fix: preserve disabled-version fallback when VersionFilter passes a range through a mount - #5838

Closes #5837

Description

With a parent VersionFilter over a mounted child and the child's latest component version disabled, the parent's list_* advertise the older enabled version (v1.0) but versionless get_tool/get_resource/get_resource_template/get_prompt return None, so call_tool/read_resource/render_prompt fail with Unknown tool / Resource not found / Unknown prompt. Only explicit version=VersionSpec(eq="1.0") calls work.

Root cause: VersionFilter forwards its policy range to the mounted child as an explicit VersionSpec. The child treats any non-None spec as an exact request, skips its disabled-version fallback, and returns None for the highest in-range version; the parent then early-returns None (its fallback only covers a non-None-but-disabled component).

What changed

• Server.get_tool, get_resource, get_resource_template and get_prompt now treat only VersionSpec.eq as an explicit exact request. Range specs resolve to the highest enabled version within the range, selected from the filtered listing using version.matches(...) and version_sort_key.
• The fallback for a range lookup miss re-resolves each listed candidate version, highest first, through the same super().get_*(..., VersionSpec(eq=candidate.version)) path. Listing is not authoritative for resolution, so lookup-only refusal transforms and lookup-time auth checks are honored rather than bypassed. A resolved component must match the candidate's identity and version, passes through session transforms, and must be enabled.
• Lookup misses with no version constraint or with an exact eq request remain authoritative; lookup-only refusal semantics for unconstrained and exact lookups are preserved.
• No changes to VersionFilter itself; explicit VersionSpec.eq behavior is unchanged.

Contribution type

• Bug fix (simple, well-scoped fix for a clearly broken behavior)
• Documentation improvement
• Enhancement

Bug fix verification

Test paths: tests/server/versioning/test_mounting.py::TestMountedVersionFilterWithDisabledLatest (five tests) and ::TestMountedVersionFilterLookupRefusals (two tests).

Red at adf90b66 (fix stashed, tests kept):

>       assert tool is not None
E       assert None is not None
tests\server\versioning\test_mounting.py:421
1 failed, 4 passed

Red before the review follow-up (at d991088, follow-up stashed): the lookup-only refusal test got a v2 tool instead of None (assert FastMCPProviderTool(name='calc', version='2.0', ...) is None).

Green at the final head: 5 passed + 2 passed.

The regression tests cover all four component types (list vs versionless get vs call/read/render), plus controls: v2 enabled still resolves to v2; no parent filter + v2 disabled falls back to v1; explicit VersionSpec(eq="1.0") works and exact eq v2 remains unserved; filter on the child directly falls back; a lookup-only refusal transform under the filter still returns None for versionless get while listing passes through; an auth-denied highest version falls back to a public lower version.

Validation

• uv run --frozen pytest tests/server/versioning/test_mounting.py -q -> 20 passed
• uv run --frozen pytest tests/server/versioning tests/server/test_hashed_tool_dispatch.py -q -> 161 passed
• uv run --frozen pytest tests/server/versioning tests/server/transforms tests/server/providers tests/server/test_server.py tests/server/test_hashed_tool_dispatch.py tests/server/test_session_visibility.py tests/server/test_providers.py -q -> 1600 passed, 26 warnings
• uv run --frozen ruff check and ruff format --check on the changed files -> clean
• uv run --isolated ty check -> All checks passed

AI assistance

Tool(s) used: Claude Code
How you used it: investigated from a verified reproduction, drafted the range-aware fallback and regression tests, and revised the fallback in response to review.

Checklist

• This PR addresses an existing issue (or fixes a self-evident bug)
• I have read CONTRIBUTING.md
• I have added tests that cover my changes
• I have run uv run prek run --all-files and all checks pass (focused checks passed)
• I have self-reviewed my changes
• If I used an LLM, it followed the repo's contributing conventions (not generic output)

Review follow-up

Codex review found a residual P1 path: when a range lookup resolved the highest version and later marks it disabled, the fallback could take a lower candidate straight from the listing, bypassing a lookup-only transform or provider that refuses that lower version. The fallback now re-resolves every listed candidate through the lookup path for both the lookup-miss and resolved-but-disabled cases, for all four component types. Regression tests cover disabled-highest plus lookup-refused-lower for tools, resources, templates and prompts.

The branch was also rebased onto the upstream get_resource → _lookup_resource refactor: the range fallback now lives inside _lookup_resource and preserves the new (resource, exists) hidden-vs-missing contract, with the same re-resolution rules for tools, resources, templates and prompts.

The triage review then found that a same-version duplicate could still be served from the listing after its own provider refused the lookup. Same-version components from different providers are indistinguishable by name and version, so the fallback now asks each provider whether its own lookup admits the candidate; a listed sibling that no provider admits is refused. TestProviderLookupAuthority covers a disabled first provider plus a lookup-refusing second provider, while test_duplicate_same_version_resolves_enabled_provider keeps the enabled-duplicate path covered.