Magpie's Content Security Policy blocks WebAssembly by default, and Vault's encryption library compiles a small WebAssembly module in the browser. The two disagreed, so Vault never finished loading for anyone. The policy now allows WebAssembly compilation specifically - nothing else changes, and it does not reopen the broader eval() restriction the policy also enforces.
Vault: fixed a page that would not unlock
Opening /vault failed outright: the page could not even get to the unlock screen.