[nicolas-grekas]

A DELETE of an unknown or already ended session is answered 200, but once a session is terminated, the server "MUST respond to requests containing that session ID with HTTP 404 Not Found".

Protocol::destroySession() now returns whether the session existed, and StreamableHttpTransport answers 404 when the session-end listener returns false. A store that can't be reached doesn't count as an unknown session.

InMemorySessionStore::exists() now applies the TTL like read() does, so that an expired session counts as ended too (spotted by the review below).

This touches the same lines as #627: once both are in, a DELETE from another principal should return false too, so that it stays answered like an unknown session.

[Copilot]

🟡 Changes recommended

The default in-memory store treats expired sessions as existing, causing DELETE to return HTTP 200 instead of 404; the existence check needs expiry handling and regression coverage.

1 open issue

• Make in-memory session existence checks TTL-aware · New

What changed in this PR

This PR propagates session-existence results from the server protocol to Streamable HTTP, allowing DELETE requests for unknown or ended sessions to return 404 instead of 200.

Changes:

• Return a boolean from session destruction and pass it through transport callbacks.
• Map an explicit false result to HTTP 404 while preserving 200 for listeners that return nothing.
• Add repeated-DELETE regression coverage, assert destruction results, and document the contract changes.

File	Description
tests/​Unit/​Server/​Transport/​StreamableHttpTransportTest.php	Tests that deleting an ended session returns 404.
tests/​Unit/​Server/​ProtocolSessionLockTest.php	Asserts destruction results alongside lock behavior.
src/​Server/​Transport/​TransportInterface.php	Documents the boolean session-end callback contract.
src/​Server/​Transport/​StreamableHttpTransport.php	Returns 404 when session termination reports no session.
src/​Server/​Transport/​ManagesTransportCallbacks.php	Updates the callback return-type annotation.
src/​Server/​Transport/​BaseTransport.php	Propagates explicit false results from session-end listeners.
src/​Server/​Protocol.php	Reports session existence without treating store failures as absence.
CHANGELOG.md	Documents the DELETE behavior and return-contract changes.

_{Review effort: Balanced}

[nicolas-grekas]

Fixed in 0c1fb09: exists() applies the same TTL check as read(), and a new test moves the clock past the TTL before sending the DELETE.

[chr-hertel]

Thanks @nicolas-grekas!