docs: the sentences the rewrite reviews left as follow-up notes (closes #723)

Each sentence named on #723 now
matches the code on `next`:

- the Firefox load steps are numbered;
- the AddToken refusal lists name a token that fakes a known symbol;
- the worker's in-memory state is listed in full;
- `script/bootstrap` falls back to `npm install -g` for yarn;
- the Send line under a `null` ETH balance holds with ETH selected;
- the well-known symbols are given per network;
- a network switch empties the fraud contract list;
- the address scan's two misses are listed;
- a new token's line depends on "Show tracked tokens with zero balance";
- wallet drainer is defined at first use.

Model: fable-5-1

README.md

@@ -89,9 +89,13 @@ Load it:
     2. Turn on "Developer mode".
     3. Click "Load unpacked".
     4. Pick `dist/chrome/`.
-- Firefox: open `about:debugging#/runtime/this-firefox`, click "Load Temporary
-  Add-on" and pick `dist/firefox/manifest.json`. A temporary add-on is unloaded
-  when Firefox exits. Read Installing on Firefox below before relying on it.
+- Firefox:
+    1. Open `about:debugging#/runtime/this-firefox`.
+    2. Click "Load Temporary Add-on".
+    3. Pick `dist/firefox/manifest.json`.
+
+A temporary add-on is unloaded when Firefox exits. Read Installing on Firefox
+below before relying on it.
 
 The user guide, [`docs/README.md`](docs/README.md), explains how to use the
 wallet. The release procedure is in [`docs/RELEASE.md`](docs/RELEASE.md).
@@ -375,12 +379,18 @@ Three rules follow from the worker being stopped:
   worker stopping. Such a connection ends when the browser closes, when the
   active address changes, or when the site is removed in Settings.
 
-Two things live only in the worker's memory and are lost when it stops: pending
-approvals and the record of broadcast nonces. An approval, and the site's
-request waiting on it, exist nowhere else. So while any approval is pending, the
-worker calls `runtime.getPlatformInfo()` every 20 seconds. Chrome counts that
-call as activity and keeps the worker running. The timer stops itself once
-nothing is pending.
+These things live only in the worker's memory and are lost when it stops:
+
+- pending approvals;
+- the record of broadcast nonces;
+- the timer that keeps the worker running while an approval is pending;
+- the record of the one open transaction approval;
+- the job that sets up the alarms at every start, while it runs.
+
+An approval, and the site's request waiting on it, exist nowhere else. So while
+any approval is pending, the worker calls `runtime.getPlatformInfo()` every 20
+seconds. Chrome counts that call as activity and keeps the worker running. The
+timer stops itself once nothing is pending.
 
 Alarms the code no longer handles are listed in `OBSOLETE_ALARMS` and cleared on
 every start. The worker fetches nothing when it starts.
@@ -903,7 +913,8 @@ not change. A flash message refuses:
 
 - a token already tracked;
 - an address on the scam list;
-- a contract that fails the lookup.
+- a contract that fails the lookup;
+- a token that fakes a known symbol.
 
 A network switch before the lookup answers adds nothing, and a flash message
 says so.
@@ -1225,7 +1236,8 @@ is `null`:
 
 - the balance lists show "quantity unknown";
 - Home's ETH balance reads `unknown (ETH)`;
-- Send reads `Current balance: unknown (ETH)`, and "Max" fills in nothing;
+- with ETH selected, Send reads `Current balance: unknown (ETH)`, and "Max"
+  fills in nothing;
 - "Send" is not refused for a zero balance;
 - the address has no total;
 - DeleteAddress shows its warning.
@@ -1725,7 +1737,9 @@ The `Makefile` targets are thin shims over `script/`:
 
 - `script/bootstrap`: install the dependencies. Node and yarn come from the
   system when present. Otherwise node comes from a pinned nvm install and yarn
-  from corepack. Fails when node cannot find a package named in `package.json`.
+  from corepack. When corepack and nvm are both missing, yarn comes from
+  `npm install -g`. Fails when node cannot find a package named in
+  `package.json`.
 - `script/setup`: `script/bootstrap`, then the git pre-commit hook.
 - `script/test`: build the `test` stage of the `Dockerfile` with `--no-cache`.
   The stage runs the jest suite, stopped at 90 seconds and rerun verbose on

docs/README.md

@@ -60,7 +60,8 @@ settings.
 - "Check recipients on Etherscan". Etherscan is a block explorer website. With
   the setting on, the wallet fetches the recipient's Etherscan page each time
   you review a send. The wallet warns when Etherscan labels the address as
-  phishing, scam, exploiter or wallet drainer. Only the recipient's address is
+  phishing, scam, exploiter or wallet drainer. A wallet drainer is a contract
+  that empties a wallet once given permission. Only the recipient's address is
   sent. The Etherscan server cannot be changed.
 
 Each time a site's request opens a window, the wallet checks the site against a
@@ -212,9 +213,14 @@ allowed or denied for it.
 Getting the address back is not easy. "+" computes only addresses that this
 wallet has never listed. The removed address was listed once, so "+" skips it.
 The way back is to delete the whole wallet and import its backup again. After
-the import, the scan lists the address again if it holds ETH or has sent a
-transaction. Otherwise "+" may reach it again, because the new wallet has never
-listed it.
+the import, the scan lists the address again when it holds ETH or has sent a
+transaction. The scan misses such an address in two cases:
+
+- the address lies past five unused addresses in a row;
+- the address is the only used one the scan finds.
+
+When the scan does not list the address, "+" may reach it again, because the new
+wallet has never listed it.
 
 ### Deleting a wallet
 
@@ -245,9 +251,11 @@ else is treated as spam and hidden. Turning "Use Blockscout" off removes every
 untracked token from the lists at once.
 
 The balance list and the send screen hide a token that carries a well-known
-symbol, `ETH` included, but comes from another contract. A token that fakes a
-known symbol cannot be tracked ("Not added: this token fakes a known symbol."),
-and is never listed at zero. See Scam protection.
+symbol but comes from another contract. `ETH` and `SepoliaETH` are well-known
+symbols on every network. The symbols of the built-in list are well-known on
+Ethereum Mainnet only. A token that fakes a known symbol cannot be tracked ("Not
+added: this token fakes a known symbol."), and is never listed at zero. See Scam
+protection.
 
 ### Tracking a token
 
@@ -263,8 +271,9 @@ From Settings, under Tracked Tokens, click "+ Add token". That screen offers the
 top 10 tokens as buttons, the top 100 in a dropdown, and a contract address
 field. The two lists are offered on Ethereum Mainnet only.
 
-A line for the new token reads `quantity unknown` until a refresh has read its
-balance.
+While "Show tracked tokens with zero balance" is on, a line for the new token
+reads `quantity unknown` until a refresh has read its balance. With that setting
+off, the token has no line until a refresh has read its balance.
 
 A token is tracked on the network that it was added on. Settings lists the
 tracked tokens of the active network, each with an `[x]` button that stops
@@ -274,7 +283,8 @@ The wallet refuses to track:
 
 - a token that is already tracked;
 - an address on its scam list;
-- a contract that does not answer as an ERC-20 token.
+- a contract that does not answer as an ERC-20 token;
+- a token that fakes a known symbol.
 
 ### The token screen
 
@@ -602,11 +612,11 @@ Blockscout reports no holder count for a token, the history and the send screen
 still show it. While "Use Blockscout" is off, no holder count is known.
 
 Fraud contracts. When the wallet detects a fake token transfer, it adds the
-token's contract to a list that it keeps. While "Hide transactions from detected
-fraud contracts" is on, the history hides transfers from the contracts on that
-list. The send screen never offers those tokens. Turning "Hide fake tokens
-impersonating a known symbol" off also stops new contracts being added to the
-list.
+token's contract to a list. A network switch empties the list. While "Hide
+transactions from detected fraud contracts" is on, the history hides transfers
+from the contracts on that list. The send screen never offers those tokens.
+Turning "Hide fake tokens impersonating a known symbol" off also stops new
+contracts being added to the list.
 
 Dust transactions. Scammers send tiny amounts of ETH from an address that
 resembles one you have dealt with, so that the similar address lands in your