docs(core),test(server): renumber standard-header rung 8→7 ahead of capability gate; align era-gating test title with its initialize body

The standard-header-validation ladder entry is moved to order 7 (ahead of
client-capabilities, now 8, and param-header-validation, now 9), and its
rationale carries an explicit precedence caveat: serveModern evaluates this
rung immediately after the supported-revision gate, so a request that also
fails a dispatch rung (method-registry 5, request-params 6) is answered here
first — the documented order is not the observed precedence relative to those.

The era-gating test's title said it posts a 2025-era tools/list without
standard headers, but the body POSTs initialize (the 2025 handshake, which is
the right body for era-gating); aligned the title to match.

Author: felixweinberger

packages/core/src/shared/inboundClassification.ts

@@ -169,8 +169,8 @@ export type InboundValidationRung =
     | 'envelope'
     | 'method-registry'
     | 'request-params'
-    | 'client-capabilities'
     | 'standard-header-validation'
+    | 'client-capabilities'
     | 'param-header-validation';
 
 /** A ladder rejection: the JSON-RPC error to emit and the HTTP status to emit it with. */
@@ -314,9 +314,25 @@ export const INBOUND_VALIDATION_LADDER: readonly InboundValidationRungDescriptor
         rationale: 'Per-method params validation; emitted in-band by the dispatch layer (HTTP 200), never via the ladder status table.'
     },
     {
-        rung: 'client-capabilities',
+        rung: 'standard-header-validation',
         order: 7,
         evaluatedAt: 'pre-dispatch',
+        codes: [HEADER_MISMATCH_ERROR_CODE],
+        conformance: ['http-header-validation'],
+        rationale:
+            'SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check ' +
+            '— are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before ' +
+            'dispatch. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge ' +
+            '`era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the ' +
+            'capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by ' +
+            'the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the ' +
+            'observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request ' +
+            'that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted.'
+    },
+    {
+        rung: 'client-capabilities',
+        order: 8,
+        evaluatedAt: 'pre-dispatch',
         codes: [ProtocolErrorCode.MissingRequiredClientCapability],
         conformance: ['server-stateless'],
         rationale:
@@ -327,21 +343,6 @@ export const INBOUND_VALIDATION_LADDER: readonly InboundValidationRungDescriptor
             'missing the capability and would also fail a dispatch rung is answered by this gate first, so the entry must ' +
             'consult the method registry before the gate if the documented precedence is to stay observable.'
     },
-    {
-        rung: 'standard-header-validation',
-        order: 8,
-        evaluatedAt: 'pre-dispatch',
-        codes: [HEADER_MISMATCH_ERROR_CODE],
-        conformance: ['http-header-validation'],
-        rationale:
-            'SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check ' +
-            '— are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before ' +
-            'dispatch. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge ' +
-            '`era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. The documented order ' +
-            '(after method resolution, params validation, and the capability gate) is not the observed precedence: serveModern ' +
-            'evaluates this rung immediately after the supported-revision gate, so a request that fails several rungs is ' +
-            'answered by this gate before the dispatch rungs (5–6) and the capability gate (7) are consulted.'
-    },
     {
         rung: 'param-header-validation',
         order: 9,

packages/server/test/server/stdHeaderValidation.test.ts

@@ -149,7 +149,7 @@ describe('SEP-2243 standard-header validation (createMcpHandler, modern era)', (
 });
 
 describe('SEP-2243 standard-header validation is era-gated', () => {
-    it('legacy traffic is byte-untouched: a 2025-era tools/list without standard headers still serves', async () => {
+    it('legacy traffic is byte-untouched: a 2025-era initialize without standard headers still serves', async () => {
         const handler = createMcpHandler(makeFactory());
         const response = await handler.fetch(
             new Request('http://localhost/mcp', {