Scenario 25: A user picks a password that technically satisfies your complexity rules (uppercase, number, symbol) but registration still rejects it.

Your CompromisedPasswordChecker integration (checking against known-breached password datasets via k-anonymity) is very likely rejecting it because that exact password has appeared in a public data breach before, regardless of how 'complex' it looks. This is by design — complexity rules alone don't guarantee a password is actually unpredictable to attackers armed with real breach data.