test(device-pin): cover existing-session admission and error sources
Summary
Follow-up to #4384 (#2161). Two test files changed; production code is unchanged.
An existing session can reuse its stored device without request-time device resolution. Add an HTTP scenario that rejects a conflicting pin before any capture call, then successfully captures through the same session with a matching pin.
Strengthen malformed-pin assertions to check the config source for user, project, and explicit files. Raw command and lease HTTP cases also check the generic metadata label when the source itself is malformed.
Validation
Tested SHA: 34741ddf722294006173bda7d29cbd1df4ae7522.
pnpm check:affected --run --head 34741ddf72 passed: run-aQB8Rp, exactCommit: true, unchanged checkout; six local checks passed and seven CI/manual checks were skipped. Focused suite: 45 passed. Receipt and mutation evidence.
In an isolated checkout, the same command on base b7a1ca3e2d278b71406ce50ecacd5317d3c88196 passes all 44 original tests with either mutation. The new tests detect both:
| Isolated mutation | Follow-up result |
|---|---|
| Disable runtime-binding pin admission | 1 failed, 44 passed |
| Replace config-source errors with a generic label | 5 failed, 40 passed |
pnpm exec vitest run --project unit-core --project provider-integration packages/contracts/src/device-inventory-pin.test.ts test/integration/provider-scenarios/device-pin.test.ts
The proof checkout was removed. This small test-only change was self-reviewed. GitHub coverage and native/device lanes remain separate CI obligations; no physical device was needed.