fix: only a permit whose amount is the Amount figure names Token In (closes #370)

A PERMIT2_PERMIT named Token In whether or not its amount stood as the
Amount figure, so the approval screen could show a permit's token, or an
allowance, where the swap's own input belonged. A permit whose spender
was not the router, or that the router may let fail, had no line naming
its spender.

Now only a permit whose amount stands names Token In. Every other
permit, before the swap steps or after them, leaves Token In and Amount
as they read with no permit and gets three lines of its own: Permit2
allowance, Allowance token and Allowance spender. README Transaction
Decoding, its unknown token scale passage and the TxApproval element
list match.

Model: opus-5-5

README.md

@@ -1129,13 +1129,15 @@ scale is not an approximation but a different number — 1,000 units of a
 6-decimal token formatted at 18 decimals reads `0.000000001` — on the screen
 whose only job is to state what is being authorized. Both amount paths of that
 screen take this rule: the ERC-20 `transfer`/`approve` line
-(`src/popup/views/approval.js`) and the swap's `Amount` and `Min. received`
-lines (`src/shared/uniswap.js`). The token permission warning on the signature
-screen takes the same rule for its amounts. An unbounded allowance or permit
-needs no scale to describe and is still shown as `Unlimited`. A source's answer
-counts only if it is a whole number from 0 to 80: `decimals()` returns a
-`uint8`, but `formatUnits()` cannot format more than 80 decimal places, so a
-token that reports 81 to 255 is shown as one whose scale nothing knows.
+(`src/popup/views/approval.js`) and the swap's `Amount`, `Min. received`,
+`Moved from the sender` and `Permit2 allowance` lines and the `Paid to` line of
+a move into the router (`src/shared/uniswap.js`). The token permission warning
+on the signature screen takes the same rule for its amounts. An unbounded
+allowance or permit needs no scale to describe and is still shown as
+`Unlimited`. A source's answer counts only if it is a whole number from 0 to 80:
+`decimals()` returns a `uint8`, but `formatUnits()` cannot format more than 80
+decimal places, so a token that reports 81 to 255 is shown as one whose scale
+nothing knows.
 
 The rule holds only if nothing invents a scale UPSTREAM of it. Those three
 sources are read as authoritative, so a value written into one of them cannot be
@@ -2092,8 +2094,11 @@ view would leave a wallet one click from deletion.
       none, and the tokens tracked on that network, and sends `chainChanged`
       with the new chain id to every open tab. A token is tracked only on the
       network it was added on, because a contract address names a token on one
-      network only. Choosing the network already active changes nothing and
-      sends nothing
+      network only. Switching also clears every address's balances. A balance
+      refresh, by the popup or the background, stores what it fetched only if
+      the stored network is still the one it fetched on when it returns, so the
+      previous network's balances never reach the new one. Choosing the network
+      already active changes nothing and sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -3215,40 +3220,42 @@ Currently supported:
   added to the total while both are quantities: a V3 exact-in of 600 USDT and a
   V2 exact-in of 400 USDT, both paid by the user, read `1000.0000 USDT`. When
   the decoder does not know a take's amount, the total is not known and there is
-  no `Amount` line. `Token In` is the token of the last `PERMIT2_PERMIT` the
-  decoder reads before the step that sets the input side, when there is one. Its
-  amount, `Unlimited` included, stands as the `Amount` figure in place of the
-  total only in the plain shape of Uniswap's own routes: it is the only
-  `PERMIT2_PERMIT` in the transaction, its spender is the router, the router may
-  not let it fail, no step before it takes its token or a token the decoder does
-  not know, and the decoder reads every step after it in full. Permit2 then lets
-  the router take no more of the token than that amount, so the permit covers
-  every take of it. A step the decoder does not read in full may raise what
-  Permit2 lets the router take, as a `PERMIT2_PERMIT_BATCH` can: a command the
-  decoder does not read (listed at the end of this section), a step whose input
-  it cannot read, in whole or in part, and a step it fails on. In any other case
-  the line gives the total, as with no permit. When the step that sets the input
-  side spends a token other than the permit's, or one the decoder does not know,
-  its amount gets lines of its own, unless it states no amount and the user pays
-  it none of its input token, and the total has no figure to start from: unless
-  the permit's amount stands there is no `Amount` line, and each take of the
-  permit's token gets lines of its own. Each take the total does not count gives
-  three lines after the `Amount` line (after `Token In` when there is none): one
-  of a token other than `Token In`; one of `Token In` after an amount that is
-  not a quantity (a V4 open delta, `ALREADY_PAID`, which keep their wording on
-  the `Amount` line, or no stated amount, as of a V4 exact-out step); and one
-  whose amount the decoder does not know. When the step that sets the input side
-  states no amount, the user pays it some of its input token, and there is no
-  `Amount` line, that step gets them too whenever another take's lines give a
-  figure, or a `PERMIT2_TRANSFER_FROM` of its token gives one, on the lines
-  below or, into the router, on its `Paid to` line, so that figure cannot read
-  as all that leaves. When it states no amount and the user pays it none of its
-  input token, as when the router pays it, that step takes none of that token
-  from the user's wallet and never gets them, with a permit or without. They
-  come in step order, the step that sets the input side first when it has them:
-  `Moved from the sender`, its amount, worded as the `Amount` line words one, or
-  `Unknown (could not be decoded)` when the decoder does not know it;
-  `Token moved`, giving the token's address as the `Token In` line does; and
+  no `Amount` line. A `PERMIT2_PERMIT` names `Token In` only when its amount,
+  `Unlimited` included, stands as the `Amount` figure in place of the total,
+  which it does only in the plain shape of Uniswap's own routes: it comes before
+  the step that sets the input side, it is the only `PERMIT2_PERMIT` in the
+  transaction, its spender is the router, the router may not let it fail, no
+  step before it takes its token or a token the decoder does not know, and the
+  decoder reads every step after it in full. Permit2 then lets the router take
+  no more of the token than that amount, so the permit covers every take of it.
+  A step the decoder does not read in full may raise what Permit2 lets the
+  router take, as a `PERMIT2_PERMIT_BATCH` can: a command the decoder does not
+  read (listed at the end of this section), a step whose input it cannot read,
+  in whole or in part, and a step it fails on. Every other `PERMIT2_PERMIT`,
+  before the step that sets the input side or after it, leaves `Token In` and
+  the `Amount` line as they read with no permit: a permit of 5,000 DAI to
+  another address and then a V3 exact-in of 600 USDT read `Swap USDT → USDC`
+  with `Amount 600.0000 USDT`, and so do that exact-in and then a permit of
+  5,000 DAI to the router. When a permit's amount stands and the step that sets
+  the input side spends a token other than the permit's, or one the decoder does
+  not know, that step's amount gets lines of its own, unless it states no amount
+  and the user pays it none of its input token. Each take the total does not
+  count gives three lines after the `Amount` line (after `Token In` when there
+  is none): one of a token other than `Token In`; one of `Token In` after an
+  amount that is not a quantity (a V4 open delta, `ALREADY_PAID`, which keep
+  their wording on the `Amount` line, or no stated amount, as of a V4 exact-out
+  step); and one whose amount the decoder does not know. When the step that sets
+  the input side states no amount, the user pays it some of its input token, and
+  there is no `Amount` line, that step gets them too whenever another take's
+  lines give a figure, or a `PERMIT2_TRANSFER_FROM` of its token gives one, on
+  the lines below or, into the router, on its `Paid to` line, so that figure
+  cannot read as all that leaves. When it states no amount and the user pays it
+  none of its input token, as when the router pays it, that step takes none of
+  that token from the user's wallet and never gets them, with a permit or
+  without. They come in step order, the step that sets the input side first when
+  it has them: `Moved from the sender`, its amount, worded as the `Amount` line
+  words one, or `Unknown (could not be decoded)` when the decoder does not know
+  it; `Token moved`, giving the token's address as the `Token In` line does; and
   `Moved to`, which reads `The swap step that spends it`. A token the decoder
   does not know gives the `Moved from the sender` line alone. A step may also
   take from the user's wallet what the decoder did not read: a V4 step whose
@@ -3269,24 +3276,19 @@ Currently supported:
   on every router but `UniversalRouterV1`, and otherwise gives the address. A
   move into the router needs none of them, because its `Paid to` line and
   `Token moved into the router` line already give the amount, the token and
-  where it goes, and so its amount is shown once. A `PERMIT2_PERMIT` after the
-  step that sets the input side names neither `Token In` nor the `Amount`
-  figure, which keep that step's token and the total: a V3 exact-in of 600 USDT
-  followed by a permit of 5,000 DAI reads `Swap USDT → USDC` with
-  `Amount 600.0000 USDT`. Every `PERMIT2_PERMIT` whose amount does not stand as
-  the `Amount` figure, before the step that sets the input side or after it,
-  gives three lines, in step order, after those for each
+  where it goes, and so its amount is shown once. Every `PERMIT2_PERMIT` whose
+  amount does not stand as the `Amount` figure, before the step that sets the
+  input side or after it, gives three lines, in step order, after those for each
   `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
   `5000.0000 DAI`, or `Unlimited` for Permit2's maximum; `Allowance token`,
   giving the token's address as the `Token In` line does; and
-  `Allowance spender`, the address it lets take the token. So does one whose
-  spender is not the router, or that the router may let fail. Only a permit
-  whose amount stands gives none: the `Amount` line gives its amount, `Token In`
-  its token, and its spender is the router. These lines change neither the
-  `Paid to` lines nor the minimum's label. A step goes unread when its recipient
-  does not decode as an address, when it is a V3 swap step whose path is shorter
-  than one token address or has bytes after its last hop, or when it is a
-  command the decoder does not read: every command other than `PERMIT2_PERMIT`,
+  `Allowance spender`, the address it lets take the token. Only a permit whose
+  amount stands gives none: the `Amount` line gives its amount, `Token In` its
+  token, and its spender is the router. These lines change neither the `Paid to`
+  lines nor the minimum's label. A step goes unread when its recipient does not
+  decode as an address, when it is a V3 swap step whose path is shorter than one
+  token address or has bytes after its last hop, or when it is a command the
+  decoder does not read: every command other than `PERMIT2_PERMIT`,
   `PERMIT2_TRANSFER_FROM`, `V2_SWAP_EXACT_IN`, `V2_SWAP_EXACT_OUT`,
   `V3_SWAP_EXACT_IN`, `V3_SWAP_EXACT_OUT`, `V4_SWAP`, `SWEEP`, `TRANSFER`,
   `PAY_PORTION`, `PAY_PORTION_FULL_PRECISION`, `ACROSS_V4_DEPOSIT_V3`,

src/background/index.js

@@ -1379,6 +1379,13 @@ const RECENT_BALANCE_REFRESH_MS = Math.floor(BALANCE_REFRESH_PERIOD_MS / 2);
 // balances that came back — by address, onto whatever storage holds NOW.
 // Applying by address rather than writing the array back is what keeps a
 // wallet or address added, renamed or deleted during the round trip.
+//
+// Nothing is applied when the network stored NOW is not the one the refresh
+// ran on. A network switch during the round trip cleared every address's
+// balances (applyChainSwitchFields()), and the previous network's must not come
+// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577).
+// lastBalanceRefresh is left as the switch set it, so the next tick refreshes
+// the new network.
 async function backgroundRefresh() {
     const s = await getState();
     const now = Date.now();
@@ -1402,6 +1409,7 @@ async function backgroundRefresh() {
     }
 
     await updateState((fresh) => {
+        if (fresh.networkId !== s.networkId) return;
         for (const wallet of fresh.wallets) {
             for (const addr of wallet.addresses || []) {
                 const got = refreshed.get(String(addr.address).toLowerCase());

src/popup/index.js

@@ -68,23 +68,54 @@ let refreshInFlight = false;
 // the recovery screen: there is no profile left to refresh.
 let refreshTimer = null;
 
+// The refresh writes into a copy of the wallets. Inside the save, under the
+// lock, its results are copied onto the address records in `state` only if the
+// network it ran on is still the active one, on this page and in the stored
+// record; the background's switch, after the user approves a site's request,
+// changes only the stored record. A switch while the refresh ran cleared every
+// address's balances (applyChainSwitchFields() in
+// src/shared/chainSwitchFields.js), and the previous network's must not come
+// back over them (https://git.eeqj.de/sneak/AutistMask/issues/577). A dropped
+// refresh is not recorded as done. Results are copied by address, so an address
+// added or removed meanwhile is left as it is.
 async function doRefreshAndRender() {
     if (refreshInFlight) return;
     refreshInFlight = true;
     try {
+        const networkId = state.networkId;
+        const wallets = structuredClone(state.wallets);
         await Promise.all([
             refreshPrices(),
             refreshBalances(
-                state.wallets,
+                wallets,
                 state.rpcUrl,
                 state.blockscoutUrl,
                 state.trackedTokens,
-                state.networkId,
+                networkId,
                 pageClosed.signal,
             ),
         ]);
-        state.lastBalanceRefresh = Date.now();
-        await saveState();
+        const refreshed = new Map();
+        for (const wallet of wallets) {
+            for (const addr of wallet.addresses) {
+                refreshed.set(addr.address, addr);
+            }
+        }
+        await saveState((stored) => {
+            if (state.networkId !== networkId) return false;
+            if (stored.networkId !== networkId) return false;
+            for (const wallet of state.wallets) {
+                for (const addr of wallet.addresses) {
+                    const got = refreshed.get(addr.address);
+                    if (!got) continue;
+                    for (const key of ["balance", "ensName", "tokenBalances"]) {
+                        if (got[key] !== undefined) addr[key] = got[key];
+                    }
+                }
+            }
+            state.lastBalanceRefresh = Date.now();
+            return true;
+        });
         renderWalletList();
     } catch (e) {
         // Every call site fires this and walks away — the boot below, the ten

src/shared/state.js

@@ -467,11 +467,7 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // (caught by tests/txStatus.test.js). A page's live picture of a field it
 // does not own goes on being whatever its last loadState() saw, same as
 // before this fix; only the persisted record is guaranteed current.
-async function saveStateOnce() {
-    // A copy, so what this save compares and writes is the page's state as it
-    // stood when the save began. A change made while it waits on storage is
-    // left for the next save, which compares against this copy.
-    const current = structuredClone(snapshotPersisted());
+async function saveStateOnce(beforeWrite) {
     const result = await storageGet("autistmask");
     // The record in storage right now is about to be merged into and written
     // back, so it is validated exactly like a load validates it. Without this,
@@ -485,6 +481,12 @@ async function saveStateOnce() {
     // come from storage in its loaded (self-healed) shape. See
     // normalizePersisted() in persistedState.js.
     const fresh = normalizePersisted(result.autistmask);
+    if (beforeWrite && beforeWrite(fresh) === false) return;
+
+    // A copy, so what this save compares and writes is the page's state as it
+    // stood once the stored record was read. A change made while it waits on
+    // the write is left for the next save, which compares against this copy.
+    const current = structuredClone(snapshotPersisted());
 
     const merged = { ...fresh };
     for (const key of PERSISTED_FIELDS) {
@@ -579,10 +581,15 @@ function reportSaveFailure(err) {
 // The same lock orders this page's own saves. showView() calls saveState() on
 // every navigation without awaiting it, so two saves from one page can be
 // asked for at once; they take the lock in the order they were asked, and each
-// compares the page's state as it stands when its turn begins against the
-// baseline the save before it left.
-function saveState() {
-    const turn = withLock("autistmask", saveStateOnce);
+// compares the page's state, as it stands once the stored record has been read
+// and `beforeWrite` has run, against the baseline the save before it left.
+//
+// `beforeWrite`, when given, is called inside the lock with the stored record
+// as just read, before this page's state is compared against it. It may change
+// `state`, and this save writes that change. When it returns false, nothing is
+// written; any other return lets the save go ahead.
+function saveState(beforeWrite) {
+    const turn = withLock("autistmask", () => saveStateOnce(beforeWrite));
     // Every failed save is reported, whether or not the caller awaited this
     // one. The returned promise still rejects, so a caller that DOES await
     // keeps its own error handling.

src/shared/uniswap.js

@@ -1274,8 +1274,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // when no earlier hop set it. A half the establishing hop did not
         // state stays null and the line says so, rather than being filled in
         // from a different hop. A PERMIT2_PERMIT sets no side here: after the
-        // loop, the last one read before a step set the input side names
-        // Token In, and the Amount line is formed there, in one place (see
+        // loop, one whose amount stands as the Amount figure names Token In,
+        // and the Amount line is formed there, in one place (see
         // permitStands).
         const setInput = (token, amount) => {
             inputToken = present(token) ? token : null;
@@ -1477,9 +1477,12 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     } else {
                         stepsUnread.push(i);
                     }
-                    // After a step set the input side, a permit names
-                    // neither Token In nor the Amount figure: the swap's own
-                    // input token and amount stay on those lines.
+                    // Only a permit whose amount stands as the Amount figure
+                    // names Token In (see permitStands). Every other permit,
+                    // before the step that sets the input side or after it,
+                    // leaves Token In and Amount as they read without it and
+                    // gets lines of its own. One after a step set the input
+                    // side never stands, so only one before it is kept here.
                     if (p && !inputEstablished) {
                         // Whether a step before it took its token, or may
                         // have: one in `userPaid`, when its token is the
@@ -1952,22 +1955,21 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // lines of its own. One whose amount is not known also leaves the
         // total unknown, with no figure.
         //
-        // The last PERMIT2_PERMIT read before a step set the input side names
-        // Token In. Its amount stands as the Amount figure in place of the
-        // total only in the plain shape of Uniswap's own routes: it is the
-        // only PERMIT2_PERMIT in the transaction, its spender is the router,
-        // the router may not let it fail, no step before it took its token or
-        // one not known, and this decoder read every step after it in full
-        // (see stepsUnread). Permit2 then lets the router take no more of the
-        // token than that amount, so the permit covers every take of it. A
-        // later step this decoder did not read may raise what Permit2 lets
-        // the router take, as a PERMIT2_PERMIT_BATCH can. A step that may
-        // take from the sender what this decoder did not read leaves no
-        // figure, permit or not (see spentUnread()), and an EXECUTE_SUB_PLAN
-        // step leaves both sides unknown (below). A PERMIT2_PERMIT after a
-        // step set the input side counts among the PERMIT2_PERMITs here.
-        // Every PERMIT2_PERMIT but one whose amount stands gets lines of its
-        // own below.
+        // A PERMIT2_PERMIT names Token In only when its amount stands as the
+        // Amount figure in place of the total, which it does only in the
+        // plain shape of Uniswap's own routes: it comes before the step that
+        // set the input side, it is the only PERMIT2_PERMIT in the
+        // transaction, its spender is the router, the router may not let it
+        // fail, no step before it took its token or one not known, and this
+        // decoder read every step after it in full (see stepsUnread). Permit2
+        // then lets the router take no more of the token than that amount, so
+        // the permit covers every take of it. A later step this decoder did
+        // not read may raise what Permit2 lets the router take, as a
+        // PERMIT2_PERMIT_BATCH can. Every other PERMIT2_PERMIT leaves Token In
+        // and the Amount line as they read without it, and gets lines of its
+        // own below. A step that may take from the sender what this decoder
+        // did not read leaves no figure, permit or not (see spentUnread()),
+        // and an EXECUTE_SUB_PLAN step leaves both sides unknown (below).
         const stepCommands = Array.from(
             commandsBytes,
             (b) => commands[b & commandTypeMask],
@@ -1994,17 +1996,17 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // The take of the step that set the input side, when the total
         // starts from it and it stated no amount (see below), or null.
         let firstTakeUnstated = null;
-        if (permit === null || sameAddress(inputToken, permit.token)) {
+        if (!permitStands || sameAddress(inputToken, permit.token)) {
             total = inputAmount;
             if (hasFirstTake && !present(inputAmount)) {
                 firstTakeUnstated = { token: inputToken, amount: null };
             }
         } else if (hasFirstTake) {
             // The step that set the input side spent a token other than the
-            // permit's, or one not known, so the total starts with no figure.
+            // permit's, or one not known, so its amount gets lines of its own.
             spentFromSender.push({ token: inputToken, amount: inputAmount });
         }
-        if (permit !== null) inputToken = permit.token;
+        if (permitStands) inputToken = permit.token;
         for (const t of userPaid) {
             const ofTokenIn = sameAddress(t.token, inputToken);
             if (ofTokenIn && permitStands) continue;

tests/backgroundStateIsolation.test.js

@@ -19,7 +19,10 @@
 //     that followed persisted the pre-refresh values — while still stamping
 //     lastBalanceRefresh, suppressing the redo.
 //
-// Both use the real persistence path over a cloning storage stub. Nothing here
+// A network switch landing inside a balance refresh's round trip is covered at
+// the end (https://git.eeqj.de/sneak/AutistMask/issues/577).
+//
+// All use the real persistence path over a cloning storage stub. Nothing here
 // asserts the absence of a loadState() call; each asserts the OUTCOME, so it
 // holds against any implementation that gets the outcome right.
 
@@ -395,3 +398,48 @@ describe("a balance refresh under another handler's state read", () => {
         expect(after.wallets[0].addresses[0].balance).toBe(REFRESHED_BALANCE);
     });
 });
+
+describe("a balance refresh under a network switch", () => {
+    // https://git.eeqj.de/sneak/AutistMask/issues/577. The switch clears every
+    // address's balances, and a refresh that started on the previous network
+    // must not write that network's back over them when it returns. The same
+    // refresh in the popup is in tests/balanceRefreshNetworkSwitch.test.js.
+    test("a refresh that returns after a switch writes nothing, and the next one runs on the new network", async () => {
+        const roundTrip = deferred();
+        const reachedNetwork = deferred();
+        const ranOn = [];
+
+        const bg = loadWorker("sepolia", {
+            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
+                ranOn.push(id);
+                reachedNetwork.resolve();
+                await roundTrip.promise;
+                wallets[0].addresses[0].balance = REFRESHED_BALANCE;
+            },
+        });
+
+        const refresh = bg.fireBalanceAlarm();
+        await reachedNetwork.promise;
+
+        // The user switches to Ethereum Mainnet in Settings while the round
+        // trip is out.
+        const during = bg.persisted();
+        applyChainSwitchFields(during, MAINNET.id);
+        global.chrome.storage.write("autistmask", during);
+
+        roundTrip.resolve();
+        await refresh;
+
+        const after = bg.persisted();
+        expect(after.networkId).toBe("mainnet");
+        expect(after.wallets[0].addresses[0].balance).toBe("0");
+        expect(after.lastBalanceRefresh).toBe(0);
+
+        await bg.fireBalanceAlarm();
+
+        expect(ranOn).toEqual(["sepolia", "mainnet"]);
+        expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
+            REFRESHED_BALANCE,
+        );
+    });
+});

tests/balanceRefreshNetworkSwitch.test.js

@@ -0,0 +1,160 @@
+// A balance refresh the popup started on one network, and that returns after
+// the network was switched to another, writes nothing: the switch cleared every
+// address's balances, and the previous network's must not come back over them
+// (https://git.eeqj.de/sneak/AutistMask/issues/577). The switch is made either
+// by the user in this popup's Settings, or by the background after the user
+// approved a site's request, which changes only the stored record. Driven
+// through the real popup over a stored profile on Ethereum Mainnet. The same
+// refresh in the background is in tests/backgroundStateIsolation.test.js.
+
+const {
+    bootPopup,
+    cleanupPopup,
+    unversionedValidProfile,
+    TOKEN_ADDRESS,
+} = require("./support/popupBoot");
+const { applyChainSwitchFields } = require("../src/shared/chainSwitchFields");
+
+afterEach(() => {
+    cleanupPopup();
+});
+
+// Starts the ten-second refresh and holds it open. The balance stand-in writes
+// Ethereum Mainnet's balances in place, on the records handed in, as the real
+// refreshBalances() does, once the returned function is called. Resolves with
+// that function and the refresh still running.
+async function holdRefresh(page) {
+    const { refreshBalances } = require("../src/shared/balances");
+    let answer;
+    refreshBalances.mockImplementationOnce(async (wallets) => {
+        await new Promise((resolve) => {
+            answer = resolve;
+        });
+        wallets[0].addresses[0].balance = "7.0";
+        wallets[0].addresses[0].tokenBalances = [
+            {
+                address: TOKEN_ADDRESS,
+                name: "Test Token",
+                symbol: "TST",
+                decimals: 18,
+                balance: "5.0",
+                holders: null,
+            },
+        ];
+    });
+    const ticking = page.tick();
+    await page.settle();
+    return {
+        finish: async () => {
+            answer();
+            await ticking;
+        },
+    };
+}
+
+// Picks `networkId` in the Settings network selector, as the user does.
+async function chooseNetwork(page, networkId) {
+    const select = page.node("settings-network");
+    select.value = networkId;
+    for (const fn of select.listeners.change) await fn();
+    await page.settle();
+}
+
+// The stored record holds none of Ethereum Mainnet's balances, and no refresh
+// recorded as done.
+function expectNothingStored(page) {
+    const stored = page.storage.read("autistmask");
+    expect(stored.networkId).toBe("sepolia");
+    expect(stored.wallets[0].addresses[0].balance).toBe("0");
+    expect(stored.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expect(stored.lastBalanceRefresh).toBe(0);
+}
+
+test("a refresh that returns after a switch in Settings writes nothing, and the next one runs on the new network", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { refreshBalances } = require("../src/shared/balances");
+    const { state } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    await page.click("btn-settings");
+    await chooseNetwork(page, "sepolia");
+    await refresh.finish();
+
+    expect(state.wallets[0].addresses[0].balance).toBe("0");
+    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expectNothingStored(page);
+
+    await page.click("btn-settings-back");
+    expect(page.visibleViews()).toEqual(["main"]);
+    expect(page.text("total-value")).toBe("0.0000 SepoliaETH");
+
+    await page.tick();
+
+    expect(refreshBalances.mock.lastCall[4]).toBe("sepolia");
+    expect(page.storage.read("autistmask").lastBalanceRefresh).toBeGreaterThan(
+        0,
+    );
+});
+
+// The stored record still holds Ethereum Mainnet while the refresh's save reads
+// it, so only this page's own network shows the switch.
+test("a refresh whose save is reading the stored record when the user switches in Settings writes nothing", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { state } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    await page.click("btn-settings");
+
+    // The next read of the stored record, the refresh's save's, is held.
+    const get = page.storage.local.get;
+    const read = get.getMockImplementation();
+    let releaseRead;
+    get.mockImplementationOnce(async (key) => {
+        await new Promise((resolve) => {
+            releaseRead = resolve;
+        });
+        return read(key);
+    });
+    const finishing = refresh.finish();
+    await page.settle();
+
+    // The user picks Sepolia meanwhile; the switch's own save waits for the
+    // refresh's save to let the lock go.
+    const select = page.node("settings-network");
+    select.value = "sepolia";
+    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
+    await page.settle();
+
+    releaseRead();
+    await finishing;
+    await switching;
+    await page.settle();
+
+    expect(state.networkId).toBe("sepolia");
+    expect(state.wallets[0].addresses[0].balance).toBe("0");
+    expect(state.wallets[0].addresses[0].tokenBalances).toEqual([]);
+    expectNothingStored(page);
+});
+
+test("a refresh that returns after the background switched the network writes nothing", async () => {
+    const page = await bootPopup(unversionedValidProfile());
+    expect(page.pageErrors).toEqual([]);
+    const { saveState } = require("../src/shared/state");
+
+    const refresh = await holdRefresh(page);
+    // The background writes the switch to Sepolia, as its updateState() does
+    // once the user approves a site's request. This page is not told.
+    const record = page.storage.read("autistmask");
+    applyChainSwitchFields(record, "sepolia");
+    page.storage.write("autistmask", record);
+    await refresh.finish();
+
+    expectNothingStored(page);
+
+    // Nor does a later save by this page, such as every navigation makes.
+    await saveState();
+
+    expectNothingStored(page);
+});

tests/uniswap.test.js

@@ -2261,10 +2261,10 @@ describe("uniswap decoder", () => {
         // https://git.eeqj.de/sneak/AutistMask/issues/370 — a PERMIT2_PERMIT
         // after the step that set the input side named Token In in place of
         // that step's token, and its amount could stand as the Amount figure.
-        // The swap's own token and amount now stay on those lines. That
-        // permit, and every other whose amount does not stand as the Amount
-        // figure, gets lines of its own; a permit before the swap steps still
-        // names Token In.
+        // Only a permit whose amount stands as the Amount figure names Token
+        // In now. Every other, before the swap steps or after them, leaves
+        // Token In and Amount as they read without it and gets lines of its
+        // own.
         describe("a PERMIT2_PERMIT whose amount does not stand as the Amount figure", () => {
             const DAI_5000 = 5000000000000000000000n;
             const USDT_5000 = 5000000000n;
@@ -2336,8 +2336,40 @@ describe("uniswap decoder", () => {
                         ROUTER_ADDR,
                     ),
                 },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 DAI to another spender, then a V3 exact-in of 600 USDT,",
+                    commands: [0x0a, 0x00],
+                    inputs: [
+                        encodePermit2(DAI_ADDR, DAI_5000, OTHER_ADDR),
+                        V3_600,
+                    ],
+                    lines: permitLines(
+                        "5000.0000 DAI",
+                        DAI_ADDR,
+                        "DAI",
+                        OTHER_ADDR,
+                    ),
+                },
+                {
+                    kind: "a PERMIT2_PERMIT of 5,000 DAI to the router, a V3 exact-in of 600 USDT, then a PERMIT2_PERMIT of 600 USDT to the router,",
+                    commands: [0x0a, 0x00, 0x0a],
+                    inputs: [
+                        encodePermit2(DAI_ADDR, DAI_5000, ROUTER_ADDR),
+                        V3_600,
+                        encodePermit2(USDT_ADDR, USDT_600, ROUTER_ADDR),
+                    ],
+                    lines: [
+                        ...permitLines(
+                            "5000.0000 DAI",
+                            DAI_ADDR,
+                            "DAI",
+                            ROUTER_ADDR,
+                        ),
+                        ...USDT_600_LINES,
+                    ],
+                },
             ])(
-                "$kind shows the swap's 600 USDT and the permit's own lines",
+                "$kind shows the swap's 600 USDT and each permit's own lines",
                 ({ commands, inputs, lines }) => {
                     const result = decodeSteps(commands, inputs);
                     expect(result.name).toBe("Swap USDT → USDC");
@@ -2352,8 +2384,7 @@ describe("uniswap decoder", () => {
                 },
             );
 
-            // The permit before the swap steps still names Token In. With a
-            // second permit its amount does not stand, so the Amount line
+            // With two permits neither amount stands, so the Amount line
             // gives the total the steps take of USDT, the 400 DAI the last
             // step takes gets lines of its own, and so does each permit.
             test("a PERMIT2_PERMIT of USDT, a V3 exact-in of 600 USDT, a PERMIT2_PERMIT of DAI and a V2 exact-in of 400 DAI shows both tokens' amounts and each permit's own lines", () => {

tests/uniswapRecipient.test.js

@@ -2827,7 +2827,8 @@ describe("the allow-revert flag", () => {
             // The permit names the router at ROUTER as its spender, so its
             // amount stands as the Amount figure only there, and only without
             // the flag. With the flag it stands on no router and gets lines
-            // of its own.
+            // of its own, and the swap step names Token In: the same token,
+            // its address in lowercase.
             const permitLines = [
                 "Permit2 allowance",
                 "Allowance token",
@@ -2836,9 +2837,14 @@ describe("the allow-revert flag", () => {
             const swapLines = (r) =>
                 r.details.filter(
                     (d) =>
-                        d.label !== "Steps" && !permitLines.includes(d.label),
+                        !["Steps", "Token In", ...permitLines].includes(
+                            d.label,
+                        ),
                 );
             expect(swapLines(withFlag)).toEqual(swapLines(plain));
+            expect(detail(withFlag, "Token In").address.toLowerCase()).toBe(
+                detail(plain, "Token In").address.toLowerCase(),
+            );
             expect(
                 labels(withFlag).filter((l) => permitLines.includes(l)),
             ).toEqual(permitLines);