47 tests over src/shared/transactions.js: both real address-poisoning attacks as fixtures, each of the four filters on and off, threshold boundaries, no false positives, and the per-address merge/dedup path. No source file changed.
