refactor(vast): [PKG-VAST-03] isolate lifecycle ownership checkpoint

refactor/risks.json

@@ -702,7 +702,7 @@
         "PKG-VAST-05"
       ],
       "evidence": [
-        "packages/artplayer-plugin-vast/src/index.js",
+        "packages/artplayer-plugin-vast/src/sdk.ts",
         "refactor/baselines/vast-contract.md",
         "refactor/baselines/vast-release.json",
         "refactor/changes/2026-09-12-PKG-VAST-01-contract.md",
@@ -3181,7 +3181,8 @@
         "refactor/baselines/vast-contract.md",
         "refactor/baselines/vast-release.json",
         "refactor/changes/2026-09-12-PKG-VAST-01-contract.md",
-        "refactor/baselines/vast-contract-validation.json"
+        "refactor/baselines/vast-contract-validation.json",
+        "refactor/vast-compatibility-decision.md"
       ],
       "compatibleResolution": "Restore published id/$container access and reconcile eager non-null Player with lazy workspace usage using explicit consumer evidence.",
       "closureCriteria": "Published and workspace consumer fixtures cover all callback fields and initialization timing; any irreconcilable behavior has a concrete decision rather than implicit waiver."
@@ -3199,10 +3200,13 @@
         "refactor/baselines/vast-contract.md",
         "refactor/baselines/vast-release.json",
         "refactor/changes/2026-09-12-PKG-VAST-01-contract.md",
-        "refactor/baselines/vast-contract-validation.json"
+        "refactor/baselines/vast-contract-validation.json",
+        "refactor/baselines/vast-lifecycle-validation.json",
+        "refactor/changes/2026-09-12-PKG-VAST-03-lifecycle.md"
       ],
       "compatibleResolution": "Provide accurate Promise/context/IMA types and a self-contained installed declaration chain while checking legacy export= and consumers.",
-      "closureCriteria": "Strict isolated package consumers pass without skipLibCheck; synchronous Result inference differences are reproduced and resolved or separately approved. Ads approval does not apply."
+      "closureCriteria": "Strict isolated package consumers pass without skipLibCheck; synchronous Result inference differences are reproduced and resolved or separately approved. Ads approval does not apply.",
+      "workspaceState": "Direct @alugha/ima2.1.0 removes the two TS2307 diagnostics in TS5.9.3 and4.3.5; public synchronous Result mismatch and isolated packaged declaration validation remain04/06."
     },
     {
       "id": "VAST-LIFE-01",
@@ -3222,11 +3226,13 @@
         "refactor/changes/2026-09-12-PKG-VAST-02-tests.md",
         "refactor/baselines/vast-behavior-validation.json",
         "refactor/baselines/vast-core.json",
-        "refactor/vast-validation.md"
+        "refactor/vast-validation.md",
+        "refactor/baselines/vast-lifecycle-validation.json",
+        "refactor/changes/2026-09-12-PKG-VAST-03-lifecycle.md"
       ],
       "compatibleResolution": "Reproduce pending SDK/callback destruction, errors, duplicate IDs and stale ad events before adding compatible cleanup and state ownership.",
       "closureCriteria": "Tests prove cleanup during load/callback rejection/core destruction and distinguish explicit plugin recreation from terminal core destruction; vendor media restoration is separately verified.",
-      "workspaceState": "45 Node tests include 16 frozen historical observations across 10 lifecycle/error categories. Real browser core destruction plus late SDK resolution leaves a newly allocated recorder in the detached player across 5.1.7/5.4.1/candidate. Google IMA allocation itself is not simulated as evidence; exact wrapper SDK boundary is controlled. All production fixes remain PKG-VAST-03 work."
+      "workspaceState": "45 Node tests include 16 frozen historical observations across 10 lifecycle/error categories. Real browser core destruction plus late SDK resolution leaves a newly allocated recorder in the detached player across 5.1.7/5.4.1/candidate. Google IMA allocation itself is not simulated as evidence; exact wrapper SDK boundary is controlled. All production fixes remain PKG-VAST-03 work. PKG-VAST-03 checkpoint: 15 candidate lifecycle assertions fail on frozen workspace and pass after TS ownership changes; 117 real browser wrapper checks pass with controlled SDK. Risk stays open pending full compatibility and actual vendor acceptance."
     },
     {
       "id": "VAST-DIST-01",