feat(compat): complete negotiated buyer lifecycle parity

[bokelley]

Follow-up to #1146 / #1148 and the AdCP 3.x SDK lifecycle audit.

#1146 establishes the first buyer-side compatibility slice: one negotiated list_products -> buy_products application workflow across compact and established sellers. This issue owns the remaining buyer lifecycle parity work after that list-to-buy foundation is reviewed and merged.

Keep this separate from #1147, which owns the opposite seller-side direction (legacy buyers against compact-backed sellers), and from adcp#7439, which owns cross-language schema-derived response conformance evidence.

Scope

• Add negotiated proposal discovery, acceptance, refinement, and decline across compatible 3.0/3.1/3.2 routes while preserving native task signatures.
• Add negotiated media-buy control and shared media-buy/delivery readbacks.
• Select complete compatible workflow lanes and require every advertised tool and buying mode before dispatch; do not choose routes independently per call.
• Preserve exact served-version and account scope on every established request, including refine/decline.
• Keep established refine/decline fail-closed after transport ambiguity where the actual legacy wire request cannot carry an idempotency key. Never infer seller replay protection from unrelated capability metadata.
• Make known seller-task polling recoverable across transient status and local persistence failures; reserve ambiguous state for identity/type conflicts or genuinely non-authoritative outcomes.
• Support same-ID proposal successors and exact completed replay from immutable source evidence rather than mutable current evidence.
• Enforce proposal expiry using the durable store's authoritative clock inside the atomic reservation, while allowing retained completed operations to replay after proposal expiry.

Durable evidence design gate

Do not ship legacy proposal mutations until the design can guarantee that every accepted terminal result can be durably represented after an irreversible seller call.

• Define a bounded replay projection or a protocol/capability-backed maximum for schema-valid proposal and media-buy terminal results. Current 3.0/3.1 arrays are unbounded, so a fixed 256 KiB post-dispatch cap is not sufficient.
• Reserve task identity, terminal projection bytes, and permitted successor fan-out atomically before dispatch. A submitted task ID or a 1 -> N refinement must not exceed capacity after the seller mutation.
• Specify production retention, pruning, permanent success fences, encryption, and multi-instance atomicity for acceptance and mutation records.
• Make any replay lookup capability required for guarantees that public docs promise; optional store protocols must result in explicitly degraded behavior.
• Add exact-quota submitted-task, oversized terminal, 1 -> N successor, expiry-race, replay-after-expiry, concurrent reservation, and restart-recovery tests.

Public API and evidence

• Provide typed coordinator inputs that cannot be bypassed by broad Mapping[str, Any] annotations in normal typed usage.
• Document exact retry/recovery behavior without promising redispatch on legacy wires that cannot carry idempotency identity.
• Add real ADCPClient -> adapter -> server-boundary tests for every projected route, not only permissive fake-client tests.
• Feed the resulting Python cases into the release-pinned conformance work in adcp#7439, keeping routing, schema validity, semantic preservation, and workflow completion as separate results.

Coordination

• Buyer list-to-buy foundation: feat(media-buy): add a negotiated 3.x catalog purchase helper #1146 / feat(compat): coordinate media-buy lifecycle across AdCP 3.x #1148
• Seller reverse facade: feat(server): add a reverse legacy facade for compact media-buy handlers #1147
• Cross-language lifecycle audit: adcp#7420
• Cross-language response conformance: adcp#7439
• Go continuation and reverse-facade tracker: adcp-go#482

This issue must not claim full TypeScript parity until the applicable shared behavioral and response-conformance evidence passes in all languages.

[bokelley]

Triage

Classification: Feature request (epic / tracking)
Bucket(s): client, handlers
Status: deferred

My take: This issue is explicitly scoped as the remaining buyer lifecycle parity work "after that list-to-buy foundation is reviewed and merged" — the preconditions are #1146 (open) and its implementing PR #1148 (open). Pre-classifies as child-of-open-parent; expert review deferred until the foundation lands.

Blocked-on: #1148 — resurfaces on merge.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_01MRNov7BaGe8qH5po5v4x6T

---

Generated by Claude Code