Validate Pi 0.87 compatibility

[tmustier]

Purpose

Validate compatibility with Pi 0.87.0. The lockfile and development dependencies now resolve to Pi 0.87.0, and a real runtime contract test pins agent_settled handler ordering. The contract passes on Pi 0.87 and fails on Pi 0.86's reentrant behavior.

There are no product changes.

Changes

• refresh the lockfile so the Pi development packages and their transitive dependencies resolve to the Pi 0.87.0 release set
• add a real AgentSession integration test proving all agent_settled handlers finish before queue-steer's requested follow-up run starts
• allow the integration harness to disable compaction so the ordering contract isolates settled-handler behavior
• update the validation guide with Pi 0.87.0, the 82-test result, and the new ordering coverage

Verification

• npm run ci: 82/82 tests passed
• real TUI harness on Pi 0.87.0 passed

[tmustier]

Independent pre-merge review

Verdict: merge. No blocker, high, medium, or low findings.

Ordering contract

The contract at test/pi-integration.test.ts:324-381 exercises the real AgentSession path rather than a mock. Its setup is all load-bearing: the length stop sends queue-steer's follow-up through agent_settled, disabled compaction isolates that boundary, and the gated observer proves the next run cannot begin while another settled handler is still awaiting.

I ran the focused test against Pi 0.86.0. It fails at line 363 with the reentrant trace start, settled:start, start, settled:start, settled:end instead of the expected blocked trace. Against 0.87.0 it passes. I also checked the installed Pi 0.87.0 implementation at /Users/tmnexcade/.local/lib/node_modules/@earendil-works/pi-coding-agent: _emitAgentSettled() marks the emission active and prompt() defers requested work until extension emission completes, matching what this test pins.

Lockfile

The resolved direct Pi packages are all 0.87.0 (package-lock.json:418, :443, :2498). Starting from base 1f67c4c and running the documented targeted update for pi-ai, pi-coding-agent, and pi-tui regenerated a byte-for-byte identical lockfile. The large diff is therefore the required 0.84.1-to-0.87.0 transitive graph refresh, not unrelated manual churn.

Simplification and verification

The change adds no production branches or defensive behavior. The one harness option is necessary to isolate a possible runtime state, and the regression test fails under the actual prior behavior. Cleanup is bounded and releases its gates in finally, so the test cannot strand the session after an assertion.

• npm run ci: 82/82 passed (typecheck included)
• focused ordering test on Pi 0.86.0: failed as expected
• focused ordering test on Pi 0.87.0: passed
• GitHub CI and GitGuardian: passing

Release readiness

No version bump or changelog entry is needed for this merge: it changes compatibility evidence, tests, validation docs, and the development lockfile, with no product/runtime change. The repository is already at released version 0.2.0 and Unreleased is empty. If a new tag/package is intentionally cut solely to publish this updated validation artifact, follow the existing release pattern in a separate release commit (bump package.json and lockfile together, then move an Unreleased entry into the new version); that is not a pre-merge requirement for this PR.