I've had this comment in my client around the finalization code for quite a while, so I must have run into it.
Boulder's ACME implementation (at least on Staging) currently doesn't quite follow the spec at this point. What I've observed is that the response to the finalize request is indeed the order object and it appears to have 'valid' status and a URL for the certificate. But it skips the 'processing' status entirely which we shouldn't rely on according to the spec.
So we start polling the order directly and the first response comes back with 'valid' status, but no certificate URL. Not sure if that means the previous certificate URL was invalid. But we ultimately need to check for both 'valid' status and a certificate URL to return.
So basically, the order object returned by the finalize request has the cert URL. But if you POST-as-GET the order object, it's missing for some period of time. Maybe it has to do with internal DB propagation across nodes?