fix: settle Pi child capacity reservations

.project-docs/30-worklog/tasks/20260823-pi-child-workers-5c8e2a71.md

@@ -8,7 +8,7 @@
 - Worktree: D:\Datas\OthersProjects\makelore-pi-child-workers-5c8e2a71
 - Base commit: b806c78139aa11e338c680d4c3fa92e076901aa2
 - Owner: codex
-- Status: Planner corrections complete; re-review pending
+- Status: Second planner corrections complete; re-review pending
 
 ## Scope
 
@@ -68,6 +68,15 @@
   prioritizes child reservations so a running parent cannot deadlock while
   waiting on its own child. The child enters the priority queue before idle
   reclamation releases capacity.
+- Planner re-review of `3de85d6` confirmed the original three findings closed,
+  then reproduced two further supported failure paths: a child reservation
+  could wait forever when no parent was idle during the one-time reclaim but a
+  spawning/running parent became reclaimable later; and reclaim/worker-stop
+  failure could leave an unowned process lease. The pool now wakes pending
+  reclaimers on `ready`/`idle` state transitions without polling. Scheduler
+  reservations race direct capacity against this cancellable event-driven
+  reclaim and always settle/release on reclaim rejection, parent abort, or any
+  other early exit. Parent `stop()` now releases its process lease in `finally`.
 - Added the managed ephemeral child opener. It resolves only enabled,
   unarchived project Agents from `.niancode/project.json`, materializes their
   exact model/prompt/skills, keeps credentials in the child environment and
@@ -101,7 +110,10 @@
   parent reclamation; parallel sibling preservation; chain skip/abort rules;
   parent generation cancellation with no orphan and zero leaked permits;
   recursive child rejection; parent/child same-project write-lease queuing;
-  and unknown schema/version raw-payload suppression.
+  unknown schema/version raw-payload suppression; first reclaim finding no
+  idle followed by delayed parent readiness and automatic child execution;
+  reclaim rejection/abort with zero queued lease; and stop rejection with zero
+  active/waiting lease.
 - Locked real Pi 0.84.2 workspace smoke passed for both the parent worker and
   an ephemeral read-only child launched through Electron Node with the child
   extension role and `--no-session`. A probe extension reads Pi's actual
@@ -117,18 +129,17 @@
   authenticated Main bridge; the active-tool process probes and bridge execute
   test jointly cover visibility and tool invocation without an external
   Provider.
-- All cumulative Pi tests passed: 22 files, 106 passed and 1 staged-only
+- All cumulative Pi tests passed: 22 files, 110 passed and 1 staged-only
   skipped; the staged-only command passed separately as described above.
 - `pnpm run typecheck`: passed.
 - `pnpm run lint:check`: passed with 0 errors and 6 pre-existing frontend
   warnings outside this task.
 - `pnpm run build:vite`: passed for Renderer, Main, Preload, and utility
   worker bundles; existing chunk-size/dynamic-import warnings remain.
-- First full-suite run, executed concurrently with the build, passed 2208/2209
-  and hit the known Windows temporary JSON `rename` `EPERM` in the unchanged
-  conversation store. The failing test passed in isolation, then the serial
-  full-suite rerun passed. After planner corrections the final serial full
-  suite passed: 202 files, 2209 passed and 1 staged-only skipped.
+- The final full-suite first pass hit the known Windows temporary JSON `rename`
+  `EPERM` in the unchanged conversation store. The failing runtime test passed
+  1/1 in isolation, and the single full-suite rerun passed: 202 files, 2213
+  passed and 1 staged-only skipped.
 - Real external Provider validation remains **Explicitly Waived / Accepted
   Risk** with `realTurnVerified=false`. Provider concurrency, credential
   isolation, protocol compatibility, and image-path risk are accepted rather
@@ -153,7 +164,9 @@
   Future impact: any final Main composition must pass one `PiProcessBudget` to
   both the parent pool and child scheduler, preserve child-priority budget
   reservations ahead of normal parent-start waiters, and wire the scheduler's
-  capacity reclaimer to `PiWorkerPool.reclaimIdleWorker`. Semantic conflicts:
-  none with the accepted PI runtime specification; this makes its parent/child
-  cap executable. Human confirmation required: no, unless integration changes
-  the accepted process-cap policy.
+  cancellable capacity reclaimer to `PiWorkerPool.reclaimIdleWorker`. The pool
+  must notify an already waiting child when a spawning/running parent becomes
+  `ready`/`idle`, and stop/reclaim failure must never retain a lease. Semantic
+  conflicts: none with the accepted PI runtime specification; this makes its
+  parent/child cap executable. Human confirmation required: no, unless
+  integration changes the accepted process-cap policy.