The password route disabled its Confirm Delete button before the decrypt and never re-enabled it on success, so a second delete in the same popup session found a dead button until the popup was closed and reopened. The lost-password route re-enabled its own button in its leave hook, so the two screens on the one screen behaved differently. Both routes now reset the button through the shared finishDelete(), the one path they both take, and the lost-password leave hook no longer handles it separately. Tests drive a password-route delete and a second delete in the same session; they fail against the prior head, where the button stays disabled after the first delete. Model: opus-4-8