test: fix lock-screen setupVault — strong VAULT_PASSWORD passes the create-vault gate, auto-complete recovery confirmation to land in the unlocked vault (LS07b/c/d opt out), unlock fills + LSC01 use VAULT_PASSWORD, empty-vault unlock assertions check the lock-button shell not entry rows; suite 3→13 passing (remaining 24 are pre-existing timeout/flaky/feature-coupled debt)

@@ -37,7 +37,20 @@3737   });3838 }3939 40-async function setupVault(ctx: BrowserContext, password = "password123") {40+// "password123" was both too short (<12) and too weak for the create-vault41+// strength gate, so the old default never actually created a vault — the42+// "create vault" button stayed in its blocker state and every downstream43+// lock/unlock test failed. VAULT_PASSWORD passes the gate. setupVault also44+// completes the recovery-words confirmation by default so callers land in45+// the unlocked vault; LS07b/c/d opt out to stay on the recovery screen.46+const VAULT_PASSWORD = "correct horse battery staple";47+48+async function setupVault(49+  ctx: BrowserContext,50+  password = VAULT_PASSWORD,51+  opts: { confirmRecovery?: boolean } = {},52+) {53+  const { confirmRecovery = true } = opts;4154   const { popup, extId } = await loadPopup(ctx);4255   const advanceButton = popup.getByRole("button", { name: /next|get started/i });4356   const pw = popup.locator("#master-password");@@ -55,6 +68,7 @@5568     await popup.locator("#confirm-password").fill(password);5669     await popup.getByRole("button", { name: /create vault/i }).click();5770     await expect(popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });71+    if (confirmRecovery) await completeRecoveryConfirmation(popup);5872   }5973   return { popup, extId };6074 }@@ -148,7 +162,7 @@148162   });149163 150164   test("LS07b - recovery screen mounts after vault creation", async () => {151-    const { popup } = await setupVault(ctx, "correct horse battery staple");165+    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });152166     await expect(popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });153167     await expect(popup.locator("text=save your recovery words")).toBeVisible({ timeout: 5000 });154168     await expect(popup.locator(".peach-recovery-word-item")).toHaveCount(12);@@ -158,7 +172,7 @@158172   });159173 160174   test("LS07c - recovery confirmation returns to the unlocked vault", async () => {161-    const { popup } = await setupVault(ctx, "correct horse battery staple");175+    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });162176     await completeRecoveryConfirmation(popup);163177 164178     await expect(popup.locator(".peach-lock-btn[aria-label='Lock vault']")).toBeVisible({ timeout: 5000 });@@ -166,7 +180,7 @@166180   });167181 168182   test("LS07d - recovery confirmation survives popup close and reopen", async () => {169-    const { popup } = await setupVault(ctx, "correct horse battery staple");183+    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });170184     const confirmInputs = popup.locator(".peach-recovery-confirm-input");171185     const recoveryWords = popup.locator(".peach-recovery-word-text");172186 @@ -189,11 +203,12 @@189203   test("LS08 - correct password unlocks vault", async () => {190204     const { popup } = await setupVault(ctx);191205     await lockVault(popup);192-    await popup.locator("#master-password").fill("password123");206+    await popup.locator("#master-password").fill(VAULT_PASSWORD);193207     await popup.getByRole("button", { name: /unlock/i }).click();194208     await popup.waitForTimeout(2000);195-    const entries = popup.locator(".peach-entry-row");196-    await expect(entries.first()).toBeVisible({ timeout: 5000 });209+    // A freshly created vault has no entries, so the unlocked shell (lock210+    // button present) is the correct proof that unlock succeeded.211+    await expect(popup.locator(".peach-lock-btn[aria-label='Lock vault']")).toBeVisible({ timeout: 5000 });197212     await ctx.close();198213   });199214 @@ -214,7 +229,7 @@214229     await popup.keyboard.press("Escape");215230     await popup.waitForTimeout(200);216231     await lockVault(popup);217-    await popup.locator("#master-password").fill("password123");232+    await popup.locator("#master-password").fill(VAULT_PASSWORD);218233     await popup.getByRole("button", { name: /unlock/i }).click();219234     await popup.waitForTimeout(2000);220235     await ctx.close();@@ -233,12 +248,13 @@233248     const { popup } = await setupVault(ctx);234249     for (let i = 0; i < 3; i++) {235250       await lockVault(popup);236-      await popup.locator("#master-password").fill("password123");251+      await popup.locator("#master-password").fill(VAULT_PASSWORD);237252       await popup.getByRole("button", { name: /unlock/i }).click();238253       await popup.waitForTimeout(1500);239254     }240-    const entries = popup.locator(".peach-entry-row");241-    await expect(entries.first()).toBeVisible({ timeout: 5000 });255+    // A freshly created vault has no entries, so the unlocked shell (lock256+    // button present) is the correct proof that unlock succeeded.257+    await expect(popup.locator(".peach-lock-btn[aria-label='Lock vault']")).toBeVisible({ timeout: 5000 });242258     await ctx.close();243259   });244260 @@ -266,7 +282,7 @@266282   test("LS15 - unlock button is disabled during loading", async () => {267283     const { popup } = await setupVault(ctx);268284     await lockVault(popup);269-    await popup.locator("#master-password").fill("password123");285+    await popup.locator("#master-password").fill(VAULT_PASSWORD);270286     const unlockBtn = popup.getByRole("button", { name: /unlock/i });271287     await unlockBtn.click();272288     await popup.waitForTimeout(300);@@ -287,11 +303,12 @@287303     const { popup } = await setupVault(ctx);288304     await lockVault(popup);289305     await popup.locator("#master-password").focus();290-    await popup.keyboard.type("password123");306+    await popup.keyboard.type(VAULT_PASSWORD);291307     await popup.keyboard.press("Enter");292308     await popup.waitForTimeout(2000);293-    const entries = popup.locator(".peach-entry-row");294-    await expect(entries.first()).toBeVisible({ timeout: 5000 });309+    // A freshly created vault has no entries, so the unlocked shell (lock310+    // button present) is the correct proof that unlock succeeded.311+    await expect(popup.locator(".peach-lock-btn[aria-label='Lock vault']")).toBeVisible({ timeout: 5000 });295312     await ctx.close();296313   });297314 @@ -317,7 +334,7 @@317334   test("LS20 - unlock shows loading state", async () => {318335     const { popup } = await setupVault(ctx);319336     await lockVault(popup);320-    await popup.locator("#master-password").fill("password123");337+    await popup.locator("#master-password").fill(VAULT_PASSWORD);321338     const unlockBtn = popup.getByRole("button", { name: /unlock/i });322339     await unlockBtn.click();323340     await popup.waitForTimeout(300);@@ -438,7 +455,7 @@438455     const { popup } = await setupVault(ctx);439456     await lockVault(popup);440457     const html = await popup.content();441-    expect(html).not.toContain("password123");458+    expect(html).not.toContain(VAULT_PASSWORD);442459     expect(html).not.toContain("argon2");443460     await ctx.close();444461   });@@ -480,12 +497,16 @@480497       await popup.waitForTimeout(500);481498     }482499     await popup.waitForTimeout(1000);483-    await popup.locator("#master-password").fill("password123");500+    await popup.locator("#master-password").fill(VAULT_PASSWORD);484501     await popup.getByRole("button", { name: /unlock/i }).click();485502     await popup.waitForTimeout(2000);486-    const entries = popup.locator(".peach-entry-row");487-    const hasEntries = await entries.isVisible({ timeout: 3000 }).catch(() => false);488-    expect(hasEntries).toBeTruthy();503+    // Fresh vault has no entries; a visible unlocked shell proves the correct504+    // password still works after the wrong attempts.505+    const unlocked = await popup506+      .locator(".peach-lock-btn[aria-label='Lock vault']")507+      .isVisible({ timeout: 3000 })508+      .catch(() => false);509+    expect(unlocked).toBeTruthy();489510     await ctx.close();490511   });491512