 20 test (...) matrix jobs). coverage report fails with:

tests/shared/test_streamable_http.py   990   1   108   1   99.82%   844
TOTAL                                                              99.99%
Coverage failure: total of 99.99 is less than fail-under=100.00

Line 844 in the new test is uncovered (this repo enforces fail-under = 100 with branch = true, and tests/ is in [tool.coverage.run] source). Worth running uv run --frozen --no-sync coverage run -m pytest -n auto && uv run --frozen --no-sync coverage combine && uv run --frozen --no-sync coverage report locally to see the exact arc — usually it's one branch of the gated-event-store path that isn't taken.

2. pre-commit (pyright). The pre-commit job fails on 6 pyright errors in the same new test, e.g.:

tests/shared/test_streamable_http.py:853:28 - error: Expected mapping for dictionary unpack operator (reportGeneralTypeIssues)
tests/shared/test_streamable_http.py:851:13 - error: Type of "init_request" is partially unknown

Looks like init_request needs a concrete type so the **-unpack resolves.

Once those two are green the change looks solid. For what it's worth, I'm putting up the dispatcher-layer piece we discussed (the jsonrpc_dispatcher.py _in_flight overwrite + the cancellation-targeting case) as a separate PR, scoped exactly as you described — transport guard and dispatcher guard composing.

Thanks for running those down, both fixed. The uncovered line was the test helper's defensive raise, now marked no-cover matching the module-level first_sse_data helper's convention. The pyright errors came from the untyped dict unpacks; init_request and the tool call payload now have concrete types, and I moved the protocol version header import to its defining module while there. pyright is clean on the file and the coverage gate passes locally apart from pre-existing platform-conditional lines in other test files that only execute on Linux.

Glad the dispatcher piece is up as #3064, and the scoping is exactly right. The two guards compose and neither alone closes the issue, so from my side please keep it open.