@@ -39,6 +39,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.46.0
 	go.uber.org/zap v1.28.0
 	golang.org/x/mod v0.41.0
+	golang.org/x/sync v0.23.0
 	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
 	golang.org/x/text v0.42.0
@@ -145,7 +146,6 @@ require (
 	go.uber.org/multierr v1.10.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 
@@ -94,6 +94,12 @@ type Client struct {
 	// when multiple requests are in-flight simultaneously
 	sseRequestMu sync.Mutex
 
+	// sessionGate keeps requests off the mcp-go client while a session
+	// re-initialize rewrites its protocol state (see ReinitializeSession).
+	sessionGate sessionGate
+	// sessionGen counts session re-initializes (see SessionGeneration).
+	sessionGen atomic.Uint64
+
 	// retryAfter collects the `Retry-After` hints this upstream's HTTP/SSE
 	// responses carry. mcp-go flattens a 429 into an error string long before
 	// the connection state machine sees it, so the hint is captured by a
@@ -345,6 +351,11 @@ func (c *Client) Ping(ctx context.Context) error {
 	// pin MUST come with an era-aware replacement, or spec 074's health loop
 	// goes blind; that is tracked as a required task of the pin lift, not as
 	// cleanup.
+	release, err := c.beginRequest(ctx, string(mcp.MethodPing))
+	if err != nil {
+		return err
+	}
+	defer release()
 	//nolint:staticcheck // SA1019: valid on the legacy era this client is pinned to; see above.
 	return client.Ping(ctx)
 }
@@ -388,8 +399,13 @@ func (c *Client) ListTools(ctx context.Context) ([]*config.ToolMetadata, error)
 	c.logger.Info("Making direct tools list call to upstream server",
 		zap.String("server", c.config.Name))
 
+	release, err := c.beginRequest(ctx, string(mcp.MethodToolsList))
+	if err != nil {
+		return nil, err
+	}
 	listReq := mcp.ListToolsRequest{}
 	toolsResult, err := client.ListTools(ctx, listReq)
+	release()
 	if err != nil {
 		// Debug, not Error: both callers above (managed.Client.ListTools and
 		// upstream.Manager.discoverTools) log this same failure, so logging it
@@ -526,11 +542,21 @@ func (c *Client) CallTool(ctx context.Context, toolName string, args map[string]
 			zap.String("server", c.config.Name),
 			zap.String("tool", toolName))
 	}
+	// A session re-initialize in progress on this client finishes before the
+	// call is handed to mcp-go, and none starts until it returns (the gate is
+	// held across the whole mcp-go call, which reads the client's protocol
+	// state on the response too). Waiting here sends nothing.
+	release, err := c.beginRequest(ctx, string(mcp.MethodToolsCall))
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+
 	// Spec 117 FR-018: the caller's policy verdicts are re-read here, after
-	// the SSE request lock (a call may have waited behind a long in-flight
-	// call while a capture failure marked the server review-dirty) and before
-	// every send, including a session re-init's retry. Nothing is sent when
-	// a check refuses.
+	// the SSE request lock and the session gate (a call may have waited behind
+	// a long in-flight call while a capture failure marked the server
+	// review-dirty) and before every send, including a session re-init's
+	// retry. Nothing is sent when a check refuses.
 	if err := RunDispatchRecheck(ctx); err != nil {
 		return nil, err
 	}
 
@@ -74,6 +74,12 @@ func (c *Client) ListPrompts(ctx context.Context) ([]mcp.Prompt, error) {
 	// ListPromptsByPage instead and stop at maxListPromptsPages pages, at
 	// maxListPromptsItems accumulated prompts (aligned with the per-server trim in
 	// Manager.ListPrompts), or on ctx expiry — whichever comes first (Finding F14).
+	release, err := c.beginRequest(ctx, string(mcp.MethodPromptsList))
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+
 	listReq := mcp.ListPromptsRequest{}
 	var prompts []mcp.Prompt
 	for page := 1; ; page++ {
@@ -152,7 +158,12 @@ func (c *Client) GetPrompt(ctx context.Context, name string, args map[string]str
 	request.Params.Name = name
 	request.Params.Arguments = args
 
+	release, err := c.beginRequest(ctx, string(mcp.MethodPromptsGet))
+	if err != nil {
+		return nil, err
+	}
 	result, err := upstreamClient.GetPrompt(ctx, request)
+	release()
 	if err != nil {
 		return nil, fmt.Errorf("GetPrompt failed for '%s': %w", name, err)
 	}
 
@@ -0,0 +1,62 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// A re-initialize waits for requests already on the client and gives up at its
+// own deadline instead of hanging behind a long in-flight call.
+func TestSessionGate_ExclusiveWaitsForSharedAndHonoursContext(t *testing.T) {
+	var g sessionGate
+	release, err := g.acquireShared(context.Background())
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	_, err = g.acquireExclusive(ctx)
+	require.True(t, errors.Is(err, context.DeadlineExceeded), "got %v", err)
+
+	release()
+	excl, err := g.acquireExclusive(context.Background())
+	require.NoError(t, err)
+	excl()
+}
+
+// A request queued behind a re-initialize returns when its caller goes away,
+// and is admitted once the re-initialize releases the gate.
+func TestSessionGate_SharedQueuesBehindExclusive(t *testing.T) {
+	c := &Client{}
+	g := &c.sessionGate
+	excl, err := g.acquireExclusive(context.Background())
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	_, err = c.beginRequest(ctx, "tools/call")
+	require.True(t, errors.Is(err, context.DeadlineExceeded), "got %v", err)
+
+	admitted := make(chan struct{})
+	go func() {
+		rel, err := g.acquireShared(context.Background())
+		if err == nil {
+			rel()
+		}
+		close(admitted)
+	}()
+	select {
+	case <-admitted:
+		t.Fatal("request admitted while a re-initialize holds the gate")
+	case <-time.After(50 * time.Millisecond):
+	}
+	excl()
+	select {
+	case <-admitted:
+	case <-time.After(5 * time.Second):
+		t.Fatal("request not admitted after the re-initialize released the gate")
+	}
+}
@@ -2,13 +2,104 @@ package core
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"math"
+	"sync"
 
 	"github.com/mark3labs/mcp-go/client/transport"
 	"github.com/mark3labs/mcp-go/mcp"
 	"go.uber.org/zap"
+	"golang.org/x/sync/semaphore"
 )
 
+// sessionGate serializes a session re-initialize with the requests sent on the
+// same mcp-go client. mcp-go's Initialize writes the client's negotiated
+// protocol state (protocol version, server and client capabilities, client
+// info) without synchronization, and every request reads that state: before it
+// is sent (sendRequest -> applyRequestMeta/applyStandardHeaders) and, for
+// tools/call, again on the response. So a request holds the gate shared for
+// the whole mcp-go call and a re-initialize holds it exclusively for the
+// Initialize handshake only.
+//
+// It is a weighted semaphore rather than a sync.RWMutex so both sides honour
+// their context: a re-initialize waiting behind a long in-flight call gives up
+// at the flight's deadline instead of hanging, and a request queued behind a
+// re-initialize returns when its caller goes away, with nothing sent. Like
+// sync.RWMutex it is writer-preferring (FIFO): once a re-initialize is
+// waiting, new requests queue behind it rather than starving it.
+//
+// The zero value is ready; the semaphore is created on first use because core
+// clients are also built as struct literals.
+type sessionGate struct {
+	once sync.Once
+	sem  *semaphore.Weighted
+}
+
+const sessionGateWeight = math.MaxInt64
+
+func (g *sessionGate) weighted() *semaphore.Weighted {
+	g.once.Do(func() { g.sem = semaphore.NewWeighted(sessionGateWeight) })
+	return g.sem
+}
+
+// acquireShared admits one request; release it when the mcp-go call returns.
+func (g *sessionGate) acquireShared(ctx context.Context) (release func(), err error) {
+	sem := g.weighted()
+	if err := sem.Acquire(ctx, 1); err != nil {
+		return nil, err
+	}
+	return func() { sem.Release(1) }, nil
+}
+
+// acquireExclusive waits for every admitted request to finish and holds new
+// ones back until release is called.
+func (g *sessionGate) acquireExclusive(ctx context.Context) (release func(), err error) {
+	sem := g.weighted()
+	if err := sem.Acquire(ctx, sessionGateWeight); err != nil {
+		return nil, err
+	}
+	return func() { sem.Release(sessionGateWeight) }, nil
+}
+
+// ErrSessionChanged is returned, with nothing sent, by a request whose context
+// was pinned to a session generation (WithSessionGeneration) when a session
+// re-initialize ran after the pin was taken. The caller re-validates what it
+// checked against the old session and sends again.
+var ErrSessionChanged = errors.New("upstream session was re-initialized before the request was sent")
+
+type sessionGenerationKey struct{}
+
+// WithSessionGeneration pins the requests made with ctx to session generation
+// gen (from SessionGeneration): such a request is refused with
+// ErrSessionChanged, before anything is sent, if a session re-initialize has
+// run since. The managed layer pins tools/call this way so a call checked
+// against one session's toolset is never sent on a session whose toolset has
+// not been verified yet.
+func WithSessionGeneration(ctx context.Context, gen uint64) context.Context {
+	return context.WithValue(ctx, sessionGenerationKey{}, gen)
+}
+
+// SessionGeneration counts the session re-initializes run on this client. It
+// changes while ReinitializeSession holds the session gate exclusively, so a
+// request admitted to the gate sees a stable value for its whole send.
+func (c *Client) SessionGeneration() uint64 { return c.sessionGen.Load() }
+
+// beginRequest admits a request to the mcp-go client, waiting out a session
+// re-initialize in progress. A context error is wrapped so it still matches
+// context.Canceled / context.DeadlineExceeded.
+func (c *Client) beginRequest(ctx context.Context, method string) (release func(), err error) {
+	release, err = c.sessionGate.acquireShared(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%s not sent: waiting for session re-initialize: %w", method, err)
+	}
+	if gen, ok := ctx.Value(sessionGenerationKey{}).(uint64); ok && gen != c.sessionGen.Load() {
+		release()
+		return nil, fmt.Errorf("%s not sent: %w", method, ErrSessionChanged)
+	}
+	return release, nil
+}
+
 // Spec 113-e (G8): helpers that let the managed layer re-initialize a
 // Streamable HTTP MCP session in place after the upstream answered HTTP 404
 // (mcp-go: transport.ErrSessionTerminated) for a session id it no longer
@@ -54,7 +145,18 @@ func (c *Client) ReinitializeSession(ctx context.Context) error {
 	req.Params.ClientInfo = mcp.Implementation{Name: "mcpproxy-go", Version: "1.0.0"}
 	req.Params.Capabilities = mcp.ClientCapabilities{}
 
+	// Initialize rewrites the shared client's protocol state, so it runs only
+	// once every request already on this client has returned, and holds new
+	// ones until it is done.
+	release, err := c.sessionGate.acquireExclusive(ctx)
+	if err != nil {
+		return fmt.Errorf("session re-initialize: waiting for in-flight requests: %w", err)
+	}
+	// Initialize mutates the client's session even when it fails, so the
+	// generation moves either way.
+	c.sessionGen.Add(1)
 	res, err := cl.Initialize(ctx, req)
+	release()
 	if err != nil {
 		return fmt.Errorf("session re-initialize failed: %w", err)
 	}