fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373)

A popup already open when the stored profile became unreadable stayed on the
last good profile until reopened. Every save already runs the check loadState()
runs at open; a save refused by it now stops the ten-second refresh, runs the
leave cleanup of the current screen, and raises the recovery screen. From then
on showView() shows nothing else in that popup, so a transaction wait or a later
save cannot take the user off it or clear an export or a typed confirmation.
That is held in memory, never as the saved current view, so a popup opened
after the record is erased elsewhere opens normally. Any other failed save
keeps the "NOT SAVED" banner. The popup test harness now honours
clearInterval().

Model: opus-5-5

src/popup/index.js

@@ -50,6 +50,10 @@ function renderWalletList() {
 
 let refreshInFlight = false;
 
+// The ten-second refresh init() starts, stopped when the popup moves to the
+// recovery screen: there is no profile left to refresh.
+let refreshTimer = null;
+
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
@@ -155,7 +159,28 @@ async function init() {
     // reported rather than being swallowed by the save queue
     // (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
     // the approval-window branch below too, since that window saves as well.
-    onSaveFailure(showSaveFailureBanner);
+    //
+    // Every save first reads the stored record and refuses it with the same
+    // check loadState() runs below. So a record that becomes unreadable while
+    // the popup is open is found by the next save, a navigation or the
+    // ten-second refresh, and gets the screen it would get at open
+    // (https://git.eeqj.de/sneak/AutistMask/issues/373). Passing the recovery
+    // screen to showView() first leaves the current screen as any navigation
+    // does, so a phrase, key or password on it is wiped, and from then on
+    // showView() shows nothing else. A later save that fails the same way,
+    // such as a refresh already in flight, comes back here, where both calls
+    // see the screen already up and do nothing. Any other failed save is a
+    // read or write that failed, and gets the banner without changing the
+    // screen.
+    onSaveFailure((e) => {
+        if (e instanceof StateUnusableError) {
+            clearInterval(refreshTimer);
+            showView("state-recovery");
+            stateRecovery.show(e);
+        } else {
+            showSaveFailureBanner(e);
+        }
+    });
     try {
         await loadState();
     } catch (e) {
@@ -244,7 +269,7 @@ async function init() {
         renderWalletList();
         restoreView();
         doRefreshAndRender();
-        setInterval(doRefreshAndRender, 10000);
+        refreshTimer = setInterval(doRefreshAndRender, 10000);
     }
 }