fix: visuals reference matching overhaul and better workflow

features/verify_screen.qa.md

@@ -7,14 +7,15 @@ Mock `useApi` (`POST /v1/auth/verify`, `POST /v1/auth/login`, `DELETE /v1/auth/r
 VerifyPage inside AuthShell with a test router whose current route starts at the "c" query the case
 needs; use fake timers for the 800 ms success delay and the 429 countdown.
 
-1. **Verifying state** — mount at "/register/validate?c=abc123"; assert the full-card spinner text
+1. **Verifying state** — mount at "/register/validate?c=abc123"; assert the full-card spinner title
    "Verifying your account…" and that `POST /v1/auth/verify` was called exactly once with
    `{ code: 'abc123' }` and `{ onUnauthorized: 'passthrough', onForbidden: 'passthrough' }`.
 2. **Success state** — mock `POST /v1/auth/verify` resolving 200; mock the session store's
    `retry()` to resolve; mount and let it settle; assert the ResultPanel (success, shield-check,
-   "Your account is verified", "Taking you to your dashboard…", no actions); advance fake timers by
-   800 ms; assert `retry()` was called; assert the router's current path is /home and a toast was
-   raised with title "Your account is verified", description "Welcome to RenewCMS."
+   "Your account is verified", "Taking you to your dashboard…", no actions); assert a toast was
+   already raised with title "Your account is verified", description "Welcome to RenewCMS." while
+   the path is still /register/validate; advance by 800 ms; assert `retry()` was called and the
+   router's current path is /home, with no second toast.
 3. **Invalid or expired state** — mock `POST /v1/auth/verify` resolving 403; assert the ResultPanel
    (error, link-2-off, "This verification link doesn't work", the text and note above) with actions
    "Cancel registration and start over" (primary) and "Log out" (secondary).
@@ -38,8 +39,9 @@ needs; use fake timers for the 800 ms success delay and the 429 countdown.
    to finish verifying", description, Username placeholder "Your username", Password with show/hide,
    submit "Log in and verify") and assert no "Forgot password?" link and no registration footer are
    rendered.
-8. **No session — submit disabled until filled** — from state 7, assert the submit button is
-   disabled; fill both fields; assert it becomes enabled.
+8. **No session — empty fields are caught on submit** — from state 7, assert the submit button is
+   enabled; submit with both fields empty; assert "Use at least 3 characters." and "Enter your
+   password." are shown and `POST /v1/auth/login` was not called.
 9. **No session — successful login retries** — from state 7, fill valid credentials; mock
    `POST /v1/auth/login` resolving 200; mock a second `POST /v1/auth/verify` call; submit; assert the
    spinner "Verifying your account…" reappears and the second `POST /v1/auth/verify` call was made
@@ -67,7 +69,8 @@ Reference: `docs/design/source/RenewCMS Screens Auth.dc.html`, group "Verify". R
 
 - [ ] Verifying state: the full-card spinner (the only one in the product) matches the board's
       layout exactly, with no title header shown.
-- [ ] Success state: ResultPanel with no actions, transient toast over the /home board.
+- [ ] Success state: ResultPanel with no actions and the success toast over it, captured before
+      the 800 ms redirect (the visual setup freezes timers with `paused: true`).
 - [ ] Invalid or expired state: ResultPanel with note and both actions, button order (primary
       "Cancel registration and start over" first per components.md's safe/primary-on-top rule for
       stacked mobile buttons).