@@ -46,6 +46,11 @@ Hostable = any scenario that implements `handler()` (single origin) or
 `authHandlers()` (multi-origin, see below). `listHostableScenarios()` derives
 the list at runtime, gated by which aux origins are configured.
 
+Each run gets its own scenario instance, built from the registry entry with a
+no-arg constructor. A scenario whose constructor takes parameters (one class
+registered under several names, e.g. `skills/verification-*`) implements
+`Scenario.fresh()` to carry them into the per-run copy.
+
 `sse-retry` implements `handler()` and works under `conformance hosted`, but
 its connection-close-timing checks won't be meaningful through a buffered
 fetch bridge — see below.
 
@@ -258,10 +258,13 @@ describe('hosted server', () => {
 
   it('every hostable scenario can be instantiated without binding a port', () => {
     // Guard against regressions where a handler() implementation reaches for
-    // this._server / this.port etc.
+    // this._server / this.port etc., and against per-run instances that lose
+    // constructor parameters (one class registered under several names must
+    // implement fresh()).
     for (const name of listHostableScenarios()) {
       const run = sessions.getOrCreate(name, `probe-${name}`, () => 'http://x');
       expect(typeof run.listener).toBe('function');
+      expect(run.scenario.name).toBe(name);
     }
   });
 });
@@ -36,7 +36,8 @@ import {
   UnknownScenarioError,
   NotHostableError,
   listHostableScenarios,
-  hostedScenarioContext
+  hostedScenarioContext,
+  freshScenario
 } from './session';
 import { renderLanding, renderResults } from './html';
 import type { RunStore } from './store';
@@ -390,8 +391,7 @@ export function createHostedApp(opts: HostedServerOptions = {}): {
   ): StatelessInstance {
     const proto = getScenario(scenarioName);
     if (!proto) throw new UnknownScenarioError(scenarioName);
-    const Ctor = proto.constructor as new () => Scenario;
-    const scenario = new Ctor();
+    const scenario = freshScenario(proto);
 
     if (scenario instanceof AuthHandlerScenario) {
       const missing = scenario.auxRoles.filter((r) => !auxOrigins[r]);
 
@@ -99,6 +99,17 @@ export function rawChecksOf(scenario: Scenario): ConformanceCheck[] {
   return scenario.getChecks();
 }
 
+/**
+ * New, unstarted instance of a registered scenario. Prefers `Scenario.fresh()`
+ * so scenarios registered with constructor parameters keep them; falls back
+ * to the no-arg constructor.
+ */
+export function freshScenario(proto: Scenario): Scenario {
+  if (typeof proto.fresh === 'function') return proto.fresh();
+  const Ctor = proto.constructor as new () => Scenario;
+  return new Ctor();
+}
+
 /**
  * Judge a merged raw log with the scenario's own end-of-run logic by loading
  * it into a fresh instance. Falls back to the raw log for scenarios that
@@ -111,8 +122,7 @@ export function finalizeChecks(
   const proto = getScenario(scenarioName);
   if (!proto) return merged;
   try {
-    const Ctor = proto.constructor as new () => Scenario;
-    const fresh = new Ctor() as unknown as {
+    const fresh = freshScenario(proto) as unknown as {
       checks?: unknown;
       getChecks(): ConformanceCheck[];
     };
@@ -165,8 +175,7 @@ export class SessionManager {
     const proto = getScenario(scenarioName);
     if (!proto) throw new UnknownScenarioError(scenarioName);
 
-    const Ctor = proto.constructor as new () => Scenario;
-    const scenario = new Ctor();
+    const scenario = freshScenario(proto);
     const runId = id ?? randomBytes(6).toString('base64url');
 
     let listener: RequestListener;
 
@@ -12,6 +12,8 @@ import type { BaseHttpScenario } from './http-base';
 import { RequestMetadataScenario } from './request-metadata';
 import { MRTRClientScenario } from './mrtr-client';
 import { JsonSchemaRefDerefScenario } from './json-schema-ref-deref';
+import { SkillsNoPrefetchScenario } from './skills/no-prefetch';
+import { SkillsVerificationScenario } from './skills/verification';
 
 /**
  * Pins that the hand-rolled mock servers used by client-direction scenarios
@@ -528,3 +530,96 @@ describe('sep-2322-client-request-state mock results (2026-07-28)', () => {
     }
   });
 });
+
+describe('sep-2640 skills client mock results', () => {
+  const skillsScenarios: Array<{
+    name: string;
+    make: () => BaseHttpScenario;
+  }> = [
+    {
+      name: 'sep-2640-client-no-prefetch',
+      make: () => new SkillsNoPrefetchScenario()
+    },
+    {
+      name: 'sep-2640-client-verify-digest',
+      make: () => new SkillsVerificationScenario('digest')
+    },
+    {
+      name: 'sep-2640-client-verify-size',
+      make: () => new SkillsVerificationScenario('size')
+    },
+    {
+      name: 'sep-2640-client-verify-frontmatter',
+      make: () => new SkillsVerificationScenario('frontmatter')
+    }
+  ];
+
+  for (const s of skillsScenarios) {
+    it(`${s.name} carries the draft-required members on skills/list and resources/read`, async () => {
+      const scenario = s.make();
+      const { serverUrl } = await scenario.start(
+        testScenarioContext(DRAFT_PROTOCOL_VERSION)
+      );
+      try {
+        let id = 1;
+        for (const [method, params] of [
+          ['skills/list', {}],
+          ['resources/read', { uri: 'skill://pdf-processing/SKILL.md' }]
+        ] as const) {
+          const { status, body } = await post(
+            serverUrl,
+            {
+              jsonrpc: '2.0',
+              id: id++,
+              method,
+              params: { ...params, _meta: meta }
+            },
+            {
+              'mcp-protocol-version': DRAFT_PROTOCOL_VERSION,
+              'Mcp-Method': method
+            }
+          );
+          expect(status, method).toBe(200);
+          expect(body.result, method).toMatchObject(CACHEABLE_FIELDS);
+          if (method === 'resources/read') {
+            expect(
+              wireSchemaErrors(DRAFT_PROTOCOL_VERSION, body, method),
+              method
+            ).toEqual([]);
+          }
+        }
+      } finally {
+        await scenario.stop();
+      }
+    });
+
+    // The runner hands these scenarios' clients 2025-11-25 unless
+    // --spec-version says otherwise, and the extension has no 2026-07-28
+    // dependency, so the mock answers at the version the client asked for.
+    it(`${s.name} answers initialize at the requested protocol version`, async () => {
+      const scenario = s.make();
+      const { serverUrl } = await scenario.start(testScenarioContext());
+      try {
+        let id = 1;
+        for (const protocolVersion of ['2025-11-25', DRAFT_PROTOCOL_VERSION]) {
+          const { status, body } = await post(serverUrl, {
+            jsonrpc: '2.0',
+            id: id++,
+            method: 'initialize',
+            params: {
+              protocolVersion,
+              capabilities: {},
+              clientInfo: { name: 'test', version: '1.0' }
+            }
+          });
+          expect(status, protocolVersion).toBe(200);
+          expect(body.result.protocolVersion, protocolVersion).toBe(
+            protocolVersion
+          );
+        }
+      } finally {
+        await scenario.stop();
+      }
+    });
+  }
+});
@@ -0,0 +1,83 @@
+import { describe, test, expect } from 'vitest';
+import { testScenarioContext } from '../../../mock-server/testing';
+import { sendStatelessRequest } from '../../../connection/stateless';
+import { DRAFT_PROTOCOL_VERSION } from '../../../types';
+import { SkillsNoPrefetchScenario } from './no-prefetch';
+import { SkillsVerificationScenario } from './verification';
+
+/**
+ * Regression for PR #330 review: both skills client scenarios declared the
+ * skills extension only in their `initialize` reply, but `BaseHttpScenario`
+ * intercepts `server/discover` before `handlePost` runs. A 2026-07-28
+ * discover-first client therefore saw the base class default (`{tools: {}}`)
+ * and had nothing to gate a `skills/list` call on.
+ *
+ * The scenarios passed anyway because `server/discover` is optional for
+ * clients and the clients we ran did not use it. That is exactly the failure
+ * mode where a check goes green because its condition never arose, so both
+ * lifecycles are asserted here rather than left to the next client to notice.
+ */
+
+const SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills';
+
+type Caps = {
+  resources?: unknown;
+  extensions?: Record<string, unknown>;
+};
+
+function capsOf(result: unknown): Caps {
+  return ((result as { capabilities?: Caps })?.capabilities ?? {}) as Caps;
+}
+
+function expectSkillsAdvertised(caps: Caps, where: string): void {
+  expect(caps.extensions, `${where}: no extensions block`).toBeDefined();
+  expect(
+    caps.extensions?.[SKILLS_EXTENSION_ID],
+    `${where}: skills extension not advertised`
+  ).toBeDefined();
+  // resources/read is how every skill file is fetched, so a client that gates
+  // on capabilities needs this too.
+  expect(caps.resources, `${where}: resources not advertised`).toBeDefined();
+}
+
+const SCENARIOS: Array<
+  [string, () => SkillsNoPrefetchScenario | SkillsVerificationScenario]
+> = [
+  ['no-prefetch', () => new SkillsNoPrefetchScenario()],
+  ['verify-digest', () => new SkillsVerificationScenario('digest')],
+  ['verify-size', () => new SkillsVerificationScenario('size')],
+  ['verify-frontmatter', () => new SkillsVerificationScenario('frontmatter')]
+];
+
+describe('SEP-2640 client scenarios advertise skills on both lifecycles', () => {
+  test.each(SCENARIOS)('%s: server/discover', async (label, make) => {
+    const scenario = make();
+    const { serverUrl } = await scenario.start(testScenarioContext());
+    try {
+      const discover = await sendStatelessRequest(serverUrl, 'server/discover');
+      expect(discover.status).toBe(200);
+      expectSkillsAdvertised(
+        capsOf(discover.body?.result),
+        `${label} discover`
+      );
+    } finally {
+      await scenario.stop();
+    }
+  });
+
+  test.each(SCENARIOS)('%s: initialize', async (label, make) => {
+    const scenario = make();
+    const { serverUrl } = await scenario.start(testScenarioContext());
+    try {
+      const init = await sendStatelessRequest(serverUrl, 'initialize', {
+        protocolVersion: DRAFT_PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: 'capabilities-test', version: '1.0.0' }
+      });
+      expect(init.status).toBe(200);
+      expectSkillsAdvertised(capsOf(init.body?.result), `${label} initialize`);
+    } finally {
+      await scenario.stop();
+    }
+  });
+});
@@ -0,0 +1,52 @@
+/**
+ * Results for the hand-rolled SEP-2640 client-scenario mocks, shaped like a
+ * conformant server's so a strict client is graded on its skills behaviour
+ * rather than turned away by the harness.
+ */
+
+import {
+  DRAFT_PROTOCOL_VERSION,
+  NEGOTIABLE_PROTOCOL_VERSIONS
+} from '../../../types.js';
+import { withRequiredDraftResultFields } from '../../../mock-server/index.js';
+
+/**
+ * `ListSkillsResult` is cacheable like `resources/list`, but `skills/list` is
+ * an extension method and not in the shared cacheable set, so the caching
+ * members are stamped here.
+ */
+export function skillsListResult(skills: object[]): object {
+  return { resultType: 'complete', ttlMs: 0, cacheScope: 'private', skills };
+}
+
+export function readResult(uri: unknown, text: string): unknown {
+  return withRequiredDraftResultFields('resources/read', {
+    contents: [{ uri, mimeType: 'text/markdown', text }]
+  });
+}
+
+/**
+ * The `initialize` result at the version the client asked for, when the suite
+ * can speak it. The extension has no 2026-07-28 dependency, and the runner
+ * hands these scenarios' clients 2025-11-25 unless `--spec-version` says
+ * otherwise, so a fixed 2026-07-28 reply would turn a correct stateful client
+ * away before it ever lists.
+ */
+export function initializeResult(
+  name: string,
+  request: { params?: { protocolVersion?: unknown } },
+  capabilities: object
+): object {
+  const requested = request.params?.protocolVersion;
+  const protocolVersion =
+    typeof requested === 'string' &&
+    NEGOTIABLE_PROTOCOL_VERSIONS.includes(requested)
+      ? requested
+      : DRAFT_PROTOCOL_VERSION;
+  return {
+    resultType: 'complete',
+    protocolVersion,
+    serverInfo: { name: `${name}-server`, version: '1.0.0' },
+    capabilities
+  };
+}