fix(e2e): navigate the router, not the URL fragment

[rubenvdlinde]

keepiq's E2E has been red on development since e225828b feat(router): move keepiq off hash routing to clean path URLs. Three follow-up commits (#586, #585, #590) each fixed something real and the suite stayed red, because none of them touched the navigation helper.

What actually broke. gotoVaultRoute navigated by setting window.location.hash. Under the old hash router that both changed the URL and drove the route. Under createWebHistory the same line still appears to work: the URL gains a fragment and hashchange fires. But createWebHistory does not listen to hashchange, so the route never changed, and nothing threw.

That is why the failures were so hard to read. Every caller went on to fail 20 seconds later on a missing .secret-list-item or an invisible view, so 43 of them reported element(s) not found and the suite looked like a broken vault. The vault was fine. The tests never left the page they started on.

openVault had a second copy of the same hash logic: it looked for an anchor whose href matched #/secrets, and after the migration no such anchor exists, so it fell through to the location.hash branch and did nothing either.

The fix. gotoVaultRoute pushes through the router instance on #keepiq-app, falling back to history.pushState plus a dispatched popstate, which is the listener createWebHistory actually installs. Both navigate in place, and that is not a stylistic preference here: the vault's CryptoKey lives only in memory, so any real reload drops it and the router guard bounces to the lock gate. The fallback derives its base exactly as routerBase() in src/main.js does, so both the /apps/ and /index.php/apps/ URL forms resolve.

openVault now delegates to that helper rather than keeping its own copy, and the two specs that set location.hash inline (compromise-recovery, folder-sharing) call the helper too.

Verified locally: playwright --list collects 72 tests across 17 files, and lint reports 0 errors. The E2E job itself only runs on the push to development, not on this PR, so the real verdict lands after merge and I will report it there.

[github-actions]

Quality Report — ConductionNL/keepiq @ b9c6d29

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-01 13:32 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/keepiq @ b9c6d29

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-01 13:38 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Verified against a live Nextcloud before merging, not just in CI.

Ran workflows/page-surfaces.spec.ts locally against a real instance: 9 passed (4.5m). That is the spec that leans hardest on the helper, and every one of its authenticated cases was failing on development.

The first CI run here failed gate-4 (composer-audit, exit 100 with no advisory named, so the audit could not reach its database). This branch touches only tests/e2e/*.ts, and gate-4 passed on development an hour earlier, so I re-ran it rather than assuming either way. It passes. All 42 checks are green.