C3: remove server-stateless from conformance baselines; C2: TODO-anchor audit

Conformance @ 65fcd39: server-stateless 25/25 SUCCESS, 0 FAILURE. Removed from
both expected-failures files along with two stale entries that now pass
(input-required-result-validate-input, input-required-result-missing-input-response).
http-header-validation stays baselined (SEP-2243 Mcp-Method/Mcp-Name cross-check
is separate work).

TODO comments in S2-touched files now cite their CLEANUP-LEDGER row;
_requirements.py drops the deleted SingleExchangeDispatcher class name from
its prose constant.

Author: maxisbey

.github/actions/conformance/expected-failures.2026-07-28.yml

@@ -69,9 +69,6 @@ server:
   - json-schema-2020-12
 
   # --- Draft scenarios (same failures and reasons as the `--suite draft` leg) ---
-  # SEP-2575 (stateless HTTP / _meta envelope): server has no stateless mode,
-  # _meta-derived capabilities, error-code mappings, or server/discover yet.
-  - server-stateless
   # SEP-2322 (multi-round-trip requests / IncompleteResult): not implemented.
   - input-required-result-basic-elicitation
   - input-required-result-basic-sampling
@@ -83,14 +80,6 @@ server:
   - input-required-result-result-type
   - input-required-result-tampered-state
   - input-required-result-capability-check
-  - input-required-result-validate-input
-  # SEP-2243 (HTTP header standardization): -32020 HeaderMismatch handling and
-  # case-insensitive/whitespace-trimmed header validation not implemented.
+  # SEP-2243 (HTTP header standardization): Mcp-Method / Mcp-Name cross-check
+  # against the request body is not implemented.
   - http-header-validation
-
-  # --- WARNING-only entries ---
-  # These scenarios emit no FAILURE checks, only SHOULD-level WARNINGs, but
-  # the expected-failures evaluator counts WARNINGs as failures. Same entries
-  # as the draft suite in expected-failures.yml.
-  # SEP-2322 SHOULD-level behaviour (re-request missing inputResponses).
-  - input-required-result-missing-input-response

.github/actions/conformance/expected-failures.yml

@@ -34,12 +34,7 @@ client:
 
 server:
   # --- Draft-spec scenarios (in `--suite draft`; the `active` suite is green) ---
-  # SEP-2575 (stateless HTTP / _meta envelope): server has no stateless mode,
-  # _meta-derived capabilities, error-code mappings, or server/discover yet.
-  - server-stateless
-  # SEP-2322 (multi-round-trip requests / IncompleteResult): not implemented;
-  # most scenarios currently fail early with "Missing session ID" because
-  # mcp-everything-server only runs in stateful mode.
+  # SEP-2322 (multi-round-trip requests / IncompleteResult): not implemented.
   - input-required-result-basic-elicitation
   - input-required-result-basic-sampling
   - input-required-result-basic-list-roots
@@ -50,17 +45,6 @@ server:
   - input-required-result-result-type
   - input-required-result-tampered-state
   - input-required-result-capability-check
-  # SEP-2243 (HTTP header standardization): -32020 HeaderMismatch handling and
-  # case-insensitive/whitespace-trimmed header validation not implemented.
+  # SEP-2243 (HTTP header standardization): Mcp-Method / Mcp-Name cross-check
+  # against the request body is not implemented.
   - http-header-validation
-  # WARNING-only entries: these scenarios emit no FAILURE checks, only SHOULD-level
-  # WARNINGs, but the expected-failures evaluator counts WARNINGs as failures.
-  # SEP-2322 SHOULD-level behaviour (re-request missing inputResponses).
-  - input-required-result-missing-input-response
-  # SEP-2322 negative-case scenarios: input-required-result-validate-input is
-  # now baselined (added when the stateless path landed — the stateless server
-  # reaches the handler, so the previous accidental pass via -32600 "Missing
-  # session ID" no longer applies). input-required-result-unsupported-methods
-  # is intentionally NOT baselined: it still passes for now; add it once it
-  # starts failing for real.
-  - input-required-result-validate-input

src/mcp/server/connection.py

@@ -320,7 +320,7 @@ def check_capability(self, capability: ClientCapabilities) -> bool:
 
         Returns `False` when no client info has been recorded.
         """
-        # TODO(L29): redesign - mirrors v1 ServerSession.check_client_capability
+        # TODO(L53): redesign - mirrors v1 ServerSession.check_client_capability
         # verbatim for parity.
         if self.client_params is None:
             return False

src/mcp/server/lowlevel/server.py

@@ -310,7 +310,7 @@ def get_notification_handler(self, method: str) -> HandlerEntry[LifespanResultT]
         """Return the registered entry for a notification method, or `None`."""
         return self._notification_handlers.get(method)
 
-    # TODO: Rethink capabilities API. Currently capabilities are derived from registered
+    # TODO(L53): Rethink capabilities API. Currently capabilities are derived from registered
     # handlers but require NotificationOptions to be passed externally for list_changed
     # flags, and experimental_capabilities as a separate dict. Consider deriving capabilities
     # entirely from server state (e.g. constructor params for list_changed) instead of

src/mcp/server/runner.py

@@ -245,7 +245,7 @@ async def _inner() -> HandlerResult:
                     _methods.validate_client_request(method, version, params)
                 except KeyError:
                     raise MCPError(code=METHOD_NOT_FOUND, message="Method not found", data=method) from None
-            # TODO(maxisbey): the 2026-07-28 spec drops the handshake; this branch and
+            # TODO(L29): the 2026-07-28 spec drops the handshake; this branch and
             # the gate become a per-version legacy path then. Initialize runs inline
             # (read loop parked), so awaiting the peer anywhere on this path deadlocks.
             if method == "initialize":
@@ -272,7 +272,7 @@ async def _inner() -> HandlerResult:
 
         call = self._compose_server_middleware(ctx, method, params, _inner)
         result = _dump_result(await call())
-        # TODO: reject resultType values outside {"complete", "input_required"} unless the
+        # TODO(L56): reject resultType values outside {"complete", "input_required"} unless the
         # corresponding extension is in this request's _meta clientCapabilities.extensions; the
         # explicit MUST-reject is client-side (basic/index.mdx ResultType), this enforces it proactively.
         if is_spec_method:

src/mcp/shared/jsonrpc_dispatcher.py

@@ -707,7 +707,7 @@ async def _handle_request(
                 await self._write_error(req.id, error)
             else:
                 logger.exception("handler for %r raised", req.method)
-                # TODO(maxisbey): code=0 pins existing-server compat; JSON-RPC says
+                # TODO(L19): code=0 pins existing-server compat; JSON-RPC says
                 # INTERNAL_ERROR. Revisit per the suite's divergence entry.
                 await self._write_error(req.id, ErrorData(code=0, message=str(e)))
                 if self._raise_handler_exceptions:

tests/interaction/_requirements.py

@@ -97,9 +97,9 @@
 )
 
 _MODERN_NOTIFY_DROP = (
-    "SingleExchangeDispatcher.notify() no-ops on the modern streamable-http driver; handler-emitted "
-    "logging/progress notifications never reach the per-request SSE response. Passes once SSE "
-    "response mode lands."
+    "The modern single-exchange dispatch context no-ops notify() on the streamable-http driver; "
+    "handler-emitted logging/progress notifications never reach the per-request SSE response. "
+    "Passes once SSE response mode lands."
 )