fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373)

A popup already open when the stored profile became unreadable stayed on the
last good profile until reopened. Every save already runs the check loadState()
runs at open; a save refused by it now stops the ten-second refresh, runs the
leave cleanup of the current screen, and raises the recovery screen. From then
on showView() shows nothing else in that popup, so a transaction wait or a later
save cannot take the user off it or clear an export or a typed confirmation.
That is held in memory, never as the saved current view, so a popup opened
after the record is erased elsewhere opens normally. Any other failed save
keeps the "NOT SAVED" banner. The popup test harness now honours
clearInterval().

Model: opus-5-5

src/popup/views/helpers.js

@@ -52,9 +52,8 @@ const VIEWS = [
     "export-privkey",
     "show-phrase",
     // Shown by src/popup/views/stateRecovery.js when the stored profile
-    // cannot be read. It is never reached through showView() — by then the
-    // state singleton this file writes on every navigation refuses to be read
-    // — but it is listed so that every view-hiding loop covers it.
+    // cannot be read, never by showView() (see there), but listed so that
+    // every view-hiding loop covers it.
     "state-recovery",
 ];
 
@@ -85,12 +84,28 @@ function hideError(id) {
     el.style.visibility = "hidden";
 }
 
+// Set when src/popup/index.js passes the recovery screen to showView(), and
+// never cleared. Kept in memory for this popup's life, never in
+// state.currentView, which is saved: a popup opened later must not inherit it.
+let stateRecoveryShown = false;
+
 function showView(name) {
+    // The recovery screen, once up, is never replaced: work still running
+    // when it went up, such as a transaction wait, must not take the user off
+    // it or clear what they exported or typed there
+    // (https://git.eeqj.de/sneak/AutistMask/issues/373).
+    if (stateRecoveryShown) return;
     const leaving = state.currentView;
     if (leaving && leaving !== name) {
         const onLeave = viewLeaveHandlers.get(leaving);
         if (onLeave) onLeave();
     }
+    // Passed here only so the screen it replaces is left like any other;
+    // stateRecovery.show() raises it, and it is never the current view.
+    if (name === "state-recovery") {
+        stateRecoveryShown = true;
+        return;
+    }
     for (const v of VIEWS) {
         const el = document.getElementById(`view-${v}`);
         if (el) {

src/popup/views/stateRecovery.js

@@ -3,8 +3,10 @@
 // Everything else in the popup assumes a loaded profile: showView() reads and
 // writes the state singleton, every view renders from it, and the Settings
 // gear leads to a screen that does both. None of that is available here — by
-// the time this runs, loadState() has REFUSED, deliberately, and reading the
-// singleton throws (https://git.eeqj.de/sneak/AutistMask/issues/311).
+// the time this runs, the stored record has been REFUSED, deliberately: at
+// open loadState() refused it and reading the singleton throws
+// (https://git.eeqj.de/sneak/AutistMask/issues/311), and under an open popup
+// a save refused it (https://git.eeqj.de/sneak/AutistMask/issues/373).
 //
 // So this module talks to the DOM directly and touches no state at all. It is
 // the one screen that must work when nothing else can, which is also why it
@@ -170,6 +172,11 @@ function wire() {
  *     refused, or its sentence.
  */
 function show(problem) {
+    // Already up: a later save that trips over the same record, such as a
+    // refresh that was in flight when the screen went up, must not clear what
+    // the user has exported or typed here.
+    if (!$("view-state-recovery").classList.contains("hidden")) return;
+
     const sentence =
         (problem && (problem.problem || problem.message)) || String(problem);