refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)

Every call site that touched `browser.*` or `chrome.*` now goes through
`src/shared/browserApi.js`, the only file in the tree that names either.
It exposes lazily-resolved namespace handles for events and synchronous
methods, and promise-returning wrappers for everything that is
callback-shaped on Chrome. Callers await; `runtime.lastError` is gone,
folded into the rejection the wrapper produces on the Chrome path.

`storageGet()` and `storageSet()` reject where `storage.local` is
absent. They carry the wallet: resolving `{}` would make an existing
wallet read back as no wallet, and a no-op write would discard the
user's state with nothing logged. The one caller that genuinely
degrades, `src/shared/phishingDomains.js`, takes `storageLocal()`
directly and keeps its own null check.

The Firefox suite gains the four dApp round trips the issue's definition
of done asks for — `eth_requestAccounts`, `personal_sign`,
`eth_sendTransaction`, and a closed approval window rejecting with
EIP-1193 4001 — driven through the real content script, background page
and approval windows. `--network none` was thought to rule that out
because it leaves no `http://` origin to inject into; loopback survives
it, so the page and a JSON-RPC node are served from 127.0.0.1 inside the
container and the run still reaches nothing but itself.

That harness refutes the premise it was built to verify. On Firefox
153.0.3, `browser.*` honours a trailing Chrome-style callback and does
populate `runtime.lastError`, both measured directly, and all four flows
pass against the unconverted code. So this is a uniformity and coverage
change, not a repair of a broken target; the PR records the measurement
in full, and the comments in `browserApi.js` and the Firefox suite say
that rather than the refuted claim.

An unhandled promise rejection fails a run on both harnesses, measured
by throwing past the first await of the unawaited `approval.show()`:
Firefox reports it from the console-service drain and Chrome as a
`pageerror`. README.md records the demonstration.

One real defect is fixed on the way past: the window id written back
into a pending approval after `windows.create()` was unguarded, so an
approval settled during the open — an address switch will do it —
dereferenced a deleted entry.

README.md

@@ -185,17 +185,14 @@ to the background — with the message that would carry it required to be presen
 so that check cannot pass by observing nothing. That last one is the standing
 floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
-Three limits of that coverage, none of them papered over. The RPC is stubbed
+Two limits of that coverage, neither of them papered over. The RPC is stubbed
 throughout, so this is **not** a real dApp against a real network with real
 funds; that remains a human pass before 1.0.0. The site-connection prompt is
 raised through `chrome.action.openPopup()`, and headless Chromium's
 browser-action popup is not a page Playwright can see or click, so that one
 prompt is driven at the URL the extension itself puts on the action — the same
 page and the same approval id, but whether a real toolbar click shows it is not
-observable here. And the EIP-1193 error code does not survive the last hop: the
-rejection that crosses the boundary carries code 4001 and is asserted to, but
-`src/content/inpage.js` rebuilds it as `new Error(message)`, so the calling page
-catches an error with no `code` property.
+observable here.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -283,6 +280,15 @@ throw inside one and watched it fail the run, so it remains an expectation
 rather than a demonstrated fact. Errors from add-on install and background
 startup are folded into step 1 rather than discarded.
 
+An **unhandled promise rejection counts as an uncaught error** on both suites,
+which matters because a good deal of popup code is now `async` and called
+without an `await`. Demonstrated, not assumed: a `throw` placed past the first
+`await` of `approval.show()` — which nothing awaits — turns the
+`eth_requestAccounts` step red on Firefox
+(`uncaught extension errors during this step`, from the console-service drain)
+and on Chrome (`pageerror`), with the rest of the run unaffected because the
+approval view had already rendered.
+
 One error is tolerated rather than fatal, listed in `ALLOWED_ERRORS` in
 `tests/e2e/firefox/run.js` with the issue that will delete it, and printed on
 every occurrence so the concession stays visible in the run output. It is
@@ -658,6 +664,21 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 
+A reopened popup renders the wallet list and the one screen it restores onto,
+and nothing else, so every screen on the stack behind that one is still the
+blank template from `index.html`. "Back" therefore renders its target rather
+than only unhiding it, through the same dispatch and data guards as the restore
+(`src/popup/viewRouter.js`), and falls back to Home when the state the target
+would render is gone.
+
+It renders only a screen this page load has not rendered yet. Forward navigation
+renders as it goes, and `viewRouter.js` records every screen that reaches
+`showView()`, so "Back" onto a screen already on the page unhides it and nothing
+more — rendering it a second time would re-fetch and overwrite what it holds,
+such as an edit typed into Settings and not yet saved. Home is the one screen
+"Back" always re-renders, so the wallet list reflects anything that changed
+while the user was away from it.
+
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret

TODO.md

@@ -45,7 +45,7 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-12: One shared extension-API module,
+- 2026-08-17: One shared extension-API module,
   [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
   the tree that names `browser` or `chrome`. Every call site returns a promise;
   `runtime.lastError` is gone. The same commit gives the Firefox suite the four
@@ -57,7 +57,21 @@ undefined identifiers, which is how
   harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
   populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
   all four flows pass against the unconverted code. What landed is a uniformity
-  and coverage change, not a repair of a broken target.
+  and coverage change, not a repair of a broken target. `storageGet()` and
+  `storageSet()` **reject** where `storage.local` is absent rather than
+  resolving `{}` and a no-op write — they carry the wallet, and defaulting would
+  read an existing wallet back as none. The one caller that genuinely degrades,
+  [`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), takes
+  `storageLocal()` directly and keeps its own null check.
+- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
+  have. The End-to-End Tests section listed the EIP-1193 code being dropped in
+  the last hop into the page as a standing limit of the dApp coverage; that
+  stopped being true when
+  [#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
+  touch the README. The paragraph is deleted and the two remaining limits — the
+  stubbed RPC and the unobservable toolbar popup — were checked against the
+  current `src/content/inpage.js` and `tests/e2e/` and left as they are
+  ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the
@@ -72,6 +86,23 @@ undefined identifiers, which is how
   `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
   now requires it on the page's Error as well as on the wire, for all four
   rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
+- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
+  it. A reopened popup renders the wallet list and the one screen it restores
+  onto, so every screen further down the stack was still the blank template from
+  `index.html`, and Back walked straight onto it — an empty address, no
+  balances, no QR code. The Back path now goes through the same per-view
+  dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
+  with `restoreView()`), falling back to Home when the state the target would
+  render is gone. It renders only a view this page load has not rendered yet:
+  `viewRouter.js` records every view that reaches `showView()`, which is where
+  forward navigation and the restore both end, so Back onto a view already on
+  the page unhides it and nothing more. That is what keeps a second render from
+  re-fetching and overwriting what the view holds — an unsaved edit in Settings,
+  a transaction list already loaded. Home is the exception and is always
+  re-rendered, as it was before. Covered by unit tests on the real `goBack()`
+  and by three end-to-end cases against the real popup, each demonstrated
+  failing on the unfixed build
+  ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
   that bear it, not to one of them. A ticker is not unique: seven of the 512
   bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —

src/popup/index.js

@@ -9,16 +9,17 @@ const {
     $,
     showView,
     updateDebugBanner,
-    setRenderMain,
+    setBackRenderer,
     pushCurrentView,
     goBack,
     clearViewStack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-// Views that can be fully re-rendered from persisted state. All others fall
-// back to the nearest restorable parent; see the module for why the
-// secret-bearing views are absent.
-const { RESTORABLE_VIEWS } = require("./restorableViews");
+// Renders a view the popup lands on without having navigated to it forward:
+// on restore here, and on Back. Only the views that can be fully re-rendered
+// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
+// through it; anything else falls back to the nearest restorable parent.
+const { renderView, makeBackRenderer } = require("./viewRouter");
 
 const home = require("./views/home");
 const welcome = require("./views/welcome");
@@ -108,92 +109,23 @@ const ctx = {
     },
 };
 
-function needsAddress(view) {
-    return (
-        view === "address" ||
-        view === "address-token" ||
-        view === "receive" ||
-        view === "transaction"
-    );
-}
-
-function hasValidAddress() {
-    return (
-        state.selectedWallet !== null &&
-        state.selectedAddress !== null &&
-        state.wallets[state.selectedWallet] &&
-        state.wallets[state.selectedWallet].addresses[state.selectedAddress]
-    );
-}
+// The view modules the router renders through, keyed as it expects them.
+const viewModules = {
+    main: { show: () => fallbackView() },
+    addressDetail,
+    addressToken,
+    receive,
+    settings,
+    settingsAddToken,
+    confirmTx,
+    transactionDetail,
+    txStatus,
+};
 
 function restoreView() {
-    const view = state.currentView;
-    if (!view || !RESTORABLE_VIEWS.has(view)) {
-        return fallbackView();
-    }
-
-    if (needsAddress(view) && !hasValidAddress()) {
-        return fallbackView();
-    }
-
-    if (view === "address-token" && !state.selectedToken) {
-        return fallbackView();
-    }
-
-    switch (view) {
-        case "address":
-            addressDetail.show();
-            break;
-        case "address-token":
-            addressToken.show();
-            break;
-        case "receive":
-            receive.show();
-            break;
-        case "settings":
-            settings.show();
-            break;
-        case "settings-addtoken":
-            settingsAddToken.show();
-            break;
-        case "confirm-tx":
-            if (state.viewData && state.viewData.pendingTx) {
-                confirmTx.restore();
-            } else {
+    if (!renderView(state.currentView, state, viewModules)) {
         fallbackView();
     }
-            break;
-        case "transaction":
-            if (state.viewData && state.viewData.tx) {
-                transactionDetail.render();
-            } else {
-                fallbackView();
-            }
-            break;
-        case "wait-tx":
-            // Resumes the receipt poll from the persisted broadcast time.
-            if (!txStatus.restoreWait()) {
-                fallbackView();
-            }
-            break;
-        case "success-tx":
-            if (state.viewData && state.viewData.hash) {
-                txStatus.renderSuccess();
-            } else {
-                fallbackView();
-            }
-            break;
-        case "error-tx":
-            if (state.viewData && state.viewData.message) {
-                txStatus.renderError();
-            } else {
-                fallbackView();
-            }
-            break;
-        default:
-            fallbackView();
-            break;
-    }
 }
 
 function fallbackView() {
@@ -229,6 +161,12 @@ async function init() {
     const params = new URLSearchParams(window.location.search);
     const approvalId = params.get("approval");
     if (approvalId) {
+        // Deliberately not awaited, and deliberately not .catch()ed. show()
+        // is async, so a throw past its first await surfaces as an unhandled
+        // rejection rather than an uncaught error — measured as still failing
+        // the run on both harnesses (Playwright `pageerror`, and the Firefox
+        // driver's console-service drain), so nothing is lost by leaving it
+        // on that path.
         approval.show(approvalId);
         showView("approve-site");
         return;
@@ -247,7 +185,7 @@ async function init() {
         settings.show();
     });
 
-    setRenderMain(renderWalletList);
+    setBackRenderer(makeBackRenderer(state, viewModules));
 
     welcome.init(ctx);
     addWallet.init(ctx);

src/popup/viewRouter.js

@@ -0,0 +1,167 @@
+// Rendering a view the popup lands on without having navigated to it
+// forward: on restore, and on Back. In both cases the view may never have
+// been rendered in this page load — a reopened popup renders only the
+// wallet list and the view it restores onto, so every other view is still
+// the blank static template from index.html — so unhiding it is not enough.
+//
+// Forward navigation renders as it goes and must NOT come through here:
+// rendering a second time would re-fetch and clobber whatever the view has
+// in flight.
+//
+// The view modules are injected and nothing here touches the DOM, so the
+// dispatch and its data guards can be tested directly; src/popup/index.js
+// cannot be required outside a browser.
+
+const { RESTORABLE_VIEWS } = require("./restorableViews");
+
+// The views this page load has rendered.
+//
+// The Back path cannot otherwise tell its two cases apart. A view the popup
+// never rendered is still the blank template from index.html and has to be
+// rendered; a view already on the page must NOT be rendered again, because
+// a second render re-fetches and overwrites whatever the user has typed
+// into it and not yet saved.
+//
+// Registration is showView() in views/helpers.js, which is the last thing
+// every render path runs — restoreView()'s, the Back path's, and every
+// forward show(). That is the point of putting it there rather than in the
+// individual views: a view added later registers itself with no one having
+// to remember it, so this cannot decay.
+//
+// Module scope is page-load scope: the popup loads this module once per
+// page load, and a reopened popup gets a fresh, empty set — which is
+// exactly the state that makes the Back path render.
+const renderedViews = new Set();
+
+function markViewRendered(view) {
+    if (view) renderedViews.add(view);
+}
+
+// Begin a fresh page-load scope. The popup gets one by being loaded; the
+// unit tests, which simulate several page loads against one module
+// instance, ask for one.
+function resetRenderedViews() {
+    renderedViews.clear();
+}
+
+// Home is the exception: Back re-renders it every time, which is what the
+// popup did before this router existed (index.js registered
+// renderWalletList() as setRenderMain(), and goBack() called it on every
+// Back onto "main"). It must stay that way — the wallet list has to reflect
+// what changed while the user was away from it, such as a wallet renamed or
+// an address removed in Settings — and Home holds no unsaved input to lose.
+const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
+
+// Views that render an address the user picked and cannot be rendered
+// without one.
+const ADDRESS_VIEWS = new Set([
+    "address",
+    "address-token",
+    "receive",
+    "transaction",
+]);
+
+function needsAddress(view) {
+    return ADDRESS_VIEWS.has(view);
+}
+
+function hasValidAddress(state) {
+    return Boolean(
+        state.selectedWallet !== null &&
+        state.selectedAddress !== null &&
+        state.wallets[state.selectedWallet] &&
+        state.wallets[state.selectedWallet].addresses[state.selectedAddress],
+    );
+}
+
+// Render `view` from persisted state. Each view module shows itself, so a
+// true return means the view is both rendered and on screen.
+//
+// Returns false when the view is not one the popup renders from state, or
+// when the state it would render is gone — a token no longer selected, a
+// transaction no longer persisted. The caller falls back rather than
+// putting an empty template on screen.
+function renderView(view, state, views) {
+    if (!view || !RESTORABLE_VIEWS.has(view)) return false;
+    if (needsAddress(view) && !hasValidAddress(state)) return false;
+    if (view === "address-token" && !state.selectedToken) return false;
+
+    const data = state.viewData || {};
+    switch (view) {
+        case "main":
+            views.main.show();
+            return true;
+        case "address":
+            views.addressDetail.show();
+            return true;
+        case "address-token":
+            views.addressToken.show();
+            return true;
+        case "receive":
+            views.receive.show();
+            return true;
+        case "settings":
+            views.settings.show();
+            return true;
+        case "settings-addtoken":
+            views.settingsAddToken.show();
+            return true;
+        case "confirm-tx":
+            if (!data.pendingTx) return false;
+            views.confirmTx.restore();
+            return true;
+        case "transaction":
+            if (!data.tx) return false;
+            views.transactionDetail.render();
+            return true;
+        case "wait-tx":
+            // Resumes the receipt poll from the persisted broadcast time,
+            // and answers false when there is nothing resumable left.
+            return Boolean(views.txStatus.restoreWait());
+        case "success-tx":
+            if (!data.hash) return false;
+            views.txStatus.renderSuccess();
+            return true;
+        case "error-tx":
+            if (!data.message) return false;
+            views.txStatus.renderError();
+            return true;
+        default:
+            return false;
+    }
+}
+
+// The Back-path renderer, registered with setBackRenderer() in
+// views/helpers.js.
+//
+// Returns false — leaving goBack() to unhide the view, as it always did —
+// in the two cases where the view is known to be on the page already:
+//
+//   - It is not one the popup renders from persisted state. The restored
+//     stack is filtered against RESTORABLE_VIEWS, so such a view can only
+//     be on the stack from this page load, where forward navigation
+//     rendered it on the way in.
+//   - This page load has rendered it. Re-rendering would re-fetch and
+//     clobber what it holds; Home is rendered anyway, see above.
+//
+// What is left is the case the router exists for: a view on the stack that
+// this page load has never rendered, whose template is still blank.
+function makeBackRenderer(state, views) {
+    return function renderBack(view) {
+        if (!RESTORABLE_VIEWS.has(view)) return false;
+        if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
+            return false;
+        }
+        if (!renderView(view, state, views)) {
+            views.main.show();
+        }
+        return true;
+    };
+}
+
+module.exports = {
+    renderView,
+    makeBackRenderer,
+    markViewRendered,
+    resetRenderedViews,
+};

src/popup/views/helpers.js

@@ -7,6 +7,7 @@ const {
     getAddressValueUsd,
 } = require("../../shared/prices");
 const { state, saveState, currentNetwork } = require("../../shared/state");
+const { markViewRendered } = require("../viewRouter");
 
 // When views are added, removed, or transitions between them change,
 // update the view-navigation documentation in README.md to match.
@@ -76,6 +77,10 @@ function showView(name) {
     }
     clearFlash();
     state.currentView = name;
+    // A view's show() ends here, so this is where the Back path learns the
+    // view is no longer the blank template from index.html and must not be
+    // rendered a second time. See viewRouter.js.
+    markViewRendered(name);
     saveState();
     updateDebugBanner(name);
 }
@@ -111,12 +116,19 @@ function updateDebugBanner(viewName) {
     }
 }
 
-// Callback to re-render the main/home view when navigating back to it.
-// Set once by index.js via setRenderMain().
-let _renderMain = null;
+// Callback that renders a view being navigated BACK onto. Set once by
+// index.js via setBackRenderer(), which routes the view through the same
+// per-view render and data guards restoreView() uses.
+//
+// It answers true when it took the navigation — the view is rendered and
+// shown, or its backing data was gone and it fell back — and false for a
+// view the popup does not render from persisted state. Those can only be
+// on the stack from this page load, because the stack is filtered on load,
+// so they have already been rendered and only need unhiding.
+let _renderBack = null;
 
-function setRenderMain(fn) {
-    _renderMain = fn;
+function setBackRenderer(fn) {
+    _renderBack = fn;
 }
 
 // Push the current view onto the navigation stack so goBack() can
@@ -136,9 +148,11 @@ function goBack() {
     } else {
         target = "main";
     }
-    if (target === "main" && _renderMain) {
-        _renderMain();
-    }
+    // A popped view is landed on, not navigated to. If the popup has been
+    // closed and reopened since the view was pushed, nothing has ever
+    // rendered it in this page load and its template is still blank, so it
+    // has to be rendered here rather than merely unhidden.
+    if (_renderBack && _renderBack(target)) return;
     showView(target);
 }
 
@@ -470,7 +484,7 @@ module.exports = {
     showView,
     onViewLeave,
     updateDebugBanner,
-    setRenderMain,
+    setBackRenderer,
     pushCurrentView,
     goBack,
     clearViewStack,

src/shared/browserApi.js

@@ -1,28 +1,29 @@
 // The one place in this tree that names `browser` or `chrome`.
 //
-// The two targets do not agree on either the namespace or the call shape.
-// Chrome MV3 exposes `chrome.*`, where tabs, windows and messaging take a
-// trailing callback and report failure through the global
-// `chrome.runtime.lastError`. Firefox MV2 exposes `browser.*`, where those
-// same methods return promises and take no callback at all — a function
-// passed where an options argument is expected is simply never invoked, so
-// the call looks like it succeeded and silently never completes. Resolving
-// the namespace with a ternary and then calling it Chrome-style, which is
-// what this codebase used to do, is broken on Firefox in exactly that way:
-// see https://git.eeqj.de/sneak/AutistMask/issues/153.
+// The two targets do not agree on the namespace, and they disagree about the
+// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
+// where tabs, windows and messaging take a trailing callback and report
+// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
+// `browser.*`, where those same methods return promises — but, measured on
+// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
+// no promise when one is given, and populates `browser.runtime.lastError`.
+// The callback code that predated this module therefore ran on both, and
+// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
+// that it did not. This module exists for uniformity, not for repair: the
+// tree used to resolve the namespace with a ternary at six call sites and
+// then mix promise-form storage with callback-form messaging.
 //
-// The strategy is promises out, everywhere. Callers `await`; nothing outside
-// this file has to know which browser it is running on.
+// The strategy is promises out, everywhere: one namespace, one call shape,
+// composing with the `async` handlers in the background. Callers `await`;
+// nothing outside this file has to know which browser it is running on.
 //
 // Two deliberate asymmetries, because they are what the browsers actually do
 // rather than what a uniform-looking shim would pretend:
 //
 //  - Storage is called in its PROMISE form on both namespaces.
 //    `chrome.storage.local.get()` returns a promise on MV3 and the popup
-//    already depends on that — src/shared/state.js has always awaited it, and
-//    that is precisely why the Firefox popup flows work today while
-//    everything in the issue above does not. Wrapping it in a callback here
-//    would be a change, not a fix.
+//    already depends on that — src/shared/state.js has always awaited it.
+//    Wrapping it in a callback here would be a change, not a fix.
 //  - notify() sends without a callback. It is for a message whose answer
 //    nobody reads; appending a callback would only manufacture a
 //    lastError/rejection for a receiver that was never expected to reply.
@@ -80,17 +81,21 @@ function actionApi() {
     return api.action || api.browserAction || null;
 }
 
-// `storage.local`, or null in a context that has no storage permission. Null
-// rather than a throw because two callers degrade rather than fail on it.
+// `storage.local`, or null in a context that has no storage permission.
+//
+// Null rather than a throw for the one caller that genuinely degrades:
+// src/shared/phishingDomains.js falls back to its vendored blocklist and does
+// its own null check. Everything that reads or writes the wallet goes through
+// storageGet()/storageSet(), which reject instead — see there.
 function storageLocal() {
     const storage = namespaceMember("storage");
     return (storage && storage.local) || null;
 }
 
-// The Chrome-only error channel. Never populated for a `browser.*` call,
-// which is why the checks that used to guard callbacks in the background are
-// gone: on this side it becomes a rejection, and on the other side there was
-// never anything to read.
+// The callback-path error channel. Read only from inside an appended
+// callback, i.e. only on the `chrome.*` path, where it is the sole way a
+// failure is reported. The background's three explicit lastError checks are
+// gone because invoke() turns it into a rejection before any caller sees it.
 function lastError() {
     const runtime = runtimeApi();
     return (runtime && runtime.lastError) || null;
@@ -157,23 +162,35 @@ function notify(message) {
     if (result && typeof result.catch === "function") result.catch(() => {});
 }
 
+// These two carry the wallet. A missing `storage.local` has to reject and not
+// default: resolving {} would make an existing wallet read back as no wallet,
+// and resolving a no-op write would discard the user's state with nothing
+// logged. A caller that wants to degrade takes storageLocal() directly.
+function storageUnavailable(method) {
+    return Promise.reject(
+        new Error("extension storage.local is not available: " + method),
+    );
+}
+
 /**
  * @param {string|string[]|Object} keys
- * @returns {Promise<Object>} the stored items, or {} where storage is absent.
+ * @returns {Promise<Object>} the stored items.
+ * @throws rejects where `storage.local` is absent.
  */
 function storageGet(keys) {
     const storage = storageLocal();
-    if (!storage) return Promise.resolve({});
+    if (!storage) return storageUnavailable("get");
     return Promise.resolve(storage.get(keys));
 }
 
 /**
  * @param {Object} items
  * @returns {Promise<void>}
+ * @throws rejects where `storage.local` is absent.
  */
 function storageSet(items) {
     const storage = storageLocal();
-    if (!storage) return Promise.resolve();
+    if (!storage) return storageUnavailable("set");
     return Promise.resolve(storage.set(items));
 }
 

tests/backNavigation.test.js

@@ -0,0 +1,329 @@
+// Back after reopening the popup (#268).
+//
+// A reopened popup renders the wallet list and the one view it restores
+// onto; every other view is still the blank static template from
+// index.html. goBack() used to only unhide its target, so Back landed on
+// that blank template for any view the popup had not rendered in this page
+// load. These tests drive the real goBack() with the real router wired to
+// recording view modules, so what is asserted is which view render ran —
+// the thing that was missing.
+//
+// The rendering itself is asserted against the real popup in a real
+// browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
+// only needs showView() to work.
+
+const els = new Map();
+
+function fakeEl() {
+    return {
+        textContent: "",
+        innerHTML: "",
+        classList: {
+            toggle() {},
+            add() {},
+            remove() {},
+            contains: () => false,
+        },
+        remove() {},
+    };
+}
+
+globalThis.document = {
+    getElementById(id) {
+        if (!els.has(id)) els.set(id, fakeEl());
+        return els.get(id);
+    },
+};
+
+// helpers.js pulls in state.js, which reads chrome.storage.local at load.
+globalThis.chrome = {
+    storage: { local: { get: async () => ({}), set: async () => {} } },
+};
+
+const {
+    showView,
+    goBack,
+    setBackRenderer,
+    pushCurrentView,
+} = require("../src/popup/views/helpers");
+const {
+    makeBackRenderer,
+    markViewRendered,
+    resetRenderedViews,
+} = require("../src/popup/viewRouter");
+const { state } = require("../src/shared/state");
+
+const ADDRESS = "0x1111111111111111111111111111111111111111";
+const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
+
+let calls;
+
+// Stand-ins for the view modules. Each records itself and then shows its
+// view, which is what every real view render ends with — so the assertions
+// can tell "rendered and shown" apart from "merely unhidden".
+function recorder(name, view) {
+    return () => {
+        calls.push(name);
+        showView(view);
+    };
+}
+
+function makeViews() {
+    return {
+        main: { show: recorder("main", "main") },
+        addressDetail: { show: recorder("addressDetail", "address") },
+        addressToken: { show: recorder("addressToken", "address-token") },
+        receive: { show: recorder("receive", "receive") },
+        settings: { show: recorder("settings", "settings") },
+        settingsAddToken: {
+            show: recorder("settingsAddToken", "settings-addtoken"),
+        },
+        confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
+        transactionDetail: {
+            render: recorder("transactionDetail", "transaction"),
+        },
+        txStatus: {
+            restoreWait: () => {
+                calls.push("waitTx");
+                showView("wait-tx");
+                return true;
+            },
+            renderSuccess: recorder("successTx", "success-tx"),
+            renderError: recorder("errorTx", "error-tx"),
+        },
+    };
+}
+
+// The popup as it stands just after a reopen: one wallet with one address,
+// the view the popup restored onto, and the stack behind it.
+//
+// A reopen is a fresh page load, so the record of what has been rendered
+// starts empty — that emptiness is what makes the Back path render at all.
+// Returns the view modules so a test can drive forward navigation through
+// the same recorders the router renders through.
+function reopenedOn(view, stack, extra) {
+    calls = [];
+    resetRenderedViews();
+    state.wallets = [
+        {
+            name: "Wallet 1",
+            addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
+        },
+    ];
+    state.selectedWallet = 0;
+    state.selectedAddress = 0;
+    state.selectedToken = null;
+    state.viewData = null;
+    state.currentView = view;
+    state.viewStack = stack.slice();
+    Object.assign(state, extra || {});
+    // Restoring onto a view renders it, so the reopened popup has that one
+    // view on the page and nothing else.
+    markViewRendered(view);
+    const views = makeViews();
+    setBackRenderer(makeBackRenderer(state, views));
+    return views;
+}
+
+// The reproduction from the issue, step for step.
+describe("Back onto a view the reopened popup never rendered", () => {
+    test("Back from settings renders the address detail underneath", () => {
+        reopenedOn("settings", ["main", "address"]);
+        goBack();
+        expect(calls).toEqual(["addressDetail"]);
+        expect(state.currentView).toBe("address");
+        expect(state.viewStack).toEqual(["main"]);
+    });
+
+    test("Back onto the token detail renders it", () => {
+        reopenedOn("settings", ["main", "address", "address-token"], {
+            selectedToken: TOKEN,
+        });
+        goBack();
+        expect(calls).toEqual(["addressToken"]);
+        expect(state.currentView).toBe("address-token");
+    });
+
+    test("Back onto Receive renders it", () => {
+        reopenedOn("settings", ["main", "address", "receive"]);
+        goBack();
+        expect(calls).toEqual(["receive"]);
+        expect(state.currentView).toBe("receive");
+    });
+
+    test("Back onto the transaction detail renders it", () => {
+        reopenedOn("settings", ["main", "transaction"], {
+            viewData: { tx: { hash: "0xdead" } },
+        });
+        goBack();
+        expect(calls).toEqual(["transactionDetail"]);
+        expect(state.currentView).toBe("transaction");
+    });
+
+    test("Back onto the transaction confirmation restores it", () => {
+        reopenedOn("settings", ["main", "confirm-tx"], {
+            viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
+        });
+        goBack();
+        expect(calls).toEqual(["confirmTx"]);
+        expect(state.currentView).toBe("confirm-tx");
+    });
+
+    test("Back onto the success screen renders it", () => {
+        reopenedOn("settings", ["main", "success-tx"], {
+            viewData: { hash: "0xdead" },
+        });
+        goBack();
+        expect(calls).toEqual(["successTx"]);
+        expect(state.currentView).toBe("success-tx");
+    });
+
+    test("Back onto the failure screen renders it", () => {
+        reopenedOn("settings", ["main", "error-tx"], {
+            viewData: { message: "execution reverted" },
+        });
+        goBack();
+        expect(calls).toEqual(["errorTx"]);
+        expect(state.currentView).toBe("error-tx");
+    });
+
+    test("Back onto Home renders the wallet list", () => {
+        reopenedOn("settings", ["main"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("Back with an empty stack renders Home", () => {
+        reopenedOn("settings", []);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});
+
+// The guards are restoreView()'s, so a popped view whose backing data is
+// gone lands on Home rather than on an empty template.
+describe("Back onto a view whose backing data is gone", () => {
+    test("the token detail with no token selected falls back to Home", () => {
+        reopenedOn("settings", ["main", "address-token"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the transaction detail with no transaction falls back to Home", () => {
+        reopenedOn("settings", ["main", "transaction"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the confirmation with no pending transaction falls back to Home", () => {
+        reopenedOn("settings", ["main", "confirm-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("an address view with no address selected falls back to Home", () => {
+        reopenedOn("settings", ["main", "receive"], {
+            selectedAddress: null,
+        });
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the success screen with no transaction hash falls back to Home", () => {
+        reopenedOn("settings", ["main", "success-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("the failure screen with no message falls back to Home", () => {
+        reopenedOn("settings", ["main", "error-tx"]);
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+
+    test("a wait that can no longer be resumed falls back to Home", () => {
+        reopenedOn("settings", ["main", "wait-tx"]);
+        const views = makeViews();
+        views.txStatus.restoreWait = () => false;
+        setBackRenderer(makeBackRenderer(state, views));
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});
+
+// Forward navigation renders as it goes, and a second render would re-fetch
+// and clobber whatever the view holds — an unsaved edit, a request in
+// flight. So the Back path renders only a view this page load has never
+// rendered, and merely unhides every other one: the views it does not
+// render from persisted state, and the views already on the page.
+describe("what the Back path leaves alone", () => {
+    test("forward navigation renders nothing by itself", () => {
+        reopenedOn("address", ["main"]);
+        pushCurrentView();
+        showView("send");
+        expect(calls).toEqual([]);
+        expect(state.viewStack).toEqual(["main", "address"]);
+    });
+
+    test("Back onto a live-session view only unhides it", () => {
+        reopenedOn("confirm-tx", ["main", "address", "send"]);
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("send");
+    });
+
+    test("Back renders its target exactly once", () => {
+        reopenedOn("settings", ["main", "address"]);
+        goBack();
+        expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
+    });
+
+    test("Back onto a view this page load already rendered only unhides it", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.addressDetail.show();
+        pushCurrentView();
+        views.settings.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("address");
+    });
+
+    // The unit mirror of the regression the browser suite pins: Settings
+    // reassigns its fields from persisted state on every render, so a
+    // re-render on the way back discards an edit the user has not saved.
+    test("Back onto Settings visited earlier in this page load does not re-render it", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.settings.show();
+        pushCurrentView();
+        views.settingsAddToken.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual([]);
+        expect(state.currentView).toBe("settings");
+    });
+
+    // Home is the deliberate exception, unchanged from the popup's
+    // behaviour before the router existed: it re-renders on every Back so
+    // the wallet list reflects what changed while the user was away.
+    test("Back onto Home renders it again even when it is already on the page", () => {
+        const views = reopenedOn("main", []);
+        pushCurrentView();
+        views.addressDetail.show();
+        calls = [];
+        goBack();
+        expect(calls).toEqual(["main"]);
+        expect(state.currentView).toBe("main");
+    });
+});

tests/e2e/firefox/run.js

@@ -162,10 +162,12 @@ step("add token screen opens from address detail", async (env) => {
 //
 // Everything above drives the popup on its own. From here the page, the
 // content script, the inpage provider, the background page and the approval
-// window all have to work together, which on Firefox is exactly the seam
-// https://git.eeqj.de/sneak/AutistMask/issues/153 is about: every one of
-// these paths used to hand a Chrome-style callback to the promise-only
-// browser.* namespace and simply never complete.
+// window all have to work together — the paths
+// https://git.eeqj.de/sneak/AutistMask/issues/153 rewrote, and the ones no
+// Firefox test reached before. They are asserted here because nothing else
+// covers them on this browser, not because they were broken: these steps
+// pass against the pre-refactor callback code too, which is how the issue's
+// premise was refuted.
 //
 // The shape is the Chrome suite's (tests/e2e/run.js, the #183 section) and
 // the assertions mean the same things:
@@ -702,9 +704,9 @@ step(
         await d.waitVisible("#view-approve-sign");
 
         // Closed, not rejected: this is the windows.onRemoved path, which can
-        // only fire if windows.create() handed back a window id for the approval
-        // to be matched against — call site 4 in the issue, where the id used to
-        // be assigned from a callback the browser.* namespace never invoked.
+        // only fire if windows.create() handed back a window id for the
+        // approval to be matched against — call site 4 in the issue, and the
+        // reason suppressing that write-back turns this step red.
         await d.closeWindow(env.dappWindow);
 
         await assertUserRejection(d, "sign-closed", "a closed approval window");

tests/e2e/run.js

@@ -419,6 +419,172 @@ test("reopening the popup never lands on the phrase screen (#161)", async (env)
     assertWiped(st, env.phrase, "after reopening the popup");
 });
 
+// ------------------------------- Back after reopening the popup (#268)
+
+// A reopened popup renders the wallet list and the view it restores onto,
+// and nothing else: every other screen is still the blank static template
+// from index.html. Back used to only unhide its target, which is why these
+// have to run against the real popup — the template is present and
+// well-formed, so only its emptiness distinguishes the defect, and only a
+// real reopen produces it.
+
+// Everything the address screen must have on it, read out of the DOM.
+function addressScreenState(page) {
+    return page.evaluate(() => {
+        const line = document.getElementById("address-line");
+        const balances = document.getElementById("address-balances");
+        return {
+            hidden: document
+                .getElementById("view-address")
+                .classList.contains("hidden"),
+            line: line ? line.innerText.trim() : "",
+            balances: balances ? balances.innerText.trim() : "",
+        };
+    });
+}
+
+// Close and reopen the page rather than reload it: that is what the toolbar
+// popup does, and it is the only thing that produces the unrendered views.
+async function reopenPopup(env, restoredView) {
+    await env.page.close();
+    env.page = await openPopup(env.ctx, env.popupUrl);
+    await visible(env.page, restoredView);
+}
+
+// The reproduction from the issue, step for step.
+test("Back after reopening the popup renders the address screen (#268)", async (env) => {
+    await openAddressDetail(env.page);
+    const before = await addressScreenState(env.page);
+    assert(
+        before.line.length > 0,
+        "the address screen was blank to begin with",
+    );
+
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    await reopenPopup(env, "#view-settings");
+
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-address");
+
+    const after = await addressScreenState(env.page);
+    assert(
+        after.line === before.line,
+        "the address line reads " +
+            JSON.stringify(after.line) +
+            ", expected " +
+            JSON.stringify(before.line),
+    );
+    assert(
+        after.balances.includes("ETH"),
+        "the balances read " + JSON.stringify(after.balances),
+    );
+});
+
+// The same defect one screen further in. Receive holds the address twice
+// over — as text and as the QR code the sender scans — and a blank one is
+// worse than a missing screen.
+// Everything the Receive screen must have on it. The QR code is read as
+// pixels, not as an element: the blank template carries the canvas too, a
+// default 300x150 one with nothing drawn on it and every pixel fully
+// transparent. A drawn QR paints an opaque background across the whole
+// canvas, so a single opaque pixel is the whole question.
+function receiveScreenState(page) {
+    return page.evaluate(() => {
+        const block = document.getElementById("receive-address-block");
+        const canvas = document.getElementById("receive-qr");
+        const px = canvas
+            .getContext("2d")
+            .getImageData(0, 0, canvas.width, canvas.height).data;
+        let opaque = 0;
+        for (let i = 3; i < px.length; i += 4) {
+            if (px[i] > 0) opaque += 1;
+        }
+        return {
+            address: block.dataset.full || "",
+            text: block.innerText.trim(),
+            qrOpaquePixels: opaque,
+        };
+    });
+}
+
+test("Back after reopening the popup renders the Receive screen (#268)", async (env) => {
+    await openAddressDetail(env.page);
+    await env.page.click("#btn-receive");
+    await visible(env.page, "#view-receive");
+    const before = await receiveScreenState(env.page);
+    assert(
+        /^0x[0-9a-fA-F]{40}$/.test(before.address),
+        "Receive showed no address to begin with: " +
+            JSON.stringify(before.address),
+    );
+
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    await reopenPopup(env, "#view-settings");
+
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-receive");
+
+    const shown = await receiveScreenState(env.page);
+    assert(
+        shown.address === before.address,
+        "Receive shows " +
+            JSON.stringify(shown.address) +
+            ", expected " +
+            JSON.stringify(before.address),
+    );
+    assert(
+        shown.text.includes(before.address),
+        "the Receive address is not on screen: " + JSON.stringify(shown.text),
+    );
+    assert(shown.qrOpaquePixels > 0, "Receive shows an unpainted QR code");
+
+    // Leave the suite where it found it.
+    await env.page.click("#btn-receive-back");
+    await visible(env.page, "#view-address");
+    await env.page.click("#btn-address-back");
+    await visible(env.page, "#view-main");
+});
+
+// The other half of the requirement: Back renders a screen this page load
+// never rendered, and must NOT re-render one it already has on screen.
+// settings.show() reassigns #settings-rpc from persisted state, so
+// re-rendering Settings on the way back would silently revert whatever the
+// user typed and had not saved yet — and they could then press Save and
+// store the value they believed they had replaced. No reopen here: this is
+// an ordinary in-session forward-and-back, which is exactly why the render
+// must not happen.
+test("Back onto Settings keeps unsaved input (#268)", async (env) => {
+    await visible(env.page, "#view-main");
+    await env.page.click("#btn-settings");
+    await visible(env.page, "#view-settings");
+
+    const typed = "https://rpc.example.invalid/unsaved";
+    await env.page.fill("#settings-rpc", typed);
+
+    await env.page.click("#btn-settings-add-token");
+    await visible(env.page, "#view-settings-addtoken");
+    await env.page.click("#btn-settings-addtoken-back");
+    await visible(env.page, "#view-settings");
+
+    const kept = await env.page.inputValue("#settings-rpc");
+    assert(
+        kept === typed,
+        "the unsaved RPC URL reads " +
+            JSON.stringify(kept) +
+            ", expected " +
+            JSON.stringify(typed),
+    );
+
+    // Leave the suite where it found it. The typed value was never saved,
+    // and Settings reloads the field from state next time it renders.
+    await env.page.click("#btn-settings-back");
+    await visible(env.page, "#view-main");
+});
+
 // -------------------------------------------- address removal (#162)
 
 // Number of address rows across every wallet in the list, counted in the DOM