fix: an open popup moves to the recovery screen when its profile becomes unreadable (closes #373)

A popup already open when the stored profile became unreadable stayed on the
last good profile until reopened. Every save already reads the stored record
and runs the same check loadState() runs at open; the popup now sends a save
refused by that check to the recovery screen and stops its ten-second refresh,
while any other failed save keeps the "NOT SAVED" banner and the screen it is
on. The recovery screen ignores a second request to show it, so a save that
was in flight does not clear an export or a typed confirmation. The test
harness records the refresh loop so a test can run one tick of it.

Model: opus-5-5

TODO.md

@@ -45,6 +45,16 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-04: A popup that is already open when the stored profile becomes
+  unreadable moves to the recovery screen
+  ([#373](https://git.eeqj.de/sneak/AutistMask/issues/373)). It used to stay on
+  the last good profile, with the "NOT SAVED" banner at most, until reopened.
+  Every save already ran the check the popup runs at open; a save that fails
+  that check now raises the recovery screen and stops the ten-second refresh, so
+  the popup finds the record at the next navigation or refresh. Any other failed
+  save still gets the banner and leaves the screen alone. The recovery screen
+  ignores a second request to show it, so a later save does not clear an export
+  or a typed confirmation.
 - 2026-10-04: A token that reports more than 80 decimal places has no known
   scale ([#350](https://git.eeqj.de/sneak/AutistMask/issues/350)). The shared
   scale check `toDecimals()` accepted any `uint8`, but `formatUnits()` throws