fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

Stored state had no version and no structural validation, so a corrupt blob produced a completely blank popup with no message and no recovery control, and made every dApp RPC call from every page answer a generic -32603. There was no reset or wipe control anywhere in the UI.

saveState() now stamps a schema version and loadState() validates the shape. A version it does not understand, or a wallets array it cannot parse, lands on a recovery screen that names the problem, offers the stored record verbatim for export, and offers a destructive reset behind a typed confirmation. Unversioned but valid state -- which every existing install has -- migrates in place and keeps working; it is never shown a wipe prompt. A dApp call against unusable state answers -32007, which EIP-1474 leaves unassigned, rather than -32603. networkById() refuses an unknown id loudly instead of returning mainnet, and networkId is validated so a corrupt value cannot be used as an object key.

Fields the gate does not refuse are floored by type, container and entries both: a malformed trackedTokens or tokenBalances entry is dropped rather than dereferenced. Verified by an independent sweep of 1152 corrupt blobs producing no blank popup, with the same harness showing 9 blanks against the previous revision.

README.md

@@ -985,6 +985,55 @@ tokens with fewer than 1,000 holders" setting governs the transaction history
 and the send-screen token selector, not this list. Tracked tokens with a zero
 balance are listed as well while "Show tracked tokens with zero balance" is on.
 
+#### Stored state and its version
+
+The whole profile lives under a single extension-storage key, `autistmask`, and
+carries a `schemaVersion` — `STATE_SCHEMA_VERSION` in
+`src/shared/stateSchema.js`, currently `1`. Every write stamps it: the popup's
+`saveState()` and the background's `updateState()` both do, so whichever context
+wrote last, the record says which build's shape it is in.
+
+Version 1 is the shape that shipped before versions existed, so a stored record
+with no `schemaVersion` is version 1 rather than a defect: it loads normally and
+is migrated in place by being stamped on the first write. An upgrade never shows
+an existing user a warning about a profile that is perfectly good. The version
+is bumped only when the MEANING of a stored field changes — a new field with a
+sensible absent value is handled by `normalizePersisted()` and is not a bump,
+because bumping for one would send every older install to StateRecovery for
+nothing.
+
+Every read of the record goes through `assertStateUsable()` first, on the raw
+bytes, before normalization: `loadState()` for the popup and `getState()` for
+the background. It refuses a record that is not an object, a `schemaVersion`
+this build does not understand (a newer one included), a `wallets` that is not a
+list of wallet records with address records in them, and a `networkId` that is
+not a network in `src/shared/networks.js`. Refusing is the whole point — a
+record the wallet cannot vouch for is never normalized, never written back, and
+never half-loaded. The popup shows StateRecovery; a dApp gets a specific error
+(`-32007`, an EIP-1474 server-error code the spec leaves unassigned) saying the
+saved data cannot be read and that nothing was signed or sent, rather than the
+generic `-32603` every request used to answer.
+
+Every other field of the record is floored in `normalizePersisted()` rather than
+gated. That floor is a type check for the fields something dereferences
+structurally — `trackedTokens`, each address's `tokenBalances`, `networkId`,
+`networkEndpoints`, `activeAddress`, `viewStack` — and it checks the ENTRIES as
+well as the container, because `[1, 2]` is a list and `t.address` is one level
+below an `Array.isArray()`. The remaining fields get a `saved.x || default` or a
+present-or-default passthrough that takes the stored value verbatim, with no
+type check at all; which field is in which category is listed in the header of
+`src/shared/stateSchema.js`. A truthy value of the wrong type in a field that IS
+dereferenced walks through truthiness and throws on the first read, which is the
+blank popup again by a longer route — so adding a field means choosing between
+the two by what reads it.
+
+The `networkId` check is not cosmetic: that value is an object KEY into
+`state.networkEndpoints`, so an unvalidated `"__proto__"` would set the map's
+prototype instead of an own key and the user's endpoint would silently not be
+recorded. Every key test in the gate is an own-property test for that reason,
+and `networkById()` throws on an id it does not know rather than quietly
+answering mainnet.
+
 #### Navigation
 
 The main view shows all addresses grouped by wallet, with ETH balances inline.
@@ -1011,10 +1060,12 @@ Three elements sit outside the screens and are present on all of them: the title
 bar ("AutistMask by @sneak" plus the Settings gear), the flash message line
 under it, and the red banner at the very top that appears on a debug build, when
 runtime debug mode is on, or when the active network is a testnet. They are not
-repeated in the element lists below.
+repeated in the element lists below. StateRecovery is the one screen they are
+not all present on: it hides the Settings gear, because it is shown precisely
+when there is no profile for the screens behind that gear to render from.
 
 Closing and reopening the popup returns to the screen the user was last on only
-for the views listed in `RESTORABLE_VIEWS` (`src/popup/restorableViews.js`).
+for the views listed in `RESTORABLE_VIEWS` (`src/shared/restorableViews.js`).
 Every other screen falls back to Home. The screens that display a secret —
 ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
@@ -1684,6 +1735,48 @@ view would leave a wallet one click from deletion.
     - Popup window closed without answering → the request is rejected with
       EIP-1193 code 4001
 
+#### StateRecovery (`state-recovery`)
+
+- **When**: `loadState()` refused the stored profile, so the popup has no
+  profile at all. It is the only screen reached without one, and the only one
+  that never appears during ordinary use.
+- **Why it exists**: a record the wallet cannot read used to render nothing — no
+  view, no message, no control — while every dApp call answered a generic
+  internal error, and no reset or wipe control existed anywhere in the product.
+  The only escape was clearing extension storage through browser internals
+  ([#311](https://git.eeqj.de/sneak/AutistMask/issues/311)).
+- **Elements**:
+    - "Saved Data Cannot Be Read" heading, and a statement that nothing has been
+      changed or erased and nothing can be signed or sent
+    - The problem, in one sentence naming what is wrong with the record
+    - "Export Saved Data" button, and the read-only text box it fills
+    - What erasing does and does not do, in bold: every wallet stored in this
+      browser is deleted; nothing on chain changes and no money is moved
+    - A text input asking for `ERASE MY WALLET` to be typed back
+    - Error line
+    - "Erase Saved Data" button
+- **Transitions**:
+    - "Export Saved Data" → the raw stored record, verbatim, in the text box on
+      the screen, and a downloaded `autistmask-saved-data.json` where the
+      browser allows one. The box is filled first and never depends on the
+      download: an export that can fail is not an export.
+    - "Erase Saved Data" (phrase typed) → the stored record is removed and the
+      popup reloads into **Welcome**
+    - "Erase Saved Data" (phrase not typed) → "Type ERASE MY WALLET to confirm.
+      Nothing was erased." on the error line
+- **No other control is reachable.** The Settings gear is hidden while this
+  screen is up, because every screen behind it renders from the profile that
+  could not be read, and `showView()` is not used to raise it for the same
+  reason — it reads and writes the state singleton.
+- **Both controls are required.** An export with no reset leaves the user
+  looking at a broken profile with no way to use the wallet again; a reset with
+  no export destroys the only copy of a record that may hold recoverable key
+  material. The typed phrase is the same barrier DeleteWalletLostPassword uses,
+  and for the same reason: there is no password to gate this with, since there
+  is no profile to check one against.
+- Not in `RESTORABLE_VIEWS`: it is never persisted as the current view, because
+  nothing on this path writes state at all.
+
 ### External Services
 
 AutistMask is not a fully self-contained offline tool. It necessarily