complete Browser secure reset after verified legacy clear

@@ -1783,6 +1783,29 @@17831783     });17841784     expect(res).toMatchObject({ ok: false, error: "invalid_payload" });17851785   });1786+  it("SECURE_RESET archives legacy trust and reaches the new Sync anchor", async () => {1787+    const vault = await import("./vault");1788+    await vault.createVault("correct-pass-12345");1789+    const identity = await import("./device-identity");1790+    await identity.getOrCreateDeviceId();1791+    const { upsertPairedDevice } = await import("./paired-devices");1792+    await upsertPairedDevice({1793+      deviceId: "phone-1",1794+      deviceName: "June's Phone",1795+      deviceType: "android",1796+      longTermPublicKeyHex: "a".repeat(64),1797+      signingPublicKeyHex: "b".repeat(64),1798+      pairedAt: 1_700_000_000_000,1799+      trustSource: "direct",1800+    });1801+1802+    const response = await dispatch({1803+      type: "SECURE_RESET",1804+      payload: { password: "correct-pass-12345" },1805+    });1806+1807+    expect(response).toMatchObject({ ok: true, data: { state: "V2_ANCHOR" } });1808+  });17861809 17871810   // The old "fresh direct re-pair clears the old revocation" test dispatched17881811   // COMPLETE_PAIRING, a handler deleted on 2026-08-04 (no legitimate senders;

@@ -405,8 +405,7 @@405405         browserGenerationIo.hasLegacyRouteMaterial(),406406         chrome.storage.session.get(SESSION_PAIR_SECRETS_KEY),407407       ]);408-      return !paired && !revocations && !pending && !route &&409-        !(SESSION_PAIR_SECRETS_KEY in session);408+      return !paired && !revocations && !pending && !route && session[SESSION_PAIR_SECRETS_KEY] === undefined;410409     } catch {411410       return false;412411     }