fix(pi): settle delayed compact ownership

.project-docs/30-worklog/tasks/20260825-pi-background-run-lease-6a4e2c91.md

@@ -8,7 +8,7 @@
 - Worktree: D:\Datas\OthersProjects\makelore-pi-background-run-lease-6a4e2c91
 - Base commit: 92f4c91088e79252aca76af3279b184da68e1eb7
 - Owner: codex-root
-- Status: Implementing follow-up
+- Status: Ready for integration
 
 ## Scope
 
@@ -133,13 +133,21 @@ Follow-up plan from cumulative HEAD `621ebb17810394f6f7b97154cb01217bc9112857`:
   service performs model/fork rejection before metadata persistence or fork
   target creation; sibling Conversations retain independent permits.
 - Manual compact uses the same retained ownership through
-  `compaction_start`, `compaction_end`, authoritative settlement, and hydrate.
-  The final-ASAR proof now arms a controlled 12-second compact response and
-  records its running/uncertain and completed/idle states.
-- Renderer submission errors retain their stable backend code. An uncertain
-  submission keeps the draft and prevents overlap, shows the actionable delay
-  message instead of a runtime-outage banner, and automatically removes the
-  transient message when the authoritative run reaches a terminal state.
+  `compaction_start`, `compaction_end`, correlated RPC settlement, and
+  hydrate. Locked Pi `0.84.2` does not emit `agent_settled` for a manual
+  compact, so the pool now emits a target-scoped top-level settlement after
+  the correlated compact success (including a late success) and the runtime
+  releases its lease exactly once. If `compaction_end(error)` terminalizes the
+  projection before the RPC rejection arrives, the later failure cleanup also
+  releases the already-terminal run lease idempotently.
+- The final-ASAR proof now arms controlled 12-second Provider and Pi RPC
+  response delays, materializes proof-only compact thresholds in the isolated
+  userData, and records running/uncertain followed by completed/idle states.
+- Renderer submission/action errors retain their stable backend code. An
+  uncertain submission keeps the draft and prevents overlap, shows the
+  actionable delay message instead of a runtime-outage banner, and the Header
+  derives away a stale compact uncertainty once a newer generation/sequence
+  reaches a non-uncertain terminal state.
   Model, thinking, compact, and fork controls are disabled while the run is
   active; abort and recover remain available.
 
@@ -181,21 +189,21 @@ Follow-up plan from cumulative HEAD `621ebb17810394f6f7b97154cb01217bc9112857`:
   old implementation retired the correlation and released active ownership at
   10 seconds, returned a raw timeout, and retained the UI uncertainty after a
   completed run.
-- Focused green gate — passed: 8 files / 115 tests, including delayed prompt
+- Focused green gate — passed: 10 files / 121 tests, including delayed prompt
   and compact, late success/failure, settled-before-response, same-target
   mutation exclusion with zero fork/model persistence, sibling isolation,
   safe Host error mapping, Renderer automatic unlock, and final-ASAR wiring.
 - `pnpm run typecheck` — passed after the final runtime/Renderer/proof changes.
 - `pnpm run lint:check` — passed with zero errors and the same 5 pre-existing
   warnings in `src/pages/Home/index.tsx` and `src/pages/Makelore/index.tsx`.
-- `pnpm test` — passed: 181 regular files / 1535 tests passed / 2 skipped,
+- `pnpm test` — passed: 181 regular files / 1538 tests passed / 2 skipped,
   followed by the isolated pressure file / 1 test passed.
 - `pnpm run build:vite` — passed for Renderer, Main, Preload, and utility
   bundles; only existing dynamic-import and chunk-size warnings were emitted.
 - `pnpm run test:electron:windows` — passed: 2 files / 4 tests.
-- Final amended-HEAD NSIS, artifact closure, 12-second packaged UI/Main proof,
-  Authenticode, and zero-residual-process results are completed after the task
-  documentation/registry commit so the returned artifact binds to a clean
+- Final clean-HEAD NSIS, artifact closure, 12-second packaged UI/Main proof,
+  Authenticode, and zero-residual-process results are run after this task
+  documentation commit so the returned artifact binds to the docs-bearing
   cumulative HEAD.
 - The first candidate packaged proof intentionally required
   `CODING_REQUEST_UNCERTAIN` but the controlled Provider's message-shape
@@ -213,6 +221,15 @@ Follow-up plan from cumulative HEAD `621ebb17810394f6f7b97154cb01217bc9112857`:
   through the existing Main fault-injection surface, is absent from Renderer
   and product configuration, and preserves the real packaged Pi command,
   session, Provider request, events, and cleanup path.
+- The final-ASAR candidate proof passed after the compact settlement fix:
+  prompt and compact each crossed the former 10-second confirmation threshold
+  while retaining target ownership; compact reached a durable completed node,
+  context/run idle, Provider active count zero, and background lease zero;
+  stale uncertainty disappeared from the real UI. Hidden idle eviction then
+  used `background_sleep`, the explicit crash/protocol/dispose matrix retained
+  sibling isolation and same-session recovery, and all tracked proof PIDs and
+  resource counters reached zero. This remains controlled loopback/fault
+  injection evidence with `realTurnVerified=false`.
 
 - `pnpm install --frozen-lockfile` — passed with package-manager-pinned pnpm
   `10.33.4` and locked Pi `0.84.2`.