Running conformance locally could take "forever" or silently test stale code. Root cause: every pnpm test:conformance:server run leaks the test server, which then poisons later runs.

Motivation and Context

run-server-conformance.sh starts the server with npx tsx ./src/everythingServer.ts & and kills $SERVER_PID on exit — but that PID is the npx wrapper. The actual node server survives every run and keeps listening on port 3000. That single leak produces three failure modes:

1. Silent stale-server testing: on the next run the fresh server dies on an unhandled EADDRINUSE (no error handler on app.listen), the readiness curl happily gets a response from the leaked server, and conformance runs against old code. CI hits this too: test:conformance:server and test:conformance:server:draft run back-to-back in one job, so the draft pass was exercising the leaked server from the previous step (the Actions runner logs Terminate orphan process after the job).
2. Infinite hang: the readiness loop is while ! curl -s ... with MAX_RETRIES=30 — but no --max-time. Once a leaked listener stops responding (or any half-open socket holds the port), curl blocks forever and the retry cap never engages. The run sits at "Waiting for server to be ready..." indefinitely.
3. Tens-of-minutes runs: against a wedged-but-accepting listener the runner has no per-scenario timeout, so each scenario burns the SDK's 60s request timeout sequentially — ~30 min for the active suite.

Separately, the plain test:conformance:client script has been broken since the 0.2.0-alpha.1 pin (#2227): the CLI now requires --scenario or --suite in client mode, so the script exits immediately with a usage error. CI never noticed because it only runs :client:all.

What changed

• scripts/run-server-conformance.sh:
  • refuse to start if anything already listens on the port (with the lsof/PORT remedy in the message) — removes the silent-stale-testing mode
  • spawn via node --import tsx so $SERVER_PID is the server process itself and the cleanup kill actually stops it — removes the leak
  • curl --max-time 2 in the readiness loop, plus a fail-fast if the server process died — removes the unbounded hang
• package.json: node --import tsx for all spawned commands; declare tsx explicitly (it was resolving via root hoisting); add --suite core to test:conformance:client (core matches the CLI's previous no-flag default, active)
• everythingServer.ts / authTestServer.ts: handle the listen error event — EADDRINUSE now prints a one-line "stale server still running?" hint instead of an uncaught stack trace
• README.md: document the new refuse-to-start behavior for the manual-debugging flow

How Has This Been Tested?

All on Linux, current main:

• Reproduced each failure mode before the fix: leaked listener present after a green run (lsof -i:3000 -sTCP:LISTEN); second run "passing" against the stale server; readiness loop stuck >75s against an accepting-but-silent listener (nc -lk).
• After the fix: back-to-back server runs green (42 passed) with the port free immediately after each; a squatted port fails in milliseconds with the clear message; double-start prints the EADDRINUSE hint; test:conformance:client runs the core suite green; :client:all and :server:draft unchanged; lint and typecheck clean.

Breaking Changes

None for CI. Two local behavior changes: test:conformance:server now refuses to start while the port is taken (previously it silently tested whatever was listening), and the spawn commands require Node ≥ 20.6 for --import (engines says ≥ 20; test/e2e already uses node --import tsx).

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

A deeper fix would be binding an ephemeral port (PORT=0) and passing the discovered URL to the runner, eliminating the fixed-port collision class entirely — left as a follow-up since it changes the documented debugging workflow. The missing per-scenario timeout in the runner itself is a conformance-repo issue, not addressable from this repo.