What about this idea:  Trace where the power (+) contact of the battery pack leads to on the motherboard and it should arrive at a step-down regulator. Tap into the input to the regulator and connect it directly to the pack's (+) contact.  So this should bypass any switches between the pack and the regulator.  Unless the power management driver of Windows insists on authentication of the pack, would this not result in pack powering the laptop?  The power icon in the Taskbar will still show "no battery", but the laptop will operate normally.

If the authentication switch is inside the pack, then open the pack and directly connect cell (+) to the (+) contact.  You may lose balancing of the cells in the 3S formation.  In which case tap into B1(+) and B2(+) and bring these out of the pack and once in a blue moon manually balance the cells.

Could there be a simple way to defeat the locking mechanism of Lenovo?

Find the input to the power regulator on the laptop, and connect the battery power directly to this, bypassing all the handshake and power control stuff?

You need all the control stuff from the old battery pack. There's actual data coming and going from the BMS SMBus, it will be nier impossible just to "spoof" those signals without all the control stuff from the pack. Without SMBus communication from the pack, the laptops internal charging circuit won't provide charging current. Get the (or another dead one) original battery pack with all the control stuff and connector, ditch the old cells and replace them with a cell layout of similar voltages (Ah does not really matter). Include all safety stuff from the old pack (thermistor etc.). Kinda been there, even a 15 years old Toshiba would not do shit without the original circuit board and connector. Old NiHM -packs were simple, just cells and connectors, but anything with Li-Ion cells will have a circuit board bms with communication bus. 

If you want to raw dog it with just a diy cell battery pack -> power input it is.

Where is the PMBus(I2C variant) stuff?

BMS, fuel gauge, e.t.c.

Also you need to control the charger inside the computer from the battery (most likely).

You could use a Logic Analyzer. Or if it has 6 cells in total is just the laptop reading each individual cell voltage and the balacing is done in the laptop internals. The seventh wire is reading the 12.6v all the voltage across all the pack. 

The laptop does not read individual cells.  The BMS in the battery pack does that.  Besides being 3S2P, you only need to read 4 wires to balance, not 7.

As for the neck and base of the PET bottles, there is no mechanism to cut them and inject them into the form of flemant threads.

There may be some DRM type crypto stuff in the old battery pack. A 3 wire connection would support the "Single Wire" or "One Wire" protocols. The DRM would be to insure that nobody tried to put an off brand pack in. Not sure that it was used in battery packs, but one of the major laptop vendors was asking for that in external power supply chips/boards.

My error.  There are 7 contacts.  4 are Gnd and Vcc.  How do I spoof this?

Is the PCB from the old battery pack completely destroyed? If you can get an idea of what the laptop is expecting to talk to on the SMBus, that would give you a better idea of what you need to do. Knowing something about the thermistor would be a big help too. Lacking either of those, you are probably going to need to snoop the traffic on a working battery pack and measure the voltage on the thermistor.

Not to be a safety nanny, but the thermistor is certainly a protective device for charging, and the battery management chip(s) likely are too.

Thanks for your info.  As I suspected, Lenovo has made it quite certain that consumers have to buy their overpriced packs.

Not to worry about thermistors.  Modern Li-ion cells have a DC impedence as low as 20 mR.  At 2 A charging, which is the most a laptop delivers, you get 1 A per cell for 2 parallel cells.  Thermal generation = 1 x 1 x .02 = .02 W.  Nothing to worry about.  Just holding the pack will make it warmer from body heat.  Thermistor is not needed unless you plan to short the pack.  At 1C discharge you get 3x3x.02 = .18 W.  You couldn't even feel the heat.

I think that the charging algorithm changes with ambient temperature. I was not thinking of self heating. In any event, if there is a thermistor in the pack, a DIY pack is going to need to handle that signal in a way that will make the laptop happy.

Was just down at my local electronic surplus shop and they have old laptop battery packs for $3 or less each. This might be a low cost source for a functional battery management/fuel gauge board.

If there are just three terminals then the third one may just be a thermistor, but this would be unusual for a removable battery pack. Are you sure there aren't more contacts? These packs usually use SMBus (clock+data) to talk to the internal "fuel gauge" IC.

You are correct.  Now I see 7 terminals.  Apparently 4 are Gnd and Vcc.  The other three are SMBus and thermistor?  How do I spoof the protocol?

Thanks!