The write-only security check in 08-pr-vision-admin.spec.ts asserted
page.content() does not contain 'sk-or-'. The password input for the
API key renders with placeholder="sk-or-…" (an ellipsis format hint
shown when the key is admin-managed). This placeholder contains the
literal string 'sk-or-' so the naive toContain assertion trips even
though value="" and no real key is in the page.
Fix: replace toContain('sk-or-') with toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/).
A real OpenRouter key uses the format 'sk-or-v1-<20+ alnum chars>';
the placeholder ellipsis 'sk-or-…' never matches this pattern, so the
false-positive is eliminated. The assertion still catches any real key
accidentally rendered in server-side HTML.
The value="" assertion is unchanged and continues to guard the core
write-only invariant independently.
Agent-Session: fix-smoke-key-assertion-20260617
