fix(server): stamp envelope status at sync dispatch chokepoint

[bokelley]

Summary

Closes #1897 (the SDK-wide gap the #1895 audit missed).

• Adds injectEnvelopeStatusIntoResponse at the finalize() chokepoint in createAdcpServer's tool dispatcher. One seam — every framework-registered tool gets envelope status: \"completed\" without per-helper edits, whether it dispatches through productsResponse, mediaBuyResponse, genericResponse, or the test-controller bridge's wrap(merged) rewrites.
• Chokepoint placement preserves the MediaBuyStatus / TaskStatus collision at the same top-level key — only stamps when structuredContent.status is missing. So CreateMediaBuySuccess.status: 'active' (valid MediaBuyStatus, not a valid TaskStatus) ships verbatim; the spec-level ambiguity is filed for adcontextprotocol/adcp separately.
• Error envelopes (isError: true) are skipped — their status semantics (failed / rejected) belong to the adcp_error path. Submitted envelopes keep their handler-set status: 'submitted'. Auto-registered get_adcp_capabilities continues to stamp via capabilitiesResponse directly (bypasses finalize()); both layers reinforce.

Why the chokepoint instead of fixing each helper

19 of 21 *Response helpers had the gap, and the ~30 wrap: null tools in TOOL_META fell through to genericResponse with the same gap. Touching every helper would be near-mechanical churn and would still miss future helpers added without remembering the envelope. The finalize() chokepoint already runs sanitizeAdcpErrorEnvelope / enrichErrorTwoLayer / injectContextIntoResponse / injectVersionIntoResponse — envelope status belongs in the same row.

Test plan

• New: 4 targeted tests in test/server-create-adcp-server.test.js covering productsResponse path, getSignalsResponse path, genericResponse fallback (list_property_lists), and the MediaBuyStatus collision case (create_media_buy returning status: 'active' ships unchanged)
• NODE_ENV=test node --test test/server-create-adcp-server.test.js — 97/97
• NODE_ENV=test node --test test/server-responses.test.js test/server-decisioning-from-platform.test.js test/server-idempotency.test.js — 312/312
• NODE_ENV=test node --test test/lib/storyboard-validations.test.js test/lib/idempotency.test.js test/lib/capabilities-tools-drift.test.js test/lib/governance-e2e.test.js test/server-decisioning-capability-projections.test.js — 96/96
• npm test full suite: 9409/9417 pass; 5 unrelated failures (all v1-canonical-mapping.json not found in 3.1.0-beta schema cache — confirmed pre-existing on origin/main, not introduced by this change)
• npm run format:check clean

Follow-up

Spec-level question for adcontextprotocol/adcp: envelope-level status (TaskStatus) collides with payload-level status (MediaBuyStatus) at the same top-level key on mediaBuyResponse / updateMediaBuyResponse / cancelMediaBuyResponse. Either nest payload under payload (matches the normative envelope example in protocol-envelope.json) or rename the payload field. Tracking issue inbound.

🤖 Generated with Claude Code

[aao-ipr-bot]

LGTM. Chokepoint at finalize() is the right seam — one place, every framework-registered tool inherits envelope conformance, no per-helper churn. Follow-ups below.

Things I checked

• Chokepoint placement at create-adcp-server.ts:3459 — ordered after sanitizeAdcpErrorEnvelope / enrichErrorTwoLayer, before context/version injection. Same row as the other envelope-shape stampers. Correct.
• Guard logic at create-adcp-server.ts:2682: if ('status' in sc) return preserves CreateMediaBuySuccess.status: 'active' (test at test/server-create-adcp-server.test.js:476-497 locks it in), cancelMediaBuyResponse's hard-coded 'canceled', and the submitted-envelope 'submitted'. 'status' in sc is the same shape the sibling injectors use — consistency wins.
• isError: true skip is correct for this injector's scope. The broader error-envelope conformance gap (see Follow-ups) lives on the adcpError() builder, not here.
• L2/L3 dual write mirrors injectContextIntoResponse and injectVersionIntoResponse byte-for-byte. Drift on JSON.parse failure is the same drift those two already accept — handlers don't emit non-JSON L2 text alongside L3 structuredContent in practice.
• Changeset present, patch level — restoring spec-required envelope behavior, no new exported API. Right call.
• Test coverage: four targeted paths (productsResponse / getSignalsResponse / genericResponse fallback / MediaBuyStatus collision). The collision test is the load-bearing one — proves payload semantics survive the stamp.
• ad-tech-protocol-expert verdict: sound-with-caveats. Witness invariant not violated — envelope fields (status, context_id, task_id, replayed, adcp_version, errors) are framework-owned per ProtocolResponseParser.ts:38-51's own allowlist. Stamping is the framework's job.

Follow-ups (non-blocking — file as issues)

1. Error envelopes still don't carry status: 'failed' / 'rejected'. adcpError() at src/lib/server/errors.ts:160-164 builds { isError: true, structuredContent: { adcp_error: filtered } } with no top-level status. The PR comment frames this as 'wired separately by the adcp_error path' — today that path doesn't exist. AdCP #4876 makes envelope status required on every task response, and failed/rejected are valid TaskStatus values. Either extend the chokepoint to derive status from adcp_error.recovery / code, or land a sibling injector on the error path. Tighten the changeset prose either way — today it overstates the coverage.
2. Stamp runs unconditionally across the wire-version compat matrix. injectVersionIntoResponse gates on if (!servedVersion) return;. injectEnvelopeStatusIntoResponse does not. COMPATIBLE_ADCP_VERSIONS in src/lib/version.ts:28-58 still covers v2.5/v2.6/3.0.0-beta.* responses. Pre-3.0 schemas don't define envelope status at the top level — additive but ambiguous to a v2.5 buyer. Mirror the version gate (bundleSupportsEnvelopeStatus(adcpVersion)) so we don't ship an envelope field on bundles whose contract didn't include it.
3. 'status' in sc treats status: undefined as handler-owned. Edge case — a buggy handler that explicitly sets status: undefined blocks the stamp because in matches present-but-undefined. sc.status != null would be tighter without losing the documented intent. Cheap to harden.

Minor nits (non-blocking)

1. Test reparenting. test/server-create-adcp-server.test.js:435 closes response builder wiring early; :437 opens the new envelope status describe; :560 closes it. That sweeps 'uses generic wrapper for tools without dedicated builders' (:499), 'passes through adcpError responses' (:512), and 'detects build_creative single vs multi-format' (:532) into a describe block whose theme they don't share. Tests pass, but the CI output and a future reader will both lie. Move the closing }); from :560 up to immediately after the MediaBuyStatus collision test at :497.
2. Orphaned JSDoc at create-adcp-server.ts:2645-2655. That block described injectVersionIntoResponse. Inserting the new function between them moved the JSDoc onto the wrong target — TypeScript binds the new function instead. Lift the 2645-2655 block down next to injectVersionIntoResponse at :2700, leaving only the new envelope-status JSDoc above the new function.
3. Notable that #1895 framed itself as the fix and this PR is the third commit in a row cleaning up the same envelope gap. The audit-vs-sweep split is fine for changelog clarity; an npm run review:fork-matrix-style assertion that every *Response helper round-trips an envelope status would close this category for good.

Safe to merge. Land the error-path stamp + version gate in the next sweep — preferably before the storyboard generalises no_legacy_status_fields past get_adcp_capabilities.