fix(pi): strengthen final release proof

tests/unit/pi-managed-worker-opener.test.ts

@@ -176,6 +176,8 @@ describe('managed Pi worker opener', () => {
       'resources.ready', 'worker.spawn', 'rpc.ready', 'session.open',
       'resources.ready', 'worker.spawn', 'rpc.ready', 'session.open',
     ]);
+    expect(telemetry.slice(0, 4).every(({ cold }) => cold)).toBe(true);
+    expect(telemetry.slice(4).every(({ cold }) => !cold)).toBe(true);
     expect(JSON.stringify(telemetry)).not.toContain(created.id);
     expect(JSON.stringify(telemetry)).not.toContain('PRIVATE MANAGED PROMPT');
     expect(JSON.stringify(telemetry)).not.toContain('provider-secret-value');

tests/unit/pi-product-artifact.test.ts

@@ -1,6 +1,7 @@
 // @vitest-environment node
 
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { afterEach, describe, expect, it } from 'vitest';
@@ -9,6 +10,7 @@ import {
   assertNodeEngineCompatible,
   classifyOpenCodeResourcePaths,
   collectAbsoluteManifestValues,
+  collectForbiddenAsarPaths,
   collectForbiddenResourcePaths,
   defaultProductExecutable,
   validatePiArtifactMetadata,
@@ -17,6 +19,7 @@ import { parsePiArtifactVerifierArgs } from '../../scripts/verify-pi-product-art
 
 const roots: string[] = [];
 const PI_PACKAGE = '@earendil-works/pi-coding-agent';
+const { createPackage } = createRequire(import.meta.url)('@electron/asar');
 
 afterEach(async () => {
   await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
@@ -85,14 +88,46 @@ describe('final Pi product artifact verification', () => {
     expect(classifyOpenCodeResourcePaths([
       'app.asar.unpacked/resources/opencode-runtime',
       'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+      'app.asar/node_modules/@earendil-works/pi-ai/dist/providers/opencode-codex-responses.js',
     ])).toEqual({
       productOwned: ['app.asar.unpacked/resources/opencode-runtime'],
       upstreamPiProvider: [
         'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+        'app.asar/node_modules/@earendil-works/pi-ai/dist/providers/opencode-codex-responses.js',
       ],
     });
   });
 
+  it('enumerates OpenCode-named paths inside app.asar instead of scanning only physical resources', async () => {
+    const root = await mkdtemp(path.join(tmpdir(), 'makelore-pi-asar-paths-'));
+    roots.push(root);
+    const source = path.join(root, 'source');
+    await mkdir(path.join(source, 'node_modules', '@earendil-works', 'pi-ai', 'dist', 'providers'), {
+      recursive: true,
+    });
+    await mkdir(path.join(source, 'resources', 'opencode-runtime'), { recursive: true });
+    await writeFile(
+      path.join(source, 'node_modules', '@earendil-works', 'pi-ai', 'dist', 'providers', 'opencode.js'),
+      'export {};',
+    );
+    await writeFile(path.join(source, 'resources', 'opencode-runtime', 'legacy.js'), 'export {};');
+    const archive = path.join(root, 'app.asar');
+    await createPackage(source, archive);
+
+    const inventory = collectForbiddenAsarPaths(archive);
+    expect(inventory.entryCount).toBeGreaterThan(2);
+    expect(inventory.matches).toEqual(expect.arrayContaining([
+      'app.asar/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+      'app.asar/resources/opencode-runtime',
+    ]));
+    expect(classifyOpenCodeResourcePaths(inventory.matches)).toMatchObject({
+      productOwned: expect.arrayContaining(['app.asar/resources/opencode-runtime']),
+      upstreamPiProvider: expect.arrayContaining([
+        'app.asar/node_modules/@earendil-works/pi-ai/dist/providers/opencode.js',
+      ]),
+    });
+  });
+
   it('uses final unpacked-product paths and strictly parses verifier options', () => {
     expect(defaultProductExecutable('/repo', 'linux'))
       .toBe(path.resolve('/repo', 'release', 'linux-unpacked', 'niancode'));

tests/unit/pi-subagent.test.ts

@@ -86,6 +86,12 @@ describe('Pi subagent scheduler', () => {
     await expect.poll(() => running).toBe(4);
     expect(maxRunning).toBe(4);
     expect(processBudget.activeCount).toBe(4);
+    expect(scheduler.getDiagnostics()).toEqual({
+      activeChildPermits: 4,
+      waitingChildPermits: 4,
+      activeDispatches: 2,
+      activeParents: 2,
+    });
     gate.resolve();
     const [leftResult, rightResult] = await Promise.all([left, right]);
     expect(leftResult.details.tasks).toHaveLength(4);
@@ -93,6 +99,12 @@ describe('Pi subagent scheduler', () => {
     expect(opened).toHaveLength(8);
     expect(maxRunning).toBe(4);
     expect(processBudget.activeCount).toBe(0);
+    expect(scheduler.getDiagnostics()).toEqual({
+      activeChildPermits: 0,
+      waitingChildPermits: 0,
+      activeDispatches: 0,
+      activeParents: 0,
+    });
     await scheduler.close();
   });
 

tests/unit/pi-worker-pool.test.ts

@@ -714,7 +714,7 @@ describe('Pi worker pool', () => {
     expect(pool.getState('conversation-b')).toMatchObject({ state: 'ready', generation: 1 });
   });
 
-  it('records privacy-safe queue wait and RPC prompt acceptance spans', async () => {
+  it('records privacy-safe queue, acceptance, and authoritative settled spans', async () => {
     let now = 0;
     const telemetry: PiRuntimeTelemetryEvent[] = [];
     const workers = new Map<string, FakeWorker>();
@@ -757,10 +757,14 @@ describe('Pi worker pool', () => {
 
     expect(telemetry.map(({ milestone }) => milestone)).toEqual([
       'prompt.accepted',
+      'agent.settled',
       'worker.queue_wait',
       'prompt.accepted',
     ]);
-    expect(telemetry[1]).toMatchObject({ durationMs: 20, workerGeneration: 1, cold: true });
+    expect(telemetry[1]).toMatchObject({
+      milestone: 'agent.settled', durationMs: 20, workerGeneration: 1, cold: true,
+    });
+    expect(telemetry[2]).toMatchObject({ durationMs: 20, workerGeneration: 1, cold: true });
     const serialized = JSON.stringify(telemetry);
     expect(serialized).not.toContain('private first prompt');
     expect(serialized).not.toContain('private second prompt');