test(pi): align auth and extension checks with current runtime

.project-docs/30-worklog/tasks/20260928-merge-reply-cleanup-eb8d39b3.md

@@ -36,7 +36,7 @@
 ## Follow-ups
 
 - Remote main publication complete at product merge `f6944c46ebdeb05a940043ba629aee6716b5e44a`. Packaging and installation belong to the user's colleague; this final record commit carries no product changes. Source/live-trial worktree retained.
-- The 3 pre-existing Pi test assertions remain outside this teacher merge scope. Native Electron foreground interactions and signed package verification are not claimed.
+- The 3 pre-existing Pi test assertions were subsequently repaired at the user's request; see the follow-up below. Native Electron foreground interactions and signed package verification are not claimed.
 
 ## Promotion Candidates
 
@@ -55,3 +55,20 @@
 1. Merge source 40c247a into fetched main in this isolated branch; preserve source history and resolve overlaps with the current continuous-chat contract.
 2. Verify backend/context/parser/history and UI/preview/refresh paths, typecheck, lint, production compile and headless layout; independently review the merge.
 3. Recheck origin/main, integrate any concurrent advance, push normally to main and verify remote ancestry/hash. Keep the live trial checkout; packaging and app updates are outside this request.
+
+## Follow-up: Three Baseline Test Failures
+
+- User asks what the reported 3 failures mean, whether they affect the product and requests their repair. Resume the same integration-validation task in its existing owned checkout at `405846c`; official start/status verify the same task ID/mode/branch/worktree. No subagents unless separately approved; this follow-up is performed independently.
+- Context gate passed: entry/memory/task/peer scopes rechecked; unchanged positioning and prior teacher context retained; read Pi ADR-006, Main architecture, provider/domain success criteria and evidence/reflection/commitment/stale indexes. Main owns credential isolation, public error classification and managed runtime resources. No change to the accepted Pi 0.84.2/runtime-v7 behavior or login recovery flow.
+- Peers still own application installation/testing and an unfinished child-language task; their files stay read-only. This work repairs the specifically reported test debt in two Pi test files and the matching release-proof filename metadata. No semantic conflict, new product direction, paid call, packaging or app restart is involved.
+- Evidence: commit `7951cca` deliberately changed the public Provider-auth message and expanded expired-session recognition; `26cbb29` deliberately advanced the managed extension from v6 to v7. Session-projector already expects the new public message. Runtime opener uses the real materialized extension path. The three failed assertions are stale; release proof also retains a stale v6 report label.
+- Plan: align exact public-message assertions without weakening status/error-code/redaction checks; use the canonical extension filename and verify the concrete extension argument points to a readable file; remove the stale release-proof label; run focused tests, typecheck/lint/build and then the full suite. Preserve histories and production behavior.
+
+### Follow-up Outcome And Verification
+
+- Repaired both exact Provider-auth message expectations to the accepted public wording; error code, terminal state, recoverability and secret-redaction checks remain intact.
+- Worker-opener regression now uses the authoritative versioned extension filename, verifies its exact `--extension` argument path and reads the generated module. The release-proof report uses that same filename instead of an obsolete v6 label. No authentication, runtime version, model behavior or billing change.
+- Focused event/session projector, managed opener and actual extension bundle: 4 files / 37 tests passed. Full `corepack pnpm test` now passes: 263 files / 2642 tests passed, 3 unchanged skipped tests, followed by the separately executed pressure stage 1 file / 1 test passed. No remaining failed tests.
+- `typecheck`, full `lint:check` (0 errors / 8 prior warnings), `build:vite`, `git diff --check` and required documentation structure passed. Task drift retains the same 5 unchanged imported source-document diagnostics from the previous integration; current follow-up modifies only this owned record plus the 3 listed test/metadata files relative to `405846c`.
+- Impact: stale expectations made the full validation command fail although the intended auth projection and v7 extension were operating correctly; stale release-proof metadata could mislabel an artifact report. Repair restores meaningful release validation without downgrading runtime behavior. Formal package verification remains the packaging owner's responsibility.
+- Continue the authorized repository handoff with a normal fast-forward push to main after commit; no app restart, package, cloud publication, real model request or subagent creation.

electron/coding-runtime/pi/release-proof.ts

@@ -25,6 +25,7 @@ import {
 import type { ConversationPatchEnvelope, PrepareConversationInput } from '../contracts';
 import { PiAgentServerProcess } from './agent-server-process';
 import { PiManagedExtensionHost } from './extension-host';
+import { MAKELORE_PI_EXTENSION_FILENAME } from './extensions/makelore-runtime';
 import { PiManagedInputRevisionCoordinator } from './managed-input-revision';
 import { runPiReleasePressureCleanup } from './release-proof-cleanup';
 import { ensurePiManagedPaths } from './resource-loader';
@@ -1416,7 +1417,7 @@ export async function runFinalAsarExtensionProof(): Promise<PiReleaseExtensionPr
     providerRequests: requestCounts,
     subagentStatus: 'complete',
     subagentSummary: 'REAL_CHILD_COMPLETE',
-    materializedExtension: 'makelore-runtime-v6.mjs',
+    materializedExtension: MAKELORE_PI_EXTENSION_FILENAME,
     providerFirstEventDelayMs: PROOF_PROVIDER_FIRST_EVENT_DELAY_MS,
     managedTurns,
     managedWorkerMilestones: composition.telemetry,

tests/unit/pi-event-projector.test.ts

@@ -465,7 +465,7 @@ describe('Pi event projector', () => {
       terminalReason: 'failed',
       error: {
         code: 'CODING_PROVIDER_AUTH_REQUIRED',
-        message: '模型服务身份上下文无效，请重试；若仍失败请重新登录。',
+        message: '登录已失效，请重新登录后继续。',
         recoverable: true,
       },
     });
@@ -530,7 +530,7 @@ describe('Pi event projector', () => {
       terminalReason: 'failed',
       error: {
         code: 'CODING_PROVIDER_AUTH_REQUIRED',
-        message: '模型服务身份上下文无效，请重试；若仍失败请重新登录。',
+        message: '登录已失效，请重新登录后继续。',
         recoverable: true,
       },
     });

tests/unit/pi-managed-worker-opener.test.ts

@@ -27,6 +27,7 @@ import type {
 import type { PiWorkerProcessOptions } from '../../electron/coding-runtime/pi/worker-process';
 import type { PiRuntimeTelemetryEvent } from '../../electron/coding-runtime/pi/telemetry';
 import { PiManagedExtensionHost } from '../../electron/coding-runtime/pi/extension-host';
+import { MAKELORE_PI_EXTENSION_FILENAME } from '../../electron/coding-runtime/pi/extensions/makelore-runtime';
 import { PiWorkerPool } from '../../electron/coding-runtime/pi/worker-pool';
 import type { CodingCapabilityRegistry } from '../../electron/coding-plugins/registry';
 import type { EffectivePluginSnapshot } from '../../electron/coding-plugins/effective-resolver';
@@ -289,7 +290,10 @@ describe('managed Pi worker opener', () => {
       expect(argv).not.toContain('grilling');
       expect(argv).toContain('--session-id');
       expect(argv).toContain('--extension');
-      expect(argv).toContain('makelore-runtime-v6.mjs');
+      const runtimeExtensionPath = path.join(userDataDir, 'coding-runtime', 'pi', 'extensions', MAKELORE_PI_EXTENSION_FILENAME);
+      const extensionIndex = options.additionalArgs!.indexOf('--extension');
+      expect(options.additionalArgs?.[extensionIndex + 1]).toBe(runtimeExtensionPath);
+      expect(await readFile(runtimeExtensionPath, 'utf8')).toContain('export default createMakeloreRuntime();');
       expect(options.additionalArgs?.filter((argument) => argument === '--extension')).toHaveLength(2);
       expect(options.additionalArgs).toEqual(expect.arrayContaining([
         '--skill', deviceSkillPath, '--extension', deviceExtensionPath,